Browse Source
Add solidity verifier of the nova+cyclefold (#87)
* Add solidity verifier of the nova+cyclefold, and add method to prepare the calldata from Decider's proof. Missing conversion of the point coordinates into limbs (ark compatible) * chore: adding comments linking to the contract's signature * chore: update .gitignore * chore: add num-bigint as dev dependency * fix: work with abs path for storing generated sol code * chore: update comment * feat: solidity verifier working on single and multi-input circuits * feat: multi-input folding verification working + fixing encoding of additive identity in calldata * chore: make bigint a dependency * refactor: import utils functions from utils.rs and make them available from anywhere * chore: make utils and evm available publicly * fix: pub mod instead * chore: make relevant method public and add `get_decider_template_for_cyclefold_decider` to exported objects * solidity-verifiers: move tests to their corresponding files * small update: Cyclefold -> CycleFold at the missing places * abstract nova-cyclefold solidity verifiers tests to avoid code duplication, and abstract also the computed setup params (FS & Decider) to compute them only once for all related tests to save test time * small polish after rebase to last main branch changes * rm unneeded Option for KZGData::g1_crs_batch_points * add checks modifying z_0 & z_i to nova_cyclefold_solidity_verifier test * add light-test feature to decider_eth_circuit to use it in solidity-verifier tests without the big circuit * solidity-verifiers: groth16 template: port the fix from https://github.com/iden3/snarkjs/pull/480 & https://github.com/iden3/snarkjs/issues/479 * add print warning msg for light-test in DeciderEthCircuit * solidity-verifiers: update limbs logic to nonnative last version, parametrize limbs params solidity-verifiers: * update solidity limbs logic to last nonnative impl version, and to last u_i.x impl * parametrize limbs params * add light-test feature: replace the '#[cfg(not(test))]' by the 'light-test' feature that by default is not enabled, so when running the github actions we enable the feature 'light-tests', and then we can have a full-test that runs the test without the 'light-tests' flag, but we don't run this big test every time. The choice of a feature is to allow us to control this from other-crates tests (for example for the solidity-verifier separated crate tests, to avoid running the full heavy circuit in the solidity tests) * move solidity constants into template constants for auto compute of params * polishing * revm use only needed feature This is to avoid c depencency for c-kzg which is behind the c-kzg flag and not needed. * nova_cyclefold_decider.sol header * rearrange test helpers position, add error for min number of steps * in solidity-verifiers: 'data'->'vk/verifier key' * add From for NovaCycleFoldVerifierKey from original vks to simplify dev flow, also conditionally template the batchCheck related structs and methods from the KZG10 solidity template --------- Co-authored-by: dmpierre <pdaixmoreux@gmail.com>main
GitHub
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
24 changed files with 1020 additions and 483 deletions
Unified View
Diff Options
-
+2 -2.github/workflows/ci.yml
-
+1 -0.gitignore
-
+6 -29cli/README.md
-
+2 -2cli/src/main.rs
-
+20 -17cli/src/settings.rs
-
+3 -1folding-schemes/Cargo.toml
-
+1 -1folding-schemes/src/folding/circuits/nonnative/uint.rs
-
+1 -1folding-schemes/src/folding/hypernova/utils.rs
-
+86 -6folding-schemes/src/folding/nova/decider_eth.rs
-
+6 -2folding-schemes/src/folding/nova/decider_eth_circuit.rs
-
+1 -1folding-schemes/src/folding/protogalaxy/folding.rs
-
+25 -4folding-schemes/src/lib.rs
-
+1 -1folding-schemes/src/utils/espresso/sum_check/verifier.rs
-
+8 -4solidity-verifiers/Cargo.toml
-
+15 -9solidity-verifiers/src/evm.rs
-
+7 -5solidity-verifiers/src/lib.rs
-
+28 -2solidity-verifiers/src/utils/mod.rs
-
+88 -14solidity-verifiers/src/verifiers/g16.rs
-
+126 -12solidity-verifiers/src/verifiers/kzg.rs
-
+25 -331solidity-verifiers/src/verifiers/mod.rs
-
+410 -23solidity-verifiers/src/verifiers/nova_cyclefold.rs
-
+2 -2solidity-verifiers/templates/groth16_verifier.askama.sol
-
+4 -0solidity-verifiers/templates/kzg10_verifier.askama.sol
-
+152 -14solidity-verifiers/templates/nova_cyclefold_decider.askama.sol
@ -1,7 +1,9 @@ |
|||||
#[cfg(test)]
|
|
||||
mod evm;
|
|
||||
mod utils;
|
|
||||
mod verifiers;
|
|
||||
|
pub mod evm;
|
||||
|
pub mod utils;
|
||||
|
pub mod verifiers;
|
||||
|
|
||||
pub use verifiers::*;
|
pub use verifiers::*;
|
||||
pub use verifiers::{Groth16Data, KzgData, NovaCyclefoldData, ProtocolData};
|
|
||||
|
pub use verifiers::{
|
||||
|
get_decider_template_for_cyclefold_decider, Groth16VerifierKey, KZG10VerifierKey,
|
||||
|
NovaCycleFoldVerifierKey, ProtocolVerifierKey,
|
||||
|
};
|
||||
@ -1,24 +1,162 @@ |
|||||
{{ groth16_verifier }} |
|
||||
|
/* |
||||
|
Sonobe's Nova + CycleFold decider verifier. |
||||
|
Joint effort by 0xPARC & PSE. |
||||
|
|
||||
|
More details at https://github.com/privacy-scaling-explorations/sonobe |
||||
|
Usage and design documentation at https://privacy-scaling-explorations.github.io/sonobe-docs/ |
||||
|
|
||||
|
Uses the https://github.com/iden3/snarkjs/blob/master/templates/verifier_groth16.sol.ejs |
||||
|
Groth16 verifier implementation and a KZG10 Solidity template adapted from |
||||
|
https://github.com/weijiekoh/libkzg. |
||||
|
Additionally we implement the NovaDecider contract, which combines the |
||||
|
Groth16 and KZG10 verifiers to verify the zkSNARK proofs coming from |
||||
|
Nova+CycleFold folding. |
||||
|
*/ |
||||
|
|
||||
|
|
||||
|
/* =============================== */ |
||||
|
/* KZG10 verifier methods */ |
||||
{{ kzg10_verifier }} |
{{ kzg10_verifier }} |
||||
|
|
||||
|
/* =============================== */ |
||||
|
/* Groth16 verifier methods */ |
||||
|
{{ groth16_verifier }} |
||||
|
|
||||
|
|
||||
|
/* =============================== */ |
||||
|
/* Nova+CycleFold Decider verifier */ |
||||
|
/** |
||||
|
* @notice Computes the decomposition of a `uint256` into num_limbs limbs of bits_per_limb bits each. |
||||
|
* @dev Compatible with sonobe::folding-schemes::folding::circuits::nonnative::nonnative_field_to_field_elements. |
||||
|
*/ |
||||
|
library LimbsDecomposition { |
||||
|
function decompose(uint256 x) internal pure returns (uint256[{{num_limbs}}] memory) { |
||||
|
uint256[{{num_limbs}}] memory limbs; |
||||
|
for (uint8 i = 0; i < {{num_limbs}}; i++) { |
||||
|
limbs[i] = (x >> ({{bits_per_limb}} * i)) & ((1 << {{bits_per_limb}}) - 1); |
||||
|
} |
||||
|
return limbs; |
||||
|
} |
||||
|
} |
||||
|
|
||||
/** |
/** |
||||
* @author PSE & 0xPARC |
* @author PSE & 0xPARC |
||||
* @title NovaDecider contract, for verifying zk-snarks Nova IVC proofs. |
|
||||
* @dev This is an askama template. It will feature a snarkjs groth16 and a kzg10 verifier, from which this contract inherits. |
|
||||
* WARNING: This contract is not complete nor finished. It lacks checks to ensure that no soundness issues can happen. |
|
||||
* Indeed, we know some of the checks that are missing. And we're working on the solution |
|
||||
* but for now, it's good enough for testing and benchmarking. |
|
||||
|
* @title NovaDecider contract, for verifying Nova IVC SNARK proofs. |
||||
|
* @dev This is an askama template which, when templated, features a Groth16 and KZG10 verifiers from which this contract inherits. |
||||
*/ |
*/ |
||||
contract NovaDecider is Groth16Verifier, KZG10Verifier { |
contract NovaDecider is Groth16Verifier, KZG10Verifier { |
||||
function verifyProof(uint[2] calldata _pA, uint[2][2] calldata _pB, uint[2] calldata _pC, uint[1] calldata _pubSignals, uint256[2] calldata c, uint256[2] calldata pi, uint256 x, uint256 y) public view returns (bool) { |
|
||||
bool success_kzg = super.check(c, pi, x, y); |
|
||||
require(success_kzg == true, "KZG Failed"); |
|
||||
|
/** |
||||
|
* @notice Computes the linear combination of a and b with r as the coefficient. |
||||
|
* @dev All ops are done mod the BN254 scalar field prime |
||||
|
*/ |
||||
|
function rlc(uint256 a, uint256 r, uint256 b) internal pure returns (uint256 result) { |
||||
|
assembly { |
||||
|
result := addmod(a, mulmod(r, b, BN254_SCALAR_FIELD), BN254_SCALAR_FIELD) |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
/** |
||||
|
* @notice Verifies a nova cyclefold proof consisting of two KZG proofs and of a groth16 proof. |
||||
|
* @dev The selector of this function is "dynamic", since it depends on `z_len`. |
||||
|
*/ |
||||
|
function verifyNovaProof( |
||||
|
// inputs are grouped to prevent errors due stack too deep |
||||
|
uint256[{{ 1 + z_len * 2 }}] calldata i_z0_zi, // [i, z0, zi] where |z0| == |zi| |
||||
|
uint256[4] calldata U_i_cmW_U_i_cmE, // [U_i_cmW[2], U_i_cmE[2]] |
||||
|
uint256[3] calldata U_i_u_u_i_u_r, // [U_i_u, u_i_u, r] |
||||
|
uint256[4] calldata U_i_x_u_i_cmW, // [U_i_x[2], u_i_cmW[2]] |
||||
|
uint256[4] calldata u_i_x_cmT, // [u_i_x[2], cmT[2]] |
||||
|
uint256[2] calldata pA, // groth16 |
||||
|
uint256[2][2] calldata pB, // groth16 |
||||
|
uint256[2] calldata pC, // groth16 |
||||
|
uint256[4] calldata challenge_W_challenge_E_kzg_evals, // [challenge_W, challenge_E, eval_W, eval_E] |
||||
|
uint256[2][2] calldata kzg_proof // [proof_W, proof_E] |
||||
|
) public view returns (bool) { |
||||
|
|
||||
|
require(i_z0_zi[0] >= 2, "Folding: the number of folded steps should be at least 2"); |
||||
|
|
||||
|
// from gamma_abc_len, we subtract 1. |
||||
|
uint256[{{ public_inputs_len - 1 }}] memory public_inputs; |
||||
|
|
||||
|
public_inputs[0] = i_z0_zi[0]; |
||||
|
|
||||
|
for (uint i = 0; i < {{ z_len * 2 }}; i++) { |
||||
|
public_inputs[1 + i] = i_z0_zi[1 + i]; |
||||
|
} |
||||
|
|
||||
|
{ |
||||
|
// U_i.u + r * u_i.u |
||||
|
uint256 u = rlc(U_i_u_u_i_u_r[0], U_i_u_u_i_u_r[2], U_i_u_u_i_u_r[1]); |
||||
|
// U_i.x + r * u_i.x |
||||
|
uint256 x0 = rlc(U_i_x_u_i_cmW[0], U_i_u_u_i_u_r[2], u_i_x_cmT[0]); |
||||
|
uint256 x1 = rlc(U_i_x_u_i_cmW[1], U_i_u_u_i_u_r[2], u_i_x_cmT[1]); |
||||
|
|
||||
|
public_inputs[{{ z_len * 2 + 1 }}] = u; |
||||
|
public_inputs[{{ z_len * 2 + 2 }}] = x0; |
||||
|
public_inputs[{{ z_len * 2 + 3 }}] = x1; |
||||
|
} |
||||
|
|
||||
|
{ |
||||
|
// U_i.cmE + r * u_i.cmT |
||||
|
uint256[2] memory mulScalarPoint = super.mulScalar([u_i_x_cmT[2], u_i_x_cmT[3]], U_i_u_u_i_u_r[2]); |
||||
|
uint256[2] memory cmE = super.add([U_i_cmW_U_i_cmE[2], U_i_cmW_U_i_cmE[3]], mulScalarPoint); |
||||
|
|
||||
|
{ |
||||
|
uint256[{{num_limbs}}] memory cmE_x_limbs = LimbsDecomposition.decompose(cmE[0]); |
||||
|
uint256[{{num_limbs}}] memory cmE_y_limbs = LimbsDecomposition.decompose(cmE[1]); |
||||
|
|
||||
|
for (uint8 k = 0; k < {{num_limbs}}; k++) { |
||||
|
public_inputs[{{ z_len * 2 + 4 }} + k] = cmE_x_limbs[k]; |
||||
|
public_inputs[{{ z_len * 2 + 4 + num_limbs }} + k] = cmE_y_limbs[k]; |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
require(this.check(cmE, kzg_proof[1], challenge_W_challenge_E_kzg_evals[1], challenge_W_challenge_E_kzg_evals[3]), "KZG: verifying proof for challenge E failed"); |
||||
|
} |
||||
|
|
||||
|
{ |
||||
|
// U_i.cmW + r * u_i.cmW |
||||
|
uint256[2] memory mulScalarPoint = super.mulScalar([U_i_x_u_i_cmW[2], U_i_x_u_i_cmW[3]], U_i_u_u_i_u_r[2]); |
||||
|
uint256[2] memory cmW = super.add([U_i_cmW_U_i_cmE[0], U_i_cmW_U_i_cmE[1]], mulScalarPoint); |
||||
|
|
||||
|
{ |
||||
|
uint256[{{num_limbs}}] memory cmW_x_limbs = LimbsDecomposition.decompose(cmW[0]); |
||||
|
uint256[{{num_limbs}}] memory cmW_y_limbs = LimbsDecomposition.decompose(cmW[1]); |
||||
|
|
||||
|
for (uint8 k = 0; k < {{num_limbs}}; k++) { |
||||
|
public_inputs[{{ z_len * 2 + 4 + num_limbs * 2 }} + k] = cmW_x_limbs[k]; |
||||
|
public_inputs[{{ z_len * 2 + 4 + num_limbs * 3 }} + k] = cmW_y_limbs[k]; |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
require(this.check(cmW, kzg_proof[0], challenge_W_challenge_E_kzg_evals[0], challenge_W_challenge_E_kzg_evals[2]), "KZG: verifying proof for challenge W failed"); |
||||
|
} |
||||
|
|
||||
|
{ |
||||
|
// add challenges |
||||
|
public_inputs[{{ z_len * 2 + 4 + num_limbs * 4 }}] = challenge_W_challenge_E_kzg_evals[0]; |
||||
|
public_inputs[{{ z_len * 2 + 4 + num_limbs * 4 + 1 }}] = challenge_W_challenge_E_kzg_evals[1]; |
||||
|
public_inputs[{{ z_len * 2 + 4 + num_limbs * 4 + 2 }}] = challenge_W_challenge_E_kzg_evals[2]; |
||||
|
public_inputs[{{ z_len * 2 + 4 + num_limbs * 4 + 3 }}] = challenge_W_challenge_E_kzg_evals[3]; |
||||
|
|
||||
|
uint256[{{num_limbs}}] memory cmT_x_limbs; |
||||
|
uint256[{{num_limbs}}] memory cmT_y_limbs; |
||||
|
|
||||
|
cmT_x_limbs = LimbsDecomposition.decompose(u_i_x_cmT[2]); |
||||
|
cmT_y_limbs = LimbsDecomposition.decompose(u_i_x_cmT[3]); |
||||
|
|
||||
|
for (uint8 k = 0; k < {{num_limbs}}; k++) { |
||||
|
public_inputs[{{ z_len * 2 + 4 + num_limbs * 4 }} + 4 + k] = cmT_x_limbs[k]; |
||||
|
public_inputs[{{ z_len * 2 + 4 + num_limbs * 5}} + 4 + k] = cmT_y_limbs[k]; |
||||
|
} |
||||
|
|
||||
// for now, we do not relate the Groth16 and KZG10 proofs |
|
||||
bool success_g16 = super.verifyProof(_pA, _pB, _pC, _pubSignals); |
|
||||
require(success_g16 == true, "G16 Failed"); |
|
||||
|
// last element of the groth16 proof's public inputs is `r` |
||||
|
public_inputs[{{ public_inputs_len - 2 }}] = U_i_u_u_i_u_r[2]; |
||||
|
|
||||
|
bool success_g16 = this.verifyProof(pA, pB, pC, public_inputs); |
||||
|
require(success_g16 == true, "Groth16: verifying proof failed"); |
||||
|
} |
||||
|
|
||||
return(true); |
return(true); |
||||
} |
|
||||
} |
|
||||
|
} |
||||
|
} |
||||