Skip to content

[DO NOT MERGE INTO MAIN] feat: refactoring basefold API following "virtual oracle" philosophy#2749

Draft
rdalal wants to merge 2 commits into
mainfrom
rdalal/MPCSapiRefactor
Draft

[DO NOT MERGE INTO MAIN] feat: refactoring basefold API following "virtual oracle" philosophy#2749
rdalal wants to merge 2 commits into
mainfrom
rdalal/MPCSapiRefactor

Conversation

@rdalal
Copy link
Copy Markdown
Contributor

@rdalal rdalal commented Apr 23, 2026

Refactoring API for basefold prover and verifier to not repeat code in VEIL

  • think of basefold calls as creating a virtual oracle from whatever batching method then running basefold on the virtual oracle
  • factored out post-virtual oracle construction logic into a public function so that unusual virtual oracles can be used (as in VEIL)
  • some code-clarity fixes to the veil PCS verifier

THIS CHANGED THE VERIFIER CODE AND IS JUST FOR COMPARISON FOR NOW. NEVER MAKE THIS NON-DRAFT

@rdalal rdalal closed this Apr 23, 2026
@rdalal rdalal reopened this Apr 23, 2026
@rdalal rdalal changed the title basefold prover factorization + veil basefold verifier abstraction fix [DO NOT MERGE INTO MAIN] feat: refactoring basefold API following "virtual oracle" philosophy Apr 23, 2026
#[inline]
pub fn prove_trusted_mle_evaluations(
#[allow(clippy::type_complexity)]
pub fn prove_from_prebatched_inputs(
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

maybe prove_single_multilinear? Just a thought.


#[inline]
pub fn prove_trusted_mle_evaluations(
#[allow(clippy::type_complexity)]
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: maybe not necessary

final_poly,
pow_witness,
batch_grinding_witness,
batch_grinding_witness: Default::default(),
Copy link
Copy Markdown
Contributor

@erabinov erabinov Apr 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: I think this is somewhat risky (someone might forget about it and try to verify this proof). Maybe the return-type of this function should be an UnbatchedBaseFoldProof which doesn't contain the witness.

@github-actions
Copy link
Copy Markdown
Contributor

Test Old New Diff
p256_test_verify_rand_lte_100 11890960 11932842 0.3522 %
bls12_381_tests_test_inverse_fp2_100 2766653 2766653 0.0000 %
curve25519_dalek_test_decompressed_expected_value 4465164 4465164 0.0000 %
bls12_381_tests_test_inverse_fp_100 1416558 1416558 0.0000 %
k256_test_recover_pubkey_infinity 98274 98274 0.0000 %
k256_test_verify_rand_lte_100 11878185 11900128 0.1847 %
curve25519_dalek_test_zero_msm 83636 83636 0.0000 %
bls12_381_tests_test_bls_add_100 10502108 10502108 0.0000 %
rustcrypto_bigint_test_bigint_mul_add_residue 1736502 1736498 -0.0002 %
sha_test_sha2_v0_10_8_expected_digest_lte_100_times 1762437 1765493 0.1734 %
rust_crypto_rsa_test_pkcs_verify_100 29195820 29018586 -0.6071 %
rustcrypto_bigint_test_bigint_mul_mod_special 1753913 1753913 0.0000 %
secp256k1_program_test_verify_v0_30_0_rand_lte_100 17128911 17134198 0.0309 %
bls12_381_tests_test_bls_double_100 6348821 6348821 0.0000 %
bn_test_bn_test_g1_add_neg 306879 306879 0.0000 %
curve25519_dalek_test_add_then_multiply 2770508 2945260 6.3076 %
curve25519_dalek_ng_test_decompressed_noncanonical 195590 195590 0.0000 %
p256_test_recover_high_hash_high_recid 5540090 5082654 -8.2568 %
bn_test_bn_test_fq_inverse_100 834812 834812 0.0000 %
curve25519_dalek_ng_test_add_then_multiply 4137480 3867894 -6.5157 %
secp256k1_program_test_recover_rand_lte_100 5494523 5493966 -0.0101 %
bn_test_bn_test_g1_double_100 727516 727558 0.0058 %
bn_test_bn_test_g1_msm_edge 406721 406721 0.0000 %
k256_test_schnorr_verify 5741507 5741092 -0.0072 %
curve25519_dalek_ng_test_zero_mul 108069 108069 0.0000 %
bn_test_bn_test_fr_inverse_100 851812 851812 0.0000 %
bn_test_bn_test_g1_mul_zero 46120 46120 0.0000 %
bls12_381_tests_test_sqrt_fp_100 1012110 979777 -3.1946 %
bls12_381_tests_test_sqrt_fp2_100 1870903 1762766 -5.7799 %
k256_test_point_ops_edge_cases 33843 33843 0.0000 %
bn_test_bn_test_fq_sqrt_100 833212 833212 0.0000 %
curve25519_dalek_test_zero_mul 72086 72086 0.0000 %
k256_test_recover_rand_lte_100 4460003 4465615 0.1258 %
keccack_test_expected_digest_lte_100 1717071 1720047 0.1733 %
secp256k1_program_test_verify_rand_lte_100 17162608 17158107 -0.0262 %
sha_test_sha2_v0_10_6_expected_digest_lte_100_times 1764569 1764362 -0.0117 %
sha_test_sha2_v0_9_9_expected_digest_lte_100_times 1263899 1265310 0.1116 %
sha_test_sha3_expected_digest_lte_100_times 1609085 1609211 0.0078 %
bn_test_bn_test_fq_partial_ord 184120 184120 0.0000 %
curve25519_dalek_test_decompressed_noncanonical 7660 7660 0.0000 %
p256_test_recover_pubkey_infinity 102285 102285 0.0000 %
k256_test_recover_high_hash_high_recid 2140690 1889078 -11.7538 %
p256_test_recover_rand_lte_100 15981708 15941287 -0.2529 %
secp256k1_program_test_recover_v0_30_0_rand_lte_100 5495461 5482117 -0.2428 %
curve25519_dalek_ng_test_zero_msm 125560 125560 0.0000 %
sha_test_sha2_v0_10_9_expected_digest_lte_100_times 1765035 1767177 0.1214 %
bn_test_bn_test_g1_add_100 986816 986823 0.0007 %
curve25519_dalek_test_ed25519_verify 13289537 13288608 -0.0070 %

evaluation_claims: &[MleEval<GC::EF>],
eval_claim: GC::EF,
proof: &BasefoldProof<GC>,
to_virtual_oracle: impl FnOnce(&[MerkleTreeOpeningAndProof<GC>], &[usize]) -> Vec<GC::EF>,
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd prefer to make a trait OracleOpening<GC> (or some such) that has a member fn to_virtual_oracle(&[MerkleTreeOpeningAndProof<GC>, ..]) -> Vec<GC::EF>.

That way you'll have a chance to name the different implementations.

I may be reaching for traits when they're unnecessary, but I think this function is an important part of the abstraction you're building.

/// * `num_encoding_variables` — number of variables per stacked polynomial (encoding
/// width). Each committed MLE will be stacked into a tensor whose rows have
/// `2^num_encoding_variables` entries.
pub fn initialize_zk_prover_and_verifier<GC: ZkIopCtx, MK: ZkMerkleizer<GC>>(
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Useful!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants