bn128.NewFqR with field over R. Setup.Pk & .Vk

2026-02-02 17:26:41 +01:00 · 2018-12-12 14:05:59 +01:00
parent 439d894ee7
commit 7aafcfd5f3
4 changed files with 142 additions and 80 deletions
--- a/README.md
+++ b/README.md
@@ -8,9 +8,9 @@ zkSNARK library implementation in Go

 ### Usage
 - [![GoDoc](https://godoc.org/github.com/arnaucube/go-snark?status.svg)](https://godoc.org/github.com/arnaucube/go-snark) zkSnark
-        - [![GoDoc](https://godoc.org/github.com/arnaucube/go-snark/bn128?status.svg)](https://godoc.org/github.com/arnaucube/go-snark/bn128) bn128 (more details: https://github.com/arnaucube/go-snark/tree/master/bn128)
-        - [![GoDoc](https://godoc.org/github.com/arnaucube/go-snark/fields?status.svg)](https://godoc.org/github.com/arnaucube/go-snark/fields) Finite Fields operations
-        - [![GoDoc](https://godoc.org/github.com/arnaucube/go-snark/r1csqap?status.svg)](https://godoc.org/github.com/arnaucube/go-snark/r1csqap) R1CS to QAP (more details: https://github.com/arnaucube/go-snark/tree/master/r1csqap)
+- [![GoDoc](https://godoc.org/github.com/arnaucube/go-snark/bn128?status.svg)](https://godoc.org/github.com/arnaucube/go-snark/bn128) bn128 (more details: https://github.com/arnaucube/go-snark/tree/master/bn128)
+- [![GoDoc](https://godoc.org/github.com/arnaucube/go-snark/fields?status.svg)](https://godoc.org/github.com/arnaucube/go-snark/fields) Finite Fields operations
+- [![GoDoc](https://godoc.org/github.com/arnaucube/go-snark/r1csqap?status.svg)](https://godoc.org/github.com/arnaucube/go-snark/r1csqap) R1CS to QAP (more details: https://github.com/arnaucube/go-snark/tree/master/r1csqap)

 Example:
 ```go
--- a/bn128/bn128.go
+++ b/bn128/bn128.go
@@ -105,6 +105,15 @@ func NewBn128() (Bn128, error) {
 	return b, nil
 }

+func NewFqR() (fields.Fq, error){
+	r, ok := new(big.Int).SetString("21888242871839275222246405745257275088548364400416034343698204186575808495617", 10)
+	if !ok {
+		return fields.Fq{}, errors.New("err parsing R")
+	}
+	fqR := fields.NewFq(r)
+	return fqR, nil
+}
+
 func (bn128 *Bn128) preparePairing() error {
 	var ok bool
 	bn128.LoopCount, ok = new(big.Int).SetString("29793968203157093288", 10)
--- a/snark.go
+++ b/snark.go
@@ -2,10 +2,12 @@ package snark

 import (
 	"crypto/rand"
+	"fmt"
 	"math/big"

 	"github.com/arnaucube/go-snark/bn128"
 	"github.com/arnaucube/go-snark/fields"
+	"github.com/arnaucube/go-snark/r1csqap"
 )

 type Setup struct {
@@ -22,11 +24,26 @@ type Setup struct {
 	}

 	// public
-	G1T   [][3]*big.Int    // t encrypted in G1 curve
-	G2T   [][3][2]*big.Int // t encrypted in G2 curve
-	G1Kbg [3]*big.Int      // g1 * Kbeta * Kgamma
-	G2Kbg [3][2]*big.Int   // g2 * Kbeta * Kgamma
-	G2Kg  [3][2]*big.Int   // g2 * Kgamma
+	G1T [][3]*big.Int    // t encrypted in G1 curve
+	G2T [][3][2]*big.Int // t encrypted in G2 curve
+	Pk  struct {         // Proving Key pk:=(pkA, pkB, pkC, pkH)
+		A  [][3]*big.Int
+		B  [][3][2]*big.Int
+		C  [][3]*big.Int
+		Kp [][3]*big.Int
+		Ap [][3]*big.Int
+		Bp [][3]*big.Int
+		Cp [][3]*big.Int
+	}
+	Vk struct {
+		A     [3][2]*big.Int
+		B     [3]*big.Int
+		C     [3][2]*big.Int
+		G1Kbg [3]*big.Int    // g1 * Kbeta * Kgamma
+		G2Kbg [3][2]*big.Int // g2 * Kbeta * Kgamma
+		G2Kg  [3][2]*big.Int // g2 * Kgamma
+		Vkz   [3][2]*big.Int
+	}
 }

 type Proof struct {
@@ -37,16 +54,12 @@ type Proof struct {
 	PiC  [3]*big.Int
 	PiCp [3]*big.Int
 	PiH  [3]*big.Int
-	PiK  [3]*big.Int
-	Va   [3][2]*big.Int
-	Vb   [3]*big.Int
-	Vc   [3][2]*big.Int
-	Vz   [3][2]*big.Int
+	PiKp [3]*big.Int
 }

 const bits = 512

-func GenerateTrustedSetup(bn bn128.Bn128, polLength int) (Setup, error) {
+func GenerateTrustedSetup(bn bn128.Bn128, pf r1csqap.PolynomialField, witnessLength int, alphas, betas, gammas [][]*big.Int, ax, bx, cx, hx, zx []*big.Int) (Setup, error) {
 	var setup Setup
 	var err error
 	// generate random t value
@@ -93,7 +106,7 @@ func GenerateTrustedSetup(bn bn128.Bn128, polLength int) (Setup, error) {
 	// encrypt t values with curve generators
 	var gt1 [][3]*big.Int
 	var gt2 [][3][2]*big.Int
-	for i := 0; i < polLength; i++ {
+	for i := 0; i < witnessLength; i++ {
 		tPow := bn.Fq1.Exp(setup.Toxic.T, big.NewInt(int64(i)))
 		tEncr1 := bn.G1.MulScalar(bn.G1.G, tPow)
 		gt1 = append(gt1, tEncr1)
@@ -105,6 +118,10 @@ func GenerateTrustedSetup(bn bn128.Bn128, polLength int) (Setup, error) {
 	setup.G1T = gt1
 	setup.G2T = gt2

+	setup.Vk.A = bn.G2.MulScalar(bn.G2.G, setup.Toxic.Ka)
+	setup.Vk.B = bn.G1.MulScalar(bn.G1.G, setup.Toxic.Kb)
+	setup.Vk.C = bn.G2.MulScalar(bn.G2.G, setup.Toxic.Kc)
+
 	/*
 		Verification keys:
 		- Vk_betagamma1: setup.G1Kbg = g1 * Kbeta*Kgamma
@@ -112,70 +129,74 @@ func GenerateTrustedSetup(bn bn128.Bn128, polLength int) (Setup, error) {
 		- Vk_gamma: setup.G2Kg = g2 * Kgamma
 	*/
 	kbg := bn.Fq1.Mul(setup.Toxic.Kbeta, setup.Toxic.Kgamma)
-	setup.G1Kbg = bn.G1.MulScalar(bn.G1.G, kbg)
-	setup.G2Kbg = bn.G2.MulScalar(bn.G2.G, kbg)
-	setup.G2Kg = bn.G2.MulScalar(bn.G2.G, setup.Toxic.Kgamma)
+	setup.Vk.G1Kbg = bn.G1.MulScalar(bn.G1.G, kbg)
+	setup.Vk.G2Kbg = bn.G2.MulScalar(bn.G2.G, kbg)
+	setup.Vk.G2Kg = bn.G2.MulScalar(bn.G2.G, setup.Toxic.Kgamma)
+
+	for i := 0; i < witnessLength; i++ {
+		// A[i] = g1 * ax[t]
+		at := pf.Eval(alphas[i], setup.Toxic.T)
+		a := bn.G1.MulScalar(bn.G1.G, at)
+		setup.Pk.A = append(setup.Pk.A, a)
+
+		bt := pf.Eval(betas[i], setup.Toxic.T)
+		bg1 := bn.G1.MulScalar(bn.G1.G, bt)
+		bg2 := bn.G2.MulScalar(bn.G2.G, bt)
+		setup.Pk.B = append(setup.Pk.B, bg2)
+
+		ct := pf.Eval(gammas[i], setup.Toxic.T)
+		c := bn.G1.MulScalar(bn.G1.G, ct)
+		setup.Pk.C = append(setup.Pk.C, c)
+
+		kt := bn.Fq1.Add(bn.Fq1.Add(at, bt), ct)
+		k := bn.G1.MulScalar(bn.G1.G, kt)
+
+		setup.Pk.Ap = append(setup.Pk.Ap, bn.G1.MulScalar(a, setup.Toxic.Ka))
+		setup.Pk.Bp = append(setup.Pk.Bp, bn.G1.MulScalar(bg1, setup.Toxic.Kb))
+		setup.Pk.Cp = append(setup.Pk.Cp, bn.G1.MulScalar(c, setup.Toxic.Kc))
+		setup.Pk.Kp = append(setup.Pk.Kp, bn.G1.MulScalar(k, setup.Toxic.Kbeta))
+	}
+	setup.Vk.Vkz = bn.G2.MulScalar(bn.G2.G, pf.Eval(zx, setup.Toxic.T))

 	return setup, nil
 }

-func GenerateProofs(bn bn128.Bn128, f fields.Fq, setup Setup, w, ax, bx, cx, hx, zx []*big.Int) (Proof, error) {
+func GenerateProofs(bn bn128.Bn128, f fields.Fq, setup Setup, hx []*big.Int, w []*big.Int) (Proof, error) {
 	var proof Proof
-
-	// g1*A(t)
 	proof.PiA = [3]*big.Int{bn.G1.F.Zero(), bn.G1.F.Zero(), bn.G1.F.Zero()}
-	for i := 0; i < len(ax); i++ {
-		m := bn.G1.MulScalar(setup.G1T[i], ax[i])
-		proof.PiA = bn.G1.Add(proof.PiA, m)
-	}
-	proof.PiAp = bn.G1.MulScalar(proof.PiA, setup.Toxic.Ka) // move this in the setup step
-
-	// g2*B(t)
+	proof.PiAp = [3]*big.Int{bn.G1.F.Zero(), bn.G1.F.Zero(), bn.G1.F.Zero()}
 	proof.PiB = bn.Fq6.Zero()
-	// g1*B(t)
-	pib1 := [3]*big.Int{bn.G1.F.Zero(), bn.G1.F.Zero(), bn.G1.F.Zero()}
-	for i := 0; i < len(bx); i++ {
-		m := bn.G2.MulScalar(setup.G2T[i], bx[i])
-		proof.PiB = bn.G2.Add(proof.PiB, m)
-		m1 := bn.G1.MulScalar(setup.G1T[i], bx[i])
-		pib1 = bn.G1.Add(pib1, m1)
-	}
-	proof.PiBp = bn.G1.MulScalar(pib1, setup.Toxic.Kb) // this in the setup step
-
-	// g1*C(t)
+	proof.PiBp = [3]*big.Int{bn.G1.F.Zero(), bn.G1.F.Zero(), bn.G1.F.Zero()}
 	proof.PiC = [3]*big.Int{bn.G1.F.Zero(), bn.G1.F.Zero(), bn.G1.F.Zero()}
-	for i := 0; i < len(cx); i++ {
-		m := bn.G1.MulScalar(setup.G1T[i], cx[i])
-		proof.PiC = bn.G1.Add(proof.PiC, m)
-	}
-	proof.PiCp = bn.G1.MulScalar(proof.PiC, setup.Toxic.Kc) // this in the setup step
-
-	// g1*H(t)
+	proof.PiCp = [3]*big.Int{bn.G1.F.Zero(), bn.G1.F.Zero(), bn.G1.F.Zero()}
 	proof.PiH = [3]*big.Int{bn.G1.F.Zero(), bn.G1.F.Zero(), bn.G1.F.Zero()}
+	proof.PiKp = [3]*big.Int{bn.G1.F.Zero(), bn.G1.F.Zero(), bn.G1.F.Zero()}
+
+	for i := 0; i < len(w); i++ {
+		proof.PiA = bn.G1.Add(proof.PiA, bn.G1.MulScalar(setup.Pk.A[i], w[i]))
+		proof.PiAp = bn.G1.Add(proof.PiAp, bn.G1.MulScalar(setup.Pk.Ap[i], w[i]))
+	}
+
+	for i := 0; i < len(w); i++ {
+		proof.PiB = bn.G2.Add(proof.PiB, bn.G2.MulScalar(setup.Pk.B[i], w[i]))
+		proof.PiBp = bn.G1.Add(proof.PiBp, bn.G1.MulScalar(setup.Pk.Bp[i], w[i]))
+
+		proof.PiC = bn.G1.Add(proof.PiC, bn.G1.MulScalar(setup.Pk.C[i], w[i]))
+		proof.PiCp = bn.G1.Add(proof.PiCp, bn.G1.MulScalar(setup.Pk.Cp[i], w[i]))
+
+		proof.PiKp = bn.G1.Add(proof.PiKp, bn.G1.MulScalar(setup.Pk.Kp[i], w[i]))
+	}
 	for i := 0; i < len(hx); i++ {
-		m := bn.G1.MulScalar(setup.G1T[i], hx[i])
-		proof.PiH = bn.G1.Add(proof.PiH, m)
+		proof.PiH = bn.G1.Add(proof.PiH, bn.G1.MulScalar(setup.G1T[i], hx[i]))
 	}

-	proof.Vz = bn.Fq6.Zero()
-	for i := 0; i < len(bx); i++ {
-		m := bn.G2.MulScalar(setup.G2T[i], zx[i])
-		proof.Vz = bn.G2.Add(proof.Vz, m)
-	}
-	// proof.Vz = g2Zt
-	proof.Va = bn.G2.MulScalar(bn.G2.G, setup.Toxic.Ka) // this in the setup step
-
-	proof.Vb = bn.G1.MulScalar(bn.G1.G, setup.Toxic.Kb) // this in the setup step
-
-	proof.Vc = bn.G2.MulScalar(bn.G2.G, setup.Toxic.Kc) // this in the setup step
-
 	return proof, nil
 }

 func VerifyProof(bn bn128.Bn128, setup Setup, proof Proof) bool {

 	// e(piA, Va) == e(piA', g2)
-	pairingPiaVa, err := bn.Pairing(proof.PiA, proof.Va)
+	pairingPiaVa, err := bn.Pairing(proof.PiA, setup.Vk.A)
 	if err != nil {
 		return false
 	}
@@ -185,10 +206,12 @@ func VerifyProof(bn bn128.Bn128, setup Setup, proof Proof) bool {
 	}
 	if !bn.Fq12.Equal(pairingPiaVa, pairingPiapG2) {
 		return false
+	} else {
+		fmt.Println("valid knowledge commitment for A")
 	}

 	// e(Vb, piB) == e(piB', g2)
-	pairingVbPib, err := bn.Pairing(proof.Vb, proof.PiB)
+	pairingVbPib, err := bn.Pairing(setup.Vk.B, proof.PiB)
 	if err != nil {
 		return false
 	}
@@ -198,10 +221,12 @@ func VerifyProof(bn bn128.Bn128, setup Setup, proof Proof) bool {
 	}
 	if !bn.Fq12.Equal(pairingVbPib, pairingPibpG2) {
 		return false
+	} else {
+		fmt.Println("valid knowledge commitment for B")
 	}

 	// e(piC, Vc) == e(piC', g2)
-	pairingPicVc, err := bn.Pairing(proof.PiC, proof.Vc)
+	pairingPicVc, err := bn.Pairing(proof.PiC, setup.Vk.C)
 	if err != nil {
 		return false
 	}
@@ -211,38 +236,71 @@ func VerifyProof(bn bn128.Bn128, setup Setup, proof Proof) bool {
 	}
 	if !bn.Fq12.Equal(pairingPicVc, pairingPicpG2) {
 		return false
+	} else {
+		fmt.Println("valid knowledge commitment for C")
+	}
+
+	// Vkx, to then calculate Vkx+piA
+
+	// e(Vkx+piA, piB) == e(piH, Vkz) * e(piC, g2)
+	pairingPiaPib, err := bn.Pairing(proof.PiA, proof.PiB)
+	if err != nil {
+		return false
+	}
+	pairingPihVkz, err := bn.Pairing(proof.PiH, setup.Vk.Vkz)
+	if err != nil {
+		return false
+	}
+	pairingPicG2, err := bn.Pairing(proof.PiC, bn.G2.G)
+	if err != nil {
+		return false
+	}
+	pairingR := bn.Fq12.Mul(pairingPihVkz, pairingPicG2)
+	if !bn.Fq12.Equal(pairingPiaPib, pairingR) {
+		fmt.Println("p4")
+		return false
+	} else {
+		fmt.Println("QAP disibility checked")
 	}

 	// e(piA+piC, g2KbetaKgamma) * e(g1KbetaKgamma, piB)
 	// == e(piK, g2Kgamma)
 	// piApiC := bn.G1.Add(proof.PiA, proof.PiC)
-	// pairingPiACG2Kbg, err := bn.Pairing(piApiC, setup.G2Kbg)
+	// pairingPiACG2Kbg, err := bn.Pairing(piApiC, setup.Vk.G2Kbg)
 	// if err != nil {
 	//         return false
 	// }
-	// pairingG1KbgPiB, err := bn.Pairing(setup.G1Kbg, proof.PiB)
+	// pairingG1KbgPiB, err := bn.Pairing(setup.Vk.G1Kbg, proof.PiB)
 	// if err != nil {
 	//         return false
 	// }
-	// pairing1 := bn.Fq12.Mul(pairingPiACG2Kbg, pairingG1KbgPiB)
+	// pairingL := bn.Fq12.Mul(pairingPiACG2Kbg, pairingG1KbgPiB)
+	// pairingR, err := bn.Pairing(proof.PiKp, setup.Vk.G2Kg)
+	// if err != nil {
+	//         return false
+	// }
+	// if !bn.Fq12.Equal(pairingL, pairingR) {
+	//         fmt.Println("p5")
+	//         return false
+	// }

 	//

 	// e(piA, piB) == e(piH, Vz) * e(piC, g2)
 	// pairingPiaPib, err := bn.Pairing(proof.PiA, proof.PiB)
 	// if err != nil {
-	// 	return false
+	//         return false
 	// }
-	// pairingPihVz, err := bn.Pairing(proof.PiH, proof.Vz)
+	// pairingPihVz, err := bn.Pairing(proof.PiH, setup.Vk.Vkz)
 	// if err != nil {
-	// 	return false
+	//         return false
 	// }
 	// pairingPicG2, err := bn.Pairing(proof.PiC, bn.G2.G)
 	// if err != nil {
-	// 	return false
+	//         return false
 	// }
 	// if !bn.Fq12.Equal(pairingPiaPib, bn.Fq12.Mul(pairingPihVz, pairingPicG2)) {
-	// 	return false
+	//         return false
 	// }

 	return true
--- a/snark_test.go
+++ b/snark_test.go
@@ -64,26 +64,21 @@ func TestZk(t *testing.T) {
 	assert.Equal(t, abc, hz)

 	// calculate trusted setup
-	setup, err := GenerateTrustedSetup(bn, len(ax))
+	setup, err := GenerateTrustedSetup(bn, pf, len(w), alphas, betas, gammas, ax, bx, cx, hx, zx)
 	assert.Nil(t, err)
 	fmt.Println("trusted setup:")
 	fmt.Println(setup.G1T)
 	fmt.Println(setup.G2T)

 	// piA = g1 * A(t), piB = g2 * B(t), piC = g1 * C(t), piH = g1 * H(t)
-	proof, err := GenerateProofs(bn, f, setup, w, ax, bx, cx, hx, zx)
+	proof, err := GenerateProofs(bn, f, setup, hx, w)
 	assert.Nil(t, err)
 	fmt.Println("proofs:")
 	fmt.Println(proof.PiA)
 	fmt.Println(proof.PiB)
 	fmt.Println(proof.PiC)
 	fmt.Println(proof.PiH)
-	fmt.Println(proof.Vz)
+	// fmt.Println(proof.Vz)

-	publicSetup := Setup{
-		G1T: setup.G1T,
-		G2T: setup.G2T,
-	}
-
-	assert.True(t, VerifyProof(bn, publicSetup, proof))
+	assert.True(t, VerifyProof(bn, setup, proof))
 }