More verbose and stricter transcripts. #60

recmo · 2025-05-20T20:32:46Z

Make transcripts stricter by:

Type checking using Rust's ~~TypeId~~ type_name.
Requiring labels in prover and verifier.
Hierarchically grouping interactions (begin/end delimiters).

This addresses #6.

It's still a work in progress.

tcoratger · 2025-05-21T22:07:56Z

spongefish/src/transcript/transcript_pattern.rs

+
+/// Errors when validating a transcript.
+#[derive(Clone, PartialEq, Eq, PartialOrd, Ord, Debug, Hash, Error)]
+pub enum TranscriptError {


I like this, this was clearly missing and the previous way of doing things made identifying and generalizing errors difficult because if I'm not mistaken, before that, errors in the domain separator were just strings

tcoratger · 2025-05-21T22:08:40Z

spongefish/src/codecs/mod.rs

+// #[cfg(feature = "serde-postcard")]
+// /// Use [`zerocopy`] to convert types to/from bytes.
+// pub mod zerocopy;
+


To be removed?

tcoratger · 2025-05-21T22:17:10Z

spongefish/src/transcript/mod.rs

+}
+
+/// Extension trait for [`Transcript`].
+pub trait TranscriptExt {


If this is an extension trait, shouldn't it look like this?

Suggested change

pub trait TranscriptExt {

pub trait TranscriptExt: Transcript {

tcoratger · 2025-05-21T22:17:35Z

spongefish/src/transcript/mod.rs

+    /// Begin of a hint interaction.
+    fn begin_hint<T>(&mut self, label: &'static str) -> Result<(), Self::Error>;
+
+    /// End of a hint interaction..


Suggested change

/// End of a hint interaction..

/// End of a hint interaction.

tcoratger · 2025-05-21T22:17:43Z

spongefish/src/transcript/mod.rs

+    /// End of a hint interaction..
+    fn end_hint<T>(&mut self, label: &'static str) -> Result<(), Self::Error>;
+
+    /// Begin of a challenge interaction..


Suggested change

/// Begin of a challenge interaction..

/// Begin of a challenge interaction.

tcoratger · 2025-05-21T22:17:49Z

spongefish/src/transcript/mod.rs

+    /// Begin of a challenge interaction..
+    fn begin_challenge<T>(&mut self, label: &'static str) -> Result<(), Self::Error>;
+
+    /// End of a challenge interaction..


Suggested change

/// End of a challenge interaction..

/// End of a challenge interaction.

tcoratger · 2025-05-21T22:18:47Z

spongefish/src/codecs/zerocopy.rs

+pub trait ZeroCopyPattern<T>: Transcript {
+    fn message(&mut self, label: &'static str) -> Result<(), Self::Error>;
+    fn hint(&mut self, label: &'static str) -> Result<(), Self::Error>;
+    fn challenge(&mut self, label: &'static str) -> Result<(), Self::Error>;
+}
+
+pub trait ZeroCopyMessageProver<T: Immutable + IntoBytes>: Transcript {
+    fn message(&mut self, label: &'static str, value: &T) -> Result<(), Self::Error>;
+}
+
+pub trait ZeroCopyMessageVerifier<T: IntoBytes + FromBytes>: Transcript {
+    fn message(&mut self, label: &'static str) -> Result<T, Self::Error>;
+}
+
+pub trait ZeroCopyHintProver<T: Immutable + IntoBytes>: Transcript {
+    fn hint(&mut self, label: &'static str, value: &T) -> Result<(), Self::Error>;
+}
+
+pub trait ZeroCopyHintVerifier<T: IntoBytes + FromBytes>: Transcript {
+    fn hint(&mut self, label: &'static str) -> Result<T, Self::Error>;
+}
+
+pub trait ZeroCopyChallenge<T: IntoBytes + FromBytes>: Transcript {
+    fn challenge(&mut self, label: &'static str) -> Result<T, Self::Error>;
+}


Maybe can we have a very small one line header doc for each to explain the principle for the reader to better understand

tcoratger · 2025-05-21T22:20:06Z

spongefish/src/traits.rs

+pub trait BytesPattern {
+    fn add_bytes(&mut self, count: usize, label: &str);
+    fn hint(&mut self, label: &str);
+    fn challenge_bytes(&mut self, count: usize, label: &str);
+}
+
+pub trait BytesMessageProver {
+    fn message(&mut self, input: &[u8]) -> Result<(), DomainSeparatorMismatch>;
+}
+
+pub trait BytesMessageVerifier {
+    fn message(&mut self, output: &mut [u8]) -> Result<(), DomainSeparatorMismatch>;
+}
+pub trait BytesHintProver {
+    fn hint(&mut self, input: &[u8]) -> Result<(), DomainSeparatorMismatch>;
+}
+
+pub trait BytesHintVerifier {
+    fn hint(&mut self, output: &mut [u8]) -> Result<(), DomainSeparatorMismatch>;
+}
+
+pub trait BytesChallenge {
+    fn challenge(&mut self, output: &mut [u8]) -> Result<(), DomainSeparatorMismatch>;
+}


Maybe a short header doc for each?

tcoratger · 2025-05-26T15:51:58Z

spongefish/src/transcript/interaction.rs

+pub enum InteractionKind {
+    /// A protocol containing mixed interactions.
+    Protocol,
+    /// A message send in-band from prover to verifier.


Suggested change

/// A message send in-band from prover to verifier.

/// A message sent in-band from prover to verifier.

tcoratger · 2025-05-26T15:52:06Z

spongefish/src/transcript/interaction.rs

+    Protocol,
+    /// A message send in-band from prover to verifier.
+    Message,
+    /// A hint send out-of-band from prover to verifier.


Suggested change

/// A hint send out-of-band from prover to verifier.

/// A hint sent out-of-band from prover to verifier.

tcoratger · 2025-05-26T16:14:04Z

spongefish/src/transcript/interaction.rs

+    Challenge,
+}
+
+/// Kinds of prover-verifier interactions


Here the header comment should be different that the one for InteractionKind no?

tcoratger · 2025-05-26T16:29:13Z

spongefish/src/transcript/interaction.rs

+    Challenge,
+}
+
+/// Kinds of prover-verifier interactions


Suggested change

/// Kinds of prover-verifier interactions

/// Where in the transcript the interaction sits relative to other actions.

tcoratger · 2025-05-27T10:07:20Z

spongefish/src/transcript/transcript_player.rs

    position: usize,
+    /// Wheter the transcript playback has been finalized.


Suggested change

/// Wheter the transcript playback has been finalized.

/// Whether the transcript playback has been finalized.

tcoratger · 2025-05-27T10:14:28Z

spongefish/Cargo.toml

-default = []
+default = ["arkworks-algebra", "arkworks-rand", "zerocopy"]
+arkworks-rand = [
+    # Workaround to also implement arkworks version of rand as exported by ark_std


This one should solve this no? arkworks-rs/std#60

tcoratger · 2025-05-27T10:17:52Z

spongefish/src/prover/mod.rs

+/// [`ProverState`] does not implement [`Clone`] or [`Copy`] to prevent accidental leaks.
+#[derive(Clone, PartialEq, Eq, PartialOrd, Ord, Hash, Debug)]


Here the fact that we derive Clone seems contradictory with the comment just above no?

Yes, Cloneing the prover state is a footgun, why is this needed?

I'm following the Rust API Guideline C-COMMON-TRAITS here.

Is the concern here that the user may forget to Zeroize the clones causing them to potentially live longer in memory than necessary?

it's because if the prover is erroneously copied by the user down the line, and the proof system satisfies special soundness, an adversary can extract the witness. See e.g. https://media.ccc.de/v/27c3-4087-en-console_hacking_2010 around minute 37

tcoratger · 2025-05-27T10:22:39Z

spongefish/src/prover/rng.rs

+
+impl<R: RngCore + CryptoRng> CryptoRng for ProverRng<R> {}
+
+/// Implements the version of `rand` arkworks usses


Suggested change

/// Implements the version of `rand` arkworks usses

/// Implements the version of `rand` arkworks uses

tcoratger · 2025-05-27T10:35:31Z

spongefish/src/transcript/interaction.rs

+#[derive(Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Debug, Hash)]
+pub enum Hierarchy {
+    /// A single interaction.
+    Atomic,
+    /// Start of a sub-protocol.
+    Begin,
+    /// End of a sub-protocol.
+    End,
+}


Here maybe this could be useful to have an implementation like

impl Hierarchy { /// Returns true if this is an atomic (single) interaction. pub fn is_atomic(&self) -> bool { matches!(self, Hierarchy::Atomic) } /// Returns true if this marks the beginning of a sub-protocol. pub fn is_begin(&self) -> bool { matches!(self, Hierarchy::Begin) } /// Returns true if this marks the end of a sub-protocol. pub fn is_end(&self) -> bool { matches!(self, Hierarchy::End) } }

tcoratger · 2025-05-27T10:39:06Z

spongefish/src/transcript/mod.rs

+        length: Length,
+    ) -> Result<(), Self::Error>;
+
+    /// Begin of a subprotocol.


Suggested change

/// Begin of a subprotocol.

/// Beginning of a subprotocol.

tcoratger · 2025-05-27T10:39:18Z

spongefish/src/transcript/mod.rs

+        self.end::<T>(label, Kind::Protocol, Length::None)
+    }
+
+    /// Begin of a message interaction.


Suggested change

/// Begin of a message interaction.

/// Beginning of a message interaction.

tcoratger · 2025-05-27T10:39:27Z

spongefish/src/transcript/mod.rs

+        self.end::<T>(label, Kind::Message, length)
+    }
+
+    /// Begin of a hint interaction.


Suggested change

/// Begin of a hint interaction.

/// Beginning of a hint interaction.

tcoratger · 2025-05-27T10:39:34Z

spongefish/src/transcript/mod.rs

+        self.end::<T>(label, Kind::Hint, length)
+    }
+
+    /// Begin of a challenge interaction..


Suggested change

/// Begin of a challenge interaction..

/// Beginning of a challenge interaction.

tcoratger · 2025-05-27T10:39:57Z

spongefish/src/transcript/mod.rs

+        self.begin::<T>(label, Kind::Challenge, length)
+    }
+
+    /// End of a challenge interaction..


Suggested change

/// End of a challenge interaction..

/// End of a challenge interaction.

mmaker · 2025-05-27T14:45:52Z

spongefish/src/prover/mod.rs

+        assert_ne!(buf, [0; 8]);
+    }
+
+    // #[test]


Please either add these tests or remove them

Of course! Once the approach and traits are stabilized I'll make the tests work again. Right now everything is still in flux.

mmaker · 2025-05-30T16:39:28Z

Hi @recmo, thank you so so much for this incredible work! For me this is starting to become really too big to review. Is there any chance you can split it into multiple PR's? Here's some examples that would make sense:

place all the changes related to the hint into a separate PR (if possible),
place all codec-related changes into a separate PR, excluding the arkworks serialization one,
place all codec-related ark-serialize changes into a separate PR.

If that helps, we could schedule a call (potentially with @WizardOfMenlo) for speeding things up and not slow you down?

recmo added 4 commits May 20, 2025 22:31

Add transcript

0c62284

Remove TypeId

eb2306e

Every interaction is hierarchical

2a84c58

Example ZeroCopy

f02da32

recmo changed the title ~~Add strongly typed transcripts.~~ More verbose and stricter transcripts. May 21, 2025

tcoratger reviewed May 21, 2025

View reviewed changes

recmo added 3 commits May 23, 2025 13:46

Transcript to domain separator

d6de11b

Domain separators and labels

b85385d

ProverState and prover random

1600f55

tcoratger reviewed May 26, 2025

View reviewed changes

Implement ProverState traits

349ac7b

tcoratger reviewed May 27, 2025

View reviewed changes

mmaker reviewed May 27, 2025

View reviewed changes

recmo added 12 commits May 27, 2025 19:29

New approach to traits

1b9fa68

Fix build

b190f70

Fix tests

4393621

Add back prover tests

7432a5a

Bytes traits

21f04ab

Add zerocopy

f813524

Add ark_serialize hints

b25ad1f

Add field_bytes

c2b8192

Add field_bytes

c8792f9

Challenge byte extraction

827f6f0

Test ark_serialize

c7a43b8

Add Ark Field challenges

e1ccac2

recmo added 2 commits June 2, 2025 13:42

Remove module name from zerocopy

b0c1ef3

Remove module name from bytes

16dea90

recmo added 14 commits June 2, 2025 14:15

Remove module name from unit

a55e6fd

Move unit to codecs

5cccc14

Unit is associated type

f666944

Explicit error types

02ce966

Update zeropcopy traits

1f8699c

Update arkworks::serialize traits

0d83306

Update arkworks::field traits

14d88e3

Update arkworks::field trait names

abd05ac

Simplify VerifierError

43abb51

Pattern creation is infallible

3a5fd32

Interaction errors are bugs and therefore panic

f9582c8

Remove interaction errors

70b8037

Simplify traits

9e97ff6

Static lables

39ea768

	pub trait TranscriptExt {
	pub trait TranscriptExt: Transcript {

	/// End of a hint interaction..
	/// End of a hint interaction.

	/// Begin of a challenge interaction..
	/// Begin of a challenge interaction.

	/// End of a challenge interaction..
	/// End of a challenge interaction.

	/// A message send in-band from prover to verifier.
	/// A message sent in-band from prover to verifier.

	/// A hint send out-of-band from prover to verifier.
	/// A hint sent out-of-band from prover to verifier.

	/// Kinds of prover-verifier interactions
	/// Where in the transcript the interaction sits relative to other actions.

		position: usize,
		/// Wheter the transcript playback has been finalized.

	/// Wheter the transcript playback has been finalized.
	/// Whether the transcript playback has been finalized.

		/// [`ProverState`] does not implement [`Clone`] or [`Copy`] to prevent accidental leaks.
		#[derive(Clone, PartialEq, Eq, PartialOrd, Ord, Hash, Debug)]


		impl<R: RngCore + CryptoRng> CryptoRng for ProverRng<R> {}

		/// Implements the version of `rand` arkworks usses

	/// Begin of a message interaction.
	/// Beginning of a message interaction.

	/// Begin of a hint interaction.
	/// Beginning of a hint interaction.

	/// Begin of a challenge interaction..
	/// Beginning of a challenge interaction.

More verbose and stricter transcripts. #60

Are you sure you want to change the base?

More verbose and stricter transcripts. #60

Uh oh!

Conversation

recmo commented May 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mmaker May 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

recmo May 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mmaker commented May 30, 2025

Uh oh!

Uh oh!

recmo commented May 20, 2025 •

edited

Loading

mmaker May 27, 2025 •

edited

Loading

recmo May 27, 2025 •

edited

Loading