Batch Verification API #59

yaahc · 2021-01-14T00:03:06Z

No description provided.

dconnolly · 2021-01-25T08:56:15Z

The CI is pinned to 1.44.0 and build failing, on 1.49.0 (latest stable toolchain) it's passing.

daira

Untested ACK :-)

daira · 2021-01-26T01:35:27Z

src/groth16/verifier/batch.rs

+
+            ml_terms.push(((proof.a * z).into(), (-proof.b).into()));
+
+            acc_Gammas[0] += &z; // a_0 is implicitly set to 1 (??)


That's correct.

Suggested change

acc_Gammas[0] += &z; // a_0 is implicitly set to 1 (??)

acc_Gammas[0] += &z; // a_0 is implicitly set to 1

daira · 2021-01-26T01:39:26Z

src/groth16/verifier/batch.rs

+        //
+        // Y^acc_Y in multiplicative notation is [acc_Y]Y (scalar mul) in
+        // additive notation, which is the code convention here.
+        let Y = E::pairing(&vk.alpha_g1, &vk.beta_g2) * acc_Y;


This pairing could be precomputed.

Also, calling the result Y could be a little confusing.

@daira is right that it can be precomputed, but it's probably not more efficient in practice to do that. We do it in the groth16 verifier because we're just checking one proof and acc_Y = 1 more or less. In your case the multiplication by acc_Y is expensive -- it involves exponentiating by acc_Y because the result of the pairing is an element of a multiplicative subgroup of a large extension field. Instead, in practice it's probably just fine to do

ml_terms.push((E::G1Affine::from(vk.alpha_g1 * acc_Y), E::G2Prepared::from(vk.beta_g2)));

so you multiply the G1 element by acc_Y (because [z] e(A, B) = e([z] A, B) forall z, A, B) and then just add it to your multi-miller loop.

str4d

Please remove the last two commits.

str4d · 2021-01-26T21:29:35Z

.github/workflows/ci.yml

-          toolchain: 1.44.0
+          toolchain: stable


This conflicts with #62, where the MSRV is set to 1.47.0.

Resolved to 1.47.0

str4d · 2021-01-26T21:29:42Z

.github/workflows/ci.yml

-          toolchain: 1.44.0
+          toolchain: stable


Resolved to 1.47.0

str4d · 2021-01-26T21:30:55Z

src/lib.rs

-#![deny(intra_doc_link_resolution_failure)]
+#![deny(broken_intra_doc_links)]


We cannot change this until the MSRV is at least 1.48.0 (see zcash/librustzcash#279).

str4d · 2021-01-26T21:33:53Z

@dconnolly

The CI is pinned to 1.44.0 and build failing, on 1.49.0 (latest stable toolchain) it's passing.

I believe that specific CI failure is related to #57 (the upstream rustc breakage landed in 1.49 IIRC). It should be possible to similarly work around the issues here.

ebfull · 2021-01-26T21:43:03Z

src/groth16/verifier/batch.rs

+        let Psi = vk
+            .ic
+            .iter()
+            .zip(acc_Gammas.iter())
+            .map(|(&Psi_i, acc_Gamma_i)| Psi_i * acc_Gamma_i)
+            .sum();


Constant factor improvement, but this can be done as a multiexp instead.

ebfull · 2021-01-26T21:48:15Z

src/groth16/verifier/batch.rs

+        // additive notation, which is the code convention here.
+        let Y = E::pairing(&vk.alpha_g1, &vk.beta_g2) * acc_Y;
+
+        let mut terms = vec![];


let ml_terms = ml_terms.iter().map(|(a, b)| (a, b)).collect::<Vec<_>>();

ebfull · 2021-01-26T22:00:28Z

src/groth16/verifier/batch.rs

+        //
+        // Y^acc_Y in multiplicative notation is [acc_Y]Y (scalar mul) in
+        // additive notation, which is the code convention here.
+        let Y = E::pairing(&vk.alpha_g1, &vk.beta_g2) * acc_Y;


@daira is right that it can be precomputed, but it's probably not more efficient in practice to do that. We do it in the groth16 verifier because we're just checking one proof and acc_Y = 1 more or less. In your case the multiplication by acc_Y is expensive -- it involves exponentiating by acc_Y because the result of the pairing is an element of a multiplicative subgroup of a large extension field. Instead, in practice it's probably just fine to do

ml_terms.push((E::G1Affine::from(vk.alpha_g1 * acc_Y), E::G2Prepared::from(vk.beta_g2)));

so you multiply the G1 element by acc_Y (because [z] e(A, B) = e([z] A, B) forall z, A, B) and then just add it to your multi-miller loop.

ebfull · 2021-01-26T22:02:07Z

src/groth16/verifier/batch.rs

+        let mut terms = vec![];
+        ml_terms.iter().for_each(|(a, b)| terms.push((a, b)));
+
+        if E::multi_miller_loop(terms.as_slice()).final_exponentiation() + Y == E::Gt::identity() {


If you fold the change in like I mentioned then this becomes

if E::multi_miller_loop(&terms).final_exponentiation().is_identity().into() {

I think.

dconnolly · 2021-02-02T01:09:48Z

@ebfull @str4d I can't re-request a review from you in the github UI but 🙏

benches/batch.rs

src/groth16/verifier/batch.rs

Co-authored-by: str4d <thestr4d@gmail.com>

…irst

dconnolly · 2021-02-05T01:08:15Z

The clippy 'failure' if you do as it recommends it will not compile because:

‘z’: mismatched types
   expected reference `&<E as pairing::Engine>::Fr`
found associated type `<E as pairing::Engine>::Fr`
consider constraining the associated type `<E as pairing::Engine>::Fr` to `&<E as pairing::Engine>::Fr`
for more information, visit https://doc.rust-lang.org/book/ch19-03-advanced-traits.html [E0308]

…y generate a zero

dconnolly · 2021-02-05T20:23:15Z

@str4d @ebfull one more look? 🙏

daira

Untested ACK.

str4d

utACK b9737fc

dconnolly · 2021-02-10T21:51:00Z

@ebfull one more look por favor? 🙏

ebfull

Good job! :)

dconnolly · 2021-02-11T16:02:58Z

Yay, thank you!

dconnolly mentioned this pull request Jan 25, 2021

Implement Groth16 batch verification optimizations ZcashFoundation/zebra#406

Closed

daira approved these changes Jan 26, 2021

View reviewed changes

str4d requested changes Jan 26, 2021

View reviewed changes

ebfull reviewed Jan 26, 2021

View reviewed changes

dconnolly force-pushed the jane/batch branch from 899e593 to 9f66331 Compare February 1, 2021 05:18

yaahc and others added 4 commits February 1, 2021 00:23

port bellman batch changes from librustzcash

5b0226b

Finish groth16 batch verification math

414c4f2

Add common mimc test utils

b750faa

Add groth16 batch verify test and benchmarks

be65838

dconnolly force-pushed the jane/batch branch from 9f66331 to be65838 Compare February 1, 2021 05:25

Tidy up some batch verification math based on review

25b1a8c

str4d requested review from str4d and ebfull February 2, 2021 01:11

str4d marked this pull request as ready for review February 2, 2021 01:11

str4d requested changes Feb 3, 2021

View reviewed changes

yaahc mentioned this pull request Feb 4, 2021

Asynchronous Groth16 verification ZcashFoundation/zebra#830

Merged

dconnolly and others added 6 commits February 3, 2021 20:18

Tidy tuple return

70cc09e

Co-authored-by: str4d <thestr4d@gmail.com>

Update doc re: VerifiyingKey

8e4d566

Co-authored-by: str4d <thestr4d@gmail.com>

Format comment about optimizing miller loop terms

140d31d

Co-authored-by: str4d <thestr4d@gmail.com>

Add docs

ce345d9

Mark rng as &mut in closure

3e237a9

Check all batch item inputs sizes against the supplied VerifyingKey f…

9becaf5

…irst

Random z MUST be {1..2^128-1}, so we loop in case we (rarely) randoml…

b9737fc

…y generate a zero

daira approved these changes Feb 6, 2021

View reviewed changes

dconnolly mentioned this pull request Feb 8, 2021

Use batch optimizations, load params in groth16::Verifier, verify Spend & Output descriptions ZcashFoundation/zebra#1713

Merged

2 tasks

str4d approved these changes Feb 9, 2021

View reviewed changes

str4d mentioned this pull request Feb 9, 2021

Batch verification: Choose z in the range [1..2^128). #65

Open

ebfull approved these changes Feb 11, 2021

View reviewed changes

ebfull merged commit bd4af09 into zkcrypto:main Feb 11, 2021

str4d mentioned this pull request Jun 1, 2021

Implement batched Groth16 verification #31

Closed

str4d mentioned this pull request Jan 31, 2022

bellman: Batch verification API zcash/librustzcash#253

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Batch Verification API #59

Batch Verification API #59

yaahc commented Jan 14, 2021

dconnolly commented Jan 25, 2021

daira left a comment

daira Jan 26, 2021

daira Jan 26, 2021

daira Jan 26, 2021

ebfull Jan 26, 2021

str4d left a comment

str4d Jan 26, 2021

dconnolly Feb 1, 2021

str4d Jan 26, 2021

dconnolly Feb 1, 2021

str4d Jan 26, 2021

dconnolly Feb 1, 2021

str4d commented Jan 26, 2021

ebfull Jan 26, 2021

ebfull Jan 26, 2021

ebfull Jan 26, 2021

ebfull Jan 26, 2021

dconnolly commented Feb 2, 2021

dconnolly commented Feb 5, 2021 •

edited

Loading

dconnolly commented Feb 5, 2021

daira left a comment

str4d left a comment

dconnolly commented Feb 10, 2021

ebfull left a comment

dconnolly commented Feb 11, 2021


		ml_terms.push(((proof.a * z).into(), (-proof.b).into()));

		acc_Gammas[0] += &z; // a_0 is implicitly set to 1 (??)

		#![deny(intra_doc_link_resolution_failure)]
		#![deny(broken_intra_doc_links)]

Batch Verification API #59

Batch Verification API #59

Conversation

yaahc commented Jan 14, 2021

dconnolly commented Jan 25, 2021

daira left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

str4d left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

str4d commented Jan 26, 2021

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

dconnolly commented Feb 2, 2021

dconnolly commented Feb 5, 2021 • edited Loading

dconnolly commented Feb 5, 2021

daira left a comment

Choose a reason for hiding this comment

str4d left a comment

Choose a reason for hiding this comment

dconnolly commented Feb 10, 2021

ebfull left a comment

Choose a reason for hiding this comment

dconnolly commented Feb 11, 2021

dconnolly commented Feb 5, 2021 •

edited

Loading