Feat: support public input

[enricobottazzi]

#17

The PR adds support to public inputs to the circuits. Due to some engineering complications with halo2-lib APIs the way these are support is slightly different to the one described in the paper. In particular, the polynomial ai and ct0i , for each Ui matrix, are assigned to the circuit during phase 0 and exposed to the public during phase 0 . During phase 1 these polynomials are then evaluated at gamma through a constraint. The cyclo polynomial is evaluated at gamma through a constraint during phase 1.

The way of approaching the issue as described in the paper is still technically possible but presents a set of challenges:

• when generating the proof it is necessary to pass the public inputs instances, but the public inputs ai(gamma), ct0i(gamma), for each Ui matrix, and cyclo(gamma) depend on gamma, which is extracted during proof generation. Some solutions I tried are available in feat-public-input branch. The biggest issue I see there is that the prover basically has to run the synthesise function once before generating the proof only to extract the challenge gamma, then evaluate the polynomials at gamma and then pass them as public inputs. Unfortunately, there's no API that allows to do so
• when verifying the proof, the verifier is supposed to receive the polynomials ai, ct0i, for each Ui matrix, and cyclo by the prover (outside of the proof), fetch the gamma and then evaluate these polynomials at gamma and see if these match with the public inputs of the circuit. Unfortunately, fetching the challenge gamma from the proof transcript is not a trivial task.

As a consequence of this approach, there are more constraints to the circuit than originally described in the paper. These are the constraints necessary to evaluate ai(gamma), ct0i(gamma), for each Ui matrix, and cyclo(gamma) inside the circuit. Nevertheless, the performance downgrade is very minimal, but you can see that its impact grows as the complexity of the circuit grows. You can see the impact with your eyes by checking the updated benchmarks in the README and compare them with the one shown in the paper.