Separate prover and verifier keys in CompressedSNARK

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nova-snark"
-version = "0.16.0"
+version = "0.17.0"
 authors = ["Srinath Setty <[email protected]>"]
 edition = "2021"
 description = "Recursive zkSNARKs without trusted setup"

benches/compressed-snark.rs

@@ -49,6 +49,9 @@ fn bench_compressed_snark(c: &mut Criterion) {
       TrivialTestCircuit::default(),
     );
 
+    // Produce prover and verifier keys for CompressedSNARK
+    let (pk, vk) = CompressedSNARK::<_, _, _, _, S1, S2>::setup(&pp);
+
     // produce a recursive SNARK
     let num_steps = 3;
     let mut recursive_snark: Option<RecursiveSNARK<G1, G2, C1, C2>> = None;
@@ -84,12 +87,13 @@ fn bench_compressed_snark(c: &mut Criterion) {
       b.iter(|| {
         assert!(CompressedSNARK::<_, _, _, _, S1, S2>::prove(
           black_box(&pp),
+          black_box(&pk),
           black_box(&recursive_snark)
         )
         .is_ok());
       })
     });
-    let res = CompressedSNARK::<_, _, _, _, S1, S2>::prove(&pp, &recursive_snark);
+    let res = CompressedSNARK::<_, _, _, _, S1, S2>::prove(&pp, &pk, &recursive_snark);
     assert!(res.is_ok());
     let compressed_snark = res.unwrap();
 
@@ -98,7 +102,7 @@ fn bench_compressed_snark(c: &mut Criterion) {
       b.iter(|| {
         assert!(black_box(&compressed_snark)
           .verify(
-            black_box(&pp),
+            black_box(&vk),
             black_box(num_steps),
             black_box(vec![<G1 as Group>::Scalar::from(2u64)]),
             black_box(vec![<G2 as Group>::Scalar::from(2u64)]),

examples/minroot.rs

@@ -256,13 +256,15 @@ fn main() {
 
     // produce a compressed SNARK
     println!("Generating a CompressedSNARK using Spartan with IPA-PC...");
+    let (pk, vk) = CompressedSNARK::<_, _, _, _, S1, S2>::setup(&pp);
+
     let start = Instant::now();
     type EE1 = nova_snark::provider::ipa_pc::EvaluationEngine<G1>;
     type EE2 = nova_snark::provider::ipa_pc::EvaluationEngine<G2>;
     type S1 = nova_snark::spartan::RelaxedR1CSSNARK<G1, EE1>;
     type S2 = nova_snark::spartan::RelaxedR1CSSNARK<G2, EE2>;
 
-    let res = CompressedSNARK::<_, _, _, _, S1, S2>::prove(&pp, &recursive_snark);
+    let res = CompressedSNARK::<_, _, _, _, S1, S2>::prove(&pp, &pk, &recursive_snark);
     println!(
       "CompressedSNARK::prove: {:?}, took {:?}",
       res.is_ok(),
@@ -282,7 +284,7 @@ fn main() {
     // verify the compressed SNARK
     println!("Verifying a CompressedSNARK...");
     let start = Instant::now();
-    let res = compressed_snark.verify(&pp, num_steps, z0_primary, z0_secondary);
+    let res = compressed_snark.verify(&vk, num_steps, z0_primary, z0_secondary);
     println!(
       "CompressedSNARK::verify: {:?}, took {:?}",
       res.is_ok(),

src/bellperson/mod.rs

@@ -47,14 +47,14 @@ mod tests {
     let mut cs: ShapeCS<G> = ShapeCS::new();
     let _ = synthesize_alloc_bit(&mut cs);
     let shape = cs.r1cs_shape();
-    let gens = cs.r1cs_gens();
+    let ck = cs.commitment_key();
 
     // Now get the assignment
     let mut cs: SatisfyingAssignment<G> = SatisfyingAssignment::new();
     let _ = synthesize_alloc_bit(&mut cs);
-    let (inst, witness) = cs.r1cs_instance_and_witness(&shape, &gens).unwrap();
+    let (inst, witness) = cs.r1cs_instance_and_witness(&shape, &ck).unwrap();
 
     // Make sure that this is satisfiable
-    assert!(shape.is_sat(&gens, &inst, &witness).is_ok());
+    assert!(shape.is_sat(&ck, &inst, &witness).is_ok());
   }
 }

src/bellperson/r1cs.rs

@@ -3,32 +3,31 @@
 #![allow(non_snake_case)]
 
 use super::{shape_cs::ShapeCS, solver::SatisfyingAssignment};
-use bellperson::{Index, LinearCombination};
-
-use ff::PrimeField;
-
 use crate::{
   errors::NovaError,
-  r1cs::{R1CSGens, R1CSInstance, R1CSShape, R1CSWitness},
+  r1cs::{R1CSInstance, R1CSShape, R1CSWitness, R1CS},
   traits::Group,
+  CommitmentKey,
 };
+use bellperson::{Index, LinearCombination};
+use ff::PrimeField;
 
 /// `NovaWitness` provide a method for acquiring an `R1CSInstance` and `R1CSWitness` from implementers.
 pub trait NovaWitness<G: Group> {
-  /// Return an instance and witness, given a shape and gens.
+  /// Return an instance and witness, given a shape and ck.
   fn r1cs_instance_and_witness(
     &self,
     shape: &R1CSShape<G>,
-    gens: &R1CSGens<G>,
+    ck: &CommitmentKey<G>,
   ) -> Result<(R1CSInstance<G>, R1CSWitness<G>), NovaError>;
 }
 
 /// `NovaShape` provides methods for acquiring `R1CSShape` and `R1CSGens` from implementers.
 pub trait NovaShape<G: Group> {
   /// Return an appropriate `R1CSShape` struct.
   fn r1cs_shape(&self) -> R1CSShape<G>;
-  /// Return an appropriate `R1CSGens` struct.
-  fn r1cs_gens(&self) -> R1CSGens<G>;
+  /// Return an appropriate `CommitmentKey` struct.
+  fn commitment_key(&self) -> CommitmentKey<G>;
 }
 
 impl<G: Group> NovaWitness<G> for SatisfyingAssignment<G>
@@ -38,12 +37,12 @@ where
   fn r1cs_instance_and_witness(
     &self,
     shape: &R1CSShape<G>,
-    gens: &R1CSGens<G>,
+    ck: &CommitmentKey<G>,
   ) -> Result<(R1CSInstance<G>, R1CSWitness<G>), NovaError> {
     let W = R1CSWitness::<G>::new(shape, &self.aux_assignment)?;
     let X = &self.input_assignment[1..];
 
-    let comm_W = W.commit(gens);
+    let comm_W = W.commit(ck);
 
     let instance = R1CSInstance::<G>::new(shape, &comm_W, X)?;
 
@@ -88,8 +87,8 @@ where
     S
   }
 
-  fn r1cs_gens(&self) -> R1CSGens<G> {
-    R1CSGens::<G>::new(self.num_constraints(), self.num_aux())
+  fn commitment_key(&self) -> CommitmentKey<G> {
+    R1CS::<G>::commitment_key(self.num_constraints(), self.num_aux())
   }
 }
 

src/circuit.rs

@@ -3,7 +3,7 @@
 //! only the primary executes the next step of the computation.
 //! We have two running instances. Each circuit takes as input 2 hashes: one for each
 //! of the running instances. Each of these hashes is
-//! H(params = H(shape, gens), i, z0, zi, U). Each circuit folds the last invocation of
+//! H(params = H(shape, ck), i, z0, zi, U). Each circuit folds the last invocation of
 //! the other into the running instance
 
 use crate::{
@@ -390,7 +390,7 @@ mod tests {
     let ro_consts1: ROConstantsCircuit<G2> = PoseidonConstantsCircuit::new();
     let ro_consts2: ROConstantsCircuit<G1> = PoseidonConstantsCircuit::new();
 
-    // Initialize the shape and gens for the primary
+    // Initialize the shape and ck for the primary
     let circuit1: NovaAugmentedCircuit<G2, TrivialTestCircuit<<G2 as Group>::Base>> =
       NovaAugmentedCircuit::new(
         params1.clone(),
@@ -400,10 +400,10 @@ mod tests {
       );
     let mut cs: ShapeCS<G1> = ShapeCS::new();
     let _ = circuit1.synthesize(&mut cs);
-    let (shape1, gens1) = (cs.r1cs_shape(), cs.r1cs_gens());
+    let (shape1, ck1) = (cs.r1cs_shape(), cs.commitment_key());
     assert_eq!(cs.num_constraints(), 9815);
 
-    // Initialize the shape and gens for the secondary
+    // Initialize the shape and ck for the secondary
     let circuit2: NovaAugmentedCircuit<G1, TrivialTestCircuit<<G1 as Group>::Base>> =
       NovaAugmentedCircuit::new(
         params2.clone(),
@@ -413,7 +413,7 @@ mod tests {
       );
     let mut cs: ShapeCS<G2> = ShapeCS::new();
     let _ = circuit2.synthesize(&mut cs);
-    let (shape2, gens2) = (cs.r1cs_shape(), cs.r1cs_gens());
+    let (shape2, ck2) = (cs.r1cs_shape(), cs.commitment_key());
     assert_eq!(cs.num_constraints(), 10347);
 
     // Execute the base case for the primary
@@ -436,9 +436,9 @@ mod tests {
         ro_consts1,
       );
     let _ = circuit1.synthesize(&mut cs1);
-    let (inst1, witness1) = cs1.r1cs_instance_and_witness(&shape1, &gens1).unwrap();
+    let (inst1, witness1) = cs1.r1cs_instance_and_witness(&shape1, &ck1).unwrap();
     // Make sure that this is satisfiable
-    assert!(shape1.is_sat(&gens1, &inst1, &witness1).is_ok());
+    assert!(shape1.is_sat(&ck1, &inst1, &witness1).is_ok());
 
     // Execute the base case for the secondary
     let zero2 = <<G1 as Group>::Base as Field>::zero();
@@ -460,8 +460,8 @@ mod tests {
         ro_consts2,
       );
     let _ = circuit.synthesize(&mut cs2);
-    let (inst2, witness2) = cs2.r1cs_instance_and_witness(&shape2, &gens2).unwrap();
+    let (inst2, witness2) = cs2.r1cs_instance_and_witness(&shape2, &ck2).unwrap();
     // Make sure that it is satisfiable
-    assert!(shape2.is_sat(&gens2, &inst2, &witness2).is_ok());
+    assert!(shape2.is_sat(&ck2, &inst2, &witness2).is_ok());
   }
 }

src/gadgets/ecc.rs

@@ -976,12 +976,12 @@ mod tests {
     let _ = synthesize_smul::<G1, _>(cs.namespace(|| "synthesize"));
     println!("Number of constraints: {}", cs.num_constraints());
     let shape = cs.r1cs_shape();
-    let gens = cs.r1cs_gens();
+    let ck = cs.commitment_key();
 
     // Then the satisfying assignment
     let mut cs: SatisfyingAssignment<G2> = SatisfyingAssignment::new();
     let (a, e, s) = synthesize_smul::<G1, _>(cs.namespace(|| "synthesize"));
-    let (inst, witness) = cs.r1cs_instance_and_witness(&shape, &gens).unwrap();
+    let (inst, witness) = cs.r1cs_instance_and_witness(&shape, &ck).unwrap();
 
     let a_p: Point<G1> = Point::new(
       a.x.get_value().unwrap(),
@@ -996,7 +996,7 @@ mod tests {
     let e_new = a_p.scalar_mul(&s);
     assert!(e_p.x == e_new.x && e_p.y == e_new.y);
     // Make sure that this is satisfiable
-    assert!(shape.is_sat(&gens, &inst, &witness).is_ok());
+    assert!(shape.is_sat(&ck, &inst, &witness).is_ok());
   }
 
   fn synthesize_add_equal<G, CS>(mut cs: CS) -> (AllocatedPoint<G>, AllocatedPoint<G>)
@@ -1018,12 +1018,12 @@ mod tests {
     let _ = synthesize_add_equal::<G1, _>(cs.namespace(|| "synthesize add equal"));
     println!("Number of constraints: {}", cs.num_constraints());
     let shape = cs.r1cs_shape();
-    let gens = cs.r1cs_gens();
+    let ck = cs.commitment_key();
 
     // Then the satisfying assignment
     let mut cs: SatisfyingAssignment<G2> = SatisfyingAssignment::new();
     let (a, e) = synthesize_add_equal::<G1, _>(cs.namespace(|| "synthesize add equal"));
-    let (inst, witness) = cs.r1cs_instance_and_witness(&shape, &gens).unwrap();
+    let (inst, witness) = cs.r1cs_instance_and_witness(&shape, &ck).unwrap();
     let a_p: Point<G1> = Point::new(
       a.x.get_value().unwrap(),
       a.y.get_value().unwrap(),
@@ -1037,7 +1037,7 @@ mod tests {
     let e_new = a_p.add(&a_p);
     assert!(e_p.x == e_new.x && e_p.y == e_new.y);
     // Make sure that it is satisfiable
-    assert!(shape.is_sat(&gens, &inst, &witness).is_ok());
+    assert!(shape.is_sat(&ck, &inst, &witness).is_ok());
   }
 
   fn synthesize_add_negation<G, CS>(mut cs: CS) -> AllocatedPoint<G>
@@ -1064,19 +1064,19 @@ mod tests {
     let _ = synthesize_add_negation::<G1, _>(cs.namespace(|| "synthesize add equal"));
     println!("Number of constraints: {}", cs.num_constraints());
     let shape = cs.r1cs_shape();
-    let gens = cs.r1cs_gens();
+    let ck = cs.commitment_key();
 
     // Then the satisfying assignment
     let mut cs: SatisfyingAssignment<G2> = SatisfyingAssignment::new();
     let e = synthesize_add_negation::<G1, _>(cs.namespace(|| "synthesize add negation"));
-    let (inst, witness) = cs.r1cs_instance_and_witness(&shape, &gens).unwrap();
+    let (inst, witness) = cs.r1cs_instance_and_witness(&shape, &ck).unwrap();
     let e_p: Point<G1> = Point::new(
       e.x.get_value().unwrap(),
       e.y.get_value().unwrap(),
       e.is_infinity.get_value().unwrap() == <G1 as Group>::Base::one(),
     );
     assert!(e_p.is_infinity);
     // Make sure that it is satisfiable
-    assert!(shape.is_sat(&gens, &inst, &witness).is_ok());
+    assert!(shape.is_sat(&ck, &inst, &witness).is_ok());
   }
 }