|
| size_t | get_num_circuits () const |
| |
| Goblin & | get_goblin () |
| |
| const Goblin & | get_goblin () const |
| |
| | Chonk (std::vector< CircuitKind > circuit_kinds) |
| |
| void | instantiate_stdlib_verification_queue (ClientCircuit &circuit, const std::vector< StdlibCircuitVKAndHash > &input_keys={}) |
| | Instantiate a stdlib verification queue for use in the kernel completion logic.
|
| |
| std::pair< PairingPoints, EccOpRunningHash > | recursive_verification_and_consistency_checks (const StdlibVerifierInputs &verifier_inputs, HypernovaFoldingRecursiveVerifier &folding_verifier, const std::optional< StdlibFF > &prev_stdlib_acc_hash, const std::optional< EccOpRunningHash > &running_ecc_op_hash) |
| | Run sumcheck on a single proof in the group and perform its databus/accumulator-hash consistency checks.
|
| |
| void | complete_kernel_circuit_logic (ClientCircuit &circuit) |
| | Append logic to complete a kernel circuit.
|
| |
| void | accumulate (ClientCircuit &circuit, const CircuitVerificationKey &vk) |
| | Accumulate a circuit into the running IVC.
|
| |
| CircuitKind | current_kind () const |
| | Kind of the circuit currently being accumulated (or, between accumulate calls, the next one expected).
|
| |
| CircuitKind | next_kind () const |
| | Kind of the circuit that follows the one currently being accumulated, or CircuitKind::None if the current circuit is the last in the stack.
|
| |
| bool | is_init_kernel () const |
| | Whether the kernel currently being completed is the init kernel (the first kernel, which carries no accumulator from a previous kernel).
|
| |
| bool | is_hiding_kernel () const |
| | Whether the circuit currently being accumulated/completed is the hiding kernel.
|
| |
| size_t | get_num_circuits_accumulated () const |
| | Get the number of circuits accumulated by the IVC.
|
| |
| void | set_num_circuits_accumulated_for_mocking (const size_t num_circuits) |
| | Set the num circuits accumulated for mocking an IVC state. Used when writing VKs.
|
| |
| ChonkProof | prove () |
| | Construct Chonk proof using the batched MegaZK + Translator protocol.
|
| |
| std::shared_ptr< MegaZKFlavor::VKAndHash > | get_hiding_kernel_vk_and_hash () const |
| | Get the hiding kernel verification key and hash for Chonk verification.
|
| |
|
| void | verify_native_instance_sumcheck (const VerifierInputs &queue_entry) |
| | Natively verify the instance-to-accumulator sumcheck of the circuit just accumulated. Useful for debugging.
|
| |
| template<typename NativeFlavor > |
| void | run_native_instance_sumcheck (const std::shared_ptr< typename NativeFlavor::VerificationKey > &honk_vk, const VerifierInputs &queue_entry) |
| | Templated native verification of the instance to accumulator sumcheck.
|
| |
| void | update_native_verifier_accumulator (bool is_init_group) |
| | Natively verify the multilinear batching proof and update the native verifier accumulator. Useful for debugging.
|
| |
| void | verify_decider_natively () |
| |
| template<typename InstanceFlavor > |
| void | debug_incoming_circuit (ClientCircuit &circuit, const std::shared_ptr< ProverInstance_< InstanceFlavor > > &prover_instance, const std::shared_ptr< typename InstanceFlavor::VerificationKey > &precomputed_vk) |
| |
| PublicInputsResult | process_kernel_public_inputs (std::vector< StdlibFF > &public_inputs, KernelWitnessCommitments &witness_commitments, const std::optional< StdlibFF > &prev_accum_hash) |
| | Process public inputs from a verified circuit and perform databus consistency checks.
|
| |
| PublicInputsResult | process_app_public_inputs (std::vector< StdlibFF > &public_inputs, AppWitnessCommitments &witness_commitments) |
| |
| void | accumulate_and_fold (ClientCircuit &circuit, const CircuitVerificationKey &vk) |
| | Turn the incoming instance into an accumulator. If a kernel follows, also produce a multilinear batching proof.
|
| |
| void | prove_multilinear_batching () |
| | Generate multilinear batching proof for the current group of accumulators.
|
| |
| template<typename InstanceFlavor > |
| HonkProof | instance_to_accumulator (ClientCircuit &circuit, const std::shared_ptr< typename InstanceFlavor::VerificationKey > &vk) |
| |
| void | accumulate_hiding_kernel (ClientCircuit &circuit, const std::shared_ptr< MegaZKVerificationKey > &precomputed_vk) |
| | Build the hiding kernel's ZK proving key and verification key (proving is deferred to prove()).
|
| |
The IVC scheme used by the aztec client for private function execution.
Combines HyperNova with Goblin to accumulate one circuit at a time with efficient EC group operations. It is assumed that the circuits being accumulated correspond alternatingly to an app and a kernel, as is the case in Aztec. Two recursive folding verifiers are appended to each kernel (except the first one) to verify the folding of a previous kernel and an app/function circuit. Due to this structure it is enforced that the total number of circuits being accumulated is even.
Definition at line 42 of file chonk.hpp.
Accumulate a circuit into the running IVC.
Unified accumulation entry point. Dispatches on current_kind() to either folding (App / Kernel) or the hiding-kernel path (HidingKernel — proving deferred to prove()). When the next circuit is a kernel, the circuit being accumulated completes that kernel's group, so its multilinear batching proof (and, before the hiding kernel, the decider proof) is produced here.
Single entry point for circuit accumulation. Internally, it selects the correct flavor for accumulation based on the kind of the circuit processed (which are provided to Chonk at construction):
Each accumulation step:
- Transforms the incoming circuit into an Hypernova accumulator
- When the next circuit is a kernel, also produces the kernel's multilinear batching proof
- When the next circuit is the hiding kernel, also produces the decider proof
If we are accumulating the hiding kernel, we construct its prover_instance.
- Note
- The caller must pass the VK variant alternative matching
current_kind(); mismatches throw std::bad_variant_access.
Definition at line 635 of file chonk.cpp.
Instantiate a stdlib verification queue for use in the kernel completion logic.
Construct a stdlib proof/verification_key for each entry in the native verification queue. By default, both are constructed from their counterpart in the native queue. Alternatively, Stdlib verification keys can be provided directly as input to this method. (The later option is used, for example, when constructing recursive verifiers based on the verification key witnesses from an acir recursion constraint. This option is not provided for proofs since valid proof witnesses are in general not known at the time of acir constraint generation).
- Parameters
-
Definition at line 160 of file chonk.cpp.
| bool bb::Chonk::is_init_kernel |
( |
| ) |
const |
Whether the kernel currently being completed is the init kernel (the first kernel, which carries no accumulator from a previous kernel).
Derived from the group queued for verification: the init kernel's group begins with the first app's proof, whereas every later kernel's group begins with the previous kernel's proof. Must be called once the stdlib verification queue holds the current kernel's group.
Definition at line 622 of file chonk.cpp.
Process public inputs from a verified circuit and perform databus consistency checks.
For kernel circuits: reconstructs KernelIO from public inputs, verifies that databus return data commitments match witness commitments, checks accumulator hash consistency, and returns the kernel's ECC op running hash. For app circuits: reconstructs AppIO from public inputs and extracts pairing points. In both cases, updates the bus depot with the appropriate return data commitment.
- Parameters
-
| verifier_inputs | {proof, vkey, type (Oink/HN)} A set of inputs for recursive verification |
| public_inputs | The public inputs extracted from the verifier instance that was folded into the running accumulator |
| witness_commitments | The witness commitments extracted from the verifier instance that was folded into the running accumulator |
| prev_accum_hash | The accumulator hash from the previous kernel |
Definition at line 207 of file chonk.cpp.
Construct Chonk proof using the batched MegaZK + Translator protocol.
Orchestrates the batched proving flow on a shared transcript:
- MegaZK Oink (pre-sumcheck commitments for the hiding kernel)
- Merge proof (fixed-location append of the final subtable from the hiding kernel)
- ECCVM proof (produces translation challenges v, x)
- IPA proof (separate transcript)
- Translator Oink + Joint sumcheck + Joint PCS
The joint sumcheck and PCS batch the MegaZK and translator circuits together, eliminating separate sumcheck/PCS phases and reducing proof size.
Definition at line 732 of file chonk.cpp.
| void bb::Chonk::prove_multilinear_batching |
( |
| ) |
|
|
private |
Generate multilinear batching proof for the current group of accumulators.
Batch the group's sumcheck claims (collected during the group's accumulate() calls) together with the previous accumulator, using the batching circuit of exactly matching width.
In between kernels, instances are turned into accumulators. When we reach the last app in a group, we generate a single proof that batches the accumulators in the group into a single accumulator, which will be propagated by the following kernel.
Called at the end of accumulating the last circuit of a group, i.e. when the next circuit is a kernel. The resulting proof is recursively verified in that kernel's complete_kernel_circuit_logic.
Definition at line 680 of file chonk.cpp.
Run sumcheck on a single proof in the group and perform its databus/accumulator-hash consistency checks.
Delegates to two steps: (1) sumcheck on the incoming instance to obtain its claim (no multilinear batching), and (2) public inputs processing and databus consistency checks. Returns the resulting sumcheck claim, its pairing points, and the updated ECC-op running hash. The claim is collected by complete_kernel_circuit_logic and batched together with the rest of the group at the end of the kernel.
- Parameters
-
| verifier_inputs | {proof, vkey, type (Oink/HN)} A set of inputs for recursive verification |
| prev_stdlib_acc_hash | The hash of the accumulator from the previous step of recursive verification |
| running_ecc_op_hash | Running hash of ECC-op column commitments from prior steps in this kernel. |
| accumulation_recursive_transcript | Transcript shared across recursive verification of the sumchecks of K_{i-1} (kernel), A_{i,1} (app), .., A_{i, n} (app) |
Definition at line 293 of file chonk.cpp.
| void bb::Chonk::update_native_verifier_accumulator |
( |
bool |
is_init_group | ) |
|
|
private |
Natively verify the multilinear batching proof and update the native verifier accumulator. Useful for debugging.
Batches the previous accumulator (absent for the init group) with the group's collected sumcheck claims, mirroring prove_multilinear_batching, and cross-checks the result against the prover accumulator.
Definition at line 83 of file chonk.cpp.
1.9.8