|
1 | 1 | #include "gemini.hpp" |
2 | 2 |
|
3 | | -#include "../commitment_key.test.hpp" |
4 | | -#include "barretenberg/honk/transcript/transcript.hpp" |
| 3 | +#include "barretenberg/proof_system/pcs/commitment_key.test.hpp" |
| 4 | +#include "barretenberg/proof_system/transcript/transcript.hpp" |
5 | 5 | #include "barretenberg/polynomials/polynomial.hpp" |
| 6 | +#include "barretenberg/proof_system/pcs/shplonk/shplonk_single.hpp" |
| 7 | +#include "barretenberg/proof_system/pcs/kzg/kzg.hpp" |
6 | 8 | #include <cstddef> |
7 | 9 | #include <gtest/gtest.h> |
8 | 10 | #include <span> |
@@ -237,4 +239,128 @@ TYPED_TEST(GeminiTest, DoubleWithShift) |
237 | 239 | multilinear_commitments_to_be_shifted); |
238 | 240 | } |
239 | 241 |
|
| 242 | +/** |
| 243 | + * @brief Test full PCS protocol: Gemini, Shplonk, KZG and pairing check |
| 244 | + * @details Demonstrates the full PCS protocol as it is used in the construction and verification |
| 245 | + * of a single Honk proof. (Expository comments included throughout). |
| 246 | + * |
| 247 | + */ |
| 248 | +TYPED_TEST(GeminiTest, GeminiShplonkKzgWithShift) |
| 249 | +{ |
| 250 | + using Shplonk = shplonk::SingleBatchOpeningScheme<TypeParam>; |
| 251 | + using Gemini = gemini::MultilinearReductionScheme<TypeParam>; |
| 252 | + using KZG = kzg::KZG<TypeParam>; |
| 253 | + using Fr = typename TypeParam::Fr; |
| 254 | + using GroupElement = typename TypeParam::GroupElement; |
| 255 | + using Polynomial = typename barretenberg::Polynomial<Fr>; |
| 256 | + |
| 257 | + const size_t n = 16; |
| 258 | + const size_t log_n = 4; |
| 259 | + |
| 260 | + Fr rho = Fr::random_element(); |
| 261 | + |
| 262 | + // Generate multilinear polynomials, their commitments (genuine and mocked) and evaluations (genuine) at a random |
| 263 | + // point. |
| 264 | + const auto mle_opening_point = this->random_evaluation_point(log_n); // sometimes denoted 'u' |
| 265 | + auto poly1 = this->random_polynomial(n); |
| 266 | + auto poly2 = this->random_polynomial(n); |
| 267 | + poly2[0] = Fr::zero(); // this property is required of polynomials whose shift is used |
| 268 | + |
| 269 | + GroupElement commitment1 = this->commit(poly1); |
| 270 | + GroupElement commitment2 = this->commit(poly2); |
| 271 | + |
| 272 | + auto eval1 = poly1.evaluate_mle(mle_opening_point); |
| 273 | + auto eval2 = poly2.evaluate_mle(mle_opening_point); |
| 274 | + auto eval2_shift = poly2.evaluate_mle(mle_opening_point, true); |
| 275 | + |
| 276 | + // Collect multilinear evaluations for input to prover |
| 277 | + std::vector<Fr> multilinear_evaluations = { eval1, eval2, eval2_shift }; |
| 278 | + |
| 279 | + std::vector<Fr> rhos = Gemini::powers_of_rho(rho, multilinear_evaluations.size()); |
| 280 | + |
| 281 | + // Compute batched multivariate evaluation |
| 282 | + Fr batched_evaluation = Fr::zero(); |
| 283 | + for (size_t i = 0; i < rhos.size(); ++i) { |
| 284 | + batched_evaluation += multilinear_evaluations[i] * rhos[i]; |
| 285 | + } |
| 286 | + |
| 287 | + // Compute batched polynomials |
| 288 | + Polynomial batched_unshifted(n); |
| 289 | + Polynomial batched_to_be_shifted(n); |
| 290 | + batched_unshifted.add_scaled(poly1, rhos[0]); |
| 291 | + batched_unshifted.add_scaled(poly2, rhos[1]); |
| 292 | + batched_to_be_shifted.add_scaled(poly2, rhos[2]); |
| 293 | + |
| 294 | + // Compute batched commitments |
| 295 | + GroupElement batched_commitment_unshifted = GroupElement::zero(); |
| 296 | + GroupElement batched_commitment_to_be_shifted = GroupElement::zero(); |
| 297 | + batched_commitment_unshifted = commitment1 * rhos[0] + commitment2 * rhos[1]; |
| 298 | + batched_commitment_to_be_shifted = commitment2 * rhos[2]; |
| 299 | + |
| 300 | + auto prover_transcript = ProverTranscript<Fr>::init_empty(); |
| 301 | + |
| 302 | + // Run the full prover PCS protocol: |
| 303 | + |
| 304 | + // Compute: |
| 305 | + // - (d+1) opening pairs: {r, \hat{a}_0}, {-r^{2^i}, a_i}, i = 0, ..., d-1 |
| 306 | + // - (d+1) Fold polynomials Fold_{r}^(0), Fold_{-r}^(0), and Fold^(i), i = 0, ..., d-1 |
| 307 | + auto fold_polynomials = Gemini::compute_fold_polynomials( |
| 308 | + mle_opening_point, std::move(batched_unshifted), std::move(batched_to_be_shifted)); |
| 309 | + |
| 310 | + for (size_t l = 0; l < log_n - 1; ++l) { |
| 311 | + std::string label = "FOLD_" + std::to_string(l + 1); |
| 312 | + auto commitment = this->ck()->commit(fold_polynomials[l + 2]); |
| 313 | + prover_transcript.send_to_verifier(label, commitment); |
| 314 | + } |
| 315 | + |
| 316 | + const Fr r_challenge = prover_transcript.get_challenge("Gemini:r"); |
| 317 | + |
| 318 | + const auto [gemini_opening_pairs, gemini_witnesses] = |
| 319 | + Gemini::compute_fold_polynomial_evaluations(mle_opening_point, std::move(fold_polynomials), r_challenge); |
| 320 | + |
| 321 | + for (size_t l = 0; l < log_n; ++l) { |
| 322 | + std::string label = "Gemini:a_" + std::to_string(l); |
| 323 | + const auto& evaluation = gemini_opening_pairs[l + 1].evaluation; |
| 324 | + prover_transcript.send_to_verifier(label, evaluation); |
| 325 | + } |
| 326 | + |
| 327 | + // Shplonk prover output: |
| 328 | + // - opening pair: (z_challenge, 0) |
| 329 | + // - witness: polynomial Q - Q_z |
| 330 | + const Fr nu_challenge = prover_transcript.get_challenge("Shplonk:nu"); |
| 331 | + auto batched_quotient_Q = Shplonk::compute_batched_quotient(gemini_opening_pairs, gemini_witnesses, nu_challenge); |
| 332 | + prover_transcript.send_to_verifier("Shplonk:Q", this->ck()->commit(batched_quotient_Q)); |
| 333 | + |
| 334 | + const Fr z_challenge = prover_transcript.get_challenge("Shplonk:z"); |
| 335 | + const auto [shplonk_opening_pair, shplonk_witness] = Shplonk::compute_partially_evaluated_batched_quotient( |
| 336 | + gemini_opening_pairs, gemini_witnesses, std::move(batched_quotient_Q), nu_challenge, z_challenge); |
| 337 | + |
| 338 | + // KZG prover: |
| 339 | + // - Adds commitment [W] to transcript |
| 340 | + KZG::compute_opening_proof(this->ck(), shplonk_opening_pair, shplonk_witness, prover_transcript); |
| 341 | + |
| 342 | + // Run the full verifier PCS protocol with genuine opening claims (genuine commitment, genuine evaluation) |
| 343 | + |
| 344 | + auto verifier_transcript = VerifierTranscript<Fr>::init_empty(prover_transcript); |
| 345 | + |
| 346 | + // Gemini verifier output: |
| 347 | + // - claim: d+1 commitments to Fold_{r}^(0), Fold_{-r}^(0), Fold^(l), d+1 evaluations a_0_pos, a_l, l = 0:d-1 |
| 348 | + auto gemini_verifier_claim = Gemini::reduce_verify(mle_opening_point, |
| 349 | + batched_evaluation, |
| 350 | + batched_commitment_unshifted, |
| 351 | + batched_commitment_to_be_shifted, |
| 352 | + verifier_transcript); |
| 353 | + |
| 354 | + // Shplonk verifier claim: commitment [Q] - [Q_z], opening point (z_challenge, 0) |
| 355 | + const auto shplonk_verifier_claim = Shplonk::reduce_verify(gemini_verifier_claim, verifier_transcript); |
| 356 | + |
| 357 | + // KZG verifier: |
| 358 | + // aggregates inputs [Q] - [Q_z] and [W] into an 'accumulator' (can perform pairing check on result) |
| 359 | + bool verified = KZG::verify(this->vk(), shplonk_verifier_claim, verifier_transcript); |
| 360 | + |
| 361 | + // Final pairing check: e([Q] - [Q_z] + z[W], [1]_2) = e([W], [x]_2) |
| 362 | + |
| 363 | + EXPECT_EQ(verified, true); |
| 364 | +} |
| 365 | + |
240 | 366 | } // namespace proof_system::honk::pcs::gemini |
0 commit comments