Batch Verification API

Cargo.toml

@@ -25,6 +25,7 @@ subtle = "2.2.1"
 
 [dev-dependencies]
 bls12_381 = "0.4"
+criterion = "0.3"
 hex-literal = "0.3"
 rand = "0.8"
 rand_xorshift = "0.3"
@@ -40,5 +41,9 @@ name = "mimc"
 path = "tests/mimc.rs"
 required-features = ["groth16"]
 
+[[bench]]
+name = "batch"
+harness = false
+
 [badges]
 maintenance = { status = "actively-developed" }

benches/batch.rs

@@ -0,0 +1,98 @@
+use criterion::{criterion_group, criterion_main, BenchmarkId, Criterion, Throughput};
+
+use bls12_381::Bls12;
+use ff::Field;
+use rand::thread_rng;
+
+use bellman::groth16::{
+    batch, create_random_proof, generate_random_parameters, prepare_verifying_key, verify_proof,
+};
+
+#[path = "../tests/common/mod.rs"]
+mod common;
+
+use common::*;
+
+fn bench_batch_verify(c: &mut Criterion) {
+    let mut group = c.benchmark_group("Batch Verification");
+
+    for &n in [8usize, 16, 24, 32, 40, 48, 56, 64].iter() {
+        group.throughput(Throughput::Elements(n as u64));
+
+        let mut rng = thread_rng();
+
+        // Generate the MiMC round constants
+        let constants = (0..MIMC_ROUNDS)
+            .map(|_| bls12_381::Scalar::random(&mut rng))
+            .collect::<Vec<_>>();
+
+        // Create parameters for our circuit
+        let params = {
+            let c = MiMCDemo {
+                xl: None,
+                xr: None,
+                constants: &constants,
+            };
+
+            generate_random_parameters::<Bls12, _, _>(c, &mut rng).unwrap()
+        };
+
+        // Prepare the verification key (for proof verification)
+        let pvk = prepare_verifying_key(&params.vk);
+
+        let proofs = {
+            std::iter::repeat_with(|| {
+                // Generate a random preimage and compute the image
+                let xl = bls12_381::Scalar::random(&mut rng);
+                let xr = bls12_381::Scalar::random(&mut rng);
+                let image = mimc(xl, xr, &constants);
+
+                // Create an instance of our circuit (with the
+                // witness)
+                let c = MiMCDemo {
+                    xl: Some(xl),
+                    xr: Some(xr),
+                    constants: &constants,
+                };
+
+                // Create a groth16 proof with our parameters.
+                let proof = create_random_proof(c, &params, &mut rng).unwrap();
+
+                (proof, image)
+            })
+        }
+        .take(n)
+        .collect::<Vec<_>>();
+
+        group.bench_with_input(
+            BenchmarkId::new("Unbatched verification", n),
+            &proofs,
+            |b, proofs| {
+                b.iter(|| {
+                    for (proof, input) in proofs.iter() {
+                        let _ = verify_proof(&pvk, &proof, &[*input]);
+                    }
+                })
+            },
+        );
+
+        group.bench_with_input(
+            BenchmarkId::new("Batched verification", n),
+            &proofs,
+            |b, proofs| {
+                b.iter(|| {
+                    let mut batch = batch::Verifier::new();
+                    for (proof, input) in proofs.iter() {
+                        batch.queue((proof.clone(), vec![*input]));
+                    }
+                    batch.verify(&mut rng, &params.vk)
+                })
+            },
+        );
+    }
+
+    group.finish();
+}
+
+criterion_group!(benches, bench_batch_verify);
+criterion_main!(benches);

src/groth16/mod.rs

@@ -23,7 +23,7 @@ pub use self::generator::*;
 pub use self::prover::*;
 pub use self::verifier::*;
 
-#[derive(Clone)]
+#[derive(Clone, Debug)]
 pub struct Proof<E: Engine> {
     pub a: E::G1Affine,
     pub b: E::G2Affine,

src/groth16/tests/dummy_engine.rs

@@ -342,7 +342,7 @@ impl Engine for DummyEngine {
     type Gt = Fr;
 
     fn pairing(p: &Self::G1Affine, q: &Self::G2Affine) -> Self::Gt {
-        Self::multi_miller_loop(&[(p, &(*q).into())]).final_exponentiation()
+        Self::multi_miller_loop(&[(p, &(*q))]).final_exponentiation()
     }
 }
 

src/groth16/verifier.rs

@@ -6,6 +6,8 @@ use super::{PreparedVerifyingKey, Proof, VerifyingKey};
 
 use crate::VerificationError;
 
+pub mod batch;
+
 pub fn prepare_verifying_key<E: MultiMillerLoop>(vk: &VerifyingKey<E>) -> PreparedVerifyingKey<E> {
     let gamma = vk.gamma_g2.neg();
     let delta = vk.delta_g2.neg();

src/groth16/verifier/batch.rs

@@ -0,0 +1,170 @@
+//! Performs batch Groth16 proof verification.
+//!
+//! Batch verification asks whether *all* proofs in some set are valid,
+//! rather than asking whether *each* of them is valid. This allows sharing
+//! computations among all proof verifications, performing less work overall
+//! at the cost of higher latency (the entire batch must complete), complexity of
+//! caller code (which must assemble a batch of proofs across work-items),
+//! and loss of the ability to easily pinpoint failing proofs.
+//!
+//! This batch verification implementation is non-adaptive, in the sense that it
+//! assumes that all the proofs in the batch are verifiable by the same
+//! `VerifyingKey`. The reason is that if you have different proof statements,
+//! you need to specify which statement you are proving, which means that you
+//! need to refer to or lookup a particular `VerifyingKey`. In practice, with
+//! large enough batches, it's manageable and not much worse performance-wise to
+//! keep batches of each statement type, vs one large adaptive batch.
+
+use std::ops::AddAssign;
+
+use ff::Field;
+use group::{Curve, Group};
+use pairing::{MillerLoopResult, MultiMillerLoop};
+use rand_core::{CryptoRng, RngCore};
+
+use crate::{
+    groth16::{PreparedVerifyingKey, Proof, VerifyingKey},
+    VerificationError,
+};
+
+/// A batch verification item.
+///
+/// This struct exists to allow batch processing to be decoupled from the
+/// lifetime of the message. This is useful when using the batch verification
+/// API in an async context.
+#[derive(Clone, Debug)]
+pub struct Item<E: MultiMillerLoop> {
+    proof: Proof<E>,
+    inputs: Vec<E::Fr>,
+}
+
+impl<E: MultiMillerLoop> From<(&Proof<E>, &[E::Fr])> for Item<E> {
+    fn from((proof, inputs): (&Proof<E>, &[E::Fr])) -> Self {
+        (proof.clone(), inputs.to_owned()).into()
+    }
+}
+
+impl<E: MultiMillerLoop> From<(Proof<E>, Vec<E::Fr>)> for Item<E> {
+    fn from((proof, inputs): (Proof<E>, Vec<E::Fr>)) -> Self {
+        Self { proof, inputs }
+    }
+}
+
+impl<E: MultiMillerLoop> Item<E> {
+    /// Perform non-batched verification of this `Item`.
+    ///
+    /// This is useful (in combination with `Item::clone`) for implementing
+    /// fallback logic when batch verification fails.
+    pub fn verify_single(self, pvk: &PreparedVerifyingKey<E>) -> Result<(), VerificationError> {
+        super::verify_proof(pvk, &self.proof, &self.inputs)
+    }
+}
+
+/// A batch verification context.
+///
+/// In practice, you would create a batch verifier for each proof statement
+/// requiring the same `VerifyingKey`.
+#[derive(Debug)]
+pub struct Verifier<E: MultiMillerLoop> {
+    items: Vec<Item<E>>,
+}
+
+// Need to impl Default by hand to avoid a derived E: Default bound
+impl<E: MultiMillerLoop> Default for Verifier<E> {
+    fn default() -> Self {
+        Self { items: Vec::new() }
+    }
+}
+
+impl<E: MultiMillerLoop> Verifier<E>
+where
+    E::G1: AddAssign<E::G1>,
+{
+    /// Construct a new batch verifier.
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    /// Queue a (proof, inputs) tuple for verification.
+    pub fn queue<I: Into<Item<E>>>(&mut self, item: I) {
+        self.items.push(item.into())
+    }
+
+    /// Perform batch verification with a particular `VerifyingKey`, returning
+    /// `Ok(())` if all proofs were verified and `VerificationError` otherwise.
+    #[allow(non_snake_case)]
+    pub fn verify<R: RngCore + CryptoRng>(
+        self,
+        mut rng: R,
+        vk: &VerifyingKey<E>,
+    ) -> Result<(), VerificationError> {
+        if self
+            .items
+            .iter()
+            .any(|Item { inputs, .. }| inputs.len() + 1 != vk.ic.len())
+        {
+            return Err(VerificationError::InvalidVerifyingKey);
+        }
+
+        let mut ml_terms = Vec::<(E::G1Affine, E::G2Prepared)>::new();
+        let mut acc_Gammas = vec![E::Fr::zero(); vk.ic.len()];
+        let mut acc_Delta = E::G1::identity();
+        let mut acc_Y = E::Fr::zero();
+
+        for Item { proof, inputs } in self.items.into_iter() {
+            // The spec is explicit that z != 0.  Field::random is defined to
+            // return a uniformly-random field element (which may be 0), so we
+            // loop until it's not, avoiding needing an assert or throwing an
+            // error through no fault of the batch items. This will likely never
+            // actually loop, but handles the edge case.
+            let z = loop {
+                let z = E::Fr::random(&mut rng);
+                if !z.is_zero() {
+                    break z;
+                }
+            };
+
+            ml_terms.push(((proof.a * &z).into(), (-proof.b).into()));
+
+            acc_Gammas[0] += &z; // a_0 is implicitly set to 1
+            for (a_i, acc_Gamma_i) in Iterator::zip(inputs.iter(), acc_Gammas.iter_mut().skip(1)) {
+                *acc_Gamma_i += &(z * a_i);
+            }
+            acc_Delta += proof.c * &z;
+            acc_Y += &z;
+        }
+
+        ml_terms.push((acc_Delta.to_affine(), E::G2Prepared::from(vk.delta_g2)));
+
+        let Psi = vk
+            .ic
+            .iter()
+            .zip(acc_Gammas.iter())
+            .map(|(&Psi_i, acc_Gamma_i)| Psi_i * acc_Gamma_i)
+            .sum();
+
+        ml_terms.push((E::G1Affine::from(Psi), E::G2Prepared::from(vk.gamma_g2)));
+
+        // Covers the [acc_Y]⋅e(alpha_g1, beta_g2) component
+        //
+        // The multiplication by acc_Y is expensive -- it involves
+        // exponentiating by acc_Y because the result of the pairing is an
+        // element of a multiplicative subgroup of a large extension field.
+        // Instead, we add
+        //     ([acc_Y]⋅alpha_g1, beta_g2)
+        // to our Miller loop terms because
+        //     [acc_Y]⋅e(alpha_g1, beta_g2) = e([acc_Y]⋅alpha_g1, beta_g2)
+        ml_terms.push((
+            E::G1Affine::from(vk.alpha_g1 * &acc_Y),
+            E::G2Prepared::from(vk.beta_g2),
+        ));
+
+        let ml_terms = ml_terms.iter().map(|(a, b)| (a, b)).collect::<Vec<_>>();
+
+        if E::multi_miller_loop(&ml_terms[..]).final_exponentiation() == E::Gt::identity() {
+            Ok(())
+        } else {
+            Err(VerificationError::InvalidProof)
+        }
+    }
+}