commitment_key.hpp

Go to the documentation of this file.

// === AUDIT STATUS ===
// internal:    { status: Planned, auditors: [Sergei], commit: }
// external_1:  { status: not started, auditors: [], commit: }
// external_2:  { status: not started, auditors: [], commit: }
// =====================
 
#pragma once
 
#include "barretenberg/common/bb_bench.hpp"
#include "barretenberg/common/ref_span.hpp"
#include "barretenberg/ecc/scalar_multiplication/scalar_multiplication.hpp"
#include "barretenberg/polynomials/polynomial.hpp"
#include "barretenberg/srs/factories/crs_factory.hpp"
#include "barretenberg/srs/global_crs.hpp"
 
#include <cstddef>
#include <cstdlib>
#include <limits>
#include <memory>
#include <string_view>
 
namespace bb {
template <class Curve> class CommitmentKey {
 
    using Fr = typename Curve::ScalarField;
    using Commitment = typename Curve::AffineElement;
 
  protected:
    std::shared_ptr<srs::factories::Crs<Curve>> srs;
 
  public:
    size_t srs_size;
 
    CommitmentKey() = default;
 
    CommitmentKey(const size_t num_points)
        : srs(srs::get_crs_factory<Curve>()->get_crs(num_points))
        , srs_size(num_points)
    {}
    bool initialized() const { return srs != nullptr; }
 
    std::span<Commitment> get_monomial_points() const { return srs->get_monomial_points(); }
    size_t get_monomial_size() const { return srs->get_monomial_size(); }
 
    Commitment commit(PolynomialSpan<const Fr> polynomial) const
    {
        BB_BENCH_NAME("CommitmentKey::commit");
        std::span<const Commitment> point_table = get_monomial_points();
        size_t consumed_srs = polynomial.start_index + polynomial.size();
        if (consumed_srs > get_monomial_size()) {
            throw_or_abort(format("Attempting to commit to a polynomial that needs ",
                                  consumed_srs,
                                  " points with an SRS of size ",
                                  get_monomial_size()));
        }
        return scalar_multiplication::pippenger_unsafe<Curve>(polynomial, point_table);
    };
    std::vector<Commitment> batch_commit(RefSpan<Polynomial<Fr>> polynomials,
                                         size_t max_batch_size = std::numeric_limits<size_t>::max()) const
    {
        BB_BENCH_NAME("CommitmentKey::batch_commit");
 
        // We can only commit max_batch_size at a time
        // This is to prevent excessive memory usage in the pippenger algorithm
        // First batch, create the commitments vector
        std::vector<Commitment> commitments;
 
        for (size_t i = 0; i < polynomials.size();) {
            // Note: have to be careful how we compute this to not overlow e.g. max_batch_size + 1 would
            size_t batch_size = std::min(max_batch_size, polynomials.size() - i);
            size_t batch_end = i + batch_size;
 
            // Prepare spans for batch MSM
            std::vector<std::span<const Commitment>> points_spans;
            std::vector<std::span<Fr>> scalar_spans;
 
            for (auto& polynomial : polynomials.subspan(i, batch_end - i)) {
                size_t consumed_srs = polynomial.start_index() + polynomial.size();
                if (consumed_srs > get_monomial_size()) {
                    throw_or_abort(format("Attempting to commit to a polynomial that needs ",
                                          consumed_srs,
                                          " points with an SRS of size ",
                                          get_monomial_size()));
                }
                std::span<const Commitment> point_table = get_monomial_points().subspan(polynomial.start_index());
                scalar_spans.emplace_back(polynomial.coeffs());
                points_spans.emplace_back(point_table);
            }
 
            // Perform batch MSM
            auto results = scalar_multiplication::MSM<Curve>::batch_multi_scalar_mul(points_spans, scalar_spans, false);
            for (const auto& result : results) {
                commitments.emplace_back(result);
            }
            i += batch_size;
        }
        return commitments;
    };
 
    // helper builder struct for constructing a batch to commit at once
    struct CommitBatch {
        CommitmentKey* key;
        RefVector<Polynomial<Fr>> wires;
        std::vector<std::string> labels;
        std::vector<const Polynomial<Fr>*> tail_polys; // optional ZK masking tails (parallel to wires)
 
        std::vector<Commitment> commit_and_send_to_verifier(auto transcript,
                                                            size_t max_batch_size = std::numeric_limits<size_t>::max())
        {
            std::vector<Commitment> commitments = key->batch_commit(wires, max_batch_size);
 
            // Adjust commitments for wires with masking tails: C' = C_short + commit(tail)
            for (size_t i = 0; i < commitments.size(); ++i) {
                if (i < tail_polys.size() && tail_polys[i] != nullptr && !tail_polys[i]->is_empty()) {
                    commitments[i] = commitments[i] + key->commit(*tail_polys[i]);
                }
                transcript->send_to_verifier(labels[i], commitments[i]);
            }
 
            return commitments;
        }
 
        void add_to_batch(Polynomial<Fr>& poly, const std::string& label, const Polynomial<Fr>* tail = nullptr)
        {
            wires.push_back(poly);
            labels.push_back(label);
            tail_polys.push_back(tail);
        }
    };
 
    CommitBatch start_batch() { return CommitBatch{ this, {}, {} }; }
};
 
} // namespace bb