diff --git a/barretenberg/cpp/docs/src/honk.md b/barretenberg/cpp/docs/src/honk.md deleted file mode 100644 index cfda23d4ce0..00000000000 --- a/barretenberg/cpp/docs/src/honk.md +++ /dev/null @@ -1,17 +0,0 @@ -# Honk - -Honk is a sumcheck-based SNARK protocol which is similar to HyperPlonk [HyperPlonk]. A theory paper, based on the thesis [H], is forthcoming. This spec described what is currently implemented in Barretenberg. - -The variants of Honk that we build will be heavily optimized. As a warm-up, we describe a basic, unoptimized version of the protocol [here](honk-outline.md). - -# Preliminaries - -# Flavors - -# Prover's algorithm -This is outlined in `proof_system::honk::UltraProver::construct_proof()`: - \snippet cpp/src/barretenberg/ultra_honk/ultra_prover.cpp ConstructProof - -## Sumcheck -Sumcheck protocol is a proof system allowing to efficiently prove claims about the sums of values of multilinear polynomials in \f$ d \f$ variables over the Boolean hypercube \f$ \{0,1\}^d \f$ as well as more elaborate relations between such polynomials. Our implementation of Sumcheck including is described [here](sumcheck-outline.md). -# Verifier's algorithm \ No newline at end of file diff --git a/barretenberg/cpp/docs/src/sumcheck-outline.md b/barretenberg/cpp/docs/src/sumcheck-outline.md index e38e67efcbc..3685b6c8d29 100644 --- a/barretenberg/cpp/docs/src/sumcheck-outline.md +++ b/barretenberg/cpp/docs/src/sumcheck-outline.md @@ -12,8 +12,8 @@ The implementation consists of several components. Although the contribution in field operations is almost negligible, it adds non-trivial expenses during the opening procedure. - [Masking Evaluations of Multilinear Witnesses:](#MaskingEvalsOfWitnesses) - At the stage of proving their evaluations at the challenge point, the witness polynomials fed to Sumcheck must not reveal any private information. - We use a modification of Construction 3 described in Libra allowing the prover to open a new multilinear polynomial derived from the witnesses by adding a product of a random scalar and a public quadratic polynomial in the same number of variables. + At the stage of proving their evaluations at the challenge point, the multilinear witness polynomials fed to Sumcheck must not reveal any private information. + We use a modification of Construction 3 described in Libra allowing the prover to open a new multilinear polynomial in \f$d\f$ variables, where \f$2^d\f$ is the circuit size, which is derived from the witnesses by adding a product of a random scalar and a public quadratic polynomial in \f$d\f$ variables - [Total Costs:](#ZKCosts) The effect of adding Libra technique and masking evaluations of multilinear witnesses is assessed, and the theoretical upper bound on prover's work is compared to the implemenation costs. @@ -32,6 +32,7 @@ to establish that \f$ F(P_1(\vec \ell),\ldots, P_N(\vec \ell) ) = 0 \f$, i.e. th point \f$\vec \ell \{0,1\}^d\f$. In the implementation, the relation polynomial \f$ F \f$ is specified by the Flavor. + \todo Docs for Flavors and Relations. ### Main Parameters {#MainParameters} @@ -40,18 +41,22 @@ The following constants are used in this exposition. | Notation | | \f$ \sim \f$ Upper Bound | --------------------|---------------|-----------| | \f$ d \f$ | \ref multivariate_d "number of variables" in multilinear polynomials \f$ P_1,\ldots, P_N\f$ | \f$ 20 \f$ | - | \f$ N \f$ | number of Prover Polynomials specified by | \f$ 60 \f$ | - | \f$ N_w \f$ | number of Witness Polynomials specified by | \f$ 17 \f$ | + | \f$ N \f$ | number of Prover Polynomials specified by Flavor's parameter \p NUM_ALL_ENTITIES | \f$ 60 \f$ | + | \f$ N_w \f$ | number of Witness Polynomials specified by Flavor's parameter \p NUM_WITNESS_ENTITIES | \f$ 17 \f$ | | \f$ n \f$ | \ref multivariate_n "size of the hypercube", i.e. \f$ 2^d\f$. | \f$ 2^{20} \f$ | - | \f$ D \f$ | \ref bb::SumcheckProverRound< Flavor >::BATCHED_RELATION_PARTIAL_LENGTH "maximum partial degree of" \f$\tilde{F}\f$ | \f$ 12 \f$ | - | \f$ D_w\f$ | maximum witness degree of \f$ F \f$ | \f$ 5 \f$ | + | \f$ D \f$ | \ref bb::SumcheckProverRound< Flavor >::BATCHED_RELATION_PARTIAL_LENGTH "total degree of" \f$\tilde{F}\f$ as a polynomial in \f$P_1,\ldots, P_N\f$ incremented by 1 | \f$ 12 \f$ | + | \f$ D_w\f$ | [maximum witness degree](#MaximumWitnessDegree) of \f$ F \f$ | \f$ 5 \f$ | -#### Maximum Witness Degree +\todo Compute precise upper bounds. + +#### Maximum Witness Degree {#MaximumWitnessDegree} The significance of this parameter becomes apparent in Section [Masking Evaluations of Multilinear Witnesses](#MaskingEvalsOfWitnesses). It is formally defined as follows \f{align}{ D_w = \deg_{P_1, \ldots, P_{N_w}} F(P_1,\ldots, P_{N}) \f} -where by \f$ \deg_{P_1, \ldots, P_{N_w}} \f$ we mean the total degree of relation polynomial \f$ F \f$ in the first \f$N_w\f$ variables. +where by \f$ \deg_{P_1, \ldots, P_{N_w}} \f$ we mean the total degree of the relation polynomial \f$ F \f$ in the witness polynomials \f$ P_1,\ldots, P_{N_w}\f$ considered as variables. + +For example, given a polynomial \f$P_1 + P_{N_w+1} \cdot P_{N_w + 2} \cdot P_{1}^2 \cdot P_{2}\f$ in prover polynomials, where \f$N_w>2\f$, its witness degree \f$ D_w \f$ is \f$3\f$, whereas its total degree \f$D\f$ is equal to \f$ 6 \f$. ## Sumcheck Prover Algorithm {#NonZKSumcheckProver} - - - @@ -69,17 +74,18 @@ Sumcheck Prover algorithm takes a reference to an object of this class. #### Compute Round Univariates and add them to Transcript {#ComputeRoundUnivariates} The prover evaluates the round univariate \f{align}{ - \tilde{S}^i = \sum_{\vec \ell \in \{0,1\}^{d-1-i}} \tilde{F}\left(u_0,\ldots, u_{i-1}, X_i,\vec \ell\right) + \tilde{S}^i = \sum_{\vec \ell \in \{0,1\}^{d-1-i}} \tilde{F}\left(P_1(u_0,\ldots, u_{i-1}, X_i,\vec \ell), \ldots, P_N(u_0,\ldots, u_{i-1}, X_i,\vec \ell)\right) \f} -over the domain \f$ 0,\ldots, D \f$. -The evaluations are obtained using the method \ref bb::SumcheckProverRound< Flavor >::compute_univariate "compute univariate", whose implementation consists of the following sub-methods: +over the domain \f$ 0,\ldots, D \f$. In fact, it is more efficient to perform this computation sub-relation-wise, because the degrees of individual subrelations as polynomials in \f$ P_1,\ldots, P_N\f$ are generally smaller than \f$D\f$ defined in [Main Parameters](#MainParameters). Taking this into account, for a given subrelation of \f$F\f$, we perform expensive subrelation evaluations at points \f$(u_0,\ldots, u_{i-1}, k, \vec \ell)\f$ for \f$\ell \in \{0,1\}^{d-1-i} \f$ and \f$k\f$ from \f$0\f$ only up to the degree of the subrelation as a polynomial in \f$P_1,\ldots,P_N\f$ incremented by \f$1\f$. + +At the implementation level, the evaluations of \f$\tilde{S}^i\f$ are obtained using the method \ref bb::SumcheckProverRound< Flavor >::compute_univariate "compute univariate" consisting of the following sub-methods: - \ref bb::SumcheckProverRound::extend_edges "Extend evaluations" of linear univariate -polynomials \f$ P_j(u_0,\ldots, u_{i-1}, X_i, \vec \ell) \f$ to the domain \f$0,\ldots, D\f$. +polynomials \f$ P_j(u_0,\ldots, u_{i-1}, X_i, \vec \ell) \f$ to the domain \f$0,\ldots, D\f$. It is a cheap operation applied only once for every \f$\vec \ell \in \{0,1\}^d\f$ which allows to compute subrelations of \f$ F \f$ at such arguments. - \ref bb::SumcheckProverRound::accumulate_relation_univariates "Accumulate per-relation contributions" of the extended -polynomials to \f$ T^i(X_i)\f$ +polynomials to auxiliary univariates \f$ T^i(X_i)\f$ defined in \ref SumcheckProverContributionsofPow "this section" - \ref bb::SumcheckProverRound::extend_and_batch_univariates "Extend and batch the subrelation contributions" -multiplying by the constants \f$c_i\f$ and the evaluations of \f$ ( (1−X_i) + X_i\cdot \beta_i ) \f$. +multiplying by the constants \f$c_i\f$ and the evaluations of \f$ ( (1−X_i) + X_i\cdot \beta_i ) \f$ stemming from \f$F\f$ being multiplied by \f$pow_{\beta}\f$. #### Get Round Challenge {#GetRoundChallenge} @@ -115,8 +121,7 @@ The verifier algorithm is implemented in the \ref bb::SumcheckVerifier< Flavor > The verifier's work reduces to the following. For \f$ i = 0,\ldots, d-1\f$: - - Using \ref bb::BaseTranscript::receive_from_prover "receive_from_prover" method from BaseTranscript Flavor, - extract the evaluations of Round Univariate \f$ \tilde{S}^i(0),\ldots, \tilde{S}^i(D) \f$ from the transcript. + - Using \ref bb::BaseTranscript::receive_from_prover "receive_from_prover" method from \ref bb::BaseTranscript< TranscriptParams > "Base Transcript Class", extract the evaluations of Round Univariate \f$ \tilde{S}^i(0),\ldots, \tilde{S}^i(D) \f$ from the transcript. - \ref bb::SumcheckVerifierRound< Flavor >::check_sum "Check target sum": \f$\quad \sigma_{ i } \stackrel{?}{=} \tilde{S}^i(0) + \tilde{S}^i(1) \f$. - \ref bb::BaseTranscript::get_challenge "Get the next challenge" \f$u_i\f$ by hashing the transcript. @@ -148,7 +153,7 @@ As explained in Section 13.3 of ::compute_univariate "computes the univariate polynomial" for the relation +defined by \f$ \tilde{F} (X_0,\ldots, X_{d-1}) = pow_{\beta}(X_0,\ldots, X_{d-1}) \cdot F\f$, namely * \f{align}{ \tilde{S}^{i}(X_i) = \sum_{ \ell = 0} ^{2^{d-i-1}-1} pow^i_\beta ( X_i, \ell_{i+1}, \ldots, \ell_{d-1} ) S^i_{\ell}( X_i ) @@ -173,8 +176,8 @@ S^i_{\ell}( X_i ) * Define \f{align} T^{i}( X_i ) = \sum_{\ell = 0}^{2^{d-i-1}-1} \beta_{i+1}^{\ell_{i+1}} \cdot \ldots \cdot \beta_{d-1}^{\ell_{d-1}} \cdot S^{i}_{\ell}( X_i ) \f} then \f$ \deg_{X_i} (T^i) \leq \deg_{X_i} S^i \f$. - ### Main Features of PowPolynomial Class: - - The factor \f$ c_i \f$ is contained in #partial_evaluation_result and updated by \ref partially_evaluate. + ### Features of PowPolynomial used by Sumcheck Prover + - The factor \f$ c_i \f$ is the #partial_evaluation_result, it is updated by \ref partially_evaluate. - The challenges \f$(\beta_0,\ldots, \beta_{d-1}) \f$ are recorded in #betas. - The consecutive evaluations \f$ pow_{\ell}(\vec \beta) = pow_{\beta}(\vec \ell) \f$ for \f$\vec \ell\f$ identified with the integers \f$\ell = 0,\ldots, 2^d-1\f$ represented in binary are pre-computed by \ref compute_values and stored diff --git a/barretenberg/cpp/src/barretenberg/sumcheck/sumcheck.hpp b/barretenberg/cpp/src/barretenberg/sumcheck/sumcheck.hpp index d0ba5945708..516caba47f9 100644 --- a/barretenberg/cpp/src/barretenberg/sumcheck/sumcheck.hpp +++ b/barretenberg/cpp/src/barretenberg/sumcheck/sumcheck.hpp @@ -12,10 +12,10 @@ pow_{\beta}(\vec \ell) \cdot F \left(P_1(\vec \ell),\ldots, P_N(\vec \ell) \righ \f$P_1, \ldots, P_N \f$. \details - ## Notation and Setup + \section SumcheckProverNotation Notation and Setup - ### Obtaining Prover/Honk Polynomials - The Sumcheck is applied to multi-variate polynomials + \subsection SumcheckProverObtainingPolynomials Obtaining Prover/Honk Polynomials + The Sumcheck is applied to multivariate polynomials \f$P_1, \ldots, P_N\f$ that are specidied by \p Flavor. Namely, \ref prove "prove method" obtains \p full_polynomials by reference from \p Flavor 's \ref ProverPolynomials "prover polynomials". In particular, their number \f$N\f$ is specified by the \p Flavor. @@ -38,8 +38,8 @@ bb::SumcheckProverRound "Sumcheck Round Prover". The following constants are used: - \f$ d \f$ \ref multivariate_d "the number of variables" in the multilinear polynomials - \f$ n \f$ \ref multivariate_n "the size of the hypercube", i.e. \f$ 2^d\f$. - - \f$ D = \f$ \ref bb::SumcheckProverRound< Flavor >::BATCHED_RELATION_PARTIAL_LENGTH "the maximum partial degree of" -\f$\tilde{F}\f$. + - \f$ D = \f$ \ref bb::SumcheckProverRound< Flavor >::BATCHED_RELATION_PARTIAL_LENGTH "total degree of" +\f$\tilde{F}\f$ as a polynomial in \f$P_1,\ldots, P_N\f$ incremented by 1. ## Honk Polynomials and Partially Evaluated Polynomials @@ -49,9 +49,9 @@ in \f$ d \f$ variables. ### Round 0 At initialization, \ref ProverPolynomials "Prover Polynomials" -are submitted by reference into \p full_polynomials, which is a two-dimensional array defined by -\f$\texttt{full_polynomials}_{i,j} = P_j(\vec i) \f$. Here, \f$ \vec i \in \{0,1\}^d \f$ is identified with the binary -representation of the integer \f$ 0 \leq i \leq 2^d-1 \f$. +are submitted by reference into \p full_polynomials, which is a two-dimensional array with \f$N\f$ columns and \f$2^d\f$ +rows, whose entries are defined as follows \f$\texttt{full_polynomials}_{i,j} = P_j(\vec i) \f$. Here, \f$ \vec i \in +\{0,1\}^d \f$ is identified with the binary representation of the integer \f$ 0 \leq i \leq 2^d-1 \f$. When the first challenge \f$ u_0 \f$ is computed, the method \ref partially_evaluate "partially evaluate" takes as input \p full_polynomials and populates \ref partially_evaluated_polynomials "a new book-keeping table" denoted by @@ -78,9 +78,9 @@ to the transcript. ## Round Univariates -### Contributions of PowPolynomial - * For a vector of challenges \f$ \vec \beta = (\beta_0,\ldots, \beta_{d-1}) \in \mathbb{F} \f$ obtained as \ref -bb::ProverInstance_< Flavor >::gate_challenges "gate challenges" using ProverInstance class. +\subsubsection SumcheckProverContributionsofPow Contributions of PowPolynomial + + * Let \f$ \vec \beta = (\beta_0,\ldots, \beta_{d-1}) \in \mathbb{F}\f$ be a vector of challenges. * * In Round \f$i\f$, a univariate polynomial \f$ \tilde S^{i}(X_{i}) \f$ for the relation defined by \f$ \tilde{F}(X)\f$ is computed as follows. First, we introduce notation @@ -297,7 +297,8 @@ template class SumcheckProver { * * For \f$ i = 0,\ldots, d-1\f$: * - Extract Round Univariate's \f$\tilde{F}\f$ evaluations at \f$0,\ldots, D \f$ from the transcript using \ref - bb::BaseTranscript::receive_from_prover "receive_from_prover" method from BaseTranscript Flavor + bb::BaseTranscript::receive_from_prover "receive_from_prover" method from \ref bb::BaseTranscript< TranscriptParams > + "Base Transcript Class". * - \ref bb::SumcheckVerifierRound< Flavor >::check_sum "Check target sum": \f$\quad \sigma_{ i } \stackrel{?}{=} \tilde{S}^i(0) + \tilde{S}^i(1) \f$ * - Compute the challenge \f$u_i\f$ from the transcript using \ref bb::BaseTranscript::get_challenge "get_challenge" @@ -336,7 +337,7 @@ template class SumcheckVerifier { using RelationSeparator = typename Flavor::RelationSeparator; /** - * @brief The partial algebraic degree of the relation \f$\tilde F = pow_{\beta} \cdot F \f$, i.e. \ref + * @brief Maximum partial algebraic degree of the relation \f$\tilde F = pow_{\beta} \cdot F \f$, i.e. \ref * MAX_PARTIAL_RELATION_LENGTH "MAX_PARTIAL_RELATION_LENGTH + 1". */ static constexpr size_t BATCHED_RELATION_PARTIAL_LENGTH = Flavor::BATCHED_RELATION_PARTIAL_LENGTH; diff --git a/barretenberg/cpp/src/barretenberg/sumcheck/sumcheck_round.hpp b/barretenberg/cpp/src/barretenberg/sumcheck/sumcheck_round.hpp index 51822e3826f..21128a6edaa 100644 --- a/barretenberg/cpp/src/barretenberg/sumcheck/sumcheck_round.hpp +++ b/barretenberg/cpp/src/barretenberg/sumcheck/sumcheck_round.hpp @@ -48,12 +48,14 @@ template class SumcheckProverRound { */ static constexpr size_t NUM_RELATIONS = Flavor::NUM_RELATIONS; /** - * @brief The partial algebraic degree of the Sumcheck relation \f$ F \f$. + * @brief The total algebraic degree of the Sumcheck relation \f$ F \f$ as a polynomial in Prover Polynomials + * \f$P_1,\ldots, P_N\f$. */ static constexpr size_t MAX_PARTIAL_RELATION_LENGTH = Flavor::MAX_PARTIAL_RELATION_LENGTH; /** - * @brief The partial algebraic degree of the relation \f$\tilde F = pow_{\beta} \cdot F \f$, i.e. \ref - * MAX_PARTIAL_RELATION_LENGTH "MAX_PARTIAL_RELATION_LENGTH + 1". + * @brief The total algebraic degree of the Sumcheck relation \f$ F \f$ as a polynomial in Prover Polynomials + * \f$P_1,\ldots, P_N\f$ incremented by 1, i.e. it is equal \ref MAX_PARTIAL_RELATION_LENGTH + * "MAX_PARTIAL_RELATION_LENGTH + 1". */ static constexpr size_t BATCHED_RELATION_PARTIAL_LENGTH = Flavor::BATCHED_RELATION_PARTIAL_LENGTH; @@ -264,10 +266,8 @@ template class SumcheckProverRound { * @brief In Round \f$ i \f$, for a given point \f$ \vec \ell \in \{0,1\}^{d-1 - i}\f$, calculate the contribution * of each sub-relation to \f$ T^i(X_i) \f$. * - * @details In Round \f$ i \f$, this method computes the univariate \f$ T^i(X_i) \f$ which is a quotient of the full - * round univariate \f$ \tilde{S}^i(X_i)\f$, they are defined in - * section Round Univariates of \ref bb::SumcheckProver< Flavor > "Sumcheck Prover detailed description" is - * computed as follows: + * @details In Round \f$ i \f$, this method computes the univariate \f$ T^i(X_i) \f$ deined in \ref + *SumcheckProverContributionsofPow "this section". It is done as follows: * - Outer loop: iterate through the "edge" points \f$ (0,\vec \ell) \f$ on the boolean hypercube \f$\{0,1\}\times * \{0,1\}^{d-1 - i}\f$, i.e. skipping every other point. On each iteration, apply \ref extend_edges "extend edges". * - Inner loop: iterate through the sub-relations, feeding each relation the "the group of edges", i.e. the