feat: ZM updates for Translator concatenated polys

[ledwards2225]

From Kesha:

This PR adds polynomial "concatenation" functionality into ZeroMorph.

The idea behind concatenation is the following: given several polynomials (for example, $X_1$, $X_2$, $X_3$, $X_4$, $Y_1$, $Y_2$, $Y_3$, $Y_4$) of length n, we want to show that the set of values in $X$ polynomials is identical to the values in $Y$.The way we can do it is with a grand product argument, however sumcheck complexity of the grand product argument is quadratic in the number of polynomials that are used in the GP (we have to extend the univariate to the degree d and then we need to multiply those (d+1) elements d times). However, if we were to perform the same grand product instead on polynomials $X= (X_1|X_2|X_3|X_4)$ and $Y=(Y_1|Y_2|Y_3|Y_4)$, the length of the sumcheck would increase 4 times, but the degree d would decrease proportionately.

So let's say we have an original circuit of length n, where all non-permutation relations are satisfied (including on $X_i$ and $Y_i$ polynomials). However, for the grand product argument we extend the polynomials to length $k\cdot n$ , where $k$ is a power of 2. Then we use the property of Zeromorph that it uses univariate commitments for commiting to multilinear polynomials. Because of this property, the final univariate opening of $X$ at challenge $x$ is equivalent to opening $X_1+x^n\cdot X_2+x^{2n}\cdot X_3+x^{3n}\cdot X_4$. So what we do in Zeromorph is substitute the opening of a concatenated polynomial by opening of a polynomial derived from a combination of $X_i$ polynomials multiplied by powers of $x$. This allows us to have fewer commitments and avoid shifts to prove the composition of concatenated polynomials

Checklist:

Remove the checklist to signal you've completed it. Enable auto-merge if the PR is ready to merge.

• If the pull request requires a cryptography review (e.g. cryptographic algorithm implementations) I have added the 'crypto' tag.
• I have reviewed my diff in github, line by line and removed unexpected formatting changes, testing logs, or commented-out code.
• Every change is related to the PR description.
• I have linked this pull request to relevant issues (if any exist).

[AztecBot]

Benchmark results

Metrics with a significant change:

• note_history_trial_decrypting_time_in_ms (10): 145 (-36%)

Detailed results

All benchmarks are run on txs on the Benchmarking contract on the repository. Each tx consists of a batch call to create_note and increment_balance, which guarantees that each tx has a private call, a nested private call, a public call, and a nested public call, as well as an emitted private note, an unencrypted log, and public storage read and write.

This benchmark source data is available in JSON format on S3 here.

Values are compared against data from master at commit 436b22e3 and shown if the difference exceeds 1%.

L2 block published to L1

Each column represents the number of txs on an L2 block published to L1.

Metric	8 txs	32 txs	128 txs
l1_rollup_calldata_size_in_bytes	45,444	179,588	716,132
l1_rollup_calldata_gas	222,900	867,692	3,446,552
l1_rollup_execution_gas	841,987	3,594,800	22,201,921
l2_block_processing_time_in_ms	2,010 (+2%)	7,582	29,941 (-1%)
note_successful_decrypting_time_in_ms	293	881 (+1%)	3,167 (-4%)
note_trial_decrypting_time_in_ms	95.1	90.6 (+8%)	133
l2_block_building_time_in_ms	20,603	81,787	325,556
l2_block_rollup_simulation_time_in_ms	11,903	47,179 (-1%)	188,267
l2_block_public_tx_process_time_in_ms	8,654 (+1%)	34,475 (+1%)	136,790

L2 chain processing

Each column represents the number of blocks on the L2 chain where each block has 16 txs.

Metric	5 blocks	10 blocks
node_history_sync_time_in_ms	21,953 (+1%)	42,477 (+1%)
note_history_successful_decrypting_time_in_ms	2,055 (+2%)	3,963 (+1%)
note_history_trial_decrypting_time_in_ms	121 (-1%)	⚠️ 145 (-36%)
node_database_size_in_bytes	1,630,538	1,099,832
pxe_database_size_in_bytes	29,748	59,307

Circuits stats

Stats on running time and I/O sizes collected for every circuit run across all benchmarks.

Circuit	circuit_simulation_time_in_ms	circuit_input_size_in_bytes	circuit_output_size_in_bytes
private-kernel-init	763	61,697	18,905
private-kernel-ordering	125	24,297	8,153
base-rollup	1,767	656,428	873
root-rollup	168 (-1%)	4,072	1,097
private-kernel-inner	787	81,568	18,905
public-kernel-private-input	568	41,519	18,905
public-kernel-non-first-iteration	405	41,561	18,905
merge-rollup	15.1	2,592	873

Miscellaneous

Transaction sizes based on how many contracts are deployed in the tx.

Metric	0 deployed contracts	1 deployed contracts
tx_size_in_bytes	8,787	27,547

[codygunton]

Thanks

[codygunton]

WORKTODO: adding these when they're not used is a hack, added this to remind myself to look for a better way, maybe a requires. Do you see a way to improve or do you think just tech debt this?

[ledwards2225]

Turns out that moving the extraction of unshifted, shifted etc to outside of ZM made it easy to get rid of these since now they are only called from within the translator on input to prove and verify. Could add a concept but as long as no one trues to instantiate the Translator with say the Ultra flavor there's no issue.

[ledwards2225]

More accurately - they WILL only be called from the translator. Those calls don't exist in this branch but with these updates we're no longer instantiating any classes that need to call them with flavors that don't implement them.