zeromorph.hpp

#pragma once
#include "barretenberg/commitment_schemes/commitment_key.hpp"
#include "barretenberg/common/ref_vector.hpp"
#include "barretenberg/common/zip_view.hpp"
#include "barretenberg/polynomials/polynomial.hpp"
#include "barretenberg/transcript/transcript.hpp"
 
namespace proof_system::honk::pcs::zeromorph {
 
template <class FF> inline std::vector<FF> powers_of_challenge(const FF challenge, const size_t num_powers)
{
    std::vector<FF> challenge_powers = { FF(1), challenge };
    challenge_powers.reserve(num_powers);
    for (size_t j = 2; j < num_powers; j++) {
        challenge_powers.emplace_back(challenge_powers[j - 1] * challenge);
    }
    return challenge_powers;
};
 
template <typename Curve> class ZeroMorphProver_ {
    using FF = typename Curve::ScalarField;
    using Commitment = typename Curve::AffineElement;
    using Polynomial = barretenberg::Polynomial<FF>;
 
    // TODO(#742): Set this N_max to be the number of G1 elements in the mocked zeromorph SRS once it's in place.
    // (Then, eventually, set it based on the real SRS). For now we set it to be large but more or less arbitrary.
    static const size_t N_max = 1 << 22;
 
  public:
    static std::vector<Polynomial> compute_multilinear_quotients(Polynomial polynomial, std::span<const FF> u_challenge)
    {
        size_t log_N = numeric::get_msb(polynomial.size());
        // The size of the multilinear challenge must equal the log of the polynomial size
        ASSERT(log_N == u_challenge.size());
 
        // Define the vector of quotients q_k, k = 0, ..., log_N-1
        std::vector<Polynomial> quotients;
        for (size_t k = 0; k < log_N; ++k) {
            size_t size = 1 << k;
            quotients.emplace_back(Polynomial(size)); // degree 2^k - 1
        }
 
        // Compute the coefficients of q_{n-1}
        size_t size_q = 1 << (log_N - 1);
        Polynomial q{ size_q };
        for (size_t l = 0; l < size_q; ++l) {
            q[l] = polynomial[size_q + l] - polynomial[l];
        }
 
        quotients[log_N - 1] = q.share();
 
        std::vector<FF> f_k;
        f_k.resize(size_q);
 
        std::vector<FF> g(polynomial.data().get(), polynomial.data().get() + size_q);
 
        // Compute q_k in reverse order from k= n-2, i.e. q_{n-2}, ..., q_0
        for (size_t k = 1; k < log_N; ++k) {
            // Compute f_k
            for (size_t l = 0; l < size_q; ++l) {
                f_k[l] = g[l] + u_challenge[log_N - k] * q[l];
            }
 
            size_q = size_q / 2;
            q = Polynomial{ size_q };
 
            for (size_t l = 0; l < size_q; ++l) {
                q[l] = f_k[size_q + l] - f_k[l];
            }
 
            quotients[log_N - k - 1] = q.share();
            g = f_k;
        }
 
        return quotients;
    }
 
    static Polynomial compute_batched_lifted_degree_quotient(std::vector<Polynomial>& quotients,
                                                             FF y_challenge,
                                                             size_t N)
    {
        // Batched lifted degree quotient polynomial
        auto result = Polynomial(N);
 
        // Compute \hat{q} = \sum_k y^k * X^{N - d_k - 1} * q_k
        size_t k = 0;
        auto scalar = FF(1); // y^k
        for (auto& quotient : quotients) {
            // Rather than explicitly computing the shifts of q_k by N - d_k - 1 (i.e. multiplying q_k by X^{N - d_k -
            // 1}) then accumulating them, we simply accumulate y^k*q_k into \hat{q} at the index offset N - d_k - 1
            auto deg_k = static_cast<size_t>((1 << k) - 1);
            size_t offset = N - deg_k - 1;
            for (size_t idx = 0; idx < deg_k + 1; ++idx) {
                result[offset + idx] += scalar * quotient[idx];
            }
            scalar *= y_challenge; // update batching scalar y^k
            k++;
        }
 
        return result;
    }
 
    static Polynomial compute_partially_evaluated_degree_check_polynomial(Polynomial& batched_quotient,
                                                                          std::vector<Polynomial>& quotients,
                                                                          FF y_challenge,
                                                                          FF x_challenge)
    {
        size_t N = batched_quotient.size();
        size_t log_N = quotients.size();
 
        // Initialize partially evaluated degree check polynomial \zeta_x to \hat{q}
        auto result = batched_quotient;
 
        auto y_power = FF(1); // y^k
        for (size_t k = 0; k < log_N; ++k) {
            // Accumulate y^k * x^{N - d_k - 1} * q_k into \hat{q}
            auto deg_k = static_cast<size_t>((1 << k) - 1);
            auto x_power = x_challenge.pow(N - deg_k - 1); // x^{N - d_k - 1}
 
            result.add_scaled(quotients[k], -y_power * x_power);
 
            y_power *= y_challenge; // update batching scalar y^k
        }
 
        return result;
    }
 
    static Polynomial compute_partially_evaluated_zeromorph_identity_polynomial(
        Polynomial& f_batched,
        Polynomial& g_batched,
        std::vector<Polynomial>& quotients,
        FF v_evaluation,
        std::span<const FF> u_challenge,
        FF x_challenge,
        std::vector<Polynomial> concatenation_groups_batched = {})
    {
        size_t N = f_batched.size();
        size_t log_N = quotients.size();
 
        // Initialize Z_x with x * \sum_{i=0}^{m-1} f_i + \sum_{i=0}^{l-1} g_i
        auto result = g_batched;
        result.add_scaled(f_batched, x_challenge);
 
        // Compute Z_x -= v * x * \Phi_n(x)
        auto phi_numerator = x_challenge.pow(N) - 1; // x^N - 1
        auto phi_n_x = phi_numerator / (x_challenge - 1);
        result[0] -= v_evaluation * x_challenge * phi_n_x;
 
        // Add contribution from q_k polynomials
        auto x_power = x_challenge; // x^{2^k}
        for (size_t k = 0; k < log_N; ++k) {
            x_power = x_challenge.pow(1 << k); // x^{2^k}
 
            // \Phi_{n-k-1}(x^{2^{k + 1}})
            auto phi_term_1 = phi_numerator / (x_challenge.pow(1 << (k + 1)) - 1);
 
            // \Phi_{n-k}(x^{2^k})
            auto phi_term_2 = phi_numerator / (x_challenge.pow(1 << k) - 1);
 
            // x^{2^k} * \Phi_{n-k-1}(x^{2^{k+1}}) - u_k *  \Phi_{n-k}(x^{2^k})
            auto scalar = x_power * phi_term_1 - u_challenge[k] * phi_term_2;
 
            scalar *= x_challenge;
            scalar *= FF(-1);
 
            result.add_scaled(quotients[k], scalar);
        }
 
        // If necessary, add to Z_x the contribution related to concatenated polynomials:
        // \sum_{i=0}^{num_chunks_per_group}(x^{i * min_n + 1}concatenation_groups_batched_{i}).
        // We are effectively reconstructing concatenated polynomials from their chunks now that we know x
        // Note: this is an implementation detail related to Goblin Translator and is not part of the standard protocol.
        if (!concatenation_groups_batched.empty()) {
            size_t MINICIRCUIT_N = N / concatenation_groups_batched.size();
            auto x_to_minicircuit_N =
                x_challenge.pow(MINICIRCUIT_N); // power of x used to shift polynomials to the right
            auto running_shift = x_challenge;
            for (size_t i = 0; i < concatenation_groups_batched.size(); i++) {
                result.add_scaled(concatenation_groups_batched[i], running_shift);
                running_shift *= x_to_minicircuit_N;
            }
        }
 
        return result;
    }
 
    static Polynomial compute_batched_evaluation_and_degree_check_quotient(Polynomial& zeta_x,
                                                                           Polynomial& Z_x,
                                                                           FF x_challenge,
                                                                           FF z_challenge)
    {
        // We cannot commit to polynomials with size > N_max
        size_t N = zeta_x.size();
        ASSERT(N <= N_max);
 
        // Compute q_{\zeta} and q_Z in place
        zeta_x.factor_roots(x_challenge);
        Z_x.factor_roots(x_challenge);
 
        // Compute batched quotient q_{\zeta} + z*q_Z
        auto batched_quotient = zeta_x;
        batched_quotient.add_scaled(Z_x, z_challenge);
 
        // TODO(#742): To complete the degree check, we need to commit to (q_{\zeta} + z*q_Z)*X^{N_max - N - 1}.
        // Verification then requires a pairing check similar to the standard KZG check but with [1]_2 replaced by
        // [X^{N_max - N -1}]_2. Two issues: A) we do not have an SRS with these G2 elements (so need to generate a fake
        // setup until we can do the real thing), and B) its not clear to me how to update our pairing algorithms to do
        // this type of pairing. For now, simply construct q_{\zeta} + z*q_Z without the shift and do a standard KZG
        // pairing check. When we're ready, all we have to do to make this fully legit is commit to the shift here and
        // update the pairing check accordingly. Note: When this is implemented properly, it doesnt make sense to store
        // the (massive) shifted polynomial of size N_max. Ideally would only store the unshifted version and just
        // compute the shifted commitment directly via a new method.
        auto batched_shifted_quotient = batched_quotient;
 
        return batched_shifted_quotient;
    }
 
    static void prove(const std::vector<Polynomial>& f_polynomials,
                      const std::vector<Polynomial>& g_polynomials,
                      const std::vector<FF>& f_evaluations,
                      const std::vector<FF>& g_shift_evaluations,
                      const std::vector<FF>& multilinear_challenge,
                      const std::shared_ptr<CommitmentKey<Curve>>& commitment_key,
                      const std::shared_ptr<BaseTranscript>& transcript,
                      const std::vector<Polynomial>& concatenated_polynomials = {},
                      const std::vector<FF>& concatenated_evaluations = {},
                      const std::vector<RefVector<Polynomial>>& concatenation_groups = {})
    {
        // Generate batching challenge \rho and powers 1,...,\rho^{m-1}
        const FF rho = transcript->get_challenge("rho");
 
        // Extract multilinear challenge u and claimed multilinear evaluations from Sumcheck output
        std::span<const FF> u_challenge = multilinear_challenge;
        size_t log_N = u_challenge.size();
        size_t N = 1 << log_N;
 
        // Compute batching of unshifted polynomials f_i and to-be-shifted polynomials g_i:
        // f_batched = sum_{i=0}^{m-1}\rho^i*f_i and g_batched = sum_{i=0}^{l-1}\rho^{m+i}*g_i,
        // and also batched evaluation
        // v = sum_{i=0}^{m-1}\rho^i*f_i(u) + sum_{i=0}^{l-1}\rho^{m+i}*h_i(u).
        // Note: g_batched is formed from the to-be-shifted polynomials, but the batched evaluation incorporates the
        // evaluations produced by sumcheck of h_i = g_i_shifted.
        FF batched_evaluation{ 0 };
        Polynomial f_batched(N); // batched unshifted polynomials
        FF batching_scalar{ 1 };
        for (auto [f_poly, f_eval] : zip_view(f_polynomials, f_evaluations)) {
            f_batched.add_scaled(f_poly, batching_scalar);
            batched_evaluation += batching_scalar * f_eval;
            batching_scalar *= rho;
        }
 
        Polynomial g_batched{ N }; // batched to-be-shifted polynomials
        for (auto [g_poly, g_shift_eval] : zip_view(g_polynomials, g_shift_evaluations)) {
            g_batched.add_scaled(g_poly, batching_scalar);
            batched_evaluation += batching_scalar * g_shift_eval;
            batching_scalar *= rho;
        };
 
        size_t num_groups = concatenation_groups.size();
        size_t num_chunks_per_group = concatenation_groups.empty() ? 0 : concatenation_groups[0].size();
        // Concatenated polynomials
        Polynomial concatenated_batched(N);
 
        // construct concatention_groups_batched
        std::vector<Polynomial> concatenation_groups_batched;
        for (size_t i = 0; i < num_chunks_per_group; ++i) {
            concatenation_groups_batched.push_back(Polynomial(N));
        }
        // for each group
        for (size_t i = 0; i < num_groups; ++i) {
            concatenated_batched.add_scaled(concatenated_polynomials[i], batching_scalar);
            // for each element in a group
            for (size_t j = 0; j < num_chunks_per_group; ++j) {
                concatenation_groups_batched[j].add_scaled(concatenation_groups[i][j], batching_scalar);
            }
            batched_evaluation += batching_scalar * concatenated_evaluations[i];
            batching_scalar *= rho;
        }
 
        // Compute the full batched polynomial f = f_batched + g_batched.shifted() = f_batched + h_batched. This is the
        // polynomial for which we compute the quotients q_k and prove f(u) = v_batched.
        Polynomial f_polynomial = f_batched;
        f_polynomial += g_batched.shifted();
        f_polynomial += concatenated_batched;
 
        // Compute the multilinear quotients q_k = q_k(X_0, ..., X_{k-1})
        auto quotients = compute_multilinear_quotients(f_polynomial, u_challenge);
 
        // Compute and send commitments C_{q_k} = [q_k], k = 0,...,d-1
        std::vector<Commitment> q_k_commitments;
        q_k_commitments.reserve(log_N);
        for (size_t idx = 0; idx < log_N; ++idx) {
            q_k_commitments[idx] = commitment_key->commit(quotients[idx]);
            std::string label = "ZM:C_q_" + std::to_string(idx);
            transcript->send_to_verifier(label, q_k_commitments[idx]);
        }
 
        // Get challenge y
        FF y_challenge = transcript->get_challenge("ZM:y");
 
        // Compute the batched, lifted-degree quotient \hat{q}
        auto batched_quotient = compute_batched_lifted_degree_quotient(quotients, y_challenge, N);
 
        // Compute and send the commitment C_q = [\hat{q}]
        auto q_commitment = commitment_key->commit(batched_quotient);
        transcript->send_to_verifier("ZM:C_q", q_commitment);
 
        // Get challenges x and z
        auto [x_challenge, z_challenge] = challenges_to_field_elements<FF>(transcript->get_challenges("ZM:x", "ZM:z"));
 
        // Compute degree check polynomial \zeta partially evaluated at x
        auto zeta_x =
            compute_partially_evaluated_degree_check_polynomial(batched_quotient, quotients, y_challenge, x_challenge);
 
        // Compute ZeroMorph identity polynomial Z partially evaluated at x
        auto Z_x = compute_partially_evaluated_zeromorph_identity_polynomial(f_batched,
                                                                             g_batched,
                                                                             quotients,
                                                                             batched_evaluation,
                                                                             u_challenge,
                                                                             x_challenge,
                                                                             concatenation_groups_batched);
 
        // Compute batched degree-check and ZM-identity quotient polynomial pi
        auto pi_polynomial =
            compute_batched_evaluation_and_degree_check_quotient(zeta_x, Z_x, x_challenge, z_challenge);
 
        // Compute and send proof commitment pi
        auto pi_commitment = commitment_key->commit(pi_polynomial);
        transcript->send_to_verifier("ZM:PI", pi_commitment);
    }
};
 
template <typename Curve> class ZeroMorphVerifier_ {
    using FF = typename Curve::ScalarField;
    using Commitment = typename Curve::AffineElement;
 
  public:
    static Commitment compute_C_zeta_x(Commitment C_q, std::vector<Commitment>& C_q_k, FF y_challenge, FF x_challenge)
    {
        size_t log_N = C_q_k.size();
        size_t N = 1 << log_N;
 
        // Instantiate containers for input to batch mul
        std::vector<FF> scalars;
        std::vector<Commitment> commitments;
 
        // Contribution from C_q
        if constexpr (Curve::is_stdlib_type) {
            auto builder = x_challenge.get_context();
            scalars.emplace_back(FF(builder, 1));
        } else {
            scalars.emplace_back(FF(1));
        }
        commitments.emplace_back(C_q);
 
        // Contribution from C_q_k, k = 0,...,log_N
        for (size_t k = 0; k < log_N; ++k) {
            auto deg_k = static_cast<size_t>((1 << k) - 1);
            // Compute scalar y^k * x^{N - deg_k - 1}
            auto scalar = y_challenge.pow(k);
            scalar *= x_challenge.pow(N - deg_k - 1);
            scalar *= FF(-1);
 
            scalars.emplace_back(scalar);
            commitments.emplace_back(C_q_k[k]);
        }
 
        // Compute batch mul to get the result
        if constexpr (Curve::is_stdlib_type) {
            return Commitment::batch_mul(commitments, scalars);
        } else {
            return batch_mul_native(commitments, scalars);
        }
    }
 
    static Commitment compute_C_Z_x(const std::vector<Commitment>& f_commitments,
                                    const std::vector<Commitment>& g_commitments,
                                    std::vector<Commitment>& C_q_k,
                                    FF rho,
                                    FF batched_evaluation,
                                    FF x_challenge,
                                    std::vector<FF> u_challenge,
                                    const std::vector<RefVector<Commitment>>& concatenation_groups_commitments = {})
    {
        size_t log_N = C_q_k.size();
        size_t N = 1 << log_N;
 
        std::vector<FF> scalars;
        std::vector<Commitment> commitments;
 
        // Phi_n(x) = (x^N - 1) / (x - 1)
        auto phi_numerator = x_challenge.pow(N) - 1; // x^N - 1
        auto phi_n_x = phi_numerator / (x_challenge - 1);
 
        // Add contribution: -v * x * \Phi_n(x) * [1]_1
        if constexpr (Curve::is_stdlib_type) {
            auto builder = x_challenge.get_context();
            scalars.emplace_back(FF(builder, -1) * batched_evaluation * x_challenge * phi_n_x);
            commitments.emplace_back(Commitment::one(builder));
        } else {
            scalars.emplace_back(FF(-1) * batched_evaluation * x_challenge * phi_n_x);
            commitments.emplace_back(Commitment::one());
        }
 
        // Add contribution: x * \sum_{i=0}^{m-1} \rho^i*[f_i]
        auto rho_pow = FF(1);
        for (auto& commitment : f_commitments) {
            scalars.emplace_back(x_challenge * rho_pow);
            commitments.emplace_back(commitment);
            rho_pow *= rho;
        }
 
        // Add contribution: \sum_{i=0}^{l-1} \rho^{m+i}*[g_i]
        for (auto& commitment : g_commitments) {
            scalars.emplace_back(rho_pow);
            commitments.emplace_back(commitment);
            rho_pow *= rho;
        }
 
        // If applicable, add contribution from concatenated polynomial commitments
        // Note: this is an implementation detail related to Goblin Translator and is not part of the standard protocol.
        if (!concatenation_groups_commitments.empty()) {
            size_t CONCATENATION_INDEX = concatenation_groups_commitments[0].size();
            size_t MINICIRCUIT_N = N / CONCATENATION_INDEX;
            std::vector<FF> x_shifts;
            auto current_x_shift = x_challenge;
            auto x_to_minicircuit_n = x_challenge.pow(MINICIRCUIT_N);
            for (size_t i = 0; i < CONCATENATION_INDEX; ++i) {
                x_shifts.emplace_back(current_x_shift);
                current_x_shift *= x_to_minicircuit_n;
            }
            for (auto& concatenation_group_commitment : concatenation_groups_commitments) {
                for (size_t i = 0; i < CONCATENATION_INDEX; ++i) {
                    scalars.emplace_back(rho_pow * x_shifts[i]);
                    commitments.emplace_back(concatenation_group_commitment[i]);
                }
                rho_pow *= rho;
            }
        }
 
        // Add contributions: scalar * [q_k],  k = 0,...,log_N, where
        // scalar = -x * (x^{2^k} * \Phi_{n-k-1}(x^{2^{k+1}}) - u_k * \Phi_{n-k}(x^{2^k}))
        auto x_pow_2k = x_challenge;                 // x^{2^k}
        auto x_pow_2kp1 = x_challenge * x_challenge; // x^{2^{k + 1}}
        for (size_t k = 0; k < log_N; ++k) {
 
            auto phi_term_1 = phi_numerator / (x_pow_2kp1 - 1); // \Phi_{n-k-1}(x^{2^{k + 1}})
            auto phi_term_2 = phi_numerator / (x_pow_2k - 1);   // \Phi_{n-k}(x^{2^k})
 
            auto scalar = x_pow_2k * phi_term_1;
            scalar -= u_challenge[k] * phi_term_2;
            scalar *= x_challenge;
            scalar *= FF(-1);
 
            scalars.emplace_back(scalar);
            commitments.emplace_back(C_q_k[k]);
 
            // Update powers of challenge x
            x_pow_2k = x_pow_2kp1;
            x_pow_2kp1 *= x_pow_2kp1;
        }
 
        if constexpr (Curve::is_stdlib_type) {
            return Commitment::batch_mul(commitments, scalars);
        } else {
            return batch_mul_native(commitments, scalars);
        }
    }
 
    static Commitment batch_mul_native(const std::vector<Commitment>& points, const std::vector<FF>& scalars)
    {
        auto result = points[0] * scalars[0];
        for (size_t idx = 1; idx < scalars.size(); ++idx) {
            result = result + points[idx] * scalars[idx];
        }
        return result;
    }
 
    static std::array<Commitment, 2> verify(
        auto&& unshifted_commitments,
        auto&& to_be_shifted_commitments,
        auto&& unshifted_evaluations,
        auto&& shifted_evaluations,
        auto& multivariate_challenge,
        auto& transcript,
        const std::vector<RefVector<Commitment>>& concatenation_group_commitments = {},
        const std::vector<FF>& concatenated_evaluations = {})
    {
        size_t log_N = multivariate_challenge.size();
        FF rho = transcript->get_challenge("rho");
 
        // Construct batched evaluation v = sum_{i=0}^{m-1}\rho^i*f_i(u) + sum_{i=0}^{l-1}\rho^{m+i}*h_i(u)
        FF batched_evaluation = FF(0);
        FF batching_scalar = FF(1);
        for (auto& value : unshifted_evaluations) {
            batched_evaluation += value * batching_scalar;
            batching_scalar *= rho;
        }
        for (auto& value : shifted_evaluations) {
            batched_evaluation += value * batching_scalar;
            batching_scalar *= rho;
        }
        for (auto& value : concatenated_evaluations) {
            batched_evaluation += value * batching_scalar;
            batching_scalar *= rho;
        }
 
        // Receive commitments [q_k]
        std::vector<Commitment> C_q_k;
        C_q_k.reserve(log_N);
        for (size_t i = 0; i < log_N; ++i) {
            C_q_k.emplace_back(transcript->template receive_from_prover<Commitment>("ZM:C_q_" + std::to_string(i)));
        }
 
        // Challenge y
        FF y_challenge = transcript->get_challenge("ZM:y");
 
        // Receive commitment C_{q}
        auto C_q = transcript->template receive_from_prover<Commitment>("ZM:C_q");
 
        // Challenges x, z
        auto [x_challenge, z_challenge] = challenges_to_field_elements<FF>(transcript->get_challenges("ZM:x", "ZM:z"));
 
        // Compute commitment C_{\zeta_x}
        auto C_zeta_x = compute_C_zeta_x(C_q, C_q_k, y_challenge, x_challenge);
 
        // Compute commitment C_{Z_x}
        Commitment C_Z_x = compute_C_Z_x(unshifted_commitments,
                                         to_be_shifted_commitments,
                                         C_q_k,
                                         rho,
                                         batched_evaluation,
                                         x_challenge,
                                         multivariate_challenge,
                                         concatenation_group_commitments);
 
        // Compute commitment C_{\zeta,Z}
        Commitment C_zeta_Z;
        if constexpr (Curve::is_stdlib_type) {
            // Express operation as a batch_mul in order to use Goblinization if available
            auto builder = rho.get_context();
            std::vector<FF> scalars = { FF(builder, 1), z_challenge };
            std::vector<Commitment> points = { C_zeta_x, C_Z_x };
            C_zeta_Z = Commitment::batch_mul(points, scalars);
        } else {
            C_zeta_Z = C_zeta_x + C_Z_x * z_challenge;
        }
 
        // Receive proof commitment \pi
        auto C_pi = transcript->template receive_from_prover<Commitment>("ZM:PI");
 
        // Construct inputs and perform pairing check to verify claimed evaluation
        // Note: The pairing check (without the degree check component X^{N_max-N-1}) can be expressed naturally as
        // e(C_{\zeta,Z}, [1]_2) = e(pi, [X - x]_2). This can be rearranged (e.g. see the plonk paper) as
        // e(C_{\zeta,Z} - x*pi, [1]_2) * e(-pi, [X]_2) = 1, or
        // e(P_0, [1]_2) * e(P_1, [X]_2) = 1
        Commitment P0;
        if constexpr (Curve::is_stdlib_type) {
            // Express operation as a batch_mul in order to use Goblinization if available
            auto builder = rho.get_context();
            std::vector<FF> scalars = { FF(builder, 1), x_challenge };
            std::vector<Commitment> points = { C_zeta_Z, C_pi };
            P0 = Commitment::batch_mul(points, scalars);
        } else {
            P0 = C_zeta_Z + C_pi * x_challenge;
        }
 
        auto P1 = -C_pi;
 
        return { P0, P1 };
    }
};
 
} // namespace proof_system::honk::pcs::zeromorph