Chunking

[swasilyev]

Standard Plonk, as well as our ring-proof crate uses non hiding version of the KZG commitment scheme. That requires blinding the chunks as described in https://eprint.iacr.org/2024/848, but we don't do chunking in the ring-proof.

For pasta curves i set ZK_ROWS = 2 and assume that every commitment that isn't public is a Pedersen hiding commitment. So the chunks aren't additionally blinded. That makes the quotient fit 3 chunks. The highest constraint degree is deg(c) = 4n - 3 for the conditional affine addition. deg(q) = deg(c) - deg(z), where z(X) = (X^n - 1) / (X - w^{n-1})(X - w^{n-2}), deg(z) = n - 2. So deg(q) = (4n-3) - (n-2) = 3n-1 and q has 3n coefficients.

[davxy]

Few nits to fix no-std build

[davxy]

Suggested change

	println!(
	"Chunking deg {} polynomial into {} chunks",
	q_deg,
	q_chunks.len()
	);

[davxy]

Suggested change

	use ark_std::vec::Vec;
	use ark_std::{vec, vec::Vec};

[davxy]

Suggested change

	use ark_poly::DenseUVPolynomial;
	use ark_poly::DenseUVPolynomial;
	use ark_std::vec::Vec;

[davxy]

IIUC 4 is the number of chunks the commitment quotient is split into for Pasta.
Nit: what about defining a global constant instead of a magic number?
something like: pub const MAX_QUOTIENT_CHUNKS = 4 in the pasta-tree/src/lib.rs?

For what concerns KZG commitment, we stick to 1 chunk, correct?
I.e. we're using the ProverPiop::quotient() default implementation. If so, AFAICT the proof remains backward compat?

[swasilyev]

Thanks for the review, Davide! You're right, currently it's 4, i even assert it elsewhere, but... The highest constraint degree we've is ec_add (no matter sw/te) that is 4n + 3. We also have ZK_ROWS = 3 that makes effective vanishing polynomial degree n - 3. That makes the quotient degree deg(q) = (4n + 3) - (n - 3) = 3n. So the quotient has 3n + 1 coefficients that don't fit into 3 n-sized chunks.

Given that IP commitment is hiding, we can reduce to ZK_ROWS = 2. But chunking requires masking every chunk (see https://eprint.iacr.org/2024/848), that again raises the degree (by 1 i guess). But may be it can be dealt with in monomial form. So it's all a bit undecided right now.

Re KZG, here #84 i've benchmarks that chunking also improves a bit prover time (and, what may be more important, the CRS size) at the price of 2 (or 3) more points in the proof, so we can consider introducing it separately.

[davxy]

Suggested change

	// let (log_n, h) = (9, 2);
	// println!("n = {}, height = {h}, TALL", 1 << log_n);
	// _test_proof::<
	// ark_pallas::Projective,
	// ark_vesta::Projective,
	// CircuitParamsTall<ark_vesta::Affine>,
	// CircuitParamsTall<ark_pallas::Affine>,
	// >(log_n, h);
	// println!();
	// let (log_n, h) = (10, 2);
	// println!("n = {}, height = {h}, TALL", 1 << log_n);
	// _test_proof::<
	// ark_pallas::Projective,
	// ark_vesta::Projective,
	// CircuitParamsTall<ark_vesta::Affine>,
	// CircuitParamsTall<ark_pallas::Affine>,
	// >(log_n, h);
	// println!();