@ -0,0 +1,123 @@ |
|||||
|
/* |
||||
|
Copyright 2018 0KIMS association. |
||||
|
|
||||
|
This file is part of circom (Zero Knowledge Circuit Compiler). |
||||
|
|
||||
|
circom is a free software: you can redistribute it and/or modify it |
||||
|
under the terms of the GNU General Public License as published by |
||||
|
the Free Software Foundation, either version 3 of the License, or |
||||
|
(at your option) any later version. |
||||
|
|
||||
|
circom is distributed in the hope that it will be useful, but WITHOUT |
||||
|
ANY WARRANTY; without even the implied warranty of MERCHANTABILITY |
||||
|
or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public |
||||
|
License for more details. |
||||
|
|
||||
|
You should have received a copy of the GNU General Public License |
||||
|
along with circom. If not, see <https://www.gnu.org/licenses/>. |
||||
|
*/ |
||||
|
|
||||
|
include "compconstant.circom"; |
||||
|
include "pointbits.circom"; |
||||
|
include "mimcsponge.circom"; |
||||
|
include "bitify.circom"; |
||||
|
include "escalarmulany.circom"; |
||||
|
include "escalarmulfix.circom"; |
||||
|
|
||||
|
template EdDSAMiMCSpongeVerifier() { |
||||
|
signal input enabled; |
||||
|
signal input Ax; |
||||
|
signal input Ay; |
||||
|
|
||||
|
signal input S; |
||||
|
signal input R8x; |
||||
|
signal input R8y; |
||||
|
|
||||
|
signal input M; |
||||
|
|
||||
|
var i; |
||||
|
|
||||
|
// Ensure S<Subgroup Order |
||||
|
|
||||
|
component snum2bits = Num2Bits(253); |
||||
|
snum2bits.in <== S; |
||||
|
|
||||
|
component compConstant = CompConstant(2736030358979909402780800718157159386076813972158567259200215660948447373040); |
||||
|
|
||||
|
for (i=0; i<253; i++) { |
||||
|
snum2bits.out[i] ==> compConstant.in[i]; |
||||
|
} |
||||
|
compConstant.in[253] <== 0; |
||||
|
compConstant.out === 0; |
||||
|
|
||||
|
// Calculate the h = H(R,A, msg) |
||||
|
|
||||
|
component hash = MiMCSponge(5, 220, 1); |
||||
|
hash.ins[0] <== R8x; |
||||
|
hash.ins[1] <== R8y; |
||||
|
hash.ins[2] <== Ax; |
||||
|
hash.ins[3] <== Ay; |
||||
|
hash.ins[4] <== M; |
||||
|
hash.k <== 0; |
||||
|
|
||||
|
component h2bits = Num2Bits_strict(); |
||||
|
h2bits.in <== hash.outs[0]; |
||||
|
|
||||
|
// Calculate second part of the right side: right2 = h*8*A |
||||
|
|
||||
|
// Multiply by 8 by adding it 3 times. This also ensure that the result is in |
||||
|
// the subgroup. |
||||
|
component dbl1 = BabyDbl(); |
||||
|
dbl1.x <== Ax; |
||||
|
dbl1.y <== Ay; |
||||
|
component dbl2 = BabyDbl(); |
||||
|
dbl2.x <== dbl1.xout; |
||||
|
dbl2.y <== dbl1.yout; |
||||
|
component dbl3 = BabyDbl(); |
||||
|
dbl3.x <== dbl2.xout; |
||||
|
dbl3.y <== dbl2.yout; |
||||
|
|
||||
|
// We check that A is not zero. |
||||
|
component isZero = IsZero(); |
||||
|
isZero.in <== dbl3.x; |
||||
|
isZero.out === 0; |
||||
|
|
||||
|
component mulAny = EscalarMulAny(254); |
||||
|
for (i=0; i<254; i++) { |
||||
|
mulAny.e[i] <== h2bits.out[i]; |
||||
|
} |
||||
|
mulAny.p[0] <== dbl3.xout; |
||||
|
mulAny.p[1] <== dbl3.yout; |
||||
|
|
||||
|
|
||||
|
// Compute the right side: right = R8 + right2 |
||||
|
|
||||
|
component addRight = BabyAdd(); |
||||
|
addRight.x1 <== R8x; |
||||
|
addRight.y1 <== R8y; |
||||
|
addRight.x2 <== mulAny.out[0]; |
||||
|
addRight.y2 <== mulAny.out[1]; |
||||
|
|
||||
|
// Calculate left side of equation left = S*B8 |
||||
|
|
||||
|
var BASE8 = [ |
||||
|
17777552123799933955779906779655732241715742912184938656739573121738514868268, |
||||
|
2626589144620713026669568689430873010625803728049924121243784502389097019475 |
||||
|
]; |
||||
|
component mulFix = EscalarMulFix(253, BASE8); |
||||
|
for (i=0; i<253; i++) { |
||||
|
mulFix.e[i] <== snum2bits.out[i]; |
||||
|
} |
||||
|
|
||||
|
// Do the comparation left == right if enabled; |
||||
|
|
||||
|
component eqCheckX = ForceEqualIfEnabled(); |
||||
|
eqCheckX.enabled <== enabled; |
||||
|
eqCheckX.in[0] <== mulFix.out[0]; |
||||
|
eqCheckX.in[1] <== addRight.xout; |
||||
|
|
||||
|
component eqCheckY = ForceEqualIfEnabled(); |
||||
|
eqCheckY.enabled <== enabled; |
||||
|
eqCheckY.in[0] <== mulFix.out[1]; |
||||
|
eqCheckY.in[1] <== addRight.yout; |
||||
|
} |
@ -1,4 +1,5 @@ |
|||||
exports.smt = require("./src/smt"); |
exports.smt = require("./src/smt"); |
||||
exports.eddsa = require("./src/eddsa"); |
exports.eddsa = require("./src/eddsa"); |
||||
exports.mimc7 = require("./src/mimc7"); |
exports.mimc7 = require("./src/mimc7"); |
||||
|
exports.mimcsponge = require("./src/mimcsponge"); |
||||
exports.babyJub = require("./src/babyjub"); |
exports.babyJub = require("./src/babyjub"); |