Optimized aggregation

[nulltea]

This PR aims to optimize proof compression by tweaking lookup_bits (size of lookup tables) for AggregationCircuit, which was previously overlooked.

Step proof

For step proof it allowed us to decrease the first stage circuit degree to k=20 while preserving the same degree in the aggregation stage as well as verifier cost. Unfortunately, I wasn't able to find configuration that decreases verified cost (gas)

k=21/23 lookup_bits=8 (baseline)

Gate Chip | Phase 0: 11535114 advice cells
Total 2059 fixed cells
Total range check advice cells to lookup per phase: [1222736, 0, 0]
Start:   Create proof
End:     Create proof ..............................................................82.801s

computing length 1 fixed base msm
computing length 47 MSM
Gate Chip | Phase 0: 7611546 advice cells
Total 8372 fixed cells
Total range check advice cells to lookup per phase: [1338369, 0, 0]
Start:   Create EVM proof
End:     Create EVM proof ..........................................................114.144s
proof size: 1376
deployment_code size: 13276
gas_cost = 324114

k=21/23 lookup_bits=22

Gate Chip | Phase 0: 11535114 advice cells
Total 2059 fixed cells
Total range check advice cells to lookup per phase: [1222736, 0, 0]
Start:   Create proof
End:     Create proof ..............................................................81.861s

computing length 1 fixed base msm
computing length 47 MSM
Gate Chip | Phase 0: 5243370 advice cells
Total 8372 fixed cells
Total range check advice cells to lookup per phase: [548977, 0, 0]
Start:   Create EVM proof
End:     Create EVM proof ..........................................................129.515s
proof size: 1376
deployment_code size: 13276
gas_cost = 324066

k=21/22 lookup_bits=21

Attempt to reduce aggregation degree (fail)

Gate Chip | Phase 0: 11535114 advice cells
Total 2059 fixed cells
Total range check advice cells to lookup per phase: [1222736, 0, 0]
Start:   Create proof
End:     Create proof ..............................................................81.122s

computing length 1 fixed base msm
computing length 47 MSM
Gate Chip | Phase 0: 5437376 advice cells
Total 8372 fixed cells
Total range check advice cells to lookup per phase: [640451, 0, 0]
Start:   Create EVM proof
End:     Create EVM proof ..........................................................82.919s
proof size: 1984
deployment_code size: 15993
gas_cost = 371754

k=20/23 lookup_bits=22

Gate Chip | Phase 0: 11581626 advice cells
Total 2063 fixed cells
Total range check advice cells to lookup per phase: [1238240, 0, 0]
Start:   Create proof
End:     Create proof ..............................................................63.635s

computing length 1 fixed base msm
computing length 73 MSM
Gate Chip | Phase 0: 7950774 advice cells
Total 8483 fixed cells
Total range check advice cells to lookup per phase: [823094, 0, 0]
Start:   Create EVM proof
End:     Create EVM proof ..........................................................131.707s
proof size: 1376
deployment_code size: 13276
gas_cost = 324102

k=20/23 lookup_bits=19

Gate Chip | Phase 0: 11581626 advice cells
Total 2063 fixed cells
Total range check advice cells to lookup per phase: [1238240, 0, 0]
Start:   Create proof
End:     Create proof ..............................................................63.530s

computing length 1 fixed base msm
computing length 73 MSM
Gate Chip | Phase 0: 8294230 advice cells
Total 8483 fixed cells
Total range check advice cells to lookup per phase: [977616, 0, 0]
Start:   Create EVM proof
End:     Create EVM proof ..........................................................119.562s
proof size: 1376
deployment_code size: 13276
gas_cost = 324102

The first two and last two tests show an interesting fact: the correlation between lookup bits and prover time isn't linear, even though lookup bits and advice cells are linearly anti-correlated. The larger lookup table can improve prover and verifier efficiency to some point (e.g. lookup_bits=19), but after that the prover time will increase (e.g. lookup_bits=23).

Committee update proof

Here, the same curve correlation between lookup_bits and prover time is observed, so just increasing lookup_bits=24 for k=25 slows the prover from 505s to 550s. However, by increasing first stage circuit degree to 20 and lookup_bits in the aggregation circuit to 23, it ended up being possible to use k=24 in the aggregation stage while preserving the same verifier cost.

k=20/24 lookup_bits=23

Gate Chip | Phase 0: 1599532 advice cells
Total 1795 fixed cells
Total range check advice cells to lookup per phase: [4096, 0, 0]
Start:   Create proof
End:     Create proof ..............................................................161.955s

computing length 1 fixed base msm
computing length 154 MSM
Gate Chip | Phase 0: 16564545 advice cells
Total 8553 fixed cells
Total range check advice cells to lookup per phase: [1685220, 0, 0]
Start:   Create EVM proof
End:     Create EVM proof ..........................................................271.195s
proof size: 1376
deployment_code size: 23493
gas_cost = 349775

Compared to the previous configuration k=18/25 lookup_bits=8 where total prover time was 43s + 490s = 533s (see #41), this yields a 19% improvement.