Implement PLONK
jon-chuang opened this issue · 7 comments
Why? Very fast. Universal setup + proof composition = dark contracts.
Original PLONK
SHPLONK (non-essential): Multiple commits
TurboPLONK: Custom gates (e.g. EC point addition gates, can make pairing computation extremely cheap!)
PLOOKUP : Pedersen hashes. Extension: permutation networks for branching programs/RAM?
Zexe PLONK: PLONK single-layer rollup with BLS12-377 + BW6-761
Things to Investigate
- Whether using methods similar to TurboPLONK, not only elliptic curve point addition, but also pairing/G2 ops can be made primitive
If you're looking to work on this, there is a Rust implementation here: https://github.com/dusk-network/plonk/
btw we have an implementation of a similar universal setup SNARK (Marlin) here: https://github.com/scipr-lab/marlin.
@Pratyush has anyone started working on this (an ArkWorks implementation of plonk)?
I think @kobigurk had an in-progress impl here: https://github.com/kobigurk/plonk/tree/kobigurk/port_to_zexe
It's a port of the dusk implementation indeed.
I'm getting up to speed on the plonk implementation in halo 2 and the abstraction of flexible proving systems with custom gates is really cool. Maybe an adaptation of that would be nicer.
cc @daira
We'd love a Halo 2 implementation in Arkworks! It's a bit early to do that, though.
We'd love a Halo 2 implementation in Arkworks! It's a bit early to do that, though.
Just to be clear, I was referring to how PLONK is implemented, and the proving system abstraction. Not specifically Halo 2 :)
That said, it would be really cool as well!
@kobigurk I think halo2 is more or less a (very flexible) plonk framework though? (Well notwithstanding the Halo poly-commit scheme, which is also portable, I imagine).
I think if it were ported to arkworks it would live in a separate repo to poly-commit and would have its own plonk-std perhaps. But compared to R1CS, Plonk is all about tayloring the circuit layout itself to be most efficient for a desired circuit, so its questionable if plonk-std would even be desirable.
Again, it may be instructive to look into how VLSI software organises and optimises a desired circuit over a library of standard components.