add: multiproof consistency test

[agnxsh]

Adds a Verkle multiproof consistency test, a continuation to addressing issue #396, implements the test https://github.com/crate-crypto/go-ipa/blob/b1e8a79/multiproof_test.go#L63-L132 as per the Verkle trie spec

Skips ipa_multi_verify because of a potential bug in g2t, will be addressed and fixed in successive PRs

[mratsim]

Very nice, so this confirms that generating multiproof is bug free.

[agnxsh]

Very nice, so this confirms that generating multiproof is bug free.

Absolutely 🙂

[mratsim]

Currently investigating the g2t issue. I found another bug in the multiproof generation so we need more complete coverage: 1f8c376

[mratsim]

To clarify, the PR added the following test

constantine/tests/t_ethereum_verkle_ipa_primitives.nim

Lines 658 to 667 in 618d8b3

	var multiproof: IpaMultiProof[8, EC_TwEdw_Aff[Fp[Banderwagon]], Fr[Banderwagon]]
	CRS.ipa_multi_prove(
	domain, prover_transcript,
	multiproof, polys,
	commitments, opening_challenges_in_domain)
	var prover_challenge {.noInit.}: Fr[Banderwagon]
	prover_transcript.squeezeChallenge("state", prover_challenge)
	doAssert prover_challenge.toHex(littleEndian) == "0xeee8a80357ff74b766eba39db90797d022e8d6dee426ded71234241be504d519", "Issue with squeezing the prover challenge"

to confirm that the state of the transcript matches with go-ipa.

However getQuotientPolyInDomain was wrongly implemented and was missing a multiplication here 1f8c376

meaning g was wrong here:

constantine/constantine/commitments/eth_verkle_ipa.nim

Lines 746 to 769 in 618d8b3

	# Compute combining polynomial
	# g(X) = ∑rⁱ.(fᵢ(X)-yᵢ)/(X-zᵢ) = r⁰(f₀(X)-y₀)/(X-z₀) + r¹(f₁(X)-y₁)/(X-z₁) + ... + rⁿ⁻¹(fₙ₋₁(X)-yₙ₋₁)/(X-zₙ₋₁)
	# As yᵢ = fᵢ(zᵢ)
	# quotient_poly(rⁱfᵢ(X), zᵢ) == rⁱ.quotient_poly(fᵢ(X), zᵢ)
	block:
	domain.getQuotientPolyInDomain(
	g[],
	polys_by_challenges[0],
	sparse_challenges[0])
	let t = g2 # We use g2 as temporary
	t.zeroMem(sizeof(t[]))
	for i in 1 ..< num_distinct_challenges:
	domain.getQuotientPolyInDomain(
	t[],
	polys_by_challenges[i],
	sparse_challenges[i])
	g[] += t[]
	# Commit to the combining polynomial g(X) = ∑rⁱ.(fᵢ(X)-yᵢ)/(X-zᵢ)
	var D {.noInit.}: EC
	crs.pedersen_commit(D, g[])
	proof.D.affine(D)
	transcript.absorb("D", proof.D)

D is derived from committing to g(X) and then absorbed into the transcript. I'm not sure why the transcript was correct for that consistency test but it does outline that we need a more comprehensive test suite #396