No public description

PiperOrigin-RevId: 845807650

Author: mathsjames

willow/src/zk/linear_ip.rs

@@ -36,6 +36,7 @@ pub struct LinearInnerProductParameters {
     F: RistrettoPoint,
     F_: RistrettoPoint,
     G: Vec<RistrettoPoint>,
+    seed: Vec<u8>,
 }
 
 pub fn inner_product(a: &[Scalar], b: &[Scalar]) -> Scalar {
@@ -59,6 +60,7 @@ fn common_setup(length: usize, parameter_seed: &[u8]) -> LinearInnerProductParam
                 )
             })
             .collect(),
+        seed: parameter_seed.to_vec(),
     }
 }
 
@@ -67,11 +69,9 @@ fn append_params_to_transcript(
     params: &LinearInnerProductParameters,
 ) {
     transcript.append_u64(b"n", params.n as u64);
-    for G_i in &params.G {
-        transcript.append_message(b"G_i", G_i.compress().as_bytes());
-    }
-    transcript.append_message(b"F", params.F.compress().as_bytes());
-    transcript.append_message(b"F_", params.F_.compress().as_bytes());
+    // We append the seed not the resulting params themselves because appending that many params
+    // more than doubles the run time of both prove and verify.
+    transcript.append_message(b"seed", &params.seed);
 }
 
 fn validate_and_append_point(

willow/src/zk/rlwe_relation.rs

@@ -272,9 +272,9 @@ fn update_public_vec_for_range_proof(
     z_r: &Vec<Scalar>,
     z_e: &Vec<Scalar>,
     z_vw: &Vec<Scalar>,
-    psi_r: Scalar,
-    psi_e: Scalar,
-    psi_vw: Scalar,
+    psi_r: &Vec<Scalar>,
+    psi_e: &Vec<Scalar>,
+    psi_vw: &Vec<Scalar>,
     n: usize,
     range_comm_offset: usize,
     samples_required: usize,
@@ -298,20 +298,14 @@ fn update_public_vec_for_range_proof(
 
     // The range proofs equation also involves length 128 innerproducts involving the relevant
     // psi these are included in the last 3*128 entries of the inner product vectors.
-    let mut phi_psi_r_pow = phi;
-    let mut phi2_psi_e_pow = phi2;
-    let mut phi3_psi_vw_pow = phi3;
     for i in 0..128 {
-        public_vec[i + range_comm_offset] = phi_psi_r_pow;
-        public_vec[i + range_comm_offset + 128] = phi2_psi_e_pow;
-        public_vec[i + range_comm_offset + 256] = phi3_psi_vw_pow;
+        public_vec[i + range_comm_offset] = phi * Scalar::from(psi_r[i]);
+        public_vec[i + range_comm_offset + 128] = phi2 * Scalar::from(psi_e[i]);
+        public_vec[i + range_comm_offset + 256] = phi3 * Scalar::from(psi_vw[i]);
         // Add contributions of the range proofs to the overall inner product result.
-        *result += z_r[i] * phi_psi_r_pow;
-        *result += z_e[i] * phi2_psi_e_pow;
-        *result += z_vw[i] * phi3_psi_vw_pow;
-        phi_psi_r_pow *= psi_r;
-        phi2_psi_e_pow *= psi_e;
-        phi3_psi_vw_pow *= psi_vw;
+        *result += z_r[i] * public_vec[i + range_comm_offset];
+        *result += z_e[i] * public_vec[i + range_comm_offset + 128];
+        *result += z_vw[i] * public_vec[i + range_comm_offset + 256];
     }
 }
 
@@ -364,33 +358,37 @@ pub fn flatten_challenge_matrix(
     R1: Vec<u128>,
     R2: Vec<u128>,
     challenge_label: &'static [u8],
-) -> Result<(Vec<Scalar>, Scalar), status::StatusError> {
+) -> Result<(Vec<Scalar>, Vec<Scalar>), status::StatusError> {
     let n = R1.len();
     if n != R2.len() {
         return Err(status::failed_precondition("R1 and R2 have different lengths".to_string()));
     }
 
-    let mut buf = [0u8; 64];
-    transcript.challenge_bytes(challenge_label, &mut buf);
-    let psi = Scalar::from_bytes_mod_order_wide(&buf);
-
-    let mut R = vec![Scalar::from(0 as u64); n];
-    let mut psi_powers = [Scalar::from(1 as u64); 128];
-    for j in 1..128 {
-        psi_powers[j] = psi_powers[j - 1] * psi;
+    let mut Rplus = vec![0u128; n];
+    let mut Rminus = vec![0u128; n];
+    let mut Rscalar = vec![Scalar::from(0 as u64); n];
+
+    let mut psi = [0u128; 128];
+    let mut psi_scalar = vec![Scalar::from(0 as u64); 128];
+    let mut buf = [0u8; 16];
+    for j in 0..128 {
+        transcript.challenge_bytes(challenge_label, &mut buf);
+        psi[j] = u128::from_le_bytes(buf).rem_euclid(1u128 << 120);
+        psi_scalar[j] = Scalar::from(psi[j]);
     }
     for i in 0..n {
         for j in 0..128 {
             if R1[i] & (1u128 << j) != 0 {
-                R[i] += psi_powers[j];
+                Rplus[i] += psi[j];
             }
             if R2[i] & (1u128 << j) != 0 {
-                R[i] -= psi_powers[j];
+                Rminus[i] += psi[j];
             }
         }
+        Rscalar[i] = Scalar::from(Rplus[i]) - Scalar::from(Rminus[i]);
     }
 
-    Ok((R, psi))
+    Ok((Rscalar, psi_scalar))
 }
 
 // Check that loose_bound = bound*2500*sqrt(v.len()+1) fits within an i128.
@@ -430,7 +428,7 @@ fn generate_range_product(
     transcript: &mut (impl Transcript + Clone),
     challenge_label: &'static [u8],
 ) -> Result<
-    (Vec<Scalar>, RistrettoPoint, Vec<Scalar>, Scalar, Scalar, Vec<Scalar>),
+    (Vec<Scalar>, RistrettoPoint, Vec<Scalar>, Scalar, Vec<Scalar>, Vec<Scalar>),
     status::StatusError,
 > {
     // Check that computing loose bound does not result in an overflow.
@@ -522,7 +520,7 @@ fn generate_range_product_for_verification_and_verify_z_bound(
     z: &Vec<Scalar>,
     transcript: &mut impl Transcript,
     challenge_label: &'static [u8],
-) -> Result<(Vec<Scalar>, Scalar), status::StatusError> {
+) -> Result<(Vec<Scalar>, Vec<Scalar>), status::StatusError> {
     // Check that computing loose bound does not result in an overflow.
     check_loose_bound_will_not_overflow(bound, n)?;
 
@@ -798,9 +796,9 @@ impl<'a> ZeroKnowledgeProver<RlweRelationProofStatement<'a>, RlweRelationProofWi
             &z_r,
             &z_e,
             &z_vw,
-            psi_r,
-            psi_e,
-            psi_vw,
+            &psi_r,
+            &psi_e,
+            &psi_vw,
             n,
             range_comm_offset,
             samples_required,
@@ -977,9 +975,9 @@ impl<'a> ZeroKnowledgeVerifier<RlweRelationProofStatement<'a>, RlweRelationProof
             &proof.z_r,
             &proof.z_e,
             &proof.z_vw,
-            psi_r,
-            psi_e,
-            psi_vw,
+            &psi_r,
+            &psi_e,
+            &psi_vw,
             n,
             range_comm_offset,
             samples_required,
@@ -1260,12 +1258,10 @@ mod tests {
         for i in 0..4 {
             public_vec[i] = R[i];
         }
-        let mut psi_pow = Scalar::from(1u128);
         let mut result = Scalar::from(0u128);
         for i in 4..132 {
-            public_vec[i] = psi_pow;
-            result += z[i - 4] * psi_pow;
-            psi_pow *= psi;
+            public_vec[i] = psi[i - 4];
+            result += z[i - 4] * psi[i - 4];
         }
         let mut expected_result = Scalar::from(0u128);
         for j in 0..132 {