Merge branch 'main' into gr@doc-permutation-prover-structs

.github/workflows/ci.yml

@@ -8,6 +8,36 @@ on:
       - main
 
 jobs:
+
+  fmt:
+    name: Rustfmt
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions-rs/toolchain@v1
+        with:
+          override: false
+      - run: rustup component add rustfmt
+      - uses: actions-rs/cargo@v1
+        with:
+          command: fmt
+          args: --all -- --check
+
+  typos-check:
+    needs: [skip_check]
+    if: |
+      github.event.pull_request.draft == false &&
+      (github.event.action == 'ready_for_review' || needs.skip_check.outputs.should_skip != 'true')
+    name: TyposCheck
+    timeout-minutes: 5
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: crate-ci/[email protected]
+        with:
+          config: ./typos.toml
+          isolated: true
   test:
     name: Test on ${{ matrix.os }} with ${{ matrix.feature_set }} features
     runs-on: ${{ matrix.os }}
@@ -101,18 +131,4 @@ jobs:
           command: doc
           args: --all --document-private-items
 
-  fmt:
-    name: Rustfmt
-    timeout-minutes: 30
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions-rs/toolchain@v1
-        with:
-          override: false
-      - run: rustup component add rustfmt
-      - uses: actions-rs/cargo@v1
-        with:
-          command: fmt
-          args: --all -- --check
 

.gitignore

@@ -6,4 +6,5 @@ Cargo.lock
 .DS_Store
 
 layout.png
-serialization-test.pk
+serialization-example.vk
+serialization-example.pk

README.md

@@ -6,7 +6,7 @@ This repository contains the [halo2](https://github.com/zcash/halo2) fork from
 PSE and includes contributions from the community.
 
 We use the `main` branch for development, which means it may contain
-unstable/unfinished features.  For end-users we recomend using the tag releases
+unstable/unfinished features.  For end-users we recommend using the tag releases
 which can be seen as curated checkpoints with some level of guarantee of
 stability.
 

book/src/user/experimental-features.md

@@ -24,11 +24,11 @@ When using `create_proof` and `verify_proof`, we need to specify the commitment
 create_proof<IPACommitmentScheme<_>, ProverIPA<_>, _, _, _, _>
 verify_proof<IPACommitmentScheme<_>, ProverIPA<_>, _, _, _>
 
-// Using KZG with GWC19 mutli-open strategy
+// Using KZG with GWC19 multi-open strategy
 create_proof<KZGCommitmentScheme<_>, ProverGWC<_>, _, _, _, _>
 verify_proof<KZGCommitmentScheme<_>, ProverGWC<_>, _, _, _>
 
-// Using KZG with BDFG20 mutli-open strategy
+// Using KZG with BDFG20 multi-open strategy
 create_proof<KZGCommitmentScheme<_>, ProverSHPLONK<_>, _, _, _, _>
 verify_proof<KZGCommitmentScheme<_>, ProverSHPLONK<_>, _, _, _>
 ```

halo2/Cargo.toml

@@ -19,7 +19,7 @@ all-features = true
 rustdoc-args = ["--cfg", "docsrs", "--html-in-header", "katex-header.html"]
 
 [dependencies]
-halo2_proofs = { version = "0.3", path = "../halo2_proofs", default-features = false }
+halo2_proofs = { version = "0.4", path = "../halo2_proofs", default-features = false }
 
 [lib]
 bench = false

halo2_backend/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "halo2_backend"
-version = "0.3.0"
+version = "0.4.0"
 authors = [
     "Sean Bowe <[email protected]>",
     "Ying Tong Lai <[email protected]>",
@@ -28,7 +28,7 @@ rustdoc-args = ["--cfg", "docsrs", "--html-in-header", "katex-header.html"]
 backtrace = { version = "0.3", optional = true }
 ff = "0.13"
 group = "0.13"
-halo2curves = { version = "0.6.1", default-features = false }
+halo2curves = { version = "0.7.0", default-features = false }
 rand_core = { version = "0.6", default-features = false }
 tracing = "0.1"
 blake2b_simd = "1" # MSRV 1.66.0

halo2_backend/src/plonk.rs

@@ -117,7 +117,7 @@ where
             return Err(io::Error::new(
                 io::ErrorKind::InvalidData,
                 format!(
-                    "circuit size value (k): {} exceeds maxium: {}",
+                    "circuit size value (k): {} exceeds maximum: {}",
                     k,
                     C::Scalar::S
                 ),

halo2_backend/src/plonk/circuit.rs

@@ -366,3 +366,47 @@ fn shuffle_argument_required_degree<F: Field, V: Variable>(arg: &shuffle::Argume
     // (1 - (l_last + l_blind)) (z(\omega X) (s(X) + \gamma) - z(X) (a(X) + \gamma))
     std::cmp::max(2 + shuffle_degree, 2 + input_degree)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::ExpressionBack;
+    use halo2curves::bn256::Fr;
+
+    #[test]
+    fn expressionback_iter_sum() {
+        let exprs: Vec<ExpressionBack<Fr>> = vec![
+            ExpressionBack::Constant(1.into()),
+            ExpressionBack::Constant(2.into()),
+            ExpressionBack::Constant(3.into()),
+        ];
+        let happened: ExpressionBack<Fr> = exprs.into_iter().sum();
+        let expected: ExpressionBack<Fr> = ExpressionBack::Sum(
+            Box::new(ExpressionBack::Sum(
+                Box::new(ExpressionBack::Constant(1.into())),
+                Box::new(ExpressionBack::Constant(2.into())),
+            )),
+            Box::new(ExpressionBack::Constant(3.into())),
+        );
+
+        assert_eq!(happened, expected);
+    }
+
+    #[test]
+    fn expressionback_iter_product() {
+        let exprs: Vec<ExpressionBack<Fr>> = vec![
+            ExpressionBack::Constant(1.into()),
+            ExpressionBack::Constant(2.into()),
+            ExpressionBack::Constant(3.into()),
+        ];
+        let happened: ExpressionBack<Fr> = exprs.into_iter().product();
+        let expected: ExpressionBack<Fr> = ExpressionBack::Product(
+            Box::new(ExpressionBack::Product(
+                Box::new(ExpressionBack::Constant(1.into())),
+                Box::new(ExpressionBack::Constant(2.into())),
+            )),
+            Box::new(ExpressionBack::Constant(3.into())),
+        );
+
+        assert_eq!(happened, expected);
+    }
+}

halo2_backend/src/plonk/evaluation.rs

@@ -174,11 +174,11 @@ impl Calculation {
 /// Evaluator
 #[derive(Clone, Default, Debug)]
 pub(crate) struct Evaluator<C: CurveAffine> {
-    ///  Custom gates evalution
+    ///  Custom gates evaluation
     custom_gates: GraphEvaluator<C>,
-    ///  Lookups evalution
+    ///  Lookups evaluation
     lookups: Vec<GraphEvaluator<C>>,
-    ///  Shuffle evalution
+    ///  Shuffle evaluation
     shuffles: Vec<GraphEvaluator<C>>,
 }
 

halo2_backend/src/plonk/keygen.rs

@@ -107,7 +107,6 @@ where
     }
 
     // Compute fixeds
-
     let fixed_polys: Vec<_> = circuit
         .preprocessing
         .fixed
@@ -131,13 +130,7 @@ where
         .map(Polynomial::new_lagrange_from_vec)
         .collect();
 
-    // Compute l_0(X)
-    // TODO: this can be done more efficiently
-    // https://github.com/privacy-scaling-explorations/halo2/issues/269
-    let mut l0 = vk.domain.empty_lagrange();
-    l0[0] = C::Scalar::ONE;
-    let l0 = vk.domain.lagrange_to_coeff(l0);
-    let l0 = vk.domain.coeff_to_extended(l0);
+    let l0 = vk.domain.lagrange_extended(0usize);
 
     // Compute l_blind(X) which evaluates to 1 for each blinding factor row
     // and 0 otherwise over the domain.
@@ -150,10 +143,8 @@ where
 
     // Compute l_last(X) which evaluates to 1 on the first inactive row (just
     // before the blinding factors) and 0 otherwise over the domain
-    let mut l_last = vk.domain.empty_lagrange();
-    l_last[params.n() as usize - vk.cs.blinding_factors() - 1] = C::Scalar::ONE;
-    let l_last = vk.domain.lagrange_to_coeff(l_last);
-    let l_last = vk.domain.coeff_to_extended(l_last);
+    let idx = params.n() as usize - vk.cs.blinding_factors() - 1;
+    let l_last = vk.domain.lagrange_extended(idx);
 
     // Compute l_active_row(X)
     let one = C::Scalar::ONE;

halo2_backend/src/plonk/prover.rs

@@ -489,10 +489,10 @@ impl<
 
     /// Finalizes the proof creation.
     /// The following steps are performed:
-    /// - 1. Generate commited lookup polys
-    /// - 2. Generate commited permutation polys
-    /// - 3. Generate commited lookup polys
-    /// - 4. Generate commited shuffle polys
+    /// - 1. Generate committed lookup polys
+    /// - 2. Generate committed permutation polys
+    /// - 3. Generate committed lookup polys
+    /// - 4. Generate committed shuffle polys
     /// - 5. Commit to the vanishing argument's random polynomial
     /// - 6. Generate the advice polys
     /// - 7. Evaluate the h(X) polynomial
@@ -523,7 +523,7 @@ impl<
             .map(|index| challenges.remove(&index).unwrap())
             .collect::<Vec<_>>();
 
-        // 1. Generate commited ( added to transcript ) lookup polys  ---------------------------------------
+        // 1. Generate committed ( added to transcript ) lookup polys  ---------------------------------------
 
         // Sample theta challenge for keeping lookup columns linearly independent
         // [TRANSCRIPT-5]
@@ -574,9 +574,9 @@ impl<
         // [TRANSCRIPT-8]
         let gamma: ChallengeGamma<_> = self.transcript.squeeze_challenge_scalar();
 
-        // 2. Generate commited permutation polys  -----------------------------------------
+        // 2. Generate committed permutation polys  -----------------------------------------
         // [TRANSCRIPT-9]
-        let permutations_commited: Vec<permutation::prover::Committed<Scheme::Curve>> = instances
+        let permutations_committed: Vec<permutation::prover::Committed<Scheme::Curve>> = instances
             .iter()
             .zip(advices.iter())
             .map(|(instance, advice)| {
@@ -597,34 +597,35 @@ impl<
             })
             .collect::<Result<Vec<_>, _>>()?;
 
-        // 3. Generate commited lookup polys ----------------------------------------------------------
+        // 3. Generate committed lookup polys ----------------------------------------------------------
 
         // [TRANSCRIPT-10]
-        let lookups_commited: Vec<Vec<lookup::prover::Committed<Scheme::Curve>>> = permuted_lookups
-            .into_iter()
-            .map(|lookups| -> Result<Vec<_>, _> {
-                // Construct and commit to products for each lookup
-                lookups
-                    .into_iter()
-                    .map(|lookup| {
-                        lookup.commit_product(
-                            &self.engine,
-                            pk,
-                            params,
-                            beta,
-                            gamma,
-                            &mut rng,
-                            self.transcript,
-                        )
-                    })
-                    .collect::<Result<Vec<_>, _>>()
-            })
-            .collect::<Result<Vec<_>, _>>()?;
+        let lookups_committed: Vec<Vec<lookup::prover::Committed<Scheme::Curve>>> =
+            permuted_lookups
+                .into_iter()
+                .map(|lookups| -> Result<Vec<_>, _> {
+                    // Construct and commit to products for each lookup
+                    lookups
+                        .into_iter()
+                        .map(|lookup| {
+                            lookup.commit_product(
+                                &self.engine,
+                                pk,
+                                params,
+                                beta,
+                                gamma,
+                                &mut rng,
+                                self.transcript,
+                            )
+                        })
+                        .collect::<Result<Vec<_>, _>>()
+                })
+                .collect::<Result<Vec<_>, _>>()?;
 
-        // 4. Generate commited shuffle polys  -------------------------------------------------------
+        // 4. Generate committed shuffle polys  -------------------------------------------------------
 
         // [TRANSCRIPT-11]
-        let shuffles_commited: Vec<Vec<shuffle::prover::Committed<Scheme::Curve>>> = instances
+        let shuffles_committed: Vec<Vec<shuffle::prover::Committed<Scheme::Curve>>> = instances
             .iter()
             .zip(advices.iter())
             .map(|(instance, advice)| -> Result<Vec<_>, _> {
@@ -703,9 +704,9 @@ impl<
             *beta,
             *gamma,
             *theta,
-            &lookups_commited,
-            &shuffles_commited,
-            &permutations_commited,
+            &lookups_committed,
+            &shuffles_committed,
+            &permutations_committed,
         );
 
         // 8. Construct the vanishing argument's h(X) commitments --------------------------------------
@@ -796,15 +797,15 @@ impl<
         // Evaluate the permutations, if any, at omega^i x.
         // [TRANSCRIPT-21]
         let permutations_evaluated: Vec<permutation::prover::Evaluated<Scheme::Curve>> =
-            permutations_commited
+            permutations_committed
                 .into_iter()
                 .map(|permutation| -> Result<_, _> { permutation.evaluate(pk, x, self.transcript) })
                 .collect::<Result<Vec<_>, _>>()?;
 
         // Evaluate the lookups, if any, at omega^i x.
         // [TRANSCRIPT-22]
         let lookups_evaluated: Vec<Vec<lookup::prover::Evaluated<Scheme::Curve>>> =
-            lookups_commited
+            lookups_committed
                 .into_iter()
                 .map(|lookups| -> Result<Vec<_>, _> {
                     lookups
@@ -817,7 +818,7 @@ impl<
         // Evaluate the shuffles, if any, at omega^i x.
         // [TRANSCRIPT-23]
         let shuffles_evaluated: Vec<Vec<shuffle::prover::Evaluated<Scheme::Curve>>> =
-            shuffles_commited
+            shuffles_committed
                 .into_iter()
                 .map(|shuffles| -> Result<Vec<_>, _> {
                     shuffles