Barretenberg
The ZK-SNARK library at the core of Aztec
Loading...
Searching...
No Matches
Public Types | Static Public Member Functions | Static Public Attributes | List of all members
bb::ECCVMShiftableInitRelationImpl< FF_ > Class Template Reference

Pins every shiftable wire to 0 at the lagrange_first row (TRACE_OFFSET). More...

#include <ecc_shiftable_init_relation.hpp>

Public Types

enum  SubrelationIndex : size_t {
  Z_PERM_INIT = 0 , TRANSCRIPT_ACCUMULATOR_NOT_EMPTY_INIT = 1 , PRECOMPUTE_SELECT_INIT = 2 , TRANSCRIPT_MUL_INIT = 3 ,
  TRANSCRIPT_PC_INIT = 4 , PRECOMPUTE_SCALAR_SUM_INIT = 5 , PRECOMPUTE_DX_INIT = 6 , PRECOMPUTE_DY_INIT = 7 ,
  PRECOMPUTE_TX_INIT = 8 , PRECOMPUTE_TY_INIT = 9 , MSM_TRANSITION_INIT = 10 , MSM_ADD_INIT = 11 ,
  MSM_DOUBLE_INIT = 12 , MSM_SKEW_INIT = 13 , MSM_ACCUMULATOR_X_INIT = 14 , MSM_ACCUMULATOR_Y_INIT = 15 ,
  MSM_COUNT_INIT = 16 , MSM_ROUND_INIT = 17 , MSM_ADD1_INIT = 18 , MSM_PC_INIT = 19 ,
  TRANSCRIPT_MSM_COUNT_INIT = 20 , NUM_SUBRELATIONS
}
 
using FF = FF_
 

Static Public Member Functions

template<typename AllEntities >
static bool skip (const AllEntities &in)
 
template<typename ContainerOverSubrelations , typename AllEntities , typename Parameters >
static void accumulate (ContainerOverSubrelations &accumulator, const AllEntities &in, const Parameters &, const FF &scaling_factor)
 

Static Public Attributes

static constexpr std::array< size_t, 21 > SUBRELATION_PARTIAL_LENGTHS
 

Detailed Description

template<typename FF_>
class bb::ECCVMShiftableInitRelationImpl< FF_ >

Pins every shiftable wire to 0 at the lagrange_first row (TRACE_OFFSET).

ECCVM has 26 shiftable witness columns (see WireToBeShiftedWithoutAccumulatorsEntities, WireToBeShiftedAccumulatorEntities, and DerivedWitnessEntities for z_perm in eccvm_flavor.hpp). Honest builders zero all of them at the lagrange_first row (TRACE_OFFSET) — the dead header that sits between the leading zero/masking head and the first active row.

Shiftability is a polynomial-structure property — it enforces col[0] = 0 (the leading zero row of the trace), but it does not structurally enforce col[lagrange_first row] = 0. A malicious prover can commit a polynomial whose value there is non-zero. The constraint at the preceding row that would have pinned the lagrange_first row's value via col_shift sits in the disabled-head region (the first NUM_DISABLED_ROWS_IN_SUMCHECK rows have a vanishing gate separator), so it does not fire.

This relation enforces lagrange_first · col = 0 for every shiftable column whose value at the lagrange_first row is not already pinned to 0 by some other constraint. Some such constraints exist (see the per-column rationale below), in which case we document where the pinning happens and omit a subrelation here.

Without this defense, at least the following gaps existed:

  • precompute_select: phantom 1-row scalar at lagrange_first with unbounded scalar_sum propagating to the transcript-side z1 (load-bearing for soundness).
  • transcript_mul: spurious second-term-multiset denominator factor at lagrange_first with attacker-controlled fingerprint (load-bearing).
  • transcript_pc: composes with transcript_mul above (load-bearing).

For columns whose value at the lagrange_first row is free but not currently read by any firing constraint, we still pin to 0 here as defense-in-depth so that the invariant is explicit, robust to future relation changes, and easy to reason about.

Skipped here (pinned by cascade in another relation — DO NOT remove the cited constraint without revisiting):

  • transcript_accumulator_x, transcript_accumulator_y ← pinned by cascade through is_accumulator_empty · transcript_accumulator_{x,y} = 0 in ecc_transcript_relation_impl.hpp. With transcript_accumulator_not_empty = 0 at lagrange_first from TRANSCRIPT_ACCUMULATOR_NOT_EMPTY_INIT below, is_accumulator_empty = 1 there and both coordinates are forced to 0.
  • precompute_pc ← INACTIVE_PC in ecc_wnaf_relation_impl.hpp (cascade through precompute_select = 0 at lagrange_first, which we pin below).
  • precompute_round ← INACTIVE_ROUND in ecc_wnaf_relation_impl.hpp (same cascade).
  • precompute_s1hi ← INACTIVE_SLICE_W0 plus the 2-bit range constraints RANGE_S1HI, RANGE_S1LO in ecc_wnaf_relation_impl.hpp (same cascade — at precompute_select = 0, the wNAF digit w_0 is forced to -15, which combined with the range constraints on s1hi and s1lo forces both to 0).
Template Parameters
FF

Definition at line 64 of file ecc_shiftable_init_relation.hpp.

Member Typedef Documentation

◆ FF

template<typename FF_ >
using bb::ECCVMShiftableInitRelationImpl< FF_ >::FF = FF_

Definition at line 66 of file ecc_shiftable_init_relation.hpp.

Member Enumeration Documentation

◆ SubrelationIndex

template<typename FF_ >
enum bb::ECCVMShiftableInitRelationImpl::SubrelationIndex : size_t
Enumerator
Z_PERM_INIT 
TRANSCRIPT_ACCUMULATOR_NOT_EMPTY_INIT 
PRECOMPUTE_SELECT_INIT 
TRANSCRIPT_MUL_INIT 
TRANSCRIPT_PC_INIT 
PRECOMPUTE_SCALAR_SUM_INIT 
PRECOMPUTE_DX_INIT 
PRECOMPUTE_DY_INIT 
PRECOMPUTE_TX_INIT 
PRECOMPUTE_TY_INIT 
MSM_TRANSITION_INIT 
MSM_ADD_INIT 
MSM_DOUBLE_INIT 
MSM_SKEW_INIT 
MSM_ACCUMULATOR_X_INIT 
MSM_ACCUMULATOR_Y_INIT 
MSM_COUNT_INIT 
MSM_ROUND_INIT 
MSM_ADD1_INIT 
MSM_PC_INIT 
TRANSCRIPT_MSM_COUNT_INIT 
NUM_SUBRELATIONS 

Definition at line 68 of file ecc_shiftable_init_relation.hpp.

Member Function Documentation

◆ accumulate()

template<typename FF >
template<typename ContainerOverSubrelations , typename AllEntities , typename Parameters >
void bb::ECCVMShiftableInitRelationImpl< FF >::accumulate ( ContainerOverSubrelations &  accumulator,
const AllEntities &  in,
const Parameters &  ,
const FF &  scaling_factor 
)
static

Definition at line 13 of file ecc_shiftable_init_relation_impl.hpp.

◆ skip()

template<typename FF_ >
template<typename AllEntities >
static bool bb::ECCVMShiftableInitRelationImpl< FF_ >::skip ( const AllEntities &  in)
inlinestatic

Definition at line 107 of file ecc_shiftable_init_relation.hpp.

Member Data Documentation

◆ SUBRELATION_PARTIAL_LENGTHS

template<typename FF_ >
constexpr std::array<size_t, 21> bb::ECCVMShiftableInitRelationImpl< FF_ >::SUBRELATION_PARTIAL_LENGTHS
staticconstexpr
Initial value:
{ 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3,
3, 3, 3, 3, 3, 3, 3, 3, 3, 3 }

Definition at line 102 of file ecc_shiftable_init_relation.hpp.

The documentation for this class was generated from the following files: