Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

perf: optimize Verify and BatchVerifyMultiPoints methods #3

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

perf: optimize Verify and BatchVerifyMultiPoints methods #3

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
20df801
perf: optimize kzg verify
yelhousni Jul 22, 2024
51e00f7
perf: optimize kzg BatchVerifyMultiPoints
yelhousni Jul 22, 2024
c271538
fix: PairingCheckFixedQ is not compatible with Ethereum SRS
yelhousni Jul 22, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
72 changes: 19 additions & 53 deletions internal/kzg/kzg_verify.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,62 +33,28 @@ type OpeningProof struct {
// [verify_kzg_proof_impl]: https://github.com/ethereum/consensus-specs/blob/017a8495f7671f5fff2075a9bfc9238c1a0982f8/specs/deneb/polynomial-commitments.md#verify_kzg_proof_impl
// [gnark-crypto]: https://github.com/ConsenSys/gnark-crypto/blob/8f7ca09273c24ed9465043566906cbecf5dcee91/ecc/bls12-381/fr/kzg/kzg.go#L166
func Verify(commitment *Commitment, proof *OpeningProof, openKey *OpeningKey) error {
// [-1]G₂
// It's possible to precompute this, however Negation
// is cheap (2 Fp negations), so doing it per verify
// should be insignificant compared to the rest of Verify.
var negG2 bls12381.G2Affine
negG2.Neg(&openKey.GenG2)

// Convert the G2 generator to Jacobian for
// later computations.
var genG2Jac bls12381.G2Jac
genG2Jac.FromAffine(&openKey.GenG2)

// This has been changed slightly from the way that gnark-crypto
// does it to show the symmetry in the computation required for
// G₂ and G₁. This is the way it is done in the specs.

// [z]G₂
var inputPointG2Jac bls12381.G2Jac
var pointBigInt big.Int
proof.InputPoint.BigInt(&pointBigInt)
inputPointG2Jac.ScalarMultiplication(&genG2Jac, &pointBigInt)

// In the specs, this is denoted as `X_minus_z`
//
// [α - z]G₂
var alphaMinusZG2Jac bls12381.G2Jac
alphaMinusZG2Jac.FromAffine(&openKey.AlphaG2)
alphaMinusZG2Jac.SubAssign(&inputPointG2Jac)

// [α-z]G₂ (Convert to Affine format)
var alphaMinusZG2Aff bls12381.G2Affine
alphaMinusZG2Aff.FromJacobian(&alphaMinusZG2Jac)

// [f(z)]G₁
var claimedValueG1Jac bls12381.G1Jac
var claimedValueBigInt big.Int
proof.ClaimedValue.BigInt(&claimedValueBigInt)
var GenG1Jac bls12381.G1Jac
GenG1Jac.FromAffine(&openKey.GenG1)
claimedValueG1Jac.ScalarMultiplication(&GenG1Jac, &claimedValueBigInt)

// In the specs, this is denoted as `P_minus_y`
//
// [f(α) - f(z)]G₁
var fminusfzG1Jac bls12381.G1Jac
fminusfzG1Jac.FromAffine(commitment)
fminusfzG1Jac.SubAssign(&claimedValueG1Jac)

// [f(α) - f(z)]G₁ (Convert to Affine format)
var fminusfzG1Aff bls12381.G1Affine
fminusfzG1Aff.FromJacobian(&fminusfzG1Jac)

// [f(z)]G₁ + [-z]([H(α)]G₁) = [f(z) - z*H(α)]G₁
var totalG1 bls12381.G1Jac
var pointNeg fr.Element
var cmInt, pointInt big.Int
proof.ClaimedValue.BigInt(&cmInt)
pointNeg.Neg(&proof.InputPoint).BigInt(&pointInt)
totalG1.JointScalarMultiplication(&openKey.GenG1, &proof.QuotientCommitment, &cmInt, &pointInt)

// [f(z) - z*H(α)]G₁ + [-f(α)]G₁ = [f(z) - f(α) - z*H(α)]G₁
var commitmentJac bls12381.G1Jac
commitmentJac.FromAffine(commitment)
totalG1.SubAssign(&commitmentJac)

// e([f(α)-f(z)+aH(α)]G₁], G₂).e([-H(α)]G₁, [α]G₂) == 1
var totalG1Aff bls12381.G1Affine
totalG1Aff.FromJacobian(&totalG1)
check, err := bls12381.PairingCheck(
[]bls12381.G1Affine{fminusfzG1Aff, proof.QuotientCommitment},
[]bls12381.G2Affine{negG2, alphaMinusZG2Aff},
[]bls12381.G1Affine{totalG1Aff, proof.QuotientCommitment},
[]bls12381.G2Affine{openKey.GenG2, openKey.AlphaG2},
)

if err != nil {
return err
}
Expand Down
2 changes: 2 additions & 0 deletions internal/kzg/srs.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,8 @@ type OpeningKey struct {
// This is the degree-1 G_2 element in the trusted setup.
// In the specs, this is denoted as `KZG_SETUP_G2[1]`
AlphaG2 bls12381.G2Affine
// These are the precomputed pairing lines corresponding to GenG2 and AlphaG2
PairingLines [2][2][len(bls12381.LoopCounter) - 1]bls12381.LineEvaluationAff
}

// CommitKey holds the data needed to commit to polynomials and by proxy make opening proofs
Expand Down
2 changes: 2 additions & 0 deletions internal/kzg/srs_insecure.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,6 +74,8 @@ func newMonomialSRSInsecureUint64(size uint64, bAlpha *big.Int) (*SRS, error) {
openKey.GenG1 = gen1Aff
openKey.GenG2 = gen2Aff
openKey.AlphaG2.ScalarMultiplication(&gen2Aff, bAlpha)
openKey.PairingLines[0] = bls12381.PrecomputeLines(openKey.GenG2)
openKey.PairingLines[1] = bls12381.PrecomputeLines(openKey.AlphaG2)

alphas := make([]fr.Element, size-1)
alphas[0] = alpha
Expand Down
Loading