Barretenberg
The ZK-SNARK library at the core of Aztec
Loading...
Searching...
No Matches
Classes | Public Types | Public Member Functions | Static Public Member Functions | Public Attributes | Private Member Functions | Static Private Member Functions | Private Attributes | List of all members
bb::ClientIVC Class Reference

The IVC scheme used by the aztec client for private function execution. More...

#include <client_ivc.hpp>

Inheritance diagram for bb::ClientIVC:
bb::IVCBase

Classes

struct  Proof
 A full proof for the IVC scheme containing a Mega proof showing correctness of the hiding circuit (which recursive verified the last folding and decider proof) and a Goblin proof (translator VM, ECCVM and last merge proof). More...
 
struct  StdlibVerifierInputs
 
struct  VerificationKey
 
struct  VerifierInputs
 

Public Types

enum class  QUEUE_TYPE {
  OINK , PG , PG_FINAL , PG_TAIL ,
  MEGA
}
 
using Flavor = MegaFlavor
 
using MegaVerificationKey = Flavor::VerificationKey
 
using MegaZKVerificationKey = MegaZKFlavor::VerificationKey
 
using FF = Flavor::FF
 
using Point = Flavor::Curve::AffineElement
 
using FoldProof = std::vector< FF >
 
using ProverInstance = ProverInstance_< Flavor >
 
using DeciderZKProvingKey = ProverInstance_< MegaZKFlavor >
 
using VerifierInstance = VerifierInstance_< Flavor >
 
using ClientCircuit = MegaCircuitBuilder
 
using DeciderProver = DeciderProver_< Flavor >
 
using DeciderVerifier = DeciderVerifier_< Flavor >
 
using FoldingProver = ProtogalaxyProver_< Flavor >
 
using FoldingVerifier = ProtogalaxyVerifier_< VerifierInstance >
 
using ECCVMVerificationKey = bb::ECCVMFlavor::VerificationKey
 
using TranslatorVerificationKey = bb::TranslatorFlavor::VerificationKey
 
using MegaProver = UltraProver_< Flavor >
 
using MegaVerifier = UltraVerifier_< Flavor >
 
using Transcript = NativeTranscript
 
using RecursiveFlavor = MegaRecursiveFlavor_< bb::MegaCircuitBuilder >
 
using RecursiveVerifierInstance = stdlib::recursion::honk::RecursiveVerifierInstance_< RecursiveFlavor >
 
using RecursiveVerificationKey = RecursiveFlavor::VerificationKey
 
using RecursiveVKAndHash = RecursiveFlavor::VKAndHash
 
using FoldingRecursiveVerifier = bb::stdlib::recursion::honk::ProtogalaxyRecursiveVerifier_< RecursiveVerifierInstance >
 
using OinkRecursiveVerifier = bb::OinkVerifier< RecursiveFlavor >
 
using DeciderRecursiveVerifier = stdlib::recursion::honk::DeciderRecursiveVerifier_< RecursiveFlavor >
 
using RecursiveTranscript = RecursiveFlavor::Transcript
 
using DataBusDepot = stdlib::DataBusDepot< ClientCircuit >
 
using PairingPoints = stdlib::recursion::PairingPoints< ClientCircuit >
 
using PublicPairingPoints = stdlib::PublicInputComponent< PairingPoints >
 
using KernelIO = bb::stdlib::recursion::honk::KernelIO
 
using HidingKernelIO = bb::stdlib::recursion::honk::HidingKernelIO< ClientCircuit >
 
using AppIO = bb::stdlib::recursion::honk::AppIO
 
using StdlibProof = stdlib::Proof< ClientCircuit >
 
using StdlibFF = RecursiveFlavor::FF
 
using WitnessCommitments = RecursiveFlavor::WitnessCommitments
 
using TableCommitments = std::array< RecursiveFlavor::Commitment, ClientCircuit::NUM_WIRES >
 
using VerificationQueue = std::deque< VerifierInputs >
 
using StdlibVerificationQueue = std::deque< StdlibVerifierInputs >
 
- Public Types inherited from bb::IVCBase
using ClientCircuit = MegaCircuitBuilder
 
using MegaVerificationKey = MegaFlavor::VerificationKey
 

Public Member Functions

size_t get_num_circuits () const
 
Goblin & get_goblin () override
 
const Goblin & get_goblin () const override
 
 ClientIVC (size_t num_circuits, TraceSettings trace_settings={})
 
void instantiate_stdlib_verification_queue (ClientCircuit &circuit, const std::vector< std::shared_ptr< RecursiveVKAndHash > > &input_keys={})
 Instantiate a stdlib verification queue for use in the kernel completion logic.
 
std::tuple< std::shared_ptr< RecursiveVerifierInstance >, PairingPoints, TableCommitments > perform_recursive_verification_and_databus_consistency_checks (ClientCircuit &circuit, const StdlibVerifierInputs &verifier_inputs, const std::shared_ptr< RecursiveVerifierInstance > &input_verifier_accumulator, const TableCommitments &T_prev_commitments, const std::shared_ptr< RecursiveTranscript > &accumulation_recursive_transcript)
 Populate the provided circuit with constraints for (1) recursive verification of the provided accumulation proof and (2) the associated databus commitment consistency checks.
 
void complete_kernel_circuit_logic (ClientCircuit &circuit)
 Append logic to complete a kernel circuit.
 
void accumulate (ClientCircuit &circuit, const std::shared_ptr< MegaVerificationKey > &precomputed_vk) override
 Perform prover work for accumulation (e.g. PG folding, merge proving)
 
Proof prove ()
 Construct a proof for the IVC, which, if verified, fully establishes its correctness.
 
HonkProof construct_decider_proof (const std::shared_ptr< Transcript > &transcript)
 Internal method for constructing a decider proof.
 
VerificationKey get_vk () const
 
- Public Member Functions inherited from bb::IVCBase
virtual ~IVCBase ()=default
 

Static Public Member Functions

static void hide_op_queue_accumulation_result (ClientCircuit &circuit)
 Add a valid operation with random data to the op queue to prevent information leakage in Translator proof.
 
static void hide_op_queue_content_in_tail (ClientCircuit &circuit)
 Adds three random ops to the tail kernel.
 
static void hide_op_queue_content_in_hiding (ClientCircuit &circuit)
 Adds two random ops to the hiding kernel.
 
static bool verify (const Proof &proof, const VerificationKey &vk)
 

Public Attributes

ExecutionTraceUsageTracker trace_usage_tracker
 
size_t num_circuits_accumulated = 0
 
std::shared_ptr< ProverInstance > prover_accumulator
 
HonkProof decider_proof
 
std::shared_ptr< VerifierInstance > recursive_verifier_native_accum
 
std::shared_ptr< VerifierInstance > native_verifier_accum
 
VerificationQueue verification_queue
 
StdlibVerificationQueue stdlib_verification_queue
 
DataBusDepot bus_depot
 
TraceSettings trace_settings
 
MegaFlavor::CommitmentKey bn254_commitment_key
 
Goblin goblin
 

Private Member Functions

void update_native_verifier_accumulator (const VerifierInputs &queue_entry, const std::shared_ptr< Transcript > &verifier_transcript)
 Runs either Oink or PG native verifier to update the native verifier accumulator.
 
HonkProof construct_oink_proof (const std::shared_ptr< ProverInstance > &prover_instance, const std::shared_ptr< MegaVerificationKey > &honk_vk, const std::shared_ptr< Transcript > &transcript)
 
HonkProof construct_pg_proof (const std::shared_ptr< ProverInstance > &prover_instance, const std::shared_ptr< MegaVerificationKey > &honk_vk, const std::shared_ptr< Transcript > &transcript, bool is_kernel)
 
HonkProof construct_honk_proof_for_hiding_kernel (ClientCircuit &circuit, const std::shared_ptr< MegaVerificationKey > &verification_key)
 Construct a zero-knowledge proof for the hiding circuit, which recursively verifies the last folding, merge and decider proof.
 
QUEUE_TYPE get_queue_type () const
 Get queue type for the proof of a circuit about to be accumulated based on num circuits accumulated so far.
 

Static Private Member Functions

static std::shared_ptr< RecursiveVerifierInstance > perform_oink_recursive_verification (ClientCircuit &circuit, const std::shared_ptr< RecursiveVerifierInstance > &verifier_instance, const std::shared_ptr< RecursiveTranscript > &transcript, const StdlibProof &proof)
 
static std::shared_ptr< RecursiveVerifierInstance > perform_pg_recursive_verification (ClientCircuit &circuit, const std::shared_ptr< RecursiveVerifierInstance > &verifier_accumulator, const std::shared_ptr< RecursiveVerifierInstance > &verifier_instance, const std::shared_ptr< RecursiveTranscript > &transcript, const StdlibProof &proof, std::optional< StdlibFF > &prev_accum_hash, bool is_kernel)
 

Private Attributes

std::shared_ptr< Transcript > transcript = std::make_shared<Transcript>()
 
std::shared_ptr< Transcript > prover_accumulation_transcript = std::make_shared<Transcript>()
 
size_t num_circuits
 

Additional Inherited Members

- Protected Member Functions inherited from bb::IVCBase
 IVCBase ()=default
 

Detailed Description

The IVC scheme used by the aztec client for private function execution.

Combines Protogalaxy with Goblin to accumulate one circuit at a time with efficient EC group operations. It is assumed that the circuits being accumulated correspond alternatingly to an app and a kernel, as is the case in Aztec. Two recursive folding verifiers are appended to each kernel (except the first one) to verify the folding of a previous kernel and an app/function circuit. Due to this structure it is enforced that the total number of circuits being accumulated is even.

Definition at line 39 of file client_ivc.hpp.

Member Typedef Documentation

◆ AppIO

using bb::ClientIVC::AppIO = bb::stdlib::recursion::honk::AppIO

Definition at line 77 of file client_ivc.hpp.

◆ ClientCircuit

using bb::ClientIVC::ClientCircuit = MegaCircuitBuilder

Definition at line 51 of file client_ivc.hpp.

◆ DataBusDepot

using bb::ClientIVC::DataBusDepot = stdlib::DataBusDepot<ClientCircuit>

Definition at line 72 of file client_ivc.hpp.

◆ DeciderProver

using bb::ClientIVC::DeciderProver = DeciderProver_<Flavor>

Definition at line 52 of file client_ivc.hpp.

◆ DeciderRecursiveVerifier

using bb::ClientIVC::DeciderRecursiveVerifier = stdlib::recursion::honk::DeciderRecursiveVerifier_<RecursiveFlavor>

Definition at line 69 of file client_ivc.hpp.

◆ DeciderVerifier

using bb::ClientIVC::DeciderVerifier = DeciderVerifier_<Flavor>

Definition at line 53 of file client_ivc.hpp.

◆ DeciderZKProvingKey

using bb::ClientIVC::DeciderZKProvingKey = ProverInstance_<MegaZKFlavor>

Definition at line 49 of file client_ivc.hpp.

◆ ECCVMVerificationKey

using bb::ClientIVC::ECCVMVerificationKey = bb::ECCVMFlavor::VerificationKey

Definition at line 56 of file client_ivc.hpp.

◆ FF

using bb::ClientIVC::FF = Flavor::FF

Definition at line 45 of file client_ivc.hpp.

◆ Flavor

using bb::ClientIVC::Flavor = MegaFlavor

Definition at line 42 of file client_ivc.hpp.

◆ FoldingProver

using bb::ClientIVC::FoldingProver = ProtogalaxyProver_<Flavor>

Definition at line 54 of file client_ivc.hpp.

◆ FoldingRecursiveVerifier

using bb::ClientIVC::FoldingRecursiveVerifier = bb::stdlib::recursion::honk::ProtogalaxyRecursiveVerifier_<RecursiveVerifierInstance>

Definition at line 66 of file client_ivc.hpp.

◆ FoldingVerifier

using bb::ClientIVC::FoldingVerifier = ProtogalaxyVerifier_<VerifierInstance>

Definition at line 55 of file client_ivc.hpp.

◆ FoldProof

using bb::ClientIVC::FoldProof = std::vector<FF>

Definition at line 47 of file client_ivc.hpp.

◆ HidingKernelIO

using bb::ClientIVC::HidingKernelIO = bb::stdlib::recursion::honk::HidingKernelIO<ClientCircuit>

Definition at line 76 of file client_ivc.hpp.

◆ KernelIO

using bb::ClientIVC::KernelIO = bb::stdlib::recursion::honk::KernelIO

Definition at line 75 of file client_ivc.hpp.

◆ MegaProver

using bb::ClientIVC::MegaProver = UltraProver_<Flavor>

Definition at line 58 of file client_ivc.hpp.

◆ MegaVerificationKey

using bb::ClientIVC::MegaVerificationKey = Flavor::VerificationKey

Definition at line 43 of file client_ivc.hpp.

◆ MegaVerifier

using bb::ClientIVC::MegaVerifier = UltraVerifier_<Flavor>

Definition at line 59 of file client_ivc.hpp.

◆ MegaZKVerificationKey

using bb::ClientIVC::MegaZKVerificationKey = MegaZKFlavor::VerificationKey

Definition at line 44 of file client_ivc.hpp.

◆ OinkRecursiveVerifier

using bb::ClientIVC::OinkRecursiveVerifier = bb::OinkVerifier<RecursiveFlavor>

Definition at line 68 of file client_ivc.hpp.

◆ PairingPoints

using bb::ClientIVC::PairingPoints = stdlib::recursion::PairingPoints<ClientCircuit>

Definition at line 73 of file client_ivc.hpp.

◆ Point

using bb::ClientIVC::Point = Flavor::Curve::AffineElement

Definition at line 46 of file client_ivc.hpp.

◆ ProverInstance

using bb::ClientIVC::ProverInstance = ProverInstance_<Flavor>

Definition at line 48 of file client_ivc.hpp.

◆ PublicPairingPoints

using bb::ClientIVC::PublicPairingPoints = stdlib::PublicInputComponent<PairingPoints>

Definition at line 74 of file client_ivc.hpp.

◆ RecursiveFlavor

using bb::ClientIVC::RecursiveFlavor = MegaRecursiveFlavor_<bb::MegaCircuitBuilder>

Definition at line 62 of file client_ivc.hpp.

◆ RecursiveTranscript

using bb::ClientIVC::RecursiveTranscript = RecursiveFlavor::Transcript

Definition at line 70 of file client_ivc.hpp.

◆ RecursiveVerificationKey

using bb::ClientIVC::RecursiveVerificationKey = RecursiveFlavor::VerificationKey

Definition at line 64 of file client_ivc.hpp.

◆ RecursiveVerifierInstance

using bb::ClientIVC::RecursiveVerifierInstance = stdlib::recursion::honk::RecursiveVerifierInstance_<RecursiveFlavor>

Definition at line 63 of file client_ivc.hpp.

◆ RecursiveVKAndHash

using bb::ClientIVC::RecursiveVKAndHash = RecursiveFlavor::VKAndHash

Definition at line 65 of file client_ivc.hpp.

◆ StdlibFF

using bb::ClientIVC::StdlibFF = RecursiveFlavor::FF

Definition at line 79 of file client_ivc.hpp.

◆ StdlibProof

using bb::ClientIVC::StdlibProof = stdlib::Proof<ClientCircuit>

Definition at line 78 of file client_ivc.hpp.

◆ StdlibVerificationQueue

using bb::ClientIVC::StdlibVerificationQueue = std::deque<StdlibVerifierInputs>

Definition at line 250 of file client_ivc.hpp.

◆ TableCommitments

using bb::ClientIVC::TableCommitments = std::array<RecursiveFlavor::Commitment, ClientCircuit::NUM_WIRES>

Definition at line 83 of file client_ivc.hpp.

◆ Transcript

using bb::ClientIVC::Transcript = NativeTranscript

Definition at line 60 of file client_ivc.hpp.

◆ TranslatorVerificationKey

using bb::ClientIVC::TranslatorVerificationKey = bb::TranslatorFlavor::VerificationKey

Definition at line 57 of file client_ivc.hpp.

◆ VerificationQueue

using bb::ClientIVC::VerificationQueue = std::deque<VerifierInputs>

Definition at line 241 of file client_ivc.hpp.

◆ VerifierInstance

using bb::ClientIVC::VerifierInstance = VerifierInstance_<Flavor>

Definition at line 50 of file client_ivc.hpp.

◆ WitnessCommitments

using bb::ClientIVC::WitnessCommitments = RecursiveFlavor::WitnessCommitments

Definition at line 80 of file client_ivc.hpp.

Member Enumeration Documentation

◆ QUEUE_TYPE

enum class bb::ClientIVC::QUEUE_TYPE
strong
Enumerator
OINK 
PG 
PG_FINAL 
PG_TAIL 
MEGA 

Definition at line 226 of file client_ivc.hpp.

Constructor & Destructor Documentation

◆ ClientIVC()

bb::ClientIVC::ClientIVC ( size_t  num_circuits,
TraceSettings  trace_settings = {} 
)

Definition at line 19 of file client_ivc.cpp.

Member Function Documentation

◆ accumulate()

void bb::ClientIVC::accumulate ( ClientCircuit &  circuit,
const std::shared_ptr< MegaVerificationKey > &  precomputed_vk 
)
overridevirtual

Perform prover work for accumulation (e.g. PG folding, merge proving)

Execute prover work for accumulation.

Parameters
circuitThe incoming statement
precomputed_vkThe verification key of the incoming statement OR a mocked key whose metadata needs to be set using the proving key produced from circuit in order to pass some assertions in the Oink prover.
mock_vkA boolean to say whether the precomputed vk should have its metadata set.

Construct an prover instance for the provided circuit. If this is the first step in the IVC, simply initialize the folding accumulator. Otherwise, execute the PG prover to fold the prover instance into the accumulator and produce a folding proof. Also execute the merge protocol to produce a merge proof.

Parameters
circuitthis case, just produce a Honk proof for that circuit and do no folding.
precomputed_vk

Implements bb::IVCBase.

Definition at line 445 of file client_ivc.cpp.

◆ complete_kernel_circuit_logic()

void bb::ClientIVC::complete_kernel_circuit_logic ( ClientCircuit &  circuit)

Append logic to complete a kernel circuit.

A kernel circuit may contain some combination of PG recursive verification, merge recursive verification, and databus commitment consistency checks. This method appends this logic to a provided kernel circuit.

Parameters
circuit

Definition at line 275 of file client_ivc.cpp.

◆ construct_decider_proof()

HonkProof bb::ClientIVC::construct_decider_proof ( const std::shared_ptr< Transcript > &  transcript)

Internal method for constructing a decider proof.

Returns
HonkProof

Definition at line 664 of file client_ivc.cpp.

◆ construct_honk_proof_for_hiding_kernel()

HonkProof bb::ClientIVC::construct_honk_proof_for_hiding_kernel ( ClientCircuit &  circuit,
const std::shared_ptr< MegaVerificationKey > &  verification_key 
)
private

Construct a zero-knowledge proof for the hiding circuit, which recursively verifies the last folding, merge and decider proof.

Definition at line 602 of file client_ivc.cpp.

◆ construct_oink_proof()

HonkProof bb::ClientIVC::construct_oink_proof ( const std::shared_ptr< ProverInstance > &  prover_instance,
const std::shared_ptr< MegaVerificationKey > &  honk_vk,
const std::shared_ptr< Transcript > &  transcript 
)
private

Definition at line 362 of file client_ivc.cpp.

◆ construct_pg_proof()

HonkProof bb::ClientIVC::construct_pg_proof ( const std::shared_ptr< ProverInstance > &  prover_instance,
const std::shared_ptr< MegaVerificationKey > &  honk_vk,
const std::shared_ptr< Transcript > &  transcript,
bool  is_kernel 
)
private

Definition at line 382 of file client_ivc.cpp.

◆ get_goblin() [1/2]

const Goblin & bb::ClientIVC::get_goblin ( ) const
inlineoverridevirtual

Implements bb::IVCBase.

Definition at line 292 of file client_ivc.hpp.

◆ get_goblin() [2/2]

Goblin & bb::ClientIVC::get_goblin ( )
inlineoverridevirtual

Implements bb::IVCBase.

Definition at line 291 of file client_ivc.hpp.

◆ get_num_circuits()

size_t bb::ClientIVC::get_num_circuits ( ) const
inline

Definition at line 288 of file client_ivc.hpp.

◆ get_queue_type()

ClientIVC::QUEUE_TYPE bb::ClientIVC::get_queue_type ( ) const
private

Get queue type for the proof of a circuit about to be accumulated based on num circuits accumulated so far.

Definition at line 410 of file client_ivc.cpp.

◆ get_vk()

ClientIVC::VerificationKey bb::ClientIVC::get_vk ( ) const

Definition at line 795 of file client_ivc.cpp.

◆ hide_op_queue_accumulation_result()

void bb::ClientIVC::hide_op_queue_accumulation_result ( ClientCircuit &  circuit)
static

Add a valid operation with random data to the op queue to prevent information leakage in Translator proof.

The Translator circuit builder evaluates a batched polynomial (representing the four op queue polynomials in UltraOp format) at a random challenge x. This evaluation result (called accumulated_result in translator) is included in the translator proof and verified against the equivalent computation performed by ECCVM (in verify_translation, establishing equivalence between ECCVM and UltraOp format). To ensure the accumulated_result doesn't reveal information about actual ecc operations in the transaction, when the proof is sent to the rollup, we add a random yet valid operation to the op queue. This guarantees the batched polynomial over Grumpkin contains at least one random coefficient.

Definition at line 525 of file client_ivc.cpp.

◆ hide_op_queue_content_in_hiding()

void bb::ClientIVC::hide_op_queue_content_in_hiding ( ClientCircuit &  circuit)
static

Adds two random ops to the hiding kernel.

For the last subtable of ecc ops belonging to the hiding kernel, merged via appended to the full op queue, its data appears as the ecc_op_wires in the MegaZK proof, wires that are not going to be shifted, so the proof containts, for each wire, its commitment and evaluation to the Sumcheck challenge. As at least 3 random coefficients are needed in each op queue polynomial, we add 2 random ops. More details in hide_op_queue_content_in_tail.

Definition at line 592 of file client_ivc.cpp.

◆ hide_op_queue_content_in_tail()

void bb::ClientIVC::hide_op_queue_content_in_tail ( ClientCircuit &  circuit)
static

Adds three random ops to the tail kernel.

Note
The explanation below does not serve as a proof of zero-knowledge but rather as intuition for why the number of random ops and their position in the op queue.

The ClientIVC proof is sent to the rollup and so it has to be zero-knowledge. In turn, this implies that commitments and evaluations to the op queue, when regarded as 4 polynomials in UltraOp format (op, x_lo_y_hi, x_hi_z_1, y_lo_z_2), should not leak information about the actual content of the op queue with provenance from circuit operations that have been accumulated in CIVC. Since the op queue is used across several provers, randomising these polynomials has to be handled in a special way. Normally, to hide a witness we'd add random coefficients at proving time when populating ProverPolynomials. However, due to the consistency checks present throughout CIVC, to ensure all components use the same op queue data (Merge and Translator on the entire op queue table and Merge and Oink on each subtable), randomness has to be added in a common place, this place naturally being ClientIVC. ECCVM is not affected by the concerns above, randomness being added to wires at proving time as per usual, because the consistency of ECCVMOps processing and UltraOps processing between Translator and ECCVM is achieved via the translation evaluation check and avoiding an information leak there is ensured by ClientIVC::hide_op_queue_accumulation_result() and SmallSubgroupIPA in ECCVM.

We need each op queue polynomial to have 9 random coefficients (so the op queue needs to contain 5 random ops, every UltraOp adding two coefficients to each of the 4 polynomials).

For the last subtable of ecc ops belonging to the hiding kernel, merged via appended to the full op queue, its data appears as the ecc_op_wires in the MegaZK proof, wires that are not going to be shifted, so the proof contains, for each wire, its commitment and evaluation to the Sumcheck challenge. As at least 3 random coefficients are needed in each op queue polynomial, we add 2 random ops to the hiding kernel.

The op queue state previous to the append of the last subtable, is the left_table in the merge protocol, so for the degree check, we construct its inverse polynomial left_table_inverse. The MergeProof will contain the commitment to the left_table_inverse plus its evaluation at Merge protocol challenge κ. Also for the degree check, prover needs to send the evaluation of the left_table at κ⁻¹. We need to ensure random coefficients are added to one of the kernels as not to affect Apps verification keys so the best choice is to add them to the beginning of the tail kernel as to not complicate Translator relations. The above advises that another 4 random coefficients are needed in the left_table (so, 2 random ops).

Finally, the 4 polynomials representing the full ecc op queue table are committed to (in fact, in both Merge protocol and Translator but they are commitments to the same data). x_lo_y_hi, x_hi_z_1 and x_lo_z_2 are shifted polynomials in Translator so the Translator proof will contain their evaluation and evaluation of their shifts at the Sumcheck challenge. On top of that, the Shplonk proof sent in the last iteration of Merge also ascertains the opening of partially_evaluated_difference = left_table + κ^{shift -1 } * right_table - merged_table at κ is 0, so a batched quotient commitment is sent in the Merge proof. In total, for each op queue polynomial (or parts of its data), there are 4 commitments and 5 evaluations across the CIVC proof so the sweet spot is 5 random ops.

Definition at line 577 of file client_ivc.cpp.

◆ instantiate_stdlib_verification_queue()

void bb::ClientIVC::instantiate_stdlib_verification_queue ( ClientCircuit &  circuit,
const std::vector< std::shared_ptr< RecursiveVKAndHash > > &  input_keys = {} 
)

Instantiate a stdlib verification queue for use in the kernel completion logic.

Construct a stdlib proof/verification_key for each entry in the native verification queue. By default, both are constructed from their counterpart in the native queue. Alternatively, Stdlib verification keys can be provided directly as input to this method. (The later option is used, for example, when constructing recursive verifiers based on the verification key witnesses from an acir recursion constraint. This option is not provided for proofs since valid proof witnesses are in general not known at the time of acir constraint generation).

Parameters
circuit

Definition at line 44 of file client_ivc.cpp.

◆ perform_oink_recursive_verification()

std::shared_ptr< ClientIVC::RecursiveVerifierInstance > bb::ClientIVC::perform_oink_recursive_verification ( ClientCircuit &  circuit,
const std::shared_ptr< RecursiveVerifierInstance > &  verifier_instance,
const std::shared_ptr< RecursiveTranscript > &  transcript,
const StdlibProof &  proof 
)
staticprivate

Definition at line 76 of file client_ivc.cpp.

◆ perform_pg_recursive_verification()

std::shared_ptr< ClientIVC::RecursiveVerifierInstance > bb::ClientIVC::perform_pg_recursive_verification ( ClientCircuit &  circuit,
const std::shared_ptr< RecursiveVerifierInstance > &  verifier_accumulator,
const std::shared_ptr< RecursiveVerifierInstance > &  verifier_instance,
const std::shared_ptr< RecursiveTranscript > &  transcript,
const StdlibProof &  proof,
std::optional< StdlibFF > &  prev_accum_hash,
bool  is_kernel 
)
staticprivate

Definition at line 94 of file client_ivc.cpp.

◆ perform_recursive_verification_and_databus_consistency_checks()

std::tuple< std::shared_ptr< ClientIVC::RecursiveVerifierInstance >, ClientIVC::PairingPoints, ClientIVC::TableCommitments > bb::ClientIVC::perform_recursive_verification_and_databus_consistency_checks ( ClientCircuit &  circuit,
const StdlibVerifierInputs &  verifier_inputs,
const std::shared_ptr< RecursiveVerifierInstance > &  input_verifier_accumulator,
const TableCommitments &  T_prev_commitments,
const std::shared_ptr< RecursiveTranscript > &  accumulation_recursive_transcript 
)

Populate the provided circuit with constraints for (1) recursive verification of the provided accumulation proof and (2) the associated databus commitment consistency checks.

The recursive verifier will be either Oink or Protogalaxy depending on the specified proof type. In either case, the verifier accumulator is updated in place via the verification algorithm. Databus commitment consistency checks are performed on the witness commitments and public inputs extracted from the proof by the verifier. Merge verification is performed with commitments to the subtable t_j extracted from the PG verifier. The computed commitment T is propagated to the next step of recursive verification.

Parameters
circuit
verifier_inputs{proof, vkey, type (Oink/PG)} A set of inputs for recursive verification
merge_commitmentsContainer for the commitments for the Merge recursive verification to be performed
accumulation_recursive_transcriptTranscript shared across recursive verification of the folding of K_{i-1} (kernel), A_{i,1} (app), .., A_{i, n} (app)
Returns
Triple of output verifier accumulator, PairingPoints for final verification and commitments to the merged tables as read from the proof by the Merge verifier

Definition at line 138 of file client_ivc.cpp.

◆ prove()

ClientIVC::Proof bb::ClientIVC::prove ( )

Construct a proof for the IVC, which, if verified, fully establishes its correctness.

Returns
Proof

Definition at line 620 of file client_ivc.cpp.

◆ update_native_verifier_accumulator()

void bb::ClientIVC::update_native_verifier_accumulator ( const VerifierInputs &  queue_entry,
const std::shared_ptr< Transcript > &  verifier_transcript 
)
private

Runs either Oink or PG native verifier to update the native verifier accumulator.

Parameters
queue_entryThe verifier inputs from the queue.
verifier_transcriptVerifier transcript corresponding to the prover transcript.

Definition at line 805 of file client_ivc.cpp.

◆ verify()

bool bb::ClientIVC::verify ( const Proof &  proof,
const VerificationKey &  vk 
)
static

Definition at line 638 of file client_ivc.cpp.

Member Data Documentation

◆ bn254_commitment_key

MegaFlavor::CommitmentKey bb::ClientIVC::bn254_commitment_key

Definition at line 284 of file client_ivc.hpp.

◆ bus_depot

DataBusDepot bb::ClientIVC::bus_depot

Definition at line 279 of file client_ivc.hpp.

◆ decider_proof

HonkProof bb::ClientIVC::decider_proof

Definition at line 267 of file client_ivc.hpp.

◆ goblin

Goblin bb::ClientIVC::goblin

Definition at line 286 of file client_ivc.hpp.

◆ native_verifier_accum

std::shared_ptr<VerifierInstance> bb::ClientIVC::native_verifier_accum

Definition at line 271 of file client_ivc.hpp.

◆ num_circuits

size_t bb::ClientIVC::num_circuits
private

Definition at line 262 of file client_ivc.hpp.

◆ num_circuits_accumulated

size_t bb::ClientIVC::num_circuits_accumulated = 0

Definition at line 264 of file client_ivc.hpp.

◆ prover_accumulation_transcript

std::shared_ptr<Transcript> bb::ClientIVC::prover_accumulation_transcript = std::make_shared<Transcript>()
private

Definition at line 260 of file client_ivc.hpp.

◆ prover_accumulator

std::shared_ptr<ProverInstance> bb::ClientIVC::prover_accumulator

Definition at line 266 of file client_ivc.hpp.

◆ recursive_verifier_native_accum

std::shared_ptr<VerifierInstance> bb::ClientIVC::recursive_verifier_native_accum

Definition at line 270 of file client_ivc.hpp.

◆ stdlib_verification_queue

StdlibVerificationQueue bb::ClientIVC::stdlib_verification_queue

Definition at line 276 of file client_ivc.hpp.

◆ trace_settings

TraceSettings bb::ClientIVC::trace_settings

Definition at line 282 of file client_ivc.hpp.

◆ trace_usage_tracker

ExecutionTraceUsageTracker bb::ClientIVC::trace_usage_tracker

Definition at line 253 of file client_ivc.hpp.

◆ transcript

std::shared_ptr<Transcript> bb::ClientIVC::transcript = std::make_shared<Transcript>()
private

Definition at line 257 of file client_ivc.hpp.

◆ verification_queue

VerificationQueue bb::ClientIVC::verification_queue

Definition at line 274 of file client_ivc.hpp.

The documentation for this class was generated from the following files: