A generalized halo2 verifier written in Move

1. halo2-verifier.move
from 0 to 1
by @nanne007

2. Agenda
• What’s halo2-verifier
• Why we do this
• How we did this - the detailed implementation
• Problems we solve
• Problems still remains
• What’s next

3. Halo2
• PLONKish arithmetization with support of custom
gates and lookup arguments.

4. Prover
• Commit to polynomials encoding the main
components of the circuit.
• Evaluate the above polynomials at all necessary
points.
• Create an opening proof for the multipoint opening
argument using some polynomial commitment scheme
like kzg.
Verifier
• Read Commitments to polynomials encoding
the circuit.
• Read evaluation of the above polynomials at
all necessary points.
• Verify the opening proof against the
multipoint opening argument using the same
polynomial commitment scheme in prover.

5. halo2-verifier.move
i s a set o f l i brari es t o :
• expressing halo2 circuits directly in move.
• verify proofs generated by halo2 protocol.
• also, provides common crypto libraries, like implementation of msm, gwc/shplonk.

6. Why we do this
T H E M O T I V A T I O N O F
H A L O 2 V E R I F I E R I N
M O V E
For proof verification of zkmove
which built upon halo2.
So that we can integrate zkmove into move-based
blockchains
move ecosystem still lacks of public libraries
for zkp.
And we want to change the situations.
A common implementation for halo2 verifier
is a good start.
And we can do that!

7. How we reach the goal
S T E P
incomplete support
of crypto primitives
Identify the key
problem.
S T E P
study the system so we
can get to the details.
Deep understanding
of halo2
S T E P
add bn254 support
to aptos
Solve the key
problem first.
S T E P
Move is good, but can
be better.
Implement the
main components.
S T E P
the inconsistency of
curve serializations
The devil is in
the detail.
1 2 3 4 5

8. Key problem
W h e r e t o g e t t h e B N 2 5 4 p r i m i t i v e s

9. Key problem
W h e r e t o g e t t h e B N 2 5 4 p r i m i t i v e s
• There is NONE!

10. Key problem
W h e r e t o g e t t h e B N 2 5 4 p r i m i t i v e s
• There is NONE!
• Cooperate with APOTS to add bn254 feature set.

11. MSM
The Components
• Following the structures of halo2 in Rust which
already has a clean codebase.
• Implement them one by one.
• Do testing on the Move impl: make sure they
have the same results of corresponding
components of halo2.
Permutation
Expressio
n
Lookup
Transcript
Vanishing
Shplonk
Query

12. Make it Universal
d e p l o y o n c e , r e u s e e v e r y w h e r e .

13. Make it Universal
d e p l o y o n c e , r e u s e e v e r y w h e r e .
• Abstract necessary circuit’s info into Resource

14. Make it Universal
d e p l o y o n c e , r e u s e e v e r y w h e r e .
• Abstract necessary circuit’s info into Resource

15. The Expression Problem
• No way to express nested structures in Move
pub enum Expression<F> {
/// This is a constant polynomial
Constant(F),
/// This is a fixed column queried at a certain relative
location
Fixed(FixedQuery),
/// This is an advice (witness) column queried
Advice(AdviceQuery),
/// This is an instance (external) column queried
Instance(InstanceQuery),
/// This is a challenge
Challenge(Challenge),
/// This is a negated polynomial
Negated(Box<Expression<F>>),
/// This is the sum of two polynomials
Sum(Box<Expression<F>>, Box<Expression<F>>),
/// This is the product of two polynomials
Product(Box<Expression<F>>, Box<Expression<F>>),
/// This is a scaled polynomial
Scaled(Box<Expression<F>>, F),

16. The Expression Problem
• No way to express nested structures in Move
pub enum Expression<F> {
/// This is a constant polynomial
Constant(F),
/// This is a fixed column queried at a certain relative
location
Fixed(FixedQuery),
/// This is an advice (witness) column queried
Advice(AdviceQuery),
/// This is an instance (external) column queried
Instance(InstanceQuery),
/// This is a challenge
Challenge(Challenge),
/// This is a negated polynomial
Negated(Box<Expression<F>>),
/// This is the sum of two polynomials
Sum(Box<Expression<F>>, Box<Expression<F>>),
/// This is the product of two polynomials
Product(Box<Expression<F>>, Box<Expression<F>>),
/// This is a scaled polynomial
Scaled(Box<Expression<F>>, F),
2 * x_2 * x_3 +
3 * x_0 * x_1 * x_3 +
5 * x_2 * (x_3 + x_4)
Transform expression to multivariate polynomial

17. The chaos of curve serialization
• y^2 = x^3 + ax + b
• In serialization form, only store x with a bit to indicate the sign of y.
• Different crypto libraries have no agreement on which bit to use.
• In halo2-verifier.move, we had to re-serialize from halo2curves ---> arkworks.

18. Problems still remain
w h i c h n e e d t o b e a d d r e s s e d n e x t
2. heavy gas cost
mainly due to the pure move implementation
of `pow` function.
1. cannot support too complex circuits
It’s not possible to verify proofs exceeding 64k.

19. • Optimization!
• Real user cases! like zk-email for aptos.
• Expand to other move blockchains, like sui, movement.
What's Next for halo2-verifier

20. References
• zkmove website: https://www.zkmove.net/
• halo2-verifier.move: https://github.com/zkmove/halo2-verifier.move
• halo2: https://zcash.github.io/halo2/design/proving-system.html
• aptos cryptography: https://github.com/aptos-labs/aptos-core/tree/main/aptos-
move/framework/aptos-stdlib/sources/cryptography
• curve serialization: https://github.com/privacy-scaling-explorations/halo2curves/issues/109

21. About
• A few fellows experienced with Move and ZKP,
• With the goal of creating safe, efficient and trustless protocols.
• And we’re recruiting talents to build with us!

22. Questions?
We hope you learned something new.