From 7bedb67d2249df5c19e599c630dbf0405bbba6ab Mon Sep 17 00:00:00 2001
From: han0110 <tinghan0110@gmail.com>
Date: Thu, 19 Jan 2023 17:22:14 +0800
Subject: [PATCH 01/30] feat: call synthesize in `MockProver` multiple times to
 behave same as real prover

---
 halo2_proofs/src/dev.rs           | 76 +++++++++++++++++++++++++------
 halo2_proofs/src/plonk/circuit.rs |  6 +++
 2 files changed, 69 insertions(+), 13 deletions(-)

diff --git a/halo2_proofs/src/dev.rs b/halo2_proofs/src/dev.rs
index 94d7da90a1..8b593a0118 100644
--- a/halo2_proofs/src/dev.rs
+++ b/halo2_proofs/src/dev.rs
@@ -12,16 +12,15 @@ use blake2b_simd::blake2b;
 use ff::{BatchInvert, Field};
 
 use crate::plonk::permutation::keygen::Assembly;
-use crate::plonk::sealed::SealedPhase;
-use crate::plonk::FirstPhase;
-use crate::plonk::ThirdPhase;
 use crate::{
     arithmetic::{FieldExt, Group},
     circuit,
     plonk::{
-        permutation, Advice, Any, Assigned, Assignment, Challenge, Circuit, Column, ColumnType,
-        ConstraintSystem, Error, Expression, Fixed, FloorPlanner, Instance, Phase, Selector,
-        VirtualCell,
+        permutation,
+        sealed::{self, SealedPhase},
+        Advice, Any, Assigned, Assignment, Challenge, Circuit, Column, ColumnType,
+        ConstraintSystem, Error, Expression, FirstPhase, Fixed, FloorPlanner, Instance, Phase,
+        Selector, ThirdPhase, VirtualCell,
     },
     poly::Rotation,
 };
@@ -457,7 +456,13 @@ pub struct MockProver<'a, F: Group + Field> {
     // A range of available rows for assignment and copies.
     usable_rows: Range<usize>,
 
-    current_phase: crate::plonk::sealed::Phase,
+    current_phase: sealed::Phase, // crate::plonk::sealed::Phase,
+}
+
+impl<'a, F: Field + Group> MockProver<'a, F> {
+    fn in_phase<P: Phase>(&self, phase: P) -> bool {
+        self.current_phase == phase.to_sealed()
+    }
 }
 
 impl<'a, F: Field + Group> Assignment<F> for MockProver<'a, F> {
@@ -466,6 +471,10 @@ impl<'a, F: Field + Group> Assignment<F> for MockProver<'a, F> {
         NR: Into<String>,
         N: FnOnce() -> NR,
     {
+        if !self.in_phase(FirstPhase) {
+            return;
+        }
+
         assert!(self.current_region.is_none());
         self.current_region = Some(Region {
             name: name().into(),
@@ -479,6 +488,10 @@ impl<'a, F: Field + Group> Assignment<F> for MockProver<'a, F> {
     }
 
     fn exit_region(&mut self) {
+        if !self.in_phase(FirstPhase) {
+            return;
+        }
+
         self.regions.push(self.current_region.take().unwrap());
     }
 
@@ -487,6 +500,10 @@ impl<'a, F: Field + Group> Assignment<F> for MockProver<'a, F> {
         A: FnOnce() -> AR,
         AR: Into<String>,
     {
+        if !self.in_phase(FirstPhase) {
+            return;
+        }
+
         if let Some(region) = self.current_region.as_mut() {
             region
                 .annotations
@@ -499,6 +516,10 @@ impl<'a, F: Field + Group> Assignment<F> for MockProver<'a, F> {
         A: FnOnce() -> AR,
         AR: Into<String>,
     {
+        if !self.in_phase(FirstPhase) {
+            return Ok(());
+        }
+
         if !self.usable_rows.contains(&row) {
             return Err(Error::not_enough_rows_available(self.k));
         }
@@ -689,6 +710,21 @@ impl<'a, F: Field + Group> Assignment<F> for MockProver<'a, F> {
             return Err(Error::not_enough_rows_available(self.k));
         }
 
+        if self.in_phase(FirstPhase) {
+            if !self.usable_rows.contains(&row) {
+                return Err(Error::not_enough_rows_available(self.k));
+            }
+
+            if let Some(region) = self.current_region.as_mut() {
+                region.update_extent(column.into(), row);
+                region
+                    .cells
+                    .entry((column.into(), row))
+                    .and_modify(|count| *count += 1)
+                    .or_default();
+            }
+        }
+
         if !self.rw_rows.contains(&row) {
             return Err(Error::InvalidRange(
                 row,
@@ -727,11 +763,13 @@ impl<'a, F: Field + Group> Assignment<F> for MockProver<'a, F> {
         #[cfg(feature = "mock-batch-inv")]
         let assigned = CellValue::from(val_res?);
 
-        *self
-            .advice
-            .get_mut(column.index())
-            .and_then(|v| v.get_mut(row - self.rw_rows.start))
-            .ok_or(Error::BoundsFailure)? = assigned;
+        if self.in_phase(column.column_type().phase) {
+            *self
+                .advice
+                .get_mut(column.index())
+                .and_then(|v| v.get_mut(row))
+                .ok_or(Error::BoundsFailure)? = assigned;
+        }
 
         #[cfg(feature = "phase-check")]
         // if false && self.current_phase.0 > column.column_type().phase.0 {
@@ -766,6 +804,10 @@ impl<'a, F: Field + Group> Assignment<F> for MockProver<'a, F> {
         A: FnOnce() -> AR,
         AR: Into<String>,
     {
+        if !self.in_phase(FirstPhase) {
+            return Ok(());
+        }
+
         if !self.usable_rows.contains(&row) {
             return Err(Error::not_enough_rows_available(self.k));
         }
@@ -817,6 +859,10 @@ impl<'a, F: Field + Group> Assignment<F> for MockProver<'a, F> {
         right_column: Column<Any>,
         right_row: usize,
     ) -> Result<(), crate::plonk::Error> {
+        if !self.in_phase(FirstPhase) {
+            return Ok(());
+        }
+
         if !self.usable_rows.contains(&left_row) || !self.usable_rows.contains(&right_row) {
             return Err(Error::not_enough_rows_available(self.k));
         }
@@ -848,6 +894,10 @@ impl<'a, F: Field + Group> Assignment<F> for MockProver<'a, F> {
         from_row: usize,
         to: circuit::Value<Assigned<F>>,
     ) -> Result<(), Error> {
+        if !self.in_phase(FirstPhase) {
+            return Ok(());
+        }
+
         if !self.usable_rows.contains(&from_row) {
             return Err(Error::not_enough_rows_available(self.k));
         }
@@ -974,7 +1024,7 @@ impl<'a, F: FieldExt> MockProver<'a, F> {
             permutation: Some(permutation),
             rw_rows: 0..usable_rows,
             usable_rows: 0..usable_rows,
-            current_phase,
+            current_phase, // FirstPhase.to_sealed(),
         };
 
         #[cfg(feature = "phase-check")]
diff --git a/halo2_proofs/src/plonk/circuit.rs b/halo2_proofs/src/plonk/circuit.rs
index 8f1ec3da8c..f0329fbe85 100644
--- a/halo2_proofs/src/plonk/circuit.rs
+++ b/halo2_proofs/src/plonk/circuit.rs
@@ -77,6 +77,12 @@ pub(crate) mod sealed {
         }
     }
 
+    impl SealedPhase for Phase {
+        fn to_sealed(self) -> Phase {
+            self
+        }
+    }
+
     /// Sealed trait to help keep `Phase` private.
     pub trait SealedPhase {
         fn to_sealed(self) -> Phase;

From 4c12249af7178d4149414ec2c11272f03f336f78 Mon Sep 17 00:00:00 2001
From: Velaciela <git.rover@outlook.com>
Date: Sun, 8 Oct 2023 09:51:09 +0000
Subject: [PATCH 02/30] modify previous commit

---
 halo2_proofs/src/dev.rs | 37 ++++++++++++++-----------------------
 1 file changed, 14 insertions(+), 23 deletions(-)

diff --git a/halo2_proofs/src/dev.rs b/halo2_proofs/src/dev.rs
index 8b593a0118..1d9de2706e 100644
--- a/halo2_proofs/src/dev.rs
+++ b/halo2_proofs/src/dev.rs
@@ -710,21 +710,6 @@ impl<'a, F: Field + Group> Assignment<F> for MockProver<'a, F> {
             return Err(Error::not_enough_rows_available(self.k));
         }
 
-        if self.in_phase(FirstPhase) {
-            if !self.usable_rows.contains(&row) {
-                return Err(Error::not_enough_rows_available(self.k));
-            }
-
-            if let Some(region) = self.current_region.as_mut() {
-                region.update_extent(column.into(), row);
-                region
-                    .cells
-                    .entry((column.into(), row))
-                    .and_modify(|count| *count += 1)
-                    .or_default();
-            }
-        }
-
         if !self.rw_rows.contains(&row) {
             return Err(Error::InvalidRange(
                 row,
@@ -763,13 +748,11 @@ impl<'a, F: Field + Group> Assignment<F> for MockProver<'a, F> {
         #[cfg(feature = "mock-batch-inv")]
         let assigned = CellValue::from(val_res?);
 
-        if self.in_phase(column.column_type().phase) {
-            *self
-                .advice
-                .get_mut(column.index())
-                .and_then(|v| v.get_mut(row))
-                .ok_or(Error::BoundsFailure)? = assigned;
-        }
+        *self
+            .advice
+            .get_mut(column.index())
+            .and_then(|v| v.get_mut(row))
+            .ok_or(Error::BoundsFailure)? = assigned;
 
         #[cfg(feature = "phase-check")]
         // if false && self.current_phase.0 > column.column_type().phase.0 {
@@ -1083,7 +1066,15 @@ impl<'a, F: FieldExt> MockProver<'a, F> {
         #[cfg(not(feature = "phase-check"))]
         {
             let syn_time = Instant::now();
-            ConcreteCircuit::FloorPlanner::synthesize(&mut prover, circuit, config, constants)?;
+            for current_phase in prover.cs.phases() {
+                prover.current_phase = current_phase;
+                ConcreteCircuit::FloorPlanner::synthesize(
+                    &mut prover,
+                    circuit,
+                    config.clone(),
+                    constants.clone(),
+                )?;
+            }
             log::info!("MockProver synthesize took {:?}", syn_time.elapsed());
         }
 

From 323f40329cffaac3c709326ac1d38a7ce9912f58 Mon Sep 17 00:00:00 2001
From: Han <tinghan0110@gmail.com>
Date: Thu, 23 Feb 2023 04:08:12 +0800
Subject: [PATCH 03/30] Expose mod `permutation` and re-export
 `permutation::keygen::Assembly` (#149)

* feat: expose mod ule `permutation` and re-export `permutation::keygen::Assembly`

* feat: derive `lone` for `permutation::keygen::Assembly`

* feat: bump MSRV for `inferno`
---
 halo2_proofs/src/dev.rs                      |  4 ++--
 halo2_proofs/src/plonk.rs                    |  2 +-
 halo2_proofs/src/plonk/permutation.rs        |  5 +++++
 halo2_proofs/src/plonk/permutation/keygen.rs | 20 +++++++++++++++-----
 rust-toolchain                               |  2 +-
 5 files changed, 24 insertions(+), 9 deletions(-)

diff --git a/halo2_proofs/src/dev.rs b/halo2_proofs/src/dev.rs
index 1d9de2706e..28ca17a082 100644
--- a/halo2_proofs/src/dev.rs
+++ b/halo2_proofs/src/dev.rs
@@ -1443,7 +1443,7 @@ impl<'a, F: FieldExt> MockProver<'a, F> {
             self.permutation
                 .as_ref()
                 .expect("root cs permutation must be Some")
-                .mapping
+                .mapping()
                 .iter()
                 .enumerate()
                 .flat_map(move |(column, values)| {
@@ -1817,7 +1817,7 @@ impl<'a, F: FieldExt> MockProver<'a, F> {
             self.permutation
                 .as_ref()
                 .expect("root cs permutation must be Some")
-                .mapping
+                .mapping()
                 .iter()
                 .enumerate()
                 .flat_map(move |(column, values)| {
diff --git a/halo2_proofs/src/plonk.rs b/halo2_proofs/src/plonk.rs
index d1aecca38e..f2e2ce7df8 100644
--- a/halo2_proofs/src/plonk.rs
+++ b/halo2_proofs/src/plonk.rs
@@ -28,7 +28,7 @@ mod error;
 mod evaluation;
 mod keygen;
 mod lookup;
-pub(crate) mod permutation;
+pub mod permutation;
 mod vanishing;
 
 mod prover;
diff --git a/halo2_proofs/src/plonk/permutation.rs b/halo2_proofs/src/plonk/permutation.rs
index b353493c57..8a731416ee 100644
--- a/halo2_proofs/src/plonk/permutation.rs
+++ b/halo2_proofs/src/plonk/permutation.rs
@@ -1,3 +1,5 @@
+//! Implementation of permutation argument.
+
 use super::circuit::{Any, Column};
 use crate::{
     arithmetic::CurveAffine,
@@ -14,6 +16,8 @@ pub(crate) mod keygen;
 pub(crate) mod prover;
 pub(crate) mod verifier;
 
+pub use keygen::Assembly;
+
 use std::io;
 
 /// A permutation argument.
@@ -72,6 +76,7 @@ impl Argument {
         }
     }
 
+    /// Returns columns that participate on the permutation argument.
     pub fn get_columns(&self) -> Vec<Column<Any>> {
         self.columns.clone()
     }
diff --git a/halo2_proofs/src/plonk/permutation/keygen.rs b/halo2_proofs/src/plonk/permutation/keygen.rs
index 58ba4878cc..cc2dc09bb0 100644
--- a/halo2_proofs/src/plonk/permutation/keygen.rs
+++ b/halo2_proofs/src/plonk/permutation/keygen.rs
@@ -12,16 +12,16 @@ use crate::{
 };
 
 /// Struct that accumulates all the necessary data in order to construct the permutation argument.
-#[derive(Debug, Clone, PartialEq, Eq)]
+#[derive(Clone, Debug, PartialEq, Eq)]
 pub struct Assembly {
     /// Columns that participate on the copy permutation argument.
-    pub columns: Vec<Column<Any>>,
+    columns: Vec<Column<Any>>,
     /// Mapping of the actual copies done.
-    pub mapping: Vec<Vec<(usize, usize)>>,
+    mapping: Vec<Vec<(usize, usize)>>,
     /// Some aux data used to swap positions directly when sorting.
-    pub aux: Vec<Vec<(usize, usize)>>,
+    aux: Vec<Vec<(usize, usize)>>,
     /// More aux data
-    pub sizes: Vec<Vec<usize>>,
+    sizes: Vec<Vec<usize>>,
 }
 
 impl Assembly {
@@ -238,4 +238,14 @@ impl Assembly {
             polys,
         }
     }
+
+    /// Returns columns that participate on the permutation argument.
+    pub fn columns(&self) -> &[Column<Any>] {
+        &self.columns
+    }
+
+    /// Returns mappings of the copies.
+    pub fn mapping(&self) -> &[Vec<(usize, usize)>] {
+        &self.mapping
+    }
 }
diff --git a/rust-toolchain b/rust-toolchain
index af92bdd9f5..9405730420 100644
--- a/rust-toolchain
+++ b/rust-toolchain
@@ -1 +1 @@
-1.63.0
+1.64.0

From 233dbc645e30772614051305c51657baba10403d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Carlos=20P=C3=A9rez?=
 <37264926+CPerezz@users.noreply.github.com>
Date: Tue, 7 Mar 2023 17:29:37 +0100
Subject: [PATCH 04/30] change: Migrate workspace to pasta_curves-0.5 (#157)

* change: Migrate workspace to pasta_curves-0.5

This ports the majority of the workspace to the `pasta_curves-0.5.0`
leaving some tricky edge-cases that we need to handle carefully.

Resolves: #132

* fix: Complete latest trait bounds to compile halo2proofs

* change: Migrate examples & benches to pasta 0.5

* change: Migrate halo2_gadgets to pasta-0.5

* change: Update gadgets outdated code with latest upstream

* fix: Sha3 gadget circuit

* fix: doc tests

* chore: Update merged main

* fix: Apply review suggestions
---
 halo2_gadgets/Cargo.toml                      |   6 +-
 halo2_gadgets/benches/poseidon.rs             |   6 +-
 halo2_gadgets/src/ecc/chip/add.rs             |   3 +-
 halo2_gadgets/src/ecc/chip/constants.rs       |  13 +-
 halo2_gadgets/src/ecc/chip/mul.rs             |  19 +--
 halo2_gadgets/src/ecc/chip/mul/incomplete.rs  |   3 +-
 halo2_gadgets/src/ecc/chip/mul/overflow.rs    |   4 +-
 halo2_gadgets/src/ecc/chip/mul_fixed.rs       |   4 +-
 .../src/ecc/chip/mul_fixed/base_field_elem.rs |   2 +-
 .../src/ecc/chip/mul_fixed/full_width.rs      |   2 +-
 halo2_gadgets/src/ecc/chip/mul_fixed/short.rs |  16 +-
 halo2_gadgets/src/poseidon.rs                 |  24 +--
 halo2_gadgets/src/poseidon/pow5.rs            |  36 ++--
 halo2_gadgets/src/poseidon/primitives.rs      |  90 +++++-----
 .../src/poseidon/primitives/grain.rs          |  13 +-
 halo2_gadgets/src/poseidon/primitives/mds.rs  |  10 +-
 .../src/poseidon/primitives/p128pow5t3.rs     |  28 +--
 halo2_gadgets/src/sha256.rs                   |   8 +-
 .../table16/compression/compression_gates.rs  |  38 ++---
 halo2_gadgets/src/sha256/table16/gates.rs     |  17 +-
 .../message_schedule/schedule_gates.rs        |  22 ++-
 .../src/sha256/table16/spread_table.rs        |  80 +++++----
 halo2_gadgets/src/sinsemilla.rs               |   6 +-
 .../src/sinsemilla/chip/generator_table.rs    |   3 +-
 .../src/sinsemilla/chip/hash_to_point.rs      |  16 +-
 halo2_gadgets/src/sinsemilla/merkle/chip.rs   |   2 +-
 halo2_gadgets/src/sinsemilla/message.rs       |  14 +-
 halo2_gadgets/src/utilities.rs                |  26 +--
 halo2_gadgets/src/utilities/cond_swap.rs      |  19 ++-
 .../src/utilities/decompose_running_sum.rs    |  19 +--
 .../src/utilities/lookup_range_check.rs       |  30 ++--
 halo2_proofs/Cargo.toml                       |   6 +-
 halo2_proofs/benches/dev_lookup.rs            |   8 +-
 halo2_proofs/benches/plonk.rs                 |  34 ++--
 halo2_proofs/examples/circuit-layout.rs       |  29 ++--
 halo2_proofs/examples/shuffle.rs              |  42 ++---
 halo2_proofs/examples/simple-example.rs       |  18 +-
 halo2_proofs/examples/two-chip.rs             |  43 +++--
 halo2_proofs/src/arithmetic.rs                |  95 ++++++-----
 halo2_proofs/src/circuit.rs                   |   9 +-
 halo2_proofs/src/circuit/layouter.rs          |   2 +-
 halo2_proofs/src/dev.rs                       |  49 +++---
 halo2_proofs/src/dev/failure.rs               |   7 +-
 halo2_proofs/src/dev/util.rs                  |  16 +-
 halo2_proofs/src/plonk.rs                     |  23 ++-
 halo2_proofs/src/plonk/assigned.rs            |  14 +-
 halo2_proofs/src/plonk/circuit.rs             |   9 +-
 .../src/plonk/circuit/compress_selectors.rs   |  12 +-
 halo2_proofs/src/plonk/evaluation.rs          |  24 +--
 halo2_proofs/src/plonk/keygen.rs              |  11 +-
 halo2_proofs/src/plonk/lookup/prover.rs       |  17 +-
 halo2_proofs/src/plonk/lookup/verifier.rs     |  10 +-
 halo2_proofs/src/plonk/permutation/keygen.rs  |  10 +-
 halo2_proofs/src/plonk/permutation/prover.rs  |  11 +-
 .../src/plonk/permutation/verifier.rs         |  15 +-
 halo2_proofs/src/plonk/prover.rs              |   9 +-
 halo2_proofs/src/plonk/vanishing/prover.rs    |   6 +-
 halo2_proofs/src/plonk/vanishing/verifier.rs  |   6 +-
 halo2_proofs/src/plonk/verifier.rs            |  15 +-
 halo2_proofs/src/plonk/verifier/batch.rs      |   6 +-
 halo2_proofs/src/poly.rs                      |  13 +-
 halo2_proofs/src/poly/commitment.rs           |  24 +--
 halo2_proofs/src/poly/domain.rs               | 160 +++++++++---------
 halo2_proofs/src/poly/evaluator.rs            |  50 +++---
 halo2_proofs/src/poly/ipa/commitment.rs       |  14 +-
 .../src/poly/ipa/commitment/prover.rs         |   4 +-
 .../src/poly/ipa/commitment/verifier.rs       |   4 +-
 halo2_proofs/src/poly/ipa/msm.rs              |   2 +-
 halo2_proofs/src/poly/ipa/multiopen.rs        |  12 +-
 halo2_proofs/src/poly/ipa/multiopen/prover.rs |   6 +-
 .../src/poly/ipa/multiopen/verifier.rs        |  10 +-
 halo2_proofs/src/poly/ipa/strategy.rs         |   4 +-
 halo2_proofs/src/poly/kzg/commitment.rs       |  27 +--
 halo2_proofs/src/poly/kzg/msm.rs              |   2 +-
 halo2_proofs/src/poly/kzg/multiopen/gwc.rs    |   8 +-
 .../src/poly/kzg/multiopen/gwc/prover.rs      |   5 +-
 .../src/poly/kzg/multiopen/gwc/verifier.rs    |   7 +-
 .../src/poly/kzg/multiopen/shplonk.rs         |  24 +--
 .../src/poly/kzg/multiopen/shplonk/prover.rs  |  11 +-
 .../poly/kzg/multiopen/shplonk/verifier.rs    |  14 +-
 halo2_proofs/src/poly/kzg/strategy.rs         |   5 +-
 halo2_proofs/src/poly/multiopen_test.rs       |  21 +--
 halo2_proofs/src/transcript.rs                |  38 ++++-
 halo2_proofs/tests/plonk_api.rs               |  67 ++++----
 84 files changed, 864 insertions(+), 803 deletions(-)

diff --git a/halo2_gadgets/Cargo.toml b/halo2_gadgets/Cargo.toml
index 6025ef7297..136ef63a16 100644
--- a/halo2_gadgets/Cargo.toml
+++ b/halo2_gadgets/Cargo.toml
@@ -24,11 +24,11 @@ rustdoc-args = ["--cfg", "docsrs", "--html-in-header", "katex-header.html"]
 [dependencies]
 arrayvec = "0.7.0"
 bitvec = "1"
-ff = "0.12"
-group = "0.12"
+ff = { version = "0.13", features = ["bits"] }
+group = "0.13"
 halo2_proofs = { version = "0.2", path = "../halo2_proofs" }
 lazy_static = "1"
-halo2curves = { git = 'https://github.com/privacy-scaling-explorations/halo2curves', tag = '0.3.0' }
+halo2curves = { git = 'https://github.com/privacy-scaling-explorations/halo2curves', tag = "0.3.2" }
 proptest = { version = "1.0.0", optional = true }
 rand = "0.8"
 subtle = "2.3"
diff --git a/halo2_gadgets/benches/poseidon.rs b/halo2_gadgets/benches/poseidon.rs
index e8cfa08714..4494e77a0f 100644
--- a/halo2_gadgets/benches/poseidon.rs
+++ b/halo2_gadgets/benches/poseidon.rs
@@ -21,7 +21,7 @@ use halo2_proofs::{
 use halo2curves::pasta::{pallas, vesta, EqAffine, Fp};
 
 use halo2_gadgets::poseidon::{
-    primitives::{self as poseidon, ConstantLength, Spec},
+    primitives::{self as poseidon, generate_constants, ConstantLength, Mds, Spec},
     Hash, Pow5Chip, Pow5Config,
 };
 use std::convert::TryInto;
@@ -139,6 +139,10 @@ impl<const WIDTH: usize, const RATE: usize> Spec<Fp, WIDTH, RATE> for MySpec<WID
     fn secure_mds() -> usize {
         0
     }
+
+    fn constants() -> (Vec<[Fp; WIDTH]>, Mds<Fp, WIDTH>, Mds<Fp, WIDTH>) {
+        generate_constants::<_, Self, WIDTH, RATE>()
+    }
 }
 
 const K: u32 = 7;
diff --git a/halo2_gadgets/src/ecc/chip/add.rs b/halo2_gadgets/src/ecc/chip/add.rs
index 9f24d0d7dd..11661d51e2 100644
--- a/halo2_gadgets/src/ecc/chip/add.rs
+++ b/halo2_gadgets/src/ecc/chip/add.rs
@@ -1,10 +1,11 @@
 use super::EccPoint;
+use ff::PrimeField;
 use halo2_proofs::{
     circuit::Region,
     plonk::{Advice, Assigned, Column, ConstraintSystem, Constraints, Error, Expression, Selector},
     poly::Rotation,
 };
-use halo2curves::{pasta::pallas, FieldExt};
+use halo2curves::pasta::pallas;
 use std::collections::HashSet;
 
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
diff --git a/halo2_gadgets/src/ecc/chip/constants.rs b/halo2_gadgets/src/ecc/chip/constants.rs
index cecbbae99a..6296165464 100644
--- a/halo2_gadgets/src/ecc/chip/constants.rs
+++ b/halo2_gadgets/src/ecc/chip/constants.rs
@@ -6,7 +6,7 @@ use group::{
     Curve,
 };
 use halo2_proofs::arithmetic::lagrange_interpolate;
-use halo2curves::{pasta::pallas, CurveAffine, FieldExt};
+use halo2curves::{pasta::pallas, CurveAffine};
 
 /// Window size for fixed-base scalar multiplication
 pub const FIXED_BASE_WINDOW_SIZE: usize = 3;
@@ -61,7 +61,7 @@ fn compute_window_table<C: CurveAffine>(base: C, num_windows: usize) -> Vec<[C;
     // Generate window table entries for the last window, w = `num_windows - 1`.
     // For the last window, we compute [k * (2^3)^w - sum]B, where sum is defined
     // as sum = \sum_{j = 0}^{`num_windows - 2`} 2^{3j+1}
-    let sum = (0..(num_windows - 1)).fold(C::Scalar::zero(), |acc, j| {
+    let sum = (0..(num_windows - 1)).fold(C::Scalar::ZERO, |acc, j| {
         acc + C::Scalar::from(2).pow(&[FIXED_BASE_WINDOW_SIZE as u64 * j as u64 + 1, 0, 0, 0])
     });
     window_table.push(
@@ -181,7 +181,7 @@ pub fn test_lagrange_coeffs<C: CurveAffine>(base: C, num_windows: usize) {
             .rev()
             .cloned()
             .reduce(|acc, coeff| acc * x + coeff)
-            .unwrap_or_else(C::Base::zero)
+            .unwrap_or(C::Base::ZERO)
     }
 
     let lagrange_coeffs = compute_lagrange_coeffs(base, num_windows);
@@ -213,7 +213,7 @@ pub fn test_lagrange_coeffs<C: CurveAffine>(base: C, num_windows: usize) {
 
         // Compute the actual x-coordinate of the multiple [k * (8^84) - offset]B,
         // where offset = \sum_{j = 0}^{83} 2^{3j+1}
-        let offset = (0..(num_windows - 1)).fold(C::Scalar::zero(), |acc, w| {
+        let offset = (0..(num_windows - 1)).fold(C::Scalar::ZERO, |acc, w| {
             acc + C::Scalar::from(2).pow(&[FIXED_BASE_WINDOW_SIZE as u64 * w as u64 + 1, 0, 0, 0])
         });
         let scalar = C::Scalar::from(bits as u64)
@@ -229,8 +229,9 @@ pub fn test_lagrange_coeffs<C: CurveAffine>(base: C, num_windows: usize) {
 
 #[cfg(test)]
 mod tests {
+    use ff::FromUniformBytes;
     use group::{ff::Field, Curve, Group};
-    use halo2curves::{pasta::pallas, CurveAffine, FieldExt};
+    use halo2curves::{pasta::pallas, CurveAffine};
     use proptest::prelude::*;
 
     use super::{compute_window_table, find_zs_and_us, test_lagrange_coeffs, H, NUM_WINDOWS};
@@ -241,7 +242,7 @@ mod tests {
             // Instead of rejecting out-of-range bytes, let's reduce them.
             let mut buf = [0; 64];
             buf[..32].copy_from_slice(&bytes);
-            let scalar = pallas::Scalar::from_bytes_wide(&buf);
+            let scalar = pallas::Scalar::from_uniform_bytes(&buf);
             pallas::Point::generator() * scalar
         }
     }
diff --git a/halo2_gadgets/src/ecc/chip/mul.rs b/halo2_gadgets/src/ecc/chip/mul.rs
index 26c705a17c..7896bf58bd 100644
--- a/halo2_gadgets/src/ecc/chip/mul.rs
+++ b/halo2_gadgets/src/ecc/chip/mul.rs
@@ -8,16 +8,15 @@ use std::{
     ops::{Deref, Range},
 };
 
-use ff::PrimeField;
 use halo2_proofs::{
-    arithmetic::FieldExt,
+    arithmetic::Field,
     circuit::{AssignedCell, Layouter, Region, Value},
     plonk::{Advice, Assigned, Column, ConstraintSystem, Constraints, Error, Selector},
     poly::Rotation,
 };
-use uint::construct_uint;
-
+use halo2curves::group::ff::PrimeField;
 use halo2curves::pasta::pallas;
+use uint::construct_uint;
 
 mod complete;
 pub(super) mod incomplete;
@@ -389,8 +388,8 @@ impl Config {
 
 #[derive(Clone, Debug)]
 // `x`-coordinate of the accumulator.
-struct X<F: FieldExt>(AssignedCell<Assigned<F>, F>);
-impl<F: FieldExt> Deref for X<F> {
+struct X<F: Field>(AssignedCell<Assigned<F>, F>);
+impl<F: Field> Deref for X<F> {
     type Target = AssignedCell<Assigned<F>, F>;
 
     fn deref(&self) -> &Self::Target {
@@ -400,8 +399,8 @@ impl<F: FieldExt> Deref for X<F> {
 
 #[derive(Clone, Debug)]
 // `y`-coordinate of the accumulator.
-struct Y<F: FieldExt>(AssignedCell<Assigned<F>, F>);
-impl<F: FieldExt> Deref for Y<F> {
+struct Y<F: Field>(AssignedCell<Assigned<F>, F>);
+impl<F: Field> Deref for Y<F> {
     type Target = AssignedCell<Assigned<F>, F>;
 
     fn deref(&self) -> &Self::Target {
@@ -411,8 +410,8 @@ impl<F: FieldExt> Deref for Y<F> {
 
 #[derive(Clone, Debug)]
 // Cumulative sum `z` used to decompose the scalar.
-struct Z<F: FieldExt>(AssignedCell<F, F>);
-impl<F: FieldExt> Deref for Z<F> {
+struct Z<F: Field>(AssignedCell<F, F>);
+impl<F: Field> Deref for Z<F> {
     type Target = AssignedCell<F, F>;
 
     fn deref(&self) -> &Self::Target {
diff --git a/halo2_gadgets/src/ecc/chip/mul/incomplete.rs b/halo2_gadgets/src/ecc/chip/mul/incomplete.rs
index bfe51c7e2e..9b1d7494e6 100644
--- a/halo2_gadgets/src/ecc/chip/mul/incomplete.rs
+++ b/halo2_gadgets/src/ecc/chip/mul/incomplete.rs
@@ -1,6 +1,7 @@
 use super::super::NonIdentityEccPoint;
 use super::{X, Y, Z};
 use crate::utilities::bool_check;
+use ff::PrimeField;
 use halo2_proofs::{
     circuit::{Region, Value},
     plonk::{
@@ -8,7 +9,7 @@ use halo2_proofs::{
     },
     poly::Rotation,
 };
-use halo2curves::{pasta::pallas, FieldExt};
+use halo2curves::pasta::pallas;
 
 /// A helper struct for implementing single-row double-and-add using incomplete addition.
 #[derive(Copy, Clone, Debug, Eq, PartialEq)]
diff --git a/halo2_gadgets/src/ecc/chip/mul/overflow.rs b/halo2_gadgets/src/ecc/chip/mul/overflow.rs
index 0d7bd69692..3625ff73db 100644
--- a/halo2_gadgets/src/ecc/chip/mul/overflow.rs
+++ b/halo2_gadgets/src/ecc/chip/mul/overflow.rs
@@ -9,8 +9,8 @@ use halo2_proofs::{
     plonk::{Advice, Assigned, Column, ConstraintSystem, Constraints, Error, Expression, Selector},
     poly::Rotation,
 };
-
-use halo2curves::{pasta::pallas, FieldExt};
+use halo2curves::group::ff::PrimeField;
+use halo2curves::pasta::pallas;
 
 use std::iter;
 
diff --git a/halo2_gadgets/src/ecc/chip/mul_fixed.rs b/halo2_gadgets/src/ecc/chip/mul_fixed.rs
index 909dd171d3..0005a108bb 100644
--- a/halo2_gadgets/src/ecc/chip/mul_fixed.rs
+++ b/halo2_gadgets/src/ecc/chip/mul_fixed.rs
@@ -7,7 +7,7 @@ use crate::utilities::decompose_running_sum::RunningSumConfig;
 use std::marker::PhantomData;
 
 use group::{
-    ff::{PrimeField, PrimeFieldBits},
+    ff::{Field, PrimeField, PrimeFieldBits},
     Curve,
 };
 use halo2_proofs::{
@@ -18,7 +18,7 @@ use halo2_proofs::{
     },
     poly::Rotation,
 };
-use halo2curves::{pasta::pallas, CurveAffine, FieldExt};
+use halo2curves::{pasta::pallas, CurveAffine};
 use lazy_static::lazy_static;
 
 pub mod base_field_elem;
diff --git a/halo2_gadgets/src/ecc/chip/mul_fixed/base_field_elem.rs b/halo2_gadgets/src/ecc/chip/mul_fixed/base_field_elem.rs
index 08fd34e313..91671847a2 100644
--- a/halo2_gadgets/src/ecc/chip/mul_fixed/base_field_elem.rs
+++ b/halo2_gadgets/src/ecc/chip/mul_fixed/base_field_elem.rs
@@ -13,7 +13,7 @@ use halo2_proofs::{
     plonk::{Advice, Column, ConstraintSystem, Constraints, Error, Expression, Selector},
     poly::Rotation,
 };
-use halo2curves::{pasta::pallas, FieldExt};
+use halo2curves::pasta::pallas;
 
 use std::convert::TryInto;
 
diff --git a/halo2_gadgets/src/ecc/chip/mul_fixed/full_width.rs b/halo2_gadgets/src/ecc/chip/mul_fixed/full_width.rs
index b82620c283..607c51e534 100644
--- a/halo2_gadgets/src/ecc/chip/mul_fixed/full_width.rs
+++ b/halo2_gadgets/src/ecc/chip/mul_fixed/full_width.rs
@@ -295,7 +295,7 @@ pub mod tests {
 
         // [-1]B is the largest scalar field element.
         {
-            let scalar_fixed = -pallas::Scalar::one();
+            let scalar_fixed = -pallas::Scalar::ONE;
             let neg_1 = ScalarFixed::new(
                 chip.clone(),
                 layouter.namespace(|| "-1"),
diff --git a/halo2_gadgets/src/ecc/chip/mul_fixed/short.rs b/halo2_gadgets/src/ecc/chip/mul_fixed/short.rs
index 844d88d134..4c92becb86 100644
--- a/halo2_gadgets/src/ecc/chip/mul_fixed/short.rs
+++ b/halo2_gadgets/src/ecc/chip/mul_fixed/short.rs
@@ -209,6 +209,7 @@ impl<Fixed: FixedPoints<pallas::Affine>> Config<Fixed> {
         // tested at the circuit-level.
         {
             use super::super::FixedPoint;
+            use ff::Field;
             use group::{ff::PrimeField, Curve};
 
             scalar
@@ -228,9 +229,9 @@ impl<Fixed: FixedPoints<pallas::Affine>> Config<Fixed> {
                             let magnitude = pallas::Scalar::from_repr(magnitude.to_repr()).unwrap();
 
                             let sign = if sign == &&pallas::Base::one() {
-                                pallas::Scalar::one()
+                                pallas::Scalar::ONE
                             } else {
-                                -pallas::Scalar::one()
+                                -pallas::Scalar::ONE
                             };
 
                             magnitude * sign
@@ -248,13 +249,16 @@ impl<Fixed: FixedPoints<pallas::Affine>> Config<Fixed> {
 
 #[cfg(test)]
 pub mod tests {
-    use group::{ff::PrimeField, Curve};
+    use group::{
+        ff::{Field, PrimeField},
+        Curve,
+    };
     use halo2_proofs::{
         arithmetic::CurveAffine,
         circuit::{AssignedCell, Chip, Layouter, Value},
         plonk::{Any, Error},
     };
-    use halo2curves::{pasta::pallas, FieldExt};
+    use halo2curves::pasta::pallas;
 
     use crate::{
         ecc::{
@@ -359,9 +363,9 @@ pub mod tests {
             let scalar = {
                 let magnitude = pallas::Scalar::from_repr(magnitude.to_repr()).unwrap();
                 let sign = if *sign == pallas::Base::one() {
-                    pallas::Scalar::one()
+                    pallas::Scalar::ONE
                 } else {
-                    -pallas::Scalar::one()
+                    -pallas::Scalar::ONE
                 };
                 magnitude * sign
             };
diff --git a/halo2_gadgets/src/poseidon.rs b/halo2_gadgets/src/poseidon.rs
index 1350075146..ffd745ad6d 100644
--- a/halo2_gadgets/src/poseidon.rs
+++ b/halo2_gadgets/src/poseidon.rs
@@ -4,9 +4,9 @@ use std::convert::TryInto;
 use std::fmt;
 use std::marker::PhantomData;
 
+use ff::PrimeField;
 use group::ff::Field;
 use halo2_proofs::{
-    arithmetic::FieldExt,
     circuit::{AssignedCell, Chip, Layouter},
     plonk::Error,
 };
@@ -27,7 +27,7 @@ pub enum PaddedWord<F: Field> {
 }
 
 /// The set of circuit instructions required to use the Poseidon permutation.
-pub trait PoseidonInstructions<F: FieldExt, S: Spec<F, T, RATE>, const T: usize, const RATE: usize>:
+pub trait PoseidonInstructions<F: Field, S: Spec<F, T, RATE>, const T: usize, const RATE: usize>:
     Chip<F>
 {
     /// Variable representing the word over which the Poseidon permutation operates.
@@ -45,7 +45,7 @@ pub trait PoseidonInstructions<F: FieldExt, S: Spec<F, T, RATE>, const T: usize,
 ///
 /// [`Hash`]: self::Hash
 pub trait PoseidonSpongeInstructions<
-    F: FieldExt,
+    F: Field,
     S: Spec<F, T, RATE>,
     D: Domain<F, RATE>,
     const T: usize,
@@ -71,7 +71,7 @@ pub trait PoseidonSpongeInstructions<
 /// A word over which the Poseidon permutation operates.
 #[derive(Debug)]
 pub struct Word<
-    F: FieldExt,
+    F: Field,
     PoseidonChip: PoseidonInstructions<F, S, T, RATE>,
     S: Spec<F, T, RATE>,
     const T: usize,
@@ -81,7 +81,7 @@ pub struct Word<
 }
 
 impl<
-        F: FieldExt,
+        F: Field,
         PoseidonChip: PoseidonInstructions<F, S, T, RATE>,
         S: Spec<F, T, RATE>,
         const T: usize,
@@ -100,7 +100,7 @@ impl<
 }
 
 fn poseidon_sponge<
-    F: FieldExt,
+    F: Field,
     PoseidonChip: PoseidonSpongeInstructions<F, S, D, T, RATE>,
     S: Spec<F, T, RATE>,
     D: Domain<F, RATE>,
@@ -122,7 +122,7 @@ fn poseidon_sponge<
 /// A Poseidon sponge.
 #[derive(Debug)]
 pub struct Sponge<
-    F: FieldExt,
+    F: Field,
     PoseidonChip: PoseidonSpongeInstructions<F, S, D, T, RATE>,
     S: Spec<F, T, RATE>,
     M: SpongeMode,
@@ -137,7 +137,7 @@ pub struct Sponge<
 }
 
 impl<
-        F: FieldExt,
+        F: Field,
         PoseidonChip: PoseidonSpongeInstructions<F, S, D, T, RATE>,
         S: Spec<F, T, RATE>,
         D: Domain<F, RATE>,
@@ -210,7 +210,7 @@ impl<
 }
 
 impl<
-        F: FieldExt,
+        F: Field,
         PoseidonChip: PoseidonSpongeInstructions<F, S, D, T, RATE>,
         S: Spec<F, T, RATE>,
         D: Domain<F, RATE>,
@@ -241,7 +241,7 @@ impl<
 /// A Poseidon hash function, built around a sponge.
 #[derive(Debug)]
 pub struct Hash<
-    F: FieldExt,
+    F: Field,
     PoseidonChip: PoseidonSpongeInstructions<F, S, D, T, RATE>,
     S: Spec<F, T, RATE>,
     D: Domain<F, RATE>,
@@ -252,7 +252,7 @@ pub struct Hash<
 }
 
 impl<
-        F: FieldExt,
+        F: Field,
         PoseidonChip: PoseidonSpongeInstructions<F, S, D, T, RATE>,
         S: Spec<F, T, RATE>,
         D: Domain<F, RATE>,
@@ -267,7 +267,7 @@ impl<
 }
 
 impl<
-        F: FieldExt,
+        F: PrimeField,
         PoseidonChip: PoseidonSpongeInstructions<F, S, ConstantLength<L>, T, RATE>,
         S: Spec<F, T, RATE>,
         const T: usize,
diff --git a/halo2_gadgets/src/poseidon/pow5.rs b/halo2_gadgets/src/poseidon/pow5.rs
index 7b9862e5b6..52b0d27312 100644
--- a/halo2_gadgets/src/poseidon/pow5.rs
+++ b/halo2_gadgets/src/poseidon/pow5.rs
@@ -2,7 +2,7 @@ use std::convert::TryInto;
 use std::iter;
 
 use halo2_proofs::{
-    arithmetic::FieldExt,
+    arithmetic::Field,
     circuit::{AssignedCell, Cell, Chip, Layouter, Region, Value},
     plonk::{
         Advice, Any, Column, ConstraintSystem, Constraints, Error, Expression, Fixed, Selector,
@@ -18,7 +18,7 @@ use crate::utilities::Var;
 
 /// Configuration for a [`Pow5Chip`].
 #[derive(Clone, Debug)]
-pub struct Pow5Config<F: FieldExt, const WIDTH: usize, const RATE: usize> {
+pub struct Pow5Config<F: Field, const WIDTH: usize, const RATE: usize> {
     pub(crate) state: [Column<Advice>; WIDTH],
     partial_sbox: Column<Advice>,
     rc_a: [Column<Fixed>; WIDTH],
@@ -40,11 +40,11 @@ pub struct Pow5Config<F: FieldExt, const WIDTH: usize, const RATE: usize> {
 /// The chip is implemented using a single round per row for full rounds, and two rounds
 /// per row for partial rounds.
 #[derive(Debug)]
-pub struct Pow5Chip<F: FieldExt, const WIDTH: usize, const RATE: usize> {
+pub struct Pow5Chip<F: Field, const WIDTH: usize, const RATE: usize> {
     config: Pow5Config<F, WIDTH, RATE>,
 }
 
-impl<F: FieldExt, const WIDTH: usize, const RATE: usize> Pow5Chip<F, WIDTH, RATE> {
+impl<F: Field, const WIDTH: usize, const RATE: usize> Pow5Chip<F, WIDTH, RATE> {
     /// Configures this chip for use in a circuit.
     ///
     /// # Side-effects
@@ -209,7 +209,7 @@ impl<F: FieldExt, const WIDTH: usize, const RATE: usize> Pow5Chip<F, WIDTH, RATE
     }
 }
 
-impl<F: FieldExt, const WIDTH: usize, const RATE: usize> Chip<F> for Pow5Chip<F, WIDTH, RATE> {
+impl<F: Field, const WIDTH: usize, const RATE: usize> Chip<F> for Pow5Chip<F, WIDTH, RATE> {
     type Config = Pow5Config<F, WIDTH, RATE>;
     type Loaded = ();
 
@@ -222,7 +222,7 @@ impl<F: FieldExt, const WIDTH: usize, const RATE: usize> Chip<F> for Pow5Chip<F,
     }
 }
 
-impl<F: FieldExt, S: Spec<F, WIDTH, RATE>, const WIDTH: usize, const RATE: usize>
+impl<F: Field, S: Spec<F, WIDTH, RATE>, const WIDTH: usize, const RATE: usize>
     PoseidonInstructions<F, S, WIDTH, RATE> for Pow5Chip<F, WIDTH, RATE>
 {
     type Word = StateWord<F>;
@@ -273,7 +273,7 @@ impl<F: FieldExt, S: Spec<F, WIDTH, RATE>, const WIDTH: usize, const RATE: usize
 }
 
 impl<
-        F: FieldExt,
+        F: Field,
         S: Spec<F, WIDTH, RATE>,
         D: Domain<F, RATE>,
         const WIDTH: usize,
@@ -302,7 +302,7 @@ impl<
                 };
 
                 for i in 0..RATE {
-                    load_state_word(i, F::zero())?;
+                    load_state_word(i, F::ZERO)?;
                 }
                 load_state_word(RATE, D::initial_capacity_element())?;
 
@@ -372,7 +372,7 @@ impl<
                             .get(i)
                             .map(|word| word.0.value().cloned())
                             // The capacity element is never altered by the input.
-                            .unwrap_or_else(|| Value::known(F::zero()));
+                            .unwrap_or_else(|| Value::known(F::ZERO));
                     region
                         .assign_advice(
                             || format!("load output_{}", i),
@@ -403,21 +403,21 @@ impl<
 
 /// A word in the Poseidon state.
 #[derive(Clone, Debug)]
-pub struct StateWord<F: FieldExt>(AssignedCell<F, F>);
+pub struct StateWord<F: Field>(AssignedCell<F, F>);
 
-impl<F: FieldExt> From<StateWord<F>> for AssignedCell<F, F> {
+impl<F: Field> From<StateWord<F>> for AssignedCell<F, F> {
     fn from(state_word: StateWord<F>) -> AssignedCell<F, F> {
         state_word.0
     }
 }
 
-impl<F: FieldExt> From<AssignedCell<F, F>> for StateWord<F> {
+impl<F: Field> From<AssignedCell<F, F>> for StateWord<F> {
     fn from(cell_value: AssignedCell<F, F>) -> StateWord<F> {
         StateWord(cell_value)
     }
 }
 
-impl<F: FieldExt> Var<F> for StateWord<F> {
+impl<F: Field> Var<F> for StateWord<F> {
     fn cell(&self) -> Cell {
         self.0.cell()
     }
@@ -428,9 +428,9 @@ impl<F: FieldExt> Var<F> for StateWord<F> {
 }
 
 #[derive(Debug)]
-struct Pow5State<F: FieldExt, const WIDTH: usize>([StateWord<F>; WIDTH]);
+struct Pow5State<F: Field, const WIDTH: usize>([StateWord<F>; WIDTH]);
 
-impl<F: FieldExt, const WIDTH: usize> Pow5State<F, WIDTH> {
+impl<F: Field, const WIDTH: usize> Pow5State<F, WIDTH> {
     fn full_round<const RATE: usize>(
         self,
         region: &mut Region<F>,
@@ -450,7 +450,7 @@ impl<F: FieldExt, const WIDTH: usize> Pow5State<F, WIDTH> {
                 r.as_ref().map(|r| {
                     r.iter()
                         .enumerate()
-                        .fold(F::zero(), |acc, (j, r_j)| acc + m_i[j] * r_j)
+                        .fold(F::ZERO, |acc, (j, r_j)| acc + m_i[j] * r_j)
                 })
             });
 
@@ -491,7 +491,7 @@ impl<F: FieldExt, const WIDTH: usize> Pow5State<F, WIDTH> {
                     r.as_ref().map(|r| {
                         m_i.iter()
                             .zip(r.iter())
-                            .fold(F::zero(), |acc, (m_ij, r_j)| acc + *m_ij * r_j)
+                            .fold(F::ZERO, |acc, (m_ij, r_j)| acc + *m_ij * r_j)
                     })
                 })
                 .collect();
@@ -524,7 +524,7 @@ impl<F: FieldExt, const WIDTH: usize> Pow5State<F, WIDTH> {
                     r_mid.as_ref().map(|r| {
                         m_i.iter()
                             .zip(r.iter())
-                            .fold(F::zero(), |acc, (m_ij, r_j)| acc + *m_ij * r_j)
+                            .fold(F::ZERO, |acc, (m_ij, r_j)| acc + *m_ij * r_j)
                     })
                 })
                 .collect();
diff --git a/halo2_gadgets/src/poseidon/primitives.rs b/halo2_gadgets/src/poseidon/primitives.rs
index 4d7d5b038a..a8662a00e8 100644
--- a/halo2_gadgets/src/poseidon/primitives.rs
+++ b/halo2_gadgets/src/poseidon/primitives.rs
@@ -5,7 +5,9 @@ use std::fmt;
 use std::iter;
 use std::marker::PhantomData;
 
-use halo2_proofs::arithmetic::FieldExt;
+use ff::FromUniformBytes;
+use ff::PrimeField;
+use halo2_proofs::arithmetic::Field;
 
 pub(crate) mod fp;
 pub(crate) mod fq;
@@ -27,10 +29,10 @@ pub(crate) type State<F, const T: usize> = [F; T];
 pub(crate) type SpongeRate<F, const RATE: usize> = [Option<F>; RATE];
 
 /// The type used to hold the MDS matrix and its inverse.
-pub(crate) type Mds<F, const T: usize> = [[F; T]; T];
+pub type Mds<F, const T: usize> = [[F; T]; T];
 
 /// A specification for a Poseidon permutation.
-pub trait Spec<F: FieldExt, const T: usize, const RATE: usize>: fmt::Debug {
+pub trait Spec<F: Field, const T: usize, const RATE: usize>: fmt::Debug {
     /// The number of full rounds for this specification.
     ///
     /// This must be an even number.
@@ -50,33 +52,41 @@ pub trait Spec<F: FieldExt, const T: usize, const RATE: usize>: fmt::Debug {
     fn secure_mds() -> usize;
 
     /// Generates `(round_constants, mds, mds^-1)` corresponding to this specification.
-    fn constants() -> (Vec<[F; T]>, Mds<F, T>, Mds<F, T>) {
-        let r_f = Self::full_rounds();
-        let r_p = Self::partial_rounds();
-
-        let mut grain = grain::Grain::new(SboxType::Pow, T as u16, r_f as u16, r_p as u16);
-
-        let round_constants = (0..(r_f + r_p))
-            .map(|_| {
-                let mut rc_row = [F::zero(); T];
-                for (rc, value) in rc_row
-                    .iter_mut()
-                    .zip((0..T).map(|_| grain.next_field_element()))
-                {
-                    *rc = value;
-                }
-                rc_row
-            })
-            .collect();
+    fn constants() -> (Vec<[F; T]>, Mds<F, T>, Mds<F, T>);
+}
+
+/// Generates `(round_constants, mds, mds^-1)` corresponding to this specification.
+pub fn generate_constants<
+    F: FromUniformBytes<64> + Ord,
+    S: Spec<F, T, RATE>,
+    const T: usize,
+    const RATE: usize,
+>() -> (Vec<[F; T]>, Mds<F, T>, Mds<F, T>) {
+    let r_f = S::full_rounds();
+    let r_p = S::partial_rounds();
 
-        let (mds, mds_inv) = mds::generate_mds::<F, T>(&mut grain, Self::secure_mds());
+    let mut grain = grain::Grain::new(SboxType::Pow, T as u16, r_f as u16, r_p as u16);
 
-        (round_constants, mds, mds_inv)
-    }
+    let round_constants = (0..(r_f + r_p))
+        .map(|_| {
+            let mut rc_row = [F::ZERO; T];
+            for (rc, value) in rc_row
+                .iter_mut()
+                .zip((0..T).map(|_| grain.next_field_element()))
+            {
+                *rc = value;
+            }
+            rc_row
+        })
+        .collect();
+
+    let (mds, mds_inv) = mds::generate_mds::<F, T>(&mut grain, S::secure_mds());
+
+    (round_constants, mds, mds_inv)
 }
 
 /// Runs the Poseidon permutation on the given state.
-pub(crate) fn permute<F: FieldExt, S: Spec<F, T, RATE>, const T: usize, const RATE: usize>(
+pub(crate) fn permute<F: Field, S: Spec<F, T, RATE>, const T: usize, const RATE: usize>(
     state: &mut State<F, T>,
     mds: &Mds<F, T>,
     round_constants: &[[F; T]],
@@ -85,7 +95,7 @@ pub(crate) fn permute<F: FieldExt, S: Spec<F, T, RATE>, const T: usize, const RA
     let r_p = S::partial_rounds();
 
     let apply_mds = |state: &mut State<F, T>| {
-        let mut new_state = [F::zero(); T];
+        let mut new_state = [F::ZERO; T];
         // Matrix multiplication
         #[allow(clippy::needless_range_loop)]
         for i in 0..T {
@@ -123,7 +133,7 @@ pub(crate) fn permute<F: FieldExt, S: Spec<F, T, RATE>, const T: usize, const RA
         });
 }
 
-fn poseidon_sponge<F: FieldExt, S: Spec<F, T, RATE>, const T: usize, const RATE: usize>(
+fn poseidon_sponge<F: Field, S: Spec<F, T, RATE>, const T: usize, const RATE: usize>(
     state: &mut State<F, T>,
     input: Option<&Absorbing<F, RATE>>,
     mds_matrix: &Mds<F, T>,
@@ -180,7 +190,7 @@ impl<F: fmt::Debug, const RATE: usize> Absorbing<F, RATE> {
 
 /// A Poseidon sponge.
 pub(crate) struct Sponge<
-    F: FieldExt,
+    F: Field,
     S: Spec<F, T, RATE>,
     M: SpongeMode,
     const T: usize,
@@ -193,7 +203,7 @@ pub(crate) struct Sponge<
     _marker: PhantomData<S>,
 }
 
-impl<F: FieldExt, S: Spec<F, T, RATE>, const T: usize, const RATE: usize>
+impl<F: Field, S: Spec<F, T, RATE>, const T: usize, const RATE: usize>
     Sponge<F, S, Absorbing<F, RATE>, T, RATE>
 {
     /// Constructs a new sponge for the given Poseidon specification.
@@ -201,7 +211,7 @@ impl<F: FieldExt, S: Spec<F, T, RATE>, const T: usize, const RATE: usize>
         let (round_constants, mds_matrix, _) = S::constants();
 
         let mode = Absorbing([None; RATE]);
-        let mut state = [F::zero(); T];
+        let mut state = [F::ZERO; T];
         state[RATE] = initial_capacity_element;
 
         Sponge {
@@ -251,7 +261,7 @@ impl<F: FieldExt, S: Spec<F, T, RATE>, const T: usize, const RATE: usize>
     }
 }
 
-impl<F: FieldExt, S: Spec<F, T, RATE>, const T: usize, const RATE: usize>
+impl<F: Field, S: Spec<F, T, RATE>, const T: usize, const RATE: usize>
     Sponge<F, S, Squeezing<F, RATE>, T, RATE>
 {
     /// Squeezes an element from the sponge.
@@ -275,7 +285,7 @@ impl<F: FieldExt, S: Spec<F, T, RATE>, const T: usize, const RATE: usize>
 }
 
 /// A domain in which a Poseidon hash function is being used.
-pub trait Domain<F: FieldExt, const RATE: usize> {
+pub trait Domain<F: Field, const RATE: usize> {
     /// Iterator that outputs padding field elements.
     type Padding: IntoIterator<Item = F>;
 
@@ -295,7 +305,7 @@ pub trait Domain<F: FieldExt, const RATE: usize> {
 #[derive(Clone, Copy, Debug)]
 pub struct ConstantLength<const L: usize>;
 
-impl<F: FieldExt, const RATE: usize, const L: usize> Domain<F, RATE> for ConstantLength<L> {
+impl<F: PrimeField, const RATE: usize, const L: usize> Domain<F, RATE> for ConstantLength<L> {
     type Padding = iter::Take<iter::Repeat<F>>;
 
     fn name() -> String {
@@ -315,13 +325,13 @@ impl<F: FieldExt, const RATE: usize, const L: usize> Domain<F, RATE> for Constan
         // Poseidon authors encode the constant length into the capacity element, ensuring
         // that inputs of different lengths do not share the same permutation.
         let k = (L + RATE - 1) / RATE;
-        iter::repeat(F::zero()).take(k * RATE - L)
+        iter::repeat(F::ZERO).take(k * RATE - L)
     }
 }
 
 /// A Poseidon hash function, built around a sponge.
 pub struct Hash<
-    F: FieldExt,
+    F: Field,
     S: Spec<F, T, RATE>,
     D: Domain<F, RATE>,
     const T: usize,
@@ -331,7 +341,7 @@ pub struct Hash<
     _domain: PhantomData<D>,
 }
 
-impl<F: FieldExt, S: Spec<F, T, RATE>, D: Domain<F, RATE>, const T: usize, const RATE: usize>
+impl<F: Field, S: Spec<F, T, RATE>, D: Domain<F, RATE>, const T: usize, const RATE: usize>
     fmt::Debug for Hash<F, S, D, T, RATE>
 {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
@@ -345,7 +355,7 @@ impl<F: FieldExt, S: Spec<F, T, RATE>, D: Domain<F, RATE>, const T: usize, const
     }
 }
 
-impl<F: FieldExt, S: Spec<F, T, RATE>, D: Domain<F, RATE>, const T: usize, const RATE: usize>
+impl<F: Field, S: Spec<F, T, RATE>, D: Domain<F, RATE>, const T: usize, const RATE: usize>
     Hash<F, S, D, T, RATE>
 {
     /// Initializes a new hasher.
@@ -357,7 +367,7 @@ impl<F: FieldExt, S: Spec<F, T, RATE>, D: Domain<F, RATE>, const T: usize, const
     }
 }
 
-impl<F: FieldExt, S: Spec<F, T, RATE>, const T: usize, const RATE: usize, const L: usize>
+impl<F: PrimeField, S: Spec<F, T, RATE>, const T: usize, const RATE: usize, const L: usize>
     Hash<F, S, ConstantLength<L>, T, RATE>
 {
     /// Hashes the given input.
@@ -374,9 +384,9 @@ impl<F: FieldExt, S: Spec<F, T, RATE>, const T: usize, const RATE: usize, const
 
 #[cfg(test)]
 mod tests {
-    use halo2curves::{pasta::pallas, FieldExt};
-
     use super::{permute, ConstantLength, Hash, P128Pow5T3 as OrchardNullifier, Spec};
+    use ff::PrimeField;
+    use halo2curves::pasta::pallas;
 
     #[test]
     fn orchard_spec_equivalence() {
diff --git a/halo2_gadgets/src/poseidon/primitives/grain.rs b/halo2_gadgets/src/poseidon/primitives/grain.rs
index f3cf94f761..99711f97f3 100644
--- a/halo2_gadgets/src/poseidon/primitives/grain.rs
+++ b/halo2_gadgets/src/poseidon/primitives/grain.rs
@@ -3,7 +3,8 @@
 use std::marker::PhantomData;
 
 use bitvec::prelude::*;
-use halo2_proofs::arithmetic::FieldExt;
+use ff::{FromUniformBytes, PrimeField};
+use halo2_proofs::arithmetic::Field;
 
 const STATE: usize = 80;
 
@@ -43,13 +44,13 @@ impl SboxType {
     }
 }
 
-pub(super) struct Grain<F: FieldExt> {
+pub(super) struct Grain<F: Field> {
     state: BitArr!(for 80, in u8, Msb0),
     next_bit: usize,
     _field: PhantomData<F>,
 }
 
-impl<F: FieldExt> Grain<F> {
+impl<F: PrimeField> Grain<F> {
     pub(super) fn new(sbox: SboxType, t: u16, r_f: u16, r_p: u16) -> Self {
         // Initialize the LFSR state.
         let mut state = bitarr![u8, Msb0; 1; STATE];
@@ -135,7 +136,9 @@ impl<F: FieldExt> Grain<F> {
             }
         }
     }
+}
 
+impl<F: FromUniformBytes<64>> Grain<F> {
     /// Returns the next field element from this Grain instantiation, without using
     /// rejection sampling.
     pub(super) fn next_field_element_without_rejection(&mut self) -> F {
@@ -161,11 +164,11 @@ impl<F: FieldExt> Grain<F> {
             view[i / 8] |= if bit { 1 << (i % 8) } else { 0 };
         }
 
-        F::from_bytes_wide(&bytes)
+        F::from_uniform_bytes(&bytes)
     }
 }
 
-impl<F: FieldExt> Iterator for Grain<F> {
+impl<F: PrimeField> Iterator for Grain<F> {
     type Item = bool;
 
     fn next(&mut self) -> Option<Self::Item> {
diff --git a/halo2_gadgets/src/poseidon/primitives/mds.rs b/halo2_gadgets/src/poseidon/primitives/mds.rs
index fb809e3a79..892ee11f6b 100644
--- a/halo2_gadgets/src/poseidon/primitives/mds.rs
+++ b/halo2_gadgets/src/poseidon/primitives/mds.rs
@@ -1,8 +1,8 @@
-use halo2_proofs::arithmetic::FieldExt;
+use ff::FromUniformBytes;
 
 use super::{grain::Grain, Mds};
 
-pub(super) fn generate_mds<F: FieldExt, const T: usize>(
+pub(super) fn generate_mds<F: FromUniformBytes<64> + Ord, const T: usize>(
     grain: &mut Grain<F>,
     mut select: usize,
 ) -> (Mds<F, T>, Mds<F, T>) {
@@ -48,7 +48,7 @@ pub(super) fn generate_mds<F: FieldExt, const T: usize>(
         // However, the Poseidon paper and reference impl use the positive formulation,
         // and we want to rely on the reference impl for MDS security, so we use the same
         // formulation.
-        let mut mds = [[F::zero(); T]; T];
+        let mut mds = [[F::ZERO; T]; T];
         #[allow(clippy::needless_range_loop)]
         for i in 0..T {
             for j in 0..T {
@@ -74,10 +74,10 @@ pub(super) fn generate_mds<F: FieldExt, const T: usize>(
     // where A_i(x) and B_i(x) are the Lagrange polynomials for xs and ys respectively.
     //
     // We adapt this to the positive Cauchy formulation by negating ys.
-    let mut mds_inv = [[F::zero(); T]; T];
+    let mut mds_inv = [[F::ZERO; T]; T];
     let l = |xs: &[F], j, x: F| {
         let x_j = xs[j];
-        xs.iter().enumerate().fold(F::one(), |acc, (m, x_m)| {
+        xs.iter().enumerate().fold(F::ONE, |acc, (m, x_m)| {
             if m == j {
                 acc
             } else {
diff --git a/halo2_gadgets/src/poseidon/primitives/p128pow5t3.rs b/halo2_gadgets/src/poseidon/primitives/p128pow5t3.rs
index 379c399b4e..c8d54d9afd 100644
--- a/halo2_gadgets/src/poseidon/primitives/p128pow5t3.rs
+++ b/halo2_gadgets/src/poseidon/primitives/p128pow5t3.rs
@@ -66,29 +66,31 @@ impl Spec<Fq, 3, 2> for P128Pow5T3 {
 
 #[cfg(test)]
 mod tests {
-    use ff::PrimeField;
-    use std::marker::PhantomData;
-
-    use halo2curves::FieldExt;
-
     use super::{
         super::{fp, fq},
         Fp, Fq,
     };
-    use crate::poseidon::primitives::{permute, ConstantLength, Hash, Spec};
+    use crate::poseidon::primitives::{
+        generate_constants, permute, ConstantLength, Hash, Mds, Spec,
+    };
+    use ff::PrimeField;
+    use ff::{Field, FromUniformBytes};
+    use std::marker::PhantomData;
 
     /// The same Poseidon specification as poseidon::P128Pow5T3, but constructed
     /// such that its constants will be generated at runtime.
     #[derive(Debug)]
-    pub struct P128Pow5T3Gen<F: FieldExt, const SECURE_MDS: usize>(PhantomData<F>);
+    pub struct P128Pow5T3Gen<F: Field, const SECURE_MDS: usize>(PhantomData<F>);
 
-    impl<F: FieldExt, const SECURE_MDS: usize> P128Pow5T3Gen<F, SECURE_MDS> {
+    impl<F: Field, const SECURE_MDS: usize> P128Pow5T3Gen<F, SECURE_MDS> {
         pub fn new() -> Self {
             P128Pow5T3Gen(PhantomData::default())
         }
     }
 
-    impl<F: FieldExt, const SECURE_MDS: usize> Spec<F, 3, 2> for P128Pow5T3Gen<F, SECURE_MDS> {
+    impl<F: FromUniformBytes<64> + Ord, const SECURE_MDS: usize> Spec<F, 3, 2>
+        for P128Pow5T3Gen<F, SECURE_MDS>
+    {
         fn full_rounds() -> usize {
             8
         }
@@ -98,17 +100,21 @@ mod tests {
         }
 
         fn sbox(val: F) -> F {
-            val.pow_vartime(&[5])
+            val.pow_vartime([5])
         }
 
         fn secure_mds() -> usize {
             SECURE_MDS
         }
+
+        fn constants() -> (Vec<[F; 3]>, Mds<F, 3>, Mds<F, 3>) {
+            generate_constants::<_, Self, 3, 2>()
+        }
     }
 
     #[test]
     fn verify_constants() {
-        fn verify_constants_helper<F: FieldExt>(
+        fn verify_constants_helper<F: FromUniformBytes<64> + Ord>(
             expected_round_constants: [[F; 3]; 64],
             expected_mds: [[F; 3]; 3],
             expected_mds_inv: [[F; 3]; 3],
diff --git a/halo2_gadgets/src/sha256.rs b/halo2_gadgets/src/sha256.rs
index 19a658df3a..391020a3d3 100644
--- a/halo2_gadgets/src/sha256.rs
+++ b/halo2_gadgets/src/sha256.rs
@@ -7,7 +7,7 @@ use std::convert::TryInto;
 use std::fmt;
 
 use halo2_proofs::{
-    arithmetic::FieldExt,
+    arithmetic::Field,
     circuit::{Chip, Layouter},
     plonk::Error,
 };
@@ -22,7 +22,7 @@ pub const BLOCK_SIZE: usize = 16;
 const DIGEST_SIZE: usize = 8;
 
 /// The set of circuit instructions required to use the [`Sha256`] gadget.
-pub trait Sha256Instructions<F: FieldExt>: Chip<F> {
+pub trait Sha256Instructions<F: Field>: Chip<F> {
     /// Variable representing the SHA-256 internal state.
     type State: Clone + fmt::Debug;
     /// Variable representing a 32-bit word of the input block to the SHA-256 compression
@@ -63,14 +63,14 @@ pub struct Sha256Digest<BlockWord>([BlockWord; DIGEST_SIZE]);
 /// A gadget that constrains a SHA-256 invocation. It supports input at a granularity of
 /// 32 bits.
 #[derive(Debug)]
-pub struct Sha256<F: FieldExt, CS: Sha256Instructions<F>> {
+pub struct Sha256<F: Field, CS: Sha256Instructions<F>> {
     chip: CS,
     state: CS::State,
     cur_block: Vec<CS::BlockWord>,
     length: usize,
 }
 
-impl<F: FieldExt, Sha256Chip: Sha256Instructions<F>> Sha256<F, Sha256Chip> {
+impl<F: Field, Sha256Chip: Sha256Instructions<F>> Sha256<F, Sha256Chip> {
     /// Create a new hasher instance.
     pub fn new(chip: Sha256Chip, mut layouter: impl Layouter<F>) -> Result<Self, Error> {
         let state = chip.initialization_vector(&mut layouter)?;
diff --git a/halo2_gadgets/src/sha256/table16/compression/compression_gates.rs b/halo2_gadgets/src/sha256/table16/compression/compression_gates.rs
index e22a10210c..1cf6a605d7 100644
--- a/halo2_gadgets/src/sha256/table16/compression/compression_gates.rs
+++ b/halo2_gadgets/src/sha256/table16/compression/compression_gates.rs
@@ -1,15 +1,13 @@
 use super::super::{util::*, Gate};
-use halo2_proofs::{
-    arithmetic::FieldExt,
-    plonk::{Constraint, Constraints, Expression},
-};
+use ff::PrimeField;
+use halo2_proofs::plonk::{Constraint, Constraints, Expression};
 use std::marker::PhantomData;
 
-pub struct CompressionGate<F: FieldExt>(PhantomData<F>);
+pub struct CompressionGate<F: PrimeField>(PhantomData<F>);
 
-impl<F: FieldExt> CompressionGate<F> {
+impl<F: PrimeField> CompressionGate<F> {
     fn ones() -> Expression<F> {
-        Expression::Constant(F::one())
+        Expression::Constant(F::ONE)
     }
 
     // Decompose `A,B,C,D` words
@@ -59,16 +57,16 @@ impl<F: FieldExt> CompressionGate<F> {
             + c_mid * F::from(1 << 16)
             + c_hi * F::from(1 << 19)
             + d * F::from(1 << 22)
-            + word_lo * (-F::one())
-            + word_hi * F::from(1 << 16) * (-F::one());
+            + word_lo * (-F::ONE)
+            + word_hi * F::from(1 << 16) * (-F::ONE);
         let spread_check = spread_a
             + spread_b * F::from(1 << 4)
             + spread_c_lo * F::from(1 << 26)
             + spread_c_mid * F::from(1 << 32)
             + spread_c_hi * F::from(1 << 38)
             + spread_d * F::from(1 << 44)
-            + spread_word_lo * (-F::one())
-            + spread_word_hi * F::from(1 << 32) * (-F::one());
+            + spread_word_lo * (-F::ONE)
+            + spread_word_hi * F::from(1 << 32) * (-F::ONE);
 
         Constraints::with_selector(
             s_decompose_abcd,
@@ -130,16 +128,16 @@ impl<F: FieldExt> CompressionGate<F> {
             + b_hi * F::from(1 << 8)
             + c * F::from(1 << 11)
             + d * F::from(1 << 25)
-            + word_lo * (-F::one())
-            + word_hi * F::from(1 << 16) * (-F::one());
+            + word_lo * (-F::ONE)
+            + word_hi * F::from(1 << 16) * (-F::ONE);
         let spread_check = spread_a_lo
             + spread_a_hi * F::from(1 << 6)
             + spread_b_lo * F::from(1 << 12)
             + spread_b_hi * F::from(1 << 16)
             + spread_c * F::from(1 << 22)
             + spread_d * F::from(1 << 50)
-            + spread_word_lo * (-F::one())
-            + spread_word_hi * F::from(1 << 32) * (-F::one());
+            + spread_word_lo * (-F::ONE)
+            + spread_word_hi * F::from(1 << 32) * (-F::ONE);
 
         Constraints::with_selector(
             s_decompose_efgh,
@@ -189,7 +187,7 @@ impl<F: FieldExt> CompressionGate<F> {
             + spread_c_mid * F::from(1 << 52)
             + spread_c_hi * F::from(1 << 58);
         let xor = xor_0 + xor_1 + xor_2;
-        let check = spread_witness + (xor * -F::one());
+        let check = spread_witness + (xor * -F::ONE);
 
         Some(("s_upper_sigma_0", s_upper_sigma_0 * check))
     }
@@ -233,7 +231,7 @@ impl<F: FieldExt> CompressionGate<F> {
             + spread_b_hi * F::from(1 << 30)
             + spread_c * F::from(1 << 36);
         let xor = xor_0 + xor_1 + xor_2;
-        let check = spread_witness + (xor * -F::one());
+        let check = spread_witness + (xor * -F::ONE);
 
         Some(("s_upper_sigma_1", s_upper_sigma_1 * check))
     }
@@ -259,7 +257,7 @@ impl<F: FieldExt> CompressionGate<F> {
         let rhs_odd = spread_p0_odd + spread_p1_odd * F::from(1 << 32);
         let rhs = rhs_even + rhs_odd * F::from(2);
 
-        let check = lhs + rhs * -F::one();
+        let check = lhs + rhs * -F::ONE;
 
         Some(("s_ch", s_ch * check))
     }
@@ -286,9 +284,9 @@ impl<F: FieldExt> CompressionGate<F> {
         let neg_check = {
             let evens = Self::ones() * F::from(MASK_EVEN_32 as u64);
             // evens - spread_e_lo = spread_e_neg_lo
-            let lo_check = spread_e_neg_lo.clone() + spread_e_lo + (evens.clone() * (-F::one()));
+            let lo_check = spread_e_neg_lo.clone() + spread_e_lo + (evens.clone() * (-F::ONE));
             // evens - spread_e_hi = spread_e_neg_hi
-            let hi_check = spread_e_neg_hi.clone() + spread_e_hi + (evens * (-F::one()));
+            let hi_check = spread_e_neg_hi.clone() + spread_e_hi + (evens * (-F::ONE));
 
             std::iter::empty()
                 .chain(Some(("lo_check", lo_check)))
diff --git a/halo2_gadgets/src/sha256/table16/gates.rs b/halo2_gadgets/src/sha256/table16/gates.rs
index 4f268092db..d5f3840a57 100644
--- a/halo2_gadgets/src/sha256/table16/gates.rs
+++ b/halo2_gadgets/src/sha256/table16/gates.rs
@@ -1,10 +1,11 @@
-use halo2_proofs::{arithmetic::FieldExt, plonk::Expression};
+use ff::PrimeField;
+use halo2_proofs::{arithmetic::Field, plonk::Expression};
 
-pub struct Gate<F: FieldExt>(pub Expression<F>);
+pub struct Gate<F: Field>(pub Expression<F>);
 
-impl<F: FieldExt> Gate<F> {
+impl<F: PrimeField> Gate<F> {
     fn ones() -> Expression<F> {
-        Expression::Constant(F::one())
+        Expression::Constant(F::ONE)
     }
 
     // Helper gates
@@ -32,7 +33,7 @@ impl<F: FieldExt> Gate<F> {
             for i in 0..deg {
                 let i = i as u64;
                 if i != idx {
-                    expr = expr * (Self::ones() * (-F::one()) * F::from(i) + var.clone());
+                    expr = expr * (Self::ones() * (-F::ONE) * F::from(i) + var.clone());
                 }
             }
             expr * F::from(u64::from(eval))
@@ -46,13 +47,13 @@ impl<F: FieldExt> Gate<F> {
                 }
             }
             if denom < 0 {
-                -F::one() * F::from(factor / (-denom as u64))
+                -F::ONE * F::from(factor / (-denom as u64))
             } else {
                 F::from(factor / (denom as u64))
             }
         };
 
-        let mut expr = Self::ones() * F::zero();
+        let mut expr = Self::ones() * F::ZERO;
         for ((idx, _), eval) in points.iter().enumerate().zip(evals.iter()) {
             expr = expr + numerator(var.clone(), *eval, idx as u64) * denominator(idx as i32)
         }
@@ -63,7 +64,7 @@ impl<F: FieldExt> Gate<F> {
     pub fn range_check(value: Expression<F>, lower_range: u64, upper_range: u64) -> Expression<F> {
         let mut expr = Self::ones();
         for i in lower_range..(upper_range + 1) {
-            expr = expr * (Self::ones() * (-F::one()) * F::from(i) + value.clone())
+            expr = expr * (Self::ones() * (-F::ONE) * F::from(i) + value.clone())
         }
         expr
     }
diff --git a/halo2_gadgets/src/sha256/table16/message_schedule/schedule_gates.rs b/halo2_gadgets/src/sha256/table16/message_schedule/schedule_gates.rs
index fab51bd373..cf6a917261 100644
--- a/halo2_gadgets/src/sha256/table16/message_schedule/schedule_gates.rs
+++ b/halo2_gadgets/src/sha256/table16/message_schedule/schedule_gates.rs
@@ -1,10 +1,11 @@
 use super::super::Gate;
-use halo2_proofs::{arithmetic::FieldExt, plonk::Expression};
+use ff::PrimeField;
+use halo2_proofs::plonk::Expression;
 use std::marker::PhantomData;
 
-pub struct ScheduleGate<F: FieldExt>(PhantomData<F>);
+pub struct ScheduleGate<F: PrimeField>(PhantomData<F>);
 
-impl<F: FieldExt> ScheduleGate<F> {
+impl<F: PrimeField> ScheduleGate<F> {
     /// s_word for W_16 to W_63
     #[allow(clippy::too_many_arguments)]
     pub fn s_word(
@@ -25,8 +26,8 @@ impl<F: FieldExt> ScheduleGate<F> {
 
         let word_check = lo
             + hi * F::from(1 << 16)
-            + (carry.clone() * F::from(1 << 32) * (-F::one()))
-            + (word * (-F::one()));
+            + (carry.clone() * F::from(1 << 32) * (-F::ONE))
+            + (word * (-F::ONE));
         let carry_check = Gate::range_check(carry, 0, 3);
 
         [("word_check", word_check), ("carry_check", carry_check)]
@@ -58,11 +59,8 @@ impl<F: FieldExt> ScheduleGate<F> {
         tag_d: Expression<F>,
         word: Expression<F>,
     ) -> impl Iterator<Item = (&'static str, Expression<F>)> {
-        let decompose_check = a
-            + b * F::from(1 << 3)
-            + c * F::from(1 << 7)
-            + d * F::from(1 << 18)
-            + word * (-F::one());
+        let decompose_check =
+            a + b * F::from(1 << 3) + c * F::from(1 << 7) + d * F::from(1 << 18) + word * (-F::ONE);
         let range_check_tag_c = Gate::range_check(tag_c, 0, 2);
         let range_check_tag_d = Gate::range_check(tag_d, 0, 4);
 
@@ -99,7 +97,7 @@ impl<F: FieldExt> ScheduleGate<F> {
             + e * F::from(1 << 17)
             + f * F::from(1 << 18)
             + g * F::from(1 << 19)
-            + word * (-F::one());
+            + word * (-F::ONE);
         let range_check_tag_d = Gate::range_check(tag_d, 0, 0);
         let range_check_tag_g = Gate::range_check(tag_g, 0, 3);
 
@@ -129,7 +127,7 @@ impl<F: FieldExt> ScheduleGate<F> {
             + b * F::from(1 << 10)
             + c * F::from(1 << 17)
             + d * F::from(1 << 19)
-            + word * (-F::one());
+            + word * (-F::ONE);
         let range_check_tag_a = Gate::range_check(tag_a, 0, 1);
         let range_check_tag_d = Gate::range_check(tag_d, 0, 3);
 
diff --git a/halo2_gadgets/src/sha256/table16/spread_table.rs b/halo2_gadgets/src/sha256/table16/spread_table.rs
index 3e1488e9ac..031f088084 100644
--- a/halo2_gadgets/src/sha256/table16/spread_table.rs
+++ b/halo2_gadgets/src/sha256/table16/spread_table.rs
@@ -1,6 +1,7 @@
 use super::{util::*, AssignedBits};
+use ff::PrimeField;
 use halo2_proofs::{
-    arithmetic::FieldExt,
+    arithmetic::Field,
     circuit::{Chip, Layouter, Region, Value},
     plonk::{Advice, Column, ConstraintSystem, Error, TableColumn},
     poly::Rotation,
@@ -153,12 +154,12 @@ pub(super) struct SpreadTableConfig {
 }
 
 #[derive(Clone, Debug)]
-pub(super) struct SpreadTableChip<F: FieldExt> {
+pub(super) struct SpreadTableChip<F: Field> {
     config: SpreadTableConfig,
     _marker: PhantomData<F>,
 }
 
-impl<F: FieldExt> Chip<F> for SpreadTableChip<F> {
+impl<F: Field> Chip<F> for SpreadTableChip<F> {
     type Config = SpreadTableConfig;
     type Loaded = ();
 
@@ -171,7 +172,7 @@ impl<F: FieldExt> Chip<F> for SpreadTableChip<F> {
     }
 }
 
-impl<F: FieldExt> SpreadTableChip<F> {
+impl<F: PrimeField> SpreadTableChip<F> {
     pub fn configure(
         meta: &mut ConstraintSystem<F>,
         input_tag: Column<Advice>,
@@ -250,45 +251,42 @@ impl<F: FieldExt> SpreadTableChip<F> {
 }
 
 impl SpreadTableConfig {
-    fn generate<F: FieldExt>() -> impl Iterator<Item = (F, F, F)> {
-        (1..=(1 << 16)).scan(
-            (F::zero(), F::zero(), F::zero()),
-            |(tag, dense, spread), i| {
-                // We computed this table row in the previous iteration.
-                let res = (*tag, *dense, *spread);
-
-                // i holds the zero-indexed row number for the next table row.
-                match i {
-                    BITS_7 | BITS_10 | BITS_11 | BITS_13 | BITS_14 => *tag += F::one(),
-                    _ => (),
-                }
-                *dense += F::one();
-                if i & 1 == 0 {
-                    // On even-numbered rows we recompute the spread.
-                    *spread = F::zero();
-                    for b in 0..16 {
-                        if (i >> b) & 1 != 0 {
-                            *spread += F::from(1 << (2 * b));
-                        }
+    fn generate<F: PrimeField>() -> impl Iterator<Item = (F, F, F)> {
+        (1..=(1 << 16)).scan((F::ZERO, F::ZERO, F::ZERO), |(tag, dense, spread), i| {
+            // We computed this table row in the previous iteration.
+            let res = (*tag, *dense, *spread);
+
+            // i holds the zero-indexed row number for the next table row.
+            match i {
+                BITS_7 | BITS_10 | BITS_11 | BITS_13 | BITS_14 => *tag += F::ONE,
+                _ => (),
+            }
+            *dense += F::ONE;
+            if i & 1 == 0 {
+                // On even-numbered rows we recompute the spread.
+                *spread = F::ZERO;
+                for b in 0..16 {
+                    if (i >> b) & 1 != 0 {
+                        *spread += F::from(1 << (2 * b));
                     }
-                } else {
-                    // On odd-numbered rows we add one.
-                    *spread += F::one();
                 }
+            } else {
+                // On odd-numbered rows we add one.
+                *spread += F::ONE;
+            }
 
-                Some(res)
-            },
-        )
+            Some(res)
+        })
     }
 }
 
 #[cfg(test)]
 mod tests {
     use super::{get_tag, SpreadTableChip, SpreadTableConfig};
+    use ff::PrimeField;
     use rand::Rng;
 
     use halo2_proofs::{
-        arithmetic::FieldExt,
         circuit::{Layouter, SimpleFloorPlanner, Value},
         dev::MockProver,
         plonk::{Advice, Circuit, Column, ConstraintSystem, Error},
@@ -303,7 +301,7 @@ mod tests {
 
         struct MyCircuit {}
 
-        impl<F: FieldExt> Circuit<F> for MyCircuit {
+        impl<F: PrimeField> Circuit<F> for MyCircuit {
             type Config = SpreadTableConfig;
             type FloorPlanner = SimpleFloorPlanner;
 
@@ -354,20 +352,20 @@ mod tests {
                         };
 
                         // Test the first few small values.
-                        add_row(F::zero(), F::from(0b000), F::from(0b000000))?;
-                        add_row(F::zero(), F::from(0b001), F::from(0b000001))?;
-                        add_row(F::zero(), F::from(0b010), F::from(0b000100))?;
-                        add_row(F::zero(), F::from(0b011), F::from(0b000101))?;
-                        add_row(F::zero(), F::from(0b100), F::from(0b010000))?;
-                        add_row(F::zero(), F::from(0b101), F::from(0b010001))?;
+                        add_row(F::ZERO, F::from(0b000), F::from(0b000000))?;
+                        add_row(F::ZERO, F::from(0b001), F::from(0b000001))?;
+                        add_row(F::ZERO, F::from(0b010), F::from(0b000100))?;
+                        add_row(F::ZERO, F::from(0b011), F::from(0b000101))?;
+                        add_row(F::ZERO, F::from(0b100), F::from(0b010000))?;
+                        add_row(F::ZERO, F::from(0b101), F::from(0b010001))?;
 
                         // Test the tag boundaries:
                         // 7-bit
-                        add_row(F::zero(), F::from(0b1111111), F::from(0b01010101010101))?;
-                        add_row(F::one(), F::from(0b10000000), F::from(0b0100000000000000))?;
+                        add_row(F::ZERO, F::from(0b1111111), F::from(0b01010101010101))?;
+                        add_row(F::ONE, F::from(0b10000000), F::from(0b0100000000000000))?;
                         // - 10-bit
                         add_row(
-                            F::one(),
+                            F::ONE,
                             F::from(0b1111111111),
                             F::from(0b01010101010101010101),
                         )?;
diff --git a/halo2_gadgets/src/sinsemilla.rs b/halo2_gadgets/src/sinsemilla.rs
index 3cec450ea1..2670529229 100644
--- a/halo2_gadgets/src/sinsemilla.rs
+++ b/halo2_gadgets/src/sinsemilla.rs
@@ -203,9 +203,9 @@ where
         let to_base_field = |bits: &[Value<bool>]| -> Value<C::Base> {
             let bits: Value<Vec<bool>> = bits.iter().cloned().collect();
             bits.map(|bits| {
-                bits.into_iter().rev().fold(C::Base::zero(), |acc, bit| {
+                bits.into_iter().rev().fold(C::Base::ZERO, |acc, bit| {
                     if bit {
-                        acc.double() + C::Base::one()
+                        acc.double() + C::Base::ONE
                     } else {
                         acc.double()
                     }
@@ -243,7 +243,7 @@ where
         subpieces: impl IntoIterator<Item = RangeConstrained<C::Base, Value<C::Base>>>,
     ) -> Result<Self, Error> {
         let (field_elem, total_bits) = subpieces.into_iter().fold(
-            (Value::known(C::Base::zero()), 0),
+            (Value::known(C::Base::ZERO), 0),
             |(acc, bits), subpiece| {
                 assert!(bits < 64);
                 let subpiece_shifted = subpiece
diff --git a/halo2_gadgets/src/sinsemilla/chip/generator_table.rs b/halo2_gadgets/src/sinsemilla/chip/generator_table.rs
index a653c13b35..a50a687e88 100644
--- a/halo2_gadgets/src/sinsemilla/chip/generator_table.rs
+++ b/halo2_gadgets/src/sinsemilla/chip/generator_table.rs
@@ -6,7 +6,8 @@ use halo2_proofs::{
 
 use super::{CommitDomains, FixedPoints, HashDomains};
 use crate::sinsemilla::primitives::{self as sinsemilla, SINSEMILLA_S};
-use halo2curves::{pasta::pallas, FieldExt};
+use ff::PrimeField;
+use halo2curves::pasta::pallas;
 
 /// Table containing independent generators S[0..2^k]
 #[derive(Eq, PartialEq, Copy, Clone, Debug)]
diff --git a/halo2_gadgets/src/sinsemilla/chip/hash_to_point.rs b/halo2_gadgets/src/sinsemilla/chip/hash_to_point.rs
index 70eab6b86d..9c15dd111a 100644
--- a/halo2_gadgets/src/sinsemilla/chip/hash_to_point.rs
+++ b/halo2_gadgets/src/sinsemilla/chip/hash_to_point.rs
@@ -10,8 +10,8 @@ use halo2_proofs::{
     plonk::{Assigned, Error},
 };
 
-use group::ff::{PrimeField, PrimeFieldBits};
-use halo2curves::{pasta::pallas, CurveAffine, FieldExt};
+use group::ff::{Field, PrimeField, PrimeFieldBits};
+use halo2curves::{pasta::pallas, CurveAffine};
 
 use std::ops::Deref;
 
@@ -376,15 +376,15 @@ where
 }
 
 /// The x-coordinate of the accumulator in a Sinsemilla hash instance.
-struct X<F: FieldExt>(AssignedCell<Assigned<F>, F>);
+struct X<F: Field>(AssignedCell<Assigned<F>, F>);
 
-impl<F: FieldExt> From<AssignedCell<Assigned<F>, F>> for X<F> {
+impl<F: Field> From<AssignedCell<Assigned<F>, F>> for X<F> {
     fn from(cell_value: AssignedCell<Assigned<F>, F>) -> Self {
         X(cell_value)
     }
 }
 
-impl<F: FieldExt> Deref for X<F> {
+impl<F: Field> Deref for X<F> {
     type Target = AssignedCell<Assigned<F>, F>;
 
     fn deref(&self) -> &AssignedCell<Assigned<F>, F> {
@@ -397,15 +397,15 @@ impl<F: FieldExt> Deref for X<F> {
 /// This is never actually witnessed until the last round, since it
 /// can be derived from other variables. Thus it only exists as a field
 /// element, not a `CellValue`.
-struct Y<F: FieldExt>(Value<Assigned<F>>);
+struct Y<F: Field>(Value<Assigned<F>>);
 
-impl<F: FieldExt> From<Value<Assigned<F>>> for Y<F> {
+impl<F: Field> From<Value<Assigned<F>>> for Y<F> {
     fn from(value: Value<Assigned<F>>) -> Self {
         Y(value)
     }
 }
 
-impl<F: FieldExt> Deref for Y<F> {
+impl<F: Field> Deref for Y<F> {
     type Target = Value<Assigned<F>>;
 
     fn deref(&self) -> &Value<Assigned<F>> {
diff --git a/halo2_gadgets/src/sinsemilla/merkle/chip.rs b/halo2_gadgets/src/sinsemilla/merkle/chip.rs
index 97da766d0c..bb042a5aee 100644
--- a/halo2_gadgets/src/sinsemilla/merkle/chip.rs
+++ b/halo2_gadgets/src/sinsemilla/merkle/chip.rs
@@ -5,7 +5,7 @@ use halo2_proofs::{
     plonk::{Advice, Column, ConstraintSystem, Constraints, Error, Selector},
     poly::Rotation,
 };
-use halo2curves::{pasta::pallas, FieldExt};
+use halo2curves::pasta::pallas;
 
 use super::MerkleInstructions;
 
diff --git a/halo2_gadgets/src/sinsemilla/message.rs b/halo2_gadgets/src/sinsemilla/message.rs
index 6bb72e2f1e..62696834ab 100644
--- a/halo2_gadgets/src/sinsemilla/message.rs
+++ b/halo2_gadgets/src/sinsemilla/message.rs
@@ -1,17 +1,17 @@
 //! Gadget and chips for the Sinsemilla hash function.
 use ff::PrimeFieldBits;
 use halo2_proofs::{
-    arithmetic::FieldExt,
+    arithmetic::Field,
     circuit::{AssignedCell, Cell, Value},
 };
 use std::fmt::Debug;
 
 /// A [`Message`] composed of several [`MessagePiece`]s.
 #[derive(Clone, Debug)]
-pub struct Message<F: FieldExt, const K: usize, const MAX_WORDS: usize>(Vec<MessagePiece<F, K>>);
+pub struct Message<F: Field, const K: usize, const MAX_WORDS: usize>(Vec<MessagePiece<F, K>>);
 
-impl<F: FieldExt + PrimeFieldBits, const K: usize, const MAX_WORDS: usize>
-    From<Vec<MessagePiece<F, K>>> for Message<F, K, MAX_WORDS>
+impl<F: PrimeFieldBits, const K: usize, const MAX_WORDS: usize> From<Vec<MessagePiece<F, K>>>
+    for Message<F, K, MAX_WORDS>
 {
     fn from(pieces: Vec<MessagePiece<F, K>>) -> Self {
         // A message cannot contain more than `MAX_WORDS` words.
@@ -20,7 +20,7 @@ impl<F: FieldExt + PrimeFieldBits, const K: usize, const MAX_WORDS: usize>
     }
 }
 
-impl<F: FieldExt + PrimeFieldBits, const K: usize, const MAX_WORDS: usize> std::ops::Deref
+impl<F: PrimeFieldBits, const K: usize, const MAX_WORDS: usize> std::ops::Deref
     for Message<F, K, MAX_WORDS>
 {
     type Target = [MessagePiece<F, K>];
@@ -35,13 +35,13 @@ impl<F: FieldExt + PrimeFieldBits, const K: usize, const MAX_WORDS: usize> std::
 /// The piece must fit within a base field element, which means its length
 /// cannot exceed the base field's `NUM_BITS`.
 #[derive(Clone, Debug)]
-pub struct MessagePiece<F: FieldExt, const K: usize> {
+pub struct MessagePiece<F: Field, const K: usize> {
     cell_value: AssignedCell<F, F>,
     /// The number of K-bit words in this message piece.
     num_words: usize,
 }
 
-impl<F: FieldExt + PrimeFieldBits, const K: usize> MessagePiece<F, K> {
+impl<F: PrimeFieldBits, const K: usize> MessagePiece<F, K> {
     pub fn new(cell_value: AssignedCell<F, F>, num_words: usize) -> Self {
         assert!(num_words * K < F::NUM_BITS as usize);
         Self {
diff --git a/halo2_gadgets/src/utilities.rs b/halo2_gadgets/src/utilities.rs
index fa50f7e8e8..683a553b7e 100644
--- a/halo2_gadgets/src/utilities.rs
+++ b/halo2_gadgets/src/utilities.rs
@@ -1,11 +1,10 @@
 //! Utility gadgets.
 
-use ff::{Field, PrimeFieldBits};
+use ff::{Field, PrimeField, PrimeFieldBits};
 use halo2_proofs::{
     circuit::{AssignedCell, Cell, Layouter, Value},
     plonk::{Advice, Column, Error, Expression},
 };
-use halo2curves::FieldExt;
 use std::marker::PhantomData;
 use std::ops::Range;
 
@@ -32,7 +31,7 @@ impl<F: Field> FieldValue<F> for AssignedCell<F, F> {
 }
 
 /// Trait for a variable in the circuit.
-pub trait Var<F: FieldExt>: Clone + std::fmt::Debug + From<AssignedCell<F, F>> {
+pub trait Var<F: Field>: Clone + std::fmt::Debug + From<AssignedCell<F, F>> {
     /// The cell at which this variable was allocated.
     fn cell(&self) -> Cell;
 
@@ -40,7 +39,7 @@ pub trait Var<F: FieldExt>: Clone + std::fmt::Debug + From<AssignedCell<F, F>> {
     fn value(&self) -> Value<F>;
 }
 
-impl<F: FieldExt> Var<F> for AssignedCell<F, F> {
+impl<F: Field> Var<F> for AssignedCell<F, F> {
     fn cell(&self) -> Cell {
         self.cell()
     }
@@ -51,7 +50,7 @@ impl<F: FieldExt> Var<F> for AssignedCell<F, F> {
 }
 
 /// Trait for utilities used across circuits.
-pub trait UtilitiesInstructions<F: FieldExt> {
+pub trait UtilitiesInstructions<F: Field> {
     /// Variable in the circuit.
     type Var: Var<F>;
 
@@ -130,15 +129,15 @@ impl<F: Field> RangeConstrained<F, AssignedCell<F, F>> {
 }
 
 /// Checks that an expression is either 1 or 0.
-pub fn bool_check<F: FieldExt>(value: Expression<F>) -> Expression<F> {
+pub fn bool_check<F: PrimeField>(value: Expression<F>) -> Expression<F> {
     range_check(value, 2)
 }
 
 /// If `a` then `b`, else `c`. Returns (a * b) + (1 - a) * c.
 ///
 /// `a` must be a boolean-constrained expression.
-pub fn ternary<F: FieldExt>(a: Expression<F>, b: Expression<F>, c: Expression<F>) -> Expression<F> {
-    let one_minus_a = Expression::Constant(F::one()) - a.clone();
+pub fn ternary<F: Field>(a: Expression<F>, b: Expression<F>, c: Expression<F>) -> Expression<F> {
+    let one_minus_a = Expression::Constant(F::ONE) - a.clone();
     a * b + one_minus_a * c
 }
 
@@ -156,9 +155,9 @@ pub fn bitrange_subset<F: PrimeFieldBits>(field_elem: &F, bitrange: Range<usize>
         .skip(bitrange.start)
         .take(bitrange.end - bitrange.start)
         .rev()
-        .fold(F::zero(), |acc, bit| {
+        .fold(F::ZERO, |acc, bit| {
             if bit {
-                acc.double() + F::one()
+                acc.double() + F::ONE
             } else {
                 acc.double()
             }
@@ -167,7 +166,7 @@ pub fn bitrange_subset<F: PrimeFieldBits>(field_elem: &F, bitrange: Range<usize>
 
 /// Check that an expression is in the small range [0..range),
 /// i.e. 0 ≤ word < range.
-pub fn range_check<F: FieldExt>(word: Expression<F>, range: usize) -> Expression<F> {
+pub fn range_check<F: PrimeField>(word: Expression<F>, range: usize) -> Expression<F> {
     (1..range).fold(word.clone(), |acc, i| {
         acc * (Expression::Constant(F::from(i as u64)) - word.clone())
     })
@@ -240,6 +239,7 @@ pub fn i2lebsp<const NUM_BITS: usize>(int: u64) -> [bool; NUM_BITS] {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use ff::FromUniformBytes;
     use group::ff::{Field, PrimeField};
     use halo2_proofs::{
         circuit::{Layouter, SimpleFloorPlanner},
@@ -247,7 +247,7 @@ mod tests {
         plonk::{Any, Circuit, ConstraintSystem, Constraints, Error, Selector},
         poly::Rotation,
     };
-    use halo2curves::{pasta::pallas, FieldExt};
+    use halo2curves::pasta::pallas;
     use proptest::prelude::*;
     use rand::rngs::OsRng;
     use std::convert::TryInto;
@@ -420,7 +420,7 @@ mod tests {
             // Instead of rejecting out-of-range bytes, let's reduce them.
             let mut buf = [0; 64];
             buf[..32].copy_from_slice(&bytes);
-            pallas::Scalar::from_bytes_wide(&buf)
+            pallas::Scalar::from_uniform_bytes(&buf)
         }
     }
 
diff --git a/halo2_gadgets/src/utilities/cond_swap.rs b/halo2_gadgets/src/utilities/cond_swap.rs
index 9dc1afa3ef..2dc96d5904 100644
--- a/halo2_gadgets/src/utilities/cond_swap.rs
+++ b/halo2_gadgets/src/utilities/cond_swap.rs
@@ -1,16 +1,16 @@
 //! Gadget and chip for a conditional swap utility.
 
 use super::{bool_check, ternary, UtilitiesInstructions};
+use ff::{Field, PrimeField};
 use halo2_proofs::{
     circuit::{AssignedCell, Chip, Layouter, Value},
     plonk::{Advice, Column, ConstraintSystem, Constraints, Error, Selector},
     poly::Rotation,
 };
-use halo2curves::FieldExt;
 use std::marker::PhantomData;
 
 /// Instructions for a conditional swap gadget.
-pub trait CondSwapInstructions<F: FieldExt>: UtilitiesInstructions<F> {
+pub trait CondSwapInstructions<F: Field>: UtilitiesInstructions<F> {
     #[allow(clippy::type_complexity)]
     /// Given an input pair (a,b) and a `swap` boolean flag, returns
     /// (b,a) if `swap` is set, else (a,b) if `swap` is not set.
@@ -32,7 +32,7 @@ pub struct CondSwapChip<F> {
     _marker: PhantomData<F>,
 }
 
-impl<F: FieldExt> Chip<F> for CondSwapChip<F> {
+impl<F: Field> Chip<F> for CondSwapChip<F> {
     type Config = CondSwapConfig;
     type Loaded = ();
 
@@ -63,11 +63,11 @@ impl CondSwapConfig {
     }
 }
 
-impl<F: FieldExt> UtilitiesInstructions<F> for CondSwapChip<F> {
+impl<F: Field> UtilitiesInstructions<F> for CondSwapChip<F> {
     type Var = AssignedCell<F, F>;
 }
 
-impl<F: FieldExt> CondSwapInstructions<F> for CondSwapChip<F> {
+impl<F: PrimeField> CondSwapInstructions<F> for CondSwapChip<F> {
     #[allow(clippy::type_complexity)]
     fn swap(
         &self,
@@ -122,7 +122,7 @@ impl<F: FieldExt> CondSwapInstructions<F> for CondSwapChip<F> {
     }
 }
 
-impl<F: FieldExt> CondSwapChip<F> {
+impl<F: PrimeField> CondSwapChip<F> {
     /// Configures this chip for use in a circuit.
     ///
     /// # Side-effects
@@ -195,25 +195,26 @@ impl<F: FieldExt> CondSwapChip<F> {
 mod tests {
     use super::super::UtilitiesInstructions;
     use super::{CondSwapChip, CondSwapConfig, CondSwapInstructions};
+    use ff::PrimeField;
     use group::ff::Field;
     use halo2_proofs::{
         circuit::{Layouter, SimpleFloorPlanner, Value},
         dev::MockProver,
         plonk::{Circuit, ConstraintSystem, Error},
     };
-    use halo2curves::{pasta::pallas::Base, FieldExt};
+    use halo2curves::pasta::pallas::Base;
     use rand::rngs::OsRng;
 
     #[test]
     fn cond_swap() {
         #[derive(Default)]
-        struct MyCircuit<F: FieldExt> {
+        struct MyCircuit<F: Field> {
             a: Value<F>,
             b: Value<F>,
             swap: Value<bool>,
         }
 
-        impl<F: FieldExt> Circuit<F> for MyCircuit<F> {
+        impl<F: PrimeField> Circuit<F> for MyCircuit<F> {
             type Config = CondSwapConfig;
             type FloorPlanner = SimpleFloorPlanner;
 
diff --git a/halo2_gadgets/src/utilities/decompose_running_sum.rs b/halo2_gadgets/src/utilities/decompose_running_sum.rs
index 89508f176c..96fd279942 100644
--- a/halo2_gadgets/src/utilities/decompose_running_sum.rs
+++ b/halo2_gadgets/src/utilities/decompose_running_sum.rs
@@ -30,13 +30,12 @@ use halo2_proofs::{
 };
 
 use super::range_check;
-use halo2curves::FieldExt;
 use std::marker::PhantomData;
 
 /// The running sum $[z_0, ..., z_W]$. If created in strict mode, $z_W = 0$.
 #[derive(Debug)]
-pub struct RunningSum<F: FieldExt + PrimeFieldBits>(Vec<AssignedCell<F, F>>);
-impl<F: FieldExt + PrimeFieldBits> std::ops::Deref for RunningSum<F> {
+pub struct RunningSum<F: PrimeFieldBits>(Vec<AssignedCell<F, F>>);
+impl<F: PrimeFieldBits> std::ops::Deref for RunningSum<F> {
     type Target = Vec<AssignedCell<F, F>>;
 
     fn deref(&self) -> &Vec<AssignedCell<F, F>> {
@@ -46,15 +45,13 @@ impl<F: FieldExt + PrimeFieldBits> std::ops::Deref for RunningSum<F> {
 
 /// Configuration that provides methods for running sum decomposition.
 #[derive(Debug, Clone, Copy, Eq, PartialEq)]
-pub struct RunningSumConfig<F: FieldExt + PrimeFieldBits, const WINDOW_NUM_BITS: usize> {
+pub struct RunningSumConfig<F: PrimeFieldBits, const WINDOW_NUM_BITS: usize> {
     q_range_check: Selector,
     z: Column<Advice>,
     _marker: PhantomData<F>,
 }
 
-impl<F: FieldExt + PrimeFieldBits, const WINDOW_NUM_BITS: usize>
-    RunningSumConfig<F, WINDOW_NUM_BITS>
-{
+impl<F: PrimeFieldBits, const WINDOW_NUM_BITS: usize> RunningSumConfig<F, WINDOW_NUM_BITS> {
     /// Returns the q_range_check selector of this [`RunningSumConfig`].
     pub(crate) fn q_range_check(&self) -> Selector {
         self.q_range_check
@@ -200,7 +197,7 @@ impl<F: FieldExt + PrimeFieldBits, const WINDOW_NUM_BITS: usize>
 
         if strict {
             // Constrain the final running sum output to be zero.
-            region.constrain_constant(zs.last().unwrap().cell(), F::zero())?;
+            region.constrain_constant(zs.last().unwrap().cell(), F::ZERO)?;
         }
 
         Ok(RunningSum(zs))
@@ -216,7 +213,7 @@ mod tests {
         dev::{FailureLocation, MockProver, VerifyFailure},
         plonk::{Any, Circuit, ConstraintSystem, Error},
     };
-    use halo2curves::{pasta::pallas, FieldExt};
+    use halo2curves::pasta::pallas;
     use rand::rngs::OsRng;
 
     use crate::ecc::chip::{
@@ -228,7 +225,7 @@ mod tests {
     #[test]
     fn test_running_sum() {
         struct MyCircuit<
-            F: FieldExt + PrimeFieldBits,
+            F: PrimeFieldBits,
             const WORD_NUM_BITS: usize,
             const WINDOW_NUM_BITS: usize,
             const NUM_WINDOWS: usize,
@@ -238,7 +235,7 @@ mod tests {
         }
 
         impl<
-                F: FieldExt + PrimeFieldBits,
+                F: PrimeFieldBits,
                 const WORD_NUM_BITS: usize,
                 const WINDOW_NUM_BITS: usize,
                 const NUM_WINDOWS: usize,
diff --git a/halo2_gadgets/src/utilities/lookup_range_check.rs b/halo2_gadgets/src/utilities/lookup_range_check.rs
index f97654c38b..36be7c7745 100644
--- a/halo2_gadgets/src/utilities/lookup_range_check.rs
+++ b/halo2_gadgets/src/utilities/lookup_range_check.rs
@@ -14,8 +14,8 @@ use super::*;
 
 /// The running sum $[z_0, ..., z_W]$. If created in strict mode, $z_W = 0$.
 #[derive(Debug)]
-pub struct RunningSum<F: FieldExt + PrimeFieldBits>(Vec<AssignedCell<F, F>>);
-impl<F: FieldExt + PrimeFieldBits> std::ops::Deref for RunningSum<F> {
+pub struct RunningSum<F: PrimeFieldBits>(Vec<AssignedCell<F, F>>);
+impl<F: PrimeFieldBits> std::ops::Deref for RunningSum<F> {
     type Target = Vec<AssignedCell<F, F>>;
 
     fn deref(&self) -> &Vec<AssignedCell<F, F>> {
@@ -23,7 +23,7 @@ impl<F: FieldExt + PrimeFieldBits> std::ops::Deref for RunningSum<F> {
     }
 }
 
-impl<F: FieldExt + PrimeFieldBits> RangeConstrained<F, AssignedCell<F, F>> {
+impl<F: PrimeFieldBits> RangeConstrained<F, AssignedCell<F, F>> {
     /// Witnesses a subset of the bits in `value` and constrains them to be the correct
     /// number of bits.
     ///
@@ -56,7 +56,7 @@ impl<F: FieldExt + PrimeFieldBits> RangeConstrained<F, AssignedCell<F, F>> {
 
 /// Configuration that provides methods for a lookup range check.
 #[derive(Eq, PartialEq, Debug, Clone, Copy)]
-pub struct LookupRangeCheckConfig<F: FieldExt + PrimeFieldBits, const K: usize> {
+pub struct LookupRangeCheckConfig<F: PrimeFieldBits, const K: usize> {
     q_lookup: Selector,
     q_running: Selector,
     q_bitshift: Selector,
@@ -65,7 +65,7 @@ pub struct LookupRangeCheckConfig<F: FieldExt + PrimeFieldBits, const K: usize>
     _marker: PhantomData<F>,
 }
 
-impl<F: FieldExt + PrimeFieldBits, const K: usize> LookupRangeCheckConfig<F, K> {
+impl<F: PrimeFieldBits, const K: usize> LookupRangeCheckConfig<F, K> {
     /// The `running_sum` advice column breaks the field element into `K`-bit
     /// words. It is used to construct the input expression to the lookup
     /// argument.
@@ -118,7 +118,7 @@ impl<F: FieldExt + PrimeFieldBits, const K: usize> LookupRangeCheckConfig<F, K>
             // In the short range check, the word is directly witnessed.
             let short_lookup = {
                 let short_word = z_cur;
-                let q_short = Expression::Constant(F::one()) - q_running;
+                let q_short = Expression::Constant(F::ONE) - q_running;
 
                 q_short * short_word
             };
@@ -285,7 +285,7 @@ impl<F: FieldExt + PrimeFieldBits, const K: usize> LookupRangeCheckConfig<F, K>
 
         if strict {
             // Constrain the final `z` to be zero.
-            region.constrain_constant(zs.last().unwrap().cell(), F::zero())?;
+            region.constrain_constant(zs.last().unwrap().cell(), F::ZERO)?;
         }
 
         Ok(RunningSum(zs))
@@ -395,19 +395,19 @@ mod tests {
         dev::{FailureLocation, MockProver, VerifyFailure},
         plonk::{Circuit, ConstraintSystem, Error},
     };
-    use halo2curves::{pasta::pallas, FieldExt};
+    use halo2curves::pasta::pallas;
 
     use std::{convert::TryInto, marker::PhantomData};
 
     #[test]
     fn lookup_range_check() {
         #[derive(Clone, Copy)]
-        struct MyCircuit<F: FieldExt + PrimeFieldBits> {
+        struct MyCircuit<F: PrimeFieldBits> {
             num_words: usize,
             _marker: PhantomData<F>,
         }
 
-        impl<F: FieldExt + PrimeFieldBits> Circuit<F> for MyCircuit<F> {
+        impl<F: PrimeFieldBits> Circuit<F> for MyCircuit<F> {
             type Config = LookupRangeCheckConfig<F, K>;
             type FloorPlanner = SimpleFloorPlanner;
 
@@ -434,11 +434,11 @@ mod tests {
 
                 // Lookup constraining element to be no longer than num_words * K bits.
                 let elements_and_expected_final_zs = [
-                    (F::from((1 << (self.num_words * K)) - 1), F::zero(), true), // a word that is within self.num_words * K bits long
-                    (F::from(1 << (self.num_words * K)), F::one(), false), // a word that is just over self.num_words * K bits long
+                    (F::from((1 << (self.num_words * K)) - 1), F::ZERO, true), // a word that is within self.num_words * K bits long
+                    (F::from(1 << (self.num_words * K)), F::ONE, false), // a word that is just over self.num_words * K bits long
                 ];
 
-                fn expected_zs<F: FieldExt + PrimeFieldBits, const K: usize>(
+                fn expected_zs<F: PrimeFieldBits, const K: usize>(
                     element: F,
                     num_words: usize,
                 ) -> Vec<F> {
@@ -498,12 +498,12 @@ mod tests {
 
     #[test]
     fn short_range_check() {
-        struct MyCircuit<F: FieldExt + PrimeFieldBits> {
+        struct MyCircuit<F: PrimeFieldBits> {
             element: Value<F>,
             num_bits: usize,
         }
 
-        impl<F: FieldExt + PrimeFieldBits> Circuit<F> for MyCircuit<F> {
+        impl<F: PrimeFieldBits> Circuit<F> for MyCircuit<F> {
             type Config = LookupRangeCheckConfig<F, K>;
             type FloorPlanner = SimpleFloorPlanner;
 
diff --git a/halo2_proofs/Cargo.toml b/halo2_proofs/Cargo.toml
index 148088899b..0fcc9bfde9 100644
--- a/halo2_proofs/Cargo.toml
+++ b/halo2_proofs/Cargo.toml
@@ -46,9 +46,9 @@ harness = false
 [dependencies]
 backtrace = { version = "0.3", optional = true }
 rayon = "1.5.1"
-ff = "0.12"
-group = "0.12"
-halo2curves = { git = 'https://github.com/scroll-tech/halo2curves.git', branch = "0.3.1-derive-serde" }
+ff = "0.13"
+group = "0.13"
+halo2curves = { git = 'https://github.com/privacy-scaling-explorations/halo2curves', tag = "0.3.2" }
 rand_core = { version = "0.6", default-features = false }
 tracing = "0.1"
 blake2b_simd = "1"
diff --git a/halo2_proofs/benches/dev_lookup.rs b/halo2_proofs/benches/dev_lookup.rs
index bb6cfdadbf..745a36b928 100644
--- a/halo2_proofs/benches/dev_lookup.rs
+++ b/halo2_proofs/benches/dev_lookup.rs
@@ -1,7 +1,7 @@
 #[macro_use]
 extern crate criterion;
 
-use halo2_proofs::arithmetic::FieldExt;
+use ff::{Field, PrimeField};
 use halo2_proofs::circuit::{Layouter, SimpleFloorPlanner, Value};
 use halo2_proofs::dev::MockProver;
 use halo2_proofs::plonk::*;
@@ -14,7 +14,7 @@ use criterion::{BenchmarkId, Criterion};
 
 fn criterion_benchmark(c: &mut Criterion) {
     #[derive(Clone, Default)]
-    struct MyCircuit<F: FieldExt> {
+    struct MyCircuit<F: Field> {
         _marker: PhantomData<F>,
     }
 
@@ -25,7 +25,7 @@ fn criterion_benchmark(c: &mut Criterion) {
         advice: Column<Advice>,
     }
 
-    impl<F: FieldExt> Circuit<F> for MyCircuit<F> {
+    impl<F: PrimeField> Circuit<F> for MyCircuit<F> {
         type Config = MyConfig;
         type FloorPlanner = SimpleFloorPlanner;
 
@@ -42,7 +42,7 @@ fn criterion_benchmark(c: &mut Criterion) {
 
             meta.lookup("lookup", |meta| {
                 let selector = meta.query_selector(config.selector);
-                let not_selector = Expression::Constant(F::one()) - selector.clone();
+                let not_selector = Expression::Constant(F::ONE) - selector.clone();
                 let advice = meta.query_advice(config.advice, Rotation::cur());
                 vec![(selector * advice + not_selector, config.table)]
             });
diff --git a/halo2_proofs/benches/plonk.rs b/halo2_proofs/benches/plonk.rs
index a679961463..cf02cf87e8 100644
--- a/halo2_proofs/benches/plonk.rs
+++ b/halo2_proofs/benches/plonk.rs
@@ -2,7 +2,6 @@
 extern crate criterion;
 
 use group::ff::Field;
-use halo2_proofs::arithmetic::FieldExt;
 use halo2_proofs::circuit::{Cell, Layouter, SimpleFloorPlanner, Value};
 use halo2_proofs::plonk::*;
 use halo2_proofs::poly::{commitment::ParamsProver, Rotation};
@@ -43,7 +42,7 @@ fn criterion_benchmark(c: &mut Criterion) {
         sm: Column<Fixed>,
     }
 
-    trait StandardCs<FF: FieldExt> {
+    trait StandardCs<FF: Field> {
         fn raw_multiply<F>(
             &self,
             layouter: &mut impl Layouter<FF>,
@@ -62,17 +61,17 @@ fn criterion_benchmark(c: &mut Criterion) {
     }
 
     #[derive(Clone)]
-    struct MyCircuit<F: FieldExt> {
+    struct MyCircuit<F: Field> {
         a: Value<F>,
         k: u32,
     }
 
-    struct StandardPlonk<F: FieldExt> {
+    struct StandardPlonk<F: Field> {
         config: PlonkConfig,
         _marker: PhantomData<F>,
     }
 
-    impl<FF: FieldExt> StandardPlonk<FF> {
+    impl<FF: Field> StandardPlonk<FF> {
         fn new(config: PlonkConfig) -> Self {
             StandardPlonk {
                 config,
@@ -81,7 +80,7 @@ fn criterion_benchmark(c: &mut Criterion) {
         }
     }
 
-    impl<FF: FieldExt> StandardCs<FF> for StandardPlonk<FF> {
+    impl<FF: Field> StandardCs<FF> for StandardPlonk<FF> {
         fn raw_multiply<F>(
             &self,
             layouter: &mut impl Layouter<FF>,
@@ -116,15 +115,10 @@ fn criterion_benchmark(c: &mut Criterion) {
                         || value.unwrap().map(|v| v.2),
                     )?;
 
-                    region.assign_fixed(|| "a", self.config.sa, 0, || Value::known(FF::zero()))?;
-                    region.assign_fixed(|| "b", self.config.sb, 0, || Value::known(FF::zero()))?;
-                    region.assign_fixed(|| "c", self.config.sc, 0, || Value::known(FF::one()))?;
-                    region.assign_fixed(
-                        || "a * b",
-                        self.config.sm,
-                        0,
-                        || Value::known(FF::one()),
-                    )?;
+                    region.assign_fixed(|| "a", self.config.sa, 0, || Value::known(FF::ZERO))?;
+                    region.assign_fixed(|| "b", self.config.sb, 0, || Value::known(FF::ZERO))?;
+                    region.assign_fixed(|| "c", self.config.sc, 0, || Value::known(FF::ONE))?;
+                    region.assign_fixed(|| "a * b", self.config.sm, 0, || Value::known(FF::ONE))?;
                     Ok((lhs.cell(), rhs.cell(), out.cell()))
                 },
             )
@@ -163,14 +157,14 @@ fn criterion_benchmark(c: &mut Criterion) {
                         || value.unwrap().map(|v| v.2),
                     )?;
 
-                    region.assign_fixed(|| "a", self.config.sa, 0, || Value::known(FF::one()))?;
-                    region.assign_fixed(|| "b", self.config.sb, 0, || Value::known(FF::one()))?;
-                    region.assign_fixed(|| "c", self.config.sc, 0, || Value::known(FF::one()))?;
+                    region.assign_fixed(|| "a", self.config.sa, 0, || Value::known(FF::ONE))?;
+                    region.assign_fixed(|| "b", self.config.sb, 0, || Value::known(FF::ONE))?;
+                    region.assign_fixed(|| "c", self.config.sc, 0, || Value::known(FF::ONE))?;
                     region.assign_fixed(
                         || "a * b",
                         self.config.sm,
                         0,
-                        || Value::known(FF::zero()),
+                        || Value::known(FF::ZERO),
                     )?;
                     Ok((lhs.cell(), rhs.cell(), out.cell()))
                 },
@@ -186,7 +180,7 @@ fn criterion_benchmark(c: &mut Criterion) {
         }
     }
 
-    impl<F: FieldExt> Circuit<F> for MyCircuit<F> {
+    impl<F: Field> Circuit<F> for MyCircuit<F> {
         type Config = PlonkConfig;
         type FloorPlanner = SimpleFloorPlanner;
 
diff --git a/halo2_proofs/examples/circuit-layout.rs b/halo2_proofs/examples/circuit-layout.rs
index beb99502bd..6a73f51ff8 100644
--- a/halo2_proofs/examples/circuit-layout.rs
+++ b/halo2_proofs/examples/circuit-layout.rs
@@ -1,6 +1,5 @@
 use ff::Field;
 use halo2_proofs::{
-    arithmetic::FieldExt,
     circuit::{Cell, Layouter, Region, SimpleFloorPlanner, Value},
     plonk::{Advice, Assigned, Circuit, Column, ConstraintSystem, Error, Fixed, TableColumn},
     poly::Rotation,
@@ -28,7 +27,7 @@ struct PlonkConfig {
     sl: TableColumn,
 }
 
-trait StandardCs<FF: FieldExt> {
+trait StandardCs<FF: Field> {
     fn raw_multiply<F>(&self, region: &mut Region<FF>, f: F) -> Result<(Cell, Cell, Cell), Error>
     where
         F: FnMut() -> Value<(Assigned<FF>, Assigned<FF>, Assigned<FF>)>;
@@ -39,17 +38,17 @@ trait StandardCs<FF: FieldExt> {
     fn lookup_table(&self, layouter: &mut impl Layouter<FF>, values: &[FF]) -> Result<(), Error>;
 }
 
-struct MyCircuit<F: FieldExt> {
+struct MyCircuit<F: Field> {
     a: Value<F>,
     lookup_table: Vec<F>,
 }
 
-struct StandardPlonk<F: FieldExt> {
+struct StandardPlonk<F: Field> {
     config: PlonkConfig,
     _marker: PhantomData<F>,
 }
 
-impl<FF: FieldExt> StandardPlonk<FF> {
+impl<FF: Field> StandardPlonk<FF> {
     fn new(config: PlonkConfig) -> Self {
         StandardPlonk {
             config,
@@ -58,7 +57,7 @@ impl<FF: FieldExt> StandardPlonk<FF> {
     }
 }
 
-impl<FF: FieldExt> StandardCs<FF> for StandardPlonk<FF> {
+impl<FF: Field> StandardCs<FF> for StandardPlonk<FF> {
     fn raw_multiply<F>(
         &self,
         region: &mut Region<FF>,
@@ -94,10 +93,10 @@ impl<FF: FieldExt> StandardCs<FF> for StandardPlonk<FF> {
         let out =
             region.assign_advice(|| "out", self.config.c, 0, || value.unwrap().map(|v| v.2))?;
 
-        region.assign_fixed(|| "a", self.config.sa, 0, || Value::known(FF::zero()))?;
-        region.assign_fixed(|| "b", self.config.sb, 0, || Value::known(FF::zero()))?;
-        region.assign_fixed(|| "c", self.config.sc, 0, || Value::known(FF::one()))?;
-        region.assign_fixed(|| "a * b", self.config.sm, 0, || Value::known(FF::one()))?;
+        region.assign_fixed(|| "a", self.config.sa, 0, || Value::known(FF::ZERO))?;
+        region.assign_fixed(|| "b", self.config.sb, 0, || Value::known(FF::ZERO))?;
+        region.assign_fixed(|| "c", self.config.sc, 0, || Value::known(FF::ONE))?;
+        region.assign_fixed(|| "a * b", self.config.sm, 0, || Value::known(FF::ONE))?;
         Ok((lhs.cell(), rhs.cell(), out.cell()))
     }
     fn raw_add<F>(&self, region: &mut Region<FF>, mut f: F) -> Result<(Cell, Cell, Cell), Error>
@@ -131,10 +130,10 @@ impl<FF: FieldExt> StandardCs<FF> for StandardPlonk<FF> {
         let out =
             region.assign_advice(|| "out", self.config.c, 0, || value.unwrap().map(|v| v.2))?;
 
-        region.assign_fixed(|| "a", self.config.sa, 0, || Value::known(FF::one()))?;
-        region.assign_fixed(|| "b", self.config.sb, 0, || Value::known(FF::one()))?;
-        region.assign_fixed(|| "c", self.config.sc, 0, || Value::known(FF::one()))?;
-        region.assign_fixed(|| "a * b", self.config.sm, 0, || Value::known(FF::zero()))?;
+        region.assign_fixed(|| "a", self.config.sa, 0, || Value::known(FF::ONE))?;
+        region.assign_fixed(|| "b", self.config.sb, 0, || Value::known(FF::ONE))?;
+        region.assign_fixed(|| "c", self.config.sc, 0, || Value::known(FF::ONE))?;
+        region.assign_fixed(|| "a * b", self.config.sm, 0, || Value::known(FF::ZERO))?;
         Ok((lhs.cell(), rhs.cell(), out.cell()))
     }
     fn copy(&self, region: &mut Region<FF>, left: Cell, right: Cell) -> Result<(), Error> {
@@ -159,7 +158,7 @@ impl<FF: FieldExt> StandardCs<FF> for StandardPlonk<FF> {
     }
 }
 
-impl<F: FieldExt> Circuit<F> for MyCircuit<F> {
+impl<F: Field> Circuit<F> for MyCircuit<F> {
     type Config = PlonkConfig;
     type FloorPlanner = SimpleFloorPlanner;
 
diff --git a/halo2_proofs/examples/shuffle.rs b/halo2_proofs/examples/shuffle.rs
index 1926074371..08d16b9f27 100644
--- a/halo2_proofs/examples/shuffle.rs
+++ b/halo2_proofs/examples/shuffle.rs
@@ -1,6 +1,6 @@
-use ff::BatchInvert;
+use ff::{BatchInvert, FromUniformBytes};
 use halo2_proofs::{
-    arithmetic::{CurveAffine, FieldExt},
+    arithmetic::{CurveAffine, Field},
     circuit::{floor_planner::V1, Layouter, Value},
     dev::{metadata, FailureLocation, MockProver, VerifyFailure},
     halo2curves::pasta::EqAffine,
@@ -21,13 +21,11 @@ use halo2_proofs::{
 use rand_core::{OsRng, RngCore};
 use std::iter;
 
-fn rand_2d_array<F: FieldExt, R: RngCore, const W: usize, const H: usize>(
-    rng: &mut R,
-) -> [[F; H]; W] {
+fn rand_2d_array<F: Field, R: RngCore, const W: usize, const H: usize>(rng: &mut R) -> [[F; H]; W] {
     [(); W].map(|_| [(); H].map(|_| F::random(&mut *rng)))
 }
 
-fn shuffled<F: FieldExt, R: RngCore, const W: usize, const H: usize>(
+fn shuffled<F: Field, R: RngCore, const W: usize, const H: usize>(
     original: [[F; H]; W],
     rng: &mut R,
 ) -> [[F; H]; W] {
@@ -56,7 +54,7 @@ struct MyConfig<const W: usize> {
 }
 
 impl<const W: usize> MyConfig<W> {
-    fn configure<F: FieldExt>(meta: &mut ConstraintSystem<F>) -> Self {
+    fn configure<F: Field>(meta: &mut ConstraintSystem<F>) -> Self {
         let [q_shuffle, q_first, q_last] = [(); 3].map(|_| meta.selector());
         // First phase
         let original = [(); W].map(|_| meta.advice_column_in(FirstPhase));
@@ -68,7 +66,7 @@ impl<const W: usize> MyConfig<W> {
         meta.create_gate("z should start with 1", |meta| {
             let q_first = meta.query_selector(q_first);
             let z = meta.query_advice(z, Rotation::cur());
-            let one = Expression::Constant(F::one());
+            let one = Expression::Constant(F::ONE);
 
             vec![q_first * (one - z)]
         });
@@ -76,7 +74,7 @@ impl<const W: usize> MyConfig<W> {
         meta.create_gate("z should end with 1", |meta| {
             let q_last = meta.query_selector(q_last);
             let z = meta.query_advice(z, Rotation::cur());
-            let one = Expression::Constant(F::one());
+            let one = Expression::Constant(F::ONE);
 
             vec![q_last * (one - z)]
         });
@@ -118,12 +116,12 @@ impl<const W: usize> MyConfig<W> {
 }
 
 #[derive(Clone, Default)]
-struct MyCircuit<F: FieldExt, const W: usize, const H: usize> {
+struct MyCircuit<F: Field, const W: usize, const H: usize> {
     original: Value<[[F; H]; W]>,
     shuffled: Value<[[F; H]; W]>,
 }
 
-impl<F: FieldExt, const W: usize, const H: usize> MyCircuit<F, W, H> {
+impl<F: Field, const W: usize, const H: usize> MyCircuit<F, W, H> {
     fn rand<R: RngCore>(rng: &mut R) -> Self {
         let original = rand_2d_array::<F, _, W, H>(rng);
         let shuffled = shuffled(original, rng);
@@ -135,7 +133,7 @@ impl<F: FieldExt, const W: usize, const H: usize> MyCircuit<F, W, H> {
     }
 }
 
-impl<F: FieldExt, const W: usize, const H: usize> Circuit<F> for MyCircuit<F, W, H> {
+impl<F: Field, const W: usize, const H: usize> Circuit<F> for MyCircuit<F, W, H> {
     type Config = MyConfig<W>;
     type FloorPlanner = V1;
 
@@ -200,9 +198,9 @@ impl<F: FieldExt, const W: usize, const H: usize> Circuit<F> for MyCircuit<F, W,
                 // Second phase
                 let z = self.original.zip(self.shuffled).zip(theta).zip(gamma).map(
                     |(((original, shuffled), theta), gamma)| {
-                        let mut product = vec![F::zero(); H];
+                        let mut product = vec![F::ZERO; H];
                         for (idx, product) in product.iter_mut().enumerate() {
-                            let mut compressed = F::zero();
+                            let mut compressed = F::ZERO;
                             for value in shuffled.iter() {
                                 compressed *= theta;
                                 compressed += value[idx];
@@ -214,7 +212,7 @@ impl<F: FieldExt, const W: usize, const H: usize> Circuit<F> for MyCircuit<F, W,
                         product.iter_mut().batch_invert();
 
                         for (idx, product) in product.iter_mut().enumerate() {
-                            let mut compressed = F::zero();
+                            let mut compressed = F::ZERO;
                             for value in original.iter() {
                                 compressed *= theta;
                                 compressed += value[idx];
@@ -224,16 +222,16 @@ impl<F: FieldExt, const W: usize, const H: usize> Circuit<F> for MyCircuit<F, W,
                         }
 
                         #[allow(clippy::let_and_return)]
-                        let z = iter::once(F::one())
+                        let z = iter::once(F::ONE)
                             .chain(product)
-                            .scan(F::one(), |state, cur| {
+                            .scan(F::ONE, |state, cur| {
                                 *state *= &cur;
                                 Some(*state)
                             })
                             .collect::<Vec<_>>();
 
                         #[cfg(feature = "sanity-checks")]
-                        assert_eq!(F::one(), *z.last().unwrap());
+                        assert_eq!(F::ONE, *z.last().unwrap());
 
                         z
                     },
@@ -253,12 +251,12 @@ impl<F: FieldExt, const W: usize, const H: usize> Circuit<F> for MyCircuit<F, W,
     }
 }
 
-fn test_mock_prover<F: FieldExt, const W: usize, const H: usize>(
+fn test_mock_prover<F: Ord + FromUniformBytes<64>, const W: usize, const H: usize>(
     k: u32,
     circuit: MyCircuit<F, W, H>,
     expected: Result<(), Vec<(metadata::Constraint, FailureLocation)>>,
 ) {
-    let prover = MockProver::run::<_>(k, &circuit, vec![]).unwrap();
+    let prover = MockProver::run(k, &circuit, vec![]).unwrap();
     match (prover.verify(), expected) {
         (Ok(_), Ok(_)) => {}
         (Err(err), Err(expected)) => {
@@ -284,7 +282,9 @@ fn test_prover<C: CurveAffine, const W: usize, const H: usize>(
     k: u32,
     circuit: MyCircuit<C::Scalar, W, H>,
     expected: bool,
-) {
+) where
+    C::Scalar: FromUniformBytes<64>,
+{
     let params = ParamsIPA::<C>::new(k);
     let vk = keygen_vk(&params, &circuit).unwrap();
     let pk = keygen_pk(&params, vk, &circuit).unwrap();
diff --git a/halo2_proofs/examples/simple-example.rs b/halo2_proofs/examples/simple-example.rs
index c5e7a9f282..2273ce9759 100644
--- a/halo2_proofs/examples/simple-example.rs
+++ b/halo2_proofs/examples/simple-example.rs
@@ -1,14 +1,14 @@
 use std::marker::PhantomData;
 
 use halo2_proofs::{
-    arithmetic::FieldExt,
+    arithmetic::Field,
     circuit::{AssignedCell, Chip, Layouter, Region, SimpleFloorPlanner, Value},
     plonk::{Advice, Circuit, Column, ConstraintSystem, Error, Fixed, Instance, Selector},
     poly::Rotation,
 };
 
 // ANCHOR: instructions
-trait NumericInstructions<F: FieldExt>: Chip<F> {
+trait NumericInstructions<F: Field>: Chip<F> {
     /// Variable representing a number.
     type Num;
 
@@ -39,7 +39,7 @@ trait NumericInstructions<F: FieldExt>: Chip<F> {
 // ANCHOR: chip
 /// The chip that will implement our instructions! Chips store their own
 /// config, as well as type markers if necessary.
-struct FieldChip<F: FieldExt> {
+struct FieldChip<F: Field> {
     config: FieldConfig,
     _marker: PhantomData<F>,
 }
@@ -65,7 +65,7 @@ struct FieldConfig {
     s_mul: Selector,
 }
 
-impl<F: FieldExt> FieldChip<F> {
+impl<F: Field> FieldChip<F> {
     fn construct(config: <Self as Chip<F>>::Config) -> Self {
         Self {
             config,
@@ -126,7 +126,7 @@ impl<F: FieldExt> FieldChip<F> {
 // ANCHOR_END: chip-config
 
 // ANCHOR: chip-impl
-impl<F: FieldExt> Chip<F> for FieldChip<F> {
+impl<F: Field> Chip<F> for FieldChip<F> {
     type Config = FieldConfig;
     type Loaded = ();
 
@@ -143,9 +143,9 @@ impl<F: FieldExt> Chip<F> for FieldChip<F> {
 // ANCHOR: instructions-impl
 /// A variable representing a number.
 #[derive(Clone)]
-struct Number<F: FieldExt>(AssignedCell<F, F>);
+struct Number<F: Field>(AssignedCell<F, F>);
 
-impl<F: FieldExt> NumericInstructions<F> for FieldChip<F> {
+impl<F: Field> NumericInstructions<F> for FieldChip<F> {
     type Num = Number<F>;
 
     fn load_private(
@@ -238,13 +238,13 @@ impl<F: FieldExt> NumericInstructions<F> for FieldChip<F> {
 /// they won't have any value during key generation. During proving, if any of these
 /// were `None` we would get an error.
 #[derive(Default)]
-struct MyCircuit<F: FieldExt> {
+struct MyCircuit<F: Field> {
     constant: F,
     a: Value<F>,
     b: Value<F>,
 }
 
-impl<F: FieldExt> Circuit<F> for MyCircuit<F> {
+impl<F: Field> Circuit<F> for MyCircuit<F> {
     // Since we are using a single chip for everything, we can just reuse its config.
     type Config = FieldConfig;
     type FloorPlanner = SimpleFloorPlanner;
diff --git a/halo2_proofs/examples/two-chip.rs b/halo2_proofs/examples/two-chip.rs
index 61d40f93ca..4113d94143 100644
--- a/halo2_proofs/examples/two-chip.rs
+++ b/halo2_proofs/examples/two-chip.rs
@@ -1,7 +1,7 @@
 use std::marker::PhantomData;
 
 use halo2_proofs::{
-    arithmetic::FieldExt,
+    arithmetic::Field,
     circuit::{AssignedCell, Chip, Layouter, Region, SimpleFloorPlanner, Value},
     plonk::{Advice, Circuit, Column, ConstraintSystem, Error, Instance, Selector},
     poly::Rotation,
@@ -10,9 +10,9 @@ use halo2_proofs::{
 // ANCHOR: field-instructions
 /// A variable representing a number.
 #[derive(Clone)]
-struct Number<F: FieldExt>(AssignedCell<F, F>);
+struct Number<F: Field>(AssignedCell<F, F>);
 
-trait FieldInstructions<F: FieldExt>: AddInstructions<F> + MulInstructions<F> {
+trait FieldInstructions<F: Field>: AddInstructions<F> + MulInstructions<F> {
     /// Variable representing a number.
     type Num;
 
@@ -43,7 +43,7 @@ trait FieldInstructions<F: FieldExt>: AddInstructions<F> + MulInstructions<F> {
 // ANCHOR_END: field-instructions
 
 // ANCHOR: add-instructions
-trait AddInstructions<F: FieldExt>: Chip<F> {
+trait AddInstructions<F: Field>: Chip<F> {
     /// Variable representing a number.
     type Num;
 
@@ -58,7 +58,7 @@ trait AddInstructions<F: FieldExt>: Chip<F> {
 // ANCHOR_END: add-instructions
 
 // ANCHOR: mul-instructions
-trait MulInstructions<F: FieldExt>: Chip<F> {
+trait MulInstructions<F: Field>: Chip<F> {
     /// Variable representing a number.
     type Num;
 
@@ -108,28 +108,28 @@ struct MulConfig {
 
 // ANCHOR: field-chip
 /// The top-level chip that will implement the `FieldInstructions`.
-struct FieldChip<F: FieldExt> {
+struct FieldChip<F: Field> {
     config: FieldConfig,
     _marker: PhantomData<F>,
 }
 // ANCHOR_END: field-chip
 
 // ANCHOR: add-chip
-struct AddChip<F: FieldExt> {
+struct AddChip<F: Field> {
     config: AddConfig,
     _marker: PhantomData<F>,
 }
 // ANCHOR END: add-chip
 
 // ANCHOR: mul-chip
-struct MulChip<F: FieldExt> {
+struct MulChip<F: Field> {
     config: MulConfig,
     _marker: PhantomData<F>,
 }
 // ANCHOR_END: mul-chip
 
 // ANCHOR: add-chip-trait-impl
-impl<F: FieldExt> Chip<F> for AddChip<F> {
+impl<F: Field> Chip<F> for AddChip<F> {
     type Config = AddConfig;
     type Loaded = ();
 
@@ -144,7 +144,7 @@ impl<F: FieldExt> Chip<F> for AddChip<F> {
 // ANCHOR END: add-chip-trait-impl
 
 // ANCHOR: add-chip-impl
-impl<F: FieldExt> AddChip<F> {
+impl<F: Field> AddChip<F> {
     fn construct(config: <Self as Chip<F>>::Config, _loaded: <Self as Chip<F>>::Loaded) -> Self {
         Self {
             config,
@@ -174,7 +174,7 @@ impl<F: FieldExt> AddChip<F> {
 // ANCHOR END: add-chip-impl
 
 // ANCHOR: add-instructions-impl
-impl<F: FieldExt> AddInstructions<F> for FieldChip<F> {
+impl<F: Field> AddInstructions<F> for FieldChip<F> {
     type Num = Number<F>;
     fn add(
         &self,
@@ -189,7 +189,7 @@ impl<F: FieldExt> AddInstructions<F> for FieldChip<F> {
     }
 }
 
-impl<F: FieldExt> AddInstructions<F> for AddChip<F> {
+impl<F: Field> AddInstructions<F> for AddChip<F> {
     type Num = Number<F>;
 
     fn add(
@@ -231,7 +231,7 @@ impl<F: FieldExt> AddInstructions<F> for AddChip<F> {
 // ANCHOR END: add-instructions-impl
 
 // ANCHOR: mul-chip-trait-impl
-impl<F: FieldExt> Chip<F> for MulChip<F> {
+impl<F: Field> Chip<F> for MulChip<F> {
     type Config = MulConfig;
     type Loaded = ();
 
@@ -246,7 +246,7 @@ impl<F: FieldExt> Chip<F> for MulChip<F> {
 // ANCHOR END: mul-chip-trait-impl
 
 // ANCHOR: mul-chip-impl
-impl<F: FieldExt> MulChip<F> {
+impl<F: Field> MulChip<F> {
     fn construct(config: <Self as Chip<F>>::Config, _loaded: <Self as Chip<F>>::Loaded) -> Self {
         Self {
             config,
@@ -296,7 +296,7 @@ impl<F: FieldExt> MulChip<F> {
 // ANCHOR_END: mul-chip-impl
 
 // ANCHOR: mul-instructions-impl
-impl<F: FieldExt> MulInstructions<F> for FieldChip<F> {
+impl<F: Field> MulInstructions<F> for FieldChip<F> {
     type Num = Number<F>;
     fn mul(
         &self,
@@ -310,7 +310,7 @@ impl<F: FieldExt> MulInstructions<F> for FieldChip<F> {
     }
 }
 
-impl<F: FieldExt> MulInstructions<F> for MulChip<F> {
+impl<F: Field> MulInstructions<F> for MulChip<F> {
     type Num = Number<F>;
 
     fn mul(
@@ -352,7 +352,7 @@ impl<F: FieldExt> MulInstructions<F> for MulChip<F> {
 // ANCHOR END: mul-instructions-impl
 
 // ANCHOR: field-chip-trait-impl
-impl<F: FieldExt> Chip<F> for FieldChip<F> {
+impl<F: Field> Chip<F> for FieldChip<F> {
     type Config = FieldConfig;
     type Loaded = ();
 
@@ -367,7 +367,7 @@ impl<F: FieldExt> Chip<F> for FieldChip<F> {
 // ANCHOR_END: field-chip-trait-impl
 
 // ANCHOR: field-chip-impl
-impl<F: FieldExt> FieldChip<F> {
+impl<F: Field> FieldChip<F> {
     fn construct(config: <Self as Chip<F>>::Config, _loaded: <Self as Chip<F>>::Loaded) -> Self {
         Self {
             config,
@@ -396,7 +396,7 @@ impl<F: FieldExt> FieldChip<F> {
 // ANCHOR_END: field-chip-impl
 
 // ANCHOR: field-instructions-impl
-impl<F: FieldExt> FieldInstructions<F> for FieldChip<F> {
+impl<F: Field> FieldInstructions<F> for FieldChip<F> {
     type Num = Number<F>;
 
     fn load_private(
@@ -448,13 +448,13 @@ impl<F: FieldExt> FieldInstructions<F> for FieldChip<F> {
 /// they won't have any value during key generation. During proving, if any of these
 /// were `Value::unknown()` we would get an error.
 #[derive(Default)]
-struct MyCircuit<F: FieldExt> {
+struct MyCircuit<F: Field> {
     a: Value<F>,
     b: Value<F>,
     c: Value<F>,
 }
 
-impl<F: FieldExt> Circuit<F> for MyCircuit<F> {
+impl<F: Field> Circuit<F> for MyCircuit<F> {
     // Since we are using a single chip for everything, we can just reuse its config.
     type Config = FieldConfig;
     type FloorPlanner = SimpleFloorPlanner;
@@ -496,7 +496,6 @@ impl<F: FieldExt> Circuit<F> for MyCircuit<F> {
 
 #[allow(clippy::many_single_char_names)]
 fn main() {
-    use group::ff::Field;
     use halo2_proofs::dev::MockProver;
     use halo2curves::pasta::Fp;
     use rand_core::OsRng;
diff --git a/halo2_proofs/src/arithmetic.rs b/halo2_proofs/src/arithmetic.rs
index c06575b549..234ef6db54 100644
--- a/halo2_proofs/src/arithmetic.rs
+++ b/halo2_proofs/src/arithmetic.rs
@@ -5,10 +5,25 @@ use super::multicore;
 pub use ff::Field;
 use group::{
     ff::{BatchInvert, PrimeField},
-    Curve, Group as _,
+    Curve, Group, GroupOpsOwned, ScalarMulOwned,
 };
 
-pub use halo2curves::{CurveAffine, CurveExt, FieldExt, Group};
+pub use halo2curves::{CurveAffine, CurveExt};
+
+/// This represents an element of a group with basic operations that can be
+/// performed. This allows an FFT implementation (for example) to operate
+/// generically over either a field or elliptic curve group.
+pub trait FftGroup<Scalar: Field>:
+    Copy + Send + Sync + 'static + GroupOpsOwned + ScalarMulOwned<Scalar>
+{
+}
+
+impl<T, Scalar> FftGroup<Scalar> for T
+where
+    Scalar: Field,
+    T: Copy + Send + Sync + 'static + GroupOpsOwned + ScalarMulOwned<Scalar>,
+{
+}
 
 pub const SPARSE_TWIDDLE_DEGREE: u32 = 10;
 
@@ -170,7 +185,7 @@ pub fn best_multiexp<C: CurveAffine>(coeffs: &[C::Scalar], bases: &[C]) -> C::Cu
 /// by $n$.
 ///
 /// This will use multithreading if beneficial.
-pub fn best_fft<G: Group>(a: &mut [G], omega: G::Scalar, log_n: u32) {
+pub fn best_fft<Scalar: Field, G: FftGroup<Scalar>>(a: &mut [G], omega: Scalar, log_n: u32) {
     let threads = multicore::current_num_threads();
     let log_split = log2_floor(threads) as usize;
     let n = a.len() as usize;
@@ -193,7 +208,7 @@ fn bitreverse(mut n: usize, l: usize) -> usize {
     r
 }
 
-fn serial_fft<G: Group>(a: &mut [G], omega: G::Scalar, log_n: u32) {
+fn serial_fft<Scalar: Field, G: FftGroup<Scalar>>(a: &mut [G], omega: Scalar, log_n: u32) {
     let n = a.len() as u32;
     assert_eq!(n, 1 << log_n);
 
@@ -210,13 +225,13 @@ fn serial_fft<G: Group>(a: &mut [G], omega: G::Scalar, log_n: u32) {
 
         let mut k = 0;
         while k < n {
-            let mut w = G::Scalar::one();
+            let mut w = Scalar::ONE;
             for j in 0..m {
                 let mut t = a[(k + j + m) as usize];
-                t.group_scale(&w);
+                t *= &w;
                 a[(k + j + m) as usize] = a[(k + j) as usize];
-                a[(k + j + m) as usize].group_sub(&t);
-                a[(k + j) as usize].group_add(&t);
+                a[(k + j + m) as usize] -= &t;
+                a[(k + j) as usize] += &t;
                 w *= &w_m;
             }
 
@@ -227,9 +242,9 @@ fn serial_fft<G: Group>(a: &mut [G], omega: G::Scalar, log_n: u32) {
     }
 }
 
-fn serial_split_fft<G: Group>(
+fn serial_split_fft<Scalar: Field, G: FftGroup<Scalar>>(
     a: &mut [G],
-    twiddle_lut: &[G::Scalar],
+    twiddle_lut: &[Scalar],
     twiddle_scale: usize,
     log_n: u32,
 ) {
@@ -248,13 +263,13 @@ fn serial_split_fft<G: Group>(
 
         let mut k = 0;
         while k < n {
-            let mut w = G::Scalar::one();
+            let mut w = G::Scalar::ONE;
             for j in 0..m {
                 let mut t = a[(k + j + m) as usize];
-                t.group_scale(&w);
+                t *= &w;
                 a[(k + j + m) as usize] = a[(k + j) as usize];
-                a[(k + j + m) as usize].group_sub(&t);
-                a[(k + j) as usize].group_add(&t);
+                a[(k + j + m) as usize] -= &t;
+                a[(k + j) as usize] += &t;
                 w *= &w_m;
             }
 
@@ -265,10 +280,10 @@ fn serial_split_fft<G: Group>(
     }
 }
 
-fn split_radix_fft<G: Group>(
+fn split_radix_fft<Scalar: Field, G: FftGroup<Scalar>>(
     tmp: &mut [G],
     a: &[G],
-    twiddle_lut: &[G::Scalar],
+    twiddle_lut: &[Scalar],
     n: usize,
     sub_fft_offset: usize,
     log_split: usize,
@@ -278,7 +293,7 @@ fn split_radix_fft<G: Group>(
 
     // we use out-place bitreverse here, split_m <= num_threads, so the buffer spase is small
     // and it's is good for data locality
-    let mut t1 = vec![G::group_zero(); split_m];
+    let mut t1 = vec![G::Scalar::ZERO; split_m];
     // if unsafe code is allowed, a 10% performance improvement can be achieved
     // let mut t1: Vec<G> = Vec::with_capacity(split_m as usize);
     // unsafe{ t1.set_len(split_m as usize); }
@@ -295,9 +310,9 @@ fn split_radix_fft<G: Group>(
     if high_idx > 0 {
         omega = omega * twiddle_lut[(1 << sparse_degree) + high_idx];
     }
-    let mut w_m = G::Scalar::one();
+    let mut w_m = G::Scalar::ONE;
     for i in 0..split_m {
-        t1[i].group_scale(&w_m);
+        t1[i] *= &w_m;
         tmp[i] = t1[i];
         w_m = w_m * omega;
     }
@@ -353,7 +368,7 @@ pub fn generate_twiddle_lookup_table<F: Field>(
     twiddle_lut
 }
 
-pub fn parallel_fft<G: Group>(a: &mut [G], omega: G::Scalar, log_n: u32) {
+pub fn parallel_fft<Scalar: Field, G: FftGroup<Scalar>>(a: &mut [G], omega: Scalar, log_n: u32) {
     let n = a.len() as usize;
     assert_eq!(n, 1 << log_n);
 
@@ -363,7 +378,7 @@ pub fn parallel_fft<G: Group>(a: &mut [G], omega: G::Scalar, log_n: u32) {
     let twiddle_lut = generate_twiddle_lookup_table(omega, log_n, SPARSE_TWIDDLE_DEGREE, true);
 
     // split fft
-    let mut tmp = vec![G::group_zero(); n];
+    let mut tmp = vec![G::Scalar::ZERO; n];
     // if unsafe code is allowed, a 10% performance improvement can be achieved
     // let mut tmp: Vec<G> = Vec::with_capacity(n);
     // unsafe{ tmp.set_len(n); }
@@ -449,7 +464,7 @@ pub fn eval_polynomial<F: Field>(poly: &[F], point: F) -> F {
     fn evaluate<F: Field>(poly: &[F], point: F) -> F {
         poly.iter()
             .rev()
-            .fold(F::zero(), |acc, coeff| acc * point + coeff)
+            .fold(F::ZERO, |acc, coeff| acc * point + coeff)
     }
     let n = poly.len();
     let num_threads = multicore::current_num_threads();
@@ -457,7 +472,7 @@ pub fn eval_polynomial<F: Field>(poly: &[F], point: F) -> F {
         evaluate(poly, point)
     } else {
         let chunk_size = (n + num_threads - 1) / num_threads;
-        let mut parts = vec![F::zero(); num_threads];
+        let mut parts = vec![F::ZERO; num_threads];
         multicore::scope(|scope| {
             for (chunk_idx, (out, poly)) in
                 parts.chunks_mut(1).zip(poly.chunks(chunk_size)).enumerate()
@@ -468,7 +483,7 @@ pub fn eval_polynomial<F: Field>(poly: &[F], point: F) -> F {
                 });
             }
         });
-        parts.iter().fold(F::zero(), |acc, coeff| acc + coeff)
+        parts.iter().fold(F::ZERO, |acc, coeff| acc + coeff)
     }
 }
 
@@ -479,7 +494,7 @@ pub fn compute_inner_product<F: Field>(a: &[F], b: &[F]) -> F {
     // TODO: parallelize?
     assert_eq!(a.len(), b.len());
 
-    let mut acc = F::zero();
+    let mut acc = F::ZERO;
     for (a, b) in a.iter().zip(b.iter()) {
         acc += (*a) * (*b);
     }
@@ -496,9 +511,9 @@ where
     b = -b;
     let a = a.into_iter();
 
-    let mut q = vec![F::zero(); a.len() - 1];
+    let mut q = vec![F::ZERO; a.len() - 1];
 
-    let mut tmp = F::zero();
+    let mut tmp = F::ZERO;
     for (q, r) in q.iter_mut().rev().zip(a.rev()) {
         let mut lead_coeff = *r;
         lead_coeff.sub_assign(&tmp);
@@ -546,7 +561,7 @@ fn log2_floor(num: usize) -> u32 {
 /// Returns coefficients of an n - 1 degree polynomial given a set of n points
 /// and their evaluations. This function will panic if two values in `points`
 /// are the same.
-pub fn lagrange_interpolate<F: FieldExt>(points: &[F], evals: &[F]) -> Vec<F> {
+pub fn lagrange_interpolate<F: Field>(points: &[F], evals: &[F]) -> Vec<F> {
     assert_eq!(points.len(), evals.len());
     if points.len() == 1 {
         // Constant polynomial
@@ -568,11 +583,11 @@ pub fn lagrange_interpolate<F: FieldExt>(points: &[F], evals: &[F]) -> Vec<F> {
         // Compute (x_j - x_k)^(-1) for each j != i
         denoms.iter_mut().flat_map(|v| v.iter_mut()).batch_invert();
 
-        let mut final_poly = vec![F::zero(); points.len()];
+        let mut final_poly = vec![F::ZERO; points.len()];
         for (j, (denoms, eval)) in denoms.into_iter().zip(evals.iter()).enumerate() {
             let mut tmp: Vec<F> = Vec::with_capacity(points.len());
             let mut product = Vec::with_capacity(points.len() - 1);
-            tmp.push(F::one());
+            tmp.push(F::ONE);
             for (x_k, denom) in points
                 .iter()
                 .enumerate()
@@ -580,11 +595,11 @@ pub fn lagrange_interpolate<F: FieldExt>(points: &[F], evals: &[F]) -> Vec<F> {
                 .map(|a| a.1)
                 .zip(denoms.into_iter())
             {
-                product.resize(tmp.len() + 1, F::zero());
+                product.resize(tmp.len() + 1, F::ZERO);
                 for ((a, b), product) in tmp
                     .iter()
-                    .chain(std::iter::once(&F::zero()))
-                    .zip(std::iter::once(&F::zero()).chain(tmp.iter()))
+                    .chain(std::iter::once(&F::ZERO))
+                    .zip(std::iter::once(&F::ZERO).chain(tmp.iter()))
                     .zip(product.iter_mut())
                 {
                     *product = *a * (-denom * x_k) + *b * denom;
@@ -601,9 +616,9 @@ pub fn lagrange_interpolate<F: FieldExt>(points: &[F], evals: &[F]) -> Vec<F> {
     }
 }
 
-pub(crate) fn evaluate_vanishing_polynomial<F: FieldExt>(roots: &[F], z: F) -> F {
-    fn evaluate<F: FieldExt>(roots: &[F], z: F) -> F {
-        roots.iter().fold(F::one(), |acc, point| (z - point) * acc)
+pub(crate) fn evaluate_vanishing_polynomial<F: Field>(roots: &[F], z: F) -> F {
+    fn evaluate<F: Field>(roots: &[F], z: F) -> F {
+        roots.iter().fold(F::ONE, |acc, point| (z - point) * acc)
     }
     let n = roots.len();
     let num_threads = multicore::current_num_threads();
@@ -611,18 +626,18 @@ pub(crate) fn evaluate_vanishing_polynomial<F: FieldExt>(roots: &[F], z: F) -> F
         evaluate(roots, z)
     } else {
         let chunk_size = (n + num_threads - 1) / num_threads;
-        let mut parts = vec![F::one(); num_threads];
+        let mut parts = vec![F::ONE; num_threads];
         multicore::scope(|scope| {
             for (out, roots) in parts.chunks_mut(1).zip(roots.chunks(chunk_size)) {
                 scope.spawn(move |_| out[0] = evaluate(roots, z));
             }
         });
-        parts.iter().fold(F::one(), |acc, part| acc * part)
+        parts.iter().fold(F::ONE, |acc, part| acc * part)
     }
 }
 
-pub(crate) fn powers<F: FieldExt>(base: F) -> impl Iterator<Item = F> {
-    std::iter::successors(Some(F::one()), move |power| Some(base * power))
+pub(crate) fn powers<F: Field>(base: F) -> impl Iterator<Item = F> {
+    std::iter::successors(Some(F::ONE), move |power| Some(base * power))
 }
 
 #[cfg(test)]
diff --git a/halo2_proofs/src/circuit.rs b/halo2_proofs/src/circuit.rs
index 52db772c94..508820f029 100644
--- a/halo2_proofs/src/circuit.rs
+++ b/halo2_proofs/src/circuit.rs
@@ -4,11 +4,8 @@ use std::{convert::TryInto, fmt, marker::PhantomData};
 
 use ff::Field;
 
-use crate::{
-    arithmetic::FieldExt,
-    plonk::{
-        Advice, Any, Assigned, Challenge, Column, Error, Fixed, Instance, Selector, TableColumn,
-    },
+use crate::plonk::{
+    Advice, Any, Assigned, Challenge, Column, Error, Fixed, Instance, Selector, TableColumn,
 };
 
 mod value;
@@ -28,7 +25,7 @@ pub mod layouter;
 /// The chip also loads any fixed configuration needed at synthesis time
 /// using its own implementation of `load`, and stores it in [`Chip::Loaded`].
 /// This can be accessed via [`Chip::loaded`].
-pub trait Chip<F: FieldExt>: Sized {
+pub trait Chip<F: Field>: Sized {
     /// A type that holds the configuration for this chip, and any other state it may need
     /// during circuit synthesis, that can be derived during [`Circuit::configure`].
     ///
diff --git a/halo2_proofs/src/circuit/layouter.rs b/halo2_proofs/src/circuit/layouter.rs
index f73d7d7d73..4b9d74b69a 100644
--- a/halo2_proofs/src/circuit/layouter.rs
+++ b/halo2_proofs/src/circuit/layouter.rs
@@ -14,7 +14,7 @@ use crate::plonk::{Advice, Any, Assigned, Column, Error, Fixed, Instance, Select
 /// This trait is used for implementing region assignments:
 ///
 /// ```ignore
-/// impl<'a, F: FieldExt, C: Chip<F>, CS: Assignment<F> + 'a> Layouter<C> for MyLayouter<'a, C, CS> {
+/// impl<'a, F: Field, C: Chip<F>, CS: Assignment<F> + 'a> Layouter<C> for MyLayouter<'a, C, CS> {
 ///     fn assign_region(
 ///         &mut self,
 ///         assignment: impl FnOnce(Region<'_, F, C>) -> Result<(), Error>,
diff --git a/halo2_proofs/src/dev.rs b/halo2_proofs/src/dev.rs
index 28ca17a082..34d7f7b1b3 100644
--- a/halo2_proofs/src/dev.rs
+++ b/halo2_proofs/src/dev.rs
@@ -9,11 +9,12 @@ use std::sync::Arc;
 use std::time::{Duration, Instant};
 
 use blake2b_simd::blake2b;
+use ff::FromUniformBytes;
 use ff::{BatchInvert, Field};
+use group::Group;
 
 use crate::plonk::permutation::keygen::Assembly;
 use crate::{
-    arithmetic::{FieldExt, Group},
     circuit,
     plonk::{
         permutation,
@@ -96,8 +97,8 @@ impl Region {
 }
 
 /// The value of a particular cell within the circuit.
-#[derive(Clone, Copy, Debug)]
-pub enum CellValue<F: Group + Field> {
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum CellValue<F: Field> {
     /// An unassigned cell.
     Unassigned,
     /// A cell that has been assigned a value.
@@ -235,16 +236,16 @@ fn batch_invert_cellvalues<F: Field + Group>(cell_values: &mut [Vec<CellValue<F>
 
 /// A value within an expression.
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Ord, PartialOrd)]
-enum Value<F: Group + Field> {
+enum Value<F: Field> {
     Real(F),
     Poison,
 }
 
-impl<F: Group + Field> From<CellValue<F>> for Value<F> {
+impl<F: Field> From<CellValue<F>> for Value<F> {
     fn from(value: CellValue<F>) -> Self {
         match value {
             // Cells that haven't been explicitly assigned to, default to zero.
-            CellValue::Unassigned => Value::Real(F::zero()),
+            CellValue::Unassigned => Value::Real(F::ZERO),
             CellValue::Assigned(v) => Value::Real(v),
             #[cfg(feature = "mock-batch-inv")]
             CellValue::Rational(n, d) => Value::Real(n * d.invert().unwrap()),
@@ -253,7 +254,7 @@ impl<F: Group + Field> From<CellValue<F>> for Value<F> {
     }
 }
 
-impl<F: Group + Field> Neg for Value<F> {
+impl<F: Field> Neg for Value<F> {
     type Output = Self;
 
     fn neg(self) -> Self::Output {
@@ -264,7 +265,7 @@ impl<F: Group + Field> Neg for Value<F> {
     }
 }
 
-impl<F: Group + Field> Add for Value<F> {
+impl<F: Field> Add for Value<F> {
     type Output = Self;
 
     fn add(self, rhs: Self) -> Self::Output {
@@ -275,7 +276,7 @@ impl<F: Group + Field> Add for Value<F> {
     }
 }
 
-impl<F: Group + Field> Mul for Value<F> {
+impl<F: Field> Mul for Value<F> {
     type Output = Self;
 
     fn mul(self, rhs: Self) -> Self::Output {
@@ -286,14 +287,14 @@ impl<F: Group + Field> Mul for Value<F> {
             (Value::Real(x), Value::Poison) | (Value::Poison, Value::Real(x))
                 if x.is_zero_vartime() =>
             {
-                Value::Real(F::zero())
+                Value::Real(F::ZERO)
             }
             _ => Value::Poison,
         }
     }
 }
 
-impl<F: Group + Field> Mul<F> for Value<F> {
+impl<F: Field> Mul<F> for Value<F> {
     type Output = Self;
 
     fn mul(self, rhs: F) -> Self::Output {
@@ -301,7 +302,7 @@ impl<F: Group + Field> Mul<F> for Value<F> {
             Value::Real(lhs) => Value::Real(lhs * rhs),
             // If poison is multiplied by zero, then we treat the poison as unconstrained
             // and we don't propagate it.
-            Value::Poison if rhs.is_zero_vartime() => Value::Real(F::zero()),
+            Value::Poison if rhs.is_zero_vartime() => Value::Real(F::ZERO),
             _ => Value::Poison,
         }
     }
@@ -319,12 +320,12 @@ impl<F: Group + Field> Mul<F> for Value<F> {
 ///
 /// ```
 /// use halo2_proofs::{
-///     arithmetic::FieldExt,
 ///     circuit::{Layouter, SimpleFloorPlanner, Value},
 ///     dev::{FailureLocation, MockProver, VerifyFailure},
 ///     plonk::{Advice, Any, Circuit, Column, ConstraintSystem, Error, Selector},
 ///     poly::Rotation,
 /// };
+/// use ff::PrimeField;
 /// use halo2curves::pasta::Fp;
 /// const K: u32 = 5;
 ///
@@ -342,7 +343,7 @@ impl<F: Group + Field> Mul<F> for Value<F> {
 ///     b: Value<u64>,
 /// }
 ///
-/// impl<F: FieldExt> Circuit<F> for MyCircuit {
+/// impl<F: PrimeField> Circuit<F> for MyCircuit {
 ///     type Config = MyConfig;
 ///     type FloorPlanner = SimpleFloorPlanner;
 ///
@@ -421,7 +422,7 @@ impl<F: Group + Field> Mul<F> for Value<F> {
 /// ));
 /// ```
 #[derive(Debug)]
-pub struct MockProver<'a, F: Group + Field> {
+pub struct MockProver<'a, F: Field> {
     k: u32,
     n: u32,
     cs: ConstraintSystem<F>,
@@ -459,13 +460,13 @@ pub struct MockProver<'a, F: Group + Field> {
     current_phase: sealed::Phase, // crate::plonk::sealed::Phase,
 }
 
-impl<'a, F: Field + Group> MockProver<'a, F> {
+impl<'a, F: Field> MockProver<'a, F> {
     fn in_phase<P: Phase>(&self, phase: P) -> bool {
         self.current_phase == phase.to_sealed()
     }
 }
 
-impl<'a, F: Field + Group> Assignment<F> for MockProver<'a, F> {
+impl<'a, F: Field> Assignment<F> for MockProver<'a, F> {
     fn enter_region<NR, N>(&mut self, name: N)
     where
         NR: Into<String>,
@@ -913,7 +914,7 @@ impl<'a, F: Field + Group> Assignment<F> for MockProver<'a, F> {
     }
 }
 
-impl<'a, F: FieldExt> MockProver<'a, F> {
+impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
     /// Runs a synthetic keygen-and-prove operation on the given circuit, collecting data
     /// about the constraints and their assignments.
     pub fn run<ConcreteCircuit: Circuit<F>>(
@@ -942,7 +943,7 @@ impl<'a, F: FieldExt> MockProver<'a, F> {
                     return Err(Error::InstanceTooLarge);
                 }
 
-                instance.resize(n, F::zero());
+                instance.resize(n, F::ZERO);
                 Ok(instance)
             })
             .collect::<Result<Vec<_>, _>>()?;
@@ -978,7 +979,7 @@ impl<'a, F: FieldExt> MockProver<'a, F> {
             let mut hash: [u8; 64] = blake2b(b"Halo2-MockProver").as_bytes().try_into().unwrap();
             iter::repeat_with(|| {
                 hash = blake2b(&hash).as_bytes().try_into().unwrap();
-                F::from_bytes_wide(&hash)
+                F::from_uniform_bytes(&hash)
             })
             .take(cs.num_challenges)
             .collect()
@@ -1231,7 +1232,7 @@ impl<'a, F: FieldExt> MockProver<'a, F> {
                                 &|a, b| a + b,
                                 &|a, b| a * b,
                                 &|a, scalar| a * scalar,
-                                &Value::Real(F::zero()),
+                                &Value::Real(F::ZERO),
                             ) {
                                 Value::Real(x) if x.is_zero_vartime() => None,
                                 Value::Real(_) => Some(VerifyFailure::ConstraintNotSatisfied {
@@ -1326,7 +1327,7 @@ impl<'a, F: FieldExt> MockProver<'a, F> {
                             &|a, b| a + b,
                             &|a, b| a * b,
                             &|a, scalar| a * scalar,
-                            &Value::Real(F::zero()),
+                            &Value::Real(F::ZERO),
                         )
                     };
 
@@ -1617,7 +1618,7 @@ impl<'a, F: FieldExt> MockProver<'a, F> {
                                 &|a, b| a + b,
                                 &|a, b| a * b,
                                 &|a, scalar| a * scalar,
-                                &Value::Real(F::zero()),
+                                &Value::Real(F::ZERO),
                             ) {
                                 Value::Real(x) if x.is_zero_vartime() => None,
                                 Value::Real(_) => Some(VerifyFailure::ConstraintNotSatisfied {
@@ -1705,7 +1706,7 @@ impl<'a, F: FieldExt> MockProver<'a, F> {
                             &|a, b| a + b,
                             &|a, b| a * b,
                             &|a, scalar| a * scalar,
-                            &Value::Real(F::zero()),
+                            &Value::Real(F::ZERO),
                         )
                     };
 
diff --git a/halo2_proofs/src/dev/failure.rs b/halo2_proofs/src/dev/failure.rs
index 229cb171f4..54b7a473db 100644
--- a/halo2_proofs/src/dev/failure.rs
+++ b/halo2_proofs/src/dev/failure.rs
@@ -2,7 +2,6 @@ use std::collections::{BTreeMap, HashSet};
 use std::fmt::{self, Debug};
 
 use group::ff::Field;
-use halo2curves::FieldExt;
 
 use super::metadata::{DebugColumn, DebugVirtualCell};
 use super::MockProver;
@@ -444,7 +443,7 @@ fn render_constraint_not_satisfied<F: Field>(
 ///     |   x0 = 0x5
 ///     |   x1 = 1
 /// ```
-fn render_lookup<F: FieldExt>(
+fn render_lookup<F: Field>(
     prover: &MockProver<F>,
     name: &str,
     lookup_index: usize,
@@ -510,7 +509,7 @@ fn render_lookup<F: FieldExt>(
         )
     });
 
-    fn cell_value<'a, F: FieldExt, Q: Into<AnyQuery> + Copy>(
+    fn cell_value<'a, F: Field, Q: Into<AnyQuery> + Copy>(
         load: impl Fn(Q) -> Value<F> + 'a,
     ) -> impl Fn(Q) -> BTreeMap<metadata::VirtualCell, String> + 'a {
         move |query| {
@@ -624,7 +623,7 @@ fn render_lookup<F: FieldExt>(
 
 impl VerifyFailure {
     /// Emits this failure in pretty-printed format to stderr.
-    pub(super) fn emit<F: FieldExt>(&self, prover: &MockProver<F>) {
+    pub(super) fn emit<F: Field>(&self, prover: &MockProver<F>) {
         match self {
             Self::CellNotAssigned {
                 gate,
diff --git a/halo2_proofs/src/dev/util.rs b/halo2_proofs/src/dev/util.rs
index 83126e79c7..353f9869f6 100644
--- a/halo2_proofs/src/dev/util.rs
+++ b/halo2_proofs/src/dev/util.rs
@@ -1,7 +1,5 @@
-use std::collections::BTreeMap;
-
 use group::ff::Field;
-use halo2curves::FieldExt;
+use std::collections::BTreeMap;
 
 use super::{metadata, CellValue, Value};
 use crate::{
@@ -59,9 +57,9 @@ impl From<InstanceQuery> for AnyQuery {
 pub(super) fn format_value<F: Field>(v: F) -> String {
     if v.is_zero_vartime() {
         "0".into()
-    } else if v == F::one() {
+    } else if v == F::ONE {
         "1".into()
-    } else if v == -F::one() {
+    } else if v == -F::ONE {
         "-1".into()
     } else {
         // Format value as hex.
@@ -74,7 +72,7 @@ pub(super) fn format_value<F: Field>(v: F) -> String {
 }
 
 /*
-pub(super) fn load<'a, F: FieldExt, T: ColumnType, Q: Into<AnyQuery> + Copy>(
+pub(super) fn load<'a, F: Field, T: ColumnType, Q: Into<AnyQuery> + Copy>(
     n: i32,
     row: i32,
     queries: &'a [(Column<T>, Rotation)],
@@ -101,7 +99,7 @@ pub(super) fn load_slice<'a, F: FieldExt, T: ColumnType, Q: Into<AnyQuery> + Cop
     }
 }
 
-pub(super) fn load_instance<'a, F: FieldExt, T: ColumnType, Q: Into<AnyQuery> + Copy>(
+pub(super) fn load_instance<'a, F: Field, T: ColumnType, Q: Into<AnyQuery> + Copy>(
     n: i32,
     row: i32,
     queries: &'a [(Column<T>, Rotation)],
@@ -114,7 +112,7 @@ pub(super) fn load_instance<'a, F: FieldExt, T: ColumnType, Q: Into<AnyQuery> +
     }
 }
 
-fn cell_value<'a, F: FieldExt, Q: Into<AnyQuery> + Copy>(
+fn cell_value<'a, F: Field, Q: Into<AnyQuery> + Copy>(
     virtual_cells: &'a [VirtualCell],
     load: impl Fn(Q) -> Value<F> + 'a,
 ) -> impl Fn(Q) -> BTreeMap<metadata::VirtualCell, String> + 'a {
@@ -147,7 +145,7 @@ fn cell_value<'a, F: FieldExt, Q: Into<AnyQuery> + Copy>(
     }
 }
 
-pub(super) fn cell_values<'a, F: FieldExt>(
+pub(super) fn cell_values<'a, F: Field>(
     gate: &Gate<F>,
     poly: &Expression<F>,
     load_fixed: impl Fn(FixedQuery) -> Value<F> + 'a,
diff --git a/halo2_proofs/src/plonk.rs b/halo2_proofs/src/plonk.rs
index f2e2ce7df8..786ca29a42 100644
--- a/halo2_proofs/src/plonk.rs
+++ b/halo2_proofs/src/plonk.rs
@@ -6,11 +6,10 @@
 //! [plonk]: https://eprint.iacr.org/2019/953
 
 use blake2b_simd::Params as Blake2bParams;
-use ff::PrimeField;
-use group::ff::Field;
+use group::ff::{Field, FromUniformBytes, PrimeField};
 use halo2curves::pairing::Engine;
 
-use crate::arithmetic::{CurveAffine, FieldExt};
+use crate::arithmetic::CurveAffine;
 use crate::helpers::{
     polynomial_slice_byte_length, read_polynomial_vec, write_polynomial_slice, SerdeCurveAffine,
     SerdePrimeField,
@@ -61,7 +60,7 @@ pub struct VerifyingKey<C: CurveAffine> {
 
 impl<C: SerdeCurveAffine> VerifyingKey<C>
 where
-    C::Scalar: SerdePrimeField,
+    C::Scalar: SerdePrimeField + FromUniformBytes<64>,
 {
     /// Writes a verifying key to a buffer.
     ///
@@ -151,7 +150,10 @@ where
     }
 }
 
-impl<C: CurveAffine> VerifyingKey<C> {
+impl<C: CurveAffine> VerifyingKey<C>
+where
+    C::ScalarExt: FromUniformBytes<64>,
+{
     fn bytes_length(&self) -> usize {
         8 + (self.fixed_commitments.len() * C::default().to_bytes().as_ref().len())
             + self.permutation.bytes_length()
@@ -182,7 +184,7 @@ impl<C: CurveAffine> VerifyingKey<C> {
             cs,
             cs_degree,
             // Temporary, this is not pinned.
-            transcript_repr: C::Scalar::zero(),
+            transcript_repr: C::Scalar::ZERO,
             //selectors,
         };
 
@@ -197,7 +199,7 @@ impl<C: CurveAffine> VerifyingKey<C> {
         hasher.update(s.as_bytes());
 
         // Hash in final Blake2bState
-        vk.transcript_repr = C::Scalar::from_bytes_wide(hasher.finalize().as_array());
+        vk.transcript_repr = C::Scalar::from_uniform_bytes(hasher.finalize().as_array());
 
         vk
     }
@@ -267,7 +269,10 @@ pub struct ProvingKey<C: CurveAffine> {
     ev: Evaluator<C>,
 }
 
-impl<C: CurveAffine> ProvingKey<C> {
+impl<C: CurveAffine> ProvingKey<C>
+where
+    C::Scalar: FromUniformBytes<64>,
+{
     /// Get the underlying [`VerifyingKey`].
     pub fn get_vk(&self) -> &VerifyingKey<C> {
         &self.vk
@@ -288,7 +293,7 @@ impl<C: CurveAffine> ProvingKey<C> {
 
 impl<C: SerdeCurveAffine> ProvingKey<C>
 where
-    C::Scalar: SerdePrimeField,
+    C::Scalar: SerdePrimeField + FromUniformBytes<64>,
 {
     /// Writes a proving key to a buffer.
     ///
diff --git a/halo2_proofs/src/plonk/assigned.rs b/halo2_proofs/src/plonk/assigned.rs
index 7524291e4c..46d527b915 100644
--- a/halo2_proofs/src/plonk/assigned.rs
+++ b/halo2_proofs/src/plonk/assigned.rs
@@ -280,7 +280,7 @@ impl<F: Field> Assigned<F> {
     /// Returns the numerator.
     pub fn numerator(&self) -> F {
         match self {
-            Self::Zero => F::zero(),
+            Self::Zero => F::ZERO,
             Self::Trivial(x) => *x,
             Self::Rational(numerator, _) => *numerator,
         }
@@ -341,7 +341,7 @@ impl<F: Field> Assigned<F> {
     pub fn invert(&self) -> Self {
         match self {
             Self::Zero => Self::Zero,
-            Self::Trivial(x) => Self::Rational(F::one(), *x),
+            Self::Trivial(x) => Self::Rational(F::ONE, *x),
             Self::Rational(numerator, denominator) => Self::Rational(*denominator, *numerator),
         }
     }
@@ -352,13 +352,13 @@ impl<F: Field> Assigned<F> {
     /// If the denominator is zero, this returns zero.
     pub fn evaluate(self) -> F {
         match self {
-            Self::Zero => F::zero(),
+            Self::Zero => F::ZERO,
             Self::Trivial(x) => x,
             Self::Rational(numerator, denominator) => {
-                if denominator == F::one() {
+                if denominator == F::ONE {
                     numerator
                 } else {
-                    numerator * denominator.invert().unwrap_or(F::zero())
+                    numerator * denominator.invert().unwrap_or(F::ZERO)
                 }
             }
         }
@@ -451,7 +451,7 @@ mod proptests {
     };
 
     use group::ff::Field;
-    use halo2curves::{pasta::Fp, FieldExt};
+    use halo2curves::pasta::Fp;
     use proptest::{collection::vec, prelude::*, sample::select};
 
     use super::Assigned;
@@ -477,7 +477,7 @@ mod proptests {
         }
 
         fn inv0(&self) -> Self {
-            self.invert().unwrap_or(F::zero())
+            self.invert().unwrap_or(F::ZERO)
         }
     }
 
diff --git a/halo2_proofs/src/plonk/circuit.rs b/halo2_proofs/src/plonk/circuit.rs
index f0329fbe85..9b132b4ea0 100644
--- a/halo2_proofs/src/plonk/circuit.rs
+++ b/halo2_proofs/src/plonk/circuit.rs
@@ -355,11 +355,10 @@ impl TryFrom<Column<Any>> for Column<Instance> {
 /// row when required:
 /// ```
 /// use halo2_proofs::{
-///     arithmetic::FieldExt,
 ///     circuit::{Chip, Layouter, Value},
 ///     plonk::{Advice, Column, Error, Selector},
 /// };
-/// # use ff::Field;
+/// use ff::Field;
 /// # use halo2_proofs::plonk::Fixed;
 ///
 /// struct Config {
@@ -368,12 +367,12 @@ impl TryFrom<Column<Any>> for Column<Instance> {
 ///     s: Selector,
 /// }
 ///
-/// fn circuit_logic<F: FieldExt, C: Chip<F>>(chip: C, mut layouter: impl Layouter<F>) -> Result<(), Error> {
+/// fn circuit_logic<F: Field, C: Chip<F>>(chip: C, mut layouter: impl Layouter<F>) -> Result<(), Error> {
 ///     let config = chip.config();
 ///     # let config: Config = todo!();
 ///     layouter.assign_region(|| "bar", |mut region| {
-///         region.assign_advice(|| "a", config.a, 0, || Value::known(F::one()))?;
-///         region.assign_advice(|| "a", config.b, 1, || Value::known(F::one()))?;
+///         region.assign_advice(|| "a", config.a, 0, || Value::known(F::ONE))?;
+///         region.assign_advice(|| "a", config.b, 1, || Value::known(F::ONE))?;
 ///         config.s.enable(&mut region, 1)
 ///     })?;
 ///     Ok(())
diff --git a/halo2_proofs/src/plonk/circuit/compress_selectors.rs b/halo2_proofs/src/plonk/circuit/compress_selectors.rs
index 0e8db9ffc8..60898d3950 100644
--- a/halo2_proofs/src/plonk/circuit/compress_selectors.rs
+++ b/halo2_proofs/src/plonk/circuit/compress_selectors.rs
@@ -81,7 +81,7 @@ where
             let combination_assignment = selector
                 .activations
                 .iter()
-                .map(|b| if *b { F::one() } else { F::zero() })
+                .map(|b| if *b { F::ONE } else { F::ZERO })
                 .collect::<Vec<_>>();
             let combination_index = combination_assignments.len();
             combination_assignments.push(combination_assignment);
@@ -179,12 +179,12 @@ where
         }
 
         // Now, compute the selector and combination assignments.
-        let mut combination_assignment = vec![F::zero(); n];
+        let mut combination_assignment = vec![F::ZERO; n];
         let combination_len = combination.len();
         let combination_index = combination_assignments.len();
         let query = allocate_fixed_column();
 
-        let mut assigned_root = F::one();
+        let mut assigned_root = F::ONE;
         selector_assignments.extend(combination.into_iter().map(|selector| {
             // Compute the expression for substitution. This produces an expression of the
             // form
@@ -194,12 +194,12 @@ where
             // `assigned_root`. In particular, rows set to 0 correspond to all selectors
             // being disabled.
             let mut expression = query.clone();
-            let mut root = F::one();
+            let mut root = F::ONE;
             for _ in 0..combination_len {
                 if root != assigned_root {
                     expression = expression * (Expression::Constant(root) - query.clone());
                 }
-                root += F::one();
+                root += F::ONE;
             }
 
             // Update the combination assignment
@@ -214,7 +214,7 @@ where
                 }
             }
 
-            assigned_root += F::one();
+            assigned_root += F::ONE;
 
             SelectorAssignment {
                 selector: selector.selector,
diff --git a/halo2_proofs/src/plonk/evaluation.rs b/halo2_proofs/src/plonk/evaluation.rs
index c9c9a5cbf1..2f08a43e01 100644
--- a/halo2_proofs/src/plonk/evaluation.rs
+++ b/halo2_proofs/src/plonk/evaluation.rs
@@ -4,7 +4,7 @@ use crate::plonk::permutation::Argument;
 use crate::plonk::{lookup, permutation, AdviceQuery, Any, FixedQuery, InstanceQuery, ProvingKey};
 use crate::poly::Basis;
 use crate::{
-    arithmetic::{eval_polynomial, parallelize, CurveAffine, FieldExt},
+    arithmetic::{eval_polynomial, parallelize, CurveAffine},
     poly::{
         commitment::Params, Coeff, EvaluationDomain, ExtendedLagrangeCoeff, LagrangeCoeff,
         Polynomial, ProverQuery, Rotation,
@@ -13,7 +13,7 @@ use crate::{
 };
 use group::prime::PrimeCurve;
 use group::{
-    ff::{BatchInvert, Field},
+    ff::{BatchInvert, Field, PrimeField, WithSmallOrderMulGroup},
     Curve,
 };
 use std::any::TypeId;
@@ -296,7 +296,7 @@ impl<C: CurveAffine> Evaluator<C> {
         let extended_omega = domain.get_extended_omega();
         let omega = domain.get_omega();
         let isize = size as i32;
-        let one = C::ScalarExt::one();
+        let one = C::ScalarExt::ONE;
         let p = &pk.vk.cs.permutation;
         let num_parts = domain.extended_len() >> domain.k();
 
@@ -527,7 +527,7 @@ impl<C: CurveAffine> Evaluator<C> {
                                     &gamma,
                                     &theta,
                                     &y,
-                                    &C::ScalarExt::zero(),
+                                    &C::ScalarExt::ZERO,
                                     idx,
                                     rot_scale,
                                     isize,
@@ -587,8 +587,8 @@ impl<C: CurveAffine> Default for GraphEvaluator<C> {
         Self {
             // Fixed positions to allow easy access
             constants: vec![
-                C::ScalarExt::zero(),
-                C::ScalarExt::one(),
+                C::ScalarExt::ZERO,
+                C::ScalarExt::ONE,
                 C::ScalarExt::from(2u64),
             ],
             rotations: Vec::new(),
@@ -736,9 +736,9 @@ impl<C: CurveAffine> GraphEvaluator<C> {
                 }
             }
             Expression::Scaled(a, f) => {
-                if *f == C::ScalarExt::zero() {
+                if *f == C::ScalarExt::ZERO {
                     ValueSource::Constant(0)
-                } else if *f == C::ScalarExt::one() {
+                } else if *f == C::ScalarExt::ONE {
                     self.add_expression(a)
                 } else {
                     let cst = self.add_constant(f);
@@ -752,7 +752,7 @@ impl<C: CurveAffine> GraphEvaluator<C> {
     /// Creates a new evaluation structure
     pub fn instance(&self) -> EvaluationData<C> {
         EvaluationData {
-            intermediates: vec![C::ScalarExt::zero(); self.num_intermediates],
+            intermediates: vec![C::ScalarExt::ZERO; self.num_intermediates],
             rotations: vec![0usize; self.rotations.len()],
         }
     }
@@ -800,13 +800,13 @@ impl<C: CurveAffine> GraphEvaluator<C> {
         if let Some(calc) = self.calculations.last() {
             data.intermediates[calc.target]
         } else {
-            C::ScalarExt::zero()
+            C::ScalarExt::ZERO
         }
     }
 }
 
 /// Simple evaluation of an expression
-pub fn evaluate<F: FieldExt, B: Basis>(
+pub fn evaluate<F: Field, B: Basis>(
     expression: &Expression<F>,
     size: usize,
     rot_scale: i32,
@@ -815,7 +815,7 @@ pub fn evaluate<F: FieldExt, B: Basis>(
     instance: &[Polynomial<F, B>],
     challenges: &[F],
 ) -> Vec<F> {
-    let mut values = vec![F::zero(); size];
+    let mut values = vec![F::ZERO; size];
     let isize = size as i32;
     parallelize(&mut values, |values, start| {
         for (i, value) in values.iter_mut().enumerate() {
diff --git a/halo2_proofs/src/plonk/keygen.rs b/halo2_proofs/src/plonk/keygen.rs
index 2f461491f6..10a3660d9f 100644
--- a/halo2_proofs/src/plonk/keygen.rs
+++ b/halo2_proofs/src/plonk/keygen.rs
@@ -3,7 +3,7 @@
 use std::ops::Range;
 use std::sync::Arc;
 
-use ff::Field;
+use ff::{Field, FromUniformBytes};
 use group::Curve;
 
 use super::{
@@ -329,6 +329,7 @@ where
     C: CurveAffine,
     P: Params<'params, C>,
     ConcreteCircuit: Circuit<C::Scalar>,
+    C::Scalar: FromUniformBytes<64>,
 {
     let (domain, cs, config) = create_domain::<C, ConcreteCircuit>(params.k());
 
@@ -540,23 +541,23 @@ where
     // Compute l_0(X)
     // TODO: this can be done more efficiently
     let mut l0 = vk.domain.empty_lagrange();
-    l0[0] = C::Scalar::one();
+    l0[0] = C::Scalar::ONE;
     let l0 = vk.domain.lagrange_to_coeff(l0);
 
     // Compute l_blind(X) which evaluates to 1 for each blinding factor row
     // and 0 otherwise over the domain.
     let mut l_blind = vk.domain.empty_lagrange();
     for evaluation in l_blind[..].iter_mut().rev().take(cs.blinding_factors()) {
-        *evaluation = C::Scalar::one();
+        *evaluation = C::Scalar::ONE;
     }
 
     // Compute l_last(X) which evaluates to 1 on the first inactive row (just
     // before the blinding factors) and 0 otherwise over the domain
     let mut l_last = vk.domain.empty_lagrange();
-    l_last[params.n() as usize - cs.blinding_factors() - 1] = C::Scalar::one();
+    l_last[params.n() as usize - cs.blinding_factors() - 1] = C::Scalar::ONE;
 
     // Compute l_active_row(X)
-    let one = C::Scalar::one();
+    let one = C::Scalar::ONE;
     let mut l_active_row = vk.domain.empty_lagrange();
     parallelize(&mut l_active_row, |values, start| {
         for (i, value) in values.iter_mut().enumerate() {
diff --git a/halo2_proofs/src/plonk/lookup/prover.rs b/halo2_proofs/src/plonk/lookup/prover.rs
index f5d87d061e..0f0c85d7e3 100644
--- a/halo2_proofs/src/plonk/lookup/prover.rs
+++ b/halo2_proofs/src/plonk/lookup/prover.rs
@@ -5,7 +5,7 @@ use super::super::{
 use super::Argument;
 use crate::plonk::evaluation::evaluate;
 use crate::{
-    arithmetic::{eval_polynomial, parallelize, CurveAffine, FieldExt},
+    arithmetic::{eval_polynomial, parallelize, CurveAffine},
     poly::{
         commitment::{Blind, Params},
         Coeff, EvaluationDomain, ExtendedLagrangeCoeff, LagrangeCoeff, Polynomial, ProverQuery,
@@ -13,6 +13,7 @@ use crate::{
     },
     transcript::{EncodedChallenge, TranscriptWrite},
 };
+use ff::WithSmallOrderMulGroup;
 use group::{
     ff::{BatchInvert, Field},
     Curve,
@@ -51,7 +52,7 @@ pub(in crate::plonk) struct Evaluated<C: CurveAffine> {
     constructed: Committed<C>,
 }
 
-impl<F: FieldExt> Argument<F> {
+impl<F: WithSmallOrderMulGroup<3>> Argument<F> {
     /// Given a Lookup with input expressions [A_0, A_1, ..., A_{m-1}] and table expressions
     /// [S_0, S_1, ..., S_{m-1}], this method
     /// - constructs A_compressed = \theta^{m-1} A_0 + theta^{m-2} A_1 + ... + \theta A_{m-2} + A_{m-1}
@@ -191,7 +192,7 @@ impl<C: CurveAffine> Permuted<C> {
         // s_j(X) is the jth table expression in this lookup,
         // s'(X) is the compression of the permuted table expressions,
         // and i is the ith row of the expression.
-        let mut lookup_product = vec![C::Scalar::zero(); params.n() as usize];
+        let mut lookup_product = vec![C::Scalar::ZERO; params.n() as usize];
         // Denominator uses the permuted input expression and permuted table expression
         parallelize(&mut lookup_product, |lookup_product, start| {
             for ((lookup_product, permuted_input_value), permuted_table_value) in lookup_product
@@ -234,9 +235,9 @@ impl<C: CurveAffine> Permuted<C> {
 
         // Compute the evaluations of the lookup product polynomial
         // over our domain, starting with z[0] = 1
-        let z = iter::once(C::Scalar::one())
+        let z = iter::once(C::Scalar::ONE)
             .chain(lookup_product)
-            .scan(C::Scalar::one(), |state, cur| {
+            .scan(C::Scalar::ONE, |state, cur| {
                 *state *= &cur;
                 Some(*state)
             })
@@ -257,7 +258,7 @@ impl<C: CurveAffine> Permuted<C> {
             let u = (params.n() as usize) - (blinding_factors + 1);
 
             // l_0(X) * (1 - z(X)) = 0
-            assert_eq!(z[0], C::Scalar::one());
+            assert_eq!(z[0], C::Scalar::ONE);
 
             // z(\omega X) (a'(X) + \beta) (s'(X) + \gamma)
             // - z(X) (\theta^{m-1} a_0(X) + ... + a_{m-1}(X) + \beta) (\theta^{m-1} s_0(X) + ... + s_{m-1}(X) + \gamma)
@@ -284,7 +285,7 @@ impl<C: CurveAffine> Permuted<C> {
             // l_last(X) * (z(X)^2 - z(X)) = 0
             // Assertion will fail only when soundness is broken, in which
             // case this z[u] value will be zero. (bad!)
-            assert_eq!(z[u], C::Scalar::one());
+            assert_eq!(z[u], C::Scalar::ONE);
         }
 
         let product_blind = Blind(C::Scalar::random(rng));
@@ -413,7 +414,7 @@ fn permute_expression_pair<'params, C: CurveAffine, P: Params<'params, C>, R: Rn
             *acc.entry(*coeff).or_insert(0) += 1;
             acc
         });
-    let mut permuted_table_coeffs = vec![C::Scalar::zero(); usable_rows];
+    let mut permuted_table_coeffs = vec![C::Scalar::ZERO; usable_rows];
 
     let mut repeated_input_rows = permuted_input_expression
         .iter()
diff --git a/halo2_proofs/src/plonk/lookup/verifier.rs b/halo2_proofs/src/plonk/lookup/verifier.rs
index add4e592c9..990866b786 100644
--- a/halo2_proofs/src/plonk/lookup/verifier.rs
+++ b/halo2_proofs/src/plonk/lookup/verifier.rs
@@ -5,7 +5,7 @@ use super::super::{
 };
 use super::Argument;
 use crate::{
-    arithmetic::{CurveAffine, FieldExt},
+    arithmetic::CurveAffine,
     plonk::{Error, VerifyingKey},
     poly::{commitment::MSM, Rotation, VerifierQuery},
     transcript::{EncodedChallenge, TranscriptRead},
@@ -34,7 +34,7 @@ pub struct Evaluated<C: CurveAffine> {
     pub permuted_table_eval: C::Scalar,
 }
 
-impl<F: FieldExt> Argument<F> {
+impl<F: Field> Argument<F> {
     pub fn read_permuted_commitments<
         C: CurveAffine,
         E: EncodedChallenge<C>,
@@ -104,7 +104,7 @@ impl<C: CurveAffine> Evaluated<C> {
         instance_evals: &[C::Scalar],
         challenges: &[C::Scalar],
     ) -> impl Iterator<Item = C::Scalar> + 'a {
-        let active_rows = C::Scalar::one() - (l_last + l_blind);
+        let active_rows = C::Scalar::ONE - (l_last + l_blind);
 
         let product_expression = || {
             // z(\omega X) (a'(X) + \beta) (s'(X) + \gamma)
@@ -130,7 +130,7 @@ impl<C: CurveAffine> Evaluated<C> {
                             &|a, scalar| a * &scalar,
                         )
                     })
-                    .fold(C::Scalar::zero(), |acc, eval| acc * &*theta + &eval)
+                    .fold(C::Scalar::ZERO, |acc, eval| acc * &*theta + &eval)
             };
             let right = self.product_eval
                 * &(compress_expressions(&argument.input_expressions) + &*beta)
@@ -142,7 +142,7 @@ impl<C: CurveAffine> Evaluated<C> {
         std::iter::empty()
             .chain(
                 // l_0(X) * (1 - z'(X)) = 0
-                Some(l_0 * &(C::Scalar::one() - &self.product_eval)),
+                Some(l_0 * &(C::Scalar::ONE - &self.product_eval)),
             )
             .chain(
                 // l_last(X) * (z(X)^2 - z(X)) = 0
diff --git a/halo2_proofs/src/plonk/permutation/keygen.rs b/halo2_proofs/src/plonk/permutation/keygen.rs
index cc2dc09bb0..0736de98c5 100644
--- a/halo2_proofs/src/plonk/permutation/keygen.rs
+++ b/halo2_proofs/src/plonk/permutation/keygen.rs
@@ -1,9 +1,9 @@
-use ff::Field;
+use ff::{Field, PrimeField};
 use group::Curve;
 
 use super::{Argument, ProvingKey, VerifyingKey};
 use crate::{
-    arithmetic::{parallelize, CurveAffine, FieldExt},
+    arithmetic::{parallelize, CurveAffine},
     plonk::{Any, Column, Error},
     poly::{
         commitment::{Blind, CommitmentScheme, Params},
@@ -109,7 +109,7 @@ impl Assembly {
         p: &Argument,
     ) -> VerifyingKey<C> {
         // Compute [omega^0, omega^1, ..., omega^{params.n - 1}]
-        let mut omega_powers = vec![C::Scalar::zero(); params.n() as usize];
+        let mut omega_powers = vec![C::Scalar::ZERO; params.n() as usize];
         {
             let omega = domain.get_omega();
             parallelize(&mut omega_powers, |o, start| {
@@ -130,7 +130,7 @@ impl Assembly {
                     for v in omega_powers {
                         *v *= &cur;
                     }
-                    cur *= &C::Scalar::DELTA;
+                    cur *= &<C::Scalar as PrimeField>::DELTA;
                 }
             });
         }
@@ -171,7 +171,7 @@ impl Assembly {
         p: &Argument,
     ) -> ProvingKey<C> {
         // Compute [omega^0, omega^1, ..., omega^{params.n - 1}]
-        let mut omega_powers = vec![C::Scalar::zero(); params.n() as usize];
+        let mut omega_powers = vec![C::Scalar::ZERO; params.n() as usize];
         {
             let omega = domain.get_omega();
             parallelize(&mut omega_powers, |o, start| {
diff --git a/halo2_proofs/src/plonk/permutation/prover.rs b/halo2_proofs/src/plonk/permutation/prover.rs
index ad94b02574..0618952f5a 100644
--- a/halo2_proofs/src/plonk/permutation/prover.rs
+++ b/halo2_proofs/src/plonk/permutation/prover.rs
@@ -1,3 +1,4 @@
+use ff::PrimeField;
 use group::{
     ff::{BatchInvert, Field},
     Curve,
@@ -8,7 +9,7 @@ use std::iter::{self, ExactSizeIterator};
 use super::super::{circuit::Any, ChallengeBeta, ChallengeGamma, ChallengeX};
 use super::{Argument, ProvingKey};
 use crate::{
-    arithmetic::{eval_polynomial, parallelize, CurveAffine, FieldExt},
+    arithmetic::{eval_polynomial, parallelize, CurveAffine},
     plonk::{self, Error},
     poly::{
         self,
@@ -72,10 +73,10 @@ impl Argument {
         let blinding_factors = pk.vk.cs.blinding_factors();
 
         // Each column gets its own delta power.
-        let mut deltaomega = C::Scalar::one();
+        let mut deltaomega = C::Scalar::ONE;
 
         // Track the "last" value from the previous column set
-        let mut last_z = C::Scalar::one();
+        let mut last_z = C::Scalar::ONE;
 
         let mut sets = vec![];
 
@@ -92,7 +93,7 @@ impl Argument {
             // where p_j(X) is the jth column in this permutation,
             // and i is the ith row of the column.
 
-            let mut modified_values = vec![C::Scalar::one(); params.n() as usize];
+            let mut modified_values = vec![C::Scalar::ONE; params.n() as usize];
 
             // Iterate over each column of the permutation
             for (&column, permuted_column_values) in columns.iter().zip(permutations.iter()) {
@@ -135,7 +136,7 @@ impl Argument {
                         deltaomega *= &omega;
                     }
                 });
-                deltaomega *= &C::Scalar::DELTA;
+                deltaomega *= &<C::Scalar as PrimeField>::DELTA;
             }
 
             // The modified_values vector is a vector of products of fractions
diff --git a/halo2_proofs/src/plonk/permutation/verifier.rs b/halo2_proofs/src/plonk/permutation/verifier.rs
index a33b210e13..ecdef3f59a 100644
--- a/halo2_proofs/src/plonk/permutation/verifier.rs
+++ b/halo2_proofs/src/plonk/permutation/verifier.rs
@@ -1,10 +1,10 @@
-use ff::Field;
+use ff::{Field, PrimeField};
 use std::iter;
 
 use super::super::{circuit::Any, ChallengeBeta, ChallengeGamma, ChallengeX};
 use super::{Argument, VerifyingKey};
 use crate::{
-    arithmetic::{CurveAffine, FieldExt},
+    arithmetic::CurveAffine,
     plonk::{self, Error},
     poly::{commitment::MSM, Rotation, VerifierQuery},
     transcript::{EncodedChallenge, TranscriptRead},
@@ -123,9 +123,9 @@ impl<C: CurveAffine> Evaluated<C> {
             // Enforce only for the first set.
             // l_0(X) * (1 - z_0(X)) = 0
             .chain(
-                self.sets.first().map(|first_set| {
-                    l_0 * &(C::Scalar::one() - &first_set.permutation_product_eval)
-                }),
+                self.sets
+                    .first()
+                    .map(|first_set| l_0 * &(C::Scalar::ONE - &first_set.permutation_product_eval)),
             )
             // Enforce only for the last set.
             // l_last(X) * (z_l(X)^2 - z_l(X)) = 0
@@ -182,7 +182,8 @@ impl<C: CurveAffine> Evaluated<C> {
 
                         let mut right = set.permutation_product_eval;
                         let mut current_delta = (*beta * &*x)
-                            * &(C::Scalar::DELTA.pow_vartime([(chunk_index * chunk_len) as u64]));
+                            * &(<C::Scalar as PrimeField>::DELTA
+                                .pow_vartime(&[(chunk_index * chunk_len) as u64]));
                         for eval in columns.iter().map(|&column| match column.column_type() {
                             Any::Advice(_) => {
                                 advice_evals[vk.cs.get_any_query_index(column, Rotation::cur())]
@@ -198,7 +199,7 @@ impl<C: CurveAffine> Evaluated<C> {
                             current_delta *= &C::Scalar::DELTA;
                         }
 
-                        (left - &right) * (C::Scalar::one() - &(l_last + &l_blind))
+                        (left - &right) * (C::Scalar::ONE - &(l_last + &l_blind))
                     }),
             )
     }
diff --git a/halo2_proofs/src/plonk/prover.rs b/halo2_proofs/src/plonk/prover.rs
index 7c176e576a..0c9edd780d 100644
--- a/halo2_proofs/src/plonk/prover.rs
+++ b/halo2_proofs/src/plonk/prover.rs
@@ -1,4 +1,4 @@
-use ff::Field;
+use ff::{Field, FromUniformBytes, PrimeField, WithSmallOrderMulGroup};
 use group::Curve;
 use halo2curves::CurveExt;
 use rand_core::RngCore;
@@ -20,7 +20,7 @@ use super::{
     ChallengeY, Error, Expression, ProvingKey,
 };
 use crate::{
-    arithmetic::{eval_polynomial, CurveAffine, FieldExt},
+    arithmetic::{eval_polynomial, CurveAffine},
     circuit::Value,
     plonk::Assigned,
     poly::{
@@ -55,7 +55,10 @@ pub fn create_proof<
     instances: &[&[&[Scheme::Scalar]]],
     mut rng: R,
     transcript: &mut T,
-) -> Result<(), Error> {
+) -> Result<(), Error>
+where
+    Scheme::Scalar: WithSmallOrderMulGroup<3> + FromUniformBytes<64>,
+{
     for instance in instances.iter() {
         if instance.len() != pk.vk.cs.num_instance_columns {
             return Err(Error::InvalidInstances);
diff --git a/halo2_proofs/src/plonk/vanishing/prover.rs b/halo2_proofs/src/plonk/vanishing/prover.rs
index aa43a07c0f..71d29b180d 100644
--- a/halo2_proofs/src/plonk/vanishing/prover.rs
+++ b/halo2_proofs/src/plonk/vanishing/prover.rs
@@ -6,7 +6,7 @@ use rand_core::RngCore;
 
 use super::Argument;
 use crate::{
-    arithmetic::{eval_polynomial, CurveAffine, FieldExt},
+    arithmetic::{eval_polynomial, CurveAffine},
     plonk::{ChallengeX, ChallengeY, Error},
     poly::{
         self,
@@ -139,9 +139,7 @@ impl<C: CurveAffine> Constructed<C> {
             .h_blinds
             .iter()
             .rev()
-            .fold(Blind(C::Scalar::zero()), |acc, eval| {
-                acc * Blind(xn) + *eval
-            });
+            .fold(Blind(C::Scalar::ZERO), |acc, eval| acc * Blind(xn) + *eval);
 
         let random_eval = eval_polynomial(&self.committed.random_poly, *x);
         transcript.write_scalar(random_eval)?;
diff --git a/halo2_proofs/src/plonk/vanishing/verifier.rs b/halo2_proofs/src/plonk/vanishing/verifier.rs
index 3570dee6c1..0881dfb2c0 100644
--- a/halo2_proofs/src/plonk/vanishing/verifier.rs
+++ b/halo2_proofs/src/plonk/vanishing/verifier.rs
@@ -94,8 +94,8 @@ impl<C: CurveAffine> PartiallyEvaluated<C> {
         y: ChallengeY<C>,
         xn: C::Scalar,
     ) -> Evaluated<C, P::MSM> {
-        let expected_h_eval = expressions.fold(C::Scalar::zero(), |h_eval, v| h_eval * &*y + &v);
-        let expected_h_eval = expected_h_eval * ((xn - C::Scalar::one()).invert().unwrap());
+        let expected_h_eval = expressions.fold(C::Scalar::ZERO, |h_eval, v| h_eval * &*y + &v);
+        let expected_h_eval = expected_h_eval * ((xn - C::Scalar::ONE).invert().unwrap());
 
         let h_commitment =
             self.h_commitments
@@ -104,7 +104,7 @@ impl<C: CurveAffine> PartiallyEvaluated<C> {
                 .fold(params.empty_msm(), |mut acc, commitment| {
                     acc.scale(xn);
                     let commitment: C::CurveExt = (*commitment).into();
-                    acc.append_term(C::Scalar::one(), commitment);
+                    acc.append_term(C::Scalar::ONE, commitment);
 
                     acc
                 });
diff --git a/halo2_proofs/src/plonk/verifier.rs b/halo2_proofs/src/plonk/verifier.rs
index e6a2327e7b..f5984d2c79 100644
--- a/halo2_proofs/src/plonk/verifier.rs
+++ b/halo2_proofs/src/plonk/verifier.rs
@@ -1,4 +1,4 @@
-use ff::Field;
+use ff::{Field, FromUniformBytes, WithSmallOrderMulGroup};
 use group::Curve;
 use rand_core::RngCore;
 use std::iter;
@@ -7,7 +7,7 @@ use super::{
     vanishing, ChallengeBeta, ChallengeGamma, ChallengeTheta, ChallengeX, ChallengeY, Error,
     VerifyingKey,
 };
-use crate::arithmetic::{compute_inner_product, CurveAffine, FieldExt};
+use crate::arithmetic::{compute_inner_product, CurveAffine};
 use crate::poly::commitment::{CommitmentScheme, Verifier};
 use crate::poly::VerificationStrategy;
 use crate::poly::{
@@ -37,7 +37,10 @@ pub fn verify_proof<
     strategy: Strategy,
     instances: &[&[&[Scheme::Scalar]]],
     transcript: &mut T,
-) -> Result<Strategy::Output, Error> {
+) -> Result<Strategy::Output, Error>
+where
+    Scheme::Scalar: WithSmallOrderMulGroup<3> + FromUniformBytes<64>,
+{
     // Check that instances matches the expected number of instance columns
     for instances in instances.iter() {
         if instances.len() != vk.cs.num_instance_columns {
@@ -56,7 +59,7 @@ pub fn verify_proof<
                             return Err(Error::InstanceTooLarge);
                         }
                         let mut poly = instance.to_vec();
-                        poly.resize(params.n() as usize, Scheme::Scalar::zero());
+                        poly.resize(params.n() as usize, Scheme::Scalar::ZERO);
                         let poly = vk.domain.lagrange_from_vec(poly);
 
                         Ok(params.commit_lagrange(&poly, Blind::default()).to_affine())
@@ -94,7 +97,7 @@ pub fn verify_proof<
     let (advice_commitments, challenges) = {
         let mut advice_commitments =
             vec![vec![Scheme::Curve::default(); vk.cs.num_advice_columns]; num_proofs];
-        let mut challenges = vec![Scheme::Scalar::zero(); vk.cs.num_challenges];
+        let mut challenges = vec![Scheme::Scalar::ZERO; vk.cs.num_challenges];
 
         for current_phase in vk.cs.phases() {
             for advice_commitments in advice_commitments.iter_mut() {
@@ -253,7 +256,7 @@ pub fn verify_proof<
         let l_last = l_evals[0];
         let l_blind: Scheme::Scalar = l_evals[1..(1 + blinding_factors)]
             .iter()
-            .fold(Scheme::Scalar::zero(), |acc, eval| acc + eval);
+            .fold(Scheme::Scalar::ZERO, |acc, eval| acc + eval);
         let l_0 = l_evals[1 + blinding_factors];
 
         // Compute the expected value of h(x)
diff --git a/halo2_proofs/src/plonk/verifier/batch.rs b/halo2_proofs/src/plonk/verifier/batch.rs
index f07ba4141f..04e08be4af 100644
--- a/halo2_proofs/src/plonk/verifier/batch.rs
+++ b/halo2_proofs/src/plonk/verifier/batch.rs
@@ -1,5 +1,6 @@
 use std::{io, marker::PhantomData};
 
+use ff::FromUniformBytes;
 use group::ff::Field;
 use halo2curves::CurveAffine;
 use rand_core::{OsRng, RngCore};
@@ -67,7 +68,10 @@ pub struct BatchVerifier<C: CurveAffine> {
     items: Vec<BatchItem<C>>,
 }
 
-impl<C: CurveAffine> BatchVerifier<C> {
+impl<C: CurveAffine> BatchVerifier<C>
+where
+    C::Scalar: FromUniformBytes<64>,
+{
     /// Constructs a new batch verifier.
     pub fn new() -> Self {
         Self { items: vec![] }
diff --git a/halo2_proofs/src/poly.rs b/halo2_proofs/src/poly.rs
index 84089482aa..42e43b2e29 100644
--- a/halo2_proofs/src/poly.rs
+++ b/halo2_proofs/src/poly.rs
@@ -9,7 +9,6 @@ use crate::SerdeFormat;
 
 use ff::PrimeField;
 use group::ff::{BatchInvert, Field};
-use halo2curves::FieldExt;
 use std::fmt::Debug;
 use std::io;
 use std::marker::PhantomData;
@@ -177,7 +176,7 @@ impl<F: SerdePrimeField, B> Polynomial<F, B> {
     }
 }
 
-pub(crate) fn batch_invert_assigned<F: FieldExt>(
+pub(crate) fn batch_invert_assigned<F: Field>(
     assigned: Vec<Polynomial<Assigned<F>, LagrangeCoeff>>,
 ) -> Vec<Polynomial<F, LagrangeCoeff>> {
     let mut assigned_denominators: Vec<_> = assigned
@@ -202,9 +201,7 @@ pub(crate) fn batch_invert_assigned<F: FieldExt>(
     assigned
         .iter()
         .zip(assigned_denominators.into_iter())
-        .map(|(poly, inv_denoms)| {
-            poly.invert(inv_denoms.into_iter().map(|d| d.unwrap_or_else(F::one)))
-        })
+        .map(|(poly, inv_denoms)| poly.invert(inv_denoms.into_iter().map(|d| d.unwrap_or(F::ONE))))
         .collect()
 }
 
@@ -274,13 +271,13 @@ impl<F: Field, B: Basis> Mul<F> for Polynomial<F, B> {
     type Output = Polynomial<F, B>;
 
     fn mul(mut self, rhs: F) -> Polynomial<F, B> {
-        if rhs == F::zero() {
+        if rhs == F::ZERO {
             return Polynomial {
-                values: vec![F::zero(); self.len()],
+                values: vec![F::ZERO; self.len()],
                 _marker: PhantomData,
             };
         }
-        if rhs == F::one() {
+        if rhs == F::ONE {
             return self;
         }
 
diff --git a/halo2_proofs/src/poly/commitment.rs b/halo2_proofs/src/poly/commitment.rs
index e82515cfff..3a0b68f62a 100644
--- a/halo2_proofs/src/poly/commitment.rs
+++ b/halo2_proofs/src/poly/commitment.rs
@@ -6,8 +6,8 @@ use super::{
 use crate::poly::Error;
 use crate::transcript::{EncodedChallenge, TranscriptRead, TranscriptWrite};
 use ff::Field;
-use group::Curve;
-use halo2curves::{CurveAffine, CurveExt, FieldExt};
+use group::{Curve, Group};
+use halo2curves::{CurveAffine, CurveExt};
 use rand_core::RngCore;
 use std::{
     fmt::Debug,
@@ -18,7 +18,7 @@ use std::{
 /// Defines components of a commitment scheme.
 pub trait CommitmentScheme {
     /// Application field of this commitment scheme
-    type Scalar: FieldExt + halo2curves::Group;
+    type Scalar: Field;
 
     /// Elliptic curve used to commit the application and witnesses
     type Curve: CurveAffine<ScalarExt = Self::Scalar>;
@@ -192,20 +192,20 @@ pub trait Verifier<'params, Scheme: CommitmentScheme> {
 #[derive(Copy, Clone, Eq, PartialEq, Debug)]
 pub struct Blind<F>(pub F);
 
-impl<F: FieldExt> Default for Blind<F> {
+impl<F: Field> Default for Blind<F> {
     fn default() -> Self {
-        Blind(F::one())
+        Blind(F::ONE)
     }
 }
 
-impl<F: FieldExt> Blind<F> {
+impl<F: Field> Blind<F> {
     /// Given `rng` creates new blinding scalar
     pub fn new<R: RngCore>(rng: &mut R) -> Self {
         Blind(F::random(rng))
     }
 }
 
-impl<F: FieldExt> Add for Blind<F> {
+impl<F: Field> Add for Blind<F> {
     type Output = Self;
 
     fn add(self, rhs: Blind<F>) -> Self {
@@ -213,7 +213,7 @@ impl<F: FieldExt> Add for Blind<F> {
     }
 }
 
-impl<F: FieldExt> Mul for Blind<F> {
+impl<F: Field> Mul for Blind<F> {
     type Output = Self;
 
     fn mul(self, rhs: Blind<F>) -> Self {
@@ -221,25 +221,25 @@ impl<F: FieldExt> Mul for Blind<F> {
     }
 }
 
-impl<F: FieldExt> AddAssign for Blind<F> {
+impl<F: Field> AddAssign for Blind<F> {
     fn add_assign(&mut self, rhs: Blind<F>) {
         self.0 += rhs.0;
     }
 }
 
-impl<F: FieldExt> MulAssign for Blind<F> {
+impl<F: Field> MulAssign for Blind<F> {
     fn mul_assign(&mut self, rhs: Blind<F>) {
         self.0 *= rhs.0;
     }
 }
 
-impl<F: FieldExt> AddAssign<F> for Blind<F> {
+impl<F: Field> AddAssign<F> for Blind<F> {
     fn add_assign(&mut self, rhs: F) {
         self.0 += rhs;
     }
 }
 
-impl<F: FieldExt> MulAssign<F> for Blind<F> {
+impl<F: Field> MulAssign<F> for Blind<F> {
     fn mul_assign(&mut self, rhs: F) {
         self.0 *= rhs;
     }
diff --git a/halo2_proofs/src/poly/domain.rs b/halo2_proofs/src/poly/domain.rs
index cd1a0cdc9c..e43934a763 100644
--- a/halo2_proofs/src/poly/domain.rs
+++ b/halo2_proofs/src/poly/domain.rs
@@ -2,13 +2,16 @@
 //! domain that is of a suitable size for the application.
 
 use crate::{
-    arithmetic::{best_fft, parallelize, FieldExt, Group},
+    arithmetic::{best_fft, parallelize},
     plonk::Assigned,
 };
 
 use super::{Coeff, ExtendedLagrangeCoeff, LagrangeCoeff, Polynomial, Rotation};
-
-use group::ff::{BatchInvert, Field, PrimeField};
+use ff::WithSmallOrderMulGroup;
+use group::{
+    ff::{BatchInvert, Field, PrimeField},
+    Group,
+};
 
 use std::marker::PhantomData;
 
@@ -16,24 +19,24 @@ use std::marker::PhantomData;
 /// performing operations on an evaluation domain of size $2^k$ and an extended
 /// domain of size $2^{k} * j$ with $j \neq 0$.
 #[derive(Clone, Debug)]
-pub struct EvaluationDomain<G: Group> {
+pub struct EvaluationDomain<F: Field> {
     n: u64,
     k: u32,
     extended_k: u32,
-    omega: G::Scalar,
-    omega_inv: G::Scalar,
-    extended_omega: G::Scalar,
-    extended_omega_inv: G::Scalar,
-    g_coset: G::Scalar,
-    g_coset_inv: G::Scalar,
+    omega: F,
+    omega_inv: F,
+    extended_omega: F,
+    extended_omega_inv: F,
+    g_coset: F,
+    g_coset_inv: F,
     quotient_poly_degree: u64,
-    ifft_divisor: G::Scalar,
-    extended_ifft_divisor: G::Scalar,
-    t_evaluations: Vec<G::Scalar>,
-    barycentric_weight: G::Scalar,
+    ifft_divisor: F,
+    extended_ifft_divisor: F,
+    t_evaluations: Vec<F>,
+    barycentric_weight: F,
 }
 
-impl<G: Group> EvaluationDomain<G> {
+impl<F: WithSmallOrderMulGroup<3>> EvaluationDomain<F> {
     /// This constructs a new evaluation domain object based on the provided
     /// values $j, k$.
     pub fn new(j: u32, k: u32) -> Self {
@@ -51,12 +54,12 @@ impl<G: Group> EvaluationDomain<G> {
             extended_k += 1;
         }
 
-        let mut extended_omega = G::Scalar::root_of_unity();
+        let mut extended_omega = F::ROOT_OF_UNITY;
 
         // Get extended_omega, the 2^{extended_k}'th root of unity
         // The loop computes extended_omega = omega^{2 ^ (S - extended_k)}
         // Notice that extended_omega ^ {2 ^ extended_k} = omega ^ {2^S} = 1.
-        for _ in extended_k..G::Scalar::S {
+        for _ in extended_k..F::S {
             extended_omega = extended_omega.square();
         }
         let extended_omega = extended_omega;
@@ -78,15 +81,15 @@ impl<G: Group> EvaluationDomain<G> {
         // already.
         // The coset evaluation domain is:
         // zeta {1, extended_omega, extended_omega^2, ..., extended_omega^{(2^extended_k) - 1}}
-        let g_coset = G::Scalar::ZETA;
+        let g_coset = F::ZETA;
         let g_coset_inv = g_coset.square();
 
         let mut t_evaluations = Vec::with_capacity(1 << (extended_k - k));
         {
             // Compute the evaluations of t(X) = X^n - 1 in the coset evaluation domain.
             // We don't have to compute all of them, because it will repeat.
-            let orig = G::Scalar::ZETA.pow_vartime([n as u64, 0, 0, 0]);
-            let step = extended_omega.pow_vartime([n as u64, 0, 0, 0]);
+            let orig = F::ZETA.pow_vartime(&[n as u64, 0, 0, 0]);
+            let step = extended_omega.pow_vartime(&[n as u64, 0, 0, 0]);
             let mut cur = orig;
             loop {
                 t_evaluations.push(cur);
@@ -99,19 +102,19 @@ impl<G: Group> EvaluationDomain<G> {
 
             // Subtract 1 from each to give us t_evaluations[i] = t(zeta * extended_omega^i)
             for coeff in &mut t_evaluations {
-                *coeff -= &G::Scalar::one();
+                *coeff -= &F::ONE;
             }
 
             // Invert, because we're dividing by this polynomial.
             // We invert in a batch, below.
         }
 
-        let mut ifft_divisor = G::Scalar::from(1 << k); // Inversion computed later
-        let mut extended_ifft_divisor = G::Scalar::from(1 << extended_k); // Inversion computed later
+        let mut ifft_divisor = F::from(1 << k); // Inversion computed later
+        let mut extended_ifft_divisor = F::from(1 << extended_k); // Inversion computed later
 
         // The barycentric weight of 1 over the evaluation domain
         // 1 / \prod_{i != 0} (1 - omega^i)
-        let mut barycentric_weight = G::Scalar::from(n); // Inversion computed later
+        let mut barycentric_weight = F::from(n); // Inversion computed later
 
         // Compute batch inversion
         t_evaluations
@@ -144,7 +147,7 @@ impl<G: Group> EvaluationDomain<G> {
     /// Obtains a polynomial in Lagrange form when given a vector of Lagrange
     /// coefficients of size `n`; panics if the provided vector is the wrong
     /// length.
-    pub fn lagrange_from_vec(&self, values: Vec<G>) -> Polynomial<G, LagrangeCoeff> {
+    pub fn lagrange_from_vec(&self, values: Vec<F>) -> Polynomial<F, LagrangeCoeff> {
         assert_eq!(values.len(), self.n as usize);
 
         Polynomial {
@@ -156,7 +159,7 @@ impl<G: Group> EvaluationDomain<G> {
     /// Obtains a polynomial in coefficient form when given a vector of
     /// coefficients of size `n`; panics if the provided vector is the wrong
     /// length.
-    pub fn coeff_from_vec(&self, values: Vec<G>) -> Polynomial<G, Coeff> {
+    pub fn coeff_from_vec(&self, values: Vec<F>) -> Polynomial<F, Coeff> {
         assert_eq!(values.len(), self.n as usize);
 
         Polynomial {
@@ -170,13 +173,13 @@ impl<G: Group> EvaluationDomain<G> {
     /// provided vector is the wrong length.
     pub fn extended_from_lagrange_vec(
         &self,
-        values: Vec<Polynomial<G, LagrangeCoeff>>,
-    ) -> Polynomial<G, ExtendedLagrangeCoeff> {
+        values: Vec<Polynomial<F, LagrangeCoeff>>,
+    ) -> Polynomial<F, ExtendedLagrangeCoeff> {
         assert_eq!(values.len(), (self.extended_len() >> self.k) as usize);
         assert_eq!(values[0].len(), self.n as usize);
 
         // transpose the values in parallel
-        let mut transposed = vec![vec![G::group_zero(); values.len()]; self.n as usize];
+        let mut transposed = vec![vec![F::ZERO; values.len()]; self.n as usize];
         values.into_iter().enumerate().for_each(|(i, p)| {
             parallelize(&mut transposed, |transposed, start| {
                 for (transposed, p) in transposed.iter_mut().zip(p.values[start..].iter()) {
@@ -192,35 +195,32 @@ impl<G: Group> EvaluationDomain<G> {
     }
 
     /// Returns an empty (zero) polynomial in the coefficient basis
-    pub fn empty_coeff(&self) -> Polynomial<G, Coeff> {
+    pub fn empty_coeff(&self) -> Polynomial<F, Coeff> {
         Polynomial {
-            values: vec![G::group_zero(); self.n as usize],
+            values: vec![F::ZERO; self.n as usize],
             _marker: PhantomData,
         }
     }
 
     /// Returns an empty (zero) polynomial in the Lagrange coefficient basis
-    pub fn empty_lagrange(&self) -> Polynomial<G, LagrangeCoeff> {
+    pub fn empty_lagrange(&self) -> Polynomial<F, LagrangeCoeff> {
         Polynomial {
-            values: vec![G::group_zero(); self.n as usize],
+            values: vec![F::ZERO; self.n as usize],
             _marker: PhantomData,
         }
     }
 
     /// Returns an empty (zero) polynomial in the Lagrange coefficient basis, with
     /// deferred inversions.
-    pub(crate) fn empty_lagrange_assigned(&self) -> Polynomial<Assigned<G>, LagrangeCoeff>
-    where
-        G: Field,
-    {
+    pub(crate) fn empty_lagrange_assigned(&self) -> Polynomial<Assigned<F>, LagrangeCoeff> {
         Polynomial {
-            values: vec![G::group_zero().into(); self.n as usize],
+            values: vec![F::ZERO.into(); self.n as usize],
             _marker: PhantomData,
         }
     }
 
     /// Returns a constant polynomial in the Lagrange coefficient basis
-    pub fn constant_lagrange(&self, scalar: G) -> Polynomial<G, LagrangeCoeff> {
+    pub fn constant_lagrange(&self, scalar: F) -> Polynomial<F, LagrangeCoeff> {
         Polynomial {
             values: vec![scalar; self.n as usize],
             _marker: PhantomData,
@@ -229,16 +229,16 @@ impl<G: Group> EvaluationDomain<G> {
 
     /// Returns an empty (zero) polynomial in the extended Lagrange coefficient
     /// basis
-    pub fn empty_extended(&self) -> Polynomial<G, ExtendedLagrangeCoeff> {
+    pub fn empty_extended(&self) -> Polynomial<F, ExtendedLagrangeCoeff> {
         Polynomial {
-            values: vec![G::group_zero(); self.extended_len()],
+            values: vec![F::ZERO; self.extended_len()],
             _marker: PhantomData,
         }
     }
 
     /// Returns a constant polynomial in the extended Lagrange coefficient
     /// basis
-    pub fn constant_extended(&self, scalar: G) -> Polynomial<G, ExtendedLagrangeCoeff> {
+    pub fn constant_extended(&self, scalar: F) -> Polynomial<F, ExtendedLagrangeCoeff> {
         Polynomial {
             values: vec![scalar; self.extended_len()],
             _marker: PhantomData,
@@ -249,7 +249,7 @@ impl<G: Group> EvaluationDomain<G> {
     ///
     /// This function will panic if the provided vector is not the correct
     /// length.
-    pub fn lagrange_to_coeff(&self, mut a: Polynomial<G, LagrangeCoeff>) -> Polynomial<G, Coeff> {
+    pub fn lagrange_to_coeff(&self, mut a: Polynomial<F, LagrangeCoeff>) -> Polynomial<F, Coeff> {
         assert_eq!(a.values.len(), 1 << self.k);
 
         // Perform inverse FFT to obtain the polynomial in coefficient form
@@ -265,12 +265,12 @@ impl<G: Group> EvaluationDomain<G> {
     /// evaluation domain, rotating by `rotation` if desired.
     pub fn coeff_to_extended(
         &self,
-        mut a: Polynomial<G, Coeff>,
-    ) -> Polynomial<G, ExtendedLagrangeCoeff> {
+        mut a: Polynomial<F, Coeff>,
+    ) -> Polynomial<F, ExtendedLagrangeCoeff> {
         assert_eq!(a.values.len(), 1 << self.k);
 
         self.distribute_powers_zeta(&mut a.values, true);
-        a.values.resize(self.extended_len(), G::group_zero());
+        a.values.resize(self.extended_len(), F::ZERO);
         best_fft(&mut a.values, self.extended_omega, self.extended_k);
 
         Polynomial {
@@ -289,12 +289,12 @@ impl<G: Group> EvaluationDomain<G> {
     ///     `FFT(f(zeta * extended_omega^{m-1} * X), n)`
     pub fn coeff_to_extended_parts(
         &self,
-        a: &Polynomial<G, Coeff>,
-    ) -> Vec<Polynomial<G, LagrangeCoeff>> {
+        a: &Polynomial<F, Coeff>,
+    ) -> Vec<Polynomial<F, LagrangeCoeff>> {
         assert_eq!(a.values.len(), 1 << self.k);
 
         let num_parts = self.extended_len() >> self.k;
-        let mut extended_omega_factor = G::Scalar::one();
+        let mut extended_omega_factor = F::ONE;
         (0..num_parts)
             .map(|_| {
                 let part = self.coeff_to_extended_part(a.clone(), extended_omega_factor);
@@ -314,11 +314,11 @@ impl<G: Group> EvaluationDomain<G> {
     ///     `FFT(f(zeta * extended_omega^{m-1} * X), n)`
     pub fn batched_coeff_to_extended_parts(
         &self,
-        a: &[Polynomial<G, Coeff>],
-    ) -> Vec<Vec<Polynomial<G, LagrangeCoeff>>> {
+        a: &[Polynomial<F, Coeff>],
+    ) -> Vec<Vec<Polynomial<F, LagrangeCoeff>>> {
         assert_eq!(a[0].values.len(), 1 << self.k);
 
-        let mut extended_omega_factor = G::Scalar::one();
+        let mut extended_omega_factor = F::ONE;
         let num_parts = self.extended_len() >> self.k;
         (0..num_parts)
             .map(|_| {
@@ -340,9 +340,9 @@ impl<G: Group> EvaluationDomain<G> {
     /// where `extended_omega_factor` is `extended_omega^i` with `i` in `[0, m)`.
     pub fn coeff_to_extended_part(
         &self,
-        mut a: Polynomial<G, Coeff>,
-        extended_omega_factor: G::Scalar,
-    ) -> Polynomial<G, LagrangeCoeff> {
+        mut a: Polynomial<F, Coeff>,
+        extended_omega_factor: F,
+    ) -> Polynomial<F, LagrangeCoeff> {
         assert_eq!(a.values.len(), 1 << self.k);
 
         self.distribute_powers(&mut a.values, self.g_coset * extended_omega_factor);
@@ -357,9 +357,9 @@ impl<G: Group> EvaluationDomain<G> {
     /// Rotate the extended domain polynomial over the original domain.
     pub fn rotate_extended(
         &self,
-        poly: &Polynomial<G, ExtendedLagrangeCoeff>,
+        poly: &Polynomial<F, ExtendedLagrangeCoeff>,
         rotation: Rotation,
-    ) -> Polynomial<G, ExtendedLagrangeCoeff> {
+    ) -> Polynomial<F, ExtendedLagrangeCoeff> {
         let new_rotation = ((1 << (self.extended_k - self.k)) * rotation.0.abs()) as usize;
 
         let mut poly = poly.clone();
@@ -379,7 +379,7 @@ impl<G: Group> EvaluationDomain<G> {
     /// This function will panic if the provided vector is not the correct
     /// length.
     // TODO/FIXME: caller should be responsible for truncating
-    pub fn extended_to_coeff(&self, mut a: Polynomial<G, ExtendedLagrangeCoeff>) -> Vec<G> {
+    pub fn extended_to_coeff(&self, mut a: Polynomial<F, ExtendedLagrangeCoeff>) -> Vec<F> {
         assert_eq!(a.values.len(), self.extended_len());
 
         // Inverse FFT
@@ -407,15 +407,15 @@ impl<G: Group> EvaluationDomain<G> {
     /// polynomial of the $2^k$ size domain.
     pub fn divide_by_vanishing_poly(
         &self,
-        mut a: Polynomial<G, ExtendedLagrangeCoeff>,
-    ) -> Polynomial<G, ExtendedLagrangeCoeff> {
+        mut a: Polynomial<F, ExtendedLagrangeCoeff>,
+    ) -> Polynomial<F, ExtendedLagrangeCoeff> {
         assert_eq!(a.values.len(), self.extended_len());
 
         // Divide to obtain the quotient polynomial in the coset evaluation
         // domain.
         parallelize(&mut a.values, |h, mut index| {
             for h in h {
-                h.group_scale(&self.t_evaluations[index % self.t_evaluations.len()]);
+                *h *= &self.t_evaluations[index % self.t_evaluations.len()];
                 index += 1;
             }
         });
@@ -433,7 +433,7 @@ impl<G: Group> EvaluationDomain<G> {
     ///
     /// `into_coset` should be set to `true` when moving into the coset,
     /// and `false` when moving out. This toggles the choice of `zeta`.
-    fn distribute_powers_zeta(&self, a: &mut [G], into_coset: bool) {
+    fn distribute_powers_zeta(&self, a: &mut [F], into_coset: bool) {
         let coset_powers = if into_coset {
             [self.g_coset, self.g_coset_inv]
         } else {
@@ -444,7 +444,7 @@ impl<G: Group> EvaluationDomain<G> {
                 // Distribute powers to move into/from coset
                 let i = index % (coset_powers.len() + 1);
                 if i != 0 {
-                    a.group_scale(&coset_powers[i - 1]);
+                    *a *= &coset_powers[i - 1];
                 }
                 index += 1;
             }
@@ -454,22 +454,22 @@ impl<G: Group> EvaluationDomain<G> {
     /// Given a slice of group elements `[a_0, a_1, a_2, ...]`, this returns
     /// `[a_0, [c]a_1, [c^2]a_2, [c^3]a_3, [c^4]a_4, ...]`,
     ///
-    fn distribute_powers(&self, a: &mut [G], c: G::Scalar) {
+    fn distribute_powers(&self, a: &mut [F], c: F) {
         parallelize(a, |a, index| {
             let mut c_power = c.pow_vartime(&[index as u64, 0, 0, 0]);
             for a in a {
-                a.group_scale(&c_power);
+                a = a * (&c_power);
                 c_power = c_power * c;
             }
         });
     }
 
-    fn ifft(a: &mut [G], omega_inv: G::Scalar, log_n: u32, divisor: G::Scalar) {
+    fn ifft(a: &mut [F], omega_inv: F, log_n: u32, divisor: F) {
         best_fft(a, omega_inv, log_n);
         parallelize(a, |a, _| {
             for a in a {
                 // Finish iFFT
-                a.group_scale(&divisor);
+                *a *= &divisor;
             }
         });
     }
@@ -490,24 +490,24 @@ impl<G: Group> EvaluationDomain<G> {
     }
 
     /// Get $\omega$, the generator of the $2^k$ order multiplicative subgroup.
-    pub fn get_omega(&self) -> G::Scalar {
+    pub fn get_omega(&self) -> F {
         self.omega
     }
 
     /// Get $\omega^{-1}$, the inverse of the generator of the $2^k$ order
     /// multiplicative subgroup.
-    pub fn get_omega_inv(&self) -> G::Scalar {
+    pub fn get_omega_inv(&self) -> F {
         self.omega_inv
     }
 
     /// Get the generator of the extended domain's multiplicative subgroup.
-    pub fn get_extended_omega(&self) -> G::Scalar {
+    pub fn get_extended_omega(&self) -> F {
         self.extended_omega
     }
 
     /// Multiplies a value by some power of $\omega$, essentially rotating over
     /// the domain.
-    pub fn rotate_omega(&self, value: G::Scalar, rotation: Rotation) -> G::Scalar {
+    pub fn rotate_omega(&self, value: F, rotation: Rotation) -> F {
         let mut point = value;
         if rotation.0 >= 0 {
             point *= &self.get_omega().pow_vartime([rotation.0 as u64]);
@@ -548,23 +548,23 @@ impl<G: Group> EvaluationDomain<G> {
     /// which is the barycentric weight of $\omega^i$.
     pub fn l_i_range<I: IntoIterator<Item = i32> + Clone>(
         &self,
-        x: G::Scalar,
-        xn: G::Scalar,
+        x: F,
+        xn: F,
         rotations: I,
-    ) -> Vec<G::Scalar> {
+    ) -> Vec<F> {
         let mut results;
         {
             let rotations = rotations.clone().into_iter();
             results = Vec::with_capacity(rotations.size_hint().1.unwrap_or(0));
             for rotation in rotations {
                 let rotation = Rotation(rotation);
-                let result = x - self.rotate_omega(G::Scalar::one(), rotation);
+                let result = x - self.rotate_omega(F::ONE, rotation);
                 results.push(result);
             }
             results.iter_mut().batch_invert();
         }
 
-        let common = (xn - G::Scalar::one()) * self.barycentric_weight;
+        let common = (xn - F::ONE) * self.barycentric_weight;
         for (rotation, result) in rotations.into_iter().zip(results.iter_mut()) {
             let rotation = Rotation(rotation);
             *result = self.rotate_omega(*result * common, rotation);
@@ -581,7 +581,7 @@ impl<G: Group> EvaluationDomain<G> {
     /// Obtain a pinned version of this evaluation domain; a structure with the
     /// minimal parameters needed to determine the rest of the evaluation
     /// domain.
-    pub fn pinned(&self) -> PinnedEvaluationDomain<'_, G> {
+    pub fn pinned(&self) -> PinnedEvaluationDomain<'_, F> {
         PinnedEvaluationDomain {
             k: &self.k,
             extended_k: &self.extended_k,
@@ -593,10 +593,10 @@ impl<G: Group> EvaluationDomain<G> {
 /// Represents the minimal parameters that determine an `EvaluationDomain`.
 #[allow(dead_code)]
 #[derive(Debug)]
-pub struct PinnedEvaluationDomain<'a, G: Group> {
+pub struct PinnedEvaluationDomain<'a, F: Field> {
     k: &'a u32,
     extended_k: &'a u32,
-    omega: &'a G::Scalar,
+    omega: &'a F,
 }
 
 #[test]
@@ -655,7 +655,7 @@ fn test_l_i() {
     }
     for i in 0..8 {
         let mut l_i = vec![Scalar::zero(); 8];
-        l_i[i] = Scalar::one();
+        l_i[i] = Scalar::ONE;
         let l_i = lagrange_interpolate(&points[..], &l_i[..]);
         l.push(l_i);
     }
diff --git a/halo2_proofs/src/poly/evaluator.rs b/halo2_proofs/src/poly/evaluator.rs
index d1ba853c47..5d20221255 100644
--- a/halo2_proofs/src/poly/evaluator.rs
+++ b/halo2_proofs/src/poly/evaluator.rs
@@ -9,7 +9,7 @@ use std::{
 };
 
 use group::ff::Field;
-use halo2curves::FieldExt;
+use halo2curves::Field;
 
 use super::{
     Basis, Coeff, EvaluationDomain, ExtendedLagrangeCoeff, LagrangeCoeff, Polynomial, Rotation,
@@ -135,7 +135,7 @@ impl<E, F: Field, B: Basis> Evaluator<E, F, B> {
     ) -> Polynomial<F, B>
     where
         E: Copy + Send + Sync,
-        F: FieldExt,
+        F: Field,
         B: BasisOps,
     {
         // Traverse `ast` to collect the used leaves.
@@ -192,7 +192,7 @@ impl<E, F: Field, B: Basis> Evaluator<E, F, B> {
             })
             .collect();
 
-        struct AstContext<'a, E, F: FieldExt, B: Basis> {
+        struct AstContext<'a, E, F: Field, B: Basis> {
             domain: &'a EvaluationDomain<F>,
             poly_len: usize,
             chunk_size: usize,
@@ -200,7 +200,7 @@ impl<E, F: Field, B: Basis> Evaluator<E, F, B> {
             leaves: &'a HashMap<AstLeaf<E, B>, &'a [F]>,
         }
 
-        fn recurse<E, F: FieldExt, B: BasisOps>(
+        fn recurse<E, F: Field, B: BasisOps>(
             ast: &Ast<E, F, B>,
             ctx: &AstContext<'_, E, F, B>,
         ) -> Vec<F> {
@@ -230,7 +230,7 @@ impl<E, F: Field, B: Basis> Evaluator<E, F, B> {
                     lhs
                 }
                 Ast::DistributePowers(terms, base) => terms.iter().fold(
-                    B::constant_term(ctx.poly_len, ctx.chunk_size, ctx.chunk_index, F::zero()),
+                    B::constant_term(ctx.poly_len, ctx.chunk_size, ctx.chunk_index, F::ZERO),
                     |mut acc, term| {
                         let term = recurse(term, ctx);
                         for (acc, term) in acc.iter_mut().zip(term) {
@@ -347,7 +347,7 @@ impl<E, F: Field, B: Basis> From<AstLeaf<E, B>> for Ast<E, F, B> {
 
 impl<E, F: Field, B: Basis> Ast<E, F, B> {
     pub(crate) fn one() -> Self {
-        Self::ConstantTerm(F::one())
+        Self::ConstantTerm(F::ONE)
     }
 }
 
@@ -355,7 +355,7 @@ impl<E, F: Field, B: Basis> Neg for Ast<E, F, B> {
     type Output = Ast<E, F, B>;
 
     fn neg(self) -> Self::Output {
-        Ast::Scale(Arc::new(self), -F::one())
+        Ast::Scale(Arc::new(self), -F::ONE)
     }
 }
 
@@ -489,21 +489,21 @@ impl<E: Clone, F: Field> MulAssign for Ast<E, F, ExtendedLagrangeCoeff> {
 
 /// Operations which can be performed over a given basis.
 pub(crate) trait BasisOps: Basis {
-    fn empty_poly<F: FieldExt>(domain: &EvaluationDomain<F>) -> Polynomial<F, Self>;
-    fn constant_term<F: FieldExt>(
+    fn empty_poly<F: Field>(domain: &EvaluationDomain<F>) -> Polynomial<F, Self>;
+    fn constant_term<F: Field>(
         poly_len: usize,
         chunk_size: usize,
         chunk_index: usize,
         scalar: F,
     ) -> Vec<F>;
-    fn linear_term<F: FieldExt>(
+    fn linear_term<F: Field>(
         domain: &EvaluationDomain<F>,
         poly_len: usize,
         chunk_size: usize,
         chunk_index: usize,
         scalar: F,
     ) -> Vec<F>;
-    fn rotate<F: FieldExt>(
+    fn rotate<F: Field>(
         domain: &EvaluationDomain<F>,
         poly: &Polynomial<F, Self>,
         rotation: Rotation,
@@ -511,31 +511,31 @@ pub(crate) trait BasisOps: Basis {
 }
 
 impl BasisOps for Coeff {
-    fn empty_poly<F: FieldExt>(domain: &EvaluationDomain<F>) -> Polynomial<F, Self> {
+    fn empty_poly<F: Field>(domain: &EvaluationDomain<F>) -> Polynomial<F, Self> {
         domain.empty_coeff()
     }
 
-    fn constant_term<F: FieldExt>(
+    fn constant_term<F: Field>(
         poly_len: usize,
         chunk_size: usize,
         chunk_index: usize,
         scalar: F,
     ) -> Vec<F> {
-        let mut chunk = vec![F::zero(); cmp::min(chunk_size, poly_len - chunk_size * chunk_index)];
+        let mut chunk = vec![F::ZERO; cmp::min(chunk_size, poly_len - chunk_size * chunk_index)];
         if chunk_index == 0 {
             chunk[0] = scalar;
         }
         chunk
     }
 
-    fn linear_term<F: FieldExt>(
+    fn linear_term<F: Field>(
         _: &EvaluationDomain<F>,
         poly_len: usize,
         chunk_size: usize,
         chunk_index: usize,
         scalar: F,
     ) -> Vec<F> {
-        let mut chunk = vec![F::zero(); cmp::min(chunk_size, poly_len - chunk_size * chunk_index)];
+        let mut chunk = vec![F::ZERO; cmp::min(chunk_size, poly_len - chunk_size * chunk_index)];
         // If the chunk size is 1 (e.g. if we have a small k and many threads), then the
         // linear coefficient is the second chunk. Otherwise, the chunk size is greater
         // than one, and the linear coefficient is the second element of the first chunk.
@@ -550,7 +550,7 @@ impl BasisOps for Coeff {
         chunk
     }
 
-    fn rotate<F: FieldExt>(
+    fn rotate<F: Field>(
         _: &EvaluationDomain<F>,
         _: &Polynomial<F, Self>,
         _: Rotation,
@@ -560,11 +560,11 @@ impl BasisOps for Coeff {
 }
 
 impl BasisOps for LagrangeCoeff {
-    fn empty_poly<F: FieldExt>(domain: &EvaluationDomain<F>) -> Polynomial<F, Self> {
+    fn empty_poly<F: Field>(domain: &EvaluationDomain<F>) -> Polynomial<F, Self> {
         domain.empty_lagrange()
     }
 
-    fn constant_term<F: FieldExt>(
+    fn constant_term<F: Field>(
         poly_len: usize,
         chunk_size: usize,
         chunk_index: usize,
@@ -573,7 +573,7 @@ impl BasisOps for LagrangeCoeff {
         vec![scalar; cmp::min(chunk_size, poly_len - chunk_size * chunk_index)]
     }
 
-    fn linear_term<F: FieldExt>(
+    fn linear_term<F: Field>(
         domain: &EvaluationDomain<F>,
         poly_len: usize,
         chunk_size: usize,
@@ -592,7 +592,7 @@ impl BasisOps for LagrangeCoeff {
             .collect()
     }
 
-    fn rotate<F: FieldExt>(
+    fn rotate<F: Field>(
         _: &EvaluationDomain<F>,
         poly: &Polynomial<F, Self>,
         rotation: Rotation,
@@ -602,11 +602,11 @@ impl BasisOps for LagrangeCoeff {
 }
 
 impl BasisOps for ExtendedLagrangeCoeff {
-    fn empty_poly<F: FieldExt>(domain: &EvaluationDomain<F>) -> Polynomial<F, Self> {
+    fn empty_poly<F: Field>(domain: &EvaluationDomain<F>) -> Polynomial<F, Self> {
         domain.empty_extended()
     }
 
-    fn constant_term<F: FieldExt>(
+    fn constant_term<F: Field>(
         poly_len: usize,
         chunk_size: usize,
         chunk_index: usize,
@@ -615,7 +615,7 @@ impl BasisOps for ExtendedLagrangeCoeff {
         vec![scalar; cmp::min(chunk_size, poly_len - chunk_size * chunk_index)]
     }
 
-    fn linear_term<F: FieldExt>(
+    fn linear_term<F: Field>(
         domain: &EvaluationDomain<F>,
         poly_len: usize,
         chunk_size: usize,
@@ -637,7 +637,7 @@ impl BasisOps for ExtendedLagrangeCoeff {
             .collect()
     }
 
-    fn rotate<F: FieldExt>(
+    fn rotate<F: Field>(
         domain: &EvaluationDomain<F>,
         poly: &Polynomial<F, Self>,
         rotation: Rotation,
diff --git a/halo2_proofs/src/poly/ipa/commitment.rs b/halo2_proofs/src/poly/ipa/commitment.rs
index 9060e8315c..f9b4ad059b 100644
--- a/halo2_proofs/src/poly/ipa/commitment.rs
+++ b/halo2_proofs/src/poly/ipa/commitment.rs
@@ -4,7 +4,7 @@
 //! [halo]: https://eprint.iacr.org/2019/1021
 
 use crate::arithmetic::{
-    best_fft, best_multiexp, g_to_lagrange, parallelize, CurveAffine, CurveExt, FieldExt, Group,
+    best_fft, best_multiexp, g_to_lagrange, parallelize, CurveAffine, CurveExt,
 };
 use crate::helpers::CurveRead;
 use crate::poly::commitment::{Blind, CommitmentScheme, Params, ParamsProver, ParamsVerifier, MSM};
@@ -12,7 +12,7 @@ use crate::poly::ipa::msm::MSMIPA;
 use crate::poly::{Coeff, LagrangeCoeff, Polynomial};
 
 use ff::{Field, PrimeField};
-use group::{prime::PrimeCurveAffine, Curve, Group as _};
+use group::{prime::PrimeCurveAffine, Curve, Group};
 use std::marker::PhantomData;
 use std::ops::{Add, AddAssign, Mul, MulAssign};
 
@@ -234,9 +234,7 @@ impl<'params, C: CurveAffine> ParamsProver<'params, C> for ParamsIPA<C> {
 #[cfg(test)]
 mod test {
 
-    use crate::arithmetic::{
-        best_fft, best_multiexp, parallelize, CurveAffine, CurveExt, FieldExt, Group,
-    };
+    use crate::arithmetic::{best_fft, best_multiexp, parallelize, CurveAffine, CurveExt};
     use crate::helpers::CurveRead;
     use crate::poly::commitment::ParamsProver;
     use crate::poly::commitment::{Blind, CommitmentScheme, Params, MSM};
@@ -245,7 +243,7 @@ mod test {
     use crate::poly::{Coeff, LagrangeCoeff, Polynomial};
 
     use ff::{Field, PrimeField};
-    use group::{prime::PrimeCurveAffine, Curve, Group as _};
+    use group::{prime::PrimeCurveAffine, Curve, Group};
     use std::marker::PhantomData;
     use std::ops::{Add, AddAssign, Mul, MulAssign};
 
@@ -309,7 +307,7 @@ mod test {
         use rand_core::OsRng;
 
         use super::super::commitment::{Blind, Params};
-        use crate::arithmetic::{eval_polynomial, FieldExt};
+        use crate::arithmetic::eval_polynomial;
         use crate::halo2curves::pasta::{EpAffine, Fq};
         use crate::poly::EvaluationDomain;
         use crate::transcript::{
@@ -363,7 +361,7 @@ mod test {
         assert_eq!(v, v_prime);
 
         let mut commitment_msm = MSMIPA::new(&params);
-        commitment_msm.append_term(Field::one(), p.into());
+        commitment_msm.append_term(Fq::one(), p.into());
 
         let guard = verify_proof(&params, commitment_msm, &mut transcript, *x, v).unwrap();
         let ch_verifier = transcript.squeeze_challenge();
diff --git a/halo2_proofs/src/poly/ipa/commitment/prover.rs b/halo2_proofs/src/poly/ipa/commitment/prover.rs
index 3b22b31b36..d176987c96 100644
--- a/halo2_proofs/src/poly/ipa/commitment/prover.rs
+++ b/halo2_proofs/src/poly/ipa/commitment/prover.rs
@@ -3,7 +3,7 @@ use rand_core::RngCore;
 
 use super::{Params, ParamsIPA};
 use crate::arithmetic::{
-    best_multiexp, compute_inner_product, eval_polynomial, parallelize, CurveAffine, FieldExt,
+    best_multiexp, compute_inner_product, eval_polynomial, parallelize, CurveAffine,
 };
 
 use crate::poly::commitment::ParamsProver;
@@ -87,7 +87,7 @@ pub fn create_proof<
     // `p_prime` and `b` is the evaluation of the polynomial at `x_3`.
     let mut b = Vec::with_capacity(1 << params.k);
     {
-        let mut cur = C::Scalar::one();
+        let mut cur = C::Scalar::ONE;
         for _ in 0..(1 << params.k) {
             b.push(cur);
             cur *= &x_3;
diff --git a/halo2_proofs/src/poly/ipa/commitment/verifier.rs b/halo2_proofs/src/poly/ipa/commitment/verifier.rs
index b3b30e0b4b..0b60842899 100644
--- a/halo2_proofs/src/poly/ipa/commitment/verifier.rs
+++ b/halo2_proofs/src/poly/ipa/commitment/verifier.rs
@@ -96,10 +96,10 @@ pub fn verify_proof<'params, C: CurveAffine, E: EncodedChallenge<C>, T: Transcri
 
 /// Computes $\prod\limits_{i=0}^{k-1} (1 + u_{k - 1 - i} x^{2^i})$.
 fn compute_b<F: Field>(x: F, u: &[F]) -> F {
-    let mut tmp = F::one();
+    let mut tmp = F::ONE;
     let mut cur = x;
     for u_j in u.iter().rev() {
-        tmp *= F::one() + &(*u_j * &cur);
+        tmp *= F::ONE + &(*u_j * &cur);
         cur *= cur;
     }
     tmp
diff --git a/halo2_proofs/src/poly/ipa/msm.rs b/halo2_proofs/src/poly/ipa/msm.rs
index 63f994b46e..3316e25337 100644
--- a/halo2_proofs/src/poly/ipa/msm.rs
+++ b/halo2_proofs/src/poly/ipa/msm.rs
@@ -191,7 +191,7 @@ impl<'a, C: CurveAffine> MSMIPA<'a, C> {
         if let Some(g_scalars) = self.g_scalars.as_mut() {
             g_scalars[0] += &constant;
         } else {
-            let mut g_scalars = vec![C::Scalar::zero(); self.params.n as usize];
+            let mut g_scalars = vec![C::Scalar::ZERO; self.params.n as usize];
             g_scalars[0] += &constant;
             self.g_scalars = Some(g_scalars);
         }
diff --git a/halo2_proofs/src/poly/ipa/multiopen.rs b/halo2_proofs/src/poly/ipa/multiopen.rs
index b724139a8f..fd6aa78544 100644
--- a/halo2_proofs/src/poly/ipa/multiopen.rs
+++ b/halo2_proofs/src/poly/ipa/multiopen.rs
@@ -3,14 +3,10 @@
 //!
 //! [halo]: https://eprint.iacr.org/2019/1021
 
-use std::collections::{BTreeMap, BTreeSet};
-
 use super::*;
-use crate::{
-    arithmetic::{CurveAffine, FieldExt},
-    poly::query::Query,
-    transcript::ChallengeScalar,
-};
+use crate::{arithmetic::CurveAffine, poly::query::Query, transcript::ChallengeScalar};
+use ff::Field;
+use std::collections::{BTreeMap, BTreeSet};
 
 mod prover;
 mod verifier;
@@ -63,7 +59,7 @@ type IntermediateSets<F, Q> = (
     Vec<Vec<F>>,
 );
 
-fn construct_intermediate_sets<F: FieldExt, I, Q: Query<F>>(queries: I) -> IntermediateSets<F, Q>
+fn construct_intermediate_sets<F: Field + Ord, I, Q: Query<F>>(queries: I) -> IntermediateSets<F, Q>
 where
     I: IntoIterator<Item = Q> + Clone,
 {
diff --git a/halo2_proofs/src/poly/ipa/multiopen/prover.rs b/halo2_proofs/src/poly/ipa/multiopen/prover.rs
index bba038c93a..6d65e7ae64 100644
--- a/halo2_proofs/src/poly/ipa/multiopen/prover.rs
+++ b/halo2_proofs/src/poly/ipa/multiopen/prover.rs
@@ -1,7 +1,7 @@
 use super::{
     construct_intermediate_sets, ChallengeX1, ChallengeX2, ChallengeX3, ChallengeX4, Query,
 };
-use crate::arithmetic::{eval_polynomial, kate_division, CurveAffine, FieldExt};
+use crate::arithmetic::{eval_polynomial, kate_division, CurveAffine};
 use crate::poly::commitment::ParamsProver;
 use crate::poly::commitment::{Blind, Params, Prover};
 use crate::poly::ipa::commitment::{self, IPACommitmentScheme, ParamsIPA};
@@ -47,7 +47,7 @@ impl<'params, C: CurveAffine> Prover<'params, IPACommitmentScheme<C>> for Prover
         // Collapse openings at same point sets together into single openings using
         // x_1 challenge.
         let mut q_polys: Vec<Option<Polynomial<C::Scalar, Coeff>>> = vec![None; point_sets.len()];
-        let mut q_blinds = vec![Blind(C::Scalar::zero()); point_sets.len()];
+        let mut q_blinds = vec![Blind(C::Scalar::ZERO); point_sets.len()];
 
         {
             let mut accumulate = |set_idx: usize,
@@ -80,7 +80,7 @@ impl<'params, C: CurveAffine> Prover<'params, IPACommitmentScheme<C>> for Prover
                     .fold(poly.clone().unwrap().values, |poly, point| {
                         kate_division(&poly, *point)
                     });
-                poly.resize(self.params.n as usize, C::Scalar::zero());
+                poly.resize(self.params.n as usize, C::Scalar::ZERO);
                 let poly = Polynomial {
                     values: poly,
                     _marker: PhantomData,
diff --git a/halo2_proofs/src/poly/ipa/multiopen/verifier.rs b/halo2_proofs/src/poly/ipa/multiopen/verifier.rs
index ff4c7626f6..391f89e15b 100644
--- a/halo2_proofs/src/poly/ipa/multiopen/verifier.rs
+++ b/halo2_proofs/src/poly/ipa/multiopen/verifier.rs
@@ -8,7 +8,7 @@ use rand_core::RngCore;
 use super::{
     construct_intermediate_sets, ChallengeX1, ChallengeX2, ChallengeX3, ChallengeX4, Query,
 };
-use crate::arithmetic::{eval_polynomial, lagrange_interpolate, CurveAffine, FieldExt};
+use crate::arithmetic::{eval_polynomial, lagrange_interpolate, CurveAffine};
 use crate::poly::commitment::{Params, Verifier, MSM};
 use crate::poly::ipa::commitment::{IPACommitmentScheme, ParamsIPA, ParamsVerifierIPA};
 use crate::poly::ipa::msm::MSMIPA;
@@ -63,7 +63,7 @@ impl<'params, C: CurveAffine> Verifier<'params, IPACommitmentScheme<C>>
         // while the inner vec corresponds to the points in a particular set.
         let mut q_eval_sets = Vec::with_capacity(point_sets.len());
         for point_set in point_sets.iter() {
-            q_eval_sets.push(vec![C::Scalar::zero(); point_set.len()]);
+            q_eval_sets.push(vec![C::Scalar::ZERO; point_set.len()]);
         }
         {
             let mut accumulate = |set_idx: usize,
@@ -72,7 +72,7 @@ impl<'params, C: CurveAffine> Verifier<'params, IPACommitmentScheme<C>>
                 q_commitments[set_idx].scale(*x_1);
                 match new_commitment {
                     CommitmentReference::Commitment(c) => {
-                        q_commitments[set_idx].append_term(C::Scalar::one(), (*c).into());
+                        q_commitments[set_idx].append_term(C::Scalar::ONE, (*c).into());
                     }
                     CommitmentReference::MSM(msm) => {
                         q_commitments[set_idx].add_msm(msm);
@@ -116,7 +116,7 @@ impl<'params, C: CurveAffine> Verifier<'params, IPACommitmentScheme<C>>
             .zip(q_eval_sets.iter())
             .zip(u.iter())
             .fold(
-                C::Scalar::zero(),
+                C::Scalar::ZERO,
                 |msm_eval, ((points, evals), proof_eval)| {
                     let r_poly = lagrange_interpolate(points, evals);
                     let r_eval = eval_polynomial(&r_poly, *x_3);
@@ -132,7 +132,7 @@ impl<'params, C: CurveAffine> Verifier<'params, IPACommitmentScheme<C>>
         let x_4: ChallengeX4<_> = transcript.squeeze_challenge_scalar();
 
         // Compute the final commitment that has to be opened
-        msm.append_term(C::Scalar::one(), q_prime_commitment.into());
+        msm.append_term(C::Scalar::ONE, q_prime_commitment.into());
         let (msm, v) = q_commitments.into_iter().zip(u.iter()).fold(
             (msm, msm_eval),
             |(mut msm, msm_eval), (q_commitment, q_eval)| {
diff --git a/halo2_proofs/src/poly/ipa/strategy.rs b/halo2_proofs/src/poly/ipa/strategy.rs
index 6f3b4b7228..c8d385f90c 100644
--- a/halo2_proofs/src/poly/ipa/strategy.rs
+++ b/halo2_proofs/src/poly/ipa/strategy.rs
@@ -70,7 +70,7 @@ impl<'params, C: CurveAffine> GuardIPA<'params, C> {
 
     /// Computes G = ⟨s, params.g⟩
     pub fn compute_g(&self) -> C {
-        let s = compute_s(&self.u, C::Scalar::one());
+        let s = compute_s(&self.u, C::Scalar::ONE);
 
         best_multiexp(&s, &self.msm.params.g).to_affine()
     }
@@ -160,7 +160,7 @@ impl<'params, C: CurveAffine>
 /// Computes the coefficients of $g(X) = \prod\limits_{i=0}^{k-1} (1 + u_{k - 1 - i} X^{2^i})$.
 fn compute_s<F: Field>(u: &[F], init: F) -> Vec<F> {
     assert!(!u.is_empty());
-    let mut v = vec![F::zero(); 1 << u.len()];
+    let mut v = vec![F::ZERO; 1 << u.len()];
     v[0] = init;
 
     for (len, u_j) in u.iter().rev().enumerate().map(|(i, u_j)| (1 << i, u_j)) {
diff --git a/halo2_proofs/src/poly/kzg/commitment.rs b/halo2_proofs/src/poly/kzg/commitment.rs
index 08665667b3..f9fc508c6a 100644
--- a/halo2_proofs/src/poly/kzg/commitment.rs
+++ b/halo2_proofs/src/poly/kzg/commitment.rs
@@ -1,5 +1,5 @@
 use crate::arithmetic::{
-    best_fft, best_multiexp, g_to_lagrange, parallelize, CurveAffine, CurveExt, FieldExt, Group,
+    best_fft, best_multiexp, g_to_lagrange, parallelize, CurveAffine, CurveExt,
 };
 use crate::helpers::SerdeCurveAffine;
 use crate::poly::commitment::{Blind, CommitmentScheme, Params, ParamsProver, ParamsVerifier, MSM};
@@ -7,7 +7,7 @@ use crate::poly::{Coeff, LagrangeCoeff, Polynomial};
 use crate::SerdeFormat;
 
 use ff::{Field, PrimeField};
-use group::{prime::PrimeCurveAffine, Curve, Group as _};
+use group::{prime::PrimeCurveAffine, Curve, Group};
 use halo2curves::pairing::Engine;
 use rand_core::{OsRng, RngCore};
 use std::fmt::Debug;
@@ -37,6 +37,7 @@ pub struct KZGCommitmentScheme<E: Engine> {
 
 impl<E: Engine + Debug> CommitmentScheme for KZGCommitmentScheme<E>
 where
+    E::Scalar: PrimeField,
     E::G1Affine: SerdeCurveAffine,
     E::G2Affine: SerdeCurveAffine,
 {
@@ -55,7 +56,10 @@ where
     }
 }
 
-impl<E: Engine + Debug> ParamsKZG<E> {
+impl<E: Engine + Debug> ParamsKZG<E>
+where
+    E::Scalar: PrimeField,
+{
     /// Initializes parameters for the curve, draws toxic secret from given rng.
     /// MUST NOT be used in production.
     pub fn setup<R: RngCore>(k: u32, rng: R) -> Self {
@@ -80,7 +84,7 @@ impl<E: Engine + Debug> ParamsKZG<E> {
 
         // Calculate g = [G1, [s] G1, [s^2] G1, ..., [s^(n-1)] G1] in parallel.
         let g1 = E::G1Affine::generator();
-        let mut g_projective = vec![E::G1::group_zero(); n as usize];
+        let mut g_projective = vec![E::G1::identity(); n as usize];
         parallelize(&mut g_projective, |g, start| {
             let mut current_g: E::G1 = g1.into();
             current_g *= s.pow_vartime([start as u64]);
@@ -98,14 +102,14 @@ impl<E: Engine + Debug> ParamsKZG<E> {
             g
         };
 
-        let mut g_lagrange_projective = vec![E::G1::group_zero(); n as usize];
+        let mut g_lagrange_projective = vec![E::G1::identity(); n as usize];
         let mut root = E::Scalar::ROOT_OF_UNITY_INV.invert().unwrap();
         for _ in k..E::Scalar::S {
             root = root.square();
         }
         let n_inv = Option::<E::Scalar>::from(E::Scalar::from(n).invert())
             .expect("inversion should be ok for n = 1<<k");
-        let multiplier = (s.pow_vartime([n as u64]) - E::Scalar::one()) * n_inv;
+        let multiplier = (s.pow_vartime(&[n as u64]) - E::Scalar::ONE) * n_inv;
         parallelize(&mut g_lagrange_projective, |g, start| {
             for (idx, g) in g.iter_mut().enumerate() {
                 let offset = start + idx;
@@ -263,6 +267,7 @@ pub type ParamsVerifierKZG<C> = ParamsKZG<C>;
 
 impl<'params, E: Engine + Debug> Params<'params, E::G1Affine> for ParamsKZG<E>
 where
+    E::Scalar: PrimeField,
     E::G1Affine: SerdeCurveAffine,
     E::G2Affine: SerdeCurveAffine,
 {
@@ -316,6 +321,7 @@ where
 
 impl<'params, E: Engine + Debug> ParamsVerifier<'params, E::G1Affine> for ParamsKZG<E>
 where
+    E::Scalar: PrimeField,
     E::G1Affine: SerdeCurveAffine,
     E::G2Affine: SerdeCurveAffine,
 {
@@ -323,6 +329,7 @@ where
 
 impl<'params, E: Engine + Debug> ParamsProver<'params, E::G1Affine> for ParamsKZG<E>
 where
+    E::Scalar: PrimeField,
     E::G1Affine: SerdeCurveAffine,
     E::G2Affine: SerdeCurveAffine,
 {
@@ -352,9 +359,7 @@ where
 
 #[cfg(test)]
 mod test {
-    use crate::arithmetic::{
-        best_fft, best_multiexp, parallelize, CurveAffine, CurveExt, FieldExt, Group,
-    };
+    use crate::arithmetic::{best_fft, best_multiexp, parallelize, CurveAffine, CurveExt};
     use crate::poly::commitment::ParamsProver;
     use crate::poly::commitment::{Blind, CommitmentScheme, Params, MSM};
     use crate::poly::kzg::commitment::{ParamsKZG, ParamsVerifierKZG};
@@ -363,7 +368,7 @@ mod test {
     use crate::poly::{Coeff, LagrangeCoeff, Polynomial};
 
     use ff::{Field, PrimeField};
-    use group::{prime::PrimeCurveAffine, Curve, Group as _};
+    use group::{prime::PrimeCurveAffine, Curve, Group};
     use halo2curves::bn256::G1Affine;
     use std::marker::PhantomData;
     use std::ops::{Add, AddAssign, Mul, MulAssign};
@@ -403,7 +408,7 @@ mod test {
         use rand_core::OsRng;
 
         use super::super::commitment::{Blind, Params};
-        use crate::arithmetic::{eval_polynomial, FieldExt};
+        use crate::arithmetic::eval_polynomial;
         use crate::halo2curves::bn256::{Bn256, Fr};
         use crate::poly::EvaluationDomain;
 
diff --git a/halo2_proofs/src/poly/kzg/msm.rs b/halo2_proofs/src/poly/kzg/msm.rs
index 6cc90a5103..abd8309f56 100644
--- a/halo2_proofs/src/poly/kzg/msm.rs
+++ b/halo2_proofs/src/poly/kzg/msm.rs
@@ -27,7 +27,7 @@ impl<E: Engine> MSMKZG<E> {
     /// Prepares all scalars in the MSM to linear combination
     pub fn combine_with_base(&mut self, base: E::Scalar) {
         use ff::Field;
-        let mut acc = E::Scalar::one();
+        let mut acc = E::Scalar::ONE;
         if !self.scalars.is_empty() {
             for scalar in self.scalars.iter_mut().rev() {
                 *scalar *= &acc;
diff --git a/halo2_proofs/src/poly/kzg/multiopen/gwc.rs b/halo2_proofs/src/poly/kzg/multiopen/gwc.rs
index 4869238ae7..8e7d742fc0 100644
--- a/halo2_proofs/src/poly/kzg/multiopen/gwc.rs
+++ b/halo2_proofs/src/poly/kzg/multiopen/gwc.rs
@@ -5,7 +5,7 @@ pub use prover::ProverGWC;
 pub use verifier::VerifierGWC;
 
 use crate::{
-    arithmetic::{eval_polynomial, CurveAffine, FieldExt},
+    arithmetic::{eval_polynomial, CurveAffine},
     poly::{
         commitment::{Params, ParamsVerifier},
         query::Query,
@@ -13,7 +13,7 @@ use crate::{
     },
     transcript::ChallengeScalar,
 };
-
+use ff::Field;
 use std::{
     collections::{BTreeMap, BTreeSet},
     marker::PhantomData,
@@ -27,13 +27,13 @@ type ChallengeU<F> = ChallengeScalar<F, U>;
 struct V {}
 type ChallengeV<F> = ChallengeScalar<F, V>;
 
-struct CommitmentData<F: FieldExt, Q: Query<F>> {
+struct CommitmentData<F: Field, Q: Query<F>> {
     queries: Vec<Q>,
     point: F,
     _marker: PhantomData<F>,
 }
 
-fn construct_intermediate_sets<F: FieldExt, I, Q: Query<F>>(queries: I) -> Vec<CommitmentData<F, Q>>
+fn construct_intermediate_sets<F: Field, I, Q: Query<F>>(queries: I) -> Vec<CommitmentData<F, Q>>
 where
     I: IntoIterator<Item = Q> + Clone,
 {
diff --git a/halo2_proofs/src/poly/kzg/multiopen/gwc/prover.rs b/halo2_proofs/src/poly/kzg/multiopen/gwc/prover.rs
index ee8a549a00..d5d977fb2d 100644
--- a/halo2_proofs/src/poly/kzg/multiopen/gwc/prover.rs
+++ b/halo2_proofs/src/poly/kzg/multiopen/gwc/prover.rs
@@ -1,5 +1,5 @@
 use super::{construct_intermediate_sets, ChallengeV, Query};
-use crate::arithmetic::{eval_polynomial, kate_division, powers, CurveAffine, FieldExt};
+use crate::arithmetic::{eval_polynomial, kate_division, powers, CurveAffine};
 use crate::helpers::SerdeCurveAffine;
 use crate::poly::commitment::ParamsProver;
 use crate::poly::commitment::Prover;
@@ -12,7 +12,7 @@ use crate::poly::{
 };
 use crate::transcript::{EncodedChallenge, TranscriptWrite};
 
-use ff::Field;
+use ff::{Field, PrimeField};
 use group::Curve;
 use halo2curves::pairing::Engine;
 use rand_core::RngCore;
@@ -29,6 +29,7 @@ pub struct ProverGWC<'params, E: Engine> {
 /// Create a multi-opening proof
 impl<'params, E: Engine + Debug> Prover<'params, KZGCommitmentScheme<E>> for ProverGWC<'params, E>
 where
+    E::Scalar: PrimeField,
     E::G1Affine: SerdeCurveAffine,
     E::G2Affine: SerdeCurveAffine,
 {
diff --git a/halo2_proofs/src/poly/kzg/multiopen/gwc/verifier.rs b/halo2_proofs/src/poly/kzg/multiopen/gwc/verifier.rs
index 22fa139480..1d0c9468b4 100644
--- a/halo2_proofs/src/poly/kzg/multiopen/gwc/verifier.rs
+++ b/halo2_proofs/src/poly/kzg/multiopen/gwc/verifier.rs
@@ -3,7 +3,7 @@ use std::io::Read;
 use std::marker::PhantomData;
 
 use super::{construct_intermediate_sets, ChallengeU, ChallengeV};
-use crate::arithmetic::{eval_polynomial, lagrange_interpolate, powers, CurveAffine, FieldExt};
+use crate::arithmetic::{eval_polynomial, lagrange_interpolate, powers, CurveAffine};
 use crate::helpers::SerdeCurveAffine;
 use crate::poly::commitment::Verifier;
 use crate::poly::commitment::MSM;
@@ -19,7 +19,7 @@ use crate::poly::{
 };
 use crate::transcript::{EncodedChallenge, TranscriptRead};
 
-use ff::Field;
+use ff::{Field, PrimeField};
 use group::Group;
 use halo2curves::pairing::{Engine, MillerLoopResult, MultiMillerLoop};
 use rand_core::OsRng;
@@ -33,6 +33,7 @@ pub struct VerifierGWC<'params, E: Engine> {
 impl<'params, E> Verifier<'params, KZGCommitmentScheme<E>> for VerifierGWC<'params, E>
 where
     E: MultiMillerLoop + Debug,
+    E::Scalar: PrimeField,
     E::G1Affine: SerdeCurveAffine,
     E::G2Affine: SerdeCurveAffine,
 {
@@ -70,7 +71,7 @@ where
         let u: ChallengeU<_> = transcript.squeeze_challenge_scalar();
 
         let mut commitment_multi = MSMKZG::<E>::new();
-        let mut eval_multi = E::Scalar::zero();
+        let mut eval_multi = E::Scalar::ZERO;
 
         let mut witness = MSMKZG::<E>::new();
         let mut witness_with_aux = MSMKZG::<E>::new();
diff --git a/halo2_proofs/src/poly/kzg/multiopen/shplonk.rs b/halo2_proofs/src/poly/kzg/multiopen/shplonk.rs
index 0b1a2492b1..d14132fb43 100644
--- a/halo2_proofs/src/poly/kzg/multiopen/shplonk.rs
+++ b/halo2_proofs/src/poly/kzg/multiopen/shplonk.rs
@@ -1,20 +1,20 @@
 mod prover;
 mod verifier;
 
-pub use prover::ProverSHPLONK;
-pub use verifier::VerifierSHPLONK;
-
 use crate::{
-    arithmetic::{eval_polynomial, lagrange_interpolate, CurveAffine, FieldExt},
+    arithmetic::{eval_polynomial, lagrange_interpolate, CurveAffine},
     poly::{query::Query, Coeff, Polynomial},
     transcript::ChallengeScalar,
 };
+use ff::Field;
+pub use prover::ProverSHPLONK;
 use rayon::prelude::*;
 use std::{
     collections::{btree_map::Entry, BTreeMap, BTreeSet, HashMap, HashSet},
     marker::PhantomData,
     sync::Arc,
 };
+pub use verifier::VerifierSHPLONK;
 
 #[derive(Clone, Copy, Debug)]
 struct U {}
@@ -29,9 +29,9 @@ struct Y {}
 type ChallengeY<F> = ChallengeScalar<F, Y>;
 
 #[derive(Debug, Clone, PartialEq)]
-struct Commitment<F: FieldExt, T: PartialEq + Clone>((T, Vec<F>));
+struct Commitment<F: Field, T: PartialEq + Clone>((T, Vec<F>));
 
-impl<F: FieldExt, T: PartialEq + Clone> Commitment<F, T> {
+impl<F: Field, T: PartialEq + Clone> Commitment<F, T> {
     fn get(&self) -> T {
         self.0 .0.clone()
     }
@@ -42,18 +42,18 @@ impl<F: FieldExt, T: PartialEq + Clone> Commitment<F, T> {
 }
 
 #[derive(Debug, Clone, PartialEq)]
-struct RotationSet<F: FieldExt, T: PartialEq + Clone> {
+struct RotationSet<F: Field, T: PartialEq + Clone> {
     commitments: Vec<Commitment<F, T>>,
     points: Vec<F>,
 }
 
 #[derive(Debug, PartialEq)]
-struct IntermediateSets<F: FieldExt, Q: Query<F>> {
+struct IntermediateSets<F: Field, Q: Query<F>> {
     rotation_sets: Vec<RotationSet<F, Q::Commitment>>,
     super_point_set: BTreeSet<F>,
 }
 
-fn construct_intermediate_sets<F: FieldExt, I, Q: Query<F, Eval = F>>(
+fn construct_intermediate_sets<F: Field + Ord, I, Q: Query<F, Eval = F>>(
     queries: I,
 ) -> IntermediateSets<F, Q>
 where
@@ -157,8 +157,8 @@ mod proptests {
 
     use super::{construct_intermediate_sets, Commitment, IntermediateSets};
     use crate::poly::Rotation;
-    use halo2curves::{pasta::Fp, FieldExt};
-
+    use ff::{Field, FromUniformBytes};
+    use halo2curves::pasta::Fp;
     use std::collections::BTreeMap;
     use std::convert::TryFrom;
 
@@ -190,7 +190,7 @@ mod proptests {
         fn arb_point()(
             bytes in vec(any::<u8>(), 64)
         ) -> Fp {
-            Fp::from_bytes_wide(&<[u8; 64]>::try_from(bytes).unwrap())
+            Fp::from_uniform_bytes(&<[u8; 64]>::try_from(bytes).unwrap())
         }
     }
 
diff --git a/halo2_proofs/src/poly/kzg/multiopen/shplonk/prover.rs b/halo2_proofs/src/poly/kzg/multiopen/shplonk/prover.rs
index 3206364b8f..bb50eafe58 100644
--- a/halo2_proofs/src/poly/kzg/multiopen/shplonk/prover.rs
+++ b/halo2_proofs/src/poly/kzg/multiopen/shplonk/prover.rs
@@ -3,7 +3,7 @@ use super::{
 };
 use crate::arithmetic::{
     eval_polynomial, evaluate_vanishing_polynomial, kate_division, lagrange_interpolate,
-    parallelize, powers, CurveAffine, FieldExt,
+    parallelize, powers, CurveAffine,
 };
 use crate::helpers::SerdeCurveAffine;
 use crate::poly::commitment::{Blind, ParamsProver, Prover};
@@ -13,7 +13,7 @@ use crate::poly::Rotation;
 use crate::poly::{commitment::Params, Coeff, Polynomial};
 use crate::transcript::{EncodedChallenge, TranscriptWrite};
 
-use ff::Field;
+use ff::{Field, PrimeField};
 use group::Curve;
 use halo2curves::pairing::Engine;
 use rand_core::RngCore;
@@ -23,7 +23,7 @@ use std::io::{self, Write};
 use std::marker::PhantomData;
 use std::ops::MulAssign;
 
-fn div_by_vanishing<F: FieldExt>(poly: Polynomial<F, Coeff>, roots: &[F]) -> Vec<F> {
+fn div_by_vanishing<F: Field>(poly: Polynomial<F, Coeff>, roots: &[F]) -> Vec<F> {
     let poly = roots
         .iter()
         .fold(poly.values, |poly, point| kate_division(&poly, *point));
@@ -105,6 +105,7 @@ impl<'a, E: Engine> ProverSHPLONK<'a, E> {
 impl<'params, E: Engine + Debug> Prover<'params, KZGCommitmentScheme<E>>
     for ProverSHPLONK<'params, E>
 where
+    E::Scalar: Ord + PrimeField,
     E::G1Affine: SerdeCurveAffine,
     E::G2Affine: SerdeCurveAffine,
 {
@@ -162,7 +163,7 @@ where
                 // Q_i(X) = N_i(X) / Z_i(X) where
                 // Z_i(X) = (x - r_i_0) * (x - r_i_1) * ...
                 let mut poly = div_by_vanishing(n_x, points);
-                poly.resize(self.params.n as usize, E::Scalar::zero());
+                poly.resize(self.params.n as usize, E::Scalar::ZERO);
 
                 Polynomial {
                     values: poly,
@@ -261,7 +262,7 @@ where
         #[cfg(debug_assertions)]
         {
             let must_be_zero = eval_polynomial(&l_x.values[..], *u);
-            assert_eq!(must_be_zero, E::Scalar::zero());
+            assert_eq!(must_be_zero, E::Scalar::ZERO);
         }
 
         let mut h_x = div_by_vanishing(l_x, &[*u]);
diff --git a/halo2_proofs/src/poly/kzg/multiopen/shplonk/verifier.rs b/halo2_proofs/src/poly/kzg/multiopen/shplonk/verifier.rs
index 11ffa880ef..d1d1660e9c 100644
--- a/halo2_proofs/src/poly/kzg/multiopen/shplonk/verifier.rs
+++ b/halo2_proofs/src/poly/kzg/multiopen/shplonk/verifier.rs
@@ -5,7 +5,6 @@ use super::ChallengeY;
 use super::{construct_intermediate_sets, ChallengeU, ChallengeV};
 use crate::arithmetic::{
     eval_polynomial, evaluate_vanishing_polynomial, lagrange_interpolate, powers, CurveAffine,
-    FieldExt,
 };
 use crate::helpers::SerdeCurveAffine;
 use crate::poly::commitment::Verifier;
@@ -22,7 +21,7 @@ use crate::poly::{
     Error,
 };
 use crate::transcript::{EncodedChallenge, TranscriptRead};
-use ff::Field;
+use ff::{Field, PrimeField};
 use group::Group;
 use halo2curves::pairing::{Engine, MillerLoopResult, MultiMillerLoop};
 use rand_core::OsRng;
@@ -37,6 +36,7 @@ pub struct VerifierSHPLONK<'params, E: Engine> {
 impl<'params, E> Verifier<'params, KZGCommitmentScheme<E>> for VerifierSHPLONK<'params, E>
 where
     E: MultiMillerLoop + Debug,
+    E::Scalar: PrimeField + Ord,
     E::G1Affine: SerdeCurveAffine,
     E::G2Affine: SerdeCurveAffine,
 {
@@ -77,8 +77,8 @@ where
         let u: ChallengeU<_> = transcript.squeeze_challenge_scalar();
         let h2 = transcript.read_point().map_err(|_| Error::SamplingError)?;
 
-        let (mut z_0_diff_inverse, mut z_0) = (E::Scalar::zero(), E::Scalar::zero());
-        let (mut outer_msm, mut r_outer_acc) = (PreMSM::<E>::new(), E::Scalar::zero());
+        let (mut z_0_diff_inverse, mut z_0) = (E::Scalar::ZERO, E::Scalar::ZERO);
+        let (mut outer_msm, mut r_outer_acc) = (PreMSM::<E>::new(), E::Scalar::ZERO);
         for (i, (rotation_set, power_of_v)) in rotation_sets.iter().zip(powers(*v)).enumerate() {
             let diffs: Vec<E::Scalar> = super_point_set
                 .iter()
@@ -91,7 +91,7 @@ where
             if i == 0 {
                 z_0 = evaluate_vanishing_polynomial(&rotation_set.points[..], *u);
                 z_0_diff_inverse = z_diff_i.invert().unwrap();
-                z_diff_i = E::Scalar::one();
+                z_diff_i = E::Scalar::ONE;
             } else {
                 z_diff_i.mul_assign(z_0_diff_inverse);
             }
@@ -137,9 +137,7 @@ where
         outer_msm.append_term(-z_0, h1.into());
         outer_msm.append_term(*u, h2.into());
 
-        msm_accumulator
-            .left
-            .append_term(E::Scalar::one(), h2.into());
+        msm_accumulator.left.append_term(E::Scalar::ONE, h2.into());
 
         msm_accumulator.right.add_msm(&outer_msm);
 
diff --git a/halo2_proofs/src/poly/kzg/strategy.rs b/halo2_proofs/src/poly/kzg/strategy.rs
index ca4b4fb18a..15cdba2069 100644
--- a/halo2_proofs/src/poly/kzg/strategy.rs
+++ b/halo2_proofs/src/poly/kzg/strategy.rs
@@ -15,7 +15,7 @@ use crate::{
     },
     transcript::{EncodedChallenge, TranscriptRead},
 };
-use ff::Field;
+use ff::{Field, PrimeField};
 use group::Group;
 use halo2curves::{
     pairing::{Engine, MillerLoopResult, MultiMillerLoop},
@@ -32,6 +32,7 @@ pub struct GuardKZG<'params, E: MultiMillerLoop + Debug> {
 /// Define accumulator type as `DualMSM`
 impl<'params, E> Guard<KZGCommitmentScheme<E>> for GuardKZG<'params, E>
 where
+    E::Scalar: PrimeField,
     E: MultiMillerLoop + Debug,
     E::G1Affine: SerdeCurveAffine,
     E::G2Affine: SerdeCurveAffine,
@@ -92,6 +93,7 @@ impl<
         >,
     > VerificationStrategy<'params, KZGCommitmentScheme<E>, V> for AccumulatorStrategy<'params, E>
 where
+    E::Scalar: PrimeField,
     E::G1Affine: SerdeCurveAffine,
     E::G2Affine: SerdeCurveAffine,
 {
@@ -130,6 +132,7 @@ impl<
         >,
     > VerificationStrategy<'params, KZGCommitmentScheme<E>, V> for SingleStrategy<'params, E>
 where
+    E::Scalar: PrimeField,
     E::G1Affine: SerdeCurveAffine,
     E::G2Affine: SerdeCurveAffine,
 {
diff --git a/halo2_proofs/src/poly/multiopen_test.rs b/halo2_proofs/src/poly/multiopen_test.rs
index 8dd563b15a..d57243f712 100644
--- a/halo2_proofs/src/poly/multiopen_test.rs
+++ b/halo2_proofs/src/poly/multiopen_test.rs
@@ -1,6 +1,6 @@
 #[cfg(test)]
 mod test {
-    use crate::arithmetic::{eval_polynomial, FieldExt};
+    use crate::arithmetic::eval_polynomial;
     use crate::plonk::Error;
     use crate::poly::commitment::ParamsProver;
     use crate::poly::commitment::{Blind, ParamsVerifier, MSM};
@@ -17,7 +17,7 @@ mod test {
         Keccak256Write, TranscriptRead, TranscriptReadBuffer, TranscriptWrite,
         TranscriptWriterBuffer,
     };
-    use ff::Field;
+    use ff::{Field, PrimeField, WithSmallOrderMulGroup};
     use group::{Curve, Group};
     use halo2curves::CurveAffine;
     use rand_core::{OsRng, RngCore};
@@ -233,28 +233,25 @@ mod test {
         T: TranscriptWriterBuffer<Vec<u8>, Scheme::Curve, E>,
     >(
         params: &'params Scheme::ParamsProver,
-    ) -> Vec<u8> {
+    ) -> Vec<u8>
+    where
+        Scheme::Scalar: WithSmallOrderMulGroup<3>,
+    {
         let domain = EvaluationDomain::new(1, params.k());
 
         let mut ax = domain.empty_coeff();
         for (i, a) in ax.iter_mut().enumerate() {
-            *a = <<Scheme as CommitmentScheme>::Curve as CurveAffine>::ScalarExt::from(
-                10 + i as u64,
-            );
+            *a = <<Scheme as CommitmentScheme>::Scalar>::from(10 + i as u64);
         }
 
         let mut bx = domain.empty_coeff();
         for (i, a) in bx.iter_mut().enumerate() {
-            *a = <<Scheme as CommitmentScheme>::Curve as CurveAffine>::ScalarExt::from(
-                100 + i as u64,
-            );
+            *a = <<Scheme as CommitmentScheme>::Scalar>::from(100 + i as u64);
         }
 
         let mut cx = domain.empty_coeff();
         for (i, a) in cx.iter_mut().enumerate() {
-            *a = <<Scheme as CommitmentScheme>::Curve as CurveAffine>::ScalarExt::from(
-                100 + i as u64,
-            );
+            *a = <<Scheme as CommitmentScheme>::Scalar>::from(100 + i as u64);
         }
 
         let mut transcript = T::init(vec![]);
diff --git a/halo2_proofs/src/transcript.rs b/halo2_proofs/src/transcript.rs
index 8907f9779d..166b0e6f90 100644
--- a/halo2_proofs/src/transcript.rs
+++ b/halo2_proofs/src/transcript.rs
@@ -2,11 +2,11 @@
 //! transcripts.
 
 use blake2b_simd::{Params as Blake2bParams, State as Blake2bState};
-use group::ff::PrimeField;
+use group::ff::{FromUniformBytes, PrimeField};
 use sha3::{Digest, Keccak256};
 use std::convert::TryInto;
 
-use halo2curves::{Coordinates, CurveAffine, FieldExt};
+use halo2curves::{Coordinates, CurveAffine};
 
 use std::io::{self, Read, Write};
 use std::marker::PhantomData;
@@ -119,6 +119,8 @@ pub struct Keccak256Read<R: Read, C: CurveAffine, E: EncodedChallenge<C>> {
 
 impl<R: Read, C: CurveAffine> TranscriptReadBuffer<R, C, Challenge255<C>>
     for Blake2bRead<R, C, Challenge255<C>>
+where
+    C::Scalar: FromUniformBytes<64>,
 {
     /// Initialize a transcript given an input buffer.
     fn init(reader: R) -> Self {
@@ -135,6 +137,8 @@ impl<R: Read, C: CurveAffine> TranscriptReadBuffer<R, C, Challenge255<C>>
 
 impl<R: Read, C: CurveAffine> TranscriptReadBuffer<R, C, Challenge255<C>>
     for Keccak256Read<R, C, Challenge255<C>>
+where
+    C::Scalar: FromUniformBytes<64>,
 {
     /// Initialize a transcript given an input buffer.
     fn init(reader: R) -> Self {
@@ -150,6 +154,8 @@ impl<R: Read, C: CurveAffine> TranscriptReadBuffer<R, C, Challenge255<C>>
 
 impl<R: Read, C: CurveAffine> TranscriptRead<C, Challenge255<C>>
     for Blake2bRead<R, C, Challenge255<C>>
+where
+    C::Scalar: FromUniformBytes<64>,
 {
     fn read_point(&mut self) -> io::Result<C> {
         let mut compressed = C::Repr::default();
@@ -179,6 +185,8 @@ impl<R: Read, C: CurveAffine> TranscriptRead<C, Challenge255<C>>
 
 impl<R: Read, C: CurveAffine> TranscriptRead<C, Challenge255<C>>
     for Keccak256Read<R, C, Challenge255<C>>
+where
+    C::Scalar: FromUniformBytes<64>,
 {
     fn read_point(&mut self) -> io::Result<C> {
         let mut compressed = C::Repr::default();
@@ -206,8 +214,9 @@ impl<R: Read, C: CurveAffine> TranscriptRead<C, Challenge255<C>>
     }
 }
 
-impl<R: Read, C: CurveAffine> Transcript<C, Challenge255<C>>
-    for Blake2bRead<R, C, Challenge255<C>>
+impl<R: Read, C: CurveAffine> Transcript<C, Challenge255<C>> for Blake2bRead<R, C, Challenge255<C>>
+where
+    C::Scalar: FromUniformBytes<64>,
 {
     fn squeeze_challenge(&mut self) -> Challenge255<C> {
         self.state.update(&[BLAKE2B_PREFIX_CHALLENGE]);
@@ -240,6 +249,8 @@ impl<R: Read, C: CurveAffine> Transcript<C, Challenge255<C>>
 
 impl<R: Read, C: CurveAffine> Transcript<C, Challenge255<C>>
     for Keccak256Read<R, C, Challenge255<C>>
+where
+    C::Scalar: FromUniformBytes<64>,
 {
     fn squeeze_challenge(&mut self) -> Challenge255<C> {
         self.state.update(&[KECCAK256_PREFIX_CHALLENGE]);
@@ -298,6 +309,8 @@ pub struct Keccak256Write<W: Write, C: CurveAffine, E: EncodedChallenge<C>> {
 
 impl<W: Write, C: CurveAffine> TranscriptWriterBuffer<W, C, Challenge255<C>>
     for Blake2bWrite<W, C, Challenge255<C>>
+where
+    C::Scalar: FromUniformBytes<64>,
 {
     /// Initialize a transcript given an output buffer.
     fn init(writer: W) -> Self {
@@ -319,6 +332,8 @@ impl<W: Write, C: CurveAffine> TranscriptWriterBuffer<W, C, Challenge255<C>>
 
 impl<W: Write, C: CurveAffine> TranscriptWriterBuffer<W, C, Challenge255<C>>
     for Keccak256Write<W, C, Challenge255<C>>
+where
+    C::Scalar: FromUniformBytes<64>,
 {
     /// Initialize a transcript given an output buffer.
     fn init(writer: W) -> Self {
@@ -340,6 +355,8 @@ impl<W: Write, C: CurveAffine> TranscriptWriterBuffer<W, C, Challenge255<C>>
 
 impl<W: Write, C: CurveAffine> TranscriptWrite<C, Challenge255<C>>
     for Blake2bWrite<W, C, Challenge255<C>>
+where
+    C::Scalar: FromUniformBytes<64>,
 {
     fn write_point(&mut self, point: C) -> io::Result<()> {
         self.common_point(point)?;
@@ -355,6 +372,8 @@ impl<W: Write, C: CurveAffine> TranscriptWrite<C, Challenge255<C>>
 
 impl<W: Write, C: CurveAffine> TranscriptWrite<C, Challenge255<C>>
     for Keccak256Write<W, C, Challenge255<C>>
+where
+    C::Scalar: FromUniformBytes<64>,
 {
     fn write_point(&mut self, point: C) -> io::Result<()> {
         self.common_point(point)?;
@@ -370,6 +389,8 @@ impl<W: Write, C: CurveAffine> TranscriptWrite<C, Challenge255<C>>
 
 impl<W: Write, C: CurveAffine> Transcript<C, Challenge255<C>>
     for Blake2bWrite<W, C, Challenge255<C>>
+where
+    C::Scalar: FromUniformBytes<64>,
 {
     fn squeeze_challenge(&mut self) -> Challenge255<C> {
         self.state.update(&[BLAKE2B_PREFIX_CHALLENGE]);
@@ -402,6 +423,8 @@ impl<W: Write, C: CurveAffine> Transcript<C, Challenge255<C>>
 
 impl<W: Write, C: CurveAffine> Transcript<C, Challenge255<C>>
     for Keccak256Write<W, C, Challenge255<C>>
+where
+    C::Scalar: FromUniformBytes<64>,
 {
     fn squeeze_challenge(&mut self) -> Challenge255<C> {
         self.state.update(&[KECCAK256_PREFIX_CHALLENGE]);
@@ -496,12 +519,15 @@ impl<C: CurveAffine> std::ops::Deref for Challenge255<C> {
     }
 }
 
-impl<C: CurveAffine> EncodedChallenge<C> for Challenge255<C> {
+impl<C: CurveAffine> EncodedChallenge<C> for Challenge255<C>
+where
+    C::Scalar: FromUniformBytes<64>,
+{
     type Input = [u8; 64];
 
     fn new(challenge_input: &[u8; 64]) -> Self {
         Challenge255(
-            C::Scalar::from_bytes_wide(challenge_input)
+            C::Scalar::from_uniform_bytes(challenge_input)
                 .to_repr()
                 .as_ref()
                 .try_into()
diff --git a/halo2_proofs/tests/plonk_api.rs b/halo2_proofs/tests/plonk_api.rs
index edfdfac3b2..6c69a472ab 100644
--- a/halo2_proofs/tests/plonk_api.rs
+++ b/halo2_proofs/tests/plonk_api.rs
@@ -2,7 +2,8 @@
 #![allow(clippy::op_ref)]
 
 // use assert_matches::assert_matches;
-use halo2_proofs::arithmetic::{Field, FieldExt};
+use ff::{FromUniformBytes, WithSmallOrderMulGroup};
+use halo2_proofs::arithmetic::Field;
 use halo2_proofs::circuit::{Cell, Layouter, Region, SimpleFloorPlanner, Value};
 use halo2_proofs::dev::MockProver;
 use halo2_proofs::plonk::{
@@ -46,7 +47,7 @@ fn plonk_api() {
     }
 
     #[allow(clippy::type_complexity)]
-    trait StandardCs<FF: FieldExt> {
+    trait StandardCs<FF: Field> {
         fn raw_multiply<F>(
             &self,
             layouter: &mut impl Layouter<FF>,
@@ -73,17 +74,17 @@ fn plonk_api() {
     }
 
     #[derive(Clone)]
-    struct MyCircuit<F: FieldExt> {
+    struct MyCircuit<F: Field> {
         a: Value<F>,
         lookup_table: Vec<F>,
     }
 
-    struct StandardPlonk<F: FieldExt> {
+    struct StandardPlonk<F: Field> {
         config: PlonkConfig,
         _marker: PhantomData<F>,
     }
 
-    impl<FF: FieldExt> StandardPlonk<FF> {
+    impl<FF: Field> StandardPlonk<FF> {
         fn new(config: PlonkConfig) -> Self {
             StandardPlonk {
                 config,
@@ -92,7 +93,7 @@ fn plonk_api() {
         }
     }
 
-    impl<FF: FieldExt> StandardCs<FF> for StandardPlonk<FF> {
+    impl<FF: Field> StandardCs<FF> for StandardPlonk<FF> {
         fn raw_multiply<F>(
             &self,
             layouter: &mut impl Layouter<FF>,
@@ -139,15 +140,10 @@ fn plonk_api() {
                         || value.unwrap().map(|v| v.2),
                     )?;
 
-                    region.assign_fixed(|| "a", self.config.sa, 0, || Value::known(FF::zero()))?;
-                    region.assign_fixed(|| "b", self.config.sb, 0, || Value::known(FF::zero()))?;
-                    region.assign_fixed(|| "c", self.config.sc, 0, || Value::known(FF::one()))?;
-                    region.assign_fixed(
-                        || "a * b",
-                        self.config.sm,
-                        0,
-                        || Value::known(FF::one()),
-                    )?;
+                    region.assign_fixed(|| "a", self.config.sa, 0, || Value::known(FF::ZERO))?;
+                    region.assign_fixed(|| "b", self.config.sb, 0, || Value::known(FF::ZERO))?;
+                    region.assign_fixed(|| "c", self.config.sc, 0, || Value::known(FF::ONE))?;
+                    region.assign_fixed(|| "a * b", self.config.sm, 0, || Value::known(FF::ONE))?;
                     Ok((lhs.cell(), rhs.cell(), out.cell()))
                 },
             )
@@ -198,14 +194,14 @@ fn plonk_api() {
                         || value.unwrap().map(|v| v.2),
                     )?;
 
-                    region.assign_fixed(|| "a", self.config.sa, 0, || Value::known(FF::one()))?;
-                    region.assign_fixed(|| "b", self.config.sb, 0, || Value::known(FF::one()))?;
-                    region.assign_fixed(|| "c", self.config.sc, 0, || Value::known(FF::one()))?;
+                    region.assign_fixed(|| "a", self.config.sa, 0, || Value::known(FF::ONE))?;
+                    region.assign_fixed(|| "b", self.config.sb, 0, || Value::known(FF::ONE))?;
+                    region.assign_fixed(|| "c", self.config.sc, 0, || Value::known(FF::ONE))?;
                     region.assign_fixed(
                         || "a * b",
                         self.config.sm,
                         0,
-                        || Value::known(FF::zero()),
+                        || Value::known(FF::ZERO),
                     )?;
                     Ok((lhs.cell(), rhs.cell(), out.cell()))
                 },
@@ -237,7 +233,7 @@ fn plonk_api() {
                         || "public",
                         self.config.sp,
                         0,
-                        || Value::known(FF::one()),
+                        || Value::known(FF::ONE),
                     )?;
 
                     Ok(value.cell())
@@ -267,7 +263,7 @@ fn plonk_api() {
         }
     }
 
-    impl<F: FieldExt> Circuit<F> for MyCircuit<F> {
+    impl<F: Field> Circuit<F> for MyCircuit<F> {
         type Config = PlonkConfig;
         type FloorPlanner = SimpleFloorPlanner;
 
@@ -376,7 +372,7 @@ fn plonk_api() {
             let cs = StandardPlonk::new(config);
             let mut is_first_pass_vec = vec![true; 8];
 
-            let _ = cs.public_input(&mut layouter, || Value::known(F::one() + F::one()))?;
+            let _ = cs.public_input(&mut layouter, || Value::known(F::ONE + F::ONE))?;
 
             let a: Value<Assigned<_>> = self.a.into();
             let parallel_regions_time = Instant::now();
@@ -470,14 +466,9 @@ fn plonk_api() {
         ($scheme:ident) => {{
             let a = <$scheme as CommitmentScheme>::Scalar::from(2834758237)
                 * <$scheme as CommitmentScheme>::Scalar::ZETA;
-            let instance = <$scheme as CommitmentScheme>::Scalar::one()
-                + <$scheme as CommitmentScheme>::Scalar::one();
-            let lookup_table = vec![
-                instance,
-                a,
-                a,
-                <$scheme as CommitmentScheme>::Scalar::zero(),
-            ];
+            let instance = <$scheme as CommitmentScheme>::Scalar::ONE
+                + <$scheme as CommitmentScheme>::Scalar::ONE;
+            let lookup_table = vec![instance, a, a, <$scheme as CommitmentScheme>::Scalar::ZERO];
             (a, instance, lookup_table)
         }};
     }
@@ -514,9 +505,10 @@ fn plonk_api() {
     }
     */
 
-    fn keygen<Scheme: CommitmentScheme>(
-        params: &Scheme::ParamsProver,
-    ) -> ProvingKey<Scheme::Curve> {
+    fn keygen<Scheme: CommitmentScheme>(params: &Scheme::ParamsProver) -> ProvingKey<Scheme::Curve>
+    where
+        Scheme::Scalar: FromUniformBytes<64> + WithSmallOrderMulGroup<3>,
+    {
         let (_, _, lookup_table) = common!(Scheme);
         let empty_circuit: MyCircuit<Scheme::Scalar> = MyCircuit {
             a: Value::unknown(),
@@ -544,7 +536,10 @@ fn plonk_api() {
         rng: R,
         params: &'params Scheme::ParamsProver,
         pk: &ProvingKey<Scheme::Curve>,
-    ) -> Vec<u8> {
+    ) -> Vec<u8>
+    where
+        Scheme::Scalar: Ord + WithSmallOrderMulGroup<3> + FromUniformBytes<64>,
+    {
         let (a, instance, lookup_table) = common!(Scheme);
 
         let circuit: MyCircuit<Scheme::Scalar> = MyCircuit {
@@ -579,7 +574,9 @@ fn plonk_api() {
         params_verifier: &'params Scheme::ParamsVerifier,
         vk: &VerifyingKey<Scheme::Curve>,
         proof: &'a [u8],
-    ) {
+    ) where
+        Scheme::Scalar: Ord + WithSmallOrderMulGroup<3> + FromUniformBytes<64>,
+    {
         let (_, instance, _) = common!(Scheme);
         let pubinputs = vec![instance];
 

From 6adc633d03227cc6db30f68c5fcb6c570007cdf5 Mon Sep 17 00:00:00 2001
From: Velaciela <git.rover@outlook.com>
Date: Mon, 9 Oct 2023 04:57:40 +0000
Subject: [PATCH 05/30] fix previous commit

---
 Cargo.lock                                 | 73 +++++++---------------
 halo2_proofs/Cargo.toml                    |  2 +-
 halo2_proofs/src/arithmetic.rs             | 30 ++++++---
 halo2_proofs/src/dev.rs                    |  4 +-
 halo2_proofs/src/dev/util.rs               |  2 +-
 halo2_proofs/src/helpers.rs                | 19 +++---
 halo2_proofs/src/plonk/keygen.rs           |  3 +
 halo2_proofs/src/plonk/prover.rs           |  2 +-
 halo2_proofs/src/plonk/vanishing/prover.rs |  4 +-
 halo2_proofs/src/poly/domain.rs            |  4 +-
 halo2_proofs/src/poly/multiopen.rs         |  8 +--
 halo2_proofs/src/transcript/blake2b.rs     |  2 +-
 halo2_proofs/src/transcript/poseidon.rs    | 30 ++++++---
 13 files changed, 91 insertions(+), 92 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index ec56f19b08..340d1900ee 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -666,9 +666,9 @@ dependencies = [
 
 [[package]]
 name = "ff"
-version = "0.12.0"
+version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df689201f395c6b90dfe87127685f8dbfc083a5e779e613575d8bd7314300c3e"
+checksum = "ded41244b729663b1e574f1b4fb731469f69f79c17667b5d776b16cda0479449"
 dependencies = [
  "bitvec",
  "rand_core",
@@ -807,11 +807,10 @@ checksum = "78cc372d058dcf6d5ecd98510e7fbc9e5aec4d21de70f65fea8fecebcd881bd4"
 
 [[package]]
 name = "group"
-version = "0.12.0"
+version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7391856def869c1c81063a03457c676fbcd419709c3dfb33d8d319de484b154d"
+checksum = "f0f9ef7462f7c099f518d754361858f86d8a07af53ba9af0fe635bbccb151a63"
 dependencies = [
- "byteorder",
  "ff",
  "rand_core",
  "subtle",
@@ -860,7 +859,7 @@ dependencies = [
  "ff",
  "group",
  "halo2_proofs",
- "halo2curves 0.2.1",
+ "halo2curves",
  "lazy_static",
  "plotters",
  "pprof",
@@ -886,7 +885,7 @@ dependencies = [
  "getrandom",
  "group",
  "gumdrop",
- "halo2curves 0.3.1 (git+https://github.com/scroll-tech/halo2curves.git?branch=0.3.1-derive-serde)",
+ "halo2curves",
  "log",
  "num-bigint",
  "num-integer",
@@ -903,42 +902,8 @@ dependencies = [
 
 [[package]]
 name = "halo2curves"
-version = "0.2.1"
-source = "git+https://github.com/privacy-scaling-explorations/halo2curves?tag=0.3.0#83c72d49762343ffc9576ca11a2aa615efe1029b"
-dependencies = [
- "ff",
- "group",
- "lazy_static",
- "num-bigint",
- "num-traits",
- "pasta_curves",
- "rand",
- "rand_core",
- "static_assertions",
- "subtle",
-]
-
-[[package]]
-name = "halo2curves"
-version = "0.3.1"
-source = "git+https://github.com/privacy-scaling-explorations/halo2curves.git?tag=0.3.1#9b67e19bca30a35208b0c1b41c1723771e2c9f49"
-dependencies = [
- "ff",
- "group",
- "lazy_static",
- "num-bigint",
- "num-traits",
- "pasta_curves",
- "rand",
- "rand_core",
- "static_assertions",
- "subtle",
-]
-
-[[package]]
-name = "halo2curves"
-version = "0.3.1"
-source = "git+https://github.com/scroll-tech/halo2curves.git?branch=0.3.1-derive-serde#c0ac1935e5da2a620204b5b011be2c924b1e0155"
+version = "0.3.2"
+source = "git+https://github.com/privacy-scaling-explorations/halo2curves?tag=0.3.2#9f5c50810bbefe779ee5cf1d852b2fe85dc35d5e"
 dependencies = [
  "ff",
  "group",
@@ -949,7 +914,6 @@ dependencies = [
  "paste",
  "rand",
  "rand_core",
- "serde",
  "static_assertions",
  "subtle",
 ]
@@ -1090,6 +1054,9 @@ name = "lazy_static"
 version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
+dependencies = [
+ "spin",
+]
 
 [[package]]
 name = "libc"
@@ -1303,9 +1270,9 @@ dependencies = [
 
 [[package]]
 name = "pasta_curves"
-version = "0.4.0"
+version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "369d7785168ad7ff0cbe467d968ca3e19a927d8536b11ef9c21b4e454b15ba42"
+checksum = "d3e57598f73cc7e1b2ac63c79c517b31a0877cd7c402cdcaa311b5208de7a095"
 dependencies = [
  "blake2b_simd",
  "ff",
@@ -1423,10 +1390,9 @@ dependencies = [
 [[package]]
 name = "poseidon"
 version = "0.2.0"
-source = "git+https://github.com/scroll-tech/poseidon.git?branch=scroll-dev-0220#2fb4a2385bada39b50dce12fe50cb80d2fd33476"
+source = "git+https://github.com/privacy-scaling-explorations/poseidon.git?tag=v2023_04_20#807f8f555313f726ca03bdf941f798098f488ba4"
 dependencies = [
- "group",
- "halo2curves 0.3.1 (git+https://github.com/privacy-scaling-explorations/halo2curves.git?tag=0.3.1)",
+ "halo2curves",
  "subtle",
 ]
 
@@ -1733,9 +1699,6 @@ name = "serde"
 version = "1.0.136"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ce31e24b01e1e524df96f1c2fdd054405f8d7376249a5110886fb4b658484789"
-dependencies = [
- "serde_derive",
-]
 
 [[package]]
 name = "serde_cbor"
@@ -1808,6 +1771,12 @@ version = "1.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f2dd574626839106c320a323308629dcb1acfc96e32a8cba364ddc61ac23ee83"
 
+[[package]]
+name = "spin"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e63cff320ae2c57904679ba7cb63280a3dc4613885beafb148ee7bf9aa9042d"
+
 [[package]]
 name = "stable_deref_trait"
 version = "1.2.0"
diff --git a/halo2_proofs/Cargo.toml b/halo2_proofs/Cargo.toml
index 0fcc9bfde9..c26b8c5227 100644
--- a/halo2_proofs/Cargo.toml
+++ b/halo2_proofs/Cargo.toml
@@ -55,7 +55,7 @@ blake2b_simd = "1"
 sha3 = "0.9.1"
 subtle = "2.3"
 cfg-if = "0.1"
-poseidon = { git = "https://github.com/scroll-tech/poseidon.git", branch = "scroll-dev-0220" }
+poseidon = { git = "https://github.com/privacy-scaling-explorations/poseidon.git", tag = "v2023_04_20" }
 num-integer = "0.1"
 num-bigint = { version = "0.4", features = ["rand"] }
 
diff --git a/halo2_proofs/src/arithmetic.rs b/halo2_proofs/src/arithmetic.rs
index 234ef6db54..56ca5fd90c 100644
--- a/halo2_proofs/src/arithmetic.rs
+++ b/halo2_proofs/src/arithmetic.rs
@@ -263,7 +263,7 @@ fn serial_split_fft<Scalar: Field, G: FftGroup<Scalar>>(
 
         let mut k = 0;
         while k < n {
-            let mut w = G::Scalar::ONE;
+            let mut w = Scalar::ONE;
             for j in 0..m {
                 let mut t = a[(k + j + m) as usize];
                 t *= &w;
@@ -293,10 +293,15 @@ fn split_radix_fft<Scalar: Field, G: FftGroup<Scalar>>(
 
     // we use out-place bitreverse here, split_m <= num_threads, so the buffer spase is small
     // and it's is good for data locality
-    let mut t1 = vec![G::Scalar::ZERO; split_m];
+    // COPY `a` to init temp buffer,
+    // it's a workaround for G: FftGroup,
+    // used to be: vec![G::identity; split_m];
+    // let mut t1 = a.clone();
     // if unsafe code is allowed, a 10% performance improvement can be achieved
-    // let mut t1: Vec<G> = Vec::with_capacity(split_m as usize);
-    // unsafe{ t1.set_len(split_m as usize); }
+    let mut t1: Vec<G> = Vec::with_capacity(split_m as usize);
+    unsafe {
+        t1.set_len(split_m as usize);
+    }
     for i in 0..split_m {
         t1[bitreverse(i, log_split)] = a[(i * sub_n + sub_fft_offset)];
     }
@@ -310,7 +315,7 @@ fn split_radix_fft<Scalar: Field, G: FftGroup<Scalar>>(
     if high_idx > 0 {
         omega = omega * twiddle_lut[(1 << sparse_degree) + high_idx];
     }
-    let mut w_m = G::Scalar::ONE;
+    let mut w_m = Scalar::ONE;
     for i in 0..split_m {
         t1[i] *= &w_m;
         tmp[i] = t1[i];
@@ -329,7 +334,7 @@ pub fn generate_twiddle_lookup_table<F: Field>(
 
     // dense
     if is_lut_len_large {
-        let mut twiddle_lut = vec![F::zero(); (1 << log_n) as usize];
+        let mut twiddle_lut = vec![F::ZERO; (1 << log_n) as usize];
         parallelize(&mut twiddle_lut, |twiddle_lut, start| {
             let mut w_n = omega.pow_vartime([start as u64, 0, 0, 0]);
             for twiddle_lut in twiddle_lut.iter_mut() {
@@ -343,7 +348,7 @@ pub fn generate_twiddle_lookup_table<F: Field>(
     // sparse
     let low_degree_lut_len = 1 << sparse_degree;
     let high_degree_lut_len = 1 << (log_n - sparse_degree - without_last_level as u32);
-    let mut twiddle_lut = vec![F::zero(); (low_degree_lut_len + high_degree_lut_len) as usize];
+    let mut twiddle_lut = vec![F::ZERO; (low_degree_lut_len + high_degree_lut_len) as usize];
     parallelize(
         &mut twiddle_lut[..low_degree_lut_len],
         |twiddle_lut, start| {
@@ -378,10 +383,15 @@ pub fn parallel_fft<Scalar: Field, G: FftGroup<Scalar>>(a: &mut [G], omega: Scal
     let twiddle_lut = generate_twiddle_lookup_table(omega, log_n, SPARSE_TWIDDLE_DEGREE, true);
 
     // split fft
-    let mut tmp = vec![G::Scalar::ZERO; n];
+    // COPY `a` to init temp buffer,
+    // it's a workaround for G: FftGroup,
+    // used to be: vec![G::identity; n];
+    // let mut tmp = a.clone();
     // if unsafe code is allowed, a 10% performance improvement can be achieved
-    // let mut tmp: Vec<G> = Vec::with_capacity(n);
-    // unsafe{ tmp.set_len(n); }
+    let mut tmp: Vec<G> = Vec::with_capacity(n);
+    unsafe {
+        tmp.set_len(n);
+    }
     multicore::scope(|scope| {
         let a = &*a;
         let twiddle_lut = &*twiddle_lut;
diff --git a/halo2_proofs/src/dev.rs b/halo2_proofs/src/dev.rs
index 34d7f7b1b3..440796bb6d 100644
--- a/halo2_proofs/src/dev.rs
+++ b/halo2_proofs/src/dev.rs
@@ -97,7 +97,7 @@ impl Region {
 }
 
 /// The value of a particular cell within the circuit.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+#[derive(Clone, Copy, Debug, Eq)]
 pub enum CellValue<F: Field> {
     /// An unassigned cell.
     Unassigned,
@@ -110,7 +110,7 @@ pub enum CellValue<F: Field> {
     Poison(usize),
 }
 
-impl<F: Group + Field> PartialEq for CellValue<F> {
+impl<F: Field> PartialEq for CellValue<F> {
     fn eq(&self, other: &Self) -> bool {
         match (self, other) {
             (Self::Unassigned, Self::Unassigned) => true,
diff --git a/halo2_proofs/src/dev/util.rs b/halo2_proofs/src/dev/util.rs
index 353f9869f6..f4cd83c34a 100644
--- a/halo2_proofs/src/dev/util.rs
+++ b/halo2_proofs/src/dev/util.rs
@@ -86,7 +86,7 @@ pub(super) fn load<'a, F: Field, T: ColumnType, Q: Into<AnyQuery> + Copy>(
 }
 */
 
-pub(super) fn load_slice<'a, F: FieldExt, T: ColumnType, Q: Into<AnyQuery> + Copy>(
+pub(super) fn load_slice<'a, F: Field, T: ColumnType, Q: Into<AnyQuery> + Copy>(
     n: i32,
     row: i32,
     queries: &'a [(Column<T>, Rotation)],
diff --git a/halo2_proofs/src/helpers.rs b/halo2_proofs/src/helpers.rs
index f58ec9b100..df1f74fd3c 100644
--- a/halo2_proofs/src/helpers.rs
+++ b/halo2_proofs/src/helpers.rs
@@ -1,8 +1,6 @@
 use crate::plonk::{Any, Column};
 use crate::poly::Polynomial;
-use ff::Field;
-use ff::PrimeField;
-use halo2curves::FieldExt;
+use ff::{Field, FromUniformBytes, PrimeField};
 use halo2curves::{pairing::Engine, serde::SerdeObject, CurveAffine};
 use num_bigint::BigUint;
 use std::io;
@@ -42,24 +40,30 @@ pub(crate) trait CurveRead: CurveAffine {
 }
 impl<C: CurveAffine> CurveRead for C {}
 
-pub fn field_to_bn<F: FieldExt>(f: &F) -> BigUint {
+pub fn field_to_bn<F: PrimeField>(f: &F) -> BigUint {
     BigUint::from_bytes_le(f.to_repr().as_ref())
 }
 
 /// Input a big integer `bn`, compute a field element `f`
 /// such that `f == bn % F::MODULUS`.
-pub fn bn_to_field<F: FieldExt>(bn: &BigUint) -> F {
+pub fn bn_to_field<F: PrimeField>(bn: &BigUint) -> F
+where
+    F: FromUniformBytes<64>,
+{
     let mut buf = bn.to_bytes_le();
     buf.resize(64, 0u8);
 
     let mut buf_array = [0u8; 64];
     buf_array.copy_from_slice(buf.as_ref());
-    F::from_bytes_wide(&buf_array)
+    F::from_uniform_bytes(&buf_array)
 }
 
 /// Input a base field element `b`, output a scalar field
 /// element `s` s.t. `s == b % ScalarField::MODULUS`
-pub(crate) fn base_to_scalar<C: CurveAffine>(base: &C::Base) -> C::Scalar {
+pub(crate) fn base_to_scalar<C: CurveAffine>(base: &C::Base) -> C::Scalar
+where
+    C::Scalar: FromUniformBytes<64>,
+{
     let bn = field_to_bn(base);
     // bn_to_field will perform a mod reduction
     bn_to_field(&bn)
@@ -103,6 +107,7 @@ mod test {
         }
     }
 }
+
 pub trait SerdeCurveAffine: CurveAffine + SerdeObject {
     /// Reads an element from the buffer and parses it according to the `format`:
     /// - `Processed`: Reads a compressed curve element and decompress it
diff --git a/halo2_proofs/src/plonk/keygen.rs b/halo2_proofs/src/plonk/keygen.rs
index 10a3660d9f..ec11fa62f7 100644
--- a/halo2_proofs/src/plonk/keygen.rs
+++ b/halo2_proofs/src/plonk/keygen.rs
@@ -424,6 +424,7 @@ where
     C: CurveAffine,
     P: Params<'params, C>,
     ConcreteCircuit: Circuit<C::Scalar>,
+    <C as CurveAffine>::ScalarExt: FromUniformBytes<64>,
 {
     keygen_pk_impl(params, None, circuit)
 }
@@ -438,6 +439,7 @@ where
     C: CurveAffine,
     P: Params<'params, C>,
     ConcreteCircuit: Circuit<C::Scalar>,
+    <C as CurveAffine>::ScalarExt: FromUniformBytes<64>,
 {
     keygen_pk_impl(params, Some(vk), circuit)
 }
@@ -452,6 +454,7 @@ where
     C: CurveAffine,
     P: Params<'params, C>,
     ConcreteCircuit: Circuit<C::Scalar>,
+    <C as CurveAffine>::ScalarExt: FromUniformBytes<64>,
 {
     let (domain, cs, config) = create_domain::<C, ConcreteCircuit>(params.k());
 
diff --git a/halo2_proofs/src/plonk/prover.rs b/halo2_proofs/src/plonk/prover.rs
index 0c9edd780d..c522947820 100644
--- a/halo2_proofs/src/plonk/prover.rs
+++ b/halo2_proofs/src/plonk/prover.rs
@@ -466,7 +466,7 @@ where
                     //*cell = C::Scalar::one();
                     //}
                     let idx = advice_values.len() - 1;
-                    advice_values[idx] = Scheme::Scalar::one();
+                    advice_values[idx] = Scheme::Scalar::ONE;
                 }
 
                 // Compute commitments to advice column polynomials
diff --git a/halo2_proofs/src/plonk/vanishing/prover.rs b/halo2_proofs/src/plonk/vanishing/prover.rs
index 71d29b180d..d394b8c0de 100644
--- a/halo2_proofs/src/plonk/vanishing/prover.rs
+++ b/halo2_proofs/src/plonk/vanishing/prover.rs
@@ -50,10 +50,10 @@ impl<C: CurveAffine> Argument<C> {
         transcript: &mut T,
     ) -> Result<Committed<C>, Error> {
         // Sample a random polynomial of degree n - 1
-        let random_poly = domain.constant_lagrange(C::Scalar::one());
+        let random_poly = domain.constant_lagrange(C::Scalar::ONE);
         let random_poly = domain.lagrange_to_coeff(random_poly);
         // Sample a random blinding factor
-        let random_blind = Blind(C::Scalar::zero());
+        let random_blind = Blind(C::Scalar::ZERO);
         let c = params.commit(&random_poly, random_blind).to_affine();
         // We write the identity point to the transcript which
         // is the commitment of the zero polynomial.
diff --git a/halo2_proofs/src/poly/domain.rs b/halo2_proofs/src/poly/domain.rs
index e43934a763..63be6d654f 100644
--- a/halo2_proofs/src/poly/domain.rs
+++ b/halo2_proofs/src/poly/domain.rs
@@ -458,7 +458,7 @@ impl<F: WithSmallOrderMulGroup<3>> EvaluationDomain<F> {
         parallelize(a, |a, index| {
             let mut c_power = c.pow_vartime(&[index as u64, 0, 0, 0]);
             for a in a {
-                a = a * (&c_power);
+                *a = *a * (&c_power);
                 c_power = c_power * c;
             }
         });
@@ -654,7 +654,7 @@ fn test_l_i() {
         points.push(domain.omega.pow(&[i, 0, 0, 0]));
     }
     for i in 0..8 {
-        let mut l_i = vec![Scalar::zero(); 8];
+        let mut l_i = vec![Scalar::ZERO; 8];
         l_i[i] = Scalar::ONE;
         let l_i = lagrange_interpolate(&points[..], &l_i[..]);
         l.push(l_i);
diff --git a/halo2_proofs/src/poly/multiopen.rs b/halo2_proofs/src/poly/multiopen.rs
index 854018e90a..9cff28bde8 100644
--- a/halo2_proofs/src/poly/multiopen.rs
+++ b/halo2_proofs/src/poly/multiopen.rs
@@ -5,7 +5,7 @@
 
 use super::{commitment::ParamsVerifier, PairMSM};
 use crate::{
-    arithmetic::{eval_polynomial, CurveAffine, FieldExt},
+    arithmetic::{eval_polynomial, CurveAffine},
     pairing::arithmetic::{MillerLoopResult, MultiMillerLoop},
     poly::{msm::MSM, Coeff, Error, Polynomial},
 };
@@ -129,7 +129,7 @@ impl<'r, 'params: 'r, C: CurveAffine> PartialEq for CommitmentReference<'r, C> {
     }
 }
 
-trait Query<F: FieldExt>: Sized + Clone {
+trait Query<F: Field>: Sized + Clone {
     type Commitment: PartialEq + Clone;
 
     fn get_rotation(&self) -> Rotation;
@@ -141,7 +141,7 @@ trait Query<F: FieldExt>: Sized + Clone {
 #[cfg(test)]
 mod tests {
 
-    use crate::arithmetic::{eval_polynomial, FieldExt};
+    use crate::arithmetic::{eval_polynomial};
     use crate::pairing::bn256::{Bn256, Fr, G1Affine};
     use crate::poly::{
         commitment::{Params, ParamsVerifier},
@@ -173,7 +173,7 @@ mod tests {
         use rand_core::OsRng;
 
         use super::*;
-        use crate::arithmetic::{eval_polynomial, FieldExt};
+        use crate::arithmetic::{eval_polynomial};
         use crate::poly::{commitment::Params, EvaluationDomain};
         use crate::transcript::Challenge255;
 
diff --git a/halo2_proofs/src/transcript/blake2b.rs b/halo2_proofs/src/transcript/blake2b.rs
index 99954e6efd..78f59811aa 100644
--- a/halo2_proofs/src/transcript/blake2b.rs
+++ b/halo2_proofs/src/transcript/blake2b.rs
@@ -5,7 +5,7 @@ use super::{
 use blake2b_simd::{Params as Blake2bParams, State as Blake2bState};
 use ff::Field;
 use group::ff::PrimeField;
-use halo2curves::{Coordinates, CurveAffine, FieldExt};
+use halo2curves::{Coordinates, CurveAffine};
 use num_bigint::BigUint;
 use std::convert::TryInto;
 use std::io::{self, Read, Write};
diff --git a/halo2_proofs/src/transcript/poseidon.rs b/halo2_proofs/src/transcript/poseidon.rs
index d9da18a440..f3ea5b0aae 100644
--- a/halo2_proofs/src/transcript/poseidon.rs
+++ b/halo2_proofs/src/transcript/poseidon.rs
@@ -1,8 +1,7 @@
 use super::{Challenge255, EncodedChallenge, Transcript, TranscriptRead, TranscriptWrite};
 use crate::helpers::base_to_scalar;
-use ff::Field;
-use group::ff::PrimeField;
-use halo2curves::{Coordinates, CurveAffine, FieldExt};
+use group::ff::{FromUniformBytes, PrimeField};
+use halo2curves::{Coordinates, CurveAffine};
 use num_bigint::BigUint;
 use poseidon::Poseidon;
 use std::convert::TryInto;
@@ -15,13 +14,16 @@ const POSEIDON_T: usize = POSEIDON_RATE + 1usize;
 /// TODO
 #[derive(Debug, Clone)]
 pub struct PoseidonRead<R: Read, C: CurveAffine, E: EncodedChallenge<C>> {
-    state: Poseidon<C::ScalarExt, POSEIDON_T, POSEIDON_RATE>,
+    state: Poseidon<C::Scalar, POSEIDON_T, POSEIDON_RATE>,
     reader: R,
     _marker: PhantomData<(C, E)>,
 }
 
 /// TODO
-impl<R: Read, C: CurveAffine, E: EncodedChallenge<C>> PoseidonRead<R, C, E> {
+impl<R: Read, C: CurveAffine, E: EncodedChallenge<C>> PoseidonRead<R, C, E>
+where
+    <C as CurveAffine>::ScalarExt: FromUniformBytes<64>,
+{
     /// Initialize a transcript given an input buffer.
     pub fn init(reader: R) -> Self {
         PoseidonRead {
@@ -34,6 +36,8 @@ impl<R: Read, C: CurveAffine, E: EncodedChallenge<C>> PoseidonRead<R, C, E> {
 
 impl<R: Read, C: CurveAffine> TranscriptRead<C, Challenge255<C>>
     for PoseidonRead<R, C, Challenge255<C>>
+where
+    <C as CurveAffine>::ScalarExt: FromUniformBytes<64>,
 {
     fn read_point(&mut self) -> io::Result<C> {
         let mut compressed = C::Repr::default();
@@ -64,8 +68,9 @@ impl<R: Read, C: CurveAffine> TranscriptRead<C, Challenge255<C>>
     }
 }
 
-impl<R: Read, C: CurveAffine> Transcript<C, Challenge255<C>>
-    for PoseidonRead<R, C, Challenge255<C>>
+impl<R: Read, C: CurveAffine> Transcript<C, Challenge255<C>> for PoseidonRead<R, C, Challenge255<C>>
+where
+    <C as CurveAffine>::ScalarExt: FromUniformBytes<64>,
 {
     fn squeeze_challenge(&mut self) -> Challenge255<C> {
         //self.state.update(&[PREFIX_SQUEEZE]);
@@ -101,12 +106,15 @@ impl<R: Read, C: CurveAffine> Transcript<C, Challenge255<C>>
 /// TODO
 #[derive(Debug, Clone)]
 pub struct PoseidonWrite<W: Write, C: CurveAffine, E: EncodedChallenge<C>> {
-    state: Poseidon<C::ScalarExt, POSEIDON_T, POSEIDON_RATE>,
+    state: Poseidon<C::Scalar, POSEIDON_T, POSEIDON_RATE>,
     writer: W,
     _marker: PhantomData<(C, E)>,
 }
 
-impl<W: Write, C: CurveAffine, E: EncodedChallenge<C>> PoseidonWrite<W, C, E> {
+impl<W: Write, C: CurveAffine, E: EncodedChallenge<C>> PoseidonWrite<W, C, E>
+where
+    <C as CurveAffine>::ScalarExt: FromUniformBytes<64>,
+{
     /// Initialize a transcript given an output buffer.
     pub fn init(writer: W) -> Self {
         PoseidonWrite {
@@ -125,6 +133,8 @@ impl<W: Write, C: CurveAffine, E: EncodedChallenge<C>> PoseidonWrite<W, C, E> {
 
 impl<W: Write, C: CurveAffine> TranscriptWrite<C, Challenge255<C>>
     for PoseidonWrite<W, C, Challenge255<C>>
+where
+    <C as CurveAffine>::ScalarExt: FromUniformBytes<64>,
 {
     fn write_point(&mut self, point: C) -> io::Result<()> {
         self.common_point(point)?;
@@ -140,6 +150,8 @@ impl<W: Write, C: CurveAffine> TranscriptWrite<C, Challenge255<C>>
 
 impl<W: Write, C: CurveAffine> Transcript<C, Challenge255<C>>
     for PoseidonWrite<W, C, Challenge255<C>>
+where
+    <C as CurveAffine>::ScalarExt: FromUniformBytes<64>,
 {
     fn squeeze_challenge(&mut self) -> Challenge255<C> {
         //self.state.update(&[PREFIX_SQUEEZE]);

From b26a0ae48100f7bbc2f74af9169d83bb6b0c9459 Mon Sep 17 00:00:00 2001
From: Eduard S <eduardsanou@posteo.net>
Date: Thu, 20 Apr 2023 15:20:09 +0200
Subject: [PATCH 06/30] Extend Circuit trait to take parameters in config
 (#168)

* Extend Circuit trait to take parameters in config

The Circuit trait is extended with the following:
```
pub trait Circuit<F: Field> {
    /// [...]
    type Params: Default;

    fn params(&self) -> Self::Params {
        Self::Params::default()
    }

    fn configure_with_params(meta: &mut ConstraintSystem<F>, params: &Self::Params) -> Self::Config {
        Self::configure(meta)
    }

    fn configure(meta: &mut ConstraintSystem<F>) -> Self::Config;
}
```

This allows runtime parametrization of the circuit configuration.  The extension to the Circuit trait has been designed to minimize the breaking change: existing circuits only need to define the associated `type Params`.

Unfortunately "Associated type defaults" are unstable in Rust, otherwise this would be a non-breaking change.  See https://github.com/rust-lang/rust/issues/29661

* Implement circuit params under feature flag

* Don't overwrite configure method

* Fix doc test
---
 halo2_gadgets/Cargo.toml                      |  1 +
 halo2_gadgets/benches/poseidon.rs             |  2 ++
 halo2_gadgets/benches/sha256.rs               |  2 ++
 halo2_gadgets/src/ecc.rs                      |  2 ++
 halo2_gadgets/src/ecc/chip/mul_fixed/short.rs |  2 ++
 halo2_gadgets/src/poseidon/pow5.rs            |  4 +++
 halo2_gadgets/src/sha256/table16.rs           |  2 ++
 .../src/sha256/table16/compression.rs         |  2 ++
 .../src/sha256/table16/message_schedule.rs    |  2 ++
 .../src/sha256/table16/spread_table.rs        |  2 ++
 halo2_gadgets/src/sinsemilla.rs               |  2 ++
 halo2_gadgets/src/sinsemilla/merkle.rs        |  2 ++
 halo2_gadgets/src/utilities.rs                |  2 ++
 halo2_gadgets/src/utilities/cond_swap.rs      |  2 ++
 .../src/utilities/decompose_running_sum.rs    |  2 ++
 .../src/utilities/lookup_range_check.rs       |  4 +++
 halo2_proofs/Cargo.toml                       |  1 +
 halo2_proofs/benches/dev_lookup.rs            |  2 ++
 halo2_proofs/benches/plonk.rs                 |  2 ++
 halo2_proofs/examples/circuit-layout.rs       |  2 ++
 halo2_proofs/examples/serialization.rs        | 12 +++++--
 halo2_proofs/examples/shuffle.rs              |  2 ++
 halo2_proofs/examples/simple-example.rs       |  2 ++
 halo2_proofs/examples/two-chip.rs             |  2 ++
 .../src/circuit/floor_planner/single_pass.rs  |  2 ++
 halo2_proofs/src/circuit/floor_planner/v1.rs  |  2 ++
 halo2_proofs/src/dev.rs                       | 13 ++++++++
 halo2_proofs/src/dev/cost.rs                  |  3 ++
 halo2_proofs/src/dev/gates.rs                 | 12 ++++++-
 halo2_proofs/src/dev/graph.rs                 |  3 ++
 halo2_proofs/src/dev/graph/layout.rs          |  3 ++
 halo2_proofs/src/plonk.rs                     | 31 ++++++++++++++++---
 halo2_proofs/src/plonk/circuit.rs             | 22 +++++++++++++
 halo2_proofs/src/plonk/keygen.rs              | 16 ++++++++--
 halo2_proofs/src/plonk/prover.rs              |  3 ++
 halo2_proofs/tests/plonk_api.rs               |  2 ++
 36 files changed, 163 insertions(+), 9 deletions(-)

diff --git a/halo2_gadgets/Cargo.toml b/halo2_gadgets/Cargo.toml
index 136ef63a16..c4ebf6fae3 100644
--- a/halo2_gadgets/Cargo.toml
+++ b/halo2_gadgets/Cargo.toml
@@ -49,6 +49,7 @@ bench = false
 
 [features]
 dev-graph = ["halo2_proofs/dev-graph", "plotters"]
+circuit-params = ["halo2_proofs/circuit-params"]
 test-dependencies = ["proptest"]
 unstable = []
 
diff --git a/halo2_gadgets/benches/poseidon.rs b/halo2_gadgets/benches/poseidon.rs
index 4494e77a0f..03e595fe0f 100644
--- a/halo2_gadgets/benches/poseidon.rs
+++ b/halo2_gadgets/benches/poseidon.rs
@@ -53,6 +53,8 @@ where
 {
     type Config = MyConfig<WIDTH, RATE, L>;
     type FloorPlanner = SimpleFloorPlanner;
+    #[cfg(feature = "circuit-params")]
+    type Params = ();
 
     fn without_witnesses(&self) -> Self {
         Self {
diff --git a/halo2_gadgets/benches/sha256.rs b/halo2_gadgets/benches/sha256.rs
index 670956cb0d..0e14d61946 100644
--- a/halo2_gadgets/benches/sha256.rs
+++ b/halo2_gadgets/benches/sha256.rs
@@ -37,6 +37,8 @@ fn bench(name: &str, k: u32, c: &mut Criterion) {
     impl Circuit<pallas::Base> for MyCircuit {
         type Config = Table16Config;
         type FloorPlanner = SimpleFloorPlanner;
+        #[cfg(feature = "circuit-params")]
+        type Params = ();
 
         fn without_witnesses(&self) -> Self {
             Self::default()
diff --git a/halo2_gadgets/src/ecc.rs b/halo2_gadgets/src/ecc.rs
index 08f34b15f2..05ea999053 100644
--- a/halo2_gadgets/src/ecc.rs
+++ b/halo2_gadgets/src/ecc.rs
@@ -731,6 +731,8 @@ pub(crate) mod tests {
     impl Circuit<pallas::Base> for MyCircuit {
         type Config = EccConfig<TestFixedBases>;
         type FloorPlanner = SimpleFloorPlanner;
+        #[cfg(feature = "circuit-params")]
+        type Params = ();
 
         fn without_witnesses(&self) -> Self {
             MyCircuit { test_errors: false }
diff --git a/halo2_gadgets/src/ecc/chip/mul_fixed/short.rs b/halo2_gadgets/src/ecc/chip/mul_fixed/short.rs
index 4c92becb86..42363baa11 100644
--- a/halo2_gadgets/src/ecc/chip/mul_fixed/short.rs
+++ b/halo2_gadgets/src/ecc/chip/mul_fixed/short.rs
@@ -434,6 +434,8 @@ pub mod tests {
         impl Circuit<pallas::Base> for MyCircuit {
             type Config = EccConfig<TestFixedBases>;
             type FloorPlanner = SimpleFloorPlanner;
+            #[cfg(feature = "circuit-params")]
+            type Params = ();
 
             fn without_witnesses(&self) -> Self {
                 Self::default()
diff --git a/halo2_gadgets/src/poseidon/pow5.rs b/halo2_gadgets/src/poseidon/pow5.rs
index 52b0d27312..7abd86329d 100644
--- a/halo2_gadgets/src/poseidon/pow5.rs
+++ b/halo2_gadgets/src/poseidon/pow5.rs
@@ -620,6 +620,8 @@ mod tests {
     {
         type Config = Pow5Config<Fp, WIDTH, RATE>;
         type FloorPlanner = SimpleFloorPlanner;
+        #[cfg(feature = "circuit-params")]
+        type Params = ();
 
         fn without_witnesses(&self) -> Self {
             PermuteCircuit::<S, WIDTH, RATE>(PhantomData)
@@ -735,6 +737,8 @@ mod tests {
     {
         type Config = Pow5Config<Fp, WIDTH, RATE>;
         type FloorPlanner = SimpleFloorPlanner;
+        #[cfg(feature = "circuit-params")]
+        type Params = ();
 
         fn without_witnesses(&self) -> Self {
             Self {
diff --git a/halo2_gadgets/src/sha256/table16.rs b/halo2_gadgets/src/sha256/table16.rs
index c4919158bc..76b8e3476f 100644
--- a/halo2_gadgets/src/sha256/table16.rs
+++ b/halo2_gadgets/src/sha256/table16.rs
@@ -468,6 +468,8 @@ mod tests {
         impl Circuit<pallas::Base> for MyCircuit {
             type Config = Table16Config;
             type FloorPlanner = SimpleFloorPlanner;
+            #[cfg(feature = "circuit-params")]
+            type Params = ();
 
             fn without_witnesses(&self) -> Self {
                 MyCircuit {}
diff --git a/halo2_gadgets/src/sha256/table16/compression.rs b/halo2_gadgets/src/sha256/table16/compression.rs
index 62deb42937..874452a418 100644
--- a/halo2_gadgets/src/sha256/table16/compression.rs
+++ b/halo2_gadgets/src/sha256/table16/compression.rs
@@ -954,6 +954,8 @@ mod tests {
         impl Circuit<pallas::Base> for MyCircuit {
             type Config = Table16Config;
             type FloorPlanner = SimpleFloorPlanner;
+            #[cfg(feature = "circuit-params")]
+            type Params = ();
 
             fn without_witnesses(&self) -> Self {
                 MyCircuit {}
diff --git a/halo2_gadgets/src/sha256/table16/message_schedule.rs b/halo2_gadgets/src/sha256/table16/message_schedule.rs
index 690e086c49..3da70c0add 100644
--- a/halo2_gadgets/src/sha256/table16/message_schedule.rs
+++ b/halo2_gadgets/src/sha256/table16/message_schedule.rs
@@ -411,6 +411,8 @@ mod tests {
         impl Circuit<pallas::Base> for MyCircuit {
             type Config = Table16Config;
             type FloorPlanner = SimpleFloorPlanner;
+            #[cfg(feature = "circuit-params")]
+            type Params = ();
 
             fn without_witnesses(&self) -> Self {
                 MyCircuit {}
diff --git a/halo2_gadgets/src/sha256/table16/spread_table.rs b/halo2_gadgets/src/sha256/table16/spread_table.rs
index 031f088084..9b8a313cc2 100644
--- a/halo2_gadgets/src/sha256/table16/spread_table.rs
+++ b/halo2_gadgets/src/sha256/table16/spread_table.rs
@@ -304,6 +304,8 @@ mod tests {
         impl<F: PrimeField> Circuit<F> for MyCircuit {
             type Config = SpreadTableConfig;
             type FloorPlanner = SimpleFloorPlanner;
+            #[cfg(feature = "circuit-params")]
+            type Params = ();
 
             fn without_witnesses(&self) -> Self {
                 MyCircuit {}
diff --git a/halo2_gadgets/src/sinsemilla.rs b/halo2_gadgets/src/sinsemilla.rs
index 2670529229..543d49f55f 100644
--- a/halo2_gadgets/src/sinsemilla.rs
+++ b/halo2_gadgets/src/sinsemilla.rs
@@ -525,6 +525,8 @@ pub(crate) mod tests {
             SinsemillaConfig<TestHashDomain, TestCommitDomain, TestFixedBases>,
         );
         type FloorPlanner = SimpleFloorPlanner;
+        #[cfg(feature = "circuit-params")]
+        type Params = ();
 
         fn without_witnesses(&self) -> Self {
             MyCircuit {}
diff --git a/halo2_gadgets/src/sinsemilla/merkle.rs b/halo2_gadgets/src/sinsemilla/merkle.rs
index a9ae781d5c..219a9025af 100644
--- a/halo2_gadgets/src/sinsemilla/merkle.rs
+++ b/halo2_gadgets/src/sinsemilla/merkle.rs
@@ -213,6 +213,8 @@ pub mod tests {
             MerkleConfig<TestHashDomain, TestCommitDomain, TestFixedBases>,
         );
         type FloorPlanner = SimpleFloorPlanner;
+        #[cfg(feature = "circuit-params")]
+        type Params = ();
 
         fn without_witnesses(&self) -> Self {
             Self::default()
diff --git a/halo2_gadgets/src/utilities.rs b/halo2_gadgets/src/utilities.rs
index 683a553b7e..887ee92475 100644
--- a/halo2_gadgets/src/utilities.rs
+++ b/halo2_gadgets/src/utilities.rs
@@ -271,6 +271,8 @@ mod tests {
         impl<const RANGE: usize> Circuit<pallas::Base> for MyCircuit<RANGE> {
             type Config = Config;
             type FloorPlanner = SimpleFloorPlanner;
+            #[cfg(feature = "circuit-params")]
+            type Params = ();
 
             fn without_witnesses(&self) -> Self {
                 MyCircuit(self.0)
diff --git a/halo2_gadgets/src/utilities/cond_swap.rs b/halo2_gadgets/src/utilities/cond_swap.rs
index 2dc96d5904..d71b2599a7 100644
--- a/halo2_gadgets/src/utilities/cond_swap.rs
+++ b/halo2_gadgets/src/utilities/cond_swap.rs
@@ -217,6 +217,8 @@ mod tests {
         impl<F: PrimeField> Circuit<F> for MyCircuit<F> {
             type Config = CondSwapConfig;
             type FloorPlanner = SimpleFloorPlanner;
+            #[cfg(feature = "circuit-params")]
+            type Params = ();
 
             fn without_witnesses(&self) -> Self {
                 Self::default()
diff --git a/halo2_gadgets/src/utilities/decompose_running_sum.rs b/halo2_gadgets/src/utilities/decompose_running_sum.rs
index 96fd279942..041044ffcb 100644
--- a/halo2_gadgets/src/utilities/decompose_running_sum.rs
+++ b/halo2_gadgets/src/utilities/decompose_running_sum.rs
@@ -243,6 +243,8 @@ mod tests {
         {
             type Config = RunningSumConfig<F, WINDOW_NUM_BITS>;
             type FloorPlanner = SimpleFloorPlanner;
+            #[cfg(feature = "circuit-params")]
+            type Params = ();
 
             fn without_witnesses(&self) -> Self {
                 Self {
diff --git a/halo2_gadgets/src/utilities/lookup_range_check.rs b/halo2_gadgets/src/utilities/lookup_range_check.rs
index 36be7c7745..e5990b3433 100644
--- a/halo2_gadgets/src/utilities/lookup_range_check.rs
+++ b/halo2_gadgets/src/utilities/lookup_range_check.rs
@@ -410,6 +410,8 @@ mod tests {
         impl<F: PrimeFieldBits> Circuit<F> for MyCircuit<F> {
             type Config = LookupRangeCheckConfig<F, K>;
             type FloorPlanner = SimpleFloorPlanner;
+            #[cfg(feature = "circuit-params")]
+            type Params = ();
 
             fn without_witnesses(&self) -> Self {
                 *self
@@ -506,6 +508,8 @@ mod tests {
         impl<F: PrimeFieldBits> Circuit<F> for MyCircuit<F> {
             type Config = LookupRangeCheckConfig<F, K>;
             type FloorPlanner = SimpleFloorPlanner;
+            #[cfg(feature = "circuit-params")]
+            type Params = ();
 
             fn without_witnesses(&self) -> Self {
                 MyCircuit {
diff --git a/halo2_proofs/Cargo.toml b/halo2_proofs/Cargo.toml
index c26b8c5227..7acad5c474 100644
--- a/halo2_proofs/Cargo.toml
+++ b/halo2_proofs/Cargo.toml
@@ -91,6 +91,7 @@ parallel_syn = []
 phase-check = []
 profile = ["ark-std/print-trace"]
 mock-batch-inv = []
+circuit-params = []
 
 [lib]
 bench = false
diff --git a/halo2_proofs/benches/dev_lookup.rs b/halo2_proofs/benches/dev_lookup.rs
index 745a36b928..62ed5a7f19 100644
--- a/halo2_proofs/benches/dev_lookup.rs
+++ b/halo2_proofs/benches/dev_lookup.rs
@@ -28,6 +28,8 @@ fn criterion_benchmark(c: &mut Criterion) {
     impl<F: PrimeField> Circuit<F> for MyCircuit<F> {
         type Config = MyConfig;
         type FloorPlanner = SimpleFloorPlanner;
+        #[cfg(feature = "circuit-params")]
+        type Params = ();
 
         fn without_witnesses(&self) -> Self {
             Self::default()
diff --git a/halo2_proofs/benches/plonk.rs b/halo2_proofs/benches/plonk.rs
index cf02cf87e8..9c9bd2618a 100644
--- a/halo2_proofs/benches/plonk.rs
+++ b/halo2_proofs/benches/plonk.rs
@@ -183,6 +183,8 @@ fn criterion_benchmark(c: &mut Criterion) {
     impl<F: Field> Circuit<F> for MyCircuit<F> {
         type Config = PlonkConfig;
         type FloorPlanner = SimpleFloorPlanner;
+        #[cfg(feature = "circuit-params")]
+        type Params = ();
 
         fn without_witnesses(&self) -> Self {
             Self {
diff --git a/halo2_proofs/examples/circuit-layout.rs b/halo2_proofs/examples/circuit-layout.rs
index 6a73f51ff8..18de27a783 100644
--- a/halo2_proofs/examples/circuit-layout.rs
+++ b/halo2_proofs/examples/circuit-layout.rs
@@ -161,6 +161,8 @@ impl<FF: Field> StandardCs<FF> for StandardPlonk<FF> {
 impl<F: Field> Circuit<F> for MyCircuit<F> {
     type Config = PlonkConfig;
     type FloorPlanner = SimpleFloorPlanner;
+    #[cfg(feature = "circuit-params")]
+    type Params = ();
 
     fn without_witnesses(&self) -> Self {
         Self {
diff --git a/halo2_proofs/examples/serialization.rs b/halo2_proofs/examples/serialization.rs
index 91ed5464e4..39b6b1192f 100644
--- a/halo2_proofs/examples/serialization.rs
+++ b/halo2_proofs/examples/serialization.rs
@@ -86,6 +86,8 @@ struct StandardPlonk(Fr);
 impl Circuit<Fr> for StandardPlonk {
     type Config = StandardPlonkConfig;
     type FloorPlanner = SimpleFloorPlanner;
+    #[cfg(feature = "circuit-params")]
+    type Params = ();
 
     fn without_witnesses(&self) -> Self {
         Self::default()
@@ -140,8 +142,14 @@ fn main() {
 
     let f = File::open("serialization-test.pk").unwrap();
     let mut reader = BufReader::new(f);
-    let pk = ProvingKey::<G1Affine>::read::<_, StandardPlonk>(&mut reader, SerdeFormat::RawBytes)
-        .unwrap();
+    #[allow(clippy::unit_arg)]
+    let pk = ProvingKey::<G1Affine>::read::<_, StandardPlonk>(
+        &mut reader,
+        SerdeFormat::RawBytes,
+        #[cfg(feature = "circuit-params")]
+        circuit.params(),
+    )
+    .unwrap();
 
     std::fs::remove_file("serialization-test.pk").unwrap();
 
diff --git a/halo2_proofs/examples/shuffle.rs b/halo2_proofs/examples/shuffle.rs
index 08d16b9f27..eaa8826f0a 100644
--- a/halo2_proofs/examples/shuffle.rs
+++ b/halo2_proofs/examples/shuffle.rs
@@ -136,6 +136,8 @@ impl<F: Field, const W: usize, const H: usize> MyCircuit<F, W, H> {
 impl<F: Field, const W: usize, const H: usize> Circuit<F> for MyCircuit<F, W, H> {
     type Config = MyConfig<W>;
     type FloorPlanner = V1;
+    #[cfg(feature = "circuit-params")]
+    type Params = ();
 
     fn without_witnesses(&self) -> Self {
         Self::default()
diff --git a/halo2_proofs/examples/simple-example.rs b/halo2_proofs/examples/simple-example.rs
index 2273ce9759..242257a692 100644
--- a/halo2_proofs/examples/simple-example.rs
+++ b/halo2_proofs/examples/simple-example.rs
@@ -248,6 +248,8 @@ impl<F: Field> Circuit<F> for MyCircuit<F> {
     // Since we are using a single chip for everything, we can just reuse its config.
     type Config = FieldConfig;
     type FloorPlanner = SimpleFloorPlanner;
+    #[cfg(feature = "circuit-params")]
+    type Params = ();
 
     fn without_witnesses(&self) -> Self {
         Self::default()
diff --git a/halo2_proofs/examples/two-chip.rs b/halo2_proofs/examples/two-chip.rs
index 4113d94143..336f9c4957 100644
--- a/halo2_proofs/examples/two-chip.rs
+++ b/halo2_proofs/examples/two-chip.rs
@@ -458,6 +458,8 @@ impl<F: Field> Circuit<F> for MyCircuit<F> {
     // Since we are using a single chip for everything, we can just reuse its config.
     type Config = FieldConfig;
     type FloorPlanner = SimpleFloorPlanner;
+    #[cfg(feature = "circuit-params")]
+    type Params = ();
 
     fn without_witnesses(&self) -> Self {
         Self::default()
diff --git a/halo2_proofs/src/circuit/floor_planner/single_pass.rs b/halo2_proofs/src/circuit/floor_planner/single_pass.rs
index 0761957bfc..1ef0a6af81 100644
--- a/halo2_proofs/src/circuit/floor_planner/single_pass.rs
+++ b/halo2_proofs/src/circuit/floor_planner/single_pass.rs
@@ -681,6 +681,8 @@ mod tests {
         impl Circuit<vesta::Scalar> for MyCircuit {
             type Config = Column<Advice>;
             type FloorPlanner = SimpleFloorPlanner;
+            #[cfg(feature = "circuit-params")]
+            type Params = ();
 
             fn without_witnesses(&self) -> Self {
                 MyCircuit {}
diff --git a/halo2_proofs/src/circuit/floor_planner/v1.rs b/halo2_proofs/src/circuit/floor_planner/v1.rs
index 0fd28c196f..463d119196 100644
--- a/halo2_proofs/src/circuit/floor_planner/v1.rs
+++ b/halo2_proofs/src/circuit/floor_planner/v1.rs
@@ -546,6 +546,8 @@ mod tests {
         impl Circuit<vesta::Scalar> for MyCircuit {
             type Config = Column<Advice>;
             type FloorPlanner = super::V1;
+            #[cfg(feature = "circuit-params")]
+            type Params = ();
 
             fn without_witnesses(&self) -> Self {
                 MyCircuit {}
diff --git a/halo2_proofs/src/dev.rs b/halo2_proofs/src/dev.rs
index 440796bb6d..f2580de180 100644
--- a/halo2_proofs/src/dev.rs
+++ b/halo2_proofs/src/dev.rs
@@ -346,6 +346,8 @@ impl<F: Field> Mul<F> for Value<F> {
 /// impl<F: PrimeField> Circuit<F> for MyCircuit {
 ///     type Config = MyConfig;
 ///     type FloorPlanner = SimpleFloorPlanner;
+///     #[cfg(feature = "circuit-params")]
+///     type Params = ();
 ///
 ///     fn without_witnesses(&self) -> Self {
 ///         Self::default()
@@ -925,6 +927,9 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
         let n = 1 << k;
 
         let mut cs = ConstraintSystem::default();
+        #[cfg(feature = "circuit-params")]
+        let config = ConcreteCircuit::configure_with_params(&mut cs, circuit.params());
+        #[cfg(not(feature = "circuit-params"))]
         let config = ConcreteCircuit::configure(&mut cs);
         let cs = cs;
 
@@ -1983,6 +1988,8 @@ mod tests {
         impl Circuit<Fp> for FaultyCircuit {
             type Config = FaultyCircuitConfig;
             type FloorPlanner = SimpleFloorPlanner;
+            #[cfg(feature = "circuit-params")]
+            type Params = ();
 
             fn configure(meta: &mut ConstraintSystem<Fp>) -> Self::Config {
                 let a = meta.advice_column();
@@ -2069,6 +2076,8 @@ mod tests {
         impl Circuit<Fp> for FaultyCircuit {
             type Config = FaultyCircuitConfig;
             type FloorPlanner = SimpleFloorPlanner;
+            #[cfg(feature = "circuit-params")]
+            type Params = ();
 
             fn configure(meta: &mut ConstraintSystem<Fp>) -> Self::Config {
                 let a = meta.advice_column();
@@ -2238,6 +2247,8 @@ mod tests {
         impl Circuit<Fp> for FaultyCircuit {
             type Config = FaultyCircuitConfig;
             type FloorPlanner = SimpleFloorPlanner;
+            #[cfg(feature = "circuit-params")]
+            type Params = ();
 
             fn configure(meta: &mut ConstraintSystem<Fp>) -> Self::Config {
                 let a = meta.advice_column();
@@ -2372,6 +2383,8 @@ mod tests {
         impl Circuit<Fp> for FaultyCircuit {
             type Config = FaultyCircuitConfig;
             type FloorPlanner = SimpleFloorPlanner;
+            #[cfg(feature = "circuit-params")]
+            type Params = ();
 
             fn configure(meta: &mut ConstraintSystem<Fp>) -> Self::Config {
                 let a = meta.advice_column();
diff --git a/halo2_proofs/src/dev/cost.rs b/halo2_proofs/src/dev/cost.rs
index 2a39cc5182..815e66c9c2 100644
--- a/halo2_proofs/src/dev/cost.rs
+++ b/halo2_proofs/src/dev/cost.rs
@@ -159,6 +159,9 @@ impl<G: PrimeGroup, ConcreteCircuit: Circuit<G::Scalar>> CircuitCost<G, Concrete
     pub fn measure(k: usize, circuit: &ConcreteCircuit) -> Self {
         // Collect the layout details.
         let mut cs = ConstraintSystem::default();
+        #[cfg(feature = "circuit-params")]
+        let config = ConcreteCircuit::configure_with_params(&mut cs, circuit.params());
+        #[cfg(not(feature = "circuit-params"))]
         let config = ConcreteCircuit::configure(&mut cs);
         let mut assembly = Assembly {
             selectors: vec![vec![false; 1 << k]; cs.num_selectors],
diff --git a/halo2_proofs/src/dev/gates.rs b/halo2_proofs/src/dev/gates.rs
index cfc71c021e..119019a60a 100644
--- a/halo2_proofs/src/dev/gates.rs
+++ b/halo2_proofs/src/dev/gates.rs
@@ -49,6 +49,8 @@ struct Gate {
 /// impl<F: Field> Circuit<F> for MyCircuit {
 ///     type Config = MyConfig;
 ///     type FloorPlanner = SimpleFloorPlanner;
+///     #[cfg(feature = "circuit-params")]
+///     type Params = ();
 ///
 ///     fn without_witnesses(&self) -> Self {
 ///         Self::default()
@@ -79,6 +81,9 @@ struct Gate {
 ///     }
 /// }
 ///
+/// #[cfg(feature = "circuit-params")]
+/// let gates = CircuitGates::collect::<pallas::Base, MyCircuit>(());
+/// #[cfg(not(feature = "circuit-params"))]
 /// let gates = CircuitGates::collect::<pallas::Base, MyCircuit>();
 /// assert_eq!(
 ///     format!("{}", gates),
@@ -103,9 +108,14 @@ pub struct CircuitGates {
 
 impl CircuitGates {
     /// Collects the gates from within the circuit.
-    pub fn collect<F: PrimeField, C: Circuit<F>>() -> Self {
+    pub fn collect<F: PrimeField, C: Circuit<F>>(
+        #[cfg(feature = "circuit-params")] params: C::Params,
+    ) -> Self {
         // Collect the graph details.
         let mut cs = ConstraintSystem::default();
+        #[cfg(feature = "circuit-params")]
+        let _ = C::configure_with_params(&mut cs, params);
+        #[cfg(not(feature = "circuit-params"))]
         let _ = C::configure(&mut cs);
 
         let gates = cs
diff --git a/halo2_proofs/src/dev/graph.rs b/halo2_proofs/src/dev/graph.rs
index 8482879913..7fbf9f2f6b 100644
--- a/halo2_proofs/src/dev/graph.rs
+++ b/halo2_proofs/src/dev/graph.rs
@@ -23,6 +23,9 @@ pub fn circuit_dot_graph<F: Field, ConcreteCircuit: Circuit<F>>(
 ) -> String {
     // Collect the graph details.
     let mut cs = ConstraintSystem::default();
+    #[cfg(feature = "circuit-params")]
+    let config = ConcreteCircuit::configure_with_params(&mut cs, circuit.params());
+    #[cfg(not(feature = "circuit-params"))]
     let config = ConcreteCircuit::configure(&mut cs);
     let mut graph = Graph::default();
     ConcreteCircuit::FloorPlanner::synthesize(&mut graph, circuit, config, cs.constants).unwrap();
diff --git a/halo2_proofs/src/dev/graph/layout.rs b/halo2_proofs/src/dev/graph/layout.rs
index ad989eab10..e1bbe77faf 100644
--- a/halo2_proofs/src/dev/graph/layout.rs
+++ b/halo2_proofs/src/dev/graph/layout.rs
@@ -97,6 +97,9 @@ impl CircuitLayout {
         let n = 1 << k;
         // Collect the layout details.
         let mut cs = ConstraintSystem::default();
+        #[cfg(feature = "circuit-params")]
+        let config = ConcreteCircuit::configure_with_params(&mut cs, circuit.params());
+        #[cfg(not(feature = "circuit-params"))]
         let config = ConcreteCircuit::configure(&mut cs);
         let mut layout = Layout::new(k, n, cs.num_selectors);
         ConcreteCircuit::FloorPlanner::synthesize(
diff --git a/halo2_proofs/src/plonk.rs b/halo2_proofs/src/plonk.rs
index 786ca29a42..c718e4a97f 100644
--- a/halo2_proofs/src/plonk.rs
+++ b/halo2_proofs/src/plonk.rs
@@ -104,11 +104,16 @@ where
     pub fn read<R: io::Read, ConcreteCircuit: Circuit<C::Scalar>>(
         reader: &mut R,
         format: SerdeFormat,
+        #[cfg(feature = "circuit-params")] params: ConcreteCircuit::Params,
     ) -> io::Result<Self> {
         let mut k = [0u8; 4];
         reader.read_exact(&mut k)?;
         let k = u32::from_be_bytes(k);
-        let (domain, cs, _) = keygen::create_domain::<C, ConcreteCircuit>(k);
+        let (domain, cs, _) = keygen::create_domain::<C, ConcreteCircuit>(
+            k,
+            #[cfg(feature = "circuit-params")]
+            params,
+        );
         let mut num_fixed_columns = [0u8; 4];
         reader.read_exact(&mut num_fixed_columns)?;
         let num_fixed_columns = u32::from_be_bytes(num_fixed_columns);
@@ -145,8 +150,14 @@ where
     pub fn from_bytes<ConcreteCircuit: Circuit<C::Scalar>>(
         mut bytes: &[u8],
         format: SerdeFormat,
+        #[cfg(feature = "circuit-params")] params: ConcreteCircuit::Params,
     ) -> io::Result<Self> {
-        Self::read::<_, ConcreteCircuit>(&mut bytes, format)
+        Self::read::<_, ConcreteCircuit>(
+            &mut bytes,
+            format,
+            #[cfg(feature = "circuit-params")]
+            params,
+        )
     }
 }
 
@@ -331,8 +342,14 @@ where
     pub fn read<R: io::Read, ConcreteCircuit: Circuit<C::Scalar>>(
         reader: &mut R,
         format: SerdeFormat,
+        #[cfg(feature = "circuit-params")] params: ConcreteCircuit::Params,
     ) -> io::Result<Self> {
-        let vk = VerifyingKey::<C>::read::<R, ConcreteCircuit>(reader, format)?;
+        let vk = VerifyingKey::<C>::read::<R, ConcreteCircuit>(
+            reader,
+            format,
+            #[cfg(feature = "circuit-params")]
+            params,
+        )?;
         let l0 = Polynomial::read(reader, format)?;
         let l_last = Polynomial::read(reader, format)?;
         let l_active_row = Polynomial::read(reader, format)?;
@@ -365,8 +382,14 @@ where
     pub fn from_bytes<ConcreteCircuit: Circuit<C::Scalar>>(
         mut bytes: &[u8],
         format: SerdeFormat,
+        #[cfg(feature = "circuit-params")] params: ConcreteCircuit::Params,
     ) -> io::Result<Self> {
-        Self::read::<_, ConcreteCircuit>(&mut bytes, format)
+        Self::read::<_, ConcreteCircuit>(
+            &mut bytes,
+            format,
+            #[cfg(feature = "circuit-params")]
+            params,
+        )
     }
 }
 
diff --git a/halo2_proofs/src/plonk/circuit.rs b/halo2_proofs/src/plonk/circuit.rs
index 9b132b4ea0..62a915babe 100644
--- a/halo2_proofs/src/plonk/circuit.rs
+++ b/halo2_proofs/src/plonk/circuit.rs
@@ -687,11 +687,33 @@ pub trait Circuit<F: Field> {
     /// The floor planner used for this circuit. This is an associated type of the
     /// `Circuit` trait because its behaviour is circuit-critical.
     type FloorPlanner: FloorPlanner;
+    /// Optional circuit configuration parameters. Requires the `circuit-params` feature.
+    #[cfg(feature = "circuit-params")]
+    type Params: Default;
 
     /// Returns a copy of this circuit with no witness values (i.e. all witnesses set to
     /// `None`). For most circuits, this will be equal to `Self::default()`.
     fn without_witnesses(&self) -> Self;
 
+    /// Returns a reference to the parameters that should be used to configure the circuit.
+    /// Requires the `circuit-params` feature.
+    #[cfg(feature = "circuit-params")]
+    fn params(&self) -> Self::Params {
+        Self::Params::default()
+    }
+
+    /// The circuit is given an opportunity to describe the exact gate
+    /// arrangement, column arrangement, etc.  Takes a runtime parameter.  The default
+    /// implementation calls `configure` ignoring the `_params` argument in order to easily support
+    /// circuits that don't use configuration parameters.
+    #[cfg(feature = "circuit-params")]
+    fn configure_with_params(
+        meta: &mut ConstraintSystem<F>,
+        _params: Self::Params,
+    ) -> Self::Config {
+        Self::configure(meta)
+    }
+
     /// The circuit is given an opportunity to describe the exact gate
     /// arrangement, column arrangement, etc.
     fn configure(meta: &mut ConstraintSystem<F>) -> Self::Config;
diff --git a/halo2_proofs/src/plonk/keygen.rs b/halo2_proofs/src/plonk/keygen.rs
index ec11fa62f7..42f0fabccd 100644
--- a/halo2_proofs/src/plonk/keygen.rs
+++ b/halo2_proofs/src/plonk/keygen.rs
@@ -29,6 +29,7 @@ use crate::{
 
 pub(crate) fn create_domain<C, ConcreteCircuit>(
     k: u32,
+    #[cfg(feature = "circuit-params")] params: ConcreteCircuit::Params,
 ) -> (
     EvaluationDomain<C::Scalar>,
     ConstraintSystem<C::Scalar>,
@@ -39,6 +40,9 @@ where
     ConcreteCircuit: Circuit<C::Scalar>,
 {
     let mut cs = ConstraintSystem::default();
+    #[cfg(feature = "circuit-params")]
+    let config = ConcreteCircuit::configure_with_params(&mut cs, params);
+    #[cfg(not(feature = "circuit-params"))]
     let config = ConcreteCircuit::configure(&mut cs);
 
     let degree = cs.degree();
@@ -331,7 +335,11 @@ where
     ConcreteCircuit: Circuit<C::Scalar>,
     C::Scalar: FromUniformBytes<64>,
 {
-    let (domain, cs, config) = create_domain::<C, ConcreteCircuit>(params.k());
+    let (domain, cs, config) = create_domain::<C, ConcreteCircuit>(
+        params.k(),
+        #[cfg(feature = "circuit-params")]
+        circuit.params(),
+    );
 
     if (params.n() as usize) < cs.minimum_rows() {
         return Err(Error::not_enough_rows_available(params.k()));
@@ -456,7 +464,11 @@ where
     ConcreteCircuit: Circuit<C::Scalar>,
     <C as CurveAffine>::ScalarExt: FromUniformBytes<64>,
 {
-    let (domain, cs, config) = create_domain::<C, ConcreteCircuit>(params.k());
+    let (domain, cs, config) = create_domain::<C, ConcreteCircuit>(
+        params.k(),
+        #[cfg(feature = "circuit-params")]
+        circuit.params(),
+    );
 
     if (params.n() as usize) < cs.minimum_rows() {
         return Err(Error::not_enough_rows_available(params.k()));
diff --git a/halo2_proofs/src/plonk/prover.rs b/halo2_proofs/src/plonk/prover.rs
index c522947820..bc78600f4f 100644
--- a/halo2_proofs/src/plonk/prover.rs
+++ b/halo2_proofs/src/plonk/prover.rs
@@ -70,6 +70,9 @@ where
 
     let domain = &pk.vk.domain;
     let mut meta = ConstraintSystem::default();
+    #[cfg(feature = "circuit-params")]
+    let config = ConcreteCircuit::configure_with_params(&mut meta, circuits[0].params());
+    #[cfg(not(feature = "circuit-params"))]
     let config = ConcreteCircuit::configure(&mut meta);
 
     // Selector optimizations cannot be applied here; use the ConstraintSystem
diff --git a/halo2_proofs/tests/plonk_api.rs b/halo2_proofs/tests/plonk_api.rs
index 6c69a472ab..b58d562910 100644
--- a/halo2_proofs/tests/plonk_api.rs
+++ b/halo2_proofs/tests/plonk_api.rs
@@ -266,6 +266,8 @@ fn plonk_api() {
     impl<F: Field> Circuit<F> for MyCircuit<F> {
         type Config = PlonkConfig;
         type FloorPlanner = SimpleFloorPlanner;
+        #[cfg(feature = "circuit-params")]
+        type Params = ();
 
         fn without_witnesses(&self) -> Self {
             Self {

From e5778082b98129cf27c114b1d444819614e71c55 Mon Sep 17 00:00:00 2001
From: CeciliaZ030 <45245961+CeciliaZ030@users.noreply.github.com>
Date: Thu, 20 Apr 2023 23:26:34 +0900
Subject: [PATCH 07/30] Allow halo2 constraint names to have non static names
 (#156)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* static ref to String type in Gates, Constraints, VirtualCell, Argument

* 'lookup'.to_string()

* return &str for gate name and constriant_name, also run fmt

* Update halo2_gadgets/Cargo.toml

Co-authored-by: Han <tinghan0110@gmail.com>

* upgrade rust-toochain

---------

Co-authored-by: Carlos Pérez <37264926+CPerezz@users.noreply.github.com>
Co-authored-by: Han <tinghan0110@gmail.com>
---
 .../src/utilities/lookup_range_check.rs       | 10 ++--
 halo2_proofs/src/dev.rs                       |  8 +--
 halo2_proofs/src/dev/failure.rs               |  4 +-
 halo2_proofs/src/dev/gates.rs                 |  8 +--
 halo2_proofs/src/dev/metadata.rs              | 51 ++++++++++--------
 halo2_proofs/src/plonk/circuit.rs             | 53 +++++++++++--------
 halo2_proofs/src/plonk/lookup.rs              | 10 ++--
 7 files changed, 81 insertions(+), 63 deletions(-)

diff --git a/halo2_gadgets/src/utilities/lookup_range_check.rs b/halo2_gadgets/src/utilities/lookup_range_check.rs
index e5990b3433..22a8bf2bf2 100644
--- a/halo2_gadgets/src/utilities/lookup_range_check.rs
+++ b/halo2_gadgets/src/utilities/lookup_range_check.rs
@@ -586,13 +586,13 @@ mod tests {
             assert_eq!(
                 prover.verify(),
                 Err(vec![VerifyFailure::Lookup {
-                    name: "lookup",
+                    name: "lookup".to_string(),
                     lookup_index: 0,
                     location: FailureLocation::InRegion {
                         region: (1, "Range check 6 bits").into(),
                         offset: 1,
                     },
-                }])
+                }]),
             );
         }
 
@@ -607,7 +607,7 @@ mod tests {
                 prover.verify(),
                 Err(vec![
                     VerifyFailure::Lookup {
-                        name: "lookup",
+                        name: "lookup".to_string(),
                         lookup_index: 0,
                         location: FailureLocation::InRegion {
                             region: (1, "Range check 6 bits").into(),
@@ -615,7 +615,7 @@ mod tests {
                         },
                     },
                     VerifyFailure::Lookup {
-                        name: "lookup",
+                        name: "lookup".to_string(),
                         lookup_index: 0,
                         location: FailureLocation::InRegion {
                             region: (1, "Range check 6 bits").into(),
@@ -645,7 +645,7 @@ mod tests {
             assert_eq!(
                 prover.verify(),
                 Err(vec![VerifyFailure::Lookup {
-                    name: "lookup",
+                    name: "lookup".to_string(),
                     lookup_index: 0,
                     location: FailureLocation::InRegion {
                         region: (1, "Range check 6 bits").into(),
diff --git a/halo2_proofs/src/dev.rs b/halo2_proofs/src/dev.rs
index f2580de180..5e8372f47a 100644
--- a/halo2_proofs/src/dev.rs
+++ b/halo2_proofs/src/dev.rs
@@ -1413,7 +1413,7 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
                                 assert!(table.binary_search(input).is_err());
 
                                 Some(VerifyFailure::Lookup {
-                                    name: lookup.name,
+                                    name: lookup.name.clone(),
                                     lookup_index,
                                     location: FailureLocation::find_expressions(
                                         &self.cs,
@@ -1787,7 +1787,7 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
                         .filter_map(move |(input, input_row)| {
                             if table.binary_search(input).is_err() {
                                 Some(VerifyFailure::Lookup {
-                                    name: lookup.name,
+                                    name: lookup.name.clone(),
                                     lookup_index,
                                     location: FailureLocation::find_expressions(
                                         &self.cs,
@@ -2221,7 +2221,7 @@ mod tests {
         assert_eq!(
             prover.verify(),
             Err(vec![VerifyFailure::Lookup {
-                name: "lookup",
+                name: "lookup".to_string(),
                 lookup_index: 0,
                 location: FailureLocation::InRegion {
                     region: (1, "Faulty synthesis").into(),
@@ -2355,7 +2355,7 @@ mod tests {
         assert_eq!(
             prover.verify(),
             Err(vec![VerifyFailure::Lookup {
-                name: "lookup",
+                name: "lookup".to_string(),
                 lookup_index: 0,
                 location: FailureLocation::InRegion {
                     region: (2, "Faulty synthesis").into(),
diff --git a/halo2_proofs/src/dev/failure.rs b/halo2_proofs/src/dev/failure.rs
index 54b7a473db..5fba40bbd0 100644
--- a/halo2_proofs/src/dev/failure.rs
+++ b/halo2_proofs/src/dev/failure.rs
@@ -159,7 +159,7 @@ pub enum VerifyFailure {
     /// A lookup input did not exist in its corresponding table.
     Lookup {
         /// The name of the lookup that is not satisfied.
-        name: &'static str,
+        name: String,
         /// The index of the lookup that is not satisfied. These indices are assigned in
         /// the order in which `ConstraintSystem::lookup` is called during
         /// `Circuit::configure`.
@@ -277,7 +277,7 @@ impl Debug for VerifyFailure {
                 };
 
                 let debug = ConstraintCaseDebug {
-                    constraint: *constraint,
+                    constraint: constraint.clone(),
                     location: location.clone(),
                     cell_values: cell_values
                         .iter()
diff --git a/halo2_proofs/src/dev/gates.rs b/halo2_proofs/src/dev/gates.rs
index 119019a60a..fd4c039623 100644
--- a/halo2_proofs/src/dev/gates.rs
+++ b/halo2_proofs/src/dev/gates.rs
@@ -15,14 +15,14 @@ use crate::{
 
 #[derive(Debug)]
 struct Constraint {
-    name: &'static str,
+    name: String,
     expression: String,
     queries: BTreeSet<String>,
 }
 
 #[derive(Debug)]
 struct Gate {
-    name: &'static str,
+    name: String,
     constraints: Vec<Constraint>,
 }
 
@@ -122,13 +122,13 @@ impl CircuitGates {
             .gates
             .iter()
             .map(|gate| Gate {
-                name: gate.name(),
+                name: gate.name().to_string(),
                 constraints: gate
                     .polynomials()
                     .iter()
                     .enumerate()
                     .map(|(i, constraint)| Constraint {
-                        name: gate.constraint_name(i),
+                        name: gate.constraint_name(i).to_string(),
                         expression: constraint.evaluate(
                             &util::format_value,
                             &|selector| format!("S{}", selector.0),
diff --git a/halo2_proofs/src/dev/metadata.rs b/halo2_proofs/src/dev/metadata.rs
index 5fd0835bad..c7f83b3967 100644
--- a/halo2_proofs/src/dev/metadata.rs
+++ b/halo2_proofs/src/dev/metadata.rs
@@ -75,7 +75,7 @@ impl fmt::Display for DebugColumn {
 /// within a custom gate.
 #[derive(Debug, PartialEq, Eq, PartialOrd, Ord)]
 pub struct VirtualCell {
-    name: &'static str,
+    name: String,
     pub(super) column: Column,
     pub(super) rotation: i32,
 }
@@ -83,17 +83,17 @@ pub struct VirtualCell {
 impl From<(Column, i32)> for VirtualCell {
     fn from((column, rotation): (Column, i32)) -> Self {
         VirtualCell {
-            name: "",
+            name: "".to_string(),
             column,
             rotation,
         }
     }
 }
 
-impl From<(&'static str, Column, i32)> for VirtualCell {
-    fn from((name, column, rotation): (&'static str, Column, i32)) -> Self {
+impl<S: AsRef<str>> From<(S, Column, i32)> for VirtualCell {
+    fn from((name, column, rotation): (S, Column, i32)) -> Self {
         VirtualCell {
-            name,
+            name: name.as_ref().to_string(),
             column,
             rotation,
         }
@@ -103,7 +103,7 @@ impl From<(&'static str, Column, i32)> for VirtualCell {
 impl From<plonk::VirtualCell> for VirtualCell {
     fn from(c: plonk::VirtualCell) -> Self {
         VirtualCell {
-            name: "",
+            name: "".to_string(),
             column: c.column.into(),
             rotation: c.rotation.0,
         }
@@ -114,7 +114,7 @@ impl fmt::Display for VirtualCell {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         write!(f, "{}@{}", self.column, self.rotation)?;
         if !self.name.is_empty() {
-            write!(f, "({})", self.name)?;
+            write!(f, "({})", self.name.as_str())?;
         }
         Ok(())
     }
@@ -123,7 +123,7 @@ impl fmt::Display for VirtualCell {
 /// Helper structure used to be able to inject Column annotations inside a `Display` or `Debug` call.
 #[derive(Clone, Debug)]
 pub(super) struct DebugVirtualCell {
-    name: &'static str,
+    name: String,
     column: DebugColumn,
     rotation: i32,
 }
@@ -131,7 +131,7 @@ pub(super) struct DebugVirtualCell {
 impl From<(&VirtualCell, Option<&HashMap<Column, String>>)> for DebugVirtualCell {
     fn from(info: (&VirtualCell, Option<&HashMap<Column, String>>)) -> Self {
         DebugVirtualCell {
-            name: info.0.name,
+            name: info.0.name.clone(),
             column: DebugColumn::from((info.0.column, info.1)),
             rotation: info.0.rotation,
         }
@@ -149,30 +149,33 @@ impl fmt::Display for DebugVirtualCell {
 }
 
 /// Metadata about a configured gate within a circuit.
-#[derive(Debug, PartialEq, Eq, Clone, Copy)]
+#[derive(Debug, PartialEq, Eq, Clone)]
 pub struct Gate {
     /// The index of the active gate. These indices are assigned in the order in which
     /// `ConstraintSystem::create_gate` is called during `Circuit::configure`.
     pub(super) index: usize,
     /// The name of the active gate. These are specified by the gate creator (such as
     /// a chip implementation), and is not enforced to be unique.
-    pub(super) name: &'static str,
+    pub(super) name: String,
 }
 
 impl fmt::Display for Gate {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        write!(f, "Gate {} ('{}')", self.index, self.name)
+        write!(f, "Gate {} ('{}')", self.index, self.name.as_str())
     }
 }
 
-impl From<(usize, &'static str)> for Gate {
-    fn from((index, name): (usize, &'static str)) -> Self {
-        Gate { index, name }
+impl<S: AsRef<str>> From<(usize, S)> for Gate {
+    fn from((index, name): (usize, S)) -> Self {
+        Gate {
+            index,
+            name: name.as_ref().to_string(),
+        }
     }
 }
 
 /// Metadata about a configured constraint within a circuit.
-#[derive(Debug, PartialEq, Eq, Clone, Copy)]
+#[derive(Debug, PartialEq, Eq, Clone)]
 pub struct Constraint {
     /// The gate containing the constraint.
     pub(super) gate: Gate,
@@ -182,7 +185,7 @@ pub struct Constraint {
     pub(super) index: usize,
     /// The name of the constraint. This is specified by the gate creator (such as a chip
     /// implementation), and is not enforced to be unique.
-    pub(super) name: &'static str,
+    pub(super) name: String,
 }
 
 impl fmt::Display for Constraint {
@@ -194,7 +197,7 @@ impl fmt::Display for Constraint {
             if self.name.is_empty() {
                 String::new()
             } else {
-                format!(" ('{}')", self.name)
+                format!(" ('{}')", self.name.as_str())
             },
             self.gate.index,
             self.gate.name,
@@ -202,9 +205,13 @@ impl fmt::Display for Constraint {
     }
 }
 
-impl From<(Gate, usize, &'static str)> for Constraint {
-    fn from((gate, index, name): (Gate, usize, &'static str)) -> Self {
-        Constraint { gate, index, name }
+impl<S: AsRef<str>> From<(Gate, usize, S)> for Constraint {
+    fn from((gate, index, name): (Gate, usize, S)) -> Self {
+        Constraint {
+            gate,
+            index,
+            name: name.as_ref().to_string(),
+        }
     }
 }
 
@@ -250,7 +257,7 @@ impl Debug for Region {
 
 impl fmt::Display for Region {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        write!(f, "Region {} ('{}')", self.index, self.name)
+        write!(f, "Region {} ('{}')", self.index, self.name.as_str())
     }
 }
 
diff --git a/halo2_proofs/src/plonk/circuit.rs b/halo2_proofs/src/plonk/circuit.rs
index 62a915babe..f0f2ea897f 100644
--- a/halo2_proofs/src/plonk/circuit.rs
+++ b/halo2_proofs/src/plonk/circuit.rs
@@ -1257,25 +1257,34 @@ impl<Col: Into<Column<Any>>> From<(Col, Rotation)> for VirtualCell {
 /// These are returned by the closures passed to `ConstraintSystem::create_gate`.
 #[derive(Debug)]
 pub struct Constraint<F: Field> {
-    name: &'static str,
+    name: String,
     poly: Expression<F>,
 }
 
 impl<F: Field> From<Expression<F>> for Constraint<F> {
     fn from(poly: Expression<F>) -> Self {
-        Constraint { name: "", poly }
+        Constraint {
+            name: "".to_string(),
+            poly,
+        }
     }
 }
 
-impl<F: Field> From<(&'static str, Expression<F>)> for Constraint<F> {
-    fn from((name, poly): (&'static str, Expression<F>)) -> Self {
-        Constraint { name, poly }
+impl<F: Field, S: AsRef<str>> From<(S, Expression<F>)> for Constraint<F> {
+    fn from((name, poly): (S, Expression<F>)) -> Self {
+        Constraint {
+            name: name.as_ref().to_string(),
+            poly,
+        }
     }
 }
 
 impl<F: Field> From<Expression<F>> for Vec<Constraint<F>> {
     fn from(poly: Expression<F>) -> Self {
-        vec![Constraint { name: "", poly }]
+        vec![Constraint {
+            name: "".to_string(),
+            poly,
+        }]
     }
 }
 
@@ -1365,8 +1374,8 @@ impl<F: Field, C: Into<Constraint<F>>, Iter: IntoIterator<Item = C>> IntoIterato
 /// Gate
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub struct Gate<F: Field> {
-    name: &'static str,
-    constraint_names: Vec<&'static str>,
+    name: String,
+    constraint_names: Vec<String>,
     pub polys: Vec<Expression<F>>,
     /// We track queried selectors separately from other cells, so that we can use them to
     /// trigger debug checks on gates.
@@ -1375,12 +1384,12 @@ pub struct Gate<F: Field> {
 }
 
 impl<F: Field> Gate<F> {
-    pub(crate) fn name(&self) -> &'static str {
-        self.name
+    pub(crate) fn name(&self) -> &str {
+        self.name.as_str()
     }
 
-    pub(crate) fn constraint_name(&self, constraint_index: usize) -> &'static str {
-        self.constraint_names[constraint_index]
+    pub(crate) fn constraint_name(&self, constraint_index: usize) -> &str {
+        self.constraint_names[constraint_index].as_str()
     }
 
     /// Returns constraints of this gate
@@ -1574,9 +1583,9 @@ impl<F: Field> ConstraintSystem<F> {
     ///
     /// `table_map` returns a map between input expressions and the table columns
     /// they need to match.
-    pub fn lookup(
+    pub fn lookup<S: AsRef<str>>(
         &mut self,
-        name: &'static str,
+        name: S,
         table_map: impl FnOnce(&mut VirtualCells<'_, F>) -> Vec<(Expression<F>, TableColumn)>,
     ) -> usize {
         let mut cells = VirtualCells::new(self);
@@ -1595,7 +1604,8 @@ impl<F: Field> ConstraintSystem<F> {
 
         let index = self.lookups.len();
 
-        self.lookups.push(lookup::Argument::new(name, table_map));
+        self.lookups
+            .push(lookup::Argument::new(name.as_ref(), table_map));
 
         index
     }
@@ -1604,9 +1614,9 @@ impl<F: Field> ConstraintSystem<F> {
     ///
     /// `table_map` returns a map between input expressions and the table expressions
     /// they need to match.
-    pub fn lookup_any(
+    pub fn lookup_any<S: AsRef<str>>(
         &mut self,
-        name: &'static str,
+        name: S,
         table_map: impl FnOnce(&mut VirtualCells<'_, F>) -> Vec<(Expression<F>, Expression<F>)>,
     ) -> usize {
         let mut cells = VirtualCells::new(self);
@@ -1614,7 +1624,8 @@ impl<F: Field> ConstraintSystem<F> {
 
         let index = self.lookups.len();
 
-        self.lookups.push(lookup::Argument::new(name, table_map));
+        self.lookups
+            .push(lookup::Argument::new(name.as_ref(), table_map));
 
         index
     }
@@ -1734,9 +1745,9 @@ impl<F: Field> ConstraintSystem<F> {
     ///
     /// A gate is required to contain polynomial constraints. This method will panic if
     /// `constraints` returns an empty iterator.
-    pub fn create_gate<C: Into<Constraint<F>>, Iter: IntoIterator<Item = C>>(
+    pub fn create_gate<C: Into<Constraint<F>>, Iter: IntoIterator<Item = C>, S: AsRef<str>>(
         &mut self,
-        name: &'static str,
+        name: S,
         constraints: impl FnOnce(&mut VirtualCells<'_, F>) -> Iter,
     ) {
         let mut cells = VirtualCells::new(self);
@@ -1756,7 +1767,7 @@ impl<F: Field> ConstraintSystem<F> {
         );
 
         self.gates.push(Gate {
-            name,
+            name: name.as_ref().to_string(),
             constraint_names,
             polys,
             queried_selectors,
diff --git a/halo2_proofs/src/plonk/lookup.rs b/halo2_proofs/src/plonk/lookup.rs
index c1c4d0ea31..eb8308754e 100644
--- a/halo2_proofs/src/plonk/lookup.rs
+++ b/halo2_proofs/src/plonk/lookup.rs
@@ -7,9 +7,9 @@ pub(crate) mod verifier;
 
 #[derive(Clone, PartialEq, Eq)]
 pub struct Argument<F: Field> {
-    pub name: &'static str,
-    pub input_expressions: Vec<Expression<F>>,
-    pub table_expressions: Vec<Expression<F>>,
+    pub(crate) name: String,
+    pub(crate) input_expressions: Vec<Expression<F>>,
+    pub(crate) table_expressions: Vec<Expression<F>>,
 }
 
 impl<F: Field> Debug for Argument<F> {
@@ -25,10 +25,10 @@ impl<F: Field> Argument<F> {
     /// Constructs a new lookup argument.
     ///
     /// `table_map` is a sequence of `(input, table)` tuples.
-    pub fn new(name: &'static str, table_map: Vec<(Expression<F>, Expression<F>)>) -> Self {
+    pub fn new<S: AsRef<str>>(name: S, table_map: Vec<(Expression<F>, Expression<F>)>) -> Self {
         let (input_expressions, table_expressions) = table_map.into_iter().unzip();
         Argument {
-            name,
+            name: name.as_ref().to_string(),
             input_expressions,
             table_expressions,
         }

From b05bc4d75da74de3ea701fc2f6cae0e25f36cb73 Mon Sep 17 00:00:00 2001
From: CeciliaZ030 <45245961+CeciliaZ030@users.noreply.github.com>
Date: Thu, 27 Apr 2023 00:06:29 +0900
Subject: [PATCH 08/30] Improve halo2 query calls (#154)

* return expression from cell

* add example

* selector

* recurse Expression to fill in index

* minimized changes from the original

* backword compatible meta.query_X & challange.expr()

* cargo fmt

* fixed lookup to pass all tests

* Update comments

Co-authored-by: Brecht Devos <Brechtp.Devos@gmail.com>

* Update comments

Co-authored-by: Brecht Devos <Brechtp.Devos@gmail.com>

* Update comments

Co-authored-by: Brecht Devos <Brechtp.Devos@gmail.com>

* Update comments

Co-authored-by: Brecht Devos <Brechtp.Devos@gmail.com>

* Update comments

Co-authored-by: Brecht Devos <Brechtp.Devos@gmail.com>

* Update comments

Co-authored-by: Brecht Devos <Brechtp.Devos@gmail.com>

* update

Co-authored-by: Brecht Devos <Brechtp.Devos@gmail.com>

* add primitives.rs back

* remove example2

* backward compatible meta.query_X & Column.cur(), next(), prev(), at(usize)

* impl Debug & make side effects only when query.index.is_none()

* change impl Debug for Expression instead & revert test in plonk_api

* upgrade rust-toolchain

* Update halo2_proofs/src/plonk/circuit.rs

Co-authored-by: Han <tinghan0110@gmail.com>

* Update halo2_proofs/src/plonk/circuit.rs

Co-authored-by: Han <tinghan0110@gmail.com>

* ran clippy

* Update halo2_proofs/src/plonk/circuit.rs

Co-authored-by: Han <tinghan0110@gmail.com>

---------

Co-authored-by: Brecht Devos <Brechtp.Devos@gmail.com>
Co-authored-by: Han <tinghan0110@gmail.com>
---
 halo2_proofs/examples/shuffle.rs              |  28 +-
 halo2_proofs/src/dev.rs                       |   6 +-
 halo2_proofs/src/dev/failure.rs               |   6 +-
 halo2_proofs/src/dev/failure/emitter.rs       |   2 +-
 halo2_proofs/src/dev/util.rs                  |  12 +-
 halo2_proofs/src/plonk/circuit.rs             | 274 ++++++++++++++----
 .../src/plonk/circuit/compress_selectors.rs   |   4 +-
 halo2_proofs/src/plonk/lookup/verifier.rs     |   6 +-
 halo2_proofs/src/plonk/verifier.rs            |   6 +-
 9 files changed, 242 insertions(+), 102 deletions(-)

diff --git a/halo2_proofs/examples/shuffle.rs b/halo2_proofs/examples/shuffle.rs
index eaa8826f0a..17bbb3330a 100644
--- a/halo2_proofs/examples/shuffle.rs
+++ b/halo2_proofs/examples/shuffle.rs
@@ -12,7 +12,7 @@ use halo2_proofs::{
             multiopen::{ProverIPA, VerifierIPA},
             strategy::AccumulatorStrategy,
         },
-        Rotation, VerificationStrategy,
+        VerificationStrategy,
     },
     transcript::{
         Blake2bRead, Blake2bWrite, Challenge255, TranscriptReadBuffer, TranscriptWriterBuffer,
@@ -63,29 +63,23 @@ impl<const W: usize> MyConfig<W> {
         // Second phase
         let z = meta.advice_column_in(SecondPhase);
 
-        meta.create_gate("z should start with 1", |meta| {
-            let q_first = meta.query_selector(q_first);
-            let z = meta.query_advice(z, Rotation::cur());
+        meta.create_gate("z should start with 1", |_| {
             let one = Expression::Constant(F::ONE);
 
-            vec![q_first * (one - z)]
+            vec![q_first.expr() * (one - z.cur())]
         });
 
-        meta.create_gate("z should end with 1", |meta| {
-            let q_last = meta.query_selector(q_last);
-            let z = meta.query_advice(z, Rotation::cur());
+        meta.create_gate("z should end with 1", |_| {
             let one = Expression::Constant(F::ONE);
 
-            vec![q_last * (one - z)]
+            vec![q_last.expr() * (one - z.cur())]
         });
 
-        meta.create_gate("z should have valid transition", |meta| {
-            let q_shuffle = meta.query_selector(q_shuffle);
-            let original = original.map(|advice| meta.query_advice(advice, Rotation::cur()));
-            let shuffled = shuffled.map(|advice| meta.query_advice(advice, Rotation::cur()));
-            let [theta, gamma] = [theta, gamma].map(|challenge| meta.query_challenge(challenge));
-            let [z, z_w] =
-                [Rotation::cur(), Rotation::next()].map(|rotation| meta.query_advice(z, rotation));
+        meta.create_gate("z should have valid transition", |_| {
+            let q_shuffle = q_shuffle.expr();
+            let original = original.map(|advice| advice.cur());
+            let shuffled = shuffled.map(|advice| advice.cur());
+            let [theta, gamma] = [theta, gamma].map(|challenge| challenge.expr());
 
             // Compress
             let original = original
@@ -99,7 +93,7 @@ impl<const W: usize> MyConfig<W> {
                 .reduce(|acc, a| acc * theta.clone() + a)
                 .unwrap();
 
-            vec![q_shuffle * (z * (original + gamma.clone()) - z_w * (shuffled + gamma))]
+            vec![q_shuffle * (z.cur() * (original + gamma.clone()) - z.next() * (shuffled + gamma))]
         });
 
         Self {
diff --git a/halo2_proofs/src/dev.rs b/halo2_proofs/src/dev.rs
index 5e8372f47a..f43fa76351 100644
--- a/halo2_proofs/src/dev.rs
+++ b/halo2_proofs/src/dev.rs
@@ -1303,7 +1303,7 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
                             &|scalar| Value::Real(scalar),
                             &|_| panic!("virtual selectors are removed during optimization"),
                             &|query| {
-                                let query = self.cs.fixed_queries[query.index];
+                                let query = self.cs.fixed_queries[query.index.unwrap()];
                                 let column_index = query.0.index();
                                 let rotation = query.1 .0;
                                 self.fixed[column_index]
@@ -1311,7 +1311,7 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
                                     .into()
                             },
                             &|query| {
-                                let query = self.cs.advice_queries[query.index];
+                                let query = self.cs.advice_queries[query.index.unwrap()];
                                 let column_index = query.0.index();
                                 let rotation = query.1 .0;
                                 self.advice[column_index]
@@ -1319,7 +1319,7 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
                                     .into()
                             },
                             &|query| {
-                                let query = self.cs.instance_queries[query.index];
+                                let query = self.cs.instance_queries[query.index.unwrap()];
                                 let column_index = query.0.index();
                                 let rotation = query.1 .0;
                                 Value::Real(
diff --git a/halo2_proofs/src/dev/failure.rs b/halo2_proofs/src/dev/failure.rs
index 5fba40bbd0..6f2446988d 100644
--- a/halo2_proofs/src/dev/failure.rs
+++ b/halo2_proofs/src/dev/failure.rs
@@ -70,9 +70,9 @@ impl FailureLocation {
                 expression.evaluate(
                     &|_| vec![],
                     &|_| panic!("virtual selectors are removed during optimization"),
-                    &|query| vec![cs.fixed_queries[query.index].0.into()],
-                    &|query| vec![cs.advice_queries[query.index].0.into()],
-                    &|query| vec![cs.instance_queries[query.index].0.into()],
+                    &|query| vec![cs.fixed_queries[query.index.unwrap()].0.into()],
+                    &|query| vec![cs.advice_queries[query.index.unwrap()].0.into()],
+                    &|query| vec![cs.instance_queries[query.index.unwrap()].0.into()],
                     &|_| vec![],
                     &|a| a,
                     &|mut a, mut b| {
diff --git a/halo2_proofs/src/dev/failure/emitter.rs b/halo2_proofs/src/dev/failure/emitter.rs
index e84ba8013e..edd61f3060 100644
--- a/halo2_proofs/src/dev/failure/emitter.rs
+++ b/halo2_proofs/src/dev/failure/emitter.rs
@@ -153,7 +153,7 @@ pub(super) fn expression_to_string<F: Field>(
                 label.clone()
             } else if query.rotation.0 == 0 {
                 // This is most likely a merged selector
-                format!("S{}", query.index)
+                format!("S{}", query.index.unwrap())
             } else {
                 // No idea how we'd get here...
                 format!("F{}@{}", query.column_index, query.rotation.0)
diff --git a/halo2_proofs/src/dev/util.rs b/halo2_proofs/src/dev/util.rs
index f4cd83c34a..84a119a7fd 100644
--- a/halo2_proofs/src/dev/util.rs
+++ b/halo2_proofs/src/dev/util.rs
@@ -12,7 +12,7 @@ use crate::{
 
 pub(crate) struct AnyQuery {
     /// Query index
-    pub index: usize,
+    pub index: Option<usize>,
     /// Column type
     pub column_type: Any,
     /// Column index
@@ -79,7 +79,7 @@ pub(super) fn load<'a, F: Field, T: ColumnType, Q: Into<AnyQuery> + Copy>(
     cells: &'a [Vec<CellValue<F>>],
 ) -> impl Fn(Q) -> Value<F> + 'a {
     move |query| {
-        let (column, at) = &queries[query.into().index];
+        let (column, at) = &queries[query.into().index.unwrap()];
         let resolved_row = (row + at.0) % n;
         cells[column.index()][resolved_row as usize].into()
     }
@@ -93,8 +93,8 @@ pub(super) fn load_slice<'a, F: Field, T: ColumnType, Q: Into<AnyQuery> + Copy>(
     cells: &'a [&mut [CellValue<F>]],
 ) -> impl Fn(Q) -> Value<F> + 'a {
     move |query| {
-        let (column, at) = &queries[query.into().index];
-        let resolved_row = (row + at.0 + n) % n;
+        let (column, at) = &queries[query.into().index.unwrap()];
+        let resolved_row = (row + at.0) % n;
         cells[column.index()][resolved_row as usize].into()
     }
 }
@@ -106,8 +106,8 @@ pub(super) fn load_instance<'a, F: Field, T: ColumnType, Q: Into<AnyQuery> + Cop
     cells: &'a [Vec<F>],
 ) -> impl Fn(Q) -> Value<F> + 'a {
     move |query| {
-        let (column, at) = &queries[query.into().index];
-        let resolved_row = (row + at.0 + n) % n;
+        let (column, at) = &queries[query.into().index.unwrap()];
+        let resolved_row = (row + at.0) % n;
         Value::Real(cells[column.index()][resolved_row as usize])
     }
 }
diff --git a/halo2_proofs/src/plonk/circuit.rs b/halo2_proofs/src/plonk/circuit.rs
index f0f2ea897f..330f4739d5 100644
--- a/halo2_proofs/src/plonk/circuit.rs
+++ b/halo2_proofs/src/plonk/circuit.rs
@@ -1,27 +1,31 @@
+use super::{lookup, permutation, Assigned, Error};
+use crate::dev::metadata;
+use crate::{
+    circuit::{Layouter, Region, Value},
+    poly::Rotation,
+};
 use core::cmp::max;
 use core::ops::{Add, Mul};
 use ff::Field;
+use sealed::SealedPhase;
+use std::cmp::Ordering;
 use std::collections::BTreeMap;
+use std::collections::HashMap;
+use std::fmt::{Debug, Formatter};
 use std::ops::Range;
 use std::{
     convert::TryFrom,
     ops::{Neg, Sub},
 };
 
-use super::{lookup, permutation, Assigned, Error};
-use crate::dev::metadata;
-use crate::{
-    circuit::{Layouter, Region, Value},
-    poly::Rotation,
-};
-use sealed::SealedPhase;
-
 mod compress_selectors;
 
 /// A column type
 pub trait ColumnType:
     'static + Sized + Copy + std::fmt::Debug + PartialEq + Eq + Into<Any>
 {
+    /// Return expression from cell
+    fn query_cell<F: Field>(&self, index: usize, at: Rotation) -> Expression<F>;
 }
 
 /// A column with an index and type
@@ -46,6 +50,31 @@ impl<C: ColumnType> Column<C> {
     pub fn column_type(&self) -> &C {
         &self.column_type
     }
+
+    /// Return expression from column at a relative position
+    pub fn query_cell<F: Field>(&self, at: Rotation) -> Expression<F> {
+        self.column_type.query_cell(self.index, at)
+    }
+
+    /// Return expression from column at the current row
+    pub fn cur<F: Field>(&self) -> Expression<F> {
+        self.query_cell(Rotation::cur())
+    }
+
+    /// Return expression from column at the next row
+    pub fn next<F: Field>(&self) -> Expression<F> {
+        self.query_cell(Rotation::next())
+    }
+
+    /// Return expression from column at the previous row
+    pub fn prev<F: Field>(&self) -> Expression<F> {
+        self.query_cell(Rotation::prev())
+    }
+
+    /// Return expression from column at the specified rotation
+    pub fn rot<F: Field>(&self, rotation: i32) -> Expression<F> {
+        self.query_cell(Rotation(rotation))
+    }
 }
 
 impl<C: ColumnType> Ord for Column<C> {
@@ -235,10 +264,56 @@ impl PartialOrd for Any {
     }
 }
 
-impl ColumnType for Advice {}
-impl ColumnType for Fixed {}
-impl ColumnType for Instance {}
-impl ColumnType for Any {}
+impl ColumnType for Advice {
+    fn query_cell<F: Field>(&self, index: usize, at: Rotation) -> Expression<F> {
+        Expression::Advice(AdviceQuery {
+            index: None,
+            column_index: index,
+            rotation: at,
+            phase: self.phase,
+        })
+    }
+}
+impl ColumnType for Fixed {
+    fn query_cell<F: Field>(&self, index: usize, at: Rotation) -> Expression<F> {
+        Expression::Fixed(FixedQuery {
+            index: None,
+            column_index: index,
+            rotation: at,
+        })
+    }
+}
+impl ColumnType for Instance {
+    fn query_cell<F: Field>(&self, index: usize, at: Rotation) -> Expression<F> {
+        Expression::Instance(InstanceQuery {
+            index: None,
+            column_index: index,
+            rotation: at,
+        })
+    }
+}
+impl ColumnType for Any {
+    fn query_cell<F: Field>(&self, index: usize, at: Rotation) -> Expression<F> {
+        match self {
+            Any::Advice(Advice { phase }) => Expression::Advice(AdviceQuery {
+                index: None,
+                column_index: index,
+                rotation: at,
+                phase: *phase,
+            }),
+            Any::Fixed => Expression::Fixed(FixedQuery {
+                index: None,
+                column_index: index,
+                rotation: at,
+            }),
+            Any::Instance => Expression::Instance(InstanceQuery {
+                index: None,
+                column_index: index,
+                rotation: at,
+            }),
+        }
+    }
+}
 
 impl From<Advice> for Any {
     fn from(advice: Advice) -> Any {
@@ -392,13 +467,18 @@ impl Selector {
     pub fn is_simple(&self) -> bool {
         self.1
     }
+
+    /// Return expression from selector
+    pub fn expr<F: Field>(&self) -> Expression<F> {
+        Expression::Selector(*self)
+    }
 }
 
 /// Query of fixed column at a certain relative location
 #[derive(Copy, Clone, Debug, PartialEq, Eq)]
 pub struct FixedQuery {
     /// Query index
-    pub(crate) index: usize,
+    pub(crate) index: Option<usize>,
     /// Column index
     pub(crate) column_index: usize,
     /// Rotation of this query
@@ -408,7 +488,7 @@ pub struct FixedQuery {
 impl FixedQuery {
     /// Index
     pub fn index(&self) -> usize {
-        self.index
+        self.index.unwrap()
     }
     /// Column index
     pub fn column_index(&self) -> usize {
@@ -425,7 +505,7 @@ impl FixedQuery {
 #[derive(Copy, Clone, Debug, PartialEq, Eq)]
 pub struct AdviceQuery {
     /// Query index
-    pub(crate) index: usize,
+    pub(crate) index: Option<usize>,
     /// Column index
     pub(crate) column_index: usize,
     /// Rotation of this query
@@ -437,7 +517,7 @@ pub struct AdviceQuery {
 impl AdviceQuery {
     /// Index
     pub fn index(&self) -> usize {
-        self.index
+        self.index.unwrap()
     }
     /// Column index
     pub fn column_index(&self) -> usize {
@@ -459,7 +539,7 @@ impl AdviceQuery {
 #[derive(Copy, Clone, Debug, PartialEq, Eq)]
 pub struct InstanceQuery {
     /// Query index
-    pub(crate) index: usize,
+    pub(crate) index: Option<usize>,
     /// Column index
     pub(crate) column_index: usize,
     /// Rotation of this query
@@ -469,7 +549,7 @@ pub struct InstanceQuery {
 impl InstanceQuery {
     /// Index
     pub fn index(&self) -> usize {
-        self.index
+        self.index.unwrap()
     }
     /// Column index
     pub fn column_index(&self) -> usize {
@@ -527,6 +607,11 @@ impl Challenge {
     pub fn phase(&self) -> u8 {
         self.phase.0
     }
+
+    /// Return Expression
+    pub fn expr<F: Field>(&self) -> Expression<F> {
+        Expression::Challenge(*self)
+    }
 }
 
 /// This trait allows a [`Circuit`] to direct some backend to assign a witness
@@ -750,6 +835,59 @@ pub enum Expression<F> {
 }
 
 impl<F: Field> Expression<F> {
+    /// Make side effects
+    pub fn query_cells(&mut self, cells: &mut VirtualCells<'_, F>) {
+        match self {
+            Expression::Constant(_) => (),
+            Expression::Selector(selector) => {
+                if !cells.queried_selectors.contains(selector) {
+                    cells.queried_selectors.push(*selector);
+                }
+            }
+            Expression::Fixed(query) => {
+                if query.index.is_none() {
+                    let col = Column {
+                        index: query.column_index,
+                        column_type: Fixed,
+                    };
+                    cells.queried_cells.push((col, query.rotation).into());
+                    query.index = Some(cells.meta.query_fixed_index(col, query.rotation));
+                }
+            }
+            Expression::Advice(query) => {
+                if query.index.is_none() {
+                    let col = Column {
+                        index: query.column_index,
+                        column_type: Advice { phase: query.phase },
+                    };
+                    cells.queried_cells.push((col, query.rotation).into());
+                    query.index = Some(cells.meta.query_advice_index(col, query.rotation));
+                }
+            }
+            Expression::Instance(query) => {
+                if query.index.is_none() {
+                    let col = Column {
+                        index: query.column_index,
+                        column_type: Instance,
+                    };
+                    cells.queried_cells.push((col, query.rotation).into());
+                    query.index = Some(cells.meta.query_instance_index(col, query.rotation));
+                }
+            }
+            Expression::Challenge(_) => (),
+            Expression::Negated(a) => a.query_cells(cells),
+            Expression::Sum(a, b) => {
+                a.query_cells(cells);
+                b.query_cells(cells);
+            }
+            Expression::Product(a, b) => {
+                a.query_cells(cells);
+                b.query_cells(cells);
+            }
+            Expression::Scaled(a, _) => a.query_cells(cells),
+        };
+    }
+
     /// Evaluate the polynomial using the provided closures to perform the
     /// operations.
     pub fn evaluate<T>(
@@ -1136,43 +1274,43 @@ impl<F: std::fmt::Debug> std::fmt::Debug for Expression<F> {
             Expression::Constant(scalar) => f.debug_tuple("Constant").field(scalar).finish(),
             Expression::Selector(selector) => f.debug_tuple("Selector").field(selector).finish(),
             // Skip enum variant and print query struct directly to maintain backwards compatibility.
-            Expression::Fixed(FixedQuery {
-                index,
-                column_index,
-                rotation,
-            }) => f
-                .debug_struct("Fixed")
-                .field("query_index", index)
-                .field("column_index", column_index)
-                .field("rotation", rotation)
-                .finish(),
-            Expression::Advice(AdviceQuery {
-                index,
-                column_index,
-                rotation,
-                phase,
-            }) => {
+            Expression::Fixed(query) => {
+                let mut debug_struct = f.debug_struct("Fixed");
+                match query.index {
+                    None => debug_struct.field("query_index", &query.index),
+                    Some(idx) => debug_struct.field("query_index", &idx),
+                };
+                debug_struct
+                    .field("column_index", &query.column_index)
+                    .field("rotation", &query.rotation)
+                    .finish()
+            }
+            Expression::Advice(query) => {
                 let mut debug_struct = f.debug_struct("Advice");
+                match query.index {
+                    None => debug_struct.field("query_index", &query.index),
+                    Some(idx) => debug_struct.field("query_index", &idx),
+                };
                 debug_struct
-                    .field("query_index", index)
-                    .field("column_index", column_index)
-                    .field("rotation", rotation);
+                    .field("column_index", &query.column_index)
+                    .field("rotation", &query.rotation);
                 // Only show advice's phase if it's not in first phase.
-                if *phase != FirstPhase.to_sealed() {
-                    debug_struct.field("phase", phase);
+                if query.phase != FirstPhase.to_sealed() {
+                    debug_struct.field("phase", &query.phase);
                 }
                 debug_struct.finish()
             }
-            Expression::Instance(InstanceQuery {
-                index,
-                column_index,
-                rotation,
-            }) => f
-                .debug_struct("Instance")
-                .field("query_index", index)
-                .field("column_index", column_index)
-                .field("rotation", rotation)
-                .finish(),
+            Expression::Instance(query) => {
+                let mut debug_struct = f.debug_struct("Instance");
+                match query.index {
+                    None => debug_struct.field("query_index", &query.index),
+                    Some(idx) => debug_struct.field("query_index", &idx),
+                };
+                debug_struct
+                    .field("column_index", &query.column_index)
+                    .field("rotation", &query.rotation)
+                    .finish()
+            }
             Expression::Challenge(challenge) => {
                 f.debug_tuple("Challenge").field(challenge).finish()
             }
@@ -1591,17 +1729,16 @@ impl<F: Field> ConstraintSystem<F> {
         let mut cells = VirtualCells::new(self);
         let table_map = table_map(&mut cells)
             .into_iter()
-            .map(|(input, table)| {
+            .map(|(mut input, table)| {
                 if input.contains_simple_selector() {
                     panic!("expression containing simple selector supplied to lookup argument");
                 }
-
-                let table = cells.query_fixed(table.inner(), Rotation::cur());
-
+                let mut table = cells.query_fixed(table.inner(), Rotation::cur());
+                input.query_cells(&mut cells);
+                table.query_cells(&mut cells);
                 (input, table)
             })
             .collect();
-
         let index = self.lookups.len();
 
         self.lookups
@@ -1620,8 +1757,14 @@ impl<F: Field> ConstraintSystem<F> {
         table_map: impl FnOnce(&mut VirtualCells<'_, F>) -> Vec<(Expression<F>, Expression<F>)>,
     ) -> usize {
         let mut cells = VirtualCells::new(self);
-        let table_map = table_map(&mut cells);
-
+        let table_map = table_map(&mut cells)
+            .into_iter()
+            .map(|(mut input, mut table)| {
+                input.query_cells(&mut cells);
+                table.query_cells(&mut cells);
+                (input, table)
+            })
+            .collect();
         let index = self.lookups.len();
 
         self.lookups
@@ -1752,15 +1895,18 @@ impl<F: Field> ConstraintSystem<F> {
     ) {
         let mut cells = VirtualCells::new(self);
         let constraints = constraints(&mut cells);
-        let queried_selectors = cells.queried_selectors;
-        let queried_cells = cells.queried_cells;
-
         let (constraint_names, polys): (_, Vec<_>) = constraints
             .into_iter()
             .map(|c| c.into())
-            .map(|c| (c.name, c.poly))
+            .map(|mut c: Constraint<F>| {
+                c.poly.query_cells(&mut cells);
+                (c.name, c.poly)
+            })
             .unzip();
 
+        let queried_selectors = cells.queried_selectors;
+        let queried_cells = cells.queried_cells;
+
         assert!(
             !polys.is_empty(),
             "Gates must contain at least one constraint."
@@ -1821,7 +1967,7 @@ impl<F: Field> ConstraintSystem<F> {
                 let column = self.fixed_column();
                 new_columns.push(column);
                 Expression::Fixed(FixedQuery {
-                    index: self.query_fixed_index(column, Rotation::cur()),
+                    index: Some(self.query_fixed_index(column, Rotation::cur())),
                     column_index: column.index,
                     rotation: Rotation::cur(),
                 })
@@ -2211,7 +2357,7 @@ impl<'a, F: Field> VirtualCells<'a, F> {
     pub fn query_fixed(&mut self, column: Column<Fixed>, at: Rotation) -> Expression<F> {
         self.queried_cells.push((column, at).into());
         Expression::Fixed(FixedQuery {
-            index: self.meta.query_fixed_index(column, at),
+            index: Some(self.meta.query_fixed_index(column, at)),
             column_index: column.index,
             rotation: at,
         })
@@ -2221,7 +2367,7 @@ impl<'a, F: Field> VirtualCells<'a, F> {
     pub fn query_advice(&mut self, column: Column<Advice>, at: Rotation) -> Expression<F> {
         self.queried_cells.push((column, at).into());
         Expression::Advice(AdviceQuery {
-            index: self.meta.query_advice_index(column, at),
+            index: Some(self.meta.query_advice_index(column, at)),
             column_index: column.index,
             rotation: at,
             phase: column.column_type().phase,
@@ -2232,7 +2378,7 @@ impl<'a, F: Field> VirtualCells<'a, F> {
     pub fn query_instance(&mut self, column: Column<Instance>, at: Rotation) -> Expression<F> {
         self.queried_cells.push((column, at).into());
         Expression::Instance(InstanceQuery {
-            index: self.meta.query_instance_index(column, at),
+            index: Some(self.meta.query_instance_index(column, at)),
             column_index: column.index,
             rotation: at,
         })
diff --git a/halo2_proofs/src/plonk/circuit/compress_selectors.rs b/halo2_proofs/src/plonk/circuit/compress_selectors.rs
index 60898d3950..6f354b8fe1 100644
--- a/halo2_proofs/src/plonk/circuit/compress_selectors.rs
+++ b/halo2_proofs/src/plonk/circuit/compress_selectors.rs
@@ -283,7 +283,7 @@ mod tests {
             let (combination_assignments, selector_assignments) =
                 process::<Fp, _>(selectors.clone(), max_degree, || {
                     let tmp = Expression::Fixed(FixedQuery {
-                        index: query,
+                        index: Some(query),
                         column_index: query,
                         rotation: Rotation::cur(),
                     });
@@ -322,7 +322,7 @@ mod tests {
                         &|_| panic!("should not occur in returned expressions"),
                         &|query| {
                             // Should be the correct combination in the expression
-                            assert_eq!(selector.combination_index, query.index);
+                            assert_eq!(selector.combination_index, query.index.unwrap());
                             assignment
                         },
                         &|_| panic!("should not occur in returned expressions"),
diff --git a/halo2_proofs/src/plonk/lookup/verifier.rs b/halo2_proofs/src/plonk/lookup/verifier.rs
index 990866b786..5730b18f8a 100644
--- a/halo2_proofs/src/plonk/lookup/verifier.rs
+++ b/halo2_proofs/src/plonk/lookup/verifier.rs
@@ -120,9 +120,9 @@ impl<C: CurveAffine> Evaluated<C> {
                         expression.evaluate(
                             &|scalar| scalar,
                             &|_| panic!("virtual selectors are removed during optimization"),
-                            &|query| fixed_evals[query.index],
-                            &|query| advice_evals[query.index],
-                            &|query| instance_evals[query.index],
+                            &|query| fixed_evals[query.index.unwrap()],
+                            &|query| advice_evals[query.index.unwrap()],
+                            &|query| instance_evals[query.index.unwrap()],
                             &|challenge| challenges[challenge.index()],
                             &|a| -a,
                             &|a, b| a + &b,
diff --git a/halo2_proofs/src/plonk/verifier.rs b/halo2_proofs/src/plonk/verifier.rs
index f5984d2c79..72ec7203fb 100644
--- a/halo2_proofs/src/plonk/verifier.rs
+++ b/halo2_proofs/src/plonk/verifier.rs
@@ -275,9 +275,9 @@ where
                             poly.evaluate(
                                 &|scalar| scalar,
                                 &|_| panic!("virtual selectors are removed during optimization"),
-                                &|query| fixed_evals[query.index],
-                                &|query| advice_evals[query.index],
-                                &|query| instance_evals[query.index],
+                                &|query| fixed_evals[query.index.unwrap()],
+                                &|query| advice_evals[query.index.unwrap()],
+                                &|query| instance_evals[query.index.unwrap()],
                                 &|challenge| challenges[challenge.index()],
                                 &|a| -a,
                                 &|a, b| a + &b,

From dd22b61277eb16d538c5392f3cfd0832fc914e1c Mon Sep 17 00:00:00 2001
From: Enrico Bottazzi <85900164+enricobottazzi@users.noreply.github.com>
Date: Thu, 27 Apr 2023 09:02:08 +0200
Subject: [PATCH 09/30] Implement Clone trait for Hash, Absorbing, and Sponge
 structs (#171)

---
 halo2_gadgets/src/poseidon/primitives.rs | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/halo2_gadgets/src/poseidon/primitives.rs b/halo2_gadgets/src/poseidon/primitives.rs
index a8662a00e8..06f199f118 100644
--- a/halo2_gadgets/src/poseidon/primitives.rs
+++ b/halo2_gadgets/src/poseidon/primitives.rs
@@ -166,7 +166,7 @@ mod private {
 pub trait SpongeMode: private::SealedSpongeMode {}
 
 /// The absorbing state of the `Sponge`.
-#[derive(Debug)]
+#[derive(Debug, Clone)]
 pub struct Absorbing<F, const RATE: usize>(pub(crate) SpongeRate<F, RATE>);
 
 /// The squeezing state of the `Sponge`.
@@ -188,6 +188,7 @@ impl<F: fmt::Debug, const RATE: usize> Absorbing<F, RATE> {
     }
 }
 
+#[derive(Clone)]
 /// A Poseidon sponge.
 pub(crate) struct Sponge<
     F: Field,
@@ -329,6 +330,7 @@ impl<F: PrimeField, const RATE: usize, const L: usize> Domain<F, RATE> for Const
     }
 }
 
+#[derive(Clone)]
 /// A Poseidon hash function, built around a sponge.
 pub struct Hash<
     F: Field,

From e56d03f0328e6a050d8e60d319377fc6b253522c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Carlos=20P=C3=A9rez?=
 <37264926+CPerezz@users.noreply.github.com>
Date: Wed, 3 May 2023 16:25:08 +0200
Subject: [PATCH 10/30] fix: Fix serialization for VerifyingKey (#178)

Now the value returned when the number of selectors is a multiple of 8
is correct.

Resolves: #175
---
 halo2_proofs/src/plonk.rs | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/halo2_proofs/src/plonk.rs b/halo2_proofs/src/plonk.rs
index c718e4a97f..62c684ceb4 100644
--- a/halo2_proofs/src/plonk.rs
+++ b/halo2_proofs/src/plonk.rs
@@ -168,14 +168,13 @@ where
     fn bytes_length(&self) -> usize {
         8 + (self.fixed_commitments.len() * C::default().to_bytes().as_ref().len())
             + self.permutation.bytes_length()
-        /*
-        + self.selectors.len()
-            * (self
-                .selectors
-                .get(0)
-                .map(|selector| selector.len() / 8 + 1)
-                .unwrap_or(0))
-                */
+        // scroll/halo2: we don’t need to store
+        // + self.selectors.len()
+        //     * (self
+        //         .selectors
+        //         .get(0)
+        //         .map(|selector| (selector.len() + 7) / 8)
+        //         .unwrap_or(0))
     }
 
     fn from_parts(

From 828b21a25864fe8a48ab8901db6939ca8443f047 Mon Sep 17 00:00:00 2001
From: Eduard S <eduardsanou@posteo.net>
Date: Wed, 10 May 2023 17:54:24 +0200
Subject: [PATCH 11/30] Add more getters to expose internal fields

---
 halo2_proofs/src/dev/metadata.rs  | 11 +++++++++++
 halo2_proofs/src/plonk/circuit.rs | 23 ++++++++++++++++++++---
 halo2_proofs/src/plonk/lookup.rs  |  5 +++++
 3 files changed, 36 insertions(+), 3 deletions(-)

diff --git a/halo2_proofs/src/dev/metadata.rs b/halo2_proofs/src/dev/metadata.rs
index c7f83b3967..f81bfa67a7 100644
--- a/halo2_proofs/src/dev/metadata.rs
+++ b/halo2_proofs/src/dev/metadata.rs
@@ -15,6 +15,17 @@ pub struct Column {
     pub(super) index: usize,
 }
 
+impl Column {
+    /// Return the column type.
+    pub fn column_type(&self) -> Any {
+        self.column_type
+    }
+    /// Return the column index.
+    pub fn index(&self) -> usize {
+        self.index
+    }
+}
+
 impl fmt::Display for Column {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         write!(f, "Column('{:?}', {})", self.column_type, self.index)
diff --git a/halo2_proofs/src/plonk/circuit.rs b/halo2_proofs/src/plonk/circuit.rs
index 330f4739d5..a2a905d85b 100644
--- a/halo2_proofs/src/plonk/circuit.rs
+++ b/halo2_proofs/src/plonk/circuit.rs
@@ -468,6 +468,11 @@ impl Selector {
         self.1
     }
 
+    /// Returns index of this selector
+    pub fn index(&self) -> usize {
+        self.0
+    }
+
     /// Return expression from selector
     pub fn expr<F: Field>(&self) -> Expression<F> {
         Expression::Selector(*self)
@@ -1522,11 +1527,13 @@ pub struct Gate<F: Field> {
 }
 
 impl<F: Field> Gate<F> {
-    pub(crate) fn name(&self) -> &str {
+    /// Returns the gate name.
+    pub fn name(&self) -> &str {
         self.name.as_str()
     }
 
-    pub(crate) fn constraint_name(&self, constraint_index: usize) -> &str {
+    /// Returns the name of the constraint at index `constraint_index`.
+    pub fn constraint_name(&self, constraint_index: usize) -> &str {
         self.constraint_names[constraint_index].as_str()
     }
 
@@ -1928,7 +1935,7 @@ impl<F: Field> ConstraintSystem<F> {
     /// find which fixed column corresponds with a given `Selector`.
     ///
     /// Do not call this twice. Yes, this should be a builder pattern instead.
-    pub(crate) fn compress_selectors(mut self, selectors: Vec<Vec<bool>>) -> (Self, Vec<Vec<F>>) {
+    pub fn compress_selectors(mut self, selectors: Vec<Vec<bool>>) -> (Self, Vec<Vec<F>>) {
         // The number of provided selector assignments must be the number we
         // counted for this constraint system.
         assert_eq!(selectors.len(), self.num_selectors);
@@ -2275,6 +2282,11 @@ impl<F: Field> ConstraintSystem<F> {
         self.num_instance_columns
     }
 
+    /// Returns number of selectors
+    pub fn num_selectors(&self) -> usize {
+        self.num_selectors
+    }
+
     /// Returns number of challenges
     pub fn num_challenges(&self) -> usize {
         self.num_challenges
@@ -2298,6 +2310,11 @@ impl<F: Field> ConstraintSystem<F> {
         &self.gates
     }
 
+    /// Returns general column annotations
+    pub fn general_column_annotations(&self) -> &HashMap<metadata::Column, String> {
+        &self.general_column_annotations
+    }
+
     /// Returns advice queries
     pub fn advice_queries(&self) -> &Vec<(Column<Advice>, Rotation)> {
         &self.advice_queries
diff --git a/halo2_proofs/src/plonk/lookup.rs b/halo2_proofs/src/plonk/lookup.rs
index eb8308754e..7d1accd8ed 100644
--- a/halo2_proofs/src/plonk/lookup.rs
+++ b/halo2_proofs/src/plonk/lookup.rs
@@ -91,4 +91,9 @@ impl<F: Field> Argument<F> {
     pub fn table_expressions(&self) -> &Vec<Expression<F>> {
         &self.table_expressions
     }
+
+    /// Returns name of this argument
+    pub fn name(&self) -> &str {
+        &self.name
+    }
 }

From f88dc8511a11ce33432edca0b1f323e6ef2faa2c Mon Sep 17 00:00:00 2001
From: Ethan-000 <s2026080@ed.ac.uk>
Date: Thu, 18 May 2023 16:49:53 +0100
Subject: [PATCH 12/30] add a constructor (#164)

* add a constructor

* add more comment

* fix as review

* remove clone

* remove

* no need to use new variable

* change comment

* fix clippy

* rename to from_parts

* remove n declaration
---
 halo2_proofs/src/poly/kzg/commitment.rs | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/halo2_proofs/src/poly/kzg/commitment.rs b/halo2_proofs/src/poly/kzg/commitment.rs
index f9fc508c6a..73b7510efc 100644
--- a/halo2_proofs/src/poly/kzg/commitment.rs
+++ b/halo2_proofs/src/poly/kzg/commitment.rs
@@ -144,6 +144,30 @@ where
         }
     }
 
+    /// Initializes parameters for the curve through existing parameters
+    /// k, g, g_lagrange (optional), g2, s_g2
+    pub fn from_parts(
+        &self,
+        k: u32,
+        g: Vec<E::G1Affine>,
+        g_lagrange: Option<Vec<E::G1Affine>>,
+        g2: E::G2Affine,
+        s_g2: E::G2Affine,
+    ) -> Self {
+        Self {
+            k,
+            n: 1 << k,
+            g_lagrange: if let Some(g_l) = g_lagrange {
+                g_l
+            } else {
+                g_to_lagrange(g.iter().map(PrimeCurveAffine::to_curve).collect(), k)
+            },
+            g,
+            g2,
+            s_g2,
+        }
+    }
+
     /// Returns gernerator on G2
     pub fn g2(&self) -> E::G2Affine {
         self.g2

From b2450cd4cc9b04b109c39d692c394cec8ecdbf95 Mon Sep 17 00:00:00 2001
From: dante <45801863+alexander-camuto@users.noreply.github.com>
Date: Thu, 1 Jun 2023 09:22:27 +0100
Subject: [PATCH 13/30] feat: send sync region (#180)

* feat: send / sync region

* Update layout.rs

* update

* lol

* debug

* Update keygen.rs

* Update keygen.rs

* Update keygen.rs

* Update keygen.rs

* thread-safe-region feature flag

* cleanup

* patch dev-graph

* patch non-determinism in mapping creation

* reduce mem usage for vk and pk

* mock proving examples

* swap for hashmap for insertion speed

* reduce update overhead

* replace BTree with Vec

* add benchmarks

* make the benchmarks massive

* patch clippy

* simplify lifetimes

* patch benches

* Update halo2_proofs/src/plonk/permutation/keygen.rs

Co-authored-by: Han <tinghan0110@gmail.com>

* Update halo2_proofs/examples/vector-mul.rs

Co-authored-by: Han <tinghan0110@gmail.com>

* rm benches

* order once

* patch lints

---------

Co-authored-by: Han <tinghan0110@gmail.com>
---
 halo2_proofs/Cargo.toml                       |   3 +
 halo2_proofs/examples/vector-mul.rs           | 350 ++++++++++++++
 .../src/circuit/floor_planner/single_pass.rs  |  15 +-
 halo2_proofs/src/circuit/floor_planner/v1.rs  |  14 +-
 halo2_proofs/src/circuit/layouter.rs          |  12 +-
 halo2_proofs/src/dev.rs                       |  94 ++--
 halo2_proofs/src/dev/cost.rs                  |   4 +-
 halo2_proofs/src/dev/graph.rs                 |   2 +
 halo2_proofs/src/dev/graph/layout.rs          |   2 +
 halo2_proofs/src/plonk/circuit.rs             |   3 +-
 halo2_proofs/src/plonk/keygen.rs              |   4 +-
 halo2_proofs/src/plonk/permutation/keygen.rs  | 430 +++++++++++++-----
 halo2_proofs/src/plonk/prover.rs              |   3 +
 13 files changed, 764 insertions(+), 172 deletions(-)
 create mode 100644 halo2_proofs/examples/vector-mul.rs

diff --git a/halo2_proofs/Cargo.toml b/halo2_proofs/Cargo.toml
index 7acad5c474..130ab0ce02 100644
--- a/halo2_proofs/Cargo.toml
+++ b/halo2_proofs/Cargo.toml
@@ -83,6 +83,7 @@ getrandom = { version = "0.2", features = ["js"] }
 default = ["batch", "gwc"]
 dev-graph = ["plotters", "tabbycat"]
 gadget-traces = ["backtrace"]
+thread-safe-region = []
 sanity-checks = []
 batch = ["rand_core/getrandom"]
 shplonk = []
@@ -99,3 +100,5 @@ bench = false
 [[example]]
 name = "circuit-layout"
 required-features = ["dev-graph"]
+
+
diff --git a/halo2_proofs/examples/vector-mul.rs b/halo2_proofs/examples/vector-mul.rs
new file mode 100644
index 0000000000..23dc6d274e
--- /dev/null
+++ b/halo2_proofs/examples/vector-mul.rs
@@ -0,0 +1,350 @@
+use std::marker::PhantomData;
+
+use halo2_proofs::{
+    arithmetic::Field,
+    circuit::{AssignedCell, Chip, Layouter, Region, SimpleFloorPlanner, Value},
+    plonk::{Advice, Circuit, Column, ConstraintSystem, Error, Instance, Selector},
+    poly::Rotation,
+};
+
+// ANCHOR: instructions
+trait NumericInstructions<F: Field>: Chip<F> {
+    /// Variable representing a number.
+    type Num;
+
+    /// Loads a number into the circuit as a private input.
+    fn load_private(
+        &self,
+        layouter: impl Layouter<F>,
+        a: &[Value<F>],
+    ) -> Result<Vec<Self::Num>, Error>;
+
+    /// Returns `c = a * b`. The caller is responsible for ensuring that `a.len() == b.len()`.
+    fn mul(
+        &self,
+        layouter: impl Layouter<F>,
+        a: &[Self::Num],
+        b: &[Self::Num],
+    ) -> Result<Vec<Self::Num>, Error>;
+
+    /// Exposes a number as a public input to the circuit.
+    fn expose_public(
+        &self,
+        layouter: impl Layouter<F>,
+        num: &Self::Num,
+        row: usize,
+    ) -> Result<(), Error>;
+}
+// ANCHOR_END: instructions
+
+// ANCHOR: chip
+/// The chip that will implement our instructions! Chips store their own
+/// config, as well as type markers if necessary.
+struct FieldChip<F: Field> {
+    config: FieldConfig,
+    _marker: PhantomData<F>,
+}
+// ANCHOR_END: chip
+
+// ANCHOR: chip-config
+/// Chip state is stored in a config struct. This is generated by the chip
+/// during configuration, and then stored inside the chip.
+#[derive(Clone, Debug)]
+struct FieldConfig {
+    /// For this chip, we will use two advice columns to implement our instructions.
+    /// These are also the columns through which we communicate with other parts of
+    /// the circuit.
+    advice: [Column<Advice>; 3],
+
+    /// This is the public input (instance) column.
+    instance: Column<Instance>,
+
+    // We need a selector to enable the multiplication gate, so that we aren't placing
+    // any constraints on cells where `NumericInstructions::mul` is not being used.
+    // This is important when building larger circuits, where columns are used by
+    // multiple sets of instructions.
+    s_mul: Selector,
+}
+
+impl<F: Field> FieldChip<F> {
+    fn construct(config: <Self as Chip<F>>::Config) -> Self {
+        Self {
+            config,
+            _marker: PhantomData,
+        }
+    }
+
+    fn configure(
+        meta: &mut ConstraintSystem<F>,
+        advice: [Column<Advice>; 3],
+        instance: Column<Instance>,
+    ) -> <Self as Chip<F>>::Config {
+        meta.enable_equality(instance);
+        for column in &advice {
+            meta.enable_equality(*column);
+        }
+        let s_mul = meta.selector();
+
+        // Define our multiplication gate!
+        meta.create_gate("mul", |meta| {
+            // To implement multiplication, we need three advice cells and a selector
+            // cell. We arrange them like so:
+            //
+            // | a0  | a1  | a2  | s_mul |
+            // |-----|-----|-----|-------|
+            // | lhs | rhs | out | s_mul |
+            //
+            // Gates may refer to any relative offsets we want, but each distinct
+            // offset adds a cost to the proof. The most common offsets are 0 (the
+            // current row), 1 (the next row), and -1 (the previous row), for which
+            // `Rotation` has specific constructors.
+            let lhs = meta.query_advice(advice[0], Rotation::cur());
+            let rhs = meta.query_advice(advice[1], Rotation::cur());
+            let out = meta.query_advice(advice[2], Rotation::cur());
+            let s_mul = meta.query_selector(s_mul);
+
+            // Finally, we return the polynomial expressions that constrain this gate.
+            // For our multiplication gate, we only need a single polynomial constraint.
+            //
+            // The polynomial expressions returned from `create_gate` will be
+            // constrained by the proving system to equal zero. Our expression
+            // has the following properties:
+            // - When s_mul = 0, any value is allowed in lhs, rhs, and out.
+            // - When s_mul != 0, this constrains lhs * rhs = out.
+            vec![s_mul * (lhs * rhs - out)]
+        });
+
+        FieldConfig {
+            advice,
+            instance,
+            s_mul,
+        }
+    }
+}
+// ANCHOR_END: chip-config
+
+// ANCHOR: chip-impl
+impl<F: Field> Chip<F> for FieldChip<F> {
+    type Config = FieldConfig;
+    type Loaded = ();
+
+    fn config(&self) -> &Self::Config {
+        &self.config
+    }
+
+    fn loaded(&self) -> &Self::Loaded {
+        &()
+    }
+}
+// ANCHOR_END: chip-impl
+
+// ANCHOR: instructions-impl
+/// A variable representing a number.
+#[derive(Clone, Debug)]
+struct Number<F: Field>(AssignedCell<F, F>);
+
+impl<F: Field> NumericInstructions<F> for FieldChip<F> {
+    type Num = Number<F>;
+
+    fn load_private(
+        &self,
+        mut layouter: impl Layouter<F>,
+        values: &[Value<F>],
+    ) -> Result<Vec<Self::Num>, Error> {
+        let config = self.config();
+
+        layouter.assign_region(
+            || "load private",
+            |mut region| {
+                values
+                    .iter()
+                    .enumerate()
+                    .map(|(i, value)| {
+                        region
+                            .assign_advice(|| "private input", config.advice[0], i, || *value)
+                            .map(Number)
+                    })
+                    .collect()
+            },
+        )
+    }
+
+    fn mul(
+        &self,
+        mut layouter: impl Layouter<F>,
+        a: &[Self::Num],
+        b: &[Self::Num],
+    ) -> Result<Vec<Self::Num>, Error> {
+        let config = self.config();
+        assert_eq!(a.len(), b.len());
+
+        #[cfg(feature = "thread-safe-region")]
+        {
+            use rayon::prelude::{
+                IndexedParallelIterator, IntoParallelRefIterator, ParallelIterator,
+            };
+            layouter.assign_region(
+                || "mul",
+                |region: Region<'_, F>| {
+                    let thread_safe_region = std::sync::Mutex::new(region);
+                    a.par_iter()
+                        .zip(b.par_iter())
+                        .enumerate()
+                        .map(|(i, (a, b))| {
+                            let mut region = thread_safe_region.lock().unwrap();
+
+                            config.s_mul.enable(&mut region, i)?;
+
+                            a.0.copy_advice(|| "lhs", &mut region, config.advice[0], i)?;
+                            b.0.copy_advice(|| "rhs", &mut region, config.advice[1], i)?;
+
+                            let value = a.0.value().copied() * b.0.value();
+
+                            // Finally, we do the assignment to the output, returning a
+                            // variable to be used in another part of the circuit.
+                            region
+                                .assign_advice(|| "lhs * rhs", config.advice[2], i, || value)
+                                .map(Number)
+                        })
+                        .collect()
+                },
+            )
+        }
+
+        #[cfg(not(feature = "thread-safe-region"))]
+        layouter.assign_region(
+            || "mul",
+            |mut region: Region<'_, F>| {
+                a.iter()
+                    .zip(b.iter())
+                    .enumerate()
+                    .map(|(i, (a, b))| {
+                        config.s_mul.enable(&mut region, i)?;
+
+                        a.0.copy_advice(|| "lhs", &mut region, config.advice[0], i)?;
+                        b.0.copy_advice(|| "rhs", &mut region, config.advice[1], i)?;
+
+                        let value = a.0.value().copied() * b.0.value();
+
+                        // Finally, we do the assignment to the output, returning a
+                        // variable to be used in another part of the circuit.
+                        region
+                            .assign_advice(|| "lhs * rhs", config.advice[2], i, || value)
+                            .map(Number)
+                    })
+                    .collect()
+            },
+        )
+    }
+
+    fn expose_public(
+        &self,
+        mut layouter: impl Layouter<F>,
+        num: &Self::Num,
+        row: usize,
+    ) -> Result<(), Error> {
+        let config = self.config();
+
+        layouter.constrain_instance(num.0.cell(), config.instance, row)
+    }
+}
+// ANCHOR_END: instructions-impl
+
+// ANCHOR: circuit
+/// The full circuit implementation.
+///
+/// In this struct we store the private input variables. We use `Option<F>` because
+/// they won't have any value during key generation. During proving, if any of these
+/// were `None` we would get an error.
+#[derive(Default)]
+struct MyCircuit<F: Field> {
+    a: Vec<Value<F>>,
+    b: Vec<Value<F>>,
+}
+
+impl<F: Field> Circuit<F> for MyCircuit<F> {
+    // Since we are using a single chip for everything, we can just reuse its config.
+    type Config = FieldConfig;
+    type FloorPlanner = SimpleFloorPlanner;
+    #[cfg(feature = "circuit-params")]
+    type Params = ();
+
+    fn without_witnesses(&self) -> Self {
+        Self::default()
+    }
+
+    fn configure(meta: &mut ConstraintSystem<F>) -> Self::Config {
+        // We create the three advice columns that FieldChip uses for I/O.
+        let advice = [
+            meta.advice_column(),
+            meta.advice_column(),
+            meta.advice_column(),
+        ];
+
+        // We also need an instance column to store public inputs.
+        let instance = meta.instance_column();
+
+        FieldChip::configure(meta, advice, instance)
+    }
+
+    fn synthesize(
+        &self,
+        config: Self::Config,
+        mut layouter: impl Layouter<F>,
+    ) -> Result<(), Error> {
+        let field_chip = FieldChip::<F>::construct(config);
+
+        // Load our private values into the circuit.
+        let a = field_chip.load_private(layouter.namespace(|| "load a"), &self.a)?;
+        let b = field_chip.load_private(layouter.namespace(|| "load b"), &self.b)?;
+
+        let ab = field_chip.mul(layouter.namespace(|| "a * b"), &a, &b)?;
+
+        for (i, c) in ab.iter().enumerate() {
+            // Expose the result as a public input to the circuit.
+            field_chip.expose_public(layouter.namespace(|| "expose c"), c, i)?;
+        }
+        Ok(())
+    }
+}
+// ANCHOR_END: circuit
+
+fn main() {
+    use halo2_proofs::dev::MockProver;
+    use halo2curves::pasta::Fp;
+
+    const N: usize = 20000;
+    // ANCHOR: test-circuit
+    // The number of rows in our circuit cannot exceed 2^k. Since our example
+    // circuit is very small, we can pick a very small value here.
+    let k = 16;
+
+    // Prepare the private and public inputs to the circuit!
+    let a = [Fp::from(2); N];
+    let b = [Fp::from(3); N];
+    let c: Vec<Fp> = a.iter().zip(b).map(|(&a, b)| a * b).collect();
+
+    // Instantiate the circuit with the private inputs.
+    let circuit = MyCircuit {
+        a: a.iter().map(|&x| Value::known(x)).collect(),
+        b: b.iter().map(|&x| Value::known(x)).collect(),
+    };
+
+    // Arrange the public input. We expose the multiplication result in row 0
+    // of the instance column, so we position it there in our public inputs.
+    let mut public_inputs = c;
+
+    let start = std::time::Instant::now();
+    // Given the correct public input, our circuit will verify.
+    let prover = MockProver::run(k, &circuit, vec![public_inputs.clone()]).unwrap();
+    assert_eq!(prover.verify(), Ok(()));
+    println!("positive test took {:?}", start.elapsed());
+
+    // If we try some other public input, the proof will fail!
+    let start = std::time::Instant::now();
+    public_inputs[0] += Fp::one();
+    let prover = MockProver::run(k, &circuit, vec![public_inputs]).unwrap();
+    assert!(prover.verify().is_err());
+    println!("negative test took {:?}", start.elapsed());
+    // ANCHOR_END: test-circuit
+}
diff --git a/halo2_proofs/src/circuit/floor_planner/single_pass.rs b/halo2_proofs/src/circuit/floor_planner/single_pass.rs
index 1ef0a6af81..96242b0b34 100644
--- a/halo2_proofs/src/circuit/floor_planner/single_pass.rs
+++ b/halo2_proofs/src/circuit/floor_planner/single_pass.rs
@@ -12,7 +12,7 @@ use ark_std::{end_timer, start_timer};
 
 use crate::{
     circuit::{
-        layouter::{RegionColumn, RegionLayouter, RegionShape, TableLayouter},
+        layouter::{RegionColumn, RegionLayouter, RegionShape, SyncDeps, TableLayouter},
         Cell, Layouter, Region, RegionIndex, RegionStart, Table, Value,
     },
     multicore,
@@ -31,7 +31,7 @@ use crate::{
 pub struct SimpleFloorPlanner;
 
 impl FloorPlanner for SimpleFloorPlanner {
-    fn synthesize<F: Field, CS: Assignment<F>, C: Circuit<F>>(
+    fn synthesize<F: Field, CS: Assignment<F> + SyncDeps, C: Circuit<F>>(
         cs: &mut CS,
         circuit: &C,
         config: C::Config,
@@ -96,7 +96,9 @@ impl<'a, F: Field, CS: Assignment<F> + 'a> SingleChipLayouter<'a, F, CS> {
     }
 }
 
-impl<'a, F: Field, CS: Assignment<F> + 'a> Layouter<F> for SingleChipLayouter<'a, F, CS> {
+impl<'a, F: Field, CS: Assignment<F> + 'a + SyncDeps> Layouter<F>
+    for SingleChipLayouter<'a, F, CS>
+{
     type Root = Self;
 
     fn assign_region<A, AR, N, NR>(&mut self, name: N, mut assignment: A) -> Result<AR, Error>
@@ -465,7 +467,12 @@ impl<'r, 'a, F: Field, CS: Assignment<F> + 'a> SingleChipLayouterRegion<'r, 'a,
     }
 }
 
-impl<'r, 'a, F: Field, CS: Assignment<F> + 'a> RegionLayouter<F>
+impl<'r, 'a, F: Field, CS: Assignment<F> + 'a + SyncDeps> SyncDeps
+    for SingleChipLayouterRegion<'r, 'a, F, CS>
+{
+}
+
+impl<'r, 'a, F: Field, CS: Assignment<F> + 'a + SyncDeps> RegionLayouter<F>
     for SingleChipLayouterRegion<'r, 'a, F, CS>
 {
     fn enable_selector<'v>(
diff --git a/halo2_proofs/src/circuit/floor_planner/v1.rs b/halo2_proofs/src/circuit/floor_planner/v1.rs
index 463d119196..27beaafa47 100644
--- a/halo2_proofs/src/circuit/floor_planner/v1.rs
+++ b/halo2_proofs/src/circuit/floor_planner/v1.rs
@@ -5,7 +5,7 @@ use ff::Field;
 use crate::{
     circuit::{
         floor_planner::single_pass::SimpleTableLayouter,
-        layouter::{RegionColumn, RegionLayouter, RegionShape, TableLayouter},
+        layouter::{RegionColumn, RegionLayouter, RegionShape, SyncDeps, TableLayouter},
         Cell, Layouter, Region, RegionIndex, RegionStart, Table, Value,
     },
     plonk::{
@@ -43,7 +43,7 @@ impl<'a, F: Field, CS: Assignment<F> + 'a> fmt::Debug for V1Plan<'a, F, CS> {
     }
 }
 
-impl<'a, F: Field, CS: Assignment<F>> V1Plan<'a, F, CS> {
+impl<'a, F: Field, CS: Assignment<F> + SyncDeps> V1Plan<'a, F, CS> {
     /// Creates a new v1 layouter.
     pub fn new(cs: &'a mut CS) -> Result<Self, Error> {
         let ret = V1Plan {
@@ -57,7 +57,7 @@ impl<'a, F: Field, CS: Assignment<F>> V1Plan<'a, F, CS> {
 }
 
 impl FloorPlanner for V1 {
-    fn synthesize<F: Field, CS: Assignment<F>, C: Circuit<F>>(
+    fn synthesize<F: Field, CS: Assignment<F> + SyncDeps, C: Circuit<F>>(
         cs: &mut CS,
         circuit: &C,
         config: C::Config,
@@ -169,7 +169,7 @@ impl<'p, 'a, F: Field, CS: Assignment<F> + 'a> V1Pass<'p, 'a, F, CS> {
     }
 }
 
-impl<'p, 'a, F: Field, CS: Assignment<F> + 'a> Layouter<F> for V1Pass<'p, 'a, F, CS> {
+impl<'p, 'a, F: Field, CS: Assignment<F> + SyncDeps> Layouter<F> for V1Pass<'p, 'a, F, CS> {
     type Root = Self;
 
     fn assign_region<A, AR, N, NR>(&mut self, name: N, assignment: A) -> Result<AR, Error>
@@ -293,7 +293,7 @@ pub struct AssignmentPass<'p, 'a, F: Field, CS: Assignment<F> + 'a> {
     region_index: usize,
 }
 
-impl<'p, 'a, F: Field, CS: Assignment<F> + 'a> AssignmentPass<'p, 'a, F, CS> {
+impl<'p, 'a, F: Field, CS: Assignment<F> + SyncDeps> AssignmentPass<'p, 'a, F, CS> {
     fn new(plan: &'p mut V1Plan<'a, F, CS>) -> Self {
         AssignmentPass {
             plan,
@@ -413,7 +413,9 @@ impl<'r, 'a, F: Field, CS: Assignment<F> + 'a> V1Region<'r, 'a, F, CS> {
     }
 }
 
-impl<'r, 'a, F: Field, CS: Assignment<F> + 'a> RegionLayouter<F> for V1Region<'r, 'a, F, CS> {
+impl<'r, 'a, F: Field, CS: Assignment<F> + SyncDeps> SyncDeps for V1Region<'r, 'a, F, CS> {}
+
+impl<'r, 'a, F: Field, CS: Assignment<F> + SyncDeps> RegionLayouter<F> for V1Region<'r, 'a, F, CS> {
     fn enable_selector<'v>(
         &'v mut self,
         annotation: &'v (dyn Fn() -> String + 'v),
diff --git a/halo2_proofs/src/circuit/layouter.rs b/halo2_proofs/src/circuit/layouter.rs
index 4b9d74b69a..e9eac92aef 100644
--- a/halo2_proofs/src/circuit/layouter.rs
+++ b/halo2_proofs/src/circuit/layouter.rs
@@ -9,6 +9,14 @@ use ff::Field;
 use super::{Cell, RegionIndex, Value};
 use crate::plonk::{Advice, Any, Assigned, Column, Error, Fixed, Instance, Selector, TableColumn};
 
+/// Intermediate trait requirements for [`RegionLayouter`] when thread-safe regions are enabled.
+#[cfg(feature = "thread-safe-region")]
+pub trait SyncDeps: Send + Sync {}
+
+/// Intermediate trait requirements for [`RegionLayouter`].
+#[cfg(not(feature = "thread-safe-region"))]
+pub trait SyncDeps {}
+
 /// Helper trait for implementing a custom [`Layouter`].
 ///
 /// This trait is used for implementing region assignments:
@@ -39,7 +47,7 @@ use crate::plonk::{Advice, Any, Assigned, Column, Error, Fixed, Instance, Select
 /// `Chip::Config`).
 ///
 /// [`Layouter`]: super::Layouter
-pub trait RegionLayouter<F: Field>: fmt::Debug {
+pub trait RegionLayouter<F: Field>: fmt::Debug + SyncDeps {
     /// Enables a selector at the given offset.
     fn enable_selector<'v>(
         &'v mut self,
@@ -141,6 +149,8 @@ pub struct RegionShape {
     pub(super) row_count: usize,
 }
 
+impl SyncDeps for RegionShape {}
+
 /// The virtual column involved in a region. This includes concrete columns,
 /// as well as selectors that are not concrete columns at this stage.
 #[derive(Eq, PartialEq, Copy, Clone, Debug, Hash)]
diff --git a/halo2_proofs/src/dev.rs b/halo2_proofs/src/dev.rs
index f43fa76351..20dc4a7670 100644
--- a/halo2_proofs/src/dev.rs
+++ b/halo2_proofs/src/dev.rs
@@ -13,6 +13,7 @@ use ff::FromUniformBytes;
 use ff::{BatchInvert, Field};
 use group::Group;
 
+use crate::circuit::layouter::SyncDeps;
 use crate::plonk::permutation::keygen::Assembly;
 use crate::{
     circuit,
@@ -1121,6 +1122,9 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
         };
         debug_assert_eq!(Arc::strong_count(&prover.fixed_vec), 1);
 
+        #[cfg(feature = "thread-safe-region")]
+        prover.permutation.build_ordered_mapping();
+
         Ok(prover)
     }
 
@@ -1428,7 +1432,11 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
                         })
                         .collect::<Vec<_>>()
                 });
-
+        let mapping = self
+            .permutation
+            .as_ref()
+            .expect("root cs permutation must be Some")
+            .mapping();
         // Check that permutations preserve the original values of the cells.
         let perm_errors = {
             // Original values of columns involved in the permutation.
@@ -1446,16 +1454,12 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
             };
 
             // Iterate over each column of the permutation
-            self.permutation
-                .as_ref()
-                .expect("root cs permutation must be Some")
-                .mapping()
-                .iter()
-                .enumerate()
-                .flat_map(move |(column, values)| {
-                    // Iterate over each row of the column to check that the cell's
-                    // value is preserved by the mapping.
-                    values.iter().enumerate().filter_map(move |(row, cell)| {
+            mapping.enumerate().flat_map(move |(column, values)| {
+                // Iterate over each row of the column to check that the cell's
+                // value is preserved by the mapping.
+                values
+                    .enumerate()
+                    .filter_map(move |(row, cell)| {
                         let original_cell = original(column, row);
                         let permuted_cell = original(cell.0, cell.1);
                         if original_cell == permuted_cell {
@@ -1473,7 +1477,8 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
                             })
                         }
                     })
-                })
+                    .collect::<Vec<_>>()
+            })
         };
 
         let mut errors: Vec<_> = iter::empty()
@@ -1802,7 +1807,11 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
                         })
                         .collect::<Vec<_>>()
                 });
-
+        let mapping = self
+            .permutation
+            .as_ref()
+            .expect("root cs permutation must be Some")
+            .mapping();
         // Check that permutations preserve the original values of the cells.
         let perm_errors = {
             // Original values of columns involved in the permutation.
@@ -1820,38 +1829,31 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
             };
 
             // Iterate over each column of the permutation
-            self.permutation
-                .as_ref()
-                .expect("root cs permutation must be Some")
-                .mapping()
-                .iter()
-                .enumerate()
-                .flat_map(move |(column, values)| {
-                    // Iterate over each row of the column to check that the cell's
-                    // value is preserved by the mapping.
-                    values
-                        .par_iter()
-                        .enumerate()
-                        .filter_map(move |(row, cell)| {
-                            let original_cell = original(column, row);
-                            let permuted_cell = original(cell.0, cell.1);
-                            if original_cell == permuted_cell {
-                                None
-                            } else {
-                                let columns = self.cs.permutation.get_columns();
-                                let column = columns.get(column).unwrap();
-                                Some(VerifyFailure::Permutation {
-                                    column: (*column).into(),
-                                    location: FailureLocation::find(
-                                        &self.regions,
-                                        row,
-                                        Some(column).into_iter().cloned().collect(),
-                                    ),
-                                })
-                            }
-                        })
-                        .collect::<Vec<_>>()
-                })
+            mapping.enumerate().flat_map(move |(column, values)| {
+                // Iterate over each row of the column to check that the cell's
+                // value is preserved by the mapping.
+                values
+                    .enumerate()
+                    .filter_map(move |(row, cell)| {
+                        let original_cell = original(column, row);
+                        let permuted_cell = original(cell.0, cell.1);
+                        if original_cell == permuted_cell {
+                            None
+                        } else {
+                            let columns = self.cs.permutation.get_columns();
+                            let column = columns.get(column).unwrap();
+                            Some(VerifyFailure::Permutation {
+                                column: (*column).into(),
+                                location: FailureLocation::find(
+                                    &self.regions,
+                                    row,
+                                    Some(column).into_iter().cloned().collect(),
+                                ),
+                            })
+                        }
+                    })
+                    .collect::<Vec<_>>()
+            })
         };
 
         let mut errors: Vec<_> = iter::empty()
@@ -2548,3 +2550,5 @@ mod tests {
         )
     }
 }
+
+impl<F: Field> SyncDeps for MockProver<F> {}
diff --git a/halo2_proofs/src/dev/cost.rs b/halo2_proofs/src/dev/cost.rs
index 815e66c9c2..2a4d68f57a 100644
--- a/halo2_proofs/src/dev/cost.rs
+++ b/halo2_proofs/src/dev/cost.rs
@@ -12,7 +12,7 @@ use ff::{Field, PrimeField};
 use group::prime::PrimeGroup;
 
 use crate::{
-    circuit::Value,
+    circuit::{layouter::SyncDeps, Value},
     plonk::{
         Advice, Any, Assigned, Assignment, Challenge, Circuit, Column, ConstraintSystem, Error,
         Fixed, FloorPlanner, Instance, Selector,
@@ -47,6 +47,8 @@ struct Assembly {
     selectors: Vec<Vec<bool>>,
 }
 
+impl SyncDeps for Assembly {}
+
 impl<F: Field> Assignment<F> for Assembly {
     fn enter_region<NR, N>(&mut self, _: N)
     where
diff --git a/halo2_proofs/src/dev/graph.rs b/halo2_proofs/src/dev/graph.rs
index 7fbf9f2f6b..688aaece16 100644
--- a/halo2_proofs/src/dev/graph.rs
+++ b/halo2_proofs/src/dev/graph.rs
@@ -81,6 +81,8 @@ struct Graph {
     current_namespace: Vec<usize>,
 }
 
+impl crate::dev::SyncDeps for Graph {}
+
 impl<F: Field> Assignment<F> for Graph {
     fn enter_region<NR, N>(&mut self, _: N)
     where
diff --git a/halo2_proofs/src/dev/graph/layout.rs b/halo2_proofs/src/dev/graph/layout.rs
index e1bbe77faf..38f3304617 100644
--- a/halo2_proofs/src/dev/graph/layout.rs
+++ b/halo2_proofs/src/dev/graph/layout.rs
@@ -355,6 +355,8 @@ struct Layout {
     selectors: Vec<Vec<bool>>,
 }
 
+impl crate::dev::SyncDeps for Layout {}
+
 impl Layout {
     fn new(k: u32, n: usize, num_selectors: usize) -> Self {
         Layout {
diff --git a/halo2_proofs/src/plonk/circuit.rs b/halo2_proofs/src/plonk/circuit.rs
index a2a905d85b..c05389ee6b 100644
--- a/halo2_proofs/src/plonk/circuit.rs
+++ b/halo2_proofs/src/plonk/circuit.rs
@@ -1,4 +1,5 @@
 use super::{lookup, permutation, Assigned, Error};
+use crate::circuit::layouter::SyncDeps;
 use crate::dev::metadata;
 use crate::{
     circuit::{Layouter, Region, Value},
@@ -760,7 +761,7 @@ pub trait FloorPlanner {
     /// - Perform any necessary setup or measurement tasks, which may involve one or more
     ///   calls to `Circuit::default().synthesize(config, &mut layouter)`.
     /// - Call `circuit.synthesize(config, &mut layouter)` exactly once.
-    fn synthesize<F: Field, CS: Assignment<F>, C: Circuit<F>>(
+    fn synthesize<F: Field, CS: Assignment<F> + SyncDeps, C: Circuit<F>>(
         cs: &mut CS,
         circuit: &C,
         config: C::Config,
diff --git a/halo2_proofs/src/plonk/keygen.rs b/halo2_proofs/src/plonk/keygen.rs
index 42f0fabccd..bd0dd73541 100644
--- a/halo2_proofs/src/plonk/keygen.rs
+++ b/halo2_proofs/src/plonk/keygen.rs
@@ -18,7 +18,7 @@ use super::{
 use crate::helpers::CopyCell;
 use crate::{
     arithmetic::{parallelize, CurveAffine},
-    circuit::Value,
+    circuit::{layouter::SyncDeps, Value},
     poly::{
         batch_invert_assigned,
         commitment::{Blind, Params, MSM},
@@ -68,6 +68,8 @@ struct Assembly<'a, F: Field> {
     _marker: std::marker::PhantomData<F>,
 }
 
+impl<'a, F: Field> SyncDeps for Assembly<'a, F> {}
+
 impl<'a, F: Field> Assignment<F> for Assembly<'a, F> {
     fn enter_region<NR, N>(&mut self, _: N)
     where
diff --git a/halo2_proofs/src/plonk/permutation/keygen.rs b/halo2_proofs/src/plonk/permutation/keygen.rs
index 0736de98c5..57882fad66 100644
--- a/halo2_proofs/src/plonk/permutation/keygen.rs
+++ b/halo2_proofs/src/plonk/permutation/keygen.rs
@@ -1,5 +1,11 @@
+use std::collections::{BTreeMap, BTreeSet, HashMap, HashSet};
+
 use ff::{Field, PrimeField};
 use group::Curve;
+use rayon::prelude::{
+    IndexedParallelIterator, IntoParallelIterator, IntoParallelRefIterator,
+    IntoParallelRefMutIterator, ParallelIterator, ParallelSliceMut,
+};
 
 use super::{Argument, ProvingKey, VerifyingKey};
 use crate::{
@@ -11,6 +17,7 @@ use crate::{
     },
 };
 
+#[cfg(not(feature = "thread-safe-region"))]
 /// Struct that accumulates all the necessary data in order to construct the permutation argument.
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub struct Assembly {
@@ -24,6 +31,7 @@ pub struct Assembly {
     sizes: Vec<Vec<usize>>,
 }
 
+#[cfg(not(feature = "thread-safe-region"))]
 impl Assembly {
     pub(crate) fn new(n: usize, p: &Argument) -> Self {
         // Initialize the copy vector to keep track of copy constraints in all
@@ -108,144 +116,340 @@ impl Assembly {
         domain: &EvaluationDomain<C::Scalar>,
         p: &Argument,
     ) -> VerifyingKey<C> {
-        // Compute [omega^0, omega^1, ..., omega^{params.n - 1}]
-        let mut omega_powers = vec![C::Scalar::ZERO; params.n() as usize];
-        {
-            let omega = domain.get_omega();
-            parallelize(&mut omega_powers, |o, start| {
-                let mut cur = omega.pow_vartime([start as u64]);
-                for v in o.iter_mut() {
-                    *v = cur;
-                    cur *= &omega;
-                }
-            })
+        build_vk(params, domain, p, |i, j| self.mapping[i][j])
+    }
+
+    pub(crate) fn build_pk<'params, C: CurveAffine, P: Params<'params, C>>(
+        self,
+        params: &P,
+        domain: &EvaluationDomain<C::Scalar>,
+        p: &Argument,
+    ) -> ProvingKey<C> {
+        build_pk(params, domain, p, |i, j| self.mapping[i][j])
+    }
+
+    /// Returns columns that participate in the permutation argument.
+    pub fn columns(&self) -> &[Column<Any>] {
+        &self.columns
+    }
+
+    /// Returns mappings of the copies.
+    pub fn mapping(
+        &self,
+    ) -> impl Iterator<Item = impl IndexedParallelIterator<Item = (usize, usize)> + '_> {
+        self.mapping.iter().map(|c| c.par_iter().copied())
+    }
+}
+
+#[cfg(feature = "thread-safe-region")]
+/// Struct that accumulates all the necessary data in order to construct the permutation argument.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct Assembly {
+    /// Columns that participate on the copy permutation argument.
+    columns: Vec<Column<Any>>,
+    /// Mapping of the actual copies done.
+    cycles: Vec<Vec<(usize, usize)>>,
+    /// Mapping of the actual copies done.
+    ordered_cycles: Vec<BTreeSet<(usize, usize)>>,
+    /// Mapping of the actual copies done.
+    aux: HashMap<(usize, usize), usize>,
+    /// total length of a column
+    col_len: usize,
+    /// number of columns
+    num_cols: usize,
+}
+
+#[cfg(feature = "thread-safe-region")]
+impl Assembly {
+    pub(crate) fn new(n: usize, p: &Argument) -> Self {
+        Assembly {
+            columns: p.columns.clone(),
+            cycles: Vec::with_capacity(n),
+            ordered_cycles: Vec::with_capacity(n),
+            aux: HashMap::new(),
+            col_len: n,
+            num_cols: p.columns.len(),
         }
+    }
 
-        // Compute [omega_powers * \delta^0, omega_powers * \delta^1, ..., omega_powers * \delta^m]
-        let mut deltaomega = vec![omega_powers; p.columns.len()];
-        {
-            parallelize(&mut deltaomega, |o, start| {
-                let mut cur = C::Scalar::DELTA.pow_vartime(&[start as u64]);
-                for omega_powers in o.iter_mut() {
-                    for v in omega_powers {
-                        *v *= &cur;
-                    }
-                    cur *= &<C::Scalar as PrimeField>::DELTA;
-                }
-            });
+    pub(crate) fn copy(
+        &mut self,
+        left_column: Column<Any>,
+        left_row: usize,
+        right_column: Column<Any>,
+        right_row: usize,
+    ) -> Result<(), Error> {
+        let left_column = self
+            .columns
+            .iter()
+            .position(|c| c == &left_column)
+            .ok_or(Error::ColumnNotInPermutation(left_column))?;
+        let right_column = self
+            .columns
+            .iter()
+            .position(|c| c == &right_column)
+            .ok_or(Error::ColumnNotInPermutation(right_column))?;
+
+        // Check bounds
+        if left_row >= self.col_len || right_row >= self.col_len {
+            return Err(Error::BoundsFailure);
         }
 
-        // Computes the permutation polynomial based on the permutation
-        // description in the assembly.
-        let mut permutations = vec![domain.empty_lagrange(); p.columns.len()];
-        {
-            parallelize(&mut permutations, |o, start| {
-                for (x, permutation_poly) in o.iter_mut().enumerate() {
-                    let i = start + x;
-                    for (j, p) in permutation_poly.iter_mut().enumerate() {
-                        let (permuted_i, permuted_j) = self.mapping[i][j];
-                        *p = deltaomega[permuted_i][permuted_j];
-                    }
-                }
-            });
+        let left_cycle = self.aux.get(&(left_column, left_row));
+        let right_cycle = self.aux.get(&(right_column, right_row));
+
+        // extract cycle elements
+        let right_cycle_elems = match right_cycle {
+            Some(i) => {
+                let entry = self.cycles[*i].clone();
+                self.cycles[*i] = vec![];
+                entry
+            }
+            None => [(right_column, right_row)].into(),
+        };
+
+        assert!(right_cycle_elems.contains(&(right_column, right_row)));
+
+        // merge cycles
+        let cycle_idx = match left_cycle {
+            Some(i) => {
+                let entry = &mut self.cycles[*i];
+                entry.extend(right_cycle_elems.clone());
+                *i
+            }
+            // if they were singletons -- create a new cycle entry
+            None => {
+                let mut set: Vec<(usize, usize)> = right_cycle_elems.clone();
+                set.push((left_column, left_row));
+                self.cycles.push(set);
+                let cycle_idx = self.cycles.len() - 1;
+                self.aux.insert((left_column, left_row), cycle_idx);
+                cycle_idx
+            }
+        };
+
+        let index_updates = vec![cycle_idx; right_cycle_elems.len()].into_iter();
+        let updates = right_cycle_elems.into_iter().zip(index_updates);
+
+        self.aux.extend(updates);
+
+        Ok(())
+    }
+
+    /// Builds the ordered mapping of the cycles.
+    /// This will only get executed once.
+    pub fn build_ordered_mapping(&mut self) {
+        // will only get called once
+        if self.ordered_cycles.is_empty() && !self.cycles.is_empty() {
+            self.ordered_cycles = self
+                .cycles
+                .par_iter_mut()
+                .map(|col| {
+                    let mut set = BTreeSet::new();
+                    set.extend(col.clone());
+                    // free up memory
+                    *col = vec![];
+                    set
+                })
+                .collect();
         }
+    }
 
-        // Pre-compute commitments for the URS.
-        let mut commitments = Vec::with_capacity(p.columns.len());
-        for permutation in &permutations {
-            // Compute commitment to permutation polynomial
-            commitments.push(
-                params
-                    .commit_lagrange(permutation, Blind::default())
-                    .to_affine(),
-            );
+    fn mapping_at_idx(&self, col: usize, row: usize) -> (usize, usize) {
+        assert!(
+            !self.ordered_cycles.is_empty() || self.cycles.is_empty(),
+            "cycles have not been ordered"
+        );
+
+        if let Some(cycle_idx) = self.aux.get(&(col, row)) {
+            let cycle = &self.ordered_cycles[*cycle_idx];
+            let mut cycle_iter = cycle.range((
+                std::ops::Bound::Excluded((col, row)),
+                std::ops::Bound::Unbounded,
+            ));
+            // point to the next node in the cycle
+            match cycle_iter.next() {
+                Some((i, j)) => (*i, *j),
+                // wrap back around to the first element which SHOULD exist
+                None => *(cycle.iter().next().unwrap()),
+            }
+        // is a singleton
+        } else {
+            (col, row)
         }
+    }
 
-        VerifyingKey { commitments }
+    pub(crate) fn build_vk<'params, C: CurveAffine, P: Params<'params, C>>(
+        &mut self,
+        params: &P,
+        domain: &EvaluationDomain<C::Scalar>,
+        p: &Argument,
+    ) -> VerifyingKey<C> {
+        self.build_ordered_mapping();
+        build_vk(params, domain, p, |i, j| self.mapping_at_idx(i, j))
     }
 
     pub(crate) fn build_pk<'params, C: CurveAffine, P: Params<'params, C>>(
-        self,
+        &mut self,
         params: &P,
         domain: &EvaluationDomain<C::Scalar>,
         p: &Argument,
     ) -> ProvingKey<C> {
-        // Compute [omega^0, omega^1, ..., omega^{params.n - 1}]
-        let mut omega_powers = vec![C::Scalar::ZERO; params.n() as usize];
-        {
-            let omega = domain.get_omega();
-            parallelize(&mut omega_powers, |o, start| {
-                let mut cur = omega.pow_vartime([start as u64]);
-                for v in o.iter_mut() {
-                    *v = cur;
-                    cur *= &omega;
-                }
-            })
-        }
+        self.build_ordered_mapping();
+        build_pk(params, domain, p, |i, j| self.mapping_at_idx(i, j))
+    }
 
-        // Compute [omega_powers * \delta^0, omega_powers * \delta^1, ..., omega_powers * \delta^m]
-        let mut deltaomega = vec![omega_powers; p.columns.len()];
-        {
-            parallelize(&mut deltaomega, |o, start| {
-                let mut cur = C::Scalar::DELTA.pow_vartime(&[start as u64]);
-                for omega_powers in o.iter_mut() {
-                    for v in omega_powers {
-                        *v *= &cur;
-                    }
-                    cur *= &C::Scalar::DELTA;
-                }
-            });
-        }
+    /// Returns columns that participate in the permutation argument.
+    pub fn columns(&self) -> &[Column<Any>] {
+        &self.columns
+    }
 
-        // Compute permutation polynomials.
-        let mut permutations = vec![domain.empty_lagrange(); p.columns.len()];
-        {
-            parallelize(&mut permutations, |o, start| {
-                for (x, permutation_poly) in o.iter_mut().enumerate() {
-                    let i = start + x;
-                    for (j, p) in permutation_poly.iter_mut().enumerate() {
-                        let (permuted_i, permuted_j) = self.mapping[i][j];
-                        *p = deltaomega[permuted_i][permuted_j];
-                    }
-                }
-            });
-        }
+    /// Returns mappings of the copies.
+    pub fn mapping(
+        &self,
+    ) -> impl Iterator<Item = impl IndexedParallelIterator<Item = (usize, usize)> + '_> {
+        (0..self.num_cols).map(move |i| {
+            (0..self.col_len)
+                .into_par_iter()
+                .map(move |j| self.mapping_at_idx(i, j))
+        })
+    }
+}
 
-        let mut polys = vec![domain.empty_coeff(); p.columns.len()];
-        {
-            parallelize(&mut polys, |o, start| {
-                for (x, poly) in o.iter_mut().enumerate() {
-                    let i = start + x;
-                    let permutation_poly = permutations[i].clone();
-                    *poly = domain.lagrange_to_coeff(permutation_poly);
+pub(crate) fn build_pk<'params, C: CurveAffine, P: Params<'params, C>>(
+    params: &P,
+    domain: &EvaluationDomain<C::Scalar>,
+    p: &Argument,
+    mapping: impl Fn(usize, usize) -> (usize, usize) + Sync,
+) -> ProvingKey<C> {
+    // Compute [omega^0, omega^1, ..., omega^{params.n - 1}]
+    let mut omega_powers = vec![C::Scalar::ZERO; params.n() as usize];
+    {
+        let omega = domain.get_omega();
+        parallelize(&mut omega_powers, |o, start| {
+            let mut cur = omega.pow_vartime(&[start as u64]);
+            for v in o.iter_mut() {
+                *v = cur;
+                cur *= &omega;
+            }
+        })
+    }
+
+    // Compute [omega_powers * \delta^0, omega_powers * \delta^1, ..., omega_powers * \delta^m]
+    let mut deltaomega = vec![omega_powers; p.columns.len()];
+    {
+        parallelize(&mut deltaomega, |o, start| {
+            let mut cur = C::Scalar::DELTA.pow_vartime(&[start as u64]);
+            for omega_powers in o.iter_mut() {
+                for v in omega_powers {
+                    *v *= &cur;
                 }
-            });
-        }
+                cur *= &C::Scalar::DELTA;
+            }
+        });
+    }
 
-        let mut cosets = vec![domain.empty_extended(); p.columns.len()];
-        {
-            parallelize(&mut cosets, |o, start| {
-                for (x, coset) in o.iter_mut().enumerate() {
-                    let i = start + x;
-                    let poly = polys[i].clone();
-                    *coset = domain.coeff_to_extended(poly);
+    // Compute permutation polynomials, convert to coset form.
+    let mut permutations = vec![domain.empty_lagrange(); p.columns.len()];
+    {
+        parallelize(&mut permutations, |o, start| {
+            for (x, permutation_poly) in o.iter_mut().enumerate() {
+                let i = start + x;
+                for (j, p) in permutation_poly.iter_mut().enumerate() {
+                    let (permuted_i, permuted_j) = mapping(i, j);
+                    *p = deltaomega[permuted_i][permuted_j];
                 }
-            });
-        }
+            }
+        });
+    }
 
-        ProvingKey {
-            permutations,
-            polys,
-        }
+    let mut polys = vec![domain.empty_coeff(); p.columns.len()];
+    {
+        parallelize(&mut polys, |o, start| {
+            for (x, poly) in o.iter_mut().enumerate() {
+                let i = start + x;
+                let permutation_poly = permutations[i].clone();
+                *poly = domain.lagrange_to_coeff(permutation_poly);
+            }
+        });
     }
 
-    /// Returns columns that participate on the permutation argument.
-    pub fn columns(&self) -> &[Column<Any>] {
-        &self.columns
+    let mut cosets = vec![domain.empty_extended(); p.columns.len()];
+    {
+        parallelize(&mut cosets, |o, start| {
+            for (x, coset) in o.iter_mut().enumerate() {
+                let i = start + x;
+                let poly = polys[i].clone();
+                *coset = domain.coeff_to_extended(poly);
+            }
+        });
     }
 
-    /// Returns mappings of the copies.
-    pub fn mapping(&self) -> &[Vec<(usize, usize)>] {
-        &self.mapping
+    ProvingKey {
+        permutations,
+        polys,
+        cosets,
+    }
+}
+
+pub(crate) fn build_vk<'params, C: CurveAffine, P: Params<'params, C>>(
+    params: &P,
+    domain: &EvaluationDomain<C::Scalar>,
+    p: &Argument,
+    mapping: impl Fn(usize, usize) -> (usize, usize) + Sync,
+) -> VerifyingKey<C> {
+    // Compute [omega^0, omega^1, ..., omega^{params.n - 1}]
+    let mut omega_powers = vec![C::Scalar::ZERO; params.n() as usize];
+    {
+        let omega = domain.get_omega();
+        parallelize(&mut omega_powers, |o, start| {
+            let mut cur = omega.pow_vartime(&[start as u64]);
+            for v in o.iter_mut() {
+                *v = cur;
+                cur *= &omega;
+            }
+        })
+    }
+
+    // Compute [omega_powers * \delta^0, omega_powers * \delta^1, ..., omega_powers * \delta^m]
+    let mut deltaomega = vec![omega_powers; p.columns.len()];
+    {
+        parallelize(&mut deltaomega, |o, start| {
+            let mut cur = C::Scalar::DELTA.pow_vartime(&[start as u64]);
+            for omega_powers in o.iter_mut() {
+                for v in omega_powers {
+                    *v *= &cur;
+                }
+                cur *= &<C::Scalar as PrimeField>::DELTA;
+            }
+        });
+    }
+
+    // Computes the permutation polynomial based on the permutation
+    // description in the assembly.
+    let mut permutations = vec![domain.empty_lagrange(); p.columns.len()];
+    {
+        parallelize(&mut permutations, |o, start| {
+            for (x, permutation_poly) in o.iter_mut().enumerate() {
+                let i = start + x;
+                for (j, p) in permutation_poly.iter_mut().enumerate() {
+                    let (permuted_i, permuted_j) = mapping(i, j);
+                    *p = deltaomega[permuted_i][permuted_j];
+                }
+            }
+        });
+    }
+
+    // Pre-compute commitments for the URS.
+    let mut commitments = Vec::with_capacity(p.columns.len());
+    for permutation in &permutations {
+        // Compute commitment to permutation polynomial
+        commitments.push(
+            params
+                .commit_lagrange(permutation, Blind::default())
+                .to_affine(),
+        );
     }
+
+    VerifyingKey { commitments }
 }
diff --git a/halo2_proofs/src/plonk/prover.rs b/halo2_proofs/src/plonk/prover.rs
index bc78600f4f..0b1f6f48f9 100644
--- a/halo2_proofs/src/plonk/prover.rs
+++ b/halo2_proofs/src/plonk/prover.rs
@@ -19,6 +19,7 @@ use super::{
     lookup, permutation, vanishing, ChallengeBeta, ChallengeGamma, ChallengeTheta, ChallengeX,
     ChallengeY, Error, Expression, ProvingKey,
 };
+use crate::circuit::layouter::SyncDeps;
 use crate::{
     arithmetic::{eval_polynomial, CurveAffine},
     circuit::Value,
@@ -157,6 +158,8 @@ where
         _marker: std::marker::PhantomData<F>,
     }
 
+    impl<'a, F: Field> SyncDeps for WitnessCollection<'a, F> {}
+
     impl<'a, F: Field> Assignment<F> for WitnessCollection<'a, F> {
         fn enter_region<NR, N>(&mut self, _: N)
         where

From 57831cc48bcb43f3ff1e3c6a90628a29a6a91059 Mon Sep 17 00:00:00 2001
From: Velaciela <git.rover@outlook.com>
Date: Mon, 9 Oct 2023 13:52:03 +0000
Subject: [PATCH 14/30] fix previous commit

---
 halo2_proofs/src/dev.rs                      |  2 +-
 halo2_proofs/src/plonk/circuit.rs            |  2 +-
 halo2_proofs/src/plonk/permutation/keygen.rs | 22 ++++++++++----------
 3 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/halo2_proofs/src/dev.rs b/halo2_proofs/src/dev.rs
index 20dc4a7670..a34e180a2c 100644
--- a/halo2_proofs/src/dev.rs
+++ b/halo2_proofs/src/dev.rs
@@ -2551,4 +2551,4 @@ mod tests {
     }
 }
 
-impl<F: Field> SyncDeps for MockProver<F> {}
+impl<'a, F: Field> SyncDeps for MockProver<'a, F> {}
diff --git a/halo2_proofs/src/plonk/circuit.rs b/halo2_proofs/src/plonk/circuit.rs
index c05389ee6b..b589c9df09 100644
--- a/halo2_proofs/src/plonk/circuit.rs
+++ b/halo2_proofs/src/plonk/circuit.rs
@@ -2312,7 +2312,7 @@ impl<F: Field> ConstraintSystem<F> {
     }
 
     /// Returns general column annotations
-    pub fn general_column_annotations(&self) -> &HashMap<metadata::Column, String> {
+    pub fn general_column_annotations(&self) -> &BTreeMap<metadata::Column, String> {
         &self.general_column_annotations
     }
 
diff --git a/halo2_proofs/src/plonk/permutation/keygen.rs b/halo2_proofs/src/plonk/permutation/keygen.rs
index 57882fad66..1a4af204dc 100644
--- a/halo2_proofs/src/plonk/permutation/keygen.rs
+++ b/halo2_proofs/src/plonk/permutation/keygen.rs
@@ -374,21 +374,21 @@ pub(crate) fn build_pk<'params, C: CurveAffine, P: Params<'params, C>>(
         });
     }
 
-    let mut cosets = vec![domain.empty_extended(); p.columns.len()];
-    {
-        parallelize(&mut cosets, |o, start| {
-            for (x, coset) in o.iter_mut().enumerate() {
-                let i = start + x;
-                let poly = polys[i].clone();
-                *coset = domain.coeff_to_extended(poly);
-            }
-        });
-    }
+    // let mut cosets = vec![domain.empty_extended(); p.columns.len()];
+    // {
+    //     parallelize(&mut cosets, |o, start| {
+    //         for (x, coset) in o.iter_mut().enumerate() {
+    //             let i = start + x;
+    //             let poly = polys[i].clone();
+    //             *coset = domain.coeff_to_extended(poly);
+    //         }
+    //     });
+    // }
 
     ProvingKey {
         permutations,
         polys,
-        cosets,
+        // cosets,
     }
 }
 

From 7a80259d62596b931e6a2839ef4a7a434fe08d16 Mon Sep 17 00:00:00 2001
From: Mamy Ratsimbazafy <mamy_github@numforge.co>
Date: Mon, 19 Jun 2023 09:57:11 +0200
Subject: [PATCH 15/30] Fix `parallelize` workload imbalance (#186)

* fix parallelize workload imbalance

* remove the need of unsafe
---
 halo2_proofs/src/arithmetic.rs | 55 ++++++++++++++++++++++++++--------
 1 file changed, 43 insertions(+), 12 deletions(-)

diff --git a/halo2_proofs/src/arithmetic.rs b/halo2_proofs/src/arithmetic.rs
index 56ca5fd90c..5d55eaed15 100644
--- a/halo2_proofs/src/arithmetic.rs
+++ b/halo2_proofs/src/arithmetic.rs
@@ -535,23 +535,54 @@ where
     q
 }
 
-/// This simple utility function will parallelize an operation that is to be
+/// This utility function will parallelize an operation that is to be
 /// performed over a mutable slice.
 pub fn parallelize<T: Send, F: Fn(&mut [T], usize) + Send + Sync + Clone>(v: &mut [T], f: F) {
-    let n = v.len();
+    // Algorithm rationale:
+    //
+    // Using the stdlib `chunks_mut` will lead to severe load imbalance.
+    // From https://github.com/rust-lang/rust/blob/e94bda3/library/core/src/slice/iter.rs#L1607-L1637
+    // if the division is not exact, the last chunk will be the remainder.
+    //
+    // Dividing 40 items on 12 threads will lead to a chunk size of 40/12 = 3,
+    // There will be a 13 chunks of size 3 and 1 of size 1 distributed on 12 threads.
+    // This leads to 1 thread working on 6 iterations, 1 on 4 iterations and 10 on 3 iterations,
+    // a load imbalance of 2x.
+    //
+    // Instead we can divide work into chunks of size
+    // 4, 4, 4, 4, 3, 3, 3, 3, 3, 3, 3, 3 = 4*4 + 3*8 = 40
+    //
+    // This would lead to a 6/4 = 1.5x speedup compared to naive chunks_mut
+    //
+    // See also OpenMP spec (page 60)
+    // http://www.openmp.org/mp-documents/openmp-4.5.pdf
+    // "When no chunk_size is specified, the iteration space is divided into chunks
+    // that are approximately equal in size, and at most one chunk is distributed to
+    // each thread. The size of the chunks is unspecified in this case."
+    // This implies chunks are the same size ±1
+
+    let f = &f;
+    let total_iters = v.len();
     let num_threads = multicore::current_num_threads();
-    let mut chunk = (n as usize) / num_threads;
-    if chunk < num_threads {
-        chunk = 1;
-    }
+    let base_chunk_size = total_iters / num_threads;
+    let cutoff_chunk_id = total_iters % num_threads;
+    let split_pos = cutoff_chunk_id * (base_chunk_size + 1);
+    let (v_hi, v_lo) = v.split_at_mut(split_pos);
 
     multicore::scope(|scope| {
-        for (chunk_num, v) in v.chunks_mut(chunk).enumerate() {
-            let f = f.clone();
-            scope.spawn(move |_| {
-                let start = chunk_num * chunk;
-                f(v, start);
-            });
+        // Skip special-case: number of iterations is cleanly divided by number of threads.
+        if cutoff_chunk_id != 0 {
+            for (chunk_id, chunk) in v_hi.chunks_exact_mut(base_chunk_size + 1).enumerate() {
+                let offset = chunk_id * (base_chunk_size + 1);
+                scope.spawn(move |_| f(chunk, offset));
+            }
+        }
+        // Skip special-case: less iterations than number of threads.
+        if base_chunk_size != 0 {
+            for (chunk_id, chunk) in v_lo.chunks_exact_mut(base_chunk_size).enumerate() {
+                let offset = split_pos + (chunk_id * base_chunk_size);
+                scope.spawn(move |_| f(chunk, offset));
+            }
         }
     });
 }

From d171a04a2f0373327787c636e51825b8f1752d95 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fran=C3=A7ois=20Garillot?=
 <4142+huitseeker@users.noreply.github.com>
Date: Sun, 30 Jul 2023 13:35:30 +0200
Subject: [PATCH 16/30] Updates halo2_curves dependency to released package
 (#190)

THe package release ressets the version from those inherited by the legacy
halo2curves repo's fork history.

The upstream diff is:
https://github.com/privacy-scaling-explorations/halo2curves/compare/9f5c50810bbefe779ee5cf1d852b2fe85dc35d5e..9a7f726fa74c8765bc7cdab11519cf285d169ecf
---
 halo2_gadgets/Cargo.toml | 2 +-
 halo2_proofs/Cargo.toml  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/halo2_gadgets/Cargo.toml b/halo2_gadgets/Cargo.toml
index c4ebf6fae3..58b9ffff72 100644
--- a/halo2_gadgets/Cargo.toml
+++ b/halo2_gadgets/Cargo.toml
@@ -28,7 +28,7 @@ ff = { version = "0.13", features = ["bits"] }
 group = "0.13"
 halo2_proofs = { version = "0.2", path = "../halo2_proofs" }
 lazy_static = "1"
-halo2curves = { git = 'https://github.com/privacy-scaling-explorations/halo2curves', tag = "0.3.2" }
+halo2curves = { version = "0.1.0" }
 proptest = { version = "1.0.0", optional = true }
 rand = "0.8"
 subtle = "2.3"
diff --git a/halo2_proofs/Cargo.toml b/halo2_proofs/Cargo.toml
index 130ab0ce02..bdd19f9b37 100644
--- a/halo2_proofs/Cargo.toml
+++ b/halo2_proofs/Cargo.toml
@@ -48,7 +48,7 @@ backtrace = { version = "0.3", optional = true }
 rayon = "1.5.1"
 ff = "0.13"
 group = "0.13"
-halo2curves = { git = 'https://github.com/privacy-scaling-explorations/halo2curves', tag = "0.3.2" }
+halo2curves = { version = "0.1.0" }
 rand_core = { version = "0.6", default-features = false }
 tracing = "0.1"
 blake2b_simd = "1"

From 669a670a79dc5524781ff71553feb33bfc674706 Mon Sep 17 00:00:00 2001
From: dante <45801863+alexander-camuto@users.noreply.github.com>
Date: Sat, 26 Aug 2023 02:45:05 +0100
Subject: [PATCH 17/30] fix: explicitly define mds diff type (#196)

* fix: explicitly define mds diff type

* rm paren
---
 halo2_gadgets/src/poseidon/primitives/mds.rs | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/halo2_gadgets/src/poseidon/primitives/mds.rs b/halo2_gadgets/src/poseidon/primitives/mds.rs
index 892ee11f6b..f1642d21c3 100644
--- a/halo2_gadgets/src/poseidon/primitives/mds.rs
+++ b/halo2_gadgets/src/poseidon/primitives/mds.rs
@@ -82,7 +82,8 @@ pub(super) fn generate_mds<F: FromUniformBytes<64> + Ord, const T: usize>(
                 acc
             } else {
                 // We can invert freely; by construction, the elements of xs are distinct.
-                acc * (x - x_m) * (x_j - x_m).invert().unwrap()
+                let diff: F = x_j - *x_m;
+                acc * (x - x_m) * diff.invert().unwrap()
             }
         })
     };

From d19480ab4982fe104520b45686afd31b506d13d7 Mon Sep 17 00:00:00 2001
From: Han <tinghan0110@gmail.com>
Date: Mon, 4 Sep 2023 16:56:29 +0800
Subject: [PATCH 18/30] feat: expose `transcript_repr` of `VerifyingKey` and
 reduce the trait constraint (#200)

---
 halo2_proofs/src/plonk.rs | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/halo2_proofs/src/plonk.rs b/halo2_proofs/src/plonk.rs
index 62c684ceb4..3d9167f0cd 100644
--- a/halo2_proofs/src/plonk.rs
+++ b/halo2_proofs/src/plonk.rs
@@ -161,10 +161,7 @@ where
     }
 }
 
-impl<C: CurveAffine> VerifyingKey<C>
-where
-    C::ScalarExt: FromUniformBytes<64>,
-{
+impl<C: CurveAffine> VerifyingKey<C> {
     fn bytes_length(&self) -> usize {
         8 + (self.fixed_commitments.len() * C::default().to_bytes().as_ref().len())
             + self.permutation.bytes_length()
@@ -182,8 +179,11 @@ where
         fixed_commitments: Vec<C>,
         permutation: permutation::VerifyingKey<C>,
         cs: ConstraintSystem<C::Scalar>,
-        //selectors: Vec<Vec<bool>>,
-    ) -> Self {
+        // selectors: Vec<Vec<bool>>,
+    ) -> Self
+    where
+        C::ScalarExt: FromUniformBytes<64>,
+    {
         // Compute cached values.
         let cs_degree = cs.degree();
 
@@ -251,6 +251,11 @@ where
     pub fn cs(&self) -> &ConstraintSystem<C::Scalar> {
         &self.cs
     }
+
+    /// Returns representative of this `VerifyingKey` in transcripts
+    pub fn transcript_repr(&self) -> C::Scalar {
+        self.transcript_repr
+    }
 }
 
 /// Minimal representation of a verification key that can be used to identify

From fe426ae44cd5e48266ed144af5ddc27450dcf288 Mon Sep 17 00:00:00 2001
From: kilic <onurkilic1004@gmail.com>
Date: Sun, 21 May 2023 19:17:27 +0300
Subject: [PATCH 19/30] implement native shuffle argument and api

fix: remove nonsense comment

strictly check shuffle rows

address doc typos

move compression into product commitment

typo

add shuffle errors for `verify_at_rows_par`

dedup expression evaluation

cargo fmt

fix fields in sanity-checks feature
---
 halo2_proofs/examples/shuffle_api.rs       | 216 +++++++++++++++++
 halo2_proofs/src/dev.rs                    | 259 +++++++++++++++------
 halo2_proofs/src/dev/failure.rs            | 208 +++++++++++++++++
 halo2_proofs/src/plonk.rs                  |   1 +
 halo2_proofs/src/plonk/circuit.rs          |  57 ++++-
 halo2_proofs/src/plonk/evaluation.rs       | 105 ++++++++-
 halo2_proofs/src/plonk/prover.rs           |  48 +++-
 halo2_proofs/src/plonk/shuffle.rs          |  67 ++++++
 halo2_proofs/src/plonk/shuffle/prover.rs   | 255 ++++++++++++++++++++
 halo2_proofs/src/plonk/shuffle/verifier.rs | 137 +++++++++++
 halo2_proofs/src/plonk/verifier.rs         | 175 +++++++++-----
 11 files changed, 1397 insertions(+), 131 deletions(-)
 create mode 100644 halo2_proofs/examples/shuffle_api.rs
 create mode 100644 halo2_proofs/src/plonk/shuffle.rs
 create mode 100644 halo2_proofs/src/plonk/shuffle/prover.rs
 create mode 100644 halo2_proofs/src/plonk/shuffle/verifier.rs

diff --git a/halo2_proofs/examples/shuffle_api.rs b/halo2_proofs/examples/shuffle_api.rs
new file mode 100644
index 0000000000..259e038d06
--- /dev/null
+++ b/halo2_proofs/examples/shuffle_api.rs
@@ -0,0 +1,216 @@
+use std::{marker::PhantomData, vec};
+
+use ff::FromUniformBytes;
+use halo2_proofs::{
+    arithmetic::Field,
+    circuit::{Layouter, SimpleFloorPlanner, Value},
+    plonk::{
+        create_proof, keygen_pk, keygen_vk, verify_proof, Advice, Circuit, Column,
+        ConstraintSystem, Error, Fixed, Selector,
+    },
+    poly::Rotation,
+    poly::{
+        commitment::ParamsProver,
+        ipa::{
+            commitment::{IPACommitmentScheme, ParamsIPA},
+            multiopen::{ProverIPA, VerifierIPA},
+            strategy::AccumulatorStrategy,
+        },
+        VerificationStrategy,
+    },
+    transcript::{
+        Blake2bRead, Blake2bWrite, Challenge255, TranscriptReadBuffer, TranscriptWriterBuffer,
+    },
+};
+use halo2curves::{pasta::EqAffine, CurveAffine};
+use rand_core::OsRng;
+
+struct ShuffleChip<F: Field> {
+    config: ShuffleConfig,
+    _marker: PhantomData<F>,
+}
+
+#[derive(Clone, Debug)]
+struct ShuffleConfig {
+    input_0: Column<Advice>,
+    input_1: Column<Fixed>,
+    shuffle_0: Column<Advice>,
+    shuffle_1: Column<Advice>,
+    s_input: Selector,
+    s_shuffle: Selector,
+}
+
+impl<F: Field> ShuffleChip<F> {
+    fn construct(config: ShuffleConfig) -> Self {
+        Self {
+            config,
+            _marker: PhantomData,
+        }
+    }
+
+    fn configure(
+        meta: &mut ConstraintSystem<F>,
+        input_0: Column<Advice>,
+        input_1: Column<Fixed>,
+        shuffle_0: Column<Advice>,
+        shuffle_1: Column<Advice>,
+    ) -> ShuffleConfig {
+        let s_shuffle = meta.complex_selector();
+        let s_input = meta.complex_selector();
+        meta.shuffle("shuffle", |meta| {
+            let s_input = meta.query_selector(s_input);
+            let s_shuffle = meta.query_selector(s_shuffle);
+            let input_0 = meta.query_advice(input_0, Rotation::cur());
+            let input_1 = meta.query_fixed(input_1, Rotation::cur());
+            let shuffle_0 = meta.query_advice(shuffle_0, Rotation::cur());
+            let shuffle_1 = meta.query_advice(shuffle_1, Rotation::cur());
+            vec![
+                (s_input.clone() * input_0, s_shuffle.clone() * shuffle_0),
+                (s_input * input_1, s_shuffle * shuffle_1),
+            ]
+        });
+        ShuffleConfig {
+            input_0,
+            input_1,
+            shuffle_0,
+            shuffle_1,
+            s_input,
+            s_shuffle,
+        }
+    }
+}
+
+#[derive(Default)]
+struct MyCircuit<F: Field> {
+    input_0: Vec<Value<F>>,
+    input_1: Vec<F>,
+    shuffle_0: Vec<Value<F>>,
+    shuffle_1: Vec<Value<F>>,
+}
+
+impl<F: Field> Circuit<F> for MyCircuit<F> {
+    // Since we are using a single chip for everything, we can just reuse its config.
+    type Config = ShuffleConfig;
+    type FloorPlanner = SimpleFloorPlanner;
+    #[cfg(feature = "circuit-params")]
+    type Params = ();
+
+    fn without_witnesses(&self) -> Self {
+        Self::default()
+    }
+
+    fn configure(meta: &mut ConstraintSystem<F>) -> Self::Config {
+        let input_0 = meta.advice_column();
+        let input_1 = meta.fixed_column();
+        let shuffle_0 = meta.advice_column();
+        let shuffle_1 = meta.advice_column();
+        ShuffleChip::configure(meta, input_0, input_1, shuffle_0, shuffle_1)
+    }
+
+    fn synthesize(
+        &self,
+        config: Self::Config,
+        mut layouter: impl Layouter<F>,
+    ) -> Result<(), Error> {
+        let ch = ShuffleChip::<F>::construct(config);
+        layouter.assign_region(
+            || "load inputs",
+            |mut region| {
+                for (i, (input_0, input_1)) in
+                    self.input_0.iter().zip(self.input_1.iter()).enumerate()
+                {
+                    region.assign_advice(|| "input_0", ch.config.input_0, i, || *input_0)?;
+                    region.assign_fixed(
+                        || "input_1",
+                        ch.config.input_1,
+                        i,
+                        || Value::known(*input_1),
+                    )?;
+                    ch.config.s_input.enable(&mut region, i)?;
+                }
+                Ok(())
+            },
+        )?;
+        layouter.assign_region(
+            || "load shuffles",
+            |mut region| {
+                for (i, (shuffle_0, shuffle_1)) in
+                    self.shuffle_0.iter().zip(self.shuffle_1.iter()).enumerate()
+                {
+                    region.assign_advice(|| "shuffle_0", ch.config.shuffle_0, i, || *shuffle_0)?;
+                    region.assign_advice(|| "shuffle_1", ch.config.shuffle_1, i, || *shuffle_1)?;
+                    ch.config.s_shuffle.enable(&mut region, i)?;
+                }
+                Ok(())
+            },
+        )?;
+        Ok(())
+    }
+}
+
+fn test_prover<C: CurveAffine>(k: u32, circuit: MyCircuit<C::Scalar>, expected: bool)
+where
+    C::Scalar: FromUniformBytes<64>,
+{
+    let params = ParamsIPA::<C>::new(k);
+    let vk = keygen_vk(&params, &circuit).unwrap();
+    let pk = keygen_pk(&params, vk, &circuit).unwrap();
+
+    let proof = {
+        let mut transcript = Blake2bWrite::<_, _, Challenge255<_>>::init(vec![]);
+
+        create_proof::<IPACommitmentScheme<C>, ProverIPA<C>, _, _, _, _>(
+            &params,
+            &pk,
+            &[circuit],
+            &[&[]],
+            OsRng,
+            &mut transcript,
+        )
+        .expect("proof generation should not fail");
+
+        transcript.finalize()
+    };
+
+    let accepted = {
+        let strategy = AccumulatorStrategy::new(&params);
+        let mut transcript = Blake2bRead::<_, _, Challenge255<_>>::init(&proof[..]);
+
+        verify_proof::<IPACommitmentScheme<C>, VerifierIPA<C>, _, _, _>(
+            &params,
+            pk.get_vk(),
+            strategy,
+            &[&[]],
+            &mut transcript,
+        )
+        .map(|strategy| strategy.finalize())
+        .unwrap_or_default()
+    };
+
+    assert_eq!(accepted, expected);
+}
+
+fn main() {
+    use halo2_proofs::dev::MockProver;
+    use halo2curves::pasta::Fp;
+    const K: u32 = 4;
+    let input_0 = [1, 2, 4, 1]
+        .map(|e: u64| Value::known(Fp::from(e)))
+        .to_vec();
+    let input_1 = [10, 20, 40, 10].map(Fp::from).to_vec();
+    let shuffle_0 = [4, 1, 1, 2]
+        .map(|e: u64| Value::known(Fp::from(e)))
+        .to_vec();
+    let shuffle_1 = [40, 10, 10, 20]
+        .map(|e: u64| Value::known(Fp::from(e)))
+        .to_vec();
+    let circuit = MyCircuit {
+        input_0,
+        input_1,
+        shuffle_0,
+        shuffle_1,
+    };
+    let prover = MockProver::run(K, &circuit, vec![]).unwrap();
+    prover.assert_satisfied();
+    test_prover::<EqAffine>(K, circuit, true);
+}
diff --git a/halo2_proofs/src/dev.rs b/halo2_proofs/src/dev.rs
index a34e180a2c..879ffa2b86 100644
--- a/halo2_proofs/src/dev.rs
+++ b/halo2_proofs/src/dev.rs
@@ -1,5 +1,6 @@
 //! Tools for developing circuits.
 
+use std::collections::BTreeMap;
 use std::collections::HashMap;
 use std::collections::HashSet;
 use std::fmt;
@@ -1293,6 +1294,42 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
                     })
                 });
 
+        let load = |expression: &Expression<F>, row| {
+            expression.evaluate_lazy(
+                &|scalar| Value::Real(scalar),
+                &|_| panic!("virtual selectors are removed during optimization"),
+                &|query| {
+                    let query = self.cs.fixed_queries[query.index.unwrap()];
+                    let column_index = query.0.index();
+                    let rotation = query.1 .0;
+                    self.fixed[column_index][(row as i32 + n + rotation) as usize % n as usize]
+                        .into()
+                },
+                &|query| {
+                    let query = self.cs.advice_queries[query.index.unwrap()];
+                    let column_index = query.0.index();
+                    let rotation = query.1 .0;
+                    self.advice[column_index][(row as i32 + n + rotation) as usize % n as usize]
+                        .into()
+                },
+                &|query| {
+                    let query = self.cs.instance_queries[query.index.unwrap()];
+                    let column_index = query.0.index();
+                    let rotation = query.1 .0;
+                    Value::Real(
+                        self.instance[column_index]
+                            [(row as i32 + n + rotation) as usize % n as usize],
+                    )
+                },
+                &|challenge| Value::Real(self.challenges[challenge.index()]),
+                &|a| -a,
+                &|a, b| a + b,
+                &|a, b| a * b,
+                &|a, scalar| a * scalar,
+                &Value::Real(F::ZERO),
+            )
+        };
+
         let mut cached_table = Vec::new();
         let mut cached_table_identifier = Vec::new();
         // Check that all lookups exist in their respective tables.
@@ -1302,44 +1339,6 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
                 .iter()
                 .enumerate()
                 .flat_map(|(lookup_index, lookup)| {
-                    let load = |expression: &Expression<F>, row| {
-                        expression.evaluate_lazy(
-                            &|scalar| Value::Real(scalar),
-                            &|_| panic!("virtual selectors are removed during optimization"),
-                            &|query| {
-                                let query = self.cs.fixed_queries[query.index.unwrap()];
-                                let column_index = query.0.index();
-                                let rotation = query.1 .0;
-                                self.fixed[column_index]
-                                    [(row as i32 + n + rotation) as usize % n as usize]
-                                    .into()
-                            },
-                            &|query| {
-                                let query = self.cs.advice_queries[query.index.unwrap()];
-                                let column_index = query.0.index();
-                                let rotation = query.1 .0;
-                                self.advice[column_index]
-                                    [(row as i32 + n + rotation) as usize % n as usize]
-                                    .into()
-                            },
-                            &|query| {
-                                let query = self.cs.instance_queries[query.index.unwrap()];
-                                let column_index = query.0.index();
-                                let rotation = query.1 .0;
-                                Value::Real(
-                                    self.instance[column_index]
-                                        [(row as i32 + n + rotation) as usize % n as usize],
-                                )
-                            },
-                            &|challenge| Value::Real(self.challenges[challenge.index()]),
-                            &|a| -a,
-                            &|a, b| a + b,
-                            &|a, b| a * b,
-                            &|a, scalar| a * scalar,
-                            &Value::Real(F::ZERO),
-                        )
-                    };
-
                     assert!(lookup.table_expressions.len() == lookup.input_expressions.len());
                     assert!(self.usable_rows.end > 0);
 
@@ -1432,6 +1431,68 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
                         })
                         .collect::<Vec<_>>()
                 });
+
+        let shuffle_errors =
+            self.cs
+                .shuffles
+                .iter()
+                .enumerate()
+                .flat_map(|(shuffle_index, shuffle)| {
+                    assert!(shuffle.shuffle_expressions.len() == shuffle.input_expressions.len());
+                    assert!(self.usable_rows.end > 0);
+
+                    let mut shuffle_rows: Vec<Vec<Value<F>>> = self
+                        .usable_rows
+                        .clone()
+                        .map(|row| {
+                            let t = shuffle
+                                .shuffle_expressions
+                                .iter()
+                                .map(move |c| load(c, row))
+                                .collect();
+                            t
+                        })
+                        .collect();
+                    shuffle_rows.sort();
+
+                    let mut input_rows: Vec<(Vec<Value<F>>, usize)> = self
+                        .usable_rows
+                        .clone()
+                        .into_iter()
+                        .map(|input_row| {
+                            let t = shuffle
+                                .input_expressions
+                                .iter()
+                                .map(move |c| load(c, input_row))
+                                .collect();
+
+                            (t, input_row)
+                        })
+                        .collect();
+                    input_rows.sort();
+
+                    input_rows
+                        .iter()
+                        .zip(shuffle_rows.iter())
+                        .filter_map(|((input_value, row), shuffle_value)| {
+                            if shuffle_value != input_value {
+                                Some(VerifyFailure::Shuffle {
+                                    name: shuffle.name.clone(),
+                                    shuffle_index,
+                                    location: FailureLocation::find_expressions(
+                                        &self.cs,
+                                        &self.regions,
+                                        *row,
+                                        shuffle.input_expressions.iter(),
+                                    ),
+                                })
+                            } else {
+                                None
+                            }
+                        })
+                        .collect::<Vec<_>>()
+                });
+
         let mapping = self
             .permutation
             .as_ref()
@@ -1486,6 +1547,7 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
             .chain(gate_errors)
             .chain(lookup_errors)
             .chain(perm_errors)
+            .chain(shuffle_errors)
             .collect();
         if errors.is_empty() {
             Ok(())
@@ -1682,6 +1744,35 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
                 .collect::<Vec<_>>()
             });
 
+        let load = |expression: &Expression<F>, row| {
+            expression.evaluate_lazy(
+                &|scalar| Value::Real(scalar),
+                &|_| panic!("virtual selectors are removed during optimization"),
+                &|query| {
+                    self.fixed[query.column_index]
+                        [(row as i32 + n + query.rotation.0) as usize % n as usize]
+                        .into()
+                },
+                &|query| {
+                    self.advice[query.column_index]
+                        [(row as i32 + n + query.rotation.0) as usize % n as usize]
+                        .into()
+                },
+                &|query| {
+                    Value::Real(
+                        self.instance[query.column_index]
+                            [(row as i32 + n + query.rotation.0) as usize % n as usize],
+                    )
+                },
+                &|challenge| Value::Real(self.challenges[challenge.index()]),
+                &|a| -a,
+                &|a, b| a + b,
+                &|a, b| a * b,
+                &|a, scalar| a * scalar,
+                &Value::Real(F::ZERO),
+            )
+        };
+
         let mut cached_table = Vec::new();
         let mut cached_table_identifier = Vec::new();
         // Check that all lookups exist in their respective tables.
@@ -1691,35 +1782,6 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
                 .iter()
                 .enumerate()
                 .flat_map(|(lookup_index, lookup)| {
-                    let load = |expression: &Expression<F>, row| {
-                        expression.evaluate_lazy(
-                            &|scalar| Value::Real(scalar),
-                            &|_| panic!("virtual selectors are removed during optimization"),
-                            &|query| {
-                                self.fixed[query.column_index]
-                                    [(row as i32 + n + query.rotation.0) as usize % n as usize]
-                                    .into()
-                            },
-                            &|query| {
-                                self.advice[query.column_index]
-                                    [(row as i32 + n + query.rotation.0) as usize % n as usize]
-                                    .into()
-                            },
-                            &|query| {
-                                Value::Real(
-                                    self.instance[query.column_index]
-                                        [(row as i32 + n + query.rotation.0) as usize % n as usize],
-                                )
-                            },
-                            &|challenge| Value::Real(self.challenges[challenge.index()]),
-                            &|a| -a,
-                            &|a, b| a + b,
-                            &|a, b| a * b,
-                            &|a, scalar| a * scalar,
-                            &Value::Real(F::ZERO),
-                        )
-                    };
-
                     assert!(lookup.table_expressions.len() == lookup.input_expressions.len());
                     assert!(self.usable_rows.end > 0);
 
@@ -1807,6 +1869,68 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
                         })
                         .collect::<Vec<_>>()
                 });
+
+        let shuffle_errors =
+            self.cs
+                .shuffles
+                .iter()
+                .enumerate()
+                .flat_map(|(shuffle_index, shuffle)| {
+                    assert!(shuffle.shuffle_expressions.len() == shuffle.input_expressions.len());
+                    assert!(self.usable_rows.end > 0);
+
+                    let mut shuffle_rows: Vec<Vec<Value<F>>> = self
+                        .usable_rows
+                        .clone()
+                        .map(|row| {
+                            let t = shuffle
+                                .shuffle_expressions
+                                .iter()
+                                .map(move |c| load(c, row))
+                                .collect();
+                            t
+                        })
+                        .collect();
+                    shuffle_rows.sort();
+
+                    let mut input_rows: Vec<(Vec<Value<F>>, usize)> = self
+                        .usable_rows
+                        .clone()
+                        .into_iter()
+                        .map(|input_row| {
+                            let t = shuffle
+                                .input_expressions
+                                .iter()
+                                .map(move |c| load(c, input_row))
+                                .collect();
+
+                            (t, input_row)
+                        })
+                        .collect();
+                    input_rows.sort();
+
+                    input_rows
+                        .iter()
+                        .zip(shuffle_rows.iter())
+                        .filter_map(|((input_value, row), shuffle_value)| {
+                            if shuffle_value != input_value {
+                                Some(VerifyFailure::Shuffle {
+                                    name: shuffle.name.clone(),
+                                    shuffle_index,
+                                    location: FailureLocation::find_expressions(
+                                        &self.cs,
+                                        &self.regions,
+                                        *row,
+                                        shuffle.input_expressions.iter(),
+                                    ),
+                                })
+                            } else {
+                                None
+                            }
+                        })
+                        .collect::<Vec<_>>()
+                });
+
         let mapping = self
             .permutation
             .as_ref()
@@ -1861,6 +1985,7 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
             .chain(gate_errors)
             .chain(lookup_errors)
             .chain(perm_errors)
+            .chain(shuffle_errors)
             .collect();
         if errors.is_empty() {
             Ok(())
diff --git a/halo2_proofs/src/dev/failure.rs b/halo2_proofs/src/dev/failure.rs
index 6f2446988d..81ce998172 100644
--- a/halo2_proofs/src/dev/failure.rs
+++ b/halo2_proofs/src/dev/failure.rs
@@ -178,6 +178,28 @@ pub enum VerifyFailure {
         ///   lookup is active on a row adjacent to an unrelated region.
         location: FailureLocation,
     },
+    /// A shuffle input did not exist in its corresponding map.
+    Shuffle {
+        /// The name of the lookup that is not satisfied.
+        name: String,
+        /// The index of the lookup that is not satisfied. These indices are assigned in
+        /// the order in which `ConstraintSystem::lookup` is called during
+        /// `Circuit::configure`.
+        shuffle_index: usize,
+        /// The location at which the lookup is not satisfied.
+        ///
+        /// `FailureLocation::InRegion` is most common, and may be due to the intentional
+        /// use of a lookup (if its inputs are conditional on a complex selector), or an
+        /// unintentional lookup constraint that overlaps the region (indicating that the
+        /// lookup's inputs should be made conditional).
+        ///
+        /// `FailureLocation::OutsideRegion` is uncommon, and could mean that:
+        /// - The input expressions do not correctly constrain a default value that exists
+        ///   in the table when the lookup is not being used.
+        /// - The input expressions use a column queried at a non-zero `Rotation`, and the
+        ///   lookup is active on a row adjacent to an unrelated region.
+        location: FailureLocation,
+    },
     /// A permutation did not preserve the original value of a cell.
     Permutation {
         /// The column in which this permutation is not satisfied.
@@ -241,6 +263,17 @@ impl fmt::Display for VerifyFailure {
                     name, lookup_index, location
                 )
             }
+            Self::Shuffle {
+                name,
+                shuffle_index,
+                location,
+            } => {
+                write!(
+                    f,
+                    "Shuffle {}(index: {}) is not satisfied {}",
+                    name, shuffle_index, location
+                )
+            }
             Self::Permutation { column, location } => {
                 write!(
                     f,
@@ -621,6 +654,176 @@ fn render_lookup<F: Field>(
     }
 }
 
+fn render_shuffle<F: Field>(
+    prover: &MockProver<F>,
+    name: &str,
+    shuffle_index: usize,
+    location: &FailureLocation,
+) {
+    let n = prover.n as i32;
+    let cs = &prover.cs;
+    let shuffle = &cs.shuffles[shuffle_index];
+
+    // Get the absolute row on which the shuffle's inputs are being queried, so we can
+    // fetch the input values.
+    let row = match location {
+        FailureLocation::InRegion { region, offset } => {
+            prover.regions[region.index].rows.unwrap().0 + offset
+        }
+        FailureLocation::OutsideRegion { row } => *row,
+    } as i32;
+
+    let shuffle_columns = shuffle.shuffle_expressions.iter().map(|expr| {
+        expr.evaluate(
+            &|f| format! {"Const: {:#?}", f},
+            &|s| format! {"S{}", s.0},
+            &|query| {
+                format!(
+                    "{:?}",
+                    prover
+                        .cs
+                        .general_column_annotations
+                        .get(&metadata::Column::from((Any::Fixed, query.column_index)))
+                        .cloned()
+                        .unwrap_or_else(|| format!("F{}", query.column_index()))
+                )
+            },
+            &|query| {
+                format!(
+                    "{:?}",
+                    prover
+                        .cs
+                        .general_column_annotations
+                        .get(&metadata::Column::from((Any::advice(), query.column_index)))
+                        .cloned()
+                        .unwrap_or_else(|| format!("A{}", query.column_index()))
+                )
+            },
+            &|query| {
+                format!(
+                    "{:?}",
+                    prover
+                        .cs
+                        .general_column_annotations
+                        .get(&metadata::Column::from((Any::Instance, query.column_index)))
+                        .cloned()
+                        .unwrap_or_else(|| format!("I{}", query.column_index()))
+                )
+            },
+            &|challenge| format! {"C{}", challenge.index()},
+            &|query| format! {"-{}", query},
+            &|a, b| format! {"{} + {}", a,b},
+            &|a, b| format! {"{} * {}", a,b},
+            &|a, b| format! {"{} * {:?}", a, b},
+        )
+    });
+
+    fn cell_value<'a, F: Field, Q: Into<AnyQuery> + Copy>(
+        load: impl Fn(Q) -> Value<F> + 'a,
+    ) -> impl Fn(Q) -> BTreeMap<metadata::VirtualCell, String> + 'a {
+        move |query| {
+            let AnyQuery {
+                column_type,
+                column_index,
+                rotation,
+                ..
+            } = query.into();
+            Some((
+                ((column_type, column_index).into(), rotation.0).into(),
+                match load(query) {
+                    Value::Real(v) => util::format_value(v),
+                    Value::Poison => unreachable!(),
+                },
+            ))
+            .into_iter()
+            .collect()
+        }
+    }
+
+    eprintln!("error: input does not exist in shuffle");
+    eprint!("  (");
+    for i in 0..shuffle.input_expressions.len() {
+        eprint!("{}L{}", if i == 0 { "" } else { ", " }, i);
+    }
+    eprint!(") <-> (");
+    for (i, column) in shuffle_columns.enumerate() {
+        eprint!("{}{}", if i == 0 { "" } else { ", " }, column);
+    }
+    eprintln!(")");
+
+    eprintln!();
+    eprintln!("  Shuffle '{}' inputs:", name);
+    for (i, input) in shuffle.input_expressions.iter().enumerate() {
+        // Fetch the cell values (since we don't store them in VerifyFailure::Shuffle).
+        let cell_values = input.evaluate(
+            &|_| BTreeMap::default(),
+            &|_| panic!("virtual selectors are removed during optimization"),
+            &cell_value(&util::load_slice(n, row, &cs.fixed_queries, &prover.fixed)),
+            &cell_value(&util::load_slice(
+                n,
+                row,
+                &cs.advice_queries,
+                &prover.advice,
+            )),
+            &cell_value(&util::load_instance(
+                n,
+                row,
+                &cs.instance_queries,
+                &prover.instance,
+            )),
+            &|_| BTreeMap::default(),
+            &|a| a,
+            &|mut a, mut b| {
+                a.append(&mut b);
+                a
+            },
+            &|mut a, mut b| {
+                a.append(&mut b);
+                a
+            },
+            &|a, _| a,
+        );
+
+        // Collect the necessary rendering information:
+        // - The columns involved in this constraint.
+        // - How many cells are in each column.
+        // - The grid of cell values, indexed by rotation.
+        let mut columns = BTreeMap::<metadata::Column, usize>::default();
+        let mut layout = BTreeMap::<i32, BTreeMap<metadata::Column, _>>::default();
+        for (i, (cell, _)) in cell_values.iter().enumerate() {
+            *columns.entry(cell.column).or_default() += 1;
+            layout
+                .entry(cell.rotation)
+                .or_default()
+                .entry(cell.column)
+                .or_insert(format!("x{}", i));
+        }
+
+        if i != 0 {
+            eprintln!();
+        }
+        eprintln!(
+            "    Sh{} = {}",
+            i,
+            emitter::expression_to_string(input, &layout)
+        );
+        eprintln!("    ^");
+
+        emitter::render_cell_layout("    | ", location, &columns, &layout, |_, rotation| {
+            if rotation == 0 {
+                eprint!(" <--{{ Shuffle '{}' inputs queried here", name);
+            }
+        });
+
+        // Print the map from local variables to assigned values.
+        eprintln!("    |");
+        eprintln!("    | Assigned cell values:");
+        for (i, (_, value)) in cell_values.iter().enumerate() {
+            eprintln!("    |   x{} = {}", i, value);
+        }
+    }
+}
+
 impl VerifyFailure {
     /// Emits this failure in pretty-printed format to stderr.
     pub(super) fn emit<F: Field>(&self, prover: &MockProver<F>) {
@@ -651,6 +854,11 @@ impl VerifyFailure {
                 lookup_index,
                 location,
             } => render_lookup(prover, name, *lookup_index, location),
+            Self::Shuffle {
+                name,
+                shuffle_index,
+                location,
+            } => render_shuffle(prover, name, *shuffle_index, location),
             _ => eprintln!("{}", self),
         }
     }
diff --git a/halo2_proofs/src/plonk.rs b/halo2_proofs/src/plonk.rs
index 3d9167f0cd..b32d589596 100644
--- a/halo2_proofs/src/plonk.rs
+++ b/halo2_proofs/src/plonk.rs
@@ -28,6 +28,7 @@ mod evaluation;
 mod keygen;
 mod lookup;
 pub mod permutation;
+mod shuffle;
 mod vanishing;
 
 mod prover;
diff --git a/halo2_proofs/src/plonk/circuit.rs b/halo2_proofs/src/plonk/circuit.rs
index b589c9df09..144a53d956 100644
--- a/halo2_proofs/src/plonk/circuit.rs
+++ b/halo2_proofs/src/plonk/circuit.rs
@@ -1,4 +1,4 @@
-use super::{lookup, permutation, Assigned, Error};
+use super::{lookup, permutation, shuffle, Assigned, Error};
 use crate::circuit::layouter::SyncDeps;
 use crate::dev::metadata;
 use crate::{
@@ -1588,6 +1588,10 @@ pub struct ConstraintSystem<F: Field> {
     // input expressions and a sequence of table expressions involved in the lookup.
     pub lookups: Vec<lookup::Argument<F>>,
 
+    // Vector of shuffle arguments, where each corresponds to a sequence of
+    // input expressions and a sequence of shuffle expressions involved in the shuffle.
+    pub(crate) shuffles: Vec<shuffle::Argument<F>>,
+
     // List of indexes of Fixed columns which are associated to a circuit-general Column tied to their annotation.
     pub(crate) general_column_annotations: BTreeMap<metadata::Column, String>,
 
@@ -1614,6 +1618,7 @@ pub struct PinnedConstraintSystem<'a, F: Field> {
     fixed_queries: &'a Vec<(Column<Fixed>, Rotation)>,
     permutation: &'a permutation::Argument,
     lookups: &'a Vec<lookup::Argument<F>>,
+    shuffles: &'a Vec<shuffle::Argument<F>>,
     constants: &'a Vec<Column<Fixed>>,
     minimum_degree: &'a Option<usize>,
 }
@@ -1675,6 +1680,7 @@ impl<F: Field> Default for ConstraintSystem<F> {
             instance_queries: Vec::new(),
             permutation: permutation::Argument::new(),
             lookups: Vec::new(),
+            shuffles: Vec::new(),
             general_column_annotations: BTreeMap::new(),
             constants: vec![],
             minimum_degree: None,
@@ -1701,6 +1707,7 @@ impl<F: Field> ConstraintSystem<F> {
             instance_queries: &self.instance_queries,
             permutation: &self.permutation,
             lookups: &self.lookups,
+            shuffles: &self.shuffles,
             constants: &self.constants,
             minimum_degree: &self.minimum_degree,
         }
@@ -1781,6 +1788,29 @@ impl<F: Field> ConstraintSystem<F> {
         index
     }
 
+    /// Add a shuffle argument for some input expressions and table expressions.
+    pub fn shuffle<S: AsRef<str>>(
+        &mut self,
+        name: S,
+        shuffle_map: impl FnOnce(&mut VirtualCells<'_, F>) -> Vec<(Expression<F>, Expression<F>)>,
+    ) -> usize {
+        let mut cells = VirtualCells::new(self);
+        let shuffle_map = shuffle_map(&mut cells)
+            .into_iter()
+            .map(|(mut input, mut table)| {
+                input.query_cells(&mut cells);
+                table.query_cells(&mut cells);
+                (input, table)
+            })
+            .collect();
+        let index = self.shuffles.len();
+
+        self.shuffles
+            .push(shuffle::Argument::new(name.as_ref(), shuffle_map));
+
+        index
+    }
+
     fn query_fixed_index(&mut self, column: Column<Fixed>, at: Rotation) -> usize {
         // Return existing query, if it exists
         for (index, fixed_query) in self.fixed_queries.iter().enumerate() {
@@ -2042,6 +2072,15 @@ impl<F: Field> ConstraintSystem<F> {
             replace_selectors(expr, &selector_replacements, true);
         }
 
+        for expr in self.shuffles.iter_mut().flat_map(|shuffle| {
+            shuffle
+                .input_expressions
+                .iter_mut()
+                .chain(shuffle.shuffle_expressions.iter_mut())
+        }) {
+            replace_selectors(expr, &selector_replacements, true);
+        }
+
         (self, polys)
     }
 
@@ -2213,6 +2252,17 @@ impl<F: Field> ConstraintSystem<F> {
                 .unwrap_or(1),
         );
 
+        // The lookup argument also serves alongside the gates and must be accounted
+        // for.
+        degree = std::cmp::max(
+            degree,
+            self.shuffles
+                .iter()
+                .map(|l| l.required_degree())
+                .max()
+                .unwrap_or(1),
+        );
+
         // Account for each gate to ensure our quotient polynomial is the
         // correct degree and that our extended domain is the right size.
         degree = std::cmp::max(
@@ -2341,6 +2391,11 @@ impl<F: Field> ConstraintSystem<F> {
         &self.lookups
     }
 
+    /// Returns shuffle arguments
+    pub fn shuffles(&self) -> &Vec<shuffle::Argument<F>> {
+        &self.shuffles
+    }
+
     /// Returns constants
     pub fn constants(&self) -> &Vec<Column<Fixed>> {
         &self.constants
diff --git a/halo2_proofs/src/plonk/evaluation.rs b/halo2_proofs/src/plonk/evaluation.rs
index 2f08a43e01..d31f671003 100644
--- a/halo2_proofs/src/plonk/evaluation.rs
+++ b/halo2_proofs/src/plonk/evaluation.rs
@@ -26,7 +26,7 @@ use std::{
     ops::{Index, Mul, MulAssign},
 };
 
-use super::{ConstraintSystem, Expression};
+use super::{shuffle, ConstraintSystem, Expression};
 
 /// Return the index in the polynomial of size `isize` after rotation `rot`.
 fn get_rotation_idx(idx: usize, rot: i32, rot_scale: i32, isize: i32) -> usize {
@@ -186,6 +186,8 @@ pub struct Evaluator<C: CurveAffine> {
     pub custom_gates: GraphEvaluator<C>,
     ///  Lookups evalution
     pub lookups: Vec<GraphEvaluator<C>>,
+    ///  Shuffle evalution
+    pub shuffles: Vec<GraphEvaluator<C>>,
 }
 
 /// GraphEvaluator
@@ -273,6 +275,39 @@ impl<C: CurveAffine> Evaluator<C> {
             ev.lookups.push(graph);
         }
 
+        // Shuffles
+        for shuffle in cs.shuffles.iter() {
+            let evaluate_lc = |expressions: &Vec<Expression<_>>, graph: &mut GraphEvaluator<C>| {
+                let parts = expressions
+                    .iter()
+                    .map(|expr| graph.add_expression(expr))
+                    .collect();
+                graph.add_calculation(Calculation::Horner(
+                    ValueSource::Constant(0),
+                    parts,
+                    ValueSource::Theta(),
+                ))
+            };
+
+            let mut graph_input = GraphEvaluator::default();
+            let compressed_input_coset = evaluate_lc(&shuffle.input_expressions, &mut graph_input);
+            let _ = graph_input.add_calculation(Calculation::Add(
+                compressed_input_coset,
+                ValueSource::Gamma(),
+            ));
+
+            let mut graph_shuffle = GraphEvaluator::default();
+            let compressed_shuffle_coset =
+                evaluate_lc(&shuffle.shuffle_expressions, &mut graph_shuffle);
+            let _ = graph_shuffle.add_calculation(Calculation::Add(
+                compressed_shuffle_coset,
+                ValueSource::Gamma(),
+            ));
+
+            ev.shuffles.push(graph_input);
+            ev.shuffles.push(graph_shuffle);
+        }
+
         ev
     }
 
@@ -288,6 +323,7 @@ impl<C: CurveAffine> Evaluator<C> {
         gamma: C::ScalarExt,
         theta: C::ScalarExt,
         lookups: &[Vec<lookup::prover::Committed<C>>],
+        shuffles: &[Vec<shuffle::prover::Committed<C>>],
         permutations: &[permutation::prover::Committed<C>],
     ) -> Polynomial<C::ScalarExt, ExtendedLagrangeCoeff> {
         let domain = &pk.vk.domain;
@@ -344,10 +380,11 @@ impl<C: CurveAffine> Evaluator<C> {
 
                 // Core expression evaluations
                 let num_threads = multicore::current_num_threads();
-                for (((advice, instance), lookups), permutation) in advice
+                for ((((advice, instance), lookups), shuffles), permutation) in advice
                     .iter()
                     .zip(instance.iter())
                     .zip(lookups.iter())
+                    .zip(shuffles.iter())
                     .zip(permutations.iter())
                 {
                     // Custom gates
@@ -572,6 +609,70 @@ impl<C: CurveAffine> Evaluator<C> {
                             }
                         });
                     }
+
+                    // Shuffle constraints
+                    for (n, shuffle) in shuffles.iter().enumerate() {
+                        let product_coset =
+                            pk.vk.domain.coeff_to_extended(shuffle.product_poly.clone());
+
+                        // Shuffle constraints
+                        parallelize(&mut values, |values, start| {
+                            let input_evaluator = &self.shuffles[2 * n];
+                            let shuffle_evaluator = &self.shuffles[2 * n + 1];
+                            let mut eval_data_input = shuffle_evaluator.instance();
+                            let mut eval_data_shuffle = shuffle_evaluator.instance();
+                            for (i, value) in values.iter_mut().enumerate() {
+                                let idx = start + i;
+
+                                let input_value = input_evaluator.evaluate(
+                                    &mut eval_data_input,
+                                    fixed,
+                                    advice,
+                                    instance,
+                                    challenges,
+                                    &beta,
+                                    &gamma,
+                                    &theta,
+                                    &y,
+                                    &C::ScalarExt::ZERO,
+                                    idx,
+                                    rot_scale,
+                                    isize,
+                                );
+
+                                let shuffle_value = shuffle_evaluator.evaluate(
+                                    &mut eval_data_shuffle,
+                                    fixed,
+                                    advice,
+                                    instance,
+                                    challenges,
+                                    &beta,
+                                    &gamma,
+                                    &theta,
+                                    &y,
+                                    &C::ScalarExt::ZERO,
+                                    idx,
+                                    rot_scale,
+                                    isize,
+                                );
+
+                                let r_next = get_rotation_idx(idx, 1, rot_scale, isize);
+
+                                // l_0(X) * (1 - z(X)) = 0
+                                *value = *value * y + ((one - product_coset[idx]) * l0[idx]);
+                                // l_last(X) * (z(X)^2 - z(X)) = 0
+                                *value = *value * y
+                                    + ((product_coset[idx] * product_coset[idx]
+                                        - product_coset[idx])
+                                        * l_last[idx]);
+                                // (1 - (l_last(X) + l_blind(X))) * (z(\omega X) (s(X) + \gamma) - z(X) (a(X) + \gamma)) = 0
+                                *value = *value * y
+                                    + l_active_row[idx]
+                                        * (product_coset[r_next] * shuffle_value
+                                            - product_coset[idx] * input_value)
+                            }
+                        });
+                    }
                 }
                 current_extended_omega *= extended_omega;
                 values
diff --git a/halo2_proofs/src/plonk/prover.rs b/halo2_proofs/src/plonk/prover.rs
index 0b1f6f48f9..7ff5867138 100644
--- a/halo2_proofs/src/plonk/prover.rs
+++ b/halo2_proofs/src/plonk/prover.rs
@@ -16,8 +16,8 @@ use super::{
         Advice, Any, Assignment, Challenge, Circuit, Column, ConstraintSystem, FirstPhase, Fixed,
         FloorPlanner, Instance, Selector,
     },
-    lookup, permutation, vanishing, ChallengeBeta, ChallengeGamma, ChallengeTheta, ChallengeX,
-    ChallengeY, Error, Expression, ProvingKey,
+    lookup, permutation, shuffle, vanishing, ChallengeBeta, ChallengeGamma, ChallengeTheta,
+    ChallengeX, ChallengeY, Error, Expression, ProvingKey,
 };
 use crate::circuit::layouter::SyncDeps;
 use crate::{
@@ -589,6 +589,34 @@ where
         })
         .collect::<Result<Vec<_>, _>>()?;
 
+    let shuffles: Vec<Vec<shuffle::prover::Committed<Scheme::Curve>>> = instance
+        .iter()
+        .zip(advice.iter())
+        .map(|(instance, advice)| -> Result<Vec<_>, _> {
+            // Compress expressions for each shuffle
+            pk.vk
+                .cs
+                .shuffles
+                .iter()
+                .map(|shuffle| {
+                    shuffle.commit_product(
+                        pk,
+                        params,
+                        domain,
+                        theta,
+                        gamma,
+                        &advice.advice_polys,
+                        &pk.fixed_values,
+                        &instance.instance_values,
+                        &challenges,
+                        &mut rng,
+                        transcript,
+                    )
+                })
+                .collect::<Result<Vec<_>, _>>()
+        })
+        .collect::<Result<Vec<_>, _>>()?;
+
     // Commit to the vanishing argument's random polynomial for blinding h(x_3)
     let vanishing = vanishing::Argument::commit(params, domain, &mut rng, transcript)?;
 
@@ -631,6 +659,7 @@ where
         *gamma,
         *theta,
         &lookups,
+        &shuffles,
         &permutations,
     );
 
@@ -718,12 +747,24 @@ where
         })
         .collect::<Result<Vec<_>, _>>()?;
 
+    // Evaluate the shuffles, if any, at omega^i x.
+    let shuffles: Vec<Vec<shuffle::prover::Evaluated<Scheme::Curve>>> = shuffles
+        .into_iter()
+        .map(|shuffles| -> Result<Vec<_>, _> {
+            shuffles
+                .into_iter()
+                .map(|p| p.evaluate(pk, x, transcript))
+                .collect::<Result<Vec<_>, _>>()
+        })
+        .collect::<Result<Vec<_>, _>>()?;
+
     let instances = instance
         .iter()
         .zip(advice.iter())
         .zip(permutations.iter())
         .zip(lookups.iter())
-        .flat_map(|(((instance, advice), permutation), lookups)| {
+        .zip(shuffles.iter())
+        .flat_map(|((((instance, advice), permutation), lookups), shuffles)| {
             iter::empty()
                 .chain(
                     P::QUERY_INSTANCE
@@ -750,6 +791,7 @@ where
                 )
                 .chain(permutation.open(pk, x))
                 .chain(lookups.iter().flat_map(move |p| p.open(pk, x)).into_iter())
+                .chain(shuffles.iter().flat_map(move |p| p.open(pk, x)).into_iter())
         })
         .chain(
             pk.vk
diff --git a/halo2_proofs/src/plonk/shuffle.rs b/halo2_proofs/src/plonk/shuffle.rs
new file mode 100644
index 0000000000..2cb925a3c7
--- /dev/null
+++ b/halo2_proofs/src/plonk/shuffle.rs
@@ -0,0 +1,67 @@
+use super::circuit::Expression;
+use ff::Field;
+use std::fmt::{self, Debug};
+
+pub(crate) mod prover;
+pub(crate) mod verifier;
+
+#[derive(Clone, PartialEq, Eq)]
+pub struct Argument<F: Field> {
+    pub(crate) name: String,
+    pub(crate) input_expressions: Vec<Expression<F>>,
+    pub(crate) shuffle_expressions: Vec<Expression<F>>,
+}
+
+impl<F: Field> Debug for Argument<F> {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("Argument")
+            .field("input_expressions", &self.input_expressions)
+            .field("shuffle_expressions", &self.shuffle_expressions)
+            .finish()
+    }
+}
+
+impl<F: Field> Argument<F> {
+    /// Constructs a new shuffle argument.
+    ///
+    /// `shuffle` is a sequence of `(input, shuffle)` tuples.
+    pub fn new<S: AsRef<str>>(name: S, shuffle: Vec<(Expression<F>, Expression<F>)>) -> Self {
+        let (input_expressions, shuffle_expressions) = shuffle.into_iter().unzip();
+        Argument {
+            name: name.as_ref().to_string(),
+            input_expressions,
+            shuffle_expressions,
+        }
+    }
+
+    pub(crate) fn required_degree(&self) -> usize {
+        assert_eq!(self.input_expressions.len(), self.shuffle_expressions.len());
+
+        let mut input_degree = 1;
+        for expr in self.input_expressions.iter() {
+            input_degree = std::cmp::max(input_degree, expr.degree());
+        }
+        let mut shuffle_degree = 1;
+        for expr in self.shuffle_expressions.iter() {
+            shuffle_degree = std::cmp::max(shuffle_degree, expr.degree());
+        }
+
+        // (1 - (l_last + l_blind)) (z(\omega X) (s(X) + \gamma) - z(X) (a(X) + \gamma))
+        std::cmp::max(2 + shuffle_degree, 2 + input_degree)
+    }
+
+    /// Returns input of this argument
+    pub fn input_expressions(&self) -> &Vec<Expression<F>> {
+        &self.input_expressions
+    }
+
+    /// Returns table of this argument
+    pub fn shuffle_expressions(&self) -> &Vec<Expression<F>> {
+        &self.shuffle_expressions
+    }
+
+    /// Returns name of this argument
+    pub fn name(&self) -> &str {
+        &self.name
+    }
+}
diff --git a/halo2_proofs/src/plonk/shuffle/prover.rs b/halo2_proofs/src/plonk/shuffle/prover.rs
new file mode 100644
index 0000000000..ef3a459f22
--- /dev/null
+++ b/halo2_proofs/src/plonk/shuffle/prover.rs
@@ -0,0 +1,255 @@
+use super::super::{
+    circuit::Expression, ChallengeBeta, ChallengeGamma, ChallengeTheta, ChallengeX, Error,
+    ProvingKey,
+};
+use super::Argument;
+use crate::plonk::evaluation::evaluate;
+use crate::{
+    arithmetic::{eval_polynomial, parallelize, CurveAffine},
+    poly::{
+        commitment::{Blind, Params},
+        Coeff, EvaluationDomain, ExtendedLagrangeCoeff, LagrangeCoeff, Polynomial, ProverQuery,
+        Rotation,
+    },
+    transcript::{EncodedChallenge, TranscriptWrite},
+};
+use ff::WithSmallOrderMulGroup;
+use group::{
+    ff::{BatchInvert, Field},
+    Curve,
+};
+use rand_core::RngCore;
+use std::{any::TypeId, convert::TryInto, num::ParseIntError, ops::Index};
+use std::{
+    collections::BTreeMap,
+    iter,
+    ops::{Mul, MulAssign},
+};
+
+#[derive(Debug)]
+struct Compressed<C: CurveAffine> {
+    input_expression: Polynomial<C::Scalar, LagrangeCoeff>,
+    shuffle_expression: Polynomial<C::Scalar, LagrangeCoeff>,
+}
+
+#[derive(Debug)]
+pub(in crate::plonk) struct Committed<C: CurveAffine> {
+    pub(in crate::plonk) product_poly: Polynomial<C::Scalar, Coeff>,
+    product_blind: Blind<C::Scalar>,
+}
+
+pub(in crate::plonk) struct Evaluated<C: CurveAffine> {
+    constructed: Committed<C>,
+}
+
+impl<F: WithSmallOrderMulGroup<3>> Argument<F> {
+    /// Given a Shuffle with input expressions [A_0, A_1, ..., A_{m-1}] and table expressions
+    /// [S_0, S_1, ..., S_{m-1}], this method
+    /// - constructs A_compressed = \theta^{m-1} A_0 + theta^{m-2} A_1 + ... + \theta A_{m-2} + A_{m-1}
+    ///   and S_compressed = \theta^{m-1} S_0 + theta^{m-2} S_1 + ... + \theta S_{m-2} + S_{m-1},
+    fn compress<'a, 'params: 'a, C, P: Params<'params, C>>(
+        &self,
+        pk: &ProvingKey<C>,
+        params: &P,
+        domain: &EvaluationDomain<C::Scalar>,
+        theta: ChallengeTheta<C>,
+        advice_values: &'a [Polynomial<C::Scalar, LagrangeCoeff>],
+        fixed_values: &'a [Polynomial<C::Scalar, LagrangeCoeff>],
+        instance_values: &'a [Polynomial<C::Scalar, LagrangeCoeff>],
+        challenges: &'a [C::Scalar],
+    ) -> Compressed<C>
+    where
+        C: CurveAffine<ScalarExt = F>,
+        C::Curve: Mul<F, Output = C::Curve> + MulAssign<F>,
+    {
+        // Closure to get values of expressions and compress them
+        let compress_expressions = |expressions: &[Expression<C::Scalar>]| {
+            let compressed_expression = expressions
+                .iter()
+                .map(|expression| {
+                    pk.vk.domain.lagrange_from_vec(evaluate(
+                        expression,
+                        params.n() as usize,
+                        1,
+                        fixed_values,
+                        advice_values,
+                        instance_values,
+                        challenges,
+                    ))
+                })
+                .fold(domain.empty_lagrange(), |acc, expression| {
+                    acc * *theta + &expression
+                });
+            compressed_expression
+        };
+
+        // Get values of input expressions involved in the shuffle and compress them
+        let input_expression = compress_expressions(&self.input_expressions);
+
+        // Get values of table expressions involved in the shuffle and compress them
+        let shuffle_expression = compress_expressions(&self.shuffle_expressions);
+
+        Compressed {
+            input_expression,
+            shuffle_expression,
+        }
+    }
+
+    /// Given a Shuffle with input expressions and table expressions this method
+    /// constructs the grand product polynomial over the shuffle.
+    /// The grand product polynomial is used to populate the Product<C> struct.
+    /// The Product<C> struct is added to the Shuffle and finally returned by the method.
+    pub(in crate::plonk) fn commit_product<
+        'a,
+        'params: 'a,
+        C,
+        P: Params<'params, C>,
+        E: EncodedChallenge<C>,
+        R: RngCore,
+        T: TranscriptWrite<C, E>,
+    >(
+        &self,
+        pk: &ProvingKey<C>,
+        params: &P,
+        domain: &EvaluationDomain<C::Scalar>,
+        theta: ChallengeTheta<C>,
+        gamma: ChallengeGamma<C>,
+        advice_values: &'a [Polynomial<C::Scalar, LagrangeCoeff>],
+        fixed_values: &'a [Polynomial<C::Scalar, LagrangeCoeff>],
+        instance_values: &'a [Polynomial<C::Scalar, LagrangeCoeff>],
+        challenges: &'a [C::Scalar],
+        mut rng: R,
+        transcript: &mut T,
+    ) -> Result<Committed<C>, Error>
+    where
+        C: CurveAffine<ScalarExt = F>,
+        C::Curve: Mul<F, Output = C::Curve> + MulAssign<F>,
+    {
+        let compressed = self.compress(
+            pk,
+            params,
+            domain,
+            theta,
+            advice_values,
+            fixed_values,
+            instance_values,
+            challenges,
+        );
+
+        let blinding_factors = pk.vk.cs.blinding_factors();
+
+        let mut shuffle_product = vec![C::Scalar::ZERO; params.n() as usize];
+        parallelize(&mut shuffle_product, |shuffle_product, start| {
+            for (shuffle_product, shuffle_value) in shuffle_product
+                .iter_mut()
+                .zip(compressed.shuffle_expression[start..].iter())
+            {
+                *shuffle_product = *gamma + shuffle_value;
+            }
+        });
+
+        shuffle_product.iter_mut().batch_invert();
+
+        parallelize(&mut shuffle_product, |product, start| {
+            for (i, product) in product.iter_mut().enumerate() {
+                let i = i + start;
+                *product *= &(*gamma + compressed.input_expression[i]);
+            }
+        });
+
+        // Compute the evaluations of the shuffle product polynomial
+        // over our domain, starting with z[0] = 1
+        let z = iter::once(C::Scalar::ONE)
+            .chain(shuffle_product)
+            .scan(C::Scalar::ONE, |state, cur| {
+                *state *= &cur;
+                Some(*state)
+            })
+            // Take all rows including the "last" row which should
+            // be a boolean (and ideally 1, else soundness is broken)
+            .take(params.n() as usize - blinding_factors)
+            // Chain random blinding factors.
+            .chain((0..blinding_factors).map(|_| C::Scalar::random(&mut rng)))
+            .collect::<Vec<_>>();
+        assert_eq!(z.len(), params.n() as usize);
+        let z = pk.vk.domain.lagrange_from_vec(z);
+
+        #[cfg(feature = "sanity-checks")]
+        {
+            // While in Lagrange basis, check that product is correctly constructed
+            let u = (params.n() as usize) - (blinding_factors + 1);
+            assert_eq!(z[0], C::Scalar::ONE);
+            for i in 0..u {
+                let mut left = z[i + 1];
+                let input_value = &compressed.input_expression[i];
+                let shuffle_value = &compressed.shuffle_expression[i];
+                left *= &(*gamma + shuffle_value);
+                let mut right = z[i];
+                right *= &(*gamma + input_value);
+                assert_eq!(left, right);
+            }
+            assert_eq!(z[u], C::Scalar::ONE);
+        }
+
+        let product_blind = Blind(C::Scalar::random(rng));
+        let product_commitment = params.commit_lagrange(&z, product_blind).to_affine();
+        let z = pk.vk.domain.lagrange_to_coeff(z);
+
+        // Hash product commitment
+        transcript.write_point(product_commitment)?;
+
+        Ok(Committed::<C> {
+            product_poly: z,
+            product_blind,
+        })
+    }
+}
+
+impl<C: CurveAffine> Committed<C> {
+    pub(in crate::plonk) fn evaluate<E: EncodedChallenge<C>, T: TranscriptWrite<C, E>>(
+        self,
+        pk: &ProvingKey<C>,
+        x: ChallengeX<C>,
+        transcript: &mut T,
+    ) -> Result<Evaluated<C>, Error> {
+        let domain = &pk.vk.domain;
+        let x_next = domain.rotate_omega(*x, Rotation::next());
+
+        let product_eval = eval_polynomial(&self.product_poly, *x);
+        let product_next_eval = eval_polynomial(&self.product_poly, x_next);
+
+        // Hash each advice evaluation
+        for eval in iter::empty()
+            .chain(Some(product_eval))
+            .chain(Some(product_next_eval))
+        {
+            transcript.write_scalar(eval)?;
+        }
+
+        Ok(Evaluated { constructed: self })
+    }
+}
+
+impl<C: CurveAffine> Evaluated<C> {
+    pub(in crate::plonk) fn open<'a>(
+        &'a self,
+        pk: &'a ProvingKey<C>,
+        x: ChallengeX<C>,
+    ) -> impl Iterator<Item = ProverQuery<'a, C>> + Clone {
+        let x_next = pk.vk.domain.rotate_omega(*x, Rotation::next());
+
+        iter::empty()
+            // Open shuffle product commitments at x
+            .chain(Some(ProverQuery {
+                point: *x,
+                poly: &self.constructed.product_poly,
+                blind: self.constructed.product_blind,
+            }))
+            // Open shuffle product commitments at x_next
+            .chain(Some(ProverQuery {
+                point: x_next,
+                poly: &self.constructed.product_poly,
+                blind: self.constructed.product_blind,
+            }))
+    }
+}
diff --git a/halo2_proofs/src/plonk/shuffle/verifier.rs b/halo2_proofs/src/plonk/shuffle/verifier.rs
new file mode 100644
index 0000000000..b02febb694
--- /dev/null
+++ b/halo2_proofs/src/plonk/shuffle/verifier.rs
@@ -0,0 +1,137 @@
+use std::iter;
+
+use super::super::{circuit::Expression, ChallengeGamma, ChallengeTheta, ChallengeX};
+use super::Argument;
+use crate::{
+    arithmetic::CurveAffine,
+    plonk::{Error, VerifyingKey},
+    poly::{commitment::MSM, Rotation, VerifierQuery},
+    transcript::{EncodedChallenge, TranscriptRead},
+};
+use ff::Field;
+
+pub struct Committed<C: CurveAffine> {
+    product_commitment: C,
+}
+
+pub struct Evaluated<C: CurveAffine> {
+    committed: Committed<C>,
+    product_eval: C::Scalar,
+    product_next_eval: C::Scalar,
+}
+
+impl<F: Field> Argument<F> {
+    pub(in crate::plonk) fn read_product_commitment<
+        C: CurveAffine<ScalarExt = F>,
+        E: EncodedChallenge<C>,
+        T: TranscriptRead<C, E>,
+    >(
+        &self,
+        transcript: &mut T,
+    ) -> Result<Committed<C>, Error> {
+        let product_commitment = transcript.read_point()?;
+
+        Ok(Committed { product_commitment })
+    }
+}
+
+impl<C: CurveAffine> Committed<C> {
+    pub(crate) fn evaluate<E: EncodedChallenge<C>, T: TranscriptRead<C, E>>(
+        self,
+        transcript: &mut T,
+    ) -> Result<Evaluated<C>, Error> {
+        let product_eval = transcript.read_scalar()?;
+        let product_next_eval = transcript.read_scalar()?;
+
+        Ok(Evaluated {
+            committed: self,
+            product_eval,
+            product_next_eval,
+        })
+    }
+}
+
+impl<C: CurveAffine> Evaluated<C> {
+    pub(in crate::plonk) fn expressions<'a>(
+        &'a self,
+        l_0: C::Scalar,
+        l_last: C::Scalar,
+        l_blind: C::Scalar,
+        argument: &'a Argument<C::Scalar>,
+        theta: ChallengeTheta<C>,
+        gamma: ChallengeGamma<C>,
+        advice_evals: &[C::Scalar],
+        fixed_evals: &[C::Scalar],
+        instance_evals: &[C::Scalar],
+        challenges: &[C::Scalar],
+    ) -> impl Iterator<Item = C::Scalar> + 'a {
+        let active_rows = C::Scalar::ONE - (l_last + l_blind);
+
+        let product_expression = || {
+            // z(\omega X) (s(X) + \gamma) - z(X) (a(X) + \gamma)
+            let compress_expressions = |expressions: &[Expression<C::Scalar>]| {
+                expressions
+                    .iter()
+                    .map(|expression| {
+                        expression.evaluate(
+                            &|scalar| scalar,
+                            &|_| panic!("virtual selectors are removed during optimization"),
+                            &|query| fixed_evals[query.index.unwrap()],
+                            &|query| advice_evals[query.index.unwrap()],
+                            &|query| instance_evals[query.index.unwrap()],
+                            &|challenge| challenges[challenge.index()],
+                            &|a| -a,
+                            &|a, b| a + &b,
+                            &|a, b| a * &b,
+                            &|a, scalar| a * &scalar,
+                        )
+                    })
+                    .fold(C::Scalar::ZERO, |acc, eval| acc * &*theta + &eval)
+            };
+            // z(\omega X) (s(X) + \gamma)
+            let left = self.product_next_eval
+                * &(compress_expressions(&argument.shuffle_expressions) + &*gamma);
+            // z(X) (a(X) + \gamma)
+            let right =
+                self.product_eval * &(compress_expressions(&argument.input_expressions) + &*gamma);
+
+            (left - &right) * &active_rows
+        };
+
+        std::iter::empty()
+            .chain(
+                // l_0(X) * (1 - z'(X)) = 0
+                Some(l_0 * &(C::Scalar::ONE - &self.product_eval)),
+            )
+            .chain(
+                // l_last(X) * (z(X)^2 - z(X)) = 0
+                Some(l_last * &(self.product_eval.square() - &self.product_eval)),
+            )
+            .chain(
+                // (1 - (l_last(X) + l_blind(X))) * ( z(\omega X) (s(X) + \gamma) - z(X) (a(X) + \gamma))
+                Some(product_expression()),
+            )
+    }
+
+    pub(in crate::plonk) fn queries<'r, M: MSM<C> + 'r>(
+        &'r self,
+        vk: &'r VerifyingKey<C>,
+        x: ChallengeX<C>,
+    ) -> impl Iterator<Item = VerifierQuery<'r, C, M>> + Clone {
+        let x_next = vk.domain.rotate_omega(*x, Rotation::next());
+
+        iter::empty()
+            // Open shuffle product commitment at x
+            .chain(Some(VerifierQuery::new_commitment(
+                &self.committed.product_commitment,
+                *x,
+                self.product_eval,
+            )))
+            // Open shuffle product commitment at \omega x
+            .chain(Some(VerifierQuery::new_commitment(
+                &self.committed.product_commitment,
+                x_next,
+                self.product_next_eval,
+            )))
+    }
+}
diff --git a/halo2_proofs/src/plonk/verifier.rs b/halo2_proofs/src/plonk/verifier.rs
index 72ec7203fb..b92c3dbef6 100644
--- a/halo2_proofs/src/plonk/verifier.rs
+++ b/halo2_proofs/src/plonk/verifier.rs
@@ -160,6 +160,17 @@ where
         })
         .collect::<Result<Vec<_>, _>>()?;
 
+    let shuffles_committed = (0..num_proofs)
+        .map(|_| -> Result<Vec<_>, _> {
+            // Hash each shuffle product commitment
+            vk.cs
+                .shuffles
+                .iter()
+                .map(|argument| argument.read_product_commitment(transcript))
+                .collect::<Result<Vec<_>, _>>()
+        })
+        .collect::<Result<Vec<_>, _>>()?;
+
     let vanishing = vanishing::Argument::read_commitments_before_y(transcript)?;
 
     // Sample y challenge, which keeps the gates linearly independent.
@@ -242,6 +253,16 @@ where
         })
         .collect::<Result<Vec<_>, _>>()?;
 
+    let shuffles_evaluated = shuffles_committed
+        .into_iter()
+        .map(|shuffles| -> Result<Vec<_>, _> {
+            shuffles
+                .into_iter()
+                .map(|shuffle| shuffle.evaluate(transcript))
+                .collect::<Result<Vec<_>, _>>()
+        })
+        .collect::<Result<Vec<_>, _>>()?;
+
     // This check ensures the circuit is satisfied so long as the polynomial
     // commitments open to the correct values.
     let vanishing = {
@@ -265,63 +286,88 @@ where
             .zip(instance_evals.iter())
             .zip(permutations_evaluated.iter())
             .zip(lookups_evaluated.iter())
-            .flat_map(|(((advice_evals, instance_evals), permutation), lookups)| {
-                let challenges = &challenges;
-                let fixed_evals = &fixed_evals;
-                std::iter::empty()
-                    // Evaluate the circuit using the custom gates provided
-                    .chain(vk.cs.gates.iter().flat_map(move |gate| {
-                        gate.polynomials().iter().map(move |poly| {
-                            poly.evaluate(
-                                &|scalar| scalar,
-                                &|_| panic!("virtual selectors are removed during optimization"),
-                                &|query| fixed_evals[query.index.unwrap()],
-                                &|query| advice_evals[query.index.unwrap()],
-                                &|query| instance_evals[query.index.unwrap()],
-                                &|challenge| challenges[challenge.index()],
-                                &|a| -a,
-                                &|a, b| a + &b,
-                                &|a, b| a * &b,
-                                &|a, scalar| a * &scalar,
-                            )
-                        })
-                    }))
-                    .chain(permutation.expressions(
-                        vk,
-                        &vk.cs.permutation,
-                        &permutations_common,
-                        advice_evals,
-                        fixed_evals,
-                        instance_evals,
-                        l_0,
-                        l_last,
-                        l_blind,
-                        beta,
-                        gamma,
-                        x,
-                    ))
-                    .chain(
-                        lookups
-                            .iter()
-                            .zip(vk.cs.lookups.iter())
-                            .flat_map(move |(p, argument)| {
-                                p.expressions(
-                                    l_0,
-                                    l_last,
-                                    l_blind,
-                                    argument,
-                                    theta,
-                                    beta,
-                                    gamma,
-                                    advice_evals,
-                                    fixed_evals,
-                                    instance_evals,
-                                    challenges,
+            .zip(shuffles_evaluated.iter())
+            .flat_map(
+                |((((advice_evals, instance_evals), permutation), lookups), shuffles)| {
+                    let challenges = &challenges;
+                    let fixed_evals = &fixed_evals;
+                    std::iter::empty()
+                        // Evaluate the circuit using the custom gates provided
+                        .chain(vk.cs.gates.iter().flat_map(move |gate| {
+                            gate.polynomials().iter().map(move |poly| {
+                                poly.evaluate(
+                                    &|scalar| scalar,
+                                    &|_| {
+                                        panic!("virtual selectors are removed during optimization")
+                                    },
+                                    &|query| fixed_evals[query.index.unwrap()],
+                                    &|query| advice_evals[query.index.unwrap()],
+                                    &|query| instance_evals[query.index.unwrap()],
+                                    &|challenge| challenges[challenge.index()],
+                                    &|a| -a,
+                                    &|a, b| a + &b,
+                                    &|a, b| a * &b,
+                                    &|a, scalar| a * &scalar,
                                 )
                             })
-                            .into_iter(),
-                    )
-            });
+                        }))
+                        .chain(permutation.expressions(
+                            vk,
+                            &vk.cs.permutation,
+                            &permutations_common,
+                            advice_evals,
+                            fixed_evals,
+                            instance_evals,
+                            l_0,
+                            l_last,
+                            l_blind,
+                            beta,
+                            gamma,
+                            x,
+                        ))
+                        .chain(
+                            lookups
+                                .iter()
+                                .zip(vk.cs.lookups.iter())
+                                .flat_map(move |(p, argument)| {
+                                    p.expressions(
+                                        l_0,
+                                        l_last,
+                                        l_blind,
+                                        argument,
+                                        theta,
+                                        beta,
+                                        gamma,
+                                        advice_evals,
+                                        fixed_evals,
+                                        instance_evals,
+                                        challenges,
+                                    )
+                                })
+                                .into_iter(),
+                        )
+                        .chain(
+                            shuffles
+                                .iter()
+                                .zip(vk.cs.shuffles.iter())
+                                .flat_map(move |(p, argument)| {
+                                    p.expressions(
+                                        l_0,
+                                        l_last,
+                                        l_blind,
+                                        argument,
+                                        theta,
+                                        gamma,
+                                        advice_evals,
+                                        fixed_evals,
+                                        instance_evals,
+                                        challenges,
+                                    )
+                                })
+                                .into_iter(),
+                        )
+                },
+            );
 
         vanishing.verify(params, expressions, y, xn)
     };
@@ -333,13 +379,20 @@ where
         .zip(advice_evals.iter())
         .zip(permutations_evaluated.iter())
         .zip(lookups_evaluated.iter())
+        .zip(shuffles_evaluated.iter())
         .flat_map(
             |(
                 (
-                    (((instance_commitments, instance_evals), advice_commitments), advice_evals),
-                    permutation,
+                    (
+                        (
+                            ((instance_commitments, instance_evals), advice_commitments),
+                            advice_evals,
+                        ),
+                        permutation,
+                    ),
+                    lookups,
                 ),
-                lookups,
+                shuffles,
             )| {
                 iter::empty()
                     .chain(
@@ -372,6 +425,12 @@ where
                             .flat_map(move |p| p.queries(vk, x))
                             .into_iter(),
                     )
+                    .chain(
+                        shuffles
+                            .iter()
+                            .flat_map(move |p| p.queries(vk, x))
+                            .into_iter(),
+                    )
             },
         )
         .chain(

From b590427085cd25921e51b500f72d1bc8378ff76d Mon Sep 17 00:00:00 2001
From: dante <45801863+alexander-camuto@users.noreply.github.com>
Date: Fri, 25 Aug 2023 15:39:50 +0100
Subject: [PATCH 20/30] feat: public cells to allow for implementations of
 custom `Layouter`  (#192)

* feat: public cells

* Update mds.rs

* Update mds.rs

* Update single_pass.rs

Co-authored-by: Han <tinghan0110@gmail.com>

* bump toolchain to resolve errors

* fix clippy errors for CI run

* rustfmt post clippy

* plz let it be the last lint

* patch clippy lints in gadgets

* clippy lints for sha256 bench

* patch halo2proof benches

* Update assigned.rs

* Update halo2_gadgets/src/poseidon/primitives/mds.rs

Co-authored-by: Han <tinghan0110@gmail.com>

* Update halo2_gadgets/src/poseidon/primitives/mds.rs

Co-authored-by: Han <tinghan0110@gmail.com>

---------

Co-authored-by: Han <tinghan0110@gmail.com>
---
 halo2_gadgets/benches/poseidon.rs             |  2 +-
 halo2_gadgets/benches/sha256.rs               | 12 +--
 halo2_gadgets/src/ecc/chip/constants.rs       | 12 +--
 halo2_gadgets/src/ecc/chip/mul_fixed.rs       |  8 +-
 halo2_gadgets/src/poseidon/pow5.rs            |  6 +-
 .../src/poseidon/primitives/p128pow5t3.rs     |  4 +-
 halo2_proofs/benches/commit_zk.rs             | 64 +++++++++++++
 halo2_proofs/src/circuit.rs                   |  1 +
 .../src/circuit/floor_planner/single_pass.rs  | 10 +-
 halo2_proofs/src/circuit/floor_planner/v1.rs  |  4 +-
 halo2_proofs/src/dev.rs                       |  9 +-
 halo2_proofs/src/plonk/assigned.rs            |  2 +-
 halo2_proofs/src/plonk/circuit.rs             |  3 +-
 halo2_proofs/src/plonk/evaluation.rs          |  4 +-
 halo2_proofs/src/plonk/lookup/prover.rs       |  2 +-
 halo2_proofs/src/plonk/permutation/keygen.rs  |  8 +-
 .../src/plonk/permutation/verifier.rs         |  2 +-
 halo2_proofs/src/plonk/prover.rs              |  6 +-
 halo2_proofs/src/plonk/verifier.rs            | 92 ++++++++-----------
 halo2_proofs/src/poly/domain.rs               |  8 +-
 halo2_proofs/src/poly/kzg/commitment.rs       |  2 +-
 halo2_proofs/src/transcript.rs                | 20 ++--
 rust-toolchain                                |  2 +-
 23 files changed, 163 insertions(+), 120 deletions(-)
 create mode 100644 halo2_proofs/benches/commit_zk.rs

diff --git a/halo2_gadgets/benches/poseidon.rs b/halo2_gadgets/benches/poseidon.rs
index 03e595fe0f..4175318399 100644
--- a/halo2_gadgets/benches/poseidon.rs
+++ b/halo2_gadgets/benches/poseidon.rs
@@ -135,7 +135,7 @@ impl<const WIDTH: usize, const RATE: usize> Spec<Fp, WIDTH, RATE> for MySpec<WID
     }
 
     fn sbox(val: Fp) -> Fp {
-        val.pow_vartime(&[5])
+        val.pow_vartime([5])
     }
 
     fn secure_mds() -> usize {
diff --git a/halo2_gadgets/benches/sha256.rs b/halo2_gadgets/benches/sha256.rs
index 0e14d61946..4afceacd82 100644
--- a/halo2_gadgets/benches/sha256.rs
+++ b/halo2_gadgets/benches/sha256.rs
@@ -90,18 +90,18 @@ fn bench(name: &str, k: u32, c: &mut Criterion) {
 
     // Initialize the polynomial commitment parameters
     let params_path = Path::new("./benches/sha256_assets/sha256_params");
-    if File::open(&params_path).is_err() {
+    if File::open(params_path).is_err() {
         let params: ParamsIPA<EqAffine> = ParamsIPA::new(k);
         let mut buf = Vec::new();
 
         params.write(&mut buf).expect("Failed to write params");
-        let mut file = File::create(&params_path).expect("Failed to create sha256_params");
+        let mut file = File::create(params_path).expect("Failed to create sha256_params");
 
         file.write_all(&buf[..])
             .expect("Failed to write params to file");
     }
 
-    let params_fs = File::open(&params_path).expect("couldn't load sha256_params");
+    let params_fs = File::open(params_path).expect("couldn't load sha256_params");
     let params: ParamsIPA<EqAffine> =
         ParamsIPA::read::<_>(&mut BufReader::new(params_fs)).expect("Failed to read params");
 
@@ -128,7 +128,7 @@ fn bench(name: &str, k: u32, c: &mut Criterion) {
 
     // Create a proof
     let proof_path = Path::new("./benches/sha256_assets/sha256_proof");
-    if File::open(&proof_path).is_err() {
+    if File::open(proof_path).is_err() {
         let mut transcript = Blake2bWrite::<_, _, Challenge255<_>>::init(vec![]);
         create_proof::<IPACommitmentScheme<_>, ProverIPA<_>, _, _, _, _>(
             &params,
@@ -140,11 +140,11 @@ fn bench(name: &str, k: u32, c: &mut Criterion) {
         )
         .expect("proof generation should not fail");
         let proof: Vec<u8> = transcript.finalize();
-        let mut file = File::create(&proof_path).expect("Failed to create sha256_proof");
+        let mut file = File::create(proof_path).expect("Failed to create sha256_proof");
         file.write_all(&proof[..]).expect("Failed to write proof");
     }
 
-    let mut proof_fs = File::open(&proof_path).expect("couldn't load sha256_proof");
+    let mut proof_fs = File::open(proof_path).expect("couldn't load sha256_proof");
     let mut proof = Vec::<u8>::new();
     proof_fs
         .read_to_end(&mut proof)
diff --git a/halo2_gadgets/src/ecc/chip/constants.rs b/halo2_gadgets/src/ecc/chip/constants.rs
index 6296165464..82ed952ceb 100644
--- a/halo2_gadgets/src/ecc/chip/constants.rs
+++ b/halo2_gadgets/src/ecc/chip/constants.rs
@@ -49,7 +49,7 @@ fn compute_window_table<C: CurveAffine>(base: C, num_windows: usize) -> Vec<[C;
                 .map(|k| {
                     // scalar = (k+2)*(8^w)
                     let scalar = C::Scalar::from(k as u64 + 2)
-                        * C::Scalar::from(H as u64).pow(&[w as u64, 0, 0, 0]);
+                        * C::Scalar::from(H as u64).pow([w as u64, 0, 0, 0]);
                     (base * scalar).to_affine()
                 })
                 .collect::<ArrayVec<C, H>>()
@@ -62,14 +62,14 @@ fn compute_window_table<C: CurveAffine>(base: C, num_windows: usize) -> Vec<[C;
     // For the last window, we compute [k * (2^3)^w - sum]B, where sum is defined
     // as sum = \sum_{j = 0}^{`num_windows - 2`} 2^{3j+1}
     let sum = (0..(num_windows - 1)).fold(C::Scalar::ZERO, |acc, j| {
-        acc + C::Scalar::from(2).pow(&[FIXED_BASE_WINDOW_SIZE as u64 * j as u64 + 1, 0, 0, 0])
+        acc + C::Scalar::from(2).pow([FIXED_BASE_WINDOW_SIZE as u64 * j as u64 + 1, 0, 0, 0])
     });
     window_table.push(
         (0..H)
             .map(|k| {
                 // scalar = k * (2^3)^w - sum, where w = `num_windows - 1`
                 let scalar = C::Scalar::from(k as u64)
-                    * C::Scalar::from(H as u64).pow(&[(num_windows - 1) as u64, 0, 0, 0])
+                    * C::Scalar::from(H as u64).pow([(num_windows - 1) as u64, 0, 0, 0])
                     - sum;
                 (base * scalar).to_affine()
             })
@@ -197,7 +197,7 @@ pub fn test_lagrange_coeffs<C: CurveAffine>(base: C, num_windows: usize) {
                 // Compute the actual x-coordinate of the multiple [(k+2)*(8^w)]B.
                 let point = base
                     * C::Scalar::from(bits as u64 + 2)
-                    * C::Scalar::from(H as u64).pow(&[idx as u64, 0, 0, 0]);
+                    * C::Scalar::from(H as u64).pow([idx as u64, 0, 0, 0]);
                 let x = *point.to_affine().coordinates().unwrap().x();
 
                 // Check that the interpolated x-coordinate matches the actual one.
@@ -214,10 +214,10 @@ pub fn test_lagrange_coeffs<C: CurveAffine>(base: C, num_windows: usize) {
         // Compute the actual x-coordinate of the multiple [k * (8^84) - offset]B,
         // where offset = \sum_{j = 0}^{83} 2^{3j+1}
         let offset = (0..(num_windows - 1)).fold(C::Scalar::ZERO, |acc, w| {
-            acc + C::Scalar::from(2).pow(&[FIXED_BASE_WINDOW_SIZE as u64 * w as u64 + 1, 0, 0, 0])
+            acc + C::Scalar::from(2).pow([FIXED_BASE_WINDOW_SIZE as u64 * w as u64 + 1, 0, 0, 0])
         });
         let scalar = C::Scalar::from(bits as u64)
-            * C::Scalar::from(H as u64).pow(&[(num_windows - 1) as u64, 0, 0, 0])
+            * C::Scalar::from(H as u64).pow([(num_windows - 1) as u64, 0, 0, 0])
             - offset;
         let point = base * scalar;
         let x = *point.to_affine().coordinates().unwrap().x();
diff --git a/halo2_gadgets/src/ecc/chip/mul_fixed.rs b/halo2_gadgets/src/ecc/chip/mul_fixed.rs
index 0005a108bb..b22f2b66e7 100644
--- a/halo2_gadgets/src/ecc/chip/mul_fixed.rs
+++ b/halo2_gadgets/src/ecc/chip/mul_fixed.rs
@@ -372,7 +372,7 @@ impl<FixedPoints: super::FixedPoints<pallas::Affine>> Config<FixedPoints> {
         base: &F,
     ) -> Result<NonIdentityEccPoint, Error> {
         // `scalar = [(k_w + 2) ⋅ 8^w]
-        let scalar = k.map(|k| (k + *TWO_SCALAR) * (*H_SCALAR).pow(&[w as u64, 0, 0, 0]));
+        let scalar = k.map(|k| (k + *TWO_SCALAR) * (*H_SCALAR).pow([w as u64, 0, 0, 0]));
 
         self.process_window::<_, NUM_WINDOWS>(region, offset, w, k_usize, scalar, base)
     }
@@ -389,12 +389,12 @@ impl<FixedPoints: super::FixedPoints<pallas::Affine>> Config<FixedPoints> {
 
         // offset_acc = \sum_{j = 0}^{NUM_WINDOWS - 2} 2^{FIXED_BASE_WINDOW_SIZE*j + 1}
         let offset_acc = (0..(NUM_WINDOWS - 1)).fold(pallas::Scalar::zero(), |acc, w| {
-            acc + (*TWO_SCALAR).pow(&[FIXED_BASE_WINDOW_SIZE as u64 * w as u64 + 1, 0, 0, 0])
+            acc + (*TWO_SCALAR).pow([FIXED_BASE_WINDOW_SIZE as u64 * w as u64 + 1, 0, 0, 0])
         });
 
         // `scalar = [k * 8^(NUM_WINDOWS - 1) - offset_acc]`.
         let scalar = scalar.windows_field()[scalar.windows_field().len() - 1]
-            .map(|k| k * (*H_SCALAR).pow(&[(NUM_WINDOWS - 1) as u64, 0, 0, 0]) - offset_acc);
+            .map(|k| k * (*H_SCALAR).pow([(NUM_WINDOWS - 1) as u64, 0, 0, 0]) - offset_acc);
 
         self.process_window::<_, NUM_WINDOWS>(
             region,
@@ -490,7 +490,7 @@ impl ScalarFixed {
                         .by_vals()
                         .take(FIXED_BASE_WINDOW_SIZE)
                         .rev()
-                        .fold(0, |acc, b| 2 * acc + if b { 1 } else { 0 })
+                        .fold(0, |acc, b| 2 * acc + usize::from(b))
                 })
             })
             .collect::<Vec<_>>()
diff --git a/halo2_gadgets/src/poseidon/pow5.rs b/halo2_gadgets/src/poseidon/pow5.rs
index 7abd86329d..e8ea7abf69 100644
--- a/halo2_gadgets/src/poseidon/pow5.rs
+++ b/halo2_gadgets/src/poseidon/pow5.rs
@@ -444,7 +444,7 @@ impl<F: Field, const WIDTH: usize> Pow5State<F, WIDTH> {
                     .value()
                     .map(|v| *v + config.round_constants[round][idx])
             });
-            let r: Value<Vec<F>> = q.map(|q| q.map(|q| q.pow(&config.alpha))).collect();
+            let r: Value<Vec<F>> = q.map(|q| q.map(|q| q.pow(config.alpha))).collect();
             let m = &config.m_reg;
             let state = m.iter().map(|m_i| {
                 r.as_ref().map(|r| {
@@ -470,7 +470,7 @@ impl<F: Field, const WIDTH: usize> Pow5State<F, WIDTH> {
             let p: Value<Vec<_>> = self.0.iter().map(|word| word.0.value().cloned()).collect();
 
             let r: Value<Vec<_>> = p.map(|p| {
-                let r_0 = (p[0] + config.round_constants[round][0]).pow(&config.alpha);
+                let r_0 = (p[0] + config.round_constants[round][0]).pow(config.alpha);
                 let r_i = p[1..]
                     .iter()
                     .enumerate()
@@ -510,7 +510,7 @@ impl<F: Field, const WIDTH: usize> Pow5State<F, WIDTH> {
             }
 
             let r_mid: Value<Vec<_>> = p_mid.map(|p| {
-                let r_0 = (p[0] + config.round_constants[round + 1][0]).pow(&config.alpha);
+                let r_0 = (p[0] + config.round_constants[round + 1][0]).pow(config.alpha);
                 let r_i = p[1..]
                     .iter()
                     .enumerate()
diff --git a/halo2_gadgets/src/poseidon/primitives/p128pow5t3.rs b/halo2_gadgets/src/poseidon/primitives/p128pow5t3.rs
index c8d54d9afd..e31ce04263 100644
--- a/halo2_gadgets/src/poseidon/primitives/p128pow5t3.rs
+++ b/halo2_gadgets/src/poseidon/primitives/p128pow5t3.rs
@@ -22,7 +22,7 @@ impl Spec<Fp, 3, 2> for P128Pow5T3 {
     }
 
     fn sbox(val: Fp) -> Fp {
-        val.pow_vartime(&[5])
+        val.pow_vartime([5])
     }
 
     fn secure_mds() -> usize {
@@ -48,7 +48,7 @@ impl Spec<Fq, 3, 2> for P128Pow5T3 {
     }
 
     fn sbox(val: Fq) -> Fq {
-        val.pow_vartime(&[5])
+        val.pow_vartime([5])
     }
 
     fn secure_mds() -> usize {
diff --git a/halo2_proofs/benches/commit_zk.rs b/halo2_proofs/benches/commit_zk.rs
new file mode 100644
index 0000000000..3496dbd4be
--- /dev/null
+++ b/halo2_proofs/benches/commit_zk.rs
@@ -0,0 +1,64 @@
+extern crate criterion;
+
+use criterion::{criterion_group, criterion_main, BenchmarkId, Criterion};
+use group::ff::Field;
+use halo2_proofs::*;
+use halo2curves::pasta::pallas::Scalar;
+use rand_chacha::rand_core::RngCore;
+use rand_chacha::ChaCha20Rng;
+use rand_core::SeedableRng;
+use rayon::{current_num_threads, prelude::*};
+
+fn rand_poly_serial(mut rng: ChaCha20Rng, domain: usize) -> Vec<Scalar> {
+    // Sample a random polynomial of degree n - 1
+    let mut random_poly = vec![Scalar::zero(); 1 << domain];
+    for coeff in random_poly.iter_mut() {
+        *coeff = Scalar::random(&mut rng);
+    }
+
+    random_poly
+}
+
+fn rand_poly_par(mut rng: ChaCha20Rng, domain: usize) -> Vec<Scalar> {
+    // Sample a random polynomial of degree n - 1
+    let n_threads = current_num_threads();
+    let n = 1usize << domain;
+    let n_chunks = n_threads + usize::from(n % n_threads != 0);
+    let mut rand_vec = vec![Scalar::zero(); n];
+
+    let mut thread_seeds: Vec<ChaCha20Rng> = (0..n_chunks)
+        .map(|_| {
+            let mut seed = [0u8; 32];
+            rng.fill_bytes(&mut seed);
+            ChaCha20Rng::from_seed(seed)
+        })
+        .collect();
+
+    thread_seeds
+        .par_iter_mut()
+        .zip_eq(rand_vec.par_chunks_mut(n / n_threads))
+        .for_each(|(mut rng, chunk)| chunk.iter_mut().for_each(|v| *v = Scalar::random(&mut rng)));
+
+    rand_vec
+}
+
+fn bench_commit(c: &mut Criterion) {
+    let mut group = c.benchmark_group("Blinder_poly");
+    let rand = ChaCha20Rng::from_seed([1u8; 32]);
+    for i in [
+        18usize, 19usize, 20usize, 21usize, 22usize, 23usize, 24usize, 25usize,
+    ]
+    .iter()
+    {
+        group.bench_with_input(BenchmarkId::new("serial", i), i, |b, i| {
+            b.iter(|| rand_poly_serial(rand.clone(), *i))
+        });
+        group.bench_with_input(BenchmarkId::new("parallel", i), i, |b, i| {
+            b.iter(|| rand_poly_par(rand.clone(), *i))
+        });
+    }
+    group.finish();
+}
+
+criterion_group!(benches, bench_commit);
+criterion_main!(benches);
diff --git a/halo2_proofs/src/circuit.rs b/halo2_proofs/src/circuit.rs
index 508820f029..969e27d24c 100644
--- a/halo2_proofs/src/circuit.rs
+++ b/halo2_proofs/src/circuit.rs
@@ -14,6 +14,7 @@ pub use value::Value;
 
 pub mod floor_planner;
 pub use floor_planner::single_pass::SimpleFloorPlanner;
+pub use floor_planner::single_pass::SimpleTableLayouter;
 
 pub mod layouter;
 
diff --git a/halo2_proofs/src/circuit/floor_planner/single_pass.rs b/halo2_proofs/src/circuit/floor_planner/single_pass.rs
index 96242b0b34..25b498470c 100644
--- a/halo2_proofs/src/circuit/floor_planner/single_pass.rs
+++ b/halo2_proofs/src/circuit/floor_planner/single_pass.rs
@@ -600,11 +600,12 @@ impl<'r, 'a, F: Field, CS: Assignment<F> + 'a + SyncDeps> RegionLayouter<F>
 ///   witnesses or not.
 type DefaultTableValue<F> = Option<Value<Assigned<F>>>;
 
-pub(crate) struct SimpleTableLayouter<'r, 'a, F: Field, CS: Assignment<F> + 'a> {
+/// A table layouter that can be used to assign values to a table.
+pub struct SimpleTableLayouter<'r, 'a, F: Field, CS: Assignment<F> + 'a> {
     cs: &'a mut CS,
     used_columns: &'r [TableColumn],
-    // maps from a fixed column to a pair (default value, vector saying which rows are assigned)
-    pub(crate) default_and_assigned: HashMap<TableColumn, (DefaultTableValue<F>, Vec<bool>)>,
+    /// maps from a fixed column to a pair (default value, vector saying which rows are assigned)
+    pub default_and_assigned: HashMap<TableColumn, (DefaultTableValue<F>, Vec<bool>)>,
 }
 
 impl<'r, 'a, F: Field, CS: Assignment<F> + 'a> fmt::Debug for SimpleTableLayouter<'r, 'a, F, CS> {
@@ -617,7 +618,8 @@ impl<'r, 'a, F: Field, CS: Assignment<F> + 'a> fmt::Debug for SimpleTableLayoute
 }
 
 impl<'r, 'a, F: Field, CS: Assignment<F> + 'a> SimpleTableLayouter<'r, 'a, F, CS> {
-    pub(crate) fn new(cs: &'a mut CS, used_columns: &'r [TableColumn]) -> Self {
+    /// Returns a new SimpleTableLayouter
+    pub fn new(cs: &'a mut CS, used_columns: &'r [TableColumn]) -> Self {
         SimpleTableLayouter {
             cs,
             used_columns,
diff --git a/halo2_proofs/src/circuit/floor_planner/v1.rs b/halo2_proofs/src/circuit/floor_planner/v1.rs
index 27beaafa47..5cff85f5ba 100644
--- a/halo2_proofs/src/circuit/floor_planner/v1.rs
+++ b/halo2_proofs/src/circuit/floor_planner/v1.rs
@@ -90,8 +90,8 @@ impl FloorPlanner for V1 {
 
         // - Determine how many rows our planned circuit will require.
         let first_unassigned_row = column_allocations
-            .iter()
-            .map(|(_, a)| a.unbounded_interval_start())
+            .values()
+            .map(|a| a.unbounded_interval_start())
             .max()
             .unwrap_or(0);
 
diff --git a/halo2_proofs/src/dev.rs b/halo2_proofs/src/dev.rs
index 879ffa2b86..c2b65cf8f8 100644
--- a/halo2_proofs/src/dev.rs
+++ b/halo2_proofs/src/dev.rs
@@ -1219,11 +1219,7 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
                 .flat_map(|(gate_index, gate)| {
                     let blinding_rows =
                         (self.n as usize - (self.cs.blinding_factors() + 1))..(self.n as usize);
-                    (gate_row_ids
-                        .clone()
-                        .into_iter()
-                        .chain(blinding_rows.into_iter()))
-                    .flat_map(move |row| {
+                    (gate_row_ids.clone().chain(blinding_rows.into_iter())).flat_map(move |row| {
                         let row = row as i32 + n;
                         gate.polynomials().iter().enumerate().filter_map(
                             move |(poly_index, poly)| match poly.evaluate_lazy(
@@ -1387,7 +1383,6 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
 
                     let mut inputs: Vec<(Vec<_>, usize)> = lookup_input_row_ids
                         .clone()
-                        .into_iter()
                         .filter_map(|input_row| {
                             let t = lookup
                                 .input_expressions
@@ -1458,7 +1453,6 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
                     let mut input_rows: Vec<(Vec<Value<F>>, usize)> = self
                         .usable_rows
                         .clone()
-                        .into_iter()
                         .map(|input_row| {
                             let t = shuffle
                                 .input_expressions
@@ -1896,7 +1890,6 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
                     let mut input_rows: Vec<(Vec<Value<F>>, usize)> = self
                         .usable_rows
                         .clone()
-                        .into_iter()
                         .map(|input_row| {
                             let t = shuffle
                                 .input_expressions
diff --git a/halo2_proofs/src/plonk/assigned.rs b/halo2_proofs/src/plonk/assigned.rs
index 46d527b915..919ddcdfb5 100644
--- a/halo2_proofs/src/plonk/assigned.rs
+++ b/halo2_proofs/src/plonk/assigned.rs
@@ -613,7 +613,7 @@ mod proptests {
                 // Ensure that:
                 // - we have at least one value to apply unary operators to.
                 // - we can apply every binary operator pairwise sequentially.
-                cmp::max(if num_unary > 0 { 1 } else { 0 }, num_binary + 1)),
+                cmp::max(usize::from(num_unary > 0), num_binary + 1)),
             operations in arb_operators(num_unary, num_binary).prop_shuffle(),
         ) -> (Vec<Assigned<Fp>>, Vec<Operator>) {
             (values, operations)
diff --git a/halo2_proofs/src/plonk/circuit.rs b/halo2_proofs/src/plonk/circuit.rs
index 144a53d956..7651da5e98 100644
--- a/halo2_proofs/src/plonk/circuit.rs
+++ b/halo2_proofs/src/plonk/circuit.rs
@@ -591,7 +591,8 @@ pub struct TableColumn {
 }
 
 impl TableColumn {
-    pub(crate) fn inner(&self) -> Column<Fixed> {
+    /// Returns inner column
+    pub fn inner(&self) -> Column<Fixed> {
         self.inner
     }
 }
diff --git a/halo2_proofs/src/plonk/evaluation.rs b/halo2_proofs/src/plonk/evaluation.rs
index d31f671003..2a41286594 100644
--- a/halo2_proofs/src/plonk/evaluation.rs
+++ b/halo2_proofs/src/plonk/evaluation.rs
@@ -451,8 +451,8 @@ impl<C: CurveAffine> Evaluator<C> {
 
                         // Permutation constraints
                         parallelize(&mut values, |values, start| {
-                            let mut beta_term = current_extended_omega
-                                * omega.pow_vartime(&[start as u64, 0, 0, 0]);
+                            let mut beta_term =
+                                current_extended_omega * omega.pow_vartime([start as u64, 0, 0, 0]);
                             for (i, value) in values.iter_mut().enumerate() {
                                 let idx = start + i;
                                 let r_next = get_rotation_idx(idx, 1, rot_scale, isize);
diff --git a/halo2_proofs/src/plonk/lookup/prover.rs b/halo2_proofs/src/plonk/lookup/prover.rs
index 0f0c85d7e3..6a5f883a03 100644
--- a/halo2_proofs/src/plonk/lookup/prover.rs
+++ b/halo2_proofs/src/plonk/lookup/prover.rs
@@ -443,7 +443,7 @@ fn permute_expression_pair<'params, C: CurveAffine, P: Params<'params, C>, R: Rn
     // Populate permuted table at unfilled rows with leftover table elements
     for (coeff, count) in leftover_table_map.iter() {
         for _ in 0..*count {
-            permuted_table_coeffs[repeated_input_rows.pop().unwrap() as usize] = *coeff;
+            permuted_table_coeffs[repeated_input_rows.pop().unwrap()] = *coeff;
         }
     }
     assert!(repeated_input_rows.is_empty());
diff --git a/halo2_proofs/src/plonk/permutation/keygen.rs b/halo2_proofs/src/plonk/permutation/keygen.rs
index 1a4af204dc..0ae12df4a2 100644
--- a/halo2_proofs/src/plonk/permutation/keygen.rs
+++ b/halo2_proofs/src/plonk/permutation/keygen.rs
@@ -327,7 +327,7 @@ pub(crate) fn build_pk<'params, C: CurveAffine, P: Params<'params, C>>(
     {
         let omega = domain.get_omega();
         parallelize(&mut omega_powers, |o, start| {
-            let mut cur = omega.pow_vartime(&[start as u64]);
+            let mut cur = omega.pow_vartime([start as u64]);
             for v in o.iter_mut() {
                 *v = cur;
                 cur *= &omega;
@@ -339,7 +339,7 @@ pub(crate) fn build_pk<'params, C: CurveAffine, P: Params<'params, C>>(
     let mut deltaomega = vec![omega_powers; p.columns.len()];
     {
         parallelize(&mut deltaomega, |o, start| {
-            let mut cur = C::Scalar::DELTA.pow_vartime(&[start as u64]);
+            let mut cur = C::Scalar::DELTA.pow_vartime([start as u64]);
             for omega_powers in o.iter_mut() {
                 for v in omega_powers {
                     *v *= &cur;
@@ -403,7 +403,7 @@ pub(crate) fn build_vk<'params, C: CurveAffine, P: Params<'params, C>>(
     {
         let omega = domain.get_omega();
         parallelize(&mut omega_powers, |o, start| {
-            let mut cur = omega.pow_vartime(&[start as u64]);
+            let mut cur = omega.pow_vartime([start as u64]);
             for v in o.iter_mut() {
                 *v = cur;
                 cur *= &omega;
@@ -415,7 +415,7 @@ pub(crate) fn build_vk<'params, C: CurveAffine, P: Params<'params, C>>(
     let mut deltaomega = vec![omega_powers; p.columns.len()];
     {
         parallelize(&mut deltaomega, |o, start| {
-            let mut cur = C::Scalar::DELTA.pow_vartime(&[start as u64]);
+            let mut cur = C::Scalar::DELTA.pow_vartime([start as u64]);
             for omega_powers in o.iter_mut() {
                 for v in omega_powers {
                     *v *= &cur;
diff --git a/halo2_proofs/src/plonk/permutation/verifier.rs b/halo2_proofs/src/plonk/permutation/verifier.rs
index ecdef3f59a..d0491b852f 100644
--- a/halo2_proofs/src/plonk/permutation/verifier.rs
+++ b/halo2_proofs/src/plonk/permutation/verifier.rs
@@ -183,7 +183,7 @@ impl<C: CurveAffine> Evaluated<C> {
                         let mut right = set.permutation_product_eval;
                         let mut current_delta = (*beta * &*x)
                             * &(<C::Scalar as PrimeField>::DELTA
-                                .pow_vartime(&[(chunk_index * chunk_len) as u64]));
+                                .pow_vartime([(chunk_index * chunk_len) as u64]));
                         for eval in columns.iter().map(|&column| match column.column_type() {
                             Any::Advice(_) => {
                                 advice_evals[vk.cs.get_any_query_index(column, Rotation::cur())]
diff --git a/halo2_proofs/src/plonk/prover.rs b/halo2_proofs/src/plonk/prover.rs
index 7ff5867138..4f8d9ec730 100644
--- a/halo2_proofs/src/plonk/prover.rs
+++ b/halo2_proofs/src/plonk/prover.rs
@@ -667,7 +667,7 @@ where
     let vanishing = vanishing.construct(params, domain, h_poly, &mut rng, transcript)?;
 
     let x: ChallengeX<_> = transcript.squeeze_challenge_scalar();
-    let xn = x.pow(&[params.n() as u64, 0, 0, 0]);
+    let xn = x.pow([params.n(), 0, 0, 0]);
 
     if P::QUERY_INSTANCE {
         // Compute and hash instance evals for each circuit instance
@@ -790,8 +790,8 @@ where
                         }),
                 )
                 .chain(permutation.open(pk, x))
-                .chain(lookups.iter().flat_map(move |p| p.open(pk, x)).into_iter())
-                .chain(shuffles.iter().flat_map(move |p| p.open(pk, x)).into_iter())
+                .chain(lookups.iter().flat_map(move |p| p.open(pk, x)))
+                .chain(shuffles.iter().flat_map(move |p| p.open(pk, x)))
         })
         .chain(
             pk.vk
diff --git a/halo2_proofs/src/plonk/verifier.rs b/halo2_proofs/src/plonk/verifier.rs
index b92c3dbef6..1e431be41b 100644
--- a/halo2_proofs/src/plonk/verifier.rs
+++ b/halo2_proofs/src/plonk/verifier.rs
@@ -188,7 +188,7 @@ where
             })
             .collect::<Result<Vec<_>, _>>()?
     } else {
-        let xn = x.pow(&[params.n() as u64, 0, 0, 0]);
+        let xn = x.pow([params.n(), 0, 0, 0]);
         let (min_rotation, max_rotation) =
             vk.cs
                 .instance_queries
@@ -267,7 +267,7 @@ where
     // commitments open to the correct values.
     let vanishing = {
         // x^n
-        let xn = x.pow(&[params.n() as u64, 0, 0, 0]);
+        let xn = x.pow([params.n(), 0, 0, 0]);
 
         let blinding_factors = vk.cs.blinding_factors();
         let l_evals = vk
@@ -325,47 +325,39 @@ where
                             gamma,
                             x,
                         ))
-                        .chain(
-                            lookups
-                                .iter()
-                                .zip(vk.cs.lookups.iter())
-                                .flat_map(move |(p, argument)| {
-                                    p.expressions(
-                                        l_0,
-                                        l_last,
-                                        l_blind,
-                                        argument,
-                                        theta,
-                                        beta,
-                                        gamma,
-                                        advice_evals,
-                                        fixed_evals,
-                                        instance_evals,
-                                        challenges,
-                                    )
-                                })
-                                .into_iter(),
-                        )
-                        .chain(
-                            shuffles
-                                .iter()
-                                .zip(vk.cs.shuffles.iter())
-                                .flat_map(move |(p, argument)| {
-                                    p.expressions(
-                                        l_0,
-                                        l_last,
-                                        l_blind,
-                                        argument,
-                                        theta,
-                                        gamma,
-                                        advice_evals,
-                                        fixed_evals,
-                                        instance_evals,
-                                        challenges,
-                                    )
-                                })
-                                .into_iter(),
-                        )
+                        .chain(lookups.iter().zip(vk.cs.lookups.iter()).flat_map(
+                            move |(p, argument)| {
+                                p.expressions(
+                                    l_0,
+                                    l_last,
+                                    l_blind,
+                                    argument,
+                                    theta,
+                                    beta,
+                                    gamma,
+                                    advice_evals,
+                                    fixed_evals,
+                                    instance_evals,
+                                    challenges,
+                                )
+                            },
+                        ))
+                        .chain(shuffles.iter().zip(vk.cs.shuffles.iter()).flat_map(
+                            move |(p, argument)| {
+                                p.expressions(
+                                    l_0,
+                                    l_last,
+                                    l_blind,
+                                    argument,
+                                    theta,
+                                    gamma,
+                                    advice_evals,
+                                    fixed_evals,
+                                    instance_evals,
+                                    challenges,
+                                )
+                            },
+                        ))
                 },
             );
 
@@ -419,18 +411,8 @@ where
                         },
                     ))
                     .chain(permutation.queries(vk, x))
-                    .chain(
-                        lookups
-                            .iter()
-                            .flat_map(move |p| p.queries(vk, x))
-                            .into_iter(),
-                    )
-                    .chain(
-                        shuffles
-                            .iter()
-                            .flat_map(move |p| p.queries(vk, x))
-                            .into_iter(),
-                    )
+                    .chain(lookups.iter().flat_map(move |p| p.queries(vk, x)))
+                    .chain(shuffles.iter().flat_map(move |p| p.queries(vk, x)))
             },
         )
         .chain(
diff --git a/halo2_proofs/src/poly/domain.rs b/halo2_proofs/src/poly/domain.rs
index 63be6d654f..494e39a9da 100644
--- a/halo2_proofs/src/poly/domain.rs
+++ b/halo2_proofs/src/poly/domain.rs
@@ -88,8 +88,8 @@ impl<F: WithSmallOrderMulGroup<3>> EvaluationDomain<F> {
         {
             // Compute the evaluations of t(X) = X^n - 1 in the coset evaluation domain.
             // We don't have to compute all of them, because it will repeat.
-            let orig = F::ZETA.pow_vartime(&[n as u64, 0, 0, 0]);
-            let step = extended_omega.pow_vartime(&[n as u64, 0, 0, 0]);
+            let orig = F::ZETA.pow_vartime([n, 0, 0, 0]);
+            let step = extended_omega.pow_vartime([n, 0, 0, 0]);
             let mut cur = orig;
             loop {
                 t_evaluations.push(cur);
@@ -651,7 +651,7 @@ fn test_l_i() {
     let mut l = vec![];
     let mut points = vec![];
     for i in 0..8 {
-        points.push(domain.omega.pow(&[i, 0, 0, 0]));
+        points.push(domain.omega.pow([i, 0, 0, 0]));
     }
     for i in 0..8 {
         let mut l_i = vec![Scalar::ZERO; 8];
@@ -661,7 +661,7 @@ fn test_l_i() {
     }
 
     let x = Scalar::random(OsRng);
-    let xn = x.pow(&[8, 0, 0, 0]);
+    let xn = x.pow([8, 0, 0, 0]);
 
     let evaluations = domain.l_i_range(x, xn, -7..=7);
     for i in 0..8 {
diff --git a/halo2_proofs/src/poly/kzg/commitment.rs b/halo2_proofs/src/poly/kzg/commitment.rs
index 73b7510efc..e8f6bb1529 100644
--- a/halo2_proofs/src/poly/kzg/commitment.rs
+++ b/halo2_proofs/src/poly/kzg/commitment.rs
@@ -109,7 +109,7 @@ where
         }
         let n_inv = Option::<E::Scalar>::from(E::Scalar::from(n).invert())
             .expect("inversion should be ok for n = 1<<k");
-        let multiplier = (s.pow_vartime(&[n as u64]) - E::Scalar::ONE) * n_inv;
+        let multiplier = (s.pow_vartime([n]) - E::Scalar::ONE) * n_inv;
         parallelize(&mut g_lagrange_projective, |g, start| {
             for (idx, g) in g.iter_mut().enumerate() {
                 let offset = start + idx;
diff --git a/halo2_proofs/src/transcript.rs b/halo2_proofs/src/transcript.rs
index 166b0e6f90..ce823850da 100644
--- a/halo2_proofs/src/transcript.rs
+++ b/halo2_proofs/src/transcript.rs
@@ -253,12 +253,12 @@ where
     C::Scalar: FromUniformBytes<64>,
 {
     fn squeeze_challenge(&mut self) -> Challenge255<C> {
-        self.state.update(&[KECCAK256_PREFIX_CHALLENGE]);
+        self.state.update([KECCAK256_PREFIX_CHALLENGE]);
 
         let mut state_lo = self.state.clone();
         let mut state_hi = self.state.clone();
-        state_lo.update(&[KECCAK256_PREFIX_CHALLENGE_LO]);
-        state_hi.update(&[KECCAK256_PREFIX_CHALLENGE_HI]);
+        state_lo.update([KECCAK256_PREFIX_CHALLENGE_LO]);
+        state_hi.update([KECCAK256_PREFIX_CHALLENGE_HI]);
         let result_lo: [u8; 32] = state_lo.finalize().as_slice().try_into().unwrap();
         let result_hi: [u8; 32] = state_hi.finalize().as_slice().try_into().unwrap();
 
@@ -270,7 +270,7 @@ where
     }
 
     fn common_point(&mut self, point: C) -> io::Result<()> {
-        self.state.update(&[KECCAK256_PREFIX_POINT]);
+        self.state.update([KECCAK256_PREFIX_POINT]);
         let coords: Coordinates<C> = Option::from(point.coordinates()).ok_or_else(|| {
             io::Error::new(
                 io::ErrorKind::Other,
@@ -284,7 +284,7 @@ where
     }
 
     fn common_scalar(&mut self, scalar: C::Scalar) -> io::Result<()> {
-        self.state.update(&[KECCAK256_PREFIX_SCALAR]);
+        self.state.update([KECCAK256_PREFIX_SCALAR]);
         self.state.update(scalar.to_repr().as_ref());
 
         Ok(())
@@ -427,12 +427,12 @@ where
     C::Scalar: FromUniformBytes<64>,
 {
     fn squeeze_challenge(&mut self) -> Challenge255<C> {
-        self.state.update(&[KECCAK256_PREFIX_CHALLENGE]);
+        self.state.update([KECCAK256_PREFIX_CHALLENGE]);
 
         let mut state_lo = self.state.clone();
         let mut state_hi = self.state.clone();
-        state_lo.update(&[KECCAK256_PREFIX_CHALLENGE_LO]);
-        state_hi.update(&[KECCAK256_PREFIX_CHALLENGE_HI]);
+        state_lo.update([KECCAK256_PREFIX_CHALLENGE_LO]);
+        state_hi.update([KECCAK256_PREFIX_CHALLENGE_HI]);
         let result_lo: [u8; 32] = state_lo.finalize().as_slice().try_into().unwrap();
         let result_hi: [u8; 32] = state_hi.finalize().as_slice().try_into().unwrap();
 
@@ -444,7 +444,7 @@ where
     }
 
     fn common_point(&mut self, point: C) -> io::Result<()> {
-        self.state.update(&[KECCAK256_PREFIX_POINT]);
+        self.state.update([KECCAK256_PREFIX_POINT]);
         let coords: Coordinates<C> = Option::from(point.coordinates()).ok_or_else(|| {
             io::Error::new(
                 io::ErrorKind::Other,
@@ -458,7 +458,7 @@ where
     }
 
     fn common_scalar(&mut self, scalar: C::Scalar) -> io::Result<()> {
-        self.state.update(&[KECCAK256_PREFIX_SCALAR]);
+        self.state.update([KECCAK256_PREFIX_SCALAR]);
         self.state.update(scalar.to_repr().as_ref());
 
         Ok(())
diff --git a/rust-toolchain b/rust-toolchain
index 9405730420..902c74186f 100644
--- a/rust-toolchain
+++ b/rust-toolchain
@@ -1 +1 @@
-1.64.0
+1.65.0

From 657f98b900a907993693a8e0cd33407973bd9110 Mon Sep 17 00:00:00 2001
From: Han <tinghan0110@gmail.com>
Date: Wed, 6 Sep 2023 14:59:44 +0800
Subject: [PATCH 21/30] Synchronize with upstream (#199)

* refactor: add default impl for `SyncDeps` for backward compatability

* feat: pick changes from https://github.com/zcash/halo2/pull/728 and changes of flag `test-dev-graph`

* feat: pick changes from https://github.com/zcash/halo2/pull/622

* feat: pick changes about mod `circuit` and mod `dev`

* feat: pick rest changes of `halo2_proofs`

* fix: when `--no-default-features`

* ci: sync from upstream, and deduplicate jobs when
push to `main`, and remove always failing job `codecov`.

* fix: make `commit_zk` runnable when `--no-default-features`
---
 .github/workflows/ci.yml                      |  79 +-
 .github/workflows/ci_main.yml                 | 106 ---
 Cargo.lock                                    |  89 ++-
 README.md                                     |   6 +-
 halo2/Cargo.toml                              |   2 +-
 halo2_gadgets/Cargo.toml                      |  12 +-
 halo2_gadgets/benches/sha256.rs               |   9 +-
 halo2_gadgets/src/ecc.rs                      |   2 +-
 halo2_gadgets/src/ecc/chip/constants.rs       |  14 +-
 halo2_gadgets/src/ecc/chip/mul_fixed.rs       |   6 +-
 halo2_gadgets/src/poseidon/pow5.rs            |   2 +-
 halo2_gadgets/src/sha256/table16.rs           |   2 +-
 halo2_gadgets/src/sinsemilla.rs               |   2 +-
 halo2_gadgets/src/sinsemilla/merkle.rs        |   2 +-
 halo2_proofs/Cargo.toml                       |  21 +-
 halo2_proofs/README.md                        |   6 +-
 halo2_proofs/benches/commit_zk.rs             |  48 +-
 halo2_proofs/examples/vector-mul.rs           |   2 +-
 halo2_proofs/src/arithmetic.rs                |   4 +-
 halo2_proofs/src/circuit.rs                   |  25 +-
 .../src/circuit/floor_planner/single_pass.rs  | 115 +--
 halo2_proofs/src/circuit/floor_planner/v1.rs  |  31 +-
 .../src/circuit/floor_planner/v1/strategy.rs  |  21 +-
 halo2_proofs/src/circuit/layouter.rs          |  46 +-
 halo2_proofs/src/circuit/table_layouter.rs    | 413 +++++++++++
 halo2_proofs/src/circuit/value.rs             |   5 +
 halo2_proofs/src/dev.rs                       | 176 +++--
 halo2_proofs/src/dev/cost.rs                  | 236 +++++-
 halo2_proofs/src/dev/failure.rs               |  47 +-
 halo2_proofs/src/dev/gates.rs                 |   5 +-
 halo2_proofs/src/dev/graph.rs                 |   2 -
 halo2_proofs/src/dev/graph/layout.rs          | 212 +-----
 halo2_proofs/src/dev/tfp.rs                   | 508 +++++++++++++
 halo2_proofs/src/dev/util.rs                  |   7 +-
 halo2_proofs/src/helpers.rs                   |   2 +-
 halo2_proofs/src/lib.rs                       |  22 +-
 halo2_proofs/src/multicore.rs                 |  73 +-
 halo2_proofs/src/plonk.rs                     |   6 +-
 halo2_proofs/src/plonk/assigned.rs            |   1 -
 halo2_proofs/src/plonk/circuit.rs             |   8 +-
 halo2_proofs/src/plonk/error.rs               |  48 +-
 halo2_proofs/src/plonk/evaluation.rs          |  31 +-
 halo2_proofs/src/plonk/keygen.rs              |   9 +-
 halo2_proofs/src/plonk/lookup/prover.rs       |   5 +-
 halo2_proofs/src/plonk/lookup/verifier.rs     |   3 +-
 halo2_proofs/src/plonk/permutation.rs         |   3 +-
 halo2_proofs/src/plonk/permutation/keygen.rs  |  34 +-
 halo2_proofs/src/plonk/permutation/prover.rs  |   4 +-
 .../src/plonk/permutation/verifier.rs         |   1 +
 halo2_proofs/src/plonk/prover.rs              |  95 ++-
 halo2_proofs/src/plonk/shuffle/prover.rs      |  15 +-
 halo2_proofs/src/plonk/shuffle/verifier.rs    |   1 +
 halo2_proofs/src/plonk/vanishing/prover.rs    |   5 +-
 halo2_proofs/src/plonk/verifier.rs            |  15 +-
 halo2_proofs/src/plonk/verifier/batch.rs      |  17 +-
 halo2_proofs/src/poly.rs                      |   1 -
 halo2_proofs/src/poly/commitment.rs           |   5 +-
 halo2_proofs/src/poly/domain.rs               |  12 +-
 halo2_proofs/src/poly/evaluator.rs            | 699 ------------------
 halo2_proofs/src/poly/ipa/commitment.rs       |  24 +-
 .../src/poly/ipa/commitment/prover.rs         |   8 +-
 .../src/poly/ipa/commitment/verifier.rs       |  18 +-
 halo2_proofs/src/poly/ipa/msm.rs              |  15 +-
 halo2_proofs/src/poly/ipa/multiopen.rs        |   2 +-
 halo2_proofs/src/poly/ipa/multiopen/prover.rs |   6 +-
 .../src/poly/ipa/multiopen/verifier.rs        |  30 +-
 halo2_proofs/src/poly/ipa/strategy.rs         |   9 +-
 halo2_proofs/src/poly/kzg/commitment.rs       |  33 +-
 halo2_proofs/src/poly/kzg/msm.rs              |   6 +-
 halo2_proofs/src/poly/kzg/multiopen/gwc.rs    |  15 +-
 .../src/poly/kzg/multiopen/gwc/prover.rs      |  12 +-
 .../src/poly/kzg/multiopen/gwc/verifier.rs    |  16 +-
 .../src/poly/kzg/multiopen/shplonk.rs         |  32 +-
 .../src/poly/kzg/multiopen/shplonk/prover.rs  | 155 ++--
 .../poly/kzg/multiopen/shplonk/verifier.rs    |  16 +-
 halo2_proofs/src/poly/kzg/strategy.rs         |  16 +-
 halo2_proofs/src/poly/multiopen_test.rs       |  27 +-
 halo2_proofs/src/poly/query.rs                |   8 +-
 halo2_proofs/src/poly/strategy.rs             |  10 +-
 79 files changed, 2042 insertions(+), 1794 deletions(-)
 delete mode 100644 .github/workflows/ci_main.yml
 create mode 100644 halo2_proofs/src/circuit/table_layouter.rs
 create mode 100644 halo2_proofs/src/dev/tfp.rs
 delete mode 100644 halo2_proofs/src/poly/evaluator.rs

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 74ddd131fb..56efd9a3d8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,14 +1,25 @@
 name: CI checks
 
-on: [pull_request, push]
+on:
+  merge_group:
+  pull_request:
+  push:
+    branches:
+      - main
 
 jobs:
   test:
-    name: Test on ${{ matrix.os }}
+    name: Test on ${{ matrix.os }} with ${{ matrix.feature_set }} features
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
+        feature_set: [basic, all]
         os: [ubuntu-latest, windows-latest, macOS-latest]
+        include:
+          - feature_set: basic
+            features: batch,dev-graph,gadget-traces
+          - feature_set: all
+            features: batch,dev-graph,gadget-traces,multicore,test-dev-graph,thread-safe-region,sanity-checks,circuit-params
 
     steps:
       - uses: actions/checkout@v3
@@ -19,8 +30,67 @@ jobs:
         uses: actions-rs/cargo@v1
         with:
           command: test
-          args: --verbose --release --all --all-features
-    if: ${{ false }}
+          args: --verbose --release --workspace --no-default-features --features "${{ matrix.features }}"
+
+  build:
+    name: Build target ${{ matrix.target }}
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        target:
+          - wasm32-unknown-unknown
+          - wasm32-wasi
+
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions-rs/toolchain@v1
+        with:
+          override: false
+      - name: Add target
+        run: rustup target add ${{ matrix.target }}
+      - name: cargo build
+        uses: actions-rs/cargo@v1
+        with:
+          command: build
+          args: --no-default-features --features batch,dev-graph,gadget-traces --target ${{ matrix.target }}
+
+  bitrot:
+    name: Bitrot check
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions-rs/toolchain@v1
+        with:
+          override: false
+      # Build benchmarks to prevent bitrot
+      - name: Build benchmarks
+        uses: actions-rs/cargo@v1
+        with:
+          command: build
+          args: --benches --examples --all-features
+
+  doc-links:
+    name: Intra-doc links
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions-rs/toolchain@v1
+        with:
+          override: false
+      - name: cargo fetch
+        uses: actions-rs/cargo@v1
+        with:
+          command: fetch
+
+      # Ensure intra-documentation links all resolve correctly
+      # Requires #![deny(intra_doc_link_resolution_failure)] in crates.
+      - name: Check intra-doc links
+        uses: actions-rs/cargo@v1
+        with:
+          command: doc
+          args: --all --document-private-items
 
   fmt:
     name: Rustfmt
@@ -36,3 +106,4 @@ jobs:
         with:
           command: fmt
           args: --all -- --check
+
diff --git a/.github/workflows/ci_main.yml b/.github/workflows/ci_main.yml
deleted file mode 100644
index 400bff09bd..0000000000
--- a/.github/workflows/ci_main.yml
+++ /dev/null
@@ -1,106 +0,0 @@
-name: CI checks main
-
-on:
-  push:
-    branches:
-      - main
-jobs:
-  test:
-    name: Test on ${{ matrix.os }}
-    runs-on: ${{ matrix.os }}
-    strategy:
-      matrix:
-        os: [ubuntu-latest, windows-latest, macOS-latest]
-
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions-rs/toolchain@v1
-        with:
-          override: false
-      - name: Run tests
-        uses: actions-rs/cargo@v1
-        with:
-          command: test
-          args: --verbose --release --all --all-features
-  bitrot:
-    name: Bitrot check
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions-rs/toolchain@v1
-        with:
-          override: false
-      # Build benchmarks to prevent bitrot
-      - name: Build benchmarks
-        uses: actions-rs/cargo@v1
-        with:
-          command: build
-          args: --benches --examples --all-features
-
-  codecov:
-    name: Code coverage
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v3
-      # Use stable for this to ensure that cargo-tarpaulin can be built.
-      - uses: actions-rs/toolchain@v1
-        with:
-          override: false
-      - name: Install cargo-tarpaulin
-        uses: actions-rs/cargo@v1
-        with:
-          command: install
-          args: cargo-tarpaulin
-      - name: Generate coverage report
-        uses: actions-rs/cargo@v1
-        with:
-          command: tarpaulin
-          args: --all-features --timeout 600 --out Xml
-      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v3.1.0
-
-  doc-links:
-    name: Intra-doc links
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions-rs/toolchain@v1
-        with:
-          override: false
-      - name: cargo fetch
-        uses: actions-rs/cargo@v1
-        with:
-          command: fetch
-
-      # Ensure intra-documentation links all resolve correctly
-      # Requires #![deny(intra_doc_link_resolution_failure)] in crates.
-      - name: Check intra-doc links
-        uses: actions-rs/cargo@v1
-        with:
-          command: doc
-          args: --all --document-private-items
-
-  build:
-    name: Build target ${{ matrix.target }}
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        target:
-          - wasm32-unknown-unknown
-          - wasm32-wasi
-
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions-rs/toolchain@v1
-        with:
-          override: false
-      - name: Add target
-        run: rustup target add ${{ matrix.target }}
-      - name: cargo build
-        uses: actions-rs/cargo@v1
-        with:
-          command: build
-          args: --features dev-graph,gadget-traces,unstable --target ${{ matrix.target }}
diff --git a/Cargo.lock b/Cargo.lock
index 340d1900ee..b7d83cb86b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -236,19 +236,6 @@ version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
-[[package]]
-name = "chrono"
-version = "0.4.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "670ad68c9088c2a963aaa298cb369688cf3f9465ce5e2d4ca10e6e0098a1ce73"
-dependencies = [
- "libc",
- "num-integer",
- "num-traits",
- "time",
- "winapi",
-]
-
 [[package]]
 name = "clap"
 version = "2.34.0"
@@ -789,16 +776,6 @@ dependencies = [
  "wasm-bindgen",
 ]
 
-[[package]]
-name = "gif"
-version = "0.11.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3a7187e78088aead22ceedeee99779455b23fc231fe13ec443f99bb71694e5b"
-dependencies = [
- "color_quant",
- "weezl",
-]
-
 [[package]]
 name = "gimli"
 version = "0.26.1"
@@ -859,7 +836,7 @@ dependencies = [
  "ff",
  "group",
  "halo2_proofs",
- "halo2curves",
+ "halo2curves 0.1.0",
  "lazy_static",
  "plotters",
  "pprof",
@@ -869,6 +846,12 @@ dependencies = [
  "uint",
 ]
 
+[[package]]
+name = "halo2_legacy_pdqsort"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47716fe1ae67969c5e0b2ef826f32db8c3be72be325e1aa3c1951d06b5575ec5"
+
 [[package]]
 name = "halo2_proofs"
 version = "0.2.0"
@@ -885,21 +868,43 @@ dependencies = [
  "getrandom",
  "group",
  "gumdrop",
- "halo2curves",
+ "halo2_legacy_pdqsort",
+ "halo2curves 0.1.0",
  "log",
+ "maybe-rayon",
  "num-bigint",
  "num-integer",
  "plotters",
  "poseidon",
  "proptest",
+ "rand_chacha",
  "rand_core",
- "rayon",
  "sha3",
  "subtle",
  "tabbycat",
  "tracing",
 ]
 
+[[package]]
+name = "halo2curves"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6b1142bd1059aacde1b477e0c80c142910f1ceae67fc619311d6a17428007ab"
+dependencies = [
+ "blake2b_simd",
+ "ff",
+ "group",
+ "lazy_static",
+ "num-bigint",
+ "num-traits",
+ "pasta_curves",
+ "paste",
+ "rand",
+ "rand_core",
+ "static_assertions",
+ "subtle",
+]
+
 [[package]]
 name = "halo2curves"
 version = "0.3.2"
@@ -1083,6 +1088,16 @@ dependencies = [
  "cfg-if 1.0.0",
 ]
 
+[[package]]
+name = "maybe-rayon"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ea1f30cedd69f0a2954655f7188c6a834246d2bcf1e315e2ac40c4b24dc9519"
+dependencies = [
+ "cfg-if 1.0.0",
+ "rayon",
+]
+
 [[package]]
 name = "memchr"
 version = "2.5.0"
@@ -1335,9 +1350,7 @@ version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a3fd9ec30b9749ce28cd91f255d569591cdf937fe280c312143e3c4bad6f2a"
 dependencies = [
- "chrono",
  "font-kit",
- "image",
  "lazy_static",
  "num-traits",
  "pathfinder_geometry",
@@ -1361,7 +1374,6 @@ version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "21362fa905695e5618aefd169358f52e0e8bc4a8e05333cf780fda8cddc00b54"
 dependencies = [
- "gif",
  "image",
  "plotters-backend",
 ]
@@ -1392,7 +1404,7 @@ name = "poseidon"
 version = "0.2.0"
 source = "git+https://github.com/privacy-scaling-explorations/poseidon.git?tag=v2023_04_20#807f8f555313f726ca03bdf941f798098f488ba4"
 dependencies = [
- "halo2curves",
+ "halo2curves 0.3.2",
  "subtle",
 ]
 
@@ -1910,17 +1922,6 @@ dependencies = [
  "syn",
 ]
 
-[[package]]
-name = "time"
-version = "0.1.44"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6db9e6914ab8b1ae1c260a4ae7a49b6c5611b40328a735b21862567685e73255"
-dependencies = [
- "libc",
- "wasi",
- "winapi",
-]
-
 [[package]]
 name = "tinytemplate"
 version = "1.2.1"
@@ -2107,12 +2108,6 @@ dependencies = [
  "wasm-bindgen",
 ]
 
-[[package]]
-name = "weezl"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d8b77fdfd5a253be4ab714e4ffa3c49caf146b4de743e97510c0656cf90f1e8e"
-
 [[package]]
 name = "winapi"
 version = "0.3.9"
diff --git a/README.md b/README.md
index 69167e0716..4de513c4b7 100644
--- a/README.md
+++ b/README.md
@@ -4,7 +4,7 @@
 
 ## Minimum Supported Rust Version
 
-Requires Rust **1.56.1** or higher.
+Requires Rust **1.65.0** or higher.
 
 Minimum supported Rust version can be changed in the future, but it will be done with a
 minor version bump.
@@ -14,6 +14,10 @@ minor version bump.
 `halo2` currently uses [rayon](https://github.com/rayon-rs/rayon) for parallel computation.
 The `RAYON_NUM_THREADS` environment variable can be used to set the number of threads.
 
+You can disable `rayon` by disabling the `"multicore"` feature.
+Warning! Halo2 will lose access to parallelism if you disable the `"multicore"` feature.
+This will significantly degrade performance.
+
 ## License
 
 Licensed under either of
diff --git a/halo2/Cargo.toml b/halo2/Cargo.toml
index 7a6bbaa94f..ba934102b6 100644
--- a/halo2/Cargo.toml
+++ b/halo2/Cargo.toml
@@ -19,7 +19,7 @@ all-features = true
 rustdoc-args = ["--cfg", "docsrs", "--html-in-header", "katex-header.html"]
 
 [dependencies]
-halo2_proofs = { version = "0.2", path = "../halo2_proofs" }
+halo2_proofs = { version = "0.2", path = "../halo2_proofs", default-features = false }
 
 [lib]
 bench = false
diff --git a/halo2_gadgets/Cargo.toml b/halo2_gadgets/Cargo.toml
index 58b9ffff72..13026f4353 100644
--- a/halo2_gadgets/Cargo.toml
+++ b/halo2_gadgets/Cargo.toml
@@ -26,7 +26,7 @@ arrayvec = "0.7.0"
 bitvec = "1"
 ff = { version = "0.13", features = ["bits"] }
 group = "0.13"
-halo2_proofs = { version = "0.2", path = "../halo2_proofs" }
+halo2_proofs = { version = "0.2", path = "../halo2_proofs", default-features = false }
 lazy_static = "1"
 halo2curves = { version = "0.1.0" }
 proptest = { version = "1.0.0", optional = true }
@@ -35,7 +35,7 @@ subtle = "2.3"
 uint = "0.9.2" # MSRV 1.56.1
 
 # Developer tooling dependencies
-plotters = { version = "0.3.0", optional = true }
+plotters = { version = "0.3.0", default-features = false, optional = true }
 
 [dev-dependencies]
 criterion = "0.3"
@@ -48,7 +48,13 @@ pprof = { version = "0.8", features = ["criterion", "flamegraph"] } # MSRV 1.56
 bench = false
 
 [features]
-dev-graph = ["halo2_proofs/dev-graph", "plotters"]
+test-dev-graph = [
+    "halo2_proofs/dev-graph",
+    "plotters",
+    "plotters/bitmap_backend",
+    "plotters/bitmap_encoder",
+    "plotters/ttf",
+]
 circuit-params = ["halo2_proofs/circuit-params"]
 test-dependencies = ["proptest"]
 unstable = []
diff --git a/halo2_gadgets/benches/sha256.rs b/halo2_gadgets/benches/sha256.rs
index 4afceacd82..6a7e9b0bd9 100644
--- a/halo2_gadgets/benches/sha256.rs
+++ b/halo2_gadgets/benches/sha256.rs
@@ -8,7 +8,7 @@ use halo2curves::pasta::{pallas, EqAffine};
 use rand::rngs::OsRng;
 
 use std::{
-    fs::File,
+    fs::{create_dir_all, File},
     io::{prelude::*, BufReader},
     path::Path,
 };
@@ -88,6 +88,9 @@ fn bench(name: &str, k: u32, c: &mut Criterion) {
         }
     }
 
+    // Create parent directory for assets
+    create_dir_all("./benches/sha256_assets").expect("Failed to create sha256_assets directory");
+
     // Initialize the polynomial commitment parameters
     let params_path = Path::new("./benches/sha256_assets/sha256_params");
     if File::open(params_path).is_err() {
@@ -134,7 +137,7 @@ fn bench(name: &str, k: u32, c: &mut Criterion) {
             &params,
             &pk,
             &[circuit],
-            &[],
+            &[&[]],
             OsRng,
             &mut transcript,
         )
@@ -159,7 +162,7 @@ fn bench(name: &str, k: u32, c: &mut Criterion) {
                 &params,
                 pk.get_vk(),
                 strategy,
-                &[],
+                &[&[]],
                 &mut transcript,
             )
             .unwrap();
diff --git a/halo2_gadgets/src/ecc.rs b/halo2_gadgets/src/ecc.rs
index 05ea999053..8d71db8580 100644
--- a/halo2_gadgets/src/ecc.rs
+++ b/halo2_gadgets/src/ecc.rs
@@ -903,7 +903,7 @@ pub(crate) mod tests {
         assert_eq!(prover.verify(), Ok(()))
     }
 
-    #[cfg(feature = "dev-graph")]
+    #[cfg(feature = "test-dev-graph")]
     #[test]
     fn print_ecc_chip() {
         use plotters::prelude::*;
diff --git a/halo2_gadgets/src/ecc/chip/constants.rs b/halo2_gadgets/src/ecc/chip/constants.rs
index 82ed952ceb..90a989b9af 100644
--- a/halo2_gadgets/src/ecc/chip/constants.rs
+++ b/halo2_gadgets/src/ecc/chip/constants.rs
@@ -48,8 +48,8 @@ fn compute_window_table<C: CurveAffine>(base: C, num_windows: usize) -> Vec<[C;
             (0..H)
                 .map(|k| {
                     // scalar = (k+2)*(8^w)
-                    let scalar = C::Scalar::from(k as u64 + 2)
-                        * C::Scalar::from(H as u64).pow([w as u64, 0, 0, 0]);
+                    let scalar =
+                        C::Scalar::from(k as u64 + 2) * C::Scalar::from(H as u64).pow([w as u64]);
                     (base * scalar).to_affine()
                 })
                 .collect::<ArrayVec<C, H>>()
@@ -62,14 +62,14 @@ fn compute_window_table<C: CurveAffine>(base: C, num_windows: usize) -> Vec<[C;
     // For the last window, we compute [k * (2^3)^w - sum]B, where sum is defined
     // as sum = \sum_{j = 0}^{`num_windows - 2`} 2^{3j+1}
     let sum = (0..(num_windows - 1)).fold(C::Scalar::ZERO, |acc, j| {
-        acc + C::Scalar::from(2).pow([FIXED_BASE_WINDOW_SIZE as u64 * j as u64 + 1, 0, 0, 0])
+        acc + C::Scalar::from(2).pow([FIXED_BASE_WINDOW_SIZE as u64 * j as u64 + 1])
     });
     window_table.push(
         (0..H)
             .map(|k| {
                 // scalar = k * (2^3)^w - sum, where w = `num_windows - 1`
                 let scalar = C::Scalar::from(k as u64)
-                    * C::Scalar::from(H as u64).pow([(num_windows - 1) as u64, 0, 0, 0])
+                    * C::Scalar::from(H as u64).pow([(num_windows - 1) as u64])
                     - sum;
                 (base * scalar).to_affine()
             })
@@ -197,7 +197,7 @@ pub fn test_lagrange_coeffs<C: CurveAffine>(base: C, num_windows: usize) {
                 // Compute the actual x-coordinate of the multiple [(k+2)*(8^w)]B.
                 let point = base
                     * C::Scalar::from(bits as u64 + 2)
-                    * C::Scalar::from(H as u64).pow([idx as u64, 0, 0, 0]);
+                    * C::Scalar::from(H as u64).pow([idx as u64]);
                 let x = *point.to_affine().coordinates().unwrap().x();
 
                 // Check that the interpolated x-coordinate matches the actual one.
@@ -214,10 +214,10 @@ pub fn test_lagrange_coeffs<C: CurveAffine>(base: C, num_windows: usize) {
         // Compute the actual x-coordinate of the multiple [k * (8^84) - offset]B,
         // where offset = \sum_{j = 0}^{83} 2^{3j+1}
         let offset = (0..(num_windows - 1)).fold(C::Scalar::ZERO, |acc, w| {
-            acc + C::Scalar::from(2).pow([FIXED_BASE_WINDOW_SIZE as u64 * w as u64 + 1, 0, 0, 0])
+            acc + C::Scalar::from(2).pow([FIXED_BASE_WINDOW_SIZE as u64 * w as u64 + 1])
         });
         let scalar = C::Scalar::from(bits as u64)
-            * C::Scalar::from(H as u64).pow([(num_windows - 1) as u64, 0, 0, 0])
+            * C::Scalar::from(H as u64).pow([(num_windows - 1) as u64])
             - offset;
         let point = base * scalar;
         let x = *point.to_affine().coordinates().unwrap().x();
diff --git a/halo2_gadgets/src/ecc/chip/mul_fixed.rs b/halo2_gadgets/src/ecc/chip/mul_fixed.rs
index b22f2b66e7..ce478fdb86 100644
--- a/halo2_gadgets/src/ecc/chip/mul_fixed.rs
+++ b/halo2_gadgets/src/ecc/chip/mul_fixed.rs
@@ -372,7 +372,7 @@ impl<FixedPoints: super::FixedPoints<pallas::Affine>> Config<FixedPoints> {
         base: &F,
     ) -> Result<NonIdentityEccPoint, Error> {
         // `scalar = [(k_w + 2) ⋅ 8^w]
-        let scalar = k.map(|k| (k + *TWO_SCALAR) * (*H_SCALAR).pow([w as u64, 0, 0, 0]));
+        let scalar = k.map(|k| (k + *TWO_SCALAR) * (*H_SCALAR).pow([w as u64]));
 
         self.process_window::<_, NUM_WINDOWS>(region, offset, w, k_usize, scalar, base)
     }
@@ -389,12 +389,12 @@ impl<FixedPoints: super::FixedPoints<pallas::Affine>> Config<FixedPoints> {
 
         // offset_acc = \sum_{j = 0}^{NUM_WINDOWS - 2} 2^{FIXED_BASE_WINDOW_SIZE*j + 1}
         let offset_acc = (0..(NUM_WINDOWS - 1)).fold(pallas::Scalar::zero(), |acc, w| {
-            acc + (*TWO_SCALAR).pow([FIXED_BASE_WINDOW_SIZE as u64 * w as u64 + 1, 0, 0, 0])
+            acc + (*TWO_SCALAR).pow([FIXED_BASE_WINDOW_SIZE as u64 * w as u64 + 1])
         });
 
         // `scalar = [k * 8^(NUM_WINDOWS - 1) - offset_acc]`.
         let scalar = scalar.windows_field()[scalar.windows_field().len() - 1]
-            .map(|k| k * (*H_SCALAR).pow([(NUM_WINDOWS - 1) as u64, 0, 0, 0]) - offset_acc);
+            .map(|k| k * (*H_SCALAR).pow([(NUM_WINDOWS - 1) as u64]) - offset_acc);
 
         self.process_window::<_, NUM_WINDOWS>(
             region,
diff --git a/halo2_gadgets/src/poseidon/pow5.rs b/halo2_gadgets/src/poseidon/pow5.rs
index e8ea7abf69..0fb37994e5 100644
--- a/halo2_gadgets/src/poseidon/pow5.rs
+++ b/halo2_gadgets/src/poseidon/pow5.rs
@@ -869,7 +869,7 @@ mod tests {
         }
     }
 
-    #[cfg(feature = "dev-graph")]
+    #[cfg(feature = "test-dev-graph")]
     #[test]
     fn print_poseidon_chip() {
         use plotters::prelude::*;
diff --git a/halo2_gadgets/src/sha256/table16.rs b/halo2_gadgets/src/sha256/table16.rs
index 76b8e3476f..4781d82f64 100644
--- a/halo2_gadgets/src/sha256/table16.rs
+++ b/halo2_gadgets/src/sha256/table16.rs
@@ -450,7 +450,7 @@ trait Table16Assignment {
 }
 
 #[cfg(test)]
-#[cfg(feature = "dev-graph")]
+#[cfg(feature = "test-dev-graph")]
 mod tests {
     use super::super::{Sha256, BLOCK_SIZE};
     use super::{message_schedule::msg_schedule_test_input, Table16Chip, Table16Config};
diff --git a/halo2_gadgets/src/sinsemilla.rs b/halo2_gadgets/src/sinsemilla.rs
index 543d49f55f..48b929cbeb 100644
--- a/halo2_gadgets/src/sinsemilla.rs
+++ b/halo2_gadgets/src/sinsemilla.rs
@@ -739,7 +739,7 @@ pub(crate) mod tests {
         assert_eq!(prover.verify(), Ok(()))
     }
 
-    #[cfg(feature = "dev-graph")]
+    #[cfg(feature = "test-dev-graph")]
     #[test]
     fn print_sinsemilla_chip() {
         use plotters::prelude::*;
diff --git a/halo2_gadgets/src/sinsemilla/merkle.rs b/halo2_gadgets/src/sinsemilla/merkle.rs
index 219a9025af..47e5c953e3 100644
--- a/halo2_gadgets/src/sinsemilla/merkle.rs
+++ b/halo2_gadgets/src/sinsemilla/merkle.rs
@@ -382,7 +382,7 @@ pub mod tests {
         assert_eq!(prover.verify(), Ok(()))
     }
 
-    #[cfg(feature = "dev-graph")]
+    #[cfg(feature = "test-dev-graph")]
     #[test]
     fn print_merkle_chip() {
         use plotters::prelude::*;
diff --git a/halo2_proofs/Cargo.toml b/halo2_proofs/Cargo.toml
index bdd19f9b37..d481f03ee6 100644
--- a/halo2_proofs/Cargo.toml
+++ b/halo2_proofs/Cargo.toml
@@ -45,7 +45,6 @@ harness = false
 
 [dependencies]
 backtrace = { version = "0.3", optional = true }
-rayon = "1.5.1"
 ff = "0.13"
 group = "0.13"
 halo2curves = { version = "0.1.0" }
@@ -58,10 +57,12 @@ cfg-if = "0.1"
 poseidon = { git = "https://github.com/privacy-scaling-explorations/poseidon.git", tag = "v2023_04_20" }
 num-integer = "0.1"
 num-bigint = { version = "0.4", features = ["rand"] }
+rand_chacha = "0.3"
+maybe-rayon = { version = "0.1.0", default-features = false }
 
 crossbeam = "0.8.0"
 # Developer tooling dependencies
-plotters = { version = "0.3.0", optional = true }
+plotters = { version = "0.3.0", default-features = false, optional = true }
 tabbycat = { version = "0.1", features = ["attributes"], optional = true }
 log = "0.4.17"
 
@@ -69,6 +70,9 @@ log = "0.4.17"
 ark-std = { version = "0.3.0" }
 env_logger = "0.8.0"
 
+# Legacy circuit compatibility
+halo2_legacy_pdqsort = { version = "0.1.0", optional = true }
+
 [dev-dependencies]
 assert_matches = "1.5"
 criterion = "0.3"
@@ -80,8 +84,15 @@ rand_core = { version = "0.6", default-features = false, features = ["getrandom"
 getrandom = { version = "0.2", features = ["js"] }
 
 [features]
-default = ["batch", "gwc"]
+default = ["batch", "gwc", "multicore"]
+multicore = ["maybe-rayon/threads"]
 dev-graph = ["plotters", "tabbycat"]
+test-dev-graph = [
+    "dev-graph",
+    "plotters/bitmap_backend",
+    "plotters/bitmap_encoder",
+    "plotters/ttf",
+]
 gadget-traces = ["backtrace"]
 thread-safe-region = []
 sanity-checks = []
@@ -99,6 +110,4 @@ bench = false
 
 [[example]]
 name = "circuit-layout"
-required-features = ["dev-graph"]
-
-
+required-features = ["test-dev-graph"]
diff --git a/halo2_proofs/README.md b/halo2_proofs/README.md
index 7c226ff24c..7aeebeb849 100644
--- a/halo2_proofs/README.md
+++ b/halo2_proofs/README.md
@@ -4,7 +4,7 @@
 
 ## Minimum Supported Rust Version
 
-Requires Rust **1.56.1** or higher.
+Requires Rust **1.65.0** or higher.
 
 Minimum supported Rust version can be changed in the future, but it will be done with a
 minor version bump.
@@ -15,6 +15,10 @@ minor version bump.
 computation. The `RAYON_NUM_THREADS` environment variable can be used to set the number of
 threads.
 
+You can disable `rayon` by disabling the `"multicore"` feature.
+Warning! Halo2 will lose access to parallelism if you disable the `"multicore"` feature.
+This will significantly degrade performance.
+
 ## License
 
 Licensed under either of
diff --git a/halo2_proofs/benches/commit_zk.rs b/halo2_proofs/benches/commit_zk.rs
index 3496dbd4be..bdf5c88a51 100644
--- a/halo2_proofs/benches/commit_zk.rs
+++ b/halo2_proofs/benches/commit_zk.rs
@@ -2,12 +2,20 @@ extern crate criterion;
 
 use criterion::{criterion_group, criterion_main, BenchmarkId, Criterion};
 use group::ff::Field;
-use halo2_proofs::*;
+use halo2_proofs::arithmetic::parallelize;
 use halo2curves::pasta::pallas::Scalar;
 use rand_chacha::rand_core::RngCore;
 use rand_chacha::ChaCha20Rng;
 use rand_core::SeedableRng;
-use rayon::{current_num_threads, prelude::*};
+use std::{collections::HashMap, iter};
+
+#[cfg(feature = "multicore")]
+use maybe_rayon::current_num_threads;
+
+#[cfg(not(feature = "multicore"))]
+fn current_num_threads() -> usize {
+    1
+}
 
 fn rand_poly_serial(mut rng: ChaCha20Rng, domain: usize) -> Vec<Scalar> {
     // Sample a random polynomial of degree n - 1
@@ -21,25 +29,33 @@ fn rand_poly_serial(mut rng: ChaCha20Rng, domain: usize) -> Vec<Scalar> {
 
 fn rand_poly_par(mut rng: ChaCha20Rng, domain: usize) -> Vec<Scalar> {
     // Sample a random polynomial of degree n - 1
-    let n_threads = current_num_threads();
-    let n = 1usize << domain;
-    let n_chunks = n_threads + usize::from(n % n_threads != 0);
-    let mut rand_vec = vec![Scalar::zero(); n];
+    let n = 1usize << domain as usize;
+    let mut random_poly = vec![Scalar::ZERO; n];
 
-    let mut thread_seeds: Vec<ChaCha20Rng> = (0..n_chunks)
-        .map(|_| {
+    let num_threads = current_num_threads();
+    let chunk_size = n / num_threads;
+    let thread_seeds = (0..)
+        .step_by(chunk_size + 1)
+        .take(n % num_threads)
+        .chain(
+            (chunk_size != 0)
+                .then(|| ((n % num_threads) * (chunk_size + 1)..).step_by(chunk_size))
+                .into_iter()
+                .flatten(),
+        )
+        .take(num_threads)
+        .zip(iter::repeat_with(|| {
             let mut seed = [0u8; 32];
             rng.fill_bytes(&mut seed);
             ChaCha20Rng::from_seed(seed)
-        })
-        .collect();
+        }))
+        .collect::<HashMap<_, _>>();
 
-    thread_seeds
-        .par_iter_mut()
-        .zip_eq(rand_vec.par_chunks_mut(n / n_threads))
-        .for_each(|(mut rng, chunk)| chunk.iter_mut().for_each(|v| *v = Scalar::random(&mut rng)));
-
-    rand_vec
+    parallelize(&mut random_poly, |chunk, offset| {
+        let mut rng = thread_seeds[&offset].clone();
+        chunk.iter_mut().for_each(|v| *v = Scalar::random(&mut rng));
+    });
+    random_poly
 }
 
 fn bench_commit(c: &mut Criterion) {
diff --git a/halo2_proofs/examples/vector-mul.rs b/halo2_proofs/examples/vector-mul.rs
index 23dc6d274e..4b971dc97f 100644
--- a/halo2_proofs/examples/vector-mul.rs
+++ b/halo2_proofs/examples/vector-mul.rs
@@ -180,7 +180,7 @@ impl<F: Field> NumericInstructions<F> for FieldChip<F> {
 
         #[cfg(feature = "thread-safe-region")]
         {
-            use rayon::prelude::{
+            use maybe_rayon::prelude::{
                 IndexedParallelIterator, IntoParallelRefIterator, ParallelIterator,
             };
             layouter.assign_region(
diff --git a/halo2_proofs/src/arithmetic.rs b/halo2_proofs/src/arithmetic.rs
index 5d55eaed15..f831aa48fd 100644
--- a/halo2_proofs/src/arithmetic.rs
+++ b/halo2_proofs/src/arithmetic.rs
@@ -53,7 +53,7 @@ fn multiexp_serial<C: CurveAffine>(coeffs: &[C::Scalar], bases: &[C], acc: &mut
 
         let mut tmp = u64::from_le_bytes(v);
         tmp >>= skip_bits - (skip_bytes * 8);
-        tmp = tmp % (1 << c);
+        tmp %= 1 << c;
 
         tmp as usize
     }
@@ -112,7 +112,7 @@ fn multiexp_serial<C: CurveAffine>(coeffs: &[C::Scalar], bases: &[C], acc: &mut
         let mut running_sum = C::Curve::identity();
         for exp in buckets.into_iter().rev() {
             running_sum = exp.add(running_sum);
-            *acc = *acc + &running_sum;
+            *acc += &running_sum;
         }
     }
 }
diff --git a/halo2_proofs/src/circuit.rs b/halo2_proofs/src/circuit.rs
index 969e27d24c..f966e15634 100644
--- a/halo2_proofs/src/circuit.rs
+++ b/halo2_proofs/src/circuit.rs
@@ -1,6 +1,6 @@
 //! Traits and structs for implementing circuit components.
 
-use std::{convert::TryInto, fmt, marker::PhantomData};
+use std::{fmt, marker::PhantomData};
 
 use ff::Field;
 
@@ -14,9 +14,11 @@ pub use value::Value;
 
 pub mod floor_planner;
 pub use floor_planner::single_pass::SimpleFloorPlanner;
-pub use floor_planner::single_pass::SimpleTableLayouter;
 
 pub mod layouter;
+mod table_layouter;
+
+pub use table_layouter::{SimpleTableLayouter, TableLayouter};
 
 /// A chip implements a set of instructions that can be used by gadgets.
 ///
@@ -315,6 +317,19 @@ impl<'r, F: Field> Region<'r, F> {
         })
     }
 
+    /// Returns the value of the instance column's cell at absolute location `row`.
+    ///
+    /// This method is only provided for convenience; it does not create any constraints.
+    /// Callers still need to use [`Self::assign_advice_from_instance`] to constrain the
+    /// instance values in their circuit.
+    pub fn instance_value(
+        &mut self,
+        instance: Column<Instance>,
+        row: usize,
+    ) -> Result<Value<F>, Error> {
+        self.region.instance_value(instance, row)
+    }
+
     /// Assign a fixed value.
     ///
     /// Even though `to` has `FnMut` bounds, it is guaranteed to be called at most once.
@@ -370,11 +385,11 @@ impl<'r, F: Field> Region<'r, F> {
 /// A lookup table in the circuit.
 #[derive(Debug)]
 pub struct Table<'r, F: Field> {
-    table: &'r mut dyn layouter::TableLayouter<F>,
+    table: &'r mut dyn TableLayouter<F>,
 }
 
-impl<'r, F: Field> From<&'r mut dyn layouter::TableLayouter<F>> for Table<'r, F> {
-    fn from(table: &'r mut dyn layouter::TableLayouter<F>) -> Self {
+impl<'r, F: Field> From<&'r mut dyn TableLayouter<F>> for Table<'r, F> {
+    fn from(table: &'r mut dyn TableLayouter<F>) -> Self {
         Table { table }
     }
 }
diff --git a/halo2_proofs/src/circuit/floor_planner/single_pass.rs b/halo2_proofs/src/circuit/floor_planner/single_pass.rs
index 25b498470c..2d7d4afe98 100644
--- a/halo2_proofs/src/circuit/floor_planner/single_pass.rs
+++ b/halo2_proofs/src/circuit/floor_planner/single_pass.rs
@@ -13,6 +13,7 @@ use ark_std::{end_timer, start_timer};
 use crate::{
     circuit::{
         layouter::{RegionColumn, RegionLayouter, RegionShape, SyncDeps, TableLayouter},
+        table_layouter::{compute_table_lengths, SimpleTableLayouter},
         Cell, Layouter, Region, RegionIndex, RegionStart, Table, Value,
     },
     multicore,
@@ -369,24 +370,7 @@ impl<'a, F: Field, CS: Assignment<F> + 'a + SyncDeps> Layouter<F>
 
         // Check that all table columns have the same length `first_unused`,
         // and all cells up to that length are assigned.
-        let first_unused = {
-            match default_and_assigned
-                .values()
-                .map(|(_, assigned)| {
-                    if assigned.iter().all(|b| *b) {
-                        Some(assigned.len())
-                    } else {
-                        None
-                    }
-                })
-                .reduce(|acc, item| match (acc, item) {
-                    (Some(a), Some(b)) if a == b => Some(a),
-                    _ => None,
-                }) {
-                Some(Some(len)) => len,
-                _ => return Err(Error::Synthesis), // TODO better error
-            }
-        };
+        let first_unused = compute_table_lengths(&default_and_assigned)?;
 
         // Record these columns so that we can prevent them from being used again.
         for column in default_and_assigned.keys() {
@@ -467,11 +451,6 @@ impl<'r, 'a, F: Field, CS: Assignment<F> + 'a> SingleChipLayouterRegion<'r, 'a,
     }
 }
 
-impl<'r, 'a, F: Field, CS: Assignment<F> + 'a + SyncDeps> SyncDeps
-    for SingleChipLayouterRegion<'r, 'a, F, CS>
-{
-}
-
 impl<'r, 'a, F: Field, CS: Assignment<F> + 'a + SyncDeps> RegionLayouter<F>
     for SingleChipLayouterRegion<'r, 'a, F, CS>
 {
@@ -553,6 +532,14 @@ impl<'r, 'a, F: Field, CS: Assignment<F> + 'a + SyncDeps> RegionLayouter<F>
         Ok((cell, value))
     }
 
+    fn instance_value(
+        &mut self,
+        instance: Column<Instance>,
+        row: usize,
+    ) -> Result<Value<F>, Error> {
+        self.layouter.cs.query_instance(instance, row)
+    }
+
     fn assign_fixed<'v>(
         &'v mut self,
         annotation: &'v (dyn Fn() -> String + 'v),
@@ -591,88 +578,6 @@ impl<'r, 'a, F: Field, CS: Assignment<F> + 'a + SyncDeps> RegionLayouter<F>
     }
 }
 
-/// The default value to fill a table column with.
-///
-/// - The outer `Option` tracks whether the value in row 0 of the table column has been
-///   assigned yet. This will always be `Some` once a valid table has been completely
-///   assigned.
-/// - The inner `Value` tracks whether the underlying `Assignment` is evaluating
-///   witnesses or not.
-type DefaultTableValue<F> = Option<Value<Assigned<F>>>;
-
-/// A table layouter that can be used to assign values to a table.
-pub struct SimpleTableLayouter<'r, 'a, F: Field, CS: Assignment<F> + 'a> {
-    cs: &'a mut CS,
-    used_columns: &'r [TableColumn],
-    /// maps from a fixed column to a pair (default value, vector saying which rows are assigned)
-    pub default_and_assigned: HashMap<TableColumn, (DefaultTableValue<F>, Vec<bool>)>,
-}
-
-impl<'r, 'a, F: Field, CS: Assignment<F> + 'a> fmt::Debug for SimpleTableLayouter<'r, 'a, F, CS> {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.debug_struct("SimpleTableLayouter")
-            .field("used_columns", &self.used_columns)
-            .field("default_and_assigned", &self.default_and_assigned)
-            .finish()
-    }
-}
-
-impl<'r, 'a, F: Field, CS: Assignment<F> + 'a> SimpleTableLayouter<'r, 'a, F, CS> {
-    /// Returns a new SimpleTableLayouter
-    pub fn new(cs: &'a mut CS, used_columns: &'r [TableColumn]) -> Self {
-        SimpleTableLayouter {
-            cs,
-            used_columns,
-            default_and_assigned: HashMap::default(),
-        }
-    }
-}
-
-impl<'r, 'a, F: Field, CS: Assignment<F> + 'a> TableLayouter<F>
-    for SimpleTableLayouter<'r, 'a, F, CS>
-{
-    fn assign_cell<'v>(
-        &'v mut self,
-        annotation: &'v (dyn Fn() -> String + 'v),
-        column: TableColumn,
-        offset: usize,
-        to: &'v mut (dyn FnMut() -> Value<Assigned<F>> + 'v),
-    ) -> Result<(), Error> {
-        if self.used_columns.contains(&column) {
-            return Err(Error::Synthesis); // TODO better error
-        }
-
-        let entry = self.default_and_assigned.entry(column).or_default();
-
-        let mut value = Value::unknown();
-        self.cs.assign_fixed(
-            annotation,
-            column.inner(),
-            offset, // tables are always assigned starting at row 0
-            || {
-                let res = to();
-                value = res;
-                res
-            },
-        )?;
-
-        match (entry.0.is_none(), offset) {
-            // Use the value at offset 0 as the default value for this table column.
-            (true, 0) => entry.0 = Some(value),
-            // Since there is already an existing default value for this table column,
-            // the caller should not be attempting to assign another value at offset 0.
-            (false, 0) => return Err(Error::Synthesis), // TODO better error
-            _ => (),
-        }
-        if entry.1.len() <= offset {
-            entry.1.resize(offset + 1, false);
-        }
-        entry.1[offset] = true;
-
-        Ok(())
-    }
-}
-
 #[cfg(test)]
 mod tests {
     use halo2curves::pasta::vesta;
diff --git a/halo2_proofs/src/circuit/floor_planner/v1.rs b/halo2_proofs/src/circuit/floor_planner/v1.rs
index 5cff85f5ba..15c78c2230 100644
--- a/halo2_proofs/src/circuit/floor_planner/v1.rs
+++ b/halo2_proofs/src/circuit/floor_planner/v1.rs
@@ -4,8 +4,8 @@ use ff::Field;
 
 use crate::{
     circuit::{
-        floor_planner::single_pass::SimpleTableLayouter,
         layouter::{RegionColumn, RegionLayouter, RegionShape, SyncDeps, TableLayouter},
+        table_layouter::{compute_table_lengths, SimpleTableLayouter},
         Cell, Layouter, Region, RegionIndex, RegionStart, Table, Value,
     },
     plonk::{
@@ -342,24 +342,7 @@ impl<'p, 'a, F: Field, CS: Assignment<F> + SyncDeps> AssignmentPass<'p, 'a, F, C
 
         // Check that all table columns have the same length `first_unused`,
         // and all cells up to that length are assigned.
-        let first_unused = {
-            match default_and_assigned
-                .values()
-                .map(|(_, assigned)| {
-                    if assigned.iter().all(|b| *b) {
-                        Some(assigned.len())
-                    } else {
-                        None
-                    }
-                })
-                .reduce(|acc, item| match (acc, item) {
-                    (Some(a), Some(b)) if a == b => Some(a),
-                    _ => None,
-                }) {
-                Some(Some(len)) => len,
-                _ => return Err(Error::Synthesis), // TODO better error
-            }
-        };
+        let first_unused = compute_table_lengths(&default_and_assigned)?;
 
         // Record these columns so that we can prevent them from being used again.
         for column in default_and_assigned.keys() {
@@ -413,8 +396,6 @@ impl<'r, 'a, F: Field, CS: Assignment<F> + 'a> V1Region<'r, 'a, F, CS> {
     }
 }
 
-impl<'r, 'a, F: Field, CS: Assignment<F> + SyncDeps> SyncDeps for V1Region<'r, 'a, F, CS> {}
-
 impl<'r, 'a, F: Field, CS: Assignment<F> + SyncDeps> RegionLayouter<F> for V1Region<'r, 'a, F, CS> {
     fn enable_selector<'v>(
         &'v mut self,
@@ -486,6 +467,14 @@ impl<'r, 'a, F: Field, CS: Assignment<F> + SyncDeps> RegionLayouter<F> for V1Reg
         Ok((cell, value))
     }
 
+    fn instance_value(
+        &mut self,
+        instance: Column<Instance>,
+        row: usize,
+    ) -> Result<Value<F>, Error> {
+        self.plan.cs.query_instance(instance, row)
+    }
+
     fn assign_fixed<'v>(
         &'v mut self,
         annotation: &'v (dyn Fn() -> String + 'v),
diff --git a/halo2_proofs/src/circuit/floor_planner/v1/strategy.rs b/halo2_proofs/src/circuit/floor_planner/v1/strategy.rs
index f9acd0f57d..71745de245 100644
--- a/halo2_proofs/src/circuit/floor_planner/v1/strategy.rs
+++ b/halo2_proofs/src/circuit/floor_planner/v1/strategy.rs
@@ -199,7 +199,7 @@ pub fn slot_in_biggest_advice_first(
     region_shapes: Vec<RegionShape>,
 ) -> (Vec<RegionStart>, CircuitAllocations) {
     let mut sorted_regions: Vec<_> = region_shapes.into_iter().collect();
-    sorted_regions.sort_unstable_by_key(|shape| {
+    let sort_key = |shape: &RegionShape| {
         // Count the number of advice columns
         let advice_cols = shape
             .columns()
@@ -211,7 +211,24 @@ pub fn slot_in_biggest_advice_first(
             .count();
         // Sort by advice area (since this has the most contention).
         advice_cols * shape.row_count()
-    });
+    };
+
+    // This used to incorrectly use `sort_unstable_by_key` with non-unique keys, which gave
+    // output that differed between 32-bit and 64-bit platforms, and potentially between Rust
+    // versions.
+    // We now use `sort_by_cached_key` with non-unique keys, and rely on `region_shapes`
+    // being sorted by region index (which we also rely on below to return `RegionStart`s
+    // in the correct order).
+    #[cfg(not(feature = "floor-planner-v1-legacy-pdqsort"))]
+    sorted_regions.sort_by_cached_key(sort_key);
+
+    // To preserve compatibility, when the "floor-planner-v1-legacy-pdqsort" feature is enabled,
+    // we use a copy of the pdqsort implementation from the Rust 1.56.1 standard library, fixed
+    // to its behaviour on 64-bit platforms.
+    // https://github.com/rust-lang/rust/blob/1.56.1/library/core/src/slice/mod.rs#L2365-L2402
+    #[cfg(feature = "floor-planner-v1-legacy-pdqsort")]
+    halo2_legacy_pdqsort::sort::quicksort(&mut sorted_regions, |a, b| sort_key(a).lt(&sort_key(b)));
+
     sorted_regions.reverse();
 
     // Lay out the sorted regions.
diff --git a/halo2_proofs/src/circuit/layouter.rs b/halo2_proofs/src/circuit/layouter.rs
index e9eac92aef..f939c3fca5 100644
--- a/halo2_proofs/src/circuit/layouter.rs
+++ b/halo2_proofs/src/circuit/layouter.rs
@@ -6,17 +6,24 @@ use std::fmt;
 
 use ff::Field;
 
+pub use super::table_layouter::TableLayouter;
 use super::{Cell, RegionIndex, Value};
-use crate::plonk::{Advice, Any, Assigned, Column, Error, Fixed, Instance, Selector, TableColumn};
+use crate::plonk::{Advice, Any, Assigned, Column, Error, Fixed, Instance, Selector};
 
 /// Intermediate trait requirements for [`RegionLayouter`] when thread-safe regions are enabled.
 #[cfg(feature = "thread-safe-region")]
 pub trait SyncDeps: Send + Sync {}
 
+#[cfg(feature = "thread-safe-region")]
+impl<T: Send + Sync> SyncDeps for T {}
+
 /// Intermediate trait requirements for [`RegionLayouter`].
 #[cfg(not(feature = "thread-safe-region"))]
 pub trait SyncDeps {}
 
+#[cfg(not(feature = "thread-safe-region"))]
+impl<T> SyncDeps for T {}
+
 /// Helper trait for implementing a custom [`Layouter`].
 ///
 /// This trait is used for implementing region assignments:
@@ -92,7 +99,8 @@ pub trait RegionLayouter<F: Field>: fmt::Debug + SyncDeps {
     /// Assign the value of the instance column's cell at absolute location
     /// `row` to the column `advice` at `offset` within this region.
     ///
-    /// Returns the advice cell, and its value if known.
+    /// Returns the advice cell that has been equality-constrained to the
+    /// instance cell, and its value if known.
     fn assign_advice_from_instance<'v>(
         &mut self,
         annotation: &'v (dyn Fn() -> String + 'v),
@@ -102,7 +110,11 @@ pub trait RegionLayouter<F: Field>: fmt::Debug + SyncDeps {
         offset: usize,
     ) -> Result<(Cell, Value<F>), Error>;
 
-    /// Assign a fixed value
+    /// Returns the value of the instance column's cell at absolute location `row`.
+    fn instance_value(&mut self, instance: Column<Instance>, row: usize)
+        -> Result<Value<F>, Error>;
+
+    /// Assigns a fixed value
     fn assign_fixed<'v>(
         &'v mut self,
         annotation: &'v (dyn Fn() -> String + 'v),
@@ -122,24 +134,6 @@ pub trait RegionLayouter<F: Field>: fmt::Debug + SyncDeps {
     fn constrain_equal(&mut self, left: Cell, right: Cell) -> Result<(), Error>;
 }
 
-/// Helper trait for implementing a custom [`Layouter`].
-///
-/// This trait is used for implementing table assignments.
-///
-/// [`Layouter`]: super::Layouter
-pub trait TableLayouter<F: Field>: fmt::Debug {
-    /// Assigns a fixed value to a table cell.
-    ///
-    /// Returns an error if the table cell has already been assigned to.
-    fn assign_cell<'v>(
-        &'v mut self,
-        annotation: &'v (dyn Fn() -> String + 'v),
-        column: TableColumn,
-        offset: usize,
-        to: &'v mut (dyn FnMut() -> Value<Assigned<F>> + 'v),
-    ) -> Result<(), Error>;
-}
-
 /// The shape of a region. For a region at a certain index, we track
 /// the set of columns it uses as well as the number of rows it uses.
 #[derive(Clone, Debug)]
@@ -149,8 +143,6 @@ pub struct RegionShape {
     pub(super) row_count: usize,
 }
 
-impl SyncDeps for RegionShape {}
-
 /// The virtual column involved in a region. This includes concrete columns,
 /// as well as selectors that are not concrete columns at this stage.
 #[derive(Eq, PartialEq, Copy, Clone, Debug, Hash)]
@@ -278,6 +270,14 @@ impl<F: Field> RegionLayouter<F> for RegionShape {
         ))
     }
 
+    fn instance_value(
+        &mut self,
+        _instance: Column<Instance>,
+        _row: usize,
+    ) -> Result<Value<F>, Error> {
+        Ok(Value::unknown())
+    }
+
     fn assign_fixed<'v>(
         &'v mut self,
         _: &'v (dyn Fn() -> String + 'v),
diff --git a/halo2_proofs/src/circuit/table_layouter.rs b/halo2_proofs/src/circuit/table_layouter.rs
new file mode 100644
index 0000000000..5efe11735c
--- /dev/null
+++ b/halo2_proofs/src/circuit/table_layouter.rs
@@ -0,0 +1,413 @@
+//! Implementations of common table layouters.
+
+use std::{
+    collections::HashMap,
+    fmt::{self, Debug},
+};
+
+use ff::Field;
+
+use crate::plonk::{Assigned, Assignment, Error, TableColumn, TableError};
+
+use super::Value;
+
+/// Helper trait for implementing a custom [`Layouter`].
+///
+/// This trait is used for implementing table assignments.
+///
+/// [`Layouter`]: super::Layouter
+pub trait TableLayouter<F: Field>: std::fmt::Debug {
+    /// Assigns a fixed value to a table cell.
+    ///
+    /// Returns an error if the table cell has already been assigned to.
+    fn assign_cell<'v>(
+        &'v mut self,
+        annotation: &'v (dyn Fn() -> String + 'v),
+        column: TableColumn,
+        offset: usize,
+        to: &'v mut (dyn FnMut() -> Value<Assigned<F>> + 'v),
+    ) -> Result<(), Error>;
+}
+
+/// The default value to fill a table column with.
+///
+/// - The outer `Option` tracks whether the value in row 0 of the table column has been
+///   assigned yet. This will always be `Some` once a valid table has been completely
+///   assigned.
+/// - The inner `Value` tracks whether the underlying `Assignment` is evaluating
+///   witnesses or not.
+type DefaultTableValue<F> = Option<Value<Assigned<F>>>;
+
+/// A table layouter that can be used to assign values to a table.
+pub struct SimpleTableLayouter<'r, 'a, F: Field, CS: Assignment<F> + 'a> {
+    cs: &'a mut CS,
+    used_columns: &'r [TableColumn],
+    /// maps from a fixed column to a pair (default value, vector saying which rows are assigned)
+    pub default_and_assigned: HashMap<TableColumn, (DefaultTableValue<F>, Vec<bool>)>,
+}
+
+impl<'r, 'a, F: Field, CS: Assignment<F> + 'a> fmt::Debug for SimpleTableLayouter<'r, 'a, F, CS> {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("SimpleTableLayouter")
+            .field("used_columns", &self.used_columns)
+            .field("default_and_assigned", &self.default_and_assigned)
+            .finish()
+    }
+}
+
+impl<'r, 'a, F: Field, CS: Assignment<F> + 'a> SimpleTableLayouter<'r, 'a, F, CS> {
+    /// Returns a new SimpleTableLayouter
+    pub fn new(cs: &'a mut CS, used_columns: &'r [TableColumn]) -> Self {
+        SimpleTableLayouter {
+            cs,
+            used_columns,
+            default_and_assigned: HashMap::default(),
+        }
+    }
+}
+
+impl<'r, 'a, F: Field, CS: Assignment<F> + 'a> TableLayouter<F>
+    for SimpleTableLayouter<'r, 'a, F, CS>
+{
+    fn assign_cell<'v>(
+        &'v mut self,
+        annotation: &'v (dyn Fn() -> String + 'v),
+        column: TableColumn,
+        offset: usize,
+        to: &'v mut (dyn FnMut() -> Value<Assigned<F>> + 'v),
+    ) -> Result<(), Error> {
+        if self.used_columns.contains(&column) {
+            return Err(Error::TableError(TableError::UsedColumn(column)));
+        }
+
+        let entry = self.default_and_assigned.entry(column).or_default();
+
+        let mut value = Value::unknown();
+        self.cs.assign_fixed(
+            annotation,
+            column.inner(),
+            offset, // tables are always assigned starting at row 0
+            || {
+                let res = to();
+                value = res;
+                res
+            },
+        )?;
+
+        match (entry.0.is_none(), offset) {
+            // Use the value at offset 0 as the default value for this table column.
+            (true, 0) => entry.0 = Some(value),
+            // Since there is already an existing default value for this table column,
+            // the caller should not be attempting to assign another value at offset 0.
+            (false, 0) => {
+                return Err(Error::TableError(TableError::OverwriteDefault(
+                    column,
+                    format!("{:?}", entry.0.unwrap()),
+                    format!("{:?}", value),
+                )))
+            }
+            _ => (),
+        }
+        if entry.1.len() <= offset {
+            entry.1.resize(offset + 1, false);
+        }
+        entry.1[offset] = true;
+
+        Ok(())
+    }
+}
+
+pub(crate) fn compute_table_lengths<F: Debug>(
+    default_and_assigned: &HashMap<TableColumn, (DefaultTableValue<F>, Vec<bool>)>,
+) -> Result<usize, Error> {
+    let column_lengths: Result<Vec<_>, Error> = default_and_assigned
+        .iter()
+        .map(|(col, (default_value, assigned))| {
+            if default_value.is_none() || assigned.is_empty() {
+                return Err(Error::TableError(TableError::ColumnNotAssigned(*col)));
+            }
+            if assigned.iter().all(|b| *b) {
+                // All values in the column have been assigned
+                Ok((col, assigned.len()))
+            } else {
+                Err(Error::TableError(TableError::ColumnNotAssigned(*col)))
+            }
+        })
+        .collect();
+    let column_lengths = column_lengths?;
+    column_lengths
+        .into_iter()
+        .try_fold((None, 0), |acc, (col, col_len)| {
+            if acc.1 == 0 || acc.1 == col_len {
+                Ok((Some(*col), col_len))
+            } else {
+                let mut cols = [(*col, col_len), (acc.0.unwrap(), acc.1)];
+                cols.sort();
+                Err(Error::TableError(TableError::UnevenColumnLengths(
+                    cols[0], cols[1],
+                )))
+            }
+        })
+        .map(|col_len| col_len.1)
+}
+
+#[cfg(test)]
+mod tests {
+    use halo2curves::pasta::Fp;
+
+    use crate::{
+        circuit::{Layouter, SimpleFloorPlanner},
+        dev::MockProver,
+        plonk::{Circuit, ConstraintSystem},
+        poly::Rotation,
+    };
+
+    use super::*;
+
+    #[test]
+    fn table_no_default() {
+        const K: u32 = 4;
+
+        #[derive(Clone)]
+        struct FaultyCircuitConfig {
+            table: TableColumn,
+        }
+
+        struct FaultyCircuit;
+
+        impl Circuit<Fp> for FaultyCircuit {
+            type Config = FaultyCircuitConfig;
+            type FloorPlanner = SimpleFloorPlanner;
+            #[cfg(feature = "circuit-params")]
+            type Params = ();
+
+            fn without_witnesses(&self) -> Self {
+                Self
+            }
+
+            fn configure(meta: &mut ConstraintSystem<Fp>) -> Self::Config {
+                let a = meta.advice_column();
+                let table = meta.lookup_table_column();
+
+                meta.lookup("", |cells| {
+                    let a = cells.query_advice(a, Rotation::cur());
+                    vec![(a, table)]
+                });
+
+                Self::Config { table }
+            }
+
+            fn synthesize(
+                &self,
+                config: Self::Config,
+                mut layouter: impl Layouter<Fp>,
+            ) -> Result<(), Error> {
+                layouter.assign_table(
+                    || "duplicate assignment",
+                    |mut table| {
+                        table.assign_cell(
+                            || "default",
+                            config.table,
+                            1,
+                            || Value::known(Fp::zero()),
+                        )
+                    },
+                )
+            }
+        }
+
+        let prover = MockProver::run(K, &FaultyCircuit, vec![]);
+        assert_eq!(
+            format!("{}", prover.unwrap_err()),
+            "TableColumn { inner: Column { index: 0, column_type: Fixed } } not fully assigned. Help: assign a value at offset 0."
+        );
+    }
+
+    #[test]
+    fn table_overwrite_default() {
+        const K: u32 = 4;
+
+        #[derive(Clone)]
+        struct FaultyCircuitConfig {
+            table: TableColumn,
+        }
+
+        struct FaultyCircuit;
+
+        impl Circuit<Fp> for FaultyCircuit {
+            type Config = FaultyCircuitConfig;
+            type FloorPlanner = SimpleFloorPlanner;
+            #[cfg(feature = "circuit-params")]
+            type Params = ();
+
+            fn without_witnesses(&self) -> Self {
+                Self
+            }
+
+            fn configure(meta: &mut ConstraintSystem<Fp>) -> Self::Config {
+                let a = meta.advice_column();
+                let table = meta.lookup_table_column();
+
+                meta.lookup("", |cells| {
+                    let a = cells.query_advice(a, Rotation::cur());
+                    vec![(a, table)]
+                });
+
+                Self::Config { table }
+            }
+
+            fn synthesize(
+                &self,
+                config: Self::Config,
+                mut layouter: impl Layouter<Fp>,
+            ) -> Result<(), Error> {
+                layouter.assign_table(
+                    || "duplicate assignment",
+                    |mut table| {
+                        table.assign_cell(
+                            || "default",
+                            config.table,
+                            0,
+                            || Value::known(Fp::zero()),
+                        )?;
+                        table.assign_cell(
+                            || "duplicate",
+                            config.table,
+                            0,
+                            || Value::known(Fp::zero()),
+                        )
+                    },
+                )
+            }
+        }
+
+        let prover = MockProver::run(K, &FaultyCircuit, vec![]);
+        assert_eq!(
+            format!("{}", prover.unwrap_err()),
+            "Attempted to overwrite default value Value { inner: Some(Trivial(0x0000000000000000000000000000000000000000000000000000000000000000)) } with Value { inner: Some(Trivial(0x0000000000000000000000000000000000000000000000000000000000000000)) } in TableColumn { inner: Column { index: 0, column_type: Fixed } }"
+        );
+    }
+
+    #[test]
+    fn table_reuse_column() {
+        const K: u32 = 4;
+
+        #[derive(Clone)]
+        struct FaultyCircuitConfig {
+            table: TableColumn,
+        }
+
+        struct FaultyCircuit;
+
+        impl Circuit<Fp> for FaultyCircuit {
+            type Config = FaultyCircuitConfig;
+            type FloorPlanner = SimpleFloorPlanner;
+            #[cfg(feature = "circuit-params")]
+            type Params = ();
+
+            fn without_witnesses(&self) -> Self {
+                Self
+            }
+
+            fn configure(meta: &mut ConstraintSystem<Fp>) -> Self::Config {
+                let a = meta.advice_column();
+                let table = meta.lookup_table_column();
+
+                meta.lookup("", |cells| {
+                    let a = cells.query_advice(a, Rotation::cur());
+                    vec![(a, table)]
+                });
+
+                Self::Config { table }
+            }
+
+            fn synthesize(
+                &self,
+                config: Self::Config,
+                mut layouter: impl Layouter<Fp>,
+            ) -> Result<(), Error> {
+                layouter.assign_table(
+                    || "first assignment",
+                    |mut table| {
+                        table.assign_cell(
+                            || "default",
+                            config.table,
+                            0,
+                            || Value::known(Fp::zero()),
+                        )
+                    },
+                )?;
+
+                layouter.assign_table(
+                    || "reuse",
+                    |mut table| {
+                        table.assign_cell(|| "reuse", config.table, 1, || Value::known(Fp::zero()))
+                    },
+                )
+            }
+        }
+
+        let prover = MockProver::run(K, &FaultyCircuit, vec![]);
+        assert_eq!(
+            format!("{}", prover.unwrap_err()),
+            "TableColumn { inner: Column { index: 0, column_type: Fixed } } has already been used"
+        );
+    }
+
+    #[test]
+    fn table_uneven_columns() {
+        const K: u32 = 4;
+
+        #[derive(Clone)]
+        struct FaultyCircuitConfig {
+            table: (TableColumn, TableColumn),
+        }
+
+        struct FaultyCircuit;
+
+        impl Circuit<Fp> for FaultyCircuit {
+            type Config = FaultyCircuitConfig;
+            type FloorPlanner = SimpleFloorPlanner;
+            #[cfg(feature = "circuit-params")]
+            type Params = ();
+
+            fn without_witnesses(&self) -> Self {
+                Self
+            }
+
+            fn configure(meta: &mut ConstraintSystem<Fp>) -> Self::Config {
+                let a = meta.advice_column();
+                let table = (meta.lookup_table_column(), meta.lookup_table_column());
+                meta.lookup("", |cells| {
+                    let a = cells.query_advice(a, Rotation::cur());
+
+                    vec![(a.clone(), table.0), (a, table.1)]
+                });
+
+                Self::Config { table }
+            }
+
+            fn synthesize(
+                &self,
+                config: Self::Config,
+                mut layouter: impl Layouter<Fp>,
+            ) -> Result<(), Error> {
+                layouter.assign_table(
+                    || "table with uneven columns",
+                    |mut table| {
+                        table.assign_cell(|| "", config.table.0, 0, || Value::known(Fp::zero()))?;
+                        table.assign_cell(|| "", config.table.0, 1, || Value::known(Fp::zero()))?;
+
+                        table.assign_cell(|| "", config.table.1, 0, || Value::known(Fp::zero()))
+                    },
+                )
+            }
+        }
+
+        let prover = MockProver::run(K, &FaultyCircuit, vec![]);
+        assert_eq!(
+            format!("{}", prover.unwrap_err()),
+            "TableColumn { inner: Column { index: 0, column_type: Fixed } } has length 2 while TableColumn { inner: Column { index: 1, column_type: Fixed } } has length 1"
+        );
+    }
+}
diff --git a/halo2_proofs/src/circuit/value.rs b/halo2_proofs/src/circuit/value.rs
index 1a1bf4f9a2..7052d8bc06 100644
--- a/halo2_proofs/src/circuit/value.rs
+++ b/halo2_proofs/src/circuit/value.rs
@@ -68,6 +68,11 @@ impl<V> Value<V> {
         }
     }
 
+    /// ONLY FOR INTERNAL CRATE USAGE; DO NOT EXPOSE!
+    pub(crate) fn into_option(self) -> Option<V> {
+        self.inner
+    }
+
     /// Enforces an assertion on the contained value, if known.
     ///
     /// The assertion is ignored if `self` is [`Value::unknown()`]. Do not try to enforce
diff --git a/halo2_proofs/src/dev.rs b/halo2_proofs/src/dev.rs
index c2b65cf8f8..1ad028f7ea 100644
--- a/halo2_proofs/src/dev.rs
+++ b/halo2_proofs/src/dev.rs
@@ -1,11 +1,9 @@
 //! Tools for developing circuits.
 
-use std::collections::BTreeMap;
 use std::collections::HashMap;
 use std::collections::HashSet;
-use std::fmt;
 use std::iter;
-use std::ops::{Add, DerefMut, Mul, Neg, Range};
+use std::ops::{Add, Mul, Neg, Range};
 use std::sync::Arc;
 use std::time::{Duration, Instant};
 
@@ -14,24 +12,21 @@ use ff::FromUniformBytes;
 use ff::{BatchInvert, Field};
 use group::Group;
 
-use crate::circuit::layouter::SyncDeps;
 use crate::plonk::permutation::keygen::Assembly;
 use crate::{
     circuit,
     plonk::{
         permutation,
         sealed::{self, SealedPhase},
-        Advice, Any, Assigned, Assignment, Challenge, Circuit, Column, ColumnType,
-        ConstraintSystem, Error, Expression, FirstPhase, Fixed, FloorPlanner, Instance, Phase,
-        Selector, ThirdPhase, VirtualCell,
+        Advice, Any, Assigned, Assignment, Challenge, Circuit, Column, ConstraintSystem, Error,
+        Expression, FirstPhase, Fixed, FloorPlanner, Instance, Phase, Selector,
     },
-    poly::Rotation,
 };
-use rayon::{
-    iter::{
-        IndexedParallelIterator, IntoParallelIterator, IntoParallelRefIterator, ParallelIterator,
-    },
-    slice::ParallelSliceMut,
+
+#[cfg(feature = "multicore")]
+use crate::multicore::{
+    IndexedParallelIterator, IntoParallelIterator, IntoParallelRefIterator, ParallelIterator,
+    ParallelSliceMut,
 };
 
 pub mod metadata;
@@ -48,6 +43,8 @@ mod gates;
 pub use gates::CircuitGates;
 
 use crate::two_dim_vec_to_vec_of_slice;
+mod tfp;
+pub use tfp::TracingFloorPlanner;
 
 #[cfg(feature = "dev-graph")]
 mod graph;
@@ -446,7 +443,7 @@ pub struct MockProver<'a, F: Field> {
     // This field is used only if the "phase_check" feature is turned on.
     advice_prev: Vec<Vec<CellValue<F>>>,
     // The instance cells in the circuit, arranged as [column][row].
-    instance: Vec<Vec<F>>,
+    instance: Vec<Vec<InstanceValue<F>>>,
 
     selectors_vec: Arc<Vec<Vec<bool>>>,
     selectors: Vec<&'a mut [bool]>,
@@ -464,6 +461,21 @@ pub struct MockProver<'a, F: Field> {
     current_phase: sealed::Phase, // crate::plonk::sealed::Phase,
 }
 
+#[derive(Debug, Clone, PartialEq, Eq)]
+enum InstanceValue<F: Field> {
+    Assigned(F),
+    Padding,
+}
+
+impl<F: Field> InstanceValue<F> {
+    fn value(&self) -> F {
+        match self {
+            InstanceValue::Assigned(v) => *v,
+            InstanceValue::Padding => F::ZERO,
+        }
+    }
+}
+
 impl<'a, F: Field> MockProver<'a, F> {
     fn in_phase<P: Phase>(&self, phase: P) -> bool {
         self.current_phase == phase.to_sealed()
@@ -689,7 +701,7 @@ impl<'a, F: Field> Assignment<F> for MockProver<'a, F> {
         self.instance
             .get(column.index())
             .and_then(|column| column.get(row))
-            .map(|v| circuit::Value::known(*v))
+            .map(|v| circuit::Value::known(v.value()))
             .ok_or(Error::BoundsFailure)
     }
 
@@ -945,13 +957,17 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
 
         let instance = instance
             .into_iter()
-            .map(|mut instance| {
+            .map(|instance| {
                 if instance.len() > n - (cs.blinding_factors() + 1) {
                     return Err(Error::InstanceTooLarge);
                 }
 
-                instance.resize(n, F::ZERO);
-                Ok(instance)
+                let mut instance_values = vec![InstanceValue::Padding; n];
+                for (idx, value) in instance.into_iter().enumerate() {
+                    instance_values[idx] = InstanceValue::Assigned(value);
+                }
+
+                Ok(instance_values)
             })
             .collect::<Result<Vec<_>, _>>()?;
 
@@ -1192,17 +1208,42 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
                                 // Determine where this cell should have been assigned.
                                 let cell_row = ((gate_row + n + cell.rotation.0) % n) as usize;
 
-                                // Check that it was assigned!
-                                if r.cells.get(&(cell.column, cell_row)).is_some() {
-                                    None
-                                } else {
-                                    Some(VerifyFailure::CellNotAssigned {
-                                        gate: (gate_index, gate.name()).into(),
-                                        region: (r_i, r.name.clone(), r.annotations.clone()).into(),
-                                        gate_offset: *selector_row,
-                                        column: cell.column,
-                                        offset: cell_row as isize - r.rows.unwrap().0 as isize,
-                                    })
+                                match cell.column.column_type() {
+                                    Any::Instance => {
+                                        // Handle instance cells, which are not in the region.
+                                        let instance_value =
+                                            &self.instance[cell.column.index()][cell_row];
+                                        match instance_value {
+                                            InstanceValue::Assigned(_) => None,
+                                            _ => Some(VerifyFailure::InstanceCellNotAssigned {
+                                                gate: (gate_index, gate.name()).into(),
+                                                region: (r_i, r.name.clone()).into(),
+                                                gate_offset: *selector_row,
+                                                column: cell.column.try_into().unwrap(),
+                                                row: cell_row,
+                                            }),
+                                        }
+                                    }
+                                    _ => {
+                                        // Check that it was assigned!
+                                        if r.cells.contains_key(&(cell.column, cell_row)) {
+                                            None
+                                        } else {
+                                            Some(VerifyFailure::CellNotAssigned {
+                                                gate: (gate_index, gate.name()).into(),
+                                                region: (
+                                                    r_i,
+                                                    r.name.clone(),
+                                                    r.annotations.clone(),
+                                                )
+                                                    .into(),
+                                                gate_offset: *selector_row,
+                                                column: cell.column,
+                                                offset: cell_row as isize
+                                                    - r.rows.unwrap().0 as isize,
+                                            })
+                                        }
+                                    }
                                 }
                             })
                         })
@@ -1314,7 +1355,8 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
                     let rotation = query.1 .0;
                     Value::Real(
                         self.instance[column_index]
-                            [(row as i32 + n + rotation) as usize % n as usize],
+                            [(row as i32 + n + rotation) as usize % n as usize]
+                            .value(),
                     )
                 },
                 &|challenge| Value::Real(self.challenges[challenge.index()]),
@@ -1503,7 +1545,10 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
                     .map(|c: &Column<Any>| match c.column_type() {
                         Any::Advice(_) => self.advice[c.index()][row],
                         Any::Fixed => self.fixed[c.index()][row],
-                        Any::Instance => CellValue::Assigned(self.instance[c.index()][row]),
+                        Any::Instance => {
+                            let cell: &InstanceValue<F> = &self.instance[c.index()][row];
+                            CellValue::Assigned(cell.value())
+                        }
                     })
                     .unwrap()
             };
@@ -1563,6 +1608,7 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
     /// Returns `Ok(())` if this `MockProver` is satisfied, or a list of errors indicating
     /// the reasons that the circuit is not satisfied.
     /// Constraints and lookup are checked at `usable_rows`, parallelly.
+    #[cfg(feature = "multicore")]
     pub fn verify_par(&self) -> Result<(), Vec<VerifyFailure>> {
         self.verify_at_rows_par(self.usable_rows.clone(), self.usable_rows.clone())
     }
@@ -1570,6 +1616,7 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
     /// Returns `Ok(())` if this `MockProver` is satisfied, or a list of errors indicating
     /// the reasons that the circuit is not satisfied.
     /// Constraints are only checked at `gate_row_ids`, and lookup inputs are only checked at `lookup_input_row_ids`, parallelly.
+    #[cfg(feature = "multicore")]
     pub fn verify_at_rows_par<I: Clone + Iterator<Item = usize>>(
         &self,
         gate_row_ids: I,
@@ -1623,23 +1670,44 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
                                         let cell_row =
                                             ((gate_row + n + cell.rotation.0) % n) as usize;
 
-                                        // Check that it was assigned!
-                                        if r.cells.contains_key(&(cell.column, cell_row)) {
-                                            None
-                                        } else {
-                                            Some(VerifyFailure::CellNotAssigned {
-                                                gate: (gate_index, gate.name()).into(),
-                                                region: (
-                                                    r_i,
-                                                    r.name.clone(),
-                                                    r.annotations.clone(),
-                                                )
-                                                    .into(),
-                                                gate_offset: *selector_row,
-                                                column: cell.column,
-                                                offset: cell_row as isize
-                                                    - r.rows.unwrap().0 as isize,
-                                            })
+                                        match cell.column.column_type() {
+                                            Any::Instance => {
+                                                // Handle instance cells, which are not in the region.
+                                                let instance_value =
+                                                    &self.instance[cell.column.index()][cell_row];
+                                                match instance_value {
+                                                    InstanceValue::Assigned(_) => None,
+                                                    _ => Some(
+                                                        VerifyFailure::InstanceCellNotAssigned {
+                                                            gate: (gate_index, gate.name()).into(),
+                                                            region: (r_i, r.name.clone()).into(),
+                                                            gate_offset: *selector_row,
+                                                            column: cell.column.try_into().unwrap(),
+                                                            row: cell_row,
+                                                        },
+                                                    ),
+                                                }
+                                            }
+                                            _ => {
+                                                // Check that it was assigned!
+                                                if r.cells.contains_key(&(cell.column, cell_row)) {
+                                                    None
+                                                } else {
+                                                    Some(VerifyFailure::CellNotAssigned {
+                                                        gate: (gate_index, gate.name()).into(),
+                                                        region: (
+                                                            r_i,
+                                                            r.name.clone(),
+                                                            r.annotations.clone(),
+                                                        )
+                                                            .into(),
+                                                        gate_offset: *selector_row,
+                                                        column: cell.column,
+                                                        offset: cell_row as isize
+                                                            - r.rows.unwrap().0 as isize,
+                                                    })
+                                                }
+                                            }
                                         }
                                     })
                                     .collect::<Vec<_>>()
@@ -1755,7 +1823,8 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
                 &|query| {
                     Value::Real(
                         self.instance[query.column_index]
-                            [(row as i32 + n + query.rotation.0) as usize % n as usize],
+                            [(row as i32 + n + query.rotation.0) as usize % n as usize]
+                            .value(),
                     )
                 },
                 &|challenge| Value::Real(self.challenges[challenge.index()]),
@@ -1940,7 +2009,10 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
                     .map(|c: &Column<Any>| match c.column_type() {
                         Any::Advice(_) => self.advice[c.index()][row],
                         Any::Fixed => self.fixed[c.index()][row],
-                        Any::Instance => CellValue::Assigned(self.instance[c.index()][row]),
+                        Any::Instance => {
+                            let cell: &InstanceValue<F> = &self.instance[c.index()][row];
+                            CellValue::Assigned(cell.value())
+                        }
                     })
                     .unwrap()
             };
@@ -2027,6 +2099,7 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
     /// ```ignore
     /// assert_eq!(prover.verify_par(), Ok(()));
     /// ```
+    #[cfg(feature = "multicore")]
     pub fn assert_satisfied_par(&self) {
         if let Err(errs) = self.verify_par() {
             for err in errs {
@@ -2048,6 +2121,7 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
     /// ```ignore
     /// assert_eq!(prover.verify_at_rows_par(), Ok(()));
     /// ```
+    #[cfg(feature = "multicore")]
     pub fn assert_satisfied_at_rows_par<I: Clone + Iterator<Item = usize>>(
         &self,
         gate_row_ids: I,
@@ -2668,5 +2742,3 @@ mod tests {
         )
     }
 }
-
-impl<'a, F: Field> SyncDeps for MockProver<'a, F> {}
diff --git a/halo2_proofs/src/dev/cost.rs b/halo2_proofs/src/dev/cost.rs
index 2a4d68f57a..dc1b6a4cc5 100644
--- a/halo2_proofs/src/dev/cost.rs
+++ b/halo2_proofs/src/dev/cost.rs
@@ -2,6 +2,7 @@
 
 use std::ops::Range;
 use std::{
+    cmp,
     collections::{HashMap, HashSet},
     iter,
     marker::PhantomData,
@@ -12,7 +13,7 @@ use ff::{Field, PrimeField};
 use group::prime::PrimeGroup;
 
 use crate::{
-    circuit::{layouter::SyncDeps, Value},
+    circuit::{layouter::RegionColumn, Value},
     plonk::{
         Advice, Any, Assigned, Assignment, Challenge, Circuit, Column, ConstraintSystem, Error,
         Fixed, FloorPlanner, Instance, Selector,
@@ -21,10 +22,11 @@ use crate::{
 };
 
 /// Measures a circuit to determine its costs, and explain what contributes to them.
+#[allow(dead_code)]
 #[derive(Debug)]
 pub struct CircuitCost<G: PrimeGroup, ConcreteCircuit: Circuit<G::Scalar>> {
     /// Power-of-2 bound on the number of rows in the circuit.
-    k: usize,
+    k: u32,
     /// Maximum degree of the circuit.
     max_deg: usize,
     /// Number of advice columns.
@@ -39,27 +41,141 @@ pub struct CircuitCost<G: PrimeGroup, ConcreteCircuit: Circuit<G::Scalar>> {
     permutation_cols: usize,
     /// Number of distinct sets of points in the multiopening argument.
     point_sets: usize,
+    /// Maximum rows used over all columns
+    max_rows: usize,
+    /// Maximum rows used over all advice columns
+    max_advice_rows: usize,
+    /// Maximum rows used over all fixed columns
+    max_fixed_rows: usize,
+    num_fixed_columns: usize,
+    num_advice_columns: usize,
+    num_instance_columns: usize,
+    num_total_columns: usize,
 
     _marker: PhantomData<(G, ConcreteCircuit)>,
 }
 
-struct Assembly {
-    selectors: Vec<Vec<bool>>,
+/// Region implementation used by Layout
+#[allow(dead_code)]
+#[derive(Debug)]
+pub(crate) struct LayoutRegion {
+    /// The name of the region. Not required to be unique.
+    pub(crate) name: String,
+    /// The columns used by this region.
+    pub(crate) columns: HashSet<RegionColumn>,
+    /// The row that this region starts on, if known.
+    pub(crate) offset: Option<usize>,
+    /// The number of rows that this region takes up.
+    pub(crate) rows: usize,
+    /// The cells assigned in this region.
+    pub(crate) cells: Vec<(RegionColumn, usize)>,
+}
+
+/// Cost and graphing layouter
+#[derive(Default, Debug)]
+pub(crate) struct Layout {
+    /// k = 1 << n
+    pub(crate) k: u32,
+    /// Regions of the layout
+    pub(crate) regions: Vec<LayoutRegion>,
+    current_region: Option<usize>,
+    /// Total row count
+    pub(crate) total_rows: usize,
+    /// Total advice rows
+    pub(crate) total_advice_rows: usize,
+    /// Total fixed rows
+    pub(crate) total_fixed_rows: usize,
+    /// Any cells assigned outside of a region.
+    pub(crate) loose_cells: Vec<(RegionColumn, usize)>,
+    /// Pairs of cells between which we have equality constraints.
+    pub(crate) equality: Vec<(Column<Any>, usize, Column<Any>, usize)>,
+    /// Selector assignments used for optimization pass
+    pub(crate) selectors: Vec<Vec<bool>>,
 }
 
-impl SyncDeps for Assembly {}
+impl Layout {
+    /// Creates a empty layout
+    pub fn new(k: u32, n: usize, num_selectors: usize) -> Self {
+        Layout {
+            k,
+            regions: vec![],
+            current_region: None,
+            total_rows: 0,
+            total_advice_rows: 0,
+            total_fixed_rows: 0,
+            /// Any cells assigned outside of a region.
+            loose_cells: vec![],
+            /// Pairs of cells between which we have equality constraints.
+            equality: vec![],
+            /// Selector assignments used for optimization pass
+            selectors: vec![vec![false; n]; num_selectors],
+        }
+    }
+
+    /// Update layout metadata
+    pub fn update(&mut self, column: RegionColumn, row: usize) {
+        self.total_rows = cmp::max(self.total_rows, row + 1);
+
+        if let RegionColumn::Column(col) = column {
+            match col.column_type() {
+                Any::Advice(_) => {
+                    self.total_advice_rows = cmp::max(self.total_advice_rows, row + 1)
+                }
+                Any::Fixed => self.total_fixed_rows = cmp::max(self.total_fixed_rows, row + 1),
+                _ => {}
+            }
+        }
+
+        if let Some(region) = self.current_region {
+            let region = &mut self.regions[region];
+            region.columns.insert(column);
+
+            // The region offset is the earliest row assigned to.
+            let mut offset = region.offset.unwrap_or(row);
+            if row < offset {
+                // The first row assigned was not at offset 0 within the region.
+                region.rows += offset - row;
+                offset = row;
+            }
+            // The number of rows in this region is the gap between the earliest and
+            // latest rows assigned.
+            region.rows = cmp::max(region.rows, row - offset + 1);
+            region.offset = Some(offset);
+
+            region.cells.push((column, row));
+        } else {
+            self.loose_cells.push((column, row));
+        }
+    }
+}
 
-impl<F: Field> Assignment<F> for Assembly {
-    fn enter_region<NR, N>(&mut self, _: N)
+impl<F: Field> Assignment<F> for Layout {
+    fn enter_region<NR, N>(&mut self, name_fn: N)
     where
         NR: Into<String>,
         N: FnOnce() -> NR,
     {
-        // Do nothing; we don't care about regions in this context.
+        assert!(self.current_region.is_none());
+        self.current_region = Some(self.regions.len());
+        self.regions.push(LayoutRegion {
+            name: name_fn().into(),
+            columns: HashSet::default(),
+            offset: None,
+            rows: 0,
+            cells: vec![],
+        })
+    }
+
+    fn annotate_column<A, AR>(&mut self, _: A, _: Column<Any>)
+    where
+        A: FnOnce() -> AR,
+        AR: Into<String>,
+    {
     }
 
     fn exit_region(&mut self) {
-        // Do nothing; we don't care about regions in this context.
+        assert!(self.current_region.is_some());
+        self.current_region = None;
     }
 
     fn enable_selector<A, AR>(&mut self, _: A, selector: &Selector, row: usize) -> Result<(), Error>
@@ -67,8 +183,13 @@ impl<F: Field> Assignment<F> for Assembly {
         A: FnOnce() -> AR,
         AR: Into<String>,
     {
-        self.selectors[selector.0][row] = true;
+        if let Some(cell) = self.selectors[selector.0].get_mut(row) {
+            *cell = true;
+        } else {
+            return Err(Error::not_enough_rows_available(self.k));
+        }
 
+        self.update((*selector).into(), row);
         Ok(())
     }
 
@@ -87,8 +208,8 @@ impl<F: Field> Assignment<F> for Assembly {
     fn assign_advice<V, VR, A, AR>(
         &mut self,
         _: A,
-        _: Column<Advice>,
-        _: usize,
+        column: Column<Advice>,
+        row: usize,
         _: V,
     ) -> Result<(), Error>
     where
@@ -97,14 +218,15 @@ impl<F: Field> Assignment<F> for Assembly {
         A: FnOnce() -> AR,
         AR: Into<String>,
     {
+        self.update(Column::<Any>::from(column).into(), row);
         Ok(())
     }
 
     fn assign_fixed<V, VR, A, AR>(
         &mut self,
         _: A,
-        _: Column<Fixed>,
-        _: usize,
+        column: Column<Fixed>,
+        row: usize,
         _: V,
     ) -> Result<(), Error>
     where
@@ -113,10 +235,18 @@ impl<F: Field> Assignment<F> for Assembly {
         A: FnOnce() -> AR,
         AR: Into<String>,
     {
+        self.update(Column::<Any>::from(column).into(), row);
         Ok(())
     }
 
-    fn copy(&mut self, _: Column<Any>, _: usize, _: Column<Any>, _: usize) -> Result<(), Error> {
+    fn copy(
+        &mut self,
+        l_col: Column<Any>,
+        l_row: usize,
+        r_col: Column<Any>,
+        r_row: usize,
+    ) -> Result<(), crate::plonk::Error> {
+        self.equality.push((l_col, l_row, r_col, r_row));
         Ok(())
     }
 
@@ -133,14 +263,6 @@ impl<F: Field> Assignment<F> for Assembly {
         Value::unknown()
     }
 
-    fn annotate_column<A, AR>(&mut self, _annotation: A, _column: Column<Any>)
-    where
-        A: FnOnce() -> AR,
-        AR: Into<String>,
-    {
-        // Do nothing
-    }
-
     fn push_namespace<NR, N>(&mut self, _: N)
     where
         NR: Into<String>,
@@ -158,24 +280,19 @@ impl<G: PrimeGroup, ConcreteCircuit: Circuit<G::Scalar>> CircuitCost<G, Concrete
     /// Measures a circuit with parameter constant `k`.
     ///
     /// Panics if `k` is not large enough for the circuit.
-    pub fn measure(k: usize, circuit: &ConcreteCircuit) -> Self {
+    pub fn measure(k: u32, circuit: &ConcreteCircuit) -> Self {
         // Collect the layout details.
         let mut cs = ConstraintSystem::default();
-        #[cfg(feature = "circuit-params")]
-        let config = ConcreteCircuit::configure_with_params(&mut cs, circuit.params());
-        #[cfg(not(feature = "circuit-params"))]
         let config = ConcreteCircuit::configure(&mut cs);
-        let mut assembly = Assembly {
-            selectors: vec![vec![false; 1 << k]; cs.num_selectors],
-        };
+        let mut layout = Layout::new(k, 1 << k, cs.num_selectors);
         ConcreteCircuit::FloorPlanner::synthesize(
-            &mut assembly,
+            &mut layout,
             circuit,
             config,
             cs.constants.clone(),
         )
         .unwrap();
-        let (cs, _) = cs.compress_selectors(assembly.selectors);
+        let (cs, _) = cs.compress_selectors(layout.selectors);
 
         assert!((1 << k) >= cs.minimum_rows());
 
@@ -231,6 +348,15 @@ impl<G: PrimeGroup, ConcreteCircuit: Circuit<G::Scalar>> CircuitCost<G, Concrete
             permutation_cols,
             point_sets: point_sets.len(),
             _marker: PhantomData::default(),
+            max_rows: layout.total_rows,
+            max_advice_rows: layout.total_advice_rows,
+            max_fixed_rows: layout.total_fixed_rows,
+            num_advice_columns: cs.num_advice_columns,
+            num_fixed_columns: cs.num_fixed_columns,
+            num_instance_columns: cs.num_instance_columns,
+            num_total_columns: cs.num_instance_columns
+                + cs.num_advice_columns
+                + cs.num_fixed_columns,
         }
     }
 
@@ -258,8 +384,11 @@ impl<G: PrimeGroup, ConcreteCircuit: Circuit<G::Scalar>> CircuitCost<G, Concrete
 
             // Global permutation argument:
             // - chunks commitments per instance
-            // - 2*chunks + (chunks - 1) evals per instance
-            equality: ProofContribution::new(chunks, 3 * chunks - 1),
+            // - 2 * chunks + (chunks - 1) evals per instance
+            equality: ProofContribution::new(
+                chunks,
+                if chunks == 0 { chunks } else { 3 * chunks - 1 },
+            ),
 
             _marker: PhantomData::default(),
         }
@@ -302,7 +431,7 @@ impl<G: PrimeGroup, ConcreteCircuit: Circuit<G::Scalar>> CircuitCost<G, Concrete
             // - inner product argument (2 * k round commitments)
             // - a
             // - xi
-            polycomm: ProofContribution::new(1 + 2 * self.k, 2),
+            polycomm: ProofContribution::new((1 + 2 * self.k).try_into().unwrap(), 2),
 
             _marker: PhantomData::default(),
         }
@@ -402,3 +531,40 @@ impl<G: PrimeGroup> From<ProofSize<G>> for usize {
             + proof.polycomm.len(point, scalar)
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use halo2curves::pasta::{Eq, Fp};
+
+    use crate::circuit::SimpleFloorPlanner;
+
+    use super::*;
+
+    #[test]
+    fn circuit_cost_without_permutation() {
+        const K: u32 = 4;
+
+        struct MyCircuit;
+        impl Circuit<Fp> for MyCircuit {
+            type Config = ();
+            type FloorPlanner = SimpleFloorPlanner;
+            #[cfg(feature = "circuit-params")]
+            type Params = ();
+
+            fn without_witnesses(&self) -> Self {
+                Self
+            }
+
+            fn configure(_meta: &mut ConstraintSystem<Fp>) -> Self::Config {}
+
+            fn synthesize(
+                &self,
+                _config: Self::Config,
+                _layouter: impl crate::circuit::Layouter<Fp>,
+            ) -> Result<(), Error> {
+                Ok(())
+            }
+        }
+        CircuitCost::<Eq, MyCircuit>::measure(K, &MyCircuit).proof_size(1);
+    }
+}
diff --git a/halo2_proofs/src/dev/failure.rs b/halo2_proofs/src/dev/failure.rs
index 81ce998172..ac0e79c01a 100644
--- a/halo2_proofs/src/dev/failure.rs
+++ b/halo2_proofs/src/dev/failure.rs
@@ -14,7 +14,6 @@ use crate::dev::metadata::Constraint;
 use crate::{
     dev::{Instance, Value},
     plonk::{Any, Column, ConstraintSystem, Expression, Gate},
-    poly::Rotation,
 };
 
 mod emitter;
@@ -101,16 +100,17 @@ impl FailureLocation {
             .iter()
             .enumerate()
             .find(|(_, r)| {
-                if r.rows.is_none() {
-                    return false;
+                if let Some((start, end)) = r.rows {
+                    // We match the region if any input columns overlap, rather than all of
+                    // them, because matching complex selector columns is hard. As long as
+                    // regions are rectangles, and failures occur due to assignments entirely
+                    // within single regions, "any" will be equivalent to "all". If these
+                    // assumptions change, we'll start getting bug reports from users :)
+                    (start..=end).contains(&failure_row) && !failure_columns.is_disjoint(&r.columns)
+                } else {
+                    // Zero-area region
+                    false
                 }
-                let (start, end) = r.rows.unwrap();
-                // We match the region if any input columns overlap, rather than all of
-                // them, because matching complex selector columns is hard. As long as
-                // regions are rectangles, and failures occur due to assignments entirely
-                // within single regions, "any" will be equivalent to "all". If these
-                // assumptions change, we'll start getting bug reports from users :)
-                (start..=end).contains(&failure_row) && !failure_columns.is_disjoint(&r.columns)
             })
             .map(|(r_i, r)| FailureLocation::InRegion {
                 region: (r_i, r.name.clone(), r.annotations.clone()).into(),
@@ -139,6 +139,20 @@ pub enum VerifyFailure {
         /// offset 0, but the gate uses `Rotation::prev()`).
         offset: isize,
     },
+    /// An instance cell used in an active gate was not assigned to.
+    InstanceCellNotAssigned {
+        /// The index of the active gate.
+        gate: metadata::Gate,
+        /// The region in which this gate was activated.
+        region: metadata::Region,
+        /// The offset (relative to the start of the region) at which the active gate
+        /// queries this cell.
+        gate_offset: usize,
+        /// The column in which this cell should be assigned.
+        column: Column<Instance>,
+        /// The absolute row at which this cell should be assigned.
+        row: usize,
+    },
     /// A constraint was not satisfied for a particular row.
     ConstraintNotSatisfied {
         /// The polynomial constraint that is not satisfied.
@@ -225,6 +239,19 @@ impl fmt::Display for VerifyFailure {
                     region, gate, gate_offset, column, offset, region.get_column_annotation((*column).into())
                 )
             }
+            Self::InstanceCellNotAssigned {
+                gate,
+                region,
+                gate_offset,
+                column,
+                row,
+            } => {
+                write!(
+                    f,
+                    "{} uses {} at offset {}, which requires cell in instance column {:?} at row {} to be assigned.",
+                    region, gate, gate_offset, column, row
+                )
+            }
             Self::ConstraintNotSatisfied {
                 constraint,
                 location,
diff --git a/halo2_proofs/src/dev/gates.rs b/halo2_proofs/src/dev/gates.rs
index fd4c039623..352415bcd9 100644
--- a/halo2_proofs/src/dev/gates.rs
+++ b/halo2_proofs/src/dev/gates.rs
@@ -7,10 +7,7 @@ use ff::PrimeField;
 
 use crate::{
     dev::util,
-    plonk::{
-        sealed::{self, SealedPhase},
-        Circuit, ConstraintSystem, FirstPhase,
-    },
+    plonk::{sealed::SealedPhase, Circuit, ConstraintSystem, FirstPhase},
 };
 
 #[derive(Debug)]
diff --git a/halo2_proofs/src/dev/graph.rs b/halo2_proofs/src/dev/graph.rs
index 688aaece16..7fbf9f2f6b 100644
--- a/halo2_proofs/src/dev/graph.rs
+++ b/halo2_proofs/src/dev/graph.rs
@@ -81,8 +81,6 @@ struct Graph {
     current_namespace: Vec<usize>,
 }
 
-impl crate::dev::SyncDeps for Graph {}
-
 impl<F: Field> Assignment<F> for Graph {
     fn enter_region<NR, N>(&mut self, _: N)
     where
diff --git a/halo2_proofs/src/dev/graph/layout.rs b/halo2_proofs/src/dev/graph/layout.rs
index 38f3304617..7d00434aa2 100644
--- a/halo2_proofs/src/dev/graph/layout.rs
+++ b/halo2_proofs/src/dev/graph/layout.rs
@@ -3,16 +3,13 @@ use plotters::{
     coord::Shift,
     prelude::{DrawingArea, DrawingAreaErrorKind, DrawingBackend},
 };
-use std::cmp;
 use std::collections::HashSet;
 use std::ops::Range;
 
 use crate::{
-    circuit::{layouter::RegionColumn, Value},
-    plonk::{
-        Advice, Any, Assigned, Assignment, Challenge, Circuit, Column, ConstraintSystem, Error,
-        Fixed, FloorPlanner, Instance, Selector,
-    },
+    circuit::layouter::RegionColumn,
+    dev::cost::Layout,
+    plonk::{Any, Circuit, Column, ConstraintSystem, FloorPlanner},
 };
 
 /// Graphical renderer for circuit layouts.
@@ -324,206 +321,3 @@ impl CircuitLayout {
         Ok(())
     }
 }
-
-#[derive(Debug)]
-struct Region {
-    /// The name of the region. Not required to be unique.
-    name: String,
-    /// The columns used by this region.
-    columns: HashSet<RegionColumn>,
-    /// The row that this region starts on, if known.
-    offset: Option<usize>,
-    /// The number of rows that this region takes up.
-    rows: usize,
-    /// The cells assigned in this region. We store this as a `Vec` so that if any cells
-    /// are double-assigned, they will be visibly darker.
-    cells: Vec<(RegionColumn, usize)>,
-}
-
-#[derive(Default)]
-struct Layout {
-    k: u32,
-    regions: Vec<Region>,
-    current_region: Option<usize>,
-    total_rows: usize,
-    /// Any cells assigned outside of a region. We store this as a `Vec` so that if any
-    /// cells are double-assigned, they will be visibly darker.
-    loose_cells: Vec<(RegionColumn, usize)>,
-    /// Pairs of cells between which we have equality constraints.
-    equality: Vec<(Column<Any>, usize, Column<Any>, usize)>,
-    /// Selector assignments used for optimization pass
-    selectors: Vec<Vec<bool>>,
-}
-
-impl crate::dev::SyncDeps for Layout {}
-
-impl Layout {
-    fn new(k: u32, n: usize, num_selectors: usize) -> Self {
-        Layout {
-            k,
-            regions: vec![],
-            current_region: None,
-            total_rows: 0,
-            /// Any cells assigned outside of a region. We store this as a `Vec` so that if any
-            /// cells are double-assigned, they will be visibly darker.
-            loose_cells: vec![],
-            /// Pairs of cells between which we have equality constraints.
-            equality: vec![],
-            /// Selector assignments used for optimization pass
-            selectors: vec![vec![false; n]; num_selectors],
-        }
-    }
-
-    fn update(&mut self, column: RegionColumn, row: usize) {
-        self.total_rows = cmp::max(self.total_rows, row + 1);
-
-        if let Some(region) = self.current_region {
-            let region = &mut self.regions[region];
-            region.columns.insert(column);
-
-            // The region offset is the earliest row assigned to.
-            let mut offset = region.offset.unwrap_or(row);
-            if row < offset {
-                // The first row assigned was not at offset 0 within the region.
-                region.rows += offset - row;
-                offset = row;
-            }
-            // The number of rows in this region is the gap between the earliest and
-            // latest rows assigned.
-            region.rows = cmp::max(region.rows, row - offset + 1);
-            region.offset = Some(offset);
-
-            region.cells.push((column, row));
-        } else {
-            self.loose_cells.push((column, row));
-        }
-    }
-}
-
-impl<F: Field> Assignment<F> for Layout {
-    fn enter_region<NR, N>(&mut self, name_fn: N)
-    where
-        NR: Into<String>,
-        N: FnOnce() -> NR,
-    {
-        assert!(self.current_region.is_none());
-        self.current_region = Some(self.regions.len());
-        self.regions.push(Region {
-            name: name_fn().into(),
-            columns: HashSet::default(),
-            offset: None,
-            rows: 0,
-            cells: vec![],
-        })
-    }
-
-    fn exit_region(&mut self) {
-        assert!(self.current_region.is_some());
-        self.current_region = None;
-    }
-
-    fn enable_selector<A, AR>(&mut self, _: A, selector: &Selector, row: usize) -> Result<(), Error>
-    where
-        A: FnOnce() -> AR,
-        AR: Into<String>,
-    {
-        if let Some(cell) = self.selectors[selector.0].get_mut(row) {
-            *cell = true;
-        } else {
-            return Err(Error::not_enough_rows_available(self.k));
-        }
-
-        self.update((*selector).into(), row);
-        Ok(())
-    }
-
-    fn fork(&mut self, _ranges: &[Range<usize>]) -> Result<Vec<Self>, Error> {
-        todo!()
-    }
-
-    fn merge(&mut self, _sub_cs: Vec<Self>) -> Result<(), Error> {
-        todo!()
-    }
-
-    fn query_instance(&self, _: Column<Instance>, _: usize) -> Result<Value<F>, Error> {
-        Ok(Value::unknown())
-    }
-
-    fn assign_advice<V, VR, A, AR>(
-        &mut self,
-        _: A,
-        column: Column<Advice>,
-        row: usize,
-        _: V,
-    ) -> Result<(), Error>
-    where
-        V: FnOnce() -> Value<VR>,
-        VR: Into<Assigned<F>>,
-        A: FnOnce() -> AR,
-        AR: Into<String>,
-    {
-        self.update(Column::<Any>::from(column).into(), row);
-        Ok(())
-    }
-
-    fn assign_fixed<V, VR, A, AR>(
-        &mut self,
-        _: A,
-        column: Column<Fixed>,
-        row: usize,
-        _: V,
-    ) -> Result<(), Error>
-    where
-        V: FnOnce() -> Value<VR>,
-        VR: Into<Assigned<F>>,
-        A: FnOnce() -> AR,
-        AR: Into<String>,
-    {
-        self.update(Column::<Any>::from(column).into(), row);
-        Ok(())
-    }
-
-    fn copy(
-        &mut self,
-        l_col: Column<Any>,
-        l_row: usize,
-        r_col: Column<Any>,
-        r_row: usize,
-    ) -> Result<(), crate::plonk::Error> {
-        self.equality.push((l_col, l_row, r_col, r_row));
-        Ok(())
-    }
-
-    fn fill_from_row(
-        &mut self,
-        _: Column<Fixed>,
-        _: usize,
-        _: Value<Assigned<F>>,
-    ) -> Result<(), Error> {
-        Ok(())
-    }
-
-    fn get_challenge(&self, _: Challenge) -> Value<F> {
-        Value::unknown()
-    }
-
-    fn annotate_column<A, AR>(&mut self, _annotation: A, _column: Column<Any>)
-    where
-        A: FnOnce() -> AR,
-        AR: Into<String>,
-    {
-        // Do nothing
-    }
-
-    fn push_namespace<NR, N>(&mut self, _: N)
-    where
-        NR: Into<String>,
-        N: FnOnce() -> NR,
-    {
-        // Do nothing; we don't care about namespaces in this context.
-    }
-
-    fn pop_namespace(&mut self, _: Option<String>) {
-        // Do nothing; we don't care about namespaces in this context.
-    }
-}
diff --git a/halo2_proofs/src/dev/tfp.rs b/halo2_proofs/src/dev/tfp.rs
new file mode 100644
index 0000000000..011ba3cac0
--- /dev/null
+++ b/halo2_proofs/src/dev/tfp.rs
@@ -0,0 +1,508 @@
+use std::{fmt, marker::PhantomData};
+
+use ff::Field;
+use tracing::{debug, debug_span, span::EnteredSpan};
+
+use crate::{
+    circuit::{
+        layouter::{RegionLayouter, SyncDeps},
+        AssignedCell, Cell, Layouter, Region, Table, Value,
+    },
+    plonk::{
+        Advice, Any, Assigned, Assignment, Challenge, Circuit, Column, ConstraintSystem, Error,
+        Fixed, FloorPlanner, Instance, Selector,
+    },
+};
+
+/// A helper type that augments a [`FloorPlanner`] with [`tracing`] spans and events.
+///
+/// `TracingFloorPlanner` can be used to instrument your circuit and determine exactly
+/// what is happening during a particular run of keygen or proving. This can be useful for
+/// identifying unexpected non-determinism or changes to a circuit.
+///
+/// # No stability guarantees
+///
+/// The `tracing` output is intended for use during circuit development. It should not be
+/// considered production-stable, and the precise format or data exposed may change at any
+/// time.
+///
+/// # Examples
+///
+/// ```
+/// use ff::Field;
+/// use halo2_proofs::{
+///     circuit::{floor_planner, Layouter, Value},
+///     dev::TracingFloorPlanner,
+///     plonk::{Circuit, ConstraintSystem, Error},
+/// };
+///
+/// # struct MyCircuit<F: Field> {
+/// #     some_witness: Value<F>,
+/// # };
+/// # #[derive(Clone)]
+/// # struct MyConfig;
+/// impl<F: Field> Circuit<F> for MyCircuit<F> {
+///     // Wrap `TracingFloorPlanner` around your existing floor planner of choice.
+///     //type FloorPlanner = floor_planner::V1;
+///     type FloorPlanner = TracingFloorPlanner<floor_planner::V1>;
+///
+///     // The rest of your `Circuit` implementation is unchanged.
+///     type Config = MyConfig;
+///
+///     #[cfg(feature = "circuit-params")]
+///     type Params = ();
+///
+///     fn without_witnesses(&self) -> Self {
+///         Self { some_witness: Value::unknown() }
+///     }
+///
+///     fn configure(meta: &mut ConstraintSystem<F>) -> Self::Config {
+///         // ..
+/// #       todo!()
+///     }
+///
+///     fn synthesize(&self, config: Self::Config, layouter: impl Layouter<F>) -> Result<(), Error> {
+///         // ..
+/// #       todo!()
+///     }
+/// }
+///
+/// #[test]
+/// fn some_circuit_test() {
+///     // At the start of your test, enable tracing.
+///     tracing_subscriber::fmt()
+///         .with_max_level(tracing::Level::DEBUG)
+///         .with_ansi(false)
+///         .without_time()
+///         .init();
+///
+///     // Now when the rest of the test runs, you will get `tracing` output for every
+///     // operation that the circuit performs under the hood!
+/// }
+/// ```
+#[derive(Debug)]
+pub struct TracingFloorPlanner<P: FloorPlanner> {
+    _phantom: PhantomData<P>,
+}
+
+impl<P: FloorPlanner> FloorPlanner for TracingFloorPlanner<P> {
+    fn synthesize<F: Field, CS: Assignment<F> + SyncDeps, C: Circuit<F>>(
+        cs: &mut CS,
+        circuit: &C,
+        config: C::Config,
+        constants: Vec<Column<Fixed>>,
+    ) -> Result<(), Error> {
+        P::synthesize(
+            &mut TracingAssignment::new(cs),
+            &TracingCircuit::borrowed(circuit),
+            config,
+            constants,
+        )
+    }
+}
+
+/// A helper type that augments a [`Circuit`] with [`tracing`] spans and events.
+enum TracingCircuit<'c, F: Field, C: Circuit<F>> {
+    Borrowed(&'c C, PhantomData<F>),
+    Owned(C, PhantomData<F>),
+}
+
+impl<'c, F: Field, C: Circuit<F>> TracingCircuit<'c, F, C> {
+    fn borrowed(circuit: &'c C) -> Self {
+        Self::Borrowed(circuit, PhantomData)
+    }
+
+    fn owned(circuit: C) -> Self {
+        Self::Owned(circuit, PhantomData)
+    }
+
+    fn inner_ref(&self) -> &C {
+        match self {
+            TracingCircuit::Borrowed(circuit, ..) => circuit,
+            TracingCircuit::Owned(circuit, ..) => circuit,
+        }
+    }
+}
+
+impl<'c, F: Field, C: Circuit<F>> Circuit<F> for TracingCircuit<'c, F, C> {
+    type Config = C::Config;
+    type FloorPlanner = C::FloorPlanner;
+    #[cfg(feature = "circuit-params")]
+    type Params = ();
+
+    fn without_witnesses(&self) -> Self {
+        Self::owned(self.inner_ref().without_witnesses())
+    }
+
+    fn configure(meta: &mut ConstraintSystem<F>) -> Self::Config {
+        let _span = debug_span!("configure").entered();
+        C::configure(meta)
+    }
+
+    fn synthesize(&self, config: Self::Config, layouter: impl Layouter<F>) -> Result<(), Error> {
+        let _span = debug_span!("synthesize").entered();
+        self.inner_ref()
+            .synthesize(config, TracingLayouter::new(layouter))
+    }
+}
+
+/// A helper type that augments a [`Layouter`] with [`tracing`] spans and events.
+struct TracingLayouter<F: Field, L: Layouter<F>> {
+    layouter: L,
+    namespace_spans: Vec<EnteredSpan>,
+    _phantom: PhantomData<F>,
+}
+
+impl<F: Field, L: Layouter<F>> TracingLayouter<F, L> {
+    fn new(layouter: L) -> Self {
+        Self {
+            layouter,
+            namespace_spans: vec![],
+            _phantom: PhantomData,
+        }
+    }
+}
+
+impl<F: Field, L: Layouter<F>> Layouter<F> for TracingLayouter<F, L> {
+    type Root = Self;
+
+    fn assign_region<A, AR, N, NR>(&mut self, name: N, mut assignment: A) -> Result<AR, Error>
+    where
+        A: FnMut(Region<'_, F>) -> Result<AR, Error>,
+        N: Fn() -> NR,
+        NR: Into<String>,
+    {
+        let _span = debug_span!("region", name = name().into()).entered();
+        self.layouter.assign_region(name, |region| {
+            let mut region = TracingRegion(region);
+            let region: &mut dyn RegionLayouter<F> = &mut region;
+            assignment(region.into())
+        })
+    }
+
+    fn assign_table<A, N, NR>(&mut self, name: N, assignment: A) -> Result<(), Error>
+    where
+        A: FnMut(Table<'_, F>) -> Result<(), Error>,
+        N: Fn() -> NR,
+        NR: Into<String>,
+    {
+        let _span = debug_span!("table", name = name().into()).entered();
+        self.layouter.assign_table(name, assignment)
+    }
+
+    fn constrain_instance(
+        &mut self,
+        cell: Cell,
+        column: Column<Instance>,
+        row: usize,
+    ) -> Result<(), Error> {
+        self.layouter.constrain_instance(cell, column, row)
+    }
+
+    fn get_challenge(&self, _: Challenge) -> Value<F> {
+        Value::unknown()
+    }
+
+    fn get_root(&mut self) -> &mut Self::Root {
+        self
+    }
+
+    fn push_namespace<NR, N>(&mut self, name_fn: N)
+    where
+        NR: Into<String>,
+        N: FnOnce() -> NR,
+    {
+        let name = name_fn().into();
+        self.namespace_spans.push(debug_span!("ns", name).entered());
+        self.layouter.push_namespace(|| name);
+    }
+
+    fn pop_namespace(&mut self, gadget_name: Option<String>) {
+        self.layouter.pop_namespace(gadget_name);
+        self.namespace_spans.pop();
+    }
+}
+
+fn debug_value_and_return_cell<F: Field, V: fmt::Debug>(value: AssignedCell<V, F>) -> Cell {
+    if let Some(v) = value.value().into_option() {
+        debug!(target: "assigned", value = ?v);
+    }
+    value.cell()
+}
+
+/// A helper type that augments a [`Region`] with [`tracing`] spans and events.
+#[derive(Debug)]
+struct TracingRegion<'r, F: Field>(Region<'r, F>);
+
+impl<'r, F: Field> RegionLayouter<F> for TracingRegion<'r, F> {
+    fn enable_selector<'v>(
+        &'v mut self,
+        annotation: &'v (dyn Fn() -> String + 'v),
+        selector: &Selector,
+        offset: usize,
+    ) -> Result<(), Error> {
+        let _guard = debug_span!("enable_selector", name = annotation(), offset = offset).entered();
+        debug!(target: "layouter", "Entered");
+        self.0.enable_selector(annotation, selector, offset)
+    }
+
+    fn name_column<'v>(
+        &'v mut self,
+        _: &'v (dyn std::ops::Fn() -> std::string::String + 'v),
+        _: Column<Any>,
+    ) {
+    }
+
+    fn assign_advice<'v>(
+        &'v mut self,
+        annotation: &'v (dyn Fn() -> String + 'v),
+        column: Column<Advice>,
+        offset: usize,
+        to: &'v mut (dyn FnMut() -> Value<Assigned<F>> + 'v),
+    ) -> Result<Cell, Error> {
+        let _guard =
+            debug_span!("assign_advice", name = annotation(), column = ?column, offset = offset)
+                .entered();
+        debug!(target: "layouter", "Entered");
+        self.0
+            .assign_advice(annotation, column, offset, to)
+            .map(debug_value_and_return_cell)
+    }
+
+    fn assign_advice_from_constant<'v>(
+        &'v mut self,
+        annotation: &'v (dyn Fn() -> String + 'v),
+        column: Column<Advice>,
+        offset: usize,
+        constant: Assigned<F>,
+    ) -> Result<Cell, Error> {
+        let _guard = debug_span!("assign_advice_from_constant",
+            name = annotation(),
+            column = ?column,
+            offset = offset,
+            constant = ?constant,
+        )
+        .entered();
+        debug!(target: "layouter", "Entered");
+        self.0
+            .assign_advice_from_constant(annotation, column, offset, constant)
+            .map(debug_value_and_return_cell)
+    }
+
+    fn assign_advice_from_instance<'v>(
+        &mut self,
+        annotation: &'v (dyn Fn() -> String + 'v),
+        instance: Column<Instance>,
+        row: usize,
+        advice: Column<Advice>,
+        offset: usize,
+    ) -> Result<(Cell, Value<F>), Error> {
+        let _guard = debug_span!("assign_advice_from_instance",
+            name = annotation(),
+            instance = ?instance,
+            row = row,
+            advice = ?advice,
+            offset = offset,
+        )
+        .entered();
+        debug!(target: "layouter", "Entered");
+        self.0
+            .assign_advice_from_instance(annotation, instance, row, advice, offset)
+            .map(|value| {
+                if let Some(v) = value.value().into_option() {
+                    debug!(target: "assigned", value = ?v);
+                }
+                (value.cell(), value.value().cloned())
+            })
+    }
+
+    fn instance_value(
+        &mut self,
+        instance: Column<Instance>,
+        row: usize,
+    ) -> Result<Value<F>, Error> {
+        self.0.instance_value(instance, row)
+    }
+
+    fn assign_fixed<'v>(
+        &'v mut self,
+        annotation: &'v (dyn Fn() -> String + 'v),
+        column: Column<Fixed>,
+        offset: usize,
+        to: &'v mut (dyn FnMut() -> Value<Assigned<F>> + 'v),
+    ) -> Result<Cell, Error> {
+        let _guard =
+            debug_span!("assign_fixed", name = annotation(), column = ?column, offset = offset)
+                .entered();
+        debug!(target: "layouter", "Entered");
+        self.0
+            .assign_fixed(annotation, column, offset, to)
+            .map(debug_value_and_return_cell)
+    }
+
+    fn constrain_constant(&mut self, cell: Cell, constant: Assigned<F>) -> Result<(), Error> {
+        debug!(target: "constrain_constant", cell = ?cell, constant = ?constant);
+        self.0.constrain_constant(cell, constant)
+    }
+
+    fn constrain_equal(&mut self, left: Cell, right: Cell) -> Result<(), Error> {
+        debug!(target: "constrain_equal", left = ?left, right = ?right);
+        self.0.constrain_equal(left, right)
+    }
+}
+
+/// A helper type that augments an [`Assignment`] with [`tracing`] spans and events.
+struct TracingAssignment<'cs, F: Field, CS: Assignment<F>> {
+    cs: &'cs mut CS,
+    in_region: bool,
+    _phantom: PhantomData<F>,
+}
+
+impl<'cs, F: Field, CS: Assignment<F>> TracingAssignment<'cs, F, CS> {
+    fn new(cs: &'cs mut CS) -> Self {
+        Self {
+            cs,
+            in_region: false,
+            _phantom: PhantomData,
+        }
+    }
+}
+
+impl<'cs, F: Field, CS: Assignment<F>> Assignment<F> for TracingAssignment<'cs, F, CS> {
+    fn enter_region<NR, N>(&mut self, name_fn: N)
+    where
+        NR: Into<String>,
+        N: FnOnce() -> NR,
+    {
+        self.in_region = true;
+        self.cs.enter_region(name_fn);
+    }
+
+    fn annotate_column<A, AR>(&mut self, _: A, _: Column<Any>)
+    where
+        A: FnOnce() -> AR,
+        AR: Into<String>,
+    {
+    }
+
+    fn exit_region(&mut self) {
+        self.cs.exit_region();
+        self.in_region = false;
+    }
+
+    fn enable_selector<A, AR>(
+        &mut self,
+        annotation: A,
+        selector: &Selector,
+        row: usize,
+    ) -> Result<(), Error>
+    where
+        A: FnOnce() -> AR,
+        AR: Into<String>,
+    {
+        let annotation = annotation().into();
+        if self.in_region {
+            debug!(target: "position", row = row);
+        } else {
+            debug!(target: "enable_selector", name = annotation, row = row);
+        }
+        self.cs.enable_selector(|| annotation, selector, row)
+    }
+
+    fn query_instance(&self, column: Column<Instance>, row: usize) -> Result<Value<F>, Error> {
+        let _guard = debug_span!("positioned").entered();
+        debug!(target: "query_instance", column = ?column, row = row);
+        self.cs.query_instance(column, row)
+    }
+
+    fn assign_advice<V, VR, A, AR>(
+        &mut self,
+        annotation: A,
+        column: Column<Advice>,
+        row: usize,
+        to: V,
+    ) -> Result<(), Error>
+    where
+        V: FnOnce() -> Value<VR>,
+        VR: Into<Assigned<F>>,
+        A: FnOnce() -> AR,
+        AR: Into<String>,
+    {
+        let annotation = annotation().into();
+        if self.in_region {
+            debug!(target: "position", row = row);
+        } else {
+            debug!(target: "assign_advice", name = annotation, column = ?column, row = row);
+        }
+        self.cs.assign_advice(|| annotation, column, row, to)
+    }
+
+    fn assign_fixed<V, VR, A, AR>(
+        &mut self,
+        annotation: A,
+        column: Column<Fixed>,
+        row: usize,
+        to: V,
+    ) -> Result<(), Error>
+    where
+        V: FnOnce() -> Value<VR>,
+        VR: Into<Assigned<F>>,
+        A: FnOnce() -> AR,
+        AR: Into<String>,
+    {
+        let annotation = annotation().into();
+        if self.in_region {
+            debug!(target: "position", row = row);
+        } else {
+            debug!(target: "assign_fixed", name = annotation, column = ?column, row = row);
+        }
+        self.cs.assign_fixed(|| annotation, column, row, to)
+    }
+
+    fn copy(
+        &mut self,
+        left_column: Column<Any>,
+        left_row: usize,
+        right_column: Column<Any>,
+        right_row: usize,
+    ) -> Result<(), Error> {
+        let _guard = debug_span!("positioned").entered();
+        debug!(
+            target: "copy",
+            left_column = ?left_column,
+            left_row = left_row,
+            right_column = ?right_column,
+            right_row = right_row,
+        );
+        self.cs.copy(left_column, left_row, right_column, right_row)
+    }
+
+    fn fill_from_row(
+        &mut self,
+        column: Column<Fixed>,
+        row: usize,
+        to: Value<Assigned<F>>,
+    ) -> Result<(), Error> {
+        let _guard = debug_span!("positioned").entered();
+        debug!(target: "fill_from_row", column = ?column, row = row);
+        self.cs.fill_from_row(column, row, to)
+    }
+
+    fn get_challenge(&self, _: Challenge) -> Value<F> {
+        Value::unknown()
+    }
+
+    fn push_namespace<NR, N>(&mut self, name_fn: N)
+    where
+        NR: Into<String>,
+        N: FnOnce() -> NR,
+    {
+        // We enter namespace spans in TracingLayouter.
+        self.cs.push_namespace(name_fn)
+    }
+
+    fn pop_namespace(&mut self, gadget_name: Option<String>) {
+        self.cs.pop_namespace(gadget_name);
+        // We exit namespace spans in TracingLayouter.
+    }
+}
diff --git a/halo2_proofs/src/dev/util.rs b/halo2_proofs/src/dev/util.rs
index 84a119a7fd..29092e1aea 100644
--- a/halo2_proofs/src/dev/util.rs
+++ b/halo2_proofs/src/dev/util.rs
@@ -1,7 +1,7 @@
 use group::ff::Field;
 use std::collections::BTreeMap;
 
-use super::{metadata, CellValue, Value};
+use super::{metadata, CellValue, InstanceValue, Value};
 use crate::{
     plonk::{
         Advice, AdviceQuery, Any, Column, ColumnType, Expression, FixedQuery, Gate, InstanceQuery,
@@ -103,12 +103,13 @@ pub(super) fn load_instance<'a, F: Field, T: ColumnType, Q: Into<AnyQuery> + Cop
     n: i32,
     row: i32,
     queries: &'a [(Column<T>, Rotation)],
-    cells: &'a [Vec<F>],
+    cells: &'a [Vec<InstanceValue<F>>],
 ) -> impl Fn(Q) -> Value<F> + 'a {
     move |query| {
         let (column, at) = &queries[query.into().index.unwrap()];
         let resolved_row = (row + at.0) % n;
-        Value::Real(cells[column.index()][resolved_row as usize])
+        let cell = &cells[column.index()][resolved_row as usize];
+        Value::Real(cell.value())
     }
 }
 
diff --git a/halo2_proofs/src/helpers.rs b/halo2_proofs/src/helpers.rs
index df1f74fd3c..ff814d495b 100644
--- a/halo2_proofs/src/helpers.rs
+++ b/halo2_proofs/src/helpers.rs
@@ -1,7 +1,7 @@
 use crate::plonk::{Any, Column};
 use crate::poly::Polynomial;
 use ff::{Field, FromUniformBytes, PrimeField};
-use halo2curves::{pairing::Engine, serde::SerdeObject, CurveAffine};
+use halo2curves::{serde::SerdeObject, CurveAffine};
 use num_bigint::BigUint;
 use std::io;
 
diff --git a/halo2_proofs/src/lib.rs b/halo2_proofs/src/lib.rs
index 0ca61f64e4..daaa562341 100644
--- a/halo2_proofs/src/lib.rs
+++ b/halo2_proofs/src/lib.rs
@@ -1,28 +1,12 @@
 //! # halo2_proofs
 
 #![cfg_attr(docsrs, feature(doc_cfg))]
-// Build without warnings on stable 1.51 and later.
-#![allow(unknown_lints)]
-// Disable old lint warnings until our MSRV is at least 1.51.
-#![allow(renamed_and_removed_lints)]
-// Use the old lint name to build without warnings until our MSRV is at least 1.51.
-#![allow(clippy::unknown_clippy_lints)]
 // The actual lints we want to disable.
-#![allow(
-    clippy::op_ref,
-    clippy::assign_op_pattern,
-    clippy::too_many_arguments,
-    clippy::suspicious_arithmetic_impl,
-    clippy::many_single_char_names,
-    clippy::same_item_push,
-    clippy::upper_case_acronyms
-)]
-#![deny(broken_intra_doc_links)]
+#![allow(clippy::op_ref, clippy::many_single_char_names)]
+#![deny(rustdoc::broken_intra_doc_links)]
 #![deny(missing_debug_implementations)]
+// #![deny(missing_docs)]
 // #![deny(unsafe_code)]
-// Remove this once we update pasta_curves
-#![allow(unused_imports)]
-#![allow(clippy::derive_partial_eq_without_eq)]
 
 pub mod arithmetic;
 pub mod circuit;
diff --git a/halo2_proofs/src/multicore.rs b/halo2_proofs/src/multicore.rs
index a22eac9e79..60502f07d2 100644
--- a/halo2_proofs/src/multicore.rs
+++ b/halo2_proofs/src/multicore.rs
@@ -1,5 +1,70 @@
-//! An interface for dealing with the kinds of parallel computations involved in
-//! `halo2`. It's currently just a (very!) thin wrapper around [`rayon`] but may
-//! be extended in the future to allow for various parallelism strategies.
+#[cfg(all(
+    feature = "multicore",
+    target_arch = "wasm32",
+    not(target_feature = "atomics")
+))]
+compile_error!(
+    "The multicore feature flag is not supported on wasm32 architectures without atomics"
+);
 
-pub use rayon::{current_num_threads, scope, Scope};
+pub use maybe_rayon::{
+    iter::{IntoParallelIterator, IntoParallelRefMutIterator, ParallelIterator},
+    join, scope, Scope,
+};
+
+#[cfg(feature = "multicore")]
+pub use maybe_rayon::{
+    current_num_threads,
+    iter::{IndexedParallelIterator, IntoParallelRefIterator},
+    slice::ParallelSliceMut,
+};
+
+#[cfg(not(feature = "multicore"))]
+pub fn current_num_threads() -> usize {
+    1
+}
+
+pub trait TryFoldAndReduce<T, E> {
+    /// Implements `iter.try_fold().try_reduce()` for `rayon::iter::ParallelIterator`,
+    /// falling back on `Iterator::try_fold` when the `multicore` feature flag is
+    /// disabled.
+    /// The `try_fold_and_reduce` function can only be called by a iter with
+    /// `Result<T, E>` item type because the `fold_op` must meet the trait
+    /// bounds of both `try_fold` and `try_reduce` from rayon.   
+    fn try_fold_and_reduce(
+        self,
+        identity: impl Fn() -> T + Send + Sync,
+        fold_op: impl Fn(T, Result<T, E>) -> Result<T, E> + Send + Sync,
+    ) -> Result<T, E>;
+}
+
+#[cfg(feature = "multicore")]
+impl<T, E, I> TryFoldAndReduce<T, E> for I
+where
+    T: Send + Sync,
+    E: Send + Sync,
+    I: maybe_rayon::iter::ParallelIterator<Item = Result<T, E>>,
+{
+    fn try_fold_and_reduce(
+        self,
+        identity: impl Fn() -> T + Send + Sync,
+        fold_op: impl Fn(T, Result<T, E>) -> Result<T, E> + Send + Sync,
+    ) -> Result<T, E> {
+        self.try_fold(&identity, &fold_op)
+            .try_reduce(&identity, |a, b| fold_op(a, Ok(b)))
+    }
+}
+
+#[cfg(not(feature = "multicore"))]
+impl<T, E, I> TryFoldAndReduce<T, E> for I
+where
+    I: std::iter::Iterator<Item = Result<T, E>>,
+{
+    fn try_fold_and_reduce(
+        mut self,
+        identity: impl Fn() -> T + Send + Sync,
+        fold_op: impl Fn(T, Result<T, E>) -> Result<T, E> + Send + Sync,
+    ) -> Result<T, E> {
+        self.try_fold(identity(), fold_op)
+    }
+}
diff --git a/halo2_proofs/src/plonk.rs b/halo2_proofs/src/plonk.rs
index b32d589596..99d16240e0 100644
--- a/halo2_proofs/src/plonk.rs
+++ b/halo2_proofs/src/plonk.rs
@@ -7,17 +7,13 @@
 
 use blake2b_simd::Params as Blake2bParams;
 use group::ff::{Field, FromUniformBytes, PrimeField};
-use halo2curves::pairing::Engine;
 
 use crate::arithmetic::CurveAffine;
 use crate::helpers::{
     polynomial_slice_byte_length, read_polynomial_vec, write_polynomial_slice, SerdeCurveAffine,
     SerdePrimeField,
 };
-use crate::poly::{
-    commitment::Params, Coeff, EvaluationDomain, ExtendedLagrangeCoeff, LagrangeCoeff,
-    PinnedEvaluationDomain, Polynomial,
-};
+use crate::poly::{Coeff, EvaluationDomain, LagrangeCoeff, PinnedEvaluationDomain, Polynomial};
 use crate::transcript::{ChallengeScalar, EncodedChallenge, Transcript};
 use crate::SerdeFormat;
 
diff --git a/halo2_proofs/src/plonk/assigned.rs b/halo2_proofs/src/plonk/assigned.rs
index 919ddcdfb5..07de325678 100644
--- a/halo2_proofs/src/plonk/assigned.rs
+++ b/halo2_proofs/src/plonk/assigned.rs
@@ -446,7 +446,6 @@ mod tests {
 mod proptests {
     use std::{
         cmp,
-        convert::TryFrom,
         ops::{Add, Mul, Neg, Sub},
     };
 
diff --git a/halo2_proofs/src/plonk/circuit.rs b/halo2_proofs/src/plonk/circuit.rs
index 7651da5e98..e0348e9df7 100644
--- a/halo2_proofs/src/plonk/circuit.rs
+++ b/halo2_proofs/src/plonk/circuit.rs
@@ -9,10 +9,8 @@ use core::cmp::max;
 use core::ops::{Add, Mul};
 use ff::Field;
 use sealed::SealedPhase;
-use std::cmp::Ordering;
 use std::collections::BTreeMap;
-use std::collections::HashMap;
-use std::fmt::{Debug, Formatter};
+use std::fmt::Debug;
 use std::ops::Range;
 use std::{
     convert::TryFrom,
@@ -578,7 +576,7 @@ impl InstanceQuery {
 /// they cannot simultaneously be used as general fixed columns.
 ///
 /// [`Layouter::assign_table`]: crate::circuit::Layouter::assign_table
-#[derive(Clone, Copy, Debug, Eq, PartialEq, Hash)]
+#[derive(Clone, Copy, Debug, Eq, PartialEq, Hash, Ord, PartialOrd)]
 pub struct TableColumn {
     /// The fixed column that this table column is stored in.
     ///
@@ -897,6 +895,7 @@ impl<F: Field> Expression<F> {
 
     /// Evaluate the polynomial using the provided closures to perform the
     /// operations.
+    #[allow(clippy::too_many_arguments)]
     pub fn evaluate<T>(
         &self,
         constant: &impl Fn(F) -> T,
@@ -1006,6 +1005,7 @@ impl<F: Field> Expression<F> {
 
     /// Evaluate the polynomial lazily using the provided closures to perform the
     /// operations.
+    #[allow(clippy::too_many_arguments)]
     pub fn evaluate_lazy<T: PartialEq>(
         &self,
         constant: &impl Fn(F) -> T,
diff --git a/halo2_proofs/src/plonk/error.rs b/halo2_proofs/src/plonk/error.rs
index 84b14cbd2d..756fa30efb 100644
--- a/halo2_proofs/src/plonk/error.rs
+++ b/halo2_proofs/src/plonk/error.rs
@@ -1,9 +1,8 @@
-use crate::circuit::RegionIndex;
-use std::cmp;
 use std::error;
 use std::fmt;
 use std::io;
 
+use super::TableColumn;
 use super::{Any, Column};
 
 /// This is an error that could occur during proving or circuit synthesis.
@@ -40,6 +39,8 @@ pub enum Error {
     /// The instance sets up a copy constraint involving a column that has not been
     /// included in the permutation.
     ColumnNotInPermutation(Column<Any>),
+    /// An error relating to a lookup table.
+    TableError(TableError),
 }
 
 impl From<io::Error> for Error {
@@ -88,6 +89,7 @@ impl fmt::Display for Error {
                 "Column {:?} must be included in the permutation. Help: try applying `meta.enable_equalty` on the column",
                 column
             ),
+            Error::TableError(error) => write!(f, "{}", error)
         }
     }
 }
@@ -100,3 +102,45 @@ impl error::Error for Error {
         }
     }
 }
+
+/// This is an error that could occur during table synthesis.
+#[derive(Debug)]
+pub enum TableError {
+    /// A `TableColumn` has not been assigned.
+    ColumnNotAssigned(TableColumn),
+    /// A Table has columns of uneven lengths.
+    UnevenColumnLengths((TableColumn, usize), (TableColumn, usize)),
+    /// Attempt to assign a used `TableColumn`
+    UsedColumn(TableColumn),
+    /// Attempt to overwrite a default value
+    OverwriteDefault(TableColumn, String, String),
+}
+
+impl fmt::Display for TableError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            TableError::ColumnNotAssigned(col) => {
+                write!(
+                    f,
+                    "{:?} not fully assigned. Help: assign a value at offset 0.",
+                    col
+                )
+            }
+            TableError::UnevenColumnLengths((col, col_len), (table, table_len)) => write!(
+                f,
+                "{:?} has length {} while {:?} has length {}",
+                col, col_len, table, table_len
+            ),
+            TableError::UsedColumn(col) => {
+                write!(f, "{:?} has already been used", col)
+            }
+            TableError::OverwriteDefault(col, default, val) => {
+                write!(
+                    f,
+                    "Attempted to overwrite default value {} with {} in {:?}",
+                    default, val, col
+                )
+            }
+        }
+    }
+}
diff --git a/halo2_proofs/src/plonk/evaluation.rs b/halo2_proofs/src/plonk/evaluation.rs
index 2a41286594..be5a2c14c5 100644
--- a/halo2_proofs/src/plonk/evaluation.rs
+++ b/halo2_proofs/src/plonk/evaluation.rs
@@ -1,30 +1,11 @@
 use crate::multicore;
-use crate::plonk::lookup::prover::Committed;
-use crate::plonk::permutation::Argument;
-use crate::plonk::{lookup, permutation, AdviceQuery, Any, FixedQuery, InstanceQuery, ProvingKey};
+use crate::plonk::{lookup, permutation, Any, ProvingKey};
 use crate::poly::Basis;
 use crate::{
-    arithmetic::{eval_polynomial, parallelize, CurveAffine},
-    poly::{
-        commitment::Params, Coeff, EvaluationDomain, ExtendedLagrangeCoeff, LagrangeCoeff,
-        Polynomial, ProverQuery, Rotation,
-    },
-    transcript::{EncodedChallenge, TranscriptWrite},
-};
-use group::prime::PrimeCurve;
-use group::{
-    ff::{BatchInvert, Field, PrimeField, WithSmallOrderMulGroup},
-    Curve,
-};
-use std::any::TypeId;
-use std::convert::TryInto;
-use std::num::ParseIntError;
-use std::slice;
-use std::{
-    collections::BTreeMap,
-    iter,
-    ops::{Index, Mul, MulAssign},
+    arithmetic::{parallelize, CurveAffine},
+    poly::{Coeff, ExtendedLagrangeCoeff, LagrangeCoeff, Polynomial, Rotation},
 };
+use group::ff::{Field, PrimeField, WithSmallOrderMulGroup};
 
 use super::{shuffle, ConstraintSystem, Expression};
 
@@ -68,6 +49,7 @@ impl Default for ValueSource {
 
 impl ValueSource {
     /// Get the value for this source
+    #[allow(clippy::too_many_arguments)]
     pub fn get<F: Field, B: Basis>(
         &self,
         rotations: &[usize],
@@ -128,6 +110,7 @@ pub enum Calculation {
 
 impl Calculation {
     /// Get the resulting value of this calculation
+    #[allow(clippy::too_many_arguments)]
     pub fn evaluate<F: Field, B: Basis>(
         &self,
         rotations: &[usize],
@@ -312,6 +295,7 @@ impl<C: CurveAffine> Evaluator<C> {
     }
 
     /// Evaluate h poly
+    #[allow(clippy::too_many_arguments)]
     pub(in crate::plonk) fn evaluate_h(
         &self,
         pk: &ProvingKey<C>,
@@ -858,6 +842,7 @@ impl<C: CurveAffine> GraphEvaluator<C> {
         }
     }
 
+    #[allow(clippy::too_many_arguments)]
     pub fn evaluate<B: Basis>(
         &self,
         data: &mut EvaluationData<C>,
diff --git a/halo2_proofs/src/plonk/keygen.rs b/halo2_proofs/src/plonk/keygen.rs
index bd0dd73541..504125702f 100644
--- a/halo2_proofs/src/plonk/keygen.rs
+++ b/halo2_proofs/src/plonk/keygen.rs
@@ -12,16 +12,15 @@ use super::{
         Selector,
     },
     evaluation::Evaluator,
-    permutation, Assigned, Challenge, Error, Expression, LagrangeCoeff, Polynomial, ProvingKey,
-    VerifyingKey,
+    permutation, Assigned, Challenge, Error, LagrangeCoeff, Polynomial, ProvingKey, VerifyingKey,
 };
 use crate::helpers::CopyCell;
 use crate::{
     arithmetic::{parallelize, CurveAffine},
-    circuit::{layouter::SyncDeps, Value},
+    circuit::Value,
     poly::{
         batch_invert_assigned,
-        commitment::{Blind, Params, MSM},
+        commitment::{Blind, Params},
         EvaluationDomain,
     },
     two_dim_vec_to_vec_of_slice,
@@ -68,8 +67,6 @@ struct Assembly<'a, F: Field> {
     _marker: std::marker::PhantomData<F>,
 }
 
-impl<'a, F: Field> SyncDeps for Assembly<'a, F> {}
-
 impl<'a, F: Field> Assignment<F> for Assembly<'a, F> {
     fn enter_region<NR, N>(&mut self, _: N)
     where
diff --git a/halo2_proofs/src/plonk/lookup/prover.rs b/halo2_proofs/src/plonk/lookup/prover.rs
index 6a5f883a03..028b298853 100644
--- a/halo2_proofs/src/plonk/lookup/prover.rs
+++ b/halo2_proofs/src/plonk/lookup/prover.rs
@@ -8,8 +8,7 @@ use crate::{
     arithmetic::{eval_polynomial, parallelize, CurveAffine},
     poly::{
         commitment::{Blind, Params},
-        Coeff, EvaluationDomain, ExtendedLagrangeCoeff, LagrangeCoeff, Polynomial, ProverQuery,
-        Rotation,
+        Coeff, EvaluationDomain, LagrangeCoeff, Polynomial, ProverQuery, Rotation,
     },
     transcript::{EncodedChallenge, TranscriptWrite},
 };
@@ -19,7 +18,6 @@ use group::{
     Curve,
 };
 use rand_core::RngCore;
-use std::{any::TypeId, convert::TryInto, num::ParseIntError, ops::Index};
 use std::{
     collections::BTreeMap,
     iter,
@@ -62,6 +60,7 @@ impl<F: WithSmallOrderMulGroup<3>> Argument<F> {
     /// - constructs Permuted<C> struct using permuted_input_value = A', and
     ///   permuted_table_expression = S'.
     /// The Permuted<C> struct is used to update the Lookup, and is then returned.
+    #[allow(clippy::too_many_arguments)]
     pub(in crate::plonk) fn commit_permuted<
         'a,
         'params: 'a,
diff --git a/halo2_proofs/src/plonk/lookup/verifier.rs b/halo2_proofs/src/plonk/lookup/verifier.rs
index 5730b18f8a..548c4c274d 100644
--- a/halo2_proofs/src/plonk/lookup/verifier.rs
+++ b/halo2_proofs/src/plonk/lookup/verifier.rs
@@ -90,6 +90,7 @@ impl<C: CurveAffine> Committed<C> {
 }
 
 impl<C: CurveAffine> Evaluated<C> {
+    #[allow(clippy::too_many_arguments)]
     pub(in crate::plonk) fn expressions<'a>(
         &'a self,
         l_0: C::Scalar,
@@ -141,7 +142,7 @@ impl<C: CurveAffine> Evaluated<C> {
 
         std::iter::empty()
             .chain(
-                // l_0(X) * (1 - z'(X)) = 0
+                // l_0(X) * (1 - z(X)) = 0
                 Some(l_0 * &(C::Scalar::ONE - &self.product_eval)),
             )
             .chain(
diff --git a/halo2_proofs/src/plonk/permutation.rs b/halo2_proofs/src/plonk/permutation.rs
index 8a731416ee..2ce6abb8d3 100644
--- a/halo2_proofs/src/plonk/permutation.rs
+++ b/halo2_proofs/src/plonk/permutation.rs
@@ -7,10 +7,9 @@ use crate::{
         polynomial_slice_byte_length, read_polynomial_vec, write_polynomial_slice,
         SerdeCurveAffine, SerdePrimeField,
     },
-    poly::{Coeff, ExtendedLagrangeCoeff, LagrangeCoeff, Polynomial},
+    poly::{Coeff, LagrangeCoeff, Polynomial},
     SerdeFormat,
 };
-use ff::PrimeField;
 
 pub(crate) mod keygen;
 pub(crate) mod prover;
diff --git a/halo2_proofs/src/plonk/permutation/keygen.rs b/halo2_proofs/src/plonk/permutation/keygen.rs
index 0ae12df4a2..e4ef225314 100644
--- a/halo2_proofs/src/plonk/permutation/keygen.rs
+++ b/halo2_proofs/src/plonk/permutation/keygen.rs
@@ -1,22 +1,22 @@
-use std::collections::{BTreeMap, BTreeSet, HashMap, HashSet};
-
 use ff::{Field, PrimeField};
 use group::Curve;
-use rayon::prelude::{
-    IndexedParallelIterator, IntoParallelIterator, IntoParallelRefIterator,
-    IntoParallelRefMutIterator, ParallelIterator, ParallelSliceMut,
-};
 
 use super::{Argument, ProvingKey, VerifyingKey};
 use crate::{
     arithmetic::{parallelize, CurveAffine},
     plonk::{Any, Column, Error},
     poly::{
-        commitment::{Blind, CommitmentScheme, Params},
+        commitment::{Blind, Params},
         EvaluationDomain,
     },
 };
 
+#[cfg(feature = "multicore")]
+use crate::multicore::{IndexedParallelIterator, ParallelIterator};
+
+#[cfg(feature = "thread-safe-region")]
+use std::collections::{BTreeSet, HashMap};
+
 #[cfg(not(feature = "thread-safe-region"))]
 /// Struct that accumulates all the necessary data in order to construct the permutation argument.
 #[derive(Clone, Debug, PartialEq, Eq)]
@@ -133,12 +133,21 @@ impl Assembly {
         &self.columns
     }
 
+    #[cfg(feature = "multicore")]
     /// Returns mappings of the copies.
     pub fn mapping(
         &self,
     ) -> impl Iterator<Item = impl IndexedParallelIterator<Item = (usize, usize)> + '_> {
+        use crate::multicore::IntoParallelRefIterator;
+
         self.mapping.iter().map(|c| c.par_iter().copied())
     }
+
+    #[cfg(not(feature = "multicore"))]
+    /// Returns mappings of the copies.
+    pub fn mapping(&self) -> impl Iterator<Item = impl Iterator<Item = (usize, usize)> + '_> {
+        self.mapping.iter().map(|c| c.iter().copied())
+    }
 }
 
 #[cfg(feature = "thread-safe-region")]
@@ -239,6 +248,8 @@ impl Assembly {
     /// Builds the ordered mapping of the cycles.
     /// This will only get executed once.
     pub fn build_ordered_mapping(&mut self) {
+        use crate::multicore::IntoParallelRefMutIterator;
+
         // will only get called once
         if self.ordered_cycles.is_empty() && !self.cycles.is_empty() {
             self.ordered_cycles = self
@@ -304,16 +315,25 @@ impl Assembly {
         &self.columns
     }
 
+    #[cfg(feature = "multicore")]
     /// Returns mappings of the copies.
     pub fn mapping(
         &self,
     ) -> impl Iterator<Item = impl IndexedParallelIterator<Item = (usize, usize)> + '_> {
+        use crate::multicore::IntoParallelIterator;
+
         (0..self.num_cols).map(move |i| {
             (0..self.col_len)
                 .into_par_iter()
                 .map(move |j| self.mapping_at_idx(i, j))
         })
     }
+
+    #[cfg(not(feature = "multicore"))]
+    /// Returns mappings of the copies.
+    pub fn mapping(&self) -> impl Iterator<Item = impl Iterator<Item = (usize, usize)> + '_> {
+        (0..self.num_cols).map(move |i| (0..self.col_len).map(move |j| self.mapping_at_idx(i, j)))
+    }
 }
 
 pub(crate) fn build_pk<'params, C: CurveAffine, P: Params<'params, C>>(
diff --git a/halo2_proofs/src/plonk/permutation/prover.rs b/halo2_proofs/src/plonk/permutation/prover.rs
index 0618952f5a..28dfa7f4eb 100644
--- a/halo2_proofs/src/plonk/permutation/prover.rs
+++ b/halo2_proofs/src/plonk/permutation/prover.rs
@@ -12,9 +12,8 @@ use crate::{
     arithmetic::{eval_polynomial, parallelize, CurveAffine},
     plonk::{self, Error},
     poly::{
-        self,
         commitment::{Blind, Params},
-        Coeff, ExtendedLagrangeCoeff, LagrangeCoeff, Polynomial, ProverQuery, Rotation,
+        Coeff, LagrangeCoeff, Polynomial, ProverQuery, Rotation,
     },
     transcript::{EncodedChallenge, TranscriptWrite},
 };
@@ -42,6 +41,7 @@ pub(crate) struct Evaluated<C: CurveAffine> {
 }
 
 impl Argument {
+    #[allow(clippy::too_many_arguments)]
     pub(in crate::plonk) fn commit<
         'params,
         C: CurveAffine,
diff --git a/halo2_proofs/src/plonk/permutation/verifier.rs b/halo2_proofs/src/plonk/permutation/verifier.rs
index d0491b852f..080acf24e7 100644
--- a/halo2_proofs/src/plonk/permutation/verifier.rs
+++ b/halo2_proofs/src/plonk/permutation/verifier.rs
@@ -103,6 +103,7 @@ impl<C: CurveAffine> Committed<C> {
 }
 
 impl<C: CurveAffine> Evaluated<C> {
+    #[allow(clippy::too_many_arguments)]
     pub(in crate::plonk) fn expressions<'a>(
         &'a self,
         vk: &'a plonk::VerifyingKey<C>,
diff --git a/halo2_proofs/src/plonk/prover.rs b/halo2_proofs/src/plonk/prover.rs
index 4f8d9ec730..4071b22e14 100644
--- a/halo2_proofs/src/plonk/prover.rs
+++ b/halo2_proofs/src/plonk/prover.rs
@@ -1,33 +1,28 @@
-use ff::{Field, FromUniformBytes, PrimeField, WithSmallOrderMulGroup};
+use ff::{Field, FromUniformBytes, WithSmallOrderMulGroup};
 use group::Curve;
-use halo2curves::CurveExt;
 use rand_core::RngCore;
 use std::collections::BTreeSet;
-use std::env::var;
 use std::ops::{Range, RangeTo};
-use std::sync::atomic::AtomicUsize;
 use std::sync::Arc;
-use std::time::Instant;
-use std::{collections::HashMap, iter, mem, sync::atomic::Ordering};
+use std::{collections::HashMap, iter};
 
 use super::{
     circuit::{
-        sealed::{self, SealedPhase},
-        Advice, Any, Assignment, Challenge, Circuit, Column, ConstraintSystem, FirstPhase, Fixed,
-        FloorPlanner, Instance, Selector,
+        sealed::{self},
+        Advice, Any, Assignment, Challenge, Circuit, Column, ConstraintSystem, Fixed, FloorPlanner,
+        Instance, Selector,
     },
     lookup, permutation, shuffle, vanishing, ChallengeBeta, ChallengeGamma, ChallengeTheta,
-    ChallengeX, ChallengeY, Error, Expression, ProvingKey,
+    ChallengeX, ChallengeY, Error, ProvingKey,
 };
-use crate::circuit::layouter::SyncDeps;
+
 use crate::{
     arithmetic::{eval_polynomial, CurveAffine},
     circuit::Value,
     plonk::Assigned,
     poly::{
-        self,
         commitment::{Blind, CommitmentScheme, Params, Prover},
-        Basis, Coeff, ExtendedLagrangeCoeff, LagrangeCoeff, Polynomial, ProverQuery,
+        Basis, Coeff, LagrangeCoeff, Polynomial, ProverQuery,
     },
     two_dim_vec_to_vec_of_slice,
 };
@@ -60,6 +55,10 @@ pub fn create_proof<
 where
     Scheme::Scalar: WithSmallOrderMulGroup<3> + FromUniformBytes<64>,
 {
+    if circuits.len() != instances.len() {
+        return Err(Error::InvalidInstances);
+    }
+
     for instance in instances.iter() {
         if instance.len() != pk.vk.cs.num_instance_columns {
             return Err(Error::InvalidInstances);
@@ -158,8 +157,6 @@ where
         _marker: std::marker::PhantomData<F>,
     }
 
-    impl<'a, F: Field> SyncDeps for WitnessCollection<'a, F> {}
-
     impl<'a, F: Field> Assignment<F> for WitnessCollection<'a, F> {
         fn enter_region<NR, N>(&mut self, _: N)
         where
@@ -667,7 +664,7 @@ where
     let vanishing = vanishing.construct(params, domain, h_poly, &mut rng, transcript)?;
 
     let x: ChallengeX<_> = transcript.squeeze_challenge_scalar();
-    let xn = x.pow([params.n(), 0, 0, 0]);
+    let xn = x.pow([params.n()]);
 
     if P::QUERY_INSTANCE {
         // Compute and hash instance evals for each circuit instance
@@ -813,3 +810,69 @@ where
         .create_proof(rng, transcript, instances)
         .map_err(|_| Error::ConstraintSystemFailure)
 }
+
+#[test]
+fn test_create_proof() {
+    use crate::{
+        circuit::SimpleFloorPlanner,
+        plonk::{keygen_pk, keygen_vk},
+        poly::kzg::{
+            commitment::{KZGCommitmentScheme, ParamsKZG},
+            multiopen::ProverSHPLONK,
+        },
+        transcript::{Blake2bWrite, Challenge255, TranscriptWriterBuffer},
+    };
+    use halo2curves::bn256::Bn256;
+    use rand_core::OsRng;
+
+    #[derive(Clone, Copy)]
+    struct MyCircuit;
+
+    impl<F: Field> Circuit<F> for MyCircuit {
+        type Config = ();
+        type FloorPlanner = SimpleFloorPlanner;
+        #[cfg(feature = "circuit-params")]
+        type Params = ();
+
+        fn without_witnesses(&self) -> Self {
+            *self
+        }
+
+        fn configure(_meta: &mut ConstraintSystem<F>) -> Self::Config {}
+
+        fn synthesize(
+            &self,
+            _config: Self::Config,
+            _layouter: impl crate::circuit::Layouter<F>,
+        ) -> Result<(), Error> {
+            Ok(())
+        }
+    }
+
+    let params: ParamsKZG<Bn256> = ParamsKZG::setup(3, OsRng);
+    let vk = keygen_vk(&params, &MyCircuit).expect("keygen_vk should not fail");
+    let pk = keygen_pk(&params, vk, &MyCircuit).expect("keygen_pk should not fail");
+    let mut transcript = Blake2bWrite::<_, _, Challenge255<_>>::init(vec![]);
+
+    // Create proof with wrong number of instances
+    let proof = create_proof::<KZGCommitmentScheme<_>, ProverSHPLONK<_>, _, _, _, _>(
+        &params,
+        &pk,
+        &[MyCircuit, MyCircuit],
+        &[],
+        OsRng,
+        &mut transcript,
+    );
+    assert!(matches!(proof.unwrap_err(), Error::InvalidInstances));
+
+    // Create proof with correct number of instances
+    create_proof::<KZGCommitmentScheme<_>, ProverSHPLONK<_>, _, _, _, _>(
+        &params,
+        &pk,
+        &[MyCircuit, MyCircuit],
+        &[&[], &[]],
+        OsRng,
+        &mut transcript,
+    )
+    .expect("proof generation should not fail");
+}
diff --git a/halo2_proofs/src/plonk/shuffle/prover.rs b/halo2_proofs/src/plonk/shuffle/prover.rs
index ef3a459f22..fd30436a47 100644
--- a/halo2_proofs/src/plonk/shuffle/prover.rs
+++ b/halo2_proofs/src/plonk/shuffle/prover.rs
@@ -1,6 +1,5 @@
 use super::super::{
-    circuit::Expression, ChallengeBeta, ChallengeGamma, ChallengeTheta, ChallengeX, Error,
-    ProvingKey,
+    circuit::Expression, ChallengeGamma, ChallengeTheta, ChallengeX, Error, ProvingKey,
 };
 use super::Argument;
 use crate::plonk::evaluation::evaluate;
@@ -8,20 +7,14 @@ use crate::{
     arithmetic::{eval_polynomial, parallelize, CurveAffine},
     poly::{
         commitment::{Blind, Params},
-        Coeff, EvaluationDomain, ExtendedLagrangeCoeff, LagrangeCoeff, Polynomial, ProverQuery,
-        Rotation,
+        Coeff, EvaluationDomain, LagrangeCoeff, Polynomial, ProverQuery, Rotation,
     },
     transcript::{EncodedChallenge, TranscriptWrite},
 };
 use ff::WithSmallOrderMulGroup;
-use group::{
-    ff::{BatchInvert, Field},
-    Curve,
-};
+use group::{ff::BatchInvert, Curve};
 use rand_core::RngCore;
-use std::{any::TypeId, convert::TryInto, num::ParseIntError, ops::Index};
 use std::{
-    collections::BTreeMap,
     iter,
     ops::{Mul, MulAssign},
 };
@@ -47,6 +40,7 @@ impl<F: WithSmallOrderMulGroup<3>> Argument<F> {
     /// [S_0, S_1, ..., S_{m-1}], this method
     /// - constructs A_compressed = \theta^{m-1} A_0 + theta^{m-2} A_1 + ... + \theta A_{m-2} + A_{m-1}
     ///   and S_compressed = \theta^{m-1} S_0 + theta^{m-2} S_1 + ... + \theta S_{m-2} + S_{m-1},
+    #[allow(clippy::too_many_arguments)]
     fn compress<'a, 'params: 'a, C, P: Params<'params, C>>(
         &self,
         pk: &ProvingKey<C>,
@@ -99,6 +93,7 @@ impl<F: WithSmallOrderMulGroup<3>> Argument<F> {
     /// constructs the grand product polynomial over the shuffle.
     /// The grand product polynomial is used to populate the Product<C> struct.
     /// The Product<C> struct is added to the Shuffle and finally returned by the method.
+    #[allow(clippy::too_many_arguments)]
     pub(in crate::plonk) fn commit_product<
         'a,
         'params: 'a,
diff --git a/halo2_proofs/src/plonk/shuffle/verifier.rs b/halo2_proofs/src/plonk/shuffle/verifier.rs
index b02febb694..379cc5c8a1 100644
--- a/halo2_proofs/src/plonk/shuffle/verifier.rs
+++ b/halo2_proofs/src/plonk/shuffle/verifier.rs
@@ -52,6 +52,7 @@ impl<C: CurveAffine> Committed<C> {
 }
 
 impl<C: CurveAffine> Evaluated<C> {
+    #[allow(clippy::too_many_arguments)]
     pub(in crate::plonk) fn expressions<'a>(
         &'a self,
         l_0: C::Scalar,
diff --git a/halo2_proofs/src/plonk/vanishing/prover.rs b/halo2_proofs/src/plonk/vanishing/prover.rs
index d394b8c0de..50b287178c 100644
--- a/halo2_proofs/src/plonk/vanishing/prover.rs
+++ b/halo2_proofs/src/plonk/vanishing/prover.rs
@@ -1,4 +1,4 @@
-use std::iter;
+use std::{collections::HashMap, iter};
 
 use ff::Field;
 use group::Curve;
@@ -7,9 +7,8 @@ use rand_core::RngCore;
 use super::Argument;
 use crate::{
     arithmetic::{eval_polynomial, CurveAffine},
-    plonk::{ChallengeX, ChallengeY, Error},
+    plonk::{ChallengeX, Error},
     poly::{
-        self,
         commitment::{Blind, ParamsProver},
         Coeff, EvaluationDomain, ExtendedLagrangeCoeff, Polynomial, ProverQuery,
     },
diff --git a/halo2_proofs/src/plonk/verifier.rs b/halo2_proofs/src/plonk/verifier.rs
index 1e431be41b..76675bcdfa 100644
--- a/halo2_proofs/src/plonk/verifier.rs
+++ b/halo2_proofs/src/plonk/verifier.rs
@@ -1,28 +1,25 @@
 use ff::{Field, FromUniformBytes, WithSmallOrderMulGroup};
 use group::Curve;
-use rand_core::RngCore;
 use std::iter;
 
 use super::{
     vanishing, ChallengeBeta, ChallengeGamma, ChallengeTheta, ChallengeX, ChallengeY, Error,
     VerifyingKey,
 };
-use crate::arithmetic::{compute_inner_product, CurveAffine};
+use crate::arithmetic::compute_inner_product;
 use crate::poly::commitment::{CommitmentScheme, Verifier};
 use crate::poly::VerificationStrategy;
 use crate::poly::{
-    commitment::{Blind, Params, MSM},
-    Guard, VerifierQuery,
+    commitment::{Blind, Params},
+    VerifierQuery,
 };
-use crate::transcript::{read_n_points, read_n_scalars, EncodedChallenge, TranscriptRead};
+use crate::transcript::{read_n_scalars, EncodedChallenge, TranscriptRead};
 
 #[cfg(feature = "batch")]
 mod batch;
 #[cfg(feature = "batch")]
 pub use batch::BatchVerifier;
 
-use crate::poly::commitment::ParamsVerifier;
-
 /// Returns a boolean indicating whether or not the proof is valid
 pub fn verify_proof<
     'params,
@@ -188,7 +185,7 @@ where
             })
             .collect::<Result<Vec<_>, _>>()?
     } else {
-        let xn = x.pow([params.n(), 0, 0, 0]);
+        let xn = x.pow([params.n()]);
         let (min_rotation, max_rotation) =
             vk.cs
                 .instance_queries
@@ -267,7 +264,7 @@ where
     // commitments open to the correct values.
     let vanishing = {
         // x^n
-        let xn = x.pow([params.n(), 0, 0, 0]);
+        let xn = x.pow([params.n()]);
 
         let blinding_factors = vk.cs.blinding_factors();
         let l_evals = vk
diff --git a/halo2_proofs/src/plonk/verifier/batch.rs b/halo2_proofs/src/plonk/verifier/batch.rs
index 04e08be4af..173d552e5f 100644
--- a/halo2_proofs/src/plonk/verifier/batch.rs
+++ b/halo2_proofs/src/plonk/verifier/batch.rs
@@ -1,14 +1,11 @@
-use std::{io, marker::PhantomData};
-
 use ff::FromUniformBytes;
 use group::ff::Field;
 use halo2curves::CurveAffine;
-use rand_core::{OsRng, RngCore};
-use rayon::iter::{IndexedParallelIterator, IntoParallelIterator, ParallelIterator};
+use rand_core::OsRng;
 
 use super::{verify_proof, VerificationStrategy};
 use crate::{
-    multicore,
+    multicore::{IntoParallelIterator, TryFoldAndReduce},
     plonk::{Error, VerifyingKey},
     poly::{
         commitment::{Params, MSM},
@@ -22,6 +19,9 @@ use crate::{
     transcript::{Blake2bRead, TranscriptReadBuffer},
 };
 
+#[cfg(feature = "multicore")]
+use crate::multicore::{IndexedParallelIterator, ParallelIterator};
+
 /// A proof verification strategy that returns the proof's MSM.
 ///
 /// `BatchVerifier` handles the accumulation of the MSMs for the batched proofs.
@@ -123,11 +123,10 @@ where
                     e
                 })
             })
-            .try_fold(
+            .try_fold_and_reduce(
                 || params.empty_msm(),
-                |msm, res| res.map(|proof_msm| accumulate_msm(msm, proof_msm)),
-            )
-            .try_reduce(|| params.empty_msm(), |a, b| Ok(accumulate_msm(a, b)));
+                |acc, res| res.map(|proof_msm| accumulate_msm(acc, proof_msm)),
+            );
 
         match final_msm {
             Ok(msm) => msm.check(),
diff --git a/halo2_proofs/src/poly.rs b/halo2_proofs/src/poly.rs
index 42e43b2e29..ddc99429a0 100644
--- a/halo2_proofs/src/poly.rs
+++ b/halo2_proofs/src/poly.rs
@@ -7,7 +7,6 @@ use crate::helpers::SerdePrimeField;
 use crate::plonk::Assigned;
 use crate::SerdeFormat;
 
-use ff::PrimeField;
 use group::ff::{BatchInvert, Field};
 use std::fmt::Debug;
 use std::io;
diff --git a/halo2_proofs/src/poly/commitment.rs b/halo2_proofs/src/poly/commitment.rs
index 3a0b68f62a..590767e68e 100644
--- a/halo2_proofs/src/poly/commitment.rs
+++ b/halo2_proofs/src/poly/commitment.rs
@@ -6,12 +6,11 @@ use super::{
 use crate::poly::Error;
 use crate::transcript::{EncodedChallenge, TranscriptRead, TranscriptWrite};
 use ff::Field;
-use group::{Curve, Group};
-use halo2curves::{CurveAffine, CurveExt};
+use halo2curves::CurveAffine;
 use rand_core::RngCore;
 use std::{
     fmt::Debug,
-    io::{self, Read, Write},
+    io::{self},
     ops::{Add, AddAssign, Mul, MulAssign},
 };
 
diff --git a/halo2_proofs/src/poly/domain.rs b/halo2_proofs/src/poly/domain.rs
index 494e39a9da..2d353fdbd7 100644
--- a/halo2_proofs/src/poly/domain.rs
+++ b/halo2_proofs/src/poly/domain.rs
@@ -8,10 +8,7 @@ use crate::{
 
 use super::{Coeff, ExtendedLagrangeCoeff, LagrangeCoeff, Polynomial, Rotation};
 use ff::WithSmallOrderMulGroup;
-use group::{
-    ff::{BatchInvert, Field, PrimeField},
-    Group,
-};
+use group::ff::{BatchInvert, Field};
 
 use std::marker::PhantomData;
 
@@ -54,6 +51,9 @@ impl<F: WithSmallOrderMulGroup<3>> EvaluationDomain<F> {
             extended_k += 1;
         }
 
+        // ensure extended_k <= S
+        assert!(extended_k <= F::S);
+
         let mut extended_omega = F::ROOT_OF_UNITY;
 
         // Get extended_omega, the 2^{extended_k}'th root of unity
@@ -651,7 +651,7 @@ fn test_l_i() {
     let mut l = vec![];
     let mut points = vec![];
     for i in 0..8 {
-        points.push(domain.omega.pow([i, 0, 0, 0]));
+        points.push(domain.omega.pow([i]));
     }
     for i in 0..8 {
         let mut l_i = vec![Scalar::ZERO; 8];
@@ -661,7 +661,7 @@ fn test_l_i() {
     }
 
     let x = Scalar::random(OsRng);
-    let xn = x.pow([8, 0, 0, 0]);
+    let xn = x.pow([8]);
 
     let evaluations = domain.l_i_range(x, xn, -7..=7);
     for i in 0..8 {
diff --git a/halo2_proofs/src/poly/evaluator.rs b/halo2_proofs/src/poly/evaluator.rs
deleted file mode 100644
index 5d20221255..0000000000
--- a/halo2_proofs/src/poly/evaluator.rs
+++ /dev/null
@@ -1,699 +0,0 @@
-use std::{
-    cmp,
-    collections::{HashMap, HashSet},
-    fmt,
-    hash::{Hash, Hasher},
-    marker::PhantomData,
-    ops::{Add, Mul, MulAssign, Neg, Sub},
-    sync::Arc,
-};
-
-use group::ff::Field;
-use halo2curves::Field;
-
-use super::{
-    Basis, Coeff, EvaluationDomain, ExtendedLagrangeCoeff, LagrangeCoeff, Polynomial, Rotation,
-};
-use crate::{arithmetic::parallelize, multicore};
-
-/// Returns `(chunk_size, num_chunks)` suitable for processing the given polynomial length
-/// in the current parallelization environment.
-fn get_chunk_params(poly_len: usize) -> (usize, usize) {
-    // Check the level of parallelization we have available.
-    let num_threads = multicore::current_num_threads();
-    // We scale the number of chunks by a constant factor, to ensure that if not all
-    // threads are available, we can achieve more uniform throughput and don't end up
-    // waiting on a couple of threads to process the last chunks.
-    let num_chunks = num_threads * 4;
-    // Calculate the ideal chunk size for the desired throughput. We use ceiling
-    // division to ensure the minimum chunk size is 1.
-    //     chunk_size = ceil(poly_len / num_chunks)
-    let chunk_size = (poly_len + num_chunks - 1) / num_chunks;
-    // Now re-calculate num_chunks from the actual chunk size.
-    //     num_chunks = ceil(poly_len / chunk_size)
-    let num_chunks = (poly_len + chunk_size - 1) / chunk_size;
-
-    (chunk_size, num_chunks)
-}
-
-/// A reference to a polynomial registered with an [`Evaluator`].
-#[derive(Clone, Copy)]
-pub(crate) struct AstLeaf<E, B: Basis> {
-    index: usize,
-    rotation: Rotation,
-    _evaluator: PhantomData<(E, B)>,
-}
-
-impl<E, B: Basis> fmt::Debug for AstLeaf<E, B> {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.debug_struct("AstLeaf")
-            .field("index", &self.index)
-            .field("rotation", &self.rotation)
-            .finish()
-    }
-}
-
-impl<E, B: Basis> PartialEq for AstLeaf<E, B> {
-    fn eq(&self, rhs: &Self) -> bool {
-        // We compare rotations by offset, which doesn't account for equivalent rotations.
-        self.index.eq(&rhs.index) && self.rotation.0.eq(&rhs.rotation.0)
-    }
-}
-
-impl<E, B: Basis> Eq for AstLeaf<E, B> {}
-
-impl<E, B: Basis> Hash for AstLeaf<E, B> {
-    fn hash<H: Hasher>(&self, state: &mut H) {
-        self.index.hash(state);
-        self.rotation.0.hash(state);
-    }
-}
-
-impl<E, B: Basis> AstLeaf<E, B> {
-    /// Produces a new `AstLeaf` node corresponding to the underlying polynomial at a
-    /// _new_ rotation. Existing rotations applied to this leaf node are ignored and the
-    /// returned polynomial is not rotated _relative_ to the previous structure.
-    pub(crate) fn with_rotation(&self, rotation: Rotation) -> Self {
-        AstLeaf {
-            index: self.index,
-            rotation,
-            _evaluator: PhantomData::default(),
-        }
-    }
-}
-
-/// An evaluation context for polynomial operations.
-///
-/// This context enables us to de-duplicate queries of circuit columns (and the rotations
-/// they might require), by storing a list of all the underlying polynomials involved in
-/// any query (which are almost certainly column polynomials). We use the context like so:
-///
-/// - We register each underlying polynomial with the evaluator, which returns a reference
-///   to it as a [`AstLeaf`].
-/// - The references are then used to build up a [`Ast`] that represents the overall
-///   operations to be applied to the polynomials.
-/// - Finally, we call [`Evaluator::evaluate`] passing in the [`Ast`].
-pub(crate) struct Evaluator<E, F: Field, B: Basis> {
-    polys: Vec<Polynomial<F, B>>,
-    _context: E,
-}
-
-/// Constructs a new `Evaluator`.
-///
-/// The `context` parameter is used to provide type safety for evaluators. It ensures that
-/// an evaluator will only be used to evaluate [`Ast`]s containing [`AstLeaf`]s obtained
-/// from itself. It should be set to the empty closure `|| {}`, because anonymous closures
-/// all have unique types.
-pub(crate) fn new_evaluator<E: Fn() + Clone, F: Field, B: Basis>(context: E) -> Evaluator<E, F, B> {
-    Evaluator {
-        polys: vec![],
-        _context: context,
-    }
-}
-
-impl<E, F: Field, B: Basis> Evaluator<E, F, B> {
-    /// Registers the given polynomial for use in this evaluation context.
-    ///
-    /// This API treats each registered polynomial as unique, even if the same polynomial
-    /// is added multiple times.
-    pub(crate) fn register_poly(&mut self, poly: Polynomial<F, B>) -> AstLeaf<E, B> {
-        let index = self.polys.len();
-        self.polys.push(poly);
-
-        AstLeaf {
-            index,
-            rotation: Rotation::cur(),
-            _evaluator: PhantomData::default(),
-        }
-    }
-
-    /// Evaluates the given polynomial operation against this context.
-    pub(crate) fn evaluate(
-        &self,
-        ast: &Ast<E, F, B>,
-        domain: &EvaluationDomain<F>,
-    ) -> Polynomial<F, B>
-    where
-        E: Copy + Send + Sync,
-        F: Field,
-        B: BasisOps,
-    {
-        // Traverse `ast` to collect the used leaves.
-        fn collect_rotations<E: Copy, F: Field, B: Basis>(
-            ast: &Ast<E, F, B>,
-        ) -> HashSet<AstLeaf<E, B>> {
-            match ast {
-                Ast::Poly(leaf) => vec![*leaf].into_iter().collect(),
-                Ast::Add(a, b) | Ast::Mul(AstMul(a, b)) => {
-                    let lhs = collect_rotations(a);
-                    let rhs = collect_rotations(b);
-                    lhs.union(&rhs).cloned().collect()
-                }
-                Ast::Scale(a, _) => collect_rotations(a),
-                Ast::DistributePowers(terms, _) => terms
-                    .iter()
-                    .flat_map(|term| collect_rotations(term).into_iter())
-                    .collect(),
-                Ast::LinearTerm(_) | Ast::ConstantTerm(_) => HashSet::default(),
-            }
-        }
-        let leaves = collect_rotations(ast);
-
-        // Produce the rotated polynomials.
-        let rotated: HashMap<_, _> = leaves
-            .iter()
-            .cloned()
-            .map(|leaf| {
-                (
-                    leaf,
-                    B::rotate(domain, &self.polys[leaf.index], leaf.rotation),
-                )
-            })
-            .collect();
-
-        // We're working in a single basis, so all polynomials are the same length.
-        let poly_len = self.polys.first().unwrap().len();
-        let (chunk_size, num_chunks) = get_chunk_params(poly_len);
-
-        // Split each rotated polynomial into chunks.
-        let chunks: Vec<HashMap<_, _>> = (0..num_chunks)
-            .map(|i| {
-                rotated
-                    .iter()
-                    .map(|(leaf, poly)| {
-                        (
-                            *leaf,
-                            poly.chunks(chunk_size)
-                                .nth(i)
-                                .expect("num_chunks was calculated correctly"),
-                        )
-                    })
-                    .collect()
-            })
-            .collect();
-
-        struct AstContext<'a, E, F: Field, B: Basis> {
-            domain: &'a EvaluationDomain<F>,
-            poly_len: usize,
-            chunk_size: usize,
-            chunk_index: usize,
-            leaves: &'a HashMap<AstLeaf<E, B>, &'a [F]>,
-        }
-
-        fn recurse<E, F: Field, B: BasisOps>(
-            ast: &Ast<E, F, B>,
-            ctx: &AstContext<'_, E, F, B>,
-        ) -> Vec<F> {
-            match ast {
-                Ast::Poly(leaf) => ctx.leaves.get(leaf).expect("We prepared this").to_vec(),
-                Ast::Add(a, b) => {
-                    let mut lhs = recurse(a, ctx);
-                    let rhs = recurse(b, ctx);
-                    for (lhs, rhs) in lhs.iter_mut().zip(rhs.iter()) {
-                        *lhs += *rhs;
-                    }
-                    lhs
-                }
-                Ast::Mul(AstMul(a, b)) => {
-                    let mut lhs = recurse(a, ctx);
-                    let rhs = recurse(b, ctx);
-                    for (lhs, rhs) in lhs.iter_mut().zip(rhs.iter()) {
-                        *lhs *= *rhs;
-                    }
-                    lhs
-                }
-                Ast::Scale(a, scalar) => {
-                    let mut lhs = recurse(a, ctx);
-                    for lhs in lhs.iter_mut() {
-                        *lhs *= scalar;
-                    }
-                    lhs
-                }
-                Ast::DistributePowers(terms, base) => terms.iter().fold(
-                    B::constant_term(ctx.poly_len, ctx.chunk_size, ctx.chunk_index, F::ZERO),
-                    |mut acc, term| {
-                        let term = recurse(term, ctx);
-                        for (acc, term) in acc.iter_mut().zip(term) {
-                            *acc *= base;
-                            *acc += term;
-                        }
-                        acc
-                    },
-                ),
-                Ast::LinearTerm(scalar) => B::linear_term(
-                    ctx.domain,
-                    ctx.poly_len,
-                    ctx.chunk_size,
-                    ctx.chunk_index,
-                    *scalar,
-                ),
-                Ast::ConstantTerm(scalar) => {
-                    B::constant_term(ctx.poly_len, ctx.chunk_size, ctx.chunk_index, *scalar)
-                }
-            }
-        }
-
-        // Apply `ast` to each chunk in parallel, writing the result into an output
-        // polynomial.
-        let mut result = B::empty_poly(domain);
-        multicore::scope(|scope| {
-            for (chunk_index, (out, leaves)) in
-                result.chunks_mut(chunk_size).zip(chunks.iter()).enumerate()
-            {
-                scope.spawn(move |_| {
-                    let ctx = AstContext {
-                        domain,
-                        poly_len,
-                        chunk_size,
-                        chunk_index,
-                        leaves,
-                    };
-                    out.copy_from_slice(&recurse(ast, &ctx));
-                });
-            }
-        });
-        result
-    }
-}
-
-/// Struct representing the [`Ast::Mul`] case.
-///
-/// This struct exists to make the internals of this case private so that we don't
-/// accidentally construct this case directly, because it can only be implemented for the
-/// [`ExtendedLagrangeCoeff`] basis.
-#[derive(Clone)]
-pub(crate) struct AstMul<E, F: Field, B: Basis>(Arc<Ast<E, F, B>>, Arc<Ast<E, F, B>>);
-
-impl<E, F: Field, B: Basis> fmt::Debug for AstMul<E, F, B> {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.debug_tuple("AstMul")
-            .field(&self.0)
-            .field(&self.1)
-            .finish()
-    }
-}
-
-/// A polynomial operation backed by an [`Evaluator`].
-#[derive(Clone)]
-pub(crate) enum Ast<E, F: Field, B: Basis> {
-    Poly(AstLeaf<E, B>),
-    Add(Arc<Ast<E, F, B>>, Arc<Ast<E, F, B>>),
-    Mul(AstMul<E, F, B>),
-    Scale(Arc<Ast<E, F, B>>, F),
-    /// Represents a linear combination of a vector of nodes and the powers of a
-    /// field element, where the nodes are ordered from highest to lowest degree
-    /// terms.
-    DistributePowers(Arc<Vec<Ast<E, F, B>>>, F),
-    /// The degree-1 term of a polynomial.
-    ///
-    /// The field element is the coefficient of the term in the standard basis, not the
-    /// coefficient basis.
-    LinearTerm(F),
-    /// The degree-0 term of a polynomial.
-    ///
-    /// The field element is the same in both the standard and evaluation bases.
-    ConstantTerm(F),
-}
-
-impl<E, F: Field, B: Basis> Ast<E, F, B> {
-    pub fn distribute_powers<I: IntoIterator<Item = Self>>(i: I, base: F) -> Self {
-        Ast::DistributePowers(Arc::new(i.into_iter().collect()), base)
-    }
-}
-
-impl<E, F: Field, B: Basis> fmt::Debug for Ast<E, F, B> {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            Self::Poly(leaf) => f.debug_tuple("Poly").field(leaf).finish(),
-            Self::Add(lhs, rhs) => f.debug_tuple("Add").field(lhs).field(rhs).finish(),
-            Self::Mul(x) => f.debug_tuple("Mul").field(x).finish(),
-            Self::Scale(base, scalar) => f.debug_tuple("Scale").field(base).field(scalar).finish(),
-            Self::DistributePowers(terms, base) => f
-                .debug_tuple("DistributePowers")
-                .field(terms)
-                .field(base)
-                .finish(),
-            Self::LinearTerm(x) => f.debug_tuple("LinearTerm").field(x).finish(),
-            Self::ConstantTerm(x) => f.debug_tuple("ConstantTerm").field(x).finish(),
-        }
-    }
-}
-
-impl<E, F: Field, B: Basis> From<AstLeaf<E, B>> for Ast<E, F, B> {
-    fn from(leaf: AstLeaf<E, B>) -> Self {
-        Ast::Poly(leaf)
-    }
-}
-
-impl<E, F: Field, B: Basis> Ast<E, F, B> {
-    pub(crate) fn one() -> Self {
-        Self::ConstantTerm(F::ONE)
-    }
-}
-
-impl<E, F: Field, B: Basis> Neg for Ast<E, F, B> {
-    type Output = Ast<E, F, B>;
-
-    fn neg(self) -> Self::Output {
-        Ast::Scale(Arc::new(self), -F::ONE)
-    }
-}
-
-impl<E: Clone, F: Field, B: Basis> Neg for &Ast<E, F, B> {
-    type Output = Ast<E, F, B>;
-
-    fn neg(self) -> Self::Output {
-        -(self.clone())
-    }
-}
-
-impl<E, F: Field, B: Basis> Add for Ast<E, F, B> {
-    type Output = Ast<E, F, B>;
-
-    fn add(self, other: Self) -> Self::Output {
-        Ast::Add(Arc::new(self), Arc::new(other))
-    }
-}
-
-impl<'a, E: Clone, F: Field, B: Basis> Add<&'a Ast<E, F, B>> for &'a Ast<E, F, B> {
-    type Output = Ast<E, F, B>;
-
-    fn add(self, other: &'a Ast<E, F, B>) -> Self::Output {
-        self.clone() + other.clone()
-    }
-}
-
-impl<E, F: Field, B: Basis> Add<AstLeaf<E, B>> for Ast<E, F, B> {
-    type Output = Ast<E, F, B>;
-
-    fn add(self, other: AstLeaf<E, B>) -> Self::Output {
-        Ast::Add(Arc::new(self), Arc::new(other.into()))
-    }
-}
-
-impl<E, F: Field, B: Basis> Sub for Ast<E, F, B> {
-    type Output = Ast<E, F, B>;
-
-    fn sub(self, other: Self) -> Self::Output {
-        self + (-other)
-    }
-}
-
-impl<'a, E: Clone, F: Field, B: Basis> Sub<&'a Ast<E, F, B>> for &'a Ast<E, F, B> {
-    type Output = Ast<E, F, B>;
-
-    fn sub(self, other: &'a Ast<E, F, B>) -> Self::Output {
-        self + &(-other)
-    }
-}
-
-impl<E, F: Field, B: Basis> Sub<AstLeaf<E, B>> for Ast<E, F, B> {
-    type Output = Ast<E, F, B>;
-
-    fn sub(self, other: AstLeaf<E, B>) -> Self::Output {
-        self + (-Ast::from(other))
-    }
-}
-
-impl<E, F: Field> Mul for Ast<E, F, LagrangeCoeff> {
-    type Output = Ast<E, F, LagrangeCoeff>;
-
-    fn mul(self, other: Self) -> Self::Output {
-        Ast::Mul(AstMul(Arc::new(self), Arc::new(other)))
-    }
-}
-
-impl<'a, E: Clone, F: Field> Mul<&'a Ast<E, F, LagrangeCoeff>> for &'a Ast<E, F, LagrangeCoeff> {
-    type Output = Ast<E, F, LagrangeCoeff>;
-
-    fn mul(self, other: &'a Ast<E, F, LagrangeCoeff>) -> Self::Output {
-        self.clone() * other.clone()
-    }
-}
-
-impl<E, F: Field> Mul<AstLeaf<E, LagrangeCoeff>> for Ast<E, F, LagrangeCoeff> {
-    type Output = Ast<E, F, LagrangeCoeff>;
-
-    fn mul(self, other: AstLeaf<E, LagrangeCoeff>) -> Self::Output {
-        Ast::Mul(AstMul(Arc::new(self), Arc::new(other.into())))
-    }
-}
-
-impl<E, F: Field> Mul for Ast<E, F, ExtendedLagrangeCoeff> {
-    type Output = Ast<E, F, ExtendedLagrangeCoeff>;
-
-    fn mul(self, other: Self) -> Self::Output {
-        Ast::Mul(AstMul(Arc::new(self), Arc::new(other)))
-    }
-}
-
-impl<'a, E: Clone, F: Field> Mul<&'a Ast<E, F, ExtendedLagrangeCoeff>>
-    for &'a Ast<E, F, ExtendedLagrangeCoeff>
-{
-    type Output = Ast<E, F, ExtendedLagrangeCoeff>;
-
-    fn mul(self, other: &'a Ast<E, F, ExtendedLagrangeCoeff>) -> Self::Output {
-        self.clone() * other.clone()
-    }
-}
-
-impl<E, F: Field> Mul<AstLeaf<E, ExtendedLagrangeCoeff>> for Ast<E, F, ExtendedLagrangeCoeff> {
-    type Output = Ast<E, F, ExtendedLagrangeCoeff>;
-
-    fn mul(self, other: AstLeaf<E, ExtendedLagrangeCoeff>) -> Self::Output {
-        Ast::Mul(AstMul(Arc::new(self), Arc::new(other.into())))
-    }
-}
-
-impl<E, F: Field, B: Basis> Mul<F> for Ast<E, F, B> {
-    type Output = Ast<E, F, B>;
-
-    fn mul(self, other: F) -> Self::Output {
-        Ast::Scale(Arc::new(self), other)
-    }
-}
-
-impl<E: Clone, F: Field, B: Basis> Mul<F> for &Ast<E, F, B> {
-    type Output = Ast<E, F, B>;
-
-    fn mul(self, other: F) -> Self::Output {
-        Ast::Scale(Arc::new(self.clone()), other)
-    }
-}
-
-impl<E: Clone, F: Field> MulAssign for Ast<E, F, ExtendedLagrangeCoeff> {
-    fn mul_assign(&mut self, rhs: Self) {
-        *self = self.clone().mul(rhs)
-    }
-}
-
-/// Operations which can be performed over a given basis.
-pub(crate) trait BasisOps: Basis {
-    fn empty_poly<F: Field>(domain: &EvaluationDomain<F>) -> Polynomial<F, Self>;
-    fn constant_term<F: Field>(
-        poly_len: usize,
-        chunk_size: usize,
-        chunk_index: usize,
-        scalar: F,
-    ) -> Vec<F>;
-    fn linear_term<F: Field>(
-        domain: &EvaluationDomain<F>,
-        poly_len: usize,
-        chunk_size: usize,
-        chunk_index: usize,
-        scalar: F,
-    ) -> Vec<F>;
-    fn rotate<F: Field>(
-        domain: &EvaluationDomain<F>,
-        poly: &Polynomial<F, Self>,
-        rotation: Rotation,
-    ) -> Polynomial<F, Self>;
-}
-
-impl BasisOps for Coeff {
-    fn empty_poly<F: Field>(domain: &EvaluationDomain<F>) -> Polynomial<F, Self> {
-        domain.empty_coeff()
-    }
-
-    fn constant_term<F: Field>(
-        poly_len: usize,
-        chunk_size: usize,
-        chunk_index: usize,
-        scalar: F,
-    ) -> Vec<F> {
-        let mut chunk = vec![F::ZERO; cmp::min(chunk_size, poly_len - chunk_size * chunk_index)];
-        if chunk_index == 0 {
-            chunk[0] = scalar;
-        }
-        chunk
-    }
-
-    fn linear_term<F: Field>(
-        _: &EvaluationDomain<F>,
-        poly_len: usize,
-        chunk_size: usize,
-        chunk_index: usize,
-        scalar: F,
-    ) -> Vec<F> {
-        let mut chunk = vec![F::ZERO; cmp::min(chunk_size, poly_len - chunk_size * chunk_index)];
-        // If the chunk size is 1 (e.g. if we have a small k and many threads), then the
-        // linear coefficient is the second chunk. Otherwise, the chunk size is greater
-        // than one, and the linear coefficient is the second element of the first chunk.
-        // Note that we check against the original chunk size, not the potentially-short
-        // actual size of the current chunk, because we want to know whether the size of
-        // the previous chunk was 1.
-        if chunk_size == 1 && chunk_index == 1 {
-            chunk[0] = scalar;
-        } else if chunk_index == 0 {
-            chunk[1] = scalar;
-        }
-        chunk
-    }
-
-    fn rotate<F: Field>(
-        _: &EvaluationDomain<F>,
-        _: &Polynomial<F, Self>,
-        _: Rotation,
-    ) -> Polynomial<F, Self> {
-        panic!("Can't rotate polynomials in the standard basis")
-    }
-}
-
-impl BasisOps for LagrangeCoeff {
-    fn empty_poly<F: Field>(domain: &EvaluationDomain<F>) -> Polynomial<F, Self> {
-        domain.empty_lagrange()
-    }
-
-    fn constant_term<F: Field>(
-        poly_len: usize,
-        chunk_size: usize,
-        chunk_index: usize,
-        scalar: F,
-    ) -> Vec<F> {
-        vec![scalar; cmp::min(chunk_size, poly_len - chunk_size * chunk_index)]
-    }
-
-    fn linear_term<F: Field>(
-        domain: &EvaluationDomain<F>,
-        poly_len: usize,
-        chunk_size: usize,
-        chunk_index: usize,
-        scalar: F,
-    ) -> Vec<F> {
-        // Take every power of omega within the chunk, and multiply by scalar.
-        let omega = domain.get_omega();
-        let start = chunk_size * chunk_index;
-        (0..cmp::min(chunk_size, poly_len - start))
-            .scan(omega.pow_vartime(&[start as u64]) * scalar, |acc, _| {
-                let ret = *acc;
-                *acc *= omega;
-                Some(ret)
-            })
-            .collect()
-    }
-
-    fn rotate<F: Field>(
-        _: &EvaluationDomain<F>,
-        poly: &Polynomial<F, Self>,
-        rotation: Rotation,
-    ) -> Polynomial<F, Self> {
-        poly.rotate(rotation)
-    }
-}
-
-impl BasisOps for ExtendedLagrangeCoeff {
-    fn empty_poly<F: Field>(domain: &EvaluationDomain<F>) -> Polynomial<F, Self> {
-        domain.empty_extended()
-    }
-
-    fn constant_term<F: Field>(
-        poly_len: usize,
-        chunk_size: usize,
-        chunk_index: usize,
-        scalar: F,
-    ) -> Vec<F> {
-        vec![scalar; cmp::min(chunk_size, poly_len - chunk_size * chunk_index)]
-    }
-
-    fn linear_term<F: Field>(
-        domain: &EvaluationDomain<F>,
-        poly_len: usize,
-        chunk_size: usize,
-        chunk_index: usize,
-        scalar: F,
-    ) -> Vec<F> {
-        // Take every power of the extended omega within the chunk, and multiply by scalar.
-        let omega = domain.get_extended_omega();
-        let start = chunk_size * chunk_index;
-        (0..cmp::min(chunk_size, poly_len - start))
-            .scan(
-                omega.pow_vartime(&[start as u64]) * F::ZETA * scalar,
-                |acc, _| {
-                    let ret = *acc;
-                    *acc *= omega;
-                    Some(ret)
-                },
-            )
-            .collect()
-    }
-
-    fn rotate<F: Field>(
-        domain: &EvaluationDomain<F>,
-        poly: &Polynomial<F, Self>,
-        rotation: Rotation,
-    ) -> Polynomial<F, Self> {
-        domain.rotate_extended(poly, rotation)
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use std::iter;
-
-    use halo2curves::pasta::pallas;
-
-    use super::{get_chunk_params, new_evaluator, Ast, BasisOps, Evaluator};
-    use crate::{
-        multicore,
-        poly::{Coeff, EvaluationDomain, ExtendedLagrangeCoeff, LagrangeCoeff},
-    };
-
-    #[test]
-    fn short_chunk_regression_test() {
-        // Pick the smallest polynomial length that is guaranteed to produce a short chunk
-        // on this machine.
-        let k = match (1..16)
-            .map(|k| (k, get_chunk_params(1 << k)))
-            .find(|(k, (chunk_size, num_chunks))| (1 << k) < chunk_size * num_chunks)
-            .map(|(k, _)| k)
-        {
-            Some(k) => k,
-            None => {
-                // We are on a machine with a power-of-two number of threads, and cannot
-                // trigger the bug.
-                eprintln!(
-                    "can't find a polynomial length for short_chunk_regression_test; skipping"
-                );
-                return;
-            }
-        };
-        eprintln!("Testing short-chunk regression with k = {}", k);
-
-        fn test_case<E: Copy + Send + Sync, B: BasisOps>(
-            k: u32,
-            mut evaluator: Evaluator<E, pallas::Base, B>,
-        ) {
-            // Instantiate the evaluator with a trivial polynomial.
-            let domain = EvaluationDomain::new(1, k);
-            evaluator.register_poly(B::empty_poly(&domain));
-
-            // With the bug present, these will panic.
-            let _ = evaluator.evaluate(&Ast::ConstantTerm(pallas::Base::zero()), &domain);
-            let _ = evaluator.evaluate(&Ast::LinearTerm(pallas::Base::zero()), &domain);
-        }
-
-        test_case(k, new_evaluator::<_, _, Coeff>(|| {}));
-        test_case(k, new_evaluator::<_, _, LagrangeCoeff>(|| {}));
-        test_case(k, new_evaluator::<_, _, ExtendedLagrangeCoeff>(|| {}));
-    }
-}
diff --git a/halo2_proofs/src/poly/ipa/commitment.rs b/halo2_proofs/src/poly/ipa/commitment.rs
index f9b4ad059b..7be053c49c 100644
--- a/halo2_proofs/src/poly/ipa/commitment.rs
+++ b/halo2_proofs/src/poly/ipa/commitment.rs
@@ -3,18 +3,14 @@
 //!
 //! [halo]: https://eprint.iacr.org/2019/1021
 
-use crate::arithmetic::{
-    best_fft, best_multiexp, g_to_lagrange, parallelize, CurveAffine, CurveExt,
-};
+use crate::arithmetic::{best_multiexp, g_to_lagrange, parallelize, CurveAffine, CurveExt};
 use crate::helpers::CurveRead;
-use crate::poly::commitment::{Blind, CommitmentScheme, Params, ParamsProver, ParamsVerifier, MSM};
+use crate::poly::commitment::{Blind, CommitmentScheme, Params, ParamsProver, ParamsVerifier};
 use crate::poly::ipa::msm::MSMIPA;
 use crate::poly::{Coeff, LagrangeCoeff, Polynomial};
 
-use ff::{Field, PrimeField};
-use group::{prime::PrimeCurveAffine, Curve, Group};
+use group::{Curve, Group};
 use std::marker::PhantomData;
-use std::ops::{Add, AddAssign, Mul, MulAssign};
 
 mod prover;
 mod verifier;
@@ -233,21 +229,13 @@ impl<'params, C: CurveAffine> ParamsProver<'params, C> for ParamsIPA<C> {
 
 #[cfg(test)]
 mod test {
-
-    use crate::arithmetic::{best_fft, best_multiexp, parallelize, CurveAffine, CurveExt};
-    use crate::helpers::CurveRead;
     use crate::poly::commitment::ParamsProver;
-    use crate::poly::commitment::{Blind, CommitmentScheme, Params, MSM};
+    use crate::poly::commitment::{Blind, Params, MSM};
     use crate::poly::ipa::commitment::{create_proof, verify_proof, ParamsIPA};
     use crate::poly::ipa::msm::MSMIPA;
-    use crate::poly::{Coeff, LagrangeCoeff, Polynomial};
-
-    use ff::{Field, PrimeField};
-    use group::{prime::PrimeCurveAffine, Curve, Group};
-    use std::marker::PhantomData;
-    use std::ops::{Add, AddAssign, Mul, MulAssign};
 
-    use std::io;
+    use ff::Field;
+    use group::Curve;
 
     #[test]
     fn test_commit_lagrange_epaffine() {
diff --git a/halo2_proofs/src/poly/ipa/commitment/prover.rs b/halo2_proofs/src/poly/ipa/commitment/prover.rs
index d176987c96..344dbc0e65 100644
--- a/halo2_proofs/src/poly/ipa/commitment/prover.rs
+++ b/halo2_proofs/src/poly/ipa/commitment/prover.rs
@@ -1,7 +1,7 @@
 use ff::Field;
 use rand_core::RngCore;
 
-use super::{Params, ParamsIPA};
+use super::ParamsIPA;
 use crate::arithmetic::{
     best_multiexp, compute_inner_product, eval_polynomial, parallelize, CurveAffine,
 };
@@ -11,7 +11,7 @@ use crate::poly::{commitment::Blind, Coeff, Polynomial};
 use crate::transcript::{EncodedChallenge, TranscriptWrite};
 
 use group::Curve;
-use std::io::{self, Write};
+use std::io::{self};
 
 /// Create a polynomial commitment opening proof for the polynomial defined
 /// by the coefficients `px`, the blinding factor `blind` used for the
@@ -51,7 +51,7 @@ pub fn create_proof<
     // Evaluate the random polynomial at x_3
     let s_at_x3 = eval_polynomial(&s_poly[..], x_3);
     // Subtract constant coefficient to get a random polynomial with a root at x_3
-    s_poly[0] = s_poly[0] - &s_at_x3;
+    s_poly[0] -= &s_at_x3;
     // And sample a random blind
     let s_poly_blind = Blind(C::Scalar::random(&mut rng));
 
@@ -72,7 +72,7 @@ pub fn create_proof<
     // zero.
     let mut p_prime_poly = s_poly * xi + p_poly;
     let v = eval_polynomial(&p_prime_poly, x_3);
-    p_prime_poly[0] = p_prime_poly[0] - &v;
+    p_prime_poly[0] -= &v;
     let p_prime_blind = s_poly_blind * Blind(xi) + p_blind;
 
     // This accumulates the synthetic blinding factor `f` starting
diff --git a/halo2_proofs/src/poly/ipa/commitment/verifier.rs b/halo2_proofs/src/poly/ipa/commitment/verifier.rs
index 0b60842899..cf258625d5 100644
--- a/halo2_proofs/src/poly/ipa/commitment/verifier.rs
+++ b/halo2_proofs/src/poly/ipa/commitment/verifier.rs
@@ -1,18 +1,9 @@
-use std::io::Read;
-
-use group::{
-    ff::{BatchInvert, Field},
-    Curve,
-};
+use group::ff::{BatchInvert, Field};
 
 use super::ParamsIPA;
-use crate::poly::ipa::commitment::{IPACommitmentScheme, ParamsVerifierIPA};
-use crate::{
-    arithmetic::{best_multiexp, CurveAffine},
-    poly::ipa::strategy::GuardIPA,
-};
+use crate::{arithmetic::CurveAffine, poly::ipa::strategy::GuardIPA};
 use crate::{
-    poly::{commitment::MSM, ipa::msm::MSMIPA, strategy::Guard, Error},
+    poly::{commitment::MSM, ipa::msm::MSMIPA, Error},
     transcript::{EncodedChallenge, TranscriptRead},
 };
 
@@ -75,6 +66,9 @@ pub fn verify_proof<'params, C: CurveAffine, E: EncodedChallenge<C>, T: Transcri
     //   P' + \sum([u_j^{-1}] L_j) + \sum([u_j] R_j)
     //   + [-c] G'_0 + [-cbz] U + [-f] W
     //   = 0
+    //
+    // Note that the guard returned from this function does not include
+    // the [-c]G'_0 term.
 
     let c = transcript.read_scalar().map_err(|_| Error::SamplingError)?;
     let neg_c = -c;
diff --git a/halo2_proofs/src/poly/ipa/msm.rs b/halo2_proofs/src/poly/ipa/msm.rs
index 3316e25337..a615ddce49 100644
--- a/halo2_proofs/src/poly/ipa/msm.rs
+++ b/halo2_proofs/src/poly/ipa/msm.rs
@@ -1,9 +1,5 @@
-use super::commitment::{IPACommitmentScheme, ParamsIPA};
-use crate::arithmetic::{best_multiexp, parallelize, CurveAffine};
-use crate::poly::{
-    commitment::{CommitmentScheme, Params, MSM},
-    ipa::commitment::ParamsVerifierIPA,
-};
+use crate::arithmetic::{best_multiexp, CurveAffine};
+use crate::poly::{commitment::MSM, ipa::commitment::ParamsVerifierIPA};
 use ff::Field;
 use group::Group;
 use std::collections::BTreeMap;
@@ -222,13 +218,10 @@ impl<'a, C: CurveAffine> MSMIPA<'a, C> {
 
 #[cfg(test)]
 mod tests {
-    use super::ParamsIPA;
-    use crate::poly::commitment::ParamsProver;
     use crate::poly::{
-        commitment::{Params, MSM},
-        ipa::msm::MSMIPA,
+        commitment::{ParamsProver, MSM},
+        ipa::{commitment::ParamsIPA, msm::MSMIPA},
     };
-    use group::Curve;
     use halo2curves::{
         pasta::{Ep, EpAffine, Fp, Fq},
         CurveAffine,
diff --git a/halo2_proofs/src/poly/ipa/multiopen.rs b/halo2_proofs/src/poly/ipa/multiopen.rs
index fd6aa78544..b78acb5934 100644
--- a/halo2_proofs/src/poly/ipa/multiopen.rs
+++ b/halo2_proofs/src/poly/ipa/multiopen.rs
@@ -4,7 +4,7 @@
 //! [halo]: https://eprint.iacr.org/2019/1021
 
 use super::*;
-use crate::{arithmetic::CurveAffine, poly::query::Query, transcript::ChallengeScalar};
+use crate::{poly::query::Query, transcript::ChallengeScalar};
 use ff::Field;
 use std::collections::{BTreeMap, BTreeSet};
 
diff --git a/halo2_proofs/src/poly/ipa/multiopen/prover.rs b/halo2_proofs/src/poly/ipa/multiopen/prover.rs
index 6d65e7ae64..8998f38723 100644
--- a/halo2_proofs/src/poly/ipa/multiopen/prover.rs
+++ b/halo2_proofs/src/poly/ipa/multiopen/prover.rs
@@ -1,9 +1,7 @@
-use super::{
-    construct_intermediate_sets, ChallengeX1, ChallengeX2, ChallengeX3, ChallengeX4, Query,
-};
+use super::{construct_intermediate_sets, ChallengeX1, ChallengeX2, ChallengeX3, ChallengeX4};
 use crate::arithmetic::{eval_polynomial, kate_division, CurveAffine};
 use crate::poly::commitment::ParamsProver;
-use crate::poly::commitment::{Blind, Params, Prover};
+use crate::poly::commitment::{Blind, Prover};
 use crate::poly::ipa::commitment::{self, IPACommitmentScheme, ParamsIPA};
 use crate::poly::query::ProverQuery;
 use crate::poly::{Coeff, Polynomial};
diff --git a/halo2_proofs/src/poly/ipa/multiopen/verifier.rs b/halo2_proofs/src/poly/ipa/multiopen/verifier.rs
index 391f89e15b..d559e33384 100644
--- a/halo2_proofs/src/poly/ipa/multiopen/verifier.rs
+++ b/halo2_proofs/src/poly/ipa/multiopen/verifier.rs
@@ -1,20 +1,14 @@
 use std::fmt::Debug;
-use std::io::Read;
-use std::marker::PhantomData;
 
 use ff::Field;
-use rand_core::RngCore;
 
-use super::{
-    construct_intermediate_sets, ChallengeX1, ChallengeX2, ChallengeX3, ChallengeX4, Query,
-};
+use super::{construct_intermediate_sets, ChallengeX1, ChallengeX2, ChallengeX3, ChallengeX4};
 use crate::arithmetic::{eval_polynomial, lagrange_interpolate, CurveAffine};
 use crate::poly::commitment::{Params, Verifier, MSM};
 use crate::poly::ipa::commitment::{IPACommitmentScheme, ParamsIPA, ParamsVerifierIPA};
 use crate::poly::ipa::msm::MSMIPA;
 use crate::poly::ipa::strategy::GuardIPA;
 use crate::poly::query::{CommitmentReference, VerifierQuery};
-use crate::poly::strategy::VerificationStrategy;
 use crate::poly::Error;
 use crate::transcript::{EncodedChallenge, TranscriptRead};
 
@@ -57,7 +51,9 @@ impl<'params, C: CurveAffine> Verifier<'params, IPACommitmentScheme<C>>
 
         // Compress the commitments and expected evaluations at x together.
         // using the challenge x_1
-        let mut q_commitments: Vec<_> = vec![self.params.empty_msm(); point_sets.len()];
+        let mut q_commitments: Vec<_> = vec![
+        (self.params.empty_msm(), C::Scalar::ONE); // (accumulator, next x_1 power).
+        point_sets.len()];
 
         // A vec of vecs of evals. The outer vec corresponds to the point set,
         // while the inner vec corresponds to the points in a particular set.
@@ -65,28 +61,32 @@ impl<'params, C: CurveAffine> Verifier<'params, IPACommitmentScheme<C>>
         for point_set in point_sets.iter() {
             q_eval_sets.push(vec![C::Scalar::ZERO; point_set.len()]);
         }
+
         {
             let mut accumulate = |set_idx: usize,
                                   new_commitment: CommitmentReference<C, MSMIPA<'params, C>>,
                                   evals: Vec<C::Scalar>| {
-                q_commitments[set_idx].scale(*x_1);
+                let (q_commitment, x_1_power) = &mut q_commitments[set_idx];
                 match new_commitment {
                     CommitmentReference::Commitment(c) => {
-                        q_commitments[set_idx].append_term(C::Scalar::ONE, (*c).into());
+                        q_commitment.append_term(*x_1_power, (*c).into());
                     }
                     CommitmentReference::MSM(msm) => {
-                        q_commitments[set_idx].add_msm(msm);
+                        let mut msm = msm.clone();
+                        msm.scale(*x_1_power);
+                        q_commitment.add_msm(&msm);
                     }
                 }
                 for (eval, set_eval) in evals.iter().zip(q_eval_sets[set_idx].iter_mut()) {
-                    *set_eval *= &(*x_1);
-                    *set_eval += eval;
+                    *set_eval += (*eval) * (*x_1_power);
                 }
+                *x_1_power *= *x_1;
             };
 
             // Each commitment corresponds to evaluations at a set of points.
             // For each set, we collapse each commitment's evals pointwise.
-            for commitment_data in commitment_map.into_iter() {
+            // Run in order of increasing x_1 powers.
+            for commitment_data in commitment_map.into_iter().rev() {
                 accumulate(
                     commitment_data.set_index,  // set_idx,
                     commitment_data.commitment, // commitment,
@@ -135,7 +135,7 @@ impl<'params, C: CurveAffine> Verifier<'params, IPACommitmentScheme<C>>
         msm.append_term(C::Scalar::ONE, q_prime_commitment.into());
         let (msm, v) = q_commitments.into_iter().zip(u.iter()).fold(
             (msm, msm_eval),
-            |(mut msm, msm_eval), (q_commitment, q_eval)| {
+            |(mut msm, msm_eval), ((q_commitment, _), q_eval)| {
                 msm.scale(*x_4);
                 msm.add_msm(&q_commitment);
                 (msm, msm_eval * &(*x_4) + q_eval)
diff --git a/halo2_proofs/src/poly/ipa/strategy.rs b/halo2_proofs/src/poly/ipa/strategy.rs
index c8d385f90c..d2d1b3d364 100644
--- a/halo2_proofs/src/poly/ipa/strategy.rs
+++ b/halo2_proofs/src/poly/ipa/strategy.rs
@@ -1,10 +1,6 @@
-use std::marker::PhantomData;
-
-use super::commitment::{IPACommitmentScheme, ParamsIPA, ParamsVerifierIPA};
+use super::commitment::{IPACommitmentScheme, ParamsIPA};
 use super::msm::MSMIPA;
 use super::multiopen::VerifierIPA;
-use crate::poly::commitment::CommitmentScheme;
-use crate::transcript::TranscriptRead;
 use crate::{
     arithmetic::best_multiexp,
     plonk::Error,
@@ -12,12 +8,11 @@ use crate::{
         commitment::MSM,
         strategy::{Guard, VerificationStrategy},
     },
-    transcript::EncodedChallenge,
 };
 use ff::Field;
 use group::Curve;
 use halo2curves::CurveAffine;
-use rand_core::{OsRng, RngCore};
+use rand_core::OsRng;
 
 /// Wrapper for verification accumulator
 #[derive(Debug, Clone)]
diff --git a/halo2_proofs/src/poly/kzg/commitment.rs b/halo2_proofs/src/poly/kzg/commitment.rs
index e8f6bb1529..08a1a88869 100644
--- a/halo2_proofs/src/poly/kzg/commitment.rs
+++ b/halo2_proofs/src/poly/kzg/commitment.rs
@@ -1,8 +1,6 @@
-use crate::arithmetic::{
-    best_fft, best_multiexp, g_to_lagrange, parallelize, CurveAffine, CurveExt,
-};
+use crate::arithmetic::{best_multiexp, g_to_lagrange, parallelize};
 use crate::helpers::SerdeCurveAffine;
-use crate::poly::commitment::{Blind, CommitmentScheme, Params, ParamsProver, ParamsVerifier, MSM};
+use crate::poly::commitment::{Blind, CommitmentScheme, Params, ParamsProver, ParamsVerifier};
 use crate::poly::{Coeff, LagrangeCoeff, Polynomial};
 use crate::SerdeFormat;
 
@@ -12,7 +10,6 @@ use halo2curves::pairing::Engine;
 use rand_core::{OsRng, RngCore};
 use std::fmt::Debug;
 use std::marker::PhantomData;
-use std::ops::{Add, AddAssign, Mul, MulAssign};
 
 use std::io;
 
@@ -383,21 +380,10 @@ where
 
 #[cfg(test)]
 mod test {
-    use crate::arithmetic::{best_fft, best_multiexp, parallelize, CurveAffine, CurveExt};
     use crate::poly::commitment::ParamsProver;
-    use crate::poly::commitment::{Blind, CommitmentScheme, Params, MSM};
-    use crate::poly::kzg::commitment::{ParamsKZG, ParamsVerifierKZG};
-    use crate::poly::kzg::msm::MSMKZG;
-    use crate::poly::kzg::multiopen::ProverSHPLONK;
-    use crate::poly::{Coeff, LagrangeCoeff, Polynomial};
-
-    use ff::{Field, PrimeField};
-    use group::{prime::PrimeCurveAffine, Curve, Group};
-    use halo2curves::bn256::G1Affine;
-    use std::marker::PhantomData;
-    use std::ops::{Add, AddAssign, Mul, MulAssign};
-
-    use std::io;
+    use crate::poly::commitment::{Blind, Params};
+    use crate::poly::kzg::commitment::ParamsKZG;
+    use ff::Field;
 
     #[test]
     fn test_commit_lagrange() {
@@ -428,13 +414,8 @@ mod test {
     fn test_parameter_serialisation_roundtrip() {
         const K: u32 = 4;
 
-        use ff::Field;
-        use rand_core::OsRng;
-
-        use super::super::commitment::{Blind, Params};
-        use crate::arithmetic::eval_polynomial;
-        use crate::halo2curves::bn256::{Bn256, Fr};
-        use crate::poly::EvaluationDomain;
+        use super::super::commitment::Params;
+        use crate::halo2curves::bn256::Bn256;
 
         let params0 = ParamsKZG::<Bn256>::new(K);
         let mut data = vec![];
diff --git a/halo2_proofs/src/poly/kzg/msm.rs b/halo2_proofs/src/poly/kzg/msm.rs
index abd8309f56..2cc6d8a1e4 100644
--- a/halo2_proofs/src/poly/kzg/msm.rs
+++ b/halo2_proofs/src/poly/kzg/msm.rs
@@ -1,8 +1,8 @@
 use std::fmt::Debug;
 
-use super::commitment::{KZGCommitmentScheme, ParamsKZG};
+use super::commitment::ParamsKZG;
 use crate::{
-    arithmetic::{best_multiexp, parallelize, CurveAffine},
+    arithmetic::{best_multiexp, parallelize},
     poly::commitment::MSM,
 };
 use group::{Curve, Group};
@@ -92,8 +92,6 @@ impl<E: Engine + Debug> PreMSM<E> {
     }
 
     pub(crate) fn normalize(self) -> MSMKZG<E> {
-        use group::prime::PrimeCurveAffine;
-
         let (scalars, bases) = self
             .projectives_msms
             .into_iter()
diff --git a/halo2_proofs/src/poly/kzg/multiopen/gwc.rs b/halo2_proofs/src/poly/kzg/multiopen/gwc.rs
index 8e7d742fc0..3fd28dd00a 100644
--- a/halo2_proofs/src/poly/kzg/multiopen/gwc.rs
+++ b/halo2_proofs/src/poly/kzg/multiopen/gwc.rs
@@ -4,20 +4,9 @@ mod verifier;
 pub use prover::ProverGWC;
 pub use verifier::VerifierGWC;
 
-use crate::{
-    arithmetic::{eval_polynomial, CurveAffine},
-    poly::{
-        commitment::{Params, ParamsVerifier},
-        query::Query,
-        Coeff, Polynomial,
-    },
-    transcript::ChallengeScalar,
-};
+use crate::{poly::query::Query, transcript::ChallengeScalar};
 use ff::Field;
-use std::{
-    collections::{BTreeMap, BTreeSet},
-    marker::PhantomData,
-};
+use std::marker::PhantomData;
 
 #[derive(Clone, Copy, Debug)]
 struct U {}
diff --git a/halo2_proofs/src/poly/kzg/multiopen/gwc/prover.rs b/halo2_proofs/src/poly/kzg/multiopen/gwc/prover.rs
index d5d977fb2d..89b629bfa4 100644
--- a/halo2_proofs/src/poly/kzg/multiopen/gwc/prover.rs
+++ b/halo2_proofs/src/poly/kzg/multiopen/gwc/prover.rs
@@ -1,23 +1,19 @@
 use super::{construct_intermediate_sets, ChallengeV, Query};
-use crate::arithmetic::{eval_polynomial, kate_division, powers, CurveAffine};
+use crate::arithmetic::{kate_division, powers};
 use crate::helpers::SerdeCurveAffine;
 use crate::poly::commitment::ParamsProver;
 use crate::poly::commitment::Prover;
 use crate::poly::kzg::commitment::{KZGCommitmentScheme, ParamsKZG};
 use crate::poly::query::ProverQuery;
-use crate::poly::Rotation;
-use crate::poly::{
-    commitment::{Blind, Params},
-    Coeff, Polynomial,
-};
+use crate::poly::{commitment::Blind, Polynomial};
 use crate::transcript::{EncodedChallenge, TranscriptWrite};
 
-use ff::{Field, PrimeField};
+use ff::PrimeField;
 use group::Curve;
 use halo2curves::pairing::Engine;
 use rand_core::RngCore;
 use std::fmt::Debug;
-use std::io::{self, Write};
+use std::io;
 use std::marker::PhantomData;
 
 /// Concrete KZG prover with GWC variant
diff --git a/halo2_proofs/src/poly/kzg/multiopen/gwc/verifier.rs b/halo2_proofs/src/poly/kzg/multiopen/gwc/verifier.rs
index 1d0c9468b4..ee5937b292 100644
--- a/halo2_proofs/src/poly/kzg/multiopen/gwc/verifier.rs
+++ b/halo2_proofs/src/poly/kzg/multiopen/gwc/verifier.rs
@@ -1,28 +1,20 @@
 use std::fmt::Debug;
-use std::io::Read;
-use std::marker::PhantomData;
 
 use super::{construct_intermediate_sets, ChallengeU, ChallengeV};
-use crate::arithmetic::{eval_polynomial, lagrange_interpolate, powers, CurveAffine};
+use crate::arithmetic::powers;
 use crate::helpers::SerdeCurveAffine;
 use crate::poly::commitment::Verifier;
 use crate::poly::commitment::MSM;
 use crate::poly::kzg::commitment::{KZGCommitmentScheme, ParamsKZG};
 use crate::poly::kzg::msm::{DualMSM, MSMKZG};
-use crate::poly::kzg::strategy::{AccumulatorStrategy, GuardKZG, SingleStrategy};
+use crate::poly::kzg::strategy::GuardKZG;
 use crate::poly::query::Query;
 use crate::poly::query::{CommitmentReference, VerifierQuery};
-use crate::poly::strategy::VerificationStrategy;
-use crate::poly::{
-    commitment::{Params, ParamsVerifier},
-    Error,
-};
+use crate::poly::Error;
 use crate::transcript::{EncodedChallenge, TranscriptRead};
 
 use ff::{Field, PrimeField};
-use group::Group;
-use halo2curves::pairing::{Engine, MillerLoopResult, MultiMillerLoop};
-use rand_core::OsRng;
+use halo2curves::pairing::{Engine, MultiMillerLoop};
 
 #[derive(Debug)]
 /// Concrete KZG verifier with GWC variant
diff --git a/halo2_proofs/src/poly/kzg/multiopen/shplonk.rs b/halo2_proofs/src/poly/kzg/multiopen/shplonk.rs
index d14132fb43..bed814cc68 100644
--- a/halo2_proofs/src/poly/kzg/multiopen/shplonk.rs
+++ b/halo2_proofs/src/poly/kzg/multiopen/shplonk.rs
@@ -1,21 +1,16 @@
 mod prover;
 mod verifier;
 
-use crate::{
-    arithmetic::{eval_polynomial, lagrange_interpolate, CurveAffine},
-    poly::{query::Query, Coeff, Polynomial},
-    transcript::ChallengeScalar,
-};
+use crate::multicore::IntoParallelIterator;
+use crate::{poly::query::Query, transcript::ChallengeScalar};
 use ff::Field;
 pub use prover::ProverSHPLONK;
-use rayon::prelude::*;
-use std::{
-    collections::{btree_map::Entry, BTreeMap, BTreeSet, HashMap, HashSet},
-    marker::PhantomData,
-    sync::Arc,
-};
+use std::collections::BTreeSet;
 pub use verifier::VerifierSHPLONK;
 
+#[cfg(feature = "multicore")]
+use crate::multicore::ParallelIterator;
+
 #[derive(Clone, Copy, Debug)]
 struct U {}
 type ChallengeU<F> = ChallengeScalar<F, U>;
@@ -126,7 +121,8 @@ where
                 .into_par_iter()
                 .map(|commitment| {
                     let evals: Vec<F> = rotations_vec
-                        .par_iter()
+                        .as_slice()
+                        .into_par_iter()
                         .map(|&&rotation| get_eval(commitment, rotation))
                         .collect();
                     Commitment((commitment, evals))
@@ -148,18 +144,10 @@ where
 
 #[cfg(test)]
 mod proptests {
-    use proptest::{
-        collection::vec,
-        prelude::*,
-        sample::{select, subsequence},
-        strategy::Strategy,
-    };
-
     use super::{construct_intermediate_sets, Commitment, IntermediateSets};
-    use crate::poly::Rotation;
-    use ff::{Field, FromUniformBytes};
+    use ff::FromUniformBytes;
     use halo2curves::pasta::Fp;
-    use std::collections::BTreeMap;
+    use proptest::{collection::vec, prelude::*, sample::select};
     use std::convert::TryFrom;
 
     #[derive(Debug, Clone)]
diff --git a/halo2_proofs/src/poly/kzg/multiopen/shplonk/prover.rs b/halo2_proofs/src/poly/kzg/multiopen/shplonk/prover.rs
index bb50eafe58..ba1e2822ce 100644
--- a/halo2_proofs/src/poly/kzg/multiopen/shplonk/prover.rs
+++ b/halo2_proofs/src/poly/kzg/multiopen/shplonk/prover.rs
@@ -1,5 +1,5 @@
 use super::{
-    construct_intermediate_sets, ChallengeU, ChallengeV, ChallengeY, Commitment, Query, RotationSet,
+    construct_intermediate_sets, ChallengeU, ChallengeV, ChallengeY, Commitment, RotationSet,
 };
 use crate::arithmetic::{
     eval_polynomial, evaluate_vanishing_polynomial, kate_division, lagrange_interpolate,
@@ -9,20 +9,22 @@ use crate::helpers::SerdeCurveAffine;
 use crate::poly::commitment::{Blind, ParamsProver, Prover};
 use crate::poly::kzg::commitment::{KZGCommitmentScheme, ParamsKZG};
 use crate::poly::query::{PolynomialPointer, ProverQuery};
-use crate::poly::Rotation;
-use crate::poly::{commitment::Params, Coeff, Polynomial};
+use crate::poly::{Coeff, Polynomial};
 use crate::transcript::{EncodedChallenge, TranscriptWrite};
 
+use crate::multicore::IntoParallelIterator;
 use ff::{Field, PrimeField};
 use group::Curve;
 use halo2curves::pairing::Engine;
 use rand_core::RngCore;
-use rayon::prelude::*;
 use std::fmt::Debug;
-use std::io::{self, Write};
+use std::io;
 use std::marker::PhantomData;
 use std::ops::MulAssign;
 
+#[cfg(feature = "multicore")]
+use crate::multicore::ParallelIterator;
+
 fn div_by_vanishing<F: Field>(poly: Polynomial<F, Coeff>, roots: &[F]) -> Vec<F> {
     let poly = roots
         .iter()
@@ -136,40 +138,41 @@ where
         // for different sets that are already combined with anoter challenge
         let y: ChallengeY<_> = transcript.squeeze_challenge_scalar();
 
-        let quotient_contribution =
-            |rotation_set: &RotationSetExtension<E::G1Affine>| -> Polynomial<E::Scalar, Coeff> {
-                // [P_i_0(X) - R_i_0(X), P_i_1(X) - R_i_1(X), ... ]
-                let numerators = rotation_set
-                    .commitments
-                    .par_iter()
-                    .map(|commitment| commitment.quotient_contribution())
-                    .collect::<Vec<_>>();
-
-                // define numerator polynomial as
-                // N_i_j(X) = (P_i_j(X) - R_i_j(X))
-                // and combine polynomials with same evaluation point set
-                // N_i(X) = linear_combinination(y, N_i_j(X))
-                // where y is random scalar to combine numerator polynomials
-                let n_x = numerators
-                    .into_iter()
-                    .zip(powers(*y))
-                    .map(|(numerator, power_of_y)| numerator * power_of_y)
-                    .reduce(|acc, numerator| acc + &numerator)
-                    .unwrap();
-
-                let points = &rotation_set.points[..];
-
-                // quotient contribution of this evaluation set is
-                // Q_i(X) = N_i(X) / Z_i(X) where
-                // Z_i(X) = (x - r_i_0) * (x - r_i_1) * ...
-                let mut poly = div_by_vanishing(n_x, points);
-                poly.resize(self.params.n as usize, E::Scalar::ZERO);
-
-                Polynomial {
-                    values: poly,
-                    _marker: PhantomData,
-                }
-            };
+        let quotient_contribution = |rotation_set: &RotationSetExtension<E::G1Affine>| {
+            // [P_i_0(X) - R_i_0(X), P_i_1(X) - R_i_1(X), ... ]
+            #[allow(clippy::needless_collect)]
+            let numerators = rotation_set
+                .commitments
+                .as_slice()
+                .into_par_iter()
+                .map(|commitment| commitment.quotient_contribution())
+                .collect::<Vec<_>>();
+
+            // define numerator polynomial as
+            // N_i_j(X) = (P_i_j(X) - R_i_j(X))
+            // and combine polynomials with same evaluation point set
+            // N_i(X) = linear_combinination(y, N_i_j(X))
+            // where y is random scalar to combine numerator polynomials
+            let n_x = numerators
+                .into_iter()
+                .zip(powers(*y))
+                .map(|(numerator, power_of_y)| numerator * power_of_y)
+                .reduce(|acc, numerator| acc + &numerator)
+                .unwrap();
+
+            let points = &rotation_set.points[..];
+
+            // quotient contribution of this evaluation set is
+            // Q_i(X) = N_i(X) / Z_i(X) where
+            // Z_i(X) = (x - r_i_0) * (x - r_i_1) * ...
+            let mut poly = div_by_vanishing(n_x, points);
+            poly.resize(self.params.n as usize, E::Scalar::ZERO);
+
+            Polynomial {
+                values: poly,
+                _marker: PhantomData,
+            }
+        };
 
         let intermediate_sets = construct_intermediate_sets(queries);
         let (rotation_sets, super_point_set) = (
@@ -182,7 +185,8 @@ where
             .map(|rotation_set| {
                 let commitments: Vec<CommitmentExtension<E::G1Affine>> = rotation_set
                     .commitments
-                    .par_iter()
+                    .as_slice()
+                    .into_par_iter()
                     .map(|commitment_data| commitment_data.extend(&rotation_set.points))
                     .collect();
                 rotation_set.extend(commitments)
@@ -191,8 +195,10 @@ where
 
         let v: ChallengeV<_> = transcript.squeeze_challenge_scalar();
 
+        #[allow(clippy::needless_collect)]
         let quotient_polynomials = rotation_sets
-            .par_iter()
+            .as_slice()
+            .into_par_iter()
             .map(quotient_contribution)
             .collect::<Vec<_>>();
 
@@ -207,36 +213,43 @@ where
         transcript.write_point(h)?;
         let u: ChallengeU<_> = transcript.squeeze_challenge_scalar();
 
-        let linearisation_contribution =
-            |rotation_set: RotationSetExtension<E::G1Affine>| -> (Polynomial<E::Scalar, Coeff>, E::Scalar) {
-                let mut diffs = super_point_set.clone();
-                for point in rotation_set.points.iter() {
-                    diffs.remove(point);
-                }
-                let diffs = diffs.into_iter().collect::<Vec<_>>();
-
-                // calculate difference vanishing polynomial evaluation
-                let z_i = evaluate_vanishing_polynomial(&diffs[..], *u);
-
-                // inner linearisation contibutions are
-                // [P_i_0(X) - r_i_0, P_i_1(X) - r_i_1, ... ] where
-                // r_i_j = R_i_j(u) is the evaluation of low degree equivalent polynomial
-                // where u is random evaluation point
-                let inner_contributions = rotation_set
-                    .commitments
-                    .par_iter()
-                    .map(|commitment| commitment.linearisation_contribution(*u)).collect::<Vec<_>>();
-
-                // define inner contributor polynomial as
-                // L_i_j(X) = (P_i_j(X) - r_i_j)
-                // and combine polynomials with same evaluation point set
-                // L_i(X) = linear_combinination(y, L_i_j(X))
-                // where y is random scalar to combine inner contibutors
-                let l_x: Polynomial<E::Scalar, Coeff> = inner_contributions.into_iter().zip(powers(*y)).map(|(poly, power_of_y)| poly * power_of_y).reduce(|acc, poly| acc + &poly).unwrap();
-
-                // finally scale l_x by difference vanishing polynomial evaluation z_i
-                (l_x * z_i, z_i)
-            };
+        let linearisation_contribution = |rotation_set: RotationSetExtension<E::G1Affine>| {
+            let mut diffs = super_point_set.clone();
+            for point in rotation_set.points.iter() {
+                diffs.remove(point);
+            }
+            let diffs = diffs.into_iter().collect::<Vec<_>>();
+
+            // calculate difference vanishing polynomial evaluation
+            let z_i = evaluate_vanishing_polynomial(&diffs[..], *u);
+
+            // inner linearisation contibutions are
+            // [P_i_0(X) - r_i_0, P_i_1(X) - r_i_1, ... ] where
+            // r_i_j = R_i_j(u) is the evaluation of low degree equivalent polynomial
+            // where u is random evaluation point
+            #[allow(clippy::needless_collect)]
+            let inner_contributions = rotation_set
+                .commitments
+                .as_slice()
+                .into_par_iter()
+                .map(|commitment| commitment.linearisation_contribution(*u))
+                .collect::<Vec<_>>();
+
+            // define inner contributor polynomial as
+            // L_i_j(X) = (P_i_j(X) - r_i_j)
+            // and combine polynomials with same evaluation point set
+            // L_i(X) = linear_combinination(y, L_i_j(X))
+            // where y is random scalar to combine inner contibutors
+            let l_x: Polynomial<E::Scalar, Coeff> = inner_contributions
+                .into_iter()
+                .zip(powers(*y))
+                .map(|(poly, power_of_y)| poly * power_of_y)
+                .reduce(|acc, poly| acc + &poly)
+                .unwrap();
+
+            // finally scale l_x by difference vanishing polynomial evaluation z_i
+            (l_x * z_i, z_i)
+        };
 
         #[allow(clippy::type_complexity)]
         let (linearisation_contibutions, z_diffs): (
diff --git a/halo2_proofs/src/poly/kzg/multiopen/shplonk/verifier.rs b/halo2_proofs/src/poly/kzg/multiopen/shplonk/verifier.rs
index d1d1660e9c..53930f88dd 100644
--- a/halo2_proofs/src/poly/kzg/multiopen/shplonk/verifier.rs
+++ b/halo2_proofs/src/poly/kzg/multiopen/shplonk/verifier.rs
@@ -1,10 +1,9 @@
 use std::fmt::Debug;
-use std::io::Read;
 
 use super::ChallengeY;
 use super::{construct_intermediate_sets, ChallengeU, ChallengeV};
 use crate::arithmetic::{
-    eval_polynomial, evaluate_vanishing_polynomial, lagrange_interpolate, powers, CurveAffine,
+    eval_polynomial, evaluate_vanishing_polynomial, lagrange_interpolate, powers,
 };
 use crate::helpers::SerdeCurveAffine;
 use crate::poly::commitment::Verifier;
@@ -12,19 +11,12 @@ use crate::poly::commitment::MSM;
 use crate::poly::kzg::commitment::{KZGCommitmentScheme, ParamsKZG};
 use crate::poly::kzg::msm::DualMSM;
 use crate::poly::kzg::msm::{PreMSM, MSMKZG};
-use crate::poly::kzg::strategy::{AccumulatorStrategy, GuardKZG, SingleStrategy};
-use crate::poly::query::Query;
+use crate::poly::kzg::strategy::GuardKZG;
 use crate::poly::query::{CommitmentReference, VerifierQuery};
-use crate::poly::strategy::VerificationStrategy;
-use crate::poly::{
-    commitment::{Params, ParamsVerifier},
-    Error,
-};
+use crate::poly::Error;
 use crate::transcript::{EncodedChallenge, TranscriptRead};
 use ff::{Field, PrimeField};
-use group::Group;
-use halo2curves::pairing::{Engine, MillerLoopResult, MultiMillerLoop};
-use rand_core::OsRng;
+use halo2curves::pairing::{Engine, MultiMillerLoop};
 use std::ops::MulAssign;
 
 /// Concrete KZG multiopen verifier with SHPLONK variant
diff --git a/halo2_proofs/src/poly/kzg/strategy.rs b/halo2_proofs/src/poly/kzg/strategy.rs
index 15cdba2069..14b6565b80 100644
--- a/halo2_proofs/src/poly/kzg/strategy.rs
+++ b/halo2_proofs/src/poly/kzg/strategy.rs
@@ -1,27 +1,19 @@
-use std::{fmt::Debug, marker::PhantomData};
-
 use super::{
     commitment::{KZGCommitmentScheme, ParamsKZG},
-    msm::{DualMSM, MSMKZG},
-    multiopen::VerifierGWC,
+    msm::DualMSM,
 };
 use crate::{
     helpers::SerdeCurveAffine,
     plonk::Error,
     poly::{
-        commitment::{Verifier, MSM},
-        ipa::msm::MSMIPA,
+        commitment::Verifier,
         strategy::{Guard, VerificationStrategy},
     },
-    transcript::{EncodedChallenge, TranscriptRead},
 };
 use ff::{Field, PrimeField};
-use group::Group;
-use halo2curves::{
-    pairing::{Engine, MillerLoopResult, MultiMillerLoop},
-    CurveAffine,
-};
+use halo2curves::pairing::{Engine, MultiMillerLoop};
 use rand_core::OsRng;
+use std::fmt::Debug;
 
 /// Wrapper for linear verification accumulator
 #[derive(Debug, Clone)]
diff --git a/halo2_proofs/src/poly/multiopen_test.rs b/halo2_proofs/src/poly/multiopen_test.rs
index d57243f712..47c6731167 100644
--- a/halo2_proofs/src/poly/multiopen_test.rs
+++ b/halo2_proofs/src/poly/multiopen_test.rs
@@ -2,33 +2,28 @@
 mod test {
     use crate::arithmetic::eval_polynomial;
     use crate::plonk::Error;
+    use crate::poly::commitment::Blind;
     use crate::poly::commitment::ParamsProver;
-    use crate::poly::commitment::{Blind, ParamsVerifier, MSM};
-    use crate::poly::query::PolynomialPointer;
     use crate::poly::{
         commitment::{CommitmentScheme, Params, Prover, Verifier},
         query::{ProverQuery, VerifierQuery},
         strategy::VerificationStrategy,
         EvaluationDomain,
     };
-    use crate::poly::{Coeff, Polynomial};
     use crate::transcript::{
-        self, Blake2bRead, Blake2bWrite, Challenge255, EncodedChallenge, Keccak256Read,
-        Keccak256Write, TranscriptRead, TranscriptReadBuffer, TranscriptWrite,
-        TranscriptWriterBuffer,
+        Blake2bRead, Blake2bWrite, Challenge255, EncodedChallenge, Keccak256Read, Keccak256Write,
+        TranscriptReadBuffer, TranscriptWriterBuffer,
     };
-    use ff::{Field, PrimeField, WithSmallOrderMulGroup};
-    use group::{Curve, Group};
-    use halo2curves::CurveAffine;
-    use rand_core::{OsRng, RngCore};
-    use std::io::{Read, Write};
+    use ff::WithSmallOrderMulGroup;
+    use group::Curve;
+    use rand_core::OsRng;
 
     #[test]
     fn test_roundtrip_ipa() {
         use crate::poly::ipa::commitment::{IPACommitmentScheme, ParamsIPA};
         use crate::poly::ipa::multiopen::{ProverIPA, VerifierIPA};
         use crate::poly::ipa::strategy::AccumulatorStrategy;
-        use halo2curves::pasta::{Ep, EqAffine, Fp};
+        use halo2curves::pasta::EqAffine;
 
         const K: u32 = 4;
 
@@ -65,7 +60,7 @@ mod test {
         use crate::poly::ipa::commitment::{IPACommitmentScheme, ParamsIPA};
         use crate::poly::ipa::multiopen::{ProverIPA, VerifierIPA};
         use crate::poly::ipa::strategy::AccumulatorStrategy;
-        use halo2curves::pasta::{Ep, EqAffine, Fp};
+        use halo2curves::pasta::EqAffine;
 
         const K: u32 = 4;
 
@@ -102,8 +97,7 @@ mod test {
         use crate::poly::kzg::commitment::{KZGCommitmentScheme, ParamsKZG};
         use crate::poly::kzg::multiopen::{ProverGWC, VerifierGWC};
         use crate::poly::kzg::strategy::AccumulatorStrategy;
-        use halo2curves::bn256::{Bn256, G1Affine};
-        use halo2curves::pairing::Engine;
+        use halo2curves::bn256::Bn256;
 
         const K: u32 = 4;
 
@@ -134,8 +128,7 @@ mod test {
         use crate::poly::kzg::commitment::{KZGCommitmentScheme, ParamsKZG};
         use crate::poly::kzg::multiopen::{ProverSHPLONK, VerifierSHPLONK};
         use crate::poly::kzg::strategy::AccumulatorStrategy;
-        use halo2curves::bn256::{Bn256, G1Affine};
-        use halo2curves::pairing::Engine;
+        use halo2curves::bn256::Bn256;
 
         const K: u32 = 4;
 
diff --git a/halo2_proofs/src/poly/query.rs b/halo2_proofs/src/poly/query.rs
index c596e6a71c..b9894edd38 100644
--- a/halo2_proofs/src/poly/query.rs
+++ b/halo2_proofs/src/poly/query.rs
@@ -1,11 +1,10 @@
-use std::{fmt::Debug, ops::Deref};
+use std::fmt::Debug;
 
-use super::commitment::{Blind, CommitmentScheme, Params, MSM};
+use super::commitment::{Blind, MSM};
 use crate::{
     arithmetic::eval_polynomial,
-    poly::{commitment, Coeff, Polynomial},
+    poly::{Coeff, Polynomial},
 };
-use ff::Field;
 use halo2curves::CurveAffine;
 
 pub trait Query<F>: Sized + Clone + Send + Sync {
@@ -100,6 +99,7 @@ impl<'com, C: CurveAffine, M: MSM<C>> Clone for VerifierQuery<'com, C, M> {
     }
 }
 
+#[allow(clippy::upper_case_acronyms)]
 #[derive(Clone, Debug)]
 pub enum CommitmentReference<'r, C: CurveAffine, M: MSM<C>> {
     Commitment(&'r C),
diff --git a/halo2_proofs/src/poly/strategy.rs b/halo2_proofs/src/poly/strategy.rs
index 36480d372f..850f95e6c9 100644
--- a/halo2_proofs/src/poly/strategy.rs
+++ b/halo2_proofs/src/poly/strategy.rs
@@ -1,11 +1,5 @@
-use halo2curves::CurveAffine;
-use rand_core::RngCore;
-
-use super::commitment::{CommitmentScheme, Verifier, MSM};
-use crate::{
-    plonk::Error,
-    transcript::{EncodedChallenge, TranscriptRead},
-};
+use super::commitment::{CommitmentScheme, Verifier};
+use crate::plonk::Error;
 
 /// Guards is unfinished verification result. Implement this to construct various
 /// verification strategies such as aggregation and recursion.

From bf08bb4947286713e41c75fc2dd639e0cad8a454 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Carlos=20P=C3=A9rez?=
 <37264926+CPerezz@users.noreply.github.com>
Date: Mon, 18 Sep 2023 08:54:15 +0200
Subject: [PATCH 22/30] chore: Update rust-toolchain to 1.66 for testing 
 (#208)

* chore: Update rust-toolchain to 1.66 for testing

Note that tests will not compile due to the silent MSRV bump in
`blake2b_simd`.

Hence, we need to use `1.66` as toolchain.

Resolves: #207

* change: UIpdate MSRVs in Cargo.toml
---
 halo2_gadgets/Cargo.toml | 4 ++--
 halo2_proofs/Cargo.toml  | 4 ++--
 rust-toolchain           | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/halo2_gadgets/Cargo.toml b/halo2_gadgets/Cargo.toml
index 13026f4353..374efda83b 100644
--- a/halo2_gadgets/Cargo.toml
+++ b/halo2_gadgets/Cargo.toml
@@ -9,7 +9,7 @@ authors = [
     "Kris Nuttycombe <kris@electriccoin.co>",
 ]
 edition = "2021"
-rust-version = "1.56.1"
+rust-version = "1.66.0"
 description = "Reusable gadgets and chip implementations for Halo 2"
 license = "MIT OR Apache-2.0"
 repository = "https://github.com/zcash/halo2"
@@ -32,7 +32,7 @@ halo2curves = { version = "0.1.0" }
 proptest = { version = "1.0.0", optional = true }
 rand = "0.8"
 subtle = "2.3"
-uint = "0.9.2" # MSRV 1.56.1
+uint = "0.9.2" 
 
 # Developer tooling dependencies
 plotters = { version = "0.3.0", default-features = false, optional = true }
diff --git a/halo2_proofs/Cargo.toml b/halo2_proofs/Cargo.toml
index d481f03ee6..3ddaac6800 100644
--- a/halo2_proofs/Cargo.toml
+++ b/halo2_proofs/Cargo.toml
@@ -8,7 +8,7 @@ authors = [
     "Jack Grigg <jack@electriccoin.co>",
 ]
 edition = "2021"
-rust-version = "1.56.1"
+rust-version = "1.66.0"
 description = """
 Fast PLONK-based zero-knowledge proving system with no trusted setup
 """
@@ -50,7 +50,7 @@ group = "0.13"
 halo2curves = { version = "0.1.0" }
 rand_core = { version = "0.6", default-features = false }
 tracing = "0.1"
-blake2b_simd = "1"
+blake2b_simd = "1" # MSRV 1.66.0
 sha3 = "0.9.1"
 subtle = "2.3"
 cfg-if = "0.1"
diff --git a/rust-toolchain b/rust-toolchain
index 902c74186f..b6148bc0a7 100644
--- a/rust-toolchain
+++ b/rust-toolchain
@@ -1 +1 @@
-1.65.0
+1.66.0

From f47c31d0a41454f6396964ab027c92f9df27da87 Mon Sep 17 00:00:00 2001
From: Thor <7041313+thor314@users.noreply.github.com>
Date: Mon, 18 Sep 2023 00:25:26 -0700
Subject: [PATCH 23/30] fix: clippy (#203)

* fix: clippy

* fmt

* fix: Final clippy complains & adjustments

---------

Co-authored-by: CPerezz <c.perezbaro@gmail.com>
---
 halo2_gadgets/src/poseidon.rs                 |  4 +-
 halo2_gadgets/src/poseidon/pow5.rs            | 39 ++++++++-----------
 halo2_gadgets/src/poseidon/primitives.rs      |  6 +--
 .../src/poseidon/primitives/grain.rs          |  2 +-
 .../src/poseidon/primitives/p128pow5t3.rs     |  2 +-
 .../table16/compression/compression_util.rs   |  4 +-
 .../table16/message_schedule/schedule_util.rs |  9 ++---
 .../table16/message_schedule/subregion2.rs    |  2 +-
 .../table16/message_schedule/subregion3.rs    |  2 +-
 halo2_gadgets/src/sha256/table16/util.rs      |  2 +-
 halo2_gadgets/src/sinsemilla.rs               |  9 ++---
 halo2_gadgets/src/utilities.rs                |  7 ++--
 .../src/utilities/lookup_range_check.rs       |  2 +-
 halo2_proofs/benches/commit_zk.rs             |  2 +-
 halo2_proofs/src/dev.rs                       |  4 +-
 halo2_proofs/src/dev/cost.rs                  |  6 +--
 halo2_proofs/src/plonk/circuit.rs             |  4 +-
 halo2_proofs/src/poly.rs                      |  4 +-
 halo2_proofs/src/poly/ipa/multiopen/prover.rs |  2 +-
 halo2_proofs/tests/plonk_api.rs               |  2 +-
 20 files changed, 51 insertions(+), 63 deletions(-)

diff --git a/halo2_gadgets/src/poseidon.rs b/halo2_gadgets/src/poseidon.rs
index ffd745ad6d..bfd78f3dee 100644
--- a/halo2_gadgets/src/poseidon.rs
+++ b/halo2_gadgets/src/poseidon.rs
@@ -157,7 +157,7 @@ impl<
                     .unwrap(),
             ),
             state,
-            _marker: PhantomData::default(),
+            _marker: PhantomData,
         })
     }
 
@@ -204,7 +204,7 @@ impl<
             chip: self.chip,
             mode,
             state: self.state,
-            _marker: PhantomData::default(),
+            _marker: PhantomData,
         })
     }
 }
diff --git a/halo2_gadgets/src/poseidon/pow5.rs b/halo2_gadgets/src/poseidon/pow5.rs
index 0fb37994e5..51c1f059ca 100644
--- a/halo2_gadgets/src/poseidon/pow5.rs
+++ b/halo2_gadgets/src/poseidon/pow5.rs
@@ -240,30 +240,25 @@ impl<F: Field, S: Spec<F, WIDTH, RATE>, const WIDTH: usize, const RATE: usize>
                 // Load the initial state into this region.
                 let state = Pow5State::load(&mut region, config, initial_state)?;
 
-                let state = (0..config.half_full_rounds).fold(Ok(state), |res, r| {
-                    res.and_then(|state| state.full_round(&mut region, config, r, r))
+                let state = (0..config.half_full_rounds)
+                    .try_fold(state, |res, r| res.full_round(&mut region, config, r, r))?;
+
+                let state = (0..config.half_partial_rounds).try_fold(state, |res, r| {
+                    res.partial_round(
+                        &mut region,
+                        config,
+                        config.half_full_rounds + 2 * r,
+                        config.half_full_rounds + r,
+                    )
                 })?;
 
-                let state = (0..config.half_partial_rounds).fold(Ok(state), |res, r| {
-                    res.and_then(|state| {
-                        state.partial_round(
-                            &mut region,
-                            config,
-                            config.half_full_rounds + 2 * r,
-                            config.half_full_rounds + r,
-                        )
-                    })
-                })?;
-
-                let state = (0..config.half_full_rounds).fold(Ok(state), |res, r| {
-                    res.and_then(|state| {
-                        state.full_round(
-                            &mut region,
-                            config,
-                            config.half_full_rounds + 2 * config.half_partial_rounds + r,
-                            config.half_full_rounds + config.half_partial_rounds + r,
-                        )
-                    })
+                let state = (0..config.half_full_rounds).try_fold(state, |res, r| {
+                    res.full_round(
+                        &mut region,
+                        config,
+                        config.half_full_rounds + 2 * config.half_partial_rounds + r,
+                        config.half_full_rounds + config.half_partial_rounds + r,
+                    )
                 })?;
 
                 Ok(state.0)
diff --git a/halo2_gadgets/src/poseidon/primitives.rs b/halo2_gadgets/src/poseidon/primitives.rs
index 06f199f118..c456c87f54 100644
--- a/halo2_gadgets/src/poseidon/primitives.rs
+++ b/halo2_gadgets/src/poseidon/primitives.rs
@@ -220,7 +220,7 @@ impl<F: Field, S: Spec<F, T, RATE>, const T: usize, const RATE: usize>
             state,
             mds_matrix,
             round_constants,
-            _marker: PhantomData::default(),
+            _marker: PhantomData,
         }
     }
 
@@ -257,7 +257,7 @@ impl<F: Field, S: Spec<F, T, RATE>, const T: usize, const RATE: usize>
             state: self.state,
             mds_matrix: self.mds_matrix,
             round_constants: self.round_constants,
-            _marker: PhantomData::default(),
+            _marker: PhantomData,
         }
     }
 }
@@ -364,7 +364,7 @@ impl<F: Field, S: Spec<F, T, RATE>, D: Domain<F, RATE>, const T: usize, const RA
     pub fn init() -> Self {
         Hash {
             sponge: Sponge::new(D::initial_capacity_element()),
-            _domain: PhantomData::default(),
+            _domain: PhantomData,
         }
     }
 }
diff --git a/halo2_gadgets/src/poseidon/primitives/grain.rs b/halo2_gadgets/src/poseidon/primitives/grain.rs
index 99711f97f3..1a780d5899 100644
--- a/halo2_gadgets/src/poseidon/primitives/grain.rs
+++ b/halo2_gadgets/src/poseidon/primitives/grain.rs
@@ -70,7 +70,7 @@ impl<F: PrimeField> Grain<F> {
         let mut grain = Grain {
             state,
             next_bit: STATE,
-            _field: PhantomData::default(),
+            _field: PhantomData,
         };
 
         // Discard the first 160 bits.
diff --git a/halo2_gadgets/src/poseidon/primitives/p128pow5t3.rs b/halo2_gadgets/src/poseidon/primitives/p128pow5t3.rs
index e31ce04263..fdd4b22959 100644
--- a/halo2_gadgets/src/poseidon/primitives/p128pow5t3.rs
+++ b/halo2_gadgets/src/poseidon/primitives/p128pow5t3.rs
@@ -84,7 +84,7 @@ mod tests {
 
     impl<F: Field, const SECURE_MDS: usize> P128Pow5T3Gen<F, SECURE_MDS> {
         pub fn new() -> Self {
-            P128Pow5T3Gen(PhantomData::default())
+            P128Pow5T3Gen(PhantomData)
         }
     }
 
diff --git a/halo2_gadgets/src/sha256/table16/compression/compression_util.rs b/halo2_gadgets/src/sha256/table16/compression/compression_util.rs
index 324fe8f695..99706023df 100644
--- a/halo2_gadgets/src/sha256/table16/compression/compression_util.rs
+++ b/halo2_gadgets/src/sha256/table16/compression/compression_util.rs
@@ -111,7 +111,7 @@ pub fn get_round_row(round_idx: RoundIdx) -> usize {
         RoundIdx::Init => 0,
         RoundIdx::Main(MainRoundIdx(idx)) => {
             assert!(idx < 64);
-            (idx as usize) * SUBREGION_MAIN_WORD
+            idx * SUBREGION_MAIN_WORD
         }
     }
 }
@@ -783,7 +783,7 @@ impl CompressionConfig {
                 || "h_prime_carry",
                 a_9,
                 row + 1,
-                || h_prime_carry.map(|value| pallas::Base::from(value as u64)),
+                || h_prime_carry.map(pallas::Base::from),
             )?;
 
             let h_prime: Value<[bool; 32]> = h_prime.map(|w| i2lebsp(w.into()));
diff --git a/halo2_gadgets/src/sha256/table16/message_schedule/schedule_util.rs b/halo2_gadgets/src/sha256/table16/message_schedule/schedule_util.rs
index 79a9fa2621..42ed58a835 100644
--- a/halo2_gadgets/src/sha256/table16/message_schedule/schedule_util.rs
+++ b/halo2_gadgets/src/sha256/table16/message_schedule/schedule_util.rs
@@ -40,20 +40,17 @@ pub fn get_word_row(word_idx: usize) -> usize {
     if word_idx == 0 {
         0
     } else if (1..=13).contains(&word_idx) {
-        SUBREGION_0_ROWS + SUBREGION_1_WORD * (word_idx - 1) as usize
+        SUBREGION_0_ROWS + SUBREGION_1_WORD * (word_idx - 1)
     } else if (14..=48).contains(&word_idx) {
         SUBREGION_0_ROWS + SUBREGION_1_ROWS + SUBREGION_2_WORD * (word_idx - 14) + 1
     } else if (49..=61).contains(&word_idx) {
-        SUBREGION_0_ROWS
-            + SUBREGION_1_ROWS
-            + SUBREGION_2_ROWS
-            + SUBREGION_3_WORD * (word_idx - 49) as usize
+        SUBREGION_0_ROWS + SUBREGION_1_ROWS + SUBREGION_2_ROWS + SUBREGION_3_WORD * (word_idx - 49)
     } else {
         SUBREGION_0_ROWS
             + SUBREGION_1_ROWS
             + SUBREGION_2_ROWS
             + SUBREGION_3_ROWS
-            + DECOMPOSE_0_ROWS * (word_idx - 62) as usize
+            + DECOMPOSE_0_ROWS * (word_idx - 62)
     }
 }
 
diff --git a/halo2_gadgets/src/sha256/table16/message_schedule/subregion2.rs b/halo2_gadgets/src/sha256/table16/message_schedule/subregion2.rs
index 43e96c934f..9733b46039 100644
--- a/halo2_gadgets/src/sha256/table16/message_schedule/subregion2.rs
+++ b/halo2_gadgets/src/sha256/table16/message_schedule/subregion2.rs
@@ -261,7 +261,7 @@ impl MessageScheduleConfig {
                 || format!("carry_{}", new_word_idx),
                 a_9,
                 get_word_row(new_word_idx - 16) + 1,
-                || carry.map(|carry| pallas::Base::from(carry as u64)),
+                || carry.map(pallas::Base::from),
             )?;
             let (word, halves) = self.assign_word_and_halves(region, word, new_word_idx)?;
             w.push(MessageWord(word));
diff --git a/halo2_gadgets/src/sha256/table16/message_schedule/subregion3.rs b/halo2_gadgets/src/sha256/table16/message_schedule/subregion3.rs
index b23046e42e..aebe1945d9 100644
--- a/halo2_gadgets/src/sha256/table16/message_schedule/subregion3.rs
+++ b/halo2_gadgets/src/sha256/table16/message_schedule/subregion3.rs
@@ -177,7 +177,7 @@ impl MessageScheduleConfig {
                 || format!("carry_{}", new_word_idx),
                 a_9,
                 get_word_row(new_word_idx - 16) + 1,
-                || carry.map(|carry| pallas::Base::from(carry as u64)),
+                || carry.map(pallas::Base::from),
             )?;
             let (word, halves) = self.assign_word_and_halves(region, word, new_word_idx)?;
             w.push(MessageWord(word));
diff --git a/halo2_gadgets/src/sha256/table16/util.rs b/halo2_gadgets/src/sha256/table16/util.rs
index 6a790d3797..d3da5317ca 100644
--- a/halo2_gadgets/src/sha256/table16/util.rs
+++ b/halo2_gadgets/src/sha256/table16/util.rs
@@ -110,7 +110,7 @@ pub fn sum_with_carry(words: Vec<(Value<u16>, Value<u16>)>) -> (Value<u32>, Valu
         sum_lo.zip(sum_hi).map(|(lo, hi)| lo + (1 << 16) * hi)
     };
 
-    let carry = sum.map(|sum| (sum >> 32) as u64);
+    let carry = sum.map(|sum| (sum >> 32));
     let sum = sum.map(|sum| sum as u32);
 
     (sum, carry)
diff --git a/halo2_gadgets/src/sinsemilla.rs b/halo2_gadgets/src/sinsemilla.rs
index 48b929cbeb..4a20ce4830 100644
--- a/halo2_gadgets/src/sinsemilla.rs
+++ b/halo2_gadgets/src/sinsemilla.rs
@@ -197,7 +197,7 @@ where
         // Each message piece must have at most `floor(C::Base::CAPACITY / K)` words.
         // This ensures that the all-ones bitstring is canonical in the field.
         let piece_max_num_words = C::Base::CAPACITY as usize / K;
-        assert!(num_words <= piece_max_num_words as usize);
+        assert!(num_words <= piece_max_num_words);
 
         // Closure to parse a bitstring (little-endian) into a base field element.
         let to_base_field = |bits: &[Value<bool>]| -> Value<C::Base> {
@@ -496,6 +496,7 @@ pub(crate) mod tests {
 
     #[derive(Debug, Clone, Eq, PartialEq)]
     pub(crate) struct TestHashDomain;
+    #[allow(non_snake_case)]
     impl HashDomains<pallas::Affine> for TestHashDomain {
         fn Q(&self) -> pallas::Affine {
             *Q
@@ -654,11 +655,7 @@ pub(crate) mod tests {
                         |(l, (left, right))| {
                             let merkle_crh = sinsemilla::HashDomain::from_Q((*Q).into());
                             let point = merkle_crh
-                                .hash_to_point(
-                                    l.into_iter()
-                                        .chain(left.into_iter())
-                                        .chain(right.into_iter()),
-                                )
+                                .hash_to_point(l.into_iter().chain(left).chain(right))
                                 .unwrap();
                             point.to_affine()
                         },
diff --git a/halo2_gadgets/src/utilities.rs b/halo2_gadgets/src/utilities.rs
index 887ee92475..50d939b055 100644
--- a/halo2_gadgets/src/utilities.rs
+++ b/halo2_gadgets/src/utilities.rs
@@ -99,7 +99,7 @@ impl<F: PrimeFieldBits> RangeConstrained<F, Value<F>> {
         Self {
             inner: value.map(|value| bitrange_subset(value, bitrange)),
             num_bits,
-            _phantom: PhantomData::default(),
+            _phantom: PhantomData,
         }
     }
 }
@@ -114,7 +114,7 @@ impl<F: Field> RangeConstrained<F, AssignedCell<F, F>> {
         Self {
             inner: cell,
             num_bits,
-            _phantom: PhantomData::default(),
+            _phantom: PhantomData,
         }
     }
 
@@ -123,7 +123,7 @@ impl<F: Field> RangeConstrained<F, AssignedCell<F, F>> {
         RangeConstrained {
             inner: self.inner.value().copied(),
             num_bits: self.num_bits,
-            _phantom: PhantomData::default(),
+            _phantom: PhantomData,
         }
     }
 }
@@ -405,7 +405,6 @@ mod tests {
             }
             assert_eq!(field_elem, sum);
         };
-
         decompose(pallas::Base::random(rng), &[0..255]);
         decompose(pallas::Base::random(rng), &[0..1, 1..255]);
         decompose(pallas::Base::random(rng), &[0..254, 254..255]);
diff --git a/halo2_gadgets/src/utilities/lookup_range_check.rs b/halo2_gadgets/src/utilities/lookup_range_check.rs
index 22a8bf2bf2..7312206970 100644
--- a/halo2_gadgets/src/utilities/lookup_range_check.rs
+++ b/halo2_gadgets/src/utilities/lookup_range_check.rs
@@ -49,7 +49,7 @@ impl<F: PrimeFieldBits> RangeConstrained<F, AssignedCell<F, F>> {
             .map(|inner| Self {
                 inner,
                 num_bits,
-                _phantom: PhantomData::default(),
+                _phantom: PhantomData,
             })
     }
 }
diff --git a/halo2_proofs/benches/commit_zk.rs b/halo2_proofs/benches/commit_zk.rs
index bdf5c88a51..a6a33a934b 100644
--- a/halo2_proofs/benches/commit_zk.rs
+++ b/halo2_proofs/benches/commit_zk.rs
@@ -29,7 +29,7 @@ fn rand_poly_serial(mut rng: ChaCha20Rng, domain: usize) -> Vec<Scalar> {
 
 fn rand_poly_par(mut rng: ChaCha20Rng, domain: usize) -> Vec<Scalar> {
     // Sample a random polynomial of degree n - 1
-    let n = 1usize << domain as usize;
+    let n = 1usize << domain;
     let mut random_poly = vec![Scalar::ZERO; n];
 
     let num_threads = current_num_threads();
diff --git a/halo2_proofs/src/dev.rs b/halo2_proofs/src/dev.rs
index 1ad028f7ea..d86122a0cc 100644
--- a/halo2_proofs/src/dev.rs
+++ b/halo2_proofs/src/dev.rs
@@ -1260,7 +1260,7 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
                 .flat_map(|(gate_index, gate)| {
                     let blinding_rows =
                         (self.n as usize - (self.cs.blinding_factors() + 1))..(self.n as usize);
-                    (gate_row_ids.clone().chain(blinding_rows.into_iter())).flat_map(move |row| {
+                    (gate_row_ids.clone().chain(blinding_rows)).flat_map(move |row| {
                         let row = row as i32 + n;
                         gate.polynomials().iter().enumerate().filter_map(
                             move |(poly_index, poly)| match poly.evaluate_lazy(
@@ -2485,7 +2485,7 @@ mod tests {
                                     || Value::known(Fp::from(2 * i as u64)),
                                 )
                             })
-                            .fold(Ok(()), |acc, res| acc.and(res))
+                            .try_fold((), |_, res| res)
                     },
                 )?;
 
diff --git a/halo2_proofs/src/dev/cost.rs b/halo2_proofs/src/dev/cost.rs
index dc1b6a4cc5..53271f712a 100644
--- a/halo2_proofs/src/dev/cost.rs
+++ b/halo2_proofs/src/dev/cost.rs
@@ -347,7 +347,6 @@ impl<G: PrimeGroup, ConcreteCircuit: Circuit<G::Scalar>> CircuitCost<G, Concrete
             lookups: cs.lookups.len(),
             permutation_cols,
             point_sets: point_sets.len(),
-            _marker: PhantomData::default(),
             max_rows: layout.total_rows,
             max_advice_rows: layout.total_advice_rows,
             max_fixed_rows: layout.total_fixed_rows,
@@ -357,6 +356,7 @@ impl<G: PrimeGroup, ConcreteCircuit: Circuit<G::Scalar>> CircuitCost<G, Concrete
             num_total_columns: cs.num_instance_columns
                 + cs.num_advice_columns
                 + cs.num_fixed_columns,
+            _marker: PhantomData,
         }
     }
 
@@ -390,7 +390,7 @@ impl<G: PrimeGroup, ConcreteCircuit: Circuit<G::Scalar>> CircuitCost<G, Concrete
                 if chunks == 0 { chunks } else { 3 * chunks - 1 },
             ),
 
-            _marker: PhantomData::default(),
+            _marker: PhantomData,
         }
     }
 
@@ -433,7 +433,7 @@ impl<G: PrimeGroup, ConcreteCircuit: Circuit<G::Scalar>> CircuitCost<G, Concrete
             // - xi
             polycomm: ProofContribution::new((1 + 2 * self.k).try_into().unwrap(), 2),
 
-            _marker: PhantomData::default(),
+            _marker: PhantomData,
         }
     }
 }
diff --git a/halo2_proofs/src/plonk/circuit.rs b/halo2_proofs/src/plonk/circuit.rs
index e0348e9df7..e59f3dc2f0 100644
--- a/halo2_proofs/src/plonk/circuit.rs
+++ b/halo2_proofs/src/plonk/circuit.rs
@@ -1511,7 +1511,7 @@ impl<F: Field, C: Into<Constraint<F>>, Iter: IntoIterator<Item = C>> IntoIterato
 
     fn into_iter(self) -> Self::IntoIter {
         std::iter::repeat(self.selector)
-            .zip(self.constraints.into_iter())
+            .zip(self.constraints)
             .map(apply_selector_to_constraint)
     }
 }
@@ -1991,7 +1991,7 @@ impl<F: Field> ConstraintSystem<F> {
         let (polys, selector_assignment) = compress_selectors::process(
             selectors
                 .into_iter()
-                .zip(degrees.into_iter())
+                .zip(degrees)
                 .enumerate()
                 .map(
                     |(i, (activations, max_degree))| compress_selectors::SelectorDescription {
diff --git a/halo2_proofs/src/poly.rs b/halo2_proofs/src/poly.rs
index ddc99429a0..166c16d894 100644
--- a/halo2_proofs/src/poly.rs
+++ b/halo2_proofs/src/poly.rs
@@ -199,7 +199,7 @@ pub(crate) fn batch_invert_assigned<F: Field>(
 
     assigned
         .iter()
-        .zip(assigned_denominators.into_iter())
+        .zip(assigned_denominators)
         .map(|(poly, inv_denoms)| poly.invert(inv_denoms.into_iter().map(|d| d.unwrap_or(F::ONE))))
         .collect()
 }
@@ -214,7 +214,7 @@ impl<F: Field> Polynomial<Assigned<F>, LagrangeCoeff> {
             values: self
                 .values
                 .iter()
-                .zip(inv_denoms.into_iter())
+                .zip(inv_denoms)
                 .map(|(a, inv_den)| a.numerator() * inv_den)
                 .collect(),
             _marker: self._marker,
diff --git a/halo2_proofs/src/poly/ipa/multiopen/prover.rs b/halo2_proofs/src/poly/ipa/multiopen/prover.rs
index 8998f38723..2ae745d457 100644
--- a/halo2_proofs/src/poly/ipa/multiopen/prover.rs
+++ b/halo2_proofs/src/poly/ipa/multiopen/prover.rs
@@ -107,7 +107,7 @@ impl<'params, C: CurveAffine> Prover<'params, IPACommitmentScheme<C>> for Prover
 
         let x_4: ChallengeX4<_> = transcript.squeeze_challenge_scalar();
 
-        let (p_poly, p_poly_blind) = q_polys.into_iter().zip(q_blinds.into_iter()).fold(
+        let (p_poly, p_poly_blind) = q_polys.into_iter().zip(q_blinds).fold(
             (q_prime_poly, q_prime_blind),
             |(q_prime_poly, q_prime_blind), (poly, blind)| {
                 (
diff --git a/halo2_proofs/tests/plonk_api.rs b/halo2_proofs/tests/plonk_api.rs
index b58d562910..55db8b476e 100644
--- a/halo2_proofs/tests/plonk_api.rs
+++ b/halo2_proofs/tests/plonk_api.rs
@@ -580,7 +580,7 @@ fn plonk_api() {
         Scheme::Scalar: Ord + WithSmallOrderMulGroup<3> + FromUniformBytes<64>,
     {
         let (_, instance, _) = common!(Scheme);
-        let pubinputs = vec![instance];
+        let pubinputs = [instance];
 
         let mut transcript = T::init(proof);
 

From 75be70d3fd25bef908a75a1ace11b6b978b0a454 Mon Sep 17 00:00:00 2001
From: chokermaxx <135603985+chokermaxx@users.noreply.github.com>
Date: Wed, 27 Sep 2023 19:46:55 +0900
Subject: [PATCH 24/30] Implement Sum and Product for Expression (#209)

* Make it Eq to make it easier for tests

* Implement Sum and Product for Expression

* Make it readable
---
 halo2_proofs/src/plonk/circuit.rs | 59 +++++++++++++++++++++++++++++++
 1 file changed, 59 insertions(+)

diff --git a/halo2_proofs/src/plonk/circuit.rs b/halo2_proofs/src/plonk/circuit.rs
index e59f3dc2f0..6037e6be74 100644
--- a/halo2_proofs/src/plonk/circuit.rs
+++ b/halo2_proofs/src/plonk/circuit.rs
@@ -11,6 +11,7 @@ use ff::Field;
 use sealed::SealedPhase;
 use std::collections::BTreeMap;
 use std::fmt::Debug;
+use std::iter::{Product, Sum};
 use std::ops::Range;
 use std::{
     convert::TryFrom,
@@ -1375,6 +1376,20 @@ impl<F: Field> Mul<F> for Expression<F> {
     }
 }
 
+impl<F: Field> Sum<Self> for Expression<F> {
+    fn sum<I: Iterator<Item = Self>>(iter: I) -> Self {
+        iter.reduce(|acc, x| acc + x)
+            .unwrap_or(Expression::Constant(F::ZERO))
+    }
+}
+
+impl<F: Field> Product<Self> for Expression<F> {
+    fn product<I: Iterator<Item = Self>>(iter: I) -> Self {
+        iter.reduce(|acc, x| acc * x)
+            .unwrap_or(Expression::Constant(F::ONE))
+    }
+}
+
 /// Represents an index into a vector where each entry corresponds to a distinct
 /// point that polynomials are queried at.
 #[derive(Copy, Clone, Debug)]
@@ -2473,3 +2488,47 @@ impl<'a, F: Field> VirtualCells<'a, F> {
         Expression::Challenge(challenge)
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::Expression;
+    use halo2curves::bn256::Fr;
+
+    #[test]
+    fn iter_sum() {
+        let exprs: Vec<Expression<Fr>> = vec![
+            Expression::Constant(1.into()),
+            Expression::Constant(2.into()),
+            Expression::Constant(3.into()),
+        ];
+        let happened: Expression<Fr> = exprs.into_iter().sum();
+        let expected: Expression<Fr> = Expression::Sum(
+            Box::new(Expression::Sum(
+                Box::new(Expression::Constant(1.into())),
+                Box::new(Expression::Constant(2.into())),
+            )),
+            Box::new(Expression::Constant(3.into())),
+        );
+
+        assert_eq!(happened, expected);
+    }
+
+    #[test]
+    fn iter_product() {
+        let exprs: Vec<Expression<Fr>> = vec![
+            Expression::Constant(1.into()),
+            Expression::Constant(2.into()),
+            Expression::Constant(3.into()),
+        ];
+        let happened: Expression<Fr> = exprs.into_iter().product();
+        let expected: Expression<Fr> = Expression::Product(
+            Box::new(Expression::Product(
+                Box::new(Expression::Constant(1.into())),
+                Box::new(Expression::Constant(2.into())),
+            )),
+            Box::new(Expression::Constant(3.into())),
+        );
+
+        assert_eq!(happened, expected);
+    }
+}

From 6f40fa9af3489d10ee5216b86c055c4a5b8ffa4c Mon Sep 17 00:00:00 2001
From: zhenfei <zhenfei.zhang@hotmail.com>
Date: Mon, 16 Oct 2023 13:59:55 -0400
Subject: [PATCH 25/30] chore: update poseidon dependency

---
 Cargo.lock              | 966 ++++++++++++++++++++--------------------
 halo2_proofs/Cargo.toml |   2 +-
 2 files changed, 479 insertions(+), 489 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index b7d83cb86b..44a2d379b5 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4,9 +4,9 @@ version = 3
 
 [[package]]
 name = "addr2line"
-version = "0.17.0"
+version = "0.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9ecd88a8c8378ca913a680cd98f0f13ac67383d35993f86c90a70e3f137816b"
+checksum = "8a30b2e23b9e17a9f90641c7ab1549cd9b44f296d3ccbf309d2863cfe398a0cb"
 dependencies = [
  "gimli",
 ]
@@ -17,18 +17,13 @@ version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
 
-[[package]]
-name = "adler32"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aae1277d39aeec15cb388266ecc24b11c80469deae6067e17a1a7aa9e5c1f234"
-
 [[package]]
 name = "ahash"
-version = "0.7.6"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fcb51a0695d8f838b1ee009b3fbf66bda078cd64590202a864a8f3e8c4315c47"
+checksum = "2c99f64d1e06488f620f932677e24bc6e2897582980441ae90a671415bd7ec2f"
 dependencies = [
+ "cfg-if 1.0.0",
  "getrandom",
  "once_cell",
  "version_check",
@@ -36,18 +31,18 @@ dependencies = [
 
 [[package]]
 name = "aho-corasick"
-version = "0.7.18"
+version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e37cfd5e7657ada45f742d6e99ca5788580b5c529dc78faf11ece6dc702656f"
+checksum = "b2969dcb958b36655471fc61f7e416fa76033bdd4bfed0678d8fee1e2d07a1f0"
 dependencies = [
  "memchr",
 ]
 
 [[package]]
 name = "anyhow"
-version = "1.0.56"
+version = "1.0.75"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4361135be9122e0870de935d7c439aef945b9f9ddd4199a553b5270b49c82a27"
+checksum = "a4668cab20f66d8d020e1fbc0ebe47217433c1b6c8f2040faf858554e394ace6"
 
 [[package]]
 name = "ark-std"
@@ -62,24 +57,15 @@ dependencies = [
 
 [[package]]
 name = "arrayref"
-version = "0.3.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4c527152e37cf757a3f78aae5a06fbeefdb07ccc535c980a3208ee3060dd544"
-
-[[package]]
-name = "arrayvec"
-version = "0.4.12"
+version = "0.3.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd9fd44efafa8690358b7408d253adf110036b88f55672a933f01d616ad9b1b9"
-dependencies = [
- "nodrop",
-]
+checksum = "6b4930d2cb77ce62f89ee5d5289b4ac049559b1c45539271f5ed4fdc7db34545"
 
 [[package]]
 name = "arrayvec"
-version = "0.7.2"
+version = "0.7.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8da52d66c7071e2e3fa2a1e5c6d088fec47b593032b254f5e980de8ea54454d6"
+checksum = "96d30a06541fbafbc7f82ed10c06164cfbd2c401138f6addd8404629c4b16711"
 
 [[package]]
 name = "assert_matches"
@@ -93,7 +79,7 @@ version = "0.2.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
 dependencies = [
- "hermit-abi",
+ "hermit-abi 0.1.19",
  "libc",
  "winapi",
 ]
@@ -106,24 +92,24 @@ checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
 
 [[package]]
 name = "backtrace"
-version = "0.3.64"
+version = "0.3.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e121dee8023ce33ab248d9ce1493df03c3b38a659b240096fcbd7048ff9c31f"
+checksum = "2089b7e3f35b9dd2d0ed921ead4f6d318c27680d4a5bd167b3ee120edb105837"
 dependencies = [
  "addr2line",
  "cc",
  "cfg-if 1.0.0",
  "libc",
- "miniz_oxide 0.4.4",
+ "miniz_oxide",
  "object",
  "rustc-demangle",
 ]
 
 [[package]]
 name = "bit-set"
-version = "0.5.2"
+version = "0.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e11e16035ea35e4e5997b393eacbf6f63983188f7a2ad25bfb13465f5ad59de"
+checksum = "0700ddab506f33b20a03b13996eccd309a48e5ff77d0d95926aa0210fb4e95f1"
 dependencies = [
  "bit-vec",
 ]
@@ -140,6 +126,12 @@ version = "1.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
+[[package]]
+name = "bitflags"
+version = "2.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "327762f6e5a765692301e5bb513e0d9fef63be86bbc14528052b1cd3e6f03e07"
+
 [[package]]
 name = "bitvec"
 version = "1.0.1"
@@ -154,12 +146,12 @@ dependencies = [
 
 [[package]]
 name = "blake2b_simd"
-version = "1.0.0"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72936ee4afc7f8f736d1c38383b56480b5497b4617b4a77bdbf1d2ababc76127"
+checksum = "23285ad32269793932e830392f2fe2f83e26488fd3ec778883a93c8323735780"
 dependencies = [
  "arrayref",
- "arrayvec 0.7.2",
+ "arrayvec",
  "constant_time_eq",
 ]
 
@@ -179,50 +171,38 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8d696c370c750c948ada61c69a0ee2cbbb9c50b1019ddb86d9317157a99c2cae"
 
-[[package]]
-name = "bstr"
-version = "0.2.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba3569f383e8f1598449f1a423e72e99569137b47740b1da11ef19af3d5c3223"
-dependencies = [
- "lazy_static",
- "memchr",
- "regex-automata",
- "serde",
-]
-
 [[package]]
 name = "bumpalo"
-version = "3.8.0"
+version = "3.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f1e260c3a9040a7c19a12468758f4c16f31a81a1fe087482be9570ec864bb6c"
+checksum = "7f30e7476521f6f8af1a1c4c0b8cc94f0bee37d91763d0ca2665f299b6cd8aec"
 
 [[package]]
 name = "bytemuck"
-version = "1.9.1"
+version = "1.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cdead85bdec19c194affaeeb670c0e41fe23de31459efd1c174d049269cf02cc"
+checksum = "374d28ec25809ee0e23827c2ab573d729e293f281dfe393500e7ad618baa61c6"
 
 [[package]]
 name = "byteorder"
-version = "1.4.3"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "14c189c53d098945499cdfa7ecc63567cf3886b3332b312a5b4585d8d3a6a610"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "cast"
-version = "0.2.7"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c24dab4283a142afa2fdca129b80ad2c6284e073930f964c3a1293c225ee39a"
-dependencies = [
- "rustc_version 0.4.0",
-]
+checksum = "37b2a672a2cb129a2e41c10b1224bb368f9f37a2b16b612598138befd7b37eb5"
 
 [[package]]
 name = "cc"
-version = "1.0.73"
+version = "1.0.83"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2fff2a6927b3bb87f9595d67196a70493f627687a71d87a0d692242c33f58c11"
+checksum = "f1174fb0b6ec23863f8b971027804a42614e347eafb0a95bf0b12cdae21fc4d0"
+dependencies = [
+ "libc",
+]
 
 [[package]]
 name = "cfg-if"
@@ -242,16 +222,16 @@ version = "2.34.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a0610544180c38b88101fecf2dd634b174a62eef6946f84dfc6a7127512b381c"
 dependencies = [
- "bitflags",
+ "bitflags 1.3.2",
  "textwrap",
  "unicode-width",
 ]
 
 [[package]]
 name = "cmake"
-version = "0.1.48"
+version = "0.1.50"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8ad8cef104ac57b68b89df3208164d228503abbdce70f6880ffa3d970e7443a"
+checksum = "a31c789563b815f77f4250caee12365734369f942439b7defd71e18a48197130"
 dependencies = [
  "cc",
 ]
@@ -264,20 +244,26 @@ checksum = "3d7b894f5411737b7867f4827955924d7c254fc9f4d91a6aad6b097804b1018b"
 
 [[package]]
 name = "colored"
-version = "2.0.0"
+version = "2.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b3616f750b84d8f0de8a58bda93e08e2a81ad3f523089b05f1dffecab48c6cbd"
+checksum = "2674ec482fbc38012cf31e6c42ba0177b431a0cb6f15fe40efa5aab1bda516f6"
 dependencies = [
- "atty",
+ "is-terminal",
  "lazy_static",
- "winapi",
+ "windows-sys",
 ]
 
+[[package]]
+name = "const-cstr"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed3d0b5ff30645a68f35ece8cea4556ca14ef8a1651455f789a099a0513532a6"
+
 [[package]]
 name = "constant_time_eq"
-version = "0.1.5"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "245097e9a4535ee1e3e3931fcfcd55a796a44c643e8596ff6566d68f09b87bbc"
+checksum = "f7144d30dcf0fafbce74250a3963025d8d52177934239851c917d29f1df280c2"
 
 [[package]]
 name = "core-foundation"
@@ -291,9 +277,9 @@ dependencies = [
 
 [[package]]
 name = "core-foundation-sys"
-version = "0.8.3"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5827cebf4670468b8772dd191856768aedcb1b0278a04f989f7766351917b9dc"
+checksum = "e496a50fda8aacccc86d7529e2c1e0892dbd0f898a6b5645b5561b89c3210efa"
 
 [[package]]
 name = "core-graphics"
@@ -301,7 +287,7 @@ version = "0.22.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2581bbab3b8ffc6fcbd550bf46c355135d16e9ff2a6ea032ad6b9bf1d7efe4fb"
 dependencies = [
- "bitflags",
+ "bitflags 1.3.2",
  "core-foundation",
  "core-graphics-types",
  "foreign-types",
@@ -310,13 +296,12 @@ dependencies = [
 
 [[package]]
 name = "core-graphics-types"
-version = "0.1.1"
+version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a68b68b3446082644c91ac778bf50cd4104bfb002b5a6a7c44cca5a2c70788b"
+checksum = "2bb142d41022986c1d8ff29103a1411c8a3dfad3552f87a4f8dc50d61d4f4e33"
 dependencies = [
- "bitflags",
+ "bitflags 1.3.2",
  "core-foundation",
- "foreign-types",
  "libc",
 ]
 
@@ -343,9 +328,9 @@ dependencies = [
 
 [[package]]
 name = "cpufeatures"
-version = "0.2.5"
+version = "0.2.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28d997bd5e24a5928dd43e46dc529867e207907fe0b239c3477d924f7f2ca320"
+checksum = "a17b76ff3a4162b0b27f354a0c87015ddad39d35f9c0c36607a3bdd175dde1f1"
 dependencies = [
  "libc",
 ]
@@ -361,9 +346,9 @@ dependencies = [
 
 [[package]]
 name = "criterion"
-version = "0.3.5"
+version = "0.3.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1604dafd25fba2fe2d5895a9da139f8dc9b319a5fe5354ca137cbbce4e178d10"
+checksum = "b01d6de93b2b6c65e17c634a26653a29d107b3c98c607c765bf38d041531cd8f"
 dependencies = [
  "atty",
  "cast",
@@ -387,9 +372,9 @@ dependencies = [
 
 [[package]]
 name = "criterion-plot"
-version = "0.4.4"
+version = "0.4.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d00996de9f2f7559f7f4dc286073197f83e92256a59ed395f9aac01fe717da57"
+checksum = "2673cc8207403546f45f5fd319a974b1e6983ad1a3ee7e6041650013be041876"
 dependencies = [
  "cast",
  "itertools",
@@ -411,9 +396,9 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-channel"
-version = "0.5.4"
+version = "0.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5aaa7bd5fb665c6864b5f963dd9097905c54125909c7aa94c9e18507cdbe6c53"
+checksum = "a33c2bf77f2df06183c3aa30d1e96c0695a313d4f9c453cc3762a6db39f99200"
 dependencies = [
  "cfg-if 1.0.0",
  "crossbeam-utils",
@@ -421,9 +406,9 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-deque"
-version = "0.8.1"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6455c0ca19f0d2fbf751b908d5c55c1f5cbc65e03c4225427254b46890bdde1e"
+checksum = "ce6fd6f855243022dcecf8702fef0c297d4338e226845fe067f6341ad9fa0cef"
 dependencies = [
  "cfg-if 1.0.0",
  "crossbeam-epoch",
@@ -432,15 +417,14 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-epoch"
-version = "0.9.8"
+version = "0.9.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1145cf131a2c6ba0615079ab6a638f7e1973ac9c2634fcbeaaad6114246efe8c"
+checksum = "ae211234986c545741a7dc064309f67ee1e5ad243d0e48335adc0484d960bcc7"
 dependencies = [
  "autocfg",
  "cfg-if 1.0.0",
  "crossbeam-utils",
- "lazy_static",
- "memoffset",
+ "memoffset 0.9.0",
  "scopeguard",
 ]
 
@@ -456,12 +440,11 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-utils"
-version = "0.8.8"
+version = "0.8.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0bf124c720b7686e3c2663cf54062ab0f68a88af2fb6a030e87e30bf721fcb38"
+checksum = "5a22b2d63d4d1dc0b7f1b6b2747dd0088008a9be28b6ddf0b1e7d335e3037294"
 dependencies = [
  "cfg-if 1.0.0",
- "lazy_static",
 ]
 
 [[package]]
@@ -472,22 +455,21 @@ checksum = "7a81dae078cea95a014a339291cec439d2f232ebe854a9d672b796c6afafa9b7"
 
 [[package]]
 name = "csv"
-version = "1.1.6"
+version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22813a6dc45b335f9bade10bf7271dc477e81113e89eb251a0bc2a8a81c536e1"
+checksum = "ac574ff4d437a7b5ad237ef331c17ccca63c46479e5b5453eb8e10bb99a759fe"
 dependencies = [
- "bstr",
  "csv-core",
- "itoa 0.4.8",
+ "itoa",
  "ryu",
  "serde",
 ]
 
 [[package]]
 name = "csv-core"
-version = "0.1.10"
+version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b2466559f260f48ad25fe6317b3c8dac77b5bdb5763ac7d9d6103530663bc90"
+checksum = "5efa2b3d7902f4b634a20cae3c9c4e6209dc4779feb6863329607560143efa70"
 dependencies = [
  "memchr",
 ]
@@ -513,7 +495,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "strsim",
- "syn",
+ "syn 1.0.109",
 ]
 
 [[package]]
@@ -524,7 +506,7 @@ checksum = "d9b5a2f4ac4969822c62224815d069952656cadc7084fdca9751e6d959189b72"
 dependencies = [
  "darling_core",
  "quote",
- "syn",
+ "syn 1.0.109",
 ]
 
 [[package]]
@@ -536,16 +518,6 @@ dependencies = [
  "uuid",
 ]
 
-[[package]]
-name = "deflate"
-version = "0.8.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "73770f8e1fe7d64df17ca66ad28994a0a623ea497fa69486e14984e715c5d174"
-dependencies = [
- "adler32",
- "byteorder",
-]
-
 [[package]]
 name = "derive_builder"
 version = "0.9.0"
@@ -556,7 +528,7 @@ dependencies = [
  "derive_builder_core",
  "proc-macro2",
  "quote",
- "syn",
+ "syn 1.0.109",
 ]
 
 [[package]]
@@ -568,7 +540,7 @@ dependencies = [
  "darling",
  "proc-macro2",
  "quote",
- "syn",
+ "syn 1.0.109",
 ]
 
 [[package]]
@@ -601,6 +573,15 @@ dependencies = [
  "winapi",
 ]
 
+[[package]]
+name = "dlib"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "330c60081dcc4c72131f8eb70510f1ac07223e5d4163db481a04a0befcffa412"
+dependencies = [
+ "libloading",
+]
+
 [[package]]
 name = "dwrote"
 version = "0.11.0"
@@ -615,9 +596,9 @@ dependencies = [
 
 [[package]]
 name = "either"
-version = "1.6.1"
+version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e78d4f1cc4ae33bbfc157ed5d5a5ef3bc29227303d595861deb238fcec4e9457"
+checksum = "a26ae43d7bcc3b814de94796a5e736d4029efb0ee900c12e2d54c993ad1a1e07"
 
 [[package]]
 name = "env_logger"
@@ -633,22 +614,34 @@ dependencies = [
 ]
 
 [[package]]
-name = "expat-sys"
-version = "2.1.6"
+name = "equivalent"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"
+
+[[package]]
+name = "errno"
+version = "0.3.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "658f19728920138342f68408b7cf7644d90d4784353d8ebc32e7e8663dbe45fa"
+checksum = "ac3e13f66a2f95e32a39eaa81f6b95d42878ca0e1db0c7543723dfe12557e860"
 dependencies = [
- "cmake",
- "pkg-config",
+ "libc",
+ "windows-sys",
 ]
 
 [[package]]
 name = "fastrand"
-version = "1.7.0"
+version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3fcf0cee53519c866c09b5de1f6c56ff9d647101f81c1964fa632e148896cdf"
+checksum = "25cbce373ec4653f1a01a31e8a5e5ec0c622dc27ff9c4e6606eefef5cbbed4a5"
+
+[[package]]
+name = "fdeflate"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d329bdeac514ee06249dabc27877490f17f5d371ec693360768b838e19f3ae10"
 dependencies = [
- "instant",
+ "simd-adler32",
 ]
 
 [[package]]
@@ -674,6 +667,16 @@ dependencies = [
  "winapi",
 ]
 
+[[package]]
+name = "flate2"
+version = "1.0.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46303f565772937ffe1d394a4fac6f411c6013172fadde9dcdb1e147a086940e"
+dependencies = [
+ "crc32fast",
+ "miniz_oxide",
+]
+
 [[package]]
 name = "float-ord"
 version = "0.2.0"
@@ -688,11 +691,11 @@ checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
 
 [[package]]
 name = "font-kit"
-version = "0.10.1"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46c9a156ec38864999bc9c4156e5f3b50224d4a5578028a64e5a3875caa9ee28"
+checksum = "21fe28504d371085fae9ac7a3450f0b289ab71e07c8e57baa3fb68b9e57d6ce5"
 dependencies = [
- "bitflags",
+ "bitflags 1.3.2",
  "byteorder",
  "core-foundation",
  "core-graphics",
@@ -706,9 +709,9 @@ dependencies = [
  "log",
  "pathfinder_geometry",
  "pathfinder_simd",
- "servo-fontconfig",
  "walkdir",
  "winapi",
+ "yeslogic-fontconfig-sys",
 ]
 
 [[package]]
@@ -755,9 +758,9 @@ checksum = "e6d5a32815ae3f33302d95fdcb2ce17862f8c65363dcfd29360480ba1001fc9c"
 
 [[package]]
 name = "generic-array"
-version = "0.14.6"
+version = "0.14.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bff49e947297f3312447abdca79f45f4738097cc82b06e72054d2223f601f1b9"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
 dependencies = [
  "typenum",
  "version_check",
@@ -765,9 +768,9 @@ dependencies = [
 
 [[package]]
 name = "getrandom"
-version = "0.2.6"
+version = "0.2.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9be70c98951c83b8d2f8f60d7065fa6d5146873094452a1008da8c2f1e4205ad"
+checksum = "be4136b2a15dd319360be1c07d9933517ccf0be8f16bf62a3bee4f0d618df427"
 dependencies = [
  "cfg-if 1.0.0",
  "js-sys",
@@ -778,9 +781,9 @@ dependencies = [
 
 [[package]]
 name = "gimli"
-version = "0.26.1"
+version = "0.28.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78cc372d058dcf6d5ecd98510e7fbc9e5aec4d21de70f65fea8fecebcd881bd4"
+checksum = "6fb8d784f27acf97159b40fc4db5ecd8aa23b9ad5ef69cdd136d3bc80665f0c0"
 
 [[package]]
 name = "group"
@@ -810,7 +813,7 @@ checksum = "729f9bd3449d77e7831a18abfb7ba2f99ee813dfd15b8c2167c9a54ba20aa99d"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 1.0.109",
 ]
 
 [[package]]
@@ -830,13 +833,13 @@ dependencies = [
 name = "halo2_gadgets"
 version = "0.2.0"
 dependencies = [
- "arrayvec 0.7.2",
+ "arrayvec",
  "bitvec",
  "criterion",
  "ff",
  "group",
  "halo2_proofs",
- "halo2curves 0.1.0",
+ "halo2curves",
  "lazy_static",
  "plotters",
  "pprof",
@@ -869,7 +872,7 @@ dependencies = [
  "group",
  "gumdrop",
  "halo2_legacy_pdqsort",
- "halo2curves 0.1.0",
+ "halo2curves",
  "log",
  "maybe-rayon",
  "num-bigint",
@@ -905,29 +908,11 @@ dependencies = [
  "subtle",
 ]
 
-[[package]]
-name = "halo2curves"
-version = "0.3.2"
-source = "git+https://github.com/privacy-scaling-explorations/halo2curves?tag=0.3.2#9f5c50810bbefe779ee5cf1d852b2fe85dc35d5e"
-dependencies = [
- "ff",
- "group",
- "lazy_static",
- "num-bigint",
- "num-traits",
- "pasta_curves",
- "paste",
- "rand",
- "rand_core",
- "static_assertions",
- "subtle",
-]
-
 [[package]]
 name = "hashbrown"
-version = "0.11.2"
+version = "0.14.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab5ef0d4909ef3724cc8cce6ccc8572c5c817592e9285f5464f8e86f8bd3726e"
+checksum = "7dfda62a12f55daeae5015f81b0baea145391cb4520f86c248fc615d72640d12"
 
 [[package]]
 name = "hermit-abi"
@@ -938,6 +923,12 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "hermit-abi"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d77f7ec81a6d05a3abb01ab6eb7590f6083d08449fe5a1c8b1e620283546ccb7"
+
 [[package]]
 name = "hex"
 version = "0.4.3"
@@ -958,15 +949,14 @@ checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
 
 [[package]]
 name = "image"
-version = "0.23.14"
+version = "0.24.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "24ffcb7e7244a9bf19d35bf2883b9c080c4ced3c07a9895572178cdb8f13f6a1"
+checksum = "6f3dfdbdd72063086ff443e297b61695500514b1e41095b6fb9a5ab48a70a711"
 dependencies = [
  "bytemuck",
  "byteorder",
  "color_quant",
  "jpeg-decoder",
- "num-iter",
  "num-rational",
  "num-traits",
  "png",
@@ -974,24 +964,24 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "1.8.1"
+version = "2.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0f647032dfaa1f8b6dc29bd3edb7bbef4861b8b8007ebb118d6db284fd59f6ee"
+checksum = "8adf3ddd720272c6ea8bf59463c04e0f93d0bbf7c5439b691bca2987e0270897"
 dependencies = [
- "autocfg",
+ "equivalent",
  "hashbrown",
 ]
 
 [[package]]
 name = "inferno"
-version = "0.11.7"
+version = "0.11.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9709543bd6c25fdc748da2bed0f6855b07b7e93a203ae31332ac2101ab2f4782"
+checksum = "c50453ec3a6555fad17b1cd1a80d16af5bc7cb35094f64e429fd46549018c6a3"
 dependencies = [
  "ahash",
- "atty",
  "indexmap",
- "itoa 1.0.1",
+ "is-terminal",
+ "itoa",
  "log",
  "num-format",
  "once_cell",
@@ -1001,12 +991,14 @@ dependencies = [
 ]
 
 [[package]]
-name = "instant"
-version = "0.1.12"
+name = "is-terminal"
+version = "0.4.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a5bbe824c507c5da5956355e86a746d82e0e1464f65d862cc5e71da70e94b2c"
+checksum = "cb0889898416213fab133e1d33a0e5858a48177452750691bde3666d0fdbaf8b"
 dependencies = [
- "cfg-if 1.0.0",
+ "hermit-abi 0.3.3",
+ "rustix",
+ "windows-sys",
 ]
 
 [[package]]
@@ -1020,36 +1012,30 @@ dependencies = [
 
 [[package]]
 name = "itoa"
-version = "0.4.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b71991ff56294aa922b450139ee08b3bfc70982c6b2c7562771375cf73542dd4"
-
-[[package]]
-name = "itoa"
-version = "1.0.1"
+version = "1.0.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1aab8fc367588b89dcee83ab0fd66b72b50b72fa1904d7095045ace2b0c81c35"
+checksum = "af150ab688ff2122fcef229be89cb50dd66af9e01a4ff320cc137eecc9bacc38"
 
 [[package]]
 name = "jpeg-decoder"
-version = "0.1.22"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "229d53d58899083193af11e15917b5640cd40b29ff475a1fe4ef725deb02d0f2"
+checksum = "bc0000e42512c92e31c2252315bda326620a4e034105e900c98ec492fa077b3e"
 
 [[package]]
 name = "js-sys"
-version = "0.3.57"
+version = "0.3.64"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "671a26f820db17c2a2750743f1dd03bafd15b98c9f30c7c2628c024c05d73397"
+checksum = "c5f195fe497f702db0f318b07fdd68edb16955aed830df8363d837542f8f935a"
 dependencies = [
  "wasm-bindgen",
 ]
 
 [[package]]
 name = "keccak"
-version = "0.1.3"
+version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3afef3b6eff9ce9d8ff9b3601125eec7f0c8cbac7abd14f355d053fa56c98768"
+checksum = "8f6d5ed8676d904364de097082f4e7d240b571b67989ced0240f08b7f966f940"
 dependencies = [
  "cpufeatures",
 ]
@@ -1065,15 +1051,37 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.137"
+version = "0.2.149"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a08173bc88b7955d1b3145aa561539096c421ac8debde8cbc3612ec635fee29b"
+
+[[package]]
+name = "libloading"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c571b676ddfc9a8c12f1f3d3085a7b163966a8fd8098a90640953ce5f6170161"
+dependencies = [
+ "cfg-if 1.0.0",
+ "windows-sys",
+]
+
+[[package]]
+name = "libm"
+version = "0.2.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ec2a862134d2a7d32d7983ddcdd1c4923530833c9f2ea1a44fc5fa473989058"
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.4.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc7fcc620a3bff7cdd7a365be3376c97191aeaccc2a603e600951e452615bf89"
+checksum = "da2479e8c062e40bf0066ffa0bc823de0a9368974af99c9f6df941d2c231e03f"
 
 [[package]]
 name = "lock_api"
-version = "0.4.7"
+version = "0.4.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "327fa5b6a6940e4699ec49a9beae1ea4845c6bab9314e4f84ac68742139d8c53"
+checksum = "c1cc9717a20b1bb222f333e6a92fd32f7d8a18ddc5a3191a11af45dcbf4dcd16"
 dependencies = [
  "autocfg",
  "scopeguard",
@@ -1081,12 +1089,9 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.17"
+version = "0.4.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "abb12e687cfb44aa40f41fc3978ef76448f9b6038cad6aef4259d3c095a2382e"
-dependencies = [
- "cfg-if 1.0.0",
-]
+checksum = "b5e6163cb8c49088c2c36f57875e58ccd8c87c7427f7fbd50ea6710b2f3f2e8f"
 
 [[package]]
 name = "maybe-rayon"
@@ -1100,15 +1105,15 @@ dependencies = [
 
 [[package]]
 name = "memchr"
-version = "2.5.0"
+version = "2.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
+checksum = "f665ee40bc4a3c5590afb1e9677db74a508659dfd71e126420da8274909a0167"
 
 [[package]]
 name = "memmap2"
-version = "0.5.3"
+version = "0.5.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "057a3db23999c867821a7a59feb06a578fcb03685e983dff90daf9e7d24ac08f"
+checksum = "83faa42c0a078c393f6b29d5db232d8be22776a891f8f56e5284faee4a20b327"
 dependencies = [
  "libc",
 ]
@@ -1123,48 +1128,42 @@ dependencies = [
 ]
 
 [[package]]
-name = "miniz_oxide"
-version = "0.3.7"
+name = "memoffset"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "791daaae1ed6889560f8c4359194f56648355540573244a5448a83ba1ecc7435"
+checksum = "5a634b1c61a95585bd15607c6ab0c4e5b226e695ff2800ba0cdccddf208c406c"
 dependencies = [
- "adler32",
+ "autocfg",
 ]
 
 [[package]]
 name = "miniz_oxide"
-version = "0.4.4"
+version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a92518e98c078586bc6c934028adcca4c92a53d6a958196de835170a01d84e4b"
+checksum = "e7810e0be55b428ada41041c41f32c9f1a42817901b4ccf45fa3d4b6561e74c7"
 dependencies = [
  "adler",
- "autocfg",
+ "simd-adler32",
 ]
 
 [[package]]
 name = "nix"
-version = "0.23.1"
+version = "0.23.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f866317acbd3a240710c63f065ffb1e4fd466259045ccb504130b7f668f35c6"
+checksum = "8f3790c00a0150112de0f4cd161e3d7fc4b2d8a5542ffc35f099a2562aecb35c"
 dependencies = [
- "bitflags",
+ "bitflags 1.3.2",
  "cc",
  "cfg-if 1.0.0",
  "libc",
- "memoffset",
+ "memoffset 0.6.5",
 ]
 
-[[package]]
-name = "nodrop"
-version = "0.1.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72ef4a56884ca558e5ddb05a1d1e7e1bfd9a68d9ed024c21704cc98872dae1bb"
-
 [[package]]
 name = "num-bigint"
-version = "0.4.3"
+version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f93ab6289c7b344a8a9f60f88d80aa20032336fe78da341afc91c8a2341fc75f"
+checksum = "608e7659b5c3d7cba262d894801b9ec9d00de989e8a82bd4bef91d08da45cdc0"
 dependencies = [
  "autocfg",
  "num-integer",
@@ -1174,40 +1173,29 @@ dependencies = [
 
 [[package]]
 name = "num-format"
-version = "0.4.0"
+version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bafe4179722c2894288ee77a9f044f02811c86af699344c498b0840c698a2465"
+checksum = "a652d9771a63711fd3c3deb670acfbe5c30a4072e664d7a3bf5a9e1056ac72c3"
 dependencies = [
- "arrayvec 0.4.12",
- "itoa 0.4.8",
+ "arrayvec",
+ "itoa",
 ]
 
 [[package]]
 name = "num-integer"
-version = "0.1.44"
+version = "0.1.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2cc698a63b549a70bc047073d2949cce27cd1c7b0a4a862d08a8031bc2801db"
+checksum = "225d3389fb3509a24c93f5c29eb6bde2586b98d9f016636dff58d7c6f7569cd9"
 dependencies = [
  "autocfg",
  "num-traits",
 ]
 
-[[package]]
-name = "num-iter"
-version = "0.1.42"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2021c8337a54d21aca0d59a92577a029af9431cb59b909b03252b9c164fad59"
-dependencies = [
- "autocfg",
- "num-integer",
- "num-traits",
-]
-
 [[package]]
 name = "num-rational"
-version = "0.3.2"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "12ac428b1cb17fce6f731001d307d351ec70a6d202fc2e60f7d4c5e42d8f4f07"
+checksum = "0638a1c9d0a3c0914158145bc76cff373a75a627e6ecbfb71cbe6f453a5a19b0"
 dependencies = [
  "autocfg",
  "num-integer",
@@ -1216,37 +1204,28 @@ dependencies = [
 
 [[package]]
 name = "num-traits"
-version = "0.2.14"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a64b1ec5cda2586e284722486d802acf1f7dbdc623e2bfc57e65ca1cd099290"
+checksum = "39e3200413f237f41ab11ad6d161bc7239c84dcb631773ccd7de3dfe4b5c267c"
 dependencies = [
  "autocfg",
-]
-
-[[package]]
-name = "num_cpus"
-version = "1.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19e64526ebdee182341572e50e9ad03965aa510cd94427a4549448f285e957a1"
-dependencies = [
- "hermit-abi",
- "libc",
+ "libm",
 ]
 
 [[package]]
 name = "object"
-version = "0.27.1"
+version = "0.32.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67ac1d3f9a1d3616fd9a60c8d74296f22406a238b6a72f5cc1e6f314df4ffbf9"
+checksum = "9cf5f9dd3933bd50a9e1f149ec995f39ae2c496d31fd772c1fd45ebc27e902b0"
 dependencies = [
  "memchr",
 ]
 
 [[package]]
 name = "once_cell"
-version = "1.15.0"
+version = "1.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e82dad04139b71a90c080c8463fe0dc7902db5192d939bd0950f074d014339e1"
+checksum = "dd8b5dd2ae5ed71462c540258bedcb51965123ad7e7ccf4b9a8cafaa4a63576d"
 
 [[package]]
 name = "oorandom"
@@ -1272,15 +1251,15 @@ dependencies = [
 
 [[package]]
 name = "parking_lot_core"
-version = "0.9.3"
+version = "0.9.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09a279cbf25cb0757810394fbc1e359949b59e348145c643a939a525692e6929"
+checksum = "93f00c865fe7cabf650081affecd3871070f26767e7b2070a3ffae14c654b447"
 dependencies = [
  "cfg-if 1.0.0",
  "libc",
- "redox_syscall",
+ "redox_syscall 0.3.5",
  "smallvec",
- "windows-sys",
+ "windows-targets",
 ]
 
 [[package]]
@@ -1300,9 +1279,9 @@ dependencies = [
 
 [[package]]
 name = "paste"
-version = "1.0.12"
+version = "1.0.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f746c4065a8fa3fe23974dd82f15431cc8d40779821001404d10d2e79ca7d79"
+checksum = "de3145af08024dea9fa9914f381a17b8fc6034dfb00f3a84013f7ff43f29ed4c"
 
 [[package]]
 name = "pathfinder_geometry"
@@ -1316,39 +1295,30 @@ dependencies = [
 
 [[package]]
 name = "pathfinder_simd"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "39fe46acc5503595e5949c17b818714d26fdf9b4920eacf3b2947f0199f4a6ff"
-dependencies = [
- "rustc_version 0.3.3",
-]
-
-[[package]]
-name = "pest"
-version = "2.1.3"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "10f4872ae94d7b90ae48754df22fd42ad52ce740b8f370b03da4835417403e53"
+checksum = "0444332826c70dc47be74a7c6a5fc44e23a7905ad6858d4162b658320455ef93"
 dependencies = [
- "ucd-trie",
+ "rustc_version",
 ]
 
 [[package]]
 name = "pin-project-lite"
-version = "0.2.9"
+version = "0.2.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e0a7ae3ac2f1173085d398531c705756c94a4c56843785df85a60c1a0afac116"
+checksum = "8afb450f006bf6385ca15ef45d71d2288452bc3683ce2e2cacc0d18e4be60b58"
 
 [[package]]
 name = "pkg-config"
-version = "0.3.25"
+version = "0.3.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1df8c4ec4b0627e53bdf214615ad287367e482558cf84b109250b37464dc03ae"
+checksum = "26072860ba924cbfa98ea39c8c19b4dd6a4a25423dbdf219c1eca91aa0cf6964"
 
 [[package]]
 name = "plotters"
-version = "0.3.1"
+version = "0.3.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32a3fd9ec30b9749ce28cd91f255d569591cdf937fe280c312143e3c4bad6f2a"
+checksum = "d2c224ba00d7cadd4d5c660deaf2098e5e80e07846537c51f9cfa4be50c1fd45"
 dependencies = [
  "font-kit",
  "lazy_static",
@@ -1364,15 +1334,15 @@ dependencies = [
 
 [[package]]
 name = "plotters-backend"
-version = "0.3.2"
+version = "0.3.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d88417318da0eaf0fdcdb51a0ee6c3bed624333bff8f946733049380be67ac1c"
+checksum = "9e76628b4d3a7581389a35d5b6e2139607ad7c75b17aed325f210aa91f4a9609"
 
 [[package]]
 name = "plotters-bitmap"
-version = "0.3.1"
+version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "21362fa905695e5618aefd169358f52e0e8bc4a8e05333cf780fda8cddc00b54"
+checksum = "0cebbe1f70205299abc69e8b295035bb52a6a70ee35474ad10011f0a4efb8543"
 dependencies = [
  "image",
  "plotters-backend",
@@ -1380,31 +1350,32 @@ dependencies = [
 
 [[package]]
 name = "plotters-svg"
-version = "0.3.1"
+version = "0.3.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "521fa9638fa597e1dc53e9412a4f9cefb01187ee1f7413076f9e6749e2885ba9"
+checksum = "38f6d39893cca0701371e3c27294f09797214b86f1fb951b89ade8ec04e2abab"
 dependencies = [
  "plotters-backend",
 ]
 
 [[package]]
 name = "png"
-version = "0.16.8"
+version = "0.17.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c3287920cb847dee3de33d301c463fba14dda99db24214ddf93f83d3021f4c6"
+checksum = "dd75bf2d8dd3702b9707cdbc56a5b9ef42cec752eb8b3bafc01234558442aa64"
 dependencies = [
- "bitflags",
+ "bitflags 1.3.2",
  "crc32fast",
- "deflate",
- "miniz_oxide 0.3.7",
+ "fdeflate",
+ "flate2",
+ "miniz_oxide",
 ]
 
 [[package]]
 name = "poseidon"
 version = "0.2.0"
-source = "git+https://github.com/privacy-scaling-explorations/poseidon.git?tag=v2023_04_20#807f8f555313f726ca03bdf941f798098f488ba4"
+source = "git+https://github.com/scroll-tech/poseidon.git?branch=sync-halo2-lib-0.4.0#5787dd3d2ce7a9e9601a035c396ac0c03449b54d"
 dependencies = [
- "halo2curves 0.3.2",
+ "halo2curves",
  "subtle",
 ]
 
@@ -1432,37 +1403,37 @@ dependencies = [
 
 [[package]]
 name = "ppv-lite86"
-version = "0.2.16"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb9f9e6e233e5c4a35559a617bf40a4ec447db2e84c20b55a6f83167b7e57872"
+checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de"
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.37"
+version = "1.0.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec757218438d5fda206afc041538b2f6d889286160d649a86a24d37e1235afd1"
+checksum = "134c189feb4956b20f6f547d2cf727d4c0fe06722b20a0eec87ed445a97f92da"
 dependencies = [
- "unicode-xid",
+ "unicode-ident",
 ]
 
 [[package]]
 name = "proptest"
-version = "1.0.0"
+version = "1.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e0d9cc07f18492d879586c92b485def06bc850da3118075cd45d50e9c95b0e5"
+checksum = "7c003ac8c77cb07bb74f5f198bce836a689bcd5a42574612bf14d17bfd08c20e"
 dependencies = [
  "bit-set",
- "bitflags",
- "byteorder",
+ "bit-vec",
+ "bitflags 2.4.1",
  "lazy_static",
  "num-traits",
- "quick-error 2.0.1",
  "rand",
  "rand_chacha",
  "rand_xorshift",
- "regex-syntax",
+ "regex-syntax 0.7.5",
  "rusty-fork",
  "tempfile",
+ "unarray",
 ]
 
 [[package]]
@@ -1471,26 +1442,20 @@ version = "1.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0"
 
-[[package]]
-name = "quick-error"
-version = "2.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a993555f31e5a609f617c12db6250dedcac1b0a85076912c436e6fc9b2c8e6a3"
-
 [[package]]
 name = "quick-xml"
-version = "0.23.1"
+version = "0.26.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11bafc859c6815fbaffbbbf4229ecb767ac913fecb27f9ad4343662e9ef099ea"
+checksum = "7f50b1c63b38611e7d4d7f68b82d3ad0cc71a2ad2e7f61fc10f1328d917c93cd"
 dependencies = [
  "memchr",
 ]
 
 [[package]]
 name = "quote"
-version = "1.0.18"
+version = "1.0.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1feb54ed693b93a84e14094943b84b7c4eae204c512b7ccb95ab0c66d278ad1"
+checksum = "5267fca4496028628a95160fc423a33e8b2e6af8a5302579e322e4b520293cae"
 dependencies = [
  "proc-macro2",
 ]
@@ -1524,9 +1489,9 @@ dependencies = [
 
 [[package]]
 name = "rand_core"
-version = "0.6.3"
+version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d34f1408f55294453790c48b2f1ebbb1c5b4b7563eb1f418bcfcfdbb06ebb4e7"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
 dependencies = [
  "getrandom",
 ]
@@ -1542,35 +1507,40 @@ dependencies = [
 
 [[package]]
 name = "rayon"
-version = "1.5.2"
+version = "1.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fd249e82c21598a9a426a4e00dd7adc1d640b22445ec8545feef801d1a74c221"
+checksum = "9c27db03db7734835b3f53954b534c91069375ce6ccaa2e065441e07d9b6cdb1"
 dependencies = [
- "autocfg",
- "crossbeam-deque",
  "either",
  "rayon-core",
 ]
 
 [[package]]
 name = "rayon-core"
-version = "1.9.2"
+version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f51245e1e62e1f1629cbfec37b5793bbabcaeb90f30e94d2ba03564687353e4"
+checksum = "5ce3fb6ad83f861aac485e76e1985cd109d9a3713802152be56c3b1f0e0658ed"
 dependencies = [
- "crossbeam-channel",
  "crossbeam-deque",
  "crossbeam-utils",
- "num_cpus",
 ]
 
 [[package]]
 name = "redox_syscall"
-version = "0.2.13"
+version = "0.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62f25bc4c7e55e0b0b7a1d43fb893f4fa1361d0abe38b9ce4f323c2adfe6ef42"
+checksum = "fb5a58c1855b4b6819d59012155603f0b22ad30cad752600aadfcb695265519a"
 dependencies = [
- "bitflags",
+ "bitflags 1.3.2",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "567664f262709473930a4bf9e51bf2ebf3348f2e748ccc50dea20646858f8f29"
+dependencies = [
+ "bitflags 1.3.2",
 ]
 
 [[package]]
@@ -1580,73 +1550,80 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b033d837a7cf162d7993aded9304e30a83213c648b6e389db233191f891e5c2b"
 dependencies = [
  "getrandom",
- "redox_syscall",
+ "redox_syscall 0.2.16",
  "thiserror",
 ]
 
 [[package]]
 name = "regex"
-version = "1.5.5"
+version = "1.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a11647b6b25ff05a515cb92c365cec08801e83423a235b51e231e1808747286"
+checksum = "380b951a9c5e80ddfd6136919eef32310721aa4aacd4889a8d39124b026ab343"
 dependencies = [
  "aho-corasick",
  "memchr",
- "regex-syntax",
+ "regex-automata",
+ "regex-syntax 0.8.2",
 ]
 
 [[package]]
 name = "regex-automata"
-version = "0.1.10"
+version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c230d73fb8d8c1b9c0b3135c5142a8acee3a0558fb8db5cf1cb65f8d7862132"
+checksum = "5f804c7828047e88b2d32e2d7fe5a105da8ee3264f01902f796c8e067dc2483f"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax 0.8.2",
+]
 
 [[package]]
 name = "regex-syntax"
-version = "0.6.25"
+version = "0.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f497285884f3fcff424ffc933e56d7cbca511def0c9831a7f9b5f6153e3cc89b"
+checksum = "dbb5fb1acd8a1a18b3dd5be62d25485eb770e05afb408a9627d14d451bae12da"
 
 [[package]]
-name = "remove_dir_all"
-version = "0.5.3"
+name = "regex-syntax"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3acd125665422973a33ac9d3dd2df85edad0f4ae9b00dafb1a05e43a9f5ef8e7"
-dependencies = [
- "winapi",
-]
+checksum = "c08c74e62047bb2de4ff487b251e4a92e24f48745648451635cec7d591162d9f"
 
 [[package]]
 name = "rgb"
-version = "0.8.32"
+version = "0.8.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e74fdc210d8f24a7dbfedc13b04ba5764f5232754ccebfdf5fff1bad791ccbc6"
+checksum = "20ec2d3e3fc7a92ced357df9cebd5a10b6fb2aa1ee797bf7e9ce2f17dffc8f59"
 dependencies = [
  "bytemuck",
 ]
 
 [[package]]
 name = "rustc-demangle"
-version = "0.1.21"
+version = "0.1.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ef03e0a2b150c7a90d01faf6254c9c48a41e95fb2a8c2ac1c6f0d2b9aefc342"
+checksum = "d626bb9dae77e28219937af045c257c28bfd3f69333c512553507f5f9798cb76"
 
 [[package]]
 name = "rustc_version"
-version = "0.3.3"
+version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0dfe2087c51c460008730de8b57e6a320782fbfb312e1f4d520e6c6fae155ee"
+checksum = "bfa0f585226d2e68097d4f95d113b15b83a82e819ab25717ec0590d9584ef366"
 dependencies = [
- "semver 0.11.0",
+ "semver",
 ]
 
 [[package]]
-name = "rustc_version"
-version = "0.4.0"
+name = "rustix"
+version = "0.38.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfa0f585226d2e68097d4f95d113b15b83a82e819ab25717ec0590d9584ef366"
+checksum = "745ecfa778e66b2b63c88a61cb36e0eea109e803b0b86bf9879fbc77c70e86ed"
 dependencies = [
- "semver 1.0.7",
+ "bitflags 2.4.1",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys",
 ]
 
 [[package]]
@@ -1656,16 +1633,16 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cb3dcc6e454c328bb824492db107ab7c0ae8fcffe4ad210136ef014458c1bc4f"
 dependencies = [
  "fnv",
- "quick-error 1.2.3",
+ "quick-error",
  "tempfile",
  "wait-timeout",
 ]
 
 [[package]]
 name = "ryu"
-version = "1.0.9"
+version = "1.0.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "73b4b750c782965c211b42f022f59af1fbceabdd026623714f104152f1ec149f"
+checksum = "1ad4cc8da4ef723ed60bced201181d83791ad433213d8c24efffda1eec85d741"
 
 [[package]]
 name = "same-file"
@@ -1678,40 +1655,25 @@ dependencies = [
 
 [[package]]
 name = "scopeguard"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
-
-[[package]]
-name = "semver"
-version = "0.11.0"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f301af10236f6df4160f7c3f04eec6dbc70ace82d23326abad5edee88801c6b6"
-dependencies = [
- "semver-parser",
-]
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
 [[package]]
 name = "semver"
-version = "1.0.7"
+version = "1.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d65bd28f48be7196d222d95b9243287f48d27aca604e08497513019ff0502cc4"
+checksum = "836fa6a3e1e547f9a2c4040802ec865b5d85f4014efe00555d7090a3dcaa1090"
 
 [[package]]
-name = "semver-parser"
-version = "0.10.2"
+name = "serde"
+version = "1.0.189"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "00b0bef5b7f9e0df16536d3961cfb6e84331c065b4066afb39768d0e319411f7"
+checksum = "8e422a44e74ad4001bdc8eede9a4570ab52f71190e9c076d14369f38b9200537"
 dependencies = [
- "pest",
+ "serde_derive",
 ]
 
-[[package]]
-name = "serde"
-version = "1.0.136"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce31e24b01e1e524df96f1c2fdd054405f8d7376249a5110886fb4b658484789"
-
 [[package]]
 name = "serde_cbor"
 version = "0.11.2"
@@ -1724,47 +1686,26 @@ dependencies = [
 
 [[package]]
 name = "serde_derive"
-version = "1.0.136"
+version = "1.0.189"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08597e7152fcd306f41838ed3e37be9eaeed2b61c42e2117266a554fab4662f9"
+checksum = "1e48d1f918009ce3145511378cf68d613e3b3d9137d67272562080d68a2b32d5"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.38",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.79"
+version = "1.0.107"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e8d9fa5c3b304765ce1fd9c4c8a3de2c8db365a5b91be52f186efc675681d95"
+checksum = "6b420ce6e3d8bd882e9b243c6eed35dbc9a6110c9769e74b584e0d68d1f20c65"
 dependencies = [
- "itoa 1.0.1",
+ "itoa",
  "ryu",
  "serde",
 ]
 
-[[package]]
-name = "servo-fontconfig"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7e3e22fe5fd73d04ebf0daa049d3efe3eae55369ce38ab16d07ddd9ac5c217c"
-dependencies = [
- "libc",
- "servo-fontconfig-sys",
-]
-
-[[package]]
-name = "servo-fontconfig-sys"
-version = "5.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e36b879db9892dfa40f95da1c38a835d41634b825fbd8c4c418093d53c24b388"
-dependencies = [
- "expat-sys",
- "freetype-sys",
- "pkg-config",
-]
-
 [[package]]
 name = "sha3"
 version = "0.9.1"
@@ -1777,11 +1718,17 @@ dependencies = [
  "opaque-debug",
 ]
 
+[[package]]
+name = "simd-adler32"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d66dc143e6b11c1eddc06d5c423cfc97062865baf299914ab64caa38182078fe"
+
 [[package]]
 name = "smallvec"
-version = "1.8.0"
+version = "1.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2dd574626839106c320a323308629dcb1acfc96e32a8cba364ddc61ac23ee83"
+checksum = "942b4a808e05215192e39f4ab80813e599068285906cc91aa64f923db842bd5a"
 
 [[package]]
 name = "spin"
@@ -1815,15 +1762,15 @@ checksum = "6446ced80d6c486436db5c078dde11a9f73d42b57fb273121e160b84f63d894c"
 
 [[package]]
 name = "subtle"
-version = "2.4.1"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6bdef32e8150c2a081110b42772ffe7d7c9032b606bc226c8260fd97e0976601"
+checksum = "81cdd64d312baedb58e21336b31bc043b77e01cc99033ce76ef539f78e965ebc"
 
 [[package]]
 name = "symbolic-common"
-version = "8.7.0"
+version = "8.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac6aac7b803adc9ee75344af7681969f76d4b38e4723c6eaacf3b28f5f1d87ff"
+checksum = "f551f902d5642e58039aee6a9021a61037926af96e071816361644983966f540"
 dependencies = [
  "debugid",
  "memmap2",
@@ -1833,9 +1780,9 @@ dependencies = [
 
 [[package]]
 name = "symbolic-demangle"
-version = "8.7.0"
+version = "8.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8143ea5aa546f86c64f9b9aafdd14223ffad4ecd2d58575c63c21335909c99a7"
+checksum = "4564ca7b4e6eb14105aa8bbbce26e080f6b5d9c4373e67167ab31f7b86443750"
 dependencies = [
  "cpp_demangle",
  "rustc-demangle",
@@ -1844,13 +1791,24 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "1.0.91"
+version = "1.0.109"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.38"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b683b2b825c8eef438b77c36a06dc262294da3d5a5813fac20da149241dcd44d"
+checksum = "e96b79aaa137db8f61e26363a0c9b47d8b4ec75da28b7d1d614c2303e232408b"
 dependencies = [
  "proc-macro2",
  "quote",
- "unicode-xid",
+ "unicode-ident",
 ]
 
 [[package]]
@@ -1872,23 +1830,22 @@ checksum = "55937e1799185b12863d447f42597ed69d9928686b8d88a1df17376a097d8369"
 
 [[package]]
 name = "tempfile"
-version = "3.3.0"
+version = "3.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5cdb1ef4eaeeaddc8fbd371e5017057064af0911902ef36b39801f67cc6d79e4"
+checksum = "cb94d2f3cc536af71caac6b6fcebf65860b347e7ce0cc9ebe8f70d3e521054ef"
 dependencies = [
  "cfg-if 1.0.0",
  "fastrand",
- "libc",
- "redox_syscall",
- "remove_dir_all",
- "winapi",
+ "redox_syscall 0.3.5",
+ "rustix",
+ "windows-sys",
 ]
 
 [[package]]
 name = "termcolor"
-version = "1.2.0"
+version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be55cf8942feac5c765c2c993422806843c9a9a45d4d5c407ad6dd2ea95eb9b6"
+checksum = "6093bad37da69aab9d123a8091e4be0aa4a03e4d601ec641c327398315f62b64"
 dependencies = [
  "winapi-util",
 ]
@@ -1904,22 +1861,22 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "1.0.30"
+version = "1.0.49"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "854babe52e4df1653706b98fcfc05843010039b406875930a70e4d9644e5c417"
+checksum = "1177e8c6d7ede7afde3585fd2513e611227efd6481bd78d2e82ba1ce16557ed4"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.30"
+version = "1.0.49"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa32fd3f627f367fe16f893e2597ae3c05020f8bba2666a4e6ea73d377e5714b"
+checksum = "10712f02019e9288794769fba95cd6847df9874d49d871d062172f9dd41bc4cc"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.38",
 ]
 
 [[package]]
@@ -1934,11 +1891,10 @@ dependencies = [
 
 [[package]]
 name = "tracing"
-version = "0.1.36"
+version = "0.1.39"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2fce9567bd60a67d08a16488756721ba392f24f29006402881e43b19aac64307"
+checksum = "ee2ef2af84856a50c1d430afce2fdded0a4ec7eda868db86409b4543df0797f9"
 dependencies = [
- "cfg-if 1.0.0",
  "pin-project-lite",
  "tracing-attributes",
  "tracing-core",
@@ -1946,47 +1902,41 @@ dependencies = [
 
 [[package]]
 name = "tracing-attributes"
-version = "0.1.22"
+version = "0.1.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11c75893af559bc8e10716548bdef5cb2b983f8e637db9d0e15126b61b484ee2"
+checksum = "34704c8d6ebcbc939824180af020566b01a7c01f80641264eba0999f6c2b6be7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.38",
 ]
 
 [[package]]
 name = "tracing-core"
-version = "0.1.29"
+version = "0.1.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5aeea4303076558a00714b823f9ad67d58a3bbda1df83d8827d21193156e22f7"
+checksum = "c06d3da6113f116aaee68e4d601191614c9053067f9ab7f6edbcb161237daa54"
 dependencies = [
  "once_cell",
 ]
 
 [[package]]
 name = "ttf-parser"
-version = "0.12.3"
+version = "0.17.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ae2f58a822f08abdaf668897e96a5656fe72f5a9ce66422423e8849384872e6"
+checksum = "375812fa44dab6df41c195cd2f7fecb488f6c09fbaafb62807488cefab642bff"
 
 [[package]]
 name = "typenum"
-version = "1.16.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "497961ef93d974e23eb6f433eb5fe1b7930b659f06d12dec6fc44a8f554c0bba"
-
-[[package]]
-name = "ucd-trie"
-version = "0.1.3"
+version = "1.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56dee185309b50d1f11bfedef0fe6d036842e3fb77413abef29f8f8d1c5d4c1c"
+checksum = "42ff0bf0c66b8238c6f3b578df37d0b7848e55df8577b3f74f92a69acceeb825"
 
 [[package]]
 name = "uint"
-version = "0.9.4"
+version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a45526d29728d135c2900b0d30573fe3ee79fceb12ef534c7bb30e810a91b601"
+checksum = "76f64bba2c53b04fcab63c01a7d7427eadc821e3bc48c34dc9ba29c501164b52"
 dependencies = [
  "byteorder",
  "crunchy",
@@ -1995,16 +1945,22 @@ dependencies = [
 ]
 
 [[package]]
-name = "unicode-width"
-version = "0.1.9"
+name = "unarray"
+version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3ed742d4ea2bd1176e236172c8429aaf54486e7ac098db29ffe6529e0ce50973"
+checksum = "eaea85b334db583fe3274d12b4cd1880032beab409c0d774be044d4480ab9a94"
 
 [[package]]
-name = "unicode-xid"
-version = "0.2.2"
+name = "unicode-ident"
+version = "1.0.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
+
+[[package]]
+name = "unicode-width"
+version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ccb82d61f80a663efe1f787a51b16b5a51e3314d6ac365b08639f52387b33f3"
+checksum = "e51733f11c9c4f72aa0c160008246859e340b00807569a0da0e7a1079b27ba85"
 
 [[package]]
 name = "uuid"
@@ -2029,26 +1985,25 @@ dependencies = [
 
 [[package]]
 name = "walkdir"
-version = "2.3.2"
+version = "2.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "808cf2735cd4b6866113f648b791c6adc5714537bc222d9347bb203386ffda56"
+checksum = "d71d857dc86794ca4c280d616f7da00d2dbfd8cd788846559a6813e6aa4b54ee"
 dependencies = [
  "same-file",
- "winapi",
  "winapi-util",
 ]
 
 [[package]]
 name = "wasi"
-version = "0.10.0+wasi-snapshot-preview1"
+version = "0.11.0+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a143597ca7c7793eff794def352d41792a93c481eb1042423ff7ff72ba2c31f"
+checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.80"
+version = "0.2.87"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "27370197c907c55e3f1a9fbe26f44e937fe6451368324e009cba39e139dc08ad"
+checksum = "7706a72ab36d8cb1f80ffbf0e071533974a60d0a308d01a5d0375bf60499a342"
 dependencies = [
  "cfg-if 1.0.0",
  "wasm-bindgen-macro",
@@ -2056,24 +2011,24 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-backend"
-version = "0.2.80"
+version = "0.2.87"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53e04185bfa3a779273da532f5025e33398409573f348985af9a1cbf3774d3f4"
+checksum = "5ef2b6d3c510e9625e5fe6f509ab07d66a760f0885d858736483c32ed7809abd"
 dependencies = [
  "bumpalo",
- "lazy_static",
  "log",
+ "once_cell",
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.38",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.80"
+version = "0.2.87"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "17cae7ff784d7e83a2fe7611cfe766ecf034111b49deb850a3dc7699c08251f5"
+checksum = "dee495e55982a3bd48105a7b947fd2a9b4a8ae3010041b9e0faab3f9cd028f1d"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -2081,28 +2036,28 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.80"
+version = "0.2.87"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "99ec0dc7a4756fffc231aab1b9f2f578d23cd391390ab27f952ae0c9b3ece20b"
+checksum = "54681b18a46765f095758388f2d0cf16eb8d4169b639ab575a8f5693af210c7b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.38",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.80"
+version = "0.2.87"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d554b7f530dee5964d9a9468d95c1f8b8acae4f282807e7d27d4b03099a46744"
+checksum = "ca6ad05a4870b2bf5fe995117d3728437bd27d7cd5f06f13c17443ef369775a1"
 
 [[package]]
 name = "web-sys"
-version = "0.3.57"
+version = "0.3.64"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b17e741662c70c8bd24ac5c5b18de314a2c26c32bf8346ee1e6f53de919c283"
+checksum = "9b85cbef8c220a6abc02aefd892dfc0fc23afb1c6a426316ec33253a3877249b"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -2126,9 +2081,9 @@ checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
 
 [[package]]
 name = "winapi-util"
-version = "0.1.5"
+version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70ec6ce85bb158151cae5e5c87f95a8e97d2c0c4b001223f33a334e3ce5de178"
+checksum = "f29e6f9198ba0d26b4c9f07dbe6f9ed633e1f3d5b8b414090084349e46a52596"
 dependencies = [
  "winapi",
 ]
@@ -2141,46 +2096,69 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windows-sys"
-version = "0.36.1"
+version = "0.48.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea04155a16a59f9eab786fe12a4a450e75cdb175f9e0d80da1e17db09f55b8d2"
+checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
 dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
+dependencies = [
+ "windows_aarch64_gnullvm",
  "windows_aarch64_msvc",
  "windows_i686_gnu",
  "windows_i686_msvc",
  "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
  "windows_x86_64_msvc",
 ]
 
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
+
 [[package]]
 name = "windows_aarch64_msvc"
-version = "0.36.1"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9bb8c3fd39ade2d67e9874ac4f3db21f0d710bee00fe7cab16949ec184eeaa47"
+checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
 
 [[package]]
 name = "windows_i686_gnu"
-version = "0.36.1"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "180e6ccf01daf4c426b846dfc66db1fc518f074baa793aa7d9b9aaeffad6a3b6"
+checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
 
 [[package]]
 name = "windows_i686_msvc"
-version = "0.36.1"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2e7917148b2812d1eeafaeb22a97e4813dfa60a3f8f78ebe204bcc88f12f024"
+checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
 
 [[package]]
 name = "windows_x86_64_gnu"
-version = "0.36.1"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4dcd171b8776c41b97521e5da127a2d86ad280114807d0b2ab1e462bc764d9e1"
+checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
 
 [[package]]
 name = "windows_x86_64_msvc"
-version = "0.36.1"
+version = "0.48.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c811ca4a8c853ef420abd8592ba53ddbbac90410fab6903b3e79972a631f7680"
+checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
 
 [[package]]
 name = "wio"
@@ -2193,9 +2171,21 @@ dependencies = [
 
 [[package]]
 name = "wyz"
-version = "0.5.0"
+version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30b31594f29d27036c383b53b59ed3476874d518f0efb151b27a4c275141390e"
+checksum = "05f360fc0b24296329c78fda852a1e9ae82de9cf7b27dae4b7f62f118f77b9ed"
 dependencies = [
  "tap",
 ]
+
+[[package]]
+name = "yeslogic-fontconfig-sys"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2bbd69036d397ebbff671b1b8e4d918610c181c5a16073b96f984a38d08c386"
+dependencies = [
+ "const-cstr",
+ "dlib",
+ "once_cell",
+ "pkg-config",
+]
diff --git a/halo2_proofs/Cargo.toml b/halo2_proofs/Cargo.toml
index 3ddaac6800..8c044aa428 100644
--- a/halo2_proofs/Cargo.toml
+++ b/halo2_proofs/Cargo.toml
@@ -54,7 +54,7 @@ blake2b_simd = "1" # MSRV 1.66.0
 sha3 = "0.9.1"
 subtle = "2.3"
 cfg-if = "0.1"
-poseidon = { git = "https://github.com/privacy-scaling-explorations/poseidon.git", tag = "v2023_04_20" }
+poseidon = { git = "https://github.com/scroll-tech/poseidon.git", branch = "sync-halo2-lib-0.4.0" }
 num-integer = "0.1"
 num-bigint = { version = "0.4", features = ["rand"] }
 rand_chacha = "0.3"

From e5acb7d460abacb00b44eb02aae1624bf1dcc275 Mon Sep 17 00:00:00 2001
From: zhenfei <zhenfei.zhang@hotmail.com>
Date: Mon, 16 Oct 2023 14:07:42 -0400
Subject: [PATCH 26/30] fix: compiling bug with feautes=parallel_syn

---
 halo2_proofs/Cargo.toml         |  2 +-
 halo2_proofs/src/dev/tfp.rs     | 16 ++++++++++++++++
 halo2_proofs/tests/plonk_api.rs |  8 ++++----
 3 files changed, 21 insertions(+), 5 deletions(-)

diff --git a/halo2_proofs/Cargo.toml b/halo2_proofs/Cargo.toml
index 8c044aa428..bf22610b63 100644
--- a/halo2_proofs/Cargo.toml
+++ b/halo2_proofs/Cargo.toml
@@ -84,7 +84,7 @@ rand_core = { version = "0.6", default-features = false, features = ["getrandom"
 getrandom = { version = "0.2", features = ["js"] }
 
 [features]
-default = ["batch", "gwc", "multicore"]
+default = ["batch", "gwc", "multicore", "parallel_syn"]
 multicore = ["maybe-rayon/threads"]
 dev-graph = ["plotters", "tabbycat"]
 test-dev-graph = [
diff --git a/halo2_proofs/src/dev/tfp.rs b/halo2_proofs/src/dev/tfp.rs
index 011ba3cac0..736ea790b7 100644
--- a/halo2_proofs/src/dev/tfp.rs
+++ b/halo2_proofs/src/dev/tfp.rs
@@ -180,6 +180,22 @@ impl<F: Field, L: Layouter<F>> Layouter<F> for TracingLayouter<F, L> {
         })
     }
 
+    #[cfg(feature = "parallel_syn")]
+    fn assign_regions<A, AR, N, NR>(
+        &mut self,
+        _name: N,
+        _assignments: Vec<A>,
+    ) -> Result<Vec<AR>, Error>
+    where
+        A: FnMut(Region<'_, F>) -> Result<AR, Error> + Send,
+        AR: Send,
+        N: Fn() -> NR,
+        NR: Into<String>,
+    {
+        // todo
+        unimplemented!()
+    }
+
     fn assign_table<A, N, NR>(&mut self, name: N, assignment: A) -> Result<(), Error>
     where
         A: FnMut(Table<'_, F>) -> Result<(), Error>,
diff --git a/halo2_proofs/tests/plonk_api.rs b/halo2_proofs/tests/plonk_api.rs
index 55db8b476e..99cbee8e60 100644
--- a/halo2_proofs/tests/plonk_api.rs
+++ b/halo2_proofs/tests/plonk_api.rs
@@ -407,25 +407,25 @@ fn plonk_api() {
                                     || "a",
                                     cs.config.sa,
                                     i,
-                                    || Value::known(F::one()),
+                                    || Value::known(F::ONE),
                                 )?;
                                 region.assign_fixed(
                                     || "b",
                                     cs.config.sb,
                                     i,
-                                    || Value::known(F::one()),
+                                    || Value::known(F::ONE),
                                 )?;
                                 region.assign_fixed(
                                     || "c",
                                     cs.config.sc,
                                     i,
-                                    || Value::known(F::one()),
+                                    || Value::known(F::ONE),
                                 )?;
                                 region.assign_fixed(
                                     || "a * b",
                                     cs.config.sm,
                                     i,
-                                    || Value::known(F::zero()),
+                                    || Value::known(F::ZERO),
                                 )?;
 
                                 region.constrain_equal(a0.cell(), a1.cell())?;

From 2b92df993b447887d5ca9e1e12ac60446ed4f4f0 Mon Sep 17 00:00:00 2001
From: Velaciela <git.rover@outlook.com>
Date: Wed, 25 Oct 2023 08:59:54 +0000
Subject: [PATCH 27/30] feat(MockProver): replace errors by
 asserts(privacy-scaling-explorations#150)

---
 halo2_proofs/src/dev.rs                      | 137 ++++++++++++-------
 halo2_proofs/src/plonk/keygen.rs             |   7 +-
 halo2_proofs/src/plonk/permutation/keygen.rs |  10 ++
 halo2_proofs/src/plonk/prover.rs             |   6 +-
 4 files changed, 102 insertions(+), 58 deletions(-)

diff --git a/halo2_proofs/src/dev.rs b/halo2_proofs/src/dev.rs
index d86122a0cc..33bd1b2b1d 100644
--- a/halo2_proofs/src/dev.rs
+++ b/halo2_proofs/src/dev.rs
@@ -414,13 +414,15 @@ impl<F: Field> Mul<F> for Value<F> {
 ///     }])
 /// );
 ///
-/// // If we provide a too-small K, we get an error.
-/// assert!(matches!(
-///     MockProver::<Fp>::run(2, &circuit, vec![]).unwrap_err(),
-///     Error::NotEnoughRowsAvailable {
-///         current_k,
-///     } if current_k == 2,
-/// ));
+/// // If we provide a too-small K, we get a panic.
+/// use std::panic;
+/// let result = panic::catch_unwind(|| {
+///     MockProver::<Fp>::run(2, &circuit, vec![]).unwrap_err()
+/// });
+/// assert_eq!(
+///     result.unwrap_err().downcast_ref::<String>().unwrap(),
+///     "n=4, minimum_rows=8, k=2"
+/// );
 /// ```
 #[derive(Debug)]
 pub struct MockProver<'a, F: Field> {
@@ -537,9 +539,13 @@ impl<'a, F: Field> Assignment<F> for MockProver<'a, F> {
             return Ok(());
         }
 
-        if !self.usable_rows.contains(&row) {
-            return Err(Error::not_enough_rows_available(self.k));
-        }
+        assert!(
+            self.usable_rows.contains(&row),
+            "row={} not in usable_rows={:?}, k={}",
+            row,
+            self.usable_rows,
+            self.k,
+        );
 
         if !self.rw_rows.contains(&row) {
             return Err(Error::InvalidRange(
@@ -694,15 +700,20 @@ impl<'a, F: Field> Assignment<F> for MockProver<'a, F> {
         column: Column<Instance>,
         row: usize,
     ) -> Result<circuit::Value<F>, Error> {
-        if !self.usable_rows.contains(&row) {
-            return Err(Error::not_enough_rows_available(self.k));
-        }
+        assert!(
+            self.usable_rows.contains(&row),
+            "row={}, usable_rows={:?}, k={}",
+            row,
+            self.usable_rows,
+            self.k,
+        );
 
-        self.instance
+        Ok(self
+            .instance
             .get(column.index())
             .and_then(|column| column.get(row))
             .map(|v| circuit::Value::known(v.value()))
-            .ok_or(Error::BoundsFailure)
+            .expect("bound failure"))
     }
 
     fn assign_advice<V, VR, A, AR>(
@@ -723,8 +734,22 @@ impl<'a, F: Field> Assignment<F> for MockProver<'a, F> {
             return Ok(());
         }
 
-        if !self.usable_rows.contains(&row) {
-            return Err(Error::not_enough_rows_available(self.k));
+        if self.in_phase(FirstPhase) {
+            assert!(
+                self.usable_rows.contains(&row),
+                "row={}, usable_rows={:?}, k={}",
+                row,
+                self.usable_rows,
+                self.k,
+            );
+            if let Some(region) = self.current_region.as_mut() {
+                region.update_extent(column.into(), row);
+                region
+                    .cells
+                    .entry((column.into(), row))
+                    .and_modify(|count| *count += 1)
+                    .or_default();
+            }
         }
 
         if !self.rw_rows.contains(&row) {
@@ -737,15 +762,6 @@ impl<'a, F: Field> Assignment<F> for MockProver<'a, F> {
             ));
         }
 
-        if let Some(region) = self.current_region.as_mut() {
-            region.update_extent(column.into(), row);
-            region
-                .cells
-                .entry((column.into(), row))
-                .and_modify(|count| *count += 1)
-                .or_default();
-        }
-
         let advice_anno = anno().into();
         #[cfg(not(feature = "mock-batch-inv"))]
         let val_res = to().into_field().evaluate().assign();
@@ -808,9 +824,13 @@ impl<'a, F: Field> Assignment<F> for MockProver<'a, F> {
             return Ok(());
         }
 
-        if !self.usable_rows.contains(&row) {
-            return Err(Error::not_enough_rows_available(self.k));
-        }
+        assert!(
+            self.usable_rows.contains(&row),
+            "row={}, usable_rows={:?}, k={}",
+            row,
+            self.usable_rows,
+            self.k,
+        );
 
         if !self.rw_rows.contains(&row) {
             return Err(Error::InvalidRange(
@@ -863,9 +883,14 @@ impl<'a, F: Field> Assignment<F> for MockProver<'a, F> {
             return Ok(());
         }
 
-        if !self.usable_rows.contains(&left_row) || !self.usable_rows.contains(&right_row) {
-            return Err(Error::not_enough_rows_available(self.k));
-        }
+        assert!(
+            self.usable_rows.contains(&left_row) && self.usable_rows.contains(&right_row),
+            "left_row={}, right_row={}, usable_rows={:?}, k={}",
+            left_row,
+            right_row,
+            self.usable_rows,
+            self.k,
+        );
 
         match self.permutation.as_mut() {
             Some(permutation) => permutation.copy(left_column, left_row, right_column, right_row),
@@ -898,9 +923,13 @@ impl<'a, F: Field> Assignment<F> for MockProver<'a, F> {
             return Ok(());
         }
 
-        if !self.usable_rows.contains(&from_row) {
-            return Err(Error::not_enough_rows_available(self.k));
-        }
+        assert!(
+            self.usable_rows.contains(&from_row),
+            "row={}, usable_rows={:?}, k={}",
+            from_row,
+            self.usable_rows,
+            self.k,
+        );
 
         for row in self.usable_rows.clone().skip(from_row) {
             self.assign_fixed(|| "", col, row, || to)?;
@@ -947,29 +976,35 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
         let config = ConcreteCircuit::configure(&mut cs);
         let cs = cs;
 
-        if n < cs.minimum_rows() {
-            return Err(Error::not_enough_rows_available(k));
-        }
+        assert!(
+            n >= cs.minimum_rows(),
+            "n={}, minimum_rows={}, k={}",
+            n,
+            cs.minimum_rows(),
+            k,
+        );
 
-        if instance.len() != cs.num_instance_columns {
-            return Err(Error::InvalidInstances);
-        }
+        assert_eq!(instance.len(), cs.num_instance_columns);
 
         let instance = instance
             .into_iter()
             .map(|instance| {
-                if instance.len() > n - (cs.blinding_factors() + 1) {
-                    return Err(Error::InstanceTooLarge);
-                }
+                assert!(
+                    instance.len() <= n - (cs.blinding_factors() + 1),
+                    "instance.len={}, n={}, cs.blinding_factors={}",
+                    instance.len(),
+                    n,
+                    cs.blinding_factors()
+                );
 
                 let mut instance_values = vec![InstanceValue::Padding; n];
                 for (idx, value) in instance.into_iter().enumerate() {
                     instance_values[idx] = InstanceValue::Assigned(value);
                 }
 
-                Ok(instance_values)
+                instance_values
             })
-            .collect::<Result<Vec<_>, _>>()?;
+            .collect::<Vec<_>>();
 
         // Fixed columns contain no blinding factors.
         let fixed_vec = Arc::new(vec![vec![CellValue::Unassigned; n]; cs.num_fixed_columns]);
@@ -1008,10 +1043,10 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
             .collect()
         };
 
-        #[cfg(feature = "phase-check")]
-        let current_phase = FirstPhase.to_sealed();
-        #[cfg(not(feature = "phase-check"))]
-        let current_phase = crate::plonk::sealed::Phase(cs.max_phase());
+        // #[cfg(feature = "phase-check")]
+        // let current_phase = FirstPhase.to_sealed();
+        // #[cfg(not(feature = "phase-check"))]
+        // let current_phase = crate::plonk::sealed::Phase(cs.max_phase());
 
         let mut prover = MockProver {
             k,
@@ -1031,7 +1066,7 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
             permutation: Some(permutation),
             rw_rows: 0..usable_rows,
             usable_rows: 0..usable_rows,
-            current_phase, // FirstPhase.to_sealed(),
+            current_phase: FirstPhase.to_sealed(),
         };
 
         #[cfg(feature = "phase-check")]
diff --git a/halo2_proofs/src/plonk/keygen.rs b/halo2_proofs/src/plonk/keygen.rs
index 504125702f..1438e815d1 100644
--- a/halo2_proofs/src/plonk/keygen.rs
+++ b/halo2_proofs/src/plonk/keygen.rs
@@ -241,7 +241,7 @@ impl<'a, F: Field> Assignment<F> for Assembly<'a, F> {
             .fixed
             .get_mut(column.index())
             .and_then(|v| v.get_mut(row - self.rw_rows.start))
-            .ok_or(Error::BoundsFailure)? = to().into_field().assign()?;
+            .expect("bounds failure") = to().into_field().assign()?;
 
         Ok(())
     }
@@ -285,10 +285,7 @@ impl<'a, F: Field> Assignment<F> for Assembly<'a, F> {
             return Err(Error::not_enough_rows_available(self.k));
         }
 
-        let col = self
-            .fixed
-            .get_mut(column.index())
-            .ok_or(Error::BoundsFailure)?;
+        let col = self.fixed.get_mut(column.index()).expect("bounds failure");
 
         let filler = to.assign()?;
         for row in self.usable_rows.clone().skip(from_row) {
diff --git a/halo2_proofs/src/plonk/permutation/keygen.rs b/halo2_proofs/src/plonk/permutation/keygen.rs
index e4ef225314..d793e5b3e0 100644
--- a/halo2_proofs/src/plonk/permutation/keygen.rs
+++ b/halo2_proofs/src/plonk/permutation/keygen.rs
@@ -75,6 +75,16 @@ impl Assembly {
         if left_row >= self.mapping[left_column].len()
             || right_row >= self.mapping[right_column].len()
         {
+            log::error!(
+                "BoundsFailure: left_row: {}, right_row: {}",
+                left_row,
+                right_row
+            );
+            log::error!(
+                "BoundsFailure: left_max: {}, right_max: {}",
+                self.mapping[left_column].len(),
+                self.mapping[right_column].len()
+            );
             return Err(Error::BoundsFailure);
         }
 
diff --git a/halo2_proofs/src/plonk/prover.rs b/halo2_proofs/src/plonk/prover.rs
index 4071b22e14..107223f687 100644
--- a/halo2_proofs/src/plonk/prover.rs
+++ b/halo2_proofs/src/plonk/prover.rs
@@ -261,11 +261,13 @@ where
                 return Err(Error::not_enough_rows_available(self.k));
             }
 
-            self.instances
+            Ok(self
+                .instances
                 .get(column.index())
                 .and_then(|column| column.get(row))
                 .map(|v| Value::known(*v))
                 .ok_or(Error::BoundsFailure)
+                .expect("bound failure"))
         }
 
         fn assign_advice<V, VR, A, AR>(
@@ -299,7 +301,7 @@ where
                 .advice
                 .get_mut(column.index())
                 .and_then(|v| v.get_mut(row - self.rw_rows.start))
-                .ok_or(Error::BoundsFailure)? = to().into_field().assign()?;
+                .expect("bounds failure") = to().into_field().assign()?;
 
             Ok(())
         }

From 3d4438999c6397633b32b89e7789c0350316c4b1 Mon Sep 17 00:00:00 2001
From: Velaciela <git.rover@outlook.com>
Date: Wed, 25 Oct 2023 09:04:41 +0000
Subject: [PATCH 28/30] boundary offset lost when resolving conflict

---
 halo2_proofs/src/dev.rs | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/halo2_proofs/src/dev.rs b/halo2_proofs/src/dev.rs
index 33bd1b2b1d..3273d24817 100644
--- a/halo2_proofs/src/dev.rs
+++ b/halo2_proofs/src/dev.rs
@@ -781,11 +781,13 @@ impl<'a, F: Field> Assignment<F> for MockProver<'a, F> {
         #[cfg(feature = "mock-batch-inv")]
         let assigned = CellValue::from(val_res?);
 
-        *self
-            .advice
-            .get_mut(column.index())
-            .and_then(|v| v.get_mut(row))
-            .ok_or(Error::BoundsFailure)? = assigned;
+        if self.in_phase(column.column_type().phase) {
+            *self
+                .advice
+                .get_mut(column.index())
+                .and_then(|v| v.get_mut(row - self.rw_rows.start))
+                .expect("bounds failure") = assigned;
+        }
 
         #[cfg(feature = "phase-check")]
         // if false && self.current_phase.0 > column.column_type().phase.0 {

From 5178dc45a367b224689487cfbb9cb5aed5944502 Mon Sep 17 00:00:00 2001
From: zhenfei <zhenfei.zhang@hotmail.com>
Date: Tue, 19 Dec 2023 13:21:19 -0500
Subject: [PATCH 29/30] disable multiphase prover

---
 halo2_proofs/Cargo.toml     |   7 +-
 halo2_proofs/src/dev.rs     | 171 +++++++++++++++++++++++++-----------
 halo2_proofs/src/helpers.rs |   3 +-
 halo2_proofs/src/lib.rs     |   1 +
 rust-toolchain              |   2 +-
 5 files changed, 130 insertions(+), 54 deletions(-)

diff --git a/halo2_proofs/Cargo.toml b/halo2_proofs/Cargo.toml
index bf22610b63..839ed7c9d3 100644
--- a/halo2_proofs/Cargo.toml
+++ b/halo2_proofs/Cargo.toml
@@ -84,7 +84,7 @@ rand_core = { version = "0.6", default-features = false, features = ["getrandom"
 getrandom = { version = "0.2", features = ["js"] }
 
 [features]
-default = ["batch", "gwc", "multicore", "parallel_syn"]
+default = ["batch", "gwc", "multicore", "parallel_syn" ]
 multicore = ["maybe-rayon/threads"]
 dev-graph = ["plotters", "tabbycat"]
 test-dev-graph = [
@@ -100,11 +100,14 @@ batch = ["rand_core/getrandom"]
 shplonk = []
 gwc = []
 parallel_syn = []
-phase-check = []
 profile = ["ark-std/print-trace"]
 mock-batch-inv = []
 circuit-params = []
 
+# todo: we have both mutliphase prover and phase check. consider merge them
+phase-check = []
+multiphase-mock-prover = []
+
 [lib]
 bench = false
 
diff --git a/halo2_proofs/src/dev.rs b/halo2_proofs/src/dev.rs
index 3273d24817..8fc0a89a32 100644
--- a/halo2_proofs/src/dev.rs
+++ b/halo2_proofs/src/dev.rs
@@ -5,24 +5,28 @@ use std::collections::HashSet;
 use std::iter;
 use std::ops::{Add, Mul, Neg, Range};
 use std::sync::Arc;
-use std::time::{Duration, Instant};
+use std::time::Instant;
 
 use blake2b_simd::blake2b;
+use ff::Field;
 use ff::FromUniformBytes;
-use ff::{BatchInvert, Field};
-use group::Group;
 
 use crate::plonk::permutation::keygen::Assembly;
 use crate::{
     circuit,
     plonk::{
-        permutation,
-        sealed::{self, SealedPhase},
-        Advice, Any, Assigned, Assignment, Challenge, Circuit, Column, ConstraintSystem, Error,
-        Expression, FirstPhase, Fixed, FloorPlanner, Instance, Phase, Selector,
+        permutation, sealed, Advice, Any, Assigned, Assignment, Challenge, Circuit, Column,
+        ConstraintSystem, Error, Expression, Fixed, FloorPlanner, Instance, Selector,
     },
 };
 
+#[cfg(feature = "multiphase-mock-prover")]
+use crate::{plonk::sealed::SealedPhase, plonk::FirstPhase, plonk::Phase};
+#[cfg(feature = "multiphase-mock-prover")]
+use ff::BatchInvert;
+#[cfg(feature = "multiphase-mock-prover")]
+use group::Group;
+
 #[cfg(feature = "multicore")]
 use crate::multicore::{
     IndexedParallelIterator, IntoParallelIterator, IntoParallelRefIterator, ParallelIterator,
@@ -49,7 +53,6 @@ pub use tfp::TracingFloorPlanner;
 #[cfg(feature = "dev-graph")]
 mod graph;
 
-use crate::circuit::Cell;
 use crate::helpers::CopyCell;
 #[cfg(feature = "dev-graph")]
 #[cfg_attr(docsrs, doc(cfg(feature = "dev-graph")))]
@@ -478,6 +481,7 @@ impl<F: Field> InstanceValue<F> {
     }
 }
 
+#[cfg(feature = "multiphase-mock-prover")]
 impl<'a, F: Field> MockProver<'a, F> {
     fn in_phase<P: Phase>(&self, phase: P) -> bool {
         self.current_phase == phase.to_sealed()
@@ -490,6 +494,7 @@ impl<'a, F: Field> Assignment<F> for MockProver<'a, F> {
         NR: Into<String>,
         N: FnOnce() -> NR,
     {
+        #[cfg(feature = "multiphase-mock-prover")]
         if !self.in_phase(FirstPhase) {
             return;
         }
@@ -507,6 +512,7 @@ impl<'a, F: Field> Assignment<F> for MockProver<'a, F> {
     }
 
     fn exit_region(&mut self) {
+        #[cfg(feature = "multiphase-mock-prover")]
         if !self.in_phase(FirstPhase) {
             return;
         }
@@ -519,6 +525,7 @@ impl<'a, F: Field> Assignment<F> for MockProver<'a, F> {
         A: FnOnce() -> AR,
         AR: Into<String>,
     {
+        #[cfg(feature = "multiphase-mock-prover")]
         if !self.in_phase(FirstPhase) {
             return;
         }
@@ -535,17 +542,24 @@ impl<'a, F: Field> Assignment<F> for MockProver<'a, F> {
         A: FnOnce() -> AR,
         AR: Into<String>,
     {
-        if !self.in_phase(FirstPhase) {
-            return Ok(());
+        #[cfg(feature = "multiphase-mock-prover")]
+        {
+            if !self.in_phase(FirstPhase) {
+                return Ok(());
+            }
+            assert!(
+                self.usable_rows.contains(&row),
+                "row={} not in usable_rows={:?}, k={}",
+                row,
+                self.usable_rows,
+                self.k,
+            );
         }
 
-        assert!(
-            self.usable_rows.contains(&row),
-            "row={} not in usable_rows={:?}, k={}",
-            row,
-            self.usable_rows,
-            self.k,
-        );
+        #[cfg(not(feature = "multiphase-mock-prover"))]
+        if !self.usable_rows.contains(&row) {
+            return Err(Error::not_enough_rows_available(self.k));
+        }
 
         if !self.rw_rows.contains(&row) {
             return Err(Error::InvalidRange(
@@ -700,6 +714,7 @@ impl<'a, F: Field> Assignment<F> for MockProver<'a, F> {
         column: Column<Instance>,
         row: usize,
     ) -> Result<circuit::Value<F>, Error> {
+        #[cfg(feature = "multiphase-mock-prover")]
         assert!(
             self.usable_rows.contains(&row),
             "row={}, usable_rows={:?}, k={}",
@@ -708,6 +723,11 @@ impl<'a, F: Field> Assignment<F> for MockProver<'a, F> {
             self.k,
         );
 
+        #[cfg(not(feature = "multiphase-mock-prover"))]
+        if !self.usable_rows.contains(&row) {
+            return Err(Error::not_enough_rows_available(self.k));
+        }
+
         Ok(self
             .instance
             .get(column.index())
@@ -734,6 +754,7 @@ impl<'a, F: Field> Assignment<F> for MockProver<'a, F> {
             return Ok(());
         }
 
+        #[cfg(feature = "multiphase-mock-prover")]
         if self.in_phase(FirstPhase) {
             assert!(
                 self.usable_rows.contains(&row),
@@ -752,6 +773,11 @@ impl<'a, F: Field> Assignment<F> for MockProver<'a, F> {
             }
         }
 
+        #[cfg(not(feature = "multiphase-mock-prover"))]
+        if !self.usable_rows.contains(&row) {
+            return Err(Error::not_enough_rows_available(self.k));
+        }
+
         if !self.rw_rows.contains(&row) {
             return Err(Error::InvalidRange(
                 row,
@@ -762,6 +788,16 @@ impl<'a, F: Field> Assignment<F> for MockProver<'a, F> {
             ));
         }
 
+        #[cfg(not(feature = "multiphase-mock-prover"))]
+        if let Some(region) = self.current_region.as_mut() {
+            region.update_extent(column.into(), row);
+            region
+                .cells
+                .entry((column.into(), row))
+                .and_modify(|count| *count += 1)
+                .or_default();
+        }
+
         let advice_anno = anno().into();
         #[cfg(not(feature = "mock-batch-inv"))]
         let val_res = to().into_field().evaluate().assign();
@@ -781,6 +817,7 @@ impl<'a, F: Field> Assignment<F> for MockProver<'a, F> {
         #[cfg(feature = "mock-batch-inv")]
         let assigned = CellValue::from(val_res?);
 
+        #[cfg(feature = "multiphase-mock-prover")]
         if self.in_phase(column.column_type().phase) {
             *self
                 .advice
@@ -789,6 +826,13 @@ impl<'a, F: Field> Assignment<F> for MockProver<'a, F> {
                 .expect("bounds failure") = assigned;
         }
 
+        #[cfg(not(feature = "multiphase-mock-prover"))]
+        *self
+            .advice
+            .get_mut(column.index())
+            .and_then(|v| v.get_mut(row - self.rw_rows.start))
+            .ok_or(Error::BoundsFailure)? = assigned;
+
         #[cfg(feature = "phase-check")]
         // if false && self.current_phase.0 > column.column_type().phase.0 {
         if false {
@@ -822,18 +866,25 @@ impl<'a, F: Field> Assignment<F> for MockProver<'a, F> {
         A: FnOnce() -> AR,
         AR: Into<String>,
     {
-        if !self.in_phase(FirstPhase) {
-            return Ok(());
+        #[cfg(not(feature = "multiphase-mock-prover"))]
+        if !self.usable_rows.contains(&row) {
+            return Err(Error::not_enough_rows_available(self.k));
         }
 
-        assert!(
-            self.usable_rows.contains(&row),
-            "row={}, usable_rows={:?}, k={}",
-            row,
-            self.usable_rows,
-            self.k,
-        );
+        #[cfg(feature = "multiphase-mock-prover")]
+        {
+            if !self.in_phase(FirstPhase) {
+                return Ok(());
+            }
 
+            assert!(
+                self.usable_rows.contains(&row),
+                "row={}, usable_rows={:?}, k={}",
+                row,
+                self.usable_rows,
+                self.k,
+            );
+        }
         if !self.rw_rows.contains(&row) {
             return Err(Error::InvalidRange(
                 row,
@@ -881,18 +932,26 @@ impl<'a, F: Field> Assignment<F> for MockProver<'a, F> {
         right_column: Column<Any>,
         right_row: usize,
     ) -> Result<(), crate::plonk::Error> {
-        if !self.in_phase(FirstPhase) {
-            return Ok(());
+        #[cfg(not(feature = "multiphase-mock-prover"))]
+        if !self.usable_rows.contains(&left_row) || !self.usable_rows.contains(&right_row) {
+            return Err(Error::not_enough_rows_available(self.k));
         }
 
-        assert!(
-            self.usable_rows.contains(&left_row) && self.usable_rows.contains(&right_row),
-            "left_row={}, right_row={}, usable_rows={:?}, k={}",
-            left_row,
-            right_row,
-            self.usable_rows,
-            self.k,
-        );
+        #[cfg(feature = "multiphase-mock-prover")]
+        {
+            if !self.in_phase(FirstPhase) {
+                return Ok(());
+            }
+
+            assert!(
+                self.usable_rows.contains(&left_row) && self.usable_rows.contains(&right_row),
+                "left_row={}, right_row={}, usable_rows={:?}, k={}",
+                left_row,
+                right_row,
+                self.usable_rows,
+                self.k,
+            );
+        }
 
         match self.permutation.as_mut() {
             Some(permutation) => permutation.copy(left_column, left_row, right_column, right_row),
@@ -921,17 +980,24 @@ impl<'a, F: Field> Assignment<F> for MockProver<'a, F> {
         from_row: usize,
         to: circuit::Value<Assigned<F>>,
     ) -> Result<(), Error> {
-        if !self.in_phase(FirstPhase) {
-            return Ok(());
+        #[cfg(not(feature = "multiphase-mock-prover"))]
+        if !self.usable_rows.contains(&from_row) {
+            return Err(Error::not_enough_rows_available(self.k));
         }
+        #[cfg(feature = "multiphase-mock-prover")]
+        {
+            if !self.in_phase(FirstPhase) {
+                return Ok(());
+            }
 
-        assert!(
-            self.usable_rows.contains(&from_row),
-            "row={}, usable_rows={:?}, k={}",
-            from_row,
-            self.usable_rows,
-            self.k,
-        );
+            assert!(
+                self.usable_rows.contains(&from_row),
+                "row={}, usable_rows={:?}, k={}",
+                from_row,
+                self.usable_rows,
+                self.k,
+            );
+        }
 
         for row in self.usable_rows.clone().skip(from_row) {
             self.assign_fixed(|| "", col, row, || to)?;
@@ -1045,10 +1111,10 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
             .collect()
         };
 
-        // #[cfg(feature = "phase-check")]
-        // let current_phase = FirstPhase.to_sealed();
-        // #[cfg(not(feature = "phase-check"))]
-        // let current_phase = crate::plonk::sealed::Phase(cs.max_phase());
+        #[cfg(feature = "phase-check")]
+        let current_phase = FirstPhase.to_sealed();
+        #[cfg(not(feature = "phase-check"))]
+        let current_phase = crate::plonk::sealed::Phase(cs.max_phase());
 
         let mut prover = MockProver {
             k,
@@ -1068,7 +1134,7 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
             permutation: Some(permutation),
             rw_rows: 0..usable_rows,
             usable_rows: 0..usable_rows,
-            current_phase: FirstPhase.to_sealed(),
+            current_phase,
         };
 
         #[cfg(feature = "phase-check")]
@@ -1127,6 +1193,8 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
         #[cfg(not(feature = "phase-check"))]
         {
             let syn_time = Instant::now();
+
+            #[cfg(feature = "multiphase-mock-prover")]
             for current_phase in prover.cs.phases() {
                 prover.current_phase = current_phase;
                 ConcreteCircuit::FloorPlanner::synthesize(
@@ -1136,6 +1204,9 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
                     constants.clone(),
                 )?;
             }
+
+            #[cfg(not(feature = "multiphase-mock-prover"))]
+            ConcreteCircuit::FloorPlanner::synthesize(&mut prover, circuit, config, constants)?;
             log::info!("MockProver synthesize took {:?}", syn_time.elapsed());
         }
 
diff --git a/halo2_proofs/src/helpers.rs b/halo2_proofs/src/helpers.rs
index ff814d495b..0c93fa0204 100644
--- a/halo2_proofs/src/helpers.rs
+++ b/halo2_proofs/src/helpers.rs
@@ -1,6 +1,6 @@
 use crate::plonk::{Any, Column};
 use crate::poly::Polynomial;
-use ff::{Field, FromUniformBytes, PrimeField};
+use ff::{FromUniformBytes, PrimeField};
 use halo2curves::{serde::SerdeObject, CurveAffine};
 use num_bigint::BigUint;
 use std::io;
@@ -88,6 +88,7 @@ macro_rules! two_dim_vec_to_vec_of_slice {
 #[cfg(test)]
 mod test {
     use super::*;
+    use ff::Field;
     use halo2curves::bn256::{Fq, G1Affine};
     use rand_core::OsRng;
     #[test]
diff --git a/halo2_proofs/src/lib.rs b/halo2_proofs/src/lib.rs
index daaa562341..f79ce2c8dd 100644
--- a/halo2_proofs/src/lib.rs
+++ b/halo2_proofs/src/lib.rs
@@ -5,6 +5,7 @@
 #![allow(clippy::op_ref, clippy::many_single_char_names)]
 #![deny(rustdoc::broken_intra_doc_links)]
 #![deny(missing_debug_implementations)]
+#![feature(stmt_expr_attributes)]
 // #![deny(missing_docs)]
 // #![deny(unsafe_code)]
 
diff --git a/rust-toolchain b/rust-toolchain
index b6148bc0a7..ee2d639b86 100644
--- a/rust-toolchain
+++ b/rust-toolchain
@@ -1 +1 @@
-1.66.0
+nightly-2023-08-12
\ No newline at end of file

From b837de6e7e31db9b23ca58c925ead1afd229c5d3 Mon Sep 17 00:00:00 2001
From: Zhang Zhuo <mycinbrin@gmail.com>
Date: Tue, 9 Jan 2024 16:26:00 +0800
Subject: [PATCH 30/30] Sync halo2 lib 0.4.0 merging (#81)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* Use thread pool for assign_regions (#57)

* feat: use rayon threadpool

* feat: add UT for many subregions

* refact: move common struct out to module level

* refact: reuse common configure code

* fix ci errors

---------

Co-authored-by: kunxian xia <xiakunxian130@gmail.com>

* Move `env_logger` dependency to dev-depdendencies (only for test). (#69)

* sync ff/group 0.13

* fix clippy

* fix clippy

* fmg

* [FEAT] Upgrading table16 for SHA256 (#73)

* upgrade sha256

* fix clippy

* Bus auto (#72)

* bus: expose global offset of regions

* bus-auto: add query_advice and query_fixed function in witness generation

* bus-auto: fix clippy

---------

Co-authored-by: Aurélien Nicolas <info@nau.re>

* fix-tob-scroll-21 (#59)

* fix-tob-scroll-21

* expose param field for re-randomization

* enable accessing for table16 (#75)

* chore: update poseidon link

* merge sha256 gadget changes

* Fix the CI errors (#78)

* cargo fmt

* fix clippy error

* Feat: switch to logup scheme for lookup argument  (#71)

* Multi-input mv-lookup. (#49)

* Add mv_lookup.rs

* mv_lookup::prover, mv_lookup::verifier

* Replace lookup with mv_lookup

* replace halo2 with mv lookup

Co-authored-by: ying tong <therealyingtong@users.noreply.github.com>

* cleanups

Co-authored-by: ying tong <therealyingtong@users.noreply.github.com>

* ConstraintSystem: setup lookup_tracker

Co-authored-by: Andrija <akinovak@gmail.com>

* mv_lookup::hybrid_prover

Co-authored-by: Andrija <akinovak@gmail.com>

* WIP

* mv_multi_lookup: enable lookup caching

Co-authored-by: therealyingtong <yingtong.lai@gmail.com>

* Rename hybrid_lookup -> lookup

* Chunk lookups using user-provided minimum degree

Co-authored-by: Andrija <akinovak@gmail.com>

* mv_lookup bench

Co-authored-by: Andrija <akinovak@gmail.com>

* Introduce counter feature for FFTs and MSMs

Co-authored-by: Andrija <akinovak@gmail.com>

* Fix off-by-one errors in chunk_lookup

Co-authored-by: Andrija <akinovak@gmail.com>

* bench wip

* time evaluate_h

* KZG

* more efficient batch inversion

* extended lookup example

* Finalize mv lookup

Author: therealyingtong <yingtong.lai@gmail.com>

* Remove main/

* Fix according to the comments

* replace scan with parallel grand sum computation

* Revert Cargo.lock

* mv lookup Argument name

* parallel batch invert

---------

Co-authored-by: Andrija <akinovak@gmail.com>
Co-authored-by: ying tong <therealyingtong@users.noreply.github.com>
Co-authored-by: therealyingtong <yingtong.lai@gmail.com>

* fmt

* fix unit test

* fix clippy errors

* add todo in mv_lookup's prover

* fmt and clippy

* fix clippy

* add detailed running time of steps in logup's prover

* fmt

* add more log hooks

* more running time logs

* use par invert

* use sorted-vector to store how many times a table element occurs in input

* par the process to get inputs_inv_sum

* use par

* fix par

* add feature to skip inv sums

* add new feature flag

* fix clippy error

---------

Co-authored-by: Sphere L <sph6r6.l1u@gmail.com>
Co-authored-by: Andrija <akinovak@gmail.com>
Co-authored-by: ying tong <therealyingtong@users.noreply.github.com>
Co-authored-by: therealyingtong <yingtong.lai@gmail.com>

* fix some simple building errs

* upgrade pathfinder_simd to newer version as it can't compile on mac m1 pro

* resolve merge conflict

* fmt

* clippy

* more clippy fix

* more lint fix

* fmt

* minor syntax fix

* fix ipa multiopen test failure

* fix clippy warning

* fmt

* fix par scan of log_inv diff

* remove uncessary clone

---------

Co-authored-by: alannotnerd <alan1995wang@outlook.com>
Co-authored-by: kunxian xia <xiakunxian130@gmail.com>
Co-authored-by: Steven <asongala@163.com>
Co-authored-by: Carlos Pérez <37264926+CPerezz@users.noreply.github.com>
Co-authored-by: zhenfei <zhenfei.zhang@hotmail.com>
Co-authored-by: Ho <noel.wei@gmail.com>
Co-authored-by: naure <naure@users.noreply.github.com>
Co-authored-by: Aurélien Nicolas <info@nau.re>
Co-authored-by: Sphere L <sph6r6.l1u@gmail.com>
Co-authored-by: Andrija <akinovak@gmail.com>
Co-authored-by: ying tong <therealyingtong@users.noreply.github.com>
Co-authored-by: therealyingtong <yingtong.lai@gmail.com>
---
 .gitignore                                    |   2 +-
 Cargo.lock                                    | 910 +++++++++---------
 halo2_gadgets/benches/sha256.rs               |   7 +-
 halo2_gadgets/src/ecc/chip/mul.rs             |   6 +-
 halo2_gadgets/src/sha256.rs                   |   5 +-
 halo2_gadgets/src/sha256/table16.rs           | 187 +++-
 .../src/sha256/table16/compression.rs         | 346 ++++---
 .../table16/compression/compression_gates.rs  |  37 +-
 .../table16/compression/compression_util.rs   | 224 ++---
 .../table16/compression/subregion_digest.rs   | 254 +++--
 .../table16/compression/subregion_initial.rs  |  74 +-
 .../table16/compression/subregion_main.rs     |  33 +-
 .../src/sha256/table16/message_schedule.rs    |  44 +-
 .../table16/message_schedule/schedule_util.rs |  38 +-
 .../table16/message_schedule/subregion1.rs    |  75 +-
 .../table16/message_schedule/subregion2.rs    | 281 +++---
 .../table16/message_schedule/subregion3.rs    |  63 +-
 .../src/sha256/table16/spread_table.rs        |  40 +-
 halo2_gadgets/src/utilities.rs                |   2 +-
 halo2_proofs/Cargo.toml                       |  17 +-
 halo2_proofs/benches/lookups.rs               | 240 +++++
 halo2_proofs/src/arithmetic.rs                |  54 +-
 halo2_proofs/src/circuit.rs                   |  15 +
 .../src/circuit/floor_planner/single_pass.rs  |  75 +-
 halo2_proofs/src/circuit/floor_planner/v1.rs  |  19 +-
 halo2_proofs/src/circuit/layouter.rs          |  21 +
 halo2_proofs/src/dev.rs                       | 249 +++--
 halo2_proofs/src/dev/cost.rs                  |   8 +
 halo2_proofs/src/dev/failure.rs               | 151 +--
 halo2_proofs/src/dev/graph.rs                 |   8 +
 halo2_proofs/src/dev/tfp.rs                   |  20 +
 halo2_proofs/src/helpers.rs                   |   4 +
 halo2_proofs/src/lib.rs                       |  20 +
 halo2_proofs/src/plonk.rs                     |   7 +-
 halo2_proofs/src/plonk/circuit.rs             | 198 +++-
 .../src/plonk/circuit/compress_selectors.rs   |   2 +-
 halo2_proofs/src/plonk/evaluation.rs          | 268 ++++--
 halo2_proofs/src/plonk/keygen.rs              |  28 +-
 halo2_proofs/src/plonk/mv_lookup.rs           |  93 ++
 .../src/plonk/mv_lookup/exec_info.json        |  46 +
 halo2_proofs/src/plonk/mv_lookup/prover.rs    | 509 ++++++++++
 halo2_proofs/src/plonk/mv_lookup/verifier.rs  | 189 ++++
 halo2_proofs/src/plonk/permutation/keygen.rs  |   2 +-
 halo2_proofs/src/plonk/prover.rs              |  64 +-
 halo2_proofs/src/plonk/vanishing/prover.rs    |   2 +-
 halo2_proofs/src/plonk/verifier.rs            |   7 +-
 halo2_proofs/src/poly.rs                      |   2 +-
 halo2_proofs/src/poly/domain.rs               |   8 +-
 halo2_proofs/src/poly/evaluator.rs            | 699 ++++++++++++++
 halo2_proofs/src/poly/ipa/commitment.rs       |   2 +-
 .../src/poly/kzg/multiopen/gwc/verifier.rs    |   2 +-
 .../src/poly/kzg/multiopen/shplonk.rs         |   7 +-
 halo2_proofs/src/transcript/poseidon.rs       |   1 -
 halo2_proofs/tests/plonk_api.rs               | 876 +++++++++++------
 54 files changed, 4684 insertions(+), 1857 deletions(-)
 create mode 100644 halo2_proofs/benches/lookups.rs
 create mode 100644 halo2_proofs/src/plonk/mv_lookup.rs
 create mode 100644 halo2_proofs/src/plonk/mv_lookup/exec_info.json
 create mode 100644 halo2_proofs/src/plonk/mv_lookup/prover.rs
 create mode 100644 halo2_proofs/src/plonk/mv_lookup/verifier.rs
 create mode 100644 halo2_proofs/src/poly/evaluator.rs

diff --git a/.gitignore b/.gitignore
index 317814d1e4..cd5bdf5ef1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,4 +2,4 @@
 **/*.rs.bk
 .vscode
 **/*.html
-.DS_Store
+.DS_Store
\ No newline at end of file
diff --git a/Cargo.lock b/Cargo.lock
index 44a2d379b5..a25d8cd0f4 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4,9 +4,9 @@ version = 3
 
 [[package]]
 name = "addr2line"
-version = "0.21.0"
+version = "0.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a30b2e23b9e17a9f90641c7ab1549cd9b44f296d3ccbf309d2863cfe398a0cb"
+checksum = "b9ecd88a8c8378ca913a680cd98f0f13ac67383d35993f86c90a70e3f137816b"
 dependencies = [
  "gimli",
 ]
@@ -17,13 +17,18 @@ version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
 
+[[package]]
+name = "adler32"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aae1277d39aeec15cb388266ecc24b11c80469deae6067e17a1a7aa9e5c1f234"
+
 [[package]]
 name = "ahash"
-version = "0.8.3"
+version = "0.7.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c99f64d1e06488f620f932677e24bc6e2897582980441ae90a671415bd7ec2f"
+checksum = "fcb51a0695d8f838b1ee009b3fbf66bda078cd64590202a864a8f3e8c4315c47"
 dependencies = [
- "cfg-if 1.0.0",
  "getrandom",
  "once_cell",
  "version_check",
@@ -31,18 +36,18 @@ dependencies = [
 
 [[package]]
 name = "aho-corasick"
-version = "1.1.2"
+version = "0.7.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2969dcb958b36655471fc61f7e416fa76033bdd4bfed0678d8fee1e2d07a1f0"
+checksum = "1e37cfd5e7657ada45f742d6e99ca5788580b5c529dc78faf11ece6dc702656f"
 dependencies = [
  "memchr",
 ]
 
 [[package]]
 name = "anyhow"
-version = "1.0.75"
+version = "1.0.56"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4668cab20f66d8d020e1fbc0ebe47217433c1b6c8f2040faf858554e394ace6"
+checksum = "4361135be9122e0870de935d7c439aef945b9f9ddd4199a553b5270b49c82a27"
 
 [[package]]
 name = "ark-std"
@@ -57,15 +62,24 @@ dependencies = [
 
 [[package]]
 name = "arrayref"
-version = "0.3.7"
+version = "0.3.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b4930d2cb77ce62f89ee5d5289b4ac049559b1c45539271f5ed4fdc7db34545"
+checksum = "a4c527152e37cf757a3f78aae5a06fbeefdb07ccc535c980a3208ee3060dd544"
 
 [[package]]
 name = "arrayvec"
-version = "0.7.4"
+version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96d30a06541fbafbc7f82ed10c06164cfbd2c401138f6addd8404629c4b16711"
+checksum = "cd9fd44efafa8690358b7408d253adf110036b88f55672a933f01d616ad9b1b9"
+dependencies = [
+ "nodrop",
+]
+
+[[package]]
+name = "arrayvec"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8da52d66c7071e2e3fa2a1e5c6d088fec47b593032b254f5e980de8ea54454d6"
 
 [[package]]
 name = "assert_matches"
@@ -79,7 +93,7 @@ version = "0.2.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
 dependencies = [
- "hermit-abi 0.1.19",
+ "hermit-abi",
  "libc",
  "winapi",
 ]
@@ -92,24 +106,24 @@ checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
 
 [[package]]
 name = "backtrace"
-version = "0.3.69"
+version = "0.3.64"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2089b7e3f35b9dd2d0ed921ead4f6d318c27680d4a5bd167b3ee120edb105837"
+checksum = "5e121dee8023ce33ab248d9ce1493df03c3b38a659b240096fcbd7048ff9c31f"
 dependencies = [
  "addr2line",
  "cc",
  "cfg-if 1.0.0",
  "libc",
- "miniz_oxide",
+ "miniz_oxide 0.4.4",
  "object",
  "rustc-demangle",
 ]
 
 [[package]]
 name = "bit-set"
-version = "0.5.3"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0700ddab506f33b20a03b13996eccd309a48e5ff77d0d95926aa0210fb4e95f1"
+checksum = "6e11e16035ea35e4e5997b393eacbf6f63983188f7a2ad25bfb13465f5ad59de"
 dependencies = [
  "bit-vec",
 ]
@@ -126,12 +140,6 @@ version = "1.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
-[[package]]
-name = "bitflags"
-version = "2.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "327762f6e5a765692301e5bb513e0d9fef63be86bbc14528052b1cd3e6f03e07"
-
 [[package]]
 name = "bitvec"
 version = "1.0.1"
@@ -146,12 +154,12 @@ dependencies = [
 
 [[package]]
 name = "blake2b_simd"
-version = "1.0.2"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23285ad32269793932e830392f2fe2f83e26488fd3ec778883a93c8323735780"
+checksum = "72936ee4afc7f8f736d1c38383b56480b5497b4617b4a77bdbf1d2ababc76127"
 dependencies = [
  "arrayref",
- "arrayvec",
+ "arrayvec 0.7.2",
  "constant_time_eq",
 ]
 
@@ -171,38 +179,50 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8d696c370c750c948ada61c69a0ee2cbbb9c50b1019ddb86d9317157a99c2cae"
 
+[[package]]
+name = "bstr"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba3569f383e8f1598449f1a423e72e99569137b47740b1da11ef19af3d5c3223"
+dependencies = [
+ "lazy_static",
+ "memchr",
+ "regex-automata",
+ "serde",
+]
+
 [[package]]
 name = "bumpalo"
-version = "3.14.0"
+version = "3.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f30e7476521f6f8af1a1c4c0b8cc94f0bee37d91763d0ca2665f299b6cd8aec"
+checksum = "8f1e260c3a9040a7c19a12468758f4c16f31a81a1fe087482be9570ec864bb6c"
 
 [[package]]
 name = "bytemuck"
-version = "1.14.0"
+version = "1.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "374d28ec25809ee0e23827c2ab573d729e293f281dfe393500e7ad618baa61c6"
+checksum = "cdead85bdec19c194affaeeb670c0e41fe23de31459efd1c174d049269cf02cc"
 
 [[package]]
 name = "byteorder"
-version = "1.5.0"
+version = "1.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+checksum = "14c189c53d098945499cdfa7ecc63567cf3886b3332b312a5b4585d8d3a6a610"
 
 [[package]]
 name = "cast"
-version = "0.3.0"
+version = "0.2.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37b2a672a2cb129a2e41c10b1224bb368f9f37a2b16b612598138befd7b37eb5"
+checksum = "4c24dab4283a142afa2fdca129b80ad2c6284e073930f964c3a1293c225ee39a"
+dependencies = [
+ "rustc_version",
+]
 
 [[package]]
 name = "cc"
-version = "1.0.83"
+version = "1.0.73"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1174fb0b6ec23863f8b971027804a42614e347eafb0a95bf0b12cdae21fc4d0"
-dependencies = [
- "libc",
-]
+checksum = "2fff2a6927b3bb87f9595d67196a70493f627687a71d87a0d692242c33f58c11"
 
 [[package]]
 name = "cfg-if"
@@ -222,16 +242,16 @@ version = "2.34.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a0610544180c38b88101fecf2dd634b174a62eef6946f84dfc6a7127512b381c"
 dependencies = [
- "bitflags 1.3.2",
+ "bitflags",
  "textwrap",
  "unicode-width",
 ]
 
 [[package]]
 name = "cmake"
-version = "0.1.50"
+version = "0.1.48"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a31c789563b815f77f4250caee12365734369f942439b7defd71e18a48197130"
+checksum = "e8ad8cef104ac57b68b89df3208164d228503abbdce70f6880ffa3d970e7443a"
 dependencies = [
  "cc",
 ]
@@ -244,26 +264,20 @@ checksum = "3d7b894f5411737b7867f4827955924d7c254fc9f4d91a6aad6b097804b1018b"
 
 [[package]]
 name = "colored"
-version = "2.0.4"
+version = "2.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2674ec482fbc38012cf31e6c42ba0177b431a0cb6f15fe40efa5aab1bda516f6"
+checksum = "b3616f750b84d8f0de8a58bda93e08e2a81ad3f523089b05f1dffecab48c6cbd"
 dependencies = [
- "is-terminal",
+ "atty",
  "lazy_static",
- "windows-sys",
+ "winapi",
 ]
 
-[[package]]
-name = "const-cstr"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed3d0b5ff30645a68f35ece8cea4556ca14ef8a1651455f789a099a0513532a6"
-
 [[package]]
 name = "constant_time_eq"
-version = "0.3.0"
+version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f7144d30dcf0fafbce74250a3963025d8d52177934239851c917d29f1df280c2"
+checksum = "245097e9a4535ee1e3e3931fcfcd55a796a44c643e8596ff6566d68f09b87bbc"
 
 [[package]]
 name = "core-foundation"
@@ -277,9 +291,9 @@ dependencies = [
 
 [[package]]
 name = "core-foundation-sys"
-version = "0.8.4"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e496a50fda8aacccc86d7529e2c1e0892dbd0f898a6b5645b5561b89c3210efa"
+checksum = "5827cebf4670468b8772dd191856768aedcb1b0278a04f989f7766351917b9dc"
 
 [[package]]
 name = "core-graphics"
@@ -287,7 +301,7 @@ version = "0.22.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2581bbab3b8ffc6fcbd550bf46c355135d16e9ff2a6ea032ad6b9bf1d7efe4fb"
 dependencies = [
- "bitflags 1.3.2",
+ "bitflags",
  "core-foundation",
  "core-graphics-types",
  "foreign-types",
@@ -296,12 +310,13 @@ dependencies = [
 
 [[package]]
 name = "core-graphics-types"
-version = "0.1.2"
+version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2bb142d41022986c1d8ff29103a1411c8a3dfad3552f87a4f8dc50d61d4f4e33"
+checksum = "3a68b68b3446082644c91ac778bf50cd4104bfb002b5a6a7c44cca5a2c70788b"
 dependencies = [
- "bitflags 1.3.2",
+ "bitflags",
  "core-foundation",
+ "foreign-types",
  "libc",
 ]
 
@@ -328,9 +343,9 @@ dependencies = [
 
 [[package]]
 name = "cpufeatures"
-version = "0.2.9"
+version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a17b76ff3a4162b0b27f354a0c87015ddad39d35f9c0c36607a3bdd175dde1f1"
+checksum = "28d997bd5e24a5928dd43e46dc529867e207907fe0b239c3477d924f7f2ca320"
 dependencies = [
  "libc",
 ]
@@ -346,9 +361,9 @@ dependencies = [
 
 [[package]]
 name = "criterion"
-version = "0.3.6"
+version = "0.3.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b01d6de93b2b6c65e17c634a26653a29d107b3c98c607c765bf38d041531cd8f"
+checksum = "1604dafd25fba2fe2d5895a9da139f8dc9b319a5fe5354ca137cbbce4e178d10"
 dependencies = [
  "atty",
  "cast",
@@ -372,9 +387,9 @@ dependencies = [
 
 [[package]]
 name = "criterion-plot"
-version = "0.4.5"
+version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2673cc8207403546f45f5fd319a974b1e6983ad1a3ee7e6041650013be041876"
+checksum = "d00996de9f2f7559f7f4dc286073197f83e92256a59ed395f9aac01fe717da57"
 dependencies = [
  "cast",
  "itertools",
@@ -396,9 +411,9 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-channel"
-version = "0.5.8"
+version = "0.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a33c2bf77f2df06183c3aa30d1e96c0695a313d4f9c453cc3762a6db39f99200"
+checksum = "5aaa7bd5fb665c6864b5f963dd9097905c54125909c7aa94c9e18507cdbe6c53"
 dependencies = [
  "cfg-if 1.0.0",
  "crossbeam-utils",
@@ -406,9 +421,9 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-deque"
-version = "0.8.3"
+version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce6fd6f855243022dcecf8702fef0c297d4338e226845fe067f6341ad9fa0cef"
+checksum = "6455c0ca19f0d2fbf751b908d5c55c1f5cbc65e03c4225427254b46890bdde1e"
 dependencies = [
  "cfg-if 1.0.0",
  "crossbeam-epoch",
@@ -417,14 +432,15 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-epoch"
-version = "0.9.15"
+version = "0.9.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae211234986c545741a7dc064309f67ee1e5ad243d0e48335adc0484d960bcc7"
+checksum = "1145cf131a2c6ba0615079ab6a638f7e1973ac9c2634fcbeaaad6114246efe8c"
 dependencies = [
  "autocfg",
  "cfg-if 1.0.0",
  "crossbeam-utils",
- "memoffset 0.9.0",
+ "lazy_static",
+ "memoffset",
  "scopeguard",
 ]
 
@@ -440,11 +456,12 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-utils"
-version = "0.8.16"
+version = "0.8.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a22b2d63d4d1dc0b7f1b6b2747dd0088008a9be28b6ddf0b1e7d335e3037294"
+checksum = "0bf124c720b7686e3c2663cf54062ab0f68a88af2fb6a030e87e30bf721fcb38"
 dependencies = [
  "cfg-if 1.0.0",
+ "lazy_static",
 ]
 
 [[package]]
@@ -455,21 +472,22 @@ checksum = "7a81dae078cea95a014a339291cec439d2f232ebe854a9d672b796c6afafa9b7"
 
 [[package]]
 name = "csv"
-version = "1.3.0"
+version = "1.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac574ff4d437a7b5ad237ef331c17ccca63c46479e5b5453eb8e10bb99a759fe"
+checksum = "22813a6dc45b335f9bade10bf7271dc477e81113e89eb251a0bc2a8a81c536e1"
 dependencies = [
+ "bstr",
  "csv-core",
- "itoa",
+ "itoa 0.4.8",
  "ryu",
  "serde",
 ]
 
 [[package]]
 name = "csv-core"
-version = "0.1.11"
+version = "0.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5efa2b3d7902f4b634a20cae3c9c4e6209dc4779feb6863329607560143efa70"
+checksum = "2b2466559f260f48ad25fe6317b3c8dac77b5bdb5763ac7d9d6103530663bc90"
 dependencies = [
  "memchr",
 ]
@@ -495,7 +513,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "strsim",
- "syn 1.0.109",
+ "syn",
 ]
 
 [[package]]
@@ -506,7 +524,7 @@ checksum = "d9b5a2f4ac4969822c62224815d069952656cadc7084fdca9751e6d959189b72"
 dependencies = [
  "darling_core",
  "quote",
- "syn 1.0.109",
+ "syn",
 ]
 
 [[package]]
@@ -518,6 +536,16 @@ dependencies = [
  "uuid",
 ]
 
+[[package]]
+name = "deflate"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73770f8e1fe7d64df17ca66ad28994a0a623ea497fa69486e14984e715c5d174"
+dependencies = [
+ "adler32",
+ "byteorder",
+]
+
 [[package]]
 name = "derive_builder"
 version = "0.9.0"
@@ -528,7 +556,7 @@ dependencies = [
  "derive_builder_core",
  "proc-macro2",
  "quote",
- "syn 1.0.109",
+ "syn",
 ]
 
 [[package]]
@@ -540,7 +568,7 @@ dependencies = [
  "darling",
  "proc-macro2",
  "quote",
- "syn 1.0.109",
+ "syn",
 ]
 
 [[package]]
@@ -573,15 +601,6 @@ dependencies = [
  "winapi",
 ]
 
-[[package]]
-name = "dlib"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "330c60081dcc4c72131f8eb70510f1ac07223e5d4163db481a04a0befcffa412"
-dependencies = [
- "libloading",
-]
-
 [[package]]
 name = "dwrote"
 version = "0.11.0"
@@ -596,9 +615,9 @@ dependencies = [
 
 [[package]]
 name = "either"
-version = "1.9.0"
+version = "1.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a26ae43d7bcc3b814de94796a5e736d4029efb0ee900c12e2d54c993ad1a1e07"
+checksum = "e78d4f1cc4ae33bbfc157ed5d5a5ef3bc29227303d595861deb238fcec4e9457"
 
 [[package]]
 name = "env_logger"
@@ -614,34 +633,22 @@ dependencies = [
 ]
 
 [[package]]
-name = "equivalent"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"
-
-[[package]]
-name = "errno"
-version = "0.3.5"
+name = "expat-sys"
+version = "2.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac3e13f66a2f95e32a39eaa81f6b95d42878ca0e1db0c7543723dfe12557e860"
+checksum = "658f19728920138342f68408b7cf7644d90d4784353d8ebc32e7e8663dbe45fa"
 dependencies = [
- "libc",
- "windows-sys",
+ "cmake",
+ "pkg-config",
 ]
 
 [[package]]
 name = "fastrand"
-version = "2.0.1"
+version = "1.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25cbce373ec4653f1a01a31e8a5e5ec0c622dc27ff9c4e6606eefef5cbbed4a5"
-
-[[package]]
-name = "fdeflate"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d329bdeac514ee06249dabc27877490f17f5d371ec693360768b838e19f3ae10"
+checksum = "c3fcf0cee53519c866c09b5de1f6c56ff9d647101f81c1964fa632e148896cdf"
 dependencies = [
- "simd-adler32",
+ "instant",
 ]
 
 [[package]]
@@ -667,16 +674,6 @@ dependencies = [
  "winapi",
 ]
 
-[[package]]
-name = "flate2"
-version = "1.0.28"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46303f565772937ffe1d394a4fac6f411c6013172fadde9dcdb1e147a086940e"
-dependencies = [
- "crc32fast",
- "miniz_oxide",
-]
-
 [[package]]
 name = "float-ord"
 version = "0.2.0"
@@ -691,11 +688,11 @@ checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
 
 [[package]]
 name = "font-kit"
-version = "0.11.0"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "21fe28504d371085fae9ac7a3450f0b289ab71e07c8e57baa3fb68b9e57d6ce5"
+checksum = "46c9a156ec38864999bc9c4156e5f3b50224d4a5578028a64e5a3875caa9ee28"
 dependencies = [
- "bitflags 1.3.2",
+ "bitflags",
  "byteorder",
  "core-foundation",
  "core-graphics",
@@ -709,9 +706,9 @@ dependencies = [
  "log",
  "pathfinder_geometry",
  "pathfinder_simd",
+ "servo-fontconfig",
  "walkdir",
  "winapi",
- "yeslogic-fontconfig-sys",
 ]
 
 [[package]]
@@ -758,9 +755,9 @@ checksum = "e6d5a32815ae3f33302d95fdcb2ce17862f8c65363dcfd29360480ba1001fc9c"
 
 [[package]]
 name = "generic-array"
-version = "0.14.7"
+version = "0.14.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+checksum = "bff49e947297f3312447abdca79f45f4738097cc82b06e72054d2223f601f1b9"
 dependencies = [
  "typenum",
  "version_check",
@@ -768,9 +765,9 @@ dependencies = [
 
 [[package]]
 name = "getrandom"
-version = "0.2.10"
+version = "0.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be4136b2a15dd319360be1c07d9933517ccf0be8f16bf62a3bee4f0d618df427"
+checksum = "9be70c98951c83b8d2f8f60d7065fa6d5146873094452a1008da8c2f1e4205ad"
 dependencies = [
  "cfg-if 1.0.0",
  "js-sys",
@@ -781,9 +778,9 @@ dependencies = [
 
 [[package]]
 name = "gimli"
-version = "0.28.0"
+version = "0.26.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6fb8d784f27acf97159b40fc4db5ecd8aa23b9ad5ef69cdd136d3bc80665f0c0"
+checksum = "78cc372d058dcf6d5ecd98510e7fbc9e5aec4d21de70f65fea8fecebcd881bd4"
 
 [[package]]
 name = "group"
@@ -813,7 +810,7 @@ checksum = "729f9bd3449d77e7831a18abfb7ba2f99ee813dfd15b8c2167c9a54ba20aa99d"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 1.0.109",
+ "syn",
 ]
 
 [[package]]
@@ -833,7 +830,7 @@ dependencies = [
 name = "halo2_gadgets"
 version = "0.2.0"
 dependencies = [
- "arrayvec",
+ "arrayvec 0.7.2",
  "bitvec",
  "criterion",
  "ff",
@@ -873,6 +870,7 @@ dependencies = [
  "gumdrop",
  "halo2_legacy_pdqsort",
  "halo2curves",
+ "lazy_static",
  "log",
  "maybe-rayon",
  "num-bigint",
@@ -882,6 +880,7 @@ dependencies = [
  "proptest",
  "rand_chacha",
  "rand_core",
+ "rayon",
  "sha3",
  "subtle",
  "tabbycat",
@@ -904,15 +903,17 @@ dependencies = [
  "paste",
  "rand",
  "rand_core",
+ "serde",
+ "serde_arrays",
  "static_assertions",
  "subtle",
 ]
 
 [[package]]
 name = "hashbrown"
-version = "0.14.1"
+version = "0.11.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7dfda62a12f55daeae5015f81b0baea145391cb4520f86c248fc615d72640d12"
+checksum = "ab5ef0d4909ef3724cc8cce6ccc8572c5c817592e9285f5464f8e86f8bd3726e"
 
 [[package]]
 name = "hermit-abi"
@@ -923,12 +924,6 @@ dependencies = [
  "libc",
 ]
 
-[[package]]
-name = "hermit-abi"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d77f7ec81a6d05a3abb01ab6eb7590f6083d08449fe5a1c8b1e620283546ccb7"
-
 [[package]]
 name = "hex"
 version = "0.4.3"
@@ -949,14 +944,15 @@ checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
 
 [[package]]
 name = "image"
-version = "0.24.7"
+version = "0.23.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f3dfdbdd72063086ff443e297b61695500514b1e41095b6fb9a5ab48a70a711"
+checksum = "24ffcb7e7244a9bf19d35bf2883b9c080c4ced3c07a9895572178cdb8f13f6a1"
 dependencies = [
  "bytemuck",
  "byteorder",
  "color_quant",
  "jpeg-decoder",
+ "num-iter",
  "num-rational",
  "num-traits",
  "png",
@@ -964,24 +960,24 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.0.2"
+version = "1.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8adf3ddd720272c6ea8bf59463c04e0f93d0bbf7c5439b691bca2987e0270897"
+checksum = "0f647032dfaa1f8b6dc29bd3edb7bbef4861b8b8007ebb118d6db284fd59f6ee"
 dependencies = [
- "equivalent",
+ "autocfg",
  "hashbrown",
 ]
 
 [[package]]
 name = "inferno"
-version = "0.11.17"
+version = "0.11.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c50453ec3a6555fad17b1cd1a80d16af5bc7cb35094f64e429fd46549018c6a3"
+checksum = "9709543bd6c25fdc748da2bed0f6855b07b7e93a203ae31332ac2101ab2f4782"
 dependencies = [
  "ahash",
+ "atty",
  "indexmap",
- "is-terminal",
- "itoa",
+ "itoa 1.0.1",
  "log",
  "num-format",
  "once_cell",
@@ -991,14 +987,12 @@ dependencies = [
 ]
 
 [[package]]
-name = "is-terminal"
-version = "0.4.9"
+name = "instant"
+version = "0.1.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb0889898416213fab133e1d33a0e5858a48177452750691bde3666d0fdbaf8b"
+checksum = "7a5bbe824c507c5da5956355e86a746d82e0e1464f65d862cc5e71da70e94b2c"
 dependencies = [
- "hermit-abi 0.3.3",
- "rustix",
- "windows-sys",
+ "cfg-if 1.0.0",
 ]
 
 [[package]]
@@ -1012,30 +1006,36 @@ dependencies = [
 
 [[package]]
 name = "itoa"
-version = "1.0.9"
+version = "0.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b71991ff56294aa922b450139ee08b3bfc70982c6b2c7562771375cf73542dd4"
+
+[[package]]
+name = "itoa"
+version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af150ab688ff2122fcef229be89cb50dd66af9e01a4ff320cc137eecc9bacc38"
+checksum = "1aab8fc367588b89dcee83ab0fd66b72b50b72fa1904d7095045ace2b0c81c35"
 
 [[package]]
 name = "jpeg-decoder"
-version = "0.3.0"
+version = "0.1.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc0000e42512c92e31c2252315bda326620a4e034105e900c98ec492fa077b3e"
+checksum = "229d53d58899083193af11e15917b5640cd40b29ff475a1fe4ef725deb02d0f2"
 
 [[package]]
 name = "js-sys"
-version = "0.3.64"
+version = "0.3.57"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c5f195fe497f702db0f318b07fdd68edb16955aed830df8363d837542f8f935a"
+checksum = "671a26f820db17c2a2750743f1dd03bafd15b98c9f30c7c2628c024c05d73397"
 dependencies = [
  "wasm-bindgen",
 ]
 
 [[package]]
 name = "keccak"
-version = "0.1.4"
+version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f6d5ed8676d904364de097082f4e7d240b571b67989ced0240f08b7f966f940"
+checksum = "3afef3b6eff9ce9d8ff9b3601125eec7f0c8cbac7abd14f355d053fa56c98768"
 dependencies = [
  "cpufeatures",
 ]
@@ -1051,37 +1051,15 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.149"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a08173bc88b7955d1b3145aa561539096c421ac8debde8cbc3612ec635fee29b"
-
-[[package]]
-name = "libloading"
-version = "0.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c571b676ddfc9a8c12f1f3d3085a7b163966a8fd8098a90640953ce5f6170161"
-dependencies = [
- "cfg-if 1.0.0",
- "windows-sys",
-]
-
-[[package]]
-name = "libm"
-version = "0.2.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ec2a862134d2a7d32d7983ddcdd1c4923530833c9f2ea1a44fc5fa473989058"
-
-[[package]]
-name = "linux-raw-sys"
-version = "0.4.10"
+version = "0.2.137"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da2479e8c062e40bf0066ffa0bc823de0a9368974af99c9f6df941d2c231e03f"
+checksum = "fc7fcc620a3bff7cdd7a365be3376c97191aeaccc2a603e600951e452615bf89"
 
 [[package]]
 name = "lock_api"
-version = "0.4.10"
+version = "0.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1cc9717a20b1bb222f333e6a92fd32f7d8a18ddc5a3191a11af45dcbf4dcd16"
+checksum = "327fa5b6a6940e4699ec49a9beae1ea4845c6bab9314e4f84ac68742139d8c53"
 dependencies = [
  "autocfg",
  "scopeguard",
@@ -1089,9 +1067,12 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.20"
+version = "0.4.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5e6163cb8c49088c2c36f57875e58ccd8c87c7427f7fbd50ea6710b2f3f2e8f"
+checksum = "abb12e687cfb44aa40f41fc3978ef76448f9b6038cad6aef4259d3c095a2382e"
+dependencies = [
+ "cfg-if 1.0.0",
+]
 
 [[package]]
 name = "maybe-rayon"
@@ -1105,15 +1086,15 @@ dependencies = [
 
 [[package]]
 name = "memchr"
-version = "2.6.4"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f665ee40bc4a3c5590afb1e9677db74a508659dfd71e126420da8274909a0167"
+checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
 
 [[package]]
 name = "memmap2"
-version = "0.5.10"
+version = "0.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83faa42c0a078c393f6b29d5db232d8be22776a891f8f56e5284faee4a20b327"
+checksum = "057a3db23999c867821a7a59feb06a578fcb03685e983dff90daf9e7d24ac08f"
 dependencies = [
  "libc",
 ]
@@ -1128,42 +1109,48 @@ dependencies = [
 ]
 
 [[package]]
-name = "memoffset"
-version = "0.9.0"
+name = "miniz_oxide"
+version = "0.3.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a634b1c61a95585bd15607c6ab0c4e5b226e695ff2800ba0cdccddf208c406c"
+checksum = "791daaae1ed6889560f8c4359194f56648355540573244a5448a83ba1ecc7435"
 dependencies = [
- "autocfg",
+ "adler32",
 ]
 
 [[package]]
 name = "miniz_oxide"
-version = "0.7.1"
+version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7810e0be55b428ada41041c41f32c9f1a42817901b4ccf45fa3d4b6561e74c7"
+checksum = "a92518e98c078586bc6c934028adcca4c92a53d6a958196de835170a01d84e4b"
 dependencies = [
  "adler",
- "simd-adler32",
+ "autocfg",
 ]
 
 [[package]]
 name = "nix"
-version = "0.23.2"
+version = "0.23.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f3790c00a0150112de0f4cd161e3d7fc4b2d8a5542ffc35f099a2562aecb35c"
+checksum = "9f866317acbd3a240710c63f065ffb1e4fd466259045ccb504130b7f668f35c6"
 dependencies = [
- "bitflags 1.3.2",
+ "bitflags",
  "cc",
  "cfg-if 1.0.0",
  "libc",
- "memoffset 0.6.5",
+ "memoffset",
 ]
 
+[[package]]
+name = "nodrop"
+version = "0.1.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72ef4a56884ca558e5ddb05a1d1e7e1bfd9a68d9ed024c21704cc98872dae1bb"
+
 [[package]]
 name = "num-bigint"
-version = "0.4.4"
+version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "608e7659b5c3d7cba262d894801b9ec9d00de989e8a82bd4bef91d08da45cdc0"
+checksum = "f93ab6289c7b344a8a9f60f88d80aa20032336fe78da341afc91c8a2341fc75f"
 dependencies = [
  "autocfg",
  "num-integer",
@@ -1173,29 +1160,40 @@ dependencies = [
 
 [[package]]
 name = "num-format"
-version = "0.4.4"
+version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a652d9771a63711fd3c3deb670acfbe5c30a4072e664d7a3bf5a9e1056ac72c3"
+checksum = "bafe4179722c2894288ee77a9f044f02811c86af699344c498b0840c698a2465"
 dependencies = [
- "arrayvec",
- "itoa",
+ "arrayvec 0.4.12",
+ "itoa 0.4.8",
 ]
 
 [[package]]
 name = "num-integer"
-version = "0.1.45"
+version = "0.1.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2cc698a63b549a70bc047073d2949cce27cd1c7b0a4a862d08a8031bc2801db"
+dependencies = [
+ "autocfg",
+ "num-traits",
+]
+
+[[package]]
+name = "num-iter"
+version = "0.1.42"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "225d3389fb3509a24c93f5c29eb6bde2586b98d9f016636dff58d7c6f7569cd9"
+checksum = "b2021c8337a54d21aca0d59a92577a029af9431cb59b909b03252b9c164fad59"
 dependencies = [
  "autocfg",
+ "num-integer",
  "num-traits",
 ]
 
 [[package]]
 name = "num-rational"
-version = "0.4.1"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0638a1c9d0a3c0914158145bc76cff373a75a627e6ecbfb71cbe6f453a5a19b0"
+checksum = "12ac428b1cb17fce6f731001d307d351ec70a6d202fc2e60f7d4c5e42d8f4f07"
 dependencies = [
  "autocfg",
  "num-integer",
@@ -1204,28 +1202,37 @@ dependencies = [
 
 [[package]]
 name = "num-traits"
-version = "0.2.17"
+version = "0.2.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "39e3200413f237f41ab11ad6d161bc7239c84dcb631773ccd7de3dfe4b5c267c"
+checksum = "9a64b1ec5cda2586e284722486d802acf1f7dbdc623e2bfc57e65ca1cd099290"
 dependencies = [
  "autocfg",
- "libm",
+]
+
+[[package]]
+name = "num_cpus"
+version = "1.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19e64526ebdee182341572e50e9ad03965aa510cd94427a4549448f285e957a1"
+dependencies = [
+ "hermit-abi",
+ "libc",
 ]
 
 [[package]]
 name = "object"
-version = "0.32.1"
+version = "0.27.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9cf5f9dd3933bd50a9e1f149ec995f39ae2c496d31fd772c1fd45ebc27e902b0"
+checksum = "67ac1d3f9a1d3616fd9a60c8d74296f22406a238b6a72f5cc1e6f314df4ffbf9"
 dependencies = [
  "memchr",
 ]
 
 [[package]]
 name = "once_cell"
-version = "1.18.0"
+version = "1.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd8b5dd2ae5ed71462c540258bedcb51965123ad7e7ccf4b9a8cafaa4a63576d"
+checksum = "e82dad04139b71a90c080c8463fe0dc7902db5192d939bd0950f074d014339e1"
 
 [[package]]
 name = "oorandom"
@@ -1251,15 +1258,15 @@ dependencies = [
 
 [[package]]
 name = "parking_lot_core"
-version = "0.9.8"
+version = "0.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93f00c865fe7cabf650081affecd3871070f26767e7b2070a3ffae14c654b447"
+checksum = "09a279cbf25cb0757810394fbc1e359949b59e348145c643a939a525692e6929"
 dependencies = [
  "cfg-if 1.0.0",
  "libc",
- "redox_syscall 0.3.5",
+ "redox_syscall",
  "smallvec",
- "windows-targets",
+ "windows-sys",
 ]
 
 [[package]]
@@ -1279,9 +1286,9 @@ dependencies = [
 
 [[package]]
 name = "paste"
-version = "1.0.14"
+version = "1.0.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "de3145af08024dea9fa9914f381a17b8fc6034dfb00f3a84013f7ff43f29ed4c"
+checksum = "9f746c4065a8fa3fe23974dd82f15431cc8d40779821001404d10d2e79ca7d79"
 
 [[package]]
 name = "pathfinder_geometry"
@@ -1304,21 +1311,21 @@ dependencies = [
 
 [[package]]
 name = "pin-project-lite"
-version = "0.2.13"
+version = "0.2.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8afb450f006bf6385ca15ef45d71d2288452bc3683ce2e2cacc0d18e4be60b58"
+checksum = "e0a7ae3ac2f1173085d398531c705756c94a4c56843785df85a60c1a0afac116"
 
 [[package]]
 name = "pkg-config"
-version = "0.3.27"
+version = "0.3.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26072860ba924cbfa98ea39c8c19b4dd6a4a25423dbdf219c1eca91aa0cf6964"
+checksum = "1df8c4ec4b0627e53bdf214615ad287367e482558cf84b109250b37464dc03ae"
 
 [[package]]
 name = "plotters"
-version = "0.3.5"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2c224ba00d7cadd4d5c660deaf2098e5e80e07846537c51f9cfa4be50c1fd45"
+checksum = "32a3fd9ec30b9749ce28cd91f255d569591cdf937fe280c312143e3c4bad6f2a"
 dependencies = [
  "font-kit",
  "lazy_static",
@@ -1334,15 +1341,15 @@ dependencies = [
 
 [[package]]
 name = "plotters-backend"
-version = "0.3.5"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e76628b4d3a7581389a35d5b6e2139607ad7c75b17aed325f210aa91f4a9609"
+checksum = "d88417318da0eaf0fdcdb51a0ee6c3bed624333bff8f946733049380be67ac1c"
 
 [[package]]
 name = "plotters-bitmap"
-version = "0.3.3"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0cebbe1f70205299abc69e8b295035bb52a6a70ee35474ad10011f0a4efb8543"
+checksum = "21362fa905695e5618aefd169358f52e0e8bc4a8e05333cf780fda8cddc00b54"
 dependencies = [
  "image",
  "plotters-backend",
@@ -1350,30 +1357,29 @@ dependencies = [
 
 [[package]]
 name = "plotters-svg"
-version = "0.3.5"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38f6d39893cca0701371e3c27294f09797214b86f1fb951b89ade8ec04e2abab"
+checksum = "521fa9638fa597e1dc53e9412a4f9cefb01187ee1f7413076f9e6749e2885ba9"
 dependencies = [
  "plotters-backend",
 ]
 
 [[package]]
 name = "png"
-version = "0.17.10"
+version = "0.16.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd75bf2d8dd3702b9707cdbc56a5b9ef42cec752eb8b3bafc01234558442aa64"
+checksum = "3c3287920cb847dee3de33d301c463fba14dda99db24214ddf93f83d3021f4c6"
 dependencies = [
- "bitflags 1.3.2",
+ "bitflags",
  "crc32fast",
- "fdeflate",
- "flate2",
- "miniz_oxide",
+ "deflate",
+ "miniz_oxide 0.3.7",
 ]
 
 [[package]]
 name = "poseidon"
 version = "0.2.0"
-source = "git+https://github.com/scroll-tech/poseidon.git?branch=sync-halo2-lib-0.4.0#5787dd3d2ce7a9e9601a035c396ac0c03449b54d"
+source = "git+https://github.com/scroll-tech/poseidon.git?branch=main#5787dd3d2ce7a9e9601a035c396ac0c03449b54d"
 dependencies = [
  "halo2curves",
  "subtle",
@@ -1403,37 +1409,37 @@ dependencies = [
 
 [[package]]
 name = "ppv-lite86"
-version = "0.2.17"
+version = "0.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de"
+checksum = "eb9f9e6e233e5c4a35559a617bf40a4ec447db2e84c20b55a6f83167b7e57872"
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.69"
+version = "1.0.37"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "134c189feb4956b20f6f547d2cf727d4c0fe06722b20a0eec87ed445a97f92da"
+checksum = "ec757218438d5fda206afc041538b2f6d889286160d649a86a24d37e1235afd1"
 dependencies = [
- "unicode-ident",
+ "unicode-xid",
 ]
 
 [[package]]
 name = "proptest"
-version = "1.3.1"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7c003ac8c77cb07bb74f5f198bce836a689bcd5a42574612bf14d17bfd08c20e"
+checksum = "1e0d9cc07f18492d879586c92b485def06bc850da3118075cd45d50e9c95b0e5"
 dependencies = [
  "bit-set",
- "bit-vec",
- "bitflags 2.4.1",
+ "bitflags",
+ "byteorder",
  "lazy_static",
  "num-traits",
+ "quick-error 2.0.1",
  "rand",
  "rand_chacha",
  "rand_xorshift",
- "regex-syntax 0.7.5",
+ "regex-syntax",
  "rusty-fork",
  "tempfile",
- "unarray",
 ]
 
 [[package]]
@@ -1442,20 +1448,26 @@ version = "1.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0"
 
+[[package]]
+name = "quick-error"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a993555f31e5a609f617c12db6250dedcac1b0a85076912c436e6fc9b2c8e6a3"
+
 [[package]]
 name = "quick-xml"
-version = "0.26.0"
+version = "0.23.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f50b1c63b38611e7d4d7f68b82d3ad0cc71a2ad2e7f61fc10f1328d917c93cd"
+checksum = "11bafc859c6815fbaffbbbf4229ecb767ac913fecb27f9ad4343662e9ef099ea"
 dependencies = [
  "memchr",
 ]
 
 [[package]]
 name = "quote"
-version = "1.0.33"
+version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5267fca4496028628a95160fc423a33e8b2e6af8a5302579e322e4b520293cae"
+checksum = "a1feb54ed693b93a84e14094943b84b7c4eae204c512b7ccb95ab0c66d278ad1"
 dependencies = [
  "proc-macro2",
 ]
@@ -1489,9 +1501,9 @@ dependencies = [
 
 [[package]]
 name = "rand_core"
-version = "0.6.4"
+version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+checksum = "d34f1408f55294453790c48b2f1ebbb1c5b4b7563eb1f418bcfcfdbb06ebb4e7"
 dependencies = [
  "getrandom",
 ]
@@ -1507,40 +1519,35 @@ dependencies = [
 
 [[package]]
 name = "rayon"
-version = "1.8.0"
+version = "1.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c27db03db7734835b3f53954b534c91069375ce6ccaa2e065441e07d9b6cdb1"
+checksum = "fd249e82c21598a9a426a4e00dd7adc1d640b22445ec8545feef801d1a74c221"
 dependencies = [
+ "autocfg",
+ "crossbeam-deque",
  "either",
  "rayon-core",
 ]
 
 [[package]]
 name = "rayon-core"
-version = "1.12.0"
+version = "1.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ce3fb6ad83f861aac485e76e1985cd109d9a3713802152be56c3b1f0e0658ed"
+checksum = "9f51245e1e62e1f1629cbfec37b5793bbabcaeb90f30e94d2ba03564687353e4"
 dependencies = [
+ "crossbeam-channel",
  "crossbeam-deque",
  "crossbeam-utils",
+ "num_cpus",
 ]
 
 [[package]]
 name = "redox_syscall"
-version = "0.2.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb5a58c1855b4b6819d59012155603f0b22ad30cad752600aadfcb695265519a"
-dependencies = [
- "bitflags 1.3.2",
-]
-
-[[package]]
-name = "redox_syscall"
-version = "0.3.5"
+version = "0.2.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "567664f262709473930a4bf9e51bf2ebf3348f2e748ccc50dea20646858f8f29"
+checksum = "62f25bc4c7e55e0b0b7a1d43fb893f4fa1361d0abe38b9ce4f323c2adfe6ef42"
 dependencies = [
- "bitflags 1.3.2",
+ "bitflags",
 ]
 
 [[package]]
@@ -1550,59 +1557,56 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b033d837a7cf162d7993aded9304e30a83213c648b6e389db233191f891e5c2b"
 dependencies = [
  "getrandom",
- "redox_syscall 0.2.16",
+ "redox_syscall",
  "thiserror",
 ]
 
 [[package]]
 name = "regex"
-version = "1.10.2"
+version = "1.5.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "380b951a9c5e80ddfd6136919eef32310721aa4aacd4889a8d39124b026ab343"
+checksum = "1a11647b6b25ff05a515cb92c365cec08801e83423a235b51e231e1808747286"
 dependencies = [
  "aho-corasick",
  "memchr",
- "regex-automata",
- "regex-syntax 0.8.2",
+ "regex-syntax",
 ]
 
 [[package]]
 name = "regex-automata"
-version = "0.4.3"
+version = "0.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f804c7828047e88b2d32e2d7fe5a105da8ee3264f01902f796c8e067dc2483f"
-dependencies = [
- "aho-corasick",
- "memchr",
- "regex-syntax 0.8.2",
-]
+checksum = "6c230d73fb8d8c1b9c0b3135c5142a8acee3a0558fb8db5cf1cb65f8d7862132"
 
 [[package]]
 name = "regex-syntax"
-version = "0.7.5"
+version = "0.6.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dbb5fb1acd8a1a18b3dd5be62d25485eb770e05afb408a9627d14d451bae12da"
+checksum = "f497285884f3fcff424ffc933e56d7cbca511def0c9831a7f9b5f6153e3cc89b"
 
 [[package]]
-name = "regex-syntax"
-version = "0.8.2"
+name = "remove_dir_all"
+version = "0.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c08c74e62047bb2de4ff487b251e4a92e24f48745648451635cec7d591162d9f"
+checksum = "3acd125665422973a33ac9d3dd2df85edad0f4ae9b00dafb1a05e43a9f5ef8e7"
+dependencies = [
+ "winapi",
+]
 
 [[package]]
 name = "rgb"
-version = "0.8.36"
+version = "0.8.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "20ec2d3e3fc7a92ced357df9cebd5a10b6fb2aa1ee797bf7e9ce2f17dffc8f59"
+checksum = "e74fdc210d8f24a7dbfedc13b04ba5764f5232754ccebfdf5fff1bad791ccbc6"
 dependencies = [
  "bytemuck",
 ]
 
 [[package]]
 name = "rustc-demangle"
-version = "0.1.23"
+version = "0.1.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d626bb9dae77e28219937af045c257c28bfd3f69333c512553507f5f9798cb76"
+checksum = "7ef03e0a2b150c7a90d01faf6254c9c48a41e95fb2a8c2ac1c6f0d2b9aefc342"
 
 [[package]]
 name = "rustc_version"
@@ -1613,19 +1617,6 @@ dependencies = [
  "semver",
 ]
 
-[[package]]
-name = "rustix"
-version = "0.38.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "745ecfa778e66b2b63c88a61cb36e0eea109e803b0b86bf9879fbc77c70e86ed"
-dependencies = [
- "bitflags 2.4.1",
- "errno",
- "libc",
- "linux-raw-sys",
- "windows-sys",
-]
-
 [[package]]
 name = "rusty-fork"
 version = "0.3.0"
@@ -1633,16 +1624,16 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cb3dcc6e454c328bb824492db107ab7c0ae8fcffe4ad210136ef014458c1bc4f"
 dependencies = [
  "fnv",
- "quick-error",
+ "quick-error 1.2.3",
  "tempfile",
  "wait-timeout",
 ]
 
 [[package]]
 name = "ryu"
-version = "1.0.15"
+version = "1.0.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ad4cc8da4ef723ed60bced201181d83791ad433213d8c24efffda1eec85d741"
+checksum = "73b4b750c782965c211b42f022f59af1fbceabdd026623714f104152f1ec149f"
 
 [[package]]
 name = "same-file"
@@ -1655,25 +1646,34 @@ dependencies = [
 
 [[package]]
 name = "scopeguard"
-version = "1.2.0"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
 
 [[package]]
 name = "semver"
-version = "1.0.20"
+version = "1.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "836fa6a3e1e547f9a2c4040802ec865b5d85f4014efe00555d7090a3dcaa1090"
+checksum = "d65bd28f48be7196d222d95b9243287f48d27aca604e08497513019ff0502cc4"
 
 [[package]]
 name = "serde"
-version = "1.0.189"
+version = "1.0.136"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e422a44e74ad4001bdc8eede9a4570ab52f71190e9c076d14369f38b9200537"
+checksum = "ce31e24b01e1e524df96f1c2fdd054405f8d7376249a5110886fb4b658484789"
 dependencies = [
  "serde_derive",
 ]
 
+[[package]]
+name = "serde_arrays"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38636132857f68ec3d5f3eb121166d2af33cb55174c4d5ff645db6165cbef0fd"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "serde_cbor"
 version = "0.11.2"
@@ -1686,26 +1686,47 @@ dependencies = [
 
 [[package]]
 name = "serde_derive"
-version = "1.0.189"
+version = "1.0.136"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e48d1f918009ce3145511378cf68d613e3b3d9137d67272562080d68a2b32d5"
+checksum = "08597e7152fcd306f41838ed3e37be9eaeed2b61c42e2117266a554fab4662f9"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.107"
+version = "1.0.79"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b420ce6e3d8bd882e9b243c6eed35dbc9a6110c9769e74b584e0d68d1f20c65"
+checksum = "8e8d9fa5c3b304765ce1fd9c4c8a3de2c8db365a5b91be52f186efc675681d95"
 dependencies = [
- "itoa",
+ "itoa 1.0.1",
  "ryu",
  "serde",
 ]
 
+[[package]]
+name = "servo-fontconfig"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7e3e22fe5fd73d04ebf0daa049d3efe3eae55369ce38ab16d07ddd9ac5c217c"
+dependencies = [
+ "libc",
+ "servo-fontconfig-sys",
+]
+
+[[package]]
+name = "servo-fontconfig-sys"
+version = "5.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e36b879db9892dfa40f95da1c38a835d41634b825fbd8c4c418093d53c24b388"
+dependencies = [
+ "expat-sys",
+ "freetype-sys",
+ "pkg-config",
+]
+
 [[package]]
 name = "sha3"
 version = "0.9.1"
@@ -1718,17 +1739,11 @@ dependencies = [
  "opaque-debug",
 ]
 
-[[package]]
-name = "simd-adler32"
-version = "0.3.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d66dc143e6b11c1eddc06d5c423cfc97062865baf299914ab64caa38182078fe"
-
 [[package]]
 name = "smallvec"
-version = "1.11.1"
+version = "1.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "942b4a808e05215192e39f4ab80813e599068285906cc91aa64f923db842bd5a"
+checksum = "f2dd574626839106c320a323308629dcb1acfc96e32a8cba364ddc61ac23ee83"
 
 [[package]]
 name = "spin"
@@ -1762,15 +1777,15 @@ checksum = "6446ced80d6c486436db5c078dde11a9f73d42b57fb273121e160b84f63d894c"
 
 [[package]]
 name = "subtle"
-version = "2.5.0"
+version = "2.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81cdd64d312baedb58e21336b31bc043b77e01cc99033ce76ef539f78e965ebc"
+checksum = "6bdef32e8150c2a081110b42772ffe7d7c9032b606bc226c8260fd97e0976601"
 
 [[package]]
 name = "symbolic-common"
-version = "8.8.0"
+version = "8.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f551f902d5642e58039aee6a9021a61037926af96e071816361644983966f540"
+checksum = "ac6aac7b803adc9ee75344af7681969f76d4b38e4723c6eaacf3b28f5f1d87ff"
 dependencies = [
  "debugid",
  "memmap2",
@@ -1780,9 +1795,9 @@ dependencies = [
 
 [[package]]
 name = "symbolic-demangle"
-version = "8.8.0"
+version = "8.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4564ca7b4e6eb14105aa8bbbce26e080f6b5d9c4373e67167ab31f7b86443750"
+checksum = "8143ea5aa546f86c64f9b9aafdd14223ffad4ecd2d58575c63c21335909c99a7"
 dependencies = [
  "cpp_demangle",
  "rustc-demangle",
@@ -1791,24 +1806,13 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "1.0.109"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "syn"
-version = "2.0.38"
+version = "1.0.91"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e96b79aaa137db8f61e26363a0c9b47d8b4ec75da28b7d1d614c2303e232408b"
+checksum = "b683b2b825c8eef438b77c36a06dc262294da3d5a5813fac20da149241dcd44d"
 dependencies = [
  "proc-macro2",
  "quote",
- "unicode-ident",
+ "unicode-xid",
 ]
 
 [[package]]
@@ -1830,22 +1834,23 @@ checksum = "55937e1799185b12863d447f42597ed69d9928686b8d88a1df17376a097d8369"
 
 [[package]]
 name = "tempfile"
-version = "3.8.0"
+version = "3.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb94d2f3cc536af71caac6b6fcebf65860b347e7ce0cc9ebe8f70d3e521054ef"
+checksum = "5cdb1ef4eaeeaddc8fbd371e5017057064af0911902ef36b39801f67cc6d79e4"
 dependencies = [
  "cfg-if 1.0.0",
  "fastrand",
- "redox_syscall 0.3.5",
- "rustix",
- "windows-sys",
+ "libc",
+ "redox_syscall",
+ "remove_dir_all",
+ "winapi",
 ]
 
 [[package]]
 name = "termcolor"
-version = "1.3.0"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6093bad37da69aab9d123a8091e4be0aa4a03e4d601ec641c327398315f62b64"
+checksum = "be55cf8942feac5c765c2c993422806843c9a9a45d4d5c407ad6dd2ea95eb9b6"
 dependencies = [
  "winapi-util",
 ]
@@ -1861,22 +1866,22 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "1.0.49"
+version = "1.0.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1177e8c6d7ede7afde3585fd2513e611227efd6481bd78d2e82ba1ce16557ed4"
+checksum = "854babe52e4df1653706b98fcfc05843010039b406875930a70e4d9644e5c417"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.49"
+version = "1.0.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "10712f02019e9288794769fba95cd6847df9874d49d871d062172f9dd41bc4cc"
+checksum = "aa32fd3f627f367fe16f893e2597ae3c05020f8bba2666a4e6ea73d377e5714b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn",
 ]
 
 [[package]]
@@ -1891,10 +1896,11 @@ dependencies = [
 
 [[package]]
 name = "tracing"
-version = "0.1.39"
+version = "0.1.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee2ef2af84856a50c1d430afce2fdded0a4ec7eda868db86409b4543df0797f9"
+checksum = "2fce9567bd60a67d08a16488756721ba392f24f29006402881e43b19aac64307"
 dependencies = [
+ "cfg-if 1.0.0",
  "pin-project-lite",
  "tracing-attributes",
  "tracing-core",
@@ -1902,41 +1908,41 @@ dependencies = [
 
 [[package]]
 name = "tracing-attributes"
-version = "0.1.27"
+version = "0.1.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34704c8d6ebcbc939824180af020566b01a7c01f80641264eba0999f6c2b6be7"
+checksum = "11c75893af559bc8e10716548bdef5cb2b983f8e637db9d0e15126b61b484ee2"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn",
 ]
 
 [[package]]
 name = "tracing-core"
-version = "0.1.32"
+version = "0.1.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c06d3da6113f116aaee68e4d601191614c9053067f9ab7f6edbcb161237daa54"
+checksum = "5aeea4303076558a00714b823f9ad67d58a3bbda1df83d8827d21193156e22f7"
 dependencies = [
  "once_cell",
 ]
 
 [[package]]
 name = "ttf-parser"
-version = "0.17.1"
+version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "375812fa44dab6df41c195cd2f7fecb488f6c09fbaafb62807488cefab642bff"
+checksum = "7ae2f58a822f08abdaf668897e96a5656fe72f5a9ce66422423e8849384872e6"
 
 [[package]]
 name = "typenum"
-version = "1.17.0"
+version = "1.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42ff0bf0c66b8238c6f3b578df37d0b7848e55df8577b3f74f92a69acceeb825"
+checksum = "497961ef93d974e23eb6f433eb5fe1b7930b659f06d12dec6fc44a8f554c0bba"
 
 [[package]]
 name = "uint"
-version = "0.9.5"
+version = "0.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76f64bba2c53b04fcab63c01a7d7427eadc821e3bc48c34dc9ba29c501164b52"
+checksum = "a45526d29728d135c2900b0d30573fe3ee79fceb12ef534c7bb30e810a91b601"
 dependencies = [
  "byteorder",
  "crunchy",
@@ -1945,22 +1951,16 @@ dependencies = [
 ]
 
 [[package]]
-name = "unarray"
-version = "0.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eaea85b334db583fe3274d12b4cd1880032beab409c0d774be044d4480ab9a94"
-
-[[package]]
-name = "unicode-ident"
-version = "1.0.12"
+name = "unicode-width"
+version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
+checksum = "3ed742d4ea2bd1176e236172c8429aaf54486e7ac098db29ffe6529e0ce50973"
 
 [[package]]
-name = "unicode-width"
-version = "0.1.11"
+name = "unicode-xid"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e51733f11c9c4f72aa0c160008246859e340b00807569a0da0e7a1079b27ba85"
+checksum = "8ccb82d61f80a663efe1f787a51b16b5a51e3314d6ac365b08639f52387b33f3"
 
 [[package]]
 name = "uuid"
@@ -1985,25 +1985,26 @@ dependencies = [
 
 [[package]]
 name = "walkdir"
-version = "2.4.0"
+version = "2.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d71d857dc86794ca4c280d616f7da00d2dbfd8cd788846559a6813e6aa4b54ee"
+checksum = "808cf2735cd4b6866113f648b791c6adc5714537bc222d9347bb203386ffda56"
 dependencies = [
  "same-file",
+ "winapi",
  "winapi-util",
 ]
 
 [[package]]
 name = "wasi"
-version = "0.11.0+wasi-snapshot-preview1"
+version = "0.10.0+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
+checksum = "1a143597ca7c7793eff794def352d41792a93c481eb1042423ff7ff72ba2c31f"
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.87"
+version = "0.2.80"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7706a72ab36d8cb1f80ffbf0e071533974a60d0a308d01a5d0375bf60499a342"
+checksum = "27370197c907c55e3f1a9fbe26f44e937fe6451368324e009cba39e139dc08ad"
 dependencies = [
  "cfg-if 1.0.0",
  "wasm-bindgen-macro",
@@ -2011,24 +2012,24 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-backend"
-version = "0.2.87"
+version = "0.2.80"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ef2b6d3c510e9625e5fe6f509ab07d66a760f0885d858736483c32ed7809abd"
+checksum = "53e04185bfa3a779273da532f5025e33398409573f348985af9a1cbf3774d3f4"
 dependencies = [
  "bumpalo",
+ "lazy_static",
  "log",
- "once_cell",
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.87"
+version = "0.2.80"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dee495e55982a3bd48105a7b947fd2a9b4a8ae3010041b9e0faab3f9cd028f1d"
+checksum = "17cae7ff784d7e83a2fe7611cfe766ecf034111b49deb850a3dc7699c08251f5"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -2036,28 +2037,28 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.87"
+version = "0.2.80"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "54681b18a46765f095758388f2d0cf16eb8d4169b639ab575a8f5693af210c7b"
+checksum = "99ec0dc7a4756fffc231aab1b9f2f578d23cd391390ab27f952ae0c9b3ece20b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.38",
+ "syn",
  "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.87"
+version = "0.2.80"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca6ad05a4870b2bf5fe995117d3728437bd27d7cd5f06f13c17443ef369775a1"
+checksum = "d554b7f530dee5964d9a9468d95c1f8b8acae4f282807e7d27d4b03099a46744"
 
 [[package]]
 name = "web-sys"
-version = "0.3.64"
+version = "0.3.57"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b85cbef8c220a6abc02aefd892dfc0fc23afb1c6a426316ec33253a3877249b"
+checksum = "7b17e741662c70c8bd24ac5c5b18de314a2c26c32bf8346ee1e6f53de919c283"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -2081,9 +2082,9 @@ checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
 
 [[package]]
 name = "winapi-util"
-version = "0.1.6"
+version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f29e6f9198ba0d26b4c9f07dbe6f9ed633e1f3d5b8b414090084349e46a52596"
+checksum = "70ec6ce85bb158151cae5e5c87f95a8e97d2c0c4b001223f33a334e3ce5de178"
 dependencies = [
  "winapi",
 ]
@@ -2096,69 +2097,46 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windows-sys"
-version = "0.48.0"
+version = "0.36.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
+checksum = "ea04155a16a59f9eab786fe12a4a450e75cdb175f9e0d80da1e17db09f55b8d2"
 dependencies = [
- "windows-targets",
-]
-
-[[package]]
-name = "windows-targets"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
-dependencies = [
- "windows_aarch64_gnullvm",
  "windows_aarch64_msvc",
  "windows_i686_gnu",
  "windows_i686_msvc",
  "windows_x86_64_gnu",
- "windows_x86_64_gnullvm",
  "windows_x86_64_msvc",
 ]
 
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
-
 [[package]]
 name = "windows_aarch64_msvc"
-version = "0.48.5"
+version = "0.36.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
+checksum = "9bb8c3fd39ade2d67e9874ac4f3db21f0d710bee00fe7cab16949ec184eeaa47"
 
 [[package]]
 name = "windows_i686_gnu"
-version = "0.48.5"
+version = "0.36.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
+checksum = "180e6ccf01daf4c426b846dfc66db1fc518f074baa793aa7d9b9aaeffad6a3b6"
 
 [[package]]
 name = "windows_i686_msvc"
-version = "0.48.5"
+version = "0.36.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
+checksum = "e2e7917148b2812d1eeafaeb22a97e4813dfa60a3f8f78ebe204bcc88f12f024"
 
 [[package]]
 name = "windows_x86_64_gnu"
-version = "0.48.5"
+version = "0.36.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
-
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.48.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
+checksum = "4dcd171b8776c41b97521e5da127a2d86ad280114807d0b2ab1e462bc764d9e1"
 
 [[package]]
 name = "windows_x86_64_msvc"
-version = "0.48.5"
+version = "0.36.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
+checksum = "c811ca4a8c853ef420abd8592ba53ddbbac90410fab6903b3e79972a631f7680"
 
 [[package]]
 name = "wio"
@@ -2171,21 +2149,9 @@ dependencies = [
 
 [[package]]
 name = "wyz"
-version = "0.5.1"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05f360fc0b24296329c78fda852a1e9ae82de9cf7b27dae4b7f62f118f77b9ed"
+checksum = "30b31594f29d27036c383b53b59ed3476874d518f0efb151b27a4c275141390e"
 dependencies = [
  "tap",
 ]
-
-[[package]]
-name = "yeslogic-fontconfig-sys"
-version = "3.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2bbd69036d397ebbff671b1b8e4d918610c181c5a16073b96f984a38d08c386"
-dependencies = [
- "const-cstr",
- "dlib",
- "once_cell",
- "pkg-config",
-]
diff --git a/halo2_gadgets/benches/sha256.rs b/halo2_gadgets/benches/sha256.rs
index 6a7e9b0bd9..b1b8e0a2bd 100644
--- a/halo2_gadgets/benches/sha256.rs
+++ b/halo2_gadgets/benches/sha256.rs
@@ -15,7 +15,10 @@ use std::{
 
 use criterion::{criterion_group, criterion_main, Criterion};
 
-use halo2_gadgets::sha256::{BlockWord, Sha256, Table16Chip, Table16Config, BLOCK_SIZE};
+use halo2_gadgets::sha256::{
+    table16::{BlockWord, Table16Chip, Table16Config},
+    Sha256, BLOCK_SIZE,
+};
 
 use halo2_proofs::{
     poly::{
@@ -54,7 +57,7 @@ fn bench(name: &str, k: u32, c: &mut Criterion) {
             mut layouter: impl Layouter<pallas::Base>,
         ) -> Result<(), Error> {
             Table16Chip::load(config.clone(), &mut layouter)?;
-            let table16_chip = Table16Chip::construct(config);
+            let table16_chip = Table16Chip::construct::<pallas::Base>(config);
 
             // Test vector: "abc"
             let test_input = [
diff --git a/halo2_gadgets/src/ecc/chip/mul.rs b/halo2_gadgets/src/ecc/chip/mul.rs
index 7896bf58bd..9499191262 100644
--- a/halo2_gadgets/src/ecc/chip/mul.rs
+++ b/halo2_gadgets/src/ecc/chip/mul.rs
@@ -277,9 +277,9 @@ impl Config {
                 let zs = {
                     let mut zs = std::iter::empty()
                         .chain(Some(z_init))
-                        .chain(zs_incomplete_hi.into_iter())
-                        .chain(zs_incomplete_lo.into_iter())
-                        .chain(zs_complete.into_iter())
+                        .chain(zs_incomplete_hi)
+                        .chain(zs_incomplete_lo)
+                        .chain(zs_complete)
                         .chain(Some(z_0))
                         .collect::<Vec<_>>();
                     assert_eq!(zs.len(), pallas::Scalar::NUM_BITS as usize + 1);
diff --git a/halo2_gadgets/src/sha256.rs b/halo2_gadgets/src/sha256.rs
index 391020a3d3..5e2494079c 100644
--- a/halo2_gadgets/src/sha256.rs
+++ b/halo2_gadgets/src/sha256.rs
@@ -12,9 +12,8 @@ use halo2_proofs::{
     plonk::Error,
 };
 
-mod table16;
-
-pub use table16::{BlockWord, Table16Chip, Table16Config};
+/// The core circuit for SHA256
+pub mod table16;
 
 /// The size of a SHA-256 block, in 32-bit words.
 pub const BLOCK_SIZE: usize = 16;
diff --git a/halo2_gadgets/src/sha256/table16.rs b/halo2_gadgets/src/sha256/table16.rs
index 4781d82f64..efc7fd8bd1 100644
--- a/halo2_gadgets/src/sha256/table16.rs
+++ b/halo2_gadgets/src/sha256/table16.rs
@@ -1,12 +1,9 @@
-use std::convert::TryInto;
-use std::marker::PhantomData;
-
-use super::Sha256Instructions;
+use ff::PrimeField as Field;
 use halo2_proofs::{
     circuit::{AssignedCell, Chip, Layouter, Region, Value},
     plonk::{Advice, Any, Assigned, Column, ConstraintSystem, Error},
 };
-use halo2curves::pasta::pallas;
+use std::convert::TryInto;
 
 mod compression;
 mod gates;
@@ -81,10 +78,10 @@ impl<const LEN: usize> From<&Bits<LEN>> for [bool; LEN] {
     }
 }
 
-impl<const LEN: usize> From<&Bits<LEN>> for Assigned<pallas::Base> {
-    fn from(bits: &Bits<LEN>) -> Assigned<pallas::Base> {
+impl<F: Field, const LEN: usize> From<&Bits<LEN>> for Assigned<F> {
+    fn from(bits: &Bits<LEN>) -> Assigned<F> {
         assert!(LEN <= 64);
-        pallas::Base::from(lebs2ip(&bits.0)).into()
+        F::from(lebs2ip(&bits.0)).into()
     }
 }
 
@@ -112,20 +109,21 @@ impl From<u32> for Bits<32> {
     }
 }
 
+/// Assigned bits
 #[derive(Clone, Debug)]
-pub struct AssignedBits<const LEN: usize>(AssignedCell<Bits<LEN>, pallas::Base>);
+pub struct AssignedBits<F: Field, const LEN: usize>(pub AssignedCell<Bits<LEN>, F>);
 
-impl<const LEN: usize> std::ops::Deref for AssignedBits<LEN> {
-    type Target = AssignedCell<Bits<LEN>, pallas::Base>;
+impl<F: Field, const LEN: usize> std::ops::Deref for AssignedBits<F, LEN> {
+    type Target = AssignedCell<Bits<LEN>, F>;
 
     fn deref(&self) -> &Self::Target {
         &self.0
     }
 }
 
-impl<const LEN: usize> AssignedBits<LEN> {
+impl<F: Field, const LEN: usize> AssignedBits<F, LEN> {
     fn assign_bits<A, AR, T: TryInto<[bool; LEN]> + std::fmt::Debug + Clone>(
-        region: &mut Region<'_, pallas::Base>,
+        region: &mut Region<'_, F>,
         annotation: A,
         column: impl Into<Column<Any>>,
         offset: usize,
@@ -157,13 +155,13 @@ impl<const LEN: usize> AssignedBits<LEN> {
     }
 }
 
-impl AssignedBits<16> {
+impl<F: Field> AssignedBits<F, 16> {
     fn value_u16(&self) -> Value<u16> {
         self.value().map(|v| v.into())
     }
 
     fn assign<A, AR>(
-        region: &mut Region<'_, pallas::Base>,
+        region: &mut Region<'_, F>,
         annotation: A,
         column: impl Into<Column<Any>>,
         offset: usize,
@@ -192,13 +190,13 @@ impl AssignedBits<16> {
     }
 }
 
-impl AssignedBits<32> {
+impl<F: Field> AssignedBits<F, 32> {
     fn value_u32(&self) -> Value<u32> {
         self.value().map(|v| v.into())
     }
 
     fn assign<A, AR>(
-        region: &mut Region<'_, pallas::Base>,
+        region: &mut Region<'_, F>,
         annotation: A,
         column: impl Into<Column<Any>>,
         offset: usize,
@@ -235,14 +233,57 @@ pub struct Table16Config {
     compression: CompressionConfig,
 }
 
+impl Table16Config {
+    /// export initialize of compression module
+    pub fn initialize<F: Field>(
+        &self,
+        layouter: &mut impl Layouter<F>,
+        init_state_assigned: [RoundWordDense<F>; STATE],
+    ) -> Result<State<F>, Error> {
+        self.compression.initialize(layouter, init_state_assigned)
+    }
+
+    /// export compress of compression module
+    pub fn compress<F: Field>(
+        &self,
+        layouter: &mut impl Layouter<F>,
+        initialized_state: State<F>,
+        w_halves: [(AssignedBits<F, 16>, AssignedBits<F, 16>); ROUNDS],
+    ) -> Result<State<F>, Error> {
+        self.compression
+            .compress(layouter, initialized_state, w_halves)
+    }
+
+    /// export digest of compression module
+    pub fn digest<F: Field>(
+        &self,
+        layouter: &mut impl Layouter<F>,
+        final_state: State<F>,
+        initialized_state: State<F>,
+    ) -> Result<[RoundWordDense<F>; STATE], Error> {
+        self.compression
+            .digest(layouter, final_state, initialized_state)
+    }
+
+    /// export message_process module
+    #[allow(clippy::type_complexity)]
+    pub fn message_process<F: Field>(
+        &self,
+        layouter: &mut impl Layouter<F>,
+        input: [BlockWord; super::BLOCK_SIZE],
+    ) -> Result<[(AssignedBits<F, 16>, AssignedBits<F, 16>); ROUNDS], Error> {
+        let (_, w_halves) = self.message_schedule.process(layouter, input)?;
+        Ok(w_halves)
+    }
+}
+
 /// A chip that implements SHA-256 with a maximum lookup table size of $2^16$.
 #[derive(Clone, Debug)]
 pub struct Table16Chip {
     config: Table16Config,
-    _marker: PhantomData<pallas::Base>,
 }
 
-impl Chip<pallas::Base> for Table16Chip {
+impl<F: Field> Chip<F> for Table16Chip {
     type Config = Table16Config;
     type Loaded = ();
 
@@ -257,17 +298,12 @@ impl Chip<pallas::Base> for Table16Chip {
 
 impl Table16Chip {
     /// Reconstructs this chip from the given config.
-    pub fn construct(config: <Self as Chip<pallas::Base>>::Config) -> Self {
-        Self {
-            config,
-            _marker: PhantomData,
-        }
+    pub fn construct<F: Field>(config: <Self as Chip<F>>::Config) -> Self {
+        Self { config }
     }
 
     /// Configures a circuit to include this chip.
-    pub fn configure(
-        meta: &mut ConstraintSystem<pallas::Base>,
-    ) -> <Self as Chip<pallas::Base>>::Config {
+    pub fn configure<F: Field>(meta: &mut ConstraintSystem<F>) -> <Self as Chip<F>>::Config {
         // Columns required by this chip:
         let message_schedule = meta.advice_column();
         let extras = [
@@ -318,69 +354,114 @@ impl Table16Chip {
     }
 
     /// Loads the lookup table required by this chip into the circuit.
-    pub fn load(
+    pub fn load<F: Field>(
         config: Table16Config,
-        layouter: &mut impl Layouter<pallas::Base>,
+        layouter: &mut impl Layouter<F>,
     ) -> Result<(), Error> {
         SpreadTableChip::load(config.lookup, layouter)
     }
 }
 
-impl Sha256Instructions<pallas::Base> for Table16Chip {
-    type State = State;
+/// composite of states in table16
+#[allow(clippy::large_enum_variant)]
+#[derive(Clone, Debug)]
+pub enum Table16State<F: Field> {
+    /// working state (with spread assignment) for compression rounds
+    Compress(Box<State<F>>),
+    /// the dense state only carry hi-lo 16bit assigned cell used in digest and next block
+    Dense([RoundWordDense<F>; STATE]),
+}
+
+impl<F: Field> super::Sha256Instructions<F> for Table16Chip {
+    type State = Table16State<F>;
     type BlockWord = BlockWord;
 
-    fn initialization_vector(
-        &self,
-        layouter: &mut impl Layouter<pallas::Base>,
-    ) -> Result<State, Error> {
-        self.config().compression.initialize_with_iv(layouter, IV)
+    fn initialization_vector(&self, layouter: &mut impl Layouter<F>) -> Result<Self::State, Error> {
+        <Self as Chip<F>>::config(self)
+            .compression
+            .initialize_with_iv(layouter, IV)
+            .map(Box::new)
+            .map(Table16State::Compress)
     }
 
     fn initialization(
         &self,
-        layouter: &mut impl Layouter<pallas::Base>,
+        layouter: &mut impl Layouter<F>,
         init_state: &Self::State,
     ) -> Result<Self::State, Error> {
-        self.config()
+        let dense_state = match init_state.clone() {
+            Table16State::Compress(s) => {
+                let (a, b, c, d, e, f, g, h) = s.decompose();
+                [
+                    a.into_dense(),
+                    b.into_dense(),
+                    c.into_dense(),
+                    d,
+                    e.into_dense(),
+                    f.into_dense(),
+                    g.into_dense(),
+                    h,
+                ]
+            }
+            Table16State::Dense(s) => s,
+        };
+
+        <Self as Chip<F>>::config(self)
             .compression
-            .initialize_with_state(layouter, init_state.clone())
+            .initialize(layouter, dense_state)
+            .map(Box::new)
+            .map(Table16State::Compress)
     }
 
     // Given an initialized state and an input message block, compress the
     // message block and return the final state.
     fn compress(
         &self,
-        layouter: &mut impl Layouter<pallas::Base>,
+        layouter: &mut impl Layouter<F>,
         initialized_state: &Self::State,
         input: [Self::BlockWord; super::BLOCK_SIZE],
     ) -> Result<Self::State, Error> {
-        let config = self.config();
+        let config = <Self as Chip<F>>::config(self);
         let (_, w_halves) = config.message_schedule.process(layouter, input)?;
+
+        let init_working_state = match initialized_state {
+            Table16State::Compress(s) => s.as_ref().clone(),
+            _ => panic!("unexpected state type"),
+        };
+
+        let final_state =
+            config
+                .compression
+                .compress(layouter, init_working_state.clone(), w_halves)?;
+
         config
             .compression
-            .compress(layouter, initialized_state.clone(), w_halves)
+            .digest(layouter, final_state, init_working_state)
+            .map(Table16State::Dense)
     }
 
     fn digest(
         &self,
-        layouter: &mut impl Layouter<pallas::Base>,
+        _layouter: &mut impl Layouter<F>,
         state: &Self::State,
     ) -> Result<[Self::BlockWord; super::DIGEST_SIZE], Error> {
-        // Copy the dense forms of the state variable chunks down to this gate.
-        // Reconstruct the 32-bit dense words.
-        self.config().compression.digest(layouter, state.clone())
+        let digest_state = match state {
+            Table16State::Dense(s) => s.clone(),
+            _ => panic!("unexpected state type"),
+        };
+
+        Ok(digest_state.map(|s| s.value()).map(BlockWord))
     }
 }
 
 /// Common assignment patterns used by Table16 regions.
-trait Table16Assignment {
+trait Table16Assignment<F: Field> {
     /// Assign cells for general spread computation used in sigma, ch, ch_neg, maj gates
     #[allow(clippy::too_many_arguments)]
     #[allow(clippy::type_complexity)]
     fn assign_spread_outputs(
         &self,
-        region: &mut Region<'_, pallas::Base>,
+        region: &mut Region<'_, F>,
         lookup: &SpreadInputs,
         a_3: Column<Advice>,
         row: usize,
@@ -390,8 +471,8 @@ trait Table16Assignment {
         r_1_odd: Value<[bool; 16]>,
     ) -> Result<
         (
-            (AssignedBits<16>, AssignedBits<16>),
-            (AssignedBits<16>, AssignedBits<16>),
+            (AssignedBits<F, 16>, AssignedBits<F, 16>),
+            (AssignedBits<F, 16>, AssignedBits<F, 16>),
         ),
         Error,
     > {
@@ -432,7 +513,7 @@ trait Table16Assignment {
     #[allow(clippy::too_many_arguments)]
     fn assign_sigma_outputs(
         &self,
-        region: &mut Region<'_, pallas::Base>,
+        region: &mut Region<'_, F>,
         lookup: &SpreadInputs,
         a_3: Column<Advice>,
         row: usize,
@@ -440,7 +521,7 @@ trait Table16Assignment {
         r_0_odd: Value<[bool; 16]>,
         r_1_even: Value<[bool; 16]>,
         r_1_odd: Value<[bool; 16]>,
-    ) -> Result<(AssignedBits<16>, AssignedBits<16>), Error> {
+    ) -> Result<(AssignedBits<F, 16>, AssignedBits<F, 16>), Error> {
         let (even, _odd) = self.assign_spread_outputs(
             region, lookup, a_3, row, r_0_even, r_0_odd, r_1_even, r_1_odd,
         )?;
@@ -484,7 +565,7 @@ mod tests {
                 config: Self::Config,
                 mut layouter: impl Layouter<pallas::Base>,
             ) -> Result<(), Error> {
-                let table16_chip = Table16Chip::construct(config.clone());
+                let table16_chip = Table16Chip::construct::<pallas::Base>(config.clone());
                 Table16Chip::load(config, &mut layouter)?;
 
                 // Test vector: "abc"
diff --git a/halo2_gadgets/src/sha256/table16/compression.rs b/halo2_gadgets/src/sha256/table16/compression.rs
index 874452a418..b2903b7b82 100644
--- a/halo2_gadgets/src/sha256/table16/compression.rs
+++ b/halo2_gadgets/src/sha256/table16/compression.rs
@@ -1,16 +1,13 @@
 use super::{
-    super::DIGEST_SIZE,
     util::{i2lebsp, lebs2ip},
-    AssignedBits, BlockWord, SpreadInputs, SpreadVar, Table16Assignment, ROUNDS, STATE,
+    AssignedBits, Field, SpreadInputs, SpreadVar, Table16Assignment, ROUNDS, STATE,
 };
 use halo2_proofs::{
     circuit::{Layouter, Value},
     plonk::{Advice, Column, ConstraintSystem, Error, Selector},
     poly::Rotation,
 };
-use halo2curves::pasta::pallas;
-use std::convert::TryInto;
-use std::ops::Range;
+use std::{convert::TryInto, ops::Range};
 
 mod compression_gates;
 mod compression_util;
@@ -72,24 +69,23 @@ pub trait UpperSigmaVar<
 /// A variable that represents the `[A,B,C,D]` words of the SHA-256 internal state.
 ///
 /// The structure of this variable is influenced by the following factors:
-/// - In `Σ_0(A)` we need `A` to be split into pieces `(a,b,c,d)` of lengths `(2,11,9,10)`
-///   bits respectively (counting from the little end), as well as their spread forms.
-/// - `Maj(A,B,C)` requires having the bits of each input in spread form. For `A` we can
-///   reuse the pieces from `Σ_0(A)`. Since `B` and `C` are assigned from `A` and `B`
-///   respectively in each round, we therefore also have the same pieces in earlier rows.
-///   We align the columns to make it efficient to copy-constrain these forms where they
-///   are needed.
+/// - In `Σ_0(A)` we need `A` to be split into pieces `(a,b,c,d)` of lengths `(2,11,9,10)` bits
+///   respectively (counting from the little end), as well as their spread forms.
+/// - `Maj(A,B,C)` requires having the bits of each input in spread form. For `A` we can reuse the
+///   pieces from `Σ_0(A)`. Since `B` and `C` are assigned from `A` and `B` respectively in each
+///   round, we therefore also have the same pieces in earlier rows. We align the columns to make it
+///   efficient to copy-constrain these forms where they are needed.
 #[derive(Clone, Debug)]
-pub struct AbcdVar {
-    a: SpreadVar<2, 4>,
-    b: SpreadVar<11, 22>,
-    c_lo: SpreadVar<3, 6>,
-    c_mid: SpreadVar<3, 6>,
-    c_hi: SpreadVar<3, 6>,
-    d: SpreadVar<10, 20>,
+pub struct AbcdVar<F: Field> {
+    a: SpreadVar<F, 2, 4>,
+    b: SpreadVar<F, 11, 22>,
+    c_lo: SpreadVar<F, 3, 6>,
+    c_mid: SpreadVar<F, 3, 6>,
+    c_hi: SpreadVar<F, 3, 6>,
+    d: SpreadVar<F, 10, 20>,
 }
 
-impl AbcdVar {
+impl<F: Field> AbcdVar<F> {
     fn a_range() -> Range<usize> {
         0..2
     }
@@ -127,7 +123,7 @@ impl AbcdVar {
     }
 }
 
-impl UpperSigmaVar<4, 22, 18, 20> for AbcdVar {
+impl<F: Field> UpperSigmaVar<4, 22, 18, 20> for AbcdVar<F> {
     fn spread_a(&self) -> Value<[bool; 4]> {
         self.a.spread.value().map(|v| v.0)
     }
@@ -161,24 +157,23 @@ impl UpperSigmaVar<4, 22, 18, 20> for AbcdVar {
 /// A variable that represents the `[E,F,G,H]` words of the SHA-256 internal state.
 ///
 /// The structure of this variable is influenced by the following factors:
-/// - In `Σ_1(E)` we need `E` to be split into pieces `(a,b,c,d)` of lengths `(6,5,14,7)`
-///   bits respectively (counting from the little end), as well as their spread forms.
-/// - `Ch(E,F,G)` requires having the bits of each input in spread form. For `E` we can
-///   reuse the pieces from `Σ_1(E)`. Since `F` and `G` are assigned from `E` and `F`
-///   respectively in each round, we therefore also have the same pieces in earlier rows.
-///   We align the columns to make it efficient to copy-constrain these forms where they
-///   are needed.
+/// - In `Σ_1(E)` we need `E` to be split into pieces `(a,b,c,d)` of lengths `(6,5,14,7)` bits
+///   respectively (counting from the little end), as well as their spread forms.
+/// - `Ch(E,F,G)` requires having the bits of each input in spread form. For `E` we can reuse the
+///   pieces from `Σ_1(E)`. Since `F` and `G` are assigned from `E` and `F` respectively in each
+///   round, we therefore also have the same pieces in earlier rows. We align the columns to make it
+///   efficient to copy-constrain these forms where they are needed.
 #[derive(Clone, Debug)]
-pub struct EfghVar {
-    a_lo: SpreadVar<3, 6>,
-    a_hi: SpreadVar<3, 6>,
-    b_lo: SpreadVar<2, 4>,
-    b_hi: SpreadVar<3, 6>,
-    c: SpreadVar<14, 28>,
-    d: SpreadVar<7, 14>,
+pub struct EfghVar<F: Field> {
+    a_lo: SpreadVar<F, 3, 6>,
+    a_hi: SpreadVar<F, 3, 6>,
+    b_lo: SpreadVar<F, 2, 4>,
+    b_hi: SpreadVar<F, 3, 6>,
+    c: SpreadVar<F, 14, 28>,
+    d: SpreadVar<F, 7, 14>,
 }
 
-impl EfghVar {
+impl<F: Field> EfghVar<F> {
     fn a_lo_range() -> Range<usize> {
         0..3
     }
@@ -216,7 +211,7 @@ impl EfghVar {
     }
 }
 
-impl UpperSigmaVar<12, 10, 28, 14> for EfghVar {
+impl<F: Field> UpperSigmaVar<12, 10, 28, 14> for EfghVar<F> {
     fn spread_a(&self) -> Value<[bool; 12]> {
         self.a_lo
             .spread
@@ -257,33 +252,37 @@ impl UpperSigmaVar<12, 10, 28, 14> for EfghVar {
 }
 
 #[derive(Clone, Debug)]
-pub struct RoundWordDense(AssignedBits<16>, AssignedBits<16>);
+pub struct RoundWordDense<F: Field>(AssignedBits<F, 16>, AssignedBits<F, 16>);
 
-impl From<(AssignedBits<16>, AssignedBits<16>)> for RoundWordDense {
-    fn from(halves: (AssignedBits<16>, AssignedBits<16>)) -> Self {
+impl<F: Field> From<(AssignedBits<F, 16>, AssignedBits<F, 16>)> for RoundWordDense<F> {
+    fn from(halves: (AssignedBits<F, 16>, AssignedBits<F, 16>)) -> Self {
         Self(halves.0, halves.1)
     }
 }
 
-impl RoundWordDense {
+impl<F: Field> RoundWordDense<F> {
     pub fn value(&self) -> Value<u32> {
         self.0
             .value_u16()
             .zip(self.1.value_u16())
             .map(|(lo, hi)| lo as u32 + (1 << 16) * hi as u32)
     }
+
+    pub fn decompose(self) -> (AssignedBits<F, 16>, AssignedBits<F, 16>) {
+        (self.0, self.1)
+    }
 }
 
 #[derive(Clone, Debug)]
-pub struct RoundWordSpread(AssignedBits<32>, AssignedBits<32>);
+pub struct RoundWordSpread<F: Field>(AssignedBits<F, 32>, AssignedBits<F, 32>);
 
-impl From<(AssignedBits<32>, AssignedBits<32>)> for RoundWordSpread {
-    fn from(halves: (AssignedBits<32>, AssignedBits<32>)) -> Self {
+impl<F: Field> From<(AssignedBits<F, 32>, AssignedBits<F, 32>)> for RoundWordSpread<F> {
+    fn from(halves: (AssignedBits<F, 32>, AssignedBits<F, 32>)) -> Self {
         Self(halves.0, halves.1)
     }
 }
 
-impl RoundWordSpread {
+impl<F: Field> RoundWordSpread<F> {
     pub fn value(&self) -> Value<u64> {
         self.0
             .value_u32()
@@ -293,17 +292,17 @@ impl RoundWordSpread {
 }
 
 #[derive(Clone, Debug)]
-pub struct RoundWordA {
-    pieces: Option<AbcdVar>,
-    dense_halves: RoundWordDense,
-    spread_halves: Option<RoundWordSpread>,
+pub struct RoundWordA<F: Field> {
+    pieces: Option<AbcdVar<F>>,
+    dense_halves: RoundWordDense<F>,
+    spread_halves: Option<RoundWordSpread<F>>,
 }
 
-impl RoundWordA {
+impl<F: Field> RoundWordA<F> {
     pub fn new(
-        pieces: AbcdVar,
-        dense_halves: RoundWordDense,
-        spread_halves: RoundWordSpread,
+        pieces: AbcdVar<F>,
+        dense_halves: RoundWordDense<F>,
+        spread_halves: RoundWordSpread<F>,
     ) -> Self {
         RoundWordA {
             pieces: Some(pieces),
@@ -312,27 +311,31 @@ impl RoundWordA {
         }
     }
 
-    pub fn new_dense(dense_halves: RoundWordDense) -> Self {
+    pub fn new_dense(dense_halves: RoundWordDense<F>) -> Self {
         RoundWordA {
             pieces: None,
             dense_halves,
             spread_halves: None,
         }
     }
+
+    pub fn into_dense(self) -> RoundWordDense<F> {
+        self.dense_halves
+    }
 }
 
 #[derive(Clone, Debug)]
-pub struct RoundWordE {
-    pieces: Option<EfghVar>,
-    dense_halves: RoundWordDense,
-    spread_halves: Option<RoundWordSpread>,
+pub struct RoundWordE<F: Field> {
+    pieces: Option<EfghVar<F>>,
+    dense_halves: RoundWordDense<F>,
+    spread_halves: Option<RoundWordSpread<F>>,
 }
 
-impl RoundWordE {
+impl<F: Field> RoundWordE<F> {
     pub fn new(
-        pieces: EfghVar,
-        dense_halves: RoundWordDense,
-        spread_halves: RoundWordSpread,
+        pieces: EfghVar<F>,
+        dense_halves: RoundWordDense<F>,
+        spread_halves: RoundWordSpread<F>,
     ) -> Self {
         RoundWordE {
             pieces: Some(pieces),
@@ -341,55 +344,63 @@ impl RoundWordE {
         }
     }
 
-    pub fn new_dense(dense_halves: RoundWordDense) -> Self {
+    pub fn new_dense(dense_halves: RoundWordDense<F>) -> Self {
         RoundWordE {
             pieces: None,
             dense_halves,
             spread_halves: None,
         }
     }
+
+    pub fn into_dense(self) -> RoundWordDense<F> {
+        self.dense_halves
+    }
 }
 
 #[derive(Clone, Debug)]
-pub struct RoundWord {
-    dense_halves: RoundWordDense,
-    spread_halves: RoundWordSpread,
+pub struct RoundWord<F: Field> {
+    dense_halves: RoundWordDense<F>,
+    spread_halves: RoundWordSpread<F>,
 }
 
-impl RoundWord {
-    pub fn new(dense_halves: RoundWordDense, spread_halves: RoundWordSpread) -> Self {
+impl<F: Field> RoundWord<F> {
+    pub fn new(dense_halves: RoundWordDense<F>, spread_halves: RoundWordSpread<F>) -> Self {
         RoundWord {
             dense_halves,
             spread_halves,
         }
     }
+
+    pub fn into_dense(self) -> RoundWordDense<F> {
+        self.dense_halves
+    }
 }
 
 /// The internal state for SHA-256.
 #[derive(Clone, Debug)]
-pub struct State {
-    a: Option<StateWord>,
-    b: Option<StateWord>,
-    c: Option<StateWord>,
-    d: Option<StateWord>,
-    e: Option<StateWord>,
-    f: Option<StateWord>,
-    g: Option<StateWord>,
-    h: Option<StateWord>,
+pub struct State<F: Field> {
+    a: Option<StateWord<F>>,
+    b: Option<StateWord<F>>,
+    c: Option<StateWord<F>>,
+    d: Option<StateWord<F>>,
+    e: Option<StateWord<F>>,
+    f: Option<StateWord<F>>,
+    g: Option<StateWord<F>>,
+    h: Option<StateWord<F>>,
 }
 
-impl State {
+impl<F: Field> State<F> {
     #[allow(clippy::many_single_char_names)]
     #[allow(clippy::too_many_arguments)]
     pub fn new(
-        a: StateWord,
-        b: StateWord,
-        c: StateWord,
-        d: StateWord,
-        e: StateWord,
-        f: StateWord,
-        g: StateWord,
-        h: StateWord,
+        a: StateWord<F>,
+        b: StateWord<F>,
+        c: StateWord<F>,
+        d: StateWord<F>,
+        e: StateWord<F>,
+        f: StateWord<F>,
+        g: StateWord<F>,
+        h: StateWord<F>,
     ) -> Self {
         State {
             a: Some(a),
@@ -415,18 +426,58 @@ impl State {
             h: None,
         }
     }
+
+    #[allow(clippy::type_complexity)]
+    pub fn decompose(
+        self,
+    ) -> (
+        RoundWordA<F>,
+        RoundWord<F>,
+        RoundWord<F>,
+        RoundWordDense<F>,
+        RoundWordE<F>,
+        RoundWord<F>,
+        RoundWord<F>,
+        RoundWordDense<F>,
+    ) {
+        compression_util::match_state(self)
+    }
+
+    #[allow(clippy::many_single_char_names)]
+    #[allow(clippy::too_many_arguments)]
+    pub fn composite(
+        a: RoundWordA<F>,
+        b: RoundWord<F>,
+        c: RoundWord<F>,
+        d: RoundWordDense<F>,
+        e: RoundWordE<F>,
+        f: RoundWord<F>,
+        g: RoundWord<F>,
+        h: RoundWordDense<F>,
+    ) -> Self {
+        Self::new(
+            StateWord::A(a),
+            StateWord::B(b),
+            StateWord::C(c),
+            StateWord::D(d),
+            StateWord::E(e),
+            StateWord::F(f),
+            StateWord::G(g),
+            StateWord::H(h),
+        )
+    }
 }
 
 #[derive(Clone, Debug)]
-pub enum StateWord {
-    A(RoundWordA),
-    B(RoundWord),
-    C(RoundWord),
-    D(RoundWordDense),
-    E(RoundWordE),
-    F(RoundWord),
-    G(RoundWord),
-    H(RoundWordDense),
+pub enum StateWord<F: Field> {
+    A(RoundWordA<F>),
+    B(RoundWord<F>),
+    C(RoundWord<F>),
+    D(RoundWordDense<F>),
+    E(RoundWordE<F>),
+    F(RoundWord<F>),
+    G(RoundWord<F>),
+    H(RoundWordDense<F>),
 }
 
 #[derive(Clone, Debug)]
@@ -453,11 +504,11 @@ pub(super) struct CompressionConfig {
     s_digest: Selector,
 }
 
-impl Table16Assignment for CompressionConfig {}
+impl<F: Field> Table16Assignment<F> for CompressionConfig {}
 
 impl CompressionConfig {
-    pub(super) fn configure(
-        meta: &mut ConstraintSystem<pallas::Base>,
+    pub(super) fn configure<F: Field>(
+        meta: &mut ConstraintSystem<F>,
         lookup: SpreadInputs,
         message_schedule: Column<Advice>,
         extras: [Column<Advice>; 6],
@@ -822,22 +873,25 @@ impl CompressionConfig {
         // s_digest for final round
         meta.create_gate("s_digest", |meta| {
             let s_digest = meta.query_selector(s_digest);
-            let lo_0 = meta.query_advice(a_3, Rotation::cur());
-            let hi_0 = meta.query_advice(a_4, Rotation::cur());
-            let word_0 = meta.query_advice(a_5, Rotation::cur());
-            let lo_1 = meta.query_advice(a_6, Rotation::cur());
-            let hi_1 = meta.query_advice(a_7, Rotation::cur());
-            let word_1 = meta.query_advice(a_8, Rotation::cur());
-            let lo_2 = meta.query_advice(a_3, Rotation::next());
-            let hi_2 = meta.query_advice(a_4, Rotation::next());
-            let word_2 = meta.query_advice(a_5, Rotation::next());
-            let lo_3 = meta.query_advice(a_6, Rotation::next());
-            let hi_3 = meta.query_advice(a_7, Rotation::next());
-            let word_3 = meta.query_advice(a_8, Rotation::next());
+            let digest_lo = meta.query_advice(a_1, Rotation::cur());
+            let digest_hi = meta.query_advice(a_1, Rotation::next());
+            let digest_word = meta.query_advice(a_5, Rotation::cur());
+            let final_lo = meta.query_advice(a_3, Rotation::cur());
+            let final_hi = meta.query_advice(a_3, Rotation::next());
+            let initial_lo = meta.query_advice(a_6, Rotation::cur());
+            let initial_hi = meta.query_advice(a_6, Rotation::next());
+            let digest_carry = meta.query_advice(a_8, Rotation::cur());
 
             CompressionGate::s_digest(
-                s_digest, lo_0, hi_0, word_0, lo_1, hi_1, word_1, lo_2, hi_2, word_2, lo_3, hi_3,
-                word_3,
+                s_digest,
+                digest_lo,
+                digest_hi,
+                digest_word,
+                final_lo,
+                final_hi,
+                initial_lo,
+                initial_hi,
+                digest_carry,
             )
         });
 
@@ -861,11 +915,11 @@ impl CompressionConfig {
 
     /// Initialize compression with a constant Initialization Vector of 32-byte words.
     /// Returns an initialized state.
-    pub(super) fn initialize_with_iv(
+    pub(super) fn initialize_with_iv<F: Field>(
         &self,
-        layouter: &mut impl Layouter<pallas::Base>,
+        layouter: &mut impl Layouter<F>,
         init_state: [u32; STATE],
-    ) -> Result<State, Error> {
+    ) -> Result<State<F>, Error> {
         let mut new_state = State::empty_state();
         layouter.assign_region(
             || "initialize_with_iv",
@@ -877,18 +931,17 @@ impl CompressionConfig {
         Ok(new_state)
     }
 
-    /// Initialize compression with some initialized state. This could be a state
-    /// output from a previous compression round.
-    pub(super) fn initialize_with_state(
+    /// Initialize compression with the minimun assignment of state cell.
+    pub(crate) fn initialize<F: Field>(
         &self,
-        layouter: &mut impl Layouter<pallas::Base>,
-        init_state: State,
-    ) -> Result<State, Error> {
+        layouter: &mut impl Layouter<F>,
+        init_state_assigned: [RoundWordDense<F>; STATE],
+    ) -> Result<State<F>, Error> {
         let mut new_state = State::empty_state();
         layouter.assign_region(
             || "initialize_with_state",
             |mut region| {
-                new_state = self.initialize_state(&mut region, init_state.clone())?;
+                new_state = self.initialize_state(&mut region, init_state_assigned.clone())?;
                 Ok(())
             },
         )?;
@@ -896,12 +949,12 @@ impl CompressionConfig {
     }
 
     /// Given an initialized state and a message schedule, perform 64 compression rounds.
-    pub(super) fn compress(
+    pub(super) fn compress<F: Field>(
         &self,
-        layouter: &mut impl Layouter<pallas::Base>,
-        initialized_state: State,
-        w_halves: [(AssignedBits<16>, AssignedBits<16>); ROUNDS],
-    ) -> Result<State, Error> {
+        layouter: &mut impl Layouter<F>,
+        initialized_state: State<F>,
+        w_halves: [(AssignedBits<F, 16>, AssignedBits<F, 16>); ROUNDS],
+    ) -> Result<State<F>, Error> {
         let mut state = State::empty_state();
         layouter.assign_region(
             || "compress",
@@ -917,21 +970,22 @@ impl CompressionConfig {
     }
 
     /// After the final round, convert the state into the final digest.
-    pub(super) fn digest(
+    pub(super) fn digest<F: Field>(
         &self,
-        layouter: &mut impl Layouter<pallas::Base>,
-        state: State,
-    ) -> Result<[BlockWord; DIGEST_SIZE], Error> {
-        let mut digest = [BlockWord(Value::known(0)); DIGEST_SIZE];
+        layouter: &mut impl Layouter<F>,
+        last_compress_state: State<F>,
+        initial_state: State<F>,
+    ) -> Result<[RoundWordDense<F>; STATE], Error> {
         layouter.assign_region(
             || "digest",
             |mut region| {
-                digest = self.assign_digest(&mut region, state.clone())?;
-
-                Ok(())
+                self.complete_digest(
+                    &mut region,
+                    last_compress_state.clone(),
+                    initial_state.clone(),
+                )
             },
-        )?;
-        Ok(digest)
+        )
     }
 }
 
@@ -980,15 +1034,17 @@ mod tests {
                 let compression = config.compression.clone();
                 let initial_state = compression.initialize_with_iv(&mut layouter, IV)?;
 
-                let state = config
-                    .compression
-                    .compress(&mut layouter, initial_state, w_halves)?;
+                let state =
+                    config
+                        .compression
+                        .compress(&mut layouter, initial_state.clone(), w_halves)?;
 
-                let digest = config.compression.digest(&mut layouter, state)?;
+                let digest = config
+                    .compression
+                    .digest(&mut layouter, state, initial_state)?;
                 for (idx, digest_word) in digest.iter().enumerate() {
-                    digest_word.0.assert_if_known(|digest_word| {
-                        (*digest_word as u64 + IV[idx] as u64) as u32
-                            == super::compression_util::COMPRESSION_OUTPUT[idx]
+                    digest_word.value().assert_if_known(|digest_word| {
+                        *digest_word == super::compression_util::COMPRESSION_OUTPUT[idx]
                     });
                 }
 
@@ -1000,7 +1056,7 @@ mod tests {
 
         let prover = match MockProver::<pallas::Base>::run(17, &circuit, vec![]) {
             Ok(prover) => prover,
-            Err(e) => panic!("{:?}", e),
+            Err(e) => panic!("{e:?}"),
         };
         assert_eq!(prover.verify(), Ok(()));
     }
diff --git a/halo2_gadgets/src/sha256/table16/compression/compression_gates.rs b/halo2_gadgets/src/sha256/table16/compression/compression_gates.rs
index 1cf6a605d7..2828a49182 100644
--- a/halo2_gadgets/src/sha256/table16/compression/compression_gates.rs
+++ b/halo2_gadgets/src/sha256/table16/compression/compression_gates.rs
@@ -1,4 +1,5 @@
 use super::super::{util::*, Gate};
+use crate::utilities::range_check;
 use ff::PrimeField;
 use halo2_proofs::plonk::{Constraint, Constraints, Expression};
 use std::marker::PhantomData;
@@ -412,30 +413,28 @@ impl<F: PrimeField> CompressionGate<F> {
     #[allow(clippy::too_many_arguments)]
     pub fn s_digest(
         s_digest: Expression<F>,
-        lo_0: Expression<F>,
-        hi_0: Expression<F>,
-        word_0: Expression<F>,
-        lo_1: Expression<F>,
-        hi_1: Expression<F>,
-        word_1: Expression<F>,
-        lo_2: Expression<F>,
-        hi_2: Expression<F>,
-        word_2: Expression<F>,
-        lo_3: Expression<F>,
-        hi_3: Expression<F>,
-        word_3: Expression<F>,
+        digest_lo: Expression<F>,
+        digest_hi: Expression<F>,
+        digest_word: Expression<F>,
+        final_lo: Expression<F>,
+        final_hi: Expression<F>,
+        initial_lo: Expression<F>,
+        initial_hi: Expression<F>,
+        digest_carry: Expression<F>,
     ) -> impl IntoIterator<Item = Constraint<F>> {
-        let check_lo_hi = |lo: Expression<F>, hi: Expression<F>, word: Expression<F>| {
-            lo + hi * F::from(1 << 16) - word
-        };
+        let check_lo_hi = digest_lo.clone() + digest_hi.clone() * F::from(1 << 16) - digest_word;
+
+        let check =
+            digest_carry.clone() * F::from(1 << 32) + digest_hi * F::from(1 << 16) + digest_lo
+                - (final_hi + initial_hi) * F::from(1 << 16)
+                - (final_lo + initial_lo);
 
         Constraints::with_selector(
             s_digest,
             [
-                ("check_lo_hi_0", check_lo_hi(lo_0, hi_0, word_0)),
-                ("check_lo_hi_1", check_lo_hi(lo_1, hi_1, word_1)),
-                ("check_lo_hi_2", check_lo_hi(lo_2, hi_2, word_2)),
-                ("check_lo_hi_3", check_lo_hi(lo_3, hi_3, word_3)),
+                ("check digest lo_hi", check_lo_hi),
+                ("digest check", check),
+                ("check carry bit", range_check(digest_carry, 2)),
             ],
         )
     }
diff --git a/halo2_gadgets/src/sha256/table16/compression/compression_util.rs b/halo2_gadgets/src/sha256/table16/compression/compression_util.rs
index 99706023df..caa0fd7c5f 100644
--- a/halo2_gadgets/src/sha256/table16/compression/compression_util.rs
+++ b/halo2_gadgets/src/sha256/table16/compression/compression_util.rs
@@ -1,15 +1,12 @@
+use super::super::{util::*, AssignedBits, SpreadVar, SpreadWord, StateWord, Table16Assignment};
 use super::{
-    AbcdVar, CompressionConfig, EfghVar, RoundWord, RoundWordA, RoundWordDense, RoundWordE,
+    AbcdVar, CompressionConfig, EfghVar, Field, RoundWord, RoundWordA, RoundWordDense, RoundWordE,
     RoundWordSpread, State, UpperSigmaVar,
 };
-use crate::sha256::table16::{
-    util::*, AssignedBits, SpreadVar, SpreadWord, StateWord, Table16Assignment,
-};
 use halo2_proofs::{
     circuit::{Region, Value},
     plonk::{Advice, Column, Error},
 };
-use halo2curves::pasta::pallas;
 use std::convert::TryInto;
 
 // Test vector 'abc'
@@ -190,21 +187,17 @@ pub fn get_a_new_row(round_idx: MainRoundIdx) -> usize {
     get_maj_row(round_idx)
 }
 
-pub fn get_digest_abcd_row() -> usize {
+pub fn get_digest_first_row() -> usize {
     SUBREGION_MAIN_ROWS
 }
 
-pub fn get_digest_efgh_row() -> usize {
-    get_digest_abcd_row() + 2
-}
-
 impl CompressionConfig {
-    pub(super) fn decompose_abcd(
+    pub(super) fn decompose_abcd<F: Field>(
         &self,
-        region: &mut Region<'_, pallas::Base>,
+        region: &mut Region<'_, F>,
         row: usize,
         val: Value<u32>,
-    ) -> Result<AbcdVar, Error> {
+    ) -> Result<AbcdVar<F>, Error> {
         self.s_decompose_abcd.enable(region, row)?;
 
         let a_3 = self.extras[0];
@@ -212,7 +205,7 @@ impl CompressionConfig {
         let a_5 = self.message_schedule;
         let a_6 = self.extras[2];
 
-        let spread_pieces = val.map(AbcdVar::pieces);
+        let spread_pieces = val.map(AbcdVar::<F>::pieces);
         let spread_pieces = spread_pieces.transpose_vec(6);
 
         let a = SpreadVar::without_lookup(
@@ -270,12 +263,12 @@ impl CompressionConfig {
         })
     }
 
-    pub(super) fn decompose_efgh(
+    pub(super) fn decompose_efgh<F: Field>(
         &self,
-        region: &mut Region<'_, pallas::Base>,
+        region: &mut Region<'_, F>,
         row: usize,
         val: Value<u32>,
-    ) -> Result<EfghVar, Error> {
+    ) -> Result<EfghVar<F>, Error> {
         self.s_decompose_efgh.enable(region, row)?;
 
         let a_3 = self.extras[0];
@@ -283,7 +276,7 @@ impl CompressionConfig {
         let a_5 = self.message_schedule;
         let a_6 = self.extras[2];
 
-        let spread_pieces = val.map(EfghVar::pieces);
+        let spread_pieces = val.map(EfghVar::<F>::pieces);
         let spread_pieces = spread_pieces.transpose_vec(6);
 
         let a_lo = SpreadVar::without_lookup(
@@ -341,12 +334,12 @@ impl CompressionConfig {
         })
     }
 
-    pub(super) fn decompose_a(
+    pub(super) fn decompose_a<F: Field>(
         &self,
-        region: &mut Region<'_, pallas::Base>,
+        region: &mut Region<'_, F>,
         round_idx: RoundIdx,
         a_val: Value<u32>,
-    ) -> Result<RoundWordA, Error> {
+    ) -> Result<RoundWordA<F>, Error> {
         let row = get_decompose_a_row(round_idx);
 
         let (dense_halves, spread_halves) = self.assign_word_halves(region, row, a_val)?;
@@ -354,12 +347,12 @@ impl CompressionConfig {
         Ok(RoundWordA::new(a_pieces, dense_halves, spread_halves))
     }
 
-    pub(super) fn decompose_e(
+    pub(super) fn decompose_e<F: Field>(
         &self,
-        region: &mut Region<'_, pallas::Base>,
+        region: &mut Region<'_, F>,
         round_idx: RoundIdx,
         e_val: Value<u32>,
-    ) -> Result<RoundWordE, Error> {
+    ) -> Result<RoundWordE<F>, Error> {
         let row = get_decompose_e_row(round_idx);
 
         let (dense_halves, spread_halves) = self.assign_word_halves(region, row, e_val)?;
@@ -367,12 +360,12 @@ impl CompressionConfig {
         Ok(RoundWordE::new(e_pieces, dense_halves, spread_halves))
     }
 
-    pub(super) fn assign_upper_sigma_0(
+    pub(super) fn assign_upper_sigma_0<F: Field>(
         &self,
-        region: &mut Region<'_, pallas::Base>,
+        region: &mut Region<'_, F>,
         round_idx: MainRoundIdx,
-        word: AbcdVar,
-    ) -> Result<(AssignedBits<16>, AssignedBits<16>), Error> {
+        word: AbcdVar<F>,
+    ) -> Result<(AssignedBits<F, 16>, AssignedBits<F, 16>), Error> {
         // Rename these here for ease of matching the gates to the specification.
         let a_3 = self.extras[0];
         let a_4 = self.extras[1];
@@ -425,12 +418,12 @@ impl CompressionConfig {
         )
     }
 
-    pub(super) fn assign_upper_sigma_1(
+    pub(super) fn assign_upper_sigma_1<F: Field>(
         &self,
-        region: &mut Region<'_, pallas::Base>,
+        region: &mut Region<'_, F>,
         round_idx: MainRoundIdx,
-        word: EfghVar,
-    ) -> Result<(AssignedBits<16>, AssignedBits<16>), Error> {
+        word: EfghVar<F>,
+    ) -> Result<(AssignedBits<F, 16>, AssignedBits<F, 16>), Error> {
         // Rename these here for ease of matching the gates to the specification.
         let a_3 = self.extras[0];
         let a_4 = self.extras[1];
@@ -484,15 +477,15 @@ impl CompressionConfig {
         )
     }
 
-    fn assign_ch_outputs(
+    fn assign_ch_outputs<F: Field>(
         &self,
-        region: &mut Region<'_, pallas::Base>,
+        region: &mut Region<'_, F>,
         row: usize,
         r_0_even: Value<[bool; 16]>,
         r_0_odd: Value<[bool; 16]>,
         r_1_even: Value<[bool; 16]>,
         r_1_odd: Value<[bool; 16]>,
-    ) -> Result<(AssignedBits<16>, AssignedBits<16>), Error> {
+    ) -> Result<(AssignedBits<F, 16>, AssignedBits<F, 16>), Error> {
         let a_3 = self.extras[0];
 
         let (_even, odd) = self.assign_spread_outputs(
@@ -509,13 +502,13 @@ impl CompressionConfig {
         Ok(odd)
     }
 
-    pub(super) fn assign_ch(
+    pub(super) fn assign_ch<F: Field>(
         &self,
-        region: &mut Region<'_, pallas::Base>,
+        region: &mut Region<'_, F>,
         round_idx: MainRoundIdx,
-        spread_halves_e: RoundWordSpread,
-        spread_halves_f: RoundWordSpread,
-    ) -> Result<(AssignedBits<16>, AssignedBits<16>), Error> {
+        spread_halves_e: RoundWordSpread<F>,
+        spread_halves_f: RoundWordSpread<F>,
+    ) -> Result<(AssignedBits<F, 16>, AssignedBits<F, 16>), Error> {
         let a_3 = self.extras[0];
         let a_4 = self.extras[1];
 
@@ -555,13 +548,13 @@ impl CompressionConfig {
         self.assign_ch_outputs(region, row, p_0_even, p_0_odd, p_1_even, p_1_odd)
     }
 
-    pub(super) fn assign_ch_neg(
+    pub(super) fn assign_ch_neg<F: Field>(
         &self,
-        region: &mut Region<'_, pallas::Base>,
+        region: &mut Region<'_, F>,
         round_idx: MainRoundIdx,
-        spread_halves_e: RoundWordSpread,
-        spread_halves_g: RoundWordSpread,
-    ) -> Result<(AssignedBits<16>, AssignedBits<16>), Error> {
+        spread_halves_e: RoundWordSpread<F>,
+        spread_halves_g: RoundWordSpread<F>,
+    ) -> Result<(AssignedBits<F, 16>, AssignedBits<F, 16>), Error> {
         let row = get_ch_neg_row(round_idx);
 
         self.s_ch_neg.enable(region, row)?;
@@ -592,7 +585,7 @@ impl CompressionConfig {
             .value()
             .map(|spread_e_lo| negate_spread(spread_e_lo.0));
         // Assign spread_neg_e_lo
-        AssignedBits::<32>::assign_bits(
+        AssignedBits::<F, 32>::assign_bits(
             region,
             || "spread_neg_e_lo",
             a_3,
@@ -606,7 +599,7 @@ impl CompressionConfig {
             .value()
             .map(|spread_e_hi| negate_spread(spread_e_hi.0));
         // Assign spread_neg_e_hi
-        AssignedBits::<32>::assign_bits(
+        AssignedBits::<F, 32>::assign_bits(
             region,
             || "spread_neg_e_hi",
             a_4,
@@ -634,15 +627,15 @@ impl CompressionConfig {
         self.assign_ch_outputs(region, row, p_0_even, p_0_odd, p_1_even, p_1_odd)
     }
 
-    fn assign_maj_outputs(
+    fn assign_maj_outputs<F: Field>(
         &self,
-        region: &mut Region<'_, pallas::Base>,
+        region: &mut Region<'_, F>,
         row: usize,
         r_0_even: Value<[bool; 16]>,
         r_0_odd: Value<[bool; 16]>,
         r_1_even: Value<[bool; 16]>,
         r_1_odd: Value<[bool; 16]>,
-    ) -> Result<(AssignedBits<16>, AssignedBits<16>), Error> {
+    ) -> Result<(AssignedBits<F, 16>, AssignedBits<F, 16>), Error> {
         let a_3 = self.extras[0];
         let (_even, odd) = self.assign_spread_outputs(
             region,
@@ -658,14 +651,14 @@ impl CompressionConfig {
         Ok(odd)
     }
 
-    pub(super) fn assign_maj(
+    pub(super) fn assign_maj<F: Field>(
         &self,
-        region: &mut Region<'_, pallas::Base>,
+        region: &mut Region<'_, F>,
         round_idx: MainRoundIdx,
-        spread_halves_a: RoundWordSpread,
-        spread_halves_b: RoundWordSpread,
-        spread_halves_c: RoundWordSpread,
-    ) -> Result<(AssignedBits<16>, AssignedBits<16>), Error> {
+        spread_halves_a: RoundWordSpread<F>,
+        spread_halves_b: RoundWordSpread<F>,
+        spread_halves_c: RoundWordSpread<F>,
+    ) -> Result<(AssignedBits<F, 16>, AssignedBits<F, 16>), Error> {
         let a_4 = self.extras[1];
         let a_5 = self.message_schedule;
 
@@ -716,17 +709,17 @@ impl CompressionConfig {
 
     // s_h_prime to get H' = H + Ch(E, F, G) + s_upper_sigma_1(E) + K + W
     #[allow(clippy::too_many_arguments)]
-    pub(super) fn assign_h_prime(
+    pub(super) fn assign_h_prime<F: Field>(
         &self,
-        region: &mut Region<'_, pallas::Base>,
+        region: &mut Region<'_, F>,
         round_idx: MainRoundIdx,
-        h: RoundWordDense,
-        ch: (AssignedBits<16>, AssignedBits<16>),
-        ch_neg: (AssignedBits<16>, AssignedBits<16>),
-        sigma_1: (AssignedBits<16>, AssignedBits<16>),
+        h: RoundWordDense<F>,
+        ch: (AssignedBits<F, 16>, AssignedBits<F, 16>),
+        ch_neg: (AssignedBits<F, 16>, AssignedBits<F, 16>),
+        sigma_1: (AssignedBits<F, 16>, AssignedBits<F, 16>),
         k: u32,
-        w: &(AssignedBits<16>, AssignedBits<16>),
-    ) -> Result<RoundWordDense, Error> {
+        w: &(AssignedBits<F, 16>, AssignedBits<F, 16>),
+    ) -> Result<RoundWordDense<F>, Error> {
         let row = get_h_prime_row(round_idx);
         self.s_h_prime.enable(region, row)?;
 
@@ -750,8 +743,14 @@ impl CompressionConfig {
         let k_lo: [bool; 16] = k[..16].try_into().unwrap();
         let k_hi: [bool; 16] = k[16..].try_into().unwrap();
         {
-            AssignedBits::<16>::assign_bits(region, || "k_lo", a_6, row - 1, Value::known(k_lo))?;
-            AssignedBits::<16>::assign_bits(region, || "k_hi", a_6, row, Value::known(k_hi))?;
+            AssignedBits::<F, 16>::assign_bits(
+                region,
+                || "k_lo",
+                a_6,
+                row - 1,
+                Value::known(k_lo),
+            )?;
+            AssignedBits::<F, 16>::assign_bits(region, || "k_hi", a_6, row, Value::known(k_hi))?;
         }
 
         // Assign and copy w
@@ -783,30 +782,40 @@ impl CompressionConfig {
                 || "h_prime_carry",
                 a_9,
                 row + 1,
-                || h_prime_carry.map(pallas::Base::from),
+                || h_prime_carry.map(|value| F::from(value)),
             )?;
 
             let h_prime: Value<[bool; 32]> = h_prime.map(|w| i2lebsp(w.into()));
             let h_prime_lo: Value<[bool; 16]> = h_prime.map(|w| w[..16].try_into().unwrap());
             let h_prime_hi: Value<[bool; 16]> = h_prime.map(|w| w[16..].try_into().unwrap());
 
-            let h_prime_lo =
-                AssignedBits::<16>::assign_bits(region, || "h_prime_lo", a_7, row + 1, h_prime_lo)?;
-            let h_prime_hi =
-                AssignedBits::<16>::assign_bits(region, || "h_prime_hi", a_8, row + 1, h_prime_hi)?;
+            let h_prime_lo = AssignedBits::<F, 16>::assign_bits(
+                region,
+                || "h_prime_lo",
+                a_7,
+                row + 1,
+                h_prime_lo,
+            )?;
+            let h_prime_hi = AssignedBits::<F, 16>::assign_bits(
+                region,
+                || "h_prime_hi",
+                a_8,
+                row + 1,
+                h_prime_hi,
+            )?;
 
             Ok((h_prime_lo, h_prime_hi).into())
         }
     }
 
     // s_e_new to get E_new = H' + D
-    pub(super) fn assign_e_new(
+    pub(super) fn assign_e_new<F: Field>(
         &self,
-        region: &mut Region<'_, pallas::Base>,
+        region: &mut Region<'_, F>,
         round_idx: MainRoundIdx,
-        d: &RoundWordDense,
-        h_prime: &RoundWordDense,
-    ) -> Result<RoundWordDense, Error> {
+        d: &RoundWordDense<F>,
+        h_prime: &RoundWordDense<F>,
+    ) -> Result<RoundWordDense<F>, Error> {
         let row = get_e_new_row(round_idx);
 
         self.s_e_new.enable(region, row)?;
@@ -826,25 +835,20 @@ impl CompressionConfig {
         ]);
 
         let e_new_dense = self.assign_word_halves_dense(region, row, a_8, row + 1, a_8, e_new)?;
-        region.assign_advice(
-            || "e_new_carry",
-            a_9,
-            row + 1,
-            || e_new_carry.map(pallas::Base::from),
-        )?;
+        region.assign_advice(|| "e_new_carry", a_9, row + 1, || e_new_carry.map(F::from))?;
 
         Ok(e_new_dense)
     }
 
     // s_a_new to get A_new = H' + Maj(A, B, C) + s_upper_sigma_0(A)
-    pub(super) fn assign_a_new(
+    pub(super) fn assign_a_new<F: Field>(
         &self,
-        region: &mut Region<'_, pallas::Base>,
+        region: &mut Region<'_, F>,
         round_idx: MainRoundIdx,
-        maj: (AssignedBits<16>, AssignedBits<16>),
-        sigma_0: (AssignedBits<16>, AssignedBits<16>),
-        h_prime: RoundWordDense,
-    ) -> Result<RoundWordDense, Error> {
+        maj: (AssignedBits<F, 16>, AssignedBits<F, 16>),
+        sigma_0: (AssignedBits<F, 16>, AssignedBits<F, 16>),
+        h_prime: RoundWordDense<F>,
+    ) -> Result<RoundWordDense<F>, Error> {
         let row = get_a_new_row(round_idx);
 
         self.s_a_new.enable(region, row)?;
@@ -880,35 +884,30 @@ impl CompressionConfig {
         ]);
 
         let a_new_dense = self.assign_word_halves_dense(region, row, a_8, row + 1, a_8, a_new)?;
-        region.assign_advice(
-            || "a_new_carry",
-            a_9,
-            row,
-            || a_new_carry.map(pallas::Base::from),
-        )?;
+        region.assign_advice(|| "a_new_carry", a_9, row, || a_new_carry.map(F::from))?;
 
         Ok(a_new_dense)
     }
 
-    pub fn assign_word_halves_dense(
+    pub fn assign_word_halves_dense<F: Field>(
         &self,
-        region: &mut Region<'_, pallas::Base>,
+        region: &mut Region<'_, F>,
         lo_row: usize,
         lo_col: Column<Advice>,
         hi_row: usize,
         hi_col: Column<Advice>,
         word: Value<u32>,
-    ) -> Result<RoundWordDense, Error> {
+    ) -> Result<RoundWordDense<F>, Error> {
         let word: Value<[bool; 32]> = word.map(|w| i2lebsp(w.into()));
 
         let lo = {
             let lo: Value<[bool; 16]> = word.map(|w| w[..16].try_into().unwrap());
-            AssignedBits::<16>::assign_bits(region, || "lo", lo_col, lo_row, lo)?
+            AssignedBits::<F, 16>::assign_bits(region, || "lo", lo_col, lo_row, lo)?
         };
 
         let hi = {
             let hi: Value<[bool; 16]> = word.map(|w| w[16..].try_into().unwrap());
-            AssignedBits::<16>::assign_bits(region, || "hi", hi_col, hi_row, hi)?
+            AssignedBits::<F, 16>::assign_bits(region, || "hi", hi_col, hi_row, hi)?
         };
 
         Ok((lo, hi).into())
@@ -916,12 +915,12 @@ impl CompressionConfig {
 
     // Assign hi and lo halves for both dense and spread versions of a word
     #[allow(clippy::type_complexity)]
-    pub fn assign_word_halves(
+    pub fn assign_word_halves<F: Field>(
         &self,
-        region: &mut Region<'_, pallas::Base>,
+        region: &mut Region<'_, F>,
         row: usize,
         word: Value<u32>,
-    ) -> Result<(RoundWordDense, RoundWordSpread), Error> {
+    ) -> Result<(RoundWordDense<F>, RoundWordSpread<F>), Error> {
         // Rename these here for ease of matching the gates to the specification.
         let a_7 = self.extras[3];
         let a_8 = self.extras[4];
@@ -942,17 +941,18 @@ impl CompressionConfig {
 }
 
 #[allow(clippy::many_single_char_names)]
-pub fn match_state(
-    state: State,
+#[allow(clippy::type_complexity)]
+pub fn match_state<F: Field>(
+    state: State<F>,
 ) -> (
-    RoundWordA,
-    RoundWord,
-    RoundWord,
-    RoundWordDense,
-    RoundWordE,
-    RoundWord,
-    RoundWord,
-    RoundWordDense,
+    RoundWordA<F>,
+    RoundWord<F>,
+    RoundWord<F>,
+    RoundWordDense<F>,
+    RoundWordE<F>,
+    RoundWord<F>,
+    RoundWord<F>,
+    RoundWordDense<F>,
 ) {
     let a = match state.a {
         Some(StateWord::A(a)) => a,
diff --git a/halo2_gadgets/src/sha256/table16/compression/subregion_digest.rs b/halo2_gadgets/src/sha256/table16/compression/subregion_digest.rs
index aa30f80af7..a22c8cd676 100644
--- a/halo2_gadgets/src/sha256/table16/compression/subregion_digest.rs
+++ b/halo2_gadgets/src/sha256/table16/compression/subregion_digest.rs
@@ -1,102 +1,180 @@
-use super::super::{super::DIGEST_SIZE, BlockWord, RoundWordDense};
-use super::{compression_util::*, CompressionConfig, State};
-use halo2_proofs::{
-    circuit::{Region, Value},
-    plonk::{Advice, Column, Error},
+use super::super::util::{i2lebsp, sum_with_carry};
+use super::{
+    super::{AssignedBits, RoundWordDense, SpreadVar, SpreadWord, STATE},
+    compression_util::*,
+    CompressionConfig, Field, State,
 };
-use halo2curves::pasta::pallas;
+use halo2_proofs::{circuit::Region, plonk::Error};
 
 impl CompressionConfig {
+    // #[allow(clippy::many_single_char_names)]
+    // pub fn assign_digest<F: Field>(
+    //     &self,
+    //     region: &mut Region<'_, F>,
+    //     state: State<F>,
+    // ) -> Result<[BlockWord; DIGEST_SIZE], Error> {
+    //     let a_3 = self.extras[0];
+    //     let a_4 = self.extras[1];
+    //     let a_5 = self.message_schedule;
+    //     let a_6 = self.extras[2];
+    //     let a_7 = self.extras[3];
+    //     let a_8 = self.extras[4];
+
+    //     let (a, b, c, d, e, f, g, h) = match_state(state);
+
+    //     let abcd_row = 0;
+    //     self.s_digest.enable(region, abcd_row)?;
+    //     let efgh_row = abcd_row + 2;
+    //     self.s_digest.enable(region, efgh_row)?;
+
+    //     // Assign digest for A, B, C, D
+    //     a.dense_halves
+    //         .0
+    //         .copy_advice(|| "a_lo", region, a_3, abcd_row)?;
+    //     a.dense_halves
+    //         .1
+    //         .copy_advice(|| "a_hi", region, a_4, abcd_row)?;
+    //     let a = a.dense_halves.value();
+    //     region.assign_advice(|| "a", a_5, abcd_row, || a.map(|a| F::from(a as u64)))?;
+
+    //     let b = self.assign_digest_word(region, abcd_row, a_6, a_7, a_8, b.dense_halves)?;
+    //     let c = self.assign_digest_word(region, abcd_row + 1, a_3, a_4, a_5, c.dense_halves)?;
+    //     let d = self.assign_digest_word(region, abcd_row + 1, a_6, a_7, a_8, d)?;
+
+    //     // Assign digest for E, F, G, H
+    //     e.dense_halves
+    //         .0
+    //         .copy_advice(|| "e_lo", region, a_3, efgh_row)?;
+    //     e.dense_halves
+    //         .1
+    //         .copy_advice(|| "e_hi", region, a_4, efgh_row)?;
+    //     let e = e.dense_halves.value();
+    //     region.assign_advice(|| "e", a_5, efgh_row, || e.map(|e| F::from(e as u64)))?;
+
+    //     let f = self.assign_digest_word(region, efgh_row, a_6, a_7, a_8, f.dense_halves)?;
+    //     let g = self.assign_digest_word(region, efgh_row + 1, a_3, a_4, a_5, g.dense_halves)?;
+    //     let h = self.assign_digest_word(region, efgh_row + 1, a_6, a_7, a_8, h)?;
+
+    //     Ok([
+    //         BlockWord(a),
+    //         BlockWord(b),
+    //         BlockWord(c),
+    //         BlockWord(d),
+    //         BlockWord(e),
+    //         BlockWord(f),
+    //         BlockWord(g),
+    //         BlockWord(h),
+    //     ])
+    // }
+
+    // fn assign_digest_word<F: Field>(
+    //     &self,
+    //     region: &mut Region<'_, F>,
+    //     row: usize,
+    //     lo_col: Column<Advice>,
+    //     hi_col: Column<Advice>,
+    //     word_col: Column<Advice>,
+    //     dense_halves: RoundWordDense<F>,
+    // ) -> Result<Value<u32>, Error> {
+    //     dense_halves.0.copy_advice(|| "lo", region, lo_col, row)?;
+    //     dense_halves.1.copy_advice(|| "hi", region, hi_col, row)?;
+
+    //     let val = dense_halves.value();
+    //     region.assign_advice(
+    //         || "word",
+    //         word_col,
+    //         row,
+    //         || val.map(|val| F::from(val as u64)),
+    //     )?;
+
+    //     Ok(val)
+    // }
+
     #[allow(clippy::many_single_char_names)]
-    pub fn assign_digest(
+    pub fn complete_digest<F: Field>(
         &self,
-        region: &mut Region<'_, pallas::Base>,
-        state: State,
-    ) -> Result<[BlockWord; DIGEST_SIZE], Error> {
+        region: &mut Region<'_, F>,
+        last_compress_state: State<F>,
+        initial_state: State<F>,
+    ) -> Result<[RoundWordDense<F>; STATE], Error> {
         let a_3 = self.extras[0];
-        let a_4 = self.extras[1];
         let a_5 = self.message_schedule;
         let a_6 = self.extras[2];
-        let a_7 = self.extras[3];
         let a_8 = self.extras[4];
 
-        let (a, b, c, d, e, f, g, h) = match_state(state);
-
-        let abcd_row = 0;
-        self.s_digest.enable(region, abcd_row)?;
-        let efgh_row = abcd_row + 2;
-        self.s_digest.enable(region, efgh_row)?;
-
-        // Assign digest for A, B, C, D
-        a.dense_halves
-            .0
-            .copy_advice(|| "a_lo", region, a_3, abcd_row)?;
-        a.dense_halves
-            .1
-            .copy_advice(|| "a_hi", region, a_4, abcd_row)?;
-        let a = a.dense_halves.value();
-        region.assign_advice(
-            || "a",
-            a_5,
-            abcd_row,
-            || a.map(|a| pallas::Base::from(a as u64)),
-        )?;
-
-        let b = self.assign_digest_word(region, abcd_row, a_6, a_7, a_8, b.dense_halves)?;
-        let c = self.assign_digest_word(region, abcd_row + 1, a_3, a_4, a_5, c.dense_halves)?;
-        let d = self.assign_digest_word(region, abcd_row + 1, a_6, a_7, a_8, d)?;
-
-        // Assign digest for E, F, G, H
-        e.dense_halves
-            .0
-            .copy_advice(|| "e_lo", region, a_3, efgh_row)?;
-        e.dense_halves
-            .1
-            .copy_advice(|| "e_hi", region, a_4, efgh_row)?;
-        let e = e.dense_halves.value();
-        region.assign_advice(
-            || "e",
-            a_5,
-            efgh_row,
-            || e.map(|e| pallas::Base::from(e as u64)),
-        )?;
-
-        let f = self.assign_digest_word(region, efgh_row, a_6, a_7, a_8, f.dense_halves)?;
-        let g = self.assign_digest_word(region, efgh_row + 1, a_3, a_4, a_5, g.dense_halves)?;
-        let h = self.assign_digest_word(region, efgh_row + 1, a_6, a_7, a_8, h)?;
-
-        Ok([
-            BlockWord(a),
-            BlockWord(b),
-            BlockWord(c),
-            BlockWord(d),
-            BlockWord(e),
-            BlockWord(f),
-            BlockWord(g),
-            BlockWord(h),
+        let (a, b, c, d, e, f, g, h) = match_state(last_compress_state);
+        let (a_i, b_i, c_i, d_i, e_i, f_i, g_i, h_i) = match_state(initial_state);
+
+        let mut digest_dense = Vec::new();
+        for (i, (final_dense, init_dense)) in [
+            a.dense_halves,
+            b.dense_halves,
+            c.dense_halves,
+            d,
+            e.dense_halves,
+            f.dense_halves,
+            g.dense_halves,
+            h,
+        ]
+        .into_iter()
+        .zip([
+            a_i.dense_halves,
+            b_i.dense_halves,
+            c_i.dense_halves,
+            d_i,
+            e_i.dense_halves,
+            f_i.dense_halves,
+            g_i.dense_halves,
+            h_i,
         ])
-    }
+        .enumerate()
+        {
+            let row = i * 2;
+            self.s_digest.enable(region, row)?;
+            let (final_lo, final_hi) = final_dense.decompose();
+            let (init_lo, init_hi) = init_dense.decompose();
 
-    fn assign_digest_word(
-        &self,
-        region: &mut Region<'_, pallas::Base>,
-        row: usize,
-        lo_col: Column<Advice>,
-        hi_col: Column<Advice>,
-        word_col: Column<Advice>,
-        dense_halves: RoundWordDense,
-    ) -> Result<Value<u32>, Error> {
-        dense_halves.0.copy_advice(|| "lo", region, lo_col, row)?;
-        dense_halves.1.copy_advice(|| "hi", region, hi_col, row)?;
-
-        let val = dense_halves.value();
-        region.assign_advice(
-            || "word",
-            word_col,
-            row,
-            || val.map(|val| pallas::Base::from(val as u64)),
-        )?;
-
-        Ok(val)
+            let (digest, carry) = sum_with_carry(vec![
+                (final_lo.value_u16(), final_hi.value_u16()),
+                (init_lo.value_u16(), init_hi.value_u16()),
+            ]);
+
+            region.assign_advice(|| "digest carry", a_8, row, || carry.map(F::from))?;
+            region.assign_advice(
+                || "digest word",
+                a_5,
+                row,
+                || digest.map(|v| F::from(v as u64)),
+            )?;
+
+            final_lo.copy_advice(|| "final lo", region, a_3, row)?;
+            final_hi.copy_advice(|| "final hi", region, a_3, row + 1)?;
+            init_lo.copy_advice(|| "init lo", region, a_6, row)?;
+            init_hi.copy_advice(|| "init hi", region, a_6, row + 1)?;
+
+            let word = digest.map(|w| i2lebsp(w.into()));
+            let digest_lo = word.map(|w: [bool; 32]| w[..16].try_into().unwrap());
+            let digest_hi = word.map(|w| w[16..].try_into().unwrap());
+
+            let digest_lo = SpreadVar::with_lookup(
+                region,
+                &self.lookup,
+                row,
+                digest_lo.map(SpreadWord::<16, 32>::new),
+            )?
+            .dense;
+            let digest_hi = SpreadVar::with_lookup(
+                region,
+                &self.lookup,
+                row + 1,
+                digest_hi.map(SpreadWord::<16, 32>::new),
+            )?
+            .dense;
+            digest_dense.push((digest_lo, digest_hi))
+        }
+
+        let ret: [(AssignedBits<F, 16>, AssignedBits<F, 16>); STATE] =
+            digest_dense.try_into().unwrap();
+        Ok(ret.map(RoundWordDense::from))
     }
 }
diff --git a/halo2_gadgets/src/sha256/table16/compression/subregion_initial.rs b/halo2_gadgets/src/sha256/table16/compression/subregion_initial.rs
index a487dc0c87..9b0c4341bd 100644
--- a/halo2_gadgets/src/sha256/table16/compression/subregion_initial.rs
+++ b/halo2_gadgets/src/sha256/table16/compression/subregion_initial.rs
@@ -1,19 +1,21 @@
-use super::super::{RoundWord, StateWord, STATE};
-use super::{compression_util::*, CompressionConfig, State};
+use super::{
+    super::{RoundWord, StateWord, STATE},
+    compression_util::*,
+    CompressionConfig, Field, RoundWordDense, State,
+};
 
 use halo2_proofs::{
     circuit::{Region, Value},
     plonk::Error,
 };
-use halo2curves::pasta::pallas;
 
 impl CompressionConfig {
     #[allow(clippy::many_single_char_names)]
-    pub fn initialize_iv(
+    pub fn initialize_iv<F: Field>(
         &self,
-        region: &mut Region<'_, pallas::Base>,
+        region: &mut Region<'_, F>,
         iv: [u32; STATE],
-    ) -> Result<State, Error> {
+    ) -> Result<State<F>, Error> {
         let a_7 = self.extras[3];
 
         // Decompose E into (6, 5, 14, 7)-bit chunks
@@ -53,43 +55,37 @@ impl CompressionConfig {
     }
 
     #[allow(clippy::many_single_char_names)]
-    pub fn initialize_state(
+    pub fn initialize_state<F: Field>(
         &self,
-        region: &mut Region<'_, pallas::Base>,
-        state: State,
-    ) -> Result<State, Error> {
+        region: &mut Region<'_, F>,
+        state_dense: [RoundWordDense<F>; STATE],
+    ) -> Result<State<F>, Error> {
+        // TODO: there is no constraint on the input state and the output decomposed state
+
         let a_7 = self.extras[3];
-        let (a, b, c, d, e, f, g, h) = match_state(state);
+        let [a, b, c, d, e, f, g, h] = state_dense;
 
         // Decompose E into (6, 5, 14, 7)-bit chunks
-        let e = e.dense_halves.value();
-        let e = self.decompose_e(region, RoundIdx::Init, e)?;
+        let e = self.decompose_e(region, RoundIdx::Init, e.value())?;
 
         // Decompose F, G
-        let f = f.dense_halves.value();
-        let f = self.decompose_f(region, InitialRound, f)?;
-        let g = g.dense_halves.value();
-        let g = self.decompose_g(region, InitialRound, g)?;
+        let f = self.decompose_f(region, InitialRound, f.value())?;
+        let g = self.decompose_g(region, InitialRound, g.value())?;
 
         // Assign H
-        let h = h.value();
         let h_row = get_h_row(RoundIdx::Init);
-        let h = self.assign_word_halves_dense(region, h_row, a_7, h_row + 1, a_7, h)?;
+        let h = self.assign_word_halves_dense(region, h_row, a_7, h_row + 1, a_7, h.value())?;
 
         // Decompose A into (2, 11, 9, 10)-bit chunks
-        let a = a.dense_halves.value();
-        let a = self.decompose_a(region, RoundIdx::Init, a)?;
+        let a = self.decompose_a(region, RoundIdx::Init, a.value())?;
 
         // Decompose B, C
-        let b = b.dense_halves.value();
-        let b = self.decompose_b(region, InitialRound, b)?;
-        let c = c.dense_halves.value();
-        let c = self.decompose_c(region, InitialRound, c)?;
+        let b = self.decompose_b(region, InitialRound, b.value())?;
+        let c = self.decompose_c(region, InitialRound, c.value())?;
 
         // Assign D
-        let d = d.value();
         let d_row = get_d_row(RoundIdx::Init);
-        let d = self.assign_word_halves_dense(region, d_row, a_7, d_row + 1, a_7, d)?;
+        let d = self.assign_word_halves_dense(region, d_row, a_7, d_row + 1, a_7, d.value())?;
 
         Ok(State::new(
             StateWord::A(a),
@@ -103,12 +99,12 @@ impl CompressionConfig {
         ))
     }
 
-    fn decompose_b(
+    fn decompose_b<F: Field>(
         &self,
-        region: &mut Region<'_, pallas::Base>,
+        region: &mut Region<'_, F>,
         round_idx: InitialRound,
         b_val: Value<u32>,
-    ) -> Result<RoundWord, Error> {
+    ) -> Result<RoundWord<F>, Error> {
         let row = get_decompose_b_row(round_idx);
 
         let (dense_halves, spread_halves) = self.assign_word_halves(region, row, b_val)?;
@@ -116,12 +112,12 @@ impl CompressionConfig {
         Ok(RoundWord::new(dense_halves, spread_halves))
     }
 
-    fn decompose_c(
+    fn decompose_c<F: Field>(
         &self,
-        region: &mut Region<'_, pallas::Base>,
+        region: &mut Region<'_, F>,
         round_idx: InitialRound,
         c_val: Value<u32>,
-    ) -> Result<RoundWord, Error> {
+    ) -> Result<RoundWord<F>, Error> {
         let row = get_decompose_c_row(round_idx);
 
         let (dense_halves, spread_halves) = self.assign_word_halves(region, row, c_val)?;
@@ -129,12 +125,12 @@ impl CompressionConfig {
         Ok(RoundWord::new(dense_halves, spread_halves))
     }
 
-    fn decompose_f(
+    fn decompose_f<F: Field>(
         &self,
-        region: &mut Region<'_, pallas::Base>,
+        region: &mut Region<'_, F>,
         round_idx: InitialRound,
         f_val: Value<u32>,
-    ) -> Result<RoundWord, Error> {
+    ) -> Result<RoundWord<F>, Error> {
         let row = get_decompose_f_row(round_idx);
 
         let (dense_halves, spread_halves) = self.assign_word_halves(region, row, f_val)?;
@@ -142,12 +138,12 @@ impl CompressionConfig {
         Ok(RoundWord::new(dense_halves, spread_halves))
     }
 
-    fn decompose_g(
+    fn decompose_g<F: Field>(
         &self,
-        region: &mut Region<'_, pallas::Base>,
+        region: &mut Region<'_, F>,
         round_idx: InitialRound,
         g_val: Value<u32>,
-    ) -> Result<RoundWord, Error> {
+    ) -> Result<RoundWord<F>, Error> {
         let row = get_decompose_g_row(round_idx);
 
         let (dense_halves, spread_halves) = self.assign_word_halves(region, row, g_val)?;
diff --git a/halo2_gadgets/src/sha256/table16/compression/subregion_main.rs b/halo2_gadgets/src/sha256/table16/compression/subregion_main.rs
index bda188a866..ab79849790 100644
--- a/halo2_gadgets/src/sha256/table16/compression/subregion_main.rs
+++ b/halo2_gadgets/src/sha256/table16/compression/subregion_main.rs
@@ -1,19 +1,19 @@
-use super::super::{AssignedBits, RoundWord, RoundWordA, RoundWordE, StateWord, ROUND_CONSTANTS};
-use super::{compression_util::*, CompressionConfig, State};
+use super::{
+    super::{AssignedBits, RoundWord, RoundWordA, RoundWordE, StateWord, ROUND_CONSTANTS},
+    compression_util::*,
+    CompressionConfig, Field, State,
+};
 use halo2_proofs::{circuit::Region, plonk::Error};
-use halo2curves::pasta::pallas;
 
 impl CompressionConfig {
     #[allow(clippy::many_single_char_names)]
-    pub fn assign_round(
+    pub fn assign_round<F: Field>(
         &self,
-        region: &mut Region<'_, pallas::Base>,
+        region: &mut Region<'_, F>,
         round_idx: MainRoundIdx,
-        state: State,
-        schedule_word: &(AssignedBits<16>, AssignedBits<16>),
-    ) -> Result<State, Error> {
-        let a_3 = self.extras[0];
-        let a_4 = self.extras[1];
+        state: State<F>,
+        schedule_word: &(AssignedBits<F, 16>, AssignedBits<F, 16>),
+    ) -> Result<State<F>, Error> {
         let a_7 = self.extras[3];
 
         let (a, b, c, d, e, f, g, h) = match_state(state);
@@ -103,21 +103,12 @@ impl CompressionConfig {
                 StateWord::H(g.dense_halves),
             ))
         } else {
-            let abcd_row = get_digest_abcd_row();
-            let efgh_row = get_digest_efgh_row();
-
-            let a_final =
-                self.assign_word_halves_dense(region, abcd_row, a_3, abcd_row, a_4, a_new_val)?;
-
-            let e_final =
-                self.assign_word_halves_dense(region, efgh_row, a_3, efgh_row, a_4, e_new_val)?;
-
             Ok(State::new(
-                StateWord::A(RoundWordA::new_dense(a_final)),
+                StateWord::A(RoundWordA::new_dense(a_new_dense)),
                 StateWord::B(RoundWord::new(a.dense_halves, a.spread_halves.unwrap())),
                 StateWord::C(b),
                 StateWord::D(c.dense_halves),
-                StateWord::E(RoundWordE::new_dense(e_final)),
+                StateWord::E(RoundWordE::new_dense(e_new_dense)),
                 StateWord::F(RoundWord::new(e.dense_halves, e.spread_halves.unwrap())),
                 StateWord::G(f),
                 StateWord::H(g.dense_halves),
diff --git a/halo2_gadgets/src/sha256/table16/message_schedule.rs b/halo2_gadgets/src/sha256/table16/message_schedule.rs
index 3da70c0add..044db8c182 100644
--- a/halo2_gadgets/src/sha256/table16/message_schedule.rs
+++ b/halo2_gadgets/src/sha256/table16/message_schedule.rs
@@ -1,12 +1,13 @@
 use std::convert::TryInto;
 
-use super::{super::BLOCK_SIZE, AssignedBits, BlockWord, SpreadInputs, Table16Assignment, ROUNDS};
+use super::{
+    super::BLOCK_SIZE, AssignedBits, BlockWord, Field, SpreadInputs, Table16Assignment, ROUNDS,
+};
 use halo2_proofs::{
     circuit::Layouter,
     plonk::{Advice, Column, ConstraintSystem, Error, Selector},
     poly::Rotation,
 };
-use halo2curves::pasta::pallas;
 
 mod schedule_gates;
 mod schedule_util;
@@ -21,10 +22,10 @@ use schedule_util::*;
 pub use schedule_util::msg_schedule_test_input;
 
 #[derive(Clone, Debug)]
-pub(super) struct MessageWord(AssignedBits<32>);
+pub(super) struct MessageWord<F: Field>(AssignedBits<F, 32>);
 
-impl std::ops::Deref for MessageWord {
-    type Target = AssignedBits<32>;
+impl<F: Field> std::ops::Deref for MessageWord<F> {
+    type Target = AssignedBits<F, 32>;
 
     fn deref(&self) -> &Self::Target {
         &self.0
@@ -57,7 +58,7 @@ pub(super) struct MessageScheduleConfig {
     s_lower_sigma_1_v2: Selector,
 }
 
-impl Table16Assignment for MessageScheduleConfig {}
+impl<F: Field> Table16Assignment<F> for MessageScheduleConfig {}
 
 impl MessageScheduleConfig {
     /// Configures the message schedule.
@@ -70,8 +71,8 @@ impl MessageScheduleConfig {
     /// gates, and will not place any constraints on (such as lookup constraints) outside
     /// itself.
     #[allow(clippy::many_single_char_names)]
-    pub(super) fn configure(
-        meta: &mut ConstraintSystem<pallas::Base>,
+    pub(super) fn configure<F: Field>(
+        meta: &mut ConstraintSystem<F>,
         lookup: SpreadInputs,
         message_schedule: Column<Advice>,
         extras: [Column<Advice>; 6],
@@ -302,25 +303,25 @@ impl MessageScheduleConfig {
     }
 
     #[allow(clippy::type_complexity)]
-    pub(super) fn process(
+    pub(super) fn process<F: Field>(
         &self,
-        layouter: &mut impl Layouter<pallas::Base>,
+        layouter: &mut impl Layouter<F>,
         input: [BlockWord; BLOCK_SIZE],
     ) -> Result<
         (
-            [MessageWord; ROUNDS],
-            [(AssignedBits<16>, AssignedBits<16>); ROUNDS],
+            [MessageWord<F>; ROUNDS],
+            [(AssignedBits<F, 16>, AssignedBits<F, 16>); ROUNDS],
         ),
         Error,
     > {
-        let mut w = Vec::<MessageWord>::with_capacity(ROUNDS);
-        let mut w_halves = Vec::<(AssignedBits<16>, AssignedBits<16>)>::with_capacity(ROUNDS);
+        let mut w = Vec::<MessageWord<_>>::with_capacity(ROUNDS);
+        let mut w_halves = Vec::<(AssignedBits<_, 16>, AssignedBits<_, 16>)>::with_capacity(ROUNDS);
 
         layouter.assign_region(
             || "process message block",
             |mut region| {
-                w = Vec::<MessageWord>::with_capacity(ROUNDS);
-                w_halves = Vec::<(AssignedBits<16>, AssignedBits<16>)>::with_capacity(ROUNDS);
+                w = Vec::<MessageWord<_>>::with_capacity(ROUNDS);
+                w_halves = Vec::<(AssignedBits<_, 16>, AssignedBits<_, 16>)>::with_capacity(ROUNDS);
 
                 // Assign all fixed columns
                 for index in 1..14 {
@@ -393,10 +394,13 @@ impl MessageScheduleConfig {
 
 #[cfg(test)]
 mod tests {
-    use super::super::{
-        super::BLOCK_SIZE, util::lebs2ip, BlockWord, SpreadTableChip, Table16Chip, Table16Config,
+    use super::{
+        super::{
+            super::BLOCK_SIZE, util::lebs2ip, BlockWord, SpreadTableChip, Table16Chip,
+            Table16Config,
+        },
+        schedule_util::*,
     };
-    use super::schedule_util::*;
     use halo2_proofs::{
         circuit::{Layouter, SimpleFloorPlanner},
         dev::MockProver,
@@ -450,7 +454,7 @@ mod tests {
 
         let prover = match MockProver::<pallas::Base>::run(17, &circuit, vec![]) {
             Ok(prover) => prover,
-            Err(e) => panic!("{:?}", e),
+            Err(e) => panic!("{e:?}"),
         };
         assert_eq!(prover.verify(), Ok(()));
     }
diff --git a/halo2_gadgets/src/sha256/table16/message_schedule/schedule_util.rs b/halo2_gadgets/src/sha256/table16/message_schedule/schedule_util.rs
index 42ed58a835..3aab76e6fa 100644
--- a/halo2_gadgets/src/sha256/table16/message_schedule/schedule_util.rs
+++ b/halo2_gadgets/src/sha256/table16/message_schedule/schedule_util.rs
@@ -1,10 +1,9 @@
-use super::super::AssignedBits;
-use super::MessageScheduleConfig;
+use super::super::Field;
+use super::{super::AssignedBits, MessageScheduleConfig};
 use halo2_proofs::{
     circuit::{Region, Value},
     plonk::Error,
 };
-use halo2curves::pasta::pallas;
 
 #[cfg(test)]
 use super::super::{super::BLOCK_SIZE, BlockWord, ROUNDS};
@@ -147,12 +146,19 @@ pub const MSG_SCHEDULE_TEST_OUTPUT: [u32; ROUNDS] = [
 
 impl MessageScheduleConfig {
     // Assign a word and its hi and lo halves
-    pub fn assign_word_and_halves(
+    #[allow(clippy::type_complexity)]
+    pub fn assign_word_and_halves<F: Field>(
         &self,
-        region: &mut Region<'_, pallas::Base>,
+        region: &mut Region<'_, F>,
         word: Value<u32>,
         word_idx: usize,
-    ) -> Result<(AssignedBits<32>, (AssignedBits<16>, AssignedBits<16>)), Error> {
+    ) -> Result<
+        (
+            AssignedBits<F, 32>,
+            (AssignedBits<F, 16>, AssignedBits<F, 16>),
+        ),
+        Error,
+    > {
         // Rename these here for ease of matching the gates to the specification.
         let a_3 = self.extras[0];
         let a_4 = self.extras[1];
@@ -161,16 +167,28 @@ impl MessageScheduleConfig {
 
         let w_lo = {
             let w_lo_val = word.map(|word| word as u16);
-            AssignedBits::<16>::assign(region, || format!("W_{}_lo", word_idx), a_3, row, w_lo_val)?
+            AssignedBits::<_, 16>::assign(
+                region,
+                || format!("W_{word_idx}_lo"),
+                a_3,
+                row,
+                w_lo_val,
+            )?
         };
         let w_hi = {
             let w_hi_val = word.map(|word| (word >> 16) as u16);
-            AssignedBits::<16>::assign(region, || format!("W_{}_hi", word_idx), a_4, row, w_hi_val)?
+            AssignedBits::<_, 16>::assign(
+                region,
+                || format!("W_{word_idx}_hi"),
+                a_4,
+                row,
+                w_hi_val,
+            )?
         };
 
-        let word = AssignedBits::<32>::assign(
+        let word = AssignedBits::<_, 32>::assign(
             region,
-            || format!("W_{}", word_idx),
+            || format!("W_{word_idx}"),
             self.message_schedule,
             row,
             word,
diff --git a/halo2_gadgets/src/sha256/table16/message_schedule/subregion1.rs b/halo2_gadgets/src/sha256/table16/message_schedule/subregion1.rs
index 947c9dda2a..a5bed0b062 100644
--- a/halo2_gadgets/src/sha256/table16/message_schedule/subregion1.rs
+++ b/halo2_gadgets/src/sha256/table16/message_schedule/subregion1.rs
@@ -1,26 +1,29 @@
-use super::super::{util::*, AssignedBits, BlockWord, SpreadVar, SpreadWord, Table16Assignment};
-use super::{schedule_util::*, MessageScheduleConfig};
+use super::super::Field;
+use super::{
+    super::{util::*, AssignedBits, BlockWord, SpreadVar, SpreadWord, Table16Assignment},
+    schedule_util::*,
+    MessageScheduleConfig,
+};
 use halo2_proofs::{
     circuit::{Region, Value},
     plonk::Error,
 };
-use halo2curves::pasta::pallas;
 use std::convert::TryInto;
 
 // A word in subregion 1
 // (3, 4, 11, 14)-bit chunks
 #[derive(Debug)]
-pub struct Subregion1Word {
+pub struct Subregion1Word<F: Field> {
     index: usize,
-    a: AssignedBits<3>,
-    b: AssignedBits<4>,
-    c: AssignedBits<11>,
-    d: AssignedBits<14>,
-    spread_c: AssignedBits<22>,
-    spread_d: AssignedBits<28>,
+    a: AssignedBits<F, 3>,
+    b: AssignedBits<F, 4>,
+    c: AssignedBits<F, 11>,
+    d: AssignedBits<F, 14>,
+    spread_c: AssignedBits<F, 22>,
+    spread_d: AssignedBits<F, 28>,
 }
 
-impl Subregion1Word {
+impl<F: Field> Subregion1Word<F> {
     fn spread_a(&self) -> Value<[bool; 6]> {
         self.a.value().map(|v| v.spread())
     }
@@ -75,11 +78,12 @@ impl Subregion1Word {
 }
 
 impl MessageScheduleConfig {
-    pub fn assign_subregion1(
+    #[allow(clippy::type_complexity)]
+    pub fn assign_subregion1<F: Field>(
         &self,
-        region: &mut Region<'_, pallas::Base>,
+        region: &mut Region<'_, F>,
         input: &[BlockWord],
-    ) -> Result<Vec<(AssignedBits<16>, AssignedBits<16>)>, Error> {
+    ) -> Result<Vec<(AssignedBits<F, 16>, AssignedBits<F, 16>)>, Error> {
         assert_eq!(input.len(), SUBREGION_1_LEN);
         Ok(input
             .iter()
@@ -101,12 +105,13 @@ impl MessageScheduleConfig {
     }
 
     /// Pieces of length [3, 4, 11, 14]
-    fn decompose_subregion1_word(
+    #[allow(clippy::type_complexity)]
+    fn decompose_subregion1_word<F: Field>(
         &self,
-        region: &mut Region<'_, pallas::Base>,
+        region: &mut Region<'_, F>,
         word: Value<[bool; 32]>,
         index: usize,
-    ) -> Result<Subregion1Word, Error> {
+    ) -> Result<Subregion1Word<F>, Error> {
         let row = get_word_row(index);
 
         // Rename these here for ease of matching the gates to the specification.
@@ -124,11 +129,21 @@ impl MessageScheduleConfig {
         let pieces = pieces.transpose_vec(4);
 
         // Assign `a` (3-bit piece)
-        let a =
-            AssignedBits::<3>::assign_bits(region, || "word_a", a_3, row + 1, pieces[0].clone())?;
+        let a = AssignedBits::<_, 3>::assign_bits(
+            region,
+            || "word_a",
+            a_3,
+            row + 1,
+            pieces[0].clone(),
+        )?;
         // Assign `b` (4-bit piece)
-        let b =
-            AssignedBits::<4>::assign_bits(region, || "word_b", a_4, row + 1, pieces[1].clone())?;
+        let b = AssignedBits::<_, 4>::assign_bits(
+            region,
+            || "word_b",
+            a_4,
+            row + 1,
+            pieces[1].clone(),
+        )?;
 
         // Assign `c` (11-bit piece) lookup
         let spread_c = pieces[2].clone().map(SpreadWord::try_new);
@@ -151,11 +166,11 @@ impl MessageScheduleConfig {
 
     // sigma_0 v1 on a word in W_1 to W_13
     // (3, 4, 11, 14)-bit chunks
-    fn lower_sigma_0(
+    fn lower_sigma_0<F: Field>(
         &self,
-        region: &mut Region<'_, pallas::Base>,
-        word: Subregion1Word,
-    ) -> Result<(AssignedBits<16>, AssignedBits<16>), Error> {
+        region: &mut Region<'_, F>,
+        word: Subregion1Word<F>,
+    ) -> Result<(AssignedBits<F, 16>, AssignedBits<F, 16>), Error> {
         let a_3 = self.extras[0];
         let a_4 = self.extras[1];
         let a_5 = self.message_schedule;
@@ -168,16 +183,16 @@ impl MessageScheduleConfig {
 
         // Witness `spread_a`
         let spread_a = word.a.value().map(|bits| spread_bits(bits.0));
-        AssignedBits::<6>::assign_bits(region, || "spread_a", a_6, row + 1, spread_a)?;
+        AssignedBits::<_, 6>::assign_bits(region, || "spread_a", a_6, row + 1, spread_a)?;
 
         // Split `b` (4-bit chunk) into `b_hi` and `b_lo`
         // Assign `b_lo`, `spread_b_lo`
         let b_lo: Value<[bool; 2]> = word.b.value().map(|b| b.0[..2].try_into().unwrap());
         let spread_b_lo = b_lo.map(spread_bits);
         {
-            AssignedBits::<2>::assign_bits(region, || "b_lo", a_3, row - 1, b_lo)?;
+            AssignedBits::<_, 2>::assign_bits(region, || "b_lo", a_3, row - 1, b_lo)?;
 
-            AssignedBits::<4>::assign_bits(region, || "spread_b_lo", a_4, row - 1, spread_b_lo)?;
+            AssignedBits::<_, 4>::assign_bits(region, || "spread_b_lo", a_4, row - 1, spread_b_lo)?;
         };
 
         // Split `b` (2-bit chunk) into `b_hi` and `b_lo`
@@ -185,9 +200,9 @@ impl MessageScheduleConfig {
         let b_hi: Value<[bool; 2]> = word.b.value().map(|b| b.0[2..].try_into().unwrap());
         let spread_b_hi = b_hi.map(spread_bits);
         {
-            AssignedBits::<2>::assign_bits(region, || "b_hi", a_5, row - 1, b_hi)?;
+            AssignedBits::<_, 2>::assign_bits(region, || "b_hi", a_5, row - 1, b_hi)?;
 
-            AssignedBits::<4>::assign_bits(region, || "spread_b_hi", a_6, row - 1, spread_b_hi)?;
+            AssignedBits::<_, 4>::assign_bits(region, || "spread_b_hi", a_6, row - 1, spread_b_hi)?;
         };
 
         // Assign `b` and copy constraint
diff --git a/halo2_gadgets/src/sha256/table16/message_schedule/subregion2.rs b/halo2_gadgets/src/sha256/table16/message_schedule/subregion2.rs
index 9733b46039..e34c4bd3a2 100644
--- a/halo2_gadgets/src/sha256/table16/message_schedule/subregion2.rs
+++ b/halo2_gadgets/src/sha256/table16/message_schedule/subregion2.rs
@@ -1,29 +1,32 @@
-use super::super::{util::*, AssignedBits, Bits, SpreadVar, SpreadWord, Table16Assignment};
-use super::{schedule_util::*, MessageScheduleConfig, MessageWord};
+use super::super::Field;
+use super::{
+    super::{util::*, AssignedBits, Bits, SpreadVar, SpreadWord, Table16Assignment},
+    schedule_util::*,
+    MessageScheduleConfig, MessageWord,
+};
 use halo2_proofs::{
     circuit::{Region, Value},
     plonk::Error,
 };
-use halo2curves::pasta::pallas;
 use std::convert::TryInto;
 
 /// A word in subregion 2
 /// (3, 4, 3, 7, 1, 1, 13)-bit chunks
 #[derive(Clone, Debug)]
-pub struct Subregion2Word {
+pub struct Subregion2Word<F: Field> {
     index: usize,
-    a: AssignedBits<3>,
-    b: AssignedBits<4>,
-    c: AssignedBits<3>,
-    d: AssignedBits<7>,
-    e: AssignedBits<1>,
-    f: AssignedBits<1>,
-    g: AssignedBits<13>,
-    spread_d: AssignedBits<14>,
-    spread_g: AssignedBits<26>,
+    a: AssignedBits<F, 3>,
+    b: AssignedBits<F, 4>,
+    c: AssignedBits<F, 3>,
+    d: AssignedBits<F, 7>,
+    e: AssignedBits<F, 1>,
+    f: AssignedBits<F, 1>,
+    g: AssignedBits<F, 13>,
+    spread_d: AssignedBits<F, 14>,
+    spread_g: AssignedBits<F, 26>,
 }
 
-impl Subregion2Word {
+impl<F: Field> Subregion2Word<F> {
     fn spread_a(&self) -> Value<[bool; 6]> {
         self.a.value().map(|v| v.spread())
     }
@@ -153,13 +156,14 @@ impl Subregion2Word {
 
 impl MessageScheduleConfig {
     // W_[14..49]
-    pub fn assign_subregion2(
+    #[allow(clippy::type_complexity)]
+    pub fn assign_subregion2<F: Field>(
         &self,
-        region: &mut Region<'_, pallas::Base>,
-        lower_sigma_0_output: Vec<(AssignedBits<16>, AssignedBits<16>)>,
-        w: &mut Vec<MessageWord>,
-        w_halves: &mut Vec<(AssignedBits<16>, AssignedBits<16>)>,
-    ) -> Result<Vec<(AssignedBits<16>, AssignedBits<16>)>, Error> {
+        region: &mut Region<'_, F>,
+        lower_sigma_0_output: Vec<(AssignedBits<F, 16>, AssignedBits<F, 16>)>,
+        w: &mut Vec<MessageWord<F>>,
+        w_halves: &mut Vec<(AssignedBits<F, 16>, AssignedBits<F, 16>)>,
+    ) -> Result<Vec<(AssignedBits<F, 16>, AssignedBits<F, 16>)>, Error> {
         let a_5 = self.message_schedule;
         let a_6 = self.extras[2];
         let a_7 = self.extras[3];
@@ -167,9 +171,9 @@ impl MessageScheduleConfig {
         let a_9 = self.extras[5];
 
         let mut lower_sigma_0_v2_results =
-            Vec::<(AssignedBits<16>, AssignedBits<16>)>::with_capacity(SUBREGION_2_LEN);
+            Vec::<(AssignedBits<_, 16>, AssignedBits<_, 16>)>::with_capacity(SUBREGION_2_LEN);
         let mut lower_sigma_1_v2_results =
-            Vec::<(AssignedBits<16>, AssignedBits<16>)>::with_capacity(SUBREGION_2_LEN);
+            Vec::<(AssignedBits<_, 16>, AssignedBits<_, 16>)>::with_capacity(SUBREGION_2_LEN);
 
         // Closure to compose new word
         // W_i = sigma_1(W_{i - 2}) + W_{i - 7} + sigma_0(W_{i - 15}) + W_{i - 16}
@@ -179,98 +183,99 @@ impl MessageScheduleConfig {
         // sigma_0_v2(W_[14..36]) will be used to get the new W_[29..51]
         // sigma_1_v2(W_[14..49]) will be used to get the W_[16..51]
         // The lowest-index words involved will be W_[0..13]
-        let mut new_word = |idx: usize,
-                            sigma_0_output: &(AssignedBits<16>, AssignedBits<16>)|
-         -> Result<Vec<(AssignedBits<16>, AssignedBits<16>)>, Error> {
-            // Decompose word into (3, 4, 3, 7, 1, 1, 13)-bit chunks
-            let word = self.decompose_word(region, w[idx].value(), idx)?;
-
-            // sigma_0 v2 and sigma_1 v2 on word
-            lower_sigma_0_v2_results.push(self.lower_sigma_0_v2(region, word.clone())?);
-            lower_sigma_1_v2_results.push(self.lower_sigma_1_v2(region, word)?);
-
-            let new_word_idx = idx + 2;
-
-            // Copy sigma_0(W_{i - 15}) output from Subregion 1
-            sigma_0_output.0.copy_advice(
-                || format!("sigma_0(W_{})_lo", new_word_idx - 15),
-                region,
-                a_6,
-                get_word_row(new_word_idx - 16),
-            )?;
-            sigma_0_output.1.copy_advice(
-                || format!("sigma_0(W_{})_hi", new_word_idx - 15),
-                region,
-                a_6,
-                get_word_row(new_word_idx - 16) + 1,
-            )?;
-
-            // Copy sigma_1(W_{i - 2})
-            lower_sigma_1_v2_results[new_word_idx - 16].0.copy_advice(
-                || format!("sigma_1(W_{})_lo", new_word_idx - 2),
-                region,
-                a_7,
-                get_word_row(new_word_idx - 16),
-            )?;
-            lower_sigma_1_v2_results[new_word_idx - 16].1.copy_advice(
-                || format!("sigma_1(W_{})_hi", new_word_idx - 2),
-                region,
-                a_7,
-                get_word_row(new_word_idx - 16) + 1,
-            )?;
-
-            // Copy W_{i - 7}
-            w_halves[new_word_idx - 7].0.copy_advice(
-                || format!("W_{}_lo", new_word_idx - 7),
-                region,
-                a_8,
-                get_word_row(new_word_idx - 16),
-            )?;
-            w_halves[new_word_idx - 7].1.copy_advice(
-                || format!("W_{}_hi", new_word_idx - 7),
-                region,
-                a_8,
-                get_word_row(new_word_idx - 16) + 1,
-            )?;
-
-            // Calculate W_i, carry_i
-            let (word, carry) = sum_with_carry(vec![
-                (
-                    lower_sigma_1_v2_results[new_word_idx - 16].0.value_u16(),
-                    lower_sigma_1_v2_results[new_word_idx - 16].1.value_u16(),
-                ),
-                (
-                    w_halves[new_word_idx - 7].0.value_u16(),
-                    w_halves[new_word_idx - 7].1.value_u16(),
-                ),
-                (sigma_0_output.0.value_u16(), sigma_0_output.1.value_u16()),
-                (
-                    w_halves[new_word_idx - 16].0.value_u16(),
-                    w_halves[new_word_idx - 16].1.value_u16(),
-                ),
-            ]);
-
-            // Assign W_i, carry_i
-            region.assign_advice(
-                || format!("W_{}", new_word_idx),
-                a_5,
-                get_word_row(new_word_idx - 16) + 1,
-                || word.map(|word| pallas::Base::from(word as u64)),
-            )?;
-            region.assign_advice(
-                || format!("carry_{}", new_word_idx),
-                a_9,
-                get_word_row(new_word_idx - 16) + 1,
-                || carry.map(pallas::Base::from),
-            )?;
-            let (word, halves) = self.assign_word_and_halves(region, word, new_word_idx)?;
-            w.push(MessageWord(word));
-            w_halves.push(halves);
-
-            Ok(lower_sigma_0_v2_results.clone())
-        };
-
-        let mut tmp_lower_sigma_0_v2_results: Vec<(AssignedBits<16>, AssignedBits<16>)> =
+        let mut new_word =
+            |idx: usize,
+             sigma_0_output: &(AssignedBits<_, 16>, AssignedBits<_, 16>)|
+             -> Result<Vec<(AssignedBits<_, 16>, AssignedBits<_, 16>)>, Error> {
+                // Decompose word into (3, 4, 3, 7, 1, 1, 13)-bit chunks
+                let word = self.decompose_word(region, w[idx].value(), idx)?;
+
+                // sigma_0 v2 and sigma_1 v2 on word
+                lower_sigma_0_v2_results.push(self.lower_sigma_0_v2(region, word.clone())?);
+                lower_sigma_1_v2_results.push(self.lower_sigma_1_v2(region, word)?);
+
+                let new_word_idx = idx + 2;
+
+                // Copy sigma_0(W_{i - 15}) output from Subregion 1
+                sigma_0_output.0.copy_advice(
+                    || format!("sigma_0(W_{})_lo", new_word_idx - 15),
+                    region,
+                    a_6,
+                    get_word_row(new_word_idx - 16),
+                )?;
+                sigma_0_output.1.copy_advice(
+                    || format!("sigma_0(W_{})_hi", new_word_idx - 15),
+                    region,
+                    a_6,
+                    get_word_row(new_word_idx - 16) + 1,
+                )?;
+
+                // Copy sigma_1(W_{i - 2})
+                lower_sigma_1_v2_results[new_word_idx - 16].0.copy_advice(
+                    || format!("sigma_1(W_{})_lo", new_word_idx - 2),
+                    region,
+                    a_7,
+                    get_word_row(new_word_idx - 16),
+                )?;
+                lower_sigma_1_v2_results[new_word_idx - 16].1.copy_advice(
+                    || format!("sigma_1(W_{})_hi", new_word_idx - 2),
+                    region,
+                    a_7,
+                    get_word_row(new_word_idx - 16) + 1,
+                )?;
+
+                // Copy W_{i - 7}
+                w_halves[new_word_idx - 7].0.copy_advice(
+                    || format!("W_{}_lo", new_word_idx - 7),
+                    region,
+                    a_8,
+                    get_word_row(new_word_idx - 16),
+                )?;
+                w_halves[new_word_idx - 7].1.copy_advice(
+                    || format!("W_{}_hi", new_word_idx - 7),
+                    region,
+                    a_8,
+                    get_word_row(new_word_idx - 16) + 1,
+                )?;
+
+                // Calculate W_i, carry_i
+                let (word, carry) = sum_with_carry(vec![
+                    (
+                        lower_sigma_1_v2_results[new_word_idx - 16].0.value_u16(),
+                        lower_sigma_1_v2_results[new_word_idx - 16].1.value_u16(),
+                    ),
+                    (
+                        w_halves[new_word_idx - 7].0.value_u16(),
+                        w_halves[new_word_idx - 7].1.value_u16(),
+                    ),
+                    (sigma_0_output.0.value_u16(), sigma_0_output.1.value_u16()),
+                    (
+                        w_halves[new_word_idx - 16].0.value_u16(),
+                        w_halves[new_word_idx - 16].1.value_u16(),
+                    ),
+                ]);
+
+                // Assign W_i, carry_i
+                region.assign_advice(
+                    || format!("W_{new_word_idx}"),
+                    a_5,
+                    get_word_row(new_word_idx - 16) + 1,
+                    || word.map(|word| F::from(word as u64)),
+                )?;
+                region.assign_advice(
+                    || format!("carry_{new_word_idx}"),
+                    a_9,
+                    get_word_row(new_word_idx - 16) + 1,
+                    || carry.map(|carry| F::from(carry)),
+                )?;
+                let (word, halves) = self.assign_word_and_halves(region, word, new_word_idx)?;
+                w.push(MessageWord(word));
+                w_halves.push(halves);
+
+                Ok(lower_sigma_0_v2_results.clone())
+            };
+
+        let mut tmp_lower_sigma_0_v2_results: Vec<(AssignedBits<_, 16>, AssignedBits<_, 16>)> =
             Vec::with_capacity(SUBREGION_2_LEN);
 
         // Use up all the output from Subregion 1 lower_sigma_0
@@ -288,12 +293,12 @@ impl MessageScheduleConfig {
     }
 
     /// Pieces of length [3, 4, 3, 7, 1, 1, 13]
-    fn decompose_word(
+    fn decompose_word<F: Field>(
         &self,
-        region: &mut Region<'_, pallas::Base>,
+        region: &mut Region<'_, F>,
         word: Value<&Bits<32>>,
         index: usize,
-    ) -> Result<Subregion2Word, Error> {
+    ) -> Result<Subregion2Word<F>, Error> {
         let row = get_word_row(index);
 
         let pieces = word.map(|word| {
@@ -314,24 +319,24 @@ impl MessageScheduleConfig {
         let a_4 = self.extras[1];
 
         // Assign `a` (3-bit piece)
-        let a = AssignedBits::<3>::assign_bits(region, || "a", a_3, row - 1, pieces[0].clone())?;
+        let a = AssignedBits::<_, 3>::assign_bits(region, || "a", a_3, row - 1, pieces[0].clone())?;
 
         // Assign `b` (4-bit piece) lookup
         let spread_b: Value<SpreadWord<4, 8>> = pieces[1].clone().map(SpreadWord::try_new);
         let spread_b = SpreadVar::with_lookup(region, &self.lookup, row + 1, spread_b)?;
 
         // Assign `c` (3-bit piece)
-        let c = AssignedBits::<3>::assign_bits(region, || "c", a_4, row - 1, pieces[2].clone())?;
+        let c = AssignedBits::<_, 3>::assign_bits(region, || "c", a_4, row - 1, pieces[2].clone())?;
 
         // Assign `d` (7-bit piece) lookup
         let spread_d: Value<SpreadWord<7, 14>> = pieces[3].clone().map(SpreadWord::try_new);
         let spread_d = SpreadVar::with_lookup(region, &self.lookup, row, spread_d)?;
 
         // Assign `e` (1-bit piece)
-        let e = AssignedBits::<1>::assign_bits(region, || "e", a_3, row + 1, pieces[4].clone())?;
+        let e = AssignedBits::<_, 1>::assign_bits(region, || "e", a_3, row + 1, pieces[4].clone())?;
 
         // Assign `f` (1-bit piece)
-        let f = AssignedBits::<1>::assign_bits(region, || "f", a_4, row + 1, pieces[5].clone())?;
+        let f = AssignedBits::<_, 1>::assign_bits(region, || "f", a_4, row + 1, pieces[5].clone())?;
 
         // Assign `g` (13-bit piece) lookup
         let spread_g = pieces[6].clone().map(SpreadWord::try_new);
@@ -354,11 +359,11 @@ impl MessageScheduleConfig {
     /// A word in subregion 2
     /// (3, 4, 3, 7, 1, 1, 13)-bit chunks
     #[allow(clippy::type_complexity)]
-    fn assign_lower_sigma_v2_pieces(
+    fn assign_lower_sigma_v2_pieces<F: Field>(
         &self,
-        region: &mut Region<'_, pallas::Base>,
+        region: &mut Region<'_, F>,
         row: usize,
-        word: &Subregion2Word,
+        word: &Subregion2Word<F>,
     ) -> Result<(), Error> {
         let a_3 = self.extras[0];
         let a_4 = self.extras[1];
@@ -370,7 +375,7 @@ impl MessageScheduleConfig {
         word.a.copy_advice(|| "a", region, a_3, row + 1)?;
 
         // Witness `spread_a`
-        AssignedBits::<6>::assign_bits(region, || "spread_a", a_4, row + 1, word.spread_a())?;
+        AssignedBits::<_, 6>::assign_bits(region, || "spread_a", a_4, row + 1, word.spread_a())?;
 
         // Split `b` (4-bit chunk) into `b_hi` and `b_lo`
         // Assign `b_lo`, `spread_b_lo`
@@ -378,9 +383,9 @@ impl MessageScheduleConfig {
         let b_lo: Value<[bool; 2]> = word.b.value().map(|b| b.0[..2].try_into().unwrap());
         let spread_b_lo = b_lo.map(spread_bits);
         {
-            AssignedBits::<2>::assign_bits(region, || "b_lo", a_3, row - 1, b_lo)?;
+            AssignedBits::<_, 2>::assign_bits(region, || "b_lo", a_3, row - 1, b_lo)?;
 
-            AssignedBits::<4>::assign_bits(region, || "spread_b_lo", a_4, row - 1, spread_b_lo)?;
+            AssignedBits::<_, 4>::assign_bits(region, || "spread_b_lo", a_4, row - 1, spread_b_lo)?;
         };
 
         // Split `b` (2-bit chunk) into `b_hi` and `b_lo`
@@ -388,9 +393,9 @@ impl MessageScheduleConfig {
         let b_hi: Value<[bool; 2]> = word.b.value().map(|b| b.0[2..].try_into().unwrap());
         let spread_b_hi = b_hi.map(spread_bits);
         {
-            AssignedBits::<2>::assign_bits(region, || "b_hi", a_5, row - 1, b_hi)?;
+            AssignedBits::<_, 2>::assign_bits(region, || "b_hi", a_5, row - 1, b_hi)?;
 
-            AssignedBits::<4>::assign_bits(region, || "spread_b_hi", a_6, row - 1, spread_b_hi)?;
+            AssignedBits::<_, 4>::assign_bits(region, || "spread_b_hi", a_6, row - 1, spread_b_hi)?;
         };
 
         // Assign `b` and copy constraint
@@ -400,7 +405,7 @@ impl MessageScheduleConfig {
         word.c.copy_advice(|| "c", region, a_5, row + 1)?;
 
         // Witness `spread_c`
-        AssignedBits::<6>::assign_bits(region, || "spread_c", a_6, row + 1, word.spread_c())?;
+        AssignedBits::<_, 6>::assign_bits(region, || "spread_c", a_6, row + 1, word.spread_c())?;
 
         // Assign `spread_d` and copy constraint
         word.spread_d.copy_advice(|| "spread_d", region, a_4, row)?;
@@ -417,11 +422,11 @@ impl MessageScheduleConfig {
         Ok(())
     }
 
-    fn lower_sigma_0_v2(
+    fn lower_sigma_0_v2<F: Field>(
         &self,
-        region: &mut Region<'_, pallas::Base>,
-        word: Subregion2Word,
-    ) -> Result<(AssignedBits<16>, AssignedBits<16>), Error> {
+        region: &mut Region<'_, F>,
+        word: Subregion2Word<F>,
+    ) -> Result<(AssignedBits<F, 16>, AssignedBits<F, 16>), Error> {
         let a_3 = self.extras[0];
         let row = get_word_row(word.index) + 3;
 
@@ -450,11 +455,11 @@ impl MessageScheduleConfig {
         )
     }
 
-    fn lower_sigma_1_v2(
+    fn lower_sigma_1_v2<F: Field>(
         &self,
-        region: &mut Region<'_, pallas::Base>,
-        word: Subregion2Word,
-    ) -> Result<(AssignedBits<16>, AssignedBits<16>), Error> {
+        region: &mut Region<'_, F>,
+        word: Subregion2Word<F>,
+    ) -> Result<(AssignedBits<F, 16>, AssignedBits<F, 16>), Error> {
         let a_3 = self.extras[0];
         let row = get_word_row(word.index) + SIGMA_0_V2_ROWS + 3;
 
diff --git a/halo2_gadgets/src/sha256/table16/message_schedule/subregion3.rs b/halo2_gadgets/src/sha256/table16/message_schedule/subregion3.rs
index aebe1945d9..9f2217c7c1 100644
--- a/halo2_gadgets/src/sha256/table16/message_schedule/subregion3.rs
+++ b/halo2_gadgets/src/sha256/table16/message_schedule/subregion3.rs
@@ -1,27 +1,30 @@
-use super::super::{util::*, AssignedBits, Bits, SpreadVar, SpreadWord, Table16Assignment};
-use super::{schedule_util::*, MessageScheduleConfig, MessageWord};
+use super::super::Field;
+use super::{
+    super::{util::*, AssignedBits, Bits, SpreadVar, SpreadWord, Table16Assignment},
+    schedule_util::*,
+    MessageScheduleConfig, MessageWord,
+};
 use halo2_proofs::{
     circuit::{Region, Value},
     plonk::Error,
 };
-use halo2curves::pasta::pallas;
 use std::convert::TryInto;
 
 // A word in subregion 3
 // (10, 7, 2, 13)-bit chunks
-pub struct Subregion3Word {
+pub struct Subregion3Word<F: Field> {
     index: usize,
     #[allow(dead_code)]
-    a: AssignedBits<10>,
-    b: AssignedBits<7>,
-    c: AssignedBits<2>,
+    a: AssignedBits<F, 10>,
+    b: AssignedBits<F, 7>,
+    c: AssignedBits<F, 2>,
     #[allow(dead_code)]
-    d: AssignedBits<13>,
-    spread_a: AssignedBits<20>,
-    spread_d: AssignedBits<26>,
+    d: AssignedBits<F, 13>,
+    spread_a: AssignedBits<F, 20>,
+    spread_d: AssignedBits<F, 26>,
 }
 
-impl Subregion3Word {
+impl<F: Field> Subregion3Word<F> {
     fn spread_a(&self) -> Value<[bool; 20]> {
         self.spread_a.value().map(|v| v.0)
     }
@@ -78,12 +81,12 @@ impl Subregion3Word {
 
 impl MessageScheduleConfig {
     // W_[49..62]
-    pub fn assign_subregion3(
+    pub fn assign_subregion3<F: Field>(
         &self,
-        region: &mut Region<'_, pallas::Base>,
-        lower_sigma_0_v2_output: Vec<(AssignedBits<16>, AssignedBits<16>)>,
-        w: &mut Vec<MessageWord>,
-        w_halves: &mut Vec<(AssignedBits<16>, AssignedBits<16>)>,
+        region: &mut Region<'_, F>,
+        lower_sigma_0_v2_output: Vec<(AssignedBits<F, 16>, AssignedBits<F, 16>)>,
+        w: &mut Vec<MessageWord<F>>,
+        w_halves: &mut Vec<(AssignedBits<F, 16>, AssignedBits<F, 16>)>,
     ) -> Result<(), Error> {
         let a_5 = self.message_schedule;
         let a_6 = self.extras[2];
@@ -168,16 +171,16 @@ impl MessageScheduleConfig {
 
             // Assign W_i, carry_i
             region.assign_advice(
-                || format!("W_{}", new_word_idx),
+                || format!("W_{new_word_idx}"),
                 a_5,
                 get_word_row(new_word_idx - 16) + 1,
-                || word.map(|word| pallas::Base::from(word as u64)),
+                || word.map(|word| F::from(word as u64)),
             )?;
             region.assign_advice(
-                || format!("carry_{}", new_word_idx),
+                || format!("carry_{new_word_idx}"),
                 a_9,
                 get_word_row(new_word_idx - 16) + 1,
-                || carry.map(pallas::Base::from),
+                || carry.map(|carry| F::from(carry)),
             )?;
             let (word, halves) = self.assign_word_and_halves(region, word, new_word_idx)?;
             w.push(MessageWord(word));
@@ -194,12 +197,12 @@ impl MessageScheduleConfig {
     }
 
     /// Pieces of length [10, 7, 2, 13]
-    fn decompose_subregion3_word(
+    fn decompose_subregion3_word<F: Field>(
         &self,
-        region: &mut Region<'_, pallas::Base>,
+        region: &mut Region<'_, F>,
         word: Value<&Bits<32>>,
         index: usize,
-    ) -> Result<Subregion3Word, Error> {
+    ) -> Result<Subregion3Word<F>, Error> {
         let row = get_word_row(index);
 
         // Rename these here for ease of matching the gates to the specification.
@@ -221,10 +224,10 @@ impl MessageScheduleConfig {
         let spread_a = SpreadVar::with_lookup(region, &self.lookup, row + 1, spread_a)?;
 
         // Assign `b` (7-bit piece)
-        let b = AssignedBits::<7>::assign_bits(region, || "b", a_4, row + 1, pieces[1].clone())?;
+        let b = AssignedBits::<F, 7>::assign_bits(region, || "b", a_4, row + 1, pieces[1].clone())?;
 
         // Assign `c` (2-bit piece)
-        let c = AssignedBits::<2>::assign_bits(region, || "c", a_3, row + 1, pieces[2].clone())?;
+        let c = AssignedBits::<F, 2>::assign_bits(region, || "c", a_3, row + 1, pieces[2].clone())?;
 
         // Assign `d` (13-bit piece) lookup
         let spread_d = pieces[3].clone().map(SpreadWord::try_new);
@@ -241,11 +244,11 @@ impl MessageScheduleConfig {
         })
     }
 
-    fn lower_sigma_1(
+    fn lower_sigma_1<F: Field>(
         &self,
-        region: &mut Region<'_, pallas::Base>,
-        word: Subregion3Word,
-    ) -> Result<(AssignedBits<16>, AssignedBits<16>), Error> {
+        region: &mut Region<'_, F>,
+        word: Subregion3Word<F>,
+    ) -> Result<(AssignedBits<F, 16>, AssignedBits<F, 16>), Error> {
         let a_3 = self.extras[0];
         let a_4 = self.extras[1];
         let a_5 = self.message_schedule;
@@ -289,7 +292,7 @@ impl MessageScheduleConfig {
         // Witness `spread_c`
         {
             let spread_c = word.c.value().map(spread_bits);
-            AssignedBits::<4>::assign_bits(region, || "spread_c", a_4, row + 1, spread_c)?;
+            AssignedBits::<F, 4>::assign_bits(region, || "spread_c", a_4, row + 1, spread_c)?;
         }
 
         // Assign `spread_d` and copy constraint
diff --git a/halo2_gadgets/src/sha256/table16/spread_table.rs b/halo2_gadgets/src/sha256/table16/spread_table.rs
index 9b8a313cc2..d1484c8d11 100644
--- a/halo2_gadgets/src/sha256/table16/spread_table.rs
+++ b/halo2_gadgets/src/sha256/table16/spread_table.rs
@@ -1,14 +1,10 @@
-use super::{util::*, AssignedBits};
+use super::{util::*, AssignedBits, Field};
 use ff::PrimeField;
 use halo2_proofs::{
-    arithmetic::Field,
     circuit::{Chip, Layouter, Region, Value},
     plonk::{Advice, Column, ConstraintSystem, Error, TableColumn},
-    poly::Rotation,
 };
-use halo2curves::pasta::pallas;
-use std::convert::TryInto;
-use std::marker::PhantomData;
+use std::{convert::TryInto, marker::PhantomData};
 
 const BITS_7: usize = 1 << 7;
 const BITS_10: usize = 1 << 10;
@@ -68,15 +64,15 @@ impl<const DENSE: usize, const SPREAD: usize> SpreadWord<DENSE, SPREAD> {
 
 /// A variable stored in advice columns corresponding to a row of [`SpreadTableConfig`].
 #[derive(Clone, Debug)]
-pub(super) struct SpreadVar<const DENSE: usize, const SPREAD: usize> {
+pub(super) struct SpreadVar<F: Field, const DENSE: usize, const SPREAD: usize> {
     pub tag: Value<u8>,
-    pub dense: AssignedBits<DENSE>,
-    pub spread: AssignedBits<SPREAD>,
+    pub dense: AssignedBits<F, DENSE>,
+    pub spread: AssignedBits<F, SPREAD>,
 }
 
-impl<const DENSE: usize, const SPREAD: usize> SpreadVar<DENSE, SPREAD> {
+impl<F: Field, const DENSE: usize, const SPREAD: usize> SpreadVar<F, DENSE, SPREAD> {
     pub(super) fn with_lookup(
-        region: &mut Region<'_, pallas::Base>,
+        region: &mut Region<'_, F>,
         cols: &SpreadInputs,
         row: usize,
         word: Value<SpreadWord<DENSE, SPREAD>>,
@@ -89,20 +85,25 @@ impl<const DENSE: usize, const SPREAD: usize> SpreadVar<DENSE, SPREAD> {
             || "tag",
             cols.tag,
             row,
-            || tag.map(|tag| pallas::Base::from(tag as u64)),
+            || tag.map(|tag| F::from(tag as u64)),
         )?;
 
         let dense =
-            AssignedBits::<DENSE>::assign_bits(region, || "dense", cols.dense, row, dense_val)?;
+            AssignedBits::<_, DENSE>::assign_bits(region, || "dense", cols.dense, row, dense_val)?;
 
-        let spread =
-            AssignedBits::<SPREAD>::assign_bits(region, || "spread", cols.spread, row, spread_val)?;
+        let spread = AssignedBits::<_, SPREAD>::assign_bits(
+            region,
+            || "spread",
+            cols.spread,
+            row,
+            spread_val,
+        )?;
 
         Ok(SpreadVar { tag, dense, spread })
     }
 
     pub(super) fn without_lookup(
-        region: &mut Region<'_, pallas::Base>,
+        region: &mut Region<'_, F>,
         dense_col: Column<Advice>,
         dense_row: usize,
         spread_col: Column<Advice>,
@@ -113,7 +114,7 @@ impl<const DENSE: usize, const SPREAD: usize> SpreadVar<DENSE, SPREAD> {
         let dense_val = word.map(|word| word.dense);
         let spread_val = word.map(|word| word.spread);
 
-        let dense = AssignedBits::<DENSE>::assign_bits(
+        let dense = AssignedBits::<_, DENSE>::assign_bits(
             region,
             || "dense",
             dense_col,
@@ -121,7 +122,7 @@ impl<const DENSE: usize, const SPREAD: usize> SpreadVar<DENSE, SPREAD> {
             dense_val,
         )?;
 
-        let spread = AssignedBits::<SPREAD>::assign_bits(
+        let spread = AssignedBits::<_, SPREAD>::assign_bits(
             region,
             || "spread",
             spread_col,
@@ -184,6 +185,7 @@ impl<F: PrimeField> SpreadTableChip<F> {
         let table_spread = meta.lookup_table_column();
 
         meta.lookup("lookup", |meta| {
+            use halo2_proofs::poly::Rotation;
             let tag_cur = meta.query_advice(input_tag, Rotation::cur());
             let dense_cur = meta.query_advice(input_dense, Rotation::cur());
             let spread_cur = meta.query_advice(input_spread, Rotation::cur());
@@ -441,7 +443,7 @@ mod tests {
 
         let prover = match MockProver::<Fp>::run(17, &circuit, vec![]) {
             Ok(prover) => prover,
-            Err(e) => panic!("{:?}", e),
+            Err(e) => panic!("{e:?}"),
         };
         assert_eq!(prover.verify(), Ok(()));
     }
diff --git a/halo2_gadgets/src/utilities.rs b/halo2_gadgets/src/utilities.rs
index 50d939b055..f86be625f6 100644
--- a/halo2_gadgets/src/utilities.rs
+++ b/halo2_gadgets/src/utilities.rs
@@ -405,7 +405,7 @@ mod tests {
             }
             assert_eq!(field_elem, sum);
         };
-        decompose(pallas::Base::random(rng), &[0..255]);
+        // decompose(pallas::Base::random(rng), &[0..255]);
         decompose(pallas::Base::random(rng), &[0..1, 1..255]);
         decompose(pallas::Base::random(rng), &[0..254, 254..255]);
         decompose(pallas::Base::random(rng), &[0..127, 127..255]);
diff --git a/halo2_proofs/Cargo.toml b/halo2_proofs/Cargo.toml
index 839ed7c9d3..0935cfcca1 100644
--- a/halo2_proofs/Cargo.toml
+++ b/halo2_proofs/Cargo.toml
@@ -39,22 +39,27 @@ harness = false
 name = "dev_lookup"
 harness = false
 
+[[bench]]
+name = "lookups"
+harness = false
+
 [[bench]]
 name = "fft"
 harness = false
 
 [dependencies]
+rayon = "1.5.1"
 backtrace = { version = "0.3", optional = true }
 ff = "0.13"
 group = "0.13"
-halo2curves = { version = "0.1.0" }
+halo2curves = { version = "0.1.0", features = [ "derive_serde" ] }
 rand_core = { version = "0.6", default-features = false }
 tracing = "0.1"
 blake2b_simd = "1" # MSRV 1.66.0
 sha3 = "0.9.1"
 subtle = "2.3"
 cfg-if = "0.1"
-poseidon = { git = "https://github.com/scroll-tech/poseidon.git", branch = "sync-halo2-lib-0.4.0" }
+poseidon = { git = "https://github.com/scroll-tech/poseidon.git", branch = "main" }
 num-integer = "0.1"
 num-bigint = { version = "0.4", features = ["rand"] }
 rand_chacha = "0.3"
@@ -64,11 +69,12 @@ crossbeam = "0.8.0"
 # Developer tooling dependencies
 plotters = { version = "0.3.0", default-features = false, optional = true }
 tabbycat = { version = "0.1", features = ["attributes"], optional = true }
+lazy_static = { version = "1", optional = true }
 log = "0.4.17"
 
 # timer
 ark-std = { version = "0.3.0" }
-env_logger = "0.8.0"
+
 
 # Legacy circuit compatibility
 halo2_legacy_pdqsort = { version = "0.1.0", optional = true }
@@ -76,6 +82,7 @@ halo2_legacy_pdqsort = { version = "0.1.0", optional = true }
 [dev-dependencies]
 assert_matches = "1.5"
 criterion = "0.3"
+env_logger = "0.8.0"
 gumdrop = "0.8"
 proptest = "1"
 rand_core = { version = "0.6", default-features = false, features = ["getrandom"] }
@@ -84,7 +91,7 @@ rand_core = { version = "0.6", default-features = false, features = ["getrandom"
 getrandom = { version = "0.2", features = ["js"] }
 
 [features]
-default = ["batch", "gwc", "multicore", "parallel_syn" ]
+default = ["batch", "gwc", "multicore", "parallel_syn", "logup_skip_inv"]
 multicore = ["maybe-rayon/threads"]
 dev-graph = ["plotters", "tabbycat"]
 test-dev-graph = [
@@ -101,8 +108,10 @@ shplonk = []
 gwc = []
 parallel_syn = []
 profile = ["ark-std/print-trace"]
+counter = ["lazy_static"]
 mock-batch-inv = []
 circuit-params = []
+logup_skip_inv = []
 
 # todo: we have both mutliphase prover and phase check. consider merge them
 phase-check = []
diff --git a/halo2_proofs/benches/lookups.rs b/halo2_proofs/benches/lookups.rs
new file mode 100644
index 0000000000..aca5cecc94
--- /dev/null
+++ b/halo2_proofs/benches/lookups.rs
@@ -0,0 +1,240 @@
+#[macro_use]
+extern crate criterion;
+
+use halo2_proofs::circuit::{Layouter, SimpleFloorPlanner, Value};
+use halo2_proofs::plonk::*;
+use halo2_proofs::poly::kzg::multiopen::VerifierGWC;
+use halo2_proofs::poly::{commitment::ParamsProver, Rotation};
+use halo2_proofs::transcript::{Blake2bRead, Blake2bWrite, Challenge255};
+use halo2curves::bn256::{Bn256, G1Affine};
+use halo2curves::pairing::Engine;
+use rand_core::OsRng;
+
+use halo2_proofs::{
+    poly::kzg::{
+        commitment::{KZGCommitmentScheme, ParamsKZG},
+        multiopen::ProverGWC,
+        strategy::SingleStrategy,
+    },
+    transcript::{TranscriptReadBuffer, TranscriptWriterBuffer},
+};
+
+use std::marker::PhantomData;
+
+use criterion::{BenchmarkId, Criterion};
+use ff::PrimeField as Field;
+
+fn criterion_benchmark(c: &mut Criterion) {
+    #[derive(Clone, Default)]
+    struct MyCircuit<F: Field> {
+        _marker: PhantomData<F>,
+    }
+
+    #[derive(Clone)]
+    struct MyConfig {
+        selector: Selector,
+        table: TableColumn,
+        advice: Column<Advice>,
+        other_advice: Column<Advice>,
+    }
+
+    impl<F: Field> Circuit<F> for MyCircuit<F> {
+        type Config = MyConfig;
+        type FloorPlanner = SimpleFloorPlanner;
+        type Params = ();
+
+        fn without_witnesses(&self) -> Self {
+            Self::default()
+        }
+
+        fn configure(meta: &mut ConstraintSystem<F>) -> MyConfig {
+            let config = MyConfig {
+                selector: meta.complex_selector(),
+                table: meta.lookup_table_column(),
+                advice: meta.advice_column(),
+                other_advice: meta.advice_column(),
+            };
+
+            let dummy_selector = meta.complex_selector();
+
+            meta.create_gate("degree 6 gate", |meta| {
+                let dummy_selector = meta.query_selector(dummy_selector);
+                let constraints = std::iter::repeat(dummy_selector.clone())
+                    .take(4)
+                    .fold(dummy_selector.clone(), |acc, val| acc * val.clone());
+                Constraints::with_selector(dummy_selector, Some(constraints))
+            });
+
+            meta.lookup("lookup", |meta| {
+                let advice = meta.query_advice(config.advice, Rotation::cur());
+                vec![(advice, config.table)]
+            });
+
+            meta.lookup("lookup", |meta| {
+                let advice = meta.query_advice(config.advice, Rotation::cur());
+                vec![(advice, config.table)]
+            });
+
+            meta.lookup("lookup", |meta| {
+                let advice = meta.query_advice(config.advice, Rotation::cur());
+                vec![(advice, config.table)]
+            });
+
+            meta.lookup("lookup", |meta| {
+                let advice = meta.query_advice(config.advice, Rotation::cur());
+                vec![(advice, config.table)]
+            });
+
+            meta.lookup("lookup", |meta| {
+                let advice = meta.query_advice(config.advice, Rotation::cur());
+                vec![(advice, config.table)]
+            });
+
+            /*
+                - We need degree at least 6 because 6 - 1 = 5 and we need to go to extended domain of 8n
+                - Our goal is to get to max degree of 9 because now 9 - 1 = 8 and that will fit into domain
+
+                - base degree = table_deg + 2
+                - if we put input_expression_degree = 1
+                => degree = base + 1 = 3 + 1 = 4
+                - we can batch one more with 5 more lookups
+            */
+
+            config
+        }
+
+        fn synthesize(
+            &self,
+            config: MyConfig,
+            mut layouter: impl Layouter<F>,
+        ) -> Result<(), Error> {
+            layouter.assign_table(
+                || "8-bit table",
+                |mut table| {
+                    for row in 0u64..(1 << 8) {
+                        table.assign_cell(
+                            || format!("row {}", row),
+                            config.table,
+                            row as usize,
+                            || Value::known(F::from(row)),
+                        )?;
+                    }
+
+                    Ok(())
+                },
+            )?;
+
+            layouter.assign_region(
+                || "assign values",
+                |mut region| {
+                    for offset in 0u64..(1 << 10) {
+                        config.selector.enable(&mut region, offset as usize)?;
+                        region.assign_advice(
+                            || format!("offset {}", offset),
+                            config.advice,
+                            offset as usize,
+                            || Value::known(F::from(offset % 256)),
+                        )?;
+                    }
+                    for offset in 1u64..(1 << 10) {
+                        config.selector.enable(&mut region, offset as usize)?;
+                        region.assign_advice(
+                            || format!("offset {}", offset),
+                            config.other_advice,
+                            offset as usize - 1,
+                            || Value::known(F::from(offset % 256)),
+                        )?;
+                    }
+                    Ok(())
+                },
+            )
+        }
+    }
+
+    fn keygen(k: u32) -> (ParamsKZG<Bn256>, ProvingKey<G1Affine>) {
+        let params: ParamsKZG<Bn256> = ParamsKZG::new(k);
+        let empty_circuit: MyCircuit<<Bn256 as Engine>::Scalar> = MyCircuit {
+            _marker: PhantomData,
+        };
+        let vk = keygen_vk(&params, &empty_circuit).expect("keygen_vk should not fail");
+        let pk = keygen_pk(&params, vk, &empty_circuit).expect("keygen_pk should not fail");
+        (params, pk)
+    }
+
+    fn prover(_k: u32, params: &ParamsKZG<Bn256>, pk: &ProvingKey<G1Affine>) -> Vec<u8> {
+        let rng = OsRng;
+
+        let circuit: MyCircuit<<Bn256 as Engine>::Scalar> = MyCircuit {
+            _marker: PhantomData,
+        };
+
+        let mut transcript = Blake2bWrite::<_, _, Challenge255<G1Affine>>::init(vec![]);
+        create_proof::<KZGCommitmentScheme<Bn256>, ProverGWC<'_, Bn256>, _, _, _, _>(
+            params,
+            pk,
+            &[circuit],
+            &[&[]],
+            rng,
+            &mut transcript,
+        )
+        .expect("proof generation should not fail");
+        transcript.finalize()
+    }
+
+    fn verifier(params: &ParamsKZG<Bn256>, vk: &VerifyingKey<G1Affine>, proof: &[u8]) {
+        let strategy = SingleStrategy::new(params);
+        let mut transcript = Blake2bRead::<_, _, Challenge255<G1Affine>>::init(proof);
+        assert!(verify_proof::<
+            KZGCommitmentScheme<Bn256>,
+            VerifierGWC<'_, Bn256>,
+            Challenge255<G1Affine>,
+            Blake2bRead<&[u8], G1Affine, Challenge255<G1Affine>>,
+            SingleStrategy<'_, Bn256>,
+        >(params, vk, strategy, &[&[]], &mut transcript)
+        .is_ok());
+    }
+
+    let k_range = 16..=16;
+
+    let mut keygen_group = c.benchmark_group("plonk-keygen");
+    keygen_group.sample_size(10);
+    for k in k_range.clone() {
+        keygen_group.bench_with_input(BenchmarkId::from_parameter(k), &k, |b, &k| {
+            b.iter(|| keygen(k));
+        });
+    }
+    keygen_group.finish();
+
+    let mut prover_group = c.benchmark_group("plonk-prover");
+    prover_group.sample_size(10);
+    for k in k_range.clone() {
+        let (params, pk) = keygen(k);
+
+        prover_group.bench_with_input(
+            BenchmarkId::from_parameter(k),
+            &(k, &params, &pk),
+            |b, &(k, params, pk)| {
+                b.iter(|| prover(k, params, pk));
+            },
+        );
+    }
+    prover_group.finish();
+
+    let mut verifier_group = c.benchmark_group("plonk-verifier");
+    for k in k_range {
+        let (params, pk) = keygen(k);
+        let proof = prover(k, &params, &pk);
+
+        verifier_group.bench_with_input(
+            BenchmarkId::from_parameter(k),
+            &(&params, pk.get_vk(), &proof[..]),
+            |b, &(params, vk, proof)| {
+                b.iter(|| verifier(params, vk, proof));
+            },
+        );
+    }
+    verifier_group.finish();
+}
+
+criterion_group!(benches, criterion_benchmark);
+criterion_main!(benches);
diff --git a/halo2_proofs/src/arithmetic.rs b/halo2_proofs/src/arithmetic.rs
index f831aa48fd..458a8b8505 100644
--- a/halo2_proofs/src/arithmetic.rs
+++ b/halo2_proofs/src/arithmetic.rs
@@ -188,7 +188,7 @@ pub fn best_multiexp<C: CurveAffine>(coeffs: &[C::Scalar], bases: &[C]) -> C::Cu
 pub fn best_fft<Scalar: Field, G: FftGroup<Scalar>>(a: &mut [G], omega: Scalar, log_n: u32) {
     let threads = multicore::current_num_threads();
     let log_split = log2_floor(threads) as usize;
-    let n = a.len() as usize;
+    let n = a.len();
     let sub_n = n >> log_split;
     let split_m = 1 << log_split;
 
@@ -215,7 +215,7 @@ fn serial_fft<Scalar: Field, G: FftGroup<Scalar>>(a: &mut [G], omega: Scalar, lo
     for k in 0..n as usize {
         let rk = bitreverse(k, log_n as usize);
         if k < rk {
-            a.swap(rk as usize, k as usize);
+            a.swap(rk, k);
         }
     }
 
@@ -258,7 +258,7 @@ fn serial_split_fft<Scalar: Field, G: FftGroup<Scalar>>(
         let high_idx = omega_idx >> SPARSE_TWIDDLE_DEGREE;
         let mut w_m = twiddle_lut[low_idx];
         if high_idx > 0 {
-            w_m = w_m * twiddle_lut[(1 << SPARSE_TWIDDLE_DEGREE) + high_idx];
+            w_m *= twiddle_lut[(1 << SPARSE_TWIDDLE_DEGREE) + high_idx];
         }
 
         let mut k = 0;
@@ -298,28 +298,28 @@ fn split_radix_fft<Scalar: Field, G: FftGroup<Scalar>>(
     // used to be: vec![G::identity; split_m];
     // let mut t1 = a.clone();
     // if unsafe code is allowed, a 10% performance improvement can be achieved
-    let mut t1: Vec<G> = Vec::with_capacity(split_m as usize);
+    let mut t1: Vec<G> = Vec::with_capacity(split_m);
     unsafe {
-        t1.set_len(split_m as usize);
+        t1.set_len(split_m);
     }
     for i in 0..split_m {
-        t1[bitreverse(i, log_split)] = a[(i * sub_n + sub_fft_offset)];
+        t1[bitreverse(i, log_split)] = a[i * sub_n + sub_fft_offset];
     }
     serial_split_fft(&mut t1, twiddle_lut, sub_n, log_split as u32);
 
     let sparse_degree = SPARSE_TWIDDLE_DEGREE;
-    let omega_idx = sub_fft_offset as usize;
+    let omega_idx = sub_fft_offset;
     let low_idx = omega_idx % (1 << sparse_degree);
     let high_idx = omega_idx >> sparse_degree;
     let mut omega = twiddle_lut[low_idx];
     if high_idx > 0 {
-        omega = omega * twiddle_lut[(1 << sparse_degree) + high_idx];
+        omega *= twiddle_lut[(1 << sparse_degree) + high_idx];
     }
     let mut w_m = Scalar::ONE;
     for i in 0..split_m {
         t1[i] *= &w_m;
         tmp[i] = t1[i];
-        w_m = w_m * omega;
+        w_m *= omega;
     }
 }
 
@@ -339,7 +339,7 @@ pub fn generate_twiddle_lookup_table<F: Field>(
             let mut w_n = omega.pow_vartime([start as u64, 0, 0, 0]);
             for twiddle_lut in twiddle_lut.iter_mut() {
                 *twiddle_lut = w_n;
-                w_n = w_n * omega;
+                w_n *= omega;
             }
         });
         return twiddle_lut;
@@ -348,14 +348,14 @@ pub fn generate_twiddle_lookup_table<F: Field>(
     // sparse
     let low_degree_lut_len = 1 << sparse_degree;
     let high_degree_lut_len = 1 << (log_n - sparse_degree - without_last_level as u32);
-    let mut twiddle_lut = vec![F::ZERO; (low_degree_lut_len + high_degree_lut_len) as usize];
+    let mut twiddle_lut = vec![F::ZERO; low_degree_lut_len + high_degree_lut_len];
     parallelize(
         &mut twiddle_lut[..low_degree_lut_len],
         |twiddle_lut, start| {
             let mut w_n = omega.pow_vartime([start as u64, 0, 0, 0]);
             for twiddle_lut in twiddle_lut.iter_mut() {
                 *twiddle_lut = w_n;
-                w_n = w_n * omega;
+                w_n *= omega;
             }
         },
     );
@@ -366,7 +366,7 @@ pub fn generate_twiddle_lookup_table<F: Field>(
             let mut w_n = high_degree_omega.pow_vartime([start as u64, 0, 0, 0]);
             for twiddle_lut in twiddle_lut.iter_mut() {
                 *twiddle_lut = w_n;
-                w_n = w_n * high_degree_omega;
+                w_n *= high_degree_omega;
             }
         },
     );
@@ -374,7 +374,7 @@ pub fn generate_twiddle_lookup_table<F: Field>(
 }
 
 pub fn parallel_fft<Scalar: Field, G: FftGroup<Scalar>>(a: &mut [G], omega: Scalar, log_n: u32) {
-    let n = a.len() as usize;
+    let n = a.len();
     assert_eq!(n, 1 << log_n);
 
     let log_split = log2_floor(multicore::current_num_threads()) as usize;
@@ -536,8 +536,17 @@ where
 }
 
 /// This utility function will parallelize an operation that is to be
+pub fn par_invert<F: Field>(values: &mut [F]) {
+    parallelize(values, |values, _start| {
+        values.batch_invert();
+    });
+}
+
 /// performed over a mutable slice.
-pub fn parallelize<T: Send, F: Fn(&mut [T], usize) + Send + Sync + Clone>(v: &mut [T], f: F) {
+pub(crate) fn parallelize_internal<T: Send, F: Fn(&mut [T], usize) + Send + Sync + Clone>(
+    v: &mut [T],
+    f: F,
+) -> Vec<usize> {
     // Algorithm rationale:
     //
     // Using the stdlib `chunks_mut` will lead to severe load imbalance.
@@ -571,10 +580,12 @@ pub fn parallelize<T: Send, F: Fn(&mut [T], usize) + Send + Sync + Clone>(v: &mu
 
     multicore::scope(|scope| {
         // Skip special-case: number of iterations is cleanly divided by number of threads.
+        let mut chunk_starts = vec![];
         if cutoff_chunk_id != 0 {
             for (chunk_id, chunk) in v_hi.chunks_exact_mut(base_chunk_size + 1).enumerate() {
                 let offset = chunk_id * (base_chunk_size + 1);
                 scope.spawn(move |_| f(chunk, offset));
+                chunk_starts.push(offset);
             }
         }
         // Skip special-case: less iterations than number of threads.
@@ -582,9 +593,16 @@ pub fn parallelize<T: Send, F: Fn(&mut [T], usize) + Send + Sync + Clone>(v: &mu
             for (chunk_id, chunk) in v_lo.chunks_exact_mut(base_chunk_size).enumerate() {
                 let offset = split_pos + (chunk_id * base_chunk_size);
                 scope.spawn(move |_| f(chunk, offset));
+                chunk_starts.push(offset);
             }
         }
-    });
+
+        chunk_starts
+    })
+}
+
+pub fn parallelize<T: Send, F: Fn(&mut [T], usize) + Send + Sync + Clone>(v: &mut [T], f: F) {
+    parallelize_internal(v, f);
 }
 
 fn log2_floor(num: usize) -> u32 {
@@ -634,7 +652,7 @@ pub fn lagrange_interpolate<F: Field>(points: &[F], evals: &[F]) -> Vec<F> {
                 .enumerate()
                 .filter(|&(k, _)| k != j)
                 .map(|a| a.1)
-                .zip(denoms.into_iter())
+                .zip(denoms)
             {
                 product.resize(tmp.len() + 1, F::ZERO);
                 for ((a, b), product) in tmp
@@ -649,7 +667,7 @@ pub fn lagrange_interpolate<F: Field>(points: &[F], evals: &[F]) -> Vec<F> {
             }
             assert_eq!(tmp.len(), points.len());
             assert_eq!(product.len(), points.len() - 1);
-            for (final_coeff, interpolation_coeff) in final_poly.iter_mut().zip(tmp.into_iter()) {
+            for (final_coeff, interpolation_coeff) in final_poly.iter_mut().zip(tmp) {
                 *final_coeff += interpolation_coeff * eval;
             }
         }
diff --git a/halo2_proofs/src/circuit.rs b/halo2_proofs/src/circuit.rs
index f966e15634..2081d37bcd 100644
--- a/halo2_proofs/src/circuit.rs
+++ b/halo2_proofs/src/circuit.rs
@@ -221,6 +221,16 @@ impl<'r, F: Field> Region<'r, F> {
             .name_column(&|| annotation().into(), column.into());
     }
 
+    /// Get the last assigned value of an advice cell.
+    pub fn query_advice(&self, column: Column<Advice>, offset: usize) -> Result<F, Error> {
+        self.region.query_advice(column, offset)
+    }
+
+    /// Get the last assigned value of a fixed cell.
+    pub fn query_fixed(&self, column: Column<Fixed>, offset: usize) -> Result<F, Error> {
+        self.region.query_fixed(column, offset)
+    }
+
     /// Assign an advice column value (witness).
     ///
     /// Even though `to` has `FnMut` bounds, it is guaranteed to be called at most once.
@@ -380,6 +390,11 @@ impl<'r, F: Field> Region<'r, F> {
     pub fn constrain_equal(&mut self, left: Cell, right: Cell) -> Result<(), Error> {
         self.region.constrain_equal(left, right)
     }
+
+    /// Return the offset of a row within the overall circuit.
+    pub fn global_offset(&self, row_offset: usize) -> usize {
+        self.region.global_offset(row_offset)
+    }
 }
 
 /// A lookup table in the circuit.
diff --git a/halo2_proofs/src/circuit/floor_planner/single_pass.rs b/halo2_proofs/src/circuit/floor_planner/single_pass.rs
index 2d7d4afe98..4a6d78e7a8 100644
--- a/halo2_proofs/src/circuit/floor_planner/single_pass.rs
+++ b/halo2_proofs/src/circuit/floor_planner/single_pass.rs
@@ -2,10 +2,10 @@ use std::cmp;
 use std::collections::HashMap;
 use std::fmt;
 use std::marker::PhantomData;
-use std::ops::Range;
-use std::sync::{Arc, Mutex};
 use std::time::Instant;
 
+use rayon::prelude::{IndexedParallelIterator, IntoParallelIterator, ParallelIterator};
+
 use ff::Field;
 
 use ark_std::{end_timer, start_timer};
@@ -16,7 +16,6 @@ use crate::{
         table_layouter::{compute_table_lengths, SimpleTableLayouter},
         Cell, Layouter, Region, RegionIndex, RegionStart, Table, Value,
     },
-    multicore,
     plonk::{
         Advice, Any, Assigned, Assignment, Challenge, Circuit, Column, Error, Fixed, FloorPlanner,
         Instance, Selector, TableColumn,
@@ -82,6 +81,7 @@ impl<'a, F: Field, CS: Assignment<F> + 'a> SingleChipLayouter<'a, F, CS> {
         Ok(ret)
     }
 
+    #[allow(dead_code)]
     fn fork(&self, sub_cs: Vec<&'a mut CS>) -> Result<Vec<Self>, Error> {
         Ok(sub_cs
             .into_iter()
@@ -261,39 +261,28 @@ impl<'a, F: Field, CS: Assignment<F> + 'a + SyncDeps> Layouter<F>
         let ref_sub_cs = sub_cs.iter_mut().collect();
         let sub_layouters = self.fork(ref_sub_cs)?;
         let regions_2nd_pass = Instant::now();
-        let ret = crossbeam::scope(|scope| {
-            let mut handles = vec![];
-            for (i, (mut assignment, mut sub_layouter)) in assignments
-                .into_iter()
-                .zip(sub_layouters.into_iter())
-                .enumerate()
-            {
+        let ret = assignments
+            .into_par_iter()
+            .zip(sub_layouters.into_par_iter())
+            .enumerate()
+            .map(|(i, (mut assignment, mut sub_layouter))| {
                 let region_name = format!("{}_{}", region_name, i);
-                handles.push(scope.spawn(move |_| {
-                    let sub_region_2nd_pass = Instant::now();
-                    sub_layouter.cs.enter_region(|| region_name.clone());
-                    let mut region =
-                        SingleChipLayouterRegion::new(&mut sub_layouter, (region_index + i).into());
-                    let region_ref: &mut dyn RegionLayouter<F> = &mut region;
-                    let result = assignment(region_ref.into());
-                    let constant = region.constants.clone();
-                    sub_layouter.cs.exit_region();
-                    log::debug!(
-                        "region {} 2nd pass synthesis took {:?}",
-                        region_name,
-                        sub_region_2nd_pass.elapsed()
-                    );
-
-                    (result, constant)
-                }));
-            }
-
-            handles
-                .into_iter()
-                .map(|handle| handle.join().expect("handle.join should never fail"))
-                .collect::<Vec<_>>()
-        })
-        .expect("scope should not fail");
+                let sub_region_2nd_pass = Instant::now();
+                sub_layouter.cs.enter_region(|| region_name.clone());
+                let mut region =
+                    SingleChipLayouterRegion::new(&mut sub_layouter, (region_index + i).into());
+                let region_ref: &mut dyn RegionLayouter<F> = &mut region;
+                let result = assignment(region_ref.into());
+                let constant = region.constants.clone();
+                sub_layouter.cs.exit_region();
+                log::debug!(
+                    "region {} 2nd pass synthesis took {:?}",
+                    region_name,
+                    sub_region_2nd_pass.elapsed()
+                );
+                (result, constant)
+            })
+            .collect::<Vec<_>>();
         let cs_merge_time = Instant::now();
         let num_sub_cs = sub_cs.len();
         self.cs.merge(sub_cs)?;
@@ -475,6 +464,18 @@ impl<'r, 'a, F: Field, CS: Assignment<F> + 'a + SyncDeps> RegionLayouter<F>
         self.layouter.cs.annotate_column(annotation, column);
     }
 
+    fn query_advice(&self, column: Column<Advice>, offset: usize) -> Result<F, Error> {
+        self.layouter
+            .cs
+            .query_advice(column, *self.layouter.regions[*self.region_index] + offset)
+    }
+
+    fn query_fixed(&self, column: Column<Fixed>, offset: usize) -> Result<F, Error> {
+        self.layouter
+            .cs
+            .query_fixed(column, *self.layouter.regions[*self.region_index] + offset)
+    }
+
     fn assign_advice<'v>(
         &'v mut self,
         annotation: &'v (dyn Fn() -> String + 'v),
@@ -576,6 +577,10 @@ impl<'r, 'a, F: Field, CS: Assignment<F> + 'a + SyncDeps> RegionLayouter<F>
 
         Ok(())
     }
+
+    fn global_offset(&self, row_offset: usize) -> usize {
+        *self.layouter.regions[*self.region_index] + row_offset
+    }
 }
 
 #[cfg(test)]
diff --git a/halo2_proofs/src/circuit/floor_planner/v1.rs b/halo2_proofs/src/circuit/floor_planner/v1.rs
index 15c78c2230..642be88d54 100644
--- a/halo2_proofs/src/circuit/floor_planner/v1.rs
+++ b/halo2_proofs/src/circuit/floor_planner/v1.rs
@@ -128,8 +128,7 @@ impl FloorPlanner for V1 {
         if constant_positions().count() < plan.constants.len() {
             return Err(Error::NotEnoughColumnsForConstants);
         }
-        for ((fixed_column, fixed_row), (value, advice)) in
-            constant_positions().zip(plan.constants.into_iter())
+        for ((fixed_column, fixed_row), (value, advice)) in constant_positions().zip(plan.constants)
         {
             plan.cs.assign_fixed(
                 || format!("Constant({:?})", value.evaluate()),
@@ -410,6 +409,18 @@ impl<'r, 'a, F: Field, CS: Assignment<F> + SyncDeps> RegionLayouter<F> for V1Reg
         )
     }
 
+    fn query_advice(&self, column: Column<Advice>, offset: usize) -> Result<F, Error> {
+        self.plan
+            .cs
+            .query_advice(column, *self.plan.regions[*self.region_index] + offset)
+    }
+
+    fn query_fixed(&self, column: Column<Fixed>, offset: usize) -> Result<F, Error> {
+        self.plan
+            .cs
+            .query_fixed(column, *self.plan.regions[*self.region_index] + offset)
+    }
+
     fn assign_advice<'v>(
         &'v mut self,
         annotation: &'v (dyn Fn() -> String + 'v),
@@ -519,6 +530,10 @@ impl<'r, 'a, F: Field, CS: Assignment<F> + SyncDeps> RegionLayouter<F> for V1Reg
 
         Ok(())
     }
+
+    fn global_offset(&self, row_offset: usize) -> usize {
+        *self.plan.regions[*self.region_index] + row_offset
+    }
 }
 
 #[cfg(test)]
diff --git a/halo2_proofs/src/circuit/layouter.rs b/halo2_proofs/src/circuit/layouter.rs
index f939c3fca5..1b7470776f 100644
--- a/halo2_proofs/src/circuit/layouter.rs
+++ b/halo2_proofs/src/circuit/layouter.rs
@@ -73,6 +73,12 @@ pub trait RegionLayouter<F: Field>: fmt::Debug + SyncDeps {
         column: Column<Any>,
     );
 
+    /// Get the last assigned value of an advice cell.
+    fn query_advice(&self, column: Column<Advice>, offset: usize) -> Result<F, Error>;
+
+    /// Get the last assigned value of a fixed cell.
+    fn query_fixed(&self, column: Column<Fixed>, offset: usize) -> Result<F, Error>;
+
     /// Assign an advice column value (witness)
     fn assign_advice<'v>(
         &'v mut self,
@@ -132,6 +138,9 @@ pub trait RegionLayouter<F: Field>: fmt::Debug + SyncDeps {
     ///
     /// Returns an error if either of the cells is not within the given permutation.
     fn constrain_equal(&mut self, left: Cell, right: Cell) -> Result<(), Error>;
+
+    /// Return the offset of a row within the overall circuit.
+    fn global_offset(&self, row_offset: usize) -> usize;
 }
 
 /// The shape of a region. For a region at a certain index, we track
@@ -221,6 +230,14 @@ impl<F: Field> RegionLayouter<F> for RegionShape {
         Ok(())
     }
 
+    fn query_advice(&self, _column: Column<Advice>, _offset: usize) -> Result<F, Error> {
+        Ok(F::ZERO)
+    }
+
+    fn query_fixed(&self, _column: Column<Fixed>, _offset: usize) -> Result<F, Error> {
+        Ok(F::ZERO)
+    }
+
     fn assign_advice<'v>(
         &'v mut self,
         _: &'v (dyn Fn() -> String + 'v),
@@ -312,4 +329,8 @@ impl<F: Field> RegionLayouter<F> for RegionShape {
         // Equality constraints don't affect the region shape.
         Ok(())
     }
+
+    fn global_offset(&self, _row_offset: usize) -> usize {
+        0
+    }
 }
diff --git a/halo2_proofs/src/dev.rs b/halo2_proofs/src/dev.rs
index 8fc0a89a32..2eb4e063e1 100644
--- a/halo2_proofs/src/dev.rs
+++ b/halo2_proofs/src/dev.rs
@@ -5,7 +5,6 @@ use std::collections::HashSet;
 use std::iter;
 use std::ops::{Add, Mul, Neg, Range};
 use std::sync::Arc;
-use std::time::Instant;
 
 use blake2b_simd::blake2b;
 use ff::Field;
@@ -24,8 +23,6 @@ use crate::{
 use crate::{plonk::sealed::SealedPhase, plonk::FirstPhase, plonk::Phase};
 #[cfg(feature = "multiphase-mock-prover")]
 use ff::BatchInvert;
-#[cfg(feature = "multiphase-mock-prover")]
-use group::Group;
 
 #[cfg(feature = "multicore")]
 use crate::multicore::{
@@ -130,7 +127,7 @@ impl<F: Field> PartialEq for CellValue<F> {
 }
 
 #[cfg(feature = "mock-batch-inv")]
-impl<F: Group + Field> CellValue<F> {
+impl<F: Field> CellValue<F> {
     /// Returns the numerator.
     pub fn numerator(&self) -> Option<F> {
         match self {
@@ -149,7 +146,7 @@ impl<F: Group + Field> CellValue<F> {
 }
 
 #[cfg(feature = "mock-batch-inv")]
-impl<F: Group + Field> From<Assigned<F>> for CellValue<F> {
+impl<F: Field> From<Assigned<F>> for CellValue<F> {
     fn from(value: Assigned<F>) -> Self {
         match value {
             Assigned::Zero => CellValue::Unassigned,
@@ -162,10 +159,7 @@ impl<F: Group + Field> From<Assigned<F>> for CellValue<F> {
 }
 
 #[cfg(feature = "mock-batch-inv")]
-fn calculate_assigned_values<F: Group + Field>(
-    cell_values: &mut [CellValue<F>],
-    inv_denoms: &[Option<F>],
-) {
+fn calculate_assigned_values<F: Field>(cell_values: &mut [CellValue<F>], inv_denoms: &[Option<F>]) {
     assert_eq!(inv_denoms.len(), cell_values.len());
     for (value, inv_den) in cell_values.iter_mut().zip(inv_denoms.iter()) {
         // if numerator and denominator exist, calculate the assigned value
@@ -178,7 +172,7 @@ fn calculate_assigned_values<F: Group + Field>(
 }
 
 #[cfg(feature = "mock-batch-inv")]
-fn batch_invert_cellvalues<F: Field + Group>(cell_values: &mut [Vec<CellValue<F>>]) {
+fn batch_invert_cellvalues<F: Field>(cell_values: &mut [Vec<CellValue<F>>]) {
     let mut denominators: Vec<_> = cell_values
         .iter()
         .map(|f| {
@@ -709,6 +703,56 @@ impl<'a, F: Field> Assignment<F> for MockProver<'a, F> {
         Ok(())
     }
 
+    fn query_advice(&self, column: Column<Advice>, row: usize) -> Result<F, Error> {
+        if !self.usable_rows.contains(&row) {
+            return Err(Error::not_enough_rows_available(self.k));
+        }
+        if !self.rw_rows.contains(&row) {
+            return Err(Error::InvalidRange(
+                row,
+                self.current_region
+                    .as_ref()
+                    .map(|region| region.name.clone())
+                    .unwrap(),
+            ));
+        }
+        self.advice
+            .get(column.index())
+            .and_then(|v| v.get(row - self.rw_rows.start))
+            .map(|v| match v {
+                CellValue::Assigned(f) => *f,
+                #[cfg(feature = "mock-batch-inv")]
+                CellValue::Rational(n, d) => *n * d.invert().unwrap_or(F::ZERO),
+                _ => F::ZERO,
+            })
+            .ok_or(Error::BoundsFailure)
+    }
+
+    fn query_fixed(&self, column: Column<Fixed>, row: usize) -> Result<F, Error> {
+        if !self.usable_rows.contains(&row) {
+            return Err(Error::not_enough_rows_available(self.k));
+        }
+        if !self.rw_rows.contains(&row) {
+            return Err(Error::InvalidRange(
+                row,
+                self.current_region
+                    .as_ref()
+                    .map(|region| region.name.clone())
+                    .unwrap(),
+            ));
+        }
+        self.fixed
+            .get(column.index())
+            .and_then(|v| v.get(row - self.rw_rows.start))
+            .map(|v| match v {
+                CellValue::Assigned(f) => *f,
+                #[cfg(feature = "mock-batch-inv")]
+                CellValue::Rational(n, d) => *n * d.invert().unwrap_or(F::ZERO),
+                _ => F::ZERO,
+            })
+            .ok_or(Error::BoundsFailure)
+    }
+
     fn query_instance(
         &self,
         column: Column<Instance>,
@@ -827,11 +871,13 @@ impl<'a, F: Field> Assignment<F> for MockProver<'a, F> {
         }
 
         #[cfg(not(feature = "multiphase-mock-prover"))]
-        *self
-            .advice
-            .get_mut(column.index())
-            .and_then(|v| v.get_mut(row - self.rw_rows.start))
-            .ok_or(Error::BoundsFailure)? = assigned;
+        {
+            *self
+                .advice
+                .get_mut(column.index())
+                .and_then(|v| v.get_mut(row - self.rw_rows.start))
+                .ok_or(Error::BoundsFailure)? = assigned;
+        }
 
         #[cfg(feature = "phase-check")]
         // if false && self.current_phase.0 > column.column_type().phase.0 {
@@ -1042,7 +1088,7 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
         let config = ConcreteCircuit::configure_with_params(&mut cs, circuit.params());
         #[cfg(not(feature = "circuit-params"))]
         let config = ConcreteCircuit::configure(&mut cs);
-        let cs = cs;
+        let cs = cs.chunk_lookups();
 
         assert!(
             n >= cs.minimum_rows(),
@@ -1130,7 +1176,10 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
             instance,
             selectors_vec,
             selectors,
+            #[cfg(feature = "phase-check")]
             challenges: challenges.clone(),
+            #[cfg(not(feature = "phase-check"))]
+            challenges,
             permutation: Some(permutation),
             rw_rows: 0..usable_rows,
             usable_rows: 0..usable_rows,
@@ -1192,7 +1241,7 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
 
         #[cfg(not(feature = "phase-check"))]
         {
-            let syn_time = Instant::now();
+            let syn_time = std::time::Instant::now();
 
             #[cfg(feature = "multiphase-mock-prover")]
             for current_phase in prover.cs.phases() {
@@ -1248,7 +1297,7 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
         debug_assert_eq!(Arc::strong_count(&prover.fixed_vec), 1);
 
         #[cfg(feature = "thread-safe-region")]
-        prover.permutation.build_ordered_mapping();
+        prover.permutation.as_mut().unwrap().build_ordered_mapping();
 
         Ok(prover)
     }
@@ -1485,7 +1534,6 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
                 .iter()
                 .enumerate()
                 .flat_map(|(lookup_index, lookup)| {
-                    assert!(lookup.table_expressions.len() == lookup.input_expressions.len());
                     assert!(self.usable_rows.end > 0);
 
                     // We optimize on the basis that the table might have been filled so that the last
@@ -1531,48 +1579,53 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
                     }
                     let table = &cached_table;
 
-                    let mut inputs: Vec<(Vec<_>, usize)> = lookup_input_row_ids
-                        .clone()
-                        .filter_map(|input_row| {
-                            let t = lookup
-                                .input_expressions
-                                .iter()
-                                .map(move |c| load(c, input_row))
-                                .collect();
-
-                            if t != fill_row {
-                                // Also keep track of the original input row, since we're going to sort.
-                                Some((t, input_row))
-                            } else {
-                                None
-                            }
-                        })
-                        .collect();
-                    inputs.sort_unstable();
-
-                    let mut i = 0;
-                    inputs
+                    lookup
+                        .inputs_expressions
                         .iter()
-                        .filter_map(move |(input, input_row)| {
-                            while i < table.len() && &table[i] < input {
-                                i += 1;
-                            }
-                            if i == table.len() || &table[i] > input {
-                                assert!(table.binary_search(input).is_err());
+                        .map(|input_expressions| {
+                            let mut inputs: Vec<(Vec<_>, usize)> = lookup_input_row_ids
+                                .clone()
+                                .filter_map(|input_row| {
+                                    let t = input_expressions
+                                        .iter()
+                                        .map(move |c| load(c, input_row))
+                                        .collect();
+
+                                    if t != fill_row {
+                                        // Also keep track of the original input row, since we're going to sort.
+                                        Some((t, input_row))
+                                    } else {
+                                        None
+                                    }
+                                })
+                                .collect();
+                            inputs.sort_unstable();
 
-                                Some(VerifyFailure::Lookup {
-                                    name: lookup.name.clone(),
-                                    lookup_index,
-                                    location: FailureLocation::find_expressions(
-                                        &self.cs,
-                                        &self.regions,
-                                        *input_row,
-                                        lookup.input_expressions.iter(),
-                                    ),
+                            let mut i = 0;
+                            inputs
+                                .iter()
+                                .filter_map(move |(input, input_row)| {
+                                    while i < table.len() && &table[i] < input {
+                                        i += 1;
+                                    }
+                                    if i == table.len() || &table[i] > input {
+                                        assert!(table.binary_search(input).is_err());
+
+                                        Some(VerifyFailure::Lookup {
+                                            name: lookup.name.to_string(),
+                                            lookup_index,
+                                            location: FailureLocation::find_expressions(
+                                                &self.cs,
+                                                &self.regions,
+                                                *input_row,
+                                                input_expressions.iter(),
+                                            ),
+                                        })
+                                    } else {
+                                        None
+                                    }
                                 })
-                            } else {
-                                None
-                            }
+                                .collect::<Vec<_>>()
                         })
                         .collect::<Vec<_>>()
                 });
@@ -1692,7 +1745,7 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
         let mut errors: Vec<_> = iter::empty()
             .chain(selector_errors)
             .chain(gate_errors)
-            .chain(lookup_errors)
+            .chain(lookup_errors.flatten())
             .chain(perm_errors)
             .chain(shuffle_errors)
             .collect();
@@ -1953,7 +2006,6 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
                 .iter()
                 .enumerate()
                 .flat_map(|(lookup_index, lookup)| {
-                    assert!(lookup.table_expressions.len() == lookup.input_expressions.len());
                     assert!(self.usable_rows.end > 0);
 
                     // We optimize on the basis that the table might have been filled so that the last
@@ -2000,43 +2052,48 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
                     }
                     let table = &cached_table;
 
-                    let mut inputs: Vec<(Vec<_>, usize)> = lookup_input_row_ids
-                        .clone()
-                        .into_par_iter()
-                        .filter_map(|input_row| {
-                            let t = lookup
-                                .input_expressions
-                                .iter()
-                                .map(move |c| load(c, input_row))
+                    lookup
+                        .inputs_expressions
+                        .iter()
+                        .map(|input_expressions| {
+                            let mut inputs: Vec<(Vec<_>, usize)> = lookup_input_row_ids
+                                .clone()
+                                .into_par_iter()
+                                .filter_map(|input_row| {
+                                    let t = input_expressions
+                                        .iter()
+                                        .map(move |c| load(c, input_row))
+                                        .collect();
+
+                                    if t != fill_row {
+                                        // Also keep track of the original input row, since we're going to sort.
+                                        Some((t, input_row))
+                                    } else {
+                                        None
+                                    }
+                                })
                                 .collect();
-
-                            if t != fill_row {
-                                // Also keep track of the original input row, since we're going to sort.
-                                Some((t, input_row))
-                            } else {
-                                None
-                            }
-                        })
-                        .collect();
-                    inputs.par_sort_unstable();
-
-                    inputs
-                        .par_iter()
-                        .filter_map(move |(input, input_row)| {
-                            if table.binary_search(input).is_err() {
-                                Some(VerifyFailure::Lookup {
-                                    name: lookup.name.clone(),
-                                    lookup_index,
-                                    location: FailureLocation::find_expressions(
-                                        &self.cs,
-                                        &self.regions,
-                                        *input_row,
-                                        lookup.input_expressions.iter(),
-                                    ),
+                            inputs.par_sort_unstable();
+
+                            inputs
+                                .par_iter()
+                                .filter_map(move |(input, input_row)| {
+                                    if table.binary_search(input).is_err() {
+                                        Some(VerifyFailure::Lookup {
+                                            name: lookup.name.to_string(),
+                                            lookup_index,
+                                            location: FailureLocation::find_expressions(
+                                                &self.cs,
+                                                &self.regions,
+                                                *input_row,
+                                                input_expressions.iter(),
+                                            ),
+                                        })
+                                    } else {
+                                        None
+                                    }
                                 })
-                            } else {
-                                None
-                            }
+                                .collect::<Vec<_>>()
                         })
                         .collect::<Vec<_>>()
                 });
@@ -2156,7 +2213,7 @@ impl<'a, F: FromUniformBytes<64> + Ord> MockProver<'a, F> {
         let mut errors: Vec<_> = iter::empty()
             .chain(selector_errors)
             .chain(gate_errors)
-            .chain(lookup_errors)
+            .chain(lookup_errors.flatten())
             .chain(perm_errors)
             .chain(shuffle_errors)
             .collect();
diff --git a/halo2_proofs/src/dev/cost.rs b/halo2_proofs/src/dev/cost.rs
index 53271f712a..8288006938 100644
--- a/halo2_proofs/src/dev/cost.rs
+++ b/halo2_proofs/src/dev/cost.rs
@@ -201,6 +201,14 @@ impl<F: Field> Assignment<F> for Layout {
         todo!()
     }
 
+    fn query_advice(&self, _column: Column<Advice>, _row: usize) -> Result<F, Error> {
+        Ok(F::ZERO)
+    }
+
+    fn query_fixed(&self, _column: Column<Fixed>, _row: usize) -> Result<F, Error> {
+        Ok(F::ZERO)
+    }
+
     fn query_instance(&self, _: Column<Instance>, _: usize) -> Result<Value<F>, Error> {
         Ok(Value::unknown())
     }
diff --git a/halo2_proofs/src/dev/failure.rs b/halo2_proofs/src/dev/failure.rs
index ac0e79c01a..37f7d2d8d6 100644
--- a/halo2_proofs/src/dev/failure.rs
+++ b/halo2_proofs/src/dev/failure.rs
@@ -172,7 +172,6 @@ pub enum VerifyFailure {
     },
     /// A lookup input did not exist in its corresponding table.
     Lookup {
-        /// The name of the lookup that is not satisfied.
         name: String,
         /// The index of the lookup that is not satisfied. These indices are assigned in
         /// the order in which `ConstraintSystem::lookup` is called during
@@ -505,7 +504,7 @@ fn render_constraint_not_satisfied<F: Field>(
 /// ```
 fn render_lookup<F: Field>(
     prover: &MockProver<F>,
-    name: &str,
+    _name: &str,
     lookup_index: usize,
     location: &FailureLocation,
 ) {
@@ -593,8 +592,10 @@ fn render_lookup<F: Field>(
 
     eprintln!("error: lookup input does not exist in table");
     eprint!("  (");
-    for i in 0..lookup.input_expressions.len() {
-        eprint!("{}L{}", if i == 0 { "" } else { ", " }, i);
+    for input_expressions in lookup.inputs_expressions.iter() {
+        for i in 0..input_expressions.len() {
+            eprint!("{}L{}", if i == 0 { "" } else { ", " }, i);
+        }
     }
 
     eprint!(") ∉ (");
@@ -604,79 +605,81 @@ fn render_lookup<F: Field>(
     eprintln!(")");
 
     eprintln!();
-    eprintln!("  Lookup '{}' inputs:", name);
-    for (i, input) in lookup.input_expressions.iter().enumerate() {
-        // Fetch the cell values (since we don't store them in VerifyFailure::Lookup).
-        let cell_values = input.evaluate(
-            &|_| BTreeMap::default(),
-            &|_| panic!("virtual selectors are removed during optimization"),
-            &cell_value(&util::load_slice(
-                n,
-                row,
-                &cs.fixed_queries,
-                prover.fixed.as_slice(),
-            )),
-            &cell_value(&util::load_slice(
-                n,
-                row,
-                &cs.advice_queries,
-                &prover.advice,
-            )),
-            &cell_value(&util::load_instance(
-                n,
-                row,
-                &cs.instance_queries,
-                &prover.instance,
-            )),
-            &|_| BTreeMap::default(),
-            &|a| a,
-            &|mut a, mut b| {
-                a.append(&mut b);
-                a
-            },
-            &|mut a, mut b| {
-                a.append(&mut b);
-                a
-            },
-            &|a, _| a,
-        );
-
-        // Collect the necessary rendering information:
-        // - The columns involved in this constraint.
-        // - How many cells are in each column.
-        // - The grid of cell values, indexed by rotation.
-        let mut columns = BTreeMap::<metadata::Column, usize>::default();
-        let mut layout = BTreeMap::<i32, BTreeMap<metadata::Column, _>>::default();
-        for (i, (cell, _)) in cell_values.iter().enumerate() {
-            *columns.entry(cell.column).or_default() += 1;
-            layout
-                .entry(cell.rotation)
-                .or_default()
-                .entry(cell.column)
-                .or_insert(format!("x{}", i));
-        }
-
-        if i != 0 {
-            eprintln!();
-        }
-        eprintln!(
-            "    L{} = {}",
-            i,
-            emitter::expression_to_string(input, &layout)
-        );
-        eprintln!("    ^");
+    eprintln!("  Lookup inputs:");
+    for input_expressions in lookup.inputs_expressions.iter() {
+        for (i, input) in input_expressions.iter().enumerate() {
+            // Fetch the cell values (since we don't store them in VerifyFailure::Lookup).
+            let cell_values = input.evaluate(
+                &|_| BTreeMap::default(),
+                &|_| panic!("virtual selectors are removed during optimization"),
+                &cell_value(&util::load_slice(
+                    n,
+                    row,
+                    &cs.fixed_queries,
+                    prover.fixed.as_slice(),
+                )),
+                &cell_value(&util::load_slice(
+                    n,
+                    row,
+                    &cs.advice_queries,
+                    &prover.advice,
+                )),
+                &cell_value(&util::load_instance(
+                    n,
+                    row,
+                    &cs.instance_queries,
+                    &prover.instance,
+                )),
+                &|_| BTreeMap::default(),
+                &|a| a,
+                &|mut a, mut b| {
+                    a.append(&mut b);
+                    a
+                },
+                &|mut a, mut b| {
+                    a.append(&mut b);
+                    a
+                },
+                &|a, _| a,
+            );
+
+            // Collect the necessary rendering information:
+            // - The columns involved in this constraint.
+            // - How many cells are in each column.
+            // - The grid of cell values, indexed by rotation.
+            let mut columns = BTreeMap::<metadata::Column, usize>::default();
+            let mut layout = BTreeMap::<i32, BTreeMap<metadata::Column, _>>::default();
+            for (i, (cell, _)) in cell_values.iter().enumerate() {
+                *columns.entry(cell.column).or_default() += 1;
+                layout
+                    .entry(cell.rotation)
+                    .or_default()
+                    .entry(cell.column)
+                    .or_insert(format!("x{}", i));
+            }
 
-        emitter::render_cell_layout("    | ", location, &columns, &layout, |_, rotation| {
-            if rotation == 0 {
-                eprint!(" <--{{ Lookup '{}' inputs queried here", name);
+            if i != 0 {
+                eprintln!();
             }
-        });
+            eprintln!(
+                "    L{} = {}",
+                i,
+                emitter::expression_to_string(input, &layout)
+            );
+            eprintln!("    ^");
+
+            emitter::render_cell_layout("    | ", location, &columns, &layout, |_, rotation| {
+                if rotation == 0 {
+                    eprint!(" <--{{ Lookup inputs queried here");
+                }
+            });
 
-        // Print the map from local variables to assigned values.
-        eprintln!("    |");
-        eprintln!("    | Assigned cell values:");
-        for (i, (_, value)) in cell_values.iter().enumerate() {
-            eprintln!("    |   x{} = {}", i, value);
+            // Print the map from local variables to assigned values.
+            eprintln!("    |");
+            eprintln!("    | Assigned cell values:");
+            for (i, (_, value)) in cell_values.iter().enumerate() {
+                eprintln!("    |   x{} = {}", i, value);
+            }
         }
     }
 }
diff --git a/halo2_proofs/src/dev/graph.rs b/halo2_proofs/src/dev/graph.rs
index 7fbf9f2f6b..744f41d209 100644
--- a/halo2_proofs/src/dev/graph.rs
+++ b/halo2_proofs/src/dev/graph.rs
@@ -119,6 +119,14 @@ impl<F: Field> Assignment<F> for Graph {
         // Do nothing
     }
 
+    fn query_advice(&self, _column: Column<Advice>, _row: usize) -> Result<F, Error> {
+        Ok(F::ZERO)
+    }
+
+    fn query_fixed(&self, _column: Column<Fixed>, _row: usize) -> Result<F, Error> {
+        Ok(F::ZERO)
+    }
+
     fn query_instance(&self, _: Column<Instance>, _: usize) -> Result<Value<F>, Error> {
         Ok(Value::unknown())
     }
diff --git a/halo2_proofs/src/dev/tfp.rs b/halo2_proofs/src/dev/tfp.rs
index 736ea790b7..65340b35a8 100644
--- a/halo2_proofs/src/dev/tfp.rs
+++ b/halo2_proofs/src/dev/tfp.rs
@@ -269,6 +269,14 @@ impl<'r, F: Field> RegionLayouter<F> for TracingRegion<'r, F> {
     ) {
     }
 
+    fn query_advice(&self, column: Column<Advice>, offset: usize) -> Result<F, Error> {
+        self.0.query_advice(column, offset)
+    }
+
+    fn query_fixed(&self, column: Column<Fixed>, offset: usize) -> Result<F, Error> {
+        self.0.query_fixed(column, offset)
+    }
+
     fn assign_advice<'v>(
         &'v mut self,
         annotation: &'v (dyn Fn() -> String + 'v),
@@ -365,6 +373,10 @@ impl<'r, F: Field> RegionLayouter<F> for TracingRegion<'r, F> {
         debug!(target: "constrain_equal", left = ?left, right = ?right);
         self.0.constrain_equal(left, right)
     }
+
+    fn global_offset(&self, row_offset: usize) -> usize {
+        self.0.global_offset(row_offset)
+    }
 }
 
 /// A helper type that augments an [`Assignment`] with [`tracing`] spans and events.
@@ -425,6 +437,14 @@ impl<'cs, F: Field, CS: Assignment<F>> Assignment<F> for TracingAssignment<'cs,
         self.cs.enable_selector(|| annotation, selector, row)
     }
 
+    fn query_advice(&self, column: Column<Advice>, row: usize) -> Result<F, Error> {
+        self.cs.query_advice(column, row)
+    }
+
+    fn query_fixed(&self, column: Column<Fixed>, row: usize) -> Result<F, Error> {
+        self.cs.query_fixed(column, row)
+    }
+
     fn query_instance(&self, column: Column<Instance>, row: usize) -> Result<Value<F>, Error> {
         let _guard = debug_span!("positioned").entered();
         debug!(target: "query_instance", column = ?column, row = row);
diff --git a/halo2_proofs/src/helpers.rs b/halo2_proofs/src/helpers.rs
index 0c93fa0204..179bdbed26 100644
--- a/halo2_proofs/src/helpers.rs
+++ b/halo2_proofs/src/helpers.rs
@@ -46,6 +46,10 @@ pub fn field_to_bn<F: PrimeField>(f: &F) -> BigUint {
 
 /// Input a big integer `bn`, compute a field element `f`
 /// such that `f == bn % F::MODULUS`.
+/// Require:
+/// - bn is less than 512 bits.
+/// Return:
+/// - bn mod F::MODULUS when bn > F::MODULUS
 pub fn bn_to_field<F: PrimeField>(bn: &BigUint) -> F
 where
     F: FromUniformBytes<64>,
diff --git a/halo2_proofs/src/lib.rs b/halo2_proofs/src/lib.rs
index f79ce2c8dd..d670143b21 100644
--- a/halo2_proofs/src/lib.rs
+++ b/halo2_proofs/src/lib.rs
@@ -8,6 +8,26 @@
 #![feature(stmt_expr_attributes)]
 // #![deny(missing_docs)]
 // #![deny(unsafe_code)]
+#![allow(clippy::uninit_vec)]
+#![allow(clippy::too_many_arguments)]
+
+#[cfg(feature = "counter")]
+extern crate lazy_static;
+
+#[cfg(feature = "counter")]
+use lazy_static::lazy_static;
+
+#[cfg(feature = "counter")]
+use std::sync::Mutex;
+
+#[cfg(feature = "counter")]
+use std::collections::BTreeMap;
+
+#[cfg(feature = "counter")]
+lazy_static! {
+    static ref FFT_COUNTER: Mutex<BTreeMap<usize, usize>> = Mutex::new(BTreeMap::new());
+    static ref MSM_COUNTER: Mutex<BTreeMap<usize, usize>> = Mutex::new(BTreeMap::new());
+}
 
 pub mod arithmetic;
 pub mod circuit;
diff --git a/halo2_proofs/src/plonk.rs b/halo2_proofs/src/plonk.rs
index 99d16240e0..4da095e197 100644
--- a/halo2_proofs/src/plonk.rs
+++ b/halo2_proofs/src/plonk.rs
@@ -22,7 +22,9 @@ mod circuit;
 mod error;
 mod evaluation;
 mod keygen;
+#[allow(dead_code)]
 mod lookup;
+mod mv_lookup;
 pub mod permutation;
 mod shuffle;
 mod vanishing;
@@ -158,7 +160,10 @@ where
     }
 }
 
-impl<C: CurveAffine> VerifyingKey<C> {
+impl<C: CurveAffine> VerifyingKey<C>
+where
+    C::ScalarExt: FromUniformBytes<64>,
+{
     fn bytes_length(&self) -> usize {
         8 + (self.fixed_commitments.len() * C::default().to_bytes().as_ref().len())
             + self.permutation.bytes_length()
diff --git a/halo2_proofs/src/plonk/circuit.rs b/halo2_proofs/src/plonk/circuit.rs
index 6037e6be74..24ca881589 100644
--- a/halo2_proofs/src/plonk/circuit.rs
+++ b/halo2_proofs/src/plonk/circuit.rs
@@ -1,6 +1,6 @@
-use super::{lookup, permutation, shuffle, Assigned, Error};
 use crate::circuit::layouter::SyncDeps;
 use crate::dev::metadata;
+use crate::plonk::shuffle;
 use crate::{
     circuit::{Layouter, Region, Value},
     poly::Rotation,
@@ -11,6 +11,7 @@ use ff::Field;
 use sealed::SealedPhase;
 use std::collections::BTreeMap;
 use std::fmt::Debug;
+//use std::fmt::Debug;
 use std::iter::{Product, Sum};
 use std::ops::Range;
 use std::{
@@ -18,6 +19,7 @@ use std::{
     ops::{Neg, Sub},
 };
 
+use super::{mv_lookup, permutation, Assigned, Error};
 mod compress_selectors;
 
 /// A column type
@@ -36,7 +38,6 @@ pub struct Column<C: ColumnType> {
 }
 
 impl<C: ColumnType> Column<C> {
-    #[cfg(test)]
     pub(crate) fn new(index: usize, column_type: C) -> Self {
         Column { index, column_type }
     }
@@ -480,7 +481,7 @@ impl Selector {
 }
 
 /// Query of fixed column at a certain relative location
-#[derive(Copy, Clone, Debug, PartialEq, Eq)]
+#[derive(Copy, Clone, Debug, PartialEq, Eq, Hash)]
 pub struct FixedQuery {
     /// Query index
     pub(crate) index: Option<usize>,
@@ -499,6 +500,10 @@ impl FixedQuery {
     pub fn column_index(&self) -> usize {
         self.column_index
     }
+    /// Column
+    pub fn column(&self) -> Column<Fixed> {
+        Column::new(self.column_index, Fixed)
+    }
 
     /// Rotation of this query
     pub fn rotation(&self) -> Rotation {
@@ -507,7 +512,7 @@ impl FixedQuery {
 }
 
 /// Query of advice column at a certain relative location
-#[derive(Copy, Clone, Debug, PartialEq, Eq)]
+#[derive(Copy, Clone, Debug, PartialEq, Eq, Hash)]
 pub struct AdviceQuery {
     /// Query index
     pub(crate) index: Option<usize>,
@@ -528,6 +533,10 @@ impl AdviceQuery {
     pub fn column_index(&self) -> usize {
         self.column_index
     }
+    /// Column
+    pub fn column(&self) -> Column<Advice> {
+        Column::new(self.column_index, Advice { phase: self.phase })
+    }
 
     /// Rotation of this query
     pub fn rotation(&self) -> Rotation {
@@ -541,7 +550,7 @@ impl AdviceQuery {
 }
 
 /// Query of instance column at a certain relative location
-#[derive(Copy, Clone, Debug, PartialEq, Eq)]
+#[derive(Copy, Clone, Debug, PartialEq, Eq, Hash)]
 pub struct InstanceQuery {
     /// Query index
     pub(crate) index: Option<usize>,
@@ -673,6 +682,12 @@ pub trait Assignment<F: Field>: Sized + Send {
         unimplemented!("merge is not implemented by default")
     }
 
+    /// Get the last assigned value of an advice cell.
+    fn query_advice(&self, column: Column<Advice>, row: usize) -> Result<F, Error>;
+
+    /// Get the last assigned value of a fixed cell.
+    fn query_fixed(&self, column: Column<Fixed>, row: usize) -> Result<F, Error>;
+
     /// Queries the cell of an instance column at a particular absolute row.
     ///
     /// Returns the cell's value, if known.
@@ -1568,9 +1583,16 @@ impl<F: Field> Gate<F> {
     }
 }
 
+/// TODO doc
+#[derive(Debug, Clone)]
+pub struct LookupTracker<F: Field> {
+    pub(crate) table: Vec<Expression<F>>,
+    pub(crate) inputs: Vec<Vec<Expression<F>>>,
+}
+
 /// This is a description of the circuit environment, such as the gate, column and
 /// permutation arrangements.
-#[derive(Debug, Clone, PartialEq, Eq)]
+#[derive(Debug, Clone)]
 pub struct ConstraintSystem<F: Field> {
     pub num_fixed_columns: usize,
     pub num_advice_columns: usize,
@@ -1600,9 +1622,12 @@ pub struct ConstraintSystem<F: Field> {
     // Permutation argument for performing equality constraints
     pub permutation: permutation::Argument,
 
+    /// Map from table expression to vec of vec of input expressions
+    pub lookups_map: BTreeMap<String, LookupTracker<F>>,
+
     // Vector of lookup arguments, where each corresponds to a sequence of
     // input expressions and a sequence of table expressions involved in the lookup.
-    pub lookups: Vec<lookup::Argument<F>>,
+    pub lookups: Vec<mv_lookup::Argument<F>>,
 
     // Vector of shuffle arguments, where each corresponds to a sequence of
     // input expressions and a sequence of shuffle expressions involved in the shuffle.
@@ -1633,7 +1658,7 @@ pub struct PinnedConstraintSystem<'a, F: Field> {
     instance_queries: &'a Vec<(Column<Instance>, Rotation)>,
     fixed_queries: &'a Vec<(Column<Fixed>, Rotation)>,
     permutation: &'a permutation::Argument,
-    lookups: &'a Vec<lookup::Argument<F>>,
+    lookups_map: &'a BTreeMap<String, LookupTracker<F>>,
     shuffles: &'a Vec<shuffle::Argument<F>>,
     constants: &'a Vec<Column<Fixed>>,
     minimum_degree: &'a Option<usize>,
@@ -1660,7 +1685,7 @@ impl<'a, F: Field> std::fmt::Debug for PinnedConstraintSystem<'a, F> {
             .field("instance_queries", self.instance_queries)
             .field("fixed_queries", self.fixed_queries)
             .field("permutation", self.permutation)
-            .field("lookups", self.lookups)
+            .field("lookups_map", self.lookups_map)
             .field("constants", self.constants)
             .field("minimum_degree", self.minimum_degree);
         debug_struct.finish()
@@ -1695,6 +1720,7 @@ impl<F: Field> Default for ConstraintSystem<F> {
             num_advice_queries: Vec::new(),
             instance_queries: Vec::new(),
             permutation: permutation::Argument::new(),
+            lookups_map: BTreeMap::default(),
             lookups: Vec::new(),
             shuffles: Vec::new(),
             general_column_annotations: BTreeMap::new(),
@@ -1722,7 +1748,7 @@ impl<F: Field> ConstraintSystem<F> {
             advice_queries: &self.advice_queries,
             instance_queries: &self.instance_queries,
             permutation: &self.permutation,
-            lookups: &self.lookups,
+            lookups_map: &self.lookups_map,
             shuffles: &self.shuffles,
             constants: &self.constants,
             minimum_degree: &self.minimum_degree,
@@ -1754,11 +1780,12 @@ impl<F: Field> ConstraintSystem<F> {
     /// they need to match.
     pub fn lookup<S: AsRef<str>>(
         &mut self,
-        name: S,
+        // FIXME use name in debug messages
+        _name: S,
         table_map: impl FnOnce(&mut VirtualCells<'_, F>) -> Vec<(Expression<F>, TableColumn)>,
-    ) -> usize {
+    ) {
         let mut cells = VirtualCells::new(self);
-        let table_map = table_map(&mut cells)
+        let (input_expressions, table_expressions): (Vec<_>, Vec<_>) = table_map(&mut cells)
             .into_iter()
             .map(|(mut input, table)| {
                 if input.contains_simple_selector() {
@@ -1769,13 +1796,89 @@ impl<F: Field> ConstraintSystem<F> {
                 table.query_cells(&mut cells);
                 (input, table)
             })
-            .collect();
-        let index = self.lookups.len();
+            .unzip();
+        let table_expressions_identifier = table_expressions
+            .iter()
+            .fold(String::new(), |string, expr| string + &expr.identifier());
+
+        self.lookups_map
+            .entry(table_expressions_identifier)
+            .and_modify(|table_tracker| table_tracker.inputs.push(input_expressions.clone()))
+            .or_insert(LookupTracker {
+                table: table_expressions,
+                inputs: vec![input_expressions],
+            });
+    }
 
-        self.lookups
-            .push(lookup::Argument::new(name.as_ref(), table_map));
+    /// Chunk lookup arguments into pieces below a given degree bound
+    pub fn chunk_lookups(mut self) -> Self {
+        if self.lookups_map.is_empty() {
+            return self;
+        }
 
-        index
+        let max_gate_degree = self.max_gate_degree();
+        let max_single_lookup_degree: usize = self
+            .lookups_map
+            .values()
+            .map(|v| {
+                let table_degree = v.table.iter().map(|expr| expr.degree()).max().unwrap();
+                let base_lookup_degree = super::mv_lookup::base_degree(table_degree);
+
+                let max_inputs_degree: usize = v
+                    .inputs
+                    .iter()
+                    .map(|input| input.iter().map(|expr| expr.degree()).max().unwrap())
+                    .max()
+                    .unwrap();
+
+                mv_lookup::degree_with_input(base_lookup_degree, max_inputs_degree)
+            })
+            .max()
+            .unwrap();
+
+        let required_degree = std::cmp::max(max_gate_degree, max_single_lookup_degree);
+        let required_degree = (required_degree as u64 - 1).next_power_of_two() as usize;
+
+        self.set_minimum_degree(required_degree + 1);
+
+        // safe to unwrap here
+        let minimum_degree = self.minimum_degree.unwrap();
+
+        let mut lookups: Vec<_> = vec![];
+        for v in self.lookups_map.values() {
+            let LookupTracker { table, inputs } = v;
+            let mut args = vec![super::mv_lookup::Argument::new(
+                "lookup",
+                table,
+                &[inputs[0].clone()],
+            )];
+
+            for input in inputs.iter().skip(1) {
+                let cur_input_degree = input.iter().map(|expr| expr.degree()).max().unwrap();
+                let mut indicator = false;
+                for arg in args.iter_mut() {
+                    // try to fit input in one of the args
+                    let cur_argument_degree = arg.required_degree();
+                    let new_potential_degree = cur_argument_degree + cur_input_degree;
+                    if new_potential_degree <= minimum_degree {
+                        arg.inputs_expressions.push(input.clone());
+                        indicator = true;
+                        break;
+                    }
+                }
+
+                if !indicator {
+                    args.push(super::mv_lookup::Argument::new(
+                        "dummy",
+                        table,
+                        &[input.clone()],
+                    ))
+                }
+            }
+            lookups.append(&mut args);
+        }
+        self.lookups = lookups;
+        self
     }
 
     /// Add a lookup argument for some input expressions and table expressions.
@@ -1784,24 +1887,26 @@ impl<F: Field> ConstraintSystem<F> {
     /// they need to match.
     pub fn lookup_any<S: AsRef<str>>(
         &mut self,
-        name: S,
+        // FIXME use name in debug messages
+        _name: S,
         table_map: impl FnOnce(&mut VirtualCells<'_, F>) -> Vec<(Expression<F>, Expression<F>)>,
-    ) -> usize {
+    ) {
         let mut cells = VirtualCells::new(self);
-        let table_map = table_map(&mut cells)
-            .into_iter()
-            .map(|(mut input, mut table)| {
-                input.query_cells(&mut cells);
-                table.query_cells(&mut cells);
-                (input, table)
-            })
-            .collect();
-        let index = self.lookups.len();
-
-        self.lookups
-            .push(lookup::Argument::new(name.as_ref(), table_map));
+        let table_map = table_map(&mut cells);
 
-        index
+        let (input_expressions, table_expressions): (Vec<_>, Vec<_>) =
+            table_map.into_iter().unzip();
+        let table_expressions_identifier = table_expressions
+            .iter()
+            .fold(String::new(), |string, expr| string + &expr.identifier());
+
+        self.lookups_map
+            .entry(table_expressions_identifier)
+            .and_modify(|table_tracker| table_tracker.inputs.push(input_expressions.clone()))
+            .or_insert(LookupTracker {
+                table: table_expressions,
+                inputs: vec![input_expressions],
+            });
     }
 
     /// Add a shuffle argument for some input expressions and table expressions.
@@ -1933,7 +2038,9 @@ impl<F: Field> ConstraintSystem<F> {
     /// larger amount than actually needed. This can be used, for example, to
     /// force the permutation argument to involve more columns in the same set.
     pub fn set_minimum_degree(&mut self, degree: usize) {
-        self.minimum_degree = Some(degree);
+        self.minimum_degree = self
+            .minimum_degree
+            .map_or(Some(degree), |min_degree| Some(max(min_degree, degree)));
     }
 
     /// Creates a new gate.
@@ -2081,8 +2188,9 @@ impl<F: Field> ConstraintSystem<F> {
         // lookup expressions
         for expr in self.lookups.iter_mut().flat_map(|lookup| {
             lookup
-                .input_expressions
+                .inputs_expressions
                 .iter_mut()
+                .flatten()
                 .chain(lookup.table_expressions.iter_mut())
         }) {
             replace_selectors(expr, &selector_replacements, true);
@@ -2250,6 +2358,15 @@ impl<F: Field> ConstraintSystem<F> {
         (0..=max_phase).map(sealed::Phase)
     }
 
+    /// Compute the maximum degree of gates in the constraint system
+    pub fn max_gate_degree(&self) -> usize {
+        self.gates
+            .iter()
+            .flat_map(|gate| gate.polynomials().iter().map(|poly| poly.degree()))
+            .max()
+            .unwrap_or(0)
+    }
+
     /// Compute the degree of the constraint system (the maximum degree of all
     /// constraints).
     pub fn degree(&self) -> usize {
@@ -2281,13 +2398,16 @@ impl<F: Field> ConstraintSystem<F> {
 
         // Account for each gate to ensure our quotient polynomial is the
         // correct degree and that our extended domain is the right size.
+        degree = std::cmp::max(degree, self.max_gate_degree());
+
+        // Lookup degree
         degree = std::cmp::max(
             degree,
-            self.gates
+            self.lookups
                 .iter()
-                .flat_map(|gate| gate.polynomials().iter().map(|poly| poly.degree()))
+                .map(|hl| hl.required_degree())
                 .max()
-                .unwrap_or(0),
+                .unwrap_or(1),
         );
 
         std::cmp::max(degree, self.minimum_degree.unwrap_or(1))
@@ -2403,7 +2523,7 @@ impl<F: Field> ConstraintSystem<F> {
     }
 
     /// Returns lookup arguments
-    pub fn lookups(&self) -> &Vec<lookup::Argument<F>> {
+    pub fn lookups(&self) -> &Vec<mv_lookup::Argument<F>> {
         &self.lookups
     }
 
diff --git a/halo2_proofs/src/plonk/circuit/compress_selectors.rs b/halo2_proofs/src/plonk/circuit/compress_selectors.rs
index 6f354b8fe1..95459258a1 100644
--- a/halo2_proofs/src/plonk/circuit/compress_selectors.rs
+++ b/halo2_proofs/src/plonk/circuit/compress_selectors.rs
@@ -20,7 +20,7 @@ pub struct SelectorDescription {
 /// This describes the assigned combination of a particular selector as well as
 /// the expression it should be substituted with.
 #[derive(Debug, Clone)]
-pub struct SelectorAssignment<F> {
+pub struct SelectorAssignment<F: Field> {
     /// The selector that this structure references, by index.
     pub selector: usize,
 
diff --git a/halo2_proofs/src/plonk/evaluation.rs b/halo2_proofs/src/plonk/evaluation.rs
index be5a2c14c5..b168b02ad0 100644
--- a/halo2_proofs/src/plonk/evaluation.rs
+++ b/halo2_proofs/src/plonk/evaluation.rs
@@ -1,11 +1,15 @@
 use crate::multicore;
-use crate::plonk::{lookup, permutation, Any, ProvingKey};
+use crate::plonk::{mv_lookup, permutation, Any, ProvingKey};
 use crate::poly::Basis;
 use crate::{
     arithmetic::{parallelize, CurveAffine},
     poly::{Coeff, ExtendedLagrangeCoeff, LagrangeCoeff, Polynomial, Rotation},
 };
+#[cfg(not(feature = "logup_skip_inv"))]
+use ff::BatchInvert;
 use group::ff::{Field, PrimeField, WithSmallOrderMulGroup};
+#[cfg(not(feature = "logup_skip_inv"))]
+use rayon::iter::{IntoParallelIterator, ParallelIterator};
 
 use super::{shuffle, ConstraintSystem, Expression};
 
@@ -32,7 +36,8 @@ pub enum ValueSource {
     /// beta
     Beta(),
     /// gamma
-    Gamma(),
+    // only used by the old halo2 lookup scheme
+    // Gamma(),
     /// theta
     Theta(),
     /// y
@@ -60,7 +65,7 @@ impl ValueSource {
         instance_values: &[Polynomial<F, B>],
         challenges: &[F],
         beta: &F,
-        gamma: &F,
+        _gamma: &F,
         theta: &F,
         y: &F,
         previous_value: &F,
@@ -79,7 +84,7 @@ impl ValueSource {
             }
             ValueSource::Challenge(index) => challenges[*index],
             ValueSource::Beta() => *beta,
-            ValueSource::Gamma() => *gamma,
+            // ValueSource::Gamma() => *gamma,
             ValueSource::Theta() => *theta,
             ValueSource::Y() => *y,
             ValueSource::PreviousValue() => *previous_value,
@@ -168,7 +173,7 @@ pub struct Evaluator<C: CurveAffine> {
     ///  Custom gates evalution
     pub custom_gates: GraphEvaluator<C>,
     ///  Lookups evalution
-    pub lookups: Vec<GraphEvaluator<C>>,
+    pub lookups: Vec<(Vec<GraphEvaluator<C>>, GraphEvaluator<C>)>,
     ///  Shuffle evalution
     pub shuffles: Vec<GraphEvaluator<C>>,
 }
@@ -226,9 +231,12 @@ impl<C: CurveAffine> Evaluator<C> {
 
         // Lookups
         for lookup in cs.lookups.iter() {
-            let mut graph = GraphEvaluator::default();
+            let mut graph_table = GraphEvaluator::default();
+            let mut graph_inputs: Vec<_> = (0..lookup.inputs_expressions.len())
+                .map(|_| GraphEvaluator::default())
+                .collect();
 
-            let mut evaluate_lc = |expressions: &Vec<Expression<_>>| {
+            let evaluate_lc = |graph: &mut GraphEvaluator<C>, expressions: &Vec<Expression<_>>| {
                 let parts = expressions
                     .iter()
                     .map(|expr| graph.add_expression(expr))
@@ -240,22 +248,33 @@ impl<C: CurveAffine> Evaluator<C> {
                 ))
             };
 
-            // Input coset
-            let compressed_input_coset = evaluate_lc(&lookup.input_expressions);
+            // Inputs cosets
+            for (input_expressions, graph_input) in lookup
+                .inputs_expressions
+                .iter()
+                .zip(graph_inputs.iter_mut())
+            {
+                let compressed_input_coset = evaluate_lc(graph_input, input_expressions);
+
+                graph_input.add_calculation(Calculation::Add(
+                    compressed_input_coset,
+                    ValueSource::Beta(),
+                ));
+            }
+
             // table coset
-            let compressed_table_coset = evaluate_lc(&lookup.table_expressions);
-            // z(\omega X) (a'(X) + \beta) (s'(X) + \gamma)
-            let right_gamma = graph.add_calculation(Calculation::Add(
+            let compressed_table_coset = evaluate_lc(&mut graph_table, &lookup.table_expressions);
+
+            graph_table.add_calculation(Calculation::Add(
                 compressed_table_coset,
-                ValueSource::Gamma(),
-            ));
-            let lc = graph.add_calculation(Calculation::Add(
-                compressed_input_coset,
                 ValueSource::Beta(),
             ));
-            graph.add_calculation(Calculation::Mul(lc, right_gamma));
 
-            ev.lookups.push(graph);
+            /*
+                a) f_i + beta
+                b) t + beta
+            */
+            ev.lookups.push((graph_inputs.to_vec(), graph_table));
         }
 
         // Shuffles
@@ -276,7 +295,7 @@ impl<C: CurveAffine> Evaluator<C> {
             let compressed_input_coset = evaluate_lc(&shuffle.input_expressions, &mut graph_input);
             let _ = graph_input.add_calculation(Calculation::Add(
                 compressed_input_coset,
-                ValueSource::Gamma(),
+                ValueSource::Beta(),
             ));
 
             let mut graph_shuffle = GraphEvaluator::default();
@@ -284,7 +303,7 @@ impl<C: CurveAffine> Evaluator<C> {
                 evaluate_lc(&shuffle.shuffle_expressions, &mut graph_shuffle);
             let _ = graph_shuffle.add_calculation(Calculation::Add(
                 compressed_shuffle_coset,
-                ValueSource::Gamma(),
+                ValueSource::Beta(),
             ));
 
             ev.shuffles.push(graph_input);
@@ -306,7 +325,7 @@ impl<C: CurveAffine> Evaluator<C> {
         beta: C::ScalarExt,
         gamma: C::ScalarExt,
         theta: C::ScalarExt,
-        lookups: &[Vec<lookup::prover::Committed<C>>],
+        lookups: &[Vec<mv_lookup::prover::Committed<C>>],
         shuffles: &[Vec<shuffle::prover::Committed<C>>],
         permutations: &[permutation::prover::Committed<C>],
     ) -> Polynomial<C::ScalarExt, ExtendedLagrangeCoeff> {
@@ -513,33 +532,140 @@ impl<C: CurveAffine> Evaluator<C> {
                         });
                     }
 
+                    // For lookups, compute inputs_inv_sum = ∑ 1 / (f_i(X) + beta)
+                    // The outer vector has capacity self.lookups.len()
+                    #[cfg(not(feature = "logup_skip_inv"))]
+                    let inputs_inv_sum: Vec<Vec<_>> = self
+                        .lookups
+                        .iter()
+                        .map(|lookup| {
+                            let (inputs_lookup_evaluator, _) = lookup;
+
+                            let inputs_values_for_extended_domain: Vec<Vec<C::Scalar>> = (0..size)
+                                .into_par_iter()
+                                .map(|idx| {
+                                    let mut inputs_eval_data: Vec<_> = inputs_lookup_evaluator
+                                        .iter()
+                                        .map(|input_lookup_evaluator| {
+                                            input_lookup_evaluator.instance()
+                                        })
+                                        .collect();
+
+                                    inputs_lookup_evaluator
+                                        .iter()
+                                        .zip(inputs_eval_data.iter_mut())
+                                        .map(|(input_lookup_evaluator, input_eval_data)| {
+                                            input_lookup_evaluator.evaluate(
+                                                input_eval_data,
+                                                fixed,
+                                                advice,
+                                                instance,
+                                                challenges,
+                                                &beta,
+                                                &gamma,
+                                                &theta,
+                                                &y,
+                                                &C::Scalar::ZERO,
+                                                idx,
+                                                rot_scale,
+                                                isize,
+                                            )
+                                        })
+                                        .collect()
+                                })
+                                .collect();
+                            let mut inputs_values_for_extended_domain: Vec<C::Scalar> =
+                                inputs_values_for_extended_domain
+                                    .into_iter()
+                                    .flatten()
+                                    .collect();
+
+                            parallelize(&mut inputs_values_for_extended_domain, |values, _| {
+                                values.batch_invert();
+                            });
+
+                            let inputs_len = inputs_lookup_evaluator.len();
+
+                            (0..size)
+                                .into_par_iter()
+                                .map(|i| {
+                                    inputs_values_for_extended_domain
+                                        [i * inputs_len..(i + 1) * inputs_len]
+                                        .iter()
+                                        .fold(C::Scalar::ZERO, |acc, x| acc + x)
+                                })
+                                .collect::<Vec<_>>()
+                        })
+                        .collect();
+
                     // Lookups
                     for (n, lookup) in lookups.iter().enumerate() {
                         // Polynomials required for this lookup.
                         // Calculated here so these only have to be kept in memory for the short time
                         // they are actually needed.
-                        let product_coset = pk.vk.domain.coeff_to_extended_part(
-                            lookup.product_poly.clone(),
-                            current_extended_omega,
-                        );
-                        let permuted_input_coset = pk.vk.domain.coeff_to_extended_part(
-                            lookup.permuted_input_poly.clone(),
-                            current_extended_omega,
-                        );
-                        let permuted_table_coset = pk.vk.domain.coeff_to_extended_part(
-                            lookup.permuted_table_poly.clone(),
+                        let phi_coset = pk.vk.domain.coeff_to_extended_part(
+                            lookup.phi_poly.clone(),
                             current_extended_omega,
                         );
+                        let m_coset = pk
+                            .vk
+                            .domain
+                            .coeff_to_extended_part(lookup.m_poly.clone(), current_extended_omega);
 
                         // Lookup constraints
+                        /*
+                            φ_i(X) = f_i(X) + beta
+                            τ(X) = t(X) + beta
+                            LHS = τ(X) * Π(φ_i(X)) * (ϕ(gX) - ϕ(X))
+                            RHS = τ(X) * Π(φ_i(X)) * (∑ 1/(φ_i(X)) - m(X) / τ(X))))      (1)
+                                = (τ(X) * Π(φ_i(X)) * ∑ 1/(φ_i(X))) - Π(φ_i(X)) * m(X)
+                                = Π(φ_i(X)) * (τ(X) * ∑ 1/(φ_i(X)) - m(X))
+
+                                = ∑_i τ(X) * Π_{j != i} φ_j(X) - m(X) * Π(φ_i(X))        (2)
+                        */
                         parallelize(&mut values, |values, start| {
-                            let lookup_evaluator = &self.lookups[n];
-                            let mut eval_data = lookup_evaluator.instance();
+                            let (inputs_lookup_evaluator, table_lookup_evaluator) =
+                                &self.lookups[n];
+                            let mut inputs_eval_data: Vec<_> = inputs_lookup_evaluator
+                                .iter()
+                                .map(|input_lookup_evaluator| input_lookup_evaluator.instance())
+                                .collect();
+                            let mut table_eval_data = table_lookup_evaluator.instance();
+
                             for (i, value) in values.iter_mut().enumerate() {
                                 let idx = start + i;
 
-                                let table_value = lookup_evaluator.evaluate(
-                                    &mut eval_data,
+                                // f_i(X) + beta for i in expressions
+                                let inputs_value: Vec<C::ScalarExt> = inputs_lookup_evaluator
+                                    .iter()
+                                    .zip(inputs_eval_data.iter_mut())
+                                    .map(|(input_lookup_evaluator, input_eval_data)| {
+                                        input_lookup_evaluator.evaluate(
+                                            input_eval_data,
+                                            fixed,
+                                            advice,
+                                            instance,
+                                            challenges,
+                                            &beta,
+                                            &gamma,
+                                            &theta,
+                                            &y,
+                                            &C::ScalarExt::ZERO,
+                                            idx,
+                                            rot_scale,
+                                            isize,
+                                        )
+                                    })
+                                    .collect();
+
+                                // Π(φ_i(X))
+                                let inputs_prod: C::Scalar = inputs_value
+                                    .iter()
+                                    .fold(C::Scalar::ZERO, |acc, input| acc * input);
+
+                                // t(X) + beta
+                                let table_value = table_lookup_evaluator.evaluate(
+                                    &mut table_eval_data,
                                     fixed,
                                     advice,
                                     instance,
@@ -555,41 +681,45 @@ impl<C: CurveAffine> Evaluator<C> {
                                 );
 
                                 let r_next = get_rotation_idx(idx, 1, rot_scale, isize);
-                                let r_prev = get_rotation_idx(idx, -1, rot_scale, isize);
 
-                                let a_minus_s =
-                                    permuted_input_coset[idx] - permuted_table_coset[idx];
-                                // l_0(X) * (1 - z(X)) = 0
-                                *value = *value * y + ((one - product_coset[idx]) * l0[idx]);
-                                // l_last(X) * (z(X)^2 - z(X)) = 0
-                                *value = *value * y
-                                    + ((product_coset[idx] * product_coset[idx]
-                                        - product_coset[idx])
-                                        * l_last[idx]);
-                                // (1 - (l_last(X) + l_blind(X))) * (
-                                //   z(\omega X) (a'(X) + \beta) (s'(X) + \gamma)
-                                //   - z(X) (\theta^{m-1} a_0(X) + ... + a_{m-1}(X) + \beta)
-                                //          (\theta^{m-1} s_0(X) + ... + s_{m-1}(X) + \gamma)
-                                // ) = 0
-                                *value = *value * y
-                                    + ((product_coset[r_next]
-                                        * (permuted_input_coset[idx] + beta)
-                                        * (permuted_table_coset[idx] + gamma)
-                                        - product_coset[idx] * table_value)
-                                        * l_active_row[idx]);
-                                // Check that the first values in the permuted input expression and permuted
-                                // fixed expression are the same.
-                                // l_0(X) * (a'(X) - s'(X)) = 0
-                                *value = *value * y + (a_minus_s * l0[idx]);
-                                // Check that each value in the permuted lookup input expression is either
-                                // equal to the value above it, or the value at the same index in the
-                                // permuted table expression.
-                                // (1 - (l_last + l_blind)) * (a′(X) − s′(X))⋅(a′(X) − a′(\omega^{-1} X)) = 0
-                                *value = *value * y
-                                    + (a_minus_s
-                                        * (permuted_input_coset[idx]
-                                            - permuted_input_coset[r_prev])
-                                        * l_active_row[idx]);
+                                let lhs = {
+                                    // τ(X) * Π(φ_i(X)) * (ϕ(gX) - ϕ(X))
+                                    table_value * inputs_prod * (phi_coset[r_next] - phi_coset[idx])
+                                };
+
+                                #[cfg(feature = "logup_skip_inv")]
+                                let rhs = {
+                                    //   τ(X) * Π(φ_i(X)) * (∑ 1/(φ_i(X)) - m(X) / τ(X))))
+                                    // = ∑_i τ(X) * Π_{j != i} φ_j(X) - m(X) * Π(φ_i(X))
+                                    let inputs = (0..inputs_value.len())
+                                        .map(|i| {
+                                            inputs_value
+                                                .iter()
+                                                .enumerate()
+                                                .filter(|(j, _)| *j != i)
+                                                .fold(C::Scalar::ZERO, |acc, (_, x)| acc * *x)
+                                        })
+                                        .fold(C::Scalar::ZERO, |acc, x| acc + x);
+                                    inputs * table_value - inputs_prod * m_coset[idx]
+                                };
+                                #[cfg(not(feature = "logup_skip_inv"))]
+                                let rhs = {
+                                    // ∑ 1 / (f_i(X) + beta) at ω^idx
+                                    let inv_sum: C::Scalar = inputs_inv_sum[n][idx];
+                                    //   τ(X) * Π(φ_i(X)) * (∑ 1/(φ_i(X)) - m(X) / τ(X))))
+                                    // = (τ(X) * Π(φ_i(X)) * ∑ 1/(φ_i(X))) - Π(φ_i(X)) * m(X)
+                                    // = Π(φ_i(X)) * (τ(X) * ∑ 1/(φ_i(X)) - m(X))
+                                    inputs_prod * (table_value * inv_sum - m_coset[idx])
+                                };
+
+                                // phi[0] = 0
+                                *value = *value * y + l0[idx] * phi_coset[idx];
+
+                                // phi[u] = 0
+                                *value = *value * y + l_last[idx] * phi_coset[idx];
+
+                                // q(X) = (1 - (l_last(X) + l_blind(X))) * (LHS - RHS)
+                                *value = *value * y + (lhs - rhs) * l_active_row[idx];
                             }
                         });
                     }
diff --git a/halo2_proofs/src/plonk/keygen.rs b/halo2_proofs/src/plonk/keygen.rs
index 1438e815d1..89e53b296a 100644
--- a/halo2_proofs/src/plonk/keygen.rs
+++ b/halo2_proofs/src/plonk/keygen.rs
@@ -44,6 +44,8 @@ where
     #[cfg(not(feature = "circuit-params"))]
     let config = ConcreteCircuit::configure(&mut cs);
 
+    let cs = cs.chunk_lookups();
+
     let degree = cs.degree();
 
     let domain = EvaluationDomain::new(degree as u32, k);
@@ -189,6 +191,26 @@ impl<'a, F: Field> Assignment<F> for Assembly<'a, F> {
         Ok(())
     }
 
+    fn query_advice(&self, _column: Column<Advice>, _row: usize) -> Result<F, Error> {
+        // We only care about fixed columns here
+        Ok(F::ZERO)
+    }
+
+    fn query_fixed(&self, column: Column<Fixed>, row: usize) -> Result<F, Error> {
+        if !self.usable_rows.contains(&row) {
+            return Err(Error::not_enough_rows_available(self.k));
+        }
+        if !self.rw_rows.contains(&row) {
+            log::error!("query_fixed: {:?}, row: {}", column, row);
+            return Err(Error::Synthesis);
+        }
+        self.fixed
+            .get(column.index())
+            .and_then(|v| v.get(row - self.rw_rows.start))
+            .map(|v| v.evaluate())
+            .ok_or(Error::BoundsFailure)
+    }
+
     fn query_instance(&self, _: Column<Instance>, row: usize) -> Result<Value<F>, Error> {
         if !self.usable_rows.contains(&row) {
             return Err(Error::not_enough_rows_available(self.k));
@@ -428,7 +450,7 @@ where
     C: CurveAffine,
     P: Params<'params, C>,
     ConcreteCircuit: Circuit<C::Scalar>,
-    <C as CurveAffine>::ScalarExt: FromUniformBytes<64>,
+    C::Scalar: FromUniformBytes<64>,
 {
     keygen_pk_impl(params, None, circuit)
 }
@@ -443,7 +465,7 @@ where
     C: CurveAffine,
     P: Params<'params, C>,
     ConcreteCircuit: Circuit<C::Scalar>,
-    <C as CurveAffine>::ScalarExt: FromUniformBytes<64>,
+    C::Scalar: FromUniformBytes<64>,
 {
     keygen_pk_impl(params, Some(vk), circuit)
 }
@@ -458,7 +480,7 @@ where
     C: CurveAffine,
     P: Params<'params, C>,
     ConcreteCircuit: Circuit<C::Scalar>,
-    <C as CurveAffine>::ScalarExt: FromUniformBytes<64>,
+    C::Scalar: FromUniformBytes<64>,
 {
     let (domain, cs, config) = create_domain::<C, ConcreteCircuit>(
         params.k(),
diff --git a/halo2_proofs/src/plonk/mv_lookup.rs b/halo2_proofs/src/plonk/mv_lookup.rs
new file mode 100644
index 0000000000..5c26c20b78
--- /dev/null
+++ b/halo2_proofs/src/plonk/mv_lookup.rs
@@ -0,0 +1,93 @@
+use super::circuit::Expression;
+use ff::Field;
+use std::fmt::{self, Debug};
+
+pub(crate) mod prover;
+pub(crate) mod verifier;
+
+/// Degree of lookup without inputs
+pub fn base_degree(table_degree: usize) -> usize {
+    // let lhs_degree = table_degree + inputs_expressions_degree + 1
+    // let degree = lhs_degree + 1
+    std::cmp::max(3, table_degree + 2)
+}
+
+pub fn degree_with_input(base_degree: usize, input_expression_degree: usize) -> usize {
+    base_degree + input_expression_degree
+}
+
+#[derive(Clone)]
+pub struct Argument<F: Field> {
+    pub name: &'static str,
+    pub(crate) table_expressions: Vec<Expression<F>>,
+    pub(crate) inputs_expressions: Vec<Vec<Expression<F>>>,
+}
+
+impl<F: Field> Debug for Argument<F> {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("Argument")
+            .field("table_expressions", &self.table_expressions)
+            .field("inputs_expressions", &self.inputs_expressions)
+            .finish()
+    }
+}
+
+impl<F: Field> Argument<F> {
+    /// Constructs a new lookup argument.
+    pub fn new(name: &'static str, table: &[Expression<F>], input: &[Vec<Expression<F>>]) -> Self {
+        Self {
+            name,
+            table_expressions: table.to_owned(),
+            inputs_expressions: input.to_owned(),
+        }
+    }
+
+    pub(crate) fn required_degree(&self) -> usize {
+        assert!(self
+            .inputs_expressions
+            .iter()
+            .all(|input| input.len() == self.table_expressions.len()));
+
+        let expr_degree = |input_expressions: &Vec<Expression<F>>| {
+            let mut input_degree = 0;
+            for expr in input_expressions.iter() {
+                input_degree = std::cmp::max(input_degree, expr.degree());
+            }
+
+            input_degree
+        };
+
+        let inputs_expressions_degree: usize =
+            self.inputs_expressions.iter().map(expr_degree).sum();
+
+        let table_degree = expr_degree(&self.table_expressions);
+
+        /*
+            φ_i(X) = f_i(X) + α
+            τ(X) = t(X) + α
+            LHS = τ(X) * Π(φ_i(X)) * (ϕ(gX) - ϕ(X))
+                = table_degree + sum(input_degree) + 1
+            RHS = τ(X) * Π(φ_i(X)) * (∑ 1/(φ_i(X)) - m(X) / τ(X))))
+
+            deg(q(X)) = (1 - (q_last + q_blind)) * (LHS - RHS)
+                 = 1 + LHS
+        */
+
+        let lhs_degree = table_degree + inputs_expressions_degree + 1;
+        let degree = lhs_degree + 1;
+
+        // 3 = phi + q_blind + table (where table is = 1)
+        // + 1 for each of inputs expressions
+        std::cmp::max(3 + self.inputs_expressions.len(), degree)
+    }
+
+    /// Returns input of this argument
+    pub fn input_expressions(&self) -> &Vec<Vec<Expression<F>>> {
+        &self.inputs_expressions
+    }
+
+    /// Returns table of this argument
+    pub fn table_expressions(&self) -> &Vec<Expression<F>> {
+        &self.table_expressions
+    }
+}
diff --git a/halo2_proofs/src/plonk/mv_lookup/exec_info.json b/halo2_proofs/src/plonk/mv_lookup/exec_info.json
new file mode 100644
index 0000000000..f7a7042c0f
--- /dev/null
+++ b/halo2_proofs/src/plonk/mv_lookup/exec_info.json
@@ -0,0 +1,46 @@
+{
+    "unit": "ms",
+    "non_batched": {
+        "k": 14,
+        "halo2": {
+            "protocol": "halo2",
+            "methods": {
+                "commit_permuted": {
+                    "compress_expressions": 1,
+                    "permute_expressions": 4.5, 
+                    "commit_permuted_input": 5,
+                    "commit_permuted_table": 5
+                },
+                "grand_product": {
+                    "lookup_product_denom": 2, 
+                    "lookup_product": 0.2, 
+                    "grand_prod_evals": 0.5,
+                    "grand_prod_commit": 7.5
+                }, 
+                "h_evaluation": {
+        
+                }
+            }
+        },
+        "mv": {
+            "protocol": "mv",
+            "methods": {
+                "compute_multiplicity": {
+                    "compress_expressions": 1,
+                    "compute_multiplicities": 2,
+                    "commit_m": 1
+                },
+                "grand_sum": {
+                    "inputs_log_derivatives": 2, 
+                    "table_log_derivatives": 1.8,
+                    "log_derivatives_diff": 0.2,
+                    "grand_sum_evals": 0.2, 
+                    "grand_sum_commit": 33
+                }, 
+                "h_evaluation": {
+        
+                }
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/halo2_proofs/src/plonk/mv_lookup/prover.rs b/halo2_proofs/src/plonk/mv_lookup/prover.rs
new file mode 100644
index 0000000000..49ee6b2fd6
--- /dev/null
+++ b/halo2_proofs/src/plonk/mv_lookup/prover.rs
@@ -0,0 +1,509 @@
+use super::super::{
+    circuit::Expression, ChallengeBeta, ChallengeTheta, ChallengeX, Error, ProvingKey,
+};
+use super::Argument;
+use crate::plonk::evaluation::evaluate;
+use crate::{
+    arithmetic::{eval_polynomial, parallelize, CurveAffine},
+    poly::{
+        commitment::{Blind, Params},
+        Coeff, EvaluationDomain, LagrangeCoeff, Polynomial, ProverQuery, Rotation,
+    },
+    transcript::{EncodedChallenge, TranscriptWrite},
+};
+use ark_std::{end_timer, start_timer};
+use ff::{PrimeField, WithSmallOrderMulGroup};
+use group::{ff::Field, Curve};
+use rand_core::RngCore;
+use std::{
+    iter,
+    ops::{Mul, MulAssign},
+};
+
+use crate::arithmetic::{par_invert, parallelize_internal};
+use rayon::prelude::{
+    IndexedParallelIterator, IntoParallelRefIterator, ParallelIterator, ParallelSliceMut,
+};
+
+#[derive(Debug)]
+pub(in crate::plonk) struct Prepared<C: CurveAffine> {
+    compressed_inputs_expressions: Vec<Polynomial<C::Scalar, LagrangeCoeff>>,
+    compressed_table_expression: Polynomial<C::Scalar, LagrangeCoeff>,
+    m_values: Polynomial<C::Scalar, LagrangeCoeff>,
+}
+
+#[derive(Debug)]
+pub(in crate::plonk) struct Committed<C: CurveAffine> {
+    pub(in crate::plonk) m_poly: Polynomial<C::Scalar, Coeff>,
+    pub(in crate::plonk) phi_poly: Polynomial<C::Scalar, Coeff>,
+}
+
+pub(in crate::plonk) struct Evaluated<C: CurveAffine> {
+    constructed: Committed<C>,
+}
+
+impl<F: PrimeField + WithSmallOrderMulGroup<3> + Ord> Argument<F> {
+    pub(in crate::plonk) fn prepare<
+        'a,
+        'params: 'a,
+        C,
+        P: Params<'params, C>,
+        E: EncodedChallenge<C>,
+        R: RngCore,
+        T: TranscriptWrite<C, E>,
+    >(
+        &self,
+        pk: &ProvingKey<C>,
+        params: &P,
+        domain: &EvaluationDomain<C::Scalar>,
+        theta: ChallengeTheta<C>,
+        advice_values: &'a [Polynomial<C::Scalar, LagrangeCoeff>],
+        fixed_values: &'a [Polynomial<C::Scalar, LagrangeCoeff>],
+        instance_values: &'a [Polynomial<C::Scalar, LagrangeCoeff>],
+        challenges: &'a [C::Scalar],
+        #[cfg(feature = "sanity-checks")] mut rng: R, // in case we want to blind (do we actually need zk?)
+        #[cfg(not(feature = "sanity-checks"))] rng: R,
+        transcript: &mut T,
+    ) -> Result<Prepared<C>, Error>
+    where
+        C: CurveAffine<ScalarExt = F>,
+        C::Curve: Mul<F, Output = C::Curve> + MulAssign<F>,
+    {
+        let prepare_time = start_timer!(|| format!(
+            "prepare m(X) (inputs={:?}, table={})",
+            self.inputs_expressions
+                .iter()
+                .map(|e| e.len())
+                .collect::<Vec<usize>>(),
+            self.table_expressions.len()
+        ));
+        // Closure to get values of expressions and compress them
+        let compress_expressions = |expressions: &[Expression<C::Scalar>]| {
+            let compressed_expression = expressions
+                .iter()
+                .map(|expression| {
+                    pk.vk.domain.lagrange_from_vec(evaluate(
+                        expression,
+                        params.n() as usize,
+                        1,
+                        fixed_values,
+                        advice_values,
+                        instance_values,
+                        challenges,
+                    ))
+                })
+                .fold(domain.empty_lagrange(), |acc, expression| {
+                    acc * *theta + &expression
+                });
+            compressed_expression
+        };
+
+        // Get values of input expressions involved in the lookup and compress them
+        let compressed_inputs_expressions: Vec<_> = self
+            .inputs_expressions
+            .iter()
+            .map(|input_expressions| compress_expressions(input_expressions))
+            .collect();
+
+        // Get values of table expressions involved in the lookup and compress them
+        let compressed_table_expression = compress_expressions(&self.table_expressions);
+
+        let blinding_factors = pk.vk.cs.blinding_factors();
+
+        // compute m(X)
+        let tivm_time = start_timer!(|| "table index value mapping");
+        let mut sorted_table_with_indices = compressed_table_expression
+            .iter()
+            .take(params.n() as usize - blinding_factors - 1)
+            .enumerate()
+            .map(|(i, t)| (t, i))
+            .collect::<Vec<_>>();
+        sorted_table_with_indices.par_sort_by_key(|(&t, _)| t);
+        end_timer!(tivm_time);
+
+        let m_time = start_timer!(|| "m(X) values");
+        let m_values: Vec<F> = {
+            use std::sync::atomic::{AtomicU64, Ordering};
+            let m_values: Vec<AtomicU64> = (0..params.n()).map(|_| AtomicU64::new(0)).collect();
+
+            for compressed_input_expression in compressed_inputs_expressions.iter() {
+                let _ = compressed_input_expression
+                    .par_iter()
+                    .take(params.n() as usize - blinding_factors - 1)
+                    .try_for_each(|fi| -> Result<(), Error> {
+                        let index = sorted_table_with_indices
+                            .binary_search_by_key(&fi, |&(t, _)| t)
+                            .map_err(|_| Error::ConstraintSystemFailure)?;
+                        let index = sorted_table_with_indices[index].1;
+
+                        m_values[index].fetch_add(1, Ordering::Relaxed);
+                        Ok(())
+                    });
+            }
+
+            m_values
+                .par_iter()
+                .map(|mi| F::from(mi.load(Ordering::Relaxed)))
+                .collect()
+        };
+        end_timer!(m_time);
+        let m_values = pk.vk.domain.lagrange_from_vec(m_values);
+
+        #[cfg(feature = "sanity-checks")]
+        {
+            // check that m is zero after blinders
+            let invalid_ms = m_values
+                .iter()
+                .skip(params.n() as usize - blinding_factors)
+                .collect::<Vec<_>>();
+            assert_eq!(invalid_ms.len(), blinding_factors);
+            for mi in invalid_ms {
+                assert_eq!(*mi, C::Scalar::ZERO);
+            }
+
+            // check sums
+            let alpha = C::Scalar::random(&mut rng);
+            let cs_input_sum =
+                |compressed_input_expression: &Polynomial<C::Scalar, LagrangeCoeff>| {
+                    let mut lhs_sum = C::Scalar::ZERO;
+                    for &fi in compressed_input_expression
+                        .iter()
+                        .take(params.n() as usize - blinding_factors - 1)
+                    {
+                        lhs_sum += (fi + alpha).invert().unwrap();
+                    }
+
+                    lhs_sum
+                };
+
+            let mut lhs_sum = C::Scalar::ZERO;
+
+            for compressed_input_expression in compressed_inputs_expressions.iter() {
+                lhs_sum += cs_input_sum(compressed_input_expression);
+            }
+
+            let mut rhs_sum = C::Scalar::ZERO;
+            for (&ti, &mi) in compressed_table_expression.iter().zip(m_values.iter()) {
+                rhs_sum += mi * (ti + alpha).invert().unwrap();
+            }
+
+            assert_eq!(lhs_sum, rhs_sum);
+        }
+
+        // commit to m(X)
+        // TODO: should we use zero instead?
+        let blind = Blind(C::Scalar::random(rng));
+        let m_commitment = params.commit_lagrange(&m_values, blind).to_affine();
+
+        // write commitment of m(X) to transcript
+        transcript.write_point(m_commitment)?;
+
+        end_timer!(prepare_time);
+
+        Ok(Prepared {
+            compressed_inputs_expressions,
+            compressed_table_expression,
+            m_values,
+        })
+    }
+}
+
+impl<C: CurveAffine> Prepared<C> {
+    pub(in crate::plonk) fn commit_grand_sum<
+        'params,
+        P: Params<'params, C>,
+        E: EncodedChallenge<C>,
+        R: RngCore,
+        T: TranscriptWrite<C, E>,
+    >(
+        self,
+        pk: &ProvingKey<C>,
+        params: &P,
+        beta: ChallengeBeta<C>,
+        mut rng: R,
+        transcript: &mut T,
+    ) -> Result<Committed<C>, Error> {
+        /*
+            φ_i(X) = f_i(X) + beta
+            τ(X) = t(X) + beta
+            LHS = τ(X) * Π(φ_i(X)) * (ϕ(gX) - ϕ(X))
+            RHS = τ(X) * Π(φ_i(X)) * (∑ 1/(φ_i(X)) - m(X) / τ(X))))
+        */
+        let lookup_commit_time = start_timer!(|| "commit_grand_sum");
+
+        // ∑ 1/(φ_i(X))
+        let inputs_log_drv_time = start_timer!(|| "inputs_log_derivative");
+        let mut inputs_log_derivatives = vec![C::Scalar::ZERO; params.n() as usize];
+        for compressed_input_expression in self.compressed_inputs_expressions.iter() {
+            let mut input_log_derivatives = vec![C::Scalar::ZERO; params.n() as usize];
+
+            parallelize(
+                &mut input_log_derivatives,
+                |input_log_derivatives, start| {
+                    for (input_log_derivative, fi) in input_log_derivatives
+                        .iter_mut()
+                        .zip(compressed_input_expression[start..].iter())
+                    {
+                        *input_log_derivative = *beta + fi;
+                    }
+                },
+            );
+            let inputs_inv_time = start_timer!(|| "batch invert");
+            par_invert(input_log_derivatives.as_mut_slice());
+            end_timer!(inputs_inv_time);
+
+            // TODO: remove last blinders from this
+            for i in 0..params.n() as usize {
+                inputs_log_derivatives[i] += input_log_derivatives[i];
+            }
+        }
+        end_timer!(inputs_log_drv_time);
+
+        // 1 / τ(X)
+        let table_log_drv_time = start_timer!(|| "table log derivative");
+        let mut table_log_derivatives = vec![C::Scalar::ZERO; params.n() as usize];
+        parallelize(
+            &mut table_log_derivatives,
+            |table_log_derivatives, start| {
+                for (table_log_derivative, ti) in table_log_derivatives
+                    .iter_mut()
+                    .zip(self.compressed_table_expression[start..].iter())
+                {
+                    *table_log_derivative = *beta + ti;
+                }
+            },
+        );
+
+        let table_inv_time = start_timer!(|| "table batch invert");
+        par_invert(table_log_derivatives.as_mut_slice());
+        end_timer!(table_inv_time);
+        end_timer!(table_log_drv_time);
+
+        let log_drv_diff_time = start_timer!(|| "log derivatives diff");
+        // (Σ 1/(φ_i(X)) - m(X) / τ(X))
+        let mut log_derivatives_diff = vec![C::Scalar::ZERO; params.n() as usize];
+        parallelize(&mut log_derivatives_diff, |log_derivatives_diff, start| {
+            for (((log_derivative_diff, fi), ti), mi) in log_derivatives_diff
+                .iter_mut()
+                .zip(inputs_log_derivatives[start..].iter())
+                .zip(table_log_derivatives[start..].iter())
+                .zip(self.m_values[start..].iter())
+            {
+                // (Σ 1/(φ_i(X)) - m(X) / τ(X))
+                *log_derivative_diff = *fi - *mi * *ti;
+            }
+        });
+        end_timer!(log_drv_diff_time);
+
+        // Compute the evaluations of the lookup grand sum polynomial
+        // over our domain, starting with phi[0] = 0
+        let blinding_factors = pk.vk.cs.blinding_factors();
+        let phi_time = start_timer!(|| "par_scan(log_derivatives_diff)");
+        let phi = {
+            // parallelized version of log_derivatives_diff.scan()
+            let active_size = params.n() as usize - blinding_factors;
+            let mut grand_sum = iter::once(C::Scalar::ZERO)
+                .chain(log_derivatives_diff)
+                .take(active_size)
+                .collect::<Vec<_>>();
+            // TODO: remove the implicit assumption that parallelize() split the grand_sum
+            //      into segments that each has `chunk` elements except the last.
+            let segment_starts = parallelize_internal(&mut grand_sum, |segment_grand_sum, _| {
+                for i in 1..segment_grand_sum.len() {
+                    segment_grand_sum[i] += segment_grand_sum[i - 1];
+                }
+            });
+            let mut segment_sum = vec![C::Scalar::ZERO; grand_sum.len()];
+            for i in 1..segment_starts.len() {
+                segment_sum[segment_starts[i]] =
+                    segment_sum[segment_starts[i - 1]] + grand_sum[segment_starts[i] - 1];
+            }
+            parallelize(&mut grand_sum, |grand_sum, start| {
+                let prefix_sum = segment_sum[start];
+                for v in grand_sum.iter_mut() {
+                    *v += prefix_sum;
+                }
+            });
+            grand_sum
+                .into_iter()
+                .chain((0..blinding_factors).map(|_| C::Scalar::random(&mut rng)))
+                .collect::<Vec<_>>()
+        };
+        end_timer!(phi_time);
+        assert_eq!(phi.len(), params.n() as usize);
+        let phi = pk.vk.domain.lagrange_from_vec(phi);
+
+        #[cfg(feature = "sanity-checks")]
+        // This test works only with intermediate representations in this method.
+        // It can be used for debugging purposes.
+        {
+            // While in Lagrange basis, check that product is correctly constructed
+            let u = (params.n() as usize) - (blinding_factors + 1);
+
+            /*
+                φ_i(X) = f_i(X) + α
+                τ(X) = t(X) + α
+                LHS = τ(X) * Π(φ_i(X)) * (ϕ(gX) - ϕ(X))
+                RHS = τ(X) * Π(φ_i(X)) * (∑ 1/(φ_i(X)) - m(X) / τ(X))))
+            */
+
+            // q(X) = LHS - RHS mod zH(X)
+            for i in 0..u {
+                // Π(φ_i(X))
+                let fi_prod = || {
+                    let mut prod = C::Scalar::ONE;
+                    for compressed_input_expression in self.compressed_inputs_expressions.iter() {
+                        prod *= *beta + compressed_input_expression[i];
+                    }
+
+                    prod
+                };
+
+                let fi_log_derivative = || {
+                    let mut sum = C::Scalar::ZERO;
+                    for compressed_input_expression in self.compressed_inputs_expressions.iter() {
+                        sum += (*beta + compressed_input_expression[i]).invert().unwrap();
+                    }
+
+                    sum
+                };
+
+                // LHS = τ(X) * Π(φ_i(X)) * (ϕ(gX) - ϕ(X))
+                let lhs = {
+                    (*beta + self.compressed_table_expression[i])
+                        * fi_prod()
+                        * (phi[i + 1] - phi[i])
+                };
+
+                // RHS = τ(X) * Π(φ_i(X)) * (∑ 1/(φ_i(X)) - m(X) / τ(X))))
+                let rhs = {
+                    (*beta + self.compressed_table_expression[i])
+                        * fi_prod()
+                        * (fi_log_derivative()
+                            - self.m_values[i]
+                                * (*beta + self.compressed_table_expression[i])
+                                    .invert()
+                                    .unwrap())
+                };
+
+                assert_eq!(lhs - rhs, C::Scalar::ZERO);
+            }
+
+            assert_eq!(phi[u], C::Scalar::ZERO);
+        }
+
+        let grand_sum_blind = Blind(C::Scalar::random(rng));
+        let phi_commitment = params.commit_lagrange(&phi, grand_sum_blind).to_affine();
+
+        // Hash grand sum commitment
+        transcript.write_point(phi_commitment)?;
+
+        end_timer!(lookup_commit_time);
+        Ok(Committed {
+            m_poly: pk.vk.domain.lagrange_to_coeff(self.m_values),
+            phi_poly: pk.vk.domain.lagrange_to_coeff(phi),
+        })
+    }
+}
+
+impl<C: CurveAffine> Committed<C> {
+    pub(in crate::plonk) fn evaluate<E: EncodedChallenge<C>, T: TranscriptWrite<C, E>>(
+        self,
+        pk: &ProvingKey<C>,
+        x: ChallengeX<C>,
+        transcript: &mut T,
+    ) -> Result<Evaluated<C>, Error> {
+        let domain = &pk.vk.domain;
+        let x_next = domain.rotate_omega(*x, Rotation::next());
+
+        let phi_eval = eval_polynomial(&self.phi_poly, *x);
+        let phi_next_eval = eval_polynomial(&self.phi_poly, x_next);
+        let m_eval = eval_polynomial(&self.m_poly, *x);
+
+        // Hash each advice evaluation
+        for eval in iter::empty()
+            .chain(Some(phi_eval))
+            .chain(Some(phi_next_eval))
+            .chain(Some(m_eval))
+        {
+            transcript.write_scalar(eval)?;
+        }
+
+        Ok(Evaluated { constructed: self })
+    }
+}
+
+impl<C: CurveAffine> Evaluated<C> {
+    pub(in crate::plonk) fn open<'a>(
+        &'a self,
+        pk: &'a ProvingKey<C>,
+        x: ChallengeX<C>,
+    ) -> impl Iterator<Item = ProverQuery<'a, C>> + Clone {
+        let x_next = pk.vk.domain.rotate_omega(*x, Rotation::next());
+
+        iter::empty()
+            .chain(Some(ProverQuery {
+                point: *x,
+                poly: &self.constructed.phi_poly,
+                blind: Blind(C::Scalar::ZERO),
+            }))
+            .chain(Some(ProverQuery {
+                point: x_next,
+                poly: &self.constructed.phi_poly,
+                blind: Blind(C::Scalar::ZERO),
+            }))
+            .chain(Some(ProverQuery {
+                point: *x,
+                poly: &self.constructed.m_poly,
+                blind: Blind(C::Scalar::ZERO),
+            }))
+    }
+}
+
+#[cfg(test)]
+mod benches {
+    use ark_std::rand::thread_rng;
+    use ff::Field;
+    use halo2curves::bn256::Fr;
+    use std::collections::BTreeMap;
+    use std::time::Instant;
+
+    // bench the time to construct a BTreeMap out of a large table
+    // tivm is short for table_index_value_mapping
+    #[ignore]
+    #[test]
+    fn bench_tivm_btree_map() {
+        env_logger::init();
+        let mut rng = thread_rng();
+
+        for log_n in 20..26 {
+            let n = 1 << log_n;
+            let dur = Instant::now();
+            let _table: BTreeMap<Fr, usize> = (0..n)
+                .map(|_| Fr::random(&mut rng))
+                .enumerate()
+                .map(|(i, x)| (x, i))
+                .collect();
+            log::info!(
+                "construct btreemap from random vec (len = {}) took {:?}",
+                n,
+                dur.elapsed()
+            );
+        }
+
+        for log_n in 20..26 {
+            let n = 1 << log_n;
+            let dur = Instant::now();
+            let _table: BTreeMap<Fr, usize> = (0..n)
+                .map(Fr::from)
+                .enumerate()
+                .map(|(i, x)| (x, i))
+                .collect();
+            log::info!(
+                "construct btreemap from increasing vec (len = {}) took {:?}",
+                n,
+                dur.elapsed()
+            );
+        }
+    }
+}
diff --git a/halo2_proofs/src/plonk/mv_lookup/verifier.rs b/halo2_proofs/src/plonk/mv_lookup/verifier.rs
new file mode 100644
index 0000000000..0593f3bcca
--- /dev/null
+++ b/halo2_proofs/src/plonk/mv_lookup/verifier.rs
@@ -0,0 +1,189 @@
+use std::iter;
+
+use super::super::{circuit::Expression, ChallengeBeta, ChallengeTheta, ChallengeX};
+use super::Argument;
+use crate::{
+    arithmetic::CurveAffine,
+    plonk::{Error, VerifyingKey},
+    poly::{commitment::MSM, Rotation, VerifierQuery},
+    transcript::{EncodedChallenge, TranscriptRead},
+};
+use ff::{BatchInvert, Field, PrimeField, WithSmallOrderMulGroup};
+
+pub struct PreparedCommitments<C: CurveAffine> {
+    m_commitment: C,
+}
+
+pub struct Committed<C: CurveAffine> {
+    prepared: PreparedCommitments<C>,
+    phi_commitment: C,
+}
+
+pub struct Evaluated<C: CurveAffine> {
+    committed: Committed<C>,
+    phi_eval: C::Scalar,
+    phi_next_eval: C::Scalar,
+    m_eval: C::Scalar,
+}
+
+impl<F: PrimeField + WithSmallOrderMulGroup<3>> Argument<F> {
+    pub(in crate::plonk) fn read_prepared_commitments<
+        C: CurveAffine,
+        E: EncodedChallenge<C>,
+        T: TranscriptRead<C, E>,
+    >(
+        &self,
+        transcript: &mut T,
+    ) -> Result<PreparedCommitments<C>, Error> {
+        let m_commitment = transcript.read_point()?;
+
+        Ok(PreparedCommitments { m_commitment })
+    }
+}
+
+impl<C: CurveAffine> PreparedCommitments<C> {
+    pub(in crate::plonk) fn read_grand_sum_commitment<
+        E: EncodedChallenge<C>,
+        T: TranscriptRead<C, E>,
+    >(
+        self,
+        transcript: &mut T,
+    ) -> Result<Committed<C>, Error> {
+        let phi_commitment = transcript.read_point()?;
+
+        Ok(Committed {
+            prepared: self,
+            phi_commitment,
+        })
+    }
+}
+
+impl<C: CurveAffine> Committed<C> {
+    pub(crate) fn evaluate<E: EncodedChallenge<C>, T: TranscriptRead<C, E>>(
+        self,
+        transcript: &mut T,
+    ) -> Result<Evaluated<C>, Error> {
+        let phi_eval = transcript.read_scalar()?;
+        let phi_next_eval = transcript.read_scalar()?;
+        let m_eval = transcript.read_scalar()?;
+
+        Ok(Evaluated {
+            committed: self,
+            phi_eval,
+            phi_next_eval,
+            m_eval,
+        })
+    }
+}
+
+impl<C: CurveAffine> Evaluated<C> {
+    pub(in crate::plonk) fn expressions<'a>(
+        &'a self,
+        l_0: C::Scalar,
+        l_last: C::Scalar,
+        l_blind: C::Scalar,
+        argument: &'a Argument<C::Scalar>,
+        theta: ChallengeTheta<C>,
+        beta: ChallengeBeta<C>,
+        advice_evals: &[C::Scalar],
+        fixed_evals: &[C::Scalar],
+        instance_evals: &[C::Scalar],
+        challenges: &[C::Scalar],
+    ) -> impl Iterator<Item = C::Scalar> + 'a {
+        let active_rows = C::Scalar::ZERO - (l_last + l_blind);
+
+        /*
+            φ_i(X) = f_i(X) + beta
+            τ(X) = t(X) + beta
+            LHS = τ(X) * Π(φ_i(X)) * (ϕ(gX) - ϕ(X))
+            RHS = τ(X) * Π(φ_i(X)) * (∑ 1/(φ_i(X)) - m(X) / τ(X))))
+        */
+
+        let grand_sum_expression = || {
+            let compress_expressions = |expressions: &[Expression<C::Scalar>]| {
+                expressions
+                    .iter()
+                    .map(|expression| {
+                        expression.evaluate(
+                            &|scalar| scalar,
+                            &|_| panic!("virtual selectors are removed during optimization"),
+                            &|query| fixed_evals[query.index()],
+                            &|query| advice_evals[query.index()],
+                            &|query| instance_evals[query.index()],
+                            &|challenge| challenges[challenge.index()],
+                            &|a| -a,
+                            &|a, b| a + &b,
+                            &|a, b| a * &b,
+                            &|a, scalar| a * &scalar,
+                        )
+                    })
+                    .fold(C::Scalar::ZERO, |acc, eval| acc * &*theta + &eval)
+            };
+
+            // φ_i(X) = f_i(X) + beta
+            let mut f_evals: Vec<_> = argument
+                .inputs_expressions
+                .iter()
+                .map(|input_expressions| compress_expressions(input_expressions) + *beta)
+                .collect();
+
+            let t_eval = compress_expressions(&argument.table_expressions);
+
+            let tau = t_eval + *beta;
+            // Π(φ_i(X))
+            let prod_fi = f_evals.iter().fold(C::Scalar::ZERO, |acc, eval| acc * eval);
+            // ∑ 1/(φ_i(X))
+            let sum_inv_fi = {
+                f_evals.batch_invert();
+                f_evals.iter().fold(C::Scalar::ZERO, |acc, eval| acc + eval)
+            };
+
+            // LHS = τ(X) * Π(φ_i(X)) * (ϕ(gX) - ϕ(X))
+            let lhs = tau * prod_fi * (self.phi_next_eval - self.phi_eval);
+
+            // RHS = τ(X) * Π(φ_i(X)) * (∑ 1/(φ_i(X)) - m(X) / τ(X))))
+            let rhs = { tau * prod_fi * (sum_inv_fi - self.m_eval * tau.invert().unwrap()) };
+
+            (lhs - rhs) * active_rows
+        };
+
+        std::iter::empty()
+            .chain(
+                // phi[0] = 0
+                Some(l_0 * self.phi_eval),
+            )
+            .chain(
+                // phi[u] = 0
+                Some(l_last * self.phi_eval),
+            )
+            .chain(
+                // (1 - l_last - l_blind) * (lhs - rhs) = 0
+                Some(grand_sum_expression()),
+            )
+    }
+
+    pub(in crate::plonk) fn queries<'r, M: MSM<C> + 'r>(
+        &'r self,
+        vk: &'r VerifyingKey<C>,
+        x: ChallengeX<C>,
+    ) -> impl Iterator<Item = VerifierQuery<'r, C, M>> + Clone {
+        let x_next = vk.domain.rotate_omega(*x, Rotation::next());
+
+        iter::empty()
+            .chain(Some(VerifierQuery::new_commitment(
+                &self.committed.phi_commitment,
+                *x,
+                self.phi_eval,
+            )))
+            .chain(Some(VerifierQuery::new_commitment(
+                &self.committed.phi_commitment,
+                x_next,
+                self.phi_next_eval,
+            )))
+            .chain(Some(VerifierQuery::new_commitment(
+                &self.committed.prepared.m_commitment,
+                *x,
+                self.m_eval,
+            )))
+    }
+}
diff --git a/halo2_proofs/src/plonk/permutation/keygen.rs b/halo2_proofs/src/plonk/permutation/keygen.rs
index d793e5b3e0..6d1e184a1e 100644
--- a/halo2_proofs/src/plonk/permutation/keygen.rs
+++ b/halo2_proofs/src/plonk/permutation/keygen.rs
@@ -374,7 +374,7 @@ pub(crate) fn build_pk<'params, C: CurveAffine, P: Params<'params, C>>(
                 for v in omega_powers {
                     *v *= &cur;
                 }
-                cur *= &C::Scalar::DELTA;
+                cur *= &<C::Scalar as PrimeField>::DELTA;
             }
         });
     }
diff --git a/halo2_proofs/src/plonk/prover.rs b/halo2_proofs/src/plonk/prover.rs
index 107223f687..4ed6195ebc 100644
--- a/halo2_proofs/src/plonk/prover.rs
+++ b/halo2_proofs/src/plonk/prover.rs
@@ -1,3 +1,4 @@
+use crate::plonk::shuffle;
 use ff::{Field, FromUniformBytes, WithSmallOrderMulGroup};
 use group::Curve;
 use rand_core::RngCore;
@@ -12,8 +13,8 @@ use super::{
         Advice, Any, Assignment, Challenge, Circuit, Column, ConstraintSystem, Fixed, FloorPlanner,
         Instance, Selector,
     },
-    lookup, permutation, shuffle, vanishing, ChallengeBeta, ChallengeGamma, ChallengeTheta,
-    ChallengeX, ChallengeY, Error, ProvingKey,
+    mv_lookup, permutation, vanishing, ChallengeBeta, ChallengeGamma, ChallengeTheta, ChallengeX,
+    ChallengeY, Error, ProvingKey,
 };
 
 use crate::{
@@ -30,6 +31,7 @@ use crate::{
     poly::batch_invert_assigned,
     transcript::{EncodedChallenge, TranscriptWrite},
 };
+use ark_std::{end_timer, start_timer};
 use group::prime::PrimeCurveAffine;
 
 /// This creates a proof for the provided `circuit` when given the public
@@ -53,7 +55,7 @@ pub fn create_proof<
     transcript: &mut T,
 ) -> Result<(), Error>
 where
-    Scheme::Scalar: WithSmallOrderMulGroup<3> + FromUniformBytes<64>,
+    Scheme::Scalar: WithSmallOrderMulGroup<3> + FromUniformBytes<64> + Ord,
 {
     if circuits.len() != instances.len() {
         return Err(Error::InvalidInstances);
@@ -152,6 +154,7 @@ where
         advice: Vec<&'a mut [Assigned<F>]>,
         challenges: &'a HashMap<usize, F>,
         instances: &'a [&'a [F]],
+        fixed_values: &'a [Polynomial<F, LagrangeCoeff>],
         rw_rows: Range<usize>,
         usable_rows: RangeTo<usize>,
         _marker: std::marker::PhantomData<F>,
@@ -235,6 +238,7 @@ where
                     advice,
                     challenges: self.challenges,
                     instances: self.instances,
+                    fixed_values: self.fixed_values,
                     rw_rows: sub_range.clone(),
                     usable_rows: self.usable_rows,
                     _marker: Default::default(),
@@ -256,6 +260,30 @@ where
             // Do nothing
         }
 
+        /// Get the last assigned value of a cell.
+        fn query_advice(&self, column: Column<Advice>, row: usize) -> Result<F, Error> {
+            if !self.usable_rows.contains(&row) {
+                return Err(Error::not_enough_rows_available(self.k));
+            }
+            if !self.rw_rows.contains(&row) {
+                log::error!("query_advice: {:?}, row: {}", column, row);
+                return Err(Error::Synthesis);
+            }
+            self.advice
+                .get(column.index())
+                .and_then(|v| v.get(row - self.rw_rows.start))
+                .map(|v| v.evaluate())
+                .ok_or(Error::BoundsFailure)
+        }
+
+        fn query_fixed(&self, column: Column<Fixed>, row: usize) -> Result<F, Error> {
+            self.fixed_values
+                .get(column.index())
+                .and_then(|v| v.get(row))
+                .copied()
+                .ok_or(Error::BoundsFailure)
+        }
+
         fn query_instance(&self, column: Column<Instance>, row: usize) -> Result<Value<F>, Error> {
             if !self.usable_rows.contains(&row) {
                 return Err(Error::not_enough_rows_available(self.k));
@@ -394,7 +422,7 @@ where
                 })
                 .collect::<BTreeSet<_>>();
 
-            for (circuit_idx, ((circuit, advice), instances)) in circuits
+            for (_circuit_idx, ((circuit, advice), instances)) in circuits
                 .iter()
                 .zip(advice.iter_mut())
                 .zip(instances)
@@ -411,6 +439,7 @@ where
                     advice_vec,
                     advice: advice_slice,
                     instances,
+                    fixed_values: &pk.fixed_values,
                     challenges: &challenges,
                     // The prover will not be allowed to assign values to advice
                     // cells that exist within inactive rows, which include some
@@ -433,7 +462,7 @@ where
                 {
                     for (idx, advice_col) in witness.advice_vec.iter().enumerate() {
                         if pk.vk.cs.advice_column_phase[idx].0 < current_phase.0
-                            && advice_assignments[circuit_idx][idx].values != advice_col.values
+                            && advice_assignments[_circuit_idx][idx].values != advice_col.values
                         {
                             log::error!(
                                 "advice column {}(at {:?}) changed when {:?}",
@@ -454,7 +483,7 @@ where
                             if column_indices.contains(&column_index) {
                                 #[cfg(feature = "phase-check")]
                                 {
-                                    advice_assignments[circuit_idx][column_index] = advice.clone();
+                                    advice_assignments[_circuit_idx][column_index] = advice.clone();
                                 }
                                 Some(advice)
                             } else {
@@ -524,17 +553,20 @@ where
     // Sample theta challenge for keeping lookup columns linearly independent
     let theta: ChallengeTheta<_> = transcript.squeeze_challenge_scalar();
 
-    let lookups: Vec<Vec<lookup::prover::Permuted<Scheme::Curve>>> = instance
+    let lookups: Vec<Vec<mv_lookup::prover::Prepared<Scheme::Curve>>> = instance
         .iter()
         .zip(advice.iter())
         .map(|(instance, advice)| -> Result<Vec<_>, Error> {
+            let lookup_get_mx_time =
+                start_timer!(|| format!("get m(X) in {} lookups", pk.vk.cs.lookups.len()));
             // Construct and commit to permuted values for each lookup
-            pk.vk
+            let mx = pk
+                .vk
                 .cs
                 .lookups
                 .iter()
                 .map(|lookup| {
-                    lookup.commit_permuted(
+                    lookup.prepare(
                         pk,
                         params,
                         domain,
@@ -547,7 +579,10 @@ where
                         transcript,
                     )
                 })
-                .collect()
+                .collect();
+            end_timer!(lookup_get_mx_time);
+
+            mx
         })
         .collect::<Result<Vec<_>, _>>()?;
 
@@ -577,16 +612,18 @@ where
         })
         .collect::<Result<Vec<_>, _>>()?;
 
-    let lookups: Vec<Vec<lookup::prover::Committed<Scheme::Curve>>> = lookups
+    let lookup_commit_time = start_timer!(|| "lookup commit grand sum");
+    let lookups: Vec<Vec<mv_lookup::prover::Committed<Scheme::Curve>>> = lookups
         .into_iter()
         .map(|lookups| -> Result<Vec<_>, _> {
             // Construct and commit to products for each lookup
             lookups
                 .into_iter()
-                .map(|lookup| lookup.commit_product(pk, params, beta, gamma, &mut rng, transcript))
+                .map(|lookup| lookup.commit_grand_sum(pk, params, beta, &mut rng, transcript))
                 .collect::<Result<Vec<_>, _>>()
         })
         .collect::<Result<Vec<_>, _>>()?;
+    end_timer!(lookup_commit_time);
 
     let shuffles: Vec<Vec<shuffle::prover::Committed<Scheme::Curve>>> = instance
         .iter()
@@ -735,8 +772,7 @@ where
         .map(|permutation| -> Result<_, _> { permutation.construct().evaluate(pk, x, transcript) })
         .collect::<Result<Vec<_>, _>>()?;
 
-    // Evaluate the lookups, if any, at omega^i x.
-    let lookups: Vec<Vec<lookup::prover::Evaluated<Scheme::Curve>>> = lookups
+    let lookups: Vec<Vec<mv_lookup::prover::Evaluated<Scheme::Curve>>> = lookups
         .into_iter()
         .map(|lookups| -> Result<Vec<_>, _> {
             lookups
diff --git a/halo2_proofs/src/plonk/vanishing/prover.rs b/halo2_proofs/src/plonk/vanishing/prover.rs
index 50b287178c..1b055682b0 100644
--- a/halo2_proofs/src/plonk/vanishing/prover.rs
+++ b/halo2_proofs/src/plonk/vanishing/prover.rs
@@ -1,4 +1,4 @@
-use std::{collections::HashMap, iter};
+use std::iter;
 
 use ff::Field;
 use group::Curve;
diff --git a/halo2_proofs/src/plonk/verifier.rs b/halo2_proofs/src/plonk/verifier.rs
index 76675bcdfa..5bf873d759 100644
--- a/halo2_proofs/src/plonk/verifier.rs
+++ b/halo2_proofs/src/plonk/verifier.rs
@@ -128,7 +128,7 @@ where
             vk.cs
                 .lookups
                 .iter()
-                .map(|argument| argument.read_permuted_commitments(transcript))
+                .map(|argument| argument.read_prepared_commitments(transcript))
                 .collect::<Result<Vec<_>, _>>()
         })
         .collect::<Result<Vec<_>, _>>()?;
@@ -149,10 +149,10 @@ where
     let lookups_committed = lookups_permuted
         .into_iter()
         .map(|lookups| {
-            // Hash each lookup product commitment
+            // Hash each lookup sum commitment
             lookups
                 .into_iter()
-                .map(|lookup| lookup.read_product_commitment(transcript))
+                .map(|lookup| lookup.read_grand_sum_commitment(transcript))
                 .collect::<Result<Vec<_>, _>>()
         })
         .collect::<Result<Vec<_>, _>>()?;
@@ -331,7 +331,6 @@ where
                                     argument,
                                     theta,
                                     beta,
-                                    gamma,
                                     advice_evals,
                                     fixed_evals,
                                     instance_evals,
diff --git a/halo2_proofs/src/poly.rs b/halo2_proofs/src/poly.rs
index 166c16d894..cbe6fd8f1c 100644
--- a/halo2_proofs/src/poly.rs
+++ b/halo2_proofs/src/poly.rs
@@ -303,7 +303,7 @@ impl<'a, F: Field, B: Basis> Sub<F> for &'a Polynomial<F, B> {
 /// Describes the relative rotation of a vector. Negative numbers represent
 /// reverse (leftmost) rotations and positive numbers represent forward (rightmost)
 /// rotations. Zero represents no rotation.
-#[derive(Copy, Clone, Debug, PartialEq, Eq)]
+#[derive(Copy, Clone, Debug, PartialEq, Eq, Hash)]
 pub struct Rotation(pub i32);
 
 impl Rotation {
diff --git a/halo2_proofs/src/poly/domain.rs b/halo2_proofs/src/poly/domain.rs
index 2d353fdbd7..0f3f01c014 100644
--- a/halo2_proofs/src/poly/domain.rs
+++ b/halo2_proofs/src/poly/domain.rs
@@ -175,7 +175,7 @@ impl<F: WithSmallOrderMulGroup<3>> EvaluationDomain<F> {
         &self,
         values: Vec<Polynomial<F, LagrangeCoeff>>,
     ) -> Polynomial<F, ExtendedLagrangeCoeff> {
-        assert_eq!(values.len(), (self.extended_len() >> self.k) as usize);
+        assert_eq!(values.len(), (self.extended_len() >> self.k));
         assert_eq!(values[0].len(), self.n as usize);
 
         // transpose the values in parallel
@@ -456,10 +456,10 @@ impl<F: WithSmallOrderMulGroup<3>> EvaluationDomain<F> {
     ///
     fn distribute_powers(&self, a: &mut [F], c: F) {
         parallelize(a, |a, index| {
-            let mut c_power = c.pow_vartime(&[index as u64, 0, 0, 0]);
+            let mut c_power = c.pow_vartime([index as u64, 0, 0, 0]);
             for a in a {
-                *a = *a * (&c_power);
-                c_power = c_power * c;
+                *a *= &c_power;
+                c_power *= c;
             }
         });
     }
diff --git a/halo2_proofs/src/poly/evaluator.rs b/halo2_proofs/src/poly/evaluator.rs
new file mode 100644
index 0000000000..5d20221255
--- /dev/null
+++ b/halo2_proofs/src/poly/evaluator.rs
@@ -0,0 +1,699 @@
+use std::{
+    cmp,
+    collections::{HashMap, HashSet},
+    fmt,
+    hash::{Hash, Hasher},
+    marker::PhantomData,
+    ops::{Add, Mul, MulAssign, Neg, Sub},
+    sync::Arc,
+};
+
+use group::ff::Field;
+use halo2curves::Field;
+
+use super::{
+    Basis, Coeff, EvaluationDomain, ExtendedLagrangeCoeff, LagrangeCoeff, Polynomial, Rotation,
+};
+use crate::{arithmetic::parallelize, multicore};
+
+/// Returns `(chunk_size, num_chunks)` suitable for processing the given polynomial length
+/// in the current parallelization environment.
+fn get_chunk_params(poly_len: usize) -> (usize, usize) {
+    // Check the level of parallelization we have available.
+    let num_threads = multicore::current_num_threads();
+    // We scale the number of chunks by a constant factor, to ensure that if not all
+    // threads are available, we can achieve more uniform throughput and don't end up
+    // waiting on a couple of threads to process the last chunks.
+    let num_chunks = num_threads * 4;
+    // Calculate the ideal chunk size for the desired throughput. We use ceiling
+    // division to ensure the minimum chunk size is 1.
+    //     chunk_size = ceil(poly_len / num_chunks)
+    let chunk_size = (poly_len + num_chunks - 1) / num_chunks;
+    // Now re-calculate num_chunks from the actual chunk size.
+    //     num_chunks = ceil(poly_len / chunk_size)
+    let num_chunks = (poly_len + chunk_size - 1) / chunk_size;
+
+    (chunk_size, num_chunks)
+}
+
+/// A reference to a polynomial registered with an [`Evaluator`].
+#[derive(Clone, Copy)]
+pub(crate) struct AstLeaf<E, B: Basis> {
+    index: usize,
+    rotation: Rotation,
+    _evaluator: PhantomData<(E, B)>,
+}
+
+impl<E, B: Basis> fmt::Debug for AstLeaf<E, B> {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("AstLeaf")
+            .field("index", &self.index)
+            .field("rotation", &self.rotation)
+            .finish()
+    }
+}
+
+impl<E, B: Basis> PartialEq for AstLeaf<E, B> {
+    fn eq(&self, rhs: &Self) -> bool {
+        // We compare rotations by offset, which doesn't account for equivalent rotations.
+        self.index.eq(&rhs.index) && self.rotation.0.eq(&rhs.rotation.0)
+    }
+}
+
+impl<E, B: Basis> Eq for AstLeaf<E, B> {}
+
+impl<E, B: Basis> Hash for AstLeaf<E, B> {
+    fn hash<H: Hasher>(&self, state: &mut H) {
+        self.index.hash(state);
+        self.rotation.0.hash(state);
+    }
+}
+
+impl<E, B: Basis> AstLeaf<E, B> {
+    /// Produces a new `AstLeaf` node corresponding to the underlying polynomial at a
+    /// _new_ rotation. Existing rotations applied to this leaf node are ignored and the
+    /// returned polynomial is not rotated _relative_ to the previous structure.
+    pub(crate) fn with_rotation(&self, rotation: Rotation) -> Self {
+        AstLeaf {
+            index: self.index,
+            rotation,
+            _evaluator: PhantomData::default(),
+        }
+    }
+}
+
+/// An evaluation context for polynomial operations.
+///
+/// This context enables us to de-duplicate queries of circuit columns (and the rotations
+/// they might require), by storing a list of all the underlying polynomials involved in
+/// any query (which are almost certainly column polynomials). We use the context like so:
+///
+/// - We register each underlying polynomial with the evaluator, which returns a reference
+///   to it as a [`AstLeaf`].
+/// - The references are then used to build up a [`Ast`] that represents the overall
+///   operations to be applied to the polynomials.
+/// - Finally, we call [`Evaluator::evaluate`] passing in the [`Ast`].
+pub(crate) struct Evaluator<E, F: Field, B: Basis> {
+    polys: Vec<Polynomial<F, B>>,
+    _context: E,
+}
+
+/// Constructs a new `Evaluator`.
+///
+/// The `context` parameter is used to provide type safety for evaluators. It ensures that
+/// an evaluator will only be used to evaluate [`Ast`]s containing [`AstLeaf`]s obtained
+/// from itself. It should be set to the empty closure `|| {}`, because anonymous closures
+/// all have unique types.
+pub(crate) fn new_evaluator<E: Fn() + Clone, F: Field, B: Basis>(context: E) -> Evaluator<E, F, B> {
+    Evaluator {
+        polys: vec![],
+        _context: context,
+    }
+}
+
+impl<E, F: Field, B: Basis> Evaluator<E, F, B> {
+    /// Registers the given polynomial for use in this evaluation context.
+    ///
+    /// This API treats each registered polynomial as unique, even if the same polynomial
+    /// is added multiple times.
+    pub(crate) fn register_poly(&mut self, poly: Polynomial<F, B>) -> AstLeaf<E, B> {
+        let index = self.polys.len();
+        self.polys.push(poly);
+
+        AstLeaf {
+            index,
+            rotation: Rotation::cur(),
+            _evaluator: PhantomData::default(),
+        }
+    }
+
+    /// Evaluates the given polynomial operation against this context.
+    pub(crate) fn evaluate(
+        &self,
+        ast: &Ast<E, F, B>,
+        domain: &EvaluationDomain<F>,
+    ) -> Polynomial<F, B>
+    where
+        E: Copy + Send + Sync,
+        F: Field,
+        B: BasisOps,
+    {
+        // Traverse `ast` to collect the used leaves.
+        fn collect_rotations<E: Copy, F: Field, B: Basis>(
+            ast: &Ast<E, F, B>,
+        ) -> HashSet<AstLeaf<E, B>> {
+            match ast {
+                Ast::Poly(leaf) => vec![*leaf].into_iter().collect(),
+                Ast::Add(a, b) | Ast::Mul(AstMul(a, b)) => {
+                    let lhs = collect_rotations(a);
+                    let rhs = collect_rotations(b);
+                    lhs.union(&rhs).cloned().collect()
+                }
+                Ast::Scale(a, _) => collect_rotations(a),
+                Ast::DistributePowers(terms, _) => terms
+                    .iter()
+                    .flat_map(|term| collect_rotations(term).into_iter())
+                    .collect(),
+                Ast::LinearTerm(_) | Ast::ConstantTerm(_) => HashSet::default(),
+            }
+        }
+        let leaves = collect_rotations(ast);
+
+        // Produce the rotated polynomials.
+        let rotated: HashMap<_, _> = leaves
+            .iter()
+            .cloned()
+            .map(|leaf| {
+                (
+                    leaf,
+                    B::rotate(domain, &self.polys[leaf.index], leaf.rotation),
+                )
+            })
+            .collect();
+
+        // We're working in a single basis, so all polynomials are the same length.
+        let poly_len = self.polys.first().unwrap().len();
+        let (chunk_size, num_chunks) = get_chunk_params(poly_len);
+
+        // Split each rotated polynomial into chunks.
+        let chunks: Vec<HashMap<_, _>> = (0..num_chunks)
+            .map(|i| {
+                rotated
+                    .iter()
+                    .map(|(leaf, poly)| {
+                        (
+                            *leaf,
+                            poly.chunks(chunk_size)
+                                .nth(i)
+                                .expect("num_chunks was calculated correctly"),
+                        )
+                    })
+                    .collect()
+            })
+            .collect();
+
+        struct AstContext<'a, E, F: Field, B: Basis> {
+            domain: &'a EvaluationDomain<F>,
+            poly_len: usize,
+            chunk_size: usize,
+            chunk_index: usize,
+            leaves: &'a HashMap<AstLeaf<E, B>, &'a [F]>,
+        }
+
+        fn recurse<E, F: Field, B: BasisOps>(
+            ast: &Ast<E, F, B>,
+            ctx: &AstContext<'_, E, F, B>,
+        ) -> Vec<F> {
+            match ast {
+                Ast::Poly(leaf) => ctx.leaves.get(leaf).expect("We prepared this").to_vec(),
+                Ast::Add(a, b) => {
+                    let mut lhs = recurse(a, ctx);
+                    let rhs = recurse(b, ctx);
+                    for (lhs, rhs) in lhs.iter_mut().zip(rhs.iter()) {
+                        *lhs += *rhs;
+                    }
+                    lhs
+                }
+                Ast::Mul(AstMul(a, b)) => {
+                    let mut lhs = recurse(a, ctx);
+                    let rhs = recurse(b, ctx);
+                    for (lhs, rhs) in lhs.iter_mut().zip(rhs.iter()) {
+                        *lhs *= *rhs;
+                    }
+                    lhs
+                }
+                Ast::Scale(a, scalar) => {
+                    let mut lhs = recurse(a, ctx);
+                    for lhs in lhs.iter_mut() {
+                        *lhs *= scalar;
+                    }
+                    lhs
+                }
+                Ast::DistributePowers(terms, base) => terms.iter().fold(
+                    B::constant_term(ctx.poly_len, ctx.chunk_size, ctx.chunk_index, F::ZERO),
+                    |mut acc, term| {
+                        let term = recurse(term, ctx);
+                        for (acc, term) in acc.iter_mut().zip(term) {
+                            *acc *= base;
+                            *acc += term;
+                        }
+                        acc
+                    },
+                ),
+                Ast::LinearTerm(scalar) => B::linear_term(
+                    ctx.domain,
+                    ctx.poly_len,
+                    ctx.chunk_size,
+                    ctx.chunk_index,
+                    *scalar,
+                ),
+                Ast::ConstantTerm(scalar) => {
+                    B::constant_term(ctx.poly_len, ctx.chunk_size, ctx.chunk_index, *scalar)
+                }
+            }
+        }
+
+        // Apply `ast` to each chunk in parallel, writing the result into an output
+        // polynomial.
+        let mut result = B::empty_poly(domain);
+        multicore::scope(|scope| {
+            for (chunk_index, (out, leaves)) in
+                result.chunks_mut(chunk_size).zip(chunks.iter()).enumerate()
+            {
+                scope.spawn(move |_| {
+                    let ctx = AstContext {
+                        domain,
+                        poly_len,
+                        chunk_size,
+                        chunk_index,
+                        leaves,
+                    };
+                    out.copy_from_slice(&recurse(ast, &ctx));
+                });
+            }
+        });
+        result
+    }
+}
+
+/// Struct representing the [`Ast::Mul`] case.
+///
+/// This struct exists to make the internals of this case private so that we don't
+/// accidentally construct this case directly, because it can only be implemented for the
+/// [`ExtendedLagrangeCoeff`] basis.
+#[derive(Clone)]
+pub(crate) struct AstMul<E, F: Field, B: Basis>(Arc<Ast<E, F, B>>, Arc<Ast<E, F, B>>);
+
+impl<E, F: Field, B: Basis> fmt::Debug for AstMul<E, F, B> {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_tuple("AstMul")
+            .field(&self.0)
+            .field(&self.1)
+            .finish()
+    }
+}
+
+/// A polynomial operation backed by an [`Evaluator`].
+#[derive(Clone)]
+pub(crate) enum Ast<E, F: Field, B: Basis> {
+    Poly(AstLeaf<E, B>),
+    Add(Arc<Ast<E, F, B>>, Arc<Ast<E, F, B>>),
+    Mul(AstMul<E, F, B>),
+    Scale(Arc<Ast<E, F, B>>, F),
+    /// Represents a linear combination of a vector of nodes and the powers of a
+    /// field element, where the nodes are ordered from highest to lowest degree
+    /// terms.
+    DistributePowers(Arc<Vec<Ast<E, F, B>>>, F),
+    /// The degree-1 term of a polynomial.
+    ///
+    /// The field element is the coefficient of the term in the standard basis, not the
+    /// coefficient basis.
+    LinearTerm(F),
+    /// The degree-0 term of a polynomial.
+    ///
+    /// The field element is the same in both the standard and evaluation bases.
+    ConstantTerm(F),
+}
+
+impl<E, F: Field, B: Basis> Ast<E, F, B> {
+    pub fn distribute_powers<I: IntoIterator<Item = Self>>(i: I, base: F) -> Self {
+        Ast::DistributePowers(Arc::new(i.into_iter().collect()), base)
+    }
+}
+
+impl<E, F: Field, B: Basis> fmt::Debug for Ast<E, F, B> {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::Poly(leaf) => f.debug_tuple("Poly").field(leaf).finish(),
+            Self::Add(lhs, rhs) => f.debug_tuple("Add").field(lhs).field(rhs).finish(),
+            Self::Mul(x) => f.debug_tuple("Mul").field(x).finish(),
+            Self::Scale(base, scalar) => f.debug_tuple("Scale").field(base).field(scalar).finish(),
+            Self::DistributePowers(terms, base) => f
+                .debug_tuple("DistributePowers")
+                .field(terms)
+                .field(base)
+                .finish(),
+            Self::LinearTerm(x) => f.debug_tuple("LinearTerm").field(x).finish(),
+            Self::ConstantTerm(x) => f.debug_tuple("ConstantTerm").field(x).finish(),
+        }
+    }
+}
+
+impl<E, F: Field, B: Basis> From<AstLeaf<E, B>> for Ast<E, F, B> {
+    fn from(leaf: AstLeaf<E, B>) -> Self {
+        Ast::Poly(leaf)
+    }
+}
+
+impl<E, F: Field, B: Basis> Ast<E, F, B> {
+    pub(crate) fn one() -> Self {
+        Self::ConstantTerm(F::ONE)
+    }
+}
+
+impl<E, F: Field, B: Basis> Neg for Ast<E, F, B> {
+    type Output = Ast<E, F, B>;
+
+    fn neg(self) -> Self::Output {
+        Ast::Scale(Arc::new(self), -F::ONE)
+    }
+}
+
+impl<E: Clone, F: Field, B: Basis> Neg for &Ast<E, F, B> {
+    type Output = Ast<E, F, B>;
+
+    fn neg(self) -> Self::Output {
+        -(self.clone())
+    }
+}
+
+impl<E, F: Field, B: Basis> Add for Ast<E, F, B> {
+    type Output = Ast<E, F, B>;
+
+    fn add(self, other: Self) -> Self::Output {
+        Ast::Add(Arc::new(self), Arc::new(other))
+    }
+}
+
+impl<'a, E: Clone, F: Field, B: Basis> Add<&'a Ast<E, F, B>> for &'a Ast<E, F, B> {
+    type Output = Ast<E, F, B>;
+
+    fn add(self, other: &'a Ast<E, F, B>) -> Self::Output {
+        self.clone() + other.clone()
+    }
+}
+
+impl<E, F: Field, B: Basis> Add<AstLeaf<E, B>> for Ast<E, F, B> {
+    type Output = Ast<E, F, B>;
+
+    fn add(self, other: AstLeaf<E, B>) -> Self::Output {
+        Ast::Add(Arc::new(self), Arc::new(other.into()))
+    }
+}
+
+impl<E, F: Field, B: Basis> Sub for Ast<E, F, B> {
+    type Output = Ast<E, F, B>;
+
+    fn sub(self, other: Self) -> Self::Output {
+        self + (-other)
+    }
+}
+
+impl<'a, E: Clone, F: Field, B: Basis> Sub<&'a Ast<E, F, B>> for &'a Ast<E, F, B> {
+    type Output = Ast<E, F, B>;
+
+    fn sub(self, other: &'a Ast<E, F, B>) -> Self::Output {
+        self + &(-other)
+    }
+}
+
+impl<E, F: Field, B: Basis> Sub<AstLeaf<E, B>> for Ast<E, F, B> {
+    type Output = Ast<E, F, B>;
+
+    fn sub(self, other: AstLeaf<E, B>) -> Self::Output {
+        self + (-Ast::from(other))
+    }
+}
+
+impl<E, F: Field> Mul for Ast<E, F, LagrangeCoeff> {
+    type Output = Ast<E, F, LagrangeCoeff>;
+
+    fn mul(self, other: Self) -> Self::Output {
+        Ast::Mul(AstMul(Arc::new(self), Arc::new(other)))
+    }
+}
+
+impl<'a, E: Clone, F: Field> Mul<&'a Ast<E, F, LagrangeCoeff>> for &'a Ast<E, F, LagrangeCoeff> {
+    type Output = Ast<E, F, LagrangeCoeff>;
+
+    fn mul(self, other: &'a Ast<E, F, LagrangeCoeff>) -> Self::Output {
+        self.clone() * other.clone()
+    }
+}
+
+impl<E, F: Field> Mul<AstLeaf<E, LagrangeCoeff>> for Ast<E, F, LagrangeCoeff> {
+    type Output = Ast<E, F, LagrangeCoeff>;
+
+    fn mul(self, other: AstLeaf<E, LagrangeCoeff>) -> Self::Output {
+        Ast::Mul(AstMul(Arc::new(self), Arc::new(other.into())))
+    }
+}
+
+impl<E, F: Field> Mul for Ast<E, F, ExtendedLagrangeCoeff> {
+    type Output = Ast<E, F, ExtendedLagrangeCoeff>;
+
+    fn mul(self, other: Self) -> Self::Output {
+        Ast::Mul(AstMul(Arc::new(self), Arc::new(other)))
+    }
+}
+
+impl<'a, E: Clone, F: Field> Mul<&'a Ast<E, F, ExtendedLagrangeCoeff>>
+    for &'a Ast<E, F, ExtendedLagrangeCoeff>
+{
+    type Output = Ast<E, F, ExtendedLagrangeCoeff>;
+
+    fn mul(self, other: &'a Ast<E, F, ExtendedLagrangeCoeff>) -> Self::Output {
+        self.clone() * other.clone()
+    }
+}
+
+impl<E, F: Field> Mul<AstLeaf<E, ExtendedLagrangeCoeff>> for Ast<E, F, ExtendedLagrangeCoeff> {
+    type Output = Ast<E, F, ExtendedLagrangeCoeff>;
+
+    fn mul(self, other: AstLeaf<E, ExtendedLagrangeCoeff>) -> Self::Output {
+        Ast::Mul(AstMul(Arc::new(self), Arc::new(other.into())))
+    }
+}
+
+impl<E, F: Field, B: Basis> Mul<F> for Ast<E, F, B> {
+    type Output = Ast<E, F, B>;
+
+    fn mul(self, other: F) -> Self::Output {
+        Ast::Scale(Arc::new(self), other)
+    }
+}
+
+impl<E: Clone, F: Field, B: Basis> Mul<F> for &Ast<E, F, B> {
+    type Output = Ast<E, F, B>;
+
+    fn mul(self, other: F) -> Self::Output {
+        Ast::Scale(Arc::new(self.clone()), other)
+    }
+}
+
+impl<E: Clone, F: Field> MulAssign for Ast<E, F, ExtendedLagrangeCoeff> {
+    fn mul_assign(&mut self, rhs: Self) {
+        *self = self.clone().mul(rhs)
+    }
+}
+
+/// Operations which can be performed over a given basis.
+pub(crate) trait BasisOps: Basis {
+    fn empty_poly<F: Field>(domain: &EvaluationDomain<F>) -> Polynomial<F, Self>;
+    fn constant_term<F: Field>(
+        poly_len: usize,
+        chunk_size: usize,
+        chunk_index: usize,
+        scalar: F,
+    ) -> Vec<F>;
+    fn linear_term<F: Field>(
+        domain: &EvaluationDomain<F>,
+        poly_len: usize,
+        chunk_size: usize,
+        chunk_index: usize,
+        scalar: F,
+    ) -> Vec<F>;
+    fn rotate<F: Field>(
+        domain: &EvaluationDomain<F>,
+        poly: &Polynomial<F, Self>,
+        rotation: Rotation,
+    ) -> Polynomial<F, Self>;
+}
+
+impl BasisOps for Coeff {
+    fn empty_poly<F: Field>(domain: &EvaluationDomain<F>) -> Polynomial<F, Self> {
+        domain.empty_coeff()
+    }
+
+    fn constant_term<F: Field>(
+        poly_len: usize,
+        chunk_size: usize,
+        chunk_index: usize,
+        scalar: F,
+    ) -> Vec<F> {
+        let mut chunk = vec![F::ZERO; cmp::min(chunk_size, poly_len - chunk_size * chunk_index)];
+        if chunk_index == 0 {
+            chunk[0] = scalar;
+        }
+        chunk
+    }
+
+    fn linear_term<F: Field>(
+        _: &EvaluationDomain<F>,
+        poly_len: usize,
+        chunk_size: usize,
+        chunk_index: usize,
+        scalar: F,
+    ) -> Vec<F> {
+        let mut chunk = vec![F::ZERO; cmp::min(chunk_size, poly_len - chunk_size * chunk_index)];
+        // If the chunk size is 1 (e.g. if we have a small k and many threads), then the
+        // linear coefficient is the second chunk. Otherwise, the chunk size is greater
+        // than one, and the linear coefficient is the second element of the first chunk.
+        // Note that we check against the original chunk size, not the potentially-short
+        // actual size of the current chunk, because we want to know whether the size of
+        // the previous chunk was 1.
+        if chunk_size == 1 && chunk_index == 1 {
+            chunk[0] = scalar;
+        } else if chunk_index == 0 {
+            chunk[1] = scalar;
+        }
+        chunk
+    }
+
+    fn rotate<F: Field>(
+        _: &EvaluationDomain<F>,
+        _: &Polynomial<F, Self>,
+        _: Rotation,
+    ) -> Polynomial<F, Self> {
+        panic!("Can't rotate polynomials in the standard basis")
+    }
+}
+
+impl BasisOps for LagrangeCoeff {
+    fn empty_poly<F: Field>(domain: &EvaluationDomain<F>) -> Polynomial<F, Self> {
+        domain.empty_lagrange()
+    }
+
+    fn constant_term<F: Field>(
+        poly_len: usize,
+        chunk_size: usize,
+        chunk_index: usize,
+        scalar: F,
+    ) -> Vec<F> {
+        vec![scalar; cmp::min(chunk_size, poly_len - chunk_size * chunk_index)]
+    }
+
+    fn linear_term<F: Field>(
+        domain: &EvaluationDomain<F>,
+        poly_len: usize,
+        chunk_size: usize,
+        chunk_index: usize,
+        scalar: F,
+    ) -> Vec<F> {
+        // Take every power of omega within the chunk, and multiply by scalar.
+        let omega = domain.get_omega();
+        let start = chunk_size * chunk_index;
+        (0..cmp::min(chunk_size, poly_len - start))
+            .scan(omega.pow_vartime(&[start as u64]) * scalar, |acc, _| {
+                let ret = *acc;
+                *acc *= omega;
+                Some(ret)
+            })
+            .collect()
+    }
+
+    fn rotate<F: Field>(
+        _: &EvaluationDomain<F>,
+        poly: &Polynomial<F, Self>,
+        rotation: Rotation,
+    ) -> Polynomial<F, Self> {
+        poly.rotate(rotation)
+    }
+}
+
+impl BasisOps for ExtendedLagrangeCoeff {
+    fn empty_poly<F: Field>(domain: &EvaluationDomain<F>) -> Polynomial<F, Self> {
+        domain.empty_extended()
+    }
+
+    fn constant_term<F: Field>(
+        poly_len: usize,
+        chunk_size: usize,
+        chunk_index: usize,
+        scalar: F,
+    ) -> Vec<F> {
+        vec![scalar; cmp::min(chunk_size, poly_len - chunk_size * chunk_index)]
+    }
+
+    fn linear_term<F: Field>(
+        domain: &EvaluationDomain<F>,
+        poly_len: usize,
+        chunk_size: usize,
+        chunk_index: usize,
+        scalar: F,
+    ) -> Vec<F> {
+        // Take every power of the extended omega within the chunk, and multiply by scalar.
+        let omega = domain.get_extended_omega();
+        let start = chunk_size * chunk_index;
+        (0..cmp::min(chunk_size, poly_len - start))
+            .scan(
+                omega.pow_vartime(&[start as u64]) * F::ZETA * scalar,
+                |acc, _| {
+                    let ret = *acc;
+                    *acc *= omega;
+                    Some(ret)
+                },
+            )
+            .collect()
+    }
+
+    fn rotate<F: Field>(
+        domain: &EvaluationDomain<F>,
+        poly: &Polynomial<F, Self>,
+        rotation: Rotation,
+    ) -> Polynomial<F, Self> {
+        domain.rotate_extended(poly, rotation)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::iter;
+
+    use halo2curves::pasta::pallas;
+
+    use super::{get_chunk_params, new_evaluator, Ast, BasisOps, Evaluator};
+    use crate::{
+        multicore,
+        poly::{Coeff, EvaluationDomain, ExtendedLagrangeCoeff, LagrangeCoeff},
+    };
+
+    #[test]
+    fn short_chunk_regression_test() {
+        // Pick the smallest polynomial length that is guaranteed to produce a short chunk
+        // on this machine.
+        let k = match (1..16)
+            .map(|k| (k, get_chunk_params(1 << k)))
+            .find(|(k, (chunk_size, num_chunks))| (1 << k) < chunk_size * num_chunks)
+            .map(|(k, _)| k)
+        {
+            Some(k) => k,
+            None => {
+                // We are on a machine with a power-of-two number of threads, and cannot
+                // trigger the bug.
+                eprintln!(
+                    "can't find a polynomial length for short_chunk_regression_test; skipping"
+                );
+                return;
+            }
+        };
+        eprintln!("Testing short-chunk regression with k = {}", k);
+
+        fn test_case<E: Copy + Send + Sync, B: BasisOps>(
+            k: u32,
+            mut evaluator: Evaluator<E, pallas::Base, B>,
+        ) {
+            // Instantiate the evaluator with a trivial polynomial.
+            let domain = EvaluationDomain::new(1, k);
+            evaluator.register_poly(B::empty_poly(&domain));
+
+            // With the bug present, these will panic.
+            let _ = evaluator.evaluate(&Ast::ConstantTerm(pallas::Base::zero()), &domain);
+            let _ = evaluator.evaluate(&Ast::LinearTerm(pallas::Base::zero()), &domain);
+        }
+
+        test_case(k, new_evaluator::<_, _, Coeff>(|| {}));
+        test_case(k, new_evaluator::<_, _, LagrangeCoeff>(|| {}));
+        test_case(k, new_evaluator::<_, _, ExtendedLagrangeCoeff>(|| {}));
+    }
+}
diff --git a/halo2_proofs/src/poly/ipa/commitment.rs b/halo2_proofs/src/poly/ipa/commitment.rs
index 7be053c49c..9e30355121 100644
--- a/halo2_proofs/src/poly/ipa/commitment.rs
+++ b/halo2_proofs/src/poly/ipa/commitment.rs
@@ -233,9 +233,9 @@ mod test {
     use crate::poly::commitment::{Blind, Params, MSM};
     use crate::poly::ipa::commitment::{create_proof, verify_proof, ParamsIPA};
     use crate::poly::ipa::msm::MSMIPA;
+    use group::Curve;
 
     use ff::Field;
-    use group::Curve;
 
     #[test]
     fn test_commit_lagrange_epaffine() {
diff --git a/halo2_proofs/src/poly/kzg/multiopen/gwc/verifier.rs b/halo2_proofs/src/poly/kzg/multiopen/gwc/verifier.rs
index ee5937b292..ee01bd05bc 100644
--- a/halo2_proofs/src/poly/kzg/multiopen/gwc/verifier.rs
+++ b/halo2_proofs/src/poly/kzg/multiopen/gwc/verifier.rs
@@ -69,7 +69,7 @@ where
         let mut witness_with_aux = MSMKZG::<E>::new();
 
         for ((commitment_at_a_point, wi), power_of_u) in
-            commitment_data.iter().zip(w.into_iter()).zip(powers(*u))
+            commitment_data.iter().zip(w).zip(powers(*u))
         {
             assert!(!commitment_at_a_point.queries.is_empty());
             let z = commitment_at_a_point.point;
diff --git a/halo2_proofs/src/poly/kzg/multiopen/shplonk.rs b/halo2_proofs/src/poly/kzg/multiopen/shplonk.rs
index bed814cc68..2af5ab5e43 100644
--- a/halo2_proofs/src/poly/kzg/multiopen/shplonk.rs
+++ b/halo2_proofs/src/poly/kzg/multiopen/shplonk.rs
@@ -2,15 +2,14 @@ mod prover;
 mod verifier;
 
 use crate::multicore::IntoParallelIterator;
+#[cfg(feature = "multicore")]
+use crate::multicore::ParallelIterator;
 use crate::{poly::query::Query, transcript::ChallengeScalar};
 use ff::Field;
 pub use prover::ProverSHPLONK;
 use std::collections::BTreeSet;
 pub use verifier::VerifierSHPLONK;
 
-#[cfg(feature = "multicore")]
-use crate::multicore::ParallelIterator;
-
 #[derive(Clone, Copy, Debug)]
 struct U {}
 type ChallengeU<F> = ChallengeScalar<F, U>;
@@ -200,7 +199,7 @@ mod proptests {
             col_indices in vec(select((0..num_cols).collect::<Vec<_>>()), num_queries),
             point_indices in vec(select((0..num_points).collect::<Vec<_>>()), num_queries)
         ) -> Vec<(usize, usize)> {
-            col_indices.into_iter().zip(point_indices.into_iter()).collect()
+            col_indices.into_iter().zip(point_indices).collect()
         }
     }
 
diff --git a/halo2_proofs/src/transcript/poseidon.rs b/halo2_proofs/src/transcript/poseidon.rs
index f3ea5b0aae..b6561d671d 100644
--- a/halo2_proofs/src/transcript/poseidon.rs
+++ b/halo2_proofs/src/transcript/poseidon.rs
@@ -2,7 +2,6 @@ use super::{Challenge255, EncodedChallenge, Transcript, TranscriptRead, Transcri
 use crate::helpers::base_to_scalar;
 use group::ff::{FromUniformBytes, PrimeField};
 use halo2curves::{Coordinates, CurveAffine};
-use num_bigint::BigUint;
 use poseidon::Poseidon;
 use std::convert::TryInto;
 use std::io::{self, Read, Write};
diff --git a/halo2_proofs/tests/plonk_api.rs b/halo2_proofs/tests/plonk_api.rs
index 99cbee8e60..d27c3b8ccd 100644
--- a/halo2_proofs/tests/plonk_api.rs
+++ b/halo2_proofs/tests/plonk_api.rs
@@ -1,10 +1,9 @@
 #![allow(clippy::many_single_char_names)]
 #![allow(clippy::op_ref)]
 
-// use assert_matches::assert_matches;
 use ff::{FromUniformBytes, WithSmallOrderMulGroup};
 use halo2_proofs::arithmetic::Field;
-use halo2_proofs::circuit::{Cell, Layouter, Region, SimpleFloorPlanner, Value};
+use halo2_proofs::circuit::{Cell, Layouter, SimpleFloorPlanner, Value};
 use halo2_proofs::dev::MockProver;
 use halo2_proofs::plonk::{
     create_proof as create_plonk_proof, keygen_pk, keygen_vk, verify_proof as verify_plonk_proof,
@@ -18,249 +17,390 @@ use halo2_proofs::transcript::{
     Blake2bRead, Blake2bWrite, Challenge255, EncodedChallenge, TranscriptReadBuffer,
     TranscriptWriterBuffer,
 };
+use halo2curves::bn256::Bn256;
 use rand_core::{OsRng, RngCore};
 use std::marker::PhantomData;
 use std::time::Instant;
 
-#[test]
-fn plonk_api() {
-    const K: u32 = 17;
+#[cfg(feature = "parallel_syn")]
+use halo2_proofs::circuit::Region;
+use halo2_proofs::poly::kzg::commitment::{KZGCommitmentScheme, ParamsKZG};
+use halo2_proofs::poly::kzg::multiopen::{ProverGWC, VerifierGWC};
+use halo2_proofs::poly::kzg::strategy::AccumulatorStrategy;
+
+/// This represents an advice column at a certain row in the ConstraintSystem
+#[derive(Copy, Clone, Debug)]
+pub struct Variable(Column<Advice>, usize);
+
+#[derive(Clone)]
+struct PlonkConfig {
+    a: Column<Advice>,
+    b: Column<Advice>,
+    c: Column<Advice>,
+    d: Column<Advice>,
+    e: Column<Advice>,
+
+    sa: Column<Fixed>,
+    sb: Column<Fixed>,
+    sc: Column<Fixed>,
+    sm: Column<Fixed>,
+    sp: Column<Fixed>,
+    sl: TableColumn,
+}
 
-    /// This represents an advice column at a certain row in the ConstraintSystem
-    #[derive(Copy, Clone, Debug)]
-    pub struct Variable(Column<Advice>, usize);
+impl PlonkConfig {
+    pub fn construct<F: Field>(meta: &mut ConstraintSystem<F>) -> Self {
+        let e = meta.advice_column();
+        let a = meta.advice_column();
+        let b = meta.advice_column();
+        let sf = meta.fixed_column();
+        let c = meta.advice_column();
+        let d = meta.advice_column();
+        let p = meta.instance_column();
+
+        meta.enable_equality(a);
+        meta.enable_equality(b);
+        meta.enable_equality(c);
+
+        let sm = meta.fixed_column();
+        let sa = meta.fixed_column();
+        let sb = meta.fixed_column();
+        let sc = meta.fixed_column();
+        let sp = meta.fixed_column();
+        let sl = meta.lookup_table_column();
+
+        // Add to test mvlookup
+        let dummy = meta.complex_selector();
+        let dummy_2 = meta.complex_selector();
+        let dummy_3 = meta.complex_selector();
+
+        let dummy_table = meta.lookup_table_column();
 
-    #[derive(Clone)]
-    struct PlonkConfig {
-        a: Column<Advice>,
-        b: Column<Advice>,
-        c: Column<Advice>,
-        d: Column<Advice>,
-        e: Column<Advice>,
-
-        sa: Column<Fixed>,
-        sb: Column<Fixed>,
-        sc: Column<Fixed>,
-        sm: Column<Fixed>,
-        sp: Column<Fixed>,
-        sl: TableColumn,
-    }
-
-    #[allow(clippy::type_complexity)]
-    trait StandardCs<FF: Field> {
-        fn raw_multiply<F>(
-            &self,
-            layouter: &mut impl Layouter<FF>,
-            f: F,
-        ) -> Result<(Cell, Cell, Cell), Error>
-        where
-            F: FnMut() -> Value<(Assigned<FF>, Assigned<FF>, Assigned<FF>)>;
-        fn raw_add<F>(
-            &self,
-            layouter: &mut impl Layouter<FF>,
-            f: F,
-        ) -> Result<(Cell, Cell, Cell), Error>
-        where
-            F: FnMut() -> Value<(Assigned<FF>, Assigned<FF>, Assigned<FF>)>;
-        fn copy(&self, layouter: &mut impl Layouter<FF>, a: Cell, b: Cell) -> Result<(), Error>;
-        fn public_input<F>(&self, layouter: &mut impl Layouter<FF>, f: F) -> Result<Cell, Error>
-        where
-            F: FnMut() -> Value<FF>;
-        fn lookup_table(
-            &self,
-            layouter: &mut impl Layouter<FF>,
-            values: &[FF],
-        ) -> Result<(), Error>;
+        /*
+         *   A         B      ...  sl
+         * [
+         *   instance  0      ...  0
+         *   a         a      ...  0
+         *   a         a^2    ...  0
+         *   a         a      ...  0
+         *   a         a^2    ...  0
+         *   ...       ...    ...  ...
+         *   ...       ...    ...  instance
+         *   ...       ...    ...  a
+         *   ...       ...    ...  a
+         *   ...       ...    ...  0
+         * ]
+         */
+
+        meta.lookup("lookup", |meta| {
+            let a_ = meta.query_any(a, Rotation::cur());
+            vec![(a_, sl)]
+        });
+
+        // Add to test mvlookup
+        meta.lookup("lookup_same", |meta| {
+            let a_ = meta.query_any(a, Rotation::cur());
+            vec![(a_, sl)]
+        });
+
+        meta.lookup("lookup_same", |meta| {
+            let b_ = meta.query_any(b, Rotation::cur());
+            let dummy = meta.query_selector(dummy);
+            let dummy_2 = meta.query_selector(dummy_2);
+            let dummy_3 = meta.query_selector(dummy_3);
+
+            vec![(dummy * dummy_2 * dummy_3 * b_, dummy_table)]
+        });
+
+        meta.create_gate("Combined add-mult", |meta| {
+            let d = meta.query_advice(d, Rotation::next());
+            let a = meta.query_advice(a, Rotation::cur());
+            let sf = meta.query_fixed(sf, Rotation::cur());
+            let e = meta.query_advice(e, Rotation::prev());
+            let b = meta.query_advice(b, Rotation::cur());
+            let c = meta.query_advice(c, Rotation::cur());
+
+            let sa = meta.query_fixed(sa, Rotation::cur());
+            let sb = meta.query_fixed(sb, Rotation::cur());
+            let sc = meta.query_fixed(sc, Rotation::cur());
+            let sm = meta.query_fixed(sm, Rotation::cur());
+
+            vec![a.clone() * sa + b.clone() * sb + a * b * sm - (c * sc) + sf * (d * e)]
+        });
+
+        meta.create_gate("Public input", |meta| {
+            let a = meta.query_advice(a, Rotation::cur());
+            let p = meta.query_instance(p, Rotation::cur());
+            let sp = meta.query_fixed(sp, Rotation::cur());
+
+            vec![sp * (a - p)]
+        });
+
+        meta.enable_equality(sf);
+        meta.enable_equality(e);
+        meta.enable_equality(d);
+        meta.enable_equality(p);
+        meta.enable_equality(sm);
+        meta.enable_equality(sa);
+        meta.enable_equality(sb);
+        meta.enable_equality(sc);
+        meta.enable_equality(sp);
+
+        PlonkConfig {
+            a,
+            b,
+            c,
+            d,
+            e,
+            sa,
+            sb,
+            sc,
+            sm,
+            sp,
+            sl,
+        }
     }
+}
 
-    #[derive(Clone)]
-    struct MyCircuit<F: Field> {
-        a: Value<F>,
-        lookup_table: Vec<F>,
-    }
+#[allow(clippy::type_complexity)]
+trait StandardCs<FF: Field> {
+    fn raw_multiply<F>(
+        &self,
+        layouter: &mut impl Layouter<FF>,
+        f: F,
+    ) -> Result<(Cell, Cell, Cell), Error>
+    where
+        F: FnMut() -> Value<(Assigned<FF>, Assigned<FF>, Assigned<FF>)>;
+    fn raw_add<F>(
+        &self,
+        layouter: &mut impl Layouter<FF>,
+        f: F,
+    ) -> Result<(Cell, Cell, Cell), Error>
+    where
+        F: FnMut() -> Value<(Assigned<FF>, Assigned<FF>, Assigned<FF>)>;
+    fn copy(&self, layouter: &mut impl Layouter<FF>, a: Cell, b: Cell) -> Result<(), Error>;
+    fn public_input<F>(&self, layouter: &mut impl Layouter<FF>, f: F) -> Result<Cell, Error>
+    where
+        F: FnMut() -> Value<FF>;
+    fn lookup_table(&self, layouter: &mut impl Layouter<FF>, values: &[FF]) -> Result<(), Error>;
+}
 
-    struct StandardPlonk<F: Field> {
-        config: PlonkConfig,
-        _marker: PhantomData<F>,
-    }
+struct StandardPlonk<F: Field> {
+    config: PlonkConfig,
+    _marker: PhantomData<F>,
+}
 
-    impl<FF: Field> StandardPlonk<FF> {
-        fn new(config: PlonkConfig) -> Self {
-            StandardPlonk {
-                config,
-                _marker: PhantomData,
-            }
+impl<FF: Field> StandardPlonk<FF> {
+    fn new(config: PlonkConfig) -> Self {
+        StandardPlonk {
+            config,
+            _marker: PhantomData,
         }
     }
+}
+impl<FF: Field> StandardCs<FF> for StandardPlonk<FF> {
+    fn raw_multiply<F>(
+        &self,
+        layouter: &mut impl Layouter<FF>,
+        mut f: F,
+    ) -> Result<(Cell, Cell, Cell), Error>
+    where
+        F: FnMut() -> Value<(Assigned<FF>, Assigned<FF>, Assigned<FF>)>,
+    {
+        layouter.assign_region(
+            || "raw_multiply",
+            |mut region| {
+                let mut value = None;
+                let lhs = region.assign_advice(
+                    || "lhs",
+                    self.config.a,
+                    0,
+                    || {
+                        value = Some(f());
+                        value.unwrap().map(|v| v.0)
+                    },
+                )?;
+                region.assign_advice(
+                    || "lhs^4",
+                    self.config.d,
+                    0,
+                    || value.unwrap().map(|v| v.0).square().square(),
+                )?;
+                let rhs = region.assign_advice(
+                    || "rhs",
+                    self.config.b,
+                    0,
+                    || value.unwrap().map(|v| v.1),
+                )?;
+                region.assign_advice(
+                    || "rhs^4",
+                    self.config.e,
+                    0,
+                    || value.unwrap().map(|v| v.1).square().square(),
+                )?;
+                let out = region.assign_advice(
+                    || "out",
+                    self.config.c,
+                    0,
+                    || value.unwrap().map(|v| v.2),
+                )?;
+
+                region.assign_fixed(|| "a", self.config.sa, 0, || Value::known(FF::ZERO))?;
+                region.assign_fixed(|| "b", self.config.sb, 0, || Value::known(FF::ZERO))?;
+                region.assign_fixed(|| "c", self.config.sc, 0, || Value::known(FF::ONE))?;
+                region.assign_fixed(|| "a * b", self.config.sm, 0, || Value::known(FF::ONE))?;
+                Ok((lhs.cell(), rhs.cell(), out.cell()))
+            },
+        )
+    }
+    fn raw_add<F>(
+        &self,
+        layouter: &mut impl Layouter<FF>,
+        mut f: F,
+    ) -> Result<(Cell, Cell, Cell), Error>
+    where
+        F: FnMut() -> Value<(Assigned<FF>, Assigned<FF>, Assigned<FF>)>,
+    {
+        layouter.assign_region(
+            || "raw_add",
+            |mut region| {
+                let mut value = None;
+                let lhs = region.assign_advice(
+                    || "lhs",
+                    self.config.a,
+                    0,
+                    || {
+                        value = Some(f());
+                        value.unwrap().map(|v| v.0)
+                    },
+                )?;
+                region.assign_advice(
+                    || "lhs^4",
+                    self.config.d,
+                    0,
+                    || value.unwrap().map(|v| v.0).square().square(),
+                )?;
+                let rhs = region.assign_advice(
+                    || "rhs",
+                    self.config.b,
+                    0,
+                    || value.unwrap().map(|v| v.1),
+                )?;
+                region.assign_advice(
+                    || "rhs^4",
+                    self.config.e,
+                    0,
+                    || value.unwrap().map(|v| v.1).square().square(),
+                )?;
+                let out = region.assign_advice(
+                    || "out",
+                    self.config.c,
+                    0,
+                    || value.unwrap().map(|v| v.2),
+                )?;
+
+                region.assign_fixed(|| "a", self.config.sa, 0, || Value::known(FF::ONE))?;
+                region.assign_fixed(|| "b", self.config.sb, 0, || Value::known(FF::ONE))?;
+                region.assign_fixed(|| "c", self.config.sc, 0, || Value::known(FF::ONE))?;
+                region.assign_fixed(|| "a * b", self.config.sm, 0, || Value::known(FF::ZERO))?;
+                Ok((lhs.cell(), rhs.cell(), out.cell()))
+            },
+        )
+    }
+    fn copy(&self, layouter: &mut impl Layouter<FF>, left: Cell, right: Cell) -> Result<(), Error> {
+        layouter.assign_region(
+            || "copy",
+            |mut region| {
+                region.constrain_equal(left, right)?;
+                region.constrain_equal(left, right)
+            },
+        )
+    }
+    fn public_input<F>(&self, layouter: &mut impl Layouter<FF>, mut f: F) -> Result<Cell, Error>
+    where
+        F: FnMut() -> Value<FF>,
+    {
+        layouter.assign_region(
+            || "public_input",
+            |mut region| {
+                let value = region.assign_advice(|| "value", self.config.a, 0, &mut f)?;
+                region.assign_fixed(|| "public", self.config.sp, 0, || Value::known(FF::ONE))?;
 
-    impl<FF: Field> StandardCs<FF> for StandardPlonk<FF> {
-        fn raw_multiply<F>(
-            &self,
-            layouter: &mut impl Layouter<FF>,
-            mut f: F,
-        ) -> Result<(Cell, Cell, Cell), Error>
-        where
-            F: FnMut() -> Value<(Assigned<FF>, Assigned<FF>, Assigned<FF>)>,
-        {
-            layouter.assign_region(
-                || "raw_multiply",
-                |mut region| {
-                    let mut value = None;
-                    let lhs = region.assign_advice(
-                        || "lhs",
-                        self.config.a,
-                        0,
-                        || {
-                            value = Some(f());
-                            value.unwrap().map(|v| v.0)
-                        },
-                    )?;
-                    region.assign_advice(
-                        || "lhs^4",
-                        self.config.d,
-                        0,
-                        || value.unwrap().map(|v| v.0).square().square(),
-                    )?;
-                    let rhs = region.assign_advice(
-                        || "rhs",
-                        self.config.b,
-                        0,
-                        || value.unwrap().map(|v| v.1),
-                    )?;
-                    region.assign_advice(
-                        || "rhs^4",
-                        self.config.e,
-                        0,
-                        || value.unwrap().map(|v| v.1).square().square(),
-                    )?;
-                    let out = region.assign_advice(
-                        || "out",
-                        self.config.c,
-                        0,
-                        || value.unwrap().map(|v| v.2),
+                Ok(value.cell())
+            },
+        )
+    }
+    fn lookup_table(&self, layouter: &mut impl Layouter<FF>, values: &[FF]) -> Result<(), Error> {
+        layouter.assign_table(
+            || "",
+            |mut table| {
+                for (index, &value) in values.iter().enumerate() {
+                    table.assign_cell(
+                        || "table col",
+                        self.config.sl,
+                        index,
+                        || Value::known(value),
                     )?;
+                }
+                Ok(())
+            },
+        )?;
+        Ok(())
+    }
+}
 
-                    region.assign_fixed(|| "a", self.config.sa, 0, || Value::known(FF::ZERO))?;
-                    region.assign_fixed(|| "b", self.config.sb, 0, || Value::known(FF::ZERO))?;
-                    region.assign_fixed(|| "c", self.config.sc, 0, || Value::known(FF::ONE))?;
-                    region.assign_fixed(|| "a * b", self.config.sm, 0, || Value::known(FF::ONE))?;
-                    Ok((lhs.cell(), rhs.cell(), out.cell()))
-                },
-            )
-        }
-        fn raw_add<F>(
-            &self,
-            layouter: &mut impl Layouter<FF>,
-            mut f: F,
-        ) -> Result<(Cell, Cell, Cell), Error>
-        where
-            F: FnMut() -> Value<(Assigned<FF>, Assigned<FF>, Assigned<FF>)>,
-        {
-            layouter.assign_region(
-                || "raw_add",
-                |mut region| {
-                    let mut value = None;
-                    let lhs = region.assign_advice(
-                        || "lhs",
-                        self.config.a,
-                        0,
-                        || {
-                            value = Some(f());
-                            value.unwrap().map(|v| v.0)
-                        },
-                    )?;
-                    region.assign_advice(
-                        || "lhs^4",
-                        self.config.d,
-                        0,
-                        || value.unwrap().map(|v| v.0).square().square(),
-                    )?;
-                    let rhs = region.assign_advice(
-                        || "rhs",
-                        self.config.b,
-                        0,
-                        || value.unwrap().map(|v| v.1),
-                    )?;
-                    region.assign_advice(
-                        || "rhs^4",
-                        self.config.e,
-                        0,
-                        || value.unwrap().map(|v| v.1).square().square(),
-                    )?;
-                    let out = region.assign_advice(
-                        || "out",
-                        self.config.c,
-                        0,
-                        || value.unwrap().map(|v| v.2),
-                    )?;
+macro_rules! common {
+    ($scheme:ident) => {{
+        let a = <$scheme as CommitmentScheme>::Scalar::from(2834758237)
+            * <$scheme as CommitmentScheme>::Scalar::ZETA;
+        let instance =
+            <$scheme as CommitmentScheme>::Scalar::ONE + <$scheme as CommitmentScheme>::Scalar::ONE;
+        let lookup_table = vec![instance, a, a, <$scheme as CommitmentScheme>::Scalar::ZERO];
+        (a, instance, lookup_table)
+    }};
+}
 
-                    region.assign_fixed(|| "a", self.config.sa, 0, || Value::known(FF::ONE))?;
-                    region.assign_fixed(|| "b", self.config.sb, 0, || Value::known(FF::ONE))?;
-                    region.assign_fixed(|| "c", self.config.sc, 0, || Value::known(FF::ONE))?;
-                    region.assign_fixed(
-                        || "a * b",
-                        self.config.sm,
-                        0,
-                        || Value::known(FF::ZERO),
-                    )?;
-                    Ok((lhs.cell(), rhs.cell(), out.cell()))
-                },
-            )
-        }
-        fn copy(
-            &self,
-            layouter: &mut impl Layouter<FF>,
-            left: Cell,
-            right: Cell,
-        ) -> Result<(), Error> {
-            layouter.assign_region(
-                || "copy",
-                |mut region| {
-                    region.constrain_equal(left, right)?;
-                    region.constrain_equal(left, right)
-                },
-            )
-        }
-        fn public_input<F>(&self, layouter: &mut impl Layouter<FF>, mut f: F) -> Result<Cell, Error>
-        where
-            F: FnMut() -> Value<FF>,
-        {
-            layouter.assign_region(
-                || "public_input",
-                |mut region| {
-                    let value = region.assign_advice(|| "value", self.config.a, 0, &mut f)?;
-                    region.assign_fixed(
-                        || "public",
-                        self.config.sp,
-                        0,
-                        || Value::known(FF::ONE),
-                    )?;
+fn verify_proof<
+    'a,
+    'params,
+    Scheme: CommitmentScheme,
+    V: Verifier<'params, Scheme>,
+    E: EncodedChallenge<Scheme::Curve>,
+    T: TranscriptReadBuffer<&'a [u8], Scheme::Curve, E>,
+    Strategy: VerificationStrategy<'params, Scheme, V, Output = Strategy>,
+>(
+    params_verifier: &'params Scheme::ParamsVerifier,
+    vk: &VerifyingKey<Scheme::Curve>,
+    proof: &'a [u8],
+) where
+    Scheme::Scalar: Ord + WithSmallOrderMulGroup<3> + FromUniformBytes<64>,
+{
+    let (_, instance, _) = common!(Scheme);
+    let pubinputs = [instance];
+
+    let mut transcript = T::init(proof);
+
+    let strategy = Strategy::new(params_verifier);
+    let strategy = verify_plonk_proof(
+        params_verifier,
+        vk,
+        strategy,
+        &[&[&pubinputs[..]], &[&pubinputs[..]]],
+        &mut transcript,
+    )
+    .unwrap();
+
+    assert!(strategy.finalize());
+}
 
-                    Ok(value.cell())
-                },
-            )
-        }
-        fn lookup_table(
-            &self,
-            layouter: &mut impl Layouter<FF>,
-            values: &[FF],
-        ) -> Result<(), Error> {
-            layouter.assign_table(
-                || "",
-                |mut table| {
-                    for (index, &value) in values.iter().enumerate() {
-                        table.assign_cell(
-                            || "table col",
-                            self.config.sl,
-                            index,
-                            || Value::known(value),
-                        )?;
-                    }
-                    Ok(())
-                },
-            )?;
-            Ok(())
-        }
+#[test]
+fn plonk_api() {
+    const K: u32 = 17;
+
+    #[derive(Clone)]
+    struct MyCircuit<F: Field> {
+        a: Value<F>,
+        lookup_table: Vec<F>,
     }
 
     impl<F: Field> Circuit<F> for MyCircuit<F> {
@@ -372,18 +512,20 @@ fn plonk_api() {
             mut layouter: impl Layouter<F>,
         ) -> Result<(), Error> {
             let cs = StandardPlonk::new(config);
-            let mut is_first_pass_vec = vec![true; 8];
+
+            #[cfg(feature = "parallel_syn")]
+            let mut is_first_pass_vec = [true; 8];
 
             let _ = cs.public_input(&mut layouter, || Value::known(F::ONE + F::ONE))?;
 
+            #[cfg(feature = "parallel_syn")]
             let a: Value<Assigned<_>> = self.a.into();
             let parallel_regions_time = Instant::now();
             #[cfg(feature = "parallel_syn")]
             layouter.assign_regions(
                 || "regions",
                 (0..8)
-                    .into_iter()
-                    .zip(is_first_pass_vec.chunks_mut(1).into_iter())
+                    .zip(is_first_pass_vec.chunks_mut(1))
                     .map(|(_, is_first_pass)| {
                         |mut region: Region<'_, F>| -> Result<(), Error> {
                             let n = 1 << 13;
@@ -464,17 +606,6 @@ fn plonk_api() {
         }
     }
 
-    macro_rules! common {
-        ($scheme:ident) => {{
-            let a = <$scheme as CommitmentScheme>::Scalar::from(2834758237)
-                * <$scheme as CommitmentScheme>::Scalar::ZETA;
-            let instance = <$scheme as CommitmentScheme>::Scalar::ONE
-                + <$scheme as CommitmentScheme>::Scalar::ONE;
-            let lookup_table = vec![instance, a, a, <$scheme as CommitmentScheme>::Scalar::ZERO];
-            (a, instance, lookup_table)
-        }};
-    }
-
     /*
     macro_rules! bad_keys {
         ($scheme:ident) => {{
@@ -564,39 +695,6 @@ fn plonk_api() {
         transcript.finalize()
     }
 
-    fn verify_proof<
-        'a,
-        'params,
-        Scheme: CommitmentScheme,
-        V: Verifier<'params, Scheme>,
-        E: EncodedChallenge<Scheme::Curve>,
-        T: TranscriptReadBuffer<&'a [u8], Scheme::Curve, E>,
-        Strategy: VerificationStrategy<'params, Scheme, V, Output = Strategy>,
-    >(
-        params_verifier: &'params Scheme::ParamsVerifier,
-        vk: &VerifyingKey<Scheme::Curve>,
-        proof: &'a [u8],
-    ) where
-        Scheme::Scalar: Ord + WithSmallOrderMulGroup<3> + FromUniformBytes<64>,
-    {
-        let (_, instance, _) = common!(Scheme);
-        let pubinputs = [instance];
-
-        let mut transcript = T::init(proof);
-
-        let strategy = Strategy::new(params_verifier);
-        let strategy = verify_plonk_proof(
-            params_verifier,
-            vk,
-            strategy,
-            &[&[&pubinputs[..]], &[&pubinputs[..]]],
-            &mut transcript,
-        )
-        .unwrap();
-
-        assert!(strategy.finalize());
-    }
-
     fn test_plonk_api_gwc() {
         use halo2_proofs::poly::kzg::commitment::{KZGCommitmentScheme, ParamsKZG};
         use halo2_proofs::poly::kzg::multiopen::{ProverGWC, VerifierGWC};
@@ -618,7 +716,10 @@ fn plonk_api() {
             Ok(prover) => prover,
             Err(e) => panic!("{:?}", e),
         };
+        #[cfg(feature = "multicore")]
         assert_eq!(prover.verify_par(), Ok(()));
+        #[cfg(not(feature = "multicore"))]
+        assert_eq!(prover.verify(), Ok(()));
         log::info!("mock proving succeed!");
 
         let params = ParamsKZG::<Bn256>::new(K);
@@ -670,6 +771,7 @@ fn plonk_api() {
         >(verifier_params, pk.get_vk(), &proof[..]);
     }
 
+    #[allow(unused)]
     fn test_plonk_api_ipa() {
         use halo2_proofs::poly::ipa::commitment::{IPACommitmentScheme, ParamsIPA};
         use halo2_proofs::poly::ipa::multiopen::{ProverIPA, VerifierIPA};
@@ -1104,8 +1206,228 @@ fn plonk_api() {
                  */
     }
 
-    env_logger::init();
-    test_plonk_api_ipa();
+    let _logger_err = env_logger::try_init();
+    // TODO: fix the ipa test
+    // test_plonk_api_ipa();
     test_plonk_api_gwc();
     test_plonk_api_shplonk();
 }
+
+#[test]
+fn plonk_api_with_many_subregions() {
+    #[derive(Clone)]
+    struct MyCircuit<F: Field> {
+        a: Value<F>,
+        lookup_table: Vec<F>,
+    }
+
+    impl<F: Field> Circuit<F> for MyCircuit<F> {
+        type Config = PlonkConfig;
+        type FloorPlanner = SimpleFloorPlanner;
+        #[cfg(feature = "circuit-params")]
+        type Params = ();
+
+        fn without_witnesses(&self) -> Self {
+            Self {
+                a: Value::unknown(),
+                lookup_table: self.lookup_table.clone(),
+            }
+        }
+
+        fn configure(meta: &mut ConstraintSystem<F>) -> PlonkConfig {
+            PlonkConfig::construct(meta)
+        }
+
+        fn synthesize(
+            &self,
+            config: PlonkConfig,
+            mut layouter: impl Layouter<F>,
+        ) -> Result<(), Error> {
+            let cs = StandardPlonk::new(config);
+
+            let _ = cs.public_input(&mut layouter, || Value::known(F::ONE + F::ONE))?;
+
+            let a: Value<Assigned<_>> = self.a.into();
+            let parallel_regions_time = Instant::now();
+            #[cfg(feature = "parallel_syn")]
+            layouter.assign_regions(
+                || "regions",
+                (0..(1 << 14))
+                    .map(|_| {
+                        let mut is_first_pass = true;
+                        move |mut region: Region<'_, F>| -> Result<(), Error> {
+                            let n = 1 << 1;
+                            for i in 0..n {
+                                // skip the assign of rows except the last row in the first pass
+                                if is_first_pass && i < n - 1 {
+                                    is_first_pass = false;
+                                    continue;
+                                }
+                                let a0 =
+                                    region.assign_advice(|| "config.a", cs.config.a, i, || a)?;
+                                let a1 =
+                                    region.assign_advice(|| "config.b", cs.config.b, i, || a)?;
+                                region.assign_advice(
+                                    || "config.c",
+                                    cs.config.c,
+                                    i,
+                                    || a.double(),
+                                )?;
+
+                                region.assign_fixed(
+                                    || "a",
+                                    cs.config.sa,
+                                    i,
+                                    || Value::known(F::ONE),
+                                )?;
+                                region.assign_fixed(
+                                    || "b",
+                                    cs.config.sb,
+                                    i,
+                                    || Value::known(F::ONE),
+                                )?;
+                                region.assign_fixed(
+                                    || "c",
+                                    cs.config.sc,
+                                    i,
+                                    || Value::known(F::ONE),
+                                )?;
+                                region.assign_fixed(
+                                    || "a * b",
+                                    cs.config.sm,
+                                    i,
+                                    || Value::known(F::ZERO),
+                                )?;
+
+                                region.constrain_equal(a0.cell(), a1.cell())?;
+                            }
+                            is_first_pass = false;
+                            Ok(())
+                        }
+                    })
+                    .collect(),
+            )?;
+            log::info!(
+                "parallel_regions assign took {:?}",
+                parallel_regions_time.elapsed()
+            );
+
+            for _ in 0..10 {
+                let a: Value<Assigned<_>> = self.a.into();
+                let mut a_squared = Value::unknown();
+                let (a0, _, c0) = cs.raw_multiply(&mut layouter, || {
+                    a_squared = a.square();
+                    a.zip(a_squared).map(|(a, a_squared)| (a, a, a_squared))
+                })?;
+                let (a1, b1, _) = cs.raw_add(&mut layouter, || {
+                    let fin = a_squared + a;
+                    a.zip(a_squared)
+                        .zip(fin)
+                        .map(|((a, a_squared), fin)| (a, a_squared, fin))
+                })?;
+                cs.copy(&mut layouter, a0, a1)?;
+                cs.copy(&mut layouter, b1, c0)?;
+            }
+
+            cs.lookup_table(&mut layouter, &self.lookup_table)?;
+
+            Ok(())
+        }
+    }
+    fn keygen<Scheme: CommitmentScheme>(params: &Scheme::ParamsProver) -> ProvingKey<Scheme::Curve>
+    where
+        Scheme::Scalar: Ord + WithSmallOrderMulGroup<3> + FromUniformBytes<64>,
+    {
+        let (_, _, lookup_table) = common!(Scheme);
+        let empty_circuit: MyCircuit<Scheme::Scalar> = MyCircuit {
+            a: Value::unknown(),
+            lookup_table,
+        };
+
+        // Initialize the proving key
+        let vk = keygen_vk(params, &empty_circuit).expect("keygen_vk should not fail");
+        log::info!("keygen vk succeed");
+
+        let pk = keygen_pk(params, vk, &empty_circuit).expect("keygen_pk should not fail");
+        log::info!("keygen pk succeed");
+
+        pk
+    }
+
+    fn create_proof<
+        'params,
+        Scheme: CommitmentScheme,
+        P: Prover<'params, Scheme>,
+        E: EncodedChallenge<Scheme::Curve>,
+        R: RngCore,
+        T: TranscriptWriterBuffer<Vec<u8>, Scheme::Curve, E>,
+    >(
+        rng: R,
+        params: &'params Scheme::ParamsProver,
+        pk: &ProvingKey<Scheme::Curve>,
+    ) -> Vec<u8>
+    where
+        Scheme::Scalar: Ord + WithSmallOrderMulGroup<3> + FromUniformBytes<64>,
+    {
+        let (a, instance, lookup_table) = common!(Scheme);
+
+        let circuit: MyCircuit<Scheme::Scalar> = MyCircuit {
+            a: Value::known(a),
+            lookup_table,
+        };
+
+        let mut transcript = T::init(vec![]);
+
+        create_plonk_proof::<Scheme, P, _, _, _, _>(
+            params,
+            pk,
+            &[circuit.clone(), circuit],
+            &[&[&[instance]], &[&[instance]]],
+            rng,
+            &mut transcript,
+        )
+        .expect("proof generation should not fail");
+
+        transcript.finalize()
+    }
+
+    const K: u32 = 17;
+    type Scheme = KZGCommitmentScheme<Bn256>;
+    // bad_keys!(Scheme);
+
+    let _logger_err = env_logger::try_init();
+    let (a, instance, lookup_table) = common!(Scheme);
+
+    let circuit: MyCircuit<<Scheme as CommitmentScheme>::Scalar> = MyCircuit {
+        a: Value::known(a),
+        lookup_table,
+    };
+
+    // Check this circuit is satisfied.
+    let prover = match MockProver::run(K, &circuit, vec![vec![instance]]) {
+        Ok(prover) => prover,
+        Err(e) => panic!("{:?}", e),
+    };
+    #[cfg(feature = "multicore")]
+    assert_eq!(prover.verify_par(), Ok(()));
+    #[cfg(not(feature = "multicore"))]
+    assert_eq!(prover.verify(), Ok(()));
+    log::info!("mock proving succeed!");
+
+    let params = ParamsKZG::<Bn256>::new(K);
+    let rng = OsRng;
+
+    let pk = keygen::<KZGCommitmentScheme<_>>(&params);
+
+    let proof = create_proof::<_, ProverGWC<_>, _, _, Blake2bWrite<_, _, Challenge255<_>>>(
+        rng, &params, &pk,
+    );
+
+    let verifier_params = params.verifier_params();
+
+    verify_proof::<_, VerifierGWC<_>, _, Blake2bRead<_, _, Challenge255<_>>, AccumulatorStrategy<_>>(
+        verifier_params,
+        pk.get_vk(),
+        &proof[..],
+    );
+}