Skip to content

feat(backend): Use Schnorr signatures for signed PODs#236

Merged
ax0 merged 32 commits intomainfrom
ec-sig
Jun 9, 2025
Merged

feat(backend): Use Schnorr signatures for signed PODs#236
ax0 merged 32 commits intomainfrom
ec-sig

Conversation

@ax0
Copy link
Collaborator

@ax0 ax0 commented May 16, 2025

No description provided.

@ax0 ax0 marked this pull request as ready for review May 23, 2025 09:32
Copy link
Collaborator

@ed255 ed255 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Initial review pass

inputs.extend_from_slice(&p2.x.components);
inputs.extend_from_slice(&p2.u.components);
let mut outputs = ECAddHomog::apply(self, &inputs);
// plonky2 expects all gate constraints to be satisfied by the zero vector.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is very interesting. Could you share some plonky2 code reference so that I can learn more about this?
Do you know how they handle this case in the Poseidon gate?

Copy link
Collaborator

@ed255 ed255 Jun 9, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I found some references about this. Could you add this information as comments?

Each Gate can do multiple operations, and in that case the gate will register one generator per operation. When a gate operation is used, the CircuitBuilder tracks this information via the current_slots field. Finally when building the circuit the generators associated to unused operations are removed! https://github.com/0xPolygonZero/plonky2/blob/82791c4809d6275682c34b926390ecdbdc2a5297/plonky2/src/plonk/circuit_builder.rs#L1210
Since the generator for the unused operation is removed, no witness value will be calculated for it, and then it will be filled with the default value which is zero: https://github.com/0xPolygonZero/plonky2/blob/82791c4809d6275682c34b926390ecdbdc2a5297/plonky2/src/iop/witness.rs#L377
So a gate with multiple operations needs to pass the constraints for a single operation when all it's witness wire values are zero.


It would be nice if gates could define padding values so that unused operations can have their witness wires assigned to those values instead of zero, allowing for more flexibility in multi-operation gates...

Copy link
Collaborator

@ed255 ed255 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Second pass review

let u1 = QuinticTensor::from_base(wires[5..10].try_into().unwrap());
let x2 = QuinticTensor::from_base(wires[10..15].try_into().unwrap());
let u2 = QuinticTensor::from_base(wires[15..20].try_into().unwrap());
let out = add_homog_offset(x1, u1, x2, u2);
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The gate is named ECAddHomog but the implementation does an addition with an offset (that needs to be corrected). Could you document this behavior?

Copy link
Collaborator

@ed255 ed255 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Third round

Copy link
Collaborator

@ed255 ed255 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've completed my review of all the changes

ax0 and others added 3 commits June 4, 2025 09:13
Copy link
Collaborator

@ed255 ed255 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! Thanks for addressing all the requests I made!

I'll approve the PR but please could you add some documentation about the offset in the ECAddHomog? See #236 (comment)

@ax0 ax0 merged commit c66506c into main Jun 9, 2025
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants