refactor(stm): combine pairing checks ivc verify

[damrobi]

Content

This PR includes an update to the verification function of the recursive proof to combine the two pairing checks (dual MSM and accumulator) into one to speed up the verification.

Changes

• Convert the accumulator into an MSM
• Select a random scalar r to combine as: combined_msm = dual_msm + r * acc_msm
• Perform one pairing check instead of two
• Keep one pairing check in case of failure to identify the source of the failure and return the correct error

Measured gain

• with separated: 7.266ms
• with combined: 6.682ms
• Gain: ~8%

Pre-submit checklist

• Branch
  • Tests are provided (if possible)
  • Crates versions are updated (if relevant)
  • CHANGELOG file is updated (if relevant)
  • Commit sequence broadly makes sense
  • Key commits have useful messages
• PR
  • All check jobs of the CI have succeeded
  • Self-reviewed the diff
  • Useful pull request description
  • Reviewer requested
• Documentation
  • No new TODOs introduced

Issue(s)

Closes #3420

[github-actions]

Test Results

     5 files  ± 0     209 suites  ±0   59m 49s ⏱️ - 1h 36m 49s
 3 377 tests  - 71   3 377 ✅  - 71  0 💤 ±0  0 ❌ ±0 
11 237 runs   - 74  11 237 ✅  - 74  0 💤 ±0  0 ❌ ±0 

Results for commit bd5a2c8. ± Comparison against base commit 084c534.

This pull request removes 73 and adds 2 tests. Note that renamed tests count towards both.

mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::index_out_of_bounds
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::index_too_large_for_circuit_range
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::indices_not_increasing
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::leaf_merkle_path_mismatch
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::leaf_swap_keep_merkle_path
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::leaf_wrong_verification_key
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::merkle_path_corrupt_sibling
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::merkle_path_flip_position
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::merkle_path_length_long
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::merkle_path_length_short
…

mithril-stm ‑ proof_system::ivc_halo2_snark::proof::tests::golden::golden_combiner_r_for_stored_recursive_step_output
mithril-stm ‑ proof_system::ivc_halo2_snark::proof::tests::ivc_proof_verify_combined_check_holds_for_any_scalar_r

♻️ This comment has been updated with latest results.

[Copilot]

Pull request overview

This PR refactors IvcProof::verify to batch the dual MSM (KZG opening) and folded accumulator pairing equations into a single combined pairing check, reducing verifier time by avoiding a second multi-Miller loop + final exponentiation.

Changes:

• Convert the folded accumulator equation into a DualMSM, scale it by a transcript-derived challenge r, and add it to the proof’s dual_msm before running a single pairing check.
• Replace the two distinct verification failure variants with a single IvcProofError::MsmPairingCheckFailed.
• Update verification tests and add a test asserting the combined check holds for multiple candidate scalars.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 5 comments.

File	Description
mithril-stm/src/proof_system/ivc_halo2_snark/proof.rs	Implements the combined pairing check in verify and updates/adds tests accordingly.
mithril-stm/src/proof_system/ivc_halo2_snark/errors.rs	Collapses prior error variants into MsmPairingCheckFailed for the new combined check path.

Suppressed comments (6)

mithril-stm/src/proof_system/ivc_halo2_snark/proof.rs:222

• The PR description says to keep (or rerun) an individual pairing check on failure to identify whether the dual MSM or the accumulator caused the failure. The current implementation always returns MsmPairingCheckFailed without re-checking individual equations, so the error source is lost and the PR behavior no longer matches the stated intent/issue acceptance criteria.

        if !combined.check(verifier_setup.verifier_params()) {
            return Err(IvcProofError::MsmPairingCheckFailed.into());
        }

mithril-stm/src/proof_system/ivc_halo2_snark/proof.rs:751

• This assertion message still claims the failure is specifically the “KZG opening check”, but the error is now MsmPairingCheckFailed from the combined pairing check. Update the message to match the new behavior.

            Some(&IvcProofError::MsmPairingCheckFailed),
            "different protocol message must fail the KZG opening check, got: {err}"

mithril-stm/src/proof_system/ivc_halo2_snark/proof.rs:778

• This assertion message still refers to the “KZG opening check”, but the code now reports MsmPairingCheckFailed from the combined pairing check. Adjust the message to prevent confusion when the test fails.

            Some(&IvcProofError::MsmPairingCheckFailed),
            "mismatched state corrupts public inputs and must fail the KZG opening check, got: {err}"

mithril-stm/src/proof_system/ivc_halo2_snark/proof.rs:805

• This assertion message still refers to the “KZG opening check”, but verification now reports MsmPairingCheckFailed from the combined pairing check. Update the message to match the new error semantics.

            Some(&IvcProofError::MsmPairingCheckFailed),
            "mismatched accumulator corrupts public inputs and must fail the KZG opening check, got: {err}"

mithril-stm/src/proof_system/ivc_halo2_snark/proof.rs:830

• This assertion message still mentions the “KZG opening check”, but the code now fails via the combined pairing check and returns MsmPairingCheckFailed. Update the message to reflect the combined-check behavior.

            Some(&IvcProofError::MsmPairingCheckFailed),
            "Poseidon bytes via Blake2b path must fail the KZG opening check, got: {err}"

mithril-stm/src/proof_system/ivc_halo2_snark/proof.rs:874

• This assertion message still claims the failure is specifically the “accumulator check (not the KZG check)”, but verification now returns a single MsmPairingCheckFailed for the combined check, so the distinction no longer exists. Update the message to avoid implying separate error paths.

            Some(&IvcProofError::MsmPairingCheckFailed),
            "wrong fixed bases must fail the accumulator check (not the KZG check), got: {err}"

[kitounliu]

LGTM

[jpraynaud]

LGTM 👍