feat: commit the R1CS witness with zook - #485
Draft
BornPsych wants to merge 10 commits into
Draft
Conversation
Collects a slice of concrete covectors into the `Vec<&dyn LinearForm<F>>` shape whir's opening APIs take. The prover and verifier both build this vector by hand at several call sites; a shared helper removes the repetition and keeps the trait-object cast in one place.
Moves the `whir` pin from 33fbecf to 8804e80 (worldfnd/whir, PR #270). That rev replaces the `Messages` + separate-mask Reed-Solomon interface with segmented `Polynomials`, and adds the `zook` protocol module the following commits switch the witness commitment over to. Also enables serde_json's `float_roundtrip` feature: zook's `KneeWeight` and `ListSize` wrap `OrderedFloat<f64>`, and the default fast float parser is off by one ULP on read-back, which breaks scheme JSON roundtrips. Cargo.lock additionally picks up a `zeroize` edge for whir and a batch of incidental `windows-sys` version moves from re-resolving the graph; none of those affect the build on our targets.
whir replaced `Messages` plus a separate `masks` buffer with `Polynomials::from_segments`, where each `PolynomialSegment` contributes a contiguous run of coefficient columns. `interleaved_encode` now walks the segments and transposes each one into the interleaved layout `ntt_nr` consumes, instead of copying masks in as a tail block. `evaluation_points` takes the full polynomial length rather than the unmasked message length. The `codeword_length % coset_size != 0` loop condition stays spelled out: `is_multiple_of` needs Rust 1.87 and the workspace MSRV is 1.85. The proptest now also covers a zero-length mask segment, which is what `Mode::Standard` produces, and the single-buffer message layout the prover actually commits.
`WhirR1CSScheme::whir_witness` becomes a zook `ProtocolConfig` derived from an explicit `SecuritySpec`/`TuningSpec` pair rather than a plain `whir::Config`. The tuning knobs move to named constants: `Mode::Standard` for the commitment mode, and `RateSchedule::Adaptive` at the default 0.5 knee, which plans per-round inverse rates against the prover-time / proof-size pareto knee instead of stepping the rate unboundedly. `ProtocolConfig::derive` is fallible, so `new_for_r1cs`, `new_from_dimensions` and `new_witness_config_for_size` now return `anyhow::Result`, and the two dimension invariants become `ensure!` instead of `assert!` — library code should not panic on caller error. The blinding commitment stays a plain `whir::Config`: the Spartan mask `g` is extension-valued and does not go through the base-field zook path.
`WhirR1CSCommitment::witness` holds a zook `CommittedWitness`, and the padded witness length now comes from the config's `tuning().vector_size` rather than `initial_num_variables()`. zook's `commit` consumes the buffer but the prove stage still needs the message for the covector evaluations, so the padded witness is cloned; an upstream `commit(&Buffer)` or a message accessor would remove that. Both the single- and dual-commitment opening paths hand zook borrowed linear forms via `linear_form_refs` instead of boxing each covector, and the SPARK covector snapshots go away with them: zook's `prove` returns `()`, so there is no final evaluation point to re-evaluate the alpha weights at.
zook's `verify` takes the linear forms and their claimed evaluations up front and returns a `FinalClaim` whose `verify` now takes a slice rather than an iterator. Its sumcheck also draws extension-field randomness, so the impl picks up a `Standard: Distribution<Ext<P>>` bound. All three weight-reference sites switch to `linear_form_refs`.
A SPARK query needs the final WHIR evaluation point to re-evaluate the A, B, C covectors at. zook's `prove` returns `()` and keeps that point internal, so the query cannot be built. Rather than silently emitting nothing, both the generic and the Mavros prove paths now fail fast with an explanatory error, and `ProveFromAlphasCtx::spark_row` is documented as reserved. Restoring this needs a whir-side change that exposes the prover's final claim; the call sites are marked with a TODO pointing at it.
Scheme construction can now fail while deriving the zook config, so the Noir and Mavros compilers propagate the error and `MavrosSchemeBuilder` returns `anyhow::Result<Self>`. `assert_configs_secure` no longer reads a security level off the witness config — zook owns that calculation. It runs zook's own `validate` and asserts the target stays at 128 bits. The blinding half still checks `security_level` directly, since it remains a plain whir config.
`prove_setup` returns `Result<ProveInputs<P>>` and the harness builders propagate the scheme-construction error.
The gnark exporter serialises a plain whir `Config`; it has no way to describe zook's `ProtocolConfig`, and the Go recursive verifier would have to be updated in lockstep to consume one. Until that paired change lands, both entry points — the `generate-gnark-inputs` CLI command and the verifier server's parameter preparation — fail with an error that says so, and `provekit-gnark` drops out of the two crates' dependencies so `cargo machete` stays quiet. Also drops two `return` statements from the verifier server's cancellation branches; they are the last statement in their `select!` arm and clippy flags them.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
CSP benchmarks
Prover time, peak RSS, peak heap, and verifier time are arithmetic means across the iterations. Peak heap comes from the largest No baseline available yet — deltas will appear once this workflow has produced at least one successful Results
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Switches the R1CS witness commitment from plain WHIR to zook (
RateSchedule::Adaptive,Mode::Standard), and bumps whir to8804e80.On the passport circuit this is ~37% off the R1CS proving core and ~17% off total prove time, for ~26% larger proofs.
Do not merge yet. Blocked on:
provedoes not expose its final evaluation point, so SPARK query production currently errors outgnark parameter export and the Go recursive verifier are intentionally left disabled here; they need a paired update once the above land.