ITADN
a16z/jolt/Issues

[Bug] Sigma Protocol 2 Verification Failure

#1102Openadust09 创建于 2025-11-11
A
adust09commented
## Summary zkVM proof verification fails with a panic in the Dory sigma protocol verification. The error occurs because Jolt discards the correct `VerifierSetup` loaded from the URS file and regenerates it using a buggy formula in Dory's `VerifierSetup::from_prover_setup()`. Here is error when using `max_trace_length = 2^25` ``` thread 'main' panicked at /$HOME/.cargo/git/checkouts/dory-52e051d93bc7618a/c6dff3f/src/vmv/evaluate.rs:294:5: Sigma protocol 2 verification failed: d2 != e(e1, Gamma_{2, fin}) ``` ## Environment Our Project: https://github.com/tcoratger/sig-agg/pull/2/files - **Jolt version**: `master` branch, commit `dbc011e2` - **Dory version**: `markosg04/dory` branch `dev/twist-shout`, commit `c6dff3f` - **Guest configuration**: `max_trace_length = 33_554_432` (2^25) - **Platform**: macOS Darwin 25.1.0 ## Root Cause [dory/src/core/setup.rs](https://github.com/markosg04/dory/blob/dev/twist-shout/src/core/setup.rs#L474) has a bug in recovering `max_log_n`: ```rust /// Constructor from an existing prover setup pub fn from_prover_setup(prover_setup: &ProverSetup<E>) -> Self { // Since g1_vec has length n = 1 << (max_log_n / 2), we have max_log_n = 2 * log2(g1_vec.len()) let max_log_n = prover_setup.core.g1_vec.len().trailing_zeros() as usize; ``` should be `let max_log_n = 2 * (prover_setup.core.g1_vec.len().trailing_zeros() as usize);` ## Mathematical Impact For `max_trace_length = 2^25`: **Setup Generation** (`ProverSetup::new`): ```rust let n = 1 << ((max_log_n + 1) / 2); // For max_log_n = 33: // n = 1 << ((33 + 1) / 2) = 1 << 17 = 131,072 generators ``` **Verifier Reconstruction** (`VerifierSetup::from_prover_setup`): ```rust let max_log_n = prover_setup.core.g1_vec.len().trailing_zeros() as usize; // g1_vec.len() = 131,072 // trailing_zeros(131,072) = 17 ``` This causes the verifier's delta/chi arrays to have wrong dimensions, resulting in mismatched `g_fin` parameter and failed pairing check.
3 条评论