1use crate::{
  2    commitment::pedersen::{Commitment, Parameters, Randomness},
  3    crh::pedersen::Window,
  4    Vec,
  5};
  6use algebra_core::{
  7    fields::{Field, PrimeField},
  8    to_bytes, ProjectiveCurve, ToBytes, Zero,
  9};
 10use r1cs_core::{Namespace, SynthesisError};
 11
 12use core::{borrow::Borrow, marker::PhantomData};
 13use r1cs_std::prelude::*;
 14
 15type ConstraintF<C> = <<C as ProjectiveCurve>::BaseField as Field>::BasePrimeField;
 16
 17#[derive(Derivative)]
 18#[derivative(Clone(bound = "C: ProjectiveCurve, GG: CurveVar<C, ConstraintF<C>>"))]
 19pub struct ParametersVar<C: ProjectiveCurve, GG: CurveVar<C, ConstraintF<C>>>
 20where
 21    for<'a> &'a GG: GroupOpsBounds<'a, C, GG>,
 22{
 23    params: Parameters<C>,
 24    #[doc(hidden)]
 25    _group_var: PhantomData<GG>,
 26}
 27
 28#[derive(Clone, Debug)]
 29pub struct RandomnessVar<F: Field>(Vec<UInt8<F>>);
 30
 31pub struct CommGadget<C: ProjectiveCurve, GG: CurveVar<C, ConstraintF<C>>, W: Window>
 32where
 33    for<'a> &'a GG: GroupOpsBounds<'a, C, GG>,
 34{
 35    #[doc(hidden)]
 36    _curve: PhantomData<*const C>,
 37    #[doc(hidden)]
 38    _group_var: PhantomData<*const GG>,
 39    #[doc(hidden)]
 40    _window: PhantomData<*const W>,
 41}
 42
 43impl<C, GG, W> crate::commitment::CommitmentGadget<Commitment<C, W>, ConstraintF<C>>
 44    for CommGadget<C, GG, W>
 45where
 46    C: ProjectiveCurve,
 47    GG: CurveVar<C, ConstraintF<C>>,
 48    W: Window,
 49    for<'a> &'a GG: GroupOpsBounds<'a, C, GG>,
 50    ConstraintF<C>: PrimeField,
 51{
 52    type OutputVar = GG;
 53    type ParametersVar = ParametersVar<C, GG>;
 54    type RandomnessVar = RandomnessVar<ConstraintF<C>>;
 55
 56    fn commit(
 57        parameters: &Self::ParametersVar,
 58        input: &[UInt8<ConstraintF<C>>],
 59        r: &Self::RandomnessVar,
 60    ) -> Result<Self::OutputVar, SynthesisError> {
 61        assert!((input.len() * 8) <= (W::WINDOW_SIZE * W::NUM_WINDOWS));
 62
 63        let mut padded_input = input.to_vec();
 64        // Pad if input length is less than `W::WINDOW_SIZE * W::NUM_WINDOWS`.
 65        if (input.len() * 8) < W::WINDOW_SIZE * W::NUM_WINDOWS {
 66            let current_length = input.len();
 67            for _ in current_length..((W::WINDOW_SIZE * W::NUM_WINDOWS) / 8) {
 68                padded_input.push(UInt8::constant(0u8));
 69            }
 70        }
 71
 72        assert_eq!(padded_input.len() * 8, W::WINDOW_SIZE * W::NUM_WINDOWS);
 73        assert_eq!(parameters.params.generators.len(), W::NUM_WINDOWS);
 74
 75        // Allocate new variable for commitment output.
 76        let input_in_bits: Vec<_> = padded_input
 77            .iter()
 78            .flat_map(|byte| byte.into_bits_le())
 79            .collect();
 80        let input_in_bits = input_in_bits.chunks(W::WINDOW_SIZE);
 81        let mut result =
 82            GG::precomputed_base_multiscalar_mul(&parameters.params.generators, input_in_bits)?;
 83
 84        // Compute h^r
 85        let rand_bits: Vec<_> = r.0.iter().flat_map(|byte| byte.into_bits_le()).collect();
 86        result.precomputed_base_scalar_mul(
 87            rand_bits
 88                .iter()
 89                .zip(&parameters.params.randomness_generator),
 90        )?;
 91
 92        Ok(result)
 93    }
 94}
 95
 96impl<C, GG> AllocVar<Parameters<C>, ConstraintF<C>> for ParametersVar<C, GG>
 97where
 98    C: ProjectiveCurve,
 99    GG: CurveVar<C, ConstraintF<C>>,
100    for<'a> &'a GG: GroupOpsBounds<'a, C, GG>,
101{
102    fn new_variable<T: Borrow<Parameters<C>>>(
103        _cs: impl Into<Namespace<ConstraintF<C>>>,
104        f: impl FnOnce() -> Result<T, SynthesisError>,
105        _mode: AllocationMode,
106    ) -> Result<Self, SynthesisError> {
107        let params = f()?.borrow().clone();
108        Ok(ParametersVar {
109            params,
110            _group_var: PhantomData,
111        })
112    }
113}
114
115impl<C, F> AllocVar<Randomness<C>, F> for RandomnessVar<F>
116where
117    C: ProjectiveCurve,
118    F: PrimeField,
119{
120    fn new_variable<T: Borrow<Randomness<C>>>(
121        cs: impl Into<Namespace<F>>,
122        f: impl FnOnce() -> Result<T, SynthesisError>,
123        mode: AllocationMode,
124    ) -> Result<Self, SynthesisError> {
125        let r = to_bytes![&f().map(|b| b.borrow().0).unwrap_or(C::ScalarField::zero())].unwrap();
126        match mode {
127            AllocationMode::Constant => Ok(Self(UInt8::constant_vec(&r))),
128            AllocationMode::Input => UInt8::new_input_vec(cs, &r).map(Self),
129            AllocationMode::Witness => UInt8::new_witness_vec(cs, &r).map(Self),
130        }
131    }
132}
133
134#[cfg(test)]
135mod test {
136    use algebra::{
137        ed_on_bls12_381::{EdwardsProjective as JubJub, Fq, Fr},
138        test_rng, UniformRand,
139    };
140
141    use crate::{
142        commitment::{
143            pedersen::{constraints::CommGadget, Commitment, Randomness},
144            CommitmentGadget, CommitmentScheme,
145        },
146        crh::pedersen,
147    };
148    use r1cs_core::ConstraintSystem;
149    use r1cs_std::{ed_on_bls12_381::EdwardsVar, prelude::*};
150
151    #[test]
152    fn commitment_gadget_test() {
153        let cs = ConstraintSystem::<Fq>::new_ref();
154
155        #[derive(Clone, PartialEq, Eq, Hash)]
156        pub(super) struct Window;
157
158        impl pedersen::Window for Window {
159            const WINDOW_SIZE: usize = 4;
160            const NUM_WINDOWS: usize = 8;
161        }
162
163        let input = [1u8; 4];
164
165        let rng = &mut test_rng();
166
167        type TestCOMM = Commitment<JubJub, Window>;
168        type TestCOMMGadget = CommGadget<JubJub, EdwardsVar, Window>;
169
170        let randomness = Randomness(Fr::rand(rng));
171
172        let parameters = Commitment::<JubJub, Window>::setup(rng).unwrap();
173        let primitive_result =
174            Commitment::<JubJub, Window>::commit(&parameters, &input, &randomness).unwrap();
175
176        let mut input_var = vec![];
177        for input_byte in input.iter() {
178            input_var.push(UInt8::new_witness(cs.clone(), || Ok(*input_byte)).unwrap());
179        }
180
181        let randomness_var =
182            <TestCOMMGadget as CommitmentGadget<TestCOMM, Fq>>::RandomnessVar::new_witness(
183                cs.ns("gadget_randomness"),
184                || Ok(&randomness),
185            )
186            .unwrap();
187        let parameters_var =
188            <TestCOMMGadget as CommitmentGadget<TestCOMM, Fq>>::ParametersVar::new_witness(
189                cs.ns("gadget_parameters"),
190                || Ok(&parameters),
191            )
192            .unwrap();
193        let result_var =
194            TestCOMMGadget::commit(&parameters_var, &input_var, &randomness_var).unwrap();
195
196        let primitive_result = primitive_result;
197        assert_eq!(primitive_result, result_var.value().unwrap());
198        assert!(cs.is_satisfied().unwrap());
199    }
200}