Cache values in VerifyingKey that can be computed on construction

halo2_proofs/src/plonk.rs

@@ -6,6 +6,7 @@
 //! [plonk]: https://eprint.iacr.org/2019/953
 
 use blake2b_simd::Params as Blake2bParams;
+use group::ff::Field;
 
 use crate::arithmetic::{CurveAffine, FieldExt};
 use crate::helpers::CurveRead;
@@ -43,26 +44,54 @@ pub struct VerifyingKey<C: CurveAffine> {
     fixed_commitments: Vec<C>,
     permutation: permutation::VerifyingKey<C>,
     cs: ConstraintSystem<C::Scalar>,
+    /// Cached maximum degree of `cs` (which doesn't change after construction).
+    cs_degree: usize,
+    /// The representative of this `VerifyingKey` in transcripts.
+    transcript_repr: C::Scalar,
 }
 
 impl<C: CurveAffine> VerifyingKey<C> {
-    /// Hashes a verification key into a transcript.
-    pub fn hash_into<E: EncodedChallenge<C>, T: Transcript<C, E>>(
-        &self,
-        transcript: &mut T,
-    ) -> io::Result<()> {
+    fn from_parts(
+        domain: EvaluationDomain<C::Scalar>,
+        fixed_commitments: Vec<C>,
+        permutation: permutation::VerifyingKey<C>,
+        cs: ConstraintSystem<C::Scalar>,
+    ) -> Self {
+        // Compute cached values.
+        let cs_degree = cs.degree();
+
+        let mut vk = Self {
+            domain,
+            fixed_commitments,
+            permutation,
+            cs,
+            cs_degree,
+            // Temporary, this is not pinned.
+            transcript_repr: C::Scalar::zero(),
+        };
+
         let mut hasher = Blake2bParams::new()
             .hash_length(64)
             .personal(b"Halo2-Verify-Key")
             .to_state();
 
-        let s = format!("{:?}", self.pinned());
+        let s = format!("{:?}", vk.pinned());
 
         hasher.update(&(s.len() as u64).to_le_bytes());
         hasher.update(s.as_bytes());
 
         // Hash in final Blake2bState
-        transcript.common_scalar(C::Scalar::from_bytes_wide(hasher.finalize().as_array()))?;
+        vk.transcript_repr = C::Scalar::from_bytes_wide(hasher.finalize().as_array());
+
+        vk
+    }
+
+    /// Hashes a verification key into a transcript.
+    pub fn hash_into<E: EncodedChallenge<C>, T: Transcript<C, E>>(
+        &self,
+        transcript: &mut T,
+    ) -> io::Result<()> {
+        transcript.common_scalar(self.transcript_repr)?;
 
         Ok(())
     }

halo2_proofs/src/plonk/keygen.rs

@@ -234,12 +234,12 @@ where
         .map(|poly| params.commit_lagrange(poly, Blind::default()).to_affine())
         .collect();
 
-    Ok(VerifyingKey {
+    Ok(VerifyingKey::from_parts(
         domain,
         fixed_commitments,
-        permutation: permutation_vk,
+        permutation_vk,
         cs,
-    })
+    ))
 }
 
 /// Generate a `ProvingKey` from a `VerifyingKey` and an instance of `Circuit`.

halo2_proofs/src/plonk/permutation/prover.rs

@@ -69,8 +69,8 @@ impl Argument {
         // We need to multiply by z(X) and (1 - (l_last(X) + l_blind(X))). This
         // will never underflow because of the requirement of at least a degree
         // 3 circuit for the permutation argument.
-        assert!(pk.vk.cs.degree() >= 3);
-        let chunk_len = pk.vk.cs.degree() - 2;
+        assert!(pk.vk.cs_degree >= 3);
+        let chunk_len = pk.vk.cs_degree - 2;
         let blinding_factors = pk.vk.cs.blinding_factors();
 
         // Each column gets its own delta power.
@@ -211,7 +211,7 @@ impl<C: CurveAffine, Ev: Copy + Send + Sync> Committed<C, Ev> {
         Constructed<C>,
         impl Iterator<Item = poly::Ast<Ev, C::Scalar, ExtendedLagrangeCoeff>> + 'a,
     ) {
-        let chunk_len = pk.vk.cs.degree() - 2;
+        let chunk_len = pk.vk.cs_degree - 2;
         let blinding_factors = pk.vk.cs.blinding_factors();
         let last_rotation = Rotation(-((blinding_factors + 1) as i32));
 

halo2_proofs/src/plonk/permutation/verifier.rs

@@ -39,7 +39,7 @@ impl Argument {
         vk: &plonk::VerifyingKey<C>,
         transcript: &mut T,
     ) -> Result<Committed<C>, Error> {
-        let chunk_len = vk.cs.degree() - 2;
+        let chunk_len = vk.cs_degree - 2;
 
         let permutation_product_commitments = self
             .columns
@@ -114,7 +114,7 @@ impl<C: CurveAffine> Evaluated<C> {
         gamma: ChallengeGamma<C>,
         x: ChallengeX<C>,
     ) -> impl Iterator<Item = C::Scalar> + 'a {
-        let chunk_len = vk.cs.degree() - 2;
+        let chunk_len = vk.cs_degree - 2;
         iter::empty()
             // Enforce only for the first set.
             // l_0(X) * (1 - z_0(X)) = 0