Implement PLONK

[jon-chuang]

Why? Very fast. Universal setup + proof composition = dark contracts.

Original PLONK
SHPLONK (non-essential): Multiple commits
TurboPLONK: Custom gates (e.g. EC point addition gates, can make pairing computation extremely cheap!)
PLOOKUP : Pedersen hashes. Extension: permutation networks for branching programs/RAM?

Zexe PLONK: PLONK single-layer rollup with BLS12-377 + BW6-761

Things to Investigate

• Whether using methods similar to TurboPLONK, not only elliptic curve point addition, but also pairing/G2 ops can be made primitive

[Pratyush]

If you're looking to work on this, there is a Rust implementation here: https://github.com/dusk-network/plonk/

btw we have an implementation of a similar universal setup SNARK (Marlin) here: https://github.com/scipr-lab/marlin.

[iAmMichaelConnor]

@Pratyush has anyone started working on this (an ArkWorks implementation of plonk)?

[Pratyush]

I think @kobigurk had an in-progress impl here: https://github.com/kobigurk/plonk/tree/kobigurk/port_to_zexe

[kobigurk]

It's a port of the dusk implementation indeed.

I'm getting up to speed on the plonk implementation in halo 2 and the abstraction of flexible proving systems with custom gates is really cool. Maybe an adaptation of that would be nicer.

cc @daira

[daira]

We'd love a Halo 2 implementation in Arkworks! It's a bit early to do that, though.

[kobigurk]

We'd love a Halo 2 implementation in Arkworks! It's a bit early to do that, though.

Just to be clear, I was referring to how PLONK is implemented, and the proving system abstraction. Not specifically Halo 2 :)

That said, it would be really cool as well!

[jon-chuang]

@kobigurk I think halo2 is more or less a (very flexible) plonk framework though? (Well notwithstanding the Halo poly-commit scheme, which is also portable, I imagine).

I think if it were ported to arkworks it would live in a separate repo to poly-commit and would have its own plonk-std perhaps. But compared to R1CS, Plonk is all about tayloring the circuit layout itself to be most efficient for a desired circuit, so its questionable if plonk-std would even be desirable.

Again, it may be instructive to look into how VLSI software organises and optimises a desired circuit over a library of standard components.