Feat/plonk update

[ThomasPiellard]

Description

Updating plonk to the latest version https://eprint.iacr.org/archive/2019/953/1660839633.pdf

[wait for linea to redeploy the contract before merging to avoid incompatibility between prover/verifier]

• The folded quotient is appended to the linearisation polynomial
• the opening of the linearisation polynomial corresponds to the constant term of the algebraic relation
• one less opening to do (since the quotient is now opened throughout the opening of the linearisation polynomial)
• no more modular inverse to compute in the algebraic check to verify a plonk proof

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

How has this been tested?

Test suite for plonk unchanged

benchmark

• for native chain bls12-377 -> bw6-761 we go from 319k to 312k constraints
• for non native (bw6 -> bn254) the number of constraints is unchanged -> something might be off

Checklist:

• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have added tests that prove my fix is effective or that my feature works
• I did not modify files generated from templates
• golangci-lint does not output errors locally
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published in downstream modules

[ivokub]

Hmm, something is also off - BW6 in BN254 is 1131765 constraints more with the new version. I guess the additional hashing and folding is more expensive than the saved scalar multiplication.

Hmm, I think one place where we add constraints is that previously when we folded H separately, we were able to do 2-MSM and one addition (H0 + zeta^(n+2) H1 + zeta^m(n+2) H2), but now when doing together with rest of linearized polynomial we're doing computing scalar mul for H0. But now we have more hashing as kzg proof folding has more inputs.

[ivokub]

Hmm, something is also off - BW6 in BN254 is 1131765 constraints more with the new version. I guess the additional hashing and folding is more expensive than the saved scalar multiplication.

@yelhousni may investigate; but perf wise, if the finalization circuit is 41M or 42M constraint, doesn't matter we still pay for 64M price.

It is 34949956 now vs 33818191 previously.

[ivokub]

@ThomasPiellard , I retained the in-circuit version which folds H before computing big MSM in linearized polynomial computation. This allows to avoid one scalar multiplication as before. Now the benchmarks are:

• BLS12 in BW6 master 367119, now 359241
• BW6 in BN254 master 33818191, now 33871880

There is still net increase in the number of constraints, but I guess this has to do that for MSM we internally use 2-by-2 MSM and with change of input nb oddity we fall into different case. In case with complete arithmetic (as the test circuits are defined with), we get suboptimal results. But indeed, we can keep rest of optimization for later.

Just for a remark -- with incomplete arithmetic BW6-in-BN254 is now at 29711173, so under 32M threshold.

[yelhousni]

After c73574c:

• BLS12 in BW6 master 367119, now 358515 358153 scs.
• BW6 in BN254 master 33818191, now 33885256 33884909 33883478 scs (after 747d11f).

[yelhousni]

After c73574c:

• BLS12 in BW6 master 367119, now 358515 358153 scs.
• BW6 in BN254 master 33818191, now 33885256 33884909 33883478 scs (after 747d11f).

• BLS12 in BW6 master 367119, now 358153 scs.
• BW6 in BN254 master 33818191, now 32145464 scs.

[yelhousni]

Good to merge on my side 👍

[gbotrel]

can we merge?

[Sickies]

Duplicado de #1

[Sickies]

Uploading BTC_USD-202405.csv…