Update the root circuit to conditionally verify Keccak proofs

[sai-deng]

Implements the new root circuits in #620
This PR has been tested in combination with #657 and #648
Please review the circuit carefully, as it may impact the security of the system.

The gate number increased by 3083 when using the table ranges in .env.

Circuit size before this PR:

 33780 gates to root
 | 294 gates to evaluate the vanishing polynomial at our challenge point, zeta.
 | | 243 gates to evaluate gate constraints
 | | | 123 gates to evaluate PoseidonGate(PhantomData<plonky2_field::goldilocks_field::GoldilocksField>)<WIDTH=12> constraints
 | 3244 gates to verify FRI proof
 | | 113 gates to verify one (of 28) query rounds
 | 292 gates to evaluate the vanishing polynomial at our challenge point, zeta.
 | | 243 gates to evaluate gate constraints
 | | | 124 gates to evaluate PoseidonGate(PhantomData<plonky2_field::goldilocks_field::GoldilocksField>)<WIDTH=12> constraints
 | 3226 gates to verify FRI proof
 | | 114 gates to verify one (of 28) query rounds
 | 293 gates to evaluate the vanishing polynomial at our challenge point, zeta.
 | | 243 gates to evaluate gate constraints
 | | | 124 gates to evaluate PoseidonGate(PhantomData<plonky2_field::goldilocks_field::GoldilocksField>)<WIDTH=12> constraints
 | 3243 gates to verify FRI proof
 | | 113 gates to verify one (of 28) query rounds
 | 291 gates to evaluate the vanishing polynomial at our challenge point, zeta.
 | | 241 gates to evaluate gate constraints
 | | | 123 gates to evaluate PoseidonGate(PhantomData<plonky2_field::goldilocks_field::GoldilocksField>)<WIDTH=12> constraints
 | 3226 gates to verify FRI proof
 | | 113 gates to verify one (of 28) query rounds
 | 293 gates to evaluate the vanishing polynomial at our challenge point, zeta.
 | | 244 gates to evaluate gate constraints
 | | | 124 gates to evaluate PoseidonGate(PhantomData<plonky2_field::goldilocks_field::GoldilocksField>)<WIDTH=12> constraints
 | 3223 gates to verify FRI proof
 | | 113 gates to verify one (of 28) query rounds
 | 293 gates to evaluate the vanishing polynomial at our challenge point, zeta.
 | | 243 gates to evaluate gate constraints
 | | | 125 gates to evaluate PoseidonGate(PhantomData<plonky2_field::goldilocks_field::GoldilocksField>)<WIDTH=12> constraints
 | 3244 gates to verify FRI proof
 | | 114 gates to verify one (of 28) query rounds
 | 292 gates to evaluate the vanishing polynomial at our challenge point, zeta.
 | | 242 gates to evaluate gate constraints
 | | | 123 gates to evaluate PoseidonGate(PhantomData<plonky2_field::goldilocks_field::GoldilocksField>)<WIDTH=12> constraints
 | 3226 gates to verify FRI proof
 | | 113 gates to verify one (of 28) query rounds
 | 292 gates to evaluate the vanishing polynomial at our challenge point, zeta.
 | | 243 gates to evaluate gate constraints
 | | | 124 gates to evaluate PoseidonGate(PhantomData<plonky2_field::goldilocks_field::GoldilocksField>)<WIDTH=12> constraints
 | 3242 gates to verify FRI proof
 | | 112 gates to verify one (of 28) query rounds
 | 294 gates to evaluate the vanishing polynomial at our challenge point, zeta.
 | | 244 gates to evaluate gate constraints
 | | | 125 gates to evaluate PoseidonGate(PhantomData<plonky2_field::goldilocks_field::GoldilocksField>)<WIDTH=12> constraints
 | 3227 gates to verify FRI proof
 | | 115 gates to verify one (of 28) query rounds
 Total gate counts:
 - 423 instances of ReducingExtensionGate { num_coeffs: 32 }
 - 513 instances of BaseSumGate { num_limbs: 63 } + Base: 2
 - 833 instances of MulExtensionGate { num_ops: 13 }
 - 1849 instances of RandomAccessGate { bits: 4, num_copies: 4, num_extra_constants: 2, _phantom: PhantomData<plonky2_field::goldilocks_field::GoldilocksField> }<D=2>
 - 1260 instances of ReducingGate { num_coeffs: 43 }
 - 504 instances of CosetInterpolationGate { subgroup_bits: 4, degree: 6, barycentric_weights: , _phantom: PhantomData<plonky2_field::goldilocks_field::GoldilocksField> }<D=2>
 - 26 instances of RandomAccessGate { bits: 3, num_copies: 8, num_extra_constants: 0, _phantom: PhantomData<plonky2_field::goldilocks_field::GoldilocksField> }<D=2>
 - 25346 instances of PoseidonGate(PhantomData<plonky2_field::goldilocks_field::GoldilocksField>)<WIDTH=12>
 - 1 instances of ConstantGate { num_consts: 2 }
 - 34 instances of RandomAccessGate { bits: 5, num_copies: 2, num_extra_constants: 2, _phantom: PhantomData<plonky2_field::goldilocks_field::GoldilocksField> }<D=2>
 - 1723 instances of ArithmeticExtensionGate { num_ops: 10 }
 - 270 instances of PoseidonMdsGate(PhantomData<plonky2_field::goldilocks_field::GoldilocksField>)<WIDTH=12>
 - 998 instances of ArithmeticGate { num_ops: 20 }
 Degree before blinding & padding: 36054
 Degree after blinding & padding: 65536

After this PR:

36863 gates to root
 | 295 gates to evaluate the vanishing polynomial at our challenge point, zeta.
 | | 243 gates to evaluate gate constraints
 | | | 123 gates to evaluate PoseidonGate(PhantomData<plonky2_field::goldilocks_field::GoldilocksField>)<WIDTH=12> constraints
 | 3243 gates to verify FRI proof
 | | 112 gates to verify one (of 28) query rounds
 | 292 gates to evaluate the vanishing polynomial at our challenge point, zeta.
 | | 243 gates to evaluate gate constraints
 | | | 125 gates to evaluate PoseidonGate(PhantomData<plonky2_field::goldilocks_field::GoldilocksField>)<WIDTH=12> constraints
 | 3225 gates to verify FRI proof
 | | 114 gates to verify one (of 28) query rounds
 | 294 gates to evaluate the vanishing polynomial at our challenge point, zeta.
 | | 244 gates to evaluate gate constraints
 | | | 124 gates to evaluate PoseidonGate(PhantomData<plonky2_field::goldilocks_field::GoldilocksField>)<WIDTH=12> constraints
 | 3242 gates to verify FRI proof
 | | 113 gates to verify one (of 28) query rounds
 | 1521 gates to select proof
 | 292 gates to evaluate the vanishing polynomial at our challenge point, zeta.
 | | 242 gates to evaluate gate constraints
 | | | 124 gates to evaluate PoseidonGate(PhantomData<plonky2_field::goldilocks_field::GoldilocksField>)<WIDTH=12> constraints
 | 3228 gates to verify FRI proof
 | | 113 gates to verify one (of 28) query rounds
 | 1521 gates to select proof
 | 294 gates to evaluate the vanishing polynomial at our challenge point, zeta.
 | | 244 gates to evaluate gate constraints
 | | | 124 gates to evaluate PoseidonGate(PhantomData<plonky2_field::goldilocks_field::GoldilocksField>)<WIDTH=12> constraints
 | 3223 gates to verify FRI proof
 | | 114 gates to verify one (of 28) query rounds
 | 293 gates to evaluate the vanishing polynomial at our challenge point, zeta.
 | | 243 gates to evaluate gate constraints
 | | | 125 gates to evaluate PoseidonGate(PhantomData<plonky2_field::goldilocks_field::GoldilocksField>)<WIDTH=12> constraints
 | 3244 gates to verify FRI proof
 | | 115 gates to verify one (of 28) query rounds
 | 293 gates to evaluate the vanishing polynomial at our challenge point, zeta.
 | | 243 gates to evaluate gate constraints
 | | | 124 gates to evaluate PoseidonGate(PhantomData<plonky2_field::goldilocks_field::GoldilocksField>)<WIDTH=12> constraints
 | 3227 gates to verify FRI proof
 | | 114 gates to verify one (of 28) query rounds
 | 292 gates to evaluate the vanishing polynomial at our challenge point, zeta.
 | | 243 gates to evaluate gate constraints
 | | | 125 gates to evaluate PoseidonGate(PhantomData<plonky2_field::goldilocks_field::GoldilocksField>)<WIDTH=12> constraints
 | 3242 gates to verify FRI proof
 | | 112 gates to verify one (of 28) query rounds
 | 293 gates to evaluate the vanishing polynomial at our challenge point, zeta.
 | | 242 gates to evaluate gate constraints
 | | | 124 gates to evaluate PoseidonGate(PhantomData<plonky2_field::goldilocks_field::GoldilocksField>)<WIDTH=12> constraints
 | 3228 gates to verify FRI proof
 | | 114 gates to verify one (of 28) query rounds
 Total gate counts:
 - 423 instances of ReducingExtensionGate { num_coeffs: 32 }
 - 513 instances of BaseSumGate { num_limbs: 63 } + Base: 2
 - 833 instances of MulExtensionGate { num_ops: 13 }
 - 1849 instances of RandomAccessGate { bits: 4, num_copies: 4, num_extra_constants: 2, _phantom: PhantomData<plonky2_field::goldilocks_field::GoldilocksField> }<D=2>
 - 1260 instances of ReducingGate { num_coeffs: 43 }
 - 504 instances of CosetInterpolationGate { subgroup_bits: 4, degree: 6, barycentric_weights: , _phantom: PhantomData<plonky2_field::goldilocks_field::GoldilocksField> }<D=2>
 - 26 instances of RandomAccessGate { bits: 3, num_copies: 8, num_extra_constants: 0, _phantom: PhantomData<plonky2_field::goldilocks_field::GoldilocksField> }<D=2>
 - 25355 instances of PoseidonGate(PhantomData<plonky2_field::goldilocks_field::GoldilocksField>)<WIDTH=12>
 - 1 instances of ConstantGate { num_consts: 2 }
 - 34 instances of RandomAccessGate { bits: 5, num_copies: 2, num_extra_constants: 2, _phantom: PhantomData<plonky2_field::goldilocks_field::GoldilocksField> }<D=2>
 - 2183 instances of ArithmeticExtensionGate { num_ops: 10 }
 - 270 instances of PoseidonMdsGate(PhantomData<plonky2_field::goldilocks_field::GoldilocksField>)<WIDTH=12>
 - 3612 instances of ArithmeticGate { num_ops: 20 }
 Degree before blinding & padding: 39137
 Degree after blinding & padding: 65536

[Nashtare]

Thanks Sai, just a couple nits for readability

[Nashtare]

Maybe unrelated, but if we add this to the common recursion gates, I think we may be able to remove this from the root circuit definition?

builder.add_gate(
            ConstantGate::new(inner_common_data[0].config.num_constants),
            vec![],
        );

[sai-deng]

We may get trouble without it in the recursion circuits after it. Since in conditional verifying, we need a dummy circuit. But the dummy circuit will generate a constant gate while this one (root circuit) will not generate it.

[sai-deng]

Thanks for reviewing. I just tested the root circuit size changes.
The gate number increased by 3083.
But it still has the same degree after padding:

Degree after blinding & padding: 65536
See the updated PR description for more details.