1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
use super::{check_bit_consistency, extract_bit};
use crate::commitment_scheme::kzg10::Commitment;
use crate::proof_system::linearisation_poly::ProofEvaluations;
use dusk_bls12_381::{G1Affine, Scalar};
use dusk_jubjub::EDWARDS_D;
#[derive(Debug)]
pub struct VerifierKey {
pub q_l: Commitment,
pub q_r: Commitment,
pub q_ecc: Commitment,
}
impl VerifierKey {
pub(crate) fn compute_linearisation_commitment(
&self,
ecc_separation_challenge: &Scalar,
scalars: &mut Vec<Scalar>,
points: &mut Vec<G1Affine>,
evaluations: &ProofEvaluations,
) {
let kappa = ecc_separation_challenge.square();
let kappa_sq = kappa.square();
let kappa_cu = kappa_sq * kappa;
let x_beta_poly = evaluations.q_l_eval;
let y_beta_eval = evaluations.q_r_eval;
let acc_x = evaluations.a_eval;
let acc_x_next = evaluations.a_next_eval;
let acc_y = evaluations.b_eval;
let acc_y_next = evaluations.b_next_eval;
let xy_alpha = evaluations.c_eval;
let accumulated_bit = evaluations.d_eval;
let accumulated_bit_next = evaluations.d_next_eval;
let bit = extract_bit(&accumulated_bit, &accumulated_bit_next);
let bit_consistency = check_bit_consistency(bit);
let y_alpha = (bit.square() * (y_beta_eval - Scalar::one())) + Scalar::one();
let x_alpha = x_beta_poly * bit;
let xy_consistency = ((bit * evaluations.q_c_eval) - xy_alpha) * kappa;
let x_3 = acc_x_next;
let lhs = x_3 + (x_3 * xy_alpha * acc_x * acc_y * EDWARDS_D);
let rhs = (x_alpha * acc_y) + (y_alpha * acc_x);
let x_acc_consistency = (lhs - rhs) * kappa_sq;
let y_3 = acc_y_next;
let lhs = y_3 - (y_3 * xy_alpha * acc_x * acc_y * EDWARDS_D);
let rhs = (x_alpha * acc_x) + (y_alpha * acc_y);
let y_acc_consistency = (lhs - rhs) * kappa_cu;
let a = bit_consistency + x_acc_consistency + y_acc_consistency + xy_consistency;
scalars.push(a * ecc_separation_challenge);
points.push(self.q_ecc.0);
}
}