Adds SPARK

[batmendbar]

SPARK

Reference for this implementation

• SPARK: https://eprint.iacr.org/2019/550
• Stronger security analysis of SPARK: https://people.cs.georgetown.edu/jthaler/Lasso-paper.pdf

Proposed protototype workflow

1. Serve step

   • One time
     • Starts the server
     • Compiles the circuit
     • Calculates the SPARK matrix data and commits to them
   • Ongoing
     • Listens to SPARK query requests and produces SPARK proofs using the pre-calculated commitments

2. Provekit prove step

   • Runs provekit prover and obtains a deferred evaluation
   • Sends a deferred evaluation request to the server

3. Provekit and SPARK verify step

   • Verifies Provekit and SPARK proofs

Design decisions

Pack $A$, $B$, $C$ into one block matrix Z:

This is a result from Marcin (https://gist.github.com/kustosz/14b62de666f721ab855536e575891bd1)

The trick:

$$Z = \begin{bmatrix} A & B \ 0 & C \end{bmatrix}$$

Same total non-zeros, double the dimensions. Then for any $\beta$, $p$, and $q$:

$$A(p,q) + \beta B(p,q) + \beta^2 C(p,q) = (1+\beta)^2 \cdot Z!\left(\tfrac{\beta}{1+\beta}, p,\ \tfrac{\beta}{1+\beta}, q\right)$$

One matrix, one commitment, one opening.

Batching GPA and WHIR proofs

• Combining GPA

  • Products of hashes corresponding to read sets and write sets of row-wise and column-wise memory check are combined into one GPA
  • Products of hashes corresponding to init and final vectors are combined into one GPA (separate for row-wise and col-wise memory). Possible optimization - if number of rows and columns for the matrix are ensured to be equal, we can combine them into one GPA.

• WHIR Batching
  | num_terms_2batched e-values are committed and opened together. Opened once in sumcheck and once in rs_ws GPA
  | num_terms_4batched | Address/timestamp values for row-wise and col-wise memory checks are committed and opened together

Temporary Sumcheck for split witness

The current ZK WHIR doesn't support batching which would enable easier handling of split witness commitment. The repo currently uses an additional sumcheck proposed by Marcin until batch ZK commitment is supported https://gist.github.com/kustosz/c7c3f756aaae77f37e035c30c4961ea3.

The trick:

Collapsing two claims into one: With claims on $A(r,0,q_1)$ and $A(r,1,q_2)$. Draw random $\beta$ and note their RLC is just another sum over $A(r,\cdot)$, so run a Sumcheck #2 to reduce to a single claim $A(r, \gamma)$.

Full workflow for a Noir passport circuit:

# 1. Start the server (compiles circuits and pre-commits)
provekit-cli serve \
  --socket /tmp/spark.sock \
  --output-dir ./benchmark-inputs \
  --circuit t_attest:./target/t_attest.json &

# 2. Wait for server readiness
while [ ! -S /tmp/spark.sock ]; do sleep 1; done

# 3. Prove (generates Noir proof + SPARK proof)
provekit-cli prove \
  ./benchmark-inputs/t_attest.pkp \
  ./benchmark-inputs/tbs_720/t_attest.toml \
  -o ./benchmark-inputs/t_attest-proof.np \
  --socket /tmp/spark.sock \
  --circuit t_attest \
  --spark-out ./benchmark-inputs/t_attest-spark-proof.sp

# 4. Verify Noir + SPARK proof
provekit-cli verify \
  ./benchmark-inputs/t_attest.pkv \
  ./benchmark-inputs/t_attest-proof.np \
  --spark-proof ./benchmark-inputs/t_attest-spark-proof.sp

What is not included

• Recursive SPARK

Benchmark

[TODO: Update with new benchmark]

[Bisht13]

verify and verify-spark share no cryptographic state, a prover can pair an honest NoirProof for C₁ with a self-consistent .sp+.spc+query JSON set for a different circuit C₂ with matching dimensions, and both verifiers will accept. Derive the expected query from the Noir transcript and require verify-spark to consume it, ship a combined verifier.

[batmendbar]

The verify in Provekit currently doesn't even need SPARK since it directly evaluates A, B, C matrices on their own. The current ZK-WHIR api doesn't allow us to change this. (e