feat: zk sumcheck

barretenberg/cpp/docs/Doxyfile

@@ -1355,7 +1355,7 @@ HTML_EXTRA_FILES =
 # The default value is: AUTO_LIGHT.
 # This tag requires that the tag GENERATE_HTML is set to YES.
 
-HTML_COLORSTYLE = AUTO_LIGHT
+HTML_COLORSTYLE = TOGGLE
 
 # The HTML_COLORSTYLE_HUE tag controls the color of the HTML output. Doxygen
 # will adjust the colors in the style sheet and background images according to

barretenberg/cpp/src/barretenberg/eccvm/eccvm_flavor.hpp

@@ -38,6 +38,8 @@ class ECCVMFlavor {
     using RelationSeparator = FF;
     using MSM = bb::eccvm::MSM<CycleGroup>;
 
+    // Indicates that this flavor runs with non-ZK Sumcheck.
+    static constexpr bool HasZK = false;
     static constexpr size_t NUM_WIRES = 85;
 
     // The number of multivariate polynomials on which a sumcheck prover sumcheck operates (including shifts). We often
@@ -49,6 +51,8 @@ class ECCVMFlavor {
     static constexpr size_t NUM_PRECOMPUTED_ENTITIES = 3;
     // The total number of witness entities not including shifts.
     static constexpr size_t NUM_WITNESS_ENTITIES = 87;
+    // The total number of witnesses including shifts and derived entities.
+    static constexpr size_t NUM_ALL_WITNESSES = 113;
 
     using GrandProductRelations = std::tuple<ECCVMSetRelation<FF>>;
     // define the tuple of Relations that comprise the Sumcheck relation
@@ -312,6 +316,14 @@ class ECCVMFlavor {
         auto get_to_be_shifted() { return ECCVMFlavor::get_to_be_shifted<DataType>(*this); }
         auto get_shifted() { return ShiftedEntities<DataType>::get_all(); };
         auto get_precomputed() { return PrecomputedEntities<DataType>::get_all(); };
+        // the getter for all witnesses including derived and shifted ones
+        auto get_all_witnesses()
+        {
+            return concatenate(ShiftedEntities<DataType>::get_all(),
+                               WireEntities<DataType>::get_all(),
+                               DerivedWitnessEntities<DataType>::get_all());
+        };
+        auto get_non_witnesses() { return PrecomputedEntities<DataType>::get_all(); };
     };
 
   public:
@@ -1297,4 +1309,4 @@ class ECCVMFlavor {
 
 // NOLINTEND(cppcoreguidelines-avoid-const-or-ref-data-members)
 
-} // namespace bb
+} // namespace bb

barretenberg/cpp/src/barretenberg/eccvm_recursion/eccvm_recursive_flavor.hpp

@@ -33,6 +33,8 @@ template <typename BuilderType> class ECCVMRecursiveFlavor_ {
     using NativeVerificationKey = NativeFlavor::VerificationKey;
     using PCS = IPA<Curve>;
 
+    // Indicates that this flavor runs with non-ZK Sumcheck.
+    static constexpr bool HasZK = false;
     static constexpr size_t NUM_WIRES = ECCVMFlavor::NUM_WIRES;
     // The number of multivariate polynomials on which a sumcheck prover sumcheck operates (including shifts). We often
     // need containers of this size to hold related data, so we choose a name more agnostic than `NUM_POLYNOMIALS`.
@@ -130,4 +132,4 @@ template <typename BuilderType> class ECCVMRecursiveFlavor_ {
 
 }; // NOLINTEND(cppcoreguidelines-avoid-const-or-ref-data-members)
 
-} // namespace bb
+} // namespace bb

barretenberg/cpp/src/barretenberg/flavor/flavor.hpp

@@ -48,7 +48,7 @@
  * @note It would be ideal to codify more structure in these base class template and to have it imposed on the actual
  * flavors, but our inheritance model is complicated as it is, and we saw no reasonable way to fix this.
  *
- * @note One asymmetry to note is in the use of the term "key". It is worthwhile to distinguish betwen prover/verifier
+ * @note One asymmetry to note is in the use of the term "key". It is worthwhile to distinguish between prover/verifier
  * circuit data, and "keys" that consist of such data augmented with witness data (whether, raw, blinded, or polynomial
  * commitments). Currently the proving key contains witness data, while the verification key does not.
  * TODO(Cody): It would be nice to resolve this but it's not essential.
@@ -292,6 +292,27 @@ template <typename Tuple, std::size_t Index = 0> static constexpr size_t compute
         return subrelations_in_relation + compute_number_of_subrelations<Tuple, Index + 1>();
     }
 }
+
+/**
+ * @brief Takes a Tuple of objects in the Relation class and recursively computes the maximum among partial subrelation
+ lengths incremented by corresponding subrelation witness degrees over all
+ * subrelations of given relations. This method is required to compute the size of
+ * Round Univariates in ZK Sumcheck.
+ * @tparam Tuple
+ * @tparam Index
+ * @return constexpr size_t
+ */
+template <typename Tuple, std::size_t Index = 0> static constexpr size_t compute_max_zk_length()
+{
+    if constexpr (Index >= std::tuple_size<Tuple>::value) {
+        return 0; // Return 0 when reach end of the tuple
+    } else {
+        constexpr size_t current_witness_degree = std::tuple_element<Index, Tuple>::type::ZK_TOTAL_RELATION_LENGTH;
+        constexpr size_t next_witness_degree = compute_max_zk_length<Tuple, Index + 1>();
+        return (current_witness_degree > next_witness_degree) ? current_witness_degree : next_witness_degree;
+    }
+}
+
 /**
  * @brief Recursive utility function to construct a container for the subrelation accumulators of Protogalaxy folding.
  * @details The size of the outer tuple is equal to the number of relations. Each relation contributes an inner tuple of
@@ -334,6 +355,26 @@ template <typename Tuple, std::size_t Index = 0> static constexpr auto create_su
     }
 }
 
+/**
+ * @brief Recursive utility function to construct a container for the subrelation accumulators of ZK Sumcheck prover.
+ * @details The size of the outer tuple is equal to the number of relations. Each relation contributes an inner tuple of
+ * univariates whose size is equal to the number of subrelations of the relation. The length of a univariate in an inner
+ * tuple is determined by the corresponding zk subrelation length, i.e. by the subrelation partial length corrected by
+ * the corresponding witness degree.
+ */
+template <typename Tuple, std::size_t Index = 0>
+static constexpr auto create_zk_sumcheck_tuple_of_tuples_of_univariates()
+{
+    if constexpr (Index >= std::tuple_size<Tuple>::value) {
+        return std::tuple<>{}; // Return empty when reach end of the tuple
+    } else {
+        using UnivariateTuple =
+            typename std::tuple_element_t<Index, Tuple>::ZKSumcheckTupleOfUnivariatesOverSubrelations;
+        return std::tuple_cat(std::tuple<UnivariateTuple>{},
+                              create_zk_sumcheck_tuple_of_tuples_of_univariates<Tuple, Index + 1>());
+    }
+}
+
 /**
  * @brief Recursive utility function to construct tuple of arrays
  * @details Container for storing value of each identity in each relation. Each Relation contributes an array of
@@ -354,6 +395,7 @@ template <typename Tuple, std::size_t Index = 0> static constexpr auto create_tu
 // Forward declare honk flavors
 namespace bb {
 class UltraFlavor;
+class UltraFlavorWithZK;
 class ECCVMFlavor;
 class MegaFlavor;
 class TranslatorFlavor;
@@ -386,13 +428,13 @@ template <typename T>
 concept IsUltraPlonkFlavor = IsAnyOf<T, plonk::flavor::Ultra>;
 
 template <typename T> 
-concept IsUltraPlonkOrHonk = IsAnyOf<T, plonk::flavor::Ultra, UltraFlavor, MegaFlavor>;
+concept IsUltraPlonkOrHonk = IsAnyOf<T, plonk::flavor::Ultra, UltraFlavor, UltraFlavorWithZK, MegaFlavor>;
 
 template <typename T> 
-concept IsHonkFlavor = IsAnyOf<T, UltraFlavor, MegaFlavor>;
+concept IsHonkFlavor = IsAnyOf<T, UltraFlavor, UltraFlavorWithZK, MegaFlavor>;
 
 template <typename T> 
-concept IsUltraFlavor = IsAnyOf<T, UltraFlavor, MegaFlavor>;
+concept IsUltraFlavor = IsAnyOf<T, UltraFlavor, UltraFlavorWithZK, MegaFlavor, UltraFlavorWithZK>;
 
 template <typename T> 
 concept IsGoblinFlavor = IsAnyOf<T, MegaFlavor,
@@ -417,6 +459,7 @@ template <typename T> concept IsECCVMRecursiveFlavor = IsAnyOf<T, ECCVMRecursive
 template <typename T> concept IsGrumpkinFlavor = IsAnyOf<T, ECCVMFlavor>;
 
 template <typename T> concept IsFoldingFlavor = IsAnyOf<T, UltraFlavor, 
+                                                           UltraFlavorWithZK,
                                                            MegaFlavor, 
                                                            UltraRecursiveFlavor_<UltraCircuitBuilder>, 
                                                            UltraRecursiveFlavor_<MegaCircuitBuilder>, 

barretenberg/cpp/src/barretenberg/relations/relation_types.hpp

@@ -30,6 +30,10 @@ concept HasSubrelationLinearlyIndependentMember = requires(T) {
 
 template <typename T>
 concept HasParameterLengthAdjustmentsMember = requires { T::TOTAL_LENGTH_ADJUSTMENTS; };
+// The concept needed to adjust the sumcheck univariate lengths in the case of ZK Flavors and to avoid adding redundant
+// constants to the relations that are not used by ZK flavors
+template <typename T>
+concept HasWitnessDegrees = requires { T::SUBRELATION_WITNESS_DEGREES; };
 
 /**
  * @brief Check whether a given subrelation is linearly independent from the other subrelations.
@@ -66,6 +70,27 @@ consteval std::array<size_t, RelationImpl::SUBRELATION_PARTIAL_LENGTHS.size()> c
         return RelationImpl::SUBRELATION_PARTIAL_LENGTHS;
     }
 };
+/**
+ * @brief This metod adjusts the subrelation partial lengths to ZK Flavors.
+ *
+ * @tparam RelationImpl
+ * @return consteval
+ */
+template <typename RelationImpl>
+consteval std::array<size_t, RelationImpl::SUBRELATION_PARTIAL_LENGTHS.size()> compute_zk_partial_subrelation_lengths()
+{
+    if constexpr (HasWitnessDegrees<RelationImpl>) {
+        constexpr size_t NUM_SUBRELATIONS = RelationImpl::SUBRELATION_PARTIAL_LENGTHS.size();
+        std::array<size_t, NUM_SUBRELATIONS> result;
+        for (size_t idx = 0; idx < NUM_SUBRELATIONS; idx++) {
+            result[idx] =
+                RelationImpl::SUBRELATION_PARTIAL_LENGTHS[idx] + RelationImpl::SUBRELATION_WITNESS_DEGREES[idx];
+        }
+        return result;
+    } else {
+        return RelationImpl::SUBRELATION_PARTIAL_LENGTHS;
+    }
+};
 
 /**
  * @brief Get the subrelation accumulators for the Protogalaxy combiner calculation.
@@ -139,12 +164,18 @@ template <typename RelationImpl> class Relation : public RelationImpl {
 
     static constexpr std::array<size_t, RelationImpl::SUBRELATION_PARTIAL_LENGTHS.size()> SUBRELATION_TOTAL_LENGTHS =
         compute_total_subrelation_lengths<RelationImpl>();
+    // Compute the subrelation partial lengths adjusted to ZK
+    static constexpr std::array<size_t, RelationImpl::SUBRELATION_PARTIAL_LENGTHS.size()> ZK_PARTIAL_LENGTHS =
+        compute_zk_partial_subrelation_lengths<RelationImpl>();
 
     static constexpr size_t RELATION_LENGTH = *std::max_element(RelationImpl::SUBRELATION_PARTIAL_LENGTHS.begin(),
                                                                 RelationImpl::SUBRELATION_PARTIAL_LENGTHS.end());
 
     static constexpr size_t TOTAL_RELATION_LENGTH =
         *std::max_element(SUBRELATION_TOTAL_LENGTHS.begin(), SUBRELATION_TOTAL_LENGTHS.end());
+    // Determine the maximum subrelation length in the case if ZK Flavors
+    static constexpr size_t ZK_TOTAL_RELATION_LENGTH =
+        *std::max_element(ZK_PARTIAL_LENGTHS.begin(), ZK_PARTIAL_LENGTHS.end());
 
     template <size_t NUM_INSTANCES>
     using ProtogalaxyTupleOfUnivariatesOverSubrelations =
@@ -157,6 +188,10 @@ template <typename RelationImpl> class Relation : public RelationImpl {
                                     NUM_INSTANCES - 1>;
     using SumcheckTupleOfUnivariatesOverSubrelations =
         TupleOfUnivariates<FF, RelationImpl::SUBRELATION_PARTIAL_LENGTHS>;
+    // The containter constructor for sumcheck univariates corresponding to each subrelation in ZK Flavor's relations
+    using ZKSumcheckTupleOfUnivariatesOverSubrelations =
+        TupleOfUnivariates<FF, compute_zk_partial_subrelation_lengths<RelationImpl>()>;
+
     using SumcheckArrayOfValuesOverSubrelations = ArrayOfValues<FF, RelationImpl::SUBRELATION_PARTIAL_LENGTHS>;
 
     // These are commonly needed, most importantly, for explicitly instantiating

barretenberg/cpp/src/barretenberg/stdlib_circuit_builders/mega_flavor.hpp

@@ -36,6 +36,8 @@ class MegaFlavor {
     using CommitmentKey = bb::CommitmentKey<Curve>;
     using VerifierCommitmentKey = bb::VerifierCommitmentKey<Curve>;
 
+    // Indicates that this flavor runs with non-ZK Sumcheck.
+    static constexpr bool HasZK = false;
     static constexpr size_t NUM_WIRES = CircuitBuilder::NUM_WIRES;
     // The number of multivariate polynomials on which a sumcheck prover sumcheck operates (including shifts). We often
     // need containers of this size to hold related data, so we choose a name more agnostic than `NUM_POLYNOMIALS`.
@@ -74,6 +76,8 @@ class MegaFlavor {
     static constexpr size_t BATCHED_RELATION_PARTIAL_LENGTH = MAX_PARTIAL_RELATION_LENGTH + 1;
     static constexpr size_t BATCHED_RELATION_TOTAL_LENGTH = MAX_TOTAL_RELATION_LENGTH + 1;
     static constexpr size_t NUM_RELATIONS = std::tuple_size_v<Relations>;
+    // The total number of witnesses including shifts and derived entities.
+    static constexpr size_t NUM_ALL_WITNESSES = 23;
 
     // For instances of this flavour, used in folding, we need a unique sumcheck batching challenges for each
     // subrelation. This
@@ -287,6 +291,75 @@ class MegaFlavor {
         };
         auto get_precomputed() { return PrecomputedEntities<DataType>::get_all(); }
         auto get_shifted() { return ShiftedEntities<DataType>::get_all(); };
+        // this getter is used in ZK Sumcheck, where all witness evaluations (including shifts) have to be masked
+        auto get_all_witnesses()
+        {
+            return RefArray{
+                this->w_l,                     // column 0
+                this->w_r,                     // column 1
+                this->w_o,                     // column 2
+                this->w_4,                     // column 3
+                this->z_perm,                  // column 4
+                this->lookup_inverses,         // column 5
+                this->lookup_read_counts,      // column 6
+                this->lookup_read_tags,        // column 7
+                this->ecc_op_wire_1,           // column 8
+                this->ecc_op_wire_2,           // column 9
+                this->ecc_op_wire_3,           // column 10
+                this->ecc_op_wire_4,           // column 11
+                this->calldata,                // column 12
+                this->calldata_read_counts,    // column 13
+                this->calldata_inverses,       // column 14
+                this->return_data,             // column 15
+                this->return_data_read_counts, // column 16
+                this->return_data_inverses,    // column 17
+                this->w_l_shift,               // column 18
+                this->w_r_shift,               // column 19
+                this->w_o_shift,               // column 20
+                this->w_4_shift,               // column 21
+                this->z_perm_shift             // column 22
+            };
+        };
+        // this getter is used in ZK sumcheck as a countepart to get_all_witnesses
+        auto get_non_witnesses()
+        {
+            return RefArray{
+                this->q_m,                  // column 0
+                this->q_c,                  // column 1
+                this->q_l,                  // column 2
+                this->q_r,                  // column 3
+                this->q_o,                  // column 4
+                this->q_4,                  // column 5
+                this->q_arith,              // column 6
+                this->q_delta_range,        // column 7
+                this->q_elliptic,           // column 8
+                this->q_aux,                // column 9
+                this->q_lookup,             // column 10
+                this->q_busread,            // column 11
+                this->q_poseidon2_external, // column 12
+                this->q_poseidon2_internal, // column 13
+                this->sigma_1,              // column 14
+                this->sigma_2,              // column 15
+                this->sigma_3,              // column 16
+                this->sigma_4,              // column 17
+                this->id_1,                 // column 18
+                this->id_2,                 // column 19
+                this->id_3,                 // column 20
+                this->id_4,                 // column 21
+                this->table_1,              // column 22
+                this->table_2,              // column 23
+                this->table_3,              // column 24
+                this->table_4,              // column 25
+                this->lagrange_first,       // column 26
+                this->lagrange_last,        // column 27
+                this->lagrange_ecc_op,      // column 28, indicator poly for ecc op gates
+                this->databus_id,           // column 29, id polynomial, i.e. id_i = i
+                this->table_1,              // column 30
+                this->table_2,              // column 31
+                this->table_3,              // column 32
+                this->table_4,              // column 23
+            };
+        };
     };
 
     /**

barretenberg/cpp/src/barretenberg/stdlib_circuit_builders/mega_recursive_flavor.hpp

@@ -43,7 +43,8 @@ template <typename BuilderType> class MegaRecursiveFlavor_ {
 
     // Note(luke): Eventually this may not be needed at all
     using VerifierCommitmentKey = bb::VerifierCommitmentKey<NativeFlavor::Curve>;
-
+    // Indicates that this flavor runs with non-ZK Sumcheck.
+    static constexpr bool HasZK = false;
     static constexpr size_t NUM_WIRES = MegaFlavor::NUM_WIRES;
     // The number of multivariate polynomials on which a sumcheck prover sumcheck operates (including shifts). We often
     // need containers of this size to hold related data, so we choose a name more agnostic than `NUM_POLYNOMIALS`.
@@ -199,4 +200,4 @@ template <typename BuilderType> class MegaRecursiveFlavor_ {
     using Transcript = bb::BaseTranscript<bb::stdlib::recursion::honk::StdlibTranscriptParams<CircuitBuilder>>;
 };
 
-} // namespace bb
+} // namespace bb