Skip to content

Commit

Permalink
refactor: remove GKR related code
Browse files Browse the repository at this point in the history
  • Loading branch information
@Al-Kindi-0
Al-Kindi-0 committed Jan 31, 2025
1 parent 8699090 commit c7df53b
Show file tree
Hide file tree
Showing 48 changed files with 79 additions and 1,949 deletions.
1 change: 0 additions & 1 deletion README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,6 @@ Over time, we hope extend the library with additional features:

**Perfect zero-knowledge.** The current implementation provides succinct proofs but NOT perfect zero-knowledge. This means that, in its current form, the library may not be suitable for use cases where proofs must not leak any info about secret inputs.

**Auxiliary GKR proofs.** It will be possible to attach auxiliary GKR-based proofs to the base STARK proofs. This will enable powerful new ways of defining constraints and optimizing prover performance.

### Project structure
The project is organized into several crates like so:
Expand Down
118 changes: 4 additions & 114 deletions air/src/air/aux.rs
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3,132 +3,22 @@
// This source code is licensed under the MIT license found in the
// LICENSE file in the root directory of this source tree.

use alloc::{string::ToString, vec::Vec};

use crypto::{ElementHasher, RandomCoin, RandomCoinError};
use math::FieldElement;
use utils::Deserializable;

use super::lagrange::LagrangeKernelRandElements;
use alloc::vec::Vec;

/// Holds the randomly generated elements necessary to build the auxiliary trace.
///
/// Specifically, [`AuxRandElements`] currently supports 3 types of random elements:
/// - the ones needed to build the Lagrange kernel column (when using GKR to accelerate LogUp),
/// - the ones needed to build the "s" auxiliary column (when using GKR to accelerate LogUp),
/// - the ones needed to build all the other auxiliary columns
#[derive(Debug, Clone)]
pub struct AuxRandElements<E> {
rand_elements: Vec<E>,
gkr: Option<GkrRandElements<E>>,
}

impl<E> AuxRandElements<E> {
/// Creates a new [`AuxRandElements`], where the auxiliary trace doesn't contain a Lagrange
/// kernel column.
/// Creates a new [`AuxRandElements`].
pub fn new(rand_elements: Vec<E>) -> Self {
Self { rand_elements, gkr: None }
}

/// Creates a new [`AuxRandElements`], where the auxiliary trace contains columns needed when
/// using GKR to accelerate LogUp (i.e. a Lagrange kernel column and the "s" column).
pub fn new_with_gkr(rand_elements: Vec<E>, gkr: GkrRandElements<E>) -> Self {
Self { rand_elements, gkr: Some(gkr) }
Self { rand_elements }
}

/// Returns the random elements needed to build all columns other than the two GKR-related ones.
/// Returns the random elements needed to build all columns.
pub fn rand_elements(&self) -> &[E] {
&self.rand_elements
}

/// Returns the random elements needed to build the Lagrange kernel column.
pub fn lagrange(&self) -> Option<&LagrangeKernelRandElements<E>> {
self.gkr.as_ref().map(|gkr| &gkr.lagrange)
}

/// Returns the random values used to linearly combine the openings returned from the GKR proof.
///
/// These correspond to the lambdas in our documentation.
pub fn gkr_openings_combining_randomness(&self) -> Option<&[E]> {
self.gkr.as_ref().map(|gkr| gkr.openings_combining_randomness.as_ref())
}
}

/// Holds all the random elements needed when using GKR to accelerate LogUp.
///
/// This consists of two sets of random values:
/// 1. The Lagrange kernel random elements (expanded on in [`LagrangeKernelRandElements`]), and
/// 2. The "openings combining randomness".
///
/// After the verifying the LogUp-GKR circuit, the verifier is left with unproven claims provided
/// nondeterministically by the prover about the evaluations of the MLE of the main trace columns at
/// the Lagrange kernel random elements. Those claims are (linearly) combined into one using the
/// openings combining randomness.
#[derive(Clone, Debug)]
pub struct GkrRandElements<E> {
lagrange: LagrangeKernelRandElements<E>,
openings_combining_randomness: Vec<E>,
}

impl<E> GkrRandElements<E> {
/// Constructs a new [`GkrRandElements`] from [`LagrangeKernelRandElements`], and the openings
/// combining randomness.
///
/// See [`GkrRandElements`] for a more detailed description.
pub fn new(
lagrange: LagrangeKernelRandElements<E>,
openings_combining_randomness: Vec<E>,
) -> Self {
Self { lagrange, openings_combining_randomness }
}

/// Returns the random elements needed to build the Lagrange kernel column.
pub fn lagrange_kernel_rand_elements(&self) -> &LagrangeKernelRandElements<E> {
&self.lagrange
}

/// Returns the random values used to linearly combine the openings returned from the GKR proof.
pub fn openings_combining_randomness(&self) -> &[E] {
&self.openings_combining_randomness
}
}

/// A trait for verifying a GKR proof.
///
/// Specifically, the use case in mind is proving the constraints of a LogUp bus using GKR, as
/// described in [Improving logarithmic derivative lookups using
/// GKR](https://eprint.iacr.org/2023/1284.pdf).
pub trait GkrVerifier {
/// The GKR proof.
type GkrProof: Deserializable;
/// The error that can occur during GKR proof verification.
type Error: ToString;

/// Verifies the GKR proof, and returns the random elements that were used in building
/// the Lagrange kernel auxiliary column.
fn verify<E, Hasher>(
&self,
gkr_proof: Self::GkrProof,
public_coin: &mut impl RandomCoin<BaseField = E::BaseField, Hasher = Hasher>,
) -> Result<GkrRandElements<E>, Self::Error>
where
E: FieldElement,
Hasher: ElementHasher<BaseField = E::BaseField>;
}

impl GkrVerifier for () {
type GkrProof = ();
type Error = RandomCoinError;

fn verify<E, Hasher>(
&self,
_gkr_proof: Self::GkrProof,
_public_coin: &mut impl RandomCoin<BaseField = E::BaseField, Hasher = Hasher>,
) -> Result<GkrRandElements<E>, Self::Error>
where
E: FieldElement,
Hasher: ElementHasher<BaseField = E::BaseField>,
{
Ok(GkrRandElements::new(LagrangeKernelRandElements::default(), Vec::new()))
}
}
31 changes: 0 additions & 31 deletions air/src/air/coefficients.rs
View file
Original file line number Diff line number Diff line change
Expand Up @@ -32,16 +32,8 @@ use math::{get_power_series, get_power_series_with_offset, FieldElement};
pub struct ConstraintCompositionCoefficients<E: FieldElement> {
pub transition: Vec<E>,
pub boundary: Vec<E>,
pub lagrange: Option<LagrangeConstraintsCompositionCoefficients<E>>,
}

/// Stores the constraint composition coefficients for the Lagrange kernel transition and boundary
/// constraints.
#[derive(Debug, Clone)]
pub struct LagrangeConstraintsCompositionCoefficients<E: FieldElement> {
pub transition: Vec<E>,
pub boundary: E,
}
// DEEP COMPOSITION COEFFICIENTS
// ================================================================================================
/// Coefficients used in construction of DEEP composition polynomial.
Expand Down Expand Up @@ -83,33 +75,12 @@ pub struct LagrangeConstraintsCompositionCoefficients<E: FieldElement> {
/// Theorem 8 of https://eprint.iacr.org/2022/1216.
/// 3. The error will depend on the batching used in building the DEEP polynomial. More precisely,
/// when using algebraic batching there is a loss of log_2(k + m - 1) bits of soundness.
///
/// In the case when the trace polynomials contain a trace polynomial corresponding to a Lagrange
/// kernel column, the above expression of $Y(x)$ includes the additional term given by
///
/// $$
/// \gamma \cdot \frac{T_l(x) - p_S(x)}{Z_S(x)}
/// $$
///
/// where:
///
/// 1. $\gamma$ is the composition coefficient for the Lagrange kernel trace polynomial.
/// 2. $T_l(x) is the evaluation of the Lagrange trace polynomial at $x$.
/// 3. $S$ is the set of opening points for the Lagrange kernel i.e.,
/// $S := {z, z.g, z.g^2, ..., z.g^{2^{log_2(\nu) - 1}}}$.
/// 4. $p_S(X)$ is the polynomial of minimal degree interpolating the set ${(a, T_l(a)): a \in S}$.
/// 5. $Z_S(X)$ is the polynomial of minimal degree vanishing over the set $S$.
///
/// Note that, if a Lagrange kernel trace polynomial is present, then the agreement parameter needs
/// to be adapted accordingly.
#[derive(Debug, Clone)]
pub struct DeepCompositionCoefficients<E: FieldElement> {
/// Trace polynomial composition coefficients $\alpha_i$.
pub trace: Vec<E>,
/// Constraint column polynomial composition coefficients $\beta_j$.
pub constraints: Vec<E>,
/// Lagrange kernel trace polynomial composition coefficient $\gamma$.
pub lagrange: Option<E>,
}

impl<E: FieldElement> DeepCompositionCoefficients<E> {
Expand All @@ -133,7 +104,6 @@ impl<E: FieldElement> DeepCompositionCoefficients<E> {
Ok(DeepCompositionCoefficients {
trace: t_coefficients,
constraints: c_coefficients,
lagrange: None,
})
}

Expand Down Expand Up @@ -162,7 +132,6 @@ impl<E: FieldElement> DeepCompositionCoefficients<E> {
Ok(DeepCompositionCoefficients {
trace: t_coefficients,
constraints: c_coefficients,
lagrange: None,
})
}
}
34 changes: 2 additions & 32 deletions air/src/air/context.rs
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,6 @@ pub struct AirContext<B: StarkField> {
pub(super) aux_transition_constraint_degrees: Vec<TransitionConstraintDegree>,
pub(super) num_main_assertions: usize,
pub(super) num_aux_assertions: usize,
pub(super) lagrange_kernel_aux_column_idx: Option<usize>,
pub(super) ce_blowup_factor: usize,
pub(super) trace_domain_generator: B,
pub(super) lde_domain_generator: B,
Expand Down Expand Up @@ -62,7 +61,6 @@ impl<B: StarkField> AirContext<B> {
Vec::new(),
num_assertions,
0,
None,
options,
)
}
Expand Down Expand Up @@ -95,7 +93,6 @@ impl<B: StarkField> AirContext<B> {
aux_transition_constraint_degrees: Vec<TransitionConstraintDegree>,
num_main_assertions: usize,
num_aux_assertions: usize,
lagrange_kernel_aux_column_idx: Option<usize>,
options: ProofOptions,
) -> Self {
assert!(
Expand Down Expand Up @@ -124,15 +121,6 @@ impl<B: StarkField> AirContext<B> {
);
}

// validate Lagrange kernel aux column, if any
if let Some(lagrange_kernel_aux_column_idx) = lagrange_kernel_aux_column_idx {
assert!(
lagrange_kernel_aux_column_idx == trace_info.get_aux_segment_width() - 1,
"Lagrange kernel column should be the last column of the auxiliary trace: index={}, but aux trace width is {}",
lagrange_kernel_aux_column_idx, trace_info.get_aux_segment_width()
);
}

// determine minimum blowup factor needed to evaluate transition constraints by taking
// the blowup factor of the highest degree constraint
let mut ce_blowup_factor = 0;
Expand Down Expand Up @@ -165,7 +153,6 @@ impl<B: StarkField> AirContext<B> {
aux_transition_constraint_degrees,
num_main_assertions,
num_aux_assertions,
lagrange_kernel_aux_column_idx,
ce_blowup_factor,
trace_domain_generator: B::get_root_of_unity(trace_length.ilog2()),
lde_domain_generator: B::get_root_of_unity(lde_domain_size.ilog2()),
Expand Down Expand Up @@ -209,8 +196,7 @@ impl<B: StarkField> AirContext<B> {
self.trace_info.length() * self.options.blowup_factor()
}

/// Returns the number of transition constraints for a computation, excluding the Lagrange
/// kernel transition constraints, which are managed separately.
/// Returns the number of transition constraints for a computation.
///
/// The number of transition constraints is defined by the total number of transition constraint
/// degree descriptors (for both the main and the auxiliary trace constraints). This number is
Expand All @@ -230,18 +216,7 @@ impl<B: StarkField> AirContext<B> {
self.aux_transition_constraint_degrees.len()
}

/// Returns the index of the auxiliary column which implements the Lagrange kernel, if any
pub fn lagrange_kernel_aux_column_idx(&self) -> Option<usize> {
self.lagrange_kernel_aux_column_idx
}

/// Returns true if the auxiliary trace segment contains a Lagrange kernel column
pub fn has_lagrange_kernel_aux_column(&self) -> bool {
self.lagrange_kernel_aux_column_idx().is_some()
}

/// Returns the total number of assertions defined for a computation, excluding the Lagrange
/// kernel assertion, which is managed separately.
/// Returns the total number of assertions defined for a computation.
///
/// The number of assertions consists of the assertions placed against the main segment of an
/// execution trace as well as assertions placed against the auxiliary trace segment.
Expand Down Expand Up @@ -287,11 +262,6 @@ impl<B: StarkField> AirContext<B> {
/// if the highest constraint degree is equal to `5`, the constraint composition polynomial will
/// require four columns and if the highest constraint degree is equal to `7`, it will require
/// six columns to store.
///
/// Note that the Lagrange kernel constraints require only 1 column, since the degree of the
/// numerator is `trace_len - 1` for all transition constraints (i.e. the base degree is 1).
/// Hence, no matter what the degree of the divisor is for each, the degree of the fraction will
/// be at most `trace_len - 1`.
pub fn num_constraint_composition_columns(&self) -> usize {
let mut highest_constraint_degree = 0_usize;
for degree in self
Expand Down
4 changes: 1 addition & 3 deletions air/src/air/divisor.rs
View file
Original file line number Diff line number Diff line change
Expand Up @@ -49,9 +49,7 @@ impl<B: StarkField> ConstraintDivisor<B> {
/// and $k$ is the number of exemption points. The default value for $k$ is $1$.
///
/// The above divisor specifies that transition constraints must hold on all steps of the
/// constraint enforcement domain except for the last $k$ steps. The constraint enforcement
/// domain is the entire trace in the case of transition constraints, but only a subset of the
/// trace for Lagrange kernel transition constraints.
/// constraint enforcement domain except for the last $k$ steps.
pub fn from_transition(
constraint_enforcement_domain_size: usize,
num_exemptions: usize,
Expand Down
71 changes: 0 additions & 71 deletions air/src/air/lagrange/boundary.rs
View file

This file was deleted.

Loading

0 comments on commit c7df53b

Please sign in to comment.