arkworks-rs · npwardberkeley · Oct 20, 2020 · Oct 20, 2020 · Oct 26, 2020 · Oct 27, 2020
diff --git a/Cargo.toml b/Cargo.toml
@@ -20,27 +20,34 @@ license = "MIT/Apache-2.0"
 edition = "2018"
 
 [dependencies]
-ark-serialize = { git = "https://github.com/arkworks-rs/algebra", default-features = false, features = [ "derive" ] }
-ark-ff = { git = "https://github.com/arkworks-rs/algebra", default-features = false }
-ark-std = { git = "https://github.com/arkworks-rs/utils", default-features = false }
-ark-poly = { git = "https://github.com/arkworks-rs/algebra", default-features = false }
-ark-relations = { git = "https://github.com/arkworks-rs/snark", default-features = false }
-ark-poly-commit = { git = "https://github.com/arkworks-rs/poly-commit", default-features = false }
-bench-utils = { git = "https://github.com/arkworks-rs/utils", default-features = false }
+ark-serialize = { version = "^0.2.0", default-features = false, features = [ "derive" ] }
+ark-ff = { version = "^0.2.0", default-features = false }
+ark-std = { version = "^0.2.0", default-features = false }
+ark-poly = { version = "^0.2.0", default-features = false }
+ark-relations = { version = "^0.2.0", default-features = false }
+ark-poly-commit = { git = "https://github.com/arkworks-rs/poly-commit", branch = "constraints", default-features = false, features = [ "r1cs" ] }
 
-rand_core = { version = "0.5" }
 rand_chacha = { version = "0.2.1", default-features = false }
 rayon = { version = "1", optional = true }
 digest = { version = "0.9" }
 derivative = { version = "2", features = ["use_core"] }
 
+ark-ec = { version = "^0.2.0", default-features = false }
+ark-crypto-primitives = { version = "^0.2.0", default-features = false, features = [ "r1cs" ] }
+ark-r1cs-std = { version = "^0.2.0", default-features = false }
+ark-nonnative-field = { version = "^0.2.0", default-features = false }
+ark-snark = { version = "^0.2.0", default-features = false }
+hashbrown = "0.9"
+tracing = { version = "0.1", default-features = false, features = [ "attributes" ] }
+tracing-subscriber = { version = "0.2", default-features = false, optional = true }
+
 [dev-dependencies]
 blake2 = { version = "0.9", default-features = false }
-ark-bls12-381 = { git = "https://github.com/arkworks-rs/curves", default-features = false, features = [ "curve" ] }
-ark-mnt4-298 = { git = "https://github.com/arkworks-rs/curves", default-features = false, features = ["r1cs", "curve"] }
-ark-mnt6-298 = { git = "https://github.com/arkworks-rs/curves", default-features = false, features = ["r1cs"] }
-ark-mnt4-753 = { git = "https://github.com/arkworks-rs/curves", default-features = false, features = ["r1cs", "curve"] }
-ark-mnt6-753 = { git = "https://github.com/arkworks-rs/curves", default-features = false, features = ["r1cs"] }
+ark-bls12-381 = { version = "^0.2.0", default-features = false, features = [ "curve" ] }
+ark-mnt4-298 = { version = "^0.2.0", default-features = false, features = ["r1cs", "curve"] }
+ark-mnt6-298 = { version = "^0.2.0", default-features = false, features = ["r1cs"] }
+ark-mnt4-753 = { version = "^0.2.0", default-features = false, features = ["r1cs", "curve"] }
+ark-mnt6-753 = { version = "^0.2.0", default-features = false, features = ["r1cs"] }
 
 [profile.release]
 opt-level = 3
@@ -61,8 +68,8 @@ panic = 'abort'
 
 [features]
 default = ["std", "parallel"]
-std = [ "ark-ff/std", "ark-poly/std", "ark-relations/std", "ark-std/std", "ark-serialize/std", "ark-poly-commit/std" ]
-print-trace = [ "bench-utils/print-trace" ]
+std = [ "ark-crypto-primitives/std", "tracing-subscriber", "ark-ff/std", "ark-nonnative-field/std", "ark-poly/std", "ark-relations/std", "ark-std/std", "ark-serialize/std", "ark-poly-commit/std" ]
+print-trace = [ "ark-std/print-trace" ]
 parallel = [ "std", "ark-ff/parallel", "ark-poly/parallel", "ark-std/parallel", "ark-poly-commit/parallel", "rayon" ]
 
 [[bench]]

diff --git a/benches/bench.rs b/benches/bench.rs
@@ -2,13 +2,15 @@
 //     RAYON_NUM_THREADS=N cargo bench --no-default-features --features "std parallel" -- --nocapture
 // where N is the number of threads you want to use (N = 1 for single-thread).
 
-use ark_bls12_381::{Bls12_381, Fr as BlsFr};
+use ark_bls12_381::{Bls12_381, Fq as BlsFq, Fr as BlsFr};
 use ark_ff::PrimeField;
+use ark_marlin::fiat_shamir::FiatShamirChaChaRng;
 use ark_marlin::Marlin;
-use ark_mnt4_298::{Fr as MNT4Fr, MNT4_298};
-use ark_mnt4_753::{Fr as MNT4BigFr, MNT4_753};
-use ark_mnt6_298::{Fr as MNT6Fr, MNT6_298};
-use ark_mnt6_753::{Fr as MNT6BigFr, MNT6_753};
+use ark_marlin::MarlinDefaultConfig;
+use ark_mnt4_298::{Fq as MNT4Fq, Fr as MNT4Fr, MNT4_298};
+use ark_mnt4_753::{Fq as MNT4BigFq, Fr as MNT4BigFr, MNT4_753};
+use ark_mnt6_298::{Fq as MNT6Fq, Fr as MNT6Fr, MNT6_298};
+use ark_mnt6_753::{Fq as MNT6BigFq, Fr as MNT6BigFr, MNT6_753};
 use ark_poly::univariate::DensePolynomial;
 use ark_poly_commit::marlin_pc::MarlinKZG10;
 use ark_relations::{
@@ -66,7 +68,7 @@ impl<F: PrimeField> ConstraintSynthesizer<F> for DummyCircuit<F> {
 }
 
 macro_rules! marlin_prove_bench {
-    ($bench_name:ident, $bench_field:ty, $bench_pairing_engine:ty) => {
+    ($bench_name:ident, $bench_field:ty, $base_field:ty, $bench_pairing_engine:ty) => {
         let rng = &mut ark_std::test_rng();
         let c = DummyCircuit::<$bench_field> {
             a: Some(<$bench_field>::rand(rng)),
@@ -77,14 +79,18 @@ macro_rules! marlin_prove_bench {
 
         let srs = Marlin::<
             $bench_field,
+            $base_field,
             MarlinKZG10<$bench_pairing_engine, DensePolynomial<$bench_field>>,
-            Blake2s,
+            FiatShamirChaChaRng<$bench_field, $base_field, Blake2s>,
+            MarlinDefaultConfig,
         >::universal_setup(65536, 65536, 65536, rng)
         .unwrap();
         let (pk, _) = Marlin::<
             $bench_field,
+            $base_field,
             MarlinKZG10<$bench_pairing_engine, DensePolynomial<$bench_field>>,
-            Blake2s,
+            FiatShamirChaChaRng<$bench_field, $base_field, Blake2s>,
+            MarlinDefaultConfig,
         >::index(&srs, c)
         .unwrap();
 
@@ -93,8 +99,10 @@ macro_rules! marlin_prove_bench {
         for _ in 0..NUM_PROVE_REPEATITIONS {
             let _ = Marlin::<
                 $bench_field,
+                $base_field,
                 MarlinKZG10<$bench_pairing_engine, DensePolynomial<$bench_field>>,
-                Blake2s,
+                FiatShamirChaChaRng<$bench_field, $base_field, Blake2s>,
+                MarlinDefaultConfig,
             >::prove(&pk, c.clone(), rng)
             .unwrap();
         }
@@ -108,7 +116,7 @@ macro_rules! marlin_prove_bench {
 }
 
 macro_rules! marlin_verify_bench {
-    ($bench_name:ident, $bench_field:ty, $bench_pairing_engine:ty) => {
+    ($bench_name:ident, $bench_field:ty, $base_field:ty, $bench_pairing_engine:ty) => {
         let rng = &mut ark_std::test_rng();
         let c = DummyCircuit::<$bench_field> {
             a: Some(<$bench_field>::rand(rng)),
@@ -119,20 +127,26 @@ macro_rules! marlin_verify_bench {
 
         let srs = Marlin::<
             $bench_field,
+            $base_field,
             MarlinKZG10<$bench_pairing_engine, DensePolynomial<$bench_field>>,
-            Blake2s,
+            FiatShamirChaChaRng<$bench_field, $base_field, Blake2s>,
+            MarlinDefaultConfig,
         >::universal_setup(65536, 65536, 65536, rng)
         .unwrap();
         let (pk, vk) = Marlin::<
             $bench_field,
+            $base_field,
             MarlinKZG10<$bench_pairing_engine, DensePolynomial<$bench_field>>,
-            Blake2s,
+            FiatShamirChaChaRng<$bench_field, $base_field, Blake2s>,
+            MarlinDefaultConfig,
         >::index(&srs, c)
         .unwrap();
         let proof = Marlin::<
             $bench_field,
+            $base_field,
             MarlinKZG10<$bench_pairing_engine, DensePolynomial<$bench_field>>,
-            Blake2s,
+            FiatShamirChaChaRng<$bench_field, $base_field, Blake2s>,
+            MarlinDefaultConfig,
         >::prove(&pk, c.clone(), rng)
         .unwrap();
 
@@ -143,9 +157,11 @@ macro_rules! marlin_verify_bench {
         for _ in 0..NUM_VERIFY_REPEATITIONS {
             let _ = Marlin::<
                 $bench_field,
+                $base_field,
                 MarlinKZG10<$bench_pairing_engine, DensePolynomial<$bench_field>>,
-                Blake2s,
-            >::verify(&vk, &vec![v], &proof, rng)
+                FiatShamirChaChaRng<$bench_field, $base_field, Blake2s>,
+                MarlinDefaultConfig,
+            >::verify(&vk, &vec![v], &proof)
             .unwrap();
         }
 
@@ -158,19 +174,19 @@ macro_rules! marlin_verify_bench {
 }
 
 fn bench_prove() {
-    marlin_prove_bench!(bls, BlsFr, Bls12_381);
-    marlin_prove_bench!(mnt4, MNT4Fr, MNT4_298);
-    marlin_prove_bench!(mnt6, MNT6Fr, MNT6_298);
-    marlin_prove_bench!(mnt4big, MNT4BigFr, MNT4_753);
-    marlin_prove_bench!(mnt6big, MNT6BigFr, MNT6_753);
+    marlin_prove_bench!(bls, BlsFr, BlsFq, Bls12_381);
+    marlin_prove_bench!(mnt4, MNT4Fr, MNT4Fq, MNT4_298);
+    marlin_prove_bench!(mnt6, MNT6Fr, MNT6Fq, MNT6_298);
+    marlin_prove_bench!(mnt4big, MNT4BigFr, MNT4BigFq, MNT4_753);
+    marlin_prove_bench!(mnt6big, MNT6BigFr, MNT6BigFq, MNT6_753);
 }
 
 fn bench_verify() {
-    marlin_verify_bench!(bls, BlsFr, Bls12_381);
-    marlin_verify_bench!(mnt4, MNT4Fr, MNT4_298);
-    marlin_verify_bench!(mnt6, MNT6Fr, MNT6_298);
-    marlin_verify_bench!(mnt4big, MNT4BigFr, MNT4_753);
-    marlin_verify_bench!(mnt6big, MNT6BigFr, MNT6_753);
+    marlin_verify_bench!(bls, BlsFr, BlsFq, Bls12_381);
+    marlin_verify_bench!(mnt4, MNT4Fr, MNT4Fq, MNT4_298);
+    marlin_verify_bench!(mnt6, MNT6Fr, MNT6Fq, MNT6_298);
+    marlin_verify_bench!(mnt4big, MNT4BigFr, MNT4BigFq, MNT4_753);
+    marlin_verify_bench!(mnt6big, MNT6BigFr, MNT6BigFq, MNT6_753);
 }
 
 fn main() {

diff --git a/src/ahp/indexer.rs b/src/ahp/indexer.rs
@@ -38,7 +38,7 @@ pub struct IndexInfo<F> {
     pub num_instance_variables: usize,
 
     #[doc(hidden)]
-    f: PhantomData<F>,
+    pub f: PhantomData<F>,
 }
 
 impl<F: PrimeField> ark_ff::ToBytes for IndexInfo<F> {
@@ -168,7 +168,6 @@ impl<F: PrimeField> AHPForR1CS<F> {
             num_constraints,
             num_non_zero,
             num_instance_variables: num_formatted_input_variables,
-
             f: PhantomData,
         };
 

diff --git a/src/ahp/mod.rs b/src/ahp/mod.rs
@@ -39,6 +39,18 @@ impl<F: PrimeField> AHPForR1CS<F> {
         "c_row", "c_col", "c_val", "c_row_col",
     ];
 
+    #[rustfmt::skip]
+    pub const INDEXER_POLYNOMIALS_WITH_VANISHING: [&'static str; 14] = [
+        // Polynomials for A
+        "a_row", "a_col", "a_val", "a_row_col",
+        // Polynomials for B
+        "b_row", "b_col", "b_val", "b_row_col",
+        // Polynomials for C
+        "c_row", "c_col", "c_val", "c_row_col",
+        // Vanishing polynomials
+        "vanishing_poly_h", "vanishing_poly_k"
+    ];
+
     /// The labels for the polynomials output by the AHP prover.
     #[rustfmt::skip]
     pub const PROVER_POLYNOMIALS: [&'static str; 9] = [
@@ -58,6 +70,13 @@ impl<F: PrimeField> AHPForR1CS<F> {
             .map(|s| s.to_string())
     }
 
+    pub(crate) fn polynomial_labels_with_vanishing() -> impl Iterator<Item = String> {
+        Self::INDEXER_POLYNOMIALS_WITH_VANISHING
+            .iter()
+            .chain(&Self::PROVER_POLYNOMIALS)
+            .map(|s| s.to_string())
+    }
+
     /// Check that the (formatted) public input is of the form 2^n for some integer n.
     pub fn num_formatted_public_inputs_is_admissible(num_inputs: usize) -> bool {
         num_inputs.count_ones() == 1
@@ -115,6 +134,7 @@ impl<F: PrimeField> AHPForR1CS<F> {
         public_input: &[F],
         evals: &E,
         state: &verifier::VerifierState<F>,
+        with_vanishing: bool,
     ) -> Result<Vec<LinearCombination<F>>, Error>
     where
         E: EvaluationsProvider<F>,
@@ -178,6 +198,7 @@ impl<F: PrimeField> AHPForR1CS<F> {
                 (-beta * g_1_at_beta, LCTerm::One),
             ],
         );
+
         debug_assert!(evals.get_lc_eval(&outer_sumcheck, beta)?.is_zero());
 
         linear_combinations.push(z_b);
@@ -252,6 +273,25 @@ impl<F: PrimeField> AHPForR1CS<F> {
         linear_combinations.push(c_denom);
         linear_combinations.push(inner_sumcheck);
 
+        if with_vanishing {
+            let vanishing_poly_h_alpha = LinearCombination::new(
+                "vanishing_poly_h_alpha",
+                vec![(F::one(), "vanishing_poly_h")],
+            );
+            let vanishing_poly_h_beta = LinearCombination::new(
+                "vanishing_poly_h_beta",
+                vec![(F::one(), "vanishing_poly_h")],
+            );
+            let vanishing_poly_k_gamma = LinearCombination::new(
+                "vanishing_poly_k_gamma",
+                vec![(F::one(), "vanishing_poly_k")],
+            );
+
+            linear_combinations.push(vanishing_poly_h_alpha);
+            linear_combinations.push(vanishing_poly_h_beta);
+            linear_combinations.push(vanishing_poly_k_gamma);
+        }
+
         linear_combinations.sort_by(|a, b| a.label.cmp(&b.label));
         Ok(linear_combinations)
     }
@@ -285,10 +325,9 @@ impl<F: Field, T: Borrow<LabeledPolynomial<F>>> EvaluationsProvider<F> for Vec<T
                         let p: &LabeledPolynomial<F> = (*p).borrow();
                         p.label() == label
                     })
-                    .ok_or(Error::MissingEval(format!(
-                        "Missing {} for {}",
-                        label, lc.label
-                    )))?
+                    .ok_or_else(|| {
+                        Error::MissingEval(format!("Missing {} for {}", label, lc.label))
+                    })?
                     .borrow()
                     .evaluate(&point)
             } else {

diff --git a/src/ahp/prover.rs b/src/ahp/prover.rs
@@ -17,11 +17,11 @@ use ark_relations::r1cs::{
     ConstraintSynthesizer, ConstraintSystem, OptimizationGoal, SynthesisError,
 };
 use ark_serialize::{CanonicalDeserialize, CanonicalSerialize, SerializationError};
+use ark_std::rand::RngCore;
 use ark_std::{
     cfg_into_iter, cfg_iter, cfg_iter_mut,
     io::{Read, Write},
 };
-use rand_core::RngCore;
 
 /// State for the AHP prover.
 pub struct ProverState<'a, F: PrimeField> {
@@ -222,7 +222,7 @@ impl<F: PrimeField> AHPForR1CS<F> {
         });
         c.generate_constraints(pcs.clone())?;
         end_timer!(constraint_time);
-
+        assert!(pcs.is_satisfied().unwrap());
         let padding_time = start_timer!(|| "Padding matrices to make them square");
         pad_input_for_indexer_and_prover(pcs.clone());
         pcs.finalize();
@@ -309,6 +309,7 @@ impl<F: PrimeField> AHPForR1CS<F> {
     pub fn prover_first_round<'a, R: RngCore>(
         mut state: ProverState<'a, F>,
         rng: &mut R,
+        hiding: bool,
     ) -> Result<(ProverMsg<F>, ProverFirstOracles<F>, ProverState<'a, F>), Error> {
         let round_time = start_timer!(|| "AHP::Prover::FirstRound");
         let domain_h = state.domain_h;
@@ -380,11 +381,21 @@ impl<F: PrimeField> AHPForR1CS<F> {
         assert!(z_b_poly.degree() < domain_h.size() + zk_bound);
         assert!(mask_poly.degree() <= 3 * domain_h.size() + 2 * zk_bound - 3);
 
-        let w = LabeledPolynomial::new("w".to_string(), w_poly, None, Some(1));
-        let z_a = LabeledPolynomial::new("z_a".to_string(), z_a_poly, None, Some(1));
-        let z_b = LabeledPolynomial::new("z_b".to_string(), z_b_poly, None, Some(1));
-        let mask_poly =
-            LabeledPolynomial::new("mask_poly".to_string(), mask_poly.clone(), None, None);
+        let (w, z_a, z_b) = if hiding {
+            (
+                LabeledPolynomial::new("w".to_string(), w_poly, None, Some(1)),
+                LabeledPolynomial::new("z_a".to_string(), z_a_poly, None, Some(1)),
+                LabeledPolynomial::new("z_b".to_string(), z_b_poly, None, Some(1)),
+            )
+        } else {
+            (
+                LabeledPolynomial::new("w".to_string(), w_poly, None, None),
+                LabeledPolynomial::new("z_a".to_string(), z_a_poly, None, None),
+                LabeledPolynomial::new("z_b".to_string(), z_b_poly, None, None),
+            )
+        };
+
+        let mask_poly = LabeledPolynomial::new("mask_poly".to_string(), mask_poly, None, None);
 
         let oracles = ProverFirstOracles {
             w: w.clone(),
@@ -437,6 +448,7 @@ impl<F: PrimeField> AHPForR1CS<F> {
         ver_message: &VerifierFirstMsg<F>,
         mut state: ProverState<'a, F>,
         _r: &mut R,
+        hiding: bool,
     ) -> (ProverMsg<F>, ProverSecondOracles<F>, ProverState<'a, F>) {
         let round_time = start_timer!(|| "AHP::Prover::SecondRound");
 
@@ -549,10 +561,18 @@ impl<F: PrimeField> AHPForR1CS<F> {
         assert!(g_1.degree() <= domain_h.size() - 2);
         assert!(h_1.degree() <= 2 * domain_h.size() + 2 * zk_bound - 2);
 
-        let oracles = ProverSecondOracles {
-            t: LabeledPolynomial::new("t".into(), t_poly, None, None),
-            g_1: LabeledPolynomial::new("g_1".into(), g_1, Some(domain_h.size() - 2), Some(1)),
-            h_1: LabeledPolynomial::new("h_1".into(), h_1, None, None),
+        let oracles = if hiding {
+            ProverSecondOracles {
+                t: LabeledPolynomial::new("t".into(), t_poly, None, None),
+                g_1: LabeledPolynomial::new("g_1".into(), g_1, Some(domain_h.size() - 2), Some(1)),
+                h_1: LabeledPolynomial::new("h_1".into(), h_1, None, None),
+            }
+        } else {
+            ProverSecondOracles {
+                t: LabeledPolynomial::new("t".into(), t_poly, None, None),
+                g_1: LabeledPolynomial::new("g_1".into(), g_1, Some(domain_h.size() - 2), None),
+                h_1: LabeledPolynomial::new("h_1".into(), h_1, None, None),
+            }
         };
 
         state.w_poly = None;