Conversation
Before verifying an aggregator consistency proof, the Core now derives
B* = < (sid_i, H(h_tx,i, tau)) >, tau = CR.IR.t
from the declared request batch and verifies the proof against B* rather
than treating the declared values as leaf values.
The envelope declares transaction hashes; the tree stores values that
bind the round's reference time. Deriving rather than accepting a
supplied leaf value is what makes a wrong tau unrepresentable: a shard
that built its tree under any other reference time produces a root the
Core does not reproduce, so the round is rejected rather than merely
attributable afterwards. Were the batch to carry the leaf value directly,
it would also have to carry the inputs needed to check the derivation.
The Core already holds both operands. The batch arrives with the opcode
stream, and IR.Timestamp is the value it already requires to equal the
previous seal's timestamp, so no new trust is placed in the shard. This
does not extend the Core into semantic validation: it evaluates no
predicate and parses no transaction, and applies one hash to a field
already present in the certification request.
O_L opcodes open a leaf preserved from an earlier round and keep carrying
that leaf's stored value verbatim; only the current batch is derived.
ZKVerifier.VerifyProof takes the reference time. Verifiers that do not
certify aggregator leaves ignore it.
The cross-language fixtures are regenerated from the matching rugregator
commit and now carry the reference time they were built under, and the
Go side asserts that verifying them under any other reference time fails.
The envelope wire format is unchanged.
|
Added the two service-time consistency-proof commits to this branch.
Before verifying an aggregator consistency proof, the Core derives
Aggregator ZK public values grow from 64 to 72 bytes ( The prover side is ristik/rugregator#5 — the verifying key changes with the circuit, so the ZK halves land together. The cross-language envelope fixtures in Regenerating those fixtures surfaced a real divergence: rugregator's
|
…cy proof
The aggregator ZK proof's public values grow from 64 to 72 bytes:
prev_root[32] || new_root[32] || reference_time (big-endian u64)
and the Core checks the committed reference time against CR.IR.t.
The reference time is public input, the content of the batch of leaves
is secret witness. In the hash-based instantiation the Core derives each
leaf value as H(txhash, tau) from the batch it receives; here the circuit
performs the same derivation internally and exposes tau to check.
aggzk_verify_proof takes the reference time through the FFI boundary.
The prover side is rugregator's zk-guest, which commits the same three
values.
2 participants
No description provided.