Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Setup ¶
func Setup(spr *cs.SparseR1CS, srs *kzg.SRS) (*ProvingKey, *VerifyingKey, error)
Setup sets proving and verifying keys
func Verify ¶
func Verify(proof *Proof, vk *VerifyingKey, publicWitness bw6_633witness.Witness) error
Types ¶
type Proof ¶
type Proof struct {
// Commitments to the solution vectors
LRO [3]kzg.Digest
// Commitment to Z, the permutation polynomial
Z kzg.Digest
// Commitments to h1, h2, h3 such that h = h1 + Xh2 + X**2h3 is the quotient polynomial
H [3]kzg.Digest
// Batch opening proof of h1 + zeta*h2 + zeta**2h3, linearizedPolynomial, l, r, o, s1, s2
BatchedProof kzg.BatchOpeningProof
// Opening proof of Z at zeta*mu
ZShiftedOpening kzg.OpeningProof
}
func Prove ¶
func Prove(spr *cs.SparseR1CS, pk *ProvingKey, fullWitness bw6_633witness.Witness, opt backend.ProverConfig) (*Proof, error)
Prove from the public data
type ProvingKey ¶
type ProvingKey struct {
// Verifying Key is embedded into the proving key (needed by Prove)
Vk *VerifyingKey
// qr,ql,qm,qo (in canonical basis).
Ql, Qr, Qm, Qo []fr.Element
// LQk (CQk) qk in Lagrange basis (canonical basis), prepended with as many zeroes as public inputs.
// Storing LQk in Lagrange basis saves a fft...
CQk, LQk []fr.Element
// Domains used for the FFTs.
// Domain[0] = small Domain
// Domain[1] = big Domain
Domain [2]fft.Domain
// Permutation polynomials
EvaluationPermutationBigDomainBitReversed []fr.Element
S1Canonical, S2Canonical, S3Canonical []fr.Element
// position -> permuted position (position in [0,3*sizeSystem-1])
Permutation []int64
}
ProvingKey stores the data needed to generate a proof: * the commitment scheme * ql, prepended with as many ones as they are public inputs * qr, qm, qo prepended with as many zeroes as there are public inputs. * qk, prepended with as many zeroes as public inputs, to be completed by the prover with the list of public inputs. * sigma_1, sigma_2, sigma_3 in both basis * the copy constraint permutation
func (*ProvingKey) InitKZG ¶
func (pk *ProvingKey) InitKZG(srs kzgg.SRS) error
InitKZG inits pk.Vk.KZG using pk.Domain[0] cardinality and provided SRS
This should be used after deserializing a ProvingKey as pk.Vk.KZG is NOT serialized
func (*ProvingKey) ReadFrom ¶
func (pk *ProvingKey) ReadFrom(r io.Reader) (int64, error)
ReadFrom reads from binary representation in r into ProvingKey
func (*ProvingKey) VerifyingKey ¶
func (pk *ProvingKey) VerifyingKey() interface{}
VerifyingKey returns pk.Vk
type VerifyingKey ¶
type VerifyingKey struct {
// Size circuit
Size uint64
SizeInv fr.Element
Generator fr.Element
NbPublicVariables uint64
// Commitment scheme that is used for an instantiation of PLONK
KZGSRS *kzg.SRS
// cosetShift generator of the coset on the small domain
CosetShift fr.Element
// S commitments to S1, S2, S3
S [3]kzg.Digest
// Commitments to ql, qr, qm, qo prepended with as many zeroes (ones for l) as there are public inputs.
// In particular Qk is not complete.
Ql, Qr, Qm, Qo, Qk kzg.Digest
}
VerifyingKey stores the data needed to verify a proof: * The commitment scheme * Commitments of ql prepended with as many ones as there are public inputs * Commitments of qr, qm, qo, qk prepended with as many zeroes as there are public inputs * Commitments to S1, S2, S3
func (*VerifyingKey) InitKZG ¶
func (vk *VerifyingKey) InitKZG(srs kzgg.SRS) error
InitKZG inits vk.KZG using provided SRS
This should be used after deserializing a VerifyingKey as vk.KZG is NOT serialized
Note that this instantiate a new FFT domain using vk.Size
func (*VerifyingKey) NbPublicWitness ¶
func (vk *VerifyingKey) NbPublicWitness() int
NbPublicWitness returns the expected public witness size (number of field elements)
Source Files