Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: Random polynomial is now applied on a per-relation term by the Prover #547

Merged
merged 8 commits into from
Jun 27, 2023

Conversation

zac-williamson
Copy link
Contributor

@zac-williamson zac-williamson commented Jun 20, 2023

Description

The random polynomial is now applied on a per-relation term by the Prover (instead of being applied to all relations by the Verifier).

Required if we want relations that sum over the hypercube (i.e. we check the sum of the relation terms at each row are zero, instead of checking the relation term is zero at each row).

This is needed to evaluate logarithmic derivatives.

Checklist:

  • I have reviewed my diff in github, line by line.
  • Every change is related to the PR description.
  • The branch has been merged with/rebased against the head of its merge target.
  • There are no unexpected formatting changes, superfluous debug logs, or commented-out code.
  • There are no circuit changes, OR a cryptographer has been assigned for review.
  • New functions, classes, etc. have been documented according to the doxygen comment format. Classes and structs must have @brief describing the intended functionality.
  • If existing code has been modified, such documentation has been added or updated.
  • No superfluous include directives have been added.
  • I have linked to any issue(s) it resolves.
  • I'm happy for the PR to be merged at the reviewer's next convenience.

Copy link
Collaborator

@ledwards2225 ledwards2225 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me (once the build errors are fixed, of course). Presumably you're thinking it will be necessary to have subrelations within a single relation that have different requirements re: linear independence? Maybe this will be the case when employing the log deriv if we maintain the same check for "shiftability". (Seems like there's got to be a better way to do that..). Anyway, would make things a bit nicer if the linear indep label could be applied at the Relation level but if this isn't the case then so be it

@@ -56,6 +56,7 @@ class Standard {
using Relations = std::tuple<sumcheck::ArithmeticRelation<FF>, sumcheck::PermutationRelation<FF>>;

static constexpr size_t MAX_RELATION_LENGTH = get_max_relation_length<Relations>();
static constexpr size_t MAX_RANDOM_RELATION_LENGTH = MAX_RELATION_LENGTH + 1;
static constexpr size_t NUM_RELATIONS = std::tuple_size<Relations>::value;

// Instantiate the BarycentricData needed to extend each Relation Univariate
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this should now use MAX_RANDOM_RELATION_LENGTH instead of MAX_RELATION_LENGTH to ensure the correct static arrays in barycentric data are computed at compile time

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

instantiate_barycentric_utils now uses MAX_RANDOM_RELATION_LENGTH

@@ -56,6 +56,7 @@ class Standard {
using Relations = std::tuple<sumcheck::ArithmeticRelation<FF>, sumcheck::PermutationRelation<FF>>;

static constexpr size_t MAX_RELATION_LENGTH = get_max_relation_length<Relations>();
static constexpr size_t MAX_RANDOM_RELATION_LENGTH = MAX_RELATION_LENGTH + 1;
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A comment explaining that this is length after multiplying by the pow zeta univariate would be helpful here since MAX_RANDOM_RELATION_LENGTH does not immediately make it clear what this is

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

added comment

using Element = std::remove_reference_t<decltype(element)>;
// Random poly R(X) = (1-X) + X.zeta_pow
auto random_poly_edge = Univariate<FF, 2>({ 1, pow_univariate.zeta_pow });
BarycentricData<FF, 2, extended_size> barycentric_2_to_max_2 = BarycentricData<FF, 2, extended_size>();
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor nit: At first I thought barycentric_2_to_max_2 was a typo. I see why you did it now but I think something generic like edge_extender or pow_extender would be fine. The original barycentric_2_to_max is also not great since there are two max floating around now

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fixed, renamed to something more descriptive

renamed `barycentric_2_to_max_2` to `pow_zeta_univariate_extender`

attempted fix of compiler errors
@kevaundray kevaundray changed the title chore: move random poly to prover chore: Random polynomial is now applied on a per-relation term by the Prover Jun 26, 2023
@zac-williamson zac-williamson merged commit e8c914f into master Jun 27, 2023
@zac-williamson zac-williamson deleted the zw/move-random-poly-to-prover branch June 27, 2023 09:45
ludamad pushed a commit to AztecProtocol/aztec-packages that referenced this pull request Jul 22, 2023
ludamad pushed a commit to AztecProtocol/aztec-packages that referenced this pull request Jul 24, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants