refactor: move alphas generation to oink (#5515)

This PR moves the alphas generation to the oink prover and verifier and
adds it as a separate round.

barretenberg/cpp/src/barretenberg/benchmark/ultra_bench/ultra_honk_rounds.bench.cpp

@@ -15,6 +15,7 @@ enum {
     SORTED_LIST_ACCUMULATOR,
     LOG_DERIVATIVE_INVERSE,
     GRAND_PRODUCT_COMPUTATION,
+    GENERATE_ALPHAS,
     RELATION_CHECK,
     ZEROMORPH
 };
@@ -49,6 +50,7 @@ BB_PROFILE static void test_round_inner(State& state, GoblinUltraProver& prover,
     time_if_index(SORTED_LIST_ACCUMULATOR, [&] { prover.oink_prover.execute_sorted_list_accumulator_round(); });
     time_if_index(LOG_DERIVATIVE_INVERSE, [&] { prover.oink_prover.execute_log_derivative_inverse_round(); });
     time_if_index(GRAND_PRODUCT_COMPUTATION, [&] { prover.oink_prover.execute_grand_product_computation_round(); });
+    time_if_index(GENERATE_ALPHAS, [&] { prover.instance->alphas = prover.oink_prover.generate_alphas_round(); });
     // we need to get the relation_parameters and prover_polynomials from the oink_prover
     prover.instance->relation_parameters = prover.oink_prover.relation_parameters;
     prover.instance->prover_polynomials = GoblinUltraFlavor::ProverPolynomials(prover.instance->proving_key);
@@ -75,7 +77,7 @@ BB_PROFILE static void test_round(State& state, size_t index) noexcept
     {                                                                                                                  \
         test_round(state, round);                                                                                      \
     }                                                                                                                  \
-    BENCHMARK(ROUND_##round)->DenseRange(17, 19)->Unit(kMillisecond)
+    BENCHMARK(ROUND_##round)->DenseRange(12, 19)->Unit(kMillisecond)
 
 // Fast rounds take a long time to benchmark because of how we compute statistical significance.
 // Limit to one iteration so we don't spend a lot of time redoing full proofs just to measure this part.
@@ -84,6 +86,7 @@ ROUND_BENCHMARK(WIRE_COMMITMENTS)->Iterations(1);
 ROUND_BENCHMARK(SORTED_LIST_ACCUMULATOR)->Iterations(1);
 ROUND_BENCHMARK(LOG_DERIVATIVE_INVERSE)->Iterations(1);
 ROUND_BENCHMARK(GRAND_PRODUCT_COMPUTATION)->Iterations(1);
+ROUND_BENCHMARK(GENERATE_ALPHAS)->Iterations(1);
 ROUND_BENCHMARK(RELATION_CHECK);
 ROUND_BENCHMARK(ZEROMORPH);
 

barretenberg/cpp/src/barretenberg/protogalaxy/protogalaxy_prover.cpp

@@ -8,15 +8,10 @@ void ProtoGalaxyProver_<ProverInstances>::finalise_and_send_instance(std::shared
 {
     OinkProver<Flavor> oink_prover(instance->proving_key, commitment_key, transcript, domain_separator + '_');
 
-    auto [relation_params] = oink_prover.prove();
+    auto [relation_params, alphas] = oink_prover.prove();
     instance->relation_parameters = std::move(relation_params);
     instance->prover_polynomials = ProverPolynomials(instance->proving_key);
-
-    // Generate relation separators alphas for sumcheck
-    for (size_t idx = 0; idx < NUM_SUBRELATIONS - 1; idx++) {
-        instance->alphas[idx] =
-            transcript->template get_challenge<FF>(domain_separator + "_alpha_" + std::to_string(idx));
-    }
+    instance->alphas = std::move(alphas);
 }
 
 template <class ProverInstances> void ProtoGalaxyProver_<ProverInstances>::prepare_for_folding()

barretenberg/cpp/src/barretenberg/protogalaxy/protogalaxy_verifier.cpp

@@ -9,15 +9,11 @@ void ProtoGalaxyVerifier_<VerifierInstances>::receive_and_finalise_instance(cons
 {
     auto& key = inst->verification_key;
     OinkVerifier<Flavor> oink_verifier{ key, transcript, domain_separator + '_' };
-    auto [relation_parameters, witness_commitments, public_inputs] = oink_verifier.verify();
+    auto [relation_parameters, witness_commitments, public_inputs, alphas] = oink_verifier.verify();
     inst->relation_parameters = std::move(relation_parameters);
     inst->witness_commitments = std::move(witness_commitments);
     inst->public_inputs = std::move(public_inputs);
-
-    // Get the relation separation challenges
-    for (size_t idx = 0; idx < NUM_SUBRELATIONS - 1; idx++) {
-        inst->alphas[idx] = transcript->template get_challenge<FF>(domain_separator + "_alpha_" + std::to_string(idx));
-    }
+    inst->alphas = std::move(alphas);
 }
 
 // TODO(https://github.com/AztecProtocol/barretenberg/issues/795): The rounds prior to actual verifying are common

barretenberg/cpp/src/barretenberg/stdlib/honk_recursion/verifier/ultra_recursive_verifier.cpp

@@ -108,7 +108,7 @@ std::array<typename Flavor::GroupElement, 2> UltraRecursiveVerifier_<Flavor>::ve
     auto sumcheck = Sumcheck(log_circuit_size, transcript);
     RelationSeparator alpha;
     for (size_t idx = 0; idx < alpha.size(); idx++) {
-        alpha[idx] = transcript->template get_challenge<FF>("Sumcheck:alpha_" + std::to_string(idx));
+        alpha[idx] = transcript->template get_challenge<FF>("alpha_" + std::to_string(idx));
     }
 
     auto gate_challenges = std::vector<FF>(log_circuit_size);

barretenberg/cpp/src/barretenberg/ultra_honk/goblin_ultra_transcript.test.cpp

@@ -73,7 +73,7 @@ class GoblinUltraTranscriptTests : public ::testing::Test {
         manifest_expected.add_entry(round, "Z_LOOKUP", frs_per_G);
 
         for (size_t i = 0; i < NUM_SUBRELATIONS - 1; i++) {
-            std::string label = "Sumcheck:alpha_" + std::to_string(i);
+            std::string label = "alpha_" + std::to_string(i);
             manifest_expected.add_challenge(round, label);
             round++;
         }

barretenberg/cpp/src/barretenberg/ultra_honk/oink_prover.cpp

@@ -25,8 +25,12 @@ template <IsUltraFlavor Flavor> OinkProverOutput<Flavor> OinkProver<Flavor>::pro
     // Compute grand product(s) and commitments.
     execute_grand_product_computation_round();
 
+    // Generate relation separators alphas for sumcheck/combiner computation
+    RelationSeparator alphas = generate_alphas_round();
+
     return OinkProverOutput<Flavor>{
         .relation_parameters = std::move(relation_parameters),
+        .alphas = std::move(alphas),
     };
 }
 
@@ -149,6 +153,15 @@ template <IsUltraFlavor Flavor> void OinkProver<Flavor>::execute_grand_product_c
     transcript->send_to_verifier(domain_separator + commitment_labels.z_lookup, witness_commitments.z_lookup);
 }
 
+template <IsUltraFlavor Flavor> typename Flavor::RelationSeparator OinkProver<Flavor>::generate_alphas_round()
+{
+    RelationSeparator alphas;
+    for (size_t idx = 0; idx < alphas.size(); idx++) {
+        alphas[idx] = transcript->template get_challenge<FF>(domain_separator + "alpha_" + std::to_string(idx));
+    }
+    return alphas;
+}
+
 template class OinkProver<UltraFlavor>;
 template class OinkProver<GoblinUltraFlavor>;
 

barretenberg/cpp/src/barretenberg/ultra_honk/oink_prover.hpp

@@ -26,6 +26,7 @@
 namespace bb {
 template <IsUltraFlavor Flavor> struct OinkProverOutput {
     bb::RelationParameters<typename Flavor::FF> relation_parameters;
+    typename Flavor::RelationSeparator alphas;
 };
 
 /**
@@ -49,6 +50,7 @@ template <IsUltraFlavor Flavor> class OinkProver {
     std::string domain_separator;
     typename Flavor::WitnessCommitments witness_commitments;
     typename Flavor::CommitmentLabels commitment_labels;
+    using RelationSeparator = typename Flavor::RelationSeparator;
 
     bb::RelationParameters<typename Flavor::FF> relation_parameters;
 
@@ -68,5 +70,6 @@ template <IsUltraFlavor Flavor> class OinkProver {
     void execute_sorted_list_accumulator_round();
     void execute_log_derivative_inverse_round();
     void execute_grand_product_computation_round();
+    RelationSeparator generate_alphas_round();
 };
 } // namespace bb

barretenberg/cpp/src/barretenberg/ultra_honk/oink_verifier.cpp

@@ -16,10 +16,12 @@ template <IsUltraFlavor Flavor> OinkOutput<Flavor> OinkVerifier<Flavor>::verify(
     execute_sorted_list_accumulator_round();
     execute_log_derivative_inverse_round();
     execute_grand_product_computation_round();
+    RelationSeparator alphas = generate_alphas_round();
 
     return OinkOutput<Flavor>{ .relation_parameters = relation_parameters,
-                               .commitments = witness_comms,
-                               .public_inputs = public_inputs };
+                               .commitments = std::move(witness_comms),
+                               .public_inputs = public_inputs,
+                               .alphas = alphas };
 }
 
 /**
@@ -130,6 +132,16 @@ template <IsUltraFlavor Flavor> void OinkVerifier<Flavor>::execute_grand_product
         transcript->template receive_from_prover<Commitment>(domain_separator + comm_labels.z_lookup);
 }
 
+template <IsUltraFlavor Flavor> typename Flavor::RelationSeparator OinkVerifier<Flavor>::generate_alphas_round()
+{
+    // Get the relation separation challenges for sumcheck/combiner computation
+    RelationSeparator alphas;
+    for (size_t idx = 0; idx < alphas.size(); idx++) {
+        alphas[idx] = transcript->template get_challenge<FF>(domain_separator + "alpha_" + std::to_string(idx));
+    }
+    return alphas;
+}
+
 template class OinkVerifier<UltraFlavor>;
 template class OinkVerifier<GoblinUltraFlavor>;
 

barretenberg/cpp/src/barretenberg/ultra_honk/oink_verifier.hpp

@@ -12,6 +12,7 @@ template <IsUltraFlavor Flavor> struct OinkOutput {
     bb::RelationParameters<typename Flavor::FF> relation_parameters;
     typename Flavor::WitnessCommitments commitments;
     std::vector<typename Flavor::FF> public_inputs;
+    typename Flavor::RelationSeparator alphas;
 };
 
 /**
@@ -29,6 +30,7 @@ template <IsUltraFlavor Flavor> class OinkVerifier {
     using Transcript = typename Flavor::Transcript;
     using FF = typename Flavor::FF;
     using Commitment = typename Flavor::Commitment;
+    using RelationSeparator = typename Flavor::RelationSeparator;
 
   public:
     std::shared_ptr<Transcript> transcript;
@@ -58,5 +60,7 @@ template <IsUltraFlavor Flavor> class OinkVerifier {
     void execute_log_derivative_inverse_round();
 
     void execute_grand_product_computation_round();
+
+    RelationSeparator generate_alphas_round();
 };
 } // namespace bb

barretenberg/cpp/src/barretenberg/ultra_honk/ultra_prover.cpp

@@ -42,11 +42,7 @@ template <IsUltraFlavor Flavor> void UltraProver_<Flavor>::execute_relation_chec
     using Sumcheck = SumcheckProver<Flavor>;
     auto circuit_size = instance->proving_key->circuit_size;
     auto sumcheck = Sumcheck(circuit_size, transcript);
-    RelationSeparator alphas;
-    for (size_t idx = 0; idx < alphas.size(); idx++) {
-        alphas[idx] = transcript->template get_challenge<FF>("Sumcheck:alpha_" + std::to_string(idx));
-    }
-    instance->alphas = alphas;
+
     std::vector<FF> gate_challenges(numeric::get_msb(circuit_size));
     for (size_t idx = 0; idx < gate_challenges.size(); idx++) {
         gate_challenges[idx] = transcript->template get_challenge<FF>("Sumcheck:gate_challenge_" + std::to_string(idx));
@@ -79,8 +75,9 @@ template <IsUltraFlavor Flavor> HonkProof& UltraProver_<Flavor>::export_proof()
 
 template <IsUltraFlavor Flavor> HonkProof& UltraProver_<Flavor>::construct_proof()
 {
-    auto [relation_params] = oink_prover.prove();
+    auto [relation_params, alphas] = oink_prover.prove();
     instance->relation_parameters = std::move(relation_params);
+    instance->alphas = alphas;
     instance->prover_polynomials = ProverPolynomials(instance->proving_key);
 
     // Fiat-Shamir: alpha

barretenberg/cpp/src/barretenberg/ultra_honk/ultra_prover.hpp

@@ -25,7 +25,6 @@ template <IsUltraFlavor Flavor_> class UltraProver_ {
     using ProverInstance = ProverInstance_<Flavor>;
     using Instance = ProverInstance;
     using Transcript = typename Flavor::Transcript;
-    using RelationSeparator = typename Flavor::RelationSeparator;
     using ZeroMorph = ZeroMorphProver_<PCS>;
 
     std::shared_ptr<Instance> instance;

barretenberg/cpp/src/barretenberg/ultra_honk/ultra_transcript.test.cpp

@@ -67,7 +67,7 @@ class UltraTranscriptTests : public ::testing::Test {
         manifest_expected.add_entry(round, "Z_LOOKUP", frs_per_G);
 
         for (size_t i = 0; i < NUM_SUBRELATIONS - 1; i++) {
-            std::string label = "Sumcheck:alpha_" + std::to_string(i);
+            std::string label = "alpha_" + std::to_string(i);
             manifest_expected.add_challenge(round, label);
             round++;
         }

barretenberg/cpp/src/barretenberg/ultra_honk/ultra_verifier.cpp

@@ -49,7 +49,7 @@ template <typename Flavor> bool UltraVerifier_<Flavor>::verify_proof(const HonkP
     transcript = std::make_shared<Transcript>(proof);
     VerifierCommitments commitments{ key };
     OinkVerifier<Flavor> oink_verifier{ key, transcript };
-    auto [relation_parameters, witness_commitments, _] = oink_verifier.verify();
+    auto [relation_parameters, witness_commitments, _, alphas] = oink_verifier.verify();
 
     // Copy the witness_commitments over to the VerifierCommitments
     for (auto [wit_comm_1, wit_comm_2] : zip_view(commitments.get_witness(), witness_commitments.get_all())) {
@@ -59,10 +59,6 @@ template <typename Flavor> bool UltraVerifier_<Flavor>::verify_proof(const HonkP
     // Execute Sumcheck Verifier
     const size_t log_circuit_size = numeric::get_msb(key->circuit_size);
     auto sumcheck = SumcheckVerifier<Flavor>(log_circuit_size, transcript);
-    RelationSeparator alphas;
-    for (size_t idx = 0; idx < alphas.size(); idx++) {
-        alphas[idx] = transcript->template get_challenge<FF>("Sumcheck:alpha_" + std::to_string(idx));
-    }
 
     auto gate_challenges = std::vector<FF>(log_circuit_size);
     for (size_t idx = 0; idx < log_circuit_size; idx++) {

barretenberg/cpp/src/barretenberg/ultra_honk/ultra_verifier.hpp

@@ -12,7 +12,6 @@ template <typename Flavor> class UltraVerifier_ {
     using VerificationKey = typename Flavor::VerificationKey;
     using VerifierCommitmentKey = typename Flavor::VerifierCommitmentKey;
     using Transcript = typename Flavor::Transcript;
-    using RelationSeparator = typename Flavor::RelationSeparator;
 
   public:
     explicit UltraVerifier_(const std::shared_ptr<Transcript>& transcript,