chore: use public component key for pairing inputs (#13705)

Replaces `pairing_point_accumulator_public_input_indices` and
`contains_pairing_point_accumulator` with a `PublicComponentKey`
`pairing_inputs_public_input_key`. This reduces the number of field
elements in a honk VK (all variants) by 16. (The old components are
still used for Plonk so I couldn't remove them entirely yet).

Author: ledwards2225

barretenberg/acir_tests/internal_test_programs/double_verify_honk_proof/src/main.nr

@@ -1,7 +1,7 @@
 // This circuit aggregates two Honk proof from `assert_statement`.
 global SIZE_OF_PROOF_IF_LOGN_IS_28: u32 = 456;
 global HONK_IDENTIFIER: u32 = 1;
-global HONK_VERIFICATION_KEY_LENGTH_IN_FIELDS: u32 = 128;
+global HONK_VERIFICATION_KEY_LENGTH_IN_FIELDS: u32 = 112;
 fn main(
     verification_key: [Field; HONK_VERIFICATION_KEY_LENGTH_IN_FIELDS],
     // This is the proof without public inputs attached.

barretenberg/acir_tests/internal_test_programs/verify_honk_proof/src/main.nr

@@ -1,7 +1,7 @@
 // This circuit aggregates a single Honk proof from `assert_statement`.
 global SIZE_OF_PROOF_IF_LOGN_IS_28: u32 = 456;
 global HONK_IDENTIFIER: u32 = 1;
-global HONK_VERIFICATION_KEY_LENGTH_IN_FIELDS: u32 = 128;
+global HONK_VERIFICATION_KEY_LENGTH_IN_FIELDS: u32 = 112;
 fn main(
     verification_key: [Field; HONK_VERIFICATION_KEY_LENGTH_IN_FIELDS],
     // This is the proof without public inputs attached.

barretenberg/acir_tests/internal_test_programs/verify_rollup_honk_proof/src/main.nr

@@ -1,7 +1,7 @@
 // This circuit aggregates a single Honk proof from `assert_statement`.
 global SIZE_OF_PROOF_IF_LOGN_IS_28: u32 = 466 + 69;
 global ROLLUP_HONK_IDENTIFIER: u32 = 5;
-global ROLLUP_HONK_VERIFICATION_KEY_LENGTH_IN_FIELDS: u32 = 129;
+global ROLLUP_HONK_VERIFICATION_KEY_LENGTH_IN_FIELDS: u32 = 113;
 fn main(
     verification_key: [Field; ROLLUP_HONK_VERIFICATION_KEY_LENGTH_IN_FIELDS],
     // This is the proof without public inputs attached.

barretenberg/cpp/src/barretenberg/dsl/acir_format/honk_recursion_constraint.cpp

@@ -55,25 +55,21 @@ void create_dummy_vkey_and_proof(typename Flavor::CircuitBuilder& builder,
     ASSERT(proof_size == NativeFlavor::PROOF_LENGTH_WITHOUT_PUB_INPUTS);
     // Note: this computation should always result in log_circuit_size = CONST_PROOF_SIZE_LOG_N
     auto log_circuit_size = CONST_PROOF_SIZE_LOG_N;
+    uint32_t offset = 0;
     // First key field is circuit size
-    builder.assert_equal(builder.add_variable(1 << log_circuit_size), key_fields[0].witness_index);
+    builder.assert_equal(builder.add_variable(1 << log_circuit_size), key_fields[offset++].witness_index);
     // Second key field is number of public inputs
-    builder.assert_equal(builder.add_variable(public_inputs_size), key_fields[1].witness_index);
+    builder.assert_equal(builder.add_variable(public_inputs_size), key_fields[offset++].witness_index);
     // Third key field is the pub inputs offset
-    builder.assert_equal(builder.add_variable(NativeFlavor::has_zero_row ? 1 : 0), key_fields[2].witness_index);
-    // Fourth key field is the whether the proof contains an aggregation object.
-    builder.assert_equal(builder.add_variable(1), key_fields[3].witness_index);
-    uint32_t offset = 4;
+    builder.assert_equal(builder.add_variable(NativeFlavor::has_zero_row ? 1 : 0), key_fields[offset++].witness_index);
     size_t num_inner_public_inputs = public_inputs_size - bb::PAIRING_POINT_ACCUMULATOR_SIZE;
     if constexpr (HasIPAAccumulator<Flavor>) {
         num_inner_public_inputs -= bb::IPA_CLAIM_SIZE;
     }
 
     // We are making the assumption that the pairing point object is behind all the inner public inputs
-    for (size_t i = 0; i < bb::PAIRING_POINT_ACCUMULATOR_SIZE; i++) {
-        builder.assert_equal(builder.add_variable(num_inner_public_inputs + i), key_fields[offset].witness_index);
-        offset++;
-    }
+    builder.assert_equal(builder.add_variable(num_inner_public_inputs), key_fields[offset].witness_index);
+    offset++;
 
     if constexpr (HasIPAAccumulator<Flavor>) {
         // We are making the assumption that the IPA claim is behind the inner public inputs and pairing point object
@@ -207,10 +203,6 @@ void create_dummy_vkey_and_proof(typename Flavor::CircuitBuilder& builder,
  * @param input
  * @param input_aggregation_object_indices. The aggregation object coming from previous Honk recursion constraints.
  * @param has_valid_witness_assignment. Do we have witnesses or are we just generating keys?
- *
- * @note We currently only support HonkRecursionConstraint where inner_proof_contains_pairing_point_accumulator = false.
- *       We would either need a separate ACIR opcode where inner_proof_contains_pairing_point_accumulator = true,
- *       or we need non-witness data to be provided as metadata in the ACIR opcode
  */
 
 template <typename Flavor>

barretenberg/cpp/src/barretenberg/dsl/acir_format/ivc_recursion_constraint.cpp

@@ -199,7 +199,6 @@ std::shared_ptr<ClientIVC::MegaVerificationKey> create_mock_honk_vk(const size_t
     honk_verification_key->circuit_size = dyadic_size;
     honk_verification_key->num_public_inputs = num_public_inputs;
     honk_verification_key->pub_inputs_offset = pub_inputs_offset; // must be set correctly
-    honk_verification_key->contains_pairing_point_accumulator = true;
 
     for (auto& commitment : honk_verification_key->get_all()) {
         commitment = curve::BN254::AffineElement::one(); // arbitrary mock commitment

barretenberg/cpp/src/barretenberg/flavor/flavor.hpp

@@ -83,6 +83,7 @@
 #include "barretenberg/polynomials/evaluation_domain.hpp"
 #include "barretenberg/polynomials/univariate.hpp"
 #include "barretenberg/srs/global_crs.hpp"
+#include "barretenberg/stdlib_circuit_builders/public_component_key.hpp"
 
 #include <array>
 #include <concepts>
@@ -127,8 +128,7 @@ struct ActiveRegionData {
 template <typename FF, typename CommitmentKey_> class ProvingKey_ {
   public:
     size_t circuit_size;
-    bool contains_pairing_point_accumulator;
-    PairingPointAccumulatorPubInputIndices pairing_point_accumulator_public_input_indices;
+    PublicComponentKey pairing_inputs_public_input_key;
     bb::EvaluationDomain<FF> evaluation_domain;
     std::shared_ptr<CommitmentKey_> commitment_key;
     size_t num_public_inputs;
@@ -173,8 +173,7 @@ class VerificationKey_ : public PrecomputedCommitments {
     FF_ log_circuit_size;
     FF_ num_public_inputs;
     FF_ pub_inputs_offset = 0;
-    bool contains_pairing_point_accumulator = false;
-    PairingPointAccumulatorPubInputIndices pairing_point_accumulator_public_input_indices = {};
+    PublicComponentKey pairing_inputs_public_input_key;
 
     bool operator==(const VerificationKey_&) const = default;
     VerificationKey_() = default;
@@ -204,8 +203,7 @@ class VerificationKey_ : public PrecomputedCommitments {
         serialize_to_field_buffer(this->circuit_size, elements);
         serialize_to_field_buffer(this->num_public_inputs, elements);
         serialize_to_field_buffer(this->pub_inputs_offset, elements);
-        serialize_to_field_buffer(this->contains_pairing_point_accumulator, elements);
-        serialize_to_field_buffer(this->pairing_point_accumulator_public_input_indices, elements);
+        serialize_to_field_buffer(this->pairing_inputs_public_input_key.start_idx, elements);
 
         for (const Commitment& commitment : this->get_all()) {
             serialize_to_field_buffer(commitment, elements);

barretenberg/cpp/src/barretenberg/stdlib/honk_verifier/ultra_recursive_verifier.cpp

@@ -87,11 +87,9 @@ UltraRecursiveVerifier_<Flavor>::Output UltraRecursiveVerifier_<Flavor>::verify_
         gate_challenges[idx] = transcript->template get_challenge<FF>("Sumcheck:gate_challenge_" + std::to_string(idx));
     }
 
-    // Parse out the aggregation object using the key->pairing_point_accumulator_public_input_indices
-    // TODO(https://github.com/AztecProtocol/barretenberg/issues/1325): Eventually vk stores public input key directly.
-    const PublicComponentKey pairing_point_public_input_key{ key->pairing_point_accumulator_public_input_indices[0] };
+    // Extract the aggregation object from the public inputs
     AggregationObject nested_agg_obj =
-        PublicAggState::reconstruct(verification_key->public_inputs, pairing_point_public_input_key);
+        PublicAggState::reconstruct(verification_key->public_inputs, key->pairing_inputs_public_input_key);
     // TODO(https://github.com/AztecProtocol/barretenberg/issues/995): generate this challenge properly.
     typename Curve::ScalarField recursion_separator =
         Curve::ScalarField::from_witness_index(builder, builder->add_variable(42));

barretenberg/cpp/src/barretenberg/stdlib/plonk_recursion/aggregation_state/aggregation_state.hpp

@@ -115,13 +115,7 @@ template <typename Builder_> struct aggregation_state {
         P1.set_public();
 
         Builder* ctx = P0.get_context();
-        // TODO(https://github.com/AztecProtocol/barretenberg/issues/1325): Eventually the builder/PK/VK will store
-        // public input key which should be set here and pairing_point_accumulator_public_input_indices should go away.
-        uint32_t pub_idx = start_idx;
-        for (uint32_t& idx : ctx->pairing_point_accumulator_public_input_indices) {
-            idx = pub_idx++;
-        }
-        ctx->contains_pairing_point_accumulator = true;
+        ctx->pairing_inputs_public_input_key.start_idx = start_idx;
 
         return start_idx;
     }

barretenberg/cpp/src/barretenberg/stdlib/primitives/public_input_component/public_input_component.hpp

@@ -60,9 +60,8 @@ class PublicInputComponent {
     {
         // Ensure that the key has been set
         if (!key.is_set()) {
-            // TODO(https://github.com/AztecProtocol/barretenberg/issues/1284): determine when/whether a check of this
-            // form is needed: info("WARNING: Trying to construct a PublicInputComponent from an invalid key!");
-            // ASSERT(false);
+            info("WARNING: Trying to construct a PublicInputComponent from an invalid key!");
+            ASSERT(false);
         }
 
         // Use the provided key to extract the limbs of the component from the public inputs then reconstruct it

barretenberg/cpp/src/barretenberg/stdlib/protogalaxy_verifier/recursive_decider_verification_key.hpp

@@ -110,9 +110,7 @@ template <IsRecursiveFlavor Flavor> class RecursiveDeciderVerificationKey_ {
             static_cast<uint64_t>(verification_key->circuit_size.get_value()),
             static_cast<uint64_t>(verification_key->num_public_inputs.get_value()));
         native_honk_vk->pub_inputs_offset = static_cast<uint64_t>(verification_key->pub_inputs_offset.get_value());
-        native_honk_vk->contains_pairing_point_accumulator = verification_key->contains_pairing_point_accumulator;
-        native_honk_vk->pairing_point_accumulator_public_input_indices =
-            verification_key->pairing_point_accumulator_public_input_indices;
+        native_honk_vk->pairing_inputs_public_input_key = verification_key->pairing_inputs_public_input_key;
         if constexpr (IsMegaFlavor<Flavor>) {
             native_honk_vk->databus_propagation_data = verification_key->databus_propagation_data;
         }

barretenberg/cpp/src/barretenberg/stdlib_circuit_builders/circuit_builder_base.hpp

@@ -45,10 +45,13 @@ template <typename FF_> class CircuitBuilderBase {
     // DOCTODO(#231): replace with the relevant wiki link.
     std::map<uint32_t, uint32_t> tau;
 
-    // Public input indices which contain recursive proof information
+    // (PLONK ONLY) Public input indices which contain recursive proof information
     PairingPointAccumulatorPubInputIndices pairing_point_accumulator_public_input_indices;
     bool contains_pairing_point_accumulator = false;
 
+    // Index of the pairing inputs in the public inputs
+    PublicComponentKey pairing_inputs_public_input_key;
+
     // Index of the IPA opening claim in the public inputs
     PublicComponentKey ipa_claim_public_input_key;
 

barretenberg/cpp/src/barretenberg/stdlib_circuit_builders/mega_flavor.hpp

@@ -449,9 +449,7 @@ class MegaFlavor {
             this->log_circuit_size = numeric::get_msb(this->circuit_size);
             this->num_public_inputs = proving_key.num_public_inputs;
             this->pub_inputs_offset = proving_key.pub_inputs_offset;
-            this->contains_pairing_point_accumulator = proving_key.contains_pairing_point_accumulator;
-            this->pairing_point_accumulator_public_input_indices =
-                proving_key.pairing_point_accumulator_public_input_indices;
+            this->pairing_inputs_public_input_key = proving_key.pairing_inputs_public_input_key;
 
             // Databus commitment propagation data
             this->databus_propagation_data = proving_key.databus_propagation_data;
@@ -486,8 +484,7 @@ class MegaFlavor {
             serialize_to_field_buffer(this->circuit_size, elements);
             serialize_to_field_buffer(this->num_public_inputs, elements);
             serialize_to_field_buffer(this->pub_inputs_offset, elements);
-            serialize_to_field_buffer(this->contains_pairing_point_accumulator, elements);
-            serialize_to_field_buffer(this->pairing_point_accumulator_public_input_indices, elements);
+            serialize_to_field_buffer(this->pairing_inputs_public_input_key.start_idx, elements);
 
             serialize_to_field_buffer(this->databus_propagation_data.app_return_data_commitment_pub_input_key.start_idx,
                                       elements);
@@ -507,8 +504,7 @@ class MegaFlavor {
         VerificationKey(const size_t circuit_size,
                         const size_t num_public_inputs,
                         const size_t pub_inputs_offset,
-                        const bool contains_pairing_point_accumulator,
-                        const PairingPointAccumulatorPubInputIndices& pairing_point_accumulator_public_input_indices,
+                        const PublicComponentKey& pairing_inputs_public_input_key,
                         const DatabusPropagationData& databus_propagation_data,
                         const Commitment& q_m,
                         const Commitment& q_c,
@@ -545,8 +541,7 @@ class MegaFlavor {
             this->log_circuit_size = numeric::get_msb(this->circuit_size);
             this->num_public_inputs = num_public_inputs;
             this->pub_inputs_offset = pub_inputs_offset;
-            this->contains_pairing_point_accumulator = contains_pairing_point_accumulator;
-            this->pairing_point_accumulator_public_input_indices = pairing_point_accumulator_public_input_indices;
+            this->pairing_inputs_public_input_key = pairing_inputs_public_input_key;
             this->databus_propagation_data = databus_propagation_data;
             this->q_m = q_m;
             this->q_c = q_c;
@@ -583,8 +578,7 @@ class MegaFlavor {
                        log_circuit_size,
                        num_public_inputs,
                        pub_inputs_offset,
-                       contains_pairing_point_accumulator,
-                       pairing_point_accumulator_public_input_indices,
+                       pairing_inputs_public_input_key,
                        databus_propagation_data,
                        q_m,
                        q_c,

barretenberg/cpp/src/barretenberg/stdlib_circuit_builders/mega_recursive_flavor.hpp

@@ -131,9 +131,7 @@ template <typename BuilderType> class MegaRecursiveFlavor_ {
             this->log_circuit_size = FF::from_witness(builder, numeric::get_msb(native_key->circuit_size));
             this->num_public_inputs = FF::from_witness(builder, native_key->num_public_inputs);
             this->pub_inputs_offset = FF::from_witness(builder, native_key->pub_inputs_offset);
-            this->contains_pairing_point_accumulator = native_key->contains_pairing_point_accumulator;
-            this->pairing_point_accumulator_public_input_indices =
-                native_key->pairing_point_accumulator_public_input_indices;
+            this->pairing_inputs_public_input_key = native_key->pairing_inputs_public_input_key;
             this->databus_propagation_data = native_key->databus_propagation_data;
 
             // Generate stdlib commitments (biggroup) from the native counterparts
@@ -159,12 +157,9 @@ template <typename BuilderType> class MegaRecursiveFlavor_ {
             this->log_circuit_size = numeric::get_msb(static_cast<uint32_t>(this->circuit_size.get_value()));
             this->num_public_inputs = deserialize_from_frs<FF>(builder, elements, num_frs_read);
             this->pub_inputs_offset = deserialize_from_frs<FF>(builder, elements, num_frs_read);
-            this->contains_pairing_point_accumulator =
-                bool(deserialize_from_frs<FF>(builder, elements, num_frs_read).get_value());
 
-            for (uint32_t& idx : this->pairing_point_accumulator_public_input_indices) {
-                idx = uint32_t(deserialize_from_frs<FF>(builder, elements, num_frs_read).get_value());
-            }
+            this->pairing_inputs_public_input_key.start_idx =
+                uint32_t(deserialize_from_frs<FF>(builder, elements, num_frs_read).get_value());
 
             this->databus_propagation_data.app_return_data_commitment_pub_input_key.start_idx =
                 uint32_t(deserialize_from_frs<FF>(builder, elements, num_frs_read).get_value());

barretenberg/cpp/src/barretenberg/stdlib_circuit_builders/public_component_key.hpp

@@ -13,6 +13,7 @@ namespace bb {
 // The data needed to reconstruct a public input component from its limbs stored in the public inputs
 struct PublicComponentKey {
     constexpr static uint32_t DEFAULT_IDX = std::numeric_limits<uint32_t>::max();
+
     uint32_t start_idx = DEFAULT_IDX; // start index within public inputs array
 
     bool operator==(const PublicComponentKey&) const = default;

barretenberg/cpp/src/barretenberg/stdlib_circuit_builders/ultra_flavor.hpp

@@ -370,9 +370,7 @@ class UltraFlavor {
             this->log_circuit_size = numeric::get_msb(this->circuit_size);
             this->num_public_inputs = proving_key.num_public_inputs;
             this->pub_inputs_offset = proving_key.pub_inputs_offset;
-            this->contains_pairing_point_accumulator = proving_key.contains_pairing_point_accumulator;
-            this->pairing_point_accumulator_public_input_indices =
-                proving_key.pairing_point_accumulator_public_input_indices;
+            this->pairing_inputs_public_input_key = proving_key.pairing_inputs_public_input_key;
 
             if (proving_key.commitment_key == nullptr) {
                 proving_key.commitment_key = std::make_shared<CommitmentKey>(proving_key.circuit_size);
@@ -386,8 +384,7 @@ class UltraFlavor {
         VerificationKey(const uint64_t circuit_size,
                         const uint64_t num_public_inputs,
                         const uint64_t pub_inputs_offset,
-                        const bool contains_pairing_point_accumulator,
-                        const PairingPointAccumulatorPubInputIndices& pairing_point_accumulator_public_input_indices,
+                        const PublicComponentKey& pairing_inputs_public_input_key,
                         const Commitment& q_m,
                         const Commitment& q_c,
                         const Commitment& q_l,
@@ -420,8 +417,7 @@ class UltraFlavor {
             this->log_circuit_size = numeric::get_msb(this->circuit_size);
             this->num_public_inputs = num_public_inputs;
             this->pub_inputs_offset = pub_inputs_offset;
-            this->contains_pairing_point_accumulator = contains_pairing_point_accumulator;
-            this->pairing_point_accumulator_public_input_indices = pairing_point_accumulator_public_input_indices;
+            this->pairing_inputs_public_input_key = pairing_inputs_public_input_key;
             this->q_m = q_m;
             this->q_c = q_c;
             this->q_l = q_l;
@@ -456,8 +452,7 @@ class UltraFlavor {
                        log_circuit_size,
                        num_public_inputs,
                        pub_inputs_offset,
-                       contains_pairing_point_accumulator,
-                       pairing_point_accumulator_public_input_indices,
+                       pairing_inputs_public_input_key,
                        q_m,
                        q_c,
                        q_l,