ark-r1cs-std/crypto-primitives/src/prf/blake2s/constraints.rs
crypto-primitives/src/prf/blake2s/constraints.rsRaw
1use algebra_core::PrimeField;
2use r1cs_core::{ConstraintSystem, SynthesisError};
3
4use crate::prf::PRFGadget;
5use r1cs_std::prelude::*;
6
7use core::borrow::Borrow;
8
9// 2.1. Parameters
10// The following table summarizes various parameters and their ranges:
11// | BLAKE2b | BLAKE2s |
12// --------------+------------------+------------------+
13// Bits in word | w = 64 | w = 32 |
14// Rounds in F | r = 12 | r = 10 |
15// Block bytes | bb = 128 | bb = 64 |
16// Hash bytes | 1 <= nn <= 64 | 1 <= nn <= 32 |
17// Key bytes | 0 <= kk <= 64 | 0 <= kk <= 32 |
18// Input bytes | 0 <= ll < 2**128 | 0 <= ll < 2**64 |
19// --------------+------------------+------------------+
20// G Rotation | (R1, R2, R3, R4) | (R1, R2, R3, R4) |
21// constants = | (32, 24, 16, 63) | (16, 12, 8, 7) |
22// --------------+------------------+------------------+
23//
24
25const R1: usize = 16;
26const R2: usize = 12;
27const R3: usize = 8;
28const R4: usize = 7;
29
30// Round | 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 |
31// ----------+-------------------------------------------------+
32// SIGMA[0] | 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 |
33// SIGMA[1] | 14 10 4 8 9 15 13 6 1 12 0 2 11 7 5 3 |
34// SIGMA[2] | 11 8 12 0 5 2 15 13 10 14 3 6 7 1 9 4 |
35// SIGMA[3] | 7 9 3 1 13 12 11 14 2 6 5 10 4 0 15 8 |
36// SIGMA[4] | 9 0 5 7 2 4 10 15 14 1 11 12 6 8 3 13 |
37// SIGMA[5] | 2 12 6 10 0 11 8 3 4 13 7 5 15 14 1 9 |
38// SIGMA[6] | 12 5 1 15 14 13 4 10 0 7 6 3 9 2 8 11 |
39// SIGMA[7] | 13 11 7 14 12 1 3 9 5 0 15 4 8 6 2 10 |
40// SIGMA[8] | 6 15 14 9 11 3 0 8 12 2 13 7 1 4 10 5 |
41// SIGMA[9] | 10 2 8 4 7 6 1 5 15 11 9 14 3 12 13 0 |
42// ----------+-------------------------------------------------+
43//
44
45const SIGMA: [[usize; 16]; 10] = [
46 [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15],
47 [14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3],
48 [11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4],
49 [7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8],
50 [9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13],
51 [2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9],
52 [12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11],
53 [13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10],
54 [6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5],
55 [10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13, 0],
56];
57
58// 3.1. Mixing Function G
59// The G primitive function mixes two input words, "x" and "y", into
60// four words indexed by "a", "b", "c", and "d" in the working vector
61// v[0..15]. The full modified vector is returned. The rotation
62// constants (R1, R2, R3, R4) are given in Section 2.1.
63// FUNCTION G( v[0..15], a, b, c, d, x, y )
64// |
65// | v[a] := (v[a] + v[b] + x) mod 2**w
66// | v[d] := (v[d] ^ v[a]) >>> R1
67// | v[c] := (v[c] + v[d]) mod 2**w
68// | v[b] := (v[b] ^ v[c]) >>> R2
69// | v[a] := (v[a] + v[b] + y) mod 2**w
70// | v[d] := (v[d] ^ v[a]) >>> R3
71// | v[c] := (v[c] + v[d]) mod 2**w
72// | v[b] := (v[b] ^ v[c]) >>> R4
73// |
74// | RETURN v[0..15]
75// |
76// END FUNCTION.
77//
78
79fn mixing_g<ConstraintF: PrimeField, CS: ConstraintSystem<ConstraintF>>(
80 mut cs: CS,
81 v: &mut [UInt32],
82 a: usize,
83 b: usize,
84 c: usize,
85 d: usize,
86 x: &UInt32,
87 y: &UInt32,
88) -> Result<(), SynthesisError> {
89 v[a] = UInt32::addmany(
90 cs.ns(|| "mixing step 1"),
91 &[v[a].clone(), v[b].clone(), x.clone()],
92 )?;
93 v[d] = v[d].xor(cs.ns(|| "mixing step 2"), &v[a])?.rotr(R1);
94 v[c] = UInt32::addmany(cs.ns(|| "mixing step 3"), &[v[c].clone(), v[d].clone()])?;
95 v[b] = v[b].xor(cs.ns(|| "mixing step 4"), &v[c])?.rotr(R2);
96 v[a] = UInt32::addmany(
97 cs.ns(|| "mixing step 5"),
98 &[v[a].clone(), v[b].clone(), y.clone()],
99 )?;
100 v[d] = v[d].xor(cs.ns(|| "mixing step 6"), &v[a])?.rotr(R3);
101 v[c] = UInt32::addmany(cs.ns(|| "mixing step 7"), &[v[c].clone(), v[d].clone()])?;
102 v[b] = v[b].xor(cs.ns(|| "mixing step 8"), &v[c])?.rotr(R4);
103
104 Ok(())
105}
106
107// 3.2. Compression Function F
108// Compression function F takes as an argument the state vector "h",
109// message block vector "m" (last block is padded with zeros to full
110// block size, if required), 2w-bit_gadget offset counter "t", and final block
111// indicator flag "f". Local vector v[0..15] is used in processing. F
112// returns a new state vector. The number of rounds, "r", is 12 for
113// BLAKE2b and 10 for BLAKE2s. Rounds are numbered from 0 to r - 1.
114// FUNCTION F( h[0..7], m[0..15], t, f )
115// |
116// | // Initialize local work vector v[0..15]
117// | v[0..7] := h[0..7] // First half from state.
118// | v[8..15] := IV[0..7] // Second half from IV.
119// |
120// | v[12] := v[12] ^ (t mod 2**w) // Low word of the offset.
121// | v[13] := v[13] ^ (t >> w) // High word.
122// |
123// | IF f = TRUE THEN // last block flag?
124// | | v[14] := v[14] ^ 0xFF..FF // Invert all bits.
125// | END IF.
126// |
127// | // Cryptographic mixing
128// | FOR i = 0 TO r - 1 DO // Ten or twelve rounds.
129// | |
130// | | // Message word selection permutation for this round.
131// | | s[0..15] := SIGMA[i mod 10][0..15]
132// | |
133// | | v := G( v, 0, 4, 8, 12, m[s[ 0]], m[s[ 1]] )
134// | | v := G( v, 1, 5, 9, 13, m[s[ 2]], m[s[ 3]] )
135// | | v := G( v, 2, 6, 10, 14, m[s[ 4]], m[s[ 5]] )
136// | | v := G( v, 3, 7, 11, 15, m[s[ 6]], m[s[ 7]] )
137// | |
138// | | v := G( v, 0, 5, 10, 15, m[s[ 8]], m[s[ 9]] )
139// | | v := G( v, 1, 6, 11, 12, m[s[10]], m[s[11]] )
140// | | v := G( v, 2, 7, 8, 13, m[s[12]], m[s[13]] )
141// | | v := G( v, 3, 4, 9, 14, m[s[14]], m[s[15]] )
142// | |
143// | END FOR
144// |
145// | FOR i = 0 TO 7 DO // XOR the two halves.
146// | | h[i] := h[i] ^ v[i] ^ v[i + 8]
147// | END FOR.
148// |
149// | RETURN h[0..7] // New state.
150// |
151// END FUNCTION.
152//
153
154fn blake2s_compression<ConstraintF: PrimeField, CS: ConstraintSystem<ConstraintF>>(
155 mut cs: CS,
156 h: &mut [UInt32],
157 m: &[UInt32],
158 t: u64,
159 f: bool,
160) -> Result<(), SynthesisError> {
161 assert_eq!(h.len(), 8);
162 assert_eq!(m.len(), 16);
163
164 // static const uint32_t blake2s_iv[8] =
165 // {
166 // 0x6A09E667, 0xBB67AE85, 0x3C6EF372, 0xA54FF53A,
167 // 0x510E527F, 0x9B05688C, 0x1F83D9AB, 0x5BE0CD19
168 // };
169 //
170
171 let mut v = Vec::with_capacity(16);
172 v.extend_from_slice(h);
173 v.push(UInt32::constant(0x6A09E667));
174 v.push(UInt32::constant(0xBB67AE85));
175 v.push(UInt32::constant(0x3C6EF372));
176 v.push(UInt32::constant(0xA54FF53A));
177 v.push(UInt32::constant(0x510E527F));
178 v.push(UInt32::constant(0x9B05688C));
179 v.push(UInt32::constant(0x1F83D9AB));
180 v.push(UInt32::constant(0x5BE0CD19));
181
182 assert_eq!(v.len(), 16);
183
184 v[12] = v[12].xor(cs.ns(|| "first xor"), &UInt32::constant(t as u32))?;
185 v[13] = v[13].xor(cs.ns(|| "second xor"), &UInt32::constant((t >> 32) as u32))?;
186
187 if f {
188 v[14] = v[14].xor(cs.ns(|| "third xor"), &UInt32::constant(u32::max_value()))?;
189 }
190
191 for i in 0..10 {
192 let mut cs = cs.ns(|| format!("round {}", i));
193
194 let s = SIGMA[i % 10];
195
196 mixing_g(
197 cs.ns(|| "mixing invocation 1"),
198 &mut v,
199 0,
200 4,
201 8,
202 12,
203 &m[s[0]],
204 &m[s[1]],
205 )?;
206 mixing_g(
207 cs.ns(|| "mixing invocation 2"),
208 &mut v,
209 1,
210 5,
211 9,
212 13,
213 &m[s[2]],
214 &m[s[3]],
215 )?;
216 mixing_g(
217 cs.ns(|| "mixing invocation 3"),
218 &mut v,
219 2,
220 6,
221 10,
222 14,
223 &m[s[4]],
224 &m[s[5]],
225 )?;
226 mixing_g(
227 cs.ns(|| "mixing invocation 4"),
228 &mut v,
229 3,
230 7,
231 11,
232 15,
233 &m[s[6]],
234 &m[s[7]],
235 )?;
236
237 mixing_g(
238 cs.ns(|| "mixing invocation 5"),
239 &mut v,
240 0,
241 5,
242 10,
243 15,
244 &m[s[8]],
245 &m[s[9]],
246 )?;
247 mixing_g(
248 cs.ns(|| "mixing invocation 6"),
249 &mut v,
250 1,
251 6,
252 11,
253 12,
254 &m[s[10]],
255 &m[s[11]],
256 )?;
257 mixing_g(
258 cs.ns(|| "mixing invocation 7"),
259 &mut v,
260 2,
261 7,
262 8,
263 13,
264 &m[s[12]],
265 &m[s[13]],
266 )?;
267 mixing_g(
268 cs.ns(|| "mixing invocation 8"),
269 &mut v,
270 3,
271 4,
272 9,
273 14,
274 &m[s[14]],
275 &m[s[15]],
276 )?;
277 }
278
279 for i in 0..8 {
280 let mut cs = cs.ns(|| format!("h[{i}] ^ v[{i}] ^ v[{i} + 8]", i = i));
281
282 h[i] = h[i].xor(cs.ns(|| "first xor"), &v[i])?;
283 h[i] = h[i].xor(cs.ns(|| "second xor"), &v[i + 8])?;
284 }
285
286 Ok(())
287}
288
289// FUNCTION BLAKE2( d[0..dd-1], ll, kk, nn )
290// |
291// | h[0..7] := IV[0..7] // Initialization Vector.
292// |
293// | // Parameter block p[0]
294// | h[0] := h[0] ^ 0x01010000 ^ (kk << 8) ^ nn
295// |
296// | // Process padded key and data blocks
297// | IF dd > 1 THEN
298// | | FOR i = 0 TO dd - 2 DO
299// | | | h := F( h, d[i], (i + 1) * bb, FALSE )
300// | | END FOR.
301// | END IF.
302// |
303// | // Final block.
304// | IF kk = 0 THEN
305// | | h := F( h, d[dd - 1], ll, TRUE )
306// | ELSE
307// | | h := F( h, d[dd - 1], ll + bb, TRUE )
308// | END IF.
309// |
310// | RETURN first "nn" bytes from little-endian word array h[].
311// |
312// END FUNCTION.
313//
314
315pub fn blake2s_gadget<ConstraintF: PrimeField, CS: ConstraintSystem<ConstraintF>>(
316 cs: CS,
317 input: &[Boolean],
318) -> Result<Vec<UInt32>, SynthesisError> {
319 assert!(input.len() % 8 == 0);
320 let mut parameters = [0; 8];
321 parameters[0] = 0x01010000 ^ 32;
322 blake2s_gadget_with_parameters(cs, input, ¶meters)
323}
324
325pub fn blake2s_gadget_with_parameters<
326 ConstraintF: PrimeField,
327 CS: ConstraintSystem<ConstraintF>,
328>(
329 mut cs: CS,
330 input: &[Boolean],
331 parameters: &[u32; 8],
332) -> Result<Vec<UInt32>, SynthesisError> {
333 assert!(input.len() % 8 == 0);
334
335 let mut h = Vec::with_capacity(8);
336 h.push(
337 UInt32::constant(0x6A09E667).xor(cs.ns(|| "xor h[0]"), &UInt32::constant(parameters[0]))?,
338 );
339 h.push(
340 UInt32::constant(0xBB67AE85).xor(cs.ns(|| "xor h[1]"), &UInt32::constant(parameters[1]))?,
341 );
342 h.push(
343 UInt32::constant(0x3C6EF372).xor(cs.ns(|| "xor h[2]"), &UInt32::constant(parameters[2]))?,
344 );
345 h.push(
346 UInt32::constant(0xA54FF53A).xor(cs.ns(|| "xor h[3]"), &UInt32::constant(parameters[3]))?,
347 );
348 h.push(
349 UInt32::constant(0x510E527F).xor(cs.ns(|| "xor h[4]"), &UInt32::constant(parameters[4]))?,
350 );
351 h.push(
352 UInt32::constant(0x9B05688C).xor(cs.ns(|| "xor h[5]"), &UInt32::constant(parameters[5]))?,
353 );
354 h.push(
355 UInt32::constant(0x1F83D9AB).xor(cs.ns(|| "xor h[6]"), &UInt32::constant(parameters[6]))?,
356 );
357 h.push(
358 UInt32::constant(0x5BE0CD19).xor(cs.ns(|| "xor h[7]"), &UInt32::constant(parameters[7]))?,
359 );
360
361 let mut blocks: Vec<Vec<UInt32>> = vec![];
362
363 for block in input.chunks(512) {
364 let mut this_block = Vec::with_capacity(16);
365 for word in block.chunks(32) {
366 let mut tmp = word.to_vec();
367 while tmp.len() < 32 {
368 tmp.push(Boolean::constant(false));
369 }
370 this_block.push(UInt32::from_bits_le(&tmp));
371 }
372 while this_block.len() < 16 {
373 this_block.push(UInt32::constant(0));
374 }
375 blocks.push(this_block);
376 }
377
378 if blocks.is_empty() {
379 blocks.push((0..16).map(|_| UInt32::constant(0)).collect());
380 }
381
382 for (i, block) in blocks[0..blocks.len() - 1].iter().enumerate() {
383 let cs = cs.ns(|| format!("block {}", i));
384
385 blake2s_compression(cs, &mut h, block, ((i as u64) + 1) * 64, false)?;
386 }
387
388 {
389 let cs = cs.ns(|| "final block");
390
391 blake2s_compression(
392 cs,
393 &mut h,
394 &blocks[blocks.len() - 1],
395 (input.len() / 8) as u64,
396 true,
397 )?;
398 }
399
400 Ok(h)
401}
402
403use crate::prf::Blake2s;
404
405pub struct Blake2sGadget;
406#[derive(Clone, Debug)]
407pub struct Blake2sOutputGadget(pub Vec<UInt8>);
408
409impl PartialEq for Blake2sOutputGadget {
410 fn eq(&self, other: &Self) -> bool {
411 self.0 == other.0
412 }
413}
414
415impl Eq for Blake2sOutputGadget {}
416
417impl<ConstraintF: PrimeField> EqGadget<ConstraintF> for Blake2sOutputGadget {}
418
419impl<ConstraintF: PrimeField> ConditionalEqGadget<ConstraintF> for Blake2sOutputGadget {
420 #[inline]
421 fn conditional_enforce_equal<CS: ConstraintSystem<ConstraintF>>(
422 &self,
423 mut cs: CS,
424 other: &Self,
425 condition: &Boolean,
426 ) -> Result<(), SynthesisError> {
427 for (i, (a, b)) in self.0.iter().zip(other.0.iter()).enumerate() {
428 a.conditional_enforce_equal(
429 &mut cs.ns(|| format!("blake2s_equal_{}", i)),
430 b,
431 condition,
432 )?;
433 }
434 Ok(())
435 }
436
437 fn cost() -> usize {
438 32 * <UInt8 as ConditionalEqGadget<ConstraintF>>::cost()
439 }
440}
441
442impl<ConstraintF: PrimeField> ToBytesGadget<ConstraintF> for Blake2sOutputGadget {
443 #[inline]
444 fn to_bytes<CS: ConstraintSystem<ConstraintF>>(
445 &self,
446 _cs: CS,
447 ) -> Result<Vec<UInt8>, SynthesisError> {
448 Ok(self.0.clone())
449 }
450
451 #[inline]
452 fn to_bytes_strict<CS: ConstraintSystem<ConstraintF>>(
453 &self,
454 cs: CS,
455 ) -> Result<Vec<UInt8>, SynthesisError> {
456 self.to_bytes(cs)
457 }
458}
459
460impl<ConstraintF: PrimeField> AllocGadget<[u8; 32], ConstraintF> for Blake2sOutputGadget {
461 #[inline]
462 fn alloc<F, T, CS: ConstraintSystem<ConstraintF>>(
463 cs: CS,
464 value_gen: F,
465 ) -> Result<Self, SynthesisError>
466 where
467 F: FnOnce() -> Result<T, SynthesisError>,
468 T: Borrow<[u8; 32]>,
469 {
470 let zeros = [0u8; 32];
471 let value = match value_gen() {
472 Ok(val) => *(val.borrow()),
473 Err(_) => zeros,
474 };
475 let bytes = <UInt8>::alloc_vec(cs, &value)?;
476
477 Ok(Blake2sOutputGadget(bytes))
478 }
479
480 #[inline]
481 fn alloc_input<F, T, CS: ConstraintSystem<ConstraintF>>(
482 cs: CS,
483 value_gen: F,
484 ) -> Result<Self, SynthesisError>
485 where
486 F: FnOnce() -> Result<T, SynthesisError>,
487 T: Borrow<[u8; 32]>,
488 {
489 let zeros = [0u8; 32];
490 let value = match value_gen() {
491 Ok(val) => *(val.borrow()),
492 Err(_) => zeros,
493 };
494 let bytes = <UInt8>::alloc_input_vec(cs, &value)?;
495
496 Ok(Blake2sOutputGadget(bytes))
497 }
498}
499
500impl<ConstraintF: PrimeField> PRFGadget<Blake2s, ConstraintF> for Blake2sGadget {
501 type OutputGadget = Blake2sOutputGadget;
502
503 fn new_seed<CS: ConstraintSystem<ConstraintF>>(mut cs: CS, seed: &[u8; 32]) -> Vec<UInt8> {
504 UInt8::alloc_vec(&mut cs.ns(|| "alloc_seed"), seed).unwrap()
505 }
506
507 fn check_evaluation_gadget<CS: ConstraintSystem<ConstraintF>>(
508 mut cs: CS,
509 seed: &[UInt8],
510 input: &[UInt8],
511 ) -> Result<Self::OutputGadget, SynthesisError> {
512 assert_eq!(seed.len(), 32);
513 // assert_eq!(input.len(), 32);
514 let mut gadget_input = Vec::with_capacity(512);
515 for byte in seed.iter().chain(input) {
516 gadget_input.extend_from_slice(&byte.into_bits_le());
517 }
518 let mut result = Vec::new();
519 for (i, int) in blake2s_gadget(cs.ns(|| "Blake2s Eval"), &gadget_input)?
520 .into_iter()
521 .enumerate()
522 {
523 let chunk = int.to_bytes(&mut cs.ns(|| format!("Result ToBytes {}", i)))?;
524 result.extend_from_slice(&chunk);
525 }
526 Ok(Blake2sOutputGadget(result))
527 }
528}
529
530#[cfg(test)]
531mod test {
532 use algebra::jubjub::Fq as Fr;
533 use rand::{Rng, SeedableRng};
534 use rand_xorshift::XorShiftRng;
535
536 use crate::prf::blake2s::{constraints::blake2s_gadget, Blake2s as B2SPRF};
537 use blake2::VarBlake2s;
538 use r1cs_core::ConstraintSystem;
539
540 use super::Blake2sGadget;
541 use r1cs_std::{
542 boolean::AllocatedBit, prelude::*, test_constraint_system::TestConstraintSystem,
543 };
544
545 #[test]
546 fn test_blake2s_constraints() {
547 let mut cs = TestConstraintSystem::<Fr>::new();
548 let input_bits: Vec<_> = (0..512)
549 .map(|i| {
550 AllocatedBit::alloc(cs.ns(|| format!("input bit_gadget {}", i)), || Ok(true))
551 .unwrap()
552 .into()
553 })
554 .collect();
555 blake2s_gadget(&mut cs, &input_bits).unwrap();
556 assert!(cs.is_satisfied());
557 assert_eq!(cs.num_constraints(), 21792);
558 }
559
560 #[test]
561 fn test_blake2s_prf() {
562 use crate::prf::{PRFGadget, PRF};
563 use rand::Rng;
564
565 let mut rng = XorShiftRng::seed_from_u64(1231275789u64);
566 let mut cs = TestConstraintSystem::<Fr>::new();
567
568 let mut seed = [0u8; 32];
569 rng.fill(&mut seed);
570
571 let mut input = [0u8; 32];
572 rng.fill(&mut input);
573
574 let seed_gadget = Blake2sGadget::new_seed(&mut cs.ns(|| "declare_seed"), &seed);
575 let input_gadget = UInt8::alloc_vec(&mut cs.ns(|| "declare_input"), &input).unwrap();
576 let out = B2SPRF::evaluate(&seed, &input).unwrap();
577 let actual_out_gadget = <Blake2sGadget as PRFGadget<_, Fr>>::OutputGadget::alloc(
578 &mut cs.ns(|| "declare_output"),
579 || Ok(out),
580 )
581 .unwrap();
582
583 let output_gadget = Blake2sGadget::check_evaluation_gadget(
584 &mut cs.ns(|| "eval_blake2s"),
585 &seed_gadget,
586 &input_gadget,
587 )
588 .unwrap();
589 output_gadget
590 .enforce_equal(&mut cs, &actual_out_gadget)
591 .unwrap();
592
593 if !cs.is_satisfied() {
594 println!(
595 "which is unsatisfied: {:?}",
596 cs.which_is_unsatisfied().unwrap()
597 );
598 }
599 assert!(cs.is_satisfied());
600 }
601
602 #[test]
603 fn test_blake2s_precomp_constraints() {
604 // Test that 512 fixed leading bits (constants)
605 // doesn't result in more constraints.
606
607 let mut cs = TestConstraintSystem::<Fr>::new();
608 let mut rng = XorShiftRng::seed_from_u64(1231275789u64);
609 let input_bits: Vec<_> = (0..512)
610 .map(|_| Boolean::constant(rng.gen()))
611 .chain((0..512).map(|i| {
612 AllocatedBit::alloc(cs.ns(|| format!("input bit_gadget {}", i)), || Ok(true))
613 .unwrap()
614 .into()
615 }))
616 .collect();
617 blake2s_gadget(&mut cs, &input_bits).unwrap();
618 assert!(cs.is_satisfied());
619 assert_eq!(cs.num_constraints(), 21792);
620 }
621
622 #[test]
623 fn test_blake2s_constant_constraints() {
624 let mut cs = TestConstraintSystem::<Fr>::new();
625 let mut rng = XorShiftRng::seed_from_u64(1231275789u64);
626 let input_bits: Vec<_> = (0..512).map(|_| Boolean::constant(rng.gen())).collect();
627 blake2s_gadget(&mut cs, &input_bits).unwrap();
628 assert_eq!(cs.num_constraints(), 0);
629 }
630
631 #[test]
632 fn test_blake2s() {
633 let mut rng = XorShiftRng::seed_from_u64(1231275789u64);
634
635 for input_len in (0..32).chain((32..256).filter(|a| a % 8 == 0)) {
636 use digest::*;
637 let mut h = VarBlake2s::new_keyed(&[], 32);
638
639 let data: Vec<u8> = (0..input_len).map(|_| rng.gen()).collect();
640
641 h.input(&data);
642
643 let mut hash_result = Vec::with_capacity(h.output_size());
644 h.variable_result(|res| hash_result.extend_from_slice(res));
645
646 let mut cs = TestConstraintSystem::<Fr>::new();
647
648 let mut input_bits = vec![];
649
650 for (byte_i, input_byte) in data.into_iter().enumerate() {
651 for bit_i in 0..8 {
652 let cs = cs.ns(|| format!("input bit_gadget {} {}", byte_i, bit_i));
653
654 input_bits.push(
655 AllocatedBit::alloc(cs, || Ok((input_byte >> bit_i) & 1u8 == 1u8))
656 .unwrap()
657 .into(),
658 );
659 }
660 }
661
662 let r = blake2s_gadget(&mut cs, &input_bits).unwrap();
663
664 assert!(cs.is_satisfied());
665
666 let mut s = hash_result
667 .iter()
668 .flat_map(|&byte| (0..8).map(move |i| (byte >> i) & 1u8 == 1u8));
669
670 for chunk in r {
671 for b in chunk.to_bits_le() {
672 match b {
673 Boolean::Is(b) => {
674 assert!(s.next().unwrap() == b.get_value().unwrap());
675 },
676 Boolean::Not(b) => {
677 assert!(s.next().unwrap() != b.get_value().unwrap());
678 },
679 Boolean::Constant(b) => {
680 assert!(input_len == 0);
681 assert!(s.next().unwrap() == b);
682 },
683 }
684 }
685 }
686 }
687 }
688}