HorizenLabs · lgiussan · Aug 29, 2021 · Aug 29, 2021 · Aug 30, 2021 · Aug 30, 2021
diff --git a/Cargo.toml b/Cargo.toml
@@ -24,12 +24,12 @@ license = "MIT/Apache-2.0"
 edition = "2018"
 
 [dependencies]
-algebra = { git = "https://github.com/HorizenOfficial/ginger-lib", branch = "development", features = ["parallel", "fft", "derive"] }
-bench-utils = { git = "https://github.com/HorizenOfficial/ginger-lib", branch = "development" }
-r1cs-core = { git = "https://github.com/HorizenOfficial/ginger-lib", branch = "development" }
-r1cs-std = { git = "https://github.com/HorizenOfficial/ginger-lib", branch = "development" }
+algebra = { git = "https://github.com/HorizenOfficial/ginger-lib", branch = "refactor_constraint_system", features = ["parallel", "fft", "derive"] }
+bench-utils = { git = "https://github.com/HorizenOfficial/ginger-lib", branch = "refactor_constraint_system" }
+r1cs-core = { git = "https://github.com/HorizenOfficial/ginger-lib", branch = "refactor_constraint_system" }
+r1cs-std = { git = "https://github.com/HorizenOfficial/ginger-lib", branch = "refactor_constraint_system" }
 
-poly-commit = { git = "https://github.com/HorizenLabs/poly-commit", branch = "dev" }
+poly-commit = { git = "https://github.com/HorizenLabs/poly-commit", branch = "refactor_constraint_system" }
 
 rand = "0.8.4"
 rand_core = { version = "0.6.3" }
@@ -39,8 +39,8 @@ digest = { version = "0.8" }
 derivative = { version = "2", features = ["use_core"] }
 
 [dev-dependencies]
-algebra = { git = "https://github.com/HorizenOfficial/ginger-lib", branch = "development", features = ["tweedle", "derive"]}
-r1cs-std = { git = "https://github.com/HorizenOfficial/ginger-lib", branch = "development", features = ["tweedle"]}
+algebra = { git = "https://github.com/HorizenOfficial/ginger-lib", branch = "refactor_constraint_system", features = ["tweedle", "derive"]}
+r1cs-std = { git = "https://github.com/HorizenOfficial/ginger-lib", branch = "refactor_constraint_system", features = ["tweedle"]}
 
 blake2 = { version = "0.8.1", default-features = false }
 criterion = "0.3"

diff --git a/README.md b/README.md
@@ -1,95 +1,35 @@
-<h1 align="center">Marlin</h1>
+<h1 align="center">Coboundary Marlin</h1>
 
 <p align="center">
-    <a href="https://travis-ci.org/scipr-lab/marlin"><img src="https://travis-ci.org/scipr-lab/marlin.svg?branch=master"></a>
-    <a href="https://github.com/scipr-lab/marlin/blob/master/AUTHORS"><img src="https://img.shields.io/badge/authors-SCIPR%20Lab-orange.svg"></a>
-    <a href="https://github.com/scipr-lab/marlin/blob/master/LICENSE-APACHE"><img src="https://img.shields.io/badge/license-APACHE-blue.svg"></a>
-   <a href="https://github.com/scipr-lab/marlin/blob/master/LICENSE-MIT"><img src="https://img.shields.io/badge/license-MIT-blue.svg"></a>
+    <a href= "https://github.com/HorizenLabs/marlin/releases"><img src="https://img.shields.io/github/release/HorizenLabs/marlin.svg"></a>
+    <a href="AUTHORS"><img src="https://img.shields.io/github/contributors/HorizenLabs/marlin.svg?"></a>
+    <a href="https://travis-ci.com/github/HorizenLabs/marlin"><img src="https://app.travis-ci.com/HorizenLabs/marlin.svg?branch=master"></a>
+    <a href="LICENSE-APACHE"><img src="https://img.shields.io/badge/license-APACHE-blue.svg"></a>
+    <a href="LICENSE-MIT"><img src="https://img.shields.io/badge/license-MIT-blue.svg"></a>
+    <a href="CONTRIBUTING.md"><img src="https://img.shields.io/badge/PRs-welcome-brightgreen.svg?style=flat-square"></a>
 </p>
+`marlin` is a Rust library that implements *Coboundary Marlin*, an optimization of the [Marlin](https://eprint.iacr.org/2019/1047) preprocessing zk-SNARK for rank-one constraint systems (R1CS). The library is based on a fork from [arkworks](http://github.com/arkworks-rs/marlin), using the modifications as described in [HGB](https://eprint.iacr.org/2021/930). 
 
+## On the argument system ##
 
-`marlin` is a Rust library that implements a
-<p align="center">
-<b>preprocessing zkSNARK for R1CS</b><br>
-with<br>
-<b>universal and updatable SRS</b>
-</p>
-
-This library was initially developed as part of the [Marlin paper][marlin], and is released under the MIT License and the Apache v2 License (see [License](#license)).
-
-**WARNING:** This is an academic prototype, and in particular has not received careful code review. This implementation is NOT ready for production use.
-
-## Overview
-
-A zkSNARK with **preprocessing** achieves succinct verification for arbitrary computations, as opposed to only for structured computations. Informally, in an offline phase, one can preprocess the desired computation to produce a short summary of it; subsequently, in an online phase, this summary can be used to check any number of arguments relative to this computation.
-
-The preprocessing zkSNARKs in this library rely on a structured reference string (SRS), which contains system parameters required by the argument system to produce/validate arguments. The SRS in this library is **universal**, which means that it supports (deterministically) preprocessing any computation up to a given size bound. The SRS is also **updatable**, which means that anyone can contribute a fresh share of randomness to it, which facilitates deployments in the real world.
-
-The construction in this library follows the methodology introduced in the [Marlin paper][marlin], which obtains preprocessing zkSNARKs with universal and updatable SRS by combining two ingredients:
-
-* an **algebraic holographic proof**
-* a **polynomial commitment scheme**
+Coboundary Marlin is a zk-SNARK for R1CS as used by [`ginger-lib`](https://github.com/HorizenOfficial/ginger-lib"). It is built on top of any homomorphic polynomial commitment scheme, proving the satisfiability of a given constraint system (subject to some  public inputs) by means of an algebraic oracle protocol.  
 
-The first ingredient is provided as part of this library, and is an efficient algebraic holographic proof for R1CS (a generalization of arithmetic circuit satisfiability supported by many argument systems). The second ingredient is imported from [`poly-commit`](https://github.com/scipr-lab/poly-commit). See [the Marlin paper][marlin] for evaluation details.
+The main differences to Marlin are as follows:
 
-## Build guide
+- A cohomological sumcheck argument, which allows a more light-weight zero-knowledge randomization and drops the need for proving individual degree bounds,
+- a different arithmetization of the R1CS matrices, which is directly based on their Lagrange representation.
 
-The library compiles on the `stable` toolchain of the Rust compiler. To install the latest version of Rust, first install `rustup` by following the instructions [here](https://rustup.rs/), or via your platform's package manager. Once `rustup` is installed, install the Rust toolchain by invoking:
-```bash
-rustup install stable
-```
+See [HGB](https://eprint.iacr.org/2021/930) for details. 
 
-After that, use `cargo` (the standard Rust build tool) to build the library:
-```bash
-git clone https://github.com/scipr-lab/marlin.git
-cd marlin
-cargo build --release
-```
+##  Directory structure ##
 
-This library comes with some unit and integration tests. Run these tests with:
-```bash
-cargo test
-```
-
-Lastly, this library is instrumented with profiling infrastructure that prints detailed traces of execution time. To enable this, compile with `cargo build --features print-trace`.
-
-
-## Benchmarks
-
-All benchmarks below are performed over the BLS12-381 curve implemented in the [`algebra`](https://github.com/scipr-lab/zexe/tree/master/algebra) library, with the `asm` feature activated. Benchmarks were run on a machine with an Intel Xeon 6136 CPU running at 3.0 GHz.
-
-
-### Running time compared to Groth16 
-
-The graphs below compare the running time, in single-thread execution, of Marlin's indexer, prover, and verifier algorithms with the corresponding algorithms of [Groth16][groth16] (the state of the art in preprocessing zkSNARKs for R1CS with circuit-specific SRS) as implemented in [`groth16`](https://github.com/scipr-lab/zexe/tree/master/groth16). We evaluate Marlin's algorithms when instantiated with the PC scheme from [[CHMMVW20]][marlin] (denoted "M-AHP w/ PC of [[CHMMVW20]][marlin]"), and the PC scheme from [[MBKM19]][sonic] (denoted "M-AHP w/ PC of [[MBKM19]][sonic]").
-
-<p align="center">
-<img hspace="20" src="https://user-images.githubusercontent.com/3220730/82859703-52546100-9ecc-11ea-8f9d-ec2fb10f042d.png" width="45%" alt = "Indexer">
-<img hspace="20" src="https://user-images.githubusercontent.com/3220730/82859705-52ecf780-9ecc-11ea-84cc-99eda9f13d6a.png" width="45%" alt = "Prover">
-</p>
-<p align="center">
-<img src="https://user-images.githubusercontent.com/3220730/82859701-52546100-9ecc-11ea-8422-877080662073.png" width="45%" alt = "Verifier">
-</p>
-
-### Multi-threaded performance
-
-The following graphs compare the running time of Marlin's prover when instantiated with the PC scheme from [[CHMMVW20]][marlin] (left) and the PC scheme from [[MBKM19]][sonic] (right) when executed with a different number of threads.
-
-<p align="center">
-<img hspace="20" src="https://user-images.githubusercontent.com/3220730/82859700-51bbca80-9ecc-11ea-9fe1-53a611693dd1.png" width="45%" alt = "Multi-threaded scaling of Marlin AHP with the PC scheme from [CHMMVW20]">
-<img hspace="20" src="https://user-images.githubusercontent.com/3220730/82859698-51233400-9ecc-11ea-8a32-37379116e828.png" width="45%" alt = "Multi-threaded scaling of Marlin AHP with the PC scheme from [MBKM19]">
-</p>
-
-### Proof size
-
-We compare the proof size of Marlin with that of [Groth16][groth16]. We instantiate the Marlin SNARK with the PC scheme from [[CHMMVW20]][marlin], and the PC scheme from [[MBKM19]][sonic].
-
-|                   Scheme                   | Proof size in bytes |
-|:------------------------------------------:|:---------------------:|
-| Marlin AHP with PC of [[CHMMVW20]][marlin] |         880         |
-| Marlin AHP with PC of [[MBKM19]][sonic]    |         784         |
-|  [\[Groth16\]][groth16]                    |         192         |
+The high-level structure of the repository is as follows:
 
+- `data_structures.rs` essentially defines the structures around key material and SNARK proofs.
+- `lib.rs` contains the functions for parameter generation, producing and verifying SNARK proofs. The latter two are obtained as Fiat-Shamir transform of the interactive oracle proof as given in the submodule `iop`, replacing oracles by their commitments.
+- `iop/mod.rs` contains the "algebraic oracle proof", i.e. a pre-compiled version of the interactive protocol, in which polynomials to be sent to the verifier are left uncommitted. The module consists of
+  - `indexer.rs` , which contains structs and functions for the circuit-specific pre-processing stage. 
+  - `prover.rs`  and `verifier.rs` , which implement the round functions of prover and verifier of the oracle proof.
 
 ## License
 
@@ -100,16 +40,3 @@ This library is licensed under either of the following licenses, at your discret
 
 Unless you explicitly state otherwise, any contribution that you submit to this library shall be dual licensed as above (as defined in the Apache v2 License), without any additional terms or conditions.
 
-[marlin]: https://ia.cr/2019/1047
-[sonic]: https://ia.cr/2019/099
-[groth16]: https://ia.cr/2016/260
-
-## Reference paper
-
-[Marlin: Preprocessing zkSNARKs with Universal and Updatable SRS][marlin]     
-Alessandro Chiesa, Yuncong Hu, Mary Maller, [Pratyush Mishra](https://www.github.com/pratyush), Noah Vesely, [Nicholas Ward](https://www.github.com/npwardberkeley)     
-EUROCRYPT 2020
-
-## Acknowledgements
-
-This work was supported by: an Engineering and Physical Sciences Research Council grant; a Google Faculty Award; the RISELab at UC Berkeley; and donations from the Ethereum Foundation and the Interchain Foundation.
diff --git a/benches/tweedle_test_circuits.rs b/benches/tweedle_test_circuits.rs
@@ -1,10 +1,10 @@
 use algebra::{curves::tweedle::dee::Affine, fields::tweedle::Fr, UniformRand};
 use blake2::Blake2s;
 use marlin::*;
-use poly_commit::ipa_pc::InnerProductArgPC;
+use poly_commit::{ipa_pc::InnerProductArgPC, PCUniversalParams, PolynomialCommitment};
 
 use algebra::PrimeField;
-use r1cs_core::{ConstraintSynthesizer, ConstraintSystem, SynthesisError};
+use r1cs_core::{ConstraintSynthesizer, ConstraintSystemAbstract, SynthesisError};
 
 use criterion::Criterion;
 use criterion::{BatchSize, BenchmarkId};
@@ -94,7 +94,7 @@ pub struct TestCircuit2c<F: PrimeField> {
 }
 
 impl<F: PrimeField> ConstraintSynthesizer<F> for TestCircuit1a<F> {
-    fn generate_constraints<CS: ConstraintSystem<F>>(
+    fn generate_constraints<CS: ConstraintSystemAbstract<F>>(
         self,
         cs: &mut CS,
     ) -> Result<(), SynthesisError> {
@@ -146,7 +146,7 @@ impl<F: PrimeField> ConstraintSynthesizer<F> for TestCircuit1a<F> {
 }
 
 impl<F: PrimeField> ConstraintSynthesizer<F> for TestCircuit1b<F> {
-    fn generate_constraints<CS: ConstraintSystem<F>>(
+    fn generate_constraints<CS: ConstraintSystemAbstract<F>>(
         self,
         cs: &mut CS,
     ) -> Result<(), SynthesisError> {
@@ -211,7 +211,7 @@ impl<F: PrimeField> ConstraintSynthesizer<F> for TestCircuit1b<F> {
 }
 
 impl<F: PrimeField> ConstraintSynthesizer<F> for TestCircuit1c<F> {
-    fn generate_constraints<CS: ConstraintSystem<F>>(
+    fn generate_constraints<CS: ConstraintSystemAbstract<F>>(
         self,
         cs: &mut CS,
     ) -> Result<(), SynthesisError> {
@@ -297,7 +297,7 @@ impl<F: PrimeField> ConstraintSynthesizer<F> for TestCircuit1c<F> {
 }
 
 impl<F: PrimeField> ConstraintSynthesizer<F> for TestCircuit2a<F> {
-    fn generate_constraints<CS: ConstraintSystem<F>>(
+    fn generate_constraints<CS: ConstraintSystemAbstract<F>>(
         self,
         cs: &mut CS,
     ) -> Result<(), SynthesisError> {
@@ -349,7 +349,7 @@ impl<F: PrimeField> ConstraintSynthesizer<F> for TestCircuit2a<F> {
 }
 
 impl<F: PrimeField> ConstraintSynthesizer<F> for TestCircuit2b<F> {
-    fn generate_constraints<CS: ConstraintSystem<F>>(
+    fn generate_constraints<CS: ConstraintSystemAbstract<F>>(
         self,
         cs: &mut CS,
     ) -> Result<(), SynthesisError> {
@@ -428,7 +428,7 @@ impl<F: PrimeField> ConstraintSynthesizer<F> for TestCircuit2b<F> {
 }
 
 impl<F: PrimeField> ConstraintSynthesizer<F> for TestCircuit2c<F> {
-    fn generate_constraints<CS: ConstraintSystem<F>>(
+    fn generate_constraints<CS: ConstraintSystemAbstract<F>>(
         self,
         cs: &mut CS,
     ) -> Result<(), SynthesisError> {
@@ -532,8 +532,8 @@ fn bench_prover_circuit1a(c: &mut Criterion) {
             b: None,
         };
 
-        let (index_pk, pc_pk, _, _) =
-            MarlinInst::trim_and_index(&universal_srs, c.clone()).unwrap();
+        let (pc_pk, _) = IPAPC::trim(&universal_srs, universal_srs.max_degree()).unwrap();
+        let (index_pk, _) = MarlinInst::circuit_specific_setup(&pc_pk, c.clone()).unwrap();
 
         add_to_trace!(
             || format!("****************{}*******************", num_constraints),
@@ -601,8 +601,8 @@ fn bench_prover_circuit1b(c: &mut Criterion) {
             b: None,
         };
 
-        let (index_pk, pc_pk, _, _) =
-            MarlinInst::trim_and_index(&universal_srs, c.clone()).unwrap();
+        let (pc_pk, _) = IPAPC::trim(&universal_srs, universal_srs.max_degree()).unwrap();
+        let (index_pk, _) = MarlinInst::circuit_specific_setup(&pc_pk, c.clone()).unwrap();
 
         add_to_trace!(
             || format!("****************{}*******************", num_constraints),
@@ -670,8 +670,8 @@ fn bench_prover_circuit1c(c: &mut Criterion) {
             b: None,
         };
 
-        let (index_pk, pc_pk, _, _) =
-            MarlinInst::trim_and_index(&universal_srs, c.clone()).unwrap();
+        let (pc_pk, _) = IPAPC::trim(&universal_srs, universal_srs.max_degree()).unwrap();
+        let (index_pk, _) = MarlinInst::circuit_specific_setup(&pc_pk, c.clone()).unwrap();
 
         add_to_trace!(
             || format!("****************{}*******************", num_constraints),
@@ -739,8 +739,8 @@ fn bench_prover_circuit2a(c: &mut Criterion) {
             b: None,
         };
 
-        let (index_pk, pc_pk, _, _) =
-            MarlinInst::trim_and_index(&universal_srs, c.clone()).unwrap();
+        let (pc_pk, _) = IPAPC::trim(&universal_srs, universal_srs.max_degree()).unwrap();
+        let (index_pk, _) = MarlinInst::circuit_specific_setup(&pc_pk, c.clone()).unwrap();
 
         add_to_trace!(
             || format!("****************{}*******************", num_constraints),
@@ -808,8 +808,8 @@ fn bench_prover_circuit2b(c: &mut Criterion) {
             b: None,
         };
 
-        let (index_pk, pc_pk, _, _) =
-            MarlinInst::trim_and_index(&universal_srs, c.clone()).unwrap();
+        let (pc_pk, _) = IPAPC::trim(&universal_srs, universal_srs.max_degree()).unwrap();
+        let (index_pk, _) = MarlinInst::circuit_specific_setup(&pc_pk, c.clone()).unwrap();
 
         add_to_trace!(
             || format!("****************{}*******************", num_constraints),
@@ -877,8 +877,8 @@ fn bench_prover_circuit2c(c: &mut Criterion) {
             b: None,
         };
 
-        let (index_pk, pc_pk, _, _) =
-            MarlinInst::trim_and_index(&universal_srs, c.clone()).unwrap();
+        let (pc_pk, _) = IPAPC::trim(&universal_srs, universal_srs.max_degree()).unwrap();
+        let (index_pk, _) = MarlinInst::circuit_specific_setup(&pc_pk, c.clone()).unwrap();
 
         add_to_trace!(
             || format!("****************{}*******************", num_constraints),