1use crate::{
  2    commitment::pedersen::{Commitment, Parameters, Randomness},
  3    crh::pedersen::Window,
  4    Vec,
  5};
  6use algebra_core::{
  7    fields::{Field, PrimeField},
  8    to_bytes, ProjectiveCurve, Zero,
  9};
 10use r1cs_core::{Namespace, SynthesisError};
 11
 12use core::{borrow::Borrow, marker::PhantomData};
 13use r1cs_std::prelude::*;
 14
 15type ConstraintF<C> = <<C as ProjectiveCurve>::BaseField as Field>::BasePrimeField;
 16
 17#[derive(Derivative)]
 18#[derivative(Clone(bound = "C: ProjectiveCurve, GG: CurveVar<C, ConstraintF<C>>"))]
 19pub struct ParametersVar<C: ProjectiveCurve, GG: CurveVar<C, ConstraintF<C>>>
 20where
 21    for<'a> &'a GG: GroupOpsBounds<'a, C, GG>,
 22{
 23    params: Parameters<C>,
 24    #[doc(hidden)]
 25    _group_var: PhantomData<GG>,
 26}
 27
 28#[derive(Clone, Debug)]
 29pub struct RandomnessVar<F: Field>(Vec<UInt8<F>>);
 30
 31pub struct CommGadget<C: ProjectiveCurve, GG: CurveVar<C, ConstraintF<C>>, W: Window>
 32where
 33    for<'a> &'a GG: GroupOpsBounds<'a, C, GG>,
 34{
 35    #[doc(hidden)]
 36    _curve: PhantomData<*const C>,
 37    #[doc(hidden)]
 38    _group_var: PhantomData<*const GG>,
 39    #[doc(hidden)]
 40    _window: PhantomData<*const W>,
 41}
 42
 43impl<C, GG, W> crate::commitment::CommitmentGadget<Commitment<C, W>, ConstraintF<C>>
 44    for CommGadget<C, GG, W>
 45where
 46    C: ProjectiveCurve,
 47    GG: CurveVar<C, ConstraintF<C>>,
 48    W: Window,
 49    for<'a> &'a GG: GroupOpsBounds<'a, C, GG>,
 50    ConstraintF<C>: PrimeField,
 51{
 52    type OutputVar = GG;
 53    type ParametersVar = ParametersVar<C, GG>;
 54    type RandomnessVar = RandomnessVar<ConstraintF<C>>;
 55
 56    fn commit(
 57        parameters: &Self::ParametersVar,
 58        input: &[UInt8<ConstraintF<C>>],
 59        r: &Self::RandomnessVar,
 60    ) -> Result<Self::OutputVar, SynthesisError> {
 61        assert!((input.len() * 8) <= (W::WINDOW_SIZE * W::NUM_WINDOWS));
 62
 63        let mut padded_input = input.to_vec();
 64        // Pad if input length is less than `W::WINDOW_SIZE * W::NUM_WINDOWS`.
 65        if (input.len() * 8) < W::WINDOW_SIZE * W::NUM_WINDOWS {
 66            let current_length = input.len();
 67            for _ in current_length..((W::WINDOW_SIZE * W::NUM_WINDOWS) / 8) {
 68                padded_input.push(UInt8::constant(0u8));
 69            }
 70        }
 71
 72        assert_eq!(padded_input.len() * 8, W::WINDOW_SIZE * W::NUM_WINDOWS);
 73        assert_eq!(parameters.params.generators.len(), W::NUM_WINDOWS);
 74
 75        // Allocate new variable for commitment output.
 76        let input_in_bits: Vec<Boolean<_>> = padded_input
 77            .iter()
 78            .flat_map(|byte| byte.to_bits_le().unwrap())
 79            .collect();
 80        let input_in_bits = input_in_bits.chunks(W::WINDOW_SIZE);
 81        let mut result =
 82            GG::precomputed_base_multiscalar_mul_le(&parameters.params.generators, input_in_bits)?;
 83
 84        // Compute h^r
 85        let rand_bits: Vec<_> =
 86            r.0.iter()
 87                .flat_map(|byte| byte.to_bits_le().unwrap())
 88                .collect();
 89        result.precomputed_base_scalar_mul_le(
 90            rand_bits
 91                .iter()
 92                .zip(&parameters.params.randomness_generator),
 93        )?;
 94
 95        Ok(result)
 96    }
 97}
 98
 99impl<C, GG> AllocVar<Parameters<C>, ConstraintF<C>> for ParametersVar<C, GG>
100where
101    C: ProjectiveCurve,
102    GG: CurveVar<C, ConstraintF<C>>,
103    for<'a> &'a GG: GroupOpsBounds<'a, C, GG>,
104{
105    fn new_variable<T: Borrow<Parameters<C>>>(
106        _cs: impl Into<Namespace<ConstraintF<C>>>,
107        f: impl FnOnce() -> Result<T, SynthesisError>,
108        _mode: AllocationMode,
109    ) -> Result<Self, SynthesisError> {
110        let params = f()?.borrow().clone();
111        Ok(ParametersVar {
112            params,
113            _group_var: PhantomData,
114        })
115    }
116}
117
118impl<C, F> AllocVar<Randomness<C>, F> for RandomnessVar<F>
119where
120    C: ProjectiveCurve,
121    F: PrimeField,
122{
123    fn new_variable<T: Borrow<Randomness<C>>>(
124        cs: impl Into<Namespace<F>>,
125        f: impl FnOnce() -> Result<T, SynthesisError>,
126        mode: AllocationMode,
127    ) -> Result<Self, SynthesisError> {
128        let r = to_bytes![&f().map(|b| b.borrow().0).unwrap_or(C::ScalarField::zero())].unwrap();
129        match mode {
130            AllocationMode::Constant => Ok(Self(UInt8::constant_vec(&r))),
131            AllocationMode::Input => UInt8::new_input_vec(cs, &r).map(Self),
132            AllocationMode::Witness => UInt8::new_witness_vec(cs, &r).map(Self),
133        }
134    }
135}
136
137#[cfg(test)]
138mod test {
139    use algebra::{
140        ed_on_bls12_381::{EdwardsProjective as JubJub, Fq, Fr},
141        test_rng, UniformRand,
142    };
143
144    use crate::{
145        commitment::{
146            pedersen::{constraints::CommGadget, Commitment, Randomness},
147            CommitmentGadget, CommitmentScheme,
148        },
149        crh::pedersen,
150    };
151    use r1cs_core::ConstraintSystem;
152    use r1cs_std::{ed_on_bls12_381::EdwardsVar, prelude::*};
153
154    #[test]
155    fn commitment_gadget_test() {
156        let cs = ConstraintSystem::<Fq>::new_ref();
157
158        #[derive(Clone, PartialEq, Eq, Hash)]
159        pub(super) struct Window;
160
161        impl pedersen::Window for Window {
162            const WINDOW_SIZE: usize = 4;
163            const NUM_WINDOWS: usize = 8;
164        }
165
166        let input = [1u8; 4];
167
168        let rng = &mut test_rng();
169
170        type TestCOMM = Commitment<JubJub, Window>;
171        type TestCOMMGadget = CommGadget<JubJub, EdwardsVar, Window>;
172
173        let randomness = Randomness(Fr::rand(rng));
174
175        let parameters = Commitment::<JubJub, Window>::setup(rng).unwrap();
176        let primitive_result =
177            Commitment::<JubJub, Window>::commit(&parameters, &input, &randomness).unwrap();
178
179        let mut input_var = vec![];
180        for input_byte in input.iter() {
181            input_var.push(UInt8::new_witness(cs.clone(), || Ok(*input_byte)).unwrap());
182        }
183
184        let randomness_var =
185            <TestCOMMGadget as CommitmentGadget<TestCOMM, Fq>>::RandomnessVar::new_witness(
186                cs.ns("gadget_randomness"),
187                || Ok(&randomness),
188            )
189            .unwrap();
190        let parameters_var =
191            <TestCOMMGadget as CommitmentGadget<TestCOMM, Fq>>::ParametersVar::new_witness(
192                cs.ns("gadget_parameters"),
193                || Ok(&parameters),
194            )
195            .unwrap();
196        let result_var =
197            TestCOMMGadget::commit(&parameters_var, &input_var, &randomness_var).unwrap();
198
199        let primitive_result = primitive_result;
200        assert_eq!(primitive_result, result_var.value().unwrap());
201        assert!(cs.is_satisfied().unwrap());
202    }
203}