feat: add Groth16+BSB22 backend#427
Open
rose2221 wants to merge 18 commits into
Open
Conversation
rose2221
force-pushed
the
rs/groth16_impl
branch
from
a44357d to
655a725
Compare
CSP benchmarks
Prover time, peak RSS, peak heap, and verifier time are arithmetic means across the iterations. Peak heap comes from the largest Each metric cell shows the current value followed by the percentage delta against the latest successful WHIR backendResults
Groth16 backendResults
|
- Added prover implementation in to generate Groth16+BSB22 proofs from R1CS and witness. - Introduced setup functionality in to create ProvingKey and VerifyingKey from R1CS, including toxic waste management. - Defined core types in for Proof, ProvingKey, and VerifyingKey, following DIZK notation. - Implemented verifier logic in to validate proofs against the verifying key, including BSB22 commitment verification. - Added utility functions for hashing and commitment challenge derivation. - Included tests for hashing and setup with trivial R1CS to ensure correctness.
- Incremented PROVER_VERSION to 1.3 and VERIFIER_VERSION to 1.4 in binary_format.rs. - Added Groth16 prover struct and integrated it into the Prover enum. - Enhanced NoirProof to include Groth16 variant with public inputs and proof data. - Implemented Groth16 proving logic in the Prove trait for Groth16Prover. - Updated Verifier to handle Groth16 proofs and added serialization for VerifyingKey. - Modified CLI commands to support Groth16 backend for preparing proofs. - Adjusted tests and examples to accommodate changes in proof handling.
…upport - Updated the setup function to accept multiple challenges per commitment, allowing for more flexible challenge generation. - Modified the Proof struct to include validation checks for proof elements on the curve and in the correct subgroup. - Improved the verifier to handle multiple challenges derived from a single commitment, ensuring proper serialization and verification. - Refactored the Prover implementation to streamline the commitment process, utilizing a single Pedersen commitment for multiple challenges. - Enhanced error handling and logging throughout the setup and verification processes for better debugging and traceability.
- Move Prover/Groth16Prover/Groth16CommitmentInfo from provekit-common to a new provekit_prover::prover_types, breaking the dep cycle that kept the Groth16 PK stored as raw Vec<u8> rather than a typed ProvingKey. - Add provekit_prover::pkp_io with split-section .pkp v1.4 layout: header + single zstd stream of postcard-encoded metadata followed by raw arkworks-encoded ProvingKey bytes. Streaming postcard reader feeds directly off the zstd Decoder; no decompressed Vec<u8> is materialised. - Switch .pkp compression from xz to zstd (~2.5x faster reads, +4% size). - Custom Serde adapter on provekit_groth16::ProvingKey emits/decodes a zero-byte placeholder so the typed PK rides through serde transparently while its actual bytes live in the appended section. - Split groth16::prover::prove into bsb22_pok / prove_ar_bs_bs1 / prove_krs so the outer prove_with_witness can run compute_h in parallel with the H-independent stages via rayon::join. - Inside prove_ar_bs_bs1 run the three MSMs sequentially: arkworks MSM is already rayon-parallel internally, so concurrent calls only stack bucket allocators without speeding up wall clock. - Chunk Pedersen commit/PoK MSMs (100k-element chunks) to cap arkworks' per-call transient state. - Destructure the typed PK in prove_with_witness and drop each base vector immediately after its MSM finishes; drop program / witness_generator after public-input extraction. Measured on complete_age_check (~1M wires, 636k constraints): peak memory: 1.51 GB -> 789 MB (-48%) end-to-end: 3.84 s -> 2.87 s (-25%)
rose2221
changed the title
… output structure
…ts; clarify wire index conventions and Krs validation
- Introduced for a borrowed view over bases, allowing for polymorphic access to either owned or mmap'd bases without runtime overhead. - Updated to use instead of directly, enhancing memory efficiency. - Added module for mmap-backed file I/O, providing a faster alternative to the legacy zstd format. - Implemented and functions for handling mmap files, including necessary metadata and alignment. - Updated to support both owned and mmap-backed proving keys, ensuring zero-byte serialization for compatibility. - Enhanced command-line interface to allow users to specify mmap usage for Groth16 backends, improving load times at the cost of larger artifact sizes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds an end-to-end Groth16 proving/verifying backend on BN254 with the BSB22 Pedersen-commitment extension, alongside the existing WHIR pipeline. Selectable at
preparetime via--backend whir|groth16.