Add Brakedown multilinear PCS

README.md

@@ -183,6 +183,7 @@ Unless you explicitly state otherwise, any contribution that you submit to this
 [aurora-light]: https://ia.cr/2019/601
 [pcd-acc]: https://ia.cr/2020/499
 [pst]: https://ia.cr/2011/587
+[brakedown]: https://ia.cr/2021/1043
 [ligero]: https://ia.cr/2022/1608
 [hyrax]: https://eprint.iacr.org/2017/1132
 
@@ -220,6 +221,10 @@ CCS 2017
 Riad S. Wahby, Ioanna Tzialla, abhi shelat, Justin Thaler, Michael Walfish
 2018 IEEE Symposium on Security and Privacy
 
+[Brakedown: Linear-time and field-agnostic SNARKs for R1CS][brakedown]    
+Alexander Golovnev, Jonathan Lee, Srinath Setty, Justin Thaler, Riad S. Wahby    
+CRYPTO 2023
+
 ## Acknowledgements
 
 This work was supported by: an Engineering and Physical Sciences Research Council grant; a Google Faculty Award; the RISELab at UC Berkeley; and donations from the Ethereum Foundation and the Interchain Foundation.

poly-commit/Cargo.toml

@@ -33,12 +33,16 @@ name = "ipa_times"
 path = "benches/ipa_times.rs"
 harness = false
 
+[[bench]]
+name = "brakedown_times"
+path = "benches/brakedown_ml_times.rs"
+harness = false
+
 [[bench]]
 name = "ligero_ml_times"
 path = "benches/ligero_ml_times.rs"
 harness = false
 
-
 [[bench]]
 name = "hyrax_times"
 path = "benches/hyrax_times.rs"

poly-commit/benches/brakedown_ml_times.rs

@@ -0,0 +1,59 @@
+use ark_crypto_primitives::{
+    crh::{sha256::Sha256, CRHScheme, TwoToOneCRHScheme},
+    merkle_tree::{ByteDigestConverter, Config},
+};
+use ark_pcs_bench_templates::*;
+use ark_poly::{DenseMultilinearExtension, MultilinearExtension};
+
+use ark_bn254::Fr;
+use ark_ff::PrimeField;
+
+use ark_poly_commit::linear_codes::{LinearCodePCS, MultilinearBrakedown};
+use blake2::Blake2s256;
+use rand_chacha::ChaCha20Rng;
+
+// Brakedown PCS over BN254
+struct MerkleTreeParams;
+type LeafH = LeafIdentityHasher;
+type CompressH = Sha256;
+impl Config for MerkleTreeParams {
+    type Leaf = Vec<u8>;
+
+    type LeafDigest = <LeafH as CRHScheme>::Output;
+    type LeafInnerDigestConverter = ByteDigestConverter<Self::LeafDigest>;
+    type InnerDigest = <CompressH as TwoToOneCRHScheme>::Output;
+
+    type LeafHash = LeafH;
+    type TwoToOneHash = CompressH;
+}
+
+pub type MLE<F> = DenseMultilinearExtension<F>;
+type MTConfig = MerkleTreeParams;
+type ColHasher<F> = FieldToBytesColHasher<F, Blake2s256>;
+type Brakedown<F> = LinearCodePCS<
+    MultilinearBrakedown<F, MTConfig, MLE<F>, ColHasher<F>>,
+    F,
+    MLE<F>,
+    MTConfig,
+    ColHasher<F>,
+>;
+
+fn rand_poly_brakedown_ml<F: PrimeField>(
+    num_vars: usize,
+    rng: &mut ChaCha20Rng,
+) -> DenseMultilinearExtension<F> {
+    DenseMultilinearExtension::rand(num_vars, rng)
+}
+
+fn rand_point_brakedown_ml<F: PrimeField>(num_vars: usize, rng: &mut ChaCha20Rng) -> Vec<F> {
+    (0..num_vars).map(|_| F::rand(rng)).collect()
+}
+
+const MIN_NUM_VARS: usize = 12;
+const MAX_NUM_VARS: usize = 22;
+
+bench!(
+    Brakedown<Fr>,
+    rand_poly_brakedown_ml,
+    rand_point_brakedown_ml
+);

poly-commit/src/error.rs

@@ -119,6 +119,9 @@ pub enum Error {
     /// Error resulting from hashing in linear code - based PCS.
     HashingError,
 
+    /// Shows that encoding is not feasible
+    EncodingError,
+
     /// This means a commitment with a certain label was matched with a
     /// a polynomial which has a different label - which shouldn't happen
     MismatchedLabels {
@@ -235,6 +238,7 @@ impl core::fmt::Display for Error {
             Error::TranscriptError => write!(f, "Incorrect transcript manipulation"),
             Error::InvalidParameters(err) => write!(f, "{}", err),
             Error::HashingError => write!(f, "Error resulting from hashing"),
+            Error::EncodingError => write!(f, "Encoding failed"),
             Error::MismatchedLabels { commitment_label, polynomial_label } =>
                 write!(f, "Mismatched labels: commitment label: {}, polynomial label: {}",
                     commitment_label,

poly-commit/src/lib.rs

@@ -131,6 +131,7 @@ pub mod streaming_kzg;
 /// Scheme based on the Ligero construction in [[Ligero]][ligero].
 ///
 /// [ligero]: https://eprint.iacr.org/2022/1608
+/// [brakedown]: https://eprint.iacr.org/2021/1043.pdf
 pub mod linear_codes;
 
 /// A polynomial commitment scheme based on the hardness of the