feat: Recursive folding verifier and decider as ultra circuits and circuit simulator

barretenberg/cpp/src/barretenberg/stdlib/honk_recursion/verifier/decider_recursive_verifier.cpp

@@ -43,4 +43,8 @@ std::array<typename Flavor::GroupElement, 2> DeciderRecursiveVerifier_<Flavor>::
 
 template class DeciderRecursiveVerifier_<bb::UltraRecursiveFlavor_<UltraCircuitBuilder>>;
 template class DeciderRecursiveVerifier_<bb::GoblinUltraRecursiveFlavor_<GoblinUltraCircuitBuilder>>;
+template class DeciderRecursiveVerifier_<bb::UltraRecursiveFlavor_<GoblinUltraCircuitBuilder>>;
+template class DeciderRecursiveVerifier_<bb::GoblinUltraRecursiveFlavor_<UltraCircuitBuilder>>;
+template class DeciderRecursiveVerifier_<bb::UltraRecursiveFlavor_<CircuitSimulatorBN254>>;
+template class DeciderRecursiveVerifier_<bb::GoblinUltraRecursiveFlavor_<CircuitSimulatorBN254>>;
 } // namespace bb::stdlib::recursion::honk

barretenberg/cpp/src/barretenberg/stdlib/honk_recursion/verifier/protogalaxy_recursive_verifier.cpp

@@ -163,42 +163,17 @@ std::shared_ptr<typename VerifierInstances::Instance> ProtoGalaxyRecursiveVerifi
     next_accumulator->verification_key->pcs_verification_key = accumulator->verification_key->pcs_verification_key;
     next_accumulator->verification_key->pub_inputs_offset = accumulator->verification_key->pub_inputs_offset;
     next_accumulator->public_inputs = accumulator->public_inputs;
-    size_t vk_idx = 0;
-    for (auto& expected_vk : next_accumulator->verification_key->get_all()) {
-        size_t inst = 0;
-        std::vector<FF> scalars;
-        std::vector<Commitment> commitments;
-        for (auto& instance : instances) {
-            scalars.emplace_back(lagranges[inst]);
-            commitments.emplace_back(instance->verification_key->get_all()[vk_idx]);
-            inst++;
-        }
-        expected_vk = Commitment::batch_mul(commitments, scalars);
-        vk_idx++;
-    }
+
     next_accumulator->is_accumulator = true;
 
-    // Compute next folding parameters and verify against the ones received from the prover
+    // Compute next folding parameters
     next_accumulator->target_sum =
         perturbator_at_challenge * lagranges[0] + vanishing_polynomial_at_challenge * combiner_quotient_at_challenge;
     next_accumulator->gate_challenges =
         update_gate_challenges(perturbator_challenge, accumulator->gate_challenges, deltas);
 
-    // Compute ϕ and verify against the data received from the prover
-    auto& acc_witness_commitments = next_accumulator->witness_commitments;
-    size_t comm_idx = 0;
-    for (auto& comm : acc_witness_commitments.get_all()) {
-        std::vector<FF> scalars;
-        std::vector<Commitment> commitments;
-        size_t inst = 0;
-        for (auto& instance : instances) {
-            scalars.emplace_back(lagranges[inst]);
-            commitments.emplace_back(instance->witness_commitments.get_all()[comm_idx]);
-            inst++;
-        }
-        comm = Commitment::batch_mul(commitments, scalars);
-        comm_idx++;
-    }
+    // Compute ϕ
+    fold_commitments(lagranges, instances, next_accumulator);
 
     next_accumulator->public_inputs = std::vector<FF>(next_accumulator->verification_key->num_public_inputs, 0);
     size_t public_input_idx = 0;
@@ -245,4 +220,12 @@ template class ProtoGalaxyRecursiveVerifier_<
     RecursiveVerifierInstances_<UltraRecursiveFlavor_<UltraCircuitBuilder>, 2>>;
 template class ProtoGalaxyRecursiveVerifier_<
     RecursiveVerifierInstances_<GoblinUltraRecursiveFlavor_<GoblinUltraCircuitBuilder>, 2>>;
+template class ProtoGalaxyRecursiveVerifier_<
+    RecursiveVerifierInstances_<UltraRecursiveFlavor_<GoblinUltraCircuitBuilder>, 2>>;
+template class ProtoGalaxyRecursiveVerifier_<
+    RecursiveVerifierInstances_<GoblinUltraRecursiveFlavor_<UltraCircuitBuilder>, 2>>;
+template class ProtoGalaxyRecursiveVerifier_<
+    RecursiveVerifierInstances_<UltraRecursiveFlavor_<CircuitSimulatorBN254>, 2>>;
+template class ProtoGalaxyRecursiveVerifier_<
+    RecursiveVerifierInstances_<GoblinUltraRecursiveFlavor_<CircuitSimulatorBN254>, 2>>;
 } // namespace bb::stdlib::recursion::honk

barretenberg/cpp/src/barretenberg/stdlib/honk_recursion/verifier/protogalaxy_recursive_verifier.hpp

@@ -120,6 +120,83 @@ template <class VerifierInstances> class ProtoGalaxyRecursiveVerifier_ {
         }
         return result;
     };
+
+    /**
+     * @brief Hack method to fold the witness commitments and verification key without the batch_mul in the case where
+     * the recursive folding verifier is instantiated as a vanilla ultra circuit.
+     *
+     * @details In the folding recursive verifier we might hit the scenerio where we do a batch_mul(commitments,
+     * lagranges) where the commitments are equal. That is because when we add gates to ensure no zero commitments,
+     * these will be the same for all circuits, hitting an edge case in batch_mul that creates a failing constraint.
+     * Specifically, at some point in the algorithm we combute the difference between the points which, if they are
+     * equal, would be zero, case that is not supported. See https://github.com/AztecProtocol/barretenberg/issues/971.
+     */
+    void fold_commitments(std::vector<FF> lagranges,
+                          VerifierInstances& instances,
+                          std::shared_ptr<Instance>& accumulator)
+        requires IsUltraBuilder<Builder>
+    {
+        using ElementNative = typename Flavor::Curve::ElementNative;
+        using AffineElementNative = typename Flavor::Curve::AffineElementNative;
+
+        auto offset_generator = Commitment::from_witness(builder, AffineElementNative(ElementNative::random_element()));
+
+        size_t vk_idx = 0;
+        for (auto& expected_vk : accumulator->verification_key->get_all()) {
+            expected_vk = offset_generator;
+            size_t inst = 0;
+            for (auto& instance : instances) {
+                expected_vk += instance->verification_key->get_all()[vk_idx] * lagranges[inst];
+                inst++;
+            }
+            expected_vk -= offset_generator;
+            vk_idx++;
+        }
+
+        size_t comm_idx = 0;
+        for (auto& comm : accumulator->witness_commitments.get_all()) {
+            comm = offset_generator;
+            size_t inst = 0;
+            for (auto& instance : instances) {
+                comm += instance->witness_commitments.get_all()[comm_idx] * lagranges[inst];
+                inst++;
+            }
+            comm -= offset_generator;
+            comm_idx++;
+        }
+    }
+
+    /**
+     * @brief Folds the witness commitments and verification key (part of ϕ) and stores the values in the accumulator.
+     *
+     *
+     */
+
+    void fold_commitments(std::vector<FF> lagranges,
+                          VerifierInstances& instances,
+                          std::shared_ptr<Instance>& accumulator)
+        requires(!IsUltraBuilder<Builder>)
+    {
+        size_t vk_idx = 0;
+        for (auto& expected_vk : accumulator->verification_key->get_all()) {
+            std::vector<Commitment> commitments;
+            for (auto& instance : instances) {
+                commitments.emplace_back(instance->verification_key->get_all()[vk_idx]);
+            }
+            expected_vk = Commitment::batch_mul(commitments, lagranges);
+            vk_idx++;
+        }
+
+        size_t comm_idx = 0;
+        for (auto& comm : accumulator->witness_commitments.get_all()) {
+            std::vector<Commitment> commitments;
+            for (auto& instance : instances) {
+                commitments.emplace_back(instance->witness_commitments.get_all()[comm_idx]);
+            }
+            comm = Commitment::batch_mul(commitments, lagranges);
+            comm_idx++;
+        }
+    }
 };
 
 } // namespace bb::stdlib::recursion::honk