diff --git a/.github/scripts/aggregate_recursion_histogram.py b/.github/scripts/aggregate_recursion_histogram.py
new file mode 100755
index 000000000..0be0a3010
--- /dev/null
+++ b/.github/scripts/aggregate_recursion_histogram.py
@@ -0,0 +1,180 @@
+#!/usr/bin/env python3
+"""Format the recursion-guest per-function profile as a Markdown PR comment.
+
+`test_recursion_profile_1query`/`_multiquery` print a global top-25 functions
+table (folded over all verifier steps, % of total run cycles), followed by
+one top-25 table per verifier step (% of that step's own cycles, so the
+table shows what dominates *within* the step) — e.g. how much of
+`step4:openings` is `keccak`. We parse all of those tables and render them
+as Markdown.
+
+ Top 25 functions by cycle count (aggregated over their PCs, all steps; % of total cycles):
+ rank cycles % cum % PCs function
+ 1 5335072 24.95% 24.95% 72 <...>::visit_seq::<...>
+
+ Top 25 functions by cycle count — step airs_bus_balance (% of this step's 5129138364 cycles):
+ rank cycles % cum % PCs function
+ 1 5335072 24.95% 24.95% 72 <...>::visit_seq::<...>
+
+Reads the test's captured output from argv[1]; writes the Markdown body to
+argv[2] (or stdout).
+"""
+
+import re
+import sys
+from collections import OrderedDict
+
+# A per-function summary row: rank, cycles, pct%, cum%, pcs, function.
+FN_ROW = re.compile(
+ r"^\s*\d+\s+(\d+)\s+([\d.]+)%\s+([\d.]+)%\s+(\d+)\s+(.*\S)\s*$"
+)
+HEADER_ROW = re.compile(r"^\s*rank\s+cycles")
+GLOBAL_TABLE_START = re.compile(
+ r"Top \d+ functions by cycle count \(aggregated over their PCs, all steps"
+)
+STEP_TABLE_START = re.compile(
+ r"Top \d+ functions by cycle count — step (\S+) \(% of this step's (\d+) cycles\):"
+)
+TOTAL_CYCLES = re.compile(r"Total cycles\s*:\s*(\d+)")
+UNIQUE_PCS = re.compile(r"Unique PCs\s*:\s*(\d+)")
+EXEC_TIME = re.compile(r"Exec time\s*:\s*(\S+)")
+
+GLOBAL_KEY = "__global__"
+
+
+def parse(text):
+ total_cycles = unique_pcs = exec_time = None
+ # GLOBAL_KEY -> {"denom": int|None, "rows": [...]}, then one entry per
+ # step tag in first-seen order.
+ tables = OrderedDict()
+ current = None
+ skip_header = False
+ for line in text.splitlines():
+ if total_cycles is None and (m := TOTAL_CYCLES.search(line)):
+ total_cycles = int(m.group(1))
+ if unique_pcs is None and (m := UNIQUE_PCS.search(line)):
+ unique_pcs = int(m.group(1))
+ if exec_time is None and (m := EXEC_TIME.search(line)):
+ exec_time = m.group(1)
+
+ if GLOBAL_TABLE_START.search(line):
+ current = GLOBAL_KEY
+ tables[current] = {"denom": total_cycles, "rows": []}
+ skip_header = True
+ continue
+ if m := STEP_TABLE_START.search(line):
+ current = m.group(1)
+ tables[current] = {"denom": int(m.group(2)), "rows": []}
+ skip_header = True
+ continue
+
+ if current is None:
+ continue
+ if skip_header:
+ # The header row right after a table-start line; anything else
+ # (e.g. a stray blank line) just ends the table early, which is
+ # fine — an empty table renders as "no rows".
+ skip_header = False
+ if HEADER_ROW.match(line):
+ continue
+ if m := FN_ROW.match(line):
+ tables[current]["rows"].append(
+ {
+ "cycles": int(m.group(1)),
+ "pct": m.group(2),
+ "cum": m.group(3),
+ "pcs": int(m.group(4)),
+ "fn": m.group(5),
+ }
+ )
+ else:
+ current = None
+
+ return total_cycles, unique_pcs, exec_time, tables
+
+
+def short(name, width=90):
+ return name if len(name) <= width else name[: width - 1] + "…"
+
+
+def render_table(rows, denom_label):
+ if not rows:
+ return "> _no rows_\n"
+ body = "| Rank | Cycles | % | Cum % | PCs | Function |\n"
+ body += "|-----:|-------:|--:|------:|----:|----------|\n"
+ for i, r in enumerate(rows, 1):
+ body += (
+ f"| {i} | {r['cycles']:,} | {r['pct']}% | {r['cum']}% | "
+ f"{r['pcs']} | `{short(r['fn'])}` |\n"
+ )
+ last_cum = rows[-1]["cum"]
+ body += (
+ f"\nEach function's cycles are summed over all its program counters "
+ f"in this table's scope; the top {len(rows)} cover {last_cum}% of "
+ f"{denom_label}.\n"
+ )
+ return body
+
+
+def render(total_cycles, unique_pcs, exec_time, tables, title="Recursion guest profile"):
+ if not tables.get(GLOBAL_KEY, {}).get("rows"):
+ return (
+ f"### {title}\n\n"
+ "> ⚠️ No per-function rows found in the test output — the run may "
+ "have failed before printing the table. Check the workflow logs.\n"
+ )
+
+ body = f"### {title}\n\n"
+ if total_cycles is not None:
+ body += f"**Total cycles:** {total_cycles:,}"
+ if unique_pcs is not None:
+ body += f" · **Unique PCs:** {unique_pcs:,}"
+ if exec_time:
+ body += f" · **Exec time:** {exec_time}"
+ body += "\n\n"
+
+ global_rows = tables[GLOBAL_KEY]["rows"]
+ body += f"#### Top {len(global_rows)} functions by cycles (all steps)\n\n"
+ body += render_table(global_rows, "total cycles")
+
+ for step, table in tables.items():
+ if step == GLOBAL_KEY:
+ continue
+ rows, denom = table["rows"], table["denom"]
+ denom_note = f" of {denom:,} step cycles" if denom is not None else ""
+ body += (
+ f"\nStep {step}{denom_note} — "
+ f"top {len(rows)} functions
\n\n"
+ )
+ body += render_table(rows, "this step's cycles")
+ body += "\n for FieldElement
+ where
+ F: IsField,
+ F::BaseType: Serialize,
+ S: rkyv::rancor::Fallible + ?Sized,
+ {
+ #[inline]
+ fn serialize(&self, serializer: &mut S) -> Result {
+ self.value.serialize(serializer)
+ }
+ }
+
+ impl Deserialize, D> for ArchivedFieldElement
+ where
+ F: IsField,
+ F::BaseType: Archive,
+ ::Archived: Deserialize,
+ D: rkyv::rancor::Fallible + ?Sized,
+ {
+ #[inline]
+ fn deserialize(&self, deserializer: &mut D) -> Result, D::Error> {
+ Ok(FieldElement {
+ value: self.value.deserialize(deserializer)?,
+ })
+ }
+ }
+
+ impl ArchivedFieldElement
+ where
+ F: IsField,
+ F::BaseType: Archive,
+ {
+ /// Borrow the archived base-type value (for zero-copy reads).
+ #[inline]
+ pub fn archived_value(&self) -> &::Archived {
+ &self.value
+ }
+ }
+
+ // SAFETY: `#[repr(transparent)]` over the inner archived value, so checking
+ // the inner type's bytes checks the whole newtype.
+ unsafe impl rkyv::bytecheck::CheckBytes for ArchivedFieldElement
+ where
+ F: IsField,
+ F::BaseType: Archive,
+ ::Archived: rkyv::bytecheck::CheckBytes,
+ C: rkyv::rancor::Fallible + ?Sized,
+ {
+ unsafe fn check_bytes(value: *const Self, context: &mut C) -> Result<(), C::Error> {
+ unsafe {
+ <::Archived as rkyv::bytecheck::CheckBytes>::check_bytes(
+ value as *const ::Archived,
+ context,
+ )
+ }
+ }
+ }
+};
+
+// ----------------------------------------------------------------------------
+// Zero-copy native views (little-endian only)
+// ----------------------------------------------------------------------------
+//
+// rkyv archives integers as `rend::*_le` types, which are `#[repr(C, align(N))]`
+// and bit-identical to the native little-endian primitive. `FieldElement` is
+// `#[repr(transparent)]` over `F::BaseType` and `ArchivedFieldElement` is
+// `#[repr(transparent)]` over `::Archived`. So on a
+// little-endian target the two types share size, alignment, and bit layout —
+// an archived field element *is* a native field element. These views let the
+// verifier read field elements straight out of the proof buffer with no copy
+// and no allocation.
+//
+// Restricted to `target_endian = "little"` (the lambda-vm guest target). On a
+// big-endian host these would be wrong, so they simply don't exist there.
+#[cfg(all(feature = "rkyv", target_endian = "little"))]
+impl ArchivedFieldElement
+where
+ F::BaseType: rkyv::Archive,
+{
+ /// Reinterpret this archived element as a native [`FieldElement`] (no copy).
+ ///
+ /// Sound on little-endian: see the module note above.
+ #[inline]
+ pub fn as_native(&self) -> &FieldElement {
+ // SAFETY: identical size/align/bit-layout on little-endian.
+ unsafe { &*(self as *const Self as *const FieldElement) }
+ }
+
+ /// Reinterpret a slice of archived elements as a slice of native
+ /// [`FieldElement`]s (no copy, no allocation).
+ #[inline]
+ pub fn slice_as_native(slice: &[Self]) -> &[FieldElement] {
+ // SAFETY: element-wise identical layout on little-endian, so the slice
+ // (same length, same element stride) reinterprets directly.
+ unsafe {
+ core::slice::from_raw_parts(slice.as_ptr() as *const FieldElement, slice.len())
+ }
+ }
+}
diff --git a/crypto/math/src/field/extensions_goldilocks.rs b/crypto/math/src/field/extensions_goldilocks.rs
index 45fd7274b..feb5c69ed 100644
--- a/crypto/math/src/field/extensions_goldilocks.rs
+++ b/crypto/math/src/field/extensions_goldilocks.rs
@@ -199,6 +199,7 @@ impl IsField for Degree2GoldilocksExtensionField {
}
impl IsSubFieldOf for GoldilocksField {
+ #[inline(always)]
fn mul(
a: &Self::BaseType,
b: &::BaseType,
@@ -208,6 +209,7 @@ impl IsSubFieldOf for GoldilocksField {
[c0, c1]
}
+ #[inline(always)]
fn add(
a: &Self::BaseType,
b: &::BaseType,
@@ -224,6 +226,7 @@ impl IsSubFieldOf for GoldilocksField {
Ok(>::mul(a, &b_inv))
}
+ #[inline(always)]
fn sub(
a: &Self::BaseType,
b: &::BaseType,
@@ -410,6 +413,7 @@ impl IsField for Degree3GoldilocksExtensionField {
}
impl IsSubFieldOf for GoldilocksField {
+ #[inline(always)]
fn mul(
a: &Self::BaseType,
b: &::BaseType,
@@ -420,6 +424,7 @@ impl IsSubFieldOf for GoldilocksField {
[c0, c1, c2]
}
+ #[inline(always)]
fn add(
a: &Self::BaseType,
b: &::BaseType,
@@ -436,6 +441,7 @@ impl IsSubFieldOf for GoldilocksField {
Ok(>::mul(a, &b_inv))
}
+ #[inline(always)]
fn sub(
a: &Self::BaseType,
b: &::BaseType,
diff --git a/crypto/stark/Cargo.toml b/crypto/stark/Cargo.toml
index d0f6a51ef..e205810ae 100644
--- a/crypto/stark/Cargo.toml
+++ b/crypto/stark/Cargo.toml
@@ -9,16 +9,13 @@ crate-type = ["cdylib", "rlib"]
[dependencies]
-math = { path = "../math", features = [
- "std",
- "lambdaworks-serde-binary",
-] }
-crypto = { path = "../crypto", features = ["std", "serde"] }
+math = { path = "../math", features = ["std", "rkyv"] }
+crypto = { path = "../crypto", features = ["std", "rkyv"] }
thiserror = "1.0.38"
log = "0.4.17"
sha3 = "0.10.8"
-serde = { version = "1.0", features = ["derive"] }
itertools = "0.11.0"
+rkyv = { version = "0.8.10", default-features = false, features = ["alloc", "bytecheck", "aligned"] }
# Parallelization crates
rayon = { version = "1.8.0", optional = true }
@@ -32,9 +29,7 @@ math-cuda = { path = "../math-cuda", optional = true }
# wasm
wasm-bindgen = { version = "0.2", optional = true }
-serde-wasm-bindgen = { version = "0.5", optional = true }
web-sys = { version = "0.3.64", features = ['console'], optional = true }
-serde_cbor = { version = "0.11.1" }
[dev-dependencies]
criterion = { version = "0.4", default-features = false }
@@ -48,11 +43,12 @@ rand_chacha = "0.3.1"
test-utils = []
test_fiat_shamir = []
instruments = [] # This enables timing prints in prover and verifier
+profile-markers = [] # Emits inlining-immune asm markers for guest step profiling
debug-checks = [] # Enables validate_trace + bus balance report in prover
parallel = ["dep:rayon", "crypto/parallel"]
cuda = ["dep:math-cuda"]
test-cuda-faults = ["cuda", "math-cuda/test-faults"]
-wasm = ["dep:wasm-bindgen", "dep:serde-wasm-bindgen", "dep:web-sys"]
+wasm = ["dep:wasm-bindgen", "dep:web-sys"]
disk-spill = ["dep:memmap2", "dep:tempfile", "dep:libc", "crypto/disk-spill"]
diff --git a/crypto/stark/src/examples/fibonacci_2_cols_shifted.rs b/crypto/stark/src/examples/fibonacci_2_cols_shifted.rs
index 76c8ea11f..fae17e5ba 100644
--- a/crypto/stark/src/examples/fibonacci_2_cols_shifted.rs
+++ b/crypto/stark/src/examples/fibonacci_2_cols_shifted.rs
@@ -137,7 +137,7 @@ where
}
}
-#[derive(Clone, Debug)]
+#[derive(Clone, Debug, rkyv::Archive, rkyv::Serialize, rkyv::Deserialize)]
pub struct PublicInputs
where
F: IsFFTField,
diff --git a/crypto/stark/src/examples/fibonacci_multi_column.rs b/crypto/stark/src/examples/fibonacci_multi_column.rs
index ac6069ece..43efa8566 100644
--- a/crypto/stark/src/examples/fibonacci_multi_column.rs
+++ b/crypto/stark/src/examples/fibonacci_multi_column.rs
@@ -113,7 +113,7 @@ where
/// Public inputs for the multi-column Fibonacci AIR.
/// Contains the initial values (first two elements) for each column.
-#[derive(Clone, Debug, serde::Serialize, serde::Deserialize)]
+#[derive(Clone, Debug, rkyv::Archive, rkyv::Serialize, rkyv::Deserialize)]
pub struct FibonacciMultiColumnPublicInputs {
/// Initial values for each column: (a0, a1) pairs
pub initial_values: Vec<(FieldElement, FieldElement)>,
diff --git a/crypto/stark/src/examples/fibonacci_rap.rs b/crypto/stark/src/examples/fibonacci_rap.rs
index 10f1827d2..9d359bf26 100644
--- a/crypto/stark/src/examples/fibonacci_rap.rs
+++ b/crypto/stark/src/examples/fibonacci_rap.rs
@@ -164,7 +164,7 @@ where
transition_constraints: Vec>>,
}
-#[derive(Clone, Debug)]
+#[derive(Clone, Debug, rkyv::Archive, rkyv::Serialize, rkyv::Deserialize)]
pub struct FibonacciRAPPublicInputs
where
F: IsFFTField,
diff --git a/crypto/stark/src/examples/quadratic_air.rs b/crypto/stark/src/examples/quadratic_air.rs
index d49b0050d..6a7fcc3da 100644
--- a/crypto/stark/src/examples/quadratic_air.rs
+++ b/crypto/stark/src/examples/quadratic_air.rs
@@ -81,7 +81,7 @@ where
constraints: Vec>>,
}
-#[derive(Clone, Debug)]
+#[derive(Clone, Debug, rkyv::Archive, rkyv::Serialize, rkyv::Deserialize)]
pub struct QuadraticPublicInputs
where
F: IsFFTField,
diff --git a/crypto/stark/src/examples/read_only_memory.rs b/crypto/stark/src/examples/read_only_memory.rs
index 8c3e9efac..eef4b47bc 100644
--- a/crypto/stark/src/examples/read_only_memory.rs
+++ b/crypto/stark/src/examples/read_only_memory.rs
@@ -232,7 +232,7 @@ where
transition_constraints: Vec>>,
}
-#[derive(Clone, Debug)]
+#[derive(Clone, Debug, rkyv::Archive, rkyv::Serialize, rkyv::Deserialize)]
pub struct ReadOnlyPublicInputs
where
F: IsFFTField,
diff --git a/crypto/stark/src/examples/read_only_memory_logup.rs b/crypto/stark/src/examples/read_only_memory_logup.rs
index e4f25c16c..3e90dc89d 100644
--- a/crypto/stark/src/examples/read_only_memory_logup.rs
+++ b/crypto/stark/src/examples/read_only_memory_logup.rs
@@ -360,7 +360,7 @@ where
transition_constraints: Vec>>,
}
-#[derive(Clone, Debug)]
+#[derive(Clone, Debug, rkyv::Archive, rkyv::Serialize, rkyv::Deserialize)]
pub struct LogReadOnlyPublicInputs
where
F: IsFFTField + Send + Sync,
diff --git a/crypto/stark/src/examples/simple_addition.rs b/crypto/stark/src/examples/simple_addition.rs
index 78f938838..a78e71eb2 100644
--- a/crypto/stark/src/examples/simple_addition.rs
+++ b/crypto/stark/src/examples/simple_addition.rs
@@ -83,7 +83,7 @@ where
constraints: Vec>>,
}
-#[derive(Clone, Debug)]
+#[derive(Clone, Debug, rkyv::Archive, rkyv::Serialize, rkyv::Deserialize)]
pub struct SimpleAdditionPublicInputs
where
F: IsFFTField,
diff --git a/crypto/stark/src/examples/simple_fibonacci.rs b/crypto/stark/src/examples/simple_fibonacci.rs
index a39064258..7e7dab641 100644
--- a/crypto/stark/src/examples/simple_fibonacci.rs
+++ b/crypto/stark/src/examples/simple_fibonacci.rs
@@ -82,7 +82,7 @@ where
constraints: Vec>>,
}
-#[derive(Clone, Debug)]
+#[derive(Clone, Debug, rkyv::Archive, rkyv::Serialize, rkyv::Deserialize)]
pub struct FibonacciPublicInputs
where
F: IsFFTField,
diff --git a/crypto/stark/src/examples/simple_periodic_cols.rs b/crypto/stark/src/examples/simple_periodic_cols.rs
index 70f5da3b4..0f5b74af8 100644
--- a/crypto/stark/src/examples/simple_periodic_cols.rs
+++ b/crypto/stark/src/examples/simple_periodic_cols.rs
@@ -100,7 +100,7 @@ where
transition_constraints: Vec>>,
}
-#[derive(Clone, Debug)]
+#[derive(Clone, Debug, rkyv::Archive, rkyv::Serialize, rkyv::Deserialize)]
pub struct SimplePeriodicPublicInputs
where
F: IsFFTField,
diff --git a/crypto/stark/src/fri/fri_decommit.rs b/crypto/stark/src/fri/fri_decommit.rs
index f398096d5..baab2cd4d 100644
--- a/crypto/stark/src/fri/fri_decommit.rs
+++ b/crypto/stark/src/fri/fri_decommit.rs
@@ -4,8 +4,7 @@ use math::field::traits::IsField;
use crate::config::Commitment;
-#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
-#[serde(bound = "")]
+#[derive(Debug, Clone, rkyv::Archive, rkyv::Serialize, rkyv::Deserialize)]
pub struct FriDecommitment {
pub layers_auth_paths: Vec>,
pub layers_evaluations_sym: Vec>,
diff --git a/crypto/stark/src/lib.rs b/crypto/stark/src/lib.rs
index 87236c5f9..2b93f41ba 100644
--- a/crypto/stark/src/lib.rs
+++ b/crypto/stark/src/lib.rs
@@ -21,6 +21,7 @@ pub mod grinding;
pub mod instruments;
pub mod lookup;
pub(crate) mod par;
+pub mod profile_markers;
pub mod proof;
pub mod prover;
pub mod r4_denoms;
diff --git a/crypto/stark/src/lookup.rs b/crypto/stark/src/lookup.rs
index 5174bf66c..8404e9ed3 100644
--- a/crypto/stark/src/lookup.rs
+++ b/crypto/stark/src/lookup.rs
@@ -1394,8 +1394,7 @@ impl BusInteraction {
///
/// For the circular constraint, `table_contribution / N` is the per-row offset
/// that makes the accumulated column wrap to zero at row N-1.
-#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
-#[serde(bound = "")]
+#[derive(Debug, Clone, rkyv::Archive, rkyv::Serialize, rkyv::Deserialize)]
pub struct BusPublicInputs
where
E: IsField,
@@ -1403,20 +1402,45 @@ where
/// Total sum of all LogUp terms across all rows (L).
/// Used for bus balance check and to derive the per-row offset L/N.
pub table_contribution: FieldElement,
- /// Per-bus sums for this table (bus_id → sum) - for debug aggregation
+ /// Per-bus sums for this table (bus_id → sum) - for debug aggregation.
+ /// Debug-only aggregation state; not part of the archived proof (`Skip`).
#[cfg(feature = "debug-checks")]
+ #[rkyv(with = rkyv::with::Skip)]
pub per_bus_sums: HashMap>,
/// Per-bus sender sums (bus_id → sum) - positive contributions
#[cfg(feature = "debug-checks")]
+ #[rkyv(with = rkyv::with::Skip)]
pub per_bus_sender_sums: HashMap>,
/// Per-bus receiver sums (bus_id → sum) - absolute value (before negation)
#[cfg(feature = "debug-checks")]
+ #[rkyv(with = rkyv::with::Skip)]
pub per_bus_receiver_sums: HashMap>,
/// Table name for debug output
#[cfg(feature = "debug-checks")]
+ #[rkyv(with = rkyv::with::Skip)]
pub table_name: String,
}
+impl BusPublicInputs {
+ /// Build a `BusPublicInputs` carrying just the table contribution `L`.
+ /// The debug-only per-bus aggregation fields are defaulted (empty). Used by
+ /// the zero-copy verifier, which reads only `table_contribution` from the
+ /// archived proof.
+ pub fn from_contribution(table_contribution: FieldElement) -> Self {
+ Self {
+ table_contribution,
+ #[cfg(feature = "debug-checks")]
+ per_bus_sums: HashMap::new(),
+ #[cfg(feature = "debug-checks")]
+ per_bus_sender_sums: HashMap::new(),
+ #[cfg(feature = "debug-checks")]
+ per_bus_receiver_sums: HashMap::new(),
+ #[cfg(feature = "debug-checks")]
+ table_name: String::new(),
+ }
+ }
+}
+
/// Trait representing boundary constraint building behaviour.
/// Should be defined when creating an `AirWithBuses` if the AIR requires its own boundary constraints aside from the lookup ones
pub trait BoundaryConstraintBuilder<
diff --git a/crypto/stark/src/profile_markers.rs b/crypto/stark/src/profile_markers.rs
new file mode 100644
index 000000000..570b68641
--- /dev/null
+++ b/crypto/stark/src/profile_markers.rs
@@ -0,0 +1,27 @@
+//! Inlining-immune markers for guest-side step profiling.
+//!
+//! Each marker emits `addi x0, x0, N` on the RISC-V guest: a real instruction
+//! (so it survives inlining and optimization, unlike a removed symbol) that
+//! writes to the zero register and is otherwise a no-op. Real generated code
+//! never emits `addi x0, x0, N` for any nonzero `N` spontaneously (`x0` is
+//! hardwired to zero and writes to it are always discarded), so these values
+//! can't collide with organic instructions. Do not reuse this immediate
+//! encoding space for anything other than step markers.
+//!
+//! Kept separate from the `instruments` feature: `instruments` uses
+//! `std::time::Instant::now()`, which panics on the guest target.
+
+pub const STEP_DECODE_DONE: u32 = 1;
+pub const STEP_AIRS_AND_BUS_BALANCE_DONE: u32 = 2;
+pub const STEP_REPLAY_ROUNDS_AFTER_ROUND_1: u32 = 3;
+pub const STEP_VERIFY_CLAIMED_COMPOSITION_POLYNOMIAL: u32 = 4;
+pub const STEP_VERIFY_FRI: u32 = 5;
+pub const STEP_VERIFY_TRACE_AND_COMPOSITION_OPENINGS: u32 = 6;
+
+#[inline(always)]
+pub fn step_marker() {
+ #[cfg(all(feature = "profile-markers", target_arch = "riscv64"))]
+ unsafe {
+ core::arch::asm!("addi x0, x0, {n}", n = const N);
+ }
+}
diff --git a/crypto/stark/src/proof/options.rs b/crypto/stark/src/proof/options.rs
index 70976b993..2342d5a14 100644
--- a/crypto/stark/src/proof/options.rs
+++ b/crypto/stark/src/proof/options.rs
@@ -39,7 +39,7 @@ impl fmt::Display for ProofOptionsError {
/// - `coset_offset`: the offset for the coset
/// - `grinding_factor`: the number of leading zeros that we want for the Hash(hash || nonce)
#[cfg_attr(feature = "wasm", wasm_bindgen)]
-#[derive(Clone, Debug, serde::Serialize, serde::Deserialize)]
+#[derive(Clone, Debug, PartialEq, Eq, rkyv::Archive, rkyv::Serialize, rkyv::Deserialize)]
pub struct ProofOptions {
pub blowup_factor: u8,
pub fri_number_of_queries: usize,
diff --git a/crypto/stark/src/proof/stark.rs b/crypto/stark/src/proof/stark.rs
index 851c0b37a..4229b2bdb 100644
--- a/crypto/stark/src/proof/stark.rs
+++ b/crypto/stark/src/proof/stark.rs
@@ -8,8 +8,7 @@ use crate::{
config::Commitment, fri::fri_decommit::FriDecommitment, lookup::BusPublicInputs, table::Table,
};
-#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
-#[serde(bound = "")]
+#[derive(Debug, Clone, rkyv::Archive, rkyv::Serialize, rkyv::Deserialize)]
/// Opening of a bit-reversed, row-paired commitment at one FRI query.
///
/// The queried row and its symmetric counterpart (LDE positions `2·iota`,
@@ -22,8 +21,7 @@ pub struct PolynomialOpenings {
pub evaluations_sym: Vec>,
}
-#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
-#[serde(bound = "")]
+#[derive(Debug, Clone, rkyv::Archive, rkyv::Serialize, rkyv::Deserialize)]
pub struct DeepPolynomialOpening, E: IsField> {
pub composition_poly: PolynomialOpenings,
pub main_trace_polys: PolynomialOpenings,
@@ -35,8 +33,7 @@ pub struct DeepPolynomialOpening, E: IsField> {
pub type DeepPolynomialOpenings = Vec>;
-#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
-#[serde(bound = "PI: serde::Serialize + serde::de::DeserializeOwned")]
+#[derive(Debug, Clone, rkyv::Archive, rkyv::Serialize, rkyv::Deserialize)]
pub struct StarkProof, E: IsField, PI> {
// Length of the execution trace
pub trace_length: usize,
@@ -78,8 +75,7 @@ pub struct StarkProof, E: IsField, PI> {
/// A collection of STARK proofs for multiple AIRs.
/// Used for multi-table proving where tables are linked via bus (LogUp).
/// Returned by `Prover::multi_prove` and verified by `Verifier::multi_verify`.
-#[derive(Debug, serde::Serialize, serde::Deserialize)]
-#[serde(bound = "PI: serde::Serialize + serde::de::DeserializeOwned")]
+#[derive(Debug, rkyv::Archive, rkyv::Serialize, rkyv::Deserialize)]
pub struct MultiProof, E: IsField, PI> {
pub proofs: Vec>,
}
diff --git a/crypto/stark/src/table.rs b/crypto/stark/src/table.rs
index dc188d690..93541c65b 100644
--- a/crypto/stark/src/table.rs
+++ b/crypto/stark/src/table.rs
@@ -41,12 +41,18 @@ impl std::fmt::Debug for TableMmapBacking {
/// the STARK protocol implementation, such as the `TraceTable` and the `EvaluationFrame`.
/// Since this struct is a representation of a two-dimensional table, all rows should have the same
/// length.
-#[derive(Default, Debug, serde::Deserialize)]
+#[derive(Default, Debug)]
#[cfg_attr(
not(feature = "disk-spill"),
- derive(serde::Serialize, Clone, PartialEq, Eq)
+ derive(
+ Clone,
+ PartialEq,
+ Eq,
+ rkyv::Archive,
+ rkyv::Serialize,
+ rkyv::Deserialize
+ )
)]
-#[serde(bound = "")]
pub struct Table {
/// Row-major backing store. Crate-private: external callers must go through
/// the spill-safe accessors (`get`/`get_row`/`set`) rather than indexing the
@@ -55,47 +61,140 @@ pub struct Table {
pub width: usize,
pub height: usize,
#[cfg(feature = "disk-spill")]
- #[serde(skip)]
pub(crate) mmap_backing: Option,
}
+// Manual rkyv impl under disk-spill: the derive can't handle `mmap_backing`,
+// and serialization must read through `row_major_data()` so a spilled table
+// archives its mmap contents (deserializing always yields an unspilled table).
+// The archived layout matches what the derive generates without disk-spill, so
+// both configurations produce byte-identical archives.
#[cfg(feature = "disk-spill")]
-impl serde::Serialize for Table
-where
- FieldElement: serde::Serialize,
-{
- fn serialize(&self, serializer: S) -> Result {
- use serde::ser::SerializeStruct;
- let mut s = serializer.serialize_struct("Table", 3)?;
- if self.mmap_backing.is_some() {
- s.serialize_field("data", &MmapDataSeq(self))?;
- } else {
- s.serialize_field("data", &self.data)?;
+mod archived_table {
+ use super::{FieldElement, IsField, Table};
+ use math::field::element::ArchivedFieldElement;
+ use rkyv::rancor::Fallible;
+ use rkyv::ser::{Allocator, Writer};
+ use rkyv::vec::{ArchivedVec, VecResolver};
+ use rkyv::{Archive, Deserialize, Place, Portable, Serialize};
+
+ #[derive(Portable, rkyv::bytecheck::CheckBytes)]
+ #[bytecheck(crate = rkyv::bytecheck)]
+ #[repr(C)]
+ pub struct ArchivedTable
+ where
+ F::BaseType: Archive,
+ {
+ pub data: ArchivedVec>,
+ pub width: rkyv::primitive::ArchivedUsize,
+ pub height: rkyv::primitive::ArchivedUsize,
+ }
+
+ pub struct TableResolver {
+ data: VecResolver,
+ }
+
+ impl Archive for Table
+ where
+ F::BaseType: Archive,
+ {
+ type Archived = ArchivedTable;
+ type Resolver = TableResolver;
+
+ fn resolve(&self, resolver: Self::Resolver, out: Place) {
+ rkyv::munge::munge!(let ArchivedTable { data, width, height } = out);
+ ArchivedVec::resolve_from_len(self.width * self.height, resolver.data, data);
+ self.width.resolve((), width);
+ self.height.resolve((), height);
+ }
+ }
+
+ impl Serialize for Table
+ where
+ F::BaseType: Archive,
+ FieldElement: Serialize,
+ S: Fallible + Allocator + Writer + ?Sized,
+ {
+ fn serialize(&self, serializer: &mut S) -> Result {
+ Ok(TableResolver {
+ data: ArchivedVec::serialize_from_slice(self.row_major_data(), serializer)?,
+ })
+ }
+ }
+
+ impl Deserialize, D> for ArchivedTable
+ where
+ F::BaseType: Archive,
+ ArchivedFieldElement: Deserialize, D>,
+ D: Fallible + ?Sized,
+ {
+ fn deserialize(&self, deserializer: &mut D) -> Result, D::Error> {
+ Ok(Table {
+ data: self.data.deserialize(deserializer)?,
+ width: self.width.to_native() as usize,
+ height: self.height.to_native() as usize,
+ mmap_backing: None,
+ })
}
- s.serialize_field("width", &self.width)?;
- s.serialize_field("height", &self.height)?;
- s.end()
}
}
#[cfg(feature = "disk-spill")]
-struct MmapDataSeq<'a, F: IsField>(&'a Table);
+pub use archived_table::ArchivedTable;
-#[cfg(feature = "disk-spill")]
-impl serde::Serialize for MmapDataSeq<'_, F>
+/// Read API over an rkyv-archived [`Table`], used by the verifier to consume
+/// the out-of-domain evaluations straight from the proof buffer. On
+/// little-endian targets the element data is viewed in place with no copy.
+#[cfg(target_endian = "little")]
+impl ArchivedTable
where
- FieldElement: serde::Serialize,
+ F::BaseType: rkyv::Archive,
{
- fn serialize(&self, serializer: S) -> Result {
- use serde::ser::SerializeSeq;
- let table = self.0;
- let mut seq = serializer.serialize_seq(Some(table.width * table.height))?;
- for r in 0..table.height {
- for elem in table.get_row(r) {
- seq.serialize_element(elem)?;
- }
- }
- seq.end()
+ #[inline]
+ pub fn width(&self) -> usize {
+ self.width.to_native() as usize
+ }
+
+ #[inline]
+ pub fn height(&self) -> usize {
+ self.height.to_native() as usize
+ }
+
+ /// Full row-major element data, viewed in place.
+ #[inline]
+ pub fn row_major_data(&self) -> &[FieldElement] {
+ math::field::element::ArchivedFieldElement::slice_as_native(self.data.as_slice())
+ }
+
+ /// `true` iff the backing data holds exactly `width × height` elements —
+ /// the invariant `get_row` indexing relies on. A malformed archive can
+ /// advertise dimensions that disagree with the data length; callers must
+ /// reject such tables before row access.
+ #[inline]
+ pub fn dimensions_consistent(&self) -> bool {
+ self.width()
+ .checked_mul(self.height())
+ .is_some_and(|n| n == self.data.len())
+ }
+
+ /// Row `row_idx` as a native field-element slice (no copy).
+ #[inline]
+ pub fn get_row(&self, row_idx: usize) -> &[FieldElement] {
+ let width = self.width();
+ let start = row_idx * width;
+ &self.row_major_data()[start..start + width]
+ }
+
+ /// Build a [`Frame`] over this table, identical to [`Table::into_frame`].
+ /// Only the small OOD frame is materialized (bounded by `step_size × width`),
+ /// never the whole proof.
+ pub fn into_frame(&self, main_trace_columns: usize, step_size: usize) -> Frame
+ where
+ F: IsSubFieldOf,
+ {
+ frame_from_rows(self.height(), step_size, main_trace_columns, |row_idx| {
+ self.get_row(row_idx)
+ })
}
}
@@ -361,29 +460,49 @@ impl Table {
/// Given a step size, converts the given table into a `Frame`.
/// Clones row data into owned Vecs (only used by verifier on small OOD tables).
pub fn into_frame(&self, main_trace_columns: usize, step_size: usize) -> Frame {
- debug_assert!(self.height.is_multiple_of(step_size));
- let steps = (0..self.height)
- .step_by(step_size)
- .map(|initial_row_idx| {
- let end_row_idx = initial_row_idx + step_size;
-
- let mut step_main_data: Vec>> = Vec::new();
- let mut step_aux_data: Vec>> = Vec::new();
-
- (initial_row_idx..end_row_idx).for_each(|row_idx| {
- let row = self.get_row(row_idx);
- step_main_data.push(row[..main_trace_columns].to_vec());
- step_aux_data.push(row[main_trace_columns..].to_vec());
- });
-
- TableView::new(step_main_data, step_aux_data)
- })
- .collect();
-
- Frame::new(steps)
+ frame_from_rows(self.height, step_size, main_trace_columns, |row_idx| {
+ self.get_row(row_idx)
+ })
}
}
+/// Build a [`Frame`] from `height` rows accessed via `get_row`, splitting each
+/// row at `main_trace_columns` into main/aux. Shared by [`Table::into_frame`]
+/// and the zero-copy `OodTableRef::into_frame` so both produce identical frames.
+///
+/// Only the small out-of-domain frame is materialized here (bounded by
+/// `step_size × width`), never the full trace.
+pub fn frame_from_rows<'a, F>(
+ height: usize,
+ step_size: usize,
+ main_trace_columns: usize,
+ get_row: impl Fn(usize) -> &'a [FieldElement],
+) -> Frame
+where
+ F: IsSubFieldOf + IsField + 'a,
+{
+ debug_assert!(height.is_multiple_of(step_size));
+ let steps = (0..height)
+ .step_by(step_size)
+ .map(|initial_row_idx| {
+ let end_row_idx = initial_row_idx + step_size;
+
+ let mut step_main_data: Vec>> = Vec::new();
+ let mut step_aux_data: Vec>> = Vec::new();
+
+ (initial_row_idx..end_row_idx).for_each(|row_idx| {
+ let row = get_row(row_idx);
+ step_main_data.push(row[..main_trace_columns].to_vec());
+ step_aux_data.push(row[main_trace_columns..].to_vec());
+ });
+
+ TableView::new(step_main_data, step_aux_data)
+ })
+ .collect();
+
+ Frame::new(steps)
+}
+
/// A view of a contiguous subset of rows of a table.
///
/// Owns its row data (Vec per row) so it can be built from either row-major Tables
diff --git a/crypto/stark/src/tests/bus_tests/completeness_tests.rs b/crypto/stark/src/tests/bus_tests/completeness_tests.rs
index 83f8ac391..51f6ef50c 100644
--- a/crypto/stark/src/tests/bus_tests/completeness_tests.rs
+++ b/crypto/stark/src/tests/bus_tests/completeness_tests.rs
@@ -377,9 +377,10 @@ fn test_serialization_roundtrip() {
multi_prove_ram(air_trace_pairs, &mut DefaultTranscript::::new(&[])).unwrap();
// Serialize and deserialize
- let serialized = serde_cbor::to_vec(&multi_proof).expect("serialization failed");
+ let serialized =
+ rkyv::to_bytes::(&multi_proof).expect("serialization failed");
let deserialized: crate::proof::stark::MultiProof =
- serde_cbor::from_slice(&serialized).expect("deserialization failed");
+ rkyv::from_bytes::<_, rkyv::rancor::Error>(&serialized).expect("deserialization failed");
let airs: Vec<&dyn AIR> =
vec![&cpu_air, &add_air, &mul_air];
diff --git a/crypto/stark/src/tests/prove_verify_roundtrip_tests.rs b/crypto/stark/src/tests/prove_verify_roundtrip_tests.rs
index 4059ed481..032e68ea1 100644
--- a/crypto/stark/src/tests/prove_verify_roundtrip_tests.rs
+++ b/crypto/stark/src/tests/prove_verify_roundtrip_tests.rs
@@ -142,13 +142,14 @@ fn test_verify_serialized_multi_table_proofs() {
// NETWORK TRANSMISSION - Serialize and deserialize (using CBOR binary format)
// =========================================================================
- let serialized = serde_cbor::to_vec(&proofs).expect("Failed to serialize proofs");
+ let serialized =
+ rkyv::to_bytes::(&proofs).expect("Failed to serialize proofs");
// At this point, the prover's data is dropped (out of scope above)
// The verifier only has the serialized data
let received_proofs: MultiProof =
- serde_cbor::from_slice(&serialized).expect("Failed to deserialize proofs");
+ rkyv::from_bytes::<_, rkyv::rancor::Error>(&serialized).expect("Failed to deserialize proofs");
// =========================================================================
// VERIFIER SIDE - Reconstruct AIRs and verify
diff --git a/crypto/stark/src/verifier.rs b/crypto/stark/src/verifier.rs
index 03119f617..0cf5eb460 100644
--- a/crypto/stark/src/verifier.rs
+++ b/crypto/stark/src/verifier.rs
@@ -1,7 +1,7 @@
use super::{
config::BatchedMerkleTreeBackend,
domain::VerifierDomain,
- fri::fri_decommit::FriDecommitment,
+ fri::fri_decommit::ArchivedFriDecommitment,
grinding,
proof::stark::StarkProof,
traits::{AIR, TransitionEvaluationContext},
@@ -9,10 +9,15 @@ use super::{
use crate::{
config::Commitment,
domain::new_verifier_domain,
- lookup::{LOGUP_CHALLENGE_ALPHA, LOGUP_NUM_CHALLENGES, PackingShifts, compute_alpha_powers},
- proof::stark::{DeepPolynomialOpening, MultiProof, PolynomialOpenings},
+ lookup::{BusPublicInputs, LOGUP_CHALLENGE_ALPHA, LOGUP_NUM_CHALLENGES, PackingShifts, compute_alpha_powers},
+ proof::stark::{
+ ArchivedDeepPolynomialOpening, ArchivedMultiProof, ArchivedPolynomialOpenings,
+ ArchivedStarkProof, MultiProof,
+ },
};
-use crypto::{fiat_shamir::is_transcript::IsStarkTranscript, merkle_tree::proof::Proof};
+use crypto::fiat_shamir::is_transcript::IsStarkTranscript;
+use crypto::merkle_tree::proof::verify_merkle_path;
+use math::field::element::ArchivedFieldElement;
#[cfg(not(feature = "test_fiat_shamir"))]
use log::error;
#[cfg(feature = "debug-checks")]
@@ -44,6 +49,11 @@ impl<
FieldExtension: IsField + Send + Sync,
PI,
> IsStarkVerifier for Verifier
+where
+ Field::BaseType: rkyv::Archive,
+ FieldExtension::BaseType: rkyv::Archive,
+ PI: rkyv::Archive,
+ ::Archived: rkyv::Deserialize,
{
}
@@ -75,6 +85,23 @@ where
pub type DeepPolynomialEvaluations = (Vec>, Vec>);
+// The verifier reads proofs in place from their rkyv archive; archived field
+// elements are viewed as native ones, which is only valid on little-endian.
+#[cfg(not(target_endian = "little"))]
+compile_error!("the zero-copy STARK verifier requires a little-endian target");
+
+/// Deserializer used to materialize the (tiny) per-proof `PI` public inputs.
+pub type PiDeserializer = rkyv::api::high::HighDeserializer;
+
+/// `&[FieldElement]` view over an archived field-element vector (no copy).
+#[inline]
+fn evals(v: &rkyv::vec::ArchivedVec>) -> &[FieldElement]
+where
+ G::BaseType: rkyv::Archive,
+{
+ ArchivedFieldElement::slice_as_native(v.as_slice())
+}
+
/// The functionality of a STARK verifier providing methods to run the STARK Verify protocol
/// https://lambdaclass.github.io/lambdaworks/starks/protocol.html
pub trait IsStarkVerifier<
@@ -82,6 +109,11 @@ pub trait IsStarkVerifier<
FieldExtension: Send + Sync + IsField,
PI,
>
+where
+ Field::BaseType: rkyv::Archive,
+ FieldExtension::BaseType: rkyv::Archive,
+ PI: rkyv::Archive,
+ ::Archived: rkyv::Deserialize,
{
fn sample_query_indexes(
number_of_queries: usize,
@@ -99,15 +131,25 @@ pub trait IsStarkVerifier<
/// See https://lambdaclass.github.io/lambdaworks/starks/protocol.html#step-2-verify-claimed-composition-polynomial
fn step_2_verify_claimed_composition_polynomial(
air: &dyn AIR,
- proof: &StarkProof,
+ proof: &ArchivedStarkProof,
+ public_inputs: &PI,
domain: &VerifierDomain,
challenges: &Challenges,
) -> bool {
- let trace_length = proof.trace_length;
+ crate::profile_markers::step_marker::<
+ { crate::profile_markers::STEP_VERIFY_CLAIMED_COMPOSITION_POLYNOMIAL },
+ >();
+ let trace_length = proof.trace_length.to_native() as usize;
+ // Owned `BusPublicInputs` (just the table contribution L — one field
+ // element) reconstructed from the archive for the AIR boundary call.
+ let bus_public_inputs = proof
+ .bus_public_inputs
+ .as_ref()
+ .map(|bpi| BusPublicInputs::from_contribution(bpi.table_contribution.as_native().clone()));
let boundary_constraints = air.boundary_constraints(
- &proof.public_inputs,
+ public_inputs,
&challenges.rap_challenges,
- proof.bus_public_inputs.as_ref(),
+ bus_public_inputs.as_ref(),
trace_length,
);
// Precompute g^step once per distinct step to avoid the prior O(B^2)
@@ -170,8 +212,16 @@ pub trait IsStarkVerifier<
.map(|poly| poly.evaluate(&challenges.z))
.collect::>>();
- let num_main_trace_columns =
- proof.trace_ood_evaluations.width - air.num_auxiliary_rap_columns();
+ // A malformed archive can advertise fewer OOD columns than the AIR's
+ // aux count; reject instead of underflowing.
+ let num_main_trace_columns = match proof
+ .trace_ood_evaluations
+ .width()
+ .checked_sub(air.num_auxiliary_rap_columns())
+ {
+ Some(n) => n,
+ None => return false,
+ };
let logup_alpha_powers: Vec> =
if challenges.rap_challenges.len() > LOGUP_CHALLENGE_ALPHA {
@@ -183,11 +233,11 @@ pub trait IsStarkVerifier<
Vec::new()
};
- let logup_table_offset = match &proof.bus_public_inputs {
+ let logup_table_offset = match proof.bus_public_inputs.as_ref() {
Some(bpi) => {
let n = FieldElement::::from(trace_length as u64);
match n.inv() {
- Ok(n_inv) => n_inv * &bpi.table_contribution,
+ Ok(n_inv) => n_inv * bpi.table_contribution.as_native(),
Err(_) => return false, // trace_length == 0 is invalid
}
}
@@ -227,8 +277,7 @@ pub trait IsStarkVerifier<
let composition_poly_ood_evaluation =
&boundary_quotient_ood_evaluation + transition_c_i_evaluations_sum;
- let composition_poly_claimed_ood_evaluation = proof
- .composition_poly_parts_ood_evaluation
+ let composition_poly_claimed_ood_evaluation = evals(&proof.composition_poly_parts_ood_evaluation)
.iter()
.rev()
.fold(FieldElement::zero(), |acc, coeff| {
@@ -242,7 +291,7 @@ pub trait IsStarkVerifier<
/// openings of the trace polynomials and the composition polynomial parts. It then uses these to verify that the
/// FRI decommitments are valid and correspond to the Deep composition polynomial.
fn step_3_verify_fri(
- proof: &StarkProof,
+ proof: &ArchivedStarkProof,
domain: &VerifierDomain,
challenges: &Challenges,
) -> bool
@@ -250,6 +299,7 @@ pub trait IsStarkVerifier<
FieldElement: AsBytes + Sync + Send,
FieldElement: AsBytes + Sync + Send,
{
+ crate::profile_markers::step_marker::<{ crate::profile_markers::STEP_VERIFY_FRI }>();
let (deep_poly_evaluations, deep_poly_evaluations_sym) =
match Self::reconstruct_deep_composition_poly_evaluations_for_all_queries(
challenges, domain, proof,
@@ -271,6 +321,7 @@ pub trait IsStarkVerifier<
proof
.query_list
+ .as_slice()
.iter()
.zip(&challenges.iotas)
.zip(evaluation_point_inverse)
@@ -307,7 +358,7 @@ pub trait IsStarkVerifier<
/// `evaluations ‖ evaluations_sym` and verify once. (Same as the composition
/// opening check.)
fn verify_opening_pair(
- opening: &PolynomialOpenings,
+ opening: &ArchivedPolynomialOpenings,
root: &Commitment,
iota: usize,
) -> bool
@@ -315,20 +366,24 @@ pub trait IsStarkVerifier<
FieldElement: AsBytes + Sync + Send,
FieldElement: AsBytes + Sync + Send,
E: IsField,
+ E::BaseType: rkyv::Archive,
Field: IsSubFieldOf,
{
- let mut value = opening.evaluations.clone();
- value.extend_from_slice(&opening.evaluations_sym);
- opening
- .proof
- .verify::>(root, iota, &value)
+ let mut value = evals(&opening.evaluations).to_vec();
+ value.extend_from_slice(evals(&opening.evaluations_sym));
+ verify_merkle_path::>(
+ opening.proof.merkle_path.as_slice(),
+ root,
+ iota,
+ &value,
+ )
}
/// Verify opening Open(tⱼ(D_LDE), 𝜐) and Open(tⱼ(D_LDE), -𝜐) for all trace polynomials tⱼ,
/// where 𝜐 and -𝜐 are the elements corresponding to the index challenge `iota`.
fn verify_trace_openings(
- proof: &StarkProof,
- deep_poly_openings: &DeepPolynomialOpening,
+ proof: &ArchivedStarkProof,
+ deep_poly_openings: &ArchivedDeepPolynomialOpening,
iota: usize,
) -> bool
where
@@ -346,8 +401,8 @@ pub trait IsStarkVerifier<
// unreachable in practice (multi_verify rejects such proofs upstream),
// but a defensive check keeps this function self-contained.
ok &= match (
- &proof.lde_trace_precomputed_merkle_root,
- &deep_poly_openings.precomputed_trace_polys,
+ proof.lde_trace_precomputed_merkle_root.as_ref(),
+ deep_poly_openings.precomputed_trace_polys.as_ref(),
) {
(Some(root), Some(opening)) => Self::verify_opening_pair::(opening, root, iota),
(None, None) => true,
@@ -356,11 +411,11 @@ pub trait IsStarkVerifier<
// Auxiliary trace.
ok &= match (
- proof.lde_trace_aux_merkle_root,
- &deep_poly_openings.aux_trace_polys,
+ proof.lde_trace_aux_merkle_root.as_ref(),
+ deep_poly_openings.aux_trace_polys.as_ref(),
) {
(Some(root), Some(opening)) => {
- Self::verify_opening_pair::(opening, &root, iota)
+ Self::verify_opening_pair::(opening, root, iota)
}
(None, None) => true,
_ => false,
@@ -372,7 +427,7 @@ pub trait IsStarkVerifier<
/// Verify opening Open(Hᵢ(D_LDE), 𝜐) and Open(Hᵢ(D_LDE), -𝜐) for all parts Hᵢof the composition
/// polynomial, where 𝜐 and -𝜐 are the elements corresponding to the index challenge `iota`.
fn verify_composition_poly_opening(
- deep_poly_openings: &DeepPolynomialOpening,
+ deep_poly_openings: &ArchivedDeepPolynomialOpening,
composition_poly_merkle_root: &Commitment,
iota: &usize,
) -> bool
@@ -380,34 +435,35 @@ pub trait IsStarkVerifier<
FieldElement: AsBytes + Sync + Send,
FieldElement: AsBytes + Sync + Send,
{
- let mut value = deep_poly_openings.composition_poly.evaluations.clone();
- value.extend_from_slice(&deep_poly_openings.composition_poly.evaluations_sym);
-
- deep_poly_openings
- .composition_poly
- .proof
- .verify::>(
- composition_poly_merkle_root,
- *iota,
- &value,
- )
+ let mut value = evals(&deep_poly_openings.composition_poly.evaluations).to_vec();
+ value.extend_from_slice(evals(&deep_poly_openings.composition_poly.evaluations_sym));
+
+ verify_merkle_path::>(
+ deep_poly_openings.composition_poly.proof.merkle_path.as_slice(),
+ composition_poly_merkle_root,
+ *iota,
+ &value,
+ )
}
/// Verifies the validity of the purported values of the trace polynomials and the composition polynomial
/// parts at the domain elements and their symmetric counterparts corresponding to all the FRI query
/// index challenges.
fn step_4_verify_trace_and_composition_openings(
- proof: &StarkProof,
+ proof: &ArchivedStarkProof,
challenges: &Challenges,
) -> bool
where
FieldElement: AsBytes + Sync + Send,
FieldElement: AsBytes + Sync + Send,
{
+ crate::profile_markers::step_marker::<
+ { crate::profile_markers::STEP_VERIFY_TRACE_AND_COMPOSITION_OPENINGS },
+ >();
challenges
.iotas
.iter()
- .zip(&proof.deep_poly_openings)
+ .zip(proof.deep_poly_openings.as_slice())
.all(|(iota_n, deep_poly_opening)| {
Self::verify_composition_poly_opening(
deep_poly_opening,
@@ -420,7 +476,7 @@ pub trait IsStarkVerifier<
/// Verifies the openings of a fold polynomial of an inner layer of FRI.
fn verify_fri_layer_openings(
merkle_root: &Commitment,
- auth_path_sym: &Proof,
+ auth_path_sym: &[Commitment],
evaluation: &FieldElement,
evaluation_sym: &FieldElement,
iota: usize,
@@ -435,7 +491,8 @@ pub trait IsStarkVerifier<
vec![evaluation.clone(), evaluation_sym.clone()]
};
- auth_path_sym.verify::>(
+ verify_merkle_path::>(
+ auth_path_sym,
merkle_root,
iota >> 1,
&evaluations,
@@ -451,10 +508,10 @@ pub trait IsStarkVerifier<
/// `deep_composition_evaluation`: precomputed value of p₀(𝜐), where p₀ is the deep composition polynomial.
/// `deep_composition_evaluation_sym`: precomputed value of p₀(-𝜐), where p₀ is the deep composition polynomial.
fn verify_query_and_sym_openings(
- proof: &StarkProof,
+ proof: &ArchivedStarkProof,
zetas: &[FieldElement],
iota: usize,
- fri_decommitment: &FriDecommitment,
+ fri_decommitment: &ArchivedFriDecommitment,
evaluation_point_inv: FieldElement,
deep_composition_evaluation: &FieldElement,
deep_composition_evaluation_sym: &FieldElement,
@@ -463,7 +520,19 @@ pub trait IsStarkVerifier<
FieldElement: AsBytes + Sync + Send,
FieldElement: AsBytes + Sync + Send,
{
- let fri_layers_merkle_roots = &proof.fri_layers_merkle_roots;
+ let fri_layers_merkle_roots = proof.fri_layers_merkle_roots.as_slice();
+ let fri_last_value = proof.fri_last_value.as_native();
+
+ // The three per-layer vectors must line up with the committed roots:
+ // the fold below iterates their zip (min length) and only compares the
+ // final value on the last evaluation index, so an over-long
+ // `layers_evaluations_sym` would otherwise skip the `fri_last_value`
+ // check entirely.
+ if fri_decommitment.layers_auth_paths.len() != fri_layers_merkle_roots.len()
+ || fri_decommitment.layers_evaluations_sym.len() != fri_layers_merkle_roots.len()
+ {
+ return false;
+ }
let evaluation_point_vec: Vec> =
core::iter::successors(Some(evaluation_point_inv.square()), |evaluation_point| {
Some(evaluation_point.square())
@@ -483,7 +552,7 @@ pub trait IsStarkVerifier<
// In this case, the fold loop below doesn't iterate, so we need to verify
// the final value directly here.
if fri_layers_merkle_roots.is_empty() {
- return v == proof.fri_last_value;
+ return v == *fri_last_value;
}
// For each FRI layer, starting from the layer 1: use the proof to verify the validity of values pᵢ(−𝜐^(2ⁱ)) (given by the prover) and
@@ -492,8 +561,8 @@ pub trait IsStarkVerifier<
fri_layers_merkle_roots
.iter()
.enumerate()
- .zip(&fri_decommitment.layers_auth_paths)
- .zip(&fri_decommitment.layers_evaluations_sym)
+ .zip(fri_decommitment.layers_auth_paths.as_slice())
+ .zip(evals(&fri_decommitment.layers_evaluations_sym))
.zip(evaluation_point_vec)
.fold(
true,
@@ -507,7 +576,7 @@ pub trait IsStarkVerifier<
// `evaluation_sym` is pᵢ(−𝜐^(2ⁱ)).
let openings_ok = Self::verify_fri_layer_openings(
merkle_root,
- auth_path_sym,
+ auth_path_sym.merkle_path.as_slice(),
&v,
evaluation_sym,
index,
@@ -525,7 +594,7 @@ pub trait IsStarkVerifier<
result & openings_ok
} else {
// Check that final value is the given by the prover
- result & (v == proof.fri_last_value) & openings_ok
+ result & (v == *fri_last_value) & openings_ok
}
},
)
@@ -534,8 +603,13 @@ pub trait IsStarkVerifier<
fn reconstruct_deep_composition_poly_evaluations_for_all_queries(
challenges: &Challenges,
domain: &VerifierDomain,
- proof: &StarkProof,
+ proof: &ArchivedStarkProof,
) -> Option> {
+ // A malformed proof can carry fewer openings than query challenges;
+ // reject instead of panicking on the indexed access below.
+ if proof.deep_poly_openings.len() < challenges.iotas.len() {
+ return None;
+ }
let num_queries = challenges.iotas.len();
let mut deep_poly_evaluations = Vec::with_capacity(num_queries);
let mut deep_poly_evaluations_sym = Vec::with_capacity(num_queries);
@@ -547,78 +621,103 @@ pub trait IsStarkVerifier<
.expect("verifier domain root_order is a valid power of two");
for (i, iota) in challenges.iotas.iter().enumerate() {
- let opening = &proof.deep_poly_openings[i];
+ let opening = &proof.deep_poly_openings.as_slice()[i];
// Base-field portion: precomputed columns FIRST, then main trace columns.
let mut lde_base: Vec> = Vec::new();
- if let Some(p) = &opening.precomputed_trace_polys {
- lde_base.extend_from_slice(&p.evaluations);
+ if let Some(p) = opening.precomputed_trace_polys.as_ref() {
+ lde_base.extend_from_slice(evals(&p.evaluations));
}
- lde_base.extend_from_slice(&opening.main_trace_polys.evaluations);
+ lde_base.extend_from_slice(evals(&opening.main_trace_polys.evaluations));
let lde_aux: &[FieldElement] = opening
.aux_trace_polys
.as_ref()
- .map(|a| a.evaluations.as_slice())
+ .map(|a| evals(&a.evaluations))
.unwrap_or(&[]);
- let evaluation_point = Self::query_challenge_to_evaluation_point(*iota, false, domain);
- deep_poly_evaluations.push(Self::reconstruct_deep_composition_poly_evaluation(
- proof,
- &evaluation_point,
- primitive_root,
- challenges,
- &lde_base,
- lde_aux,
- &opening.composition_poly.evaluations,
- )?);
-
- // Mirror for the symmetric query point.
let mut lde_base_sym: Vec> = Vec::new();
- if let Some(p) = &opening.precomputed_trace_polys {
- lde_base_sym.extend_from_slice(&p.evaluations_sym);
+ if let Some(p) = opening.precomputed_trace_polys.as_ref() {
+ lde_base_sym.extend_from_slice(evals(&p.evaluations_sym));
}
- lde_base_sym.extend_from_slice(&opening.main_trace_polys.evaluations_sym);
+ lde_base_sym.extend_from_slice(evals(&opening.main_trace_polys.evaluations_sym));
let lde_aux_sym: &[FieldElement] = opening
.aux_trace_polys
.as_ref()
- .map(|a| a.evaluations_sym.as_slice())
+ .map(|a| evals(&a.evaluations_sym))
.unwrap_or(&[]);
- let evaluation_point = Self::query_challenge_to_evaluation_point(*iota, true, domain);
- deep_poly_evaluations_sym.push(Self::reconstruct_deep_composition_poly_evaluation(
- proof,
- &evaluation_point,
- primitive_root,
- challenges,
- &lde_base_sym,
- lde_aux_sym,
- &opening.composition_poly.evaluations_sym,
- )?);
+ let evaluation_point = Self::query_challenge_to_evaluation_point(*iota, false, domain);
+ let evaluation_point_sym =
+ Self::query_challenge_to_evaluation_point(*iota, true, domain);
+ let (evaluation, evaluation_sym) =
+ Self::reconstruct_deep_composition_poly_evaluation_pair(
+ proof,
+ &evaluation_point,
+ &evaluation_point_sym,
+ primitive_root,
+ challenges,
+ &lde_base,
+ lde_aux,
+ evals(&opening.composition_poly.evaluations),
+ &lde_base_sym,
+ lde_aux_sym,
+ evals(&opening.composition_poly.evaluations_sym),
+ )?;
+ deep_poly_evaluations.push(evaluation);
+ deep_poly_evaluations_sym.push(evaluation_sym);
}
Some((deep_poly_evaluations, deep_poly_evaluations_sym))
}
- fn reconstruct_deep_composition_poly_evaluation(
- proof: &StarkProof,
+ /// Reconstructs the deep composition polynomial evaluation at a query's
+ /// evaluation point and its symmetric counterpart in one traversal. The
+ /// OOD table walk and `trace_term_coeffs` walk are shared between the two
+ /// (they don't depend on the evaluation point), halving the loads and
+ /// letting the two `denoms_trace` vectors, and the two composition-tail
+ /// denominators, share a single batch-inverse call each.
+ ///
+ /// Algebraic rewrite of the per-element trace term: for column `col` and
+ /// row `row`,
+ /// coeff(col,row) * (base(col) - ood(row,col)) * denom(row)
+ /// distributes to
+ /// denom(row) * (coeff(col,row) * base(col) - coeff(col,row) * ood(row,col)).
+ /// Summing over `col` first isolates `coeff * ood`, which is identical for
+ /// both evaluation points, from `coeff * base`, which differs; and moves
+ /// the `denom(row)` multiplication (ext * ext) out of the column loop.
+ fn reconstruct_deep_composition_poly_evaluation_pair(
+ proof: &ArchivedStarkProof,
evaluation_point: &FieldElement,
+ evaluation_point_sym: &FieldElement