Merge branch 'main' into gr@add-more-tests

.github/workflows/ci.yml

@@ -8,6 +8,36 @@ on:
       - main
 
 jobs:
+
+  fmt:
+    name: Rustfmt
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions-rs/toolchain@v1
+        with:
+          override: false
+      - run: rustup component add rustfmt
+      - uses: actions-rs/cargo@v1
+        with:
+          command: fmt
+          args: --all -- --check
+
+  typos-check:
+    needs: [skip_check]
+    if: |
+      github.event.pull_request.draft == false &&
+      (github.event.action == 'ready_for_review' || needs.skip_check.outputs.should_skip != 'true')
+    name: TyposCheck
+    timeout-minutes: 5
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: crate-ci/[email protected]
+        with:
+          config: ./typos.toml
+          isolated: true
   test:
     name: Test on ${{ matrix.os }} with ${{ matrix.feature_set }} features
     runs-on: ${{ matrix.os }}
@@ -101,18 +131,4 @@ jobs:
           command: doc
           args: --all --document-private-items
 
-  fmt:
-    name: Rustfmt
-    timeout-minutes: 30
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions-rs/toolchain@v1
-        with:
-          override: false
-      - run: rustup component add rustfmt
-      - uses: actions-rs/cargo@v1
-        with:
-          command: fmt
-          args: --all -- --check
 

README.md

@@ -6,7 +6,7 @@ This repository contains the [halo2](https://github.com/zcash/halo2) fork from
 PSE and includes contributions from the community.
 
 We use the `main` branch for development, which means it may contain
-unstable/unfinished features.  For end-users we recomend using the tag releases
+unstable/unfinished features.  For end-users we recommend using the tag releases
 which can be seen as curated checkpoints with some level of guarantee of
 stability.
 

book/src/user/experimental-features.md

@@ -24,11 +24,11 @@ When using `create_proof` and `verify_proof`, we need to specify the commitment
 create_proof<IPACommitmentScheme<_>, ProverIPA<_>, _, _, _, _>
 verify_proof<IPACommitmentScheme<_>, ProverIPA<_>, _, _, _>
 
-// Using KZG with GWC19 mutli-open strategy
+// Using KZG with GWC19 multi-open strategy
 create_proof<KZGCommitmentScheme<_>, ProverGWC<_>, _, _, _, _>
 verify_proof<KZGCommitmentScheme<_>, ProverGWC<_>, _, _, _>
 
-// Using KZG with BDFG20 mutli-open strategy
+// Using KZG with BDFG20 multi-open strategy
 create_proof<KZGCommitmentScheme<_>, ProverSHPLONK<_>, _, _, _, _>
 verify_proof<KZGCommitmentScheme<_>, ProverSHPLONK<_>, _, _, _>
 ```

halo2/Cargo.toml

@@ -19,7 +19,7 @@ all-features = true
 rustdoc-args = ["--cfg", "docsrs", "--html-in-header", "katex-header.html"]
 
 [dependencies]
-halo2_proofs = { version = "0.3", path = "../halo2_proofs", default-features = false }
+halo2_proofs = { version = "0.4", path = "../halo2_proofs", default-features = false }
 
 [lib]
 bench = false

halo2_backend/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "halo2_backend"
-version = "0.3.0"
+version = "0.4.0"
 authors = [
     "Sean Bowe <[email protected]>",
     "Ying Tong Lai <[email protected]>",
@@ -28,7 +28,7 @@ rustdoc-args = ["--cfg", "docsrs", "--html-in-header", "katex-header.html"]
 backtrace = { version = "0.3", optional = true }
 ff = "0.13"
 group = "0.13"
-halo2curves = { version = "0.6.1", default-features = false }
+halo2curves = { version = "0.7.0", default-features = false }
 rand_core = { version = "0.6", default-features = false }
 tracing = "0.1"
 blake2b_simd = "1" # MSRV 1.66.0

halo2_backend/src/plonk.rs

@@ -117,7 +117,7 @@ where
             return Err(io::Error::new(
                 io::ErrorKind::InvalidData,
                 format!(
-                    "circuit size value (k): {} exceeds maxium: {}",
+                    "circuit size value (k): {} exceeds maximum: {}",
                     k,
                     C::Scalar::S
                 ),

halo2_backend/src/plonk/evaluation.rs

@@ -174,11 +174,11 @@ impl Calculation {
 /// Evaluator
 #[derive(Clone, Default, Debug)]
 pub(crate) struct Evaluator<C: CurveAffine> {
-    ///  Custom gates evalution
+    ///  Custom gates evaluation
     custom_gates: GraphEvaluator<C>,
-    ///  Lookups evalution
+    ///  Lookups evaluation
     lookups: Vec<GraphEvaluator<C>>,
-    ///  Shuffle evalution
+    ///  Shuffle evaluation
     shuffles: Vec<GraphEvaluator<C>>,
 }
 

halo2_backend/src/plonk/keygen.rs

@@ -107,7 +107,6 @@ where
     }
 
     // Compute fixeds
-
     let fixed_polys: Vec<_> = circuit
         .preprocessing
         .fixed
@@ -131,13 +130,7 @@ where
         .map(Polynomial::new_lagrange_from_vec)
         .collect();
 
-    // Compute l_0(X)
-    // TODO: this can be done more efficiently
-    // https://github.com/privacy-scaling-explorations/halo2/issues/269
-    let mut l0 = vk.domain.empty_lagrange();
-    l0[0] = C::Scalar::ONE;
-    let l0 = vk.domain.lagrange_to_coeff(l0);
-    let l0 = vk.domain.coeff_to_extended(l0);
+    let l0 = vk.domain.lagrange_extended(0usize);
 
     // Compute l_blind(X) which evaluates to 1 for each blinding factor row
     // and 0 otherwise over the domain.
@@ -150,10 +143,8 @@ where
 
     // Compute l_last(X) which evaluates to 1 on the first inactive row (just
     // before the blinding factors) and 0 otherwise over the domain
-    let mut l_last = vk.domain.empty_lagrange();
-    l_last[params.n() as usize - vk.cs.blinding_factors() - 1] = C::Scalar::ONE;
-    let l_last = vk.domain.lagrange_to_coeff(l_last);
-    let l_last = vk.domain.coeff_to_extended(l_last);
+    let idx = params.n() as usize - vk.cs.blinding_factors() - 1;
+    let l_last = vk.domain.lagrange_extended(idx);
 
     // Compute l_active_row(X)
     let one = C::Scalar::ONE;

halo2_backend/src/plonk/prover.rs

@@ -489,10 +489,10 @@ impl<
 
     /// Finalizes the proof creation.
     /// The following steps are performed:
-    /// - 1. Generate commited lookup polys
-    /// - 2. Generate commited permutation polys
-    /// - 3. Generate commited lookup polys
-    /// - 4. Generate commited shuffle polys
+    /// - 1. Generate committed lookup polys
+    /// - 2. Generate committed permutation polys
+    /// - 3. Generate committed lookup polys
+    /// - 4. Generate committed shuffle polys
     /// - 5. Commit to the vanishing argument's random polynomial
     /// - 6. Generate the advice polys
     /// - 7. Evaluate the h(X) polynomial
@@ -523,7 +523,7 @@ impl<
             .map(|index| challenges.remove(&index).unwrap())
             .collect::<Vec<_>>();
 
-        // 1. Generate commited ( added to transcript ) lookup polys  ---------------------------------------
+        // 1. Generate committed ( added to transcript ) lookup polys  ---------------------------------------
 
         // Sample theta challenge for keeping lookup columns linearly independent
         // [TRANSCRIPT-5]
@@ -574,9 +574,9 @@ impl<
         // [TRANSCRIPT-8]
         let gamma: ChallengeGamma<_> = self.transcript.squeeze_challenge_scalar();
 
-        // 2. Generate commited permutation polys  -----------------------------------------
+        // 2. Generate committed permutation polys  -----------------------------------------
         // [TRANSCRIPT-9]
-        let permutations_commited: Vec<permutation::prover::Committed<Scheme::Curve>> = instances
+        let permutations_committed: Vec<permutation::prover::Committed<Scheme::Curve>> = instances
             .iter()
             .zip(advices.iter())
             .map(|(instance, advice)| {
@@ -597,34 +597,35 @@ impl<
             })
             .collect::<Result<Vec<_>, _>>()?;
 
-        // 3. Generate commited lookup polys ----------------------------------------------------------
+        // 3. Generate committed lookup polys ----------------------------------------------------------
 
         // [TRANSCRIPT-10]
-        let lookups_commited: Vec<Vec<lookup::prover::Committed<Scheme::Curve>>> = permuted_lookups
-            .into_iter()
-            .map(|lookups| -> Result<Vec<_>, _> {
-                // Construct and commit to products for each lookup
-                lookups
-                    .into_iter()
-                    .map(|lookup| {
-                        lookup.commit_product(
-                            &self.engine,
-                            pk,
-                            params,
-                            beta,
-                            gamma,
-                            &mut rng,
-                            self.transcript,
-                        )
-                    })
-                    .collect::<Result<Vec<_>, _>>()
-            })
-            .collect::<Result<Vec<_>, _>>()?;
+        let lookups_committed: Vec<Vec<lookup::prover::Committed<Scheme::Curve>>> =
+            permuted_lookups
+                .into_iter()
+                .map(|lookups| -> Result<Vec<_>, _> {
+                    // Construct and commit to products for each lookup
+                    lookups
+                        .into_iter()
+                        .map(|lookup| {
+                            lookup.commit_product(
+                                &self.engine,
+                                pk,
+                                params,
+                                beta,
+                                gamma,
+                                &mut rng,
+                                self.transcript,
+                            )
+                        })
+                        .collect::<Result<Vec<_>, _>>()
+                })
+                .collect::<Result<Vec<_>, _>>()?;
 
-        // 4. Generate commited shuffle polys  -------------------------------------------------------
+        // 4. Generate committed shuffle polys  -------------------------------------------------------
 
         // [TRANSCRIPT-11]
-        let shuffles_commited: Vec<Vec<shuffle::prover::Committed<Scheme::Curve>>> = instances
+        let shuffles_committed: Vec<Vec<shuffle::prover::Committed<Scheme::Curve>>> = instances
             .iter()
             .zip(advices.iter())
             .map(|(instance, advice)| -> Result<Vec<_>, _> {
@@ -703,9 +704,9 @@ impl<
             *beta,
             *gamma,
             *theta,
-            &lookups_commited,
-            &shuffles_commited,
-            &permutations_commited,
+            &lookups_committed,
+            &shuffles_committed,
+            &permutations_committed,
         );
 
         // 8. Construct the vanishing argument's h(X) commitments --------------------------------------
@@ -796,15 +797,15 @@ impl<
         // Evaluate the permutations, if any, at omega^i x.
         // [TRANSCRIPT-21]
         let permutations_evaluated: Vec<permutation::prover::Evaluated<Scheme::Curve>> =
-            permutations_commited
+            permutations_committed
                 .into_iter()
                 .map(|permutation| -> Result<_, _> { permutation.evaluate(pk, x, self.transcript) })
                 .collect::<Result<Vec<_>, _>>()?;
 
         // Evaluate the lookups, if any, at omega^i x.
         // [TRANSCRIPT-22]
         let lookups_evaluated: Vec<Vec<lookup::prover::Evaluated<Scheme::Curve>>> =
-            lookups_commited
+            lookups_committed
                 .into_iter()
                 .map(|lookups| -> Result<Vec<_>, _> {
                     lookups
@@ -817,7 +818,7 @@ impl<
         // Evaluate the shuffles, if any, at omega^i x.
         // [TRANSCRIPT-23]
         let shuffles_evaluated: Vec<Vec<shuffle::prover::Evaluated<Scheme::Curve>>> =
-            shuffles_commited
+            shuffles_committed
                 .into_iter()
                 .map(|shuffles| -> Result<Vec<_>, _> {
                     shuffles

halo2_backend/src/poly/domain.rs

@@ -243,6 +243,67 @@ impl<F: WithSmallOrderMulGroup<3>> EvaluationDomain<F> {
         }
     }
 
+    // Compute L_i(X) in the extended co-domain, where
+    // L_i(X)is the ith Lagrange polynomial in the original domain,
+    // H = {1, g, g^2, ..., g^(n-1)}.
+    // We compute its represenation in the extended co-domain
+    // zH = {z, z*w, z*w^2, ... , z*w^(n*k - 1)}, where k is the extension factor
+    // of the domain, and z is the extended root such that w^k = g.
+    // We assume z = F::ZETA, a cubic root the field. This simplifies the computation.
+    //
+    // The computation uses the fomula:
+    // L_i(X) = g^i/n * (X^n -1)/(X-g^i)
+    pub fn lagrange_extended(&self, idx: usize) -> Polynomial<F, ExtendedLagrangeCoeff> {
+        let one = F::ONE;
+        let zeta = <F as WithSmallOrderMulGroup<3>>::ZETA;
+
+        let n: u64 = 1 << self.k();
+        let g_i = self.omega.pow_vartime([idx as u64]);
+        let mut lag_poly = vec![F::ZERO; self.extended_len()];
+
+        let w = self.get_extended_omega();
+        let wn = w.pow_vartime([n]);
+        let zeta_n = match n % 3 {
+            1 => zeta,
+            2 => zeta * zeta,
+            _ => one,
+        };
+
+        // Compute denominators. ( n * (w^j - g_i))
+        let n = F::from(n);
+        let n_g_i = n * g_i;
+        parallelize(&mut lag_poly, |e, mut index| {
+            let mut acc = n * zeta * w.pow_vartime([index as u64]);
+            for e in e {
+                *e = acc - n_g_i;
+                acc *= w;
+                index += 1;
+            }
+        });
+        lag_poly.batch_invert();
+
+        // Compute numerators.
+        //  g_i * (zeta * w^i)^n = (g_i * zeta^n) * w^(i*n)
+        // We use w^k = g and g^n = 1 to save multiplications.
+        let k = 1 << (self.extended_k() - self.k());
+        let mut wn_powers = vec![zeta_n * g_i; k];
+        for i in 1..k {
+            wn_powers[i] = wn_powers[i - 1] * wn
+        }
+
+        parallelize(&mut lag_poly, |e, mut index| {
+            for e in e {
+                *e *= wn_powers[index % k] - g_i;
+                index += 1;
+            }
+        });
+
+        Polynomial {
+            values: lag_poly,
+            _marker: std::marker::PhantomData,
+        }
+    }
+
     /// Rotate the extended domain polynomial over the original domain.
     pub fn rotate_extended(
         &self,

halo2_debug/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "halo2_debug"
-version = "0.3.0"
+version = "0.4.0"
 authors = [
     "Privacy Scaling Explorations team",
 ]
@@ -22,7 +22,7 @@ rustdoc-args = ["--cfg", "docsrs", "--html-in-header", "katex-header.html"]
 
 [dependencies]
 ff = "0.13"
-halo2curves = { version = "0.6.1", default-features = false }
+halo2curves = { version = "0.7.0", default-features = false }
 num-bigint = "0.4.5"
 halo2_middleware = { path = "../halo2_middleware" }
 tiny-keccak = { version = "2.0.2", features=["keccak"] }
@@ -32,4 +32,4 @@ rand_chacha = "0.3"
 rayon = "1.8"
 
 [features]
-vector-tests = []
+vector-tests = []