Iota refactor

[ChihChengLiang]

What we did

• Consolidate 3 iota gates into 1.
• remove instance columns
• simplify the round constant handling

Why does it work?

The original 3 gates:

# iota_b9 0~23
adv__next_lane00 = adv__lane00 + const__A4 * instance__round_constant_b9
# iota_b9 24th no mixing
adv__next_lane00 = adv__lane00 + (const__1 - adv__mixing) * (const__A4 * instance__round_constant_b9)
# iota_b13 24th mixing
adv__next_lane00 = adv__lane00 + adv__mixing * instance__round_constant_b13

The new gate

adv__next_lane00 = adv__lane00 + adv__flag * fixed__constant_value

We argue the new gate can achieve all the functionalities of the old gates.

First, the values of round constants and A4 are known at the setup time. So does the multiplication of them. So we can move them into fixed columns. This saved some verifying time overheads.
Second, (const__1 - adv__mixing) and adv__mixing can be achieved by adv__flag. We can just copy the right cells to the adv__flag respectively.

Performance

Before

Num advice columns: 31
Num fixed columns: 23
Num instance columns: 2
Num lookups: 6
Num gates: 18
Max advice rows 19042 - Constraint out_state and out_mixing
num polys: 109
max_gate_degree_poly: 6 - 

After

Num advice columns: 30
Num fixed columns: 22
Num instance columns: 0
Num lookups: 6
Num gates: 14
Max advice rows 19042 - Constraint out_state and out_mixing
num polys: 105
max_gate_degree_poly: 6 - 

TODO

• doc

[CPerezz]

Great work! Just some comments!

[CPerezz]

Why does the config need to store the constants?

We already know them right? So we can just take them directly from the constants file where they're defined.

[ChihChengLiang]

The type of F is known at the configuration time, and we eventually need to convert them to F at some point. Config is the earliest possible place to define them.

[CPerezz]

Nice work!
LGTM