longfellow 0.1.0

data/vendor/longfellow-zk/lib/arrays/eqs.h

@@ -0,0 +1,137 @@
+// Copyright 2026 Google LLC.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef PRIVACY_PROOFS_ZK_LIB_ARRAYS_EQS_H_
+#define PRIVACY_PROOFS_ZK_LIB_ARRAYS_EQS_H_
+
+#include <cstddef>
+#include <vector>
+
+#include "arrays/affine.h"
+#include "arrays/dense.h"
+#include "util/panic.h"
+
+namespace proofs {
+
+// Stateful implementation of EQ[I, j] which, for fixed
+// I, holds an array indexed by j.
+template <class Field>
+class Eqs : public Dense<Field> {
+  using Elt = typename Field::Elt;
+  using Dense<Field>::v_;
+  using Dense<Field>::n0_;
+
+ public:
+  Eqs(size_t logn, corner_t n, const Elt I[/*logn*/], const Field& F)
+      : Dense<Field>(n, 1) {
+    filleq(&v_[0], logn, n, I, F);
+  }
+
+  corner_t n() const { return n0_; }
+
+  // Optimization for a special case: return a raw vector
+  //   eq[i] = EQ(G0, i) + alpha * EQ(G1, i)
+  // for all 0 <= i < n.
+  static std::vector<Elt> raw_eq2(size_t logn, corner_t n, const Elt* G0,
+                                  const Elt* G1, const Elt& alpha,
+                                  const Field& F) {
+    std::vector<Elt> eq(n);
+    fill_recursive(&eq[0], logn, n, G0, G1, F.one(), alpha, F);
+    return eq;
+  }
+
+ private:
+  // fill_recursive(eq, l, n, G0, G1, w0, w1, F) populates eq[0, n) with
+  //   eq[i] = w0 * EQ[G0, i] + w1 * EQ[G1, i]
+  static void fill_recursive(Elt* eq, size_t l, corner_t n, const Elt* G0,
+                             const Elt* G1, const Elt& w0, const Elt& w1,
+                             const Field& F) {
+    if (l > 0) {
+      const size_t nl = l - 1;
+      const corner_t s = corner_t(1) << nl;
+
+      Elt w0hi = F.mulf(w0, G0[nl]);
+      Elt w1hi = F.mulf(w1, G1[nl]);
+      Elt w0lo = F.subf(w0, w0hi);
+      Elt w1lo = F.subf(w1, w1hi);
+      if (n <= s) {
+        fill_recursive(eq, nl, n, G0, G1, w0lo, w1lo, F);
+      } else {
+        fill_recursive(eq, nl, s, G0, G1, w0lo, w1lo, F);
+        fill_recursive(eq + s, nl, n - s, G0, G1, w0hi, w1hi, F);
+      }
+    } else {
+      eq[0] = F.addf(w0, w1);
+    }
+  }
+
+  // Return ceil(a / 2^{n}) for a != 0.
+  //
+  // Several ways exist to compute ceil(a/b) given a primitive that
+  // computes floor(a/b), such as the C++ unsigned division operator.
+  // The simplest one is floor((a+(b-1))/b), which potentially overflows.
+  // Another way is 1+floor((a-1)/b), which underflows for a==0 but
+  // otherwise does not overflow.  More complicated ways exist that neither
+  // overflow nor underflow.  Since the rest of the code assumes
+  // a!=0 anyway, we use the 1+floor((a-1)/b) version.
+  static corner_t ceilshr(corner_t a, size_t n) { return 1u + ((a - 1u) >> n); }
+
+  // Compute the array EQ[Q, i] for all 0<=i<n, for n <= 2^{logn}.
+  // (logn can otherwise be arbitrarily large.)
+  //
+  // Let Q be the array of field elements Q[0,logn), and let
+  // i[l] be the l-th bit of the binary representation of i, for
+  // 0 <= l < logn.
+  //
+  // We have
+  //   EQ[Q, i] = (1 - Q[0]) * EQ[Q[1:], i[1:]]     if i[0] = 0;
+  //   EQ[Q, i] =       Q[0] * EQ[Q[1:], i[1:]]     if i[0] = 1.
+  //
+  // Thus, EQ{n, logn} can be expressed in terms of EQ{ceil(n/2), logn-1}
+  // of half the size.
+  static void filleq(Elt* eq, size_t logn, corner_t n, const Elt* Q,
+                     const Field& F) {
+    check(n > 0, "n > 0");
+    eq[0] = F.one();
+    for (size_t l = logn; l-- > 0;) {
+      corner_t nl = ceilshr(n, l);
+      corner_t i = ceilshr(nl, 1);
+
+      // Special case for the first iteration of the i-loop
+      // below: don't compute eq[2*i+1] (post decrement) if it
+      // would overflow the array.
+      if (/*2*(i-1)+1 = */ 2 * i - 1 >= nl) {
+        i--;
+        Elt v = eq[i], qv = Q[l];
+        F.mul(qv, v);
+        eq[2 * i] = v;
+        F.sub(eq[2 * i], qv);
+      }
+      while (i-- > 0) {
+        // Assign
+        //   eq[2*i]   = (1-Q[l])*eq[i]
+        //   eq[2*i+1] = Q[l]*eq[i]
+        // with one multiplication.
+        Elt v = eq[i], qv = Q[l];
+        F.mul(qv, v);
+        eq[2 * i] = v;
+        F.sub(eq[2 * i], qv);
+        eq[2 * i + 1] = qv;
+      }
+    }
+  }
+};
+}  // namespace proofs
+
+#endif  // PRIVACY_PROOFS_ZK_LIB_ARRAYS_EQS_H_

data/vendor/longfellow-zk/lib/arrays/eqs_test.cc

@@ -0,0 +1,151 @@
+// Copyright 2026 Google LLC.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "arrays/eqs.h"
+
+#include <stddef.h>
+
+#include <vector>
+
+#include "algebra/bogorng.h"
+#include "algebra/fp.h"
+#include "arrays/affine.h"
+#include "arrays/dense.h"
+#include "arrays/eq.h"
+#include "arrays/sparse.h"
+#include "gtest/gtest.h"
+
+namespace proofs {
+namespace {
+using Field = Fp<4>;
+using Elt = typename Field::Elt;
+using index_t = Sparse<Field>::index_t;
+
+static const Field F(
+    "21888242871839275222246405745257275088548364400416034343698204186575808495"
+    "617");
+
+class RandomSlice {
+ public:
+  std::vector<Elt> r_;
+  explicit RandomSlice(size_t n) : r_(n) {
+    Bogorng<Field> rng(&F);
+    for (size_t i = 0; i < n; ++i) {
+      r_[i] = rng.next();
+    }
+  }
+};
+
+// V[T] = EQ[T|i] V[i]
+void one_test_eqs_bind(size_t logn, corner_t n) {
+  RandomSlice T(logn);
+  Eqs<Field> EQ(logn, n, T.r_.data(), F);
+  auto V = Dense<Field>(n, 1);
+  V.clear(F);
+
+  Elt rhs = F.zero();
+  for (corner_t i = 0; i < n; i++) {
+    F.add(rhs, F.mulf(EQ.at(i), V.v_[i]));
+  }
+
+  V.bind_all(logn, T.r_.data(), F);
+  Elt lhs = V.scalar();
+
+  EXPECT_EQ(lhs, rhs);
+}
+
+// EQ[A|B] = EQ[A|i] EQ[i|B]
+void one_test_eqs_decomposition(size_t logn, corner_t n) {
+  RandomSlice A(logn);
+  RandomSlice B(logn);
+  Eqs<Field> EQA(logn, n, A.r_.data(), F);
+  Eqs<Field> EQB(logn, n, B.r_.data(), F);
+
+  Elt rhs = F.zero();
+  for (corner_t i = 0; i < n; i++) {
+    F.add(rhs, F.mulf(EQA.at(i), EQB.at(i)));
+  }
+
+  Elt lhs = Eq<Field>::eval(logn, n, A.r_.data(), B.r_.data(), F);
+  EXPECT_EQ(lhs, rhs);
+}
+
+TEST(Eqs, All) {
+  for (size_t logn = 0; logn < 8; logn++) {
+      for (size_t i = 1; i <= (1 << logn); i++) {
+        one_test_eqs_bind(logn, corner_t(i));
+        one_test_eqs_decomposition(logn, corner_t(i));
+      }
+  }
+}
+
+// recursive implementation of bindv(EQ[], .) as described in the
+// RFC, so that we can verify equivalence with our implementation.
+std::vector<Elt> bindeq(size_t l, const Elt X[/*l*/]) {
+  size_t n = size_t(1) << l;
+  std::vector<Elt> B(n);
+  if (l == 0) {
+    B[0] = F.one();
+  } else {
+    auto A = bindeq(l - 1, X + 1);
+    for (size_t i = 0; 2 * i < n; ++i) {
+      B[2 * i] = F.mulf(F.subf(F.one(), X[0]), A[i]);
+      B[2 * i + 1] = F.mulf(X[0], A[i]);
+    }
+  }
+  return B;
+}
+
+TEST(Eqs, RFC) {
+  size_t logn = 11;
+  size_t n = size_t(1) << logn;
+  RandomSlice X(logn);
+  auto RFC = bindeq(logn, X.r_.data());
+  Eqs<Field> EQ(logn, n, X.r_.data(), F);
+  for (size_t i = 0; i < n; ++i) {
+    EXPECT_EQ(RFC[i], EQ.at(i));
+  }
+
+  // truncating N truncates bindv(EQ, .) with no other ill effects
+  size_t n2 = n - 7;
+  Eqs<Field> EQ2(logn, n2, X.r_.data(), F);
+  for (size_t i = 0; i < n2; ++i) {
+    EXPECT_EQ(RFC[i], EQ2.at(i));
+  }
+}
+
+TEST(Eqs, RawEq2) {
+  Bogorng<Field> rng(&F);
+  for (size_t logn = 0; logn < 6; logn++) {
+    for (corner_t n = 1; n <= (corner_t(1) << logn); n++) {
+      RandomSlice G0(logn);
+      RandomSlice G1(logn);
+      Elt alpha = rng.next();
+
+      auto eq =
+          Eqs<Field>::raw_eq2(logn, n, G0.r_.data(), G1.r_.data(), alpha, F);
+      Eqs<Field> EQ0(logn, n, G0.r_.data(), F);
+      Eqs<Field> EQ1(logn, n, G1.r_.data(), F);
+
+      ASSERT_EQ(eq.size(), n);
+      for (corner_t i = 0; i < n; i++) {
+        Elt expected = F.addf(EQ0.at(i), F.mulf(alpha, EQ1.at(i)));
+        EXPECT_EQ(eq[i], expected)
+            << "logn=" << logn << ", n=" << n << ", i=" << i;
+      }
+    }
+  }
+}
+}  // namespace
+}  // namespace proofs

data/vendor/longfellow-zk/lib/arrays/sparse.h

@@ -0,0 +1,192 @@
+// Copyright 2026 Google LLC.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef PRIVACY_PROOFS_ZK_LIB_ARRAYS_SPARSE_H_
+#define PRIVACY_PROOFS_ZK_LIB_ARRAYS_SPARSE_H_
+
+#include <stddef.h>
+
+#include <algorithm>
+#include <memory>
+#include <vector>
+
+#include "algebra/compare.h"
+#include "algebra/poly.h"
+#include "arrays/affine.h"
+#include "util/panic.h"
+
+namespace proofs {
+// ------------------------------------------------------------
+// Sparse representation of multi-affine functions.
+//
+// This class is mainly used as a reference implementation
+// for testing, and it exposes a similar interface as dense<Field>.
+// Sumcheck has its own specialized "quad" implementation.
+//
+template <class Field>
+class Sparse {
+  using Elt = typename Field::Elt;
+  using T2 = Poly<2, Field>;
+
+ public:
+  // A corner on the sparse hypercube, represented as triple of size_t
+  // and a value.  The 3D representation is kind of a guess of how
+  // many bits we'll ever need.  Under the theory that "size_t" has
+  // enough bits to index a dense array that fills the address space,
+  // and that the program should support |points| gates, and each gate
+  // has three terminals, then a triple ought to be both necessary and
+  // sufficient.
+  struct corner {
+    size_t p0, p1, p2;
+    Elt v;
+
+    bool eqndx(const corner& y) const {
+      return (p2 == y.p2 && p1 == y.p1 && p0 == y.p0);
+    }
+    bool operator==(const corner& y) const { return eqndx(y) && v == y.v; }
+    bool operator!=(const corner& y) const { return !operator==(y); }
+
+    static bool compare(const corner& x, const corner& y, const Field& F) {
+      if (x.p2 < y.p2) return true;
+      if (x.p2 > y.p2) return false;
+      if (x.p1 < y.p1) return true;
+      if (x.p1 > y.p1) return false;
+      if (x.p0 < y.p0) return true;
+      if (x.p0 > y.p0) return false;
+      return elt_less_than(x.v, y.v, F);
+    }
+  };
+
+  // the index of a point in a sparse array
+  using index_t = size_t;
+
+  index_t n_;
+  std::vector<corner> c_;
+
+  explicit Sparse(index_t n) : n_(n), c_(n) {}
+
+  // no copies, but see clone() below
+  Sparse(const Sparse& y) = delete;
+  Sparse(const Sparse&& y) = delete;
+  Sparse operator=(const Sparse& y) = delete;
+
+  // Nobody should need to clone a sparse array except tests.
+  // Reflect this fact in the name.
+  std::unique_ptr<Sparse> clone_testing_only() const {
+    auto s = std::make_unique<Sparse>(n_);
+    for (index_t i = 0; i < n_; ++i) {
+      s->c_[i] = c_[i];
+    }
+    return s;
+  }
+
+  T2 t2_at_corners(index_t* newi, index_t i, const Field& F) const {
+    // If c_[i] and c_[i+1] have the same (P2, P1), and they differ
+    // by the least-significant bit in P0:
+    if (i + 1 < n_ &&                              //
+        c_[i].p2 == c_[i + 1].p2 &&                //
+        c_[i].p1 == c_[i + 1].p1 &&                //
+        (c_[i].p0 >> 1) == (c_[i + 1].p0 >> 1) &&  //
+        c_[i + 1].p0 == c_[i].p0 + 1) {
+      // we have two corners.
+      *newi = i + 2;
+      return T2{c_[i].v, c_[i + 1].v};
+    } else {
+      // we have one corner and the other one is zero.
+      *newi = i + 1;
+      if ((c_[i].p0 & 1) == 0) {
+        return T2{c_[i].v, F.zero()};
+      } else {
+        return T2{F.zero(), c_[i].v};
+      }
+    }
+  }
+
+  // For a given random number r, the binding operation computes
+  //   v[p2, p1, p0] = (1 - r) * v[p2, p1, 2 * p0] + r * v[p2, p1, 2 * p0 + 1]
+  // Note that either the odd or the even element or both may not be actually
+  // present in the sparse array.
+  void bind(const Elt& r, const Field& F) {
+    index_t rd = 0, wr = 0;
+    while (rd < n_) {
+      index_t newrd;
+      T2 f = t2_at_corners(&newrd, rd, F);
+      c_[wr] = corner{.p0 = c_[rd].p0 >> 1,
+                      .p1 = c_[rd].p1,
+                      .p2 = c_[rd].p2,
+                      .v = affine_interpolation(r, f.t_[0], f.t_[1], F)};
+      wr++;
+      rd = newrd;
+    }
+
+    // shrink the array
+    n_ = wr;
+  }
+
+  void bind_all(size_t logv, const Elt r[/*logv*/], const Field& F) {
+    for (size_t v = 0; v < logv; ++v) {
+      bind(r[v], F);
+    }
+  }
+
+  void reshape() {
+    // this function works only if c_[i].p0 == 0 for all i, but
+    // rather than checking them one at the time, keep a giant
+    // bitwise OR and check at the end
+    size_t lost_bits = 0;
+    for (index_t i = 0; i < n_; ++i) {
+      lost_bits |= c_[i].p0;
+      c_[i] = corner{.p0 = c_[i].p1, .p1 = c_[i].p2, .p2 = 0, .v = c_[i].v};
+    }
+    check(lost_bits == 0, "lost_bits == 0");
+  }
+
+  // This method can only be called after full binding; the caller
+  // is responsible for ensuring that pre-condition.
+  Elt scalar() {
+    check(n_ == 1, "n_ == 1");
+    check(c_[0].p0 == 0, "c_[0].p0_ == 0");
+    check(c_[0].p1 == 0, "c_[0].p1_ == 0");
+    check(c_[0].p2 == 0, "c_[0].p2_ == 0");
+    return c_[0].v;
+  }
+
+  void canonicalize(const Field& F) {
+    std::sort(c_.begin(), c_.end(), [&F](const corner& x, const corner& y) {
+      return corner::compare(x, y, F);
+    });
+    return coalesce(F);
+  }
+
+ private:
+  void coalesce(const Field& F) {
+    // Coalesce duplicates.
+    // The (rd,wr)=(0,0) iteration executes the else{} branch and
+    // continues with (1,1), so we start at (1,1) and avoid the
+    // special case for wr-1 at wr=0.
+    index_t wr = 1;
+    for (index_t rd = 1; rd < n_; ++rd) {
+      if (c_[rd].eqndx(c_[wr - 1])) {
+        F.add(c_[wr - 1].v, c_[rd].v);
+      } else {
+        c_[wr] = c_[rd];
+        wr++;
+      }
+    }
+    n_ = wr;
+  }
+};
+}  // namespace proofs
+
+#endif  // PRIVACY_PROOFS_ZK_LIB_ARRAYS_SPARSE_H_