chonk_verifier.cpp

Go to the documentation of this file.

// === AUDIT STATUS ===
// internal:    { status: Complete, auditors: [Sergei], commit: }
// external_1:  { status: not started, auditors: [], commit: }
// external_2:  { status: not started, auditors: [], commit: }
// =====================
 
#include "chonk_verifier.hpp"
#include "barretenberg/chonk/batched_honk_translator/batched_honk_translator_verifier.hpp"
#include "barretenberg/commitment_schemes/ipa/ipa.hpp"
#include "barretenberg/commitment_schemes/verification_key.hpp"
#include "barretenberg/common/bb_bench.hpp"
#include "barretenberg/goblin/goblin.hpp"
 
namespace bb {
 
template <>
ChonkVerifier<false>::TripleIpaReductionResult ChonkVerifier<false>::reduce_to_triple_ipa_opening(const Proof& proof)
{
    BB_BENCH_NAME("ChonkVerifier::reduce_to_triple_ipa_opening");
 
    // Step 1: Verify MegaZK Oink on the shared transcript
    BatchedHonkTranslatorVerifier batched_verifier(vk_and_hash, transcript);
    auto oink_result = batched_verifier.verify_mega_zk_oink(proof.hiding_oink_proof);
 
    // Extract public inputs and kernel data
    HidingKernelIO kernel_io;
    kernel_io.reconstruct_from_public(oink_result.public_inputs);
 
    // Check accumulated pairing points from the IVC chain (inner recursive verifications)
    if (!kernel_io.pairing_inputs.check()) {
        info("ChonkVerifier: verification failed at PI pairing points check");
        return { false };
    }
 
    // Step 2: Databus consistency check
    const Commitment kernel_calldata_commitment = oink_result.kernel_calldata_commitment;
    const Commitment return_data_commitment = kernel_io.kernel_return_data;
    bool databus_consistency_verified = (kernel_calldata_commitment == return_data_commitment);
    vinfo("ChonkVerifier: databus consistency verified: ", databus_consistency_verified);
    if (!databus_consistency_verified) {
        info("ChonkVerifier: verification failed at databus consistency check");
        return { false };
    }
 
    // Step 3: Merge verification
    // These commitments are already in the shared Fiat-Shamir transcript: Oink read the ecc-op wire commitments
    // directly, and it read the public inputs from which HidingKernelIO reconstructs the prior table commitments.
    MergeCommitments merge_commitments{ .t_commitments = oink_result.ecc_op_wires,
                                        .T_prev_commitments = kernel_io.ecc_op_tables };
    GoblinVerifier::MergeVerifier merge_verifier{ transcript };
    auto merge_result = merge_verifier.reduce_to_pairing_check(proof.merge_proof, merge_commitments);
    vinfo("ChonkVerifier: Merge reduced to pairing check: ", merge_result.reduction_succeeded ? "true" : "false");
 
    if (!merge_result.reduction_succeeded) {
        info("ChonkVerifier: verification failed at Merge reduction");
        return { false };
    }
    if (!merge_result.pairing_points.check()) {
        info("ChonkVerifier: verification failed at Merge pairing check");
        return { false };
    }
 
    // Step 4: ECCVM verification (reconstruct TripleIPA claim; proof is carried separately)
    ECCVMVerifier_<ECCVMFlavor> eccvm_verifier{ transcript, proof.eccvm_proof };
    auto eccvm_result = eccvm_verifier.reduce_to_triple_ipa_claim();
    vinfo("ChonkVerifier: ECCVM reduced to TripleIPA claim: ", eccvm_result.reduction_succeeded ? "true" : "false");
 
    if (!eccvm_result.reduction_succeeded) {
        info("ChonkVerifier: verification failed at ECCVM step");
        return { false };
    }
    auto translator_input = eccvm_verifier.get_translator_input_data();
 
    // Step 5: Translator Oink + Joint sumcheck + Joint PCS
    auto batched_result = batched_verifier.verify(proof.joint_proof,
                                                  translator_input.evaluation_challenge_x,
                                                  translator_input.batching_challenge_v,
                                                  translator_input.accumulated_result,
                                                  merge_result.merged_commitments);
    vinfo("ChonkVerifier: Batched translator+joint reduction: ", batched_result.reduction_succeeded ? "true" : "false");
 
    if (!batched_result.reduction_succeeded) {
        info("ChonkVerifier: verification failed at batched translator+joint reduction");
        return { false };
    }
    if (!batched_result.pairing_points.check()) {
        info("ChonkVerifier: verification failed at batched translator+joint pairing check");
        return { false };
    }
 
    return { .all_checks_passed = true,
             .triple_ipa_opening = { .claim = std::move(eccvm_result.triple_ipa_claim), .proof = proof.ipa_proof } };
}
 
template <> ChonkVerifier<false>::Output ChonkVerifier<false>::verify(const Proof& proof)
{
    BB_BENCH_NAME("ChonkVerifier::verify");
    auto result = reduce_to_triple_ipa_opening(proof);
    if (!result.all_checks_passed) {
        return false;
    }
    return ECCVMVerifier::verify_accumulator(result.triple_ipa_opening.reduce_to_accumulator());
}
 
template <> ChonkVerifier<true>::Output ChonkVerifier<true>::verify(const Proof& proof)
{
    // Step 1: Verify MegaZK Oink on the shared transcript
    BatchedHonkTranslatorRecursiveVerifier batched_verifier(vk_and_hash, transcript);
    auto oink_result = batched_verifier.verify_mega_zk_oink(proof.hiding_oink_proof);
 
    // Extract public inputs and kernel data
    HidingKernelIO kernel_io;
    kernel_io.reconstruct_from_public(oink_result.public_inputs);
 
    // Step 2: Databus consistency check (in-circuit)
    const Commitment kernel_calldata_commitment = oink_result.kernel_calldata_commitment;
    if (kernel_io.kernel_return_data.get_value() != kernel_calldata_commitment.get_value()) {
        info("ChonkRecursiveVerifier: Databus Consistency check failure");
    }
    kernel_io.kernel_return_data.incomplete_assert_equal(kernel_calldata_commitment);
 
    // Step 3: Merge verification
    // These commitments are already in the shared Fiat-Shamir transcript: Oink read the ecc-op wire commitments
    // directly, and it read the public inputs from which HidingKernelIO reconstructs the prior table commitments.
    MergeCommitments merge_commitments{ .t_commitments = oink_result.ecc_op_wires,
                                        .T_prev_commitments = kernel_io.ecc_op_tables };
    typename GoblinVerifier::MergeVerifier merge_verifier{ transcript };
    auto merge_result = merge_verifier.reduce_to_pairing_check(proof.merge_proof, merge_commitments);
    vinfo("ChonkRecursiveVerifier: Merge reduced to pairing check: ",
          merge_result.reduction_succeeded ? "true" : "false");
 
    // Step 4: ECCVM verification
    typename GoblinVerifier::ECCVMVerifier eccvm_verifier{ transcript, proof.eccvm_proof };
    auto eccvm_result = eccvm_verifier.reduce_to_triple_ipa_claim();
    vinfo("ChonkRecursiveVerifier: ECCVM reduced to TripleIPA claim: ",
          eccvm_result.reduction_succeeded ? "true" : "false");
    auto translator_input = eccvm_verifier.get_translator_input_data();
 
    // Step 5: Translator Oink + Joint sumcheck + Joint PCS
    auto batched_result = batched_verifier.verify(proof.joint_proof,
                                                  translator_input.evaluation_challenge_x,
                                                  translator_input.batching_challenge_v,
                                                  translator_input.accumulated_result,
                                                  merge_result.merged_commitments);
    vinfo("ChonkRecursiveVerifier: Batched translator+joint reduction: ",
          batched_result.reduction_succeeded ? "true" : "false");
 
    // Step 6: Aggregate all pairing points (PI, Merge, Batched PCS)
    std::vector<PairingPoints> pairing_points_to_aggregate;
    pairing_points_to_aggregate.reserve(NUM_PAIRING_POINTS);
 
    pairing_points_to_aggregate.push_back(kernel_io.pairing_inputs);
    pairing_points_to_aggregate.push_back(std::move(merge_result.pairing_points));
    pairing_points_to_aggregate.push_back(std::move(batched_result.pairing_points));
 
    // Edge case handling disabled: Safe because:
    // 1. Verifier-computed points (Merge, Batched PCS) are deterministic and won't collide
    // 2. PI points are added to the result of batching the above points; biggroup addition
    //    gracefully handles edge cases.
    constexpr bool handle_edge_cases = false;
    PairingPoints aggregated_pairing_points =
        PairingPoints::aggregate_multiple(pairing_points_to_aggregate, handle_edge_cases);
 
    bool all_checks_passed =
        merge_result.reduction_succeeded && eccvm_result.reduction_succeeded && batched_result.reduction_succeeded;
 
    return ReductionResult{
        .pairing_points = std::move(aggregated_pairing_points),
        .triple_ipa_opening = { .claim = std::move(eccvm_result.triple_ipa_claim), .proof = proof.ipa_proof },
        .all_checks_passed = all_checks_passed,
    };
}
 
template <>
ChonkVerifier<true>::TripleIpaReductionResult ChonkVerifier<true>::reduce_to_triple_ipa_opening(
    [[maybe_unused]] const Proof& proof)
{
    throw_or_abort("reduce_to_triple_ipa_opening is only available for native (non-recursive) ChonkVerifier");
}
 
// Template instantiations
template class ChonkVerifier<false>; // Native verifier
template class ChonkVerifier<true>;  // Recursive verifier
 
} // namespace bb