From 6cd494f36fc0abd62319f399d65f1492ef5e4c5b Mon Sep 17 00:00:00 2001 From: arnaucube Date: Tue, 4 Dec 2018 23:50:43 +0100 Subject: [PATCH] doing trusted setup --- README.md | 80 +++++++++++++++----------- r1csqap/r1csqap.go | 16 +++--- r1csqap/r1csqap_test.go | 35 +++++------ r1csqapFloat/r1csqapFloat.go | 16 +++--- r1csqapFloat/r1csqapFloat_test.go | 33 +++++++---- zk/zk.go | 69 ++++++++++++++++++++++ zk/zk_test.go | 96 +++++++++++++++++++++++++++++++ 7 files changed, 269 insertions(+), 76 deletions(-) create mode 100644 zk/zk.go create mode 100644 zk/zk_test.go diff --git a/README.md b/README.md index 38dab20..f71a7bc 100644 --- a/README.md +++ b/README.md @@ -2,15 +2,13 @@ zk-SNARK library implementation in Go -Not finished, work in progress (doing this in my free time, so I don't have much time). - - #### Test ``` go test ./... -v ``` + ## R1CS to Quadratic Arithmetic Program - `Succinct Non-Interactive Zero Knowledge for a von Neumann Architecture`, Eli Ben-Sasson, Alessandro Chiesa, Eran Tromer, Madars Virza https://eprint.iacr.org/2013/879.pdf - Vitalik Buterin blog post about QAP https://medium.com/@VitalikButerin/quadratic-arithmetic-programs-from-zero-to-hero-f6d558cea649 @@ -20,39 +18,49 @@ go test ./... -v #### Usage - R1CS to QAP ```go -b0 := big.NewFloat(float64(0)) -b1 := big.NewFloat(float64(1)) -b5 := big.NewFloat(float64(5)) -a := [][]*big.Float{ - []*big.Float{b0, b1, b0, b0, b0, b0}, - []*big.Float{b0, b0, b0, b1, b0, b0}, - []*big.Float{b0, b1, b0, b0, b1, b0}, - []*big.Float{b5, b0, b0, b0, b0, b1}, +pf := NewPolynomialField(f) + +b0 := big.NewInt(int64(0)) +b1 := big.NewInt(int64(1)) +b3 := big.NewInt(int64(3)) +b5 := big.NewInt(int64(5)) +b9 := big.NewInt(int64(9)) +b27 := big.NewInt(int64(27)) +b30 := big.NewInt(int64(30)) +b35 := big.NewInt(int64(35)) +a := [][]*big.Int{ + []*big.Int{b0, b1, b0, b0, b0, b0}, + []*big.Int{b0, b0, b0, b1, b0, b0}, + []*big.Int{b0, b1, b0, b0, b1, b0}, + []*big.Int{b5, b0, b0, b0, b0, b1}, } -b := [][]*big.Float{ - []*big.Float{b0, b1, b0, b0, b0, b0}, - []*big.Float{b0, b1, b0, b0, b0, b0}, - []*big.Float{b1, b0, b0, b0, b0, b0}, - []*big.Float{b1, b0, b0, b0, b0, b0}, +b := [][]*big.Int{ + []*big.Int{b0, b1, b0, b0, b0, b0}, + []*big.Int{b0, b1, b0, b0, b0, b0}, + []*big.Int{b1, b0, b0, b0, b0, b0}, + []*big.Int{b1, b0, b0, b0, b0, b0}, } -c := [][]*big.Float{ - []*big.Float{b0, b0, b0, b1, b0, b0}, - []*big.Float{b0, b0, b0, b0, b1, b0}, - []*big.Float{b0, b0, b0, b0, b0, b1}, - []*big.Float{b0, b0, b1, b0, b0, b0}, +c := [][]*big.Int{ + []*big.Int{b0, b0, b0, b1, b0, b0}, + []*big.Int{b0, b0, b0, b0, b1, b0}, + []*big.Int{b0, b0, b0, b0, b0, b1}, + []*big.Int{b0, b0, b1, b0, b0, b0}, } -alpha, beta, gamma, z := R1CSToQAP(a, b, c) -fmt.Println(alpha) -fmt.Println(beta) -fmt.Println(gamma) +alphas, betas, gammas, zx := pf.R1CSToQAP(a, b, c) +fmt.Println(alphas) +fmt.Println(betas) +fmt.Println(gammas) fmt.Println(z) -/* -out: -alpha: [[-5 9.166666666666666 -5 0.8333333333333334] [8 -11.333333333333332 5 -0.6666666666666666] [0 0 0 0] [-6 9.5 -4 0.5] [4 -7 3.5 -0.5] [-1 1.8333333333333333 -1 0.16666666666666666]] -beta: [[3 -5.166666666666667 2.5 -0.33333333333333337] [-2 5.166666666666667 -2.5 0.33333333333333337] [0 0 0 0] [0 0 0 0] [0 0 0 0] [0 0 0 0]] -gamma: [[0 0 0 0] [0 0 0 0] [-1 1.8333333333333333 -1 0.16666666666666666] [4 -4.333333333333333 1.5 -0.16666666666666666] [-6 9.5 -4 0.5] [4 -7 3.5 -0.5]] -z: [24 -50 35 -10 1] -*/ + +w := []*big.Int{b1, b3, b35, b9, b27, b30} +ax, bx, cx, px := pf.CombinePolynomials(w, alphas, betas, gammas) +fmt.Println(ax) +fmt.Println(bx) +fmt.Println(cx) +fmt.Println(px) + +hx := pf.DivisorPolinomial(px, zx) +fmt.Println(hx) ``` ## Bn128 @@ -97,3 +105,11 @@ pB, err := bn128.Pairing(g1b, g2b) assert.Nil(t, err) assert.True(t, bn128.Fq12.Equal(pA, pB)) ``` + + +--- + +## Caution +Not finished, work in progress (implementing this in my free time to understand it better, so I don't have much time). + +Thanks to @jbaylina, @bellesmarta, @adriamb for their explanations that helped to understand a little bit this. diff --git a/r1csqap/r1csqap.go b/r1csqap/r1csqap.go index 345c804..cd7cb46 100644 --- a/r1csqap/r1csqap.go +++ b/r1csqap/r1csqap.go @@ -137,17 +137,17 @@ func (pf PolynomialField) R1CSToQAP(a, b, c [][]*big.Int) ([][]*big.Int, [][]*bi aT := Transpose(a) bT := Transpose(b) cT := Transpose(c) - var alpha [][]*big.Int + var alphas [][]*big.Int for i := 0; i < len(aT); i++ { - alpha = append(alpha, pf.LagrangeInterpolation(aT[i])) + alphas = append(alphas, pf.LagrangeInterpolation(aT[i])) } - var beta [][]*big.Int + var betas [][]*big.Int for i := 0; i < len(bT); i++ { - beta = append(beta, pf.LagrangeInterpolation(bT[i])) + betas = append(betas, pf.LagrangeInterpolation(bT[i])) } - var gamma [][]*big.Int + var gammas [][]*big.Int for i := 0; i < len(cT); i++ { - gamma = append(gamma, pf.LagrangeInterpolation(cT[i])) + gammas = append(gammas, pf.LagrangeInterpolation(cT[i])) } z := []*big.Int{big.NewInt(int64(1))} for i := 1; i < len(aT[0])+1; i++ { @@ -155,10 +155,10 @@ func (pf PolynomialField) R1CSToQAP(a, b, c [][]*big.Int) ([][]*big.Int, [][]*bi b1 := big.NewInt(int64(1)) z = pf.Mul(z, []*big.Int{ineg, b1}) } - return alpha, beta, gamma, z + return alphas, betas, gammas, z } -func (pf PolynomialField) SolPolynomials(r []*big.Int, ap, bp, cp [][]*big.Int) ([]*big.Int, []*big.Int, []*big.Int, []*big.Int) { +func (pf PolynomialField) CombinePolynomials(r []*big.Int, ap, bp, cp [][]*big.Int) ([]*big.Int, []*big.Int, []*big.Int, []*big.Int) { var alpha []*big.Int for i := 0; i < len(r); i++ { m := pf.Mul([]*big.Int{r[i]}, ap[i]) diff --git a/r1csqap/r1csqap_test.go b/r1csqap/r1csqap_test.go index 79c8ef9..aba859f 100644 --- a/r1csqap/r1csqap_test.go +++ b/r1csqap/r1csqap_test.go @@ -132,27 +132,30 @@ func TestR1CSToQAP(t *testing.T) { []*big.Int{b0, b0, b0, b0, b0, b1}, []*big.Int{b0, b0, b1, b0, b0, b0}, } - ap, bp, cp, z := pf.R1CSToQAP(a, b, c) - fmt.Println(ap) - fmt.Println(bp) - fmt.Println(cp) - fmt.Println(z) + alphas, betas, gammas, zx := pf.R1CSToQAP(a, b, c) + fmt.Println(alphas) + fmt.Println(betas) + fmt.Println(gammas) + fmt.Print("Z(x): ") + fmt.Println(zx) w := []*big.Int{b1, b3, b35, b9, b27, b30} - alpha, beta, gamma, px := pf.SolPolynomials(w, ap, bp, cp) - fmt.Println(alpha) - fmt.Println(beta) - fmt.Println(gamma) + ax, bx, cx, px := pf.CombinePolynomials(w, alphas, betas, gammas) + fmt.Println(ax) + fmt.Println(bx) + fmt.Println(cx) fmt.Println(px) - h := pf.DivisorPolinomial(px, z) - fmt.Println(h) + hx := pf.DivisorPolinomial(px, zx) + fmt.Println(hx) - // h==px/z so px==h*z - assert.Equal(t, px, pf.Mul(h, z)) + // hx==px/zx so px==hx*zx + assert.Equal(t, px, pf.Mul(hx, zx)) - // a(x) * b(x) - c(x) == h * z(x) - abc := pf.Sub(pf.Mul(alpha, beta), gamma) - hz := pf.Mul(h, z) + // p(x) = a(x) * b(x) - c(x) == h(x) * z(x) + abc := pf.Sub(pf.Mul(ax, bx), cx) + assert.Equal(t, abc, px) + hz := pf.Mul(hx, zx) assert.Equal(t, abc, hz) + } diff --git a/r1csqapFloat/r1csqapFloat.go b/r1csqapFloat/r1csqapFloat.go index a479a19..b5be28f 100644 --- a/r1csqapFloat/r1csqapFloat.go +++ b/r1csqapFloat/r1csqapFloat.go @@ -137,17 +137,17 @@ func R1CSToQAP(a, b, c [][]*big.Float) ([][]*big.Float, [][]*big.Float, [][]*big aT := Transpose(a) bT := Transpose(b) cT := Transpose(c) - var alpha [][]*big.Float + var alphas [][]*big.Float for i := 0; i < len(aT); i++ { - alpha = append(alpha, LagrangeInterpolation(aT[i])) + alphas = append(alphas, LagrangeInterpolation(aT[i])) } - var beta [][]*big.Float + var betas [][]*big.Float for i := 0; i < len(bT); i++ { - beta = append(beta, LagrangeInterpolation(bT[i])) + betas = append(betas, LagrangeInterpolation(bT[i])) } - var gamma [][]*big.Float + var gammas [][]*big.Float for i := 0; i < len(cT); i++ { - gamma = append(gamma, LagrangeInterpolation(cT[i])) + gammas = append(gammas, LagrangeInterpolation(cT[i])) } z := []*big.Float{big.NewFloat(float64(1))} for i := 1; i < len(aT[0])+1; i++ { @@ -155,10 +155,10 @@ func R1CSToQAP(a, b, c [][]*big.Float) ([][]*big.Float, [][]*big.Float, [][]*big b1 := big.NewFloat(float64(1)) z = PolMul(z, []*big.Float{ineg, b1}) } - return alpha, beta, gamma, z + return alphas, betas, gammas, z } -func SolPolynomials(r []*big.Float, ap, bp, cp [][]*big.Float) ([]*big.Float, []*big.Float, []*big.Float, []*big.Float) { +func CombinePolynomials(r []*big.Float, ap, bp, cp [][]*big.Float) ([]*big.Float, []*big.Float, []*big.Float, []*big.Float) { var alpha []*big.Float for i := 0; i < len(r); i++ { m := PolMul([]*big.Float{r[i]}, ap[i]) diff --git a/r1csqapFloat/r1csqapFloat_test.go b/r1csqapFloat/r1csqapFloat_test.go index 2866d79..b48d9b6 100644 --- a/r1csqapFloat/r1csqapFloat_test.go +++ b/r1csqapFloat/r1csqapFloat_test.go @@ -108,21 +108,30 @@ func TestR1CSToQAP(t *testing.T) { []*big.Float{b0, b0, b0, b0, b0, b1}, []*big.Float{b0, b0, b1, b0, b0, b0}, } - ap, bp, cp, z := R1CSToQAP(a, b, c) - fmt.Println(ap) - fmt.Println(bp) - fmt.Println(cp) - fmt.Println(z) + // alphas, betas, gammas + alphas, betas, gammas, zx := R1CSToQAP(a, b, c) + fmt.Println(alphas) + fmt.Println(betas) + fmt.Println(gammas) + fmt.Print("Z(x): ") + fmt.Println(zx) zexpected := []*big.Float{big.NewFloat(float64(24)), big.NewFloat(float64(-50)), big.NewFloat(float64(35)), big.NewFloat(float64(-10)), big.NewFloat(float64(1))} - assert.Equal(t, z, zexpected) + assert.Equal(t, zx, zexpected) + // witness w := []*big.Float{b1, b3, b35, b9, b27, b30} - alpha, beta, gamma, px := SolPolynomials(w, ap, bp, cp) - fmt.Println(alpha) - fmt.Println(beta) - fmt.Println(gamma) + fmt.Print("w: ") + fmt.Println(w) + // QAP A(x), B(x), C(x) + ax, bx, cx, px := CombinePolynomials(w, alphas, betas, gammas) + fmt.Print("A(x), B(x), C(x), P(x): ") + fmt.Println(ax) + fmt.Println(bx) + fmt.Println(cx) fmt.Println(px) - h := DivisorPolinomial(px, z) - fmt.Println(h) + hx := DivisorPolinomial(px, zx) + fmt.Print("H(x): ") + fmt.Println(hx) + } diff --git a/zk/zk.go b/zk/zk.go new file mode 100644 index 0000000..dd47a61 --- /dev/null +++ b/zk/zk.go @@ -0,0 +1,69 @@ +package zk + +import ( + "crypto/rand" + "fmt" + "math/big" + + "github.com/arnaucube/go-snark/bn128" +) + +const bits = 512 + +func GenerateTrustedSetup(bn bn128.Bn128, pollength int) ([][3]*big.Int, [][3][2]*big.Int, error) { + // generate random t value + t, err := rand.Prime(rand.Reader, bits) + if err != nil { + return [][3]*big.Int{}, [][3][2]*big.Int{}, err + } + fmt.Print("trusted t: ") + fmt.Println(t) + + // encrypt t values with curve generators + var gt1 [][3]*big.Int + var gt2 [][3][2]*big.Int + for i := 0; i < pollength; i++ { + tPow := bn.Fq1.Exp(t, big.NewInt(int64(i))) + tEncr1 := bn.G1.MulScalar(bn.G1.G, tPow) + gt1 = append(gt1, tEncr1) + tEncr2 := bn.G2.MulScalar(bn.G2.G, tPow) + gt2 = append(gt2, tEncr2) + } + // gt1: g1, g1*t, g1*t^2, g1*t^3, ... + // gt2: g2, g2*t, g2*t^2, ... + return gt1, gt2, nil +} +func GenerateProofs(bn bn128.Bn128, gt1 [][3]*big.Int, gt2 [][3][2]*big.Int, ax, bx, cx, hx, zx []*big.Int) ([3]*big.Int, [3][2]*big.Int, [3]*big.Int, [3]*big.Int, [3][2]*big.Int) { + + // multiply g1*A(x), g2*B(x), g1*C(x), g1*H(x) + + // g1*A(x) + g1At := [3]*big.Int{bn.G1.F.Zero(), bn.G1.F.Zero(), bn.G1.F.Zero()} + for i := 0; i < len(ax); i++ { + m := bn.G1.MulScalar(gt1[i], ax[i]) + g1At = bn.G1.Add(g1At, m) + } + g2Bt := bn.Fq6.Zero() + for i := 0; i < len(bx); i++ { + m := bn.G2.MulScalar(gt2[i], bx[i]) + g2Bt = bn.G2.Add(g2Bt, m) + } + + g1Ct := [3]*big.Int{bn.G1.F.Zero(), bn.G1.F.Zero(), bn.G1.F.Zero()} + for i := 0; i < len(cx); i++ { + m := bn.G1.MulScalar(gt1[i], cx[i]) + g1Ct = bn.G1.Add(g1Ct, m) + } + g1Ht := [3]*big.Int{bn.G1.F.Zero(), bn.G1.F.Zero(), bn.G1.F.Zero()} + for i := 0; i < len(hx); i++ { + m := bn.G1.MulScalar(gt1[i], hx[i]) + g1Ht = bn.G1.Add(g1Ht, m) + } + g2Zt := bn.Fq6.Zero() + for i := 0; i < len(bx); i++ { + m := bn.G2.MulScalar(gt2[i], zx[i]) + g2Zt = bn.G2.Add(g2Zt, m) + } + + return g1At, g2Bt, g1Ct, g1Ht, g2Zt +} diff --git a/zk/zk_test.go b/zk/zk_test.go new file mode 100644 index 0000000..a18fa82 --- /dev/null +++ b/zk/zk_test.go @@ -0,0 +1,96 @@ +package zk + +import ( + "fmt" + "math/big" + "testing" + + "github.com/arnaucube/go-snark/bn128" + "github.com/arnaucube/go-snark/fields" + "github.com/arnaucube/go-snark/r1csqap" + "github.com/stretchr/testify/assert" +) + +func TestZk(t *testing.T) { + bn, err := bn128.NewBn128() + assert.Nil(t, err) + + // new Finite Field + f := fields.NewFq(bn.R) + + // new Polynomial Field + pf := r1csqap.NewPolynomialField(f) + + b0 := big.NewInt(int64(0)) + b1 := big.NewInt(int64(1)) + b3 := big.NewInt(int64(3)) + b5 := big.NewInt(int64(5)) + b9 := big.NewInt(int64(9)) + b27 := big.NewInt(int64(27)) + b30 := big.NewInt(int64(30)) + b35 := big.NewInt(int64(35)) + a := [][]*big.Int{ + []*big.Int{b0, b1, b0, b0, b0, b0}, + []*big.Int{b0, b0, b0, b1, b0, b0}, + []*big.Int{b0, b1, b0, b0, b1, b0}, + []*big.Int{b5, b0, b0, b0, b0, b1}, + } + b := [][]*big.Int{ + []*big.Int{b0, b1, b0, b0, b0, b0}, + []*big.Int{b0, b1, b0, b0, b0, b0}, + []*big.Int{b1, b0, b0, b0, b0, b0}, + []*big.Int{b1, b0, b0, b0, b0, b0}, + } + c := [][]*big.Int{ + []*big.Int{b0, b0, b0, b1, b0, b0}, + []*big.Int{b0, b0, b0, b0, b1, b0}, + []*big.Int{b0, b0, b0, b0, b0, b1}, + []*big.Int{b0, b0, b1, b0, b0, b0}, + } + alphas, betas, gammas, zx := pf.R1CSToQAP(a, b, c) + + w := []*big.Int{b1, b3, b35, b9, b27, b30} + ax, bx, cx, px := pf.CombinePolynomials(w, alphas, betas, gammas) + + hx := pf.DivisorPolinomial(px, zx) + + // hx==px/zx so px==hx*zx + assert.Equal(t, px, pf.Mul(hx, zx)) + + // p(x) = a(x) * b(x) - c(x) == h(x) * z(x) + abc := pf.Sub(pf.Mul(ax, bx), cx) + assert.Equal(t, abc, px) + hz := pf.Mul(hx, zx) + assert.Equal(t, abc, hz) + + // calculate trusted setup + gt1, gt2, err := GenerateTrustedSetup(bn, len(ax)) + assert.Nil(t, err) + fmt.Println("trusted setup:") + fmt.Println(gt1) + fmt.Println(gt2) + + // piA = g1 * A(t), piB = g2 * B(t), piC = g1 * C(t), piH = g1 * H(t) + piA, piB, piC, piH, piZ := GenerateProofs(bn, gt1, gt2, ax, bx, cx, hx, zx) + fmt.Println("proofs:") + fmt.Println(piA) + fmt.Println(piB) + fmt.Println(piC) + fmt.Println(piH) + fmt.Println(piZ) + + // pairing + fmt.Println("pairing") + pairingAB, err := bn.Pairing(piA, piB) + assert.Nil(t, err) + pairingCg2, err := bn.Pairing(piC, bn.G2.G) + assert.Nil(t, err) + pairingLeft := bn.Fq12.Div(pairingAB, pairingCg2) + pairingHg2Z, err := bn.Pairing(piH, piZ) + assert.Nil(t, err) + + fmt.Println(bn.Fq12.Affine(pairingLeft)) + fmt.Println(bn.Fq12.Affine(pairingHg2Z)) + + assert.True(t, bn.Fq12.Equal(pairingLeft, pairingHg2Z)) +}