Enables optional verification of Keccak tables #657

sai-deng · 2024-09-24T21:14:07Z

Enables optional verification of Keccak tables in root circuits, saving unnecessary recursion time for empty Keccak tables. In my tests below, it reduces proving time by around 3 seconds when a segment contains no Keccak operations. #620

RUST_LOG=info /Users/sdeng/.cargo/bin/cargo test --color=always -r --lib fixed_recursive_verifier::tests::test_segment_proof_generation_without_keccak --no-fail-fast --manifest-path /Users/sdeng/Project/0xPolygonZero/zk_evm/evm_arithmetization/Cargo.toml -- --ignored

[2024-09-25T04:47:30Z INFO  evm_arithmetization::generation] CPU trace padded to 512 cycles
[2024-09-25T04:47:30Z INFO  evm_arithmetization::witness::traces] Trace lengths (before padding): TraceCheckpoint { arithmetic_len: 100, byte_packing_len: 3, cpu_len: 512, keccak_len: 24, keccak_sponge_len: 1, logic_len: 8, memory_len: 67556 }, mem_before_len: 66049, mem_after_len: 66113
[2024-09-25T04:47:46Z INFO  evm_arithmetization::generation] CPU trace padded to 512 cycles
[2024-09-25T04:47:46Z INFO  evm_arithmetization::witness::traces] Trace lengths (before padding): TraceCheckpoint { arithmetic_len: 102, byte_packing_len: 7, cpu_len: 512, keccak_len: 96, keccak_sponge_len: 4, logic_len: 23, memory_len: 67773 }, mem_before_len: 66113, mem_after_len: 66126
[2024-09-25T04:48:01Z INFO  evm_arithmetization::generation] CPU trace padded to 512 cycles
[2024-09-25T04:48:01Z INFO  evm_arithmetization::witness::traces] Trace lengths (before padding): TraceCheckpoint { arithmetic_len: 83, byte_packing_len: 5, cpu_len: 512, keccak_len: 48, keccak_sponge_len: 2, logic_len: 14, memory_len: 67631 }, mem_before_len: 66126, mem_after_len: 66136
test fixed_recursive_verifier::tests::test_segment_proof_generation_without_keccak has been running for over 60 seconds
[2024-09-25T04:48:16Z INFO  evm_arithmetization::generation] CPU trace padded to 512 cycles
[2024-09-25T04:48:16Z INFO  evm_arithmetization::witness::traces] Trace lengths (before padding): TraceCheckpoint { arithmetic_len: 121, byte_packing_len: 2, cpu_len: 512, keccak_len: 0, keccak_sponge_len: 0, logic_len: 4, memory_len: 67684 }, mem_before_len: 66136, mem_after_len: 66173
[2024-09-25T04:48:28Z INFO  evm_arithmetization::generation] CPU trace padded to 512 cycles
[2024-09-25T04:48:28Z INFO  evm_arithmetization::witness::traces] Trace lengths (before padding): TraceCheckpoint { arithmetic_len: 98, byte_packing_len: 7, cpu_len: 512, keccak_len: 24, keccak_sponge_len: 1, logic_len: 8, memory_len: 67759 }, mem_before_len: 66173, mem_after_len: 66244
[2024-09-25T04:48:44Z INFO  evm_arithmetization::generation] CPU trace padded to 512 cycles
[2024-09-25T04:48:44Z INFO  evm_arithmetization::witness::traces] Trace lengths (before padding): TraceCheckpoint { arithmetic_len: 89, byte_packing_len: 2, cpu_len: 512, keccak_len: 24, keccak_sponge_len: 1, logic_len: 8, memory_len: 67871 }, mem_before_len: 66244, mem_after_len: 66251
[2024-09-25T04:49:00Z INFO  evm_arithmetization::generation] CPU trace padded to 512 cycles
[2024-09-25T04:49:00Z INFO  evm_arithmetization::witness::traces] Trace lengths (before padding): TraceCheckpoint { arithmetic_len: 115, byte_packing_len: 2, cpu_len: 512, keccak_len: 0, keccak_sponge_len: 0, logic_len: 4, memory_len: 67796 }, mem_before_len: 66251, mem_after_len: 66251
[2024-09-25T04:49:12Z INFO  evm_arithmetization::generation] CPU trace padded to 512 cycles
[2024-09-25T04:49:12Z INFO  evm_arithmetization::witness::traces] Trace lengths (before padding): TraceCheckpoint { arithmetic_len: 121, byte_packing_len: 4, cpu_len: 512, keccak_len: 0, keccak_sponge_len: 0, logic_len: 4, memory_len: 67807 }, mem_before_len: 66251, mem_after_len: 66257
[2024-09-25T04:49:23Z INFO  evm_arithmetization::generation] CPU trace padded to 512 cycles
[2024-09-25T04:49:23Z INFO  evm_arithmetization::witness::traces] Trace lengths (before padding): TraceCheckpoint { arithmetic_len: 90, byte_packing_len: 4, cpu_len: 512, keccak_len: 48, keccak_sponge_len: 2, logic_len: 13, memory_len: 67831 }, mem_before_len: 66257, mem_after_len: 0
[2024-09-25T04:49:37Z INFO  plonky2::util::timing] 150.4260s to Segment Proof Generation
[2024-09-25T04:49:37Z INFO  plonky2::util::timing] | 22.9381s to Create all recursive circuits
[2024-09-25T04:49:37Z INFO  plonky2::util::timing] | 0.0000s to Generate dummy payload
[2024-09-25T04:49:37Z INFO  plonky2::util::timing] | 15.6231s to Prove segment
[2024-09-25T04:49:37Z INFO  plonky2::util::timing] | 15.1803s to Prove segment
[2024-09-25T04:49:37Z INFO  plonky2::util::timing] | 15.4374s to Prove segment
[2024-09-25T04:49:37Z INFO  plonky2::util::timing] | 11.6834s to Prove segment
[2024-09-25T04:49:37Z INFO  plonky2::util::timing] | 16.2813s to Prove segment
[2024-09-25T04:49:37Z INFO  plonky2::util::timing] | 15.7072s to Prove segment
[2024-09-25T04:49:37Z INFO  plonky2::util::timing] | 11.7241s to Prove segment
[2024-09-25T04:49:37Z INFO  plonky2::util::timing] | 11.6348s to Prove segment
[2024-09-25T04:49:37Z INFO  plonky2::util::timing] | 14.2030s to Prove segment
[2024-09-25T04:49:37Z INFO  plonky2::util::timing] | 0.0034s to Verify segment proof
test fixed_recursive_verifier::tests::test_segment_proof_generation_without_keccak ... ok

…le_keccak_optional_proving

LindaGuiga · 2024-10-02T07:03:04Z

evm_arithmetization/src/fixed_recursive_verifier.rs

+                    self.root.index_verifier_data[table],
+                    F::from_canonical_usize(*index_verifier_data),
+                );
+                let common_date = &table_circuits


Suggested change

let common_date = &table_circuits

let common_data = &table_circuits

evm_arithmetization/src/fixed_recursive_verifier.rs

LindaGuiga · 2024-10-02T07:23:18Z

evm_arithmetization/src/generation/mod.rs

@@ -486,7 +486,11 @@ fn get_all_memory_address_and_values(memory_before: &MemoryState) -> Vec<(Memory
    res
 }

-type TablesWithPVsAndFinalMem<F> = ([Vec<PolynomialValues<F>>; NUM_TABLES], PublicValues<F>);
+pub struct TablesWithPVsAndFinalMem<F: RichField> {


Nit: out of curiosity: why AndFinalMem?

Renamed it. Thanks for the catch!

LindaGuiga · 2024-10-02T07:37:20Z

evm_arithmetization/src/prover.rs

+        if KECCAK_TABLES_INDICES.contains(&i) && !use_keccak_tables {
+            // Observe zero merkle caps when skipping Keccak tables.
+            let zero_merkle_cap = cap.flatten().iter().map(|_| F::ZERO).collect::<Vec<F>>();
+            challenger.observe_elements(&zero_merkle_cap);


Can they not just be ignored? (as in only observe if it's not a keccak table)?

Also, has a similar change been applied on the verifier side (in get_challenges.rs)?

It is difficult to implement conditionally observe in root circuits, so I choose observe zero caps instead.

I was originally planning to implement it in the next PR (which requires changes on the Plonky2 side, and get_challenges.rs is only used for testing). However, I agree with you that we should make this PR complete. I will implement it in this PR instead.

evm_arithmetization/src/prover.rs

…le_keccak_optional_proving

Co-authored-by: Linda Guiga <[email protected]>

sai-deng · 2024-10-02T21:49:21Z

@LindaGuiga Thanks for reviewing! I have synced the zkVM verifier with the prover.

In the next PR #690 , I will make the proofs optional in the proof table, but this requires changes on the Plonky2 side. This is also why I’m sending this PR for review before updating Plonky2.

Nashtare · 2024-10-04T18:15:15Z

evm_arithmetization/src/fixed_recursive_verifier.rs

+                    .by_stark_size
+                    .keys()
+                    .min()
+                    .expect("No valid size in shrinking circuits");


nit: it'd be best to return an error early than panicking in these calls

Nashtare · 2024-10-04T18:17:02Z

evm_arithmetization/src/generation/mod.rs

+    let use_keccak_tables =
+        !state.traces.keccak_inputs.is_empty() || !state.traces.keccak_sponge_ops.is_empty();


nit: you can't have one empty and the other non-empty, so no need for the second evaluation

Nashtare · 2024-10-04T18:18:23Z

evm_arithmetization/src/prover.rs

    let (keccak_proof, _) = prove_table!(keccak_stark, Table::Keccak);
    let (keccak_sponge_proof, _) = prove_table!(keccak_sponge_stark, Table::KeccakSponge);
+    if !use_keccak_tables {
+        // We need to connect the challenger state of Logic and CPU tables when the


nit (for consistency with actual ordering)

Suggested change

// We need to connect the challenger state of Logic and CPU tables when the

// We need to connect the challenger state of CPU and Logic tables when the

also would need to probably rework the way we mark empty tables once we include BP / Logic / MemAfter, as we may do multiple hops before finding a non-empty table, and I find the use of multiple use_foo fields in AllProof slightly ugly

sai-deng added 2 commits September 24, 2024 11:17

add empty keccak tables bool

948d742

enable no keccak recursion

49bb96b

sai-deng changed the base branch from develop to sai/skip_table_in_root_circuit September 24, 2024 21:14

github-actions bot added the crate: evm_arithmetization Anything related to the evm_arithmetization crate. label Sep 24, 2024

sai-deng changed the base branch from sai/skip_table_in_root_circuit to sai/conditionally_verify_in_root_circuit September 24, 2024 21:15

sai-deng added 9 commits September 24, 2024 14:38

refactor

bbba820

fix tests

8c4a362

rename

5cdb37d

fix pis

2f0129e

resolve conflicts

5b7f818

done

56deaa3

Merge branch 'sai/conditionally_verify_in_root_circuit' into sai/enab…

cfc6f24

…le_keccak_optional_proving

fix ci

4d288f8

add comments

e6bed69

sai-deng self-assigned this Sep 25, 2024

sai-deng changed the title ~~[WIP] Sai/enable keccak optional proving~~ Enables Keccak optional proving Sep 25, 2024

sai-deng changed the title ~~Enables Keccak optional proving~~ Enables optional verification of Keccak tables Sep 25, 2024

fix ci

0bd1448

sai-deng mentioned this pull request Sep 25, 2024

Update the root circuit to conditionally verify Keccak proofs #652

Open

sai-deng marked this pull request as ready for review September 25, 2024 17:47

sai-deng requested review from wborgeaud, muursh, Nashtare and LindaGuiga as code owners September 25, 2024 17:47

sai-deng requested a review from hratoanina September 25, 2024 17:48

sai-deng added 2 commits September 25, 2024 11:18

Merge branch 'sai/conditionally_verify_in_root_circuit' into sai/enab…

daaabb6

…le_keccak_optional_proving

Merge branch 'sai/conditionally_verify_in_root_circuit' into sai/enab…

ab2ec50

…le_keccak_optional_proving

sai-deng force-pushed the sai/enable_keccak_optional_proving branch from 34c9bad to ab2ec50 Compare September 26, 2024 23:10

sai-deng added 2 commits September 30, 2024 12:12

Merge branch 'sai/conditionally_verify_in_root_circuit' into sai/enab…

ec64af9

…le_keccak_optional_proving

Merge branch 'sai/conditionally_verify_in_root_circuit' into sai/enab…

58f37e8

…le_keccak_optional_proving

sai-deng added 3 commits October 1, 2024 15:30

Merge branch 'sai/conditionally_verify_in_root_circuit' into sai/enab…

1540078

…le_keccak_optional_proving

fix ci with "cdk_erigon"

12c61a8

Merge branch 'sai/conditionally_verify_in_root_circuit' into sai/enab…

42afc90

…le_keccak_optional_proving

LindaGuiga reviewed Oct 2, 2024

View reviewed changes

sai-deng and others added 7 commits October 2, 2024 09:10

Merge branch 'sai/conditionally_verify_in_root_circuit' into sai/enab…

e7ab9eb

…le_keccak_optional_proving

enable test

09a1a4a

Update evm_arithmetization/src/fixed_recursive_verifier.rs

4a69e8a

Co-authored-by: Linda Guiga <[email protected]>

address comments

81d3681

sync changes into get_challenges

79aeb72

wip

732020d

fix

9f8ec9e

fix

503085b

sai-deng force-pushed the sai/enable_keccak_optional_proving branch from f61d7c0 to 503085b Compare October 2, 2024 21:59

sai-deng added 2 commits October 2, 2024 17:17

fix tests

a36c5f7

fix

640bae1

Nashtare added this to the Performance Tuning milestone Oct 3, 2024

Nashtare reviewed Oct 4, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Enables optional verification of Keccak tables #657

Enables optional verification of Keccak tables #657

sai-deng commented Sep 24, 2024 •

edited by Nashtare

Loading

LindaGuiga Oct 2, 2024

LindaGuiga Oct 2, 2024

sai-deng Oct 2, 2024

LindaGuiga Oct 2, 2024

sai-deng Oct 2, 2024

sai-deng commented Oct 2, 2024 •

edited

Loading

Nashtare Oct 4, 2024

Nashtare Oct 4, 2024

Nashtare Oct 4, 2024

Nashtare Oct 4, 2024

	let common_date = &table_circuits
	let common_data = &table_circuits

		let use_keccak_tables =
		!state.traces.keccak_inputs.is_empty() \|\| !state.traces.keccak_sponge_ops.is_empty();

	// We need to connect the challenger state of Logic and CPU tables when the
	// We need to connect the challenger state of CPU and Logic tables when the

Enables optional verification of Keccak tables #657

Are you sure you want to change the base?

Enables optional verification of Keccak tables #657

Conversation

sai-deng commented Sep 24, 2024 • edited by Nashtare Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sai-deng commented Oct 2, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sai-deng commented Sep 24, 2024 •

edited by Nashtare

Loading

sai-deng commented Oct 2, 2024 •

edited

Loading