Introduces the Pari Proof System - #4523
Draft
guruvamsi-policharla wants to merge 13 commits into
Draft
Conversation
Replace the dense m*m constraint matrices with the compiler's sparse rows, making compilation, the relation digest, setup column evaluation, and the prover's assignment evaluation O(nnz) instead of O(m^2). Drop the committed-input anchor rows: expressions never reference committed columns, so each link row already gives its committed column a unique nonzero entry, which is the linear independence commitment binding needs. The full-rank regression test is retained against the sparse rows. The prover no longer runs a separate satisfaction pass; the vanishing divisibility check during proving rejects unsatisfied assignments. Relation digests change; no encoded formats are affected. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Embed the sparse public columns of the constraint matrices in the verifying key, matching the paper's succinct index: verify and batch_verify no longer take the compiled relation. Drop the redundant num_vars field (the relation is square) and the stored G2 generator, cache the key digest instead of rehashing the encoded key per proof, and validate canonicity of the sparse columns on decode. Batch verification samples 128-bit coefficients and uses the SmallScalar MSMs for the point aggregations, and public-input evaluation shares one set of Lagrange coefficients between both matrices. The Lagrange helper now skips its domain-membership scan when the vanishing polynomial is nonzero. The verifying-key wire format changes; fixtures regenerated. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Add codecs for ProvingKey, so trusted-setup output can be distributed, and for Opening, along with a public accessor for its randomness. Zero witness columns produce identity basis points the point codec rejects, so the witness basis encodes sparsely by index; every other length is derived from the embedded verifying key and enforced exactly on decode. Also fold in small cleanups: deduplicate assignment accessors, replace the zero-polynomial masking idiom with mul_vanishing, sample nonzero setup trapdoors with Scalar::random, and drop the test-only vanishing alias. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Verification previously computed all m Lagrange coefficients at the challenge, making single and batched verification grow linearly with the constraint domain. Evaluate the basis only at the rows present in the verifying key's public columns via the closed form L_i(X) = Z_H(X) g^i / (m (X - g^i)) with one batched inversion, so verifier field work depends on the public-column support instead of the domain. Benchmarked against the reference garuda-pari implementation at domain 2^16, this takes single verification from 5.7ms to sub-millisecond and batched verification from 5.1ms to ~0.1ms per proof. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Deploying monorepo with
|
| Latest commit: |
3f71446
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://64cc3bb3.monorepo-eu0.pages.dev |
| Branch Preview URL: | https://gv-pari-proof-system.monorepo-eu0.pages.dev |
Benchmark resultsRegressions: ✅ `qmdb::merkleize/v=any::unordered::fixed::mmr k=10000 ch=false s=true cc=true` (2/2 gates passed)
✅ `qmdb::merkleize/v=current::ordered::fixed::mmb chunk=256 k=10000 ch=false s=true cc=true` (2/2 gates passed)
Baseline commit(s): |
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
commonware-mcp | 3f71446 | Aug 18 2026, 09:54 PM |
Generalize committed inputs from one vector to independently keyed blocks (the commit-and-prove arity of the paper's Definition 9): layouts group committed selections into blocks, setup samples one delta per block and produces per-block commitment keys, claims carry one commitment per block, witnesses carry per-block openings whose sum masks the B-side polynomial, and verification pairs each block commitment with its own delta. The identity is now a legal block commitment (homomorphic commitments to zero reach it), so the point codec gains an identity-permitting read used by claims, and the commit/verify identity gates on commitments are lifted while the proof-point gates remain. Commitment keys expose their generators so protocols can maintain commitments homomorphically outside the proof system. Claim, VerifyingKey, and ProvingKey wire formats change; fixtures regenerated. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Add lower-level prove/verify/batch entry points where the caller binds the statement (public inputs and block commitments, or their preimages) into the transcript. The standard entry points now bind the claim through a helper and call the prebound core, which reorders the transcript so the claim precedes the marker and key digest; all challenges change accordingly (ALPHA, no migration). batch_verify_prebound takes each block commitment as weighted point terms and folds the derivation into its multi-scalar multiplications, partitioning weight-one terms onto the 128-bit coefficient path. Add setup_with_trapdoor returning the zeroizing setup Trapdoor and a simulate entry point that forges accepting proofs from the trapdoor alone, for zero-knowledge testing and simulated load generation. No encoded formats change. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Add the commonware-privacy crate as a workspace member with the backend-agnostic payments contract (the Backend, Commitment, and Opening traits) and the non-cryptographic mock backend, ported unchanged from the prior arkworks-based line. The zkpari backend follows, built on commonware-cryptography's native Pari rather than arkworks. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Two Pari-compiler optimizations that keep the compiled relation small without touching the shared circuit DSL or its other consumers: - Multiplication by a constant becomes a linear scaling of the other operand, emitting no rows or columns. This also removes the cost of the DSL lowering negation and subtraction to multiplication by -1. - A squared value consumed only by a single equality assertion is fused into that assertion as one row (base^2 == other) instead of allocating an output column and a separate square row. Booleanity (b^2 == b) becomes one row and no column. On bit-decomposition circuits this cuts the padded domain by roughly a factor of four (an 8-bit reconstruction fits domain 16, not 64), which brings the batched transfer relation to domain 256. Relation digests change; no encoded formats are affected. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Add the BLS12-381 private-payments backend built on commonware-cryptography's Pari, keeping the payments::Backend contract: - range: the batched-transfer relation via the circuit DSL — two 64-bit range checks and the theta-aggregation v1 + theta*v2 — compiled to domain 256 (matching the prior arkworks design) thanks to constant folding and square-assertion fusion. - payments: fund (proof-free deterministic commitment), transfer, and burn, each committing balances in the relation's payment basis (block 1) and proving through the prebound fold API so batch verification folds the aggregate com_theta = ledger[0] + theta*ledger[1] into its MSMs. Balances are homomorphic PaymentCommitments; overspend panics before proving. - simulator: trapdoor-forged transfer proofs for load generation. - codec: compressed commitments (48 B), openings (40 B), and range proofs (176 B), the identity permitted for zero-balance commitments. Twelve tests cover the transfer/burn/mixed pipelines, boundary amounts, overspend, fund-commitment binding, simulated proofs, and codec roundtrips. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Port the proof-size and verification-time harness to the native backend: 176-byte transfer proof, 48-byte commitment, ~11 ms proving, ~81 us per transfer amortized across a batch of 100. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
An integrating ledger keys transactions by their proof, so the Pari proof and the payments RangeProof must be hashable. Add the derive and a static-assertion test that the wire types satisfy the full integration bound bundle (FixedSize + Read<Cfg=()> + Write + Clone + Eq + Debug + Hash + Send + Sync), plus Send + Sync + 'static on the params. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Batch verification re-derived the aggregation challenge per claim by re-encoding the whole verifying key (603 bytes for the transfer relation) and hashing it. Bind the key's cached digest instead, exposed via a new public VerifyingKey::digest accessor. The digest covers every field of the key, so this is strictly at least as binding as the full encoding. Same-session A/B on the transfer benchmark: batch verification of 100 transfers drops from ~84 to ~73 microseconds per transfer (~14%). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Codecov Report❌ Patch coverage is @@ Coverage Diff @@
## main #4523 +/- ##
==========================================
- Coverage 95.48% 95.46% -0.02%
==========================================
Files 606 617 +11
Lines 273215 279458 +6243
Branches 6572 6772 +200
==========================================
+ Hits 260890 266797 +5907
- Misses 10144 10394 +250
- Partials 2181 2267 +86
... and 61 files with indirect coverage changes Continue to review full report in Codecov by Harness.
🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.