Batch proof

Cargo.toml

@@ -2,7 +2,7 @@
 resolver = "2"
 members = [
 #    "evm-vrfier",
-#    "pasta-tree",
+    "pasta-tree",
     "w3f-plonk-common",
     "w3f-ring-proof",
 #    "w3f-ring-vrf-snark",
@@ -20,7 +20,7 @@ ark-ff = { version = "0.6", default-features = false }
 ark-ec = { version = "0.6", default-features = false }
 ark-poly = { version = "0.6", default-features = false }
 ark-serialize = { version = "0.6", default-features = false, features = ["derive"] }
-w3f-pcs = { version = "0.0.7", default-features = false }
+w3f-pcs = { version = "0.0.6", git = "https://github.com/paritytech/fflonk/", branch = "ipa-pcs", default-features = false }
 w3f-plonk-common = { version = "0.0.10", path = "w3f-plonk-common", default-features = false }
 rayon = { version = "1", default-features = false }
 ark-transcript = { version = "0.0.6", default-features = false }

pasta-tree/src/auth_path/node.rs

@@ -77,7 +77,7 @@ impl<G: CurveModel> LevelWitness<AffinePoint<G>> {
 }
 
 /// NB! It is not "blinded", meaning that the blinding factor hasn't been applied.
-#[derive(Clone)]
+#[derive(Clone, Debug)]
 pub struct LevelWitnessWithBlinding<G: AffineRepr> {
     pub(crate) level_witness: LevelWitness<G>,
     /// the verifier gets `Ci' = siblings[i] + bf.H`

pasta-tree/src/auth_path/path.rs

@@ -13,6 +13,7 @@ use ark_std::rand::Rng;
 /// `path_0[0]` contains the leaf (with its siblings).
 /// `commit(path_0[k].siblings) = path_1[k].siblings[path_1[k].i]`, if `path_1[k]` exists,
 /// otherwise it's the root.
+#[derive(Clone, Debug)]
 pub struct AuthenticationPath<C0: CurveGroup, C1: CurveGroup> {
     /// Nodes on the `C0` curve.
     pub c0_path: Vec<LevelWitness<C0::Affine>>,

pasta-tree/src/circuit_fat/params.rs

@@ -9,6 +9,7 @@ use ark_ff::{AdditiveGroup, BigInteger, PrimeField, Zero};
 use ark_std::{vec, vec::Vec};
 use w3f_pcs::pcs::commitment::WrappedAffine;
 use w3f_plonk_common::FieldColumn;
+use w3f_plonk_common::cond_select::CondSelect;
 use w3f_plonk_common::domain::Domain;
 use w3f_plonk_common::gadgets::booleanity::BitColumn;
 use w3f_plonk_common::gadgets::ec::AffineColumn;
@@ -29,6 +30,8 @@ pub struct PiopParams<G: AffineRepr<BaseField: PrimeField>> {
 
 impl<C: CurveGroup, G: CurveModel<BaseField = C::ScalarField>> CircuitParams<C, G>
     for PiopParams<AffinePoint<G>>
+where
+    G::BaseField: CondSelect,
 {
     type Commitments = crate::circuit_fat::ProofComms<C>;
     type Evaluations = crate::circuit_fat::ProofEvals<C::ScalarField>;
@@ -86,7 +89,10 @@ impl<C: CurveGroup, G: CurveModel<BaseField = C::ScalarField>> CircuitParams<C,
     }
 }
 
-impl<G: AffineRepr<BaseField: PrimeField>> PiopParams<G> {
+impl<G: AffineRepr<BaseField: PrimeField>> PiopParams<G>
+where
+    G::BaseField: CondSelect,
+{
     pub fn setup(domain: Domain<G::BaseField>, h: G) -> Self {
         let scalar_bitlen = G::ScalarField::MODULUS_BIT_SIZE as usize;
         Self {

pasta-tree/src/circuit_fat/prover.rs

@@ -11,6 +11,7 @@ use ark_poly::univariate::DensePolynomial;
 use ark_std::{vec, vec::Vec};
 use w3f_pcs::pcs::commitment::WrappedAffine;
 use w3f_plonk_common::FieldColumn;
+use w3f_plonk_common::cond_select::CondSelect;
 use w3f_plonk_common::domain::Domain;
 use w3f_plonk_common::gadgets::ProverGadget;
 use w3f_plonk_common::gadgets::booleanity::{BitColumn, Booleanity};
@@ -41,7 +42,10 @@ pub struct PiopProver<G: AffineRepr<BaseField: FftField>> {
     result: G,
 }
 
-impl<G: CurveModel<BaseField: PrimeField>> PiopProver<AffinePoint<G>> {
+impl<G: CurveModel<BaseField: PrimeField>> PiopProver<AffinePoint<G>>
+where
+    G::BaseField: CondSelect,
+{
     pub fn build(
         params: &PiopParams<AffinePoint<G>>,
         level: LevelWitnessWithBlinding<AffinePoint<G>>,
@@ -195,6 +199,8 @@ impl<G: CurveModel<BaseField: PrimeField>> PiopProver<AffinePoint<G>> {
 
 impl<C: CurveGroup, G: CurveModel<BaseField = C::ScalarField>>
     ProverPiop<C::ScalarField, WrappedAffine<C>> for PiopProver<AffinePoint<G>>
+where
+    G::BaseField: CondSelect,
 {
     const N_COLUMNS: usize = 9;
     const N_CONSTRAINTS: usize = 13;

pasta-tree/src/circuit_fat/verifier.rs

@@ -99,6 +99,7 @@ impl<C: CurveGroup, G: CurveModel<BaseField = C::ScalarField>>
 {
     const N_COLUMNS: usize = 9;
     const N_CONSTRAINTS: usize = 13;
+    type Instance = AffinePoint<G>;
 
     fn precommitted_columns(&self) -> Vec<WrappedAffine<C>> {
         vec![

pasta-tree/src/circuit_tall/params.rs

@@ -9,6 +9,7 @@ use ark_ff::{FftField, One};
 use ark_std::{vec, vec::Vec};
 use w3f_pcs::pcs::commitment::WrappedAffine;
 use w3f_plonk_common::FieldColumn;
+use w3f_plonk_common::cond_select::CondSelect;
 use w3f_plonk_common::domain::Domain;
 use w3f_plonk_common::gadgets::booleanity::BitColumn;
 use w3f_plonk_common::gadgets::ec::AffineColumn;
@@ -35,6 +36,8 @@ pub struct PiopParams<G: AffineRepr<BaseField: FftField>> {
 
 impl<C: CurveGroup, G: CurveModel<BaseField = C::ScalarField>> CircuitParams<C, G>
     for PiopParams<AffinePoint<G>>
+where
+    G::BaseField: CondSelect,
 {
     type Commitments = crate::circuit_tall::ProofComms<C>;
     type Evaluations = crate::circuit_tall::ProofEvals<C::ScalarField>;
@@ -106,7 +109,10 @@ impl<C: CurveGroup, G: CurveModel<BaseField = C::ScalarField>> CircuitParams<C,
     }
 }
 
-impl<G: AffineRepr<BaseField: FftField>> PiopParams<G> {
+impl<G: AffineRepr<BaseField: FftField>> PiopParams<G>
+where
+    G::BaseField: CondSelect,
+{
     pub fn setup(domain: Domain<G::BaseField>, h: G, seed: G) -> Self {
         assert!(domain.domain_size() > 256);
         let actual_capacity = domain.capacity - 1;

pasta-tree/src/circuit_tall/prover.rs

@@ -10,6 +10,7 @@ use ark_poly::univariate::DensePolynomial;
 use ark_std::{vec, vec::Vec};
 use w3f_pcs::pcs::commitment::WrappedAffine;
 use w3f_plonk_common::FieldColumn;
+use w3f_plonk_common::cond_select::CondSelect;
 use w3f_plonk_common::domain::Domain;
 use w3f_plonk_common::gadgets::ProverGadget;
 use w3f_plonk_common::gadgets::booleanity::{BitColumn, Booleanity};
@@ -35,7 +36,10 @@ pub struct PiopProver<G: AffineRepr<BaseField: FftField>> {
     result: G,
 }
 
-impl<G: CurveModel<BaseField: FftField>> PiopProver<AffinePoint<G>> {
+impl<G: CurveModel<BaseField: FftField>> PiopProver<AffinePoint<G>>
+where
+    G::BaseField: CondSelect,
+{
     pub fn build(
         params: &PiopParams<AffinePoint<G>>,
         level: LevelWitnessWithBlinding<AffinePoint<G>>,

pasta-tree/src/circuit_tall/verifier.rs

@@ -1,8 +1,8 @@
 use crate::circuit_tall::{ProofComms, ProofEvals};
+use crate::{AffinePoint, CurveModel};
 use ark_ec::AffineRepr;
 use ark_ec::CurveGroup;
 // use ark_ec::short_weierstrass::{Affine as SwAffine, SWCurveConfig};
-use crate::{AffinePoint, CurveModel};
 use ark_ff::{One, Zero};
 use ark_std::marker::PhantomData;
 use ark_std::{vec, vec::Vec};
@@ -99,6 +99,8 @@ impl<C: CurveGroup, G: CurveModel<BaseField = C::ScalarField>>
 {
     const N_COLUMNS: usize = 7;
     const N_CONSTRAINTS: usize = 7;
+    type Instance = AffinePoint<G>;
+    // type Instance = <PiopProver<AffinePoint<G>> as ProverPiop<C::ScalarField, WrappedAffine<C>>>::Instance;
 
     fn precommitted_columns(&self) -> Vec<WrappedAffine<C>> {
         vec![self.points_x.clone(), self.select_part.clone()]

pasta-tree/src/lib.rs

@@ -38,7 +38,7 @@ pub trait CircuitParams<C: CurveGroup, G: CurveModel<BaseField = C::ScalarField>
             Commitments = Self::Commitments,
             Evaluations = Self::Evaluations,
         >;
-    type VerifierCircuit: VerifierPiop<C::ScalarField, WrappedAffine<C>>;
+    type VerifierCircuit: VerifierPiop<C::ScalarField, WrappedAffine<C>, Instance = AffinePoint<G>>;
 
     fn prover_circuit(
         &self,
@@ -95,6 +95,25 @@ type LevelProof<C, G, P> = w3f_plonk_common::PiopProof<
     <P as CircuitParams<C, G>>::Evaluations,
 >;
 
+type BatchLevelProof<C, G, P, const L: usize> = w3f_plonk_common::PiopProof<
+    <C as PrimeGroup>::ScalarField,
+    WrappedAffine<C>,
+    [<P as CircuitParams<C, G>>::Commitments; L],
+    [<P as CircuitParams<C, G>>::Evaluations; L],
+>;
+
+#[derive(Clone, Debug)]
+pub struct BatchSideProof<
+    C: CurveGroup,
+    G: CurveModel<BaseField = C::ScalarField>,
+    P: CircuitParams<C, G>,
+    const L: usize,
+> {
+    piop_proof: BatchLevelProof<C, G, P, L>,
+    pcs_proof: AggregateProof<C::ScalarField, HidingIpa<C>>,
+    todo: Coeffs<C::ScalarField>,
+}
+
 #[derive(Clone)]
 pub struct CycleSideProof<
     C: CurveGroup,
@@ -117,6 +136,18 @@ pub struct CurveTreeProof<
     c1_proof: CycleSideProof<ProjectivePoint<C1>, C0, P1>,
 }
 
+#[derive(Clone, Debug)]
+pub struct CurveTreeProof2<
+    C0: CurveModel,
+    C1: CurveModel<BaseField = C0::ScalarField, ScalarField = C0::BaseField>,
+    P0: CircuitParams<ProjectivePoint<C0>, C1>,
+    P1: CircuitParams<ProjectivePoint<C1>, C0>,
+    const L: usize,
+> {
+    c0_proof: BatchSideProof<ProjectivePoint<C0>, C1, P0, L>,
+    c1_proof: BatchSideProof<ProjectivePoint<C1>, C0, P1, L>,
+}
+
 impl<C: CurveGroup, G: CurveModel<BaseField = C::ScalarField>, P: CircuitParams<C, G>>
     CycleSideParams<C, G, P>
 {
@@ -176,7 +207,7 @@ impl ArkTranscript {
     }
 }
 
-#[derive(Clone)]
+#[derive(Clone, Debug)]
 pub struct Coeffs<F: PrimeField>(F, F);
 impl<F: PrimeField, CS: PCS<F>> ShplonkTranscript<F, CS> for Coeffs<F> {
     fn get_gamma(&mut self) -> F {
@@ -261,14 +292,16 @@ mod tests {
         >(9, 2);
     }
 
+    // cargo test test_circuit_fat --release --features="print-trace" -- --show-output
+    // cargo test test_circuit_fat --release --features="print-trace parallel" -- --show-output
     #[test]
     fn test_circuit_fat() {
         _test_proof::<
             PallasConfig,
             VestaConfig,
             CircuitParamsFat<ark_vesta::Affine>,
             CircuitParamsFat<ark_pallas::Affine>,
-        >(8, 2);
+        >(8, 4);
     }
 
     // cargo test test_bench_curve_tree --release --features="print-trace" -- --show-output --ignored
@@ -349,17 +382,30 @@ mod tests {
                 .pow(height as u32)
                 .to_formatted_string(&Locale::en)
         );
-        let t_prove = start_timer!(|| format!(
-            "Proving CurveTree membership, height={height}, domain={domain_size}, arity={max_nodes}, capacity={}",
-            max_nodes.pow(height as u32)
-        ));
-        let (auth_path, proof) = params.prove(path, rng);
+        let t_prove =
+            start_timer!(|| format!("Proving membership, height={height}, domain={domain_size}"));
+        let (auth_path, proof) = params.prove(path.clone(), rng);
         end_timer!(t_prove);
 
-        let t_verify = start_timer!(|| "Verifying CurveTree membership");
+        let t_verify = start_timer!(|| "Verifying membership");
         let valid = params.verify(auth_path, proof, root);
         end_timer!(t_verify);
         assert!(valid);
+
+        // number of columns for the FAT scheme is hardcoded in batch.rs
+        if height == 4 && log_n == 8 {
+            println!("\n\n");
+            let t_prove = start_timer!(|| format!(
+                "Batch-proving membership, height={height}, domain={domain_size}"
+            ));
+            let (auth_path, proof) = params.batch_prove::<_, 2>(path, rng);
+            end_timer!(t_prove);
+
+            let t_verify = start_timer!(|| "Verifying membership batch-proof");
+            let valid = params.batch_verify::<2>(auth_path, proof, root);
+            end_timer!(t_verify);
+            assert!(valid);
+        }
     }
 
     pub fn random_witness<G: AffineRepr<BaseField: PrimeField>, R: Rng>(