Support for multilinear KZG commitments

Cargo.toml

@@ -3,7 +3,7 @@ name = "nova-snark"
 version = "0.31.0"
 authors = ["Srinath Setty <[email protected]>"]
 edition = "2021"
-description = "Recursive zkSNARKs without trusted setup"
+description = "High-speed recursive arguments from folding schemes"
 documentation = "https://docs.rs/nova-snark/"
 readme = "README.md"
 repository = "https://github.com/Microsoft/Nova"

README.md

@@ -1,16 +1,21 @@
-# Nova: Recursive SNARKs without trusted setup
+# Nova: High-speed recursive arguments from folding schemes
 
 Nova is a high-speed recursive SNARK (a SNARK is type cryptographic proof system that enables a prover to prove a mathematical statement to a verifier with a short proof and succinct verification, and a recursive SNARK enables producing proofs that prove statements about prior proofs). 
 
 More precisely, Nova achieves [incrementally verifiable computation (IVC)](https://iacr.org/archive/tcc2008/49480001/49480001.pdf), a powerful cryptographic primitive that allows a prover to produce a proof of correct execution of a "long running" sequential computations in an incremental fashion. For example, IVC enables the following: The prover takes as input a proof $\pi_i$ proving the the first $i$ steps of its computation and then update it to produce a proof $\pi_{i+1}$ proving the correct execution of the first $i + 1$ steps. Crucially, the prover's work to update the proof does not depend on the number of steps executed thus far, and the verifier's work to verify a proof does not grow with the number of steps in the computation. IVC schemes including Nova have a wide variety of applications such as Rollups, verifiable delay functions (VDFs), succinct blockchains, incrementally verifiable versions of [verifiable state machines](https://eprint.iacr.org/2020/758.pdf), and, more generally, proofs of (virtual) machine executions (e.g., EVM, RISC-V). 
 
 A distinctive aspect of Nova is that it is the simplest recursive proof system in the literature, yet it provides the fastest prover. Furthermore, it achieves the smallest verifier circuit (a key metric to minimize in this context): the circuit is constant-sized and its size is about 10,000 multiplication gates. Nova is constructed from a simple primitive called a *folding scheme*, a cryptographic primitive that reduces the task of checking two NP statements into the task of checking a single NP statement. 
 
-## Tests and examples
-This repository provides `nova-snark,` a Rust library implementation of Nova on a cycle of elliptic curves. The code currently supports Pallas/Vesta (i.e., Pasta curves) and BN254/Grumpkin elliptic curve cycles. One can use Nova with other elliptic curve cycles (e.g., secp/secq) by providing an implementation of Nova's traits for those curves (e.g., see `src/provider/mod.rs`).
+## Library details
+This repository provides `nova-snark,` a Rust library implementation of Nova on a cycle of elliptic curves. The code currently supports Pallas/Vesta (i.e., Pasta curves), BN254/Grumpkin, and secp/secq elliptic curve cycles. One can use Nova with other elliptic curve cycles by providing an implementation of Nova's traits for those curves (e.g., see `src/provider/mod.rs`).
 
 We also implement a SNARK, based on [Spartan](https://eprint.iacr.org/2019/550.pdf), to compress IVC proofs produced by Nova.
 
+At its core, Nova relies on a commitment scheme for vectors, and IVC proof compression with Spartan relies on interpreting commitments to vectors as commitments to multilinear polynomials and prove evaluations of committed polynomials. 
+
+The current code implements two commitment schemes: (1) Pedersen commitments with IPA-based evaluation argument (supported on all the three curve cycles); and (2) multilinear KZG commitments and evaluation argument (supported on curves with support for pairings e.g., BN254). For more details, please see the test `test_ivc_nontrivial_with_compression`. The multilinear KZG instantiation requires a universal trusted setup ("powers of tau"). In the `setup` method in `src/provider/mlkzg.rs`, one can load group elements produced in an existing KZG trusted setup (that was created for other proof systems based on univariate polynomials such as Plonk or Marlin or variants), but the library does not currently do so. 
+
+## Tests and examples
 To run tests (we recommend the release mode to drastically shorten run times):
 ```text
 cargo test --release

src/lib.rs

@@ -856,8 +856,8 @@ mod tests {
   use super::*;
   use crate::{
     provider::{
-      pedersen::CommitmentKeyExtTrait, traits::DlogGroup, Bn256Engine, GrumpkinEngine,
-      PallasEngine, Secp256k1Engine, Secq256k1Engine, VestaEngine,
+      mlkzg::Bn256EngineKZG, pedersen::CommitmentKeyExtTrait, traits::DlogGroup, Bn256Engine,
+      GrumpkinEngine, PallasEngine, Secp256k1Engine, Secq256k1Engine, VestaEngine,
     },
     traits::{evaluation::EvaluationEngineTrait, snark::default_ck_hint},
   };
@@ -1233,6 +1233,13 @@ mod tests {
     test_ivc_nontrivial_with_compression_with::<PallasEngine, VestaEngine, EE<_>, EE<_>>();
     test_ivc_nontrivial_with_compression_with::<Bn256Engine, GrumpkinEngine, EE<_>, EE<_>>();
     test_ivc_nontrivial_with_compression_with::<Secp256k1Engine, Secq256k1Engine, EE<_>, EE<_>>();
+
+    test_ivc_nontrivial_with_spark_compression_with::<
+      Bn256EngineKZG,
+      GrumpkinEngine,
+      provider::mlkzg::EvaluationEngine<_>,
+      EE<_>,
+    >();
   }
 
   fn test_ivc_nontrivial_with_spark_compression_with<E1, E2, EE1, EE2>()

src/provider/bn256_grumpkin.rs

@@ -3,7 +3,7 @@ use crate::{
   impl_traits,
   provider::{
     msm::cpu_best_msm,
-    traits::{CompressedGroup, DlogGroup},
+    traits::{CompressedGroup, DlogGroup, PairingGroup},
   },
   traits::{Group, PrimeFieldExt, TranscriptReprTrait},
 };
@@ -19,7 +19,8 @@ use sha3::Shake256;
 use std::io::Read;
 
 use halo2curves::bn256::{
-  G1Affine as Bn256Affine, G1Compressed as Bn256Compressed, G1 as Bn256Point,
+  pairing, G1Affine as Bn256Affine, G1Compressed as Bn256Compressed, G2Affine, G2Compressed, Gt,
+  G1 as Bn256Point, G2,
 };
 use halo2curves::grumpkin::{
   G1Affine as GrumpkinAffine, G1Compressed as GrumpkinCompressed, G1 as GrumpkinPoint,
@@ -52,3 +53,94 @@ impl_traits!(
   "30644e72e131a029b85045b68181585d97816a916871ca8d3c208c16d87cfd47",
   "30644e72e131a029b85045b68181585d2833e84879b9709143e1f593f0000001"
 );
+
+impl PairingGroup for Bn256Point {
+  type G2 = G2;
+  type GT = Gt;
+
+  fn pairing(p: &Self, q: &Self::G2) -> Self::GT {
+    pairing(&p.to_affine(), &q.to_affine())
+  }
+}
+
+impl Group for G2 {
+  type Base = bn256::Base;
+  type Scalar = bn256::Scalar;
+
+  fn group_params() -> (Self::Base, Self::Base, BigInt, BigInt) {
+    let A = bn256::Point::a();
+    let B = bn256::Point::b();
+    let order = BigInt::from_str_radix(
+      "30644e72e131a029b85045b68181585d2833e84879b9709143e1f593f0000001",
+      16,
+    )
+    .unwrap();
+    let base = BigInt::from_str_radix(
+      "30644e72e131a029b85045b68181585d97816a916871ca8d3c208c16d87cfd47",
+      16,
+    )
+    .unwrap();
+
+    (A, B, order, base)
+  }
+}
+
+impl DlogGroup for G2 {
+  type CompressedGroupElement = G2Compressed;
+  type PreprocessedGroupElement = G2Affine;
+
+  fn vartime_multiscalar_mul(
+    scalars: &[Self::Scalar],
+    bases: &[Self::PreprocessedGroupElement],
+  ) -> Self {
+    cpu_best_msm(scalars, bases)
+  }
+
+  fn preprocessed(&self) -> Self::PreprocessedGroupElement {
+    self.to_affine()
+  }
+
+  fn group(p: &Self::PreprocessedGroupElement) -> Self {
+    G2::from(*p)
+  }
+
+  fn compress(&self) -> Self::CompressedGroupElement {
+    self.to_bytes()
+  }
+
+  fn from_label(_label: &'static [u8], _n: usize) -> Vec<Self::PreprocessedGroupElement> {
+    unimplemented!()
+  }
+
+  fn zero() -> Self {
+    G2::identity()
+  }
+
+  fn gen() -> Self {
+    G2::generator()
+  }
+
+  fn to_coordinates(&self) -> (Self::Base, Self::Base, bool) {
+    unimplemented!()
+  }
+}
+
+impl<G: DlogGroup> TranscriptReprTrait<G> for G2Compressed {
+  fn to_transcript_bytes(&self) -> Vec<u8> {
+    self.as_ref().to_vec()
+  }
+}
+
+impl CompressedGroup for G2Compressed {
+  type GroupElement = G2;
+
+  fn decompress(&self) -> Option<G2> {
+    Some(G2::from_bytes(self).unwrap())
+  }
+}
+
+impl<G: DlogGroup> TranscriptReprTrait<G> for G2Affine {
+  fn to_transcript_bytes(&self) -> Vec<u8> {
+    unimplemented!()
+  }
+}