PI circuit for A5 testnet

[CeciliaZ030]

Description

Prove protocol instance get from Taiko contract.

keccak256(abi.encode(
            evidance.metaHash,
            evidance.parentHash,
            evidance.blockHash,
            evidance.signalRoot,
            evidance.graffiti,
            evidance.prover
 ));

1. bytes of keccak_output <==> 'hi' and lo values in circuit's instance column
2. parentHash can be found in historical hashes of circuit. (BlockTable lookup)
3. blockHash can be found in circuit. (BlockTable lookup)
4. [RLC(abi encoded values above), len, RLC(bytes of keccak_output)] can be found in KeccakTable lookup.

Issue Link

#138 converted for A5 testnet

Type of change

• Rewrite most logics in circuit-tools

[Brechtpd]

I think this looks good! Just some minor feedback, not sure if phase2

Performance wise this will do all constraints on every row and will do more rotations than the previous version, but seems like that shouldn't really impact performance in any significant way so I think a good tradeoff for simplicity.

[Brechtpd]

Why not use decode::value (or rlc::value, though decode makes it more clear what is being done).

[CeciliaZ030]

This is from John's old version haha

[Brechtpd]

n, b and even acc not the most self explaining names, especially because the values come from a tuple where they are also not named.

[CeciliaZ030]

Will change :)

[Brechtpd]

Is this set to 4 instead of 5 because the q_enable selector is added afterwards and so doesn't get counted while adding the constraints? Seems like another good reason not to do it I think, more edge cases to take into account! (no problem of doing it like this for this temporary version though).

[CeciliaZ030]

Ahhh yea! you're right this is such an important point I didn't think of. I'll revert the change to cb.build_constraints then.

[smtmfft]

Performance wise this will do all constraints on every row and will do more rotations than the previous version, but seems like that shouldn't really impact performance in any significant way so I think a good tradeoff for simplicity.

We have tested a few setups, the original one is single column, which leads to 1 column, >=224 rotations(1 x (32 x 7)) & 1 lookup(for byte), and then it explodes the aggregation circuit degree to 2^24, then we change layout to this 7x32, which means 7 columns, 32 rotations & 7 lookups, by a guessing it should get 4x lower than before, so 2^22 is enough, fortunately the fact is :). We continue guessing that maybe 15*15 is the best under this circuit config situation, can do some experiments later if necessary, after we solve that weird issue.

[smtmfft]

Closed as a5-testnet is already updated.