feat: zip and propagate private logs

[LeilaWang]

• Merge note_encrypted_logs and encrypted_logs into private_logs.
• Propagate the fixed-size data of private logs instead of their hashes.
  • We don't have to re-hash the logs everywhere to check that they match the hashes in the public inputs anymore.
  • Change to L2 gas for private logs to be 0 because of the above.
• Private reset kernel circuit silos contract address to the first field of private logs.
  • Which allows us to remove randomness and masked address for non-note logs.

[LeilaWang]

Tag is no longer part of the "encrypted" bytes.
Instead, it's the first field of the private log: [tag, ...bytes_to_fields(encrypted_bytes)], concatenated in the above function compute_private_log_payload.
When it was part of the encrypted_bytes, bytes_to_fields would split it and leave the first 31 bytes in the first field, and the last byte in the second field, which made it really ugly when recomputing the siloed tags to request logs.

[github-actions]

Changes to circuit sizes

Generated at commit: b0bd629f3caeb3fe72cacefaf31b04d5f6898840, compared to commit: c48ae90c5d72450a3a19b76e552df1607ff79953

🧾 Summary (100% most significant diffs)

Program	ACIR opcodes (+/-)	%	Circuit size (+/-)	%
rollup_base_public	+537,089 ❌	+151.01%	+3,515,962 ❌	+90.90%
rollup_base_private	+129,798 ❌	+76.72%	+2,230,069 ❌	+85.20%
private_kernel_tail	+2,566 ❌	+62.18%	+5,553 ❌	+44.39%
private_kernel_tail_to_public	+6,847 ❌	+44.89%	+11,481 ❌	+43.39%
private_kernel_init	+14,025 ❌	+67.86%	+12,719 ❌	+37.94%
private_kernel_inner	+20,250 ❌	+55.08%	+18,141 ❌	+32.48%
private_kernel_reset	+20,885 ❌	+23.29%	+29,689 ❌	+4.66%
private_kernel_empty	+926 ❌	+151.06%	+926 ❌	+0.10%

---

Full diff report 👇

Program	ACIR opcodes (+/-)	%	Circuit size (+/-)	%
rollup_base_public	892,763 (+537,089)	+151.01%	7,383,899 (+3,515,962)	+90.90%
rollup_base_private	298,972 (+129,798)	+76.72%	4,847,378 (+2,230,069)	+85.20%
private_kernel_tail	6,693 (+2,566)	+62.18%	18,062 (+5,553)	+44.39%
private_kernel_tail_to_public	22,100 (+6,847)	+44.89%	37,942 (+11,481)	+43.39%
private_kernel_init	34,693 (+14,025)	+67.86%	46,239 (+12,719)	+37.94%
private_kernel_inner	57,017 (+20,250)	+55.08%	73,989 (+18,141)	+32.48%
private_kernel_reset	110,547 (+20,885)	+23.29%	667,168 (+29,689)	+4.66%
private_kernel_empty	1,539 (+926)	+151.06%	902,566 (+926)	+0.10%

[LeilaWang]

The first 16 bytes of serialized_eph_sk_high/low are 0s. We don't have to include them. This saves us 32 bytes.

[LeilaWang]

This is where most of the increased gate count of reset circuit comes from. Because we are now checking the entire log (18 fields) instead of one field of log hash. But this shouldn't be so expensive. So hopefully the cost of this and other similar things will go down eventually.

[sirasistant]

That's weird indeed! If it's 18 fields per log and 64 logs, that's 1152 checks, and the increase in constraint counts is 30k so around 30 gates per check sounds like a lot

[LeilaWang]

Removing this check from the class because we can't check the siloed field by looking at the payload anymore. We will have to get the "raw" tag and silo it with the expected contract address to confirm that the log is actually from the said contract. And this should be done in components where raw tags are available.

[Thunkar]

Note tagging/discovery changes and tag siloing LGTM!

CC/ @nventuro it was either you or @iAmMichaelConnor that wanted to review encryption APIs?

CC/ @sklppy88, this affects note syncing in TXE.

[sirasistant]

😨

[sirasistant]

Does it also modify the hints if we write directly to private_logs[i].inner.log[0] ?

[nventuro]

Suggested change

	let encrypted_log =
	unsafe { compute_payload_unconstrained(*context, e, ovpk, recipient, sender) };
	context.emit_private_log(encrypted_log);
	// Unconstrained logs have both their content and encryption unconstrained - it could occur that the
	// recipient is unable to decrypt the payload.
	let encrypted_log =
	unsafe { compute_payload_unconstrained(*context, e, ovpk, recipient, sender) };
	context.emit_private_log(encrypted_log);

[nventuro]

Can you also delete the part of the comment above related to the log hash?

[nventuro]

Suggested change

	// Silo the tag with contract address.
	// This is done by the kernel circuit to the private logs.
	// But since the partial log will be finalized and emitted in public as unencrypted log, its tag is not siloed at the moment.
	// To avoid querying logs using two types of tags, we silo the tag manually here.
	// This should be done by the AVM when its processing the raw logs instead of their hashes.
	let siloed_tag_bytes: [u8; 32] =
	// Silo the tag with contract address.
	// This is done by the kernel circuit to the private logs, but since the partial log will be finalized and emitted in
	// public as unencrypted log, its tag is not siloed at the moment.
	// To avoid querying logs using two types of tags, we silo the tag manually here.
	// TODO(#10273) This should be done by the AVM when its processing the raw logs instead of their hashes.
	let siloed_tag_bytes: [u8; 32] =

[nventuro]

Created #10273 to track this

[sirasistant]

Kernel changes LGTM! 🚀

[sirasistant]

Does it also modify the hints if we write directly to private_logs[i].inner.log[0] ?

[sirasistant]

That's weird indeed! If it's 18 fields per log and 64 logs, that's 1152 checks, and the increase in constraint counts is 30k so around 30 gates per check sounds like a lot