Upgrade 5

[roynalnaruto]

Description

The batch circuit now supports aggregation of chunk SNARKS (layer-2) that can belong to either of the following routes:

1. super circuit -> compression circuit -> compression circuit
2. sp1 -> halo2-backend -> compression circuit`

Prior, since only route 1 existed, the SNARK protocol was loaded as a constant. The fundamental change made in snark-verifier (scroll-tech/snark-verifier#39) is to expose a aggregate_as_witness method that loads the SNARK protocols as witness instead.

In the batch circuit, we add the following constraints:

# for each layer-2 SNARK's transcript initial state and preprocessed polynomials
# together known as the SNARK protocol
for init_state, preprocessed_polys in zip(transcript_init_states, preprocessed_polys_set):
	# each preprocessed polynomial
	route_check_halo2 = 1
	for i, poly in enumerate(preprocessed_polys):
		# belongs to either the halo2-route or the sp1-route 
		assert(poly in [POLY_HALO2[i], POLY_SP1[i]])
		# is this SNARK from the halo2-route?
		route_check_halo2 = route_check_halo2 * (poly == POLY_HALO2[i])
	
	# if the SNARK is from the halo2-route
	if route_check_halo2:
		assert(init_state == INIT_STATE_HALO2)
	else:
		assert(init_state == INIT_STATE_SP1)

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

[lispc]

btw.. if i provide curie-chunk-circuit as HALO2_PROTOCOL, and darwin-chunk-circuit as SP1_PROTOCOL, actually the batch circuit can verify either curie chunks or darwin chunks?

so if we think more generally, the batch circuit is just a one-in-many mixer.

[roynalnaruto]

@lispc

btw.. if i provide curie-chunk-circuit as HALO2_PROTOCOL, and darwin-chunk-circuit as SP1_PROTOCOL, actually the batch circuit can verify either curie chunks or darwin chunks?

Technically, yes. But as of the current changes the batch circuit supports only 2 variants, which I have called halo2 and sp1. May be in a separate PR we can change it to some other naming that sounds more generic for variants of chunk circuits.