performance(PLONK): prove_by_steps vs prove

[HAOYUatHZ]

I wonder why in exit we use prove_by_steps (

bellman/src/plonk/mod.rs

Line 132 in f551a55

pub fn prove_by_steps<E: Engine, C: crate::Circuit<E>, T: Transcript<E::Fr>>(

) instead of prove (

bellman/src/plonk/mod.rs

Line 324 in f551a55

pub fn prove<E: Engine, C: crate::Circuit<E>, T: Transcript<E::Fr>>(

)?

Is it because prove_by_steps has a better performance?

[shamatar]

The "prove" function requires an additional form of CRS for Kate commitment to be able to commit polynomials in a Lagrange form. This allows to eliminate an FFT that is beneficial on large circuits, but would require user to download two copies of CRS to make an exit proof (for which a circuit is kind of small). In any case both functions output the same proof on the same input parameters.

[HAOYUatHZ]

I see.

Though we can get the Lagrange form by using

let worker = Worker::new();
let key_lagrange_form = Crs::<E, CrsForLagrangeForm>::from_powers(
    self.key_monomial_form.as_ref().expect("Setup should have universal setup struct"),
    self.setup_polynomials.n.next_power_of_two(),
    &worker,
);

but the from_powers actually requires an FFT.

So if calculating the Lagrange form by ourselves, the performance won't be different.

[HAOYUatHZ]

Thx!

[shamatar]

I see.

Though we can get the Lagrange form by using

let worker = Worker::new();
let key_lagrange_form = Crs::<E, CrsForLagrangeForm>::from_powers(
    self.key_monomial_form.as_ref().expect("Setup should have universal setup struct"),
    self.setup_polynomials.n.next_power_of_two(),
    &worker,
);

but the from_powers actually requires an FFT.

So if calculating the Lagrange form by ourselves, the performance won't be different.

Just for completeness, such transformation is costly (NlogN point multiplications, not just multiexponentiation)

[HAOYUatHZ]

I see.
Though we can get the Lagrange form by using

let worker = Worker::new();
let key_lagrange_form = Crs::<E, CrsForLagrangeForm>::from_powers(
    self.key_monomial_form.as_ref().expect("Setup should have universal setup struct"),
    self.setup_polynomials.n.next_power_of_two(),
    &worker,
);

but the from_powers actually requires an FFT.
So if calculating the Lagrange form by ourselves, the performance won't be different.

Just for completeness, such transformation is costly (NlogN point multiplications, not just multiexponentiation)

I see. Thanks! @shamatar