modify proof and vk structure to support fri proof (step 1)

halo2_proofs/Cargo.toml

@@ -120,7 +120,8 @@ logup_skip_inv = []
 phase-check = []
 multiphase-mock-prover = []
 
-fri = []
+fri = ["ff/fri"]
+
 [lib]
 bench = false
 

halo2_proofs/src/plonk.rs

@@ -7,6 +7,7 @@
 
 use blake2b_simd::Params as Blake2bParams;
 use group::ff::{Field, FromUniformBytes, PrimeField};
+use std::fs::read;
 
 use crate::arithmetic::CurveAffine;
 use crate::helpers::{
@@ -22,8 +23,8 @@ mod circuit;
 mod error;
 mod evaluation;
 mod keygen;
-#[allow(dead_code)]
-mod lookup;
+// #[allow(dead_code)]
+// mod lookup;
 mod mv_lookup;
 pub mod permutation;
 mod shuffle;
@@ -39,6 +40,7 @@ pub use keygen::*;
 pub use prover::*;
 pub use verifier::*;
 
+use crate::poly::commitment::{Commitment, CommitmentItem};
 use evaluation::Evaluator;
 use std::io;
 
@@ -47,7 +49,7 @@ use std::io;
 #[derive(Clone, Debug)]
 pub struct VerifyingKey<C: CurveAffine> {
     domain: EvaluationDomain<C::Scalar>,
-    fixed_commitments: Vec<C>,
+    fixed_commitments: Commitment<C>,
     permutation: permutation::VerifyingKey<C>,
     cs: ConstraintSystem<C::Scalar>,
     /// Cached maximum degree of `cs` (which doesn't change after construction).
@@ -117,9 +119,13 @@ where
         reader.read_exact(&mut num_fixed_columns)?;
         let num_fixed_columns = u32::from_be_bytes(num_fixed_columns);
 
-        let fixed_commitments: Vec<_> = (0..num_fixed_columns)
-            .map(|_| C::read(reader, format))
-            .collect::<Result<_, _>>()?;
+        let fixed_commitments: Vec<_> = if cfg!(fri) {
+            vec![CommitmentItem::<C::Scalar, C>::read(reader, format)?]
+        } else {
+            (0..num_fixed_columns)
+                .map(|_| CommitmentItem::<C::Scalar, C>::read(reader, format))
+                .collect::<Result<Vec<_>, _>>()?
+        };
 
         let permutation = permutation::VerifyingKey::read(reader, &cs.permutation, format)?;
 
@@ -178,7 +184,7 @@ where
 
     fn from_parts(
         domain: EvaluationDomain<C::Scalar>,
-        fixed_commitments: Vec<C>,
+        fixed_commitments: Vec<CommitmentItem<C::Scalar, C>>,
         permutation: permutation::VerifyingKey<C>,
         cs: ConstraintSystem<C::Scalar>,
         // selectors: Vec<Vec<bool>>,
@@ -240,7 +246,7 @@ where
     }
 
     /// Returns commitments of fixed polynomials
-    pub fn fixed_commitments(&self) -> &Vec<C> {
+    pub fn fixed_commitments(&self) -> &Vec<CommitmentItem<C::Scalar, C>> {
         &self.fixed_commitments
     }
 
@@ -269,7 +275,7 @@ pub struct PinnedVerificationKey<'a, C: CurveAffine> {
     scalar_modulus: &'static str,
     domain: PinnedEvaluationDomain<'a, C::Scalar>,
     cs: PinnedConstraintSystem<'a, C::Scalar>,
-    fixed_commitments: &'a Vec<C>,
+    fixed_commitments: &'a Commitment<C>,
     permutation: &'a permutation::VerifyingKey<C>,
 }
 /// This is a proving key which allows for the creation of proofs for a

halo2_proofs/src/plonk/keygen.rs

@@ -15,6 +15,7 @@ use super::{
     permutation, Assigned, Challenge, Error, LagrangeCoeff, Polynomial, ProvingKey, VerifyingKey,
 };
 use crate::helpers::CopyCell;
+use crate::poly::commitment::CommitmentItem;
 use crate::{
     arithmetic::{parallelize, CurveAffine},
     circuit::Value,

halo2_proofs/src/plonk/mv_lookup/verifier.rs

@@ -2,6 +2,7 @@ use std::iter;
 
 use super::super::{circuit::Expression, ChallengeBeta, ChallengeTheta, ChallengeX};
 use super::Argument;
+use crate::poly::commitment::CommitmentItem;
 use crate::{
     arithmetic::CurveAffine,
     plonk::{Error, VerifyingKey},
@@ -11,12 +12,12 @@ use crate::{
 use ff::{BatchInvert, Field, PrimeField, WithSmallOrderMulGroup};
 
 pub struct PreparedCommitments<C: CurveAffine> {
-    m_commitment: C,
+    m_commitment: Vec<CommitmentItem<C::Scalar, C>>,
 }
 
 pub struct Committed<C: CurveAffine> {
     prepared: PreparedCommitments<C>,
-    phi_commitment: C,
+    phi_commitment: Vec<CommitmentItem<C::Scalar, C>>,
 }
 
 pub struct Evaluated<C: CurveAffine> {
@@ -170,17 +171,17 @@ impl<C: CurveAffine> Evaluated<C> {
         let x_next = vk.domain.rotate_omega(*x, Rotation::next());
 
         iter::empty()
-            .chain(Some(VerifierQuery::new_commitment(
+            .chain(Some(VerifierQuery::new_general_commitment(
                 &self.committed.phi_commitment,
                 *x,
                 self.phi_eval,
             )))
-            .chain(Some(VerifierQuery::new_commitment(
+            .chain(Some(VerifierQuery::new_general_commitment(
                 &self.committed.phi_commitment,
                 x_next,
                 self.phi_next_eval,
             )))
-            .chain(Some(VerifierQuery::new_commitment(
+            .chain(Some(VerifierQuery::new_general_commitment(
                 &self.committed.prepared.m_commitment,
                 *x,
                 self.m_eval,

halo2_proofs/src/plonk/permutation.rs

@@ -17,6 +17,7 @@ pub(crate) mod verifier;
 
 pub use keygen::Assembly;
 
+use crate::poly::commitment::{Commitment, CommitmentItem};
 use std::io;
 
 /// A permutation argument.
@@ -84,18 +85,21 @@ impl Argument {
 /// The verifying key for a single permutation argument.
 #[derive(Debug, Clone)]
 pub struct VerifyingKey<C: CurveAffine> {
-    pub commitments: Vec<C>,
+    // hash-based: merkle cap of tree built from permutation sigma polys
+    // pairing-based: ec points
+    pub commitments: Commitment<C>,
 }
 
 impl<C: CurveAffine> VerifyingKey<C> {
     /// Returns commitments of sigma polynomials
-    pub fn commitments(&self) -> &Vec<C> {
+    pub fn commitments(&self) -> &Vec<CommitmentItem<C::Scalar, C>> {
         &self.commitments
     }
 
     pub(crate) fn write<W: io::Write>(&self, writer: &mut W, format: SerdeFormat) -> io::Result<()>
     where
         C: SerdeCurveAffine,
+        C::Scalar: SerdePrimeField,
     {
         for commitment in &self.commitments {
             commitment.write(writer, format)?;

halo2_proofs/src/plonk/permutation/verifier.rs

@@ -3,6 +3,7 @@ use std::iter;
 
 use super::super::{circuit::Any, ChallengeBeta, ChallengeGamma, ChallengeX};
 use super::{Argument, VerifyingKey};
+use crate::poly::commitment::CommitmentItem;
 use crate::{
     arithmetic::CurveAffine,
     plonk::{self, Error},
@@ -12,12 +13,12 @@ use crate::{
 
 #[derive(Debug)]
 pub struct Committed<C: CurveAffine> {
-    permutation_product_commitments: Vec<C>,
+    permutation_product_commitments: Vec<CommitmentItem<C::Scalar, C>>,
 }
 
 #[derive(Debug)]
 pub struct EvaluatedSet<C: CurveAffine> {
-    pub permutation_product_commitment: C,
+    pub permutation_product_commitment: Vec<CommitmentItem<C::Scalar, C>>,
     pub permutation_product_eval: C::Scalar,
     pub permutation_product_next_eval: C::Scalar,
     pub permutation_product_last_eval: Option<C::Scalar>,
@@ -221,20 +222,20 @@ impl<C: CurveAffine> Evaluated<C> {
                 iter::empty()
                     // Open permutation product commitments at x and \omega^{-1} x
                     // Open permutation product commitments at x and \omega x
-                    .chain(Some(VerifierQuery::new_commitment(
+                    .chain(Some(VerifierQuery::new_general_commitment(
                         &set.permutation_product_commitment,
                         *x,
                         set.permutation_product_eval,
                     )))
-                    .chain(Some(VerifierQuery::new_commitment(
+                    .chain(Some(VerifierQuery::new_general_commitment(
                         &set.permutation_product_commitment,
                         x_next,
                         set.permutation_product_next_eval,
                     )))
             }))
             // Open it at \omega^{last} x for all but the last set
             .chain(self.sets.iter().rev().skip(1).flat_map(move |set| {
-                Some(VerifierQuery::new_commitment(
+                Some(VerifierQuery::new_general_commitment(
                     &set.permutation_product_commitment,
                     x_last,
                     set.permutation_product_last_eval.unwrap(),
@@ -250,9 +251,21 @@ impl<C: CurveAffine> CommonEvaluated<C> {
         x: ChallengeX<C>,
     ) -> impl Iterator<Item = VerifierQuery<'r, C, M>> + Clone {
         // Open permutation commitments for each permutation argument at x
-        vkey.commitments
-            .iter()
-            .zip(self.permutation_evals.iter())
-            .map(move |(commitment, &eval)| VerifierQuery::new_commitment(commitment, *x, eval))
+        let ret = if cfg!(fri) {
+            self.permutation_evals
+                .iter()
+                .map(|&eval| {
+                    VerifierQuery::new_general_commitment(vkey.commitments.as_slice(), *x, eval)
+                })
+                .collect::<Vec<_>>()
+        } else {
+            vkey.commitments
+                .iter()
+                .zip(self.permutation_evals.iter())
+                .map(move |(commitment, &eval)| VerifierQuery::new_commitment(commitment, *x, eval))
+                .collect::<Vec<_>>()
+        };
+
+        ret.into_iter()
     }
 }

halo2_proofs/src/plonk/shuffle/prover.rs

@@ -14,6 +14,7 @@ use crate::{
 use ff::WithSmallOrderMulGroup;
 use group::{ff::BatchInvert, Curve};
 use rand_core::RngCore;
+use std::ops::Deref;
 use std::{
     iter,
     ops::{Mul, MulAssign},
@@ -187,7 +188,10 @@ impl<F: WithSmallOrderMulGroup<3>> Argument<F> {
         }
 
         let product_blind = Blind(C::Scalar::random(rng));
-        let product_commitment = params.commit_lagrange(&z, product_blind).to_affine();
+        let product_commitment = params.commit_lagrange(&z, product_blind)[0]
+            .deref()
+            .unwrap()
+            .to_affine();
         let z = pk.vk.domain.lagrange_to_coeff(z);
 
         // Hash product commitment

halo2_proofs/src/plonk/shuffle/verifier.rs

@@ -1,7 +1,9 @@
+use std::io::Read;
 use std::iter;
 
 use super::super::{circuit::Expression, ChallengeGamma, ChallengeTheta, ChallengeX};
 use super::Argument;
+use crate::poly::commitment::Commitment;
 use crate::{
     arithmetic::CurveAffine,
     plonk::{Error, VerifyingKey},
@@ -11,7 +13,7 @@ use crate::{
 use ff::Field;
 
 pub struct Committed<C: CurveAffine> {
-    product_commitment: C,
+    product_commitment: Commitment<C>,
 }
 
 pub struct Evaluated<C: CurveAffine> {
@@ -31,7 +33,9 @@ impl<F: Field> Argument<F> {
     ) -> Result<Committed<C>, Error> {
         let product_commitment = transcript.read_point()?;
 
-        Ok(Committed { product_commitment })
+        Ok(Committed {
+            product_commitment: vec![product_commitment.into()],
+        })
     }
 }
 
@@ -121,18 +125,32 @@ impl<C: CurveAffine> Evaluated<C> {
     ) -> impl Iterator<Item = VerifierQuery<'r, C, M>> + Clone {
         let x_next = vk.domain.rotate_omega(*x, Rotation::next());
 
-        iter::empty()
-            // Open shuffle product commitment at x
-            .chain(Some(VerifierQuery::new_commitment(
-                &self.committed.product_commitment,
-                *x,
-                self.product_eval,
-            )))
-            // Open shuffle product commitment at \omega x
-            .chain(Some(VerifierQuery::new_commitment(
-                &self.committed.product_commitment,
-                x_next,
-                self.product_next_eval,
-            )))
+        if cfg!(fri) {
+            iter::empty()
+                // Open shuffle product commitment at x
+                .chain(Some(VerifierQuery::new_general_commitment(
+                    &self.committed.product_commitment,
+                    *x,
+                    self.product_eval,
+                )))
+                // Open shuffle product commitment at \omega x
+                .chain(Some(VerifierQuery::new_general_commitment(
+                    &self.committed.product_commitment,
+                    x_next,
+                    self.product_next_eval,
+                )))
+        } else {
+            iter::empty()
+                .chain(Some(VerifierQuery::new_commitment(
+                    &self.committed.product_commitment[0],
+                    *x,
+                    self.product_eval,
+                )))
+                .chain(Some(VerifierQuery::new_commitment(
+                    &self.committed.product_commitment[0],
+                    x_next,
+                    self.product_next_eval,
+                )))
+        }
     }
 }