refactor: Field-agnostic and reusable transcript

[codygunton]

In preparation for proper generation of Goblin challenges, this PR makes the transcript field agnostic. The transcript is now a class and not a template, and challenges are uint256_ts. It is the developer's responsibility to construct field elements from these.

Additionally, internal state is added to the transcript so that it can be passed along from prover to prover and from verifier to cerifier. After one prover has finished with it, they export the newly added proof data. The next prover adds additional data and is able to export its newly added proof data, and so on. This is illustrated in a test, which also add data from two different fields (each having 254-bit modulus). On the verification side, the verifier transcript can be initialized with the first proof, and then later can have the second proof loaded into its data buffer. Ultimately, what this enables is for the second interactions challenge's to depend on the first interaction's proof.

There are also small additional changes, including a fix to a test that was written incorrectly and copied and pasted into several different files.

Checklist:

Remove the checklist to signal you've completed it. Enable auto-merge if the PR is ready to merge.

• If the pull request requires a cryptography review (e.g. cryptographic algorithm implementations) I have added the 'crypto' tag.
• I have reviewed my diff in github, line by line and removed unexpected formatting changes, testing logs, or commented-out code.
• Every change is related to the PR description.
• I have linked this pull request to relevant issues (if any exist).

[AztecBot]

Benchmark results

Metrics with a significant change:

• note_trial_decrypting_time_in_ms (32): 51.8 (-32%)

Detailed results

All benchmarks are run on txs on the Benchmarking contract on the repository. Each tx consists of a batch call to create_note and increment_balance, which guarantees that each tx has a private call, a nested private call, a public call, and a nested public call, as well as an emitted private note, an unencrypted log, and public storage read and write.

This benchmark source data is available in JSON format on S3 here.

Values are compared against data from master at commit 8ff37800 and shown if the difference exceeds 1%.

L2 block published to L1

Each column represents the number of txs on an L2 block published to L1.

Metric	8 txs	32 txs	128 txs
l1_rollup_calldata_size_in_bytes	45,444	179,588	716,132
l1_rollup_calldata_gas	222,780	868,220	3,449,528
l1_rollup_execution_gas	841,867	3,595,328	22,204,897
l2_block_processing_time_in_ms	2,071 (-1%)	8,027 (-1%)	33,369 (-1%)
note_successful_decrypting_time_in_ms	314 (-2%)	925 (-3%)	3,391 (-2%)
note_trial_decrypting_time_in_ms	23.1 (-22%)	⚠️ 51.8 (-32%)	202
l2_block_building_time_in_ms	20,627 (+1%)	81,059 (-1%)	325,445 (-1%)
l2_block_rollup_simulation_time_in_ms	17,078 (+1%)	67,090 (-1%)	269,378 (-1%)
l2_block_public_tx_process_time_in_ms	3,497 (-1%)	13,812 (-1%)	55,509 (-1%)

L2 chain processing

Each column represents the number of blocks on the L2 chain where each block has 16 txs.

Metric	5 blocks	10 blocks
node_history_sync_time_in_ms	22,888 (-1%)	44,305 (-1%)
note_history_successful_decrypting_time_in_ms	2,150 (-1%)	4,171 (-1%)
note_history_trial_decrypting_time_in_ms	162	234 (+1%)
node_database_size_in_bytes	3,305,214	3,645,333
pxe_database_size_in_bytes	29,748	59,307

Circuits stats

Stats on running time and I/O sizes collected for every circuit run across all benchmarks.

Circuit	circuit_simulation_time_in_ms	circuit_input_size_in_bytes	circuit_output_size_in_bytes
private-kernel-init	199	43,077	20,441
private-kernel-ordering	115	25,833	9,689
base-rollup	2,964	664,108	873
root-rollup	87.2 (-5%)	4,072	1,097
private-kernel-inner	259	64,484	20,441
public-kernel-private-input	171 (-1%)	25,203	20,441
public-kernel-non-first-iteration	169	25,245	20,441
merge-rollup	11.0	2,592	873

Miscellaneous

Transaction sizes based on how many contracts are deployed in the tx.

Metric	0 deployed contracts	1 deployed contracts
tx_size_in_bytes	10,323	25,938

[ledwards2225]

Overall LGTM. See my comment for my only concern/suggestion

[ledwards2225]

Its a little unclear to me how this will work in an actual protocol setting because currently we send the verifier a proof, not a transcript. Are you proposing we now send the transcript instead? Otherwise when the translator prover returns it's "proof" (just transcrpit.proof_data, so ECCVM proof plus Translator proof) that will then be passed to the verifier and it will have no way to extract just the Translator proof for use in load_proof. I suppose one way to make it work would be to update the export_proof method in all of our provers to use transcript.export_proof() instead of just extracting proof_data. Anyway, this is why I'd feel better if there was a test but I'll leave it up to you since this is your line of work and maybe it's clear to you.