Add merkle verify gate

[4l0n50]

Closes #73.

[sai-deng]

MerkleVerify be part of the default policy

I think we should keep default policy to disable ALL non-primitive operations.

[4l0n50]

As discussed with @hratoanina and @LindaGuiga — we’re not supporting packing yet. So I added a, for now disabled, packing option to Merkle gates.

[sai-deng]

As discussed with @hratoanina and @LindaGuiga — we’re not supporting packing yet. So I added a, for now disabled, packing option to Merkle gates.

Could you please explain why packing is disabled for now?

[LindaGuiga]

As discussed with @hratoanina and @LindaGuiga — we’re not supporting packing yet. So I added a, for now disabled, packing option to Merkle gates.

Could you please explain why packing is disabled for now?

The problem with fully packing everything (so for example, when creating a proof structure), is that the challenger sometimes needs to observe both base field and extension field elements, without adding any padding in between. So for example, if you have to observe degree_bits (one base field element, and we do it at the start of the verifier) then elements that are packed, you might overflow the sponge rate (since, because of that first base field element, we would have something that is no longer a multiple of the rate). The correct behaviour then would be to fill the rate with base field elements (therefore breaking up packed elements), apply the permutation, and then add the rest of the base field elements. But for now, given the current Witness table, we don't have a way to select one base field element among the D in a packed extension field element. We can change the Witness table to support the selection of individual elements, though.

[sai-deng]

As discussed with @hratoanina and @LindaGuiga — we’re not supporting packing yet. So I added a, for now disabled, packing option to Merkle gates.

Could you please explain why packing is disabled for now?

The problem with fully packing everything (so for example, when creating a proof structure), is that the challenger sometimes needs to observe both base field and extension field elements, without adding any padding in between. So for example, if you have to observe degree_bits (one base field element, and we do it at the start of the verifier) then elements that are packed, you might overflow the sponge rate (since, because of that first base field element, we would have something that is no longer a multiple of the rate). The correct behaviour then would be to fill the rate with base field elements (therefore breaking up packed elements), apply the permutation, and then add the rest of the base field elements. But for now, given the current Witness table, we don't have a way to select one base field element among the D in a packed extension field element. We can change the Witness table to support the selection of individual elements, though.

I think the correct and most efficient way to solve it is to change Plonky3 prover to only observe extension field elements. We can add a TODO for now.

[sai-deng]

@4l0n50 I pushed a rename commit and another commit with several fixes. Please review and merge the PR as soon as possible to unblock others.

My fixes include:
Adding root indices to the AIR tables.
Fixing missing or incorrect constraints in AIR tables.
Correcting the logic for hashing extra siblings.

[4l0n50]

I'm ok with your changes. Thanks for you help!