dusk-plonk 0.24.0

Release of dusk-plonk 0.24.0. This update includes breaking API changes listed below.

Added

• Document that proving is not constant-time #992
• Add Proof::from_slice_exact, which rejects trailing bytes #979
• Cover compressed-circuit encoding and compilation-capacity bounds #942
• Add Composer::assert_torsion_free_point #870
• Add TorsionFreeWitnessPoint #870
• Add Error::JubJubPointNotTorsionFree #870
• Add Error::JubJubPointDegenerate #889
• Add Composer::component_truncate<N> #867
• Add Composer::component_range_bits<BITS> range check counting bits directly #867
• Add the public Error::JubJubGeneratorNotPrimeOrder variant #832
• Add Error::CircuitUnsatisfied #877
• Add Display for Error to builds without the std feature #895
• Add core::error::Error for Error to builds without the std feature #895
• Cover curve-addition poles directly in point soundness regressions and update
  their module documentation #910
• Isolate the collapsed curve-addition pole residual in a point soundness
  regression #914
• Cover the positive curve-addition pole with an isolated soundness regression
  #916

Changed

• Update dusk-bls12_381 to 0.16 and dusk-jubjub to 0.16 #1011
• Reject compressed circuits with bytes after the end of the deflate stream
  #1006
• Remove the msgpacker dependency #1004
• Reject compressed circuits with an integer above usize::MAX instead of
  truncating it on 32-bit targets #1004
• Compute fixed-base scalar multiplication digits and select their addends
  without branching on the scalar #992
• Reject archived proofs whose points or scalars their byte decoders reject
  #981
• Apply the checks of ProverKey::from_slice to archived prover keys #941
• Reject unreduced raw commit-key points in Prover::try_from_bytes #987
• Reject prover keys whose selector or sigma polynomials disagree with their
  cached coset evaluations, in Prover::try_from_bytes and archive decoding
  #986
• Make Composer::append_custom_gate crate-private #988
• Report length overflow in Prover::try_from_bytes as
  Error::BytesError(InvalidData) instead of Error::NotEnoughBytes #971
• Report trailing commit-key bytes in Prover::try_from_bytes as
  Error::BytesError(InvalidData) instead of Error::NotEnoughBytes #971
• Remove Default as a supertrait of Circuit #715
• Require Default on the circuit for Compiler::compile and
  Circuit::compress #715
• Change the verifier key of circuits calling component_decomposition at
  N >= 255 #980
• Avoid redundant polynomial and KZG computations when evaluating, dividing,
  multiplying, and constructing aggregate witnesses #977
• Require proving-key capacity through degree n + 9 instead of n + 6,
  where n is the evaluation-domain size, so a 2^k setup now supports at
  most a 2^(k-1) domain #975
• Replace upstream Merlin 3.0 with dusk-merlin 4.0.0 #966
• Remove static transcript-label caching and leaked label allocations #966
• Restrict supported targets to little-endian architectures #966
• Avoid per-element allocations when serializing polynomials, evaluations,
  and commitment keys #964
• Bind proof construction to the public-input rows recorded at compile time #957
• Reject serialized provers that predate the compiled public-input row layout #957
• Update Criterion to 0.8 and align the dev-only itertools dependency #953
• Raise the MSRV to Rust 1.96.1 #951
• Update blake2b_simd to 1.0.5 #950
• Replace the deprecated tempdir development dependency with tempfile
  #949
• Update miniz_oxide to 0.9 and replace the unmaintained adler dependency
  with adler2 #948
• Align hashbrown with the version used by the optional RKYV dependency graph
  #943
• Improve prover hot-path performance by reusing sigma evaluations, batching
  permutation inversions, reducing opening-polynomial allocations, and
  parallelizing large FFT stages and independent work #921
• Parallelize independent quotient coset FFTs when std is enabled while
  retaining the serial no_std path #925
• Cache deterministic quotient-domain prover data across proofs #919
• Parallelize the final large-domain FFT stages across Rayon pools with at
  least four workers #933
• Change RKYV CommitKey and PublicParameters archives to store canonical
  compressed commitment- and opening-key source points and rebuild prepared
  pairing values during deserialization. Existing RKYV parameter archives
  must be regenerated #890 #903
• Mark Error as #[non_exhaustive] #884
• Remove the Copy derive from Error #884
• Speed up proof verification by grouping the final pairing-input MSM terms
  and batch-normalizing its G1 inputs #920
• Cache verifier domains and public-input roots and batch their denominator
  inversions during proof verification #927
• Change component_add_point, component_sub_point and component_mul_point to TorsionFreeWitnessPoint #870
• Change component_neg_point and component_select_identity to TorsionFreeWitnessPoint #870
• Change component_select_identity to constrain its bit to boolean #870
• Change the verifier key of circuits calling component_select_identity #870
• Change Composer::IDENTITY to a TorsionFreeWitnessPoint #870
• Change append_constant_point to validate natively and return Result #870
• Change the point entry points to take impl Into<JubJubExtended> #889
• Change the point entry points to return Result #889
• Change append_constant_point to validate membership on the extended point #889
• Change component_mul_generator to return Result #870
• Change unsatisfied proving to return Error::CircuitUnsatisfied #877
• Report the first unsatisfied constraint under the debug feature #877
• Cap logic gadget width at 254 bits #867
• Change the logic gadget's verifier key #867
• Increase append_logic_and/append_logic_xor gate count to bind inputs #867
• Make Composer::append_evaluated_output append exactly one active arithmetic
  row, including when the output selector is zero. This changes circuit layouts
  for direct callers, which must regenerate circuit-specific proving and
  verifier keys and cached compressed circuit descriptions. The gate_add and
  gate_mul wrapper layouts remain one row and are unchanged.
• Make Composer::component_mul_generator reject generators that are not
  on-curve points of exact prime order. Callers using custom generators should
  re-audit them; rejected generators now return
  Error::JubJubGeneratorNotPrimeOrder #832
• Constrain Composer::component_mul_generator inputs to canonical Jubjub
  scalars and its signed-digit recurrence to 253 effective digits. This changes
  the circuit shape: applications using the component must regenerate their
  circuit-specific proving and verifier keys, as well as cached compressed
  circuit descriptions. The universal SRS need not be regenerated, but public
  parameters must have capacity for the additional 70 gates per call.

Deprecated

• Deprecate Composer::component_range<BIT_PAIRS> in favour of Composer::component_range_bits<BITS> #867

Fixed

• Reject commit keys and public parameters whose setup secret is a root of
  unity of a supported domain #989
• Reject padded key segments in Verifier::try_from_bytes and
  Prover::try_from_bytes #965
• Reject nonzero retired lookup-commitment slots in VerifierKey::from_bytes
  #965
• Constrain Composer::component_decomposition to canonical bits for
  N >= 255 #980
• Fix shifted-wire blinding #975
• Reject serialized lengths and indexes that exceed the target pointer width #940
• Report verifier byte-length arithmetic overflow as BytesError(InvalidData)
  instead of NotEnoughBytes #940
• Validate verifier size metadata and public-input row layouts on construction
  and deserialization, and reject trailing serialized data #960
• Size serialized ProverKey buffers from each polynomial's actual length
  #959
• Normalize unrepresentable serialized prover-key lengths as invalid data
  #937
• Bound compressed-circuit decompression and reconstruction allocation by the
  supplied public parameters and referenced gate data #931
• Reject unrepresentable evaluation domain sizes during verifier construction
  and checked deserialization #927
• Reject fixed polynomials with degree at least the circuit domain size during
  checked ProverKey deserialization #935
• Reject invalid witness, polynomial, selector and public-input indices when
  deserializing compressed circuits #930
• Reject trailing data when deserializing compressed circuits #913
• Validate cached permutation linear evaluations during checked Prover
  deserialization #908
• Validate cached vanishing-coset evaluations during checked Prover
  deserialization #902
• Validate nonempty, canonically encoded, on-curve, prime-order KZG commitment
  keys during checked RKYV PublicParameters deserialization #903
• Prevent malformed variable-base point witnesses from panicking during affine
  projection; the circuit now rejects them as unsatisfied #906
• Reject zero vanishing-coset evaluations during checked Prover
  deserialization #898
• Reject empty commitment keys during checked Prover deserialization #897
• Reject degenerate KZG opening keys and rebuild archived prepared pairing
  values from their validated affine points before use #887
• Bind append_logic_xor/append_logic_and output to their inputs #867
• Bind the witness returned by append_evaluated_output to its input
  polynomial. Previously the public helper only calculated and allocated the
  result using host witness values, allowing a shape-compatible prover to
  replace it and prove a false relation such as public 2 + 3 = 9.
• Prevent a fixed-base scalar-multiplication soundness failure where 256 signed
  digits could encode the BLS scalar-field modulus q. The scalar endpoint
  then equalled public zero modulo q, while the same digits drove the point
  endpoint to the nonidentity point [q]G, allowing a proof of a false public
  scalar/point relation.
• Wrap the debugger's rotated (_w) wire reads to row 0

Crates.io · Full changelog