feat: greco, e0 == e0is[i] check#1049
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
WalkthroughAdded CRT decomposition fields for e0 (per-base residues and quotient polynomials), updated Greco struct/constructor and call sites to accept/reorder them, implemented a private coefficient-wise CRT consistency check invoked in verify() before Fiat–Shamir challenge generation, and propagated changes through serialization and SDK types. Changes
Sequence Diagram(s)sequenceDiagram
participant Verifier as verify()
participant CRT as check_e0_crt_consistency()
participant FS as Fiat‑Shamir (challenge gen)
participant VerifRest as remaining verification
Verifier->>CRT: Validate e0 CRT decomposition (coeff-wise using qis)
rect rgb(235,245,255)
Note over CRT: NEW — verify residues + quotients reconstruct e0 across bases
end
CRT-->>Verifier: OK / Error
alt OK
Verifier->>FS: Generate Fiat‑Shamir challenges
FS-->>Verifier: Challenges
Verifier->>VerifRest: Continue verification using challenges and inputs (including e0is/e0_quotients)
VerifRest-->>Verifier: Verification result
else Error
Verifier-->>Verifier: Abort / Reject proof
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes
Possibly related PRs
Suggested reviewers
Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
📜 Recent review detailsConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro 📒 Files selected for processing (1)
🧰 Additional context used🧠 Learnings (1)📓 Common learnings⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (10)
🔇 Additional comments (2)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
circuits/crates/libs/greco/src/lib.nr (1)
227-259: Update Greco::new call sites to match constructor signature with e0_quotients parameterVerification confirms the constructor signature includes
e0_quotients, but actual call sites are misaligned:
- ./examples/CRISP/circuits/src/main.nr (lines 75-89): Missing
e0_quotientsparameter; hase1beforee0isinstead of aftere0_quotients- ./packages/enclave-sdk/tests/fixtures/demo_circuit.json (line 220): Embedded source code has the same parameter order issue
Update both call sites to pass arguments in the correct order:
..., u, e0, e0is, e0_quotients, e1, k1, ...
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
circuits/crates/libs/greco/src/lib.nr(5 hunks)
🧰 Additional context used
🧠 Learnings (4)
📓 Common learnings
Learnt from: 0xjei
Repo: gnosisguild/enclave PR: 972
File: circuits/crates/libs/greco/src/lib.nr:192-192
Timestamp: 2025-11-07T16:17:58.988Z
Learning: In the Greco library (circuits/crates/libs/greco/src/lib.nr), the e1is array should satisfy the constraint `e1 mod qi == e1is[i]` for each CRT basis i, where qi are the CRT moduli. This constraint ensures the relationship between the global error polynomial e1 and its per-basis representations e1is[i].
Learnt from: 0xjei
Repo: gnosisguild/enclave PR: 648
File: examples/CRISP/circuits/src/main.nr:40-44
Timestamp: 2025-08-27T13:49:48.617Z
Learning: In CRISP circuits using Greco library, the binary check `assert(0 == b * (qmt - b))` for polynomial k1 should not be applied to all coefficients - only specific coefficients require this constraint, such as `k1.coefficients[2048 - 1]`.
📚 Learning: 2025-11-07T16:17:58.988Z
Learnt from: 0xjei
Repo: gnosisguild/enclave PR: 972
File: circuits/crates/libs/greco/src/lib.nr:192-192
Timestamp: 2025-11-07T16:17:58.988Z
Learning: In the Greco library (circuits/crates/libs/greco/src/lib.nr), the e1is array should satisfy the constraint `e1 mod qi == e1is[i]` for each CRT basis i, where qi are the CRT moduli. This constraint ensures the relationship between the global error polynomial e1 and its per-basis representations e1is[i].
Applied to files:
circuits/crates/libs/greco/src/lib.nr
📚 Learning: 2025-09-22T15:08:29.814Z
Learnt from: ozgurarmanc
Repo: gnosisguild/enclave PR: 734
File: packages/circuits/crates/libs/polynomial/src/lib.nr:140-155
Timestamp: 2025-09-22T15:08:29.814Z
Learning: Greco (packages/circuits/crates/libs/greco/src/lib.nr) performs range_check_1bound/2bounds on all polynomials (u, e0/e1, k1, pk*, r*, p*) before serialization; packer/flatten rely on these bounds, so per-limb asserts inside packer are unnecessary in this crate’s flow.
Applied to files:
circuits/crates/libs/greco/src/lib.nr
📚 Learning: 2025-08-27T13:49:48.617Z
Learnt from: 0xjei
Repo: gnosisguild/enclave PR: 648
File: examples/CRISP/circuits/src/main.nr:40-44
Timestamp: 2025-08-27T13:49:48.617Z
Learning: In CRISP circuits using Greco library, the binary check `assert(0 == b * (qmt - b))` for polynomial k1 should not be applied to all coefficients - only specific coefficients require this constraint, such as `k1.coefficients[2048 - 1]`.
Applied to files:
circuits/crates/libs/greco/src/lib.nr
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (8)
- GitHub Check: integration_prebuild
- GitHub Check: test_net
- GitHub Check: rust_integration
- GitHub Check: build_sdk
- GitHub Check: build_enclave_cli
- GitHub Check: test_contracts
- GitHub Check: crisp_rust_unit
- GitHub Check: rust_unit
🔇 Additional comments (4)
circuits/crates/libs/greco/src/lib.nr (4)
183-199: Struct additions fore0is/e0_quotientsare consistent with usageThe new
e0_quotients: [Polynomial<N>; L]field is wired consistently with the rest of the struct and later method usage (check_e0_crt_consistency,verify_evaluations). Keepinge0is/e0_quotientsout of the Fiat–Shamir payload is acceptable since they are only used in direct coefficient constraints rather than challenge‑based checks.
207-222: Constructor docs fore0is/e0_quotientsare clear and aligned with intentThe new argument documentation correctly explains that
e0isis the CRT decomposition ofe0ande0_quotientsare quotient witnesses for the CRT relation, matching the semantics enforced later incheck_e0_crt_consistency.
332-333: Verification step commentary matches the updated flowThe added step description for “CRT consistency for e0 polynomial” correctly reflects the new call to
check_e0_crt_consistencyinserted before the encryption‑equation checks.
352-363: Placement of CRT consistency check inverifyis appropriateRunning
check_e0_crt_consistency()right after range checks and before Fiat–Shamir challenge generation is sound: CRT consistency is enforced deterministically, and the FS challenges are then used solely for the Schwartz–Zippel‑style encryption equations. No further issues with the sequencing.
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (2)
circuits/crates/libs/greco/src/lib.nr (2)
191-193: Clarify treatment ofe0is/e0_quotientsin bounds and payload docsStruct and constructor wiring for
e0_quotientslook correct; the new field is consistently threaded throughGreco::new. However:
check_range_bounds(Line 368 onwards) still only constrainsu,e0,e1,k1,pk*,r*,p*;e0isande0_quotientsremain entirely unconstrained aside from the algebraic equalities.payload/generate_challengecomments describe “flattening all polynomials / absorbing all witness values”, but the new CRT witnesses are not included in the flattened inputs.If the intention is that
e0is/e0_quotientsare purely auxiliary CRT witnesses whose concrete values do not matter for Fiat–Shamir (only that they satisfy the equalities), it would be good to:
- Explicitly state in the doc comments that these CRT witnesses are not range-checked or included in the payload, and
- Confirm that this is acceptable for your integer/CRT soundness argument; otherwise consider adding dedicated bounds or including them in the payload with an appropriate bit-width.
Also applies to: 215-216, 234-259, 368-409
328-329: Verify ordering and documentation of the new CRT consistency stepHooking
check_e0_crt_consistencyintoverifyimmediately aftercheck_range_boundsand before challenge generation is the right place for this kind of structural check, and the updated step numbering in the docstring matches the code.One minor thing to double-check: comments above the encryption equations (Lines 336–338) still describe them in terms of
e0(gamma), whileverify_evaluationsusese0is[i]in the ct0 equation and now relies on the CRT consistency check to tiee0ande0is. It may be worth updating the comment to mention that the enforced equation is written withe0isbut is equivalent to the intendede0-based equation under the CRT constraints, just to avoid confusion for future readers.Also applies to: 351-352, 354-354, 357-359
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
circuits/crates/libs/greco/src/lib.nr(5 hunks)
🧰 Additional context used
🧠 Learnings (4)
📓 Common learnings
Learnt from: 0xjei
Repo: gnosisguild/enclave PR: 972
File: circuits/crates/libs/greco/src/lib.nr:192-192
Timestamp: 2025-11-07T16:17:58.988Z
Learning: In the Greco library (circuits/crates/libs/greco/src/lib.nr), the e1is array should satisfy the constraint `e1 mod qi == e1is[i]` for each CRT basis i, where qi are the CRT moduli. This constraint ensures the relationship between the global error polynomial e1 and its per-basis representations e1is[i].
📚 Learning: 2025-11-07T16:17:58.988Z
Learnt from: 0xjei
Repo: gnosisguild/enclave PR: 972
File: circuits/crates/libs/greco/src/lib.nr:192-192
Timestamp: 2025-11-07T16:17:58.988Z
Learning: In the Greco library (circuits/crates/libs/greco/src/lib.nr), the e1is array should satisfy the constraint `e1 mod qi == e1is[i]` for each CRT basis i, where qi are the CRT moduli. This constraint ensures the relationship between the global error polynomial e1 and its per-basis representations e1is[i].
Applied to files:
circuits/crates/libs/greco/src/lib.nr
📚 Learning: 2025-09-22T15:08:29.814Z
Learnt from: ozgurarmanc
Repo: gnosisguild/enclave PR: 734
File: packages/circuits/crates/libs/polynomial/src/lib.nr:140-155
Timestamp: 2025-09-22T15:08:29.814Z
Learning: Greco (packages/circuits/crates/libs/greco/src/lib.nr) performs range_check_1bound/2bounds on all polynomials (u, e0/e1, k1, pk*, r*, p*) before serialization; packer/flatten rely on these bounds, so per-limb asserts inside packer are unnecessary in this crate’s flow.
Applied to files:
circuits/crates/libs/greco/src/lib.nr
📚 Learning: 2025-08-27T13:49:48.617Z
Learnt from: 0xjei
Repo: gnosisguild/enclave PR: 648
File: examples/CRISP/circuits/src/main.nr:40-44
Timestamp: 2025-08-27T13:49:48.617Z
Learning: In CRISP circuits using Greco library, the binary check `assert(0 == b * (qmt - b))` for polynomial k1 should not be applied to all coefficients - only specific coefficients require this constraint, such as `k1.coefficients[2048 - 1]`.
Applied to files:
circuits/crates/libs/greco/src/lib.nr
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (10)
- GitHub Check: build_enclave_cli
- GitHub Check: test_net
- GitHub Check: test_contracts
- GitHub Check: integration_prebuild
- GitHub Check: build_e3_support_risc0
- GitHub Check: crisp_rust_unit
- GitHub Check: rust_integration
- GitHub Check: build_e3_support_dev
- GitHub Check: rust_unit
- GitHub Check: build_sdk
🔇 Additional comments (1)
circuits/crates/libs/greco/src/lib.nr (1)
295-321: Coefficient-wise CRT check fore0now matches the intended security propertyThe new
check_e0_crt_consistencyimplementation performs a per-coefficient assertion:
- For each
iin0..Landjin0..N, it enforces
e0[j] == e0is[i][j] + e0_quotients[i][j] * qis[i].This is the right granularity: it enforces
e0 ≡ e0is[i] (mod qi)coefficient-wise and avoids the earlier pitfall where summing differences into a single accumulator allowed cancellations across coefficients. This aligns with the prior design goal for CRT consistency (similar to the earliere1/e1isconstraints). Based on learnings, this is the correct shape of constraint.
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
examples/CRISP/crates/zk-inputs/src/serialization.rs (1)
234-251: Tighten invariants and tests around e0_quotients CRT decompositionThe
e0_quotientscomputation looks correct conceptually, but it currently relies on several implicit invariants:
vectors_standard.e0is.len()must equalcrypto_params.moduli.len(); otherwisemoduli[i]can panic ife0isis longer.- Each
e0imust have the same length asvectors_standard.e0; otherwisezipsilently truncates to the shorter length and drops trailing coefficients.- For the intended CRT relation, you also rely on
(e0_coeff - e0i_coeff)being divisible byqiso the quotient matches the witness used in the Greco check.If these properties are guaranteed elsewhere, consider adding a short comment and/or
debug_assert_eq!s to document them for future maintainers.To make the new field harder to accidentally break, it would help to extend the tests to cover both the in‑memory and JSON shapes. For example:
@@ fn test_construct_inputs_basic() { - assert!(inputs.u.is_object()); - assert!(inputs.e0.is_object()); - assert!(inputs.e1.is_object()); - assert!(inputs.k1.is_object()); + assert!(inputs.u.is_object()); + assert!(inputs.e0.is_object()); + assert!(inputs.e1.is_object()); + assert!(inputs.k1.is_object()); + // e0 has one CRT slice per modulus, and quotients mirror that shape. + assert_eq!(inputs.e0is.len(), vectors.e0is.len()); + assert_eq!(inputs.e0_quotients.len(), vectors.e0is.len()); @@ fn test_serialize_inputs_to_json() { - assert!(parsed.get("pk0is").is_some()); - assert!(parsed.get("pk1is").is_some()); + assert!(parsed.get("pk0is").is_some()); + assert!(parsed.get("pk1is").is_some()); + assert!(parsed.get("e0_quotients").is_some());This both documents the expected shape and ensures future refactors keep
e0_quotientswired up correctly. Based on learnings, this mirrors the CRT relation previously enforced fore1ande1is.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
examples/CRISP/crates/zk-inputs/src/serialization.rs(2 hunks)
🧰 Additional context used
🧠 Learnings (1)
📓 Common learnings
Learnt from: 0xjei
Repo: gnosisguild/enclave PR: 972
File: circuits/crates/libs/greco/src/lib.nr:192-192
Timestamp: 2025-11-07T16:17:58.988Z
Learning: In the Greco library (circuits/crates/libs/greco/src/lib.nr), the e1is array should satisfy the constraint `e1 mod qi == e1is[i]` for each CRT basis i, where qi are the CRT moduli. This constraint ensures the relationship between the global error polynomial e1 and its per-basis representations e1is[i].
Learnt from: ozgurarmanc
Repo: gnosisguild/enclave PR: 734
File: packages/circuits/crates/libs/polynomial/src/lib.nr:140-155
Timestamp: 2025-09-22T15:08:29.814Z
Learning: Greco (packages/circuits/crates/libs/greco/src/lib.nr) performs range_check_1bound/2bounds on all polynomials (u, e0/e1, k1, pk*, r*, p*) before serialization; packer/flatten rely on these bounds, so per-limb asserts inside packer are unnecessary in this crate’s flow.
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (10)
- GitHub Check: rust_integration
- GitHub Check: build_e3_support_risc0
- GitHub Check: build_sdk
- GitHub Check: build_e3_support_dev
- GitHub Check: test_contracts
- GitHub Check: build_enclave_cli
- GitHub Check: integration_prebuild
- GitHub Check: test_net
- GitHub Check: crisp_rust_unit
- GitHub Check: rust_unit
🔇 Additional comments (1)
examples/CRISP/crates/zk-inputs/src/serialization.rs (1)
39-42: Public ZKInputs JSON contract changed; confirm all downstream consumers are updated
ZKInputsispubandSerialize, so addinge0_quotientsand movinge1changes the serialized JSON shape (new key and key order). That’s usually fine, but any code that:
- deserializes with a fixed schema, or
- relies on a particular field order for hashing/transcripts
will need to tolerate/expect the new field and position. Please double‑check CRISP consumers, circuit drivers, and tooling that read these witnesses to ensure they accept the updated schema.
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
examples/CRISP/packages/crisp-sdk/src/types.ts (1)
156-157: Document CRT alignment invariants fore0is/e0_quotients.The new
e0_quotients: Polynomial[]plus reorderede1look consistent with the Greco changes (CRT decomposition ofe0and updated constructor ordering). To make this easier to use correctly from the SDK side, consider adding a brief comment here clarifying that:
e0isande0_quotientshave the same length ascrypto.qis, and- they are index‑aligned with the CRT basis (i.e., for each
i,e0is reconstructed frome0is[i]ande0_quotients[i]againstqis[i]).This mirrors the documented relationship for
e1/e1isin the Greco library and will help callers avoid subtle mis-ordering bugs. Based on learnings, this keeps the CRT constraints explicit at the type boundary.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
examples/CRISP/packages/crisp-sdk/src/types.ts(1 hunks)
🧰 Additional context used
🧠 Learnings (1)
📓 Common learnings
Learnt from: 0xjei
Repo: gnosisguild/enclave PR: 972
File: circuits/crates/libs/greco/src/lib.nr:192-192
Timestamp: 2025-11-07T16:17:58.988Z
Learning: In the Greco library (circuits/crates/libs/greco/src/lib.nr), the e1is array should satisfy the constraint `e1 mod qi == e1is[i]` for each CRT basis i, where qi are the CRT moduli. This constraint ensures the relationship between the global error polynomial e1 and its per-basis representations e1is[i].
Learnt from: ozgurarmanc
Repo: gnosisguild/enclave PR: 734
File: packages/circuits/crates/libs/polynomial/src/lib.nr:140-155
Timestamp: 2025-09-22T15:08:29.814Z
Learning: Greco (packages/circuits/crates/libs/greco/src/lib.nr) performs range_check_1bound/2bounds on all polynomials (u, e0/e1, k1, pk*, r*, p*) before serialization; packer/flatten rely on these bounds, so per-limb asserts inside packer are unnecessary in this crate’s flow.
|
the check_e0_crt_consistency function looks good to me. |
cedoor
force-pushed
the
feat/greco-e0-e0is-check
branch
from
ce6ec31 to
6c7b966
Compare
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
circuits/crates/libs/greco/src/lib.nr (1)
271-293: Optional: consider whethere0is/e0_quotientsshould be absorbed into the Fiat–Shamir payloadRight now
payload()only flattenspk*,ct*,e0,e1,u,k1,r*,p*; the new CRT witnessese0isande0_quotientsonly affect constraints viacheck_e0_crt_consistencyand the ct0 evaluation equation, but are not part of the sponge input. If you want the FS challenges to be bound to all independent witness polynomials, it may be worth either (a) including these arrays inpayload()or (b) explicitly documenting that they are treated as derived frome0/qis(and thus not independent). This is not a correctness bug, just something to double‑check against your proof/soundness argument.Also applies to: 295-321
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (4)
circuits/crates/libs/greco/src/lib.nr(5 hunks)examples/CRISP/circuits/src/main.nr(2 hunks)examples/CRISP/crates/zk-inputs/src/serialization.rs(2 hunks)examples/CRISP/packages/crisp-sdk/src/types.ts(1 hunks)
🚧 Files skipped from review as they are similar to previous changes (2)
- examples/CRISP/crates/zk-inputs/src/serialization.rs
- examples/CRISP/packages/crisp-sdk/src/types.ts
🧰 Additional context used
🧠 Learnings (5)
📓 Common learnings
Learnt from: 0xjei
Repo: gnosisguild/enclave PR: 972
File: circuits/crates/libs/greco/src/lib.nr:192-192
Timestamp: 2025-11-07T16:17:58.988Z
Learning: In the Greco library (circuits/crates/libs/greco/src/lib.nr), the e1is array should satisfy the constraint `e1 mod qi == e1is[i]` for each CRT basis i, where qi are the CRT moduli. This constraint ensures the relationship between the global error polynomial e1 and its per-basis representations e1is[i].
Learnt from: ozgurarmanc
Repo: gnosisguild/enclave PR: 734
File: packages/circuits/crates/libs/polynomial/src/lib.nr:140-155
Timestamp: 2025-09-22T15:08:29.814Z
Learning: Greco (packages/circuits/crates/libs/greco/src/lib.nr) performs range_check_1bound/2bounds on all polynomials (u, e0/e1, k1, pk*, r*, p*) before serialization; packer/flatten rely on these bounds, so per-limb asserts inside packer are unnecessary in this crate’s flow.
📚 Learning: 2025-11-07T16:17:58.988Z
Learnt from: 0xjei
Repo: gnosisguild/enclave PR: 972
File: circuits/crates/libs/greco/src/lib.nr:192-192
Timestamp: 2025-11-07T16:17:58.988Z
Learning: In the Greco library (circuits/crates/libs/greco/src/lib.nr), the e1is array should satisfy the constraint `e1 mod qi == e1is[i]` for each CRT basis i, where qi are the CRT moduli. This constraint ensures the relationship between the global error polynomial e1 and its per-basis representations e1is[i].
Applied to files:
circuits/crates/libs/greco/src/lib.nrexamples/CRISP/circuits/src/main.nr
📚 Learning: 2025-09-22T15:08:29.814Z
Learnt from: ozgurarmanc
Repo: gnosisguild/enclave PR: 734
File: packages/circuits/crates/libs/polynomial/src/lib.nr:140-155
Timestamp: 2025-09-22T15:08:29.814Z
Learning: Greco (packages/circuits/crates/libs/greco/src/lib.nr) performs range_check_1bound/2bounds on all polynomials (u, e0/e1, k1, pk*, r*, p*) before serialization; packer/flatten rely on these bounds, so per-limb asserts inside packer are unnecessary in this crate’s flow.
Applied to files:
circuits/crates/libs/greco/src/lib.nrexamples/CRISP/circuits/src/main.nr
📚 Learning: 2025-08-27T13:49:48.617Z
Learnt from: 0xjei
Repo: gnosisguild/enclave PR: 648
File: examples/CRISP/circuits/src/main.nr:40-44
Timestamp: 2025-08-27T13:49:48.617Z
Learning: In CRISP circuits using Greco library, the binary check `assert(0 == b * (qmt - b))` for polynomial k1 should not be applied to all coefficients - only specific coefficients require this constraint, such as `k1.coefficients[2048 - 1]`.
Applied to files:
circuits/crates/libs/greco/src/lib.nr
📚 Learning: 2025-08-27T14:02:25.412Z
Learnt from: 0xjei
Repo: gnosisguild/enclave PR: 648
File: examples/CRISP/circuits/src/main.nr:40-44
Timestamp: 2025-08-27T14:02:25.412Z
Learning: In CRISP circuits using Greco library, k1 represents a binary value encoded as a polynomial where only one specific coefficient (k1.coefficients[2048 - 1]) carries the actual binary information and needs the constraint `assert(0 == b * (qmt - b))`. Other coefficients in the polynomial are not significant and don't require the binary constraint.
Applied to files:
examples/CRISP/circuits/src/main.nr
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (8)
- GitHub Check: integration_prebuild
- GitHub Check: build_sdk
- GitHub Check: build_enclave_cli
- GitHub Check: test_net
- GitHub Check: test_contracts
- GitHub Check: rust_integration
- GitHub Check: rust_unit
- GitHub Check: crisp_rust_unit
🔇 Additional comments (3)
examples/CRISP/circuits/src/main.nr (1)
35-38: Greco wiring fore0is/e0_quotientsis consistentThe new
e0_quotients: [Polynomial<512>; 2]parameter and the reorderede1are threaded intoGreco::newin the same order as the updated constructor signature (e0,e0is,e0_quotients,e1). ForN=512, L=2this wiring looks correct, and I don’t see any mismatches here.Also applies to: 76-87
circuits/crates/libs/greco/src/lib.nr (2)
190-199: Struct and constructor changes fore0CRT data are internally consistentThe
Grecostruct, constructor signature, and initializer all agree on the new ordering:e0, thene0is, thene0_quotients, thene1, followed by the existing randomness polynomials. Call sites (e.g. CRISP main) match this order, and types line up as[Polynomial<N>; L]as expected. I don’t see any wiring or type issues here.Also applies to: 227-241, 243-259
215-222:check_e0_crt_consistencyenforces the intended per‑coefficient CRT relationThe new method now checks, for every basis
iand coefficientj, that
e0[j] == e0is[i][j] + e0_quotients[i][j] * qis[i]via a direct
assertinside the nested loops, which gives true coefficient‑wise CRT consistency instead of a weaker aggregated check. Integrating this as a pre‑challenge step inverify()matches the documented security goal and mirrors the earlier “per‑basis CRT correctness” style from the e1/e1is design. Based on learnings, this is the right shape for the CRT constraint.Also applies to: 295-321, 347-359
4 participants
Summary by CodeRabbit
New Features
Documentation
Refactor
Chores
✏️ Tip: You can customize this high-level summary in your review settings.