Add publics to Powdr STWO prover 1 - Shuang's Crypto Notes

need to get more detailed understanding of the concept of publics, isn’t it just some of the witness get revealed before the proving step?

it is part of the input to the circuit. to the prove function and to the verify function as well.

Table of Contents

Understanding publics from plonky3

following this fibonacci example tutorial No publics in this example.

fibonacci code from Plonky3 repo and it has publics

The evaluation function is built like this:

The inputs to the fibonacci circuits \(a\) and \(b\), and output \(x\) are all public values, as this code shows

 let pis = builder.public_values();

        let a = pis[0];
        let b = pis[1];
        let x = pis[2];

The circuit related to fibonacci logics are:

let (local, next) = (main.row_slice(0), main.row_slice(1));
        let local: &FibonacciRow<AB::Var> = (*local).borrow();
        let next: &FibonacciRow<AB::Var> = (*next).borrow();

and

// a' <- b
when_transition.assert_eq(local.right, next.left);

// b' <- a + b
when_transition.assert_eq(local.left + local.right, next.right);

these constraints above are not related to the public values, then they just defined three constraints to bind the public values with certain witness values in certain row and column, these witness in this way become public.

In this sense, the public values are extra values, binding with some witness values to make them public.

key notes:

whenever add a new value/variate to the circuit, we cannot just add a single value, instead, we need to add a whole column.
if we want to reveal a certain row and a certain column and also make the reveal verifiable, we need to either reveal the whole column, or we can add extra column, bind the value in this extra column to the original values we want to reveal, then this extra column will have zeros apart from the position bind to the original values. then this extra column can be revealed to the public.

Publics in stwo

In the state machine example, stwo define a proof for state machine, which includes public values:

based on how the states are defined below, these publics should be the state of the state machine 0 and state machine 1, the state constants two figures of M31

in mod.rs, the proof for the instance execution is created as, I need to know how the public values are related in the circuit?

let’s start with the test case for the proving function:

The initial state is defined as [0,0], and passed to the prove function

in the prove function, the initial_state as the public value, is used directly to create trace, final_state only shows up in creating the proof.

this is essentially the same with plonky3, apart from that the stwo ignores to define the constraint of public and public related witness, use public as part of witness trace directly.

how the publics are handled in the verification function?

Publics in plonky3 backend in powdr

in the setup function, publics are treated together with fix columns to take as pre-processed columns

then this info pass to the prove function, the prove function doesn’t need to specify the publics explicitly, but the publics is input to the verification function.

the prove function in powdr is not the original prove function from plonky3, plonky3 prove function needs public input.

I need to get more into the plonky3 prove function.

the constraint for the public and constraint in plonky3 backend is in circuit_builder.rs-> PowdrTable eval function

Conclusion of how should I add publics in stwo backend in Powdr

The publics are also columns, I can include them in the pre-processed

columns, they join the computation to create a proof. the proof has a commitment for all the preprocessed columns. prover can give an extra proof to prove the commitment for the publics are included in the path to the merkle tree.

in the verification, verify compute the commitment to the public by itself, verify it is included in the path to the merkle tree root.

one more important notes:

the publics are normally less values than a complete column. if using the above logic, the prover needs to send the full public column to the verifier (otherwise the verifier cannot compute the commitment of this column), to avoid this, we can create a new public column and a selector column, use selector to selector a value in a witness column, and make it as the public column, so the public column only contains values in a specific position, other than that, the values are 0.