… & translator op=0 fixes, single VK regen) (AztecProtocol#500) * feat(bb)!: hard-code shift size in merge verifier (port AztecProtocol#409 to next) Forward-port of AztecProtocol/aztec-packages-private#409 from v5-next to next. The Chonk final merge verifier read the op-queue placement shift_size from the prover transcript instead of pinning it to the fixed privacy offset, letting a malicious prover leak the private op-queue extent (kernels audit finding AztecProtocol/aztec-claude#1602). The verifier now computes the shift itself from HIDING_KERNEL_ULTRA_OPS; the prover asserts its hiding subtable matches and stops sending shift_size, shrinking the merge proof 42->41 fields. Resolved against next's divergence: HIDING_KERNEL_ULTRA_OPS uses next's circuit value (359, not v5-next's 331); proof-length constants take the -1 delta off next's bases; next's deletion of noir-protocol-circuits/pinned-build is honored and its test refactor kept. CHONK_RECURSION_GATES and the mock-protocol-circuits pinned build need CI-confirmed regeneration on next's bb. * fix(bb)!: enforce op = 0 in odd rows in translator (port AztecProtocol#378 to next) Forward-port of AztecProtocol/aztec-packages-private#378 from v5-next to next. Translator soundness requires op = 0 on odd rows: otherwise a genuine ECC operation placed on an odd row is skipped by the non-native accumulator (gated by lagrange_even * op), letting a malicious prover drop an op from the batched evaluation. The opcode relation now enforces op * (op-3)(op-4)(op-8) * lagrange_even + op * lagrange_odd so even rows keep op in {0,3,4,8} and odd rows force op = 0. Masking ops are unaffected (both lagrange selectors are zero in the masking region). Includes the odd-row negative tests. Scope vs next: AztecProtocol#378 also added the ShiftableFirstCoeffZero relation, its flavor wiring, and a pippenger SIMD-store change; next already carries the relation (plus short-monomial variants) and uses a different, intentional 16-byte-aligned store, so only the opcode fix + its tests are ported. CHONK_RECURSION_GATES is provisional (next's value + AztecProtocol#378's measured +27) and the translator VK / chonk pinned inputs need CI-confirmed regeneration. * feat(bb)!: full-width Fiat-Shamir challenges by default Make get_challenge/get_challenges return full-width (~254-bit) field challenges by default and add an explicit get_short_challenge(s) API for the callsites that genuinely need short scalars: IPA SRS folding, pairing-point aggregation, and the AVM / hypernova / per-step-merge commitment batching (short scalars let the ECCVM use the cheaper short scalar-mul). Split the codec into convert_full_challenge / convert_short_challenge and implement the full cross-field fr->fq conversion (exact natively since r < q; bigfield limb-decomposition via the audited split_unique in-circuit). Gemini:r and Shplonk:z (whose Schwartz-Zippel degree scales with the circuit size) now use the full-width default directly, superseding the interim get_full_challenge accessor. Also fixes batch-merge ecc-op-hash binding to use the full running hash instead of split_challenge[0] (now exact, 2^-254), resolves the HIDING_KERNEL_ULTRA_OPS namespace ambiguity that broke dsl test compilation, and regenerates the recursive-verifier gate counts that shrank now that in-circuit split_challenge is gone. Adds short+full coverage to the field-conversion and transcript tests. Breaking: rotates Honk verification keys (Fiat-Shamir derivation changes). * feat(sol): use full-width Fiat-Shamir challenges in Honk verifiers Match the Solidity verifiers to the C++ full-challenge transcript: each challenge is now the full keccak output reduced mod P rather than a 127-bit half of one hash. splitChallenge is removed; eta/rom_logup_gamma and beta/gamma each squeeze a second keccak over only the previous challenge, mirroring the C++ batched get_challenges whose second squeeze sees an empty round buffer. Applies to Transcript.sol, ZKTranscript.sol, and the optimized assembly templates (honk-optimized, zk-honk-optimized); the four embedded contract hpp templates are regenerated. No VK changes — challenge width does not affect circuit-polynomial commitments. * fix(bb): use get_append_offset_for_prover in translator bench The no-arg get_append_offset() is now private; use the public get_append_offset_for_prover() accessor, matching the translator tests and merge prover. * fix format * fix provenance * eccvm gate count * removing retroactive comments * rebuild pins, restore original batch merge, silence test * upd comments in transcript and field conversion * chore(bb): refresh pinned Chonk IVC inputs to 42ffe8bc8b4f60d8 Generated by ci-refresh-chonk. Only the pinned Chonk input hash is committed here; the immediate follow-up CI run is skipped intentionally. --ci-skip * trigger * address Federico's review --------- Co-authored-by: federicobarbacovi <171914500+federicobarbacovi@users.noreply.github.com> Co-authored-by: sergei iakovenko <105737703+iakovenkos@users.noreply.github.com> Co-authored-by: iakovenkos <sergey.s.yakovenko@gmail.com> Co-authored-by: AztecBot <tech@aztecprotocol.com>

Add Public Tree Roots Tree #409

Description

Activity

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions