Define and implement the Root Circuit

[ed255]

The Root circuit is in charge of

• Passing the public inputs to super circuit
• Aggregating Super Circuit proof

[andyguzmaneth]

Useful ref> https://github.com/privacy-scaling-explorations/plonk-verifier

[andyguzmaneth]

Pending: Pinkie has done part of this work, pending to review how this was implemented in zkevm-chain repo.

[pinkiebell]

At the moment, it's using the evm-verifier-with-accumulator example and only aggregates a single proof. Does it make sense to test a different setup where it aggregates all zkevm sub-circuits instead of just the super circuit?

link to aggregation circuit

[han0110]

Does it make sense to test a different setup where it aggregates all zkevm sub-circuits instead of just the super circuit?

Do you mean to prove each sub-circuit separately then aggregate and connect them inside the Root circuit? If so I think we'd have an issue for now because currently most shared lookup tables contain RLC values, which doesn't follow the fiat-shamir process.

To make this happen, we have 2 approach:

1. Share transcript among sub-provers: Refactor all sub-circuits with challenge API first, then while create each sub-circuit's proof, we need coordinate sub-provers to stop at each phase to gather the committed values and squeeze the challenge then continue. Then we can have share lookup table containing RLC values.
2. Remove RLC values from shared lookup table Still need to refactor all sub-circuits with challenge API first, then we export the shared lookup table with raw value without RLC, then the depending circuit (e.g. EVM circuit lookups Keccak circuit) should build the RLC values inside its own proof.

But it should still be interesting to see the benchmark first, we can use a mocking fixed challenge value to see how much we can shrink for the required prover resource.

[andyguzmaneth]

Currently, blocked/dependent by #790

"Should the RootCircuit depend on the Super circuit? Otherwise, it may not be a blocker."

[andyguzmaneth]

Basically done but can't test it due to #790

[andyguzmaneth]

Pinkie's PR (https://github.com/privacy-scaling-explorations/zkevm-chain/pull/102) is merged, so once Marios observes another successful aggregation proof, I think https://github.com/privacy-scaling-explorations/zkevm-circuits/issues/664 could be counted as done.

[han0110]

So it seems that current zkevm-chain only implements the aggregation part, and the public input part passing is still WIP, and it kind of depends on https://github.com/privacy-scaling-explorations/zkevm-chain/issues/79, right @pinkiebell?

[pinkiebell]

So it seems that current zkevm-chain only implements the aggregation part, and the public input part passing is still WIP, and it kind of depends on privacy-scaling-explorations/zkevm-chain#79, right @pinkiebell?

The public input part is implemented only for the original pi,super circuit inputs but not for the aggregation circuit. 👌

[andyguzmaneth]

This depends on https://github.com/privacy-scaling-explorations/zkevm-chain/issues/79

[andyguzmaneth]

Reviewing #1000

Depends on https://github.com/privacy-scaling-explorations/snark-verifier/pull/22

[ChihChengLiang]

https://github.com/privacy-scaling-explorations/snark-verifier/pull/22 is unblocked now