Skip to content

Commit

Permalink
deploy: f33fd9c
Browse files Browse the repository at this point in the history
  • Loading branch information
@mimoo
mimoo committed Oct 18, 2024
1 parent 24fae40 commit 0bb0742
Show file tree
Hide file tree
Showing 4 changed files with 38 additions and 88 deletions.
41 changes: 5 additions & 36 deletions rfcs/starknet/fri.html
View file
Original file line number Diff line number Diff line change
Expand Up @@ -384,48 +384,17 @@ <h3>General configuration</h3>
<p><strong><code>proof_of_work_bits</code></strong>. The number of bits required for the proof of work. This value should be between 20 and 50.</p>
</section>
<section>
<h3>Commitment configuration</h3>
<p>The protocol as implemented accepts proofs created using different parameters. This allows provers to decide on the trade-offs between proof size, prover time and space complexity, and verifier time and space complexity. </p>
<p>A FRI layer reduction can be configured with the following fields:</p>
<p><strong><code>table_n_columns</code></strong>. The number of values committed in each leaf of the Merkle tree. As explained in the overview, each FRI reduction makes predictible related queries to each layer, as such related points are grouped together to reduce multiple related queries to a single one.</p>
<p><strong><code>vector_height</code></strong>. The height of the Merkle tree. See the FRI config below to understand how this is validated. (TODO: why do we carry this if we already know the domain size there?)</p>
<p><strong><code>vector_n_verifier_friendly_commitment_layers</code></strong>. The number of layers (starting from the bottom) that use a circuit-friendly hash (TODO: double check). (TODO: remove this level of detail? maybe not if this has to match the proof format)</p>
<pre><code class="language-rust">struct VectorCommitmentConfig {
height: felt252,
n_verifier_friendly_commitment_layers: felt252,
}

struct TableCommitmentConfig {
n_columns: felt252,
vector: VectorCommitmentConfig,
}
</code></pre>
</section>
<section>
<h3>FRI configuration</h3>
<p>A FRI configuration contains the following fields:</p>
<p><strong><code>log_input_size</code></strong>. The size of the input layer to FRI (the number of evaluations committed). (TODO: double check)</p>
<p><strong><code>n_layers</code></strong>. The number of layers or folding that will occur as part of the FRI proof.</p>
<p><strong><code>inner_layers</code></strong>. The configuration for each of the layers (minus the first layer).</p>
<p><strong><code>fri_step_sizes</code></strong>. The number of layers to skip for each folding/reduction of the protocol.</p>
<p><strong><code>log_last_layer_degree_bound</code></strong>. The degree of the last layer's polynomial. As it is sent in clear as part of the FRI protocol, this value represents the (log) number of coefficients (minus 1) that the proof will contain.</p>
<pre><code class="language-rust">struct FriConfig {
log_input_size: felt252,
n_layers: felt252,
inner_layers: Span&lt;TableCommitmentConfig&gt;,
fri_step_sizes: Span&lt;felt252&gt;,
log_last_layer_degree_bound: felt252,
}
</code></pre>
<p>TODO: validate(cfg, log_n_cosets, n_verified_friendly_commitment_layers):</p>
<p><strong><code>n_layers</code></strong>. The number of layers or folding that will occur as part of the FRI proof. This value must be within the range <code>[2, MAX_FRI_LAYERS]</code> (see constants).</p>
<p><strong><code>inner_layers</code></strong>. An array of <code>TableCommitmentConfig</code> where each configuration represent what is expected of each commitment sent as part of the FRI proof. Refer to the <a href="merkle.html#table-commitments">Table Commitments section of the Starknet Merkle Tree Polynomial Commitments specification</a>.</p>
<p><strong><code>fri_step_sizes</code></strong>. The number of layers to skip for each folding/reduction of the protocol. The first step must always be zero, as no layer is skipped during the first reduction. Each step should be within the range <code>[1, MAX_FRI_STEP]</code>. For each step, the corresponding layer <code>inner_layers[i-1]</code> should have enough columns to support the reduction: <code>n_columns = 2^fri_step</code>.</p>
<p><strong><code>log_last_layer_degree_bound</code></strong>. The degree of the last layer's polynomial. As it is sent in clear as part of the FRI protocol, this value represents the (log) number of coefficients (minus 1) that the proof will contain. It must be less or equal to <code>MAX_LAST_LAYER_LOG_DEGREE_BOUND</code> (see constants).</p>
<p>TODO: move these validation steps in the description of the fields above</p>
<ul>
<li>the number of layers <code>n_layers</code> must be within the range <code>[2, MAX_FRI_LAYERS]</code> (see constants)</li>
<li>the <code>log_last_layer_degree_bound</code> must be less or equal to <code>MAX_LAST_LAYER_LOG_DEGREE_BOUND</code></li>
<li>the first<code>fri_step_sizes[0]</code> must be 0 (TODO: explain why)</li>
<li>for every <code>fri_step_sizes[i]</code> check:<ul>
<li>that the step <code>fri_step_sizes[i]</code> is within the range <code>[1, MAX_FRI_STEP]</code></li>
<li>that the previous layer table commitment configuration <code>inner_Layers[i-1]</code> has</li>
<li>a number of columns <code>n_columns = 2^fri_step</code> (TODO: why?)</li>
<li>a valid configuration, which can be verified using the expected log input size and the <code>n_verifier_friendly_commitment_layers</code><ul>
<li>expected log input size should be the input size minus all the step sizes so far</li>
</ul>
Expand Down
18 changes: 14 additions & 4 deletions rfcs/starknet/merkle.html
View file
Original file line number Diff line number Diff line change
Expand Up @@ -93,21 +93,31 @@ <h2>Constants</h2>
<p><strong><code>MONTGOMERY_R = 3618502788666127798953978732740734578953660990361066340291730267701097005025</code></strong>. The Montgomery form of <math xmlns="http://www.w3.org/1998/Math/MathML" display="inline"><mrow><msup><mn>2</mn><mrow><mn>256</mn></mrow></msup><mspace width="1em" /><mi>mod</mi><mspace width="0.333em" /><mtext>STARK_PRIME</mtext></mrow></math>.</p>
</section>
<section>
<h2>Vector commitments</h2>
<p>A vector commitment is simply a Merkle tree. </p>
<h2>Vector Commitments</h2>
<p>A vector commitment is simply a Merkle tree. It is configured with two fields:</p>
<ul>
<li><code>height</code>: the height of the Merkle tree</li>
<li><code>n_verifier_friendly_commitment_layers</code>: the depth at which layers will start using the verifier-friendly hash.</li>
</ul>
<p><img alt="tree indexing" src="/RFCs/img/starknet/tree_indexing.png" /></p>
<p><img alt="vector commit" src="/RFCs/img/starknet/vector_commit.png" /></p>
</section>
<section>
<h2>Table commitments</h2>
<h2>Table Commitments</h2>
<p>A table commitment in this context is a vector commitment where leaves are hashes of multiple values. Or in other words, a leaf can be seen as a hash of a table of multiple columns and a single row.</p>
<p>It can be configured with two fields:</p>
<ul>
<li><code>n_columns</code>: the number of columns in each leaf of the tree</li>
<li><code>vector</code>: the vector commitment configuration (see previous section).</li>
</ul>
<p>A few examples:</p>
<ul>
<li>the trace polynomials in the <a href="stark.html">STARK verifier specification</a> are table commitments where each leaf is a hash of the evaluations of all the trace column polynomials at the same point</li>
<li>the composition polynomial in the <a href="stark.html">STARK verifier specification</a> is a table commitment where each leaf is a hash of the evaluations of the composition polynomial columns at the same point</li>
<li>the FRI layer commitments in the <a href="fri.html">FRI verifier specification</a> are table commitments where each leaf is a hash of the evaluations of the FRI layer columns at associated points (e.g. <math xmlns="http://www.w3.org/1998/Math/MathML" display="inline"><mrow><mi>v</mi></mrow></math> and <math xmlns="http://www.w3.org/1998/Math/MathML" display="inline"><mrow><mo>&#x02212;</mo><mi>v</mi></mrow></math>)</li>
</ul>
<p>Note that values are multiplied to the <code>MONTGOMERY_R</code> constant before being hashed as leaves in the tree. TODO: explain why</p>
<p>Note that values are multiplied to the <code>MONTGOMERY_R</code> constant before being hashed as leaves in the tree. </p>
<p>TODO: explain why montgomery</p>
</section>
<section>
<h2>Index to Path Conversion</h2>
Expand Down
49 changes: 5 additions & 44 deletions source/starknet/fri.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -386,63 +386,24 @@ The FRI protocol is globally parameterized according to the following variables

**`proof_of_work_bits`**. The number of bits required for the proof of work. This value should be between 20 and 50.

### Commitment configuration

The protocol as implemented accepts proofs created using different parameters. This allows provers to decide on the trade-offs between proof size, prover time and space complexity, and verifier time and space complexity.

A FRI layer reduction can be configured with the following fields:

**`table_n_columns`**. The number of values committed in each leaf of the Merkle tree. As explained in the overview, each FRI reduction makes predictible related queries to each layer, as such related points are grouped together to reduce multiple related queries to a single one.

**`vector_height`**. The height of the Merkle tree. See the FRI config below to understand how this is validated. (TODO: why do we carry this if we already know the domain size there?)

**`vector_n_verifier_friendly_commitment_layers`**. The number of layers (starting from the bottom) that use a circuit-friendly hash (TODO: double check). (TODO: remove this level of detail? maybe not if this has to match the proof format)

```rust
struct VectorCommitmentConfig {
height: felt252,
n_verifier_friendly_commitment_layers: felt252,
}

struct TableCommitmentConfig {
n_columns: felt252,
vector: VectorCommitmentConfig,
}
```

### FRI configuration

A FRI configuration contains the following fields:

**`log_input_size`**. The size of the input layer to FRI (the number of evaluations committed). (TODO: double check)

**`n_layers`**. The number of layers or folding that will occur as part of the FRI proof.
**`n_layers`**. The number of layers or folding that will occur as part of the FRI proof. This value must be within the range `[2, MAX_FRI_LAYERS]` (see constants).

**`inner_layers`**. The configuration for each of the layers (minus the first layer).
**`inner_layers`**. An array of `TableCommitmentConfig` where each configuration represent what is expected of each commitment sent as part of the FRI proof. Refer to the [Table Commitments section of the Starknet Merkle Tree Polynomial Commitments specification](merkle.html#table-commitments).

**`fri_step_sizes`**. The number of layers to skip for each folding/reduction of the protocol.
**`fri_step_sizes`**. The number of layers to skip for each folding/reduction of the protocol. The first step must always be zero, as no layer is skipped during the first reduction. Each step should be within the range `[1, MAX_FRI_STEP]`. For each step, the corresponding layer `inner_layers[i-1]` should have enough columns to support the reduction: `n_columns = 2^fri_step`.

**`log_last_layer_degree_bound`**. The degree of the last layer's polynomial. As it is sent in clear as part of the FRI protocol, this value represents the (log) number of coefficients (minus 1) that the proof will contain.

```rust
struct FriConfig {
log_input_size: felt252,
n_layers: felt252,
inner_layers: Span<TableCommitmentConfig>,
fri_step_sizes: Span<felt252>,
log_last_layer_degree_bound: felt252,
}
```
**`log_last_layer_degree_bound`**. The degree of the last layer's polynomial. As it is sent in clear as part of the FRI protocol, this value represents the (log) number of coefficients (minus 1) that the proof will contain. It must be less or equal to `MAX_LAST_LAYER_LOG_DEGREE_BOUND` (see constants).

TODO: validate(cfg, log_n_cosets, n_verified_friendly_commitment_layers):
TODO: move these validation steps in the description of the fields above

* the number of layers `n_layers` must be within the range `[2, MAX_FRI_LAYERS]` (see constants)
* the `log_last_layer_degree_bound` must be less or equal to `MAX_LAST_LAYER_LOG_DEGREE_BOUND`
* the first`fri_step_sizes[0]` must be 0 (TODO: explain why)
* for every `fri_step_sizes[i]` check:
* that the step `fri_step_sizes[i]` is within the range `[1, MAX_FRI_STEP]`
* that the previous layer table commitment configuration `inner_Layers[i-1]` has
* a number of columns `n_columns = 2^fri_step` (TODO: why?)
* a valid configuration, which can be verified using the expected log input size and the `n_verifier_friendly_commitment_layers`
* expected log input size should be the input size minus all the step sizes so far
* the `log_expected_input_degree + log_n_cosets == log_input_size`
Expand Down
18 changes: 14 additions & 4 deletions source/starknet/merkle.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -22,25 +22,35 @@ Commitments of polynomials are done using [Merkle trees](https://en.wikipedia.or

**`MONTGOMERY_R = 3618502788666127798953978732740734578953660990361066340291730267701097005025`**. The Montgomery form of $2^{256} \mod \text{STARK_PRIME}$.

## Vector commitments
## Vector Commitments

A vector commitment is simply a Merkle tree.
A vector commitment is simply a Merkle tree. It is configured with two fields:

* `height`: the height of the Merkle tree
* `n_verifier_friendly_commitment_layers`: the depth at which layers will start using the verifier-friendly hash.

![tree indexing](/img/starknet/tree_indexing.png)

![vector commit](/img/starknet/vector_commit.png)

## Table commitments
## Table Commitments

A table commitment in this context is a vector commitment where leaves are hashes of multiple values. Or in other words, a leaf can be seen as a hash of a table of multiple columns and a single row.

It can be configured with two fields:

* `n_columns`: the number of columns in each leaf of the tree
* `vector`: the vector commitment configuration (see previous section).

A few examples:

* the trace polynomials in the [STARK verifier specification](stark.html) are table commitments where each leaf is a hash of the evaluations of all the trace column polynomials at the same point
* the composition polynomial in the [STARK verifier specification](stark.html) is a table commitment where each leaf is a hash of the evaluations of the composition polynomial columns at the same point
* the FRI layer commitments in the [FRI verifier specification](fri.html) are table commitments where each leaf is a hash of the evaluations of the FRI layer columns at associated points (e.g. $v$ and $-v$)

Note that values are multiplied to the `MONTGOMERY_R` constant before being hashed as leaves in the tree. TODO: explain why
Note that values are multiplied to the `MONTGOMERY_R` constant before being hashed as leaves in the tree.

TODO: explain why montgomery

## Index to Path Conversion

Expand Down

0 comments on commit 0bb0742

Please sign in to comment.