#include <eccvm_prover.hpp>

Public Types
using	Flavor = ECCVMShortMonomialFlavor

using	FF = Flavor::FF

using	BF = Flavor::BF

using	Commitment = Flavor::Commitment

using	CommitmentKey = Flavor::CommitmentKey

using	VerificationKey = Flavor::VerificationKey

using	ProvingKey = Flavor::ProvingKey

using	Polynomial = Flavor::Polynomial

using	Commitments = typename Flavor::template AllEntities< Commitment >

using	CommitmentLabels = Flavor::CommitmentLabels

using	Transcript = Flavor::Transcript

using	TranslationEvaluations = bb::TranslationEvaluations_< FF >

using	CircuitBuilder = Flavor::CircuitBuilder

using	ZKData = ZKSumcheckData< Flavor >

using	SmallSubgroupIPA = SmallSubgroupIPAProver< Flavor >

using	OpeningClaim = ProverOpeningClaim< Flavor::Curve >

using	VerifierOpeningClaim = bb::OpeningClaim< Flavor::Curve >

using	Proof = HonkProof

Public Member Functions
	ECCVMProver (CircuitBuilder &builder, const std::shared_ptr< Transcript > &transcript)

BB_PROFILE void	execute_preamble_round ()
	Fiat-Shamir the VK.

BB_PROFILE void	execute_wire_commitments_round ()
	Compute commitments to the first three wires.

BB_PROFILE void	execute_log_derivative_commitments_round ()
	Compute sorted witness-table accumulator.

BB_PROFILE void	execute_grand_product_computation_round ()
	Compute permutation and lookup grand product polynomials and commitments.

BB_PROFILE void	execute_relation_check_rounds ()
	Run Sumcheck resulting in u = (u_1,...,u_d) challenges and all evaluations at u being calculated.

BB_PROFILE void	execute_transcript_consistency_univariate_opening_round ()

Proof	export_proof ()

Proof	construct_proof ()

void	append_libra_opening_claims ()
	Add the Libra (sumcheck ZK masking) univariate opening claims, produced via the SmallSubgroupIPA prover.

void	append_translation_opening_claims ()
	To link the ECCVM Transcript wires `op`, `Px`, `Py`, `z1`, and `z2` to the accumulator computed by the translator, we verify their evaluations as univariates. For efficiency reasons, we batch these evaluations.

void	append_sumcheck_round_opening_claims ()
	Add the committed-sumcheck round univariate opening claims (3 per round: evaluations at 0, 1, and the round challenge), pairing each prover polynomial with its round commitment.

void	append_pow_masking_opening_claim ()
	Add a small random univariate opening claim that masks the TripleIPA pow tensor.

std::pair< OpeningClaim, VerifierOpeningClaim >	reduce_univariate_opening_claims ()
	Reduce all univariate opening claims to a single opening claim via one Shplonk.

void	prove_triple_ipa (const OpeningClaim &prover_opening, const VerifierOpeningClaim &verifier_opening)
	Open the sumcheck multilinears together with the single reduced univariate claim via the TripleIPA.

Public Attributes
std::shared_ptr< Transcript >	transcript

Proof	ipa_proof

ProverOpeningClaimBatcher< Flavor::Curve >	univariate_claims

TranslationEvaluations	translation_evaluations

std::vector< FF >	public_inputs

bb::RelationParameters< FF >	relation_parameters

std::shared_ptr< ProvingKey >	key

Commitments	commitments

CommitmentLabels	commitment_labels

ZKData	zk_sumcheck_data

FF	evaluation_challenge_x

FF	batching_challenge_v

SumcheckOutput< Flavor >	sumcheck_output

Detailed Description

Definition at line 23 of file eccvm_prover.hpp.

Member Typedef Documentation

◆ BF

using bb::ECCVMProver::BF = Flavor::BF

Definition at line 27 of file eccvm_prover.hpp.

◆ CircuitBuilder

using bb::ECCVMProver::CircuitBuilder = Flavor::CircuitBuilder

Definition at line 37 of file eccvm_prover.hpp.

◆ Commitment

using bb::ECCVMProver::Commitment = Flavor::Commitment

Definition at line 28 of file eccvm_prover.hpp.

◆ CommitmentKey

using bb::ECCVMProver::CommitmentKey = Flavor::CommitmentKey

Definition at line 29 of file eccvm_prover.hpp.

◆ CommitmentLabels

using bb::ECCVMProver::CommitmentLabels = Flavor::CommitmentLabels

Definition at line 34 of file eccvm_prover.hpp.

◆ Commitments

using bb::ECCVMProver::Commitments = typename Flavor::template AllEntities<Commitment>

Definition at line 33 of file eccvm_prover.hpp.

◆ FF

using bb::ECCVMProver::FF = Flavor::FF

Definition at line 26 of file eccvm_prover.hpp.

◆ Flavor

using bb::ECCVMProver::Flavor = ECCVMShortMonomialFlavor

Definition at line 25 of file eccvm_prover.hpp.

◆ OpeningClaim

using bb::ECCVMProver::OpeningClaim = ProverOpeningClaim<Flavor::Curve>

Definition at line 40 of file eccvm_prover.hpp.

◆ Polynomial

using bb::ECCVMProver::Polynomial = Flavor::Polynomial

Definition at line 32 of file eccvm_prover.hpp.

◆ Proof

using bb::ECCVMProver::Proof = HonkProof

Definition at line 42 of file eccvm_prover.hpp.

◆ ProvingKey

using bb::ECCVMProver::ProvingKey = Flavor::ProvingKey

Definition at line 31 of file eccvm_prover.hpp.

◆ SmallSubgroupIPA

using bb::ECCVMProver::SmallSubgroupIPA = SmallSubgroupIPAProver<Flavor>

Definition at line 39 of file eccvm_prover.hpp.

◆ Transcript

using bb::ECCVMProver::Transcript = Flavor::Transcript

Definition at line 35 of file eccvm_prover.hpp.

◆ TranslationEvaluations

using bb::ECCVMProver::TranslationEvaluations = bb::TranslationEvaluations_<FF>

Definition at line 36 of file eccvm_prover.hpp.

◆ VerificationKey

using bb::ECCVMProver::VerificationKey = Flavor::VerificationKey

Definition at line 30 of file eccvm_prover.hpp.

◆ VerifierOpeningClaim

using bb::ECCVMProver::VerifierOpeningClaim = bb::OpeningClaim<Flavor::Curve>

Definition at line 41 of file eccvm_prover.hpp.

◆ ZKData

using bb::ECCVMProver::ZKData = ZKSumcheckData<Flavor>

Definition at line 38 of file eccvm_prover.hpp.

Constructor & Destructor Documentation

◆ ECCVMProver()

bb::ECCVMProver::ECCVMProver	(	CircuitBuilder &	builder,
		const std::shared_ptr< Transcript > &	transcript
	)

explicit

Definition at line 25 of file eccvm_prover.cpp.

Member Function Documentation

◆ append_libra_opening_claims()

void bb::ECCVMProver::append_libra_opening_claims ( )

Add the Libra (sumcheck ZK masking) univariate opening claims, produced via the SmallSubgroupIPA prover.

Definition at line 173 of file eccvm_prover.cpp.

◆ append_pow_masking_opening_claim()

void bb::ECCVMProver::append_pow_masking_opening_claim ( )

Add a small random univariate opening claim that masks the TripleIPA pow tensor.

The batched quotient P (pow-tensor witness) is contracted against the eq and shift tensors in the TripleIPA cross-sums c_{F,P}, c_{sh,P}. Folding one extra random claim into the Shplonk batch injects randomness into P's low-degree coefficients, blinding those contractions, while P(z)=0 is preserved automatically by the Shplonk identity. The multilinear opening is already masked by the dense PCS mask, so this mask is tiny.

Definition at line 226 of file eccvm_prover.cpp.

◆ append_sumcheck_round_opening_claims()

void bb::ECCVMProver::append_sumcheck_round_opening_claims ( )

Add the committed-sumcheck round univariate opening claims (3 per round: evaluations at 0, 1, and the round challenge), pairing each prover polynomial with its round commitment.

Definition at line 200 of file eccvm_prover.cpp.

◆ append_translation_opening_claims()

void bb::ECCVMProver::append_translation_opening_claims ( )

To link the ECCVM Transcript wires op, Px, Py, z1, and z2 to the accumulator computed by the translator, we verify their evaluations as univariates. For efficiency reasons, we batch these evaluations.

As a sub-protocol of ECCVM, we are batch opening the op, Px, Py, z1, and z2 wires as univariates (as opposed to their openings as multilinears performed after Sumcheck). We often refer to these polynomials as translation_polynomials \( T_i \) for \( i=0, \ldots, 4\). Below, the evaluation_challenge_x is denoted by \( x \) and batching_challenge_v is denoted by \(v\).

The batched translation evaluation

\begin{align} \sum_{i=0}^4 T_i(x) \cdot v^i \end{align}

is used by the TranslatorVerifier to bind the ECCOpQueues over BN254 and Grumpkin. Namely, we check that the field element \( A = \text{accumulated_result} \) accumulated from the Ultra ECCOpQueue by TranslatorProver satisfies

\begin{align} x\cdot A = \sum_{i=0}^4 T_i(x) \cdot v^i, \end{align}

where \( x \) is an artifact of our implementation of shiftable polynomials.

The translation polynomials \( T_i \) contain random masking values in their first TRACE_OFFSET coefficients. Commitments to the masked \( T_i \) are safe to reveal, but the evaluations \( T_i(x) \) include the masking contribution. To preserve ZK, the prover uses SmallSubgroupIPA to prove the masking correction: the masking terms from all five \( T_i \) are concatenated into a polynomial \( M \) over a small subgroup \( H \), and the verifier recovers \( \sum_i m_i(x) \cdot v^i \) via an inner-product argument without learning the individual masking values.

Definition at line 356 of file eccvm_prover.cpp.

◆ construct_proof()

ECCVMProver::Proof bb::ECCVMProver::construct_proof ( )

Definition at line 304 of file eccvm_prover.cpp.

◆ execute_grand_product_computation_round()

void bb::ECCVMProver::execute_grand_product_computation_round ( )

Compute permutation and lookup grand product polynomials and commitments.

Definition at line 130 of file eccvm_prover.cpp.

◆ execute_log_derivative_commitments_round()

void bb::ECCVMProver::execute_log_derivative_commitments_round ( )

Compute sorted witness-table accumulator.

Definition at line 89 of file eccvm_prover.cpp.

◆ execute_preamble_round()

void bb::ECCVMProver::execute_preamble_round ( )

Fiat-Shamir the VK.

Definition at line 48 of file eccvm_prover.cpp.

◆ execute_relation_check_rounds()

void bb::ECCVMProver::execute_relation_check_rounds ( )

Run Sumcheck resulting in u = (u_1,...,u_d) challenges and all evaluations at u being calculated.

Definition at line 145 of file eccvm_prover.cpp.

◆ execute_transcript_consistency_univariate_opening_round()

BB_PROFILE void bb::ECCVMProver::execute_transcript_consistency_univariate_opening_round ( )

◆ execute_wire_commitments_round()

void bb::ECCVMProver::execute_wire_commitments_round ( )

Compute commitments to the first three wires.

Definition at line 63 of file eccvm_prover.cpp.

◆ export_proof()

ECCVMProver::Proof bb::ECCVMProver::export_proof ( )

Definition at line 299 of file eccvm_prover.cpp.

◆ prove_triple_ipa()

void bb::ECCVMProver::prove_triple_ipa	(	const OpeningClaim &	prover_opening,
		const VerifierOpeningClaim &	verifier_opening
	)

Open the sumcheck multilinears together with the single reduced univariate claim via the TripleIPA.

Definition at line 241 of file eccvm_prover.cpp.

◆ reduce_univariate_opening_claims()

std::pair< ECCVMProver::OpeningClaim, ECCVMProver::VerifierOpeningClaim > bb::ECCVMProver::reduce_univariate_opening_claims ( )

Reduce all univariate opening claims to a single opening claim via one Shplonk.

The batched opening claim becomes the univariate (pow-tensor) input to the TripleIPA. The prover reconstructs the same batched commitment [P] the verifier derives, so the returned claim carries both the prover witness polynomial and that commitment.

Definition at line 281 of file eccvm_prover.cpp.

Member Data Documentation

◆ batching_challenge_v

FF bb::ECCVMProver::batching_challenge_v

Definition at line 83 of file eccvm_prover.hpp.

◆ commitment_labels

CommitmentLabels bb::ECCVMProver::commitment_labels

Definition at line 79 of file eccvm_prover.hpp.

◆ commitments

Commitments bb::ECCVMProver::commitments

Definition at line 77 of file eccvm_prover.hpp.

◆ evaluation_challenge_x

FF bb::ECCVMProver::evaluation_challenge_x

Definition at line 82 of file eccvm_prover.hpp.

◆ ipa_proof

Proof bb::ECCVMProver::ipa_proof

Definition at line 65 of file eccvm_prover.hpp.

◆ key

std::shared_ptr<ProvingKey> bb::ECCVMProver::key

Definition at line 76 of file eccvm_prover.hpp.

◆ public_inputs

std::vector<FF> bb::ECCVMProver::public_inputs

Definition at line 72 of file eccvm_prover.hpp.

◆ relation_parameters

bb::RelationParameters<FF> bb::ECCVMProver::relation_parameters

Definition at line 74 of file eccvm_prover.hpp.

◆ sumcheck_output

SumcheckOutput<Flavor> bb::ECCVMProver::sumcheck_output

Definition at line 85 of file eccvm_prover.hpp.

◆ transcript

std::shared_ptr<Transcript> bb::ECCVMProver::transcript

Definition at line 64 of file eccvm_prover.hpp.

◆ translation_evaluations

TranslationEvaluations bb::ECCVMProver::translation_evaluations

Definition at line 70 of file eccvm_prover.hpp.

◆ univariate_claims

ProverOpeningClaimBatcher<Flavor::Curve> bb::ECCVMProver::univariate_claims

Definition at line 68 of file eccvm_prover.hpp.

◆ zk_sumcheck_data

ZKData bb::ECCVMProver::zk_sumcheck_data

Definition at line 80 of file eccvm_prover.hpp.

The documentation for this class was generated from the following files:

src/barretenberg/eccvm/eccvm_prover.hpp
src/barretenberg/eccvm/eccvm_prover.cpp

Public Types

Public Member Functions

Public Attributes