You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

115 lines
4.0 KiB

  1. # go-snark [![Go Report Card](https://goreportcard.com/badge/github.com/arnaucube/go-snark)](https://goreportcard.com/report/github.com/arnaucube/go-snark)
  2. zkSNARK library implementation in Go
  3. - `Succinct Non-Interactive Zero Knowledge for a von Neumann Architecture`, Eli Ben-Sasson, Alessandro Chiesa, Eran Tromer, Madars Virza https://eprint.iacr.org/2013/879.pdf
  4. - `Pinocchio: Nearly practical verifiable computation`, Bryan Parno, Craig Gentry, Jon Howell, Mariana Raykova https://eprint.iacr.org/2013/279.pdf
  5. ## Caution
  6. Implementation from scratch in Go to understand the concepts. Do not use in production.
  7. Not finished, implementing this in my free time to understand it better, so I don't have much time.
  8. Current implementation status:
  9. - [x] Finite Fields (1, 2, 6, 12) operations
  10. - [x] G1 and G2 curve operations
  11. - [x] BN128 Pairing
  12. - [x] circuit code compiler
  13. - [ ] code to flat code
  14. - [x] flat code compiler
  15. - [x] circuit to R1CS
  16. - [x] polynomial operations
  17. - [x] R1CS to QAP
  18. - [x] generate trusted setup
  19. - [x] generate proofs
  20. - [x] verify proofs with BN128 pairing
  21. ### Usage
  22. - [![GoDoc](https://godoc.org/github.com/arnaucube/go-snark?status.svg)](https://godoc.org/github.com/arnaucube/go-snark) zkSnark
  23. - [![GoDoc](https://godoc.org/github.com/arnaucube/go-snark/bn128?status.svg)](https://godoc.org/github.com/arnaucube/go-snark/bn128) bn128 (more details: https://github.com/arnaucube/go-snark/tree/master/bn128)
  24. - [![GoDoc](https://godoc.org/github.com/arnaucube/go-snark/fields?status.svg)](https://godoc.org/github.com/arnaucube/go-snark/fields) Finite Fields operations
  25. - [![GoDoc](https://godoc.org/github.com/arnaucube/go-snark/r1csqap?status.svg)](https://godoc.org/github.com/arnaucube/go-snark/r1csqap) R1CS to QAP (more details: https://github.com/arnaucube/go-snark/tree/master/r1csqap)
  26. - [![GoDoc](https://godoc.org/github.com/arnaucube/go-snark/circuitcompiler?status.svg)](https://godoc.org/github.com/arnaucube/go-snark/circuitcompiler) Circuit Compiler
  27. Example:
  28. ```go
  29. // compile circuit and get the R1CS
  30. flatCode := `
  31. func test(x):
  32. aux = x*x
  33. y = aux*x
  34. z = x + y
  35. out = z + 5
  36. `
  37. // parse the code
  38. parser := circuitcompiler.NewParser(strings.NewReader(flatCode))
  39. circuit, err := parser.Parse()
  40. assert.Nil(t, err)
  41. fmt.Println(circuit)
  42. // witness
  43. b3 := big.NewInt(int64(3))
  44. inputs := []*big.Int{b3}
  45. w := circuit.CalculateWitness(inputs)
  46. fmt.Println("\nwitness", w)
  47. /*
  48. now we have the witness:
  49. w = [1 3 35 9 27 30]
  50. */
  51. // flat code to R1CS
  52. fmt.Println("generating R1CS from flat code")
  53. a, b, c := circuit.GenerateR1CS()
  54. /*
  55. now we have the R1CS from the circuit:
  56. a == [[0 1 0 0 0 0] [0 0 0 1 0 0] [0 1 0 0 1 0] [5 0 0 0 0 1]]
  57. b == [[0 1 0 0 0 0] [0 1 0 0 0 0] [1 0 0 0 0 0] [1 0 0 0 0 0]]
  58. c == [[0 0 0 1 0 0] [0 0 0 0 1 0] [0 0 0 0 0 1] [0 0 1 0 0 0]]
  59. */
  60. alphas, betas, gammas, zx := snark.Utils.PF.R1CSToQAP(a, b, c)
  61. ax, bx, cx, px := snark.Utils.PF.CombinePolynomials(w, alphas, betas, gammas)
  62. hx := snark.Utils.PF.DivisorPolinomial(px, zx)
  63. // hx==px/zx so px==hx*zx
  64. assert.Equal(t, px, snark.Utils.PF.Mul(hx, zx))
  65. // p(x) = a(x) * b(x) - c(x) == h(x) * z(x)
  66. abc := snark.Utils.PF.Sub(pf.Mul(ax, bx), cx)
  67. assert.Equal(t, abc, px)
  68. hz := snark.Utils.PF.Mul(hx, zx)
  69. assert.Equal(t, abc, hz)
  70. div, rem := snark.Utils.PF.Div(px, zx)
  71. assert.Equal(t, hx, div)
  72. assert.Equal(t, rem, r1csqap.ArrayOfBigZeros(4))
  73. // calculate trusted setup
  74. setup, err := snark.GenerateTrustedSetup(len(w), circuit, alphas, betas, gammas, zx)
  75. assert.Nil(t, err)
  76. fmt.Println("t", setup.Toxic.T)
  77. // piA = g1 * A(t), piB = g2 * B(t), piC = g1 * C(t), piH = g1 * H(t)
  78. proof, err := snark.GenerateProofs(circuit, setup, hx, w)
  79. assert.Nil(t, err)
  80. assert.True(t, snark.VerifyProof(circuit, setup, proof))
  81. ```
  82. ### Test
  83. ```
  84. go test ./... -v
  85. ```
  86. ---
  87. Thanks to [@jbaylina](https://github.com/jbaylina), [@bellesmarta](https://github.com/bellesmarta), [@adriamb](https://github.com/adriamb) for their explanations that helped to understand this a little bit. Also thanks to [@vbuterin](https://github.com/vbuterin) for all the published articles explaining the zkSNARKs.