Arrabbiata: coining alpha challenge + implement generic coin_challenge

arrabbiata/src/challenge.rs

@@ -1,7 +1,7 @@
-use ark_ff::{Field, Zero};
+use ark_ff::Zero;
 use core::{
     fmt::{Display, Formatter, Result},
-    ops::Index,
+    ops::{Index, IndexMut},
 };
 use kimchi::circuits::expr::AlphaChallengeTerm;
 use serde::{Deserialize, Serialize};
@@ -83,6 +83,39 @@ impl<F> Index<usize> for Challenges<F> {
     }
 }
 
+impl<F> IndexMut<usize> for Challenges<F> {
+    fn index_mut(&mut self, index: usize) -> &mut F {
+        if index == 0 {
+            &mut self.constraint_randomiser
+        } else if index == 1 {
+            &mut self.beta
+        } else if index == 2 {
+            &mut self.gamma
+        } else if index == 3 {
+            &mut self.constraint_homogeniser
+        } else if index == 4 {
+            &mut self.relation_randomiser
+        } else {
+            panic!(
+                "Index out of bounds, only {} are defined",
+                ChallengeTerm::COUNT
+            )
+        }
+    }
+}
+
+impl<F> IndexMut<ChallengeTerm> for Challenges<F> {
+    fn index_mut(&mut self, term: ChallengeTerm) -> &mut F {
+        match term {
+            ChallengeTerm::ConstraintRandomiser => &mut self.constraint_randomiser,
+            ChallengeTerm::Beta => &mut self.beta,
+            ChallengeTerm::Gamma => &mut self.gamma,
+            ChallengeTerm::ConstraintHomogeniser => &mut self.constraint_homogeniser,
+            ChallengeTerm::RelationRandomiser => &mut self.relation_randomiser,
+        }
+    }
+}
+
 impl<F: Zero> Default for Challenges<F> {
     fn default() -> Self {
         Self {
@@ -95,7 +128,7 @@ impl<F: Zero> Default for Challenges<F> {
     }
 }
 
-impl<F: Field> Index<ChallengeTerm> for Challenges<F> {
+impl<F> Index<ChallengeTerm> for Challenges<F> {
     type Output = F;
 
     fn index(&self, term: ChallengeTerm) -> &Self::Output {

arrabbiata/src/main.rs

@@ -5,6 +5,7 @@
 //! specify the number of iterations, and keep this file relatively simple.
 
 use arrabbiata::{
+    challenge::ChallengeTerm,
     curve::PlonkSpongeConstants,
     interpreter::{self, InterpreterEnv},
     witness::Env,
@@ -115,6 +116,7 @@ pub fn main() {
         // Absorb the last program state.
         env.absorb_state();
 
+        // ----- Permutation argument -----
         // FIXME:
         // Coin chalenges β and γ for the permutation argument
 
@@ -123,10 +125,12 @@ pub fn main() {
 
         // FIXME:
         // Commit to the accumulator and absorb the commitment
+        // ----- Permutation argument -----
 
-        // FIXME:
         // Coin challenge α for combining the constraints
+        env.coin_challenge(ChallengeTerm::ConstraintRandomiser);
 
+        // ----- Accumulation/folding argument -----
         // FIXME:
         // Compute the cross-terms
 
@@ -153,6 +157,7 @@ pub fn main() {
 
         // FIXME:
         // Compute the accumulated error
+        // ----- Accumulation/folding argument -----
 
         debug!(
             "Iteration {i} fully proven in {elapsed} μs",

arrabbiata/src/witness.rs

@@ -12,7 +12,7 @@ use rayon::iter::{IntoParallelRefIterator, ParallelIterator};
 use std::time::Instant;
 
 use crate::{
-    challenge::Challenges,
+    challenge::{ChallengeTerm, Challenges},
     column::{Column, Gadget},
     curve::{ArrabbiataCurve, PlonkSpongeConstants},
     interpreter::{Instruction, InterpreterEnv, Side},
@@ -1236,4 +1236,51 @@ where
             Instruction::NoOp => Instruction::NoOp,
         }
     }
+
+    /// Simulate an interaction with the verifier by requesting to coin a
+    /// challenge from the current prover sponge state.
+    ///
+    /// This method supposes that all the messages have been sent to the
+    /// verifier previously, and the attribute [self.prover_sponge_state] has
+    /// been updated accordingly by absorbing all the messages correctly.
+    ///
+    /// The side-effect of this method will be to run a permutation on the
+    /// sponge state _after_ coining the challenge.
+    /// There is an hypothesis on the sponge state that the inner permutation
+    /// has been correctly executed if the absorbtion rate had been reached at
+    /// the last absorbtion.
+    ///
+    /// The challenge will be added to the [self.challenges] attribute at the
+    /// position given by the challenge `chal`.
+    ///
+    /// Internally, the method is implemented by simply loading the prover
+    /// sponge state, and squeezing a challenge from it, relying on the
+    /// implementation of the sponge. Usually, the challenge would be the first
+    /// N bits of the first element, but it is left as an implementation detail
+    /// of the sponge given by the curve.
+    pub fn coin_challenge(&mut self, chal: ChallengeTerm) {
+        if self.current_iteration % 2 == 0 {
+            let mut sponge = E1::create_new_sponge();
+            self.prover_sponge_state.iter().for_each(|x| {
+                E1::absorb_fq(
+                    &mut sponge,
+                    E1::BaseField::from_biguint(&x.to_biguint().unwrap()).unwrap(),
+                )
+            });
+            let verifier_answer = E1::squeeze_challenge(&mut sponge).to_biguint().into();
+            self.challenges[chal] = verifier_answer;
+            sponge.sponge.poseidon_block_cipher();
+        } else {
+            let mut sponge = E2::create_new_sponge();
+            self.prover_sponge_state.iter().for_each(|x| {
+                E2::absorb_fq(
+                    &mut sponge,
+                    E2::BaseField::from_biguint(&x.to_biguint().unwrap()).unwrap(),
+                )
+            });
+            let verifier_answer = E2::squeeze_challenge(&mut sponge).to_biguint().into();
+            self.challenges[chal] = verifier_answer;
+            sponge.sponge.poseidon_block_cipher();
+        };
+    }
 }

poseidon/src/poseidon.rs

@@ -70,7 +70,7 @@ impl<F: Field, SC: SpongeConstants> ArithmeticSponge<F, SC> {
         full_round::<F, SC>(self.params, &mut self.state, r);
     }
 
-    fn poseidon_block_cipher(&mut self) {
+    pub fn poseidon_block_cipher(&mut self) {
         poseidon_block_cipher::<F, SC>(self.params, &mut self.state);
     }
 }