feat: Garaga UltraStarknet[Zk]Honk flavours

barretenberg/acir_tests/bbjs-test/src/index.ts

@@ -36,7 +36,7 @@ async function generateProof({
   const backend = new UltraHonkBackend(bytecode, { threads: multiThreaded ? 8 : 1 });
 
   const witness = await fs.readFile(witnessPath);
-  const proof = await backend.generateProof(new Uint8Array(witness), { keccak: (oracleHash === "keccak") });
+  const proof = await backend.generateProof(new Uint8Array(witness), { keccak: (oracleHash === "keccak"), starknet: (oracleHash === "starknet") });
   assert(proof.proof.length === UH_PROOF_LENGTH_IN_BYTES, `Unexpected proof length ${proof.proof.length} for ${bytecodePath}`);
 
   await fs.writeFile(proofPath(outputDirectory), Buffer.from(proof.proof));
@@ -45,7 +45,7 @@ async function generateProof({
   await fs.writeFile(publicInputsPath(outputDirectory), JSON.stringify(proof.publicInputs));
   debug("Public inputs written to " + publicInputsPath(outputDirectory));
 
-  const verificationKey = await backend.getVerificationKey({ keccak: (oracleHash === "keccak") });
+  const verificationKey = await backend.getVerificationKey({ keccak: (oracleHash === "keccak"), starknet: (oracleHash === "starknet") });
   await fs.writeFile(vkeyPath(outputDirectory), Buffer.from(verificationKey));
   debug("Verification key written to " + vkeyPath(outputDirectory));
 

barretenberg/acir_tests/bootstrap.sh

@@ -184,6 +184,7 @@ function test_cmds_internal {
   echo SYS=ultra_honk FLOW=prove_then_verify RECURSIVE=true $run_test assert_statement
   echo SYS=ultra_honk FLOW=prove_then_verify RECURSIVE=true $run_test double_verify_honk_proof
   echo SYS=ultra_honk FLOW=prove_then_verify HASH=keccak $run_test assert_statement
+  echo SYS=ultra_honk FLOW=prove_then_verify HASH=starknet $run_test assert_statement
   echo SYS=ultra_honk FLOW=prove_then_verify ROLLUP=true $run_test verify_rollup_honk_proof
 
   # prove and verify using bb.js classes

barretenberg/cpp/src/CMakeLists.txt

@@ -134,6 +134,7 @@ set(BARRETENBERG_TARGET_OBJECTS
     $<TARGET_OBJECTS:crypto_keccak_objects>
     $<TARGET_OBJECTS:crypto_pedersen_commitment_objects>
     $<TARGET_OBJECTS:crypto_pedersen_hash_objects>
+    $<TARGET_OBJECTS:crypto_poseidon_objects>
     $<TARGET_OBJECTS:crypto_poseidon2_objects>
     $<TARGET_OBJECTS:crypto_schnorr_objects>
     $<TARGET_OBJECTS:crypto_sha256_objects>

barretenberg/cpp/src/barretenberg/api/api_ultra_honk.cpp

@@ -23,7 +23,7 @@ Circuit _compute_circuit(const std::string& bytecode_path,
                          const bool init_kzg_accumulator)
 {
     uint32_t honk_recursion = 0;
-    if constexpr (IsAnyOf<Flavor, UltraFlavor, UltraKeccakFlavor, UltraKeccakZKFlavor>) {
+    if constexpr (IsAnyOf<Flavor, UltraFlavor, UltraKeccakFlavor, UltraStarknetFlavor, UltraKeccakZKFlavor, UltraStarknetZKFlavor>) {
         honk_recursion = 1;
     } else if constexpr (IsAnyOf<Flavor, UltraRollupFlavor>) {
         honk_recursion = 2;
@@ -144,8 +144,12 @@ void UltraHonkAPI::prove(const Flags& flags,
         _write(_prove<UltraFlavor>(flags.write_vk, init, bytecode_path, witness_path));
     } else if (flags.oracle_hash_type == "keccak" && !flags.zk) {
         _write(_prove<UltraKeccakFlavor>(flags.write_vk, init, bytecode_path, witness_path));
+    } else if (flags.oracle_hash_type == "starknet" && !flags.zk) {
+        _write(_prove<UltraStarknetFlavor>(flags.write_vk, init, bytecode_path, witness_path));
     } else if (flags.oracle_hash_type == "keccak" && flags.zk) {
         _write(_prove<UltraKeccakZKFlavor>(flags.write_vk, init, bytecode_path, witness_path));
+    } else if (flags.oracle_hash_type == "starknet" && flags.zk) {
+        _write(_prove<UltraStarknetZKFlavor>(flags.write_vk, init, bytecode_path, witness_path));
     } else {
         throw_or_abort("Invalid proving options specified in _prove");
     }
@@ -160,14 +164,23 @@ bool UltraHonkAPI::verify(const Flags& flags,
         return _verify<UltraRollupFlavor>(ipa_accumulation, proof_path, vk_path);
     }
     if (flags.zk) {
-        return _verify<UltraKeccakZKFlavor>(ipa_accumulation, proof_path, vk_path);
+        if (flags.oracle_hash_type == "keccak") {
+            return _verify<UltraKeccakZKFlavor>(ipa_accumulation, proof_path, vk_path);
+        }
+        if (flags.oracle_hash_type == "starknet") {
+            return _verify<UltraStarknetZKFlavor>(ipa_accumulation, proof_path, vk_path);
+        }
+        return false;
     }
     if (flags.oracle_hash_type == "poseidon2") {
         return _verify<UltraFlavor>(ipa_accumulation, proof_path, vk_path);
     }
     if (flags.oracle_hash_type == "keccak") {
         return _verify<UltraKeccakFlavor>(ipa_accumulation, proof_path, vk_path);
     }
+    if (flags.oracle_hash_type == "starknet") {
+        return _verify<UltraStarknetFlavor>(ipa_accumulation, proof_path, vk_path);
+    }
     return false;
 }
 
@@ -193,8 +206,12 @@ void UltraHonkAPI::write_vk(const Flags& flags,
         _write(_compute_vk<UltraFlavor>(init, bytecode_path, ""));
     } else if (flags.oracle_hash_type == "keccak" && !flags.zk) {
         _write(_compute_vk<UltraKeccakFlavor>(init, bytecode_path, ""));
+    } else if (flags.oracle_hash_type == "starknet" && !flags.zk) {
+        _write(_compute_vk<UltraStarknetFlavor>(init, bytecode_path, ""));
     } else if (flags.oracle_hash_type == "keccak" && flags.zk) {
         _write(_compute_vk<UltraKeccakZKFlavor>(init, bytecode_path, ""));
+    } else if (flags.oracle_hash_type == "starknet" && flags.zk) {
+        _write(_compute_vk<UltraStarknetZKFlavor>(init, bytecode_path, ""));
     } else {
         throw_or_abort("Invalid proving options specified in _prove");
     }

barretenberg/cpp/src/barretenberg/bb/main.cpp

@@ -146,8 +146,9 @@ int main(int argc, char* argv[])
                          "The hash function used by the prover as random oracle standing in for a verifier's challenge "
                          "generation. Poseidon2 is to be used for proofs that are intended to be verified inside of a "
                          "circuit. Keccak is optimized for verification in an Ethereum smart contract, where Keccak "
-                         "has a privileged position due to the existence of an EVM precompile.")
-            ->check(CLI::IsMember({ "poseidon2", "keccak" }).name("is_member"));
+                         "has a privileged position due to the existence of an EVM precompile. Starknet is optimized "
+                         "for verification in a Starknet smart contract, which can be generated using the Garaga library.")
+            ->check(CLI::IsMember({ "poseidon2", "keccak", "starknet" }).name("is_member"));
     };
 
     const auto add_output_format_option = [&](CLI::App* subcommand) {

barretenberg/cpp/src/barretenberg/commitment_schemes/small_subgroup_ipa/small_subgroup_ipa.cpp

@@ -9,6 +9,7 @@
 #include "barretenberg/stdlib/primitives/curves/grumpkin.hpp"
 #include "barretenberg/stdlib_circuit_builders/mega_zk_flavor.hpp"
 #include "barretenberg/stdlib_circuit_builders/ultra_keccak_zk_flavor.hpp"
+#include "barretenberg/stdlib_circuit_builders/ultra_starknet_zk_flavor.hpp"
 #include "barretenberg/stdlib_circuit_builders/ultra_zk_flavor.hpp"
 #include "barretenberg/sumcheck/zk_sumcheck_data.hpp"
 #include "barretenberg/translator_vm/translator_flavor.hpp"
@@ -440,6 +441,7 @@ template class SmallSubgroupIPAProver<TranslatorFlavor>;
 template class SmallSubgroupIPAProver<MegaZKFlavor>;
 template class SmallSubgroupIPAProver<UltraZKFlavor>;
 template class SmallSubgroupIPAProver<UltraKeccakZKFlavor>;
+template class SmallSubgroupIPAProver<UltraStarknetZKFlavor>;
 
 // Instantiations used in tests
 template class SmallSubgroupIPAProver<BN254Settings>;

barretenberg/cpp/src/barretenberg/crypto/CMakeLists.txt

@@ -11,6 +11,7 @@ add_subdirectory(sha256)
 add_subdirectory(ecdsa)
 add_subdirectory(aes128)
 add_subdirectory(poseidon2)
+add_subdirectory(poseidon)
 
 if (NOT WASM)
     add_subdirectory(merkle_tree)

barretenberg/cpp/src/barretenberg/crypto/poseidon/CMakeLists.txt

@@ -0,0 +1 @@
+barretenberg_module(crypto_poseidon)

barretenberg/cpp/src/barretenberg/crypto/poseidon/poseidon.cpp

@@ -0,0 +1,61 @@
+#include "poseidon.hpp"
+
+namespace bb::crypto {
+
+template <typename Params>
+typename Poseidon<Params>::FF Poseidon<Params>::hash(const std::vector<typename Poseidon<Params>::FF>& input)
+{
+    return Sponge::hash_internal(input);
+}
+
+template <typename Params>
+typename Poseidon<Params>::FF Poseidon<Params>::hash(const std::vector<typename Poseidon<Params>::FF>& input, FF iv)
+{
+    return Sponge::hash_internal(input, iv);
+}
+
+template class Poseidon<PoseidonStark252BaseFieldParams>;
+
+PoseidonHash poseidon_stark252(const std::vector<uint8_t>& input)
+{
+    assert(input.size() % 32 == 0);
+
+    using Poseidon = Poseidon<PoseidonStark252BaseFieldParams>;
+    using FF = Poseidon::FF;
+
+    FF iv = FF(1);
+
+    size_t elem_count = input.size() / 32;
+    std::vector<FF> elems(2 * (1 + elem_count));
+
+    elems[0] = FF(std::string("0x0000000000000000000000000000000000000000537461726b6e6574486f6e6b")); // "StarknetHonk"
+    elems[1] = FF(0);
+
+    for (size_t k = 0; k < input.size() / 32; ++k) {
+        std::array<uint8_t, 32> limb_lo = {};
+        std::array<uint8_t, 32> limb_hi = {};
+
+        for (size_t i = 16; i < 32; ++i) {
+            limb_hi[i] = input[k * 32 + i - 16];
+            limb_lo[i] = input[k * 32 + i];
+        }
+
+        FF limb0 = from_buffer<FF>(limb_lo);
+        FF limb1 = from_buffer<FF>(limb_hi);
+
+        elems[2 * (1 + k) + 0] = limb0;
+        elems[2 * (1 + k) + 1] = limb1;
+    }
+
+    FF output = Poseidon::hash(elems, iv);
+
+    std::vector<uint8_t> digest = to_buffer(output);
+
+    PoseidonHash result;
+    for (size_t i = 0; i < 32; ++i) {
+        result[i] = digest[i];
+    }
+    return result;
+}
+
+} // namespace bb::crypto

barretenberg/cpp/src/barretenberg/crypto/poseidon/poseidon.hpp

@@ -0,0 +1,29 @@
+#pragma once
+
+#include <array>
+#include <cstdint>
+#include <vector>
+#include "poseidon_params.hpp"
+#include "poseidon_permutation.hpp"
+#include "barretenberg/crypto/poseidon2/sponge/sponge.hpp"
+
+namespace bb::crypto {
+
+template <typename Params> class Poseidon {
+  public:
+    using FF = typename Params::FF;
+
+    using Sponge = FieldSponge<FF, Params::t - 1, 1, Params::t, PoseidonPermutation<Params>>;
+
+    static FF hash(const std::vector<FF>& input);
+
+    static FF hash(const std::vector<FF>& input, FF iv);
+};
+
+extern template class Poseidon<PoseidonStark252BaseFieldParams>;
+
+using PoseidonHash = std::array<uint8_t, 32>;
+
+PoseidonHash poseidon_stark252(const std::vector<uint8_t>& input);
+
+} // namespace bb::crypto

barretenberg/cpp/src/barretenberg/crypto/poseidon/poseidon.test.cpp

@@ -0,0 +1,47 @@
+#include "poseidon.hpp"
+#include "barretenberg/crypto/poseidon/poseidon_params.hpp"
+#include "barretenberg/ecc/curves/stark252/stark252.hpp"
+#include <gtest/gtest.h>
+
+using namespace bb;
+
+namespace {
+auto& engine = numeric::get_debug_randomness();
+}
+
+TEST(Poseidon, HashBasicTests)
+{
+    using fq = stark252::fq;
+
+    fq a = fq::random_element(&engine);
+    fq b = fq::random_element(&engine);
+    fq c = fq::random_element(&engine);
+    fq d = fq::random_element(&engine);
+
+    std::vector<fq> input1{ a, b, c, d };
+    std::vector<fq> input2{ d, c, b, a };
+
+    auto r0 = crypto::Poseidon<crypto::PoseidonStark252BaseFieldParams>::hash(input1);
+    auto r1 = crypto::Poseidon<crypto::PoseidonStark252BaseFieldParams>::hash(input1);
+    auto r2 = crypto::Poseidon<crypto::PoseidonStark252BaseFieldParams>::hash(input2);
+
+    EXPECT_EQ(r0, r1);
+    EXPECT_NE(r0, r2);
+}
+
+TEST(Poseidon, HashConsistencyCheck)
+{
+    using fq = stark252::fq;
+
+    fq a(std::string("9a807b615c4d3e2fa0b1c2d3e4f56789fedcba9876543210abcdef0123456789"));
+    fq b(std::string("9a807b615c4d3e2fa0b1c2d3e4f56789fedcba9876543210abcdef0123456789"));
+    fq c(std::string("0x9a807b615c4d3e2fa0b1c2d3e4f56789fedcba9876543210abcdef0123456789"));
+    fq d(std::string("0x9a807b615c4d3e2fa0b1c2d3e4f56789fedcba9876543210abcdef0123456789"));
+
+    std::vector<fq> input{ a, b, c, d };
+    auto result = crypto::Poseidon<crypto::PoseidonStark252BaseFieldParams>::hash(input);
+
+    fq expected(std::string("0x0494e3a5a8047943395f79e41f11ba73285be9aa930953fbad060c0649a7c79d"));
+
+    EXPECT_EQ(result, expected);
+}