-
Notifications
You must be signed in to change notification settings - Fork 175
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Speedup proof verification using batched inverse. #190
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thank you very much! This is great! I left a couple of comments regarding updating the inline comments to mention the new approach - but other than that, all looks good.
// compute T'_i(x) = (T_i(x) - T_i(z)) / (x - z), multiply it by a composition | ||
// coefficient, and add the result to T(x) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I wonder if these comments need to be complemented. Conceptually, this is still what's happening, but the actual code below is different. It would probably be good to leave comments somewhere explaining the approach.
// compute T''_i(x) = (T_i(x) - T_i(z * g)) / (x - z * g), multiply it by a | ||
// composition coefficient, and add the result to T(x) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Similar comment regarding comments.
|
||
// compute z^m | ||
let num_evaluation_columns = ood_evaluations.len() as u32; | ||
let z_m = self.z[0].exp_vartime(num_evaluation_columns.into()); | ||
|
||
for (query_values, &x) in queried_evaluations.rows().zip(&self.x_coordinates) { | ||
let mut composition = E::ZERO; | ||
let mut composition_num = E::ZERO; | ||
let mut composition_den = E::ONE; | ||
for (i, &evaluation) in query_values.iter().enumerate() { | ||
// compute H'_i(x) = (H_i(x) - H_i(z^m)) / (x - z^m) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Similar comment regarding comments.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'll merge as is, and we can update the comments in subsequent commits.
Uses batch inverse function to save some cycles during verification.
This was derived while working on zkDilithium as part of ia.cr/2023/414.