keccak-chain-sonobe

Repo showcasing usage of Sonobe with Circom circuits.

Proves a chain of keccak256 hashes, using the vocdoni/keccak256-circom circuit, with Nova+CycleFold.

The main idea is to prove z_n = H(H(...~H(H(H(z_0))))), where n is the number of Keccak256 hashes (H) that we compute. Proving this in a 'normal' R1CS circuit for a large n would be too costly, but with folding we can manage to prove it in a reasonable time span.

For more info about Sonobe, check out Sonobe's docs.

Usage

Assuming rust and circom have been installed:

• ./compile-circuit.sh
• cargo test --release -- --nocapture

Repo structure

• the Circom circuit to be folded is defined at ./circuit/keccak-chain.circom
• the logic to fold the circuit using Sonobe is defined at src/lib.rs
  • (it contains some extra sanity check that would not be needed in a real-world use case)