a16z / jolt

The simplest and most extensible zkVM. Fast and fully open source from a16z crypto and friends. ⚡
https://jolt.a16zcrypto.com
MIT License
619 stars 123 forks source link

Arithmic/word address #412

Open arithmic-ASHISH opened 1 month ago

sragss commented 1 month ago

For this constraint: (LB_flag + LBU_flag + SB_flag) [remainder*(remainder -1)*(remainder -2)*(remainder-3)] + (LH_flag + LHU_flag + SH_flag) [remainder*(remainder -2)] + (LW_flag + SW_flag)*remainder = 0

Isn't the first term guaranteed to be zero? [remainder*(remainder -1)*(remainder -2)*(remainder-3)] == 0 remainder \in {0,1,2,3} If the goal is just to check that remainder is in fact {0,1,2,3} then we can get rid of the flat term out front.

For (LH_flag + LHU_flag + SH_flag) [remainder*(remainder -2)] I believe it would be clearer to structure it as:

let is_half_mem = JoltIn::IF_LH + JoltIn::IF_LHU + JoltIn::IF_SH`;
let remainder_is_0_or_2 = cs.allocate_prod(JoltIn::remainder, JoltIn::remainder - 2);
cs.constrain_eq_conditional(half_mem, remainder_is_0_or_2, 0);
vineet-n commented 3 weeks ago

For this constraint: (LB_flag + LBU_flag + SB_flag) [remainder*(remainder -1)*(remainder -2)*(remainder-3)] + (LH_flag + LHU_flag + SH_flag) [remainder*(remainder -2)] + (LW_flag + SW_flag)*remainder = 0

Isn't the first term guaranteed to be zero? [remainder*(remainder -1)*(remainder -2)*(remainder-3)] == 0 remainder \in {0,1,2,3} If the goal is just to check that remainder is in fact {0,1,2,3} then we can get rid of the flat term out front.

Not sure how we can remove it. The first term ensures that the remainder is in {0,1,2,3} when the instruction is LB, LBU, or SB. For example if the instruction is LB and remainder is 5 then constraint is non-zero, and hence an invalid execution. This cannot be captured if we remove this term.