From 7aafcfd5f3f48a89c1115f543f4bfba09ac2bdd3 Mon Sep 17 00:00:00 2001 From: arnaucube Date: Wed, 12 Dec 2018 14:05:59 +0100 Subject: [PATCH] bn128.NewFqR with field over R. Setup.Pk & .Vk --- README.md | 6 +- bn128/bn128.go | 9 +++ snark.go | 190 ++++++++++++++++++++++++++++++++----------------- snark_test.go | 13 ++-- 4 files changed, 140 insertions(+), 78 deletions(-) diff --git a/README.md b/README.md index e7c2e5f..374cc2b 100644 --- a/README.md +++ b/README.md @@ -8,9 +8,9 @@ zkSNARK library implementation in Go ### Usage - [![GoDoc](https://godoc.org/github.com/arnaucube/go-snark?status.svg)](https://godoc.org/github.com/arnaucube/go-snark) zkSnark - - [![GoDoc](https://godoc.org/github.com/arnaucube/go-snark/bn128?status.svg)](https://godoc.org/github.com/arnaucube/go-snark/bn128) bn128 (more details: https://github.com/arnaucube/go-snark/tree/master/bn128) - - [![GoDoc](https://godoc.org/github.com/arnaucube/go-snark/fields?status.svg)](https://godoc.org/github.com/arnaucube/go-snark/fields) Finite Fields operations - - [![GoDoc](https://godoc.org/github.com/arnaucube/go-snark/r1csqap?status.svg)](https://godoc.org/github.com/arnaucube/go-snark/r1csqap) R1CS to QAP (more details: https://github.com/arnaucube/go-snark/tree/master/r1csqap) +- [![GoDoc](https://godoc.org/github.com/arnaucube/go-snark/bn128?status.svg)](https://godoc.org/github.com/arnaucube/go-snark/bn128) bn128 (more details: https://github.com/arnaucube/go-snark/tree/master/bn128) +- [![GoDoc](https://godoc.org/github.com/arnaucube/go-snark/fields?status.svg)](https://godoc.org/github.com/arnaucube/go-snark/fields) Finite Fields operations +- [![GoDoc](https://godoc.org/github.com/arnaucube/go-snark/r1csqap?status.svg)](https://godoc.org/github.com/arnaucube/go-snark/r1csqap) R1CS to QAP (more details: https://github.com/arnaucube/go-snark/tree/master/r1csqap) Example: ```go diff --git a/bn128/bn128.go b/bn128/bn128.go index 7c45da1..921bde8 100644 --- a/bn128/bn128.go +++ b/bn128/bn128.go @@ -105,6 +105,15 @@ func NewBn128() (Bn128, error) { return b, nil } +func NewFqR() (fields.Fq, error){ + r, ok := new(big.Int).SetString("21888242871839275222246405745257275088548364400416034343698204186575808495617", 10) + if !ok { + return fields.Fq{}, errors.New("err parsing R") + } + fqR := fields.NewFq(r) + return fqR, nil +} + func (bn128 *Bn128) preparePairing() error { var ok bool bn128.LoopCount, ok = new(big.Int).SetString("29793968203157093288", 10) diff --git a/snark.go b/snark.go index 4840404..7c9a1b2 100644 --- a/snark.go +++ b/snark.go @@ -2,10 +2,12 @@ package snark import ( "crypto/rand" + "fmt" "math/big" "github.com/arnaucube/go-snark/bn128" "github.com/arnaucube/go-snark/fields" + "github.com/arnaucube/go-snark/r1csqap" ) type Setup struct { @@ -22,11 +24,26 @@ type Setup struct { } // public - G1T [][3]*big.Int // t encrypted in G1 curve - G2T [][3][2]*big.Int // t encrypted in G2 curve - G1Kbg [3]*big.Int // g1 * Kbeta * Kgamma - G2Kbg [3][2]*big.Int // g2 * Kbeta * Kgamma - G2Kg [3][2]*big.Int // g2 * Kgamma + G1T [][3]*big.Int // t encrypted in G1 curve + G2T [][3][2]*big.Int // t encrypted in G2 curve + Pk struct { // Proving Key pk:=(pkA, pkB, pkC, pkH) + A [][3]*big.Int + B [][3][2]*big.Int + C [][3]*big.Int + Kp [][3]*big.Int + Ap [][3]*big.Int + Bp [][3]*big.Int + Cp [][3]*big.Int + } + Vk struct { + A [3][2]*big.Int + B [3]*big.Int + C [3][2]*big.Int + G1Kbg [3]*big.Int // g1 * Kbeta * Kgamma + G2Kbg [3][2]*big.Int // g2 * Kbeta * Kgamma + G2Kg [3][2]*big.Int // g2 * Kgamma + Vkz [3][2]*big.Int + } } type Proof struct { @@ -37,16 +54,12 @@ type Proof struct { PiC [3]*big.Int PiCp [3]*big.Int PiH [3]*big.Int - PiK [3]*big.Int - Va [3][2]*big.Int - Vb [3]*big.Int - Vc [3][2]*big.Int - Vz [3][2]*big.Int + PiKp [3]*big.Int } const bits = 512 -func GenerateTrustedSetup(bn bn128.Bn128, polLength int) (Setup, error) { +func GenerateTrustedSetup(bn bn128.Bn128, pf r1csqap.PolynomialField, witnessLength int, alphas, betas, gammas [][]*big.Int, ax, bx, cx, hx, zx []*big.Int) (Setup, error) { var setup Setup var err error // generate random t value @@ -93,7 +106,7 @@ func GenerateTrustedSetup(bn bn128.Bn128, polLength int) (Setup, error) { // encrypt t values with curve generators var gt1 [][3]*big.Int var gt2 [][3][2]*big.Int - for i := 0; i < polLength; i++ { + for i := 0; i < witnessLength; i++ { tPow := bn.Fq1.Exp(setup.Toxic.T, big.NewInt(int64(i))) tEncr1 := bn.G1.MulScalar(bn.G1.G, tPow) gt1 = append(gt1, tEncr1) @@ -105,6 +118,10 @@ func GenerateTrustedSetup(bn bn128.Bn128, polLength int) (Setup, error) { setup.G1T = gt1 setup.G2T = gt2 + setup.Vk.A = bn.G2.MulScalar(bn.G2.G, setup.Toxic.Ka) + setup.Vk.B = bn.G1.MulScalar(bn.G1.G, setup.Toxic.Kb) + setup.Vk.C = bn.G2.MulScalar(bn.G2.G, setup.Toxic.Kc) + /* Verification keys: - Vk_betagamma1: setup.G1Kbg = g1 * Kbeta*Kgamma @@ -112,62 +129,66 @@ func GenerateTrustedSetup(bn bn128.Bn128, polLength int) (Setup, error) { - Vk_gamma: setup.G2Kg = g2 * Kgamma */ kbg := bn.Fq1.Mul(setup.Toxic.Kbeta, setup.Toxic.Kgamma) - setup.G1Kbg = bn.G1.MulScalar(bn.G1.G, kbg) - setup.G2Kbg = bn.G2.MulScalar(bn.G2.G, kbg) - setup.G2Kg = bn.G2.MulScalar(bn.G2.G, setup.Toxic.Kgamma) + setup.Vk.G1Kbg = bn.G1.MulScalar(bn.G1.G, kbg) + setup.Vk.G2Kbg = bn.G2.MulScalar(bn.G2.G, kbg) + setup.Vk.G2Kg = bn.G2.MulScalar(bn.G2.G, setup.Toxic.Kgamma) + + for i := 0; i < witnessLength; i++ { + // A[i] = g1 * ax[t] + at := pf.Eval(alphas[i], setup.Toxic.T) + a := bn.G1.MulScalar(bn.G1.G, at) + setup.Pk.A = append(setup.Pk.A, a) + + bt := pf.Eval(betas[i], setup.Toxic.T) + bg1 := bn.G1.MulScalar(bn.G1.G, bt) + bg2 := bn.G2.MulScalar(bn.G2.G, bt) + setup.Pk.B = append(setup.Pk.B, bg2) + + ct := pf.Eval(gammas[i], setup.Toxic.T) + c := bn.G1.MulScalar(bn.G1.G, ct) + setup.Pk.C = append(setup.Pk.C, c) + + kt := bn.Fq1.Add(bn.Fq1.Add(at, bt), ct) + k := bn.G1.MulScalar(bn.G1.G, kt) + + setup.Pk.Ap = append(setup.Pk.Ap, bn.G1.MulScalar(a, setup.Toxic.Ka)) + setup.Pk.Bp = append(setup.Pk.Bp, bn.G1.MulScalar(bg1, setup.Toxic.Kb)) + setup.Pk.Cp = append(setup.Pk.Cp, bn.G1.MulScalar(c, setup.Toxic.Kc)) + setup.Pk.Kp = append(setup.Pk.Kp, bn.G1.MulScalar(k, setup.Toxic.Kbeta)) + } + setup.Vk.Vkz = bn.G2.MulScalar(bn.G2.G, pf.Eval(zx, setup.Toxic.T)) return setup, nil } -func GenerateProofs(bn bn128.Bn128, f fields.Fq, setup Setup, w, ax, bx, cx, hx, zx []*big.Int) (Proof, error) { +func GenerateProofs(bn bn128.Bn128, f fields.Fq, setup Setup, hx []*big.Int, w []*big.Int) (Proof, error) { var proof Proof - - // g1*A(t) proof.PiA = [3]*big.Int{bn.G1.F.Zero(), bn.G1.F.Zero(), bn.G1.F.Zero()} - for i := 0; i < len(ax); i++ { - m := bn.G1.MulScalar(setup.G1T[i], ax[i]) - proof.PiA = bn.G1.Add(proof.PiA, m) - } - proof.PiAp = bn.G1.MulScalar(proof.PiA, setup.Toxic.Ka) // move this in the setup step - - // g2*B(t) + proof.PiAp = [3]*big.Int{bn.G1.F.Zero(), bn.G1.F.Zero(), bn.G1.F.Zero()} proof.PiB = bn.Fq6.Zero() - // g1*B(t) - pib1 := [3]*big.Int{bn.G1.F.Zero(), bn.G1.F.Zero(), bn.G1.F.Zero()} - for i := 0; i < len(bx); i++ { - m := bn.G2.MulScalar(setup.G2T[i], bx[i]) - proof.PiB = bn.G2.Add(proof.PiB, m) - m1 := bn.G1.MulScalar(setup.G1T[i], bx[i]) - pib1 = bn.G1.Add(pib1, m1) - } - proof.PiBp = bn.G1.MulScalar(pib1, setup.Toxic.Kb) // this in the setup step - - // g1*C(t) + proof.PiBp = [3]*big.Int{bn.G1.F.Zero(), bn.G1.F.Zero(), bn.G1.F.Zero()} proof.PiC = [3]*big.Int{bn.G1.F.Zero(), bn.G1.F.Zero(), bn.G1.F.Zero()} - for i := 0; i < len(cx); i++ { - m := bn.G1.MulScalar(setup.G1T[i], cx[i]) - proof.PiC = bn.G1.Add(proof.PiC, m) - } - proof.PiCp = bn.G1.MulScalar(proof.PiC, setup.Toxic.Kc) // this in the setup step - - // g1*H(t) + proof.PiCp = [3]*big.Int{bn.G1.F.Zero(), bn.G1.F.Zero(), bn.G1.F.Zero()} proof.PiH = [3]*big.Int{bn.G1.F.Zero(), bn.G1.F.Zero(), bn.G1.F.Zero()} - for i := 0; i < len(hx); i++ { - m := bn.G1.MulScalar(setup.G1T[i], hx[i]) - proof.PiH = bn.G1.Add(proof.PiH, m) - } + proof.PiKp = [3]*big.Int{bn.G1.F.Zero(), bn.G1.F.Zero(), bn.G1.F.Zero()} - proof.Vz = bn.Fq6.Zero() - for i := 0; i < len(bx); i++ { - m := bn.G2.MulScalar(setup.G2T[i], zx[i]) - proof.Vz = bn.G2.Add(proof.Vz, m) + for i := 0; i < len(w); i++ { + proof.PiA = bn.G1.Add(proof.PiA, bn.G1.MulScalar(setup.Pk.A[i], w[i])) + proof.PiAp = bn.G1.Add(proof.PiAp, bn.G1.MulScalar(setup.Pk.Ap[i], w[i])) } - // proof.Vz = g2Zt - proof.Va = bn.G2.MulScalar(bn.G2.G, setup.Toxic.Ka) // this in the setup step - proof.Vb = bn.G1.MulScalar(bn.G1.G, setup.Toxic.Kb) // this in the setup step + for i := 0; i < len(w); i++ { + proof.PiB = bn.G2.Add(proof.PiB, bn.G2.MulScalar(setup.Pk.B[i], w[i])) + proof.PiBp = bn.G1.Add(proof.PiBp, bn.G1.MulScalar(setup.Pk.Bp[i], w[i])) + + proof.PiC = bn.G1.Add(proof.PiC, bn.G1.MulScalar(setup.Pk.C[i], w[i])) + proof.PiCp = bn.G1.Add(proof.PiCp, bn.G1.MulScalar(setup.Pk.Cp[i], w[i])) - proof.Vc = bn.G2.MulScalar(bn.G2.G, setup.Toxic.Kc) // this in the setup step + proof.PiKp = bn.G1.Add(proof.PiKp, bn.G1.MulScalar(setup.Pk.Kp[i], w[i])) + } + for i := 0; i < len(hx); i++ { + proof.PiH = bn.G1.Add(proof.PiH, bn.G1.MulScalar(setup.G1T[i], hx[i])) + } return proof, nil } @@ -175,7 +196,7 @@ func GenerateProofs(bn bn128.Bn128, f fields.Fq, setup Setup, w, ax, bx, cx, hx, func VerifyProof(bn bn128.Bn128, setup Setup, proof Proof) bool { // e(piA, Va) == e(piA', g2) - pairingPiaVa, err := bn.Pairing(proof.PiA, proof.Va) + pairingPiaVa, err := bn.Pairing(proof.PiA, setup.Vk.A) if err != nil { return false } @@ -185,10 +206,12 @@ func VerifyProof(bn bn128.Bn128, setup Setup, proof Proof) bool { } if !bn.Fq12.Equal(pairingPiaVa, pairingPiapG2) { return false + } else { + fmt.Println("valid knowledge commitment for A") } // e(Vb, piB) == e(piB', g2) - pairingVbPib, err := bn.Pairing(proof.Vb, proof.PiB) + pairingVbPib, err := bn.Pairing(setup.Vk.B, proof.PiB) if err != nil { return false } @@ -198,10 +221,12 @@ func VerifyProof(bn bn128.Bn128, setup Setup, proof Proof) bool { } if !bn.Fq12.Equal(pairingVbPib, pairingPibpG2) { return false + } else { + fmt.Println("valid knowledge commitment for B") } // e(piC, Vc) == e(piC', g2) - pairingPicVc, err := bn.Pairing(proof.PiC, proof.Vc) + pairingPicVc, err := bn.Pairing(proof.PiC, setup.Vk.C) if err != nil { return false } @@ -211,38 +236,71 @@ func VerifyProof(bn bn128.Bn128, setup Setup, proof Proof) bool { } if !bn.Fq12.Equal(pairingPicVc, pairingPicpG2) { return false + } else { + fmt.Println("valid knowledge commitment for C") + } + + // Vkx, to then calculate Vkx+piA + + // e(Vkx+piA, piB) == e(piH, Vkz) * e(piC, g2) + pairingPiaPib, err := bn.Pairing(proof.PiA, proof.PiB) + if err != nil { + return false + } + pairingPihVkz, err := bn.Pairing(proof.PiH, setup.Vk.Vkz) + if err != nil { + return false + } + pairingPicG2, err := bn.Pairing(proof.PiC, bn.G2.G) + if err != nil { + return false + } + pairingR := bn.Fq12.Mul(pairingPihVkz, pairingPicG2) + if !bn.Fq12.Equal(pairingPiaPib, pairingR) { + fmt.Println("p4") + return false + } else { + fmt.Println("QAP disibility checked") } // e(piA+piC, g2KbetaKgamma) * e(g1KbetaKgamma, piB) // == e(piK, g2Kgamma) // piApiC := bn.G1.Add(proof.PiA, proof.PiC) - // pairingPiACG2Kbg, err := bn.Pairing(piApiC, setup.G2Kbg) + // pairingPiACG2Kbg, err := bn.Pairing(piApiC, setup.Vk.G2Kbg) + // if err != nil { + // return false + // } + // pairingG1KbgPiB, err := bn.Pairing(setup.Vk.G1Kbg, proof.PiB) // if err != nil { // return false // } - // pairingG1KbgPiB, err := bn.Pairing(setup.G1Kbg, proof.PiB) + // pairingL := bn.Fq12.Mul(pairingPiACG2Kbg, pairingG1KbgPiB) + // pairingR, err := bn.Pairing(proof.PiKp, setup.Vk.G2Kg) // if err != nil { // return false // } - // pairing1 := bn.Fq12.Mul(pairingPiACG2Kbg, pairingG1KbgPiB) + // if !bn.Fq12.Equal(pairingL, pairingR) { + // fmt.Println("p5") + // return false + // } // // e(piA, piB) == e(piH, Vz) * e(piC, g2) // pairingPiaPib, err := bn.Pairing(proof.PiA, proof.PiB) // if err != nil { - // return false + // return false // } - // pairingPihVz, err := bn.Pairing(proof.PiH, proof.Vz) + // pairingPihVz, err := bn.Pairing(proof.PiH, setup.Vk.Vkz) // if err != nil { - // return false + // return false // } // pairingPicG2, err := bn.Pairing(proof.PiC, bn.G2.G) // if err != nil { - // return false + // return false // } // if !bn.Fq12.Equal(pairingPiaPib, bn.Fq12.Mul(pairingPihVz, pairingPicG2)) { - // return false + // return false // } return true diff --git a/snark_test.go b/snark_test.go index 16417f8..3f7a3fb 100644 --- a/snark_test.go +++ b/snark_test.go @@ -64,26 +64,21 @@ func TestZk(t *testing.T) { assert.Equal(t, abc, hz) // calculate trusted setup - setup, err := GenerateTrustedSetup(bn, len(ax)) + setup, err := GenerateTrustedSetup(bn, pf, len(w), alphas, betas, gammas, ax, bx, cx, hx, zx) assert.Nil(t, err) fmt.Println("trusted setup:") fmt.Println(setup.G1T) fmt.Println(setup.G2T) // piA = g1 * A(t), piB = g2 * B(t), piC = g1 * C(t), piH = g1 * H(t) - proof, err := GenerateProofs(bn, f, setup, w, ax, bx, cx, hx, zx) + proof, err := GenerateProofs(bn, f, setup, hx, w) assert.Nil(t, err) fmt.Println("proofs:") fmt.Println(proof.PiA) fmt.Println(proof.PiB) fmt.Println(proof.PiC) fmt.Println(proof.PiH) - fmt.Println(proof.Vz) + // fmt.Println(proof.Vz) - publicSetup := Setup{ - G1T: setup.G1T, - G2T: setup.G2T, - } - - assert.True(t, VerifyProof(bn, publicSetup, proof)) + assert.True(t, VerifyProof(bn, setup, proof)) }