refactor(stm): combine pairing checks ivc verify

[damrobi]

Content

This PR includes an update to the verification function of the recursive proof to combine the two pairing checks (dual MSM and accumulator) into one to speed up the verification.

Changes

• Convert the accumulator into an MSM
• Select a random scalar r to combine as: combined_msm = dual_msm + r * acc_msm
• Perform one pairing check instead of two
• Keep one pairing check in case of failure to identify the source of the failure and return the correct error

Measured gain

• with separated: 7.266ms
• with combined: 6.682ms
• Gain: ~8%

Pre-submit checklist

• Branch
  • Tests are provided (if possible)
  • Crates versions are updated (if relevant)
  • CHANGELOG file is updated (if relevant)
  • Commit sequence broadly makes sense
  • Key commits have useful messages
• PR
  • All check jobs of the CI have succeeded
  • Self-reviewed the diff
  • Useful pull request description
  • Reviewer requested
• Documentation
  • No new TODOs introduced

Issue(s)

Closes #3420

[github-actions]

Test Results

     5 files  ± 0     209 suites  ±0   1h 20m 18s ⏱️ + 13m 52s
 3 340 tests + 4   3 340 ✅ + 4  0 💤 ±0  0 ❌ ±0 
11 116 runs  +10  11 116 ✅ +10  0 💤 ±0  0 ❌ ±0 

Results for commit b75f104. ± Comparison against base commit cfb446a.

♻️ This comment has been updated with latest results.

[Copilot]

Pull request overview

This PR refactors IvcProof::verify to batch the dual MSM (KZG opening) and folded accumulator pairing equations into a single combined pairing check, reducing verifier time by avoiding a second multi-Miller loop + final exponentiation.

Changes:

• Convert the folded accumulator equation into a DualMSM, scale it by a transcript-derived challenge r, and add it to the proof’s dual_msm before running a single pairing check.
• Replace the two distinct verification failure variants with a single IvcProofError::MsmPairingCheckFailed.
• Update verification tests and add a test asserting the combined check holds for multiple candidate scalars.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 5 comments.

File	Description
mithril-stm/src/proof_system/ivc_halo2_snark/proof.rs	Implements the combined pairing check in verify and updates/adds tests accordingly.
mithril-stm/src/proof_system/ivc_halo2_snark/errors.rs	Collapses prior error variants into MsmPairingCheckFailed for the new combined check path.

Suppressed comments (6)

mithril-stm/src/proof_system/ivc_halo2_snark/proof.rs:222

• The PR description says to keep (or rerun) an individual pairing check on failure to identify whether the dual MSM or the accumulator caused the failure. The current implementation always returns MsmPairingCheckFailed without re-checking individual equations, so the error source is lost and the PR behavior no longer matches the stated intent/issue acceptance criteria.

        if !combined.check(verifier_setup.verifier_params()) {
            return Err(IvcProofError::MsmPairingCheckFailed.into());
        }

mithril-stm/src/proof_system/ivc_halo2_snark/proof.rs:751

• This assertion message still claims the failure is specifically the “KZG opening check”, but the error is now MsmPairingCheckFailed from the combined pairing check. Update the message to match the new behavior.

            Some(&IvcProofError::MsmPairingCheckFailed),
            "different protocol message must fail the KZG opening check, got: {err}"

mithril-stm/src/proof_system/ivc_halo2_snark/proof.rs:778

• This assertion message still refers to the “KZG opening check”, but the code now reports MsmPairingCheckFailed from the combined pairing check. Adjust the message to prevent confusion when the test fails.

            Some(&IvcProofError::MsmPairingCheckFailed),
            "mismatched state corrupts public inputs and must fail the KZG opening check, got: {err}"

mithril-stm/src/proof_system/ivc_halo2_snark/proof.rs:805

• This assertion message still refers to the “KZG opening check”, but verification now reports MsmPairingCheckFailed from the combined pairing check. Update the message to match the new error semantics.

            Some(&IvcProofError::MsmPairingCheckFailed),
            "mismatched accumulator corrupts public inputs and must fail the KZG opening check, got: {err}"

mithril-stm/src/proof_system/ivc_halo2_snark/proof.rs:830

• This assertion message still mentions the “KZG opening check”, but the code now fails via the combined pairing check and returns MsmPairingCheckFailed. Update the message to reflect the combined-check behavior.

            Some(&IvcProofError::MsmPairingCheckFailed),
            "Poseidon bytes via Blake2b path must fail the KZG opening check, got: {err}"

mithril-stm/src/proof_system/ivc_halo2_snark/proof.rs:874

• This assertion message still claims the failure is specifically the “accumulator check (not the KZG check)”, but verification now returns a single MsmPairingCheckFailed for the combined check, so the distinction no longer exists. Update the message to avoid implying separate error paths.

            Some(&IvcProofError::MsmPairingCheckFailed),
            "wrong fixed bases must fail the accumulator check (not the KZG check), got: {err}"

[jpraynaud]

We probably need a test to make sure we don't use any value for r (the golden test we were talking about). This means that its computation will need to be extracted to a pub(crate) function so that it can be easily tested.