zcash / halo2

The Halo2 zero-knowledge proving system
https://zcash.github.io/halo2/
Other
736 stars 496 forks source link

Add sections to the user guide explaining witness optionality #470

Open str4d opened 2 years ago

str4d commented 2 years ago

One of the design choices we made in halo2_proofs is that we want circuit synthesis and witness generation logic to be closely-coupled, to reduce chances for error (a design choice we adopted from bellman). As a result, all witness values are assigned via closures that are not executed during keygen (when we have no witnesses), and passed around as Option<T> (and are None during keygen). We then have gadgets that are meant to encapsulate this optionality, allowing the developers to only need to deal with it at the edges of their circuit logic.

We don't currently explain this well. In one example, a user misread the Orchard circuit logic they were using as an example, and tried making the gadgets in their circuit optional (which does not work, as it changes the circuit structure). It probably didn't help that the in-circuit gadgets are often named the same as their outside-circuit equivalents that are used for witnesses (e.g. the gadgets::ecc::Point gadget which can be instantiated from an Option<pallas::Point> witness).

We should add several new sections to the user guide:

str4d commented 2 years ago

See also https://github.com/zcash/halo2/issues/509#issuecomment-1146025689 where I describe an alternate API that would make this less of a problem.

str4d commented 2 years ago

I've implemented the alternate API in #598, which should make the guide sections slightly easier to write.