Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

A question about hyperplonk/src/snark.rs test #149

Open
Sophiamer2002 opened this issue Jun 20, 2024 · 2 comments · May be fixed by #156
Open

A question about hyperplonk/src/snark.rs test #149

Sophiamer2002 opened this issue Jun 20, 2024 · 2 comments · May be fixed by #156

Comments

@Sophiamer2002
Copy link

I substituted the 673 line in hyperplonk/src/snark.rs with

let permutation = vec![
    E::ScalarField::from(1u128),
    E::ScalarField::from(2u128),
    E::ScalarField::from(3u128),
    E::ScalarField::from(4u128),
    E::ScalarField::from(5u128),
    E::ScalarField::from(6u128),
    E::ScalarField::from(7u128),
    E::ScalarField::from(0u128),
];

and ran the corresponding test test_hyperplonk_e2e, with the result _verify in line 716 being true. In my understanding, the permutation check shouldn't pass and we should have the result as false. I guess there might be vulnerability in the batch opening part of HyperPlonkSNARK::verify. Please let me know if I made any mistake here. Looking forward to your reply.
@chancharles92
Copy link
Collaborator

Hi @zhenfeizhang , this does seem to be a bad permutation given that the witness is w1 := [0, 1, 2, 3] and w2 := [0^5, 1^5, 2^5, 3^5]. Do you have time to take a look? Thanks!

@Sophiamer2002
Copy link
Author

I've found the problem.
In batch opening of multilinear kzg, we commit to a series of tuples of (multilinear polynomial, points, evaluation on the point).
Also note that we have an inheritance relationship of Sumcheck < Zerocheck < Prodcheck < Permcheck, and so do their subclaims. The subclaim of sumcheck requires a check on some point of a polynomial, which gives relationships on evaluations of multilinear polynomials we committed. These relationships are checked by function hyperplonk::utils::eval_f for "wiring identity constraints" and eval_perm_gate for "gate identity constraints".
However, we note that The subclaim of permcheck poses a further requirement, that the product polynomial should be evaluated to 1 at (0, 1, 1, ..., 1). The relationship isn't checked in verify function in hyperplonk/src/snark.rs. What's more, the relationship shall be also checked by prover, to ensure that the proof is correct.

@Sophiamer2002 Sophiamer2002 changed the title A question on hyperplonk/src/snark.rs test A question about hyperplonk/src/snark.rs test Sep 27, 2024
@Sophiamer2002 Sophiamer2002 linked a pull request Sep 28, 2024 that will close this issue
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

fix: snark prove and verify check product to be 1 Sophiamer2002/hyperplonk
2 participants
@chancharles92 @Sophiamer2002