wnaf audited except for the multiset-equality constraints.

notnotraju · notnotraju · commit 2f9d92bbae78 · 2025-08-25T16:34:29.000Z
diff --git a/barretenberg/cpp/src/barretenberg/eccvm/README.md b/barretenberg/cpp/src/barretenberg/eccvm/README.md
@@ -354,14 +354,14 @@ which is of course a bijection $\{-15, -13, \ldots, 15\}\rightarrow \{0,\ldots,
 The following is one row in the Precomputed table; there are `NUM_WNAF_DIGITS_PER_SCALAR / WNAF_DIGITS_PER_ROW == 32/4 = 8` rows. The row index is `i`. (This number is is also witnessed as `round`.)
 | column name | builder name | value range | computation | description |
 | ----------- | ---------------------- | ----------- | --------------------------------------------------------------- | ------------------------------------------------------- |
-| precompute_s1hi | s1 | $[0, 4)$ | | first two bits of $\text{compress}(a*{31 - 4i})$ |
-| precompute_s1lo | s2 | $[0, 4)$ | | second two bits of $\text{compress}(a*{31 - 4i})$ |
-| precompute_s2hi | s3 | $[0, 4)$ | | first two bits of $\text{compress}(a*{31 - (4i + 1)})$ |
-| precompute_s2lo | s4 | $[0, 4)$ | | second two bits of $\text{compress}(a*{31 - (4i + 1)})$ |
-| precompute_s3hi | s5 | $[0, 4)$ | | first two bits of $\text{compress}(a*{31 - (4i + 2)})$ |
-| precompute_s3lo | s6 | $[0, 4)$ | | second two bits of $\text{compress}(a*{31 - (4i + 2)})$ |
-| precompute_s4hi | s7 | $[0, 4)$ | | first two bits of $\text{compress}(a*{31 - (4i + 3)})$ |
-| precompute_s4lo | s8 | $[0, 4)$ | | second two bits of $\text{compress}(a*{31 - (4i + 3)})$ |
+| precomputes1hi | s1 | $[0, 4)$ | | first two bits of ${\text{compress}(a_{31 - 4i})}$ |
+| precomputes1lo | s2 | $[0, 4)$ | | second two bits of ${\text{compress}(a_{31 - 4i})}$ |
+| precomputes2hi | s3 | $[0, 4)$ | | first two bits of ${\text{compress}(a_{31 - (4i + 1)})}$ |
+| precomputes2lo | s4 | $[0, 4)$ | | second two bits of ${\text{compress}(a_{31 - (4i + 1)})}$ |
+| precomputes3hi | s5 | $[0, 4)$ | | first two bits of ${\text{compress}(a_{31 - (4i + 2)})}$ |
+| precomputes3lo | s6 | $[0, 4)$ | | second two bits of ${\text{compress}(a_{31 - (4i + 2)})}$ |
+| precomputes4hi | s7 | $[0, 4)$ | | first two bits of ${\text{compress}(a_{31 - (4i + 3)})}$ |
+| precomputes4lo | s8 | $[0, 4)$ | | second two bits of ${\text{compress}(a_{31 - (4i + 3)})}$ |
 | precompute_skew | skew | $\{0,1\}$ | | skew bit |
 | precompute_point_transition | point_transition | $\{0,1\}$ | | are we at the last row corresponding to this scalar? |
 | precompute_pc | pc | $\fq$ | | value of the program counter of this EC operation |
diff --git a/barretenberg/cpp/src/barretenberg/eccvm/eccvm_builder_types.hpp b/barretenberg/cpp/src/barretenberg/eccvm/eccvm_builder_types.hpp
@@ -28,7 +28,7 @@ template <typename CycleGroup> struct ScalarMul {
     typename CycleGroup::affine_element base_point;
     std::array<int, NUM_WNAF_DIGITS_PER_SCALAR>
         wnaf_digits; // [a_{n-1}, a_{n-1}, ..., a_{0}], where each a_i ∈ {-2ʷ⁻¹ + 1, -2ʷ⁻¹ + 3, ..., 2ʷ⁻¹ - 3, 2ʷ⁻¹ -
-                     // 1} ∪ {0}. (here, w = `NUM_WNAF_DIGIT_BITS`). in particular, a_i is an odd integer with
+                     // 1}. (here, w = `NUM_WNAF_DIGIT_BITS`). in particular, a_i is an odd integer with
                      // absolute value less than 2ʷ. Represents the number `scalar` = ∑ᵢ aᵢ 2⁴ⁱ - `wnaf_skew`.
     bool wnaf_skew;  // necessary to represent _even_ integers
     // size bumped by 1 to record base_point.dbl()
diff --git a/barretenberg/cpp/src/barretenberg/eccvm/eccvm_flavor.hpp b/barretenberg/cpp/src/barretenberg/eccvm/eccvm_flavor.hpp
@@ -509,7 +509,7 @@ class ECCVMFlavor {
          *          transcript_msm_count_at_transition_inverse: used to validate transcript_msm_count_zero_at_transition
          *          precompute_pc: point counter for Straus precomputation columns
          *          precompute_select: if 1, evaluate Straus precomputation algorithm at current row
-         *          precompute_point_transition: 1 if current row operating on a different point to previous row
+         *          precompute_point_transition: 1 if next row operating on a different point than current row.
          *          precompute_round: round counter for Straus precomputation algorithm
          *          precompute_scalar_sum: accumulating sum of Straus scalar slices
          *          precompute_s1hi/lo: 2-bit hi/lo components of a Straus 4-bit scalar slice
diff --git a/barretenberg/cpp/src/barretenberg/relations/ecc_vm/ecc_wnaf_relation_impl.hpp b/barretenberg/cpp/src/barretenberg/relations/ecc_vm/ecc_wnaf_relation_impl.hpp
@@ -18,17 +18,18 @@ namespace bb {
  * | point_transition | round | slices          | skew   | scalar_sum                      |
  * | ---------------- | ----- | --------------- | ------ | ------------------------------- |
  * | 0                | 0     | s0,s1,s2,s3     | 0      | 0                               |
- * | 0                | 1     | s4,s5,s6,s7     | 0      | \sum_{i=0}^4 16^i * s_{31 - i}  |
- * | 0                | 2     | s8,s9,s10,s11   | 0      | \sum_{i=0}^8 16^i * s_{31 - i}  |
- * | 0                | 3     | s12,s13,s14,s14 | 0      | \sum_{i=0}^12 16^i * s_{31 - i} |
- * | 0                | 4     | s16,s17,s18,s19 | 0      | \sum_{i=0}^16 16^i * s_{31 - i} |
- * | 0                | 5     | s20,s21,s22,s23 | 0      | \sum_{i=0}^20 16^i * s_{31 - i} |
- * | 0                | 6     | s24,s25,s26,s27 | 0      | \sum_{i=0}^24 16^i * s_{31 - i} |
- * | 1                | 7     | s28,s29,s30,s31 | s_skew | \sum_{i=0}^28 16^i * s_{31 - i} |
+ * | 0                | 1     | s4,s5,s6,s7     | 0      | \sum_{i=0}^4 16^i * s_{3 - i}   |
+ * | 0                | 2     | s8,s9,s10,s11   | 0      | \sum_{i=0}^8 16^i * s_{7 - i}   |
+ * | 0                | 3     | s12,s13,s14,s14 | 0      | \sum_{i=0}^12 16^i * s_{11 - i} |
+ * | 0                | 4     | s16,s17,s18,s19 | 0      | \sum_{i=0}^16 16^i * s_{15 - i} |
+ * | 0                | 5     | s20,s21,s22,s23 | 0      | \sum_{i=0}^20 16^i * s_{19 - i} |
+ * | 0                | 6     | s24,s25,s26,s27 | 0      | \sum_{i=0}^24 16^i * s_{23 - i} |
+ * | 1                | 7     | s28,s29,s30,s31 | s_skew | \sum_{i=0}^28 16^i * s_{27 - i} |
  *
- * The value of the input scalar is equal to the following:
+ * The value of the input scalar is equal to the following: RAJU: check this, seems obviously right but need to make
+ * sure set_relation is compatible etc.
  *
- * scalar = 2^16 * scalar_sum + 2^12 * s31 + 2^8 * s30 + 2^4 * s29 + s28 - s_skew
+ * scalar = 2^16 * scalar_sum + 2^12 * s28 + 2^8 * s29 + 2^4 * s30 + s31 - s_skew
  * We use a set equality check in `ecc_set_relation.hpp` to validate the above value maps to the correct input
  * scalar for a given value of `pc`.
  *
@@ -49,7 +50,7 @@ void ECCVMWnafRelationImpl<FF>::accumulate(ContainerOverSubrelations& accumulato
     using View = typename Accumulator::View;
 
     auto scalar_sum = View(in.precompute_scalar_sum);
-    auto scalar_sum_new = View(in.precompute_scalar_sum_shift);
+    auto scalar_sum_shift = View(in.precompute_scalar_sum_shift);
     auto q_transition = View(in.precompute_point_transition);
     auto round = View(in.precompute_round);
     auto round_shift = View(in.precompute_round_shift);
@@ -71,6 +72,9 @@ void ECCVMWnafRelationImpl<FF>::accumulate(ContainerOverSubrelations& accumulato
         acc += ((s - 1).sqr() - 1) * ((s - 2).sqr() - 1) * scaling_factor;
     };
 
+    // given two 2-bit numbers `s0, `s1`, convert to a wNAF digit (in {-15, -13, ..., 13, 15}) via the formula:
+    // `2(4s0 + s1) - 15`. (Here, `4s0 + s1` represents the 4-bit number corresponding to the concatenation of `s0` and
+    // `s1`.)
     const auto convert_to_wnaf = [](const View& s0, const View& s1) {
         auto t = s0 + s0;
         t += t;
@@ -80,7 +84,9 @@ void ECCVMWnafRelationImpl<FF>::accumulate(ContainerOverSubrelations& accumulato
     };
 
     const auto scaled_transition = q_transition * scaling_factor;
-    const auto scaled_transition_is_zero = -scaled_transition + scaling_factor;
+    const auto scaled_transition_is_zero =
+        -scaled_transition + scaling_factor; // `scaling_factor * (1 - q_transition)`, i.e., is the scaling_factor if we
+                                             // are _not_ at a transition, else 0.
     /**
      * @brief Constrain each of our scalar slice chunks (s1, ..., s8) to be 2 bits.
      * Doing range checks this way vs permutation-based range check removes need to create sorted list + grand product
@@ -127,7 +133,9 @@ void ECCVMWnafRelationImpl<FF>::accumulate(ContainerOverSubrelations& accumulato
      *       i.e. when q_transition  = 0
      * TODO(@zac-williamson) Optimize WNAF use (#2224)
      */
-    auto row_slice = w0;
+    auto row_slice = w0; // row_slice will eventually contain the truncated scalar corresponding to the current row,
+                         // which is 2^12 * w_0 + 2^8 * w_1 + 2^4 * w_2 + w_3. (If one just looks at the wNAF digits in
+                         // this row, this is the resulting odd number. Note that it is not necessarily positive.)
     row_slice += row_slice;
     row_slice += row_slice;
     row_slice += row_slice;
@@ -144,7 +152,7 @@ void ECCVMWnafRelationImpl<FF>::accumulate(ContainerOverSubrelations& accumulato
     row_slice += row_slice;
     row_slice += w3;
     auto sum_delta = scalar_sum * FF(1ULL << 16) + row_slice;
-    const auto check_sum = scalar_sum_new - sum_delta;
+    const auto check_sum = scalar_sum_shift - sum_delta;
     std::get<8>(accumulator) += precompute_select * check_sum * scaled_transition_is_zero;
 
     /**
@@ -159,7 +167,7 @@ void ECCVMWnafRelationImpl<FF>::accumulate(ContainerOverSubrelations& accumulato
      * Let us analyze...
      * 1. When `q_transition = 1`, we use a set membership check to map the tuple of (pc, scalar_sum) into a set.
      * We compare this set with an equivalent set generated from the transcript columns. The sets must match.
-     * 2. Only case where, at row `i`, a Prover can set `round` to value > 7 is if `q_transition = 0` for all j > i.
+     * 2. The only case where, at row `i`, a Prover can set `round` to value > 7 is if `q_transition = 0` for all j > i.
      *  `precompute_pc` decrements by 1 when `q_transition` = 1
      * We can infer from 1, 2, that if `round > 7`, the resulting wnafs will map into a set at a value of `pc` that is
      * greater than all valid msm pc values (assuming the set equivalence check on the scalar sums is satisfied).
@@ -173,17 +181,19 @@ void ECCVMWnafRelationImpl<FF>::accumulate(ContainerOverSubrelations& accumulato
     // => q_transition * (round - 7 - round_shift + round + 1) + (round_shift - round - 1)
     // => q_transition * (2 * round - round_shift - 6) + (round_shift - round - 1)
     const auto round_check = round_shift - round - 1;
-    std::get<9>(accumulator) += precompute_select * scaled_transition * ((round - round_check - 7) + round_check);
-    std::get<10>(accumulator) += precompute_select * scaled_transition * round_shift;
+    std::get<9>(accumulator) +=
+        precompute_select * (scaled_transition * (round - round_check - 7) + scaling_factor * round_check);
+    std::get<10>(accumulator) +=
+        precompute_select * scaled_transition * round_shift; // at a transition, next round == 0
 
     /**
-     * @brief Scalar transition checks.
+     * @brief Scalar transition/PC checks.
      * 1: if q_transition = 1, scalar_sum_new = 0
      * 2: if q_transition = 0, pc at next row = pc at current row
      * 3: if q_transition = 1, pc at next row = pc at current row - 1 (decrements by 1)
      * (we combine 2 and 3 into a single relation)
      */
-    std::get<11>(accumulator) += precompute_select * scalar_sum_new * scaled_transition;
+    std::get<11>(accumulator) += precompute_select * scaled_transition * scalar_sum_shift;
     // (2, 3 combined): q_transition * (pc - pc_shift - 1) + (-q_transition + 1) * (pc_shift - pc)
     // => q_transition * (-2 * (pc_shift - pc) - 1) + (pc_shift - pc)
     const auto pc_delta = pc_shift - pc;
@@ -200,7 +210,7 @@ void ECCVMWnafRelationImpl<FF>::accumulate(ContainerOverSubrelations& accumulato
      * 2: in ecc_msm_relation. Final MSM round uses skew to conditionally subtract a point from the accumulator
      */
     std::get<13>(accumulator) += precompute_select * (precompute_skew * (precompute_skew - 7)) * scaling_factor;
-
+    // set round slices, pc, and round all to zero when `precompute_select == 0`.
     const auto precompute_select_zero = (-precompute_select + 1) * scaling_factor;
     std::get<14>(accumulator) += precompute_select_zero * (w0 + 15);
     std::get<15>(accumulator) += precompute_select_zero * (w1 + 15);
