Proofs and claims merged

Author: gabriel-barrett

benches/multi_stark.rs

@@ -176,7 +176,7 @@ fn build_witness(num_adds: usize, system: &System<U32CS>) -> SystemWitness {
 }
 
 /// Build claims for the first `num_adds` additions (same PRNG seed as `build_witness`).
-fn build_claims(num_adds: usize) -> Vec<[Val; 4]> {
+fn build_claims(num_adds: usize) -> Vec<Vec<Val>> {
     let f = Val::from_u32;
     let mut a: u32 = 0xdead_beef;
     let mut b: u32 = 0xcafe_babe;
@@ -191,7 +191,7 @@ fn build_claims(num_adds: usize) -> Vec<[Val; 4]> {
         let x = a;
         let y = b;
         let (z, _carry) = x.overflowing_add(y);
-        claims.push([f(1), f(x), f(y), f(z)]);
+        claims.push(vec![f(1), f(x), f(y), f(z)]);
     }
     claims
 }
@@ -223,15 +223,12 @@ fn bench_prove(c: &mut Criterion) {
     for log_height in [12, 13, 14] {
         let num_adds = 1 << log_height;
         let claims = build_claims(num_adds);
-        let claim_refs: Vec<&[Val]> = claims.iter().map(|c| c.as_slice()).collect();
         group.bench_function(
             BenchmarkId::new("u32_add", format!("2^{log_height}")),
             |b| {
                 b.iter_batched(
-                    || build_witness(num_adds, &system),
-                    |witness| {
-                        system.prove_multiple_claims(fri_parameters, &key, &claim_refs, witness)
-                    },
+                    || (build_witness(num_adds, &system), claims.clone()),
+                    |(witness, claims)| system.prove(fri_parameters, &key, claims, witness),
                     criterion::BatchSize::LargeInput,
                 );
             },
@@ -263,17 +260,12 @@ fn bench_verify(c: &mut Criterion) {
     for log_height in [12, 13, 14] {
         let num_adds = 1 << log_height;
         let claims = build_claims(num_adds);
-        let claim_refs: Vec<&[Val]> = claims.iter().map(|c| c.as_slice()).collect();
         let witness = build_witness(num_adds, &system);
-        let proof = system.prove_multiple_claims(fri_parameters, &key, &claim_refs, witness);
+        let proof = system.prove(fri_parameters, &key, claims, witness);
         group.bench_function(
             BenchmarkId::new("u32_add", format!("2^{log_height}")),
             |b| {
-                b.iter(|| {
-                    system
-                        .verify_multiple_claims(fri_parameters, &claim_refs, &proof)
-                        .unwrap()
-                });
+                b.iter(|| system.verify(fri_parameters, &proof).unwrap());
             },
         );
     }

examples/lookup_proof.rs

@@ -141,7 +141,7 @@ fn main() {
     );
 
     // Claim: [even_index=0, input=4, expected_output=1] — is_even(4) should be 1
-    let claim = &[f(0), f(4), f(1)];
+    let claim = vec![f(0), f(4), f(1)];
     let fri_parameters = FriParameters {
         log_final_poly_len: 0,
         max_log_arity: 1,
@@ -150,8 +150,8 @@ fn main() {
         query_proof_of_work_bits: 0,
     };
 
-    let proof = system.prove(fri_parameters, &key, claim, witness);
-    system.verify(fri_parameters, claim, &proof).unwrap();
+    let proof = system.prove(fri_parameters, &key, vec![claim], witness);
+    system.verify(fri_parameters, &proof).unwrap();
     println!("Lookup proof verified successfully!");
 
     let bytes = proof.to_bytes().expect("serialization failed");

examples/preprocessed_proof.rs

@@ -125,11 +125,8 @@ fn main() {
         query_proof_of_work_bits: 0,
     };
 
-    let no_claims: &[&[Val]] = &[];
-    let proof = system.prove_multiple_claims(fri_parameters, &key, no_claims, witness);
-    system
-        .verify_multiple_claims(fri_parameters, no_claims, &proof)
-        .unwrap();
+    let proof = system.prove(fri_parameters, &key, vec![], witness);
+    system.verify(fri_parameters, &proof).unwrap();
     println!("Preprocessed proof verified successfully!");
 
     let bytes = proof.to_bytes().expect("serialization failed");

examples/simple_proof.rs

@@ -83,13 +83,10 @@ fn main() {
     };
 
     // Prove
-    let no_claims = &[];
-    let proof = system.prove_multiple_claims(fri_parameters, &key, no_claims, witness);
+    let proof = system.prove(fri_parameters, &key, vec![], witness);
 
     // Verify
-    system
-        .verify_multiple_claims(fri_parameters, no_claims, &proof)
-        .unwrap();
+    system.verify(fri_parameters, &proof).unwrap();
     println!("Proof verified successfully!");
 
     // Show proof size

src/lookup.rs

@@ -409,15 +409,15 @@ mod tests {
             ],
             &system,
         );
-        let claim = &[f(0), f(4), f(1)];
+        let claims = vec![vec![f(0), f(4), f(1)]];
         let fri_parameters = FriParameters {
             log_final_poly_len: 0,
             max_log_arity: 1,
             num_queries: 64,
             commit_proof_of_work_bits: 0,
             query_proof_of_work_bits: 0,
         };
-        let proof = system.prove(fri_parameters, &key, claim, witness);
-        system.verify(fri_parameters, claim, &proof).unwrap();
+        let proof = system.prove(fri_parameters, &key, claims, witness);
+        system.verify(fri_parameters, &proof).unwrap();
     }
 }

src/prover.rs

@@ -203,6 +203,9 @@ pub struct Proof {
     pub preprocessed_opened_values: Option<OpenedValuesForRound<ExtVal>>,
     pub stage_1_opened_values: OpenedValuesForRound<ExtVal>,
     pub stage_2_opened_values: OpenedValuesForRound<ExtVal>,
+    /// Claims bound to this proof, observed into the Fiat-Shamir transcript before
+    /// lookup challenges are sampled. The verifier reads claims directly from here.
+    pub claims: Vec<Vec<Val>>,
 }
 
 impl Proof {
@@ -223,28 +226,15 @@ impl Proof {
 }
 
 impl<A: BaseAir<Val> + for<'a> Air<ProverConstraintFolder<'a>>> System<A> {
-    /// Generates a STARK proof for the system with a single claim.
+    /// Generates a STARK proof for the system.
     ///
-    /// This is a convenience wrapper around [`Self::prove_multiple_claims`].
+    /// Each claim is a vector of field elements observed by the challenger before
+    /// lookup challenges are sampled, binding the proof to the claimed values.
     pub fn prove(
         &self,
         fri_parameters: FriParameters,
         key: &ProverKey,
-        claim: &[Val],
-        witness: SystemWitness,
-    ) -> Proof {
-        self.prove_multiple_claims(fri_parameters, key, &[claim], witness)
-    }
-
-    /// Generates a STARK proof for the system with multiple claims.
-    ///
-    /// Each claim is a slice of field elements that is observed by the challenger
-    /// before lookup challenges are sampled, binding the proof to the claimed values.
-    pub fn prove_multiple_claims(
-        &self,
-        fri_parameters: FriParameters,
-        key: &ProverKey,
-        claims: &[&[Val]],
+        claims: Vec<Vec<Val>>,
         witness: SystemWitness,
     ) -> Proof {
         // initialize pcs and challenger
@@ -279,7 +269,7 @@ impl<A: BaseAir<Val> + for<'a> Air<ProverConstraintFolder<'a>>> System<A> {
         // observe the claims
         // this has to be done before generating the lookup argument challenge
         // otherwise the lookup argument can be attacked
-        for claim in claims {
+        for claim in &claims {
             challenger.observe_slice(claim);
         }
 
@@ -291,7 +281,7 @@ impl<A: BaseAir<Val> + for<'a> Air<ProverConstraintFolder<'a>>> System<A> {
 
         // construct the accumulator from the claims
         let mut acc = ExtVal::ZERO;
-        for claim in claims {
+        for claim in &claims {
             let message = lookup_argument_challenge
                 + fingerprint(&fingerprint_challenge, claim.iter().cloned());
             acc += message.inverse();
@@ -465,6 +455,7 @@ impl<A: BaseAir<Val> + for<'a> Air<ProverConstraintFolder<'a>>> System<A> {
             preprocessed_opened_values,
             stage_1_opened_values,
             stage_2_opened_values,
+            claims,
         }
     }
 }

src/test_circuits/blake3.rs

@@ -2321,9 +2321,6 @@ mod tests {
 
         let (_traces, witness) = claims.witness(&system);
 
-        let claims_slice: Vec<&[Val]> = claims.claims.iter().map(|v| v.as_slice()).collect();
-        let claims_slice: &[&[Val]] = &claims_slice;
-
         let fri_parameters = FriParameters {
             log_final_poly_len: 0,
             max_log_arity: 1,
@@ -2332,10 +2329,9 @@ mod tests {
             query_proof_of_work_bits: 0,
         };
 
-        let proof =
-            system.prove_multiple_claims(fri_parameters, &prover_key, claims_slice, witness);
+        let proof = system.prove(fri_parameters, &prover_key, claims.claims, witness);
         system
-            .verify_multiple_claims(fri_parameters, claims_slice, &proof)
+            .verify(fri_parameters, &proof)
             .expect("verification issue");
     }
 
@@ -2495,9 +2491,7 @@ mod tests {
             );
 
             let (_traces, witness) = claims.witness(&system);
-
-            let claims_slice: Vec<&[Val]> = claims.claims.iter().map(|v| v.as_slice()).collect();
-            let claims_slice: &[&[Val]] = &claims_slice;
+            let claim_vecs = claims.claims.clone();
 
             let fri_parameters = FriParameters {
                 log_final_poly_len: 0,
@@ -2507,10 +2501,9 @@ mod tests {
                 query_proof_of_work_bits: 0,
             };
 
-            let proof =
-                system.prove_multiple_claims(fri_parameters, &prover_key, claims_slice, witness);
+            let proof = system.prove(fri_parameters, &prover_key, claim_vecs, witness);
             system
-                .verify_multiple_claims(fri_parameters, claims_slice, &proof)
+                .verify(fri_parameters, &proof)
                 .expect("verification issue");
         }
 

src/test_circuits/byte_operations.rs

@@ -139,21 +139,20 @@ mod tests {
         };
         let witness = calls.witness(&system);
         let f = Val::from_u32;
-        let claim1 = &[f(0), f(10), f(5), f(10 ^ 5)];
-        let claim2 = &[f(1), f(30), f(20), f(30 & 20)];
-        let claim3 = &[f(2), f(100), f(40), f(100 | 40)];
-        let claim4 = &[f(3), f(200), f(100)];
-        let claims: &[&[Val]] = &[claim1, claim2, claim3, claim4];
+        let claims = vec![
+            vec![f(0), f(10), f(5), f(10 ^ 5)],
+            vec![f(1), f(30), f(20), f(30 & 20)],
+            vec![f(2), f(100), f(40), f(100 | 40)],
+            vec![f(3), f(200), f(100)],
+        ];
         let fri_parameters = FriParameters {
             log_final_poly_len: 0,
             max_log_arity: 1,
             num_queries: 64,
             commit_proof_of_work_bits: 0,
             query_proof_of_work_bits: 0,
         };
-        let proof = system.prove_multiple_claims(fri_parameters, &key, claims, witness);
-        system
-            .verify_multiple_claims(fri_parameters, claims, &proof)
-            .unwrap();
+        let proof = system.prove(fri_parameters, &key, claims, witness);
+        system.verify(fri_parameters, &proof).unwrap();
     }
 }

src/test_circuits/u32_add.rs

@@ -197,21 +197,20 @@ mod tests {
         };
         let witness = calls.witness(&system);
         let f = Val::from_u32;
-        let claim1 = &[f(1), f(10), f(5), f(15)];
-        let claim2 = &[f(1), f(30), f(20), f(50)];
-        let claim3 = &[f(1), f(100), f(100), f(200)];
-        let claim4 = &[f(1), f(8000), f(10000), f(18000)];
-        let claims: &[&[Val]] = &[claim1, claim2, claim3, claim4];
+        let claims = vec![
+            vec![f(1), f(10), f(5), f(15)],
+            vec![f(1), f(30), f(20), f(50)],
+            vec![f(1), f(100), f(100), f(200)],
+            vec![f(1), f(8000), f(10000), f(18000)],
+        ];
         let fri_parameters = FriParameters {
             log_final_poly_len: 0,
             max_log_arity: 1,
             num_queries: 64,
             commit_proof_of_work_bits: 0,
             query_proof_of_work_bits: 0,
         };
-        let proof = system.prove_multiple_claims(fri_parameters, &key, claims, witness);
-        system
-            .verify_multiple_claims(fri_parameters, claims, &proof)
-            .unwrap();
+        let proof = system.prove(fri_parameters, &key, claims, witness);
+        system.verify(fri_parameters, &proof).unwrap();
     }
 }