feat: kzg batch verification

Cargo.toml

@@ -31,6 +31,8 @@ ark-poly = { version = "0.5.0", features = ["parallel"] }
 crossbeam-channel = "0.5"
 num_cpus = "1.13.0"
 sys-info = "0.9"
+itertools = "0.13.0"
+thiserror = "1.0"
 
 [dev-dependencies]
 criterion = "0.5"

benches/bench_kzg_proof.rs

@@ -23,7 +23,7 @@ fn bench_kzg_proof(c: &mut Criterion) {
         let index =
             rand::thread_rng().gen_range(0..input_poly.len_underlying_blob_field_elements());
         b.iter(|| {
-            kzg.compute_proof_with_roots_of_unity(&input_poly, index.try_into().unwrap())
+            kzg.compute_kzg_proof_with_known_z_fr_index(&input_poly, index.try_into().unwrap())
                 .unwrap()
         });
     });
@@ -37,7 +37,7 @@ fn bench_kzg_proof(c: &mut Criterion) {
         let index =
             rand::thread_rng().gen_range(0..input_poly.len_underlying_blob_field_elements());
         b.iter(|| {
-            kzg.compute_proof_with_roots_of_unity(&input_poly, index.try_into().unwrap())
+            kzg.compute_kzg_proof_with_known_z_fr_index(&input_poly, index.try_into().unwrap())
                 .unwrap()
         });
     });
@@ -51,7 +51,7 @@ fn bench_kzg_proof(c: &mut Criterion) {
         let index =
             rand::thread_rng().gen_range(0..input_poly.len_underlying_blob_field_elements());
         b.iter(|| {
-            kzg.compute_proof_with_roots_of_unity(&input_poly, index.try_into().unwrap())
+            kzg.compute_kzg_proof_with_known_z_fr_index(&input_poly, index.try_into().unwrap())
                 .unwrap()
         });
     });

benches/bench_kzg_verify.rs

@@ -24,7 +24,7 @@ fn bench_kzg_verify(c: &mut Criterion) {
             rand::thread_rng().gen_range(0..input_poly.len_underlying_blob_field_elements());
         let commitment = kzg.commit_eval_form(&input_poly).unwrap();
         let proof = kzg
-            .compute_proof_with_roots_of_unity(&input_poly, index.try_into().unwrap())
+            .compute_kzg_proof_with_known_z_fr_index(&input_poly, index.try_into().unwrap())
             .unwrap();
         let value_fr = input_poly.get_at_index(index).unwrap();
         let z_fr = kzg.get_nth_root_of_unity(index).unwrap();
@@ -41,7 +41,7 @@ fn bench_kzg_verify(c: &mut Criterion) {
             rand::thread_rng().gen_range(0..input_poly.len_underlying_blob_field_elements());
         let commitment = kzg.commit_eval_form(&input_poly).unwrap();
         let proof = kzg
-            .compute_proof_with_roots_of_unity(&input_poly, index.try_into().unwrap())
+            .compute_kzg_proof_with_known_z_fr_index(&input_poly, index.try_into().unwrap())
             .unwrap();
         let value_fr = input_poly.get_at_index(index).unwrap();
         let z_fr = kzg.get_nth_root_of_unity(index).unwrap();
@@ -58,7 +58,7 @@ fn bench_kzg_verify(c: &mut Criterion) {
             rand::thread_rng().gen_range(0..input_poly.len_underlying_blob_field_elements());
         let commitment = kzg.commit_eval_form(&input_poly).unwrap();
         let proof = kzg
-            .compute_proof_with_roots_of_unity(&input_poly, index.try_into().unwrap())
+            .compute_kzg_proof_with_known_z_fr_index(&input_poly, index.try_into().unwrap())
             .unwrap();
         let value_fr = input_poly.get_at_index(index).unwrap();
         let z_fr = kzg.get_nth_root_of_unity(index).unwrap();

src/blob.rs

@@ -3,11 +3,12 @@ use crate::{
     polynomial::{PolynomialCoeffForm, PolynomialEvalForm},
 };
 
-/// A blob which is Eigen DA spec aligned.
+/// A blob aligned with the Eigen DA specification.
 /// TODO: we should probably move to a transparent repr like
 ///       <https://docs.rs/alloy-primitives/latest/alloy_primitives/struct.FixedBytes.html>
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub struct Blob {
+    /// The binary data contained within the blob.
     blob_data: Vec<u8>,
 }
 
@@ -48,12 +49,22 @@ impl Blob {
         &self.blob_data
     }
 
-    /// Returns the length of the data in the blob.
+    /// Returns the length of the blob data.
+    ///
+    /// This length reflects the size of the data, including any padding if applied.
+    ///
+    /// # Returns
+    ///
+    /// The length of the blob data as a `usize`.
     pub fn len(&self) -> usize {
         self.blob_data.len()
     }
 
-    /// Checks if the blob data is empty.
+    /// Checks whether the blob data is empty.
+    ///
+    /// # Returns
+    ///
+    /// `true` if the blob data is empty, `false` otherwise.
     pub fn is_empty(&self) -> bool {
         self.blob_data.is_empty()
     }

src/consts.rs

@@ -1,3 +1,13 @@
 pub const BYTES_PER_FIELD_ELEMENT: usize = 32;
 pub const SIZE_OF_G1_AFFINE_COMPRESSED: usize = 32; // in bytes
 pub const SIZE_OF_G2_AFFINE_COMPRESSED: usize = 64; // in bytes
+
+pub const FIAT_SHAMIR_PROTOCOL_DOMAIN: &[u8] = b"EIGENDA_FSBLOBVERIFY_V1_"; // Adapted from 4844
+pub const KZG_ENDIANNESS: Endianness = Endianness::Big; // Choose between Big or Little.
+
+pub const RANDOM_CHALLENGE_KZG_BATCH_DOMAIN: &[u8] = b"EIGENDA_RCKZGBATCH___V1_"; // Adapted from 4844
+#[derive(Debug, Clone, Copy)]
+pub enum Endianness {
+    Big,
+    Little,
+}

src/errors.rs

@@ -1,64 +1,84 @@
-use std::{error::Error, fmt};
+use thiserror::Error;
 
-#[derive(Clone, Debug, PartialEq)]
+/// Errors related to Blob operations.
+///
+/// The `BlobError` enum encapsulates all possible errors that can occur during
+/// operations on the `Blob` struct, such as padding and conversion errors.
+#[derive(Clone, Debug, PartialEq, Error)]
 pub enum BlobError {
+    /// A generic error with a descriptive message.
+    #[error("generic error: {0}")]
     GenericError(String),
 }
 
-impl fmt::Display for BlobError {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match *self {
-            BlobError::GenericError(ref msg) => write!(f, "generic error: {}", msg),
-        }
-    }
-}
-
-impl Error for BlobError {}
-
-#[derive(Clone, Debug, PartialEq)]
+/// Errors related to Polynomial operations.
+///
+/// The `PolynomialError` enum encapsulates all possible errors that can occur
+/// during operations on the `Polynomial` struct, such as FFT transformations
+/// and serialization errors.
+#[derive(Clone, Debug, PartialEq, Error)]
 pub enum PolynomialError {
-    SerializationFromStringError,
+
+    /// Error related to commitment operations with a descriptive message.
+    #[error("commitment error: {0}")]
     CommitError(String),
-    GenericError(String),
+
+    /// Error related to Fast Fourier Transform (FFT) operations with a descriptive message.
+    #[error("FFT error: {0}")]
     FFTError(String),
+
+    /// A generic error with a descriptive message.
+    #[error("generic error: {0}")]
+    GenericError(String),
+
+    /// Error indicating that the polynomial is already in the desired form.
+    #[error("incorrect form error: {0}")]
     IncorrectFormError(String),
 }
 
-impl fmt::Display for PolynomialError {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match *self {
-            PolynomialError::SerializationFromStringError => {
-                write!(f, "couldn't load string to fr vector")
-            },
-            PolynomialError::CommitError(ref msg) => write!(f, "Commitment error: {}", msg),
-            PolynomialError::FFTError(ref msg) => write!(f, "FFT error: {}", msg),
-            PolynomialError::GenericError(ref msg) => write!(f, "generic error: {}", msg),
-            PolynomialError::IncorrectFormError(ref msg) => {
-                write!(f, "Incorrect form error: {}", msg)
-            },
-        }
-    }
-}
+/// Errors related to KZG operations.
+///
+/// The `KzgError` enum encapsulates all possible errors that can occur during
+/// KZG-related operations, including those from `PolynomialError` and `BlobError`.
+/// It also includes additional errors specific to KZG operations.
+#[derive(Clone, Debug, PartialEq, Error)]
+pub enum KzgError {
+    /// Wraps errors originating from Polynomial operations.
+    #[error("polynomial error: {0}")]
+    PolynomialError(#[from] PolynomialError),
 
-impl Error for PolynomialError {}
+    #[error("MSM error: {0}")]
+    MsmError(String),
 
-#[derive(Clone, Debug, PartialEq)]
-pub enum KzgError {
-    CommitError(String),
+    /// Wraps errors originating from Blob operations.
+    #[error("blob error: {0}")]
+    BlobError(#[from] BlobError),
+
+    /// Error related to serialization with a descriptive message.
+    #[error("serialization error: {0}")]
     SerializationError(String),
-    FftError(String),
+
+    /// Error related to commitment processes with a descriptive message.
+    #[error("not on curve error: {0}")]
+    NotOnCurveError(String),
+
+    /// Error indicating an invalid commit operation with a descriptive message.
+    #[error("commit error: {0}")]
+    CommitError(String),
+
+    /// Error related to Fast Fourier Transform (FFT) operations with a descriptive message.
+    #[error("FFT error: {0}")]
+    FFTError(String),
+
+    /// A generic error with a descriptive message.
+    #[error("generic error: {0}")]
     GenericError(String),
-}
 
-impl fmt::Display for KzgError {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match *self {
-            KzgError::CommitError(ref msg) => write!(f, "Commitment error: {}", msg),
-            KzgError::SerializationError(ref msg) => write!(f, "Serialization error: {}", msg),
-            KzgError::FftError(ref msg) => write!(f, "FFT error: {}", msg),
-            KzgError::GenericError(ref msg) => write!(f, "Generic error: {}", msg),
-        }
-    }
-}
+    /// Error indicating an invalid denominator scenario, typically in mathematical operations.
+    #[error("invalid denominator")]
+    InvalidDenominator,
 
-impl Error for KzgError {}
+    /// Error indicating an invalid input length scenario, typically in data processing.
+    #[error("invalid input length")]
+    InvalidInputLength,
+}

src/helpers.rs

@@ -1,13 +1,17 @@
 use ark_bn254::{Fq, Fq2, Fr, G1Affine, G1Projective, G2Affine, G2Projective};
-use ark_ec::AffineRepr;
+use ark_ec::{AffineRepr, CurveGroup, VariableBaseMSM};
 use ark_ff::{sbb, BigInt, BigInteger, Field, LegendreSymbol, PrimeField};
 use ark_std::{str::FromStr, vec::Vec, One, Zero};
 use crossbeam_channel::Receiver;
 use std::cmp;
 
 use crate::{
     arith,
-    consts::{BYTES_PER_FIELD_ELEMENT, SIZE_OF_G1_AFFINE_COMPRESSED, SIZE_OF_G2_AFFINE_COMPRESSED},
+    consts::{
+        Endianness, BYTES_PER_FIELD_ELEMENT, KZG_ENDIANNESS, SIZE_OF_G1_AFFINE_COMPRESSED,
+        SIZE_OF_G2_AFFINE_COMPRESSED,
+    },
+    errors::KzgError,
     traits::ReadPointFromBytes,
 };
 use ark_ec::AdditiveGroup;
@@ -117,25 +121,51 @@ pub fn to_fr_array(data: &[u8]) -> Vec<Fr> {
 }
 
 pub fn to_byte_array(data_fr: &[Fr], max_data_size: usize) -> Vec<u8> {
+    // Calculate the number of field elements in input
     let n = data_fr.len();
+
+    // Calculate actual data size as minimum of:
+    // - Total size needed for all elements (n * bytes per element)
+    // - Maximum allowed size
     let data_size = cmp::min(n * BYTES_PER_FIELD_ELEMENT, max_data_size);
+
+    // Initialize output buffer with zeros
+    // Size is determined by data_size calculation above
     let mut data = vec![0u8; data_size];
 
+    // Iterate through each field element
+    // Using enumerate().take(n) to process elements up to n
     for (i, element) in data_fr.iter().enumerate().take(n) {
-        let v: Vec<u8> = element.into_bigint().to_bytes_be();
+        // Convert field element to bytes based on configured endianness
+        let v: Vec<u8> = match KZG_ENDIANNESS {
+            Endianness::Big => element.into_bigint().to_bytes_be(), // Big-endian conversion
+            Endianness::Little => element.into_bigint().to_bytes_le(), // Little-endian conversion
+        };
 
+        // Calculate start and end indices for this element in output buffer
         let start = i * BYTES_PER_FIELD_ELEMENT;
         let end = (i + 1) * BYTES_PER_FIELD_ELEMENT;
 
         if end > max_data_size {
+            // Handle case where this element would exceed max_data_size
+            // Calculate how many bytes we can actually copy
             let slice_end = cmp::min(v.len(), max_data_size - start);
+
+            // Copy partial element and break the loop
+            // We can't fit any more complete elements
             data[start..start + slice_end].copy_from_slice(&v[..slice_end]);
             break;
         } else {
+            // Normal case: element fits within max_data_size
+            // Calculate actual end index considering data_size limit
             let actual_end = cmp::min(end, data_size);
+
+            // Copy element bytes to output buffer
+            // Only copy up to actual_end in case this is the last partial element
             data[start..actual_end].copy_from_slice(&v[..actual_end - start]);
         }
     }
+
     data
 }
 
@@ -179,11 +209,6 @@ pub fn lexicographically_largest(z: &Fq) -> bool {
     let tmp = arith::montgomery_reduce(&z.0 .0[0], &z.0 .0[1], &z.0 .0[2], &z.0 .0[3]);
     let mut borrow: u64 = 0;
 
-    // (_, borrow) = sbb(tmp.0, 0x9E10460B6C3E7EA4, 0);
-    // (_, borrow) = sbb(tmp.1, 0xCBC0B548B438E546, borrow);
-    // (_, borrow) = sbb(tmp.2, 0xDC2822DB40C0AC2E, borrow);
-    // (_, borrow) = sbb(tmp.3, 0x183227397098D014, borrow);
-
     sbb!(tmp.0, 0x9E10460B6C3E7EA4, &mut borrow);
     sbb!(tmp.1, 0xCBC0B548B438E546, &mut borrow);
     sbb!(tmp.2, 0xDC2822DB40C0AC2E, &mut borrow);
@@ -374,3 +399,55 @@ pub fn is_on_curve_g2(g2: &G2Projective) -> bool {
     right += &tmp;
     left == right
 }
+
+/// Computes powers of a field element up to a given exponent.
+/// Ref: https://github.com/ethereum/consensus-specs/blob/master/specs/deneb/polynomial-commitments.md#compute_powers
+///
+/// For a given field element x, computes [1, x, x², x³, ..., x^(count-1)]
+///
+/// # Arguments
+/// * `base` - The field element to compute powers of
+/// * `count` - The number of powers to compute (0 to count-1)
+///
+/// # Returns
+/// * Vector of field elements containing powers: [x⁰, x¹, x², ..., x^(count-1)]
+pub fn compute_powers(base: &Fr, count: usize) -> Vec<Fr> {
+    // Pre-allocate vector to avoid reallocations
+    let mut powers = Vec::with_capacity(count);
+
+    // Start with x⁰ = 1
+    let mut current = Fr::one();
+
+    // Compute successive powers by multiplying by base
+    for _ in 0..count {
+        // Add current power to vector
+        powers.push(current);
+        // Compute next power: x^(i+1) = x^i * x
+        current *= base;
+    }
+
+    powers
+}
+
+/// Computes a linear combination of G1 points weighted by scalar coefficients.
+///
+/// Given points P₁, P₂, ..., Pₙ and scalars s₁, s₂, ..., sₙ
+/// Computes: s₁P₁ + s₂P₂ + ... + sₙPₙ
+/// Uses Multi-Scalar Multiplication (MSM) for efficient computation.
+///
+/// # Arguments
+/// * `points` - Array of G1 points in affine form
+/// * `scalars` - Array of field elements as scalar weights
+///
+/// # Returns
+/// * Single G1 point in affine form representing the linear combination
+pub fn g1_lincomb(points: &[G1Affine], scalars: &[Fr]) -> Result<G1Affine, KzgError> {
+    // Use MSM (Multi-Scalar Multiplication) for efficient linear combination
+    // MSM is much faster than naive point addition and scalar multiplication
+    let lincomb =
+        G1Projective::msm(points, scalars).map_err(|e| KzgError::MsmError(e.to_string()))?;
+
+    // Convert result back to affine coordinates
+    // This is typically needed as most protocols expect points in affine form
+    Ok(lincomb.into_affine())
+}