multi-plonk

Author: gabriel-barrett

Cargo.lock

@@ -1,3 +1,6 @@
+[workspace]
+members = ["multi-plonk"]
+
 [package]
 name = "multi-stark"
 version = "0.1.0"

Cargo.toml

@@ -0,0 +1,61 @@
+[package]
+name = "multi-plonk"
+version = "0.1.0"
+edition = "2024"
+authors = ["Argument Engineering <engineering@argument.xyz>"]
+license = "MIT OR Apache-2.0"
+rust-version = "1.88"
+
+[dependencies]
+ark-bls12-381 = { version = "0.5", features = ["curve"] }
+ark-ec = "0.5"
+ark-ff = "0.5"
+ark-poly = "0.5"
+ark-std = "0.5"
+ark-crypto-primitives = { version = "0.5", features = ["sponge"] }
+ark-poly-commit = "0.5"
+ark-serialize = "0.5"
+
+[lints.clippy]
+cast_lossless = "warn"
+cast_possible_truncation = "warn"
+cast_precision_loss = "warn"
+cast_sign_loss = "warn"
+cast_possible_wrap = "warn"
+ptr_as_ptr = "warn"
+checked_conversions = "warn"
+dbg_macro = "warn"
+derive_partial_eq_without_eq = "warn"
+enum_glob_use = "warn"
+explicit_into_iter_loop = "warn"
+fallible_impl_from = "warn"
+filter_map_next = "warn"
+flat_map_option = "warn"
+from_iter_instead_of_collect = "warn"
+implicit_clone = "warn"
+inefficient_to_string = "warn"
+large_stack_arrays = "warn"
+large_types_passed_by_value = "warn"
+macro_use_imports = "warn"
+manual_assert = "warn"
+map_err_ignore = "warn"
+map_unwrap_or = "warn"
+match_same_arms = "warn"
+match_wild_err_arm = "warn"
+needless_continue = "warn"
+needless_for_each = "warn"
+needless_pass_by_value = "warn"
+option_option = "warn"
+same_functions_in_if_condition = "warn"
+trait_duplication_in_bounds = "warn"
+unnecessary_wraps = "warn"
+unnested_or_patterns = "warn"
+use_self = "warn"
+
+[lints.rust]
+nonstandard_style = "warn"
+rust_2024_compatibility = "warn"
+trivial_numeric_casts = "warn"
+unused_lifetimes = "warn"
+unused_qualifications = "warn"
+unreachable_pub = "warn"

multi-plonk/Cargo.toml

@@ -0,0 +1,89 @@
+//! End-to-end smoke test: prove `a² + b² == c²` over a 4-row trace using
+//! the multi-plonk KZG-based prover/verifier on BLS12-381.
+
+use ark_ff::Zero;
+use ark_serialize::CanonicalSerialize;
+use ark_std::test_rng;
+
+use multi_plonk::air::{Air, AirBuilder, BaseAir};
+use multi_plonk::lookup::LookupAir;
+use multi_plonk::matrix::Matrix;
+use multi_plonk::system::{System, SystemWitness};
+use multi_plonk::types::{PlonkConfig, Val};
+
+struct PythagoreanAir;
+
+impl BaseAir for PythagoreanAir {
+    fn width(&self) -> usize {
+        3
+    }
+}
+
+impl<AB: AirBuilder> Air<AB> for PythagoreanAir {
+    fn eval(&self, builder: &mut AB) {
+        let row = builder.main_local();
+        let a: AB::Expr = row[0].into();
+        let b: AB::Expr = row[1].into();
+        let c: AB::Expr = row[2].into();
+        // a² + b² == c²
+        builder.assert_eq(a.clone() * a + b.clone() * b, c.clone() * c);
+    }
+}
+
+fn main() {
+    let mut rng = test_rng();
+    // largest expected polynomial degree fits comfortably below this:
+    //   trace size n = 4, max constraint degree 2 → coset size 8,
+    //   quotient degree ≤ 2n - 1 = 7.
+    let config = PlonkConfig::setup(64, &mut rng);
+
+    let air = PythagoreanAir;
+    let width = air.width();
+    let lookup_air = LookupAir::new(air, vec![]);
+    let (system, key) = System::new(&config, [lookup_air]);
+
+    let f = |x: u64| Val::from(x);
+    let trace = Matrix::new(
+        vec![
+            f(3),
+            f(4),
+            f(5),
+            f(5),
+            f(12),
+            f(13),
+            f(8),
+            f(15),
+            f(17),
+            f(7),
+            f(24),
+            f(25),
+        ],
+        width,
+    );
+    let witness = SystemWitness::from_stage_1(vec![trace], &system);
+
+    let no_claims = &[];
+    let proof = system.prove_multiple_claims(&config, &key, no_claims, witness);
+    println!(
+        "intermediate accumulators: {:?}",
+        proof.intermediate_accumulators
+    );
+    assert_eq!(
+        proof.intermediate_accumulators.last().copied(),
+        Some(Val::zero())
+    );
+
+    system
+        .verify_multiple_claims(&config, no_claims, &proof)
+        .expect("verify");
+    println!("Verified.");
+
+    let mut bytes = vec![];
+    proof.serialize_uncompressed(&mut bytes).expect("serialize");
+    let compressed_size = proof.compressed_size();
+    println!(
+        "Proof size: {} bytes (uncompressed), {} bytes (compressed)",
+        bytes.len(),
+        compressed_size
+    );
+}

multi-plonk/examples/pythagorean.rs

@@ -0,0 +1,124 @@
+//! AIR trait + minimal `AirBuilder` hierarchy.
+//!
+//! Mirrors the `p3_air::Air` / `p3_air::AirBuilder` shape, simplified for a
+//! single field (no extension). Each builder exposes:
+//!   * a 2-row window over the main, preprocessed, and stage-2 traces
+//!   * row selectors (`is_first_row`, `is_last_row`, `is_transition`)
+//!   * stage-2 public values (lookup challenges + accumulators)
+//!   * an `assert_zero` sink that constraint folders accumulate into
+
+use std::ops::{Add, Mul, Neg, Sub};
+
+use crate::matrix::Matrix;
+use crate::types::Val;
+
+/// Static circuit metadata: trace width and optional preprocessed trace.
+pub trait BaseAir {
+    fn width(&self) -> usize;
+    fn preprocessed_trace(&self) -> Option<Matrix<Val>> {
+        None
+    }
+}
+
+/// Constraint-evaluation interface implemented by symbolic, prover, verifier
+/// and debug builders.
+pub trait AirBuilder: Sized {
+    type Var: Copy + Into<Self::Expr>;
+    type Expr: Sized
+        + Clone
+        + From<Val>
+        + From<Self::Var>
+        + Add<Self::Expr, Output = Self::Expr>
+        + Sub<Self::Expr, Output = Self::Expr>
+        + Mul<Self::Expr, Output = Self::Expr>
+        + Neg<Output = Self::Expr>;
+
+    fn main_local(&self) -> &[Self::Var];
+    fn main_next(&self) -> &[Self::Var];
+    fn preprocessed_local(&self) -> &[Self::Var];
+    fn preprocessed_next(&self) -> &[Self::Var];
+    fn stage_2_local(&self) -> &[Self::Var];
+    fn stage_2_next(&self) -> &[Self::Var];
+    fn stage_2_public_values(&self) -> &[Self::Var];
+
+    fn is_first_row(&self) -> Self::Expr;
+    fn is_last_row(&self) -> Self::Expr;
+    fn is_transition(&self) -> Self::Expr;
+
+    fn assert_zero<I: Into<Self::Expr>>(&mut self, x: I);
+
+    fn assert_eq<I, J>(&mut self, x: I, y: J)
+    where
+        I: Into<Self::Expr>,
+        J: Into<Self::Expr>,
+    {
+        self.assert_zero(x.into() - y.into());
+    }
+
+    fn assert_one<I: Into<Self::Expr>>(&mut self, x: I) {
+        let one: Self::Expr = Val::from(1u64).into();
+        self.assert_zero(x.into() - one);
+    }
+
+    fn assert_bool<I: Into<Self::Expr>>(&mut self, x: I) {
+        let x = x.into();
+        let one: Self::Expr = Val::from(1u64).into();
+        self.assert_zero(x.clone() * (x - one));
+    }
+
+    fn when<I: Into<Self::Expr>>(&mut self, condition: I) -> FilteredBuilder<'_, Self> {
+        FilteredBuilder {
+            inner: self,
+            condition: condition.into(),
+        }
+    }
+
+    fn when_first_row(&mut self) -> FilteredBuilder<'_, Self> {
+        let cond = self.is_first_row();
+        self.when(cond)
+    }
+
+    fn when_last_row(&mut self) -> FilteredBuilder<'_, Self> {
+        let cond = self.is_last_row();
+        self.when(cond)
+    }
+
+    fn when_transition(&mut self) -> FilteredBuilder<'_, Self> {
+        let cond = self.is_transition();
+        self.when(cond)
+    }
+}
+
+/// Sub-builder that scopes assertions under a boolean `condition` expression
+/// (multiplies the assertion by the condition before forwarding it).
+pub struct FilteredBuilder<'a, AB: AirBuilder> {
+    inner: &'a mut AB,
+    condition: AB::Expr,
+}
+
+impl<'a, AB: AirBuilder> FilteredBuilder<'a, AB> {
+    pub fn assert_zero<I: Into<AB::Expr>>(&mut self, x: I) {
+        let x: AB::Expr = x.into();
+        self.inner.assert_zero(self.condition.clone() * x);
+    }
+
+    pub fn assert_eq<I, J>(&mut self, x: I, y: J)
+    where
+        I: Into<AB::Expr>,
+        J: Into<AB::Expr>,
+    {
+        self.assert_zero(x.into() - y.into());
+    }
+
+    pub fn assert_one<I: Into<AB::Expr>>(&mut self, x: I) {
+        let one: AB::Expr = Val::from(1u64).into();
+        self.assert_eq(x, one);
+    }
+}
+
+/// AIR generic over the builder type, so the same constraints can be evaluated
+/// symbolically (degree analysis), concretely on a coset (prover), or at a
+/// single point (verifier).
+pub trait Air<AB: AirBuilder>: BaseAir {
+    fn eval(&self, builder: &mut AB);
+}

multi-plonk/src/air.rs

@@ -0,0 +1,104 @@
+//! Debug builder that checks every constraint on every row, used in tests to
+//! locate constraint violations before invoking the full prover.
+
+use ark_ff::Zero;
+
+use crate::air::{Air, AirBuilder};
+use crate::matrix::Matrix;
+use crate::types::Val;
+
+pub fn check_constraints<A>(
+    air: &A,
+    preprocessed: Option<&Matrix<Val>>,
+    stage_1: &Matrix<Val>,
+    stage_2: &Matrix<Val>,
+    stage_2_public_values: &[Val],
+) where
+    A: for<'a> Air<DebugConstraintBuilder<'a>>,
+{
+    let height = stage_1.height();
+    for i in 0..height {
+        let i_next = (i + 1) % height;
+        let mut builder = DebugConstraintBuilder {
+            row_index: i,
+            preprocessed_local: &[],
+            preprocessed_next: &[],
+            stage_1_local: stage_1.row(i),
+            stage_1_next: stage_1.row(i_next),
+            stage_2_local: stage_2.row(i),
+            stage_2_next: stage_2.row(i_next),
+            stage_2_public_values,
+            is_first_row: Val::from(u64::from(i == 0)),
+            is_last_row: Val::from(u64::from(i == height - 1)),
+            is_transition: Val::from(u64::from(i != height - 1)),
+        };
+        if let Some(preprocessed) = preprocessed {
+            builder.preprocessed_local = preprocessed.row(i);
+            builder.preprocessed_next = preprocessed.row(i_next);
+            air.eval(&mut builder);
+        } else {
+            air.eval(&mut builder);
+        }
+    }
+}
+
+pub struct DebugConstraintBuilder<'a> {
+    pub row_index: usize,
+    pub preprocessed_local: &'a [Val],
+    pub preprocessed_next: &'a [Val],
+    pub stage_1_local: &'a [Val],
+    pub stage_1_next: &'a [Val],
+    pub stage_2_local: &'a [Val],
+    pub stage_2_next: &'a [Val],
+    pub stage_2_public_values: &'a [Val],
+    pub is_first_row: Val,
+    pub is_last_row: Val,
+    pub is_transition: Val,
+}
+
+impl<'a> AirBuilder for DebugConstraintBuilder<'a> {
+    type Var = Val;
+    type Expr = Val;
+
+    fn main_local(&self) -> &[Val] {
+        self.stage_1_local
+    }
+    fn main_next(&self) -> &[Val] {
+        self.stage_1_next
+    }
+    fn preprocessed_local(&self) -> &[Val] {
+        self.preprocessed_local
+    }
+    fn preprocessed_next(&self) -> &[Val] {
+        self.preprocessed_next
+    }
+    fn stage_2_local(&self) -> &[Val] {
+        self.stage_2_local
+    }
+    fn stage_2_next(&self) -> &[Val] {
+        self.stage_2_next
+    }
+    fn stage_2_public_values(&self) -> &[Val] {
+        self.stage_2_public_values
+    }
+
+    fn is_first_row(&self) -> Val {
+        self.is_first_row
+    }
+    fn is_last_row(&self) -> Val {
+        self.is_last_row
+    }
+    fn is_transition(&self) -> Val {
+        self.is_transition
+    }
+
+    fn assert_zero<I: Into<Val>>(&mut self, x: I) {
+        let x: Val = x.into();
+        assert!(
+            x.is_zero(),
+            "constraint had nonzero value on row {}: {:?}",
+            self.row_index,
+            x
+        );
+    }
+}