this commits 6K->3K polynomial degree reduction (#17)

Co-authored-by: ltvvlz <[email protected]>
o1-labs · Jan 17, 2020 · adf5c3b · adf5c3b
1 parent 2327c3e
commit adf5c3b
Show file tree

Hide file tree

Showing 8 changed files with 72 additions and 12 deletions.
diff --git a/dlog/circuits/src/compiled.rs b/dlog/circuits/src/compiled.rs
@@ -22,8 +22,10 @@ pub struct Compiled<G: AffineCurve>
     pub col_comm: G,
     pub row_comm: G,
     pub val_comm: G,
+    pub rc_comm: G,
 
     // compiled polynomials and evaluations
+    pub rc      : DensePolynomial<Fr<G>>,
     pub row     : DensePolynomial<Fr<G>>,
     pub col     : DensePolynomial<Fr<G>>,
     pub val     : DensePolynomial<Fr<G>>,
@@ -33,6 +35,7 @@ pub struct Compiled<G: AffineCurve>
     pub row_eval_b: Evaluations<Fr<G>>,
     pub col_eval_b: Evaluations<Fr<G>>,
     pub val_eval_b: Evaluations<Fr<G>>,
+    pub rc_eval_b : Evaluations<Fr<G>>,
 }
 
 impl<G: AffineCurve> Compiled<G>
@@ -85,23 +88,27 @@ impl<G: AffineCurve> Compiled<G>
         let row = row_eval_k.clone().interpolate();
         let col = col_eval_k.clone().interpolate();
         let val = val_eval_k.clone().interpolate();
+        let rc = (&row_eval_k * &col_eval_k).interpolate();
 
         // commit to the index polynomials
         Ok(Compiled::<G>
         {
             constraints,
+            rc_comm: srs.commit_no_degree_bound(&rc)?,
             row_comm: srs.commit_no_degree_bound(&row)?,
             col_comm: srs.commit_no_degree_bound(&col)?,
             val_comm: srs.commit_no_degree_bound(&val)?,
             row_eval_b: Evaluations::<Fr<G>>::from_vec_and_domain(b_group.fft(&row), b_group),
             col_eval_b: Evaluations::<Fr<G>>::from_vec_and_domain(b_group.fft(&col), b_group),
             val_eval_b: Evaluations::<Fr<G>>::from_vec_and_domain(b_group.fft(&val), b_group),
+            rc_eval_b: Evaluations::<Fr<G>>::from_vec_and_domain(b_group.fft(&rc), b_group),
             row_eval_k,
             col_eval_k,
             val_eval_k,
             row,
             col,
             val,
+            rc
         })
     }
 
@@ -114,11 +121,14 @@ impl<G: AffineCurve> Compiled<G>
         oracle2: Fr<G>,
     ) -> Vec<Fr<G>>
     {
-        self.row_eval_b.evals.iter().zip(self.col_eval_b.evals.iter()).map
+        self.row_eval_b.evals.iter().
+            zip(self.col_eval_b.evals.iter()).
+            zip(self.rc_eval_b.evals.iter()).
+            map
         (
-            |(row, col)|
+            |((row, col), rc)|
             {
-                (oracle2 - row) * &(oracle1 - col)
+                oracle2 * &oracle1 - &(oracle1 * &row) - &(oracle2 * &col) + &rc
             }
         ).collect()
     }

diff --git a/dlog/circuits/src/index.rs b/dlog/circuits/src/index.rs
@@ -82,7 +82,7 @@ impl<G: AffineCurve> Index<G>
         (
             EvaluationDomain::<Fr<G>>::new(h_group_size),
             EvaluationDomain::<Fr<G>>::new(k_group_size),
-            EvaluationDomain::<Fr<G>>::new(k_group_size * 6 - 6),
+            EvaluationDomain::<Fr<G>>::new(k_group_size * 3 - 3),
             EvaluationDomain::<Fr<G>>::new(x_group_size),
         )
         {

diff --git a/dlog/protocol/src/prover.rs b/dlog/protocol/src/prover.rs
@@ -28,6 +28,7 @@ pub struct ProofEvaluations<Fr> {
     pub row: [Fr; 3],
     pub col: [Fr; 3],
     pub val: [Fr; 3],
+    pub rc: [Fr; 3],
 }
 
 #[derive(Clone)]
@@ -253,6 +254,12 @@ impl<G: AffineCurve> ProverProof<G>
                         index.compiled[1].val.evaluate(oracles.beta[i]),
                         index.compiled[2].val.evaluate(oracles.beta[i]),
                     ],
+                    rc:
+                    [
+                        index.compiled[0].rc.evaluate(oracles.beta[i]),
+                        index.compiled[1].rc.evaluate(oracles.beta[i]),
+                        index.compiled[2].rc.evaluate(oracles.beta[i]),
+                    ],
                 }
             ).collect::<Vec<_>>();
             [evl[0].clone(), evl[1].clone(), evl[2].clone()]
@@ -303,6 +310,9 @@ impl<G: AffineCurve> ProverProof<G>
                     (index.compiled[0].val.clone(), None),
                     (index.compiled[1].val.clone(), None),
                     (index.compiled[2].val.clone(), None),
+                    (index.compiled[0].rc.clone(), None),
+                    (index.compiled[1].rc.clone(), None),
+                    (index.compiled[2].rc.clone(), None),
                 ],
                 &oracles.beta.to_vec(),
                 oracles.polys,

diff --git a/dlog/protocol/src/verifier.rs b/dlog/protocol/src/verifier.rs
@@ -95,7 +95,13 @@ impl<G: AffineCurve> ProverProof<G>
     {
         let crb: Vec<Fr<G>> = (0..3).map
         (
-            |i| {(oracles.beta[1] - &self.evals[2].row[i]) * &(oracles.beta[0] - &self.evals[2].col[i])}
+            |i|
+            {
+                oracles.beta[1] * &oracles.beta[0] -
+                &(oracles.beta[0] * &self.evals[2].row[i]) -
+                &(oracles.beta[1] * &self.evals[2].col[i]) +
+                &self.evals[2].rc[i]
+            }
         ).collect();
 
         let acc = (0..3).map
@@ -172,7 +178,10 @@ impl<G: AffineCurve> ProverProof<G>
                     (index.compiled[0].val_comm, proof.evals.iter().map(|e| e.val[0]).collect(), None),
                     (index.compiled[1].val_comm, proof.evals.iter().map(|e| e.val[1]).collect(), None),
                     (index.compiled[2].val_comm, proof.evals.iter().map(|e| e.val[2]).collect(), None),
-                ],
+                    (index.compiled[0].rc_comm, proof.evals.iter().map(|e| e.rc[0]).collect(), None),
+                    (index.compiled[1].rc_comm, proof.evals.iter().map(|e| e.rc[1]).collect(), None),
+                    (index.compiled[2].rc_comm, proof.evals.iter().map(|e| e.rc[2]).collect(), None),
+        ],
                 proof.proof
             ));
         }

diff --git a/pairing/circuits/src/compiled.rs b/pairing/circuits/src/compiled.rs
@@ -20,8 +20,10 @@ pub struct Compiled<E: PairingEngine>
     pub col_comm: E::G1Affine,
     pub row_comm: E::G1Affine,
     pub val_comm: E::G1Affine,
+    pub rc_comm: E::G1Affine,
 
     // compiled polynomials and evaluations
+    pub rc      : DensePolynomial<E::Fr>,
     pub row     : DensePolynomial<E::Fr>,
     pub col     : DensePolynomial<E::Fr>,
     pub val     : DensePolynomial<E::Fr>,
@@ -31,6 +33,7 @@ pub struct Compiled<E: PairingEngine>
     pub row_eval_b: Evaluations<E::Fr>,
     pub col_eval_b: Evaluations<E::Fr>,
     pub val_eval_b: Evaluations<E::Fr>,
+    pub rc_eval_b : Evaluations<E::Fr>,
 }
 
 impl<E: PairingEngine> Compiled<E>
@@ -83,23 +86,27 @@ impl<E: PairingEngine> Compiled<E>
         let row = row_eval_k.clone().interpolate();
         let col = col_eval_k.clone().interpolate();
         let val = val_eval_k.clone().interpolate();
+        let rc = (&row_eval_k * &col_eval_k).interpolate();
 
         // commit to the index polynomials
         Ok(Compiled::<E>
         {
             constraints,
+            rc_comm: urs.commit(&rc)?,
             row_comm: urs.commit(&row)?,
             col_comm: urs.commit(&col)?,
             val_comm: urs.commit(&val)?,
             row_eval_b: Evaluations::<E::Fr>::from_vec_and_domain(b_group.fft(&row), b_group),
             col_eval_b: Evaluations::<E::Fr>::from_vec_and_domain(b_group.fft(&col), b_group),
             val_eval_b: Evaluations::<E::Fr>::from_vec_and_domain(b_group.fft(&val), b_group),
+            rc_eval_b: Evaluations::<E::Fr>::from_vec_and_domain(b_group.fft(&rc), b_group),
             row_eval_k,
             col_eval_k,
             val_eval_k,
             row,
             col,
             val,
+            rc
         })
     }
 
@@ -112,11 +119,14 @@ impl<E: PairingEngine> Compiled<E>
         oracle2: E::Fr,
     ) -> Vec<E::Fr>
     {
-        self.row_eval_b.evals.iter().zip(self.col_eval_b.evals.iter()).map
+        self.row_eval_b.evals.iter().
+            zip(self.col_eval_b.evals.iter()).
+            zip(self.rc_eval_b.evals.iter()).
+            map
         (
-            |(row, col)|
+            |((row, col), rc)|
             {
-                (oracle2 - row) * &(oracle1 - col)
+                oracle2 * &oracle1 - &(oracle1 * &row) - &(oracle2 * &col) + &rc
             }
         ).collect()
     }

diff --git a/pairing/circuits/src/index.rs b/pairing/circuits/src/index.rs
@@ -52,7 +52,7 @@ impl<E:PairingEngine> EvaluationDomains<E> {
 
         let h = EvaluationDomain::<E::Fr>::new(h_group_size)?;
         let k = EvaluationDomain::<E::Fr>::new(k_group_size)?;
-        let b = EvaluationDomain::<E::Fr>::new(k_group_size * 6 - 6)?;
+        let b = EvaluationDomain::<E::Fr>::new(k_group_size * 3 - 3)?;
         let x = EvaluationDomain::<E::Fr>::new(x_group_size)?;
 
         Some (EvaluationDomains { h, k, b, x })
@@ -112,6 +112,7 @@ pub struct MatrixValues<A> {
     pub row : A,
     pub col : A,
     pub val : A,
+    pub rc : A,
 }
 
 pub struct VerifierIndex<E: PairingEngine>
@@ -143,6 +144,7 @@ impl<'a, E: PairingEngine> Index<'a, E>
             row: c.row_comm,
             col: c.col_comm,
             val: c.val_comm,
+            rc: c.rc_comm,
         }
     }
 

diff --git a/pairing/protocol/src/prover.rs b/pairing/protocol/src/prover.rs
@@ -25,6 +25,7 @@ pub struct ProofEvaluations<Fr> {
     pub row: [Fr; 3],
     pub col: [Fr; 3],
     pub val: [Fr; 3],
+    pub rc: [Fr; 3],
 }
 
 #[derive(Clone)]
@@ -251,6 +252,12 @@ impl<E: PairingEngine> ProverProof<E>
                 index.compiled[1].val.evaluate(oracles.beta[2]),
                 index.compiled[2].val.evaluate(oracles.beta[2]),
             ],
+            rc:
+            [
+                index.compiled[0].rc.evaluate(oracles.beta[2]),
+                index.compiled[1].rc.evaluate(oracles.beta[2]),
+                index.compiled[2].rc.evaluate(oracles.beta[2]),
+            ],
         };
 
         let x_hat_beta1 = x_hat.evaluate(oracles.beta[0]);
@@ -317,6 +324,9 @@ impl<E: PairingEngine> ProverProof<E>
                     &index.compiled[0].val,
                     &index.compiled[1].val,
                     &index.compiled[2].val,
+                    &index.compiled[0].rc,
+                    &index.compiled[1].rc,
+                    &index.compiled[2].rc,
                 ],
                 oracles.batch,
                 oracles.beta[2]

diff --git a/pairing/protocol/src/verifier.rs b/pairing/protocol/src/verifier.rs
@@ -83,7 +83,13 @@ impl<E: PairingEngine> ProverProof<E>
     {
         let crb: Vec<E::Fr> = (0..3).map
         (
-            |i| {(oracles.beta[1] - &self.evals.row[i]) * &(oracles.beta[0] - &self.evals.col[i])}
+            |i|
+            {
+                oracles.beta[1] * &oracles.beta[0] -
+                &(oracles.beta[0] * &self.evals.row[i]) -
+                &(oracles.beta[1] * &self.evals.col[i]) +
+                &self.evals.rc[i]
+            }
         ).collect();
 
         let acc = (0..3).map
@@ -181,7 +187,10 @@ impl<E: PairingEngine> ProverProof<E>
                     (index.matrix_commitments[0].val, proof.evals.val[0], None),
                     (index.matrix_commitments[1].val, proof.evals.val[1], None),
                     (index.matrix_commitments[2].val, proof.evals.val[2], None),
-                ],
+                    (index.matrix_commitments[0].rc, proof.evals.rc[0], None),
+                    (index.matrix_commitments[1].rc, proof.evals.rc[1], None),
+                    (index.matrix_commitments[2].rc, proof.evals.rc[2], None),
+        ],
                 proof.proof3
             ));
         }