Reduce verifier KZG params

halo2_proofs/benches/arithmetic.rs

@@ -1,13 +1,13 @@
 #[macro_use]
 extern crate criterion;
 
-use crate::arithmetic::small_multiexp;
+use crate::arithmetic::{parallelize, small_multiexp, CurveAffine, CurveExt};
 use crate::halo2curves::pasta::{EqAffine, Fp};
+use group::cofactor::CofactorCurveAffine;
 use group::ff::Field;
+use group::{Curve, Group};
 use halo2_proofs::*;
 
-use halo2_proofs::poly::{commitment::ParamsProver, ipa::commitment::ParamsIPA};
-
 use criterion::{black_box, Criterion};
 use rand_core::OsRng;
 
@@ -16,8 +16,40 @@ fn criterion_benchmark(c: &mut Criterion) {
 
     // small multiexp
     {
-        let params: ParamsIPA<EqAffine> = ParamsIPA::new(5);
-        let g = &mut params.get_g().to_vec();
+        let k = 5u32;
+        let n: u64 = 1 << k;
+        let id = <EqAffine as CofactorCurveAffine>::Curve::identity();
+
+        let g_projective = {
+            let mut g = Vec::with_capacity(n as usize);
+            g.resize(n as usize, id);
+
+            parallelize(&mut g, move |g, start| {
+                let hasher = <EqAffine as CurveAffine>::CurveExt::hash_to_curve("Halo2-Parameters");
+
+                for (i, g) in g.iter_mut().enumerate() {
+                    let i = (i + start) as u32;
+
+                    let mut message = [0u8; 5];
+                    message[1..5].copy_from_slice(&i.to_le_bytes());
+
+                    *g = hasher(&message);
+                }
+            });
+
+            g
+        };
+
+        let mut g = {
+            let mut g: Vec<EqAffine> = vec![id.into(); n as usize];
+            parallelize(&mut g, |g, starts| {
+                <EqAffine as CofactorCurveAffine>::Curve::batch_normalize(
+                    &g_projective[starts..(starts + g.len())],
+                    g,
+                );
+            });
+            g
+        };
         let len = g.len() / 2;
         let (g_lo, g_hi) = g.split_at_mut(len);
 

halo2_proofs/examples/serialization.rs

@@ -11,6 +11,7 @@ use halo2_proofs::{
         ConstraintSystem, Error, Fixed, Instance, ProvingKey,
     },
     poly::{
+        commitment::ParamsProver,
         kzg::{
             commitment::{KZGCommitmentScheme, ParamsKZG},
             multiopen::{ProverGWC, VerifierGWC},
@@ -173,16 +174,17 @@ fn main() {
     .expect("prover should not fail");
     let proof = transcript.finalize();
 
-    let strategy = SingleStrategy::new(&params);
+    let verifier_params = params.into_verifier_params();
+    let strategy = SingleStrategy::new(&verifier_params);
     let mut transcript = Blake2bRead::<_, _, Challenge255<_>>::init(&proof[..]);
     assert!(verify_proof::<
         KZGCommitmentScheme<Bn256>,
-        VerifierGWC<'_, Bn256>,
+        VerifierGWC<Bn256>,
         Challenge255<G1Affine>,
         Blake2bRead<&[u8], G1Affine, Challenge255<G1Affine>>,
         SingleStrategy<'_, Bn256>,
     >(
-        &params,
+        &verifier_params,
         pk.get_vk(),
         strategy,
         &[instances],

halo2_proofs/src/plonk/verifier.rs

@@ -7,7 +7,7 @@ use super::{
     VerifyingKey,
 };
 use crate::arithmetic::compute_inner_product;
-use crate::poly::commitment::{CommitmentScheme, Verifier};
+use crate::poly::commitment::{CommitmentScheme, ParamsVerifier, Verifier};
 use crate::poly::VerificationStrategy;
 use crate::poly::{
     commitment::{Blind, Params},
@@ -52,7 +52,9 @@ where
                 instance
                     .iter()
                     .map(|instance| {
-                        if instance.len() > params.n() as usize - (vk.cs.blinding_factors() + 1) {
+                        if instance.len()
+                            > params.trimed_size() as usize - (vk.cs.blinding_factors() + 1)
+                        {
                             return Err(Error::InstanceTooLarge);
                         }
                         let mut poly = instance.to_vec();

halo2_proofs/src/poly/commitment.rs

@@ -87,15 +87,16 @@ pub trait ParamsProver<'params, C: CurveAffine>: Params<'params, C> {
     fn commit(&self, poly: &Polynomial<C::ScalarExt, Coeff>, r: Blind<C::ScalarExt>)
         -> C::CurveExt;
 
-    /// Getter for g generators
-    fn get_g(&self) -> &[C];
-
     /// Returns verification parameters.
-    fn verifier_params(&'params self) -> &'params Self::ParamsVerifier;
+    fn into_verifier_params(self) -> Self::ParamsVerifier;
 }
 
 /// Verifier specific functionality with circuit constraints
-pub trait ParamsVerifier<'params, C: CurveAffine>: Params<'params, C> {}
+pub trait ParamsVerifier<'params, C: CurveAffine>: Params<'params, C> {
+    /// Returns the size of the trimed parameters.
+    /// This is the maximum size of the PI that these params can be used to commit to.
+    fn trimed_size(&self) -> u64;
+}
 
 /// Multi scalar multiplication engine
 pub trait MSM<C: CurveAffine>: Clone + Debug + Send + Sync {

halo2_proofs/src/poly/ipa/commitment.rs

@@ -56,7 +56,12 @@ impl<C: CurveAffine> CommitmentScheme for IPACommitmentScheme<C> {
 /// Verifier parameters
 pub type ParamsVerifierIPA<C> = ParamsIPA<C>;
 
-impl<'params, C: CurveAffine> ParamsVerifier<'params, C> for ParamsIPA<C> {}
+impl<'params, C: CurveAffine> ParamsVerifier<'params, C> for ParamsIPA<C> {
+    fn trimed_size(&self) -> u64 {
+        // IPA parameters are never trimed so their sized is always the full size of the domain.
+        self.n
+    }
+}
 
 impl<'params, C: CurveAffine> Params<'params, C> for ParamsIPA<C> {
     type MSM = MSMIPA<'params, C>;
@@ -145,7 +150,7 @@ impl<'params, C: CurveAffine> Params<'params, C> for ParamsIPA<C> {
 impl<'params, C: CurveAffine> ParamsProver<'params, C> for ParamsIPA<C> {
     type ParamsVerifier = ParamsVerifierIPA<C>;
 
-    fn verifier_params(&'params self) -> &'params Self::ParamsVerifier {
+    fn into_verifier_params(self) -> Self::ParamsVerifier {
         self
     }
 
@@ -221,10 +226,6 @@ impl<'params, C: CurveAffine> ParamsProver<'params, C> for ParamsIPA<C> {
 
         best_multiexp::<C>(&tmp_scalars, &tmp_bases)
     }
-
-    fn get_g(&self) -> &[C] {
-        &self.g
-    }
 }
 
 #[cfg(test)]