arnaucube
/
circom
mirror of https://github.com/arnaucube/circom.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
Browse Source

Merge branch 'master' of github.com:iden3/circom

feature/c-tester-linux
Jordi Baylina 4 years ago
parent
d79d59416d 16cf75c94b
commit
3ef303593b
No known key found for this signature in database GPG Key ID: 7480C80C1BE43112
1 changed files with 21 additions and 21 deletions
Unified View
Diff Options
Show Stats Download Patch File Download Diff File
  1. +21
    -21
      TUTORIAL.md

+ 21
- 21
TUTORIAL.md
View File

@ -105,21 +105,21 @@ Ok, let's run a setup for our circuit:
snarkjs setup snarkjs setup
``` ```
> By default `snarkjs` will look for and use `circuit.r1cs`. You can always specify a different circuit file by adding `-r <circuit R1CS file name>`
> By default `snarkjs` will look for and use `circuit.r1cs`. You can always specify a different circuit file by adding `-r <circuit R1CS file name>`.
The output of the setup will in the form of 2 files: `proving_key.json` and `verification_key.json`
The output of the setup will be in the form of 2 files: `proving_key.json` and `verification_key.json`.
### 3.3. Calculating a witness ### 3.3. Calculating a witness
Before creating any proof, we need to calculate all the signals of the circuit that match (all) the constrains of the circuit.
Before creating any proof, we need to calculate all the signals of the circuit that match (all) the constraints of the circuit.
`circom` generates a wasm module that calculates those for you. You need to provide a file with the inputs and it will execute the circuit and calculate all the intermediate signals and the output. This set of signals is the *witness*. `circom` generates a wasm module that calculates those for you. You need to provide a file with the inputs and it will execute the circuit and calculate all the intermediate signals and the output. This set of signals is the *witness*.
The zero knowledge proofs prove that you know a set of signals (witness) that match all the constraints, without revealing any of the signals except the public inputs plus the outputs.
The zero-knowledge proofs prove that you know a set of signals (witness) that match all the constraints without revealing any of the signals except the public inputs and the outputs.
For example, imagine you want to prove you are able to factor 33. It means that you know two numbers `a` and `b` and when you multiply them, it results in 33.
For example, imagine you want to prove you are able to factor the number 33. It means that you know two numbers `a` and `b` that when you multiply them, it results in 33.
> Of course you can always use one and the same number as `a` or `b`. We will deal with this problem later.
> Of course you can always use the number one and the same number as `a` or `b`. We will deal with this problem later.
So you want to prove that you know 3 and 11. So you want to prove that you know 3 and 11.
@ -147,7 +147,7 @@ snarkjs proof
This command will use the `proving_key.json` and the `witness.json` files by default to generate `proof.json` and `public.json` This command will use the `proving_key.json` and the `witness.json` files by default to generate `proof.json` and `public.json`
The `proof.json` file will contain the actual proof. And the `public.json` file will contain just the values of the public inputs and the outputs.
The `proof.json` file will contain the actual proof and the `public.json` file will contain just the values of the public inputs and the outputs.
### Verifying the proof ### Verifying the proof
@ -177,7 +177,7 @@ You can take the code in `verifier.sol` and cut and paste it in remix.
This code contains two contracts: Pairings and Verifier. You only need to deploy the `Verifier` contract. This code contains two contracts: Pairings and Verifier. You only need to deploy the `Verifier` contract.
> You may want to use a test net like Rinkeby, Kovan or Ropsten. You can also use the Javascript VM, but in some browsers, the verification takes long and it may hang the page.
> You may want to use a test net like Rinkeby, Kovan or Ropsten. You can also use the Javascript VM, but in some browsers the verification takes long and it may hang the page.
### Verifying the proof on-chain ### Verifying the proof on-chain
@ -186,7 +186,7 @@ The verifier contract deployed in the last step has a `view` function called `ve
This function will return true if the proof and the inputs are valid. This function will return true if the proof and the inputs are valid.
To facilitate the call, you can use snarkjs to generate the parameters of the call by typing:
To facilitate the call, you can use `snarkjs` to generate the parameters of the call by typing:
```sh ```sh
snarkjs generatecall snarkjs generatecall
@ -201,15 +201,15 @@ If you change any bit in the parameters, the result will be verifiably false.
## Bonus track ## Bonus track
We can fix the circuit to not accept one as any of the values by adding some extra constraints.
We can fix the circuit to not accept the number 1 as any of the input values by adding some extra constraints.
Here the trick is that we use the property that 0 has no inverse. So `(a-1)` should not have an inverse.
Here, the trick is that we use the property that 0 has no inverse. So `(a-1)` should not have an inverse.
That means that `(a-1)*inv = 1` will be inpossible to match if `a` is 1. That means that `(a-1)*inv = 1` will be inpossible to match if `a` is 1.
We just calculate inv by `1/(a-1)`
We just calculate inv by `1/(a-1)`.
So let's modify the circuit:
So, let's modify the circuit:
``` ```
template Multiplier() { template Multiplier() {
@ -231,22 +231,22 @@ template Multiplier() {
component main = Multiplier(); component main = Multiplier();
``` ```
A nice thing of the circom language is that you can split a <== into two independent actions: <-- and ===
A nice thing of the circom language is that you can split a `<==` into two independent actions: `<--` and `===`.
The <-- and --> operators assign a value to a signal without creating any constraints.
The `<--` and `-->` operators assign a value to a signal without creating any constraints.
The === operator adds a constraint without assigning any value to any signal.
The `===` operator adds a constraint without assigning any value to a signal.
The circuit also has another problem: the operation works in Zr, so we need to guarantee the multiplication does not overflow. This can be done by converting the inputs to binary and checking the ranges, but we will reserve it for future tutorials.
The circuit also has another problem: the operation works in `Z_r`, so we need to guarantee the multiplication does not overflow. This can be done by converting the inputs to binary and checking the ranges, but we will reserve it for future tutorials.
## Where to go from here:
## Where to go from here
You may want to read the [README](https://github.com/iden3/circom) to learn more features about circom.
You may want to read the [README](https://github.com/iden3/circom) to learn more features about `circom`.
You can also check a library with many basic circuits lib binarizations, comparators, eddsa, hashes, merkle trees etc [here](https://github.com/iden3/circomlib) (Work in progress). You can also check a library with many basic circuits lib binarizations, comparators, eddsa, hashes, merkle trees etc [here](https://github.com/iden3/circomlib) (Work in progress).
Or a exponentiation in the Baby Jub curve [here](https://github.com/iden3/circomlib) (Work in progress).
Or a exponentiation in the Baby Jubjub curve [here](https://github.com/iden3/circomlib) (Work in progress).
# Final note # Final note
@ -255,4 +255,4 @@ There is nothing worse for a dev than working with a buggy compiler. This is a
And please contact us for any isue you have. In general, a github issue with a small piece of code with the bug is very useful to us. And please contact us for any isue you have. In general, a github issue with a small piece of code with the bug is very useful to us.
Enjoy zero knowledge proving!
Enjoy zero-knowledge proving!

Write Preview
Loading…
Cancel
Save