Endoscaling instructions and chip. #529

therealyingtong · 2022-03-22T10:36:14Z

Closes #583. Closes #248. Based on https://github.com/zcash/halo2/tree/endoscale-prep, which includes the PRs:

Introduce double-and-add helper ([halo2_gadgets] Introduce double_and_add helper #592)
Minor refactors to decompose_running_sum helper ([halo2_gadgets] Minor refactors to decompose_running_sum helper #594)
Introduce double API in EccInstructions ([halo2_gadgets] Minor refactors and introduction of double API in EccInstructions #596)

ebfull

First pass (didn't cover the chip in detail)

halo2/src/recursion/endoscale.rs

halo2/src/recursion/endoscale/primitive.rs

halo2/src/recursion/endoscale/chip.rs

str4d · 2022-05-18T14:29:23Z

halo2/src/lib.rs

@@ -5,3 +5,5 @@
 #![deny(missing_debug_implementations)]
 #![deny(missing_docs)]
 #![deny(unsafe_code)]
+
+pub mod recursion;


We probably don't need this module any more (since halo2 is now entirely the recursive crate, and the non-recursive parts were moved to halo2_proofs).

I thought that we re-exported all the halo2_proofs stuff from halo2 (at least, that was the original plan)? In which case a recursion module is still needed to separate the recursion-specific APIs and let users switch a halo2_proofs import to a halo2 one easily.

halo2/src/recursion.rs

halo2/src/recursion/endoscale.rs

str4d · 2022-05-18T15:19:56Z

halo2_gadgets/src/utilities/lookup_range_check.rs

@@ -271,7 +271,7 @@ impl<F: FieldExt + PrimeFieldBits, const K: usize> LookupRangeCheckConfig<F, K>
    pub fn copy_short_check(
        &self,
        mut layouter: impl Layouter<F>,
-        element: AssignedCell<F, F>,
+        element: &AssignedCell<F, F>,


Needs documentation in the changelog.

halo2/src/recursion/endoscale/primitive.rs

str4d · 2022-05-18T15:47:25Z

halo2/src/recursion/endoscale.rs

+    fn endoscale_fixed_base<L: Layouter<C::Base>, const NUM_BITS: usize, const NUM_WINDOWS: usize>(
+        &self,
+        layouter: L,
+        base: C,


Currently, there is no way to constrain in the circuit that multiple invocations of endoscale_fixed_base use the same fixed base (it can happen incidentally, but only if the caller passes the same value through to be constant-assigned; a mistake here couldn't be caught in an automated way). Is this intentional (i.e. are the bases supposed to be unconnected)? If not, then a separate associated type, and a corresponding "assign this type from a constant" would be good (and probably what we actually want is just #334).

therealyingtong · 2022-07-13T15:02:50Z

halo2_gadgets/src/endoscale/chip/alg_1.rs

+            let y_check = {
+                let endo_y = double_and_add.y_p(meta, Rotation::cur());
+                let p_y = meta.query_advice(base.1, Rotation::cur());
+                // If the first bit is set, check that endo_y = P_y
+                let b0_set = b_0.clone() * (endo_y.clone() - p_y.clone());
+
+                // If the first bit is not set, check that endo_y = -P_y
+                let not_b0 = Expression::Constant(C::Base::one()) - b_0;
+                let b0_not_set = not_b0 * (endo_y + p_y);
+
+                b0_set + b0_not_set
+            };
+            let x_check = {
+                let endo_x = meta.query_advice(double_and_add.x_p, Rotation::cur());
+                let p_x = meta.query_advice(base.0, Rotation::cur());
+                // If the second bit is set, check that endo_x = ζ * P_x
+                let zeta = Expression::Constant(C::Base::ZETA);
+                let b1_set = b_1.clone() * (endo_x.clone() - zeta * p_x.clone());
+
+                // If the second bit is not set, check that endo_x = P_x
+                let not_b1 = Expression::Constant(C::Base::one()) - b_1;
+                let b1_not_set = not_b1 * (endo_x - p_x);
+
+                b1_set + b1_not_set
+            };


Use ternary gate.

…_base.

[book] Add description of endoscaling and public input handling. Co-authored-by: Ying Tong Lai <yingtong@electriccoin.co> Signed-off-by: Daira Hopwood <daira@jacaranda.org>

str4d

Gave this a quick review with an eye to differentiating between what can go straight into stable, and what should be behind a nightly feature flag.

str4d · 2023-02-03T21:16:49Z

halo2_gadgets/src/lib.rs

@@ -22,6 +22,7 @@
 #![deny(unsafe_code)]

 pub mod ecc;
+pub mod endoscale;


Suggested change

pub mod endoscale;

#[cfg(feature = "unstable-endoscale-gadget")]

pub mod endoscale;

str4d · 2023-02-03T21:19:28Z

book/src/SUMMARY.md

    - [SHA-256](design/gadgets/sha256.md)
      - [16-bit table chip](design/gadgets/sha256/table16.md)
+    - [Endoscaling](design/gadgets/endoscaling.md)


Suggested change

- [SHA-256](design/gadgets/sha256.md)

- [16-bit table chip](design/gadgets/sha256/table16.md)

- [Endoscaling](design/gadgets/endoscaling.md)

- Unstable

- [SHA-256](design/gadgets/sha256.md)

- [16-bit table chip](design/gadgets/sha256/table16.md)

- [Endoscaling](design/gadgets/endoscaling.md)

I think this would make them sub-sections of an "Unstable" section in the summary, while keeping their URLs stable.

str4d · 2023-02-03T21:20:23Z

book/src/design/gadgets/endoscaling.md

@@ -0,0 +1,368 @@
+# Endoscaling


Suggested change

# Endoscaling

# Endoscaling

> Status: Nightly

> Feature flag: `unstable-endoscale-gadget`

str4d · 2023-02-03T21:21:13Z

halo2_gadgets/src/utilities.rs

+/// # Panics
+///
+/// Panics if the bitstring is longer than `F::NUM_BITS`.
+pub fn le_bits_to_field_elem<F: PrimeFieldBits>(bits: &[bool]) -> F {


Does this need to be pub? How is it used outside halo2_gadgets?

str4d · 2023-02-03T21:21:39Z

halo2_gadgets/src/utilities/decompose_running_sum.rs

@@ -32,7 +32,7 @@ use halo2_proofs::{
 use std::marker::PhantomData;

 /// The running sum $[z_0, ..., z_W]$. If created in strict mode, $z_W = 0$.
-#[derive(Debug)]
+#[derive(Clone, Debug)]


Technically should be listed as an addition in the changelog.

str4d · 2023-02-03T21:23:49Z

halo2_proofs/src/circuit.rs

@@ -136,6 +136,16 @@ impl<F: Field> AssignedCell<Assigned<F>, F> {
    }
 }

+impl<F: Field> From<AssignedCell<F, F>> for AssignedCell<Assigned<F>, F> {


Document as an addition in the changelog.

str4d · 2023-02-03T21:24:52Z

halo2_proofs/src/poly/commitment.rs

@@ -160,6 +160,11 @@ impl<C: CurveAffine> Params<C> {
        self.g.clone()
    }

+    /// The `g_lagrange` bases
+    pub fn g_lagrange(&self) -> Vec<C> {


Document as an addition in the changelog. It would also be useful to document how or why this is useful. If it is only useful for endoscaling:

Suggested change

pub fn g_lagrange(&self) -> Vec<C> {

#[cfg(feature = "unstable-endoscale-gadget")]

pub fn g_lagrange(&self) -> Vec<C> {

therealyingtong force-pushed the endoscale branch from ed5ab6e to 54d723a Compare March 29, 2022 15:26

therealyingtong changed the base branch from refactor-decompose-gadget to endoscale-prep March 29, 2022 15:26

ebfull requested changes May 16, 2022

View reviewed changes

str4d reviewed May 18, 2022

View reviewed changes

therealyingtong mentioned this pull request May 23, 2022

[ECC chip] double_and_add helper #587

Closed

therealyingtong force-pushed the endoscale-prep branch 2 times, most recently from 1caf222 to 920d3d0 Compare June 2, 2022 10:01

therealyingtong force-pushed the endoscale-prep branch from 920d3d0 to 82051ba Compare June 10, 2022 13:39

therealyingtong force-pushed the endoscale branch from 54d723a to 1097cb9 Compare June 10, 2022 13:47

therealyingtong force-pushed the endoscale-prep branch from 82051ba to 779e09c Compare June 16, 2022 20:04

therealyingtong force-pushed the endoscale branch from 1097cb9 to 698248c Compare June 16, 2022 20:04

therealyingtong modified the milestone: Release 5.2.0 Jun 16, 2022

therealyingtong force-pushed the endoscale branch 2 times, most recently from 867eb36 to 6474826 Compare July 3, 2022 17:11

therealyingtong force-pushed the endoscale-prep branch from 779e09c to 943b495 Compare July 4, 2022 15:20

therealyingtong force-pushed the endoscale branch from 6474826 to a1ffacf Compare July 4, 2022 15:34

therealyingtong force-pushed the endoscale-prep branch from 943b495 to 499464c Compare July 6, 2022 19:46

therealyingtong force-pushed the endoscale branch 2 times, most recently from 20baed5 to 4b9b2da Compare July 7, 2022 14:07

therealyingtong commented Jul 13, 2022

View reviewed changes

therealyingtong force-pushed the endoscale-prep branch from 499464c to e6036de Compare September 27, 2022 12:43

therealyingtong force-pushed the endoscale branch from 34bfc60 to f1f824a Compare September 27, 2022 12:45

therealyingtong mentioned this pull request Sep 27, 2022

[WIP] Recursive verifier API #666

Draft

therealyingtong force-pushed the endoscale-prep branch from e6036de to 789eeef Compare October 24, 2022 22:28

therealyingtong force-pushed the endoscale branch from f1f824a to 6a2ba5e Compare October 24, 2022 22:28

str4d added the F-nightly Issue or PR about a nightly feature label Jan 20, 2023

therealyingtong force-pushed the endoscale-prep branch from 789eeef to 4d7c2b7 Compare January 22, 2023 02:51

therealyingtong force-pushed the endoscale branch from 6a2ba5e to fb7fde9 Compare January 22, 2023 12:53

Utilities for endoscaling.

eb8b9b5

therealyingtong added 7 commits January 24, 2023 13:30

recursion::endoscale: Add EndoscaleInstructions.

c331e65

endoscale::chip: Add skeleton EndoscaleConfig configuration.

342436f

endoscale::chip: Implement witness_bitstring instruction.

9040c4d

endoscale::chip::alg_1: Implement endoscale_fixed_base, endoscale_var…

4c466d1

…_base.

endoscale::chip::alg_2: Implement compute_endoscalar

9e803bd

compute_endoscalar: Implement support for partial chunks.

089e8d1

endoscale::chip::alg_2: constrain_bitstring

de5778b

therealyingtong force-pushed the endoscale branch from fb7fde9 to 75250e7 Compare January 24, 2023 18:43

therealyingtong and others added 2 commits January 24, 2023 13:46

Test endoscale chip.

7cfe08e

Add description of endoscaling and public input handling (#599)

1af488a

[book] Add description of endoscaling and public input handling. Co-authored-by: Ying Tong Lai <yingtong@electriccoin.co> Signed-off-by: Daira Hopwood <daira@jacaranda.org>

therealyingtong force-pushed the endoscale branch from 75250e7 to 1af488a Compare January 24, 2023 18:46

str4d requested changes Feb 3, 2023

View reviewed changes

str4d mentioned this pull request Feb 25, 2023

Add Region::instance_value method, or figure out how RegionLayouter::instance_value is made accessible #740

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Endoscaling instructions and chip. #529

Endoscaling instructions and chip. #529

therealyingtong commented Mar 22, 2022 •

edited

Loading

ebfull left a comment

str4d May 18, 2022

daira Jun 10, 2022

str4d May 18, 2022

str4d May 18, 2022

therealyingtong Jul 13, 2022

str4d left a comment

str4d Feb 3, 2023

str4d Feb 3, 2023

str4d Feb 3, 2023

str4d Feb 3, 2023

str4d Feb 3, 2023

str4d Feb 3, 2023

str4d Feb 3, 2023

	pub mod endoscale;
	#[cfg(feature = "unstable-endoscale-gadget")]
	pub mod endoscale;

	pub fn g_lagrange(&self) -> Vec<C> {
	#[cfg(feature = "unstable-endoscale-gadget")]
	pub fn g_lagrange(&self) -> Vec<C> {

Endoscaling instructions and chip. #529

Are you sure you want to change the base?

Endoscaling instructions and chip. #529

Conversation

therealyingtong commented Mar 22, 2022 • edited Loading

ebfull left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

str4d left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

therealyingtong commented Mar 22, 2022 •

edited

Loading