beginning of the plonk algorithm: setup the circuit and initialize the gates

scripts/halo/plonk.sage

@@ -24,3 +24,87 @@ def get_omega():
 # Order of this element is 2^32
 omega = get_omega()
 
+var_one = K(1)
+var_x = K(4)
+var_y = K(6)
+var_s = K(1)
+var_xy = var_x * var_y
+var_x_y = var_x + var_y
+var_1_neg_s = var_one - var_s
+var_sxy = var_s * var_xy
+var_1_neg_s_x_y = var_1_neg_s * var_x_y
+#var_s_neg_1 = -var_1_neg_s
+var_zero = K(0)
+
+public_value = -(var_s * (var_x * var_y) + (1 - var_s) * (var_x + var_y))
+
+# See also the file plonk-naive.sage
+# x * y = xy
+a1, b1, c1 = var_x, var_y, var_xy
+Ql1, Qr1, Qm1, Qo1, Qc1 = 0, 0, 1, -1, 0
+assert Ql1 * a1 + Qr1 * b1 + Qm1 * a1 * b1 + Qo1 * c1 + Qc1 == 0
+# x + y = (x + y)
+a2, b2, c2 = var_x, var_y, var_x_y
+Ql2, Qr2, Qm2, Qo2, Qc2 = 1, 1, 0, -1, 0
+assert Ql2 * a2 + Qr2 * b2 + Qm2 * a2 * b2 + Qo2 * c2 + Qc2 == 0
+# 1 - s = (1 - s)
+a3, b3, c3 = var_one, var_s, var_1_neg_s
+Ql3, Qr3, Qm3, Qo3, Qc3 = 1, -1, 0, -1, 0
+assert Ql3 * a3 + Qr3 * b3 + Qm3 * a3 * b3 + Qo3 * c3 + Qc3 == 0
+# s * (xy) = sxy
+a4, b4, c4 = var_s, var_xy, var_sxy
+Ql4, Qr4, Qm4, Qo4, Qc4 = 0, 0, 1, -1, 0
+assert Ql4 * a4 + Qr4 * b4 + Qm4 * a4 * b4 + Qo4 * c4 + Qc4 == 0
+# (1 - s) * (x + y) = [(1 - s)(x + y)]
+a5, b5, c5 = var_1_neg_s, var_x_y, var_1_neg_s_x_y
+Ql5, Qr5, Qm5, Qo5, Qc5 = 0, 0, 1, -1, 0
+assert Ql5 * a5 + Qr5 * b5 + Qm5 * a5 * b5 + Qo5 * c5 + Qc5 == 0
+# (sxy) + [(1 - s)(x + y)] = public_value
+# c6 is unused
+a6, b6, c6 = var_sxy, var_1_neg_s_x_y, var_zero
+Ql6, Qr6, Qm6, Qo6, Qc6 = 1, 1, 0, 0, 0
+assert Ql6 * a6 + Qr6 * b6 + Qm6 * a6 * b6 + Qo6 * c6 + Qc6 + public_value == 0
+# one == 1, b7 and c7 unused
+a7, b7, c7 = var_one, var_zero, var_zero
+Ql7, Qr7, Qm7, Qo7, Qc7 = 1, 0, 0, 0, -1
+assert Ql7 * a7 + Qr7 * b7 + Qm7 * a7 * b7 + Qo7 * c7 + Qc7 == 0
+
+a = [a1, a2, a3, a4, a5, a6, a7]
+b = [b1, b2, b3, b4, b5, b6, b7]
+c = [c1, c2, c3, c4, c5, c6, c7]
+
+Ql = [Ql1, Ql2, Ql3, Ql4, Ql5, Ql6, Ql7]
+Qr = [Qr1, Qr2, Qr3, Qr4, Qr5, Qr6, Qr7]
+Qm = [Qm1, Qm2, Qm3, Qm4, Qm5, Qm6, Qm7]
+Qo = [Qo1, Qo2, Qo3, Qo4, Qo5, Qo6, Qo7]
+Qc = [Qc1, Qc2, Qc3, Qc4, Qc5, Qc6, Qc7]
+
+public_values = [0, 0, 0, 0, 0, public_value, 0]
+
+for a_i, b_i, c_i, Ql_i, Qr_i, Qm_i, Qo_i, Qc_i, public_i in \
+    zip(a, b, c, Ql, Qr, Qm, Qo, Qc, public_values):
+    assert (Ql_i * a_i + Qr_i * b_i + Qm_i * a_i * b_i + Qo_i * c_i
+            + Qc_i + public_i) == 0
+
+#    0   1      2      3    4               5               6
+# a: x,  x,     1,     s,   1 - s,          sxy,            1
+#
+#    7   8      9      10   11              12              13
+# b: y,  y,     s,     xy,  x + y,          (1 - s)(x + y), -
+#
+#    14  15     16     17   18              19              20
+# c: xy, x + y, 1 - s, sxy, (1 - s)(x + y), -,              -
+
+permuted_indices_a = [1,  0,  6,  9,  16, 17, 2]
+permuted_indices_b = [8,  7,  3,  14, 15, 18, 13]
+permuted_indices_c = [10, 11, 4,  5,  12, 19, 20]
+eval_domain = range(0, 21)
+
+witness = a + b + c
+permuted_indices = permuted_indices_a + permuted_indices_b + permuted_indices_c
+for i, val in enumerate(a + b + c):
+    assert val == witness[permuted_indices[i]]
+# Just used to check our values are correct
+del witness
+del permuted_indices
+