Fast zero-knowledge proof-carrying data implementation with no trusted setup.
What is Halo 2?
Halo 2 is a proving system that combines the Halo recursion technique with an arithmetization based on PLONK, and a polynomial commitment scheme based around the Inner Product Argument. The protocol is described here.
It is implemented across three Rust crates:
The core Halo 2 implementation. Provides the various traits and structs for writing circuits, and the APIs for creating and verifying proofs.
A collection of reusable gadgets for building circuits, and implementations of chips to power them.
Provides the APIs for building recursive circuits and proofs.
Halo 2 circuits are two-dimensional: they use a grid of "cells" identified by columns and rows, into which values are assigned. Constraints on those cells are grouped into "gates", which apply to every row simultaneously, and can refer to cells at relative rows. To enable both low-level relative cell references in gates, and high-level layout optimisations, circuit developers can define "regions" in which assigned cells will preserve their relative offsets.
- Instance columns contain per-proof public values, that the prover gives to the verifier.
- Advice columns are where the prover assigns private (witness) values, that the verifier learns zero knowledge about.
- Fixed columns contain constants used by every proof that are baked into the circuit.
- Selector columns are special cases of fixed columns that can be used to selectively enable gates.
In the example circuit layout pictured, the columns are indicated with different backgrounds. The instance column in white; advice columns in red; fixed columns in light blue; and selector columns in dark blue. Regions are shown in light green, and assigned cells in dark green or black.
Office Hours: March
- 9am PDT
- 12pm EDT
- 4pm UTC
- 6pm CEST
Come chat to us in the Halo 2 Discord channel about the proving system, the Rust crates, circuits you might be having trouble with, or anything else related to Halo 2!