1use algebra::Field;
  2use std::hash::Hash;
  3
  4use crate::crh::{
  5    bowe_hopwood::{BoweHopwoodPedersenCRH, BoweHopwoodPedersenParameters, CHUNK_SIZE},
  6    pedersen::PedersenWindow,
  7    FixedLengthCRHGadget,
  8};
  9use algebra::groups::Group;
 10use r1cs_core::{ConstraintSystem, SynthesisError};
 11use r1cs_std::{alloc::AllocGadget, groups::GroupGadget, uint8::UInt8};
 12
 13use r1cs_std::bits::boolean::Boolean;
 14use std::{borrow::Borrow, marker::PhantomData};
 15
 16#[derive(Derivative)]
 17#[derivative(Clone(
 18    bound = "G: Group, W: PedersenWindow, ConstraintF: Field, GG: GroupGadget<G, ConstraintF>"
 19))]
 20pub struct BoweHopwoodPedersenCRHGadgetParameters<
 21    G: Group,
 22    W: PedersenWindow,
 23    ConstraintF: Field,
 24    GG: GroupGadget<G, ConstraintF>,
 25> {
 26    params:   BoweHopwoodPedersenParameters<G>,
 27    _group_g: PhantomData<GG>,
 28    _engine:  PhantomData<ConstraintF>,
 29    _window:  PhantomData<W>,
 30}
 31
 32pub struct BoweHopwoodPedersenCRHGadget<
 33    G: Group,
 34    ConstraintF: Field,
 35    GG: GroupGadget<G, ConstraintF>,
 36> {
 37    _group:        PhantomData<*const G>,
 38    _group_gadget: PhantomData<*const GG>,
 39    _engine:       PhantomData<ConstraintF>,
 40}
 41
 42impl<ConstraintF, G, GG, W> FixedLengthCRHGadget<BoweHopwoodPedersenCRH<G, W>, ConstraintF>
 43    for BoweHopwoodPedersenCRHGadget<G, ConstraintF, GG>
 44where
 45    ConstraintF: Field,
 46    G: Group + Hash,
 47    GG: GroupGadget<G, ConstraintF>,
 48    W: PedersenWindow,
 49{
 50    type OutputGadget = GG;
 51    type ParametersGadget = BoweHopwoodPedersenCRHGadgetParameters<G, W, ConstraintF, GG>;
 52
 53    fn check_evaluation_gadget<CS: ConstraintSystem<ConstraintF>>(
 54        cs: CS,
 55        parameters: &Self::ParametersGadget,
 56        input: &[UInt8],
 57    ) -> Result<Self::OutputGadget, SynthesisError> {
 58        // Pad the input if it is not the current length.
 59        let mut input_in_bits: Vec<_> = input.iter().flat_map(|byte| byte.into_bits_le()).collect();
 60        if (input_in_bits.len()) % CHUNK_SIZE != 0 {
 61            let current_length = input_in_bits.len();
 62            for _ in 0..(CHUNK_SIZE - current_length % CHUNK_SIZE) {
 63                input_in_bits.push(Boolean::constant(false));
 64            }
 65        }
 66        assert!(input_in_bits.len() % CHUNK_SIZE == 0);
 67        assert_eq!(parameters.params.generators.len(), W::NUM_WINDOWS);
 68        for generators in parameters.params.generators.iter() {
 69            assert_eq!(generators.len(), W::WINDOW_SIZE);
 70        }
 71
 72        // Allocate new variable for the result.
 73        let input_in_bits = input_in_bits
 74            .chunks(W::WINDOW_SIZE * CHUNK_SIZE)
 75            .map(|x| x.chunks(CHUNK_SIZE).collect::<Vec<_>>())
 76            .collect::<Vec<_>>();
 77        let result = GG::precomputed_base_3_bit_signed_digit_scalar_mul(
 78            cs,
 79            &parameters.params.generators,
 80            &input_in_bits,
 81        )?;
 82
 83        Ok(result)
 84    }
 85}
 86
 87impl<G: Group, W: PedersenWindow, ConstraintF: Field, GG: GroupGadget<G, ConstraintF>>
 88    AllocGadget<BoweHopwoodPedersenParameters<G>, ConstraintF>
 89    for BoweHopwoodPedersenCRHGadgetParameters<G, W, ConstraintF, GG>
 90{
 91    fn alloc<F, T, CS: ConstraintSystem<ConstraintF>>(
 92        _cs: CS,
 93        value_gen: F,
 94    ) -> Result<Self, SynthesisError>
 95    where
 96        F: FnOnce() -> Result<T, SynthesisError>,
 97        T: Borrow<BoweHopwoodPedersenParameters<G>>,
 98    {
 99        let params = value_gen()?.borrow().clone();
100        Ok(BoweHopwoodPedersenCRHGadgetParameters {
101            params,
102            _group_g: PhantomData,
103            _engine: PhantomData,
104            _window: PhantomData,
105        })
106    }
107
108    fn alloc_input<F, T, CS: ConstraintSystem<ConstraintF>>(
109        _cs: CS,
110        value_gen: F,
111    ) -> Result<Self, SynthesisError>
112    where
113        F: FnOnce() -> Result<T, SynthesisError>,
114        T: Borrow<BoweHopwoodPedersenParameters<G>>,
115    {
116        let params = value_gen()?.borrow().clone();
117        Ok(BoweHopwoodPedersenCRHGadgetParameters {
118            params,
119            _group_g: PhantomData,
120            _engine: PhantomData,
121            _window: PhantomData,
122        })
123    }
124}
125
126#[cfg(test)]
127mod test {
128    use algebra::fields::sw6::fr::Fr;
129    use rand::{thread_rng, Rng};
130
131    use crate::crh::{
132        bowe_hopwood::{constraints::BoweHopwoodPedersenCRHGadget, BoweHopwoodPedersenCRH},
133        pedersen::PedersenWindow,
134        FixedLengthCRH, FixedLengthCRHGadget,
135    };
136    use algebra::{curves::edwards_sw6::EdwardsProjective as Edwards, ProjectiveCurve};
137    use r1cs_core::ConstraintSystem;
138    use r1cs_std::{
139        alloc::AllocGadget, groups::curves::twisted_edwards::edwards_sw6::EdwardsSWGadget,
140        test_constraint_system::TestConstraintSystem, uint8::UInt8,
141    };
142
143    type TestCRH = BoweHopwoodPedersenCRH<Edwards, Window>;
144    type TestCRHGadget = BoweHopwoodPedersenCRHGadget<Edwards, Fr, EdwardsSWGadget>;
145
146    #[derive(Clone, PartialEq, Eq, Hash)]
147    pub(super) struct Window;
148
149    impl PedersenWindow for Window {
150        const WINDOW_SIZE: usize = 90;
151        const NUM_WINDOWS: usize = 8;
152    }
153
154    fn generate_input<CS: ConstraintSystem<Fr>, R: Rng>(
155        mut cs: CS,
156        rng: &mut R,
157    ) -> ([u8; 270], Vec<UInt8>) {
158        let mut input = [1u8; 270];
159        rng.fill_bytes(&mut input);
160
161        let mut input_bytes = vec![];
162        for (byte_i, input_byte) in input.iter().enumerate() {
163            let cs = cs.ns(|| format!("input_byte_gadget_{}", byte_i));
164            input_bytes.push(UInt8::alloc(cs, || Ok(*input_byte)).unwrap());
165        }
166        (input, input_bytes)
167    }
168
169    #[test]
170    fn crh_primitive_gadget_test() {
171        let rng = &mut thread_rng();
172        let mut cs = TestConstraintSystem::<Fr>::new();
173
174        let (input, input_bytes) = generate_input(&mut cs, rng);
175        println!("number of constraints for input: {}", cs.num_constraints());
176
177        let parameters = TestCRH::setup(rng).unwrap();
178        let primitive_result = TestCRH::evaluate(&parameters, &input).unwrap();
179
180        let gadget_parameters =
181            <TestCRHGadget as FixedLengthCRHGadget<TestCRH, Fr>>::ParametersGadget::alloc(
182                &mut cs.ns(|| "gadget_parameters"),
183                || Ok(&parameters),
184            )
185            .unwrap();
186        println!(
187            "number of constraints for input + params: {}",
188            cs.num_constraints()
189        );
190
191        let gadget_result =
192            <TestCRHGadget as FixedLengthCRHGadget<TestCRH, Fr>>::check_evaluation_gadget(
193                &mut cs.ns(|| "gadget_evaluation"),
194                &gadget_parameters,
195                &input_bytes,
196            )
197            .unwrap();
198
199        println!("number of constraints total: {}", cs.num_constraints());
200
201        let primitive_result = primitive_result.into_affine();
202        assert_eq!(primitive_result.x, gadget_result.x.value.unwrap());
203        assert_eq!(primitive_result.y, gadget_result.y.value.unwrap());
204        assert!(cs.is_satisfied());
205    }
206}