Method check_combinations

poly-commit/src/lib.rs:489–576

Verify opening proofs for all polynomials involved in a number of linear combinations (LC) simultaneously.

(
        vk: &Self::VerifierKey,
        linear_combinations: impl IntoIterator<Item = &'a LinearCombination<F>>,
        commitments: impl IntoIterator<Item = &'a LabeledCommitment<Self::Commitment>

    /// Verify opening proofs for all polynomials involved in a number of
    /// linear combinations (LC) simultaneously.
    fn check_combinations<'a, R: RngCore>(
        vk: &Self::VerifierKey,
        linear_combinations: impl IntoIterator<Item = &'a LinearCombination<F>>,
        commitments: impl IntoIterator<Item = &'a LabeledCommitment<Self::Commitment>>,
        eqn_query_set: &QuerySet<P::Point>,
        eqn_evaluations: &Evaluations<P::Point, F>,
        proof: &BatchLCProof<F, Self::BatchProof>,
        sponge: &mut impl CryptographicSponge,
        rng: &mut R,
    ) -> Result<bool, Self::Error>
    where
        Self::Commitment: 'a,
    {
        // The default implementation does this by batch-checking each
        // batch-opening proof of polynomials appearing in those LC that were
        // queried at the same point, then computing the evaluations of each LC
        // using the proved polynomial evaluations.
        let BatchLCProof { proof, evals } = proof;
        let lc_s = BTreeMap::from_iter(linear_combinations.into_iter().map(|lc| (lc.label(), lc)));

        // Rearrange the information about queries on linear combinations into
        // information about queries on individual polynomials.
        let poly_query_set = lc_query_set_to_poly_query_set(lc_s.values().copied(), eqn_query_set);
        let sorted_by_poly_and_query_label: BTreeSet<_> = poly_query_set
            .clone()
            .into_iter()
            .map(|(poly_label, v)| ((poly_label.clone(), v.1), v.0))
            .collect();

        let poly_evals = Evaluations::from_iter(
            sorted_by_poly_and_query_label
                .into_iter()
                .zip(evals.clone().unwrap())
                .map(|(((poly_label, point), _query_label), eval)| ((poly_label, point), eval)),
        );

        for &(ref lc_label, (_, ref point)) in eqn_query_set {
            if let Some(lc) = lc_s.get(lc_label) {
                let claimed_rhs = *eqn_evaluations
                    .get(&(lc_label.clone(), point.clone()))
                    .ok_or(Error::MissingEvaluation {
                        label: lc_label.to_string(),
                    })?;

                let mut actual_rhs = F::zero();

                // Compute the value of the linear combination by adding the
                // claimed value for each polynomial in it (to be proved later)
                // scaled by the corresponding coefficient.
                for (coeff, label) in lc.iter() {
                    let eval = match label {
                        LCTerm::One => F::one(),
                        LCTerm::PolyLabel(l) => *poly_evals
                            .get(&(l.clone().into(), point.clone()))
                            .ok_or(Error::MissingEvaluation {
                                label: format!("{}-{:?}", l.clone(), point.clone()),
                            })?,
                    };