feat: add ipa-hybrid feature for hybrid IPA with configurable bullet rounds#118
Open
srinathsetty wants to merge 6 commits into
Open
feat: add ipa-hybrid feature for hybrid IPA with configurable bullet rounds#118srinathsetty wants to merge 6 commits into
srinathsetty wants to merge 6 commits into
Conversation
…rounds Adds InnerProductArgumentHybrid that performs k rounds of Bulletproofs halving followed by a Schnorr vector tail proof. k is configurable via the BULLET_ROUNDS const generic parameter. When k=0, behaves like linear IPA (full Schnorr on original vector). When k=lg(n), equivalent to full logarithmic IPA. Includes robustness fixes: - Bounds check k <= lg_n in BulletReductionProof::verify - z_vec length validated before first use in hybrid verify Gated behind 'ipa-hybrid' feature flag.
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a new hybrid Inner Product Argument (IPA) implementation intended to trade off proof size and prover cost by doing k Bulletproofs-style halving rounds followed by a Schnorr “tail” proof, and wires Hyrax PCS to optionally use it behind a new ipa-hybrid feature.
Changes:
- Introduces
InnerProductArgumentHybrid+BulletReductionProofin a new PCS module. - Adds
ipa-hybridCargo feature and updates Hyrax PCS to select linear vs hybrid IPA viacfg(feature = "ipa-hybrid"). - Exposes
InnerProductInstance/InnerProductWitnessinternals aspub(crate)so the new module can access them.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 7 comments.
Show a summary per file
| File | Description |
|---|---|
src/provider/pcs/mod.rs |
Exposes the new IPA module from the PCS namespace. |
src/provider/pcs/ipa_log.rs |
Implements hybrid IPA (bullet reduction + Schnorr tail) and adds unit tests. |
src/provider/pcs/ipa.rs |
Makes instance/witness fields pub(crate) for reuse by the hybrid IPA. |
src/provider/pcs/hyrax_pc.rs |
Switches Hyrax IPA proof generation/verification between linear and hybrid based on feature flag. |
Cargo.toml |
Adds the ipa-hybrid feature flag. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
added 2 commits
April 22, 2026 02:54
…fe shift - Gate ipa_log module behind #[cfg(feature = "ipa-hybrid")] in mod.rs BulletReductionProof::prove and InnerProductArgumentHybrid::prove - Relax ck.len() == n to ck.len() >= n with slice to &ck[..n] in prove - Add L_vec/R_vec length mismatch check in BulletReductionProof::verify - Add b.len() == n validation and replace debug_assert with real check - Defer n_reduced computation until after bullet.verify validates k - Replace println! with tracing::debug! in tests
…add negative tests - Slice ck to &ck[..n] in verify (matching prove) to handle oversized Hyrax keys - Validate U.b_vec.len() == n in prove before inner_product to avoid panic from assert_eq! inside inner_product - Remove redundant lg_n recomputation in BulletReductionProof::verify - Add type aliases (Scalar, GE, TE) in tests for readability - Add test: oversized ck accepted by prove and verify - Add test: malformed proofs (truncated z_vec, corrupted z_vec, mismatched L/R) return errors instead of panicking - Add test: mismatched witness/instance lengths return error from prove
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
added 2 commits
April 22, 2026 03:08
- Linear IPA prove: validate ck.len() >= n and W.a_vec.len() == n before indexing, preventing panics on mismatched inputs - Linear IPA verify: validate U.b_vec.len() == n before inner_product call which would panic on length mismatch via assert_eq! - r1cs multiply_vec_precommitted: replace assert_eq! with SpartanError::InvalidInputLength return (public fn returning Result)
- Verify rejects proofs with k != BULLET_ROUNDS.min(lg_n), preventing DoS via attacker-chosen smaller k that increases verifier MSM work - Validate n is a non-zero power of two before computing lg_n - Fix doc comment: tail MSM is O(n) (expanded to original generators), not O(n/2^k) as previously claimed - Rename module ipa_log -> ipa_hybrid to match the ipa-hybrid feature and reduce confusion for maintainers
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
… negative tests - Move all input validation before transcript.dom_sep()/absorb() in both hybrid and linear IPA prove/verify to avoid dirty transcript state on error - Fix doc comment: proof contains 3 points (comm_v, T_eq, D), not 2 - Add edge-case tests: K=0 (pure Schnorr), K>lg_n (clamped), small n=2 - Add negative tests for all proof fields: comm_v, T_eq, s1_eq, s2_eq, D, z_r - Add linear IPA error-path tests: short ck, short a_vec, mismatched b_vec - Fix clippy assign_op_pattern warnings
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds InnerProductArgumentHybrid that performs k rounds of Bulletproofs halving followed by a Schnorr vector tail proof. k is configurable via the BULLET_ROUNDS const generic parameter.
When k=0, behaves like linear IPA (full Schnorr on original vector). When k=lg(n), equivalent to full logarithmic IPA.
Gated behind 'ipa-hybrid' feature flag.