Feat/213 chunked verifier with folded fp12 (BitVM#215)

* init: sync with main branch

* chore: reuse constraint synthesizer

* fix: g1 hinted msm

* fix g2 double line removes coeffs

* add assigner and elements trait

changing elem trait

changing elem trait

fix issues with preimage

fix issues with preimage

wip: cargo fix

wip: cargo fix 2

remove comments

* feat: undo cargo fix on out of scope files

* select assertion to corrupt randomly

* feat: undo cargo fix on out of scope files and remove unneeded test

* revert changes to winternitz.rs

* chunker new line at eof

* feat: change wots api to use existing winternitz module

* chore: move tapscripts to individual files

* chore: move tapscript tests to individual files

* doc: add few notes on muls and point ops

* chore: add comments

* feat: add input validity checks on tapscripts

wip: input validity checks added to chunk methods

feat: integrate premiller verification checks to next tapscripts

feat: integrate msm verification checks to next tapscripts

wip: input validity checks during assertion

fix(disprove-exec): issue with chunk_precompute_p py zero

* feat: cleanup interface to chunker and add more tests

init: api utils

chore: remove legacy api code

feat: update interface to chunker

* test(api): add full execution test

* chore: sync with main branch

* chore: move g16 tests and cleanup

chore: replace with braces on script macro

chore: move g16 tests to api

chore: fix tests

chore: adding RUST_MIN_STACK flag to ci

* chore: cleanup and reorg methods

chore: remove panics add Result

chore: cargo lock

* chore(bn254_g2): cleanup g2 point ops functions

* chore: add comments to data types

* fix: handle when input to doubling is inf

* feat: remove numerator is zero check

* feat: include free subgroup check on last tapscript

* fix: remove calculation for s param of proof

---------

Co-authored-by: Manish Bista <manishbista@Manishs-MBP.lan>
Co-authored-by: Manish Bista <manishbista@Manishs-MacBook-Pro.local>

Author: 3 people

.github/workflows/CI.yml

@@ -65,7 +65,7 @@ jobs:
 
     - name: Run tests
       run: |
-        cargo test -- --skip bridge::
+        RUST_MIN_STACK=104857600 cargo test -- --skip bridge::
   
 #  test_bridge:
 #    if: github.event.pull_request.draft == false

Cargo.lock

@@ -48,7 +48,7 @@ serde-big-array = "0.5.1"
 num-bigint = { version = "0.4.4", features = ["rand"] }
 ark-std = { version = "0.4.0", default-features = false, features = ["print-trace"] }
 ark-crypto-primitives = { git = "https://github.com/arkworks-rs/crypto-primitives", features = ["snark", "sponge"] }
-ark-relations = { git = "https://github.com/arkworks-rs/snark/" }
+ark-relations = { version = "0.4.0" }
 serial_test = "*"
 tqdm = "0.7"
 secp256k1 = { version = "0.29.1", features = ["global-context"]}

Cargo.toml

@@ -10,6 +10,7 @@ pub struct BigIntImpl<const N_BITS: u32, const LIMB_SIZE: u32> {}
 
 impl<const N_BITS: u32, const LIMB_SIZE: u32> BigIntImpl<N_BITS, LIMB_SIZE> {
     pub const N_BITS: u32 = N_BITS;
+    pub const LIMB_SIZE: u32 = LIMB_SIZE;
     pub const N_LIMBS: u32 = N_BITS.div_ceil(LIMB_SIZE);
     pub const HEAD: u32 = N_BITS - (Self::N_LIMBS - 1) * LIMB_SIZE;
     pub const HEAD_OFFSET: u32 = 1u32 << Self::HEAD;

bitvm/src/bigint/mod.rs

@@ -685,6 +685,64 @@ pub trait Fp254Impl {
 
         (script, hints)
     }
+
+    #[allow(clippy::too_many_arguments)]
+    fn hinted_mul_lc4(
+        a_depth: u32,
+        a: ark_bn254::Fq,
+        b_depth: u32,
+        b: ark_bn254::Fq,
+        c_depth: u32,
+        c: ark_bn254::Fq,
+        d_depth: u32,
+        d: ark_bn254::Fq,
+
+        e_depth: u32,
+        e: ark_bn254::Fq,
+        f_depth: u32,
+        f: ark_bn254::Fq,
+        g_depth: u32,
+        g: ark_bn254::Fq,
+        h_depth: u32,
+        h: ark_bn254::Fq,
+    ) -> (Script, Vec<Hint>) {
+        assert!(a_depth > b_depth && b_depth > c_depth && c_depth > d_depth && d_depth > e_depth && e_depth > f_depth && f_depth > g_depth && g_depth > h_depth);
+
+        let mut hints = Vec::new();
+
+        let modulus = &Fq::modulus_as_bigint();
+
+        let x1 = BigInt::from_str(&a.to_string()).unwrap();
+        let y1 = BigInt::from_str(&b.to_string()).unwrap();
+        let z1 = BigInt::from_str(&c.to_string()).unwrap();
+        let w1 = BigInt::from_str(&d.to_string()).unwrap();
+
+        let x2 = BigInt::from_str(&e.to_string()).unwrap();
+        let y2 = BigInt::from_str(&f.to_string()).unwrap();
+        let z2 = BigInt::from_str(&g.to_string()).unwrap();
+        let w2 = BigInt::from_str(&h.to_string()).unwrap();
+
+        let q = (x1 * x2 + y1 * y2 + z1 * z2 + w1 * w2) / modulus;
+
+        let script = script! {
+            for _ in 0..Self::N_LIMBS {
+                OP_DEPTH OP_1SUB OP_ROLL // hints
+            }
+            // { fq_push(ark_bn254::Fq::from_str(&q.to_string()).unwrap()) }
+            { Fq::roll(a_depth + 1) }
+            { Fq::roll(b_depth + 2) }
+            { Fq::roll(c_depth + 3) }
+            { Fq::roll(d_depth + 4) }
+            { Fq::roll(e_depth + 5) }
+            { Fq::roll(f_depth + 6) }
+            { Fq::roll(g_depth + 7) }
+            { Fq::roll(h_depth + 8) }
+            { Fq::tmul_lc4() }
+        };
+        hints.push(Hint::BigIntegerTmulLC4(q));
+
+        (script, hints)
+    }
 
     #[allow(clippy::too_many_arguments)]
     fn hinted_mul_lc2_keep_elements(

bitvm/src/bn254/fp254impl.rs

@@ -47,6 +47,12 @@ impl Fq {
         }
     }
 
+    pub fn tmul_lc4() -> Script {
+        script!{ 
+            { <Fq as Fp254Mul4LC>::tmul() }
+        }
+    }
+
     pub const fn bigint_tmul_lc_1() -> (u32, u32) {
         const X: u32 = <Fq as Fp254Mul>::T::N_BITS;
         const Y: u32 = <Fq as Fp254Mul>::LIMB_SIZE;
@@ -58,6 +64,12 @@ impl Fq {
         const Y: u32 = <Fq as Fp254Mul2LC>::LIMB_SIZE;
         (X, Y)
     }
+
+    pub const fn bigint_tmul_lc_4() -> (u32, u32) {
+        const X: u32 = <Fq as Fp254Mul4LC>::T::N_BITS;
+        const Y: u32 = <Fq as Fp254Mul4LC>::LIMB_SIZE;
+        (X, Y)
+    }
 
     #[inline]
     pub fn push(a: ark_bn254::Fq) -> Script {
@@ -396,6 +408,7 @@ macro_rules! fp_lc_mul {
 
 fp_lc_mul!(Mul, 4, 4, [true]);
 fp_lc_mul!(Mul2LC, 3, 3, [true, true]);
+fp_lc_mul!(Mul4LC, 3, 3, [true, true, true, true]);
 
 #[cfg(test)]
 mod test {

bitvm/src/bn254/fq.rs

@@ -217,6 +217,50 @@ impl Fq2 {
         (script, hints)
     }
 
+    pub fn hinted_mul_lc4_keep_elements(
+        a: ark_bn254::Fq2, b:ark_bn254::Fq2, c:ark_bn254::Fq2, d:ark_bn254::Fq2
+    ) -> (Script, Vec<Hint>) {
+
+        let mut hints = Vec::new();
+
+        let (hinted_script1, hint1) = Fq::hinted_mul_lc4(7, a.c0, 6, -a.c1, 5, c.c0, 4, -c.c1, 3, b.c0, 2, b.c1, 1, d.c0, 0, d.c1);
+        let (hinted_script2, hint2) = Fq::hinted_mul_lc4(7, a.c0, 6, a.c1, 5, c.c0, 4, c.c1, 3, b.c1, 2, b.c0, 1, d.c1, 0, d.c0);
+
+        let script = script! {
+            // [a, b, c, d] 
+            {Fq2::copy(6)}
+            {Fq::neg(0)}
+            // [a, b, c, d, -a]
+            {Fq2::copy(4)}
+            {Fq::neg(0)}
+            // [a, b, c, d, -a, -c]
+            {Fq2::copy(8)}
+            // [a, b, c, d, -a, -c, b]
+            {Fq2::copy(6)}
+            // [a, b, c, d, -a, -c, b, d]
+            {hinted_script1}
+            {Fq::toaltstack()}
+            // [a, b, c, d]
+            {Fq2::copy(6)} {Fq2::copy(6)} {Fq2::copy(6)} {Fq2::copy(6)} 
+            // [a, b, c, d, a, b, c, d]
+            {Fq2::toaltstack()} {Fq2::roll(2)} 
+            // [a, c, b, d]
+            {Fq::roll(1)}
+            {Fq2::fromaltstack()}
+            {Fq::roll(1)}
+            // [a, c, b', d']
+            {hinted_script2}
+            {Fq::fromaltstack()}
+            {Fq::roll(1)}
+        };
+
+        hints.extend(hint1);
+        hints.extend(hint2);
+
+        (script, hints)
+    }
+
+    
     /// Square the top Fq2 element
     pub fn hinted_square(a: ark_bn254::Fq2) -> (Script, Vec<Hint>) {
         let mut hints = Vec::new();

bitvm/src/bn254/fq2.rs

@@ -1,9 +1,10 @@
 use crate::bn254::fp254impl::Fp254Impl;
 use crate::bn254::fq::Fq;
+use crate::bn254::fq12::Fq12;
 use crate::bn254::fq2::Fq2;
 use crate::treepp::{script, Script};
 use crate::bn254::utils::Hint;
-use ark_ff::{Field, Fp6Config};
+use ark_ff::{AdditiveGroup, Field, Fp6Config};
 use num_bigint::BigUint;
 
 pub struct Fq6;
@@ -41,6 +42,22 @@ impl Fq6 {
         }
     }
 
+    pub fn is_zero() -> Script {
+        script! (
+            for _ in 0..6 {
+                {Fq::push(ark_bn254::Fq::ZERO)}
+                {Fq::equal(1, 0)}
+                OP_TOALTSTACK
+            }
+            {1}
+            for _ in 0..6 {
+                OP_FROMALTSTACK
+                OP_BOOLAND
+            }
+        )
+        // Fq6::ZERO -> {1} else {0}
+    }
+
     pub fn fromaltstack() -> Script {
         script! {
             { Fq2::fromaltstack() }
@@ -131,7 +148,105 @@ impl Fq6 {
         }
     }
 
-    pub fn hinted_mul(mut a_depth: u32, mut a: ark_bn254::Fq6, mut b_depth: u32, mut b: ark_bn254::Fq6) -> (Script, Vec<Hint>) {
+    pub fn hinted_square(a: ark_bn254::Fq6) -> (Script, Vec<Hint>) {
+        let mut hints = Vec::new();
+
+        let (hinted_script1, hints1) = Fq2::hinted_square(a.c0);
+        let (hinted_script2, hints2) = Fq2::hinted_square(a.c0 + a.c1 + a.c2);
+        let (hinted_script3, hints3) = Fq2::hinted_square(a.c0 - a.c1 + a.c2);
+        let (hinted_script4, hints4) = Fq2::hinted_mul(2, a.c1,0, a.c2);
+        let (hinted_script5, hints5) = Fq2::hinted_square(a.c2);
+
+        let mut script = script! {};
+        let script_lines = [
+            // compute s_0 = a_0 ^ 2
+            Fq2::copy(4),
+            hinted_script1,
+
+            // compute a_0 + a_2
+            Fq2::roll(6),
+            Fq2::copy(4),
+            Fq2::add(2, 0),
+
+            // compute s_1 = (a_0 + a_1 + a_2) ^ 2
+            Fq2::copy(0),
+            Fq2::copy(8),
+            Fq2::add(2, 0),
+            hinted_script2,
+
+            // compute s_2 = (a_0 - a_1 + a_2) ^ 2
+            Fq2::copy(8),
+            Fq2::sub(4, 0),
+            hinted_script3,
+
+            // compute s_3 = 2a_1a_2
+            Fq2::roll(8),
+            Fq2::copy(8),
+            hinted_script4,
+            Fq2::double(0),
+
+            // compute s_4 = a_2 ^ 2
+            Fq2::roll(8),
+            hinted_script5,
+
+            // compute t_1 = (s_1 + s_2) / 2
+            Fq2::copy(6),
+            Fq2::roll(6),
+            Fq2::add(2, 0),
+            Fq2::div2(),
+
+            // at this point, we have s_0, s_1, s_3, s_4, t_1
+
+            // compute c_0 = s_0 + \beta s_3
+            Fq2::copy(4),
+            Fq6::mul_fq2_by_nonresidue(),
+            Fq2::copy(10),
+            Fq2::add(2, 0),
+
+            // compute c_1 = s_1 - s_3 - t_1 + \beta s_4
+            Fq2::copy(4),
+            Fq6::mul_fq2_by_nonresidue(),
+            Fq2::copy(4),
+            Fq2::add(10, 0),
+            Fq2::sub(10, 0),
+            Fq2::add(2, 0),
+
+            // compute c_2 = t_1 - s_0 - s_4
+            Fq2::add(8, 6),
+            Fq2::sub(6, 0),
+        ];
+        for script_line in script_lines {
+            script = script.push_script(script_line.compile());
+        }
+
+        hints.extend(hints1);
+        hints.extend(hints2);
+        hints.extend(hints3);
+        hints.extend(hints4);
+        hints.extend(hints5);
+        
+        (script, hints)
+    }
+
+    // Input: [A, B]
+    // Output: [C] where C = A x B
+    pub fn hinted_mul(a_depth: u32, a: ark_bn254::Fq6, b_depth: u32, b: ark_bn254::Fq6) -> (Script, Vec<Hint>) {
+        Self::hinted_mul_core(a_depth, a, b_depth, b, script!{})
+    }
+
+    // Input: [A, B]
+    // Output: [A, B, C] where C = A x B
+    pub fn hinted_mul_keep_elements(a_depth: u32, a: ark_bn254::Fq6, b_depth: u32, b: ark_bn254::Fq6) -> (Script, Vec<Hint>) {
+        let preserve_scr = script!{
+            {Fq6::toaltstack()}
+            {Fq12::copy(0)}
+            {Fq6::fromaltstack()}
+        };
+        
+        Self::hinted_mul_core(a_depth, a, b_depth, b, preserve_scr)
+    }
+
+    fn hinted_mul_core(mut a_depth: u32, mut a: ark_bn254::Fq6, mut b_depth: u32, mut b: ark_bn254::Fq6, keep_elements_scr: Script) -> (Script, Vec<Hint>) {
         // The degree-6 extension on BN254 Fq2 is under the polynomial y^3 - x - 9
         // Toom-Cook-3 from https://eprint.iacr.org/2006/471.pdf
         if a_depth < b_depth {
@@ -184,6 +299,8 @@ impl Fq6 {
             // compute (a-b+c)(d-e+f) = P(-1)
             { hinted_script3 }
 
+            { keep_elements_scr }
+
             // compute 2b
             { Fq2::roll(a_depth + 8) }
             { Fq2::double(0) }