feat: Switch verifier 6 to rolling hash (#149)

Previous implementation did a hash over all inputs. This does not line
up with the verifier deployed in contracts, as such, it should fail SL
verification. This PR adjusts the hashing to be a rolling hash matching
contracts verifier implementation.

Initial commit was tested E2E. Upcoming commits were tested via CLI (old
commit would generate same input as latest version/commits).

---------

Co-authored-by: Anton Baliasnikov <aba@matterlabs.dev>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

Author: 3 people

.github/workflows/update-verifiers.yml

@@ -20,7 +20,8 @@ jobs:
             -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
             https://api.github.com/repos/${{ github.repository }}/commits/${COMMIT_SHA} \
             | jq -r .commit.message)
-          echo message="${MESSAGE}" >> "${GITHUB_OUTPUT}"
+          # Save only the commit message header
+          echo message="$(echo ${MESSAGE} | head -n 1)" >> "${GITHUB_OUTPUT}"
 
       - name: Checkout repo
         if: ${{ !contains(steps.commit.outputs.message, env.COMMIT_MESSAGE) }}

tools/cli/src/main.rs

@@ -672,41 +672,45 @@ fn run_binary(
         }
     }
 
-    let registers = match machine {
+    let (registers, reached_end) = match machine {
         Machine::Standard => {
             let result = run_simple_with_entry_point_and_non_determimism_source_for_config::<
                 _,
                 IMStandardIsaConfig,
             >(config, non_determinism_source);
 
-            result.state.registers
+            (result.state.registers, result.reached_end)
         }
         Machine::Reduced => {
             let result = run_simple_with_entry_point_and_non_determimism_source_for_config::<
                 _,
                 IWithoutByteAccessIsaConfigWithDelegation,
             >(config, non_determinism_source);
 
-            result.state.registers
+            (result.state.registers, result.reached_end)
         }
         Machine::ReducedLog23 => {
             let result = run_simple_with_entry_point_and_non_determimism_source_for_config::<
                 _,
                 IWithoutByteAccessIsaConfigWithDelegation,
             >(config, non_determinism_source);
 
-            result.state.registers
+            (result.state.registers, result.reached_end)
         }
         Machine::ReducedFinal => {
             let result = run_simple_with_entry_point_and_non_determimism_source_for_config::<
                 _,
                 IWithoutByteAccessIsaConfig,
             >(config, non_determinism_source);
 
-            result.state.registers
+            (result.state.registers, result.reached_end)
         }
     };
 
+    if !reached_end {
+        println!("WARNING: execution did not finish; most likely ran out of cycles!");
+    }
+
     // our convention is to return 32 bytes placed into registers x10-x17
 
     let result = registers[10..26]

tools/verifier/build.sh

@@ -44,7 +44,7 @@ CARGO_TARGET_DIR=target/nine cargo objcopy --release --features recursion_step_n
 CARGO_TARGET_DIR=target/ten cargo objcopy --release --features final_recursion_step,panic_output --no-default-features -- -O binary final_recursion_layer_with_output.bin &
 
 # cargo biild --release -Z build-std=core,panic_abort,alloc --features universal_circuit,panic_output --no-default-features
-CARGO_TARGET_DIR=target/eleven cargo objcopy --release -Z build-std=core,panic_abort,alloc --features universal_circuit,panic_output --no-default-features -- -O binary universal.bin &
+CARGO_TARGET_DIR=target/eleven cargo objcopy --release -Z build-std=core,panic_abort,alloc --features universal_circuit,panic_output --no-default-features -- -O binary universal.bin
 
 # cargo build --release -Z build-std=core,panic_abort,alloc --features universal_circuit_no_delegation,panic_output --no-default-features
 CARGO_TARGET_DIR=target/twelve cargo objcopy --release -Z build-std=core,panic_abort,alloc --features universal_circuit_no_delegation,panic_output --no-default-features -- -O binary universal_no_delegation.bin &

tools/verifier/src/main.rs

@@ -163,22 +163,9 @@ unsafe fn workload() -> ! {
             // First - verify both proofs (keep reading from the CSR).
             let output1 = full_statement_verifier::verify_recursion_layer();
             let output2 = full_statement_verifier::verify_recursion_layer();
-            // Proving chains must be equal.
-            for i in 8..16 {
-                assert_eq!(output1[i], output2[i], "Proving chains must be equal");
-            }
-
-            // The first 8 words of the result are the hash of the two outputs.
-            // This way, to verify the combined proof, we can check that it matches
-            // the rolling hash of the public inputs.
-            let mut hasher = Keccak32::new();
 
-            update_from_recursive_circuit_output(&mut hasher, &output1);
-            update_from_recursive_circuit_output(&mut hasher, &output2);
-            let mut result = [0u32; 16];
-            // TODO: in the future - set the result[7] to be equal to 0.
-            result[0..8].copy_from_slice(&hasher.finalize());
-            result[8..16].copy_from_slice(&output1[8..16]);
+            // merge the inputs together
+            let result = merge_recursive_circuit_output(output1, output2);
 
             riscv_common::zksync_os_finish_success_extended(&result);
         }
@@ -190,43 +177,31 @@ unsafe fn workload() -> ! {
         // This is similar to 4, combine 2 proofs into one, but now we combine N proofs into one.
         // The advantage is in the number of proving rounds you need to do.
         // Option 4 requires O(n) rounds of proving, whilst this requires a single round (time will be closer to O(logn), due to recursion).
+        //
+        // The right way to think about this method is a rolling hash over circuits:
+        // keccak(..., keccak(keccak(output1 || output2), output3), output4, ... outputN)
         6 => {
             let no_circuits = riscv_common::csr_read_word();
             assert!(no_circuits >= 2, "Requires at least two circuits to verify");
 
-            // The first 8 words of the result are the hash of the proof's outputs.
-            // This way, to verify multiple combined proof, we can check that it matches
-            // the rolling hash of the public inputs.
-            let mut hasher = Keccak32::new();
-
-            // verify first proof & keep it's output to ensure all proof come from the same chain
-            // NOTE: this could be any other proof, not necessarily the first one.
-            let first_output = full_statement_verifier::verify_recursion_layer();
-
-            update_from_recursive_circuit_output(&mut hasher, &first_output);
+            // verify first proof & use it as the seed for the rolling hash
+            //
+            // the proof's outputs are as follows:
+            // output[0..8] - the actual output of the circuit
+            // output[8..16] - the verification key (should be the same across all proofs, checked inside merge_recursive_circuit_output)
+            // merging is done over inputs [0..8], whilst key is not modified (being copied over and over)
+            let mut rolling_hash = full_statement_verifier::verify_recursion_layer();
 
             // iterate over remaining circuits
             for _ in 1..no_circuits {
                 // verify proof
                 let output = full_statement_verifier::verify_recursion_layer();
 
-                // Proving chains must be equal.
-                for i in 8..16 {
-                    assert_eq!(first_output[i], output[i], "Proving chains must be equal");
-                }
-
-                // build the rolling hash over proofs's outputs
-                update_from_recursive_circuit_output(&mut hasher, &output);
+                // build the rolling hash over the remaining proofs' outputs (ensuring they belong to same proving chain)
+                rolling_hash = merge_recursive_circuit_output(rolling_hash, output);
             }
 
-            let mut result = [0u32; 16];
-
-            // TODO: in the future - set the result[7] to be equal to 0.
-            result[0..8].copy_from_slice(&hasher.finalize());
-            // chain remains the same
-            result[8..16].copy_from_slice(&first_output[8..16]);
-
-            riscv_common::zksync_os_finish_success_extended(&result);
+            riscv_common::zksync_os_finish_success_extended(&rolling_hash);
         }
         // Unknown metadata.
         _ => {
@@ -239,21 +214,43 @@ unsafe fn workload() -> ! {
     feature = "universal_circuit",
     feature = "universal_circuit_no_delegation"
 ))]
-/// Used in hashing proofs for verification.
-/// Keccak-256 implementation, but hashes specifically to be compatible with our SNARK.
-/// First 8 [0 -> 8) words represent the actual output of the circuit, which is what we need to hash.
-/// Last 8 [8 -> 16) words represent the the verification key.
-/// Verification Key stays the same across all circuits (already checked above).
-fn update_from_recursive_circuit_output(hasher: &mut Keccak32, output: &[u32; 16]) {
+/// Merges proof outputs from two recursive circuits into one output.
+/// TL;DR; Keccaks the two outputs together.
+///
+/// Note, a proof is structured as follows:
+/// - first 8 u32s are the actual proof output
+/// - last 8 u32s are the verification key identifier (proving chain)
+fn merge_recursive_circuit_output(first: [u32; 16], second: [u32; 16]) -> [u32; 16] {
+    // Proving chain must be equal
+    for i in 8..16 {
+        assert_eq!(first[i], second[i], "Proving chains must be equal");
+    }
+
     // To make it compatible with our SNARK - we'll assume that last register (7th) is 0 (as snark ignores that too).
     // and we'll actually shift them all by 1.
-    // So our output is the keccak(input_1[0..8]>>32, input_2[0..8]>>32, ..., input_n[0..8]>>32)
+
     // TODO: in the future, check explicitly that output1[7] && output2[7] == 0.
+    let mut hasher = Keccak32::new();
     hasher.update(&[0u32]);
 
-    for val in &output[0..7] {
+    for val in &first[0..7] {
         hasher.update(&[*val]);
     }
+
+    // TODO: in the future, check explicitly that output1[7] && output2[7] == 0.
+    hasher.update(&[0u32]);
+
+    for val in &second[0..7] {
+        hasher.update(&[*val]);
+    }
+
+    let mut result = [0u32; 16];
+    // merged outputs
+    result[0..8].copy_from_slice(&hasher.finalize());
+    // same vk
+    result[8..16].copy_from_slice(&first[8..16]);
+
+    result
 }
 
 #[cfg(feature = "verifier_tests")]

tools/verifier/universal.bin

@@ -1,15 +1,15 @@
 {
   "machine_type": "Reduced",
-  "bytecode_hash_hex": "190d028cc90e557122d0cc8b4a905b916ec9d0a3ce9b5a556b42a1e988dd4949",
+  "bytecode_hash_hex": "9b9e6a3039a15659ede904a2f6d604f7d108bedda75e6e8c2555e8dc3c2c6af3",
   "params": [
-    1507285083,
-    1629886555,
-    2581269536,
-    3767387307,
-    3339214042,
-    68130942,
-    3352680445,
-    627368356
+    888351984,
+    940558052,
+    3830943380,
+    1193990115,
+    1248532493,
+    2415499945,
+    1815829353,
+    1499096935
   ],
-  "params_hex": "59d7585b6126185b99db0c20e08dc4abc7085cda040f987ec7d5d7fd2564e1a4"
+  "params_hex": "34f32cf0380fc6e4e4578e94472ad7e34a6b180d8ff99aa96c3b5b69595a6767"
 }

tools/verifier/universal.reduced.vk.json

@@ -1,15 +1,15 @@
 {
   "machine_type": "ReducedLog23",
-  "bytecode_hash_hex": "190d028cc90e557122d0cc8b4a905b916ec9d0a3ce9b5a556b42a1e988dd4949",
+  "bytecode_hash_hex": "9b9e6a3039a15659ede904a2f6d604f7d108bedda75e6e8c2555e8dc3c2c6af3",
   "params": [
-    1708230190,
-    678606975,
-    1975657360,
-    2228014280,
-    4164773463,
-    839555725,
-    496381199,
-    3220715007
+    1495014810,
+    2087910462,
+    4139352863,
+    1966499135,
+    3477645534,
+    3754295931,
+    201124820,
+    3520443595
   ],
-  "params_hex": "65d1862e2872b87f75c2239084ccccc8f83d6657320a9a8d1d962d0fbff835ff"
+  "params_hex": "591c1d9a7c72fc3ef6b9831f7536653fcf48a8dedfc6027b0bfcebd4d1d5b4cb"
 }

tools/verifier/universal.reduced_log23.vk.json

@@ -1,15 +1,15 @@
 {
   "machine_type": "ReducedFinal",
-  "bytecode_hash_hex": "4e5e33d92803c79c997012f30b0e65ebf6037d17f7008ccaf351d8de192a6d4c",
+  "bytecode_hash_hex": "657b3c2089fd941bffa22bc8eaf7585be0e22b7b3be2b7509e18d5d8328913bc",
   "params": [
-    3473599108,
-    1490869294,
-    464289112,
-    2020737700,
-    1310155971,
-    2046873517,
-    199288278,
-    4288235415
+    1827654521,
+    1740281205,
+    1402311827,
+    1988274110,
+    2172001405,
+    1997754489,
+    188561396,
+    2215923557
   ],
-  "params_hex": "cf0aea8458dcdc2e1bac7d58787202a44e1764c37a00cfad0be0e5d6ff994797"
+  "params_hex": "6cefcb7967ba9575539594937682a7be81761c7d771350790b3d37f484144f65"
 }