Start VM with initialized Sponge state #296

jan-ferdinand · 2024-05-29T07:34:50Z

Previously, it was necessary to initialize Triton VM's Sponge state manually before any other Sponge instruction could be used. Now, instructions sponge_absorb, sponge_absorb_mem, and sponge_squeeze can be executed without first executing instruction sponge_init.

This is a breaking change because the VMState's field sponge is both public and changes type from Option<Tip5> to Tip5.

Specific reasons I have flagged you for review:

@Sword-Smith: how much work would this cause downstream?
@aszepieniec: do the updated constraints look sane?

Apart from these specific questions, I'm happy to receive general ∧/∨ other feedback, of course.

Previously, it was necessary to initialize Triton VM's Sponge state manually before any other Sponge instruction could be used. Now, instructions `sponge_absorb`, `sponge_absorb_mem`, and `sponge_squeeze` can be executed without first executing instruction `sponge_init`.

aszepieniec

I cannot say I managed to wrap my head around it, sorry. Maybe I need to sit on it for a while. Let me try again tomorrow.

aszepieniec · 2024-05-29T07:55:01Z

triton-vm/src/table/hash_table.rs

@@ -435,6 +436,7 @@ impl ExtHashTable {
        let if_ci_is_sponge_init_then_round_number_is_0 =
            if_ci_is_sponge_init_then_.clone() * round_number.clone();

+        // the capacity being zero is guaranteed by the evaluation argument


Suggested change

// the capacity being zero is guaranteed by the evaluation argument

// the capacity-elements being zero is guaranteed by the evaluation argument

aszepieniec · 2024-05-29T12:19:52Z

triton-vm/src/table/hash_table.rs

+        // If the next round number is 0, then
+        // - the next mode is either `Hash` or `Pad`, or
+        // - the next instruction is `sponge_init`, or
+        // - the capacity does not change, or
+        // - the current mode is `ProgramHashing` and (!) the next mode is `sponge`.
+        //
+        // The “and” marked with an exclamation mark requires above constraint to be
+        // expressed through two polynomials.
+        let capacity_doesnt_change_at_section_start_when_program_hashing_or_ =


I think section_start is a poor choice of words. What is a section? Are there at most four sections, one for each mode? I gather (perhaps incorrectly) that section means the same as round. Why not use that word instead? Or even better: new_round.

If it does mean "contiguous region of constant mode" I would suggest using instead mode_switch instead.

This (pair of) constraints is very confusing. Is it because it is trying to achieve several features at once? If so, consider separating it into more constraints. If mode switches from A to B then enforce C; if mode switches from X to Y then enforce Z; etc.

aszepieniec · 2024-05-29T12:28:25Z

triton-vm/src/table/hash_table.rs

+            capacity_doesnt_change_at_section_start_when_program_hashing_or_
+                * Self::select_mode(circuit_builder, &mode_next, HashTableMode::Sponge);
+
+        let randomized_sum_of_state_differences =


Consider renaming to state_doesnt_change.

aszepieniec · 2024-05-29T12:31:36Z

triton-vm/src/table/hash_table.rs

            Self::round_number_deselector(circuit_builder, &round_number_next, 0)
+                * Self::select_mode(circuit_builder, &mode, HashTableMode::ProgramHashing)


I would expect there to be a deselector for mode Sponge. Can't you transition from something other than ProgramHashing to Sponge?

The four separate modes are program_hashing, sponge, hash, and pad, and they evolve in that order.

Got it!

aszepieniec · 2024-05-29T12:40:47Z

specification/src/hash-table.md

@@ -189,8 +157,12 @@ define `state_i_hi_limbs_minus_2_pow_32 := 2^32 - 1 - 2^16·state_i_highest_lk_i
 1. If the `round_no` in the next row is 0
 and the `Mode` in the next row is either `program_hashing` or `sponge`
 and the instruction in the next row is either `sponge_absorb` or `sponge_init`,
-then the capacity's state registers don't change.
-1. If the `round_no` in the next row is 0 and the current instruction in the next row is `sponge_squeeze`, then none of the state registers change.
+then the capacity's state registers don't change,


The capacity elements do not change if the next instruction is sponge_init? That doesn't sound right. I would expect them to be set to zero.

aszepieniec · 2024-05-29T12:42:42Z

specification/src/hash-table.md

+then the capacity's state registers don't change,
+or the `Mode` in the current row is `program_hashing` and the `Mode` in the next row is `sponge`.
+1. If the `round_no` in the next row is 0
+and the current instruction in the next row is `sponge_squeeze`,


"current instruction in the next row" is confusing; consider abbreviating to "CI".

aszepieniec · 2024-05-29T12:46:34Z

specification/src/hash-table.md

+1. If the `round_no` in the next row is 0
+and the current instruction in the next row is `sponge_squeeze`,
+then none of the state registers change,
+or the `Mode` in the current row is `program_hashing`.


So if the current mode is program_hashing and the next instruction is sponge_squeeze then the state registers can change? Very counter-intuitive.

jan-ferdinand requested review from aszepieniec and Sword-Smith May 29, 2024 07:34

jan-ferdinand changed the title ~~refactor!: Start VM with initialized Sponge state~~ Start VM with initialized Sponge state May 29, 2024

jan-ferdinand force-pushed the start_with_init_sponge branch 3 times, most recently from 09521e3 to 9a79cfd Compare May 29, 2024 10:05

jan-ferdinand force-pushed the start_with_init_sponge branch from 9a79cfd to 5f54e1e Compare May 29, 2024 11:46

jan-ferdinand force-pushed the master branch from 02fe606 to be87aef Compare May 29, 2024 11:52

aszepieniec reviewed May 29, 2024

View reviewed changes

jan-ferdinand force-pushed the master branch 2 times, most recently from 1c2ccef to dd496f7 Compare June 8, 2024 08:02

jan-ferdinand force-pushed the master branch from 02b483d to c6791e8 Compare August 19, 2024 12:23

jan-ferdinand force-pushed the master branch 2 times, most recently from 358c67f to 6271c3d Compare September 13, 2024 07:20

jan-ferdinand force-pushed the master branch from d2fd1ed to 52b5057 Compare December 23, 2024 12:36

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Start VM with initialized Sponge state #296

Start VM with initialized Sponge state #296

jan-ferdinand commented May 29, 2024

aszepieniec left a comment

aszepieniec May 29, 2024

aszepieniec May 29, 2024

aszepieniec May 29, 2024

aszepieniec May 29, 2024

aszepieniec May 29, 2024

aszepieniec May 29, 2024

aszepieniec May 29, 2024

aszepieniec May 29, 2024

aszepieniec May 29, 2024

aszepieniec May 29, 2024

	// the capacity being zero is guaranteed by the evaluation argument
	// the capacity-elements being zero is guaranteed by the evaluation argument

		Self::round_number_deselector(circuit_builder, &round_number_next, 0)
		* Self::select_mode(circuit_builder, &mode, HashTableMode::ProgramHashing)

Start VM with initialized Sponge state #296

Are you sure you want to change the base?

Start VM with initialized Sponge state #296

Conversation

jan-ferdinand commented May 29, 2024

aszepieniec left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment