Browse Source
Implement CycleFold in Nova's IVC (#45)
* Implement CycleFold in Nova's IVC (CycleFold: https://eprint.iacr.org/2023/1192) * CycleFoldChallengeGadget: add points coordinates as bytes * Apply PR review suggestionsupdate-nifs-interface
GitHub
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
17 changed files with 1320 additions and 559 deletions
Split View
Diff Options
-
+2 -2Cargo.toml
-
+1 -1src/ccs/mod.rs
-
+8 -8src/ccs/r1cs.rs
-
+5 -3src/constants.rs
-
+0 -65src/folding/circuits/cyclefold.rs
-
+0 -1src/folding/circuits/mod.rs
-
+5 -7src/folding/circuits/nonnative.rs
-
+342 -296src/folding/nova/circuits.rs
-
+566 -0src/folding/nova/cyclefold.rs
-
+231 -74src/folding/nova/ivc.rs
-
+8 -5src/folding/nova/mod.rs
-
+118 -82src/folding/nova/nifs.rs
-
+9 -0src/frontend/arkworks/mod.rs
-
+5 -1src/lib.rs
-
+3 -1src/pedersen.rs
-
+4 -6src/transcript/poseidon.rs
-
+13 -7src/utils/vec.rs
@ -1,3 +1,5 @@ |
|||
// used for committed instances hash, so when going to the other curve of the cycle it does not
|
|||
// overflow the scalar field
|
|||
pub const N_BITS_HASH: usize = 250;
|
|||
// used for the RO challenges.
|
|||
// From [Srinath Setty](research.microsoft.com/en-us/people/srinath/): In Nova, soundness error ≤
|
|||
// 2/|S|, where S is the subset of the field F from which the challenges are drawn. In this case,
|
|||
// we keep the size of S close to 2^128.
|
|||
pub const N_BITS_RO: usize = 128;
|
|||
@ -1,65 +0,0 @@ |
|||
/// Implements the C_{EC} circuit described in [CycleFold paper](https://eprint.iacr.org/2023/1192.pdf)
|
|||
use ark_ec::CurveGroup;
|
|||
use ark_r1cs_std::{boolean::Boolean, prelude::CurveVar};
|
|||
use ark_relations::r1cs::SynthesisError;
|
|||
use core::marker::PhantomData;
|
|||
|
|||
use super::CF;
|
|||
|
|||
/// ECRLC implements gadget that checks the Elliptic Curve points RandomLinearCombination described
|
|||
/// in [CycleFold](https://eprint.iacr.org/2023/1192.pdf).
|
|||
#[derive(Debug)]
|
|||
pub struct ECRLC<C: CurveGroup, GC: CurveVar<C, CF<C>>> {
|
|||
_c: PhantomData<C>,
|
|||
_gc: PhantomData<GC>,
|
|||
}
|
|||
impl<C: CurveGroup, GC: CurveVar<C, CF<C>>> ECRLC<C, GC> {
|
|||
pub fn check(
|
|||
// get r in bits format, so it can be reused across many instances of ECRLC gadget,
|
|||
// reducing the number of constraints needed
|
|||
r_bits: Vec<Boolean<CF<C>>>,
|
|||
p1: GC,
|
|||
p2: GC,
|
|||
p3: GC,
|
|||
) -> Result<Boolean<CF<C>>, SynthesisError> {
|
|||
p3.is_eq(&(p1 + p2.scalar_mul_le(r_bits.iter())?))
|
|||
}
|
|||
}
|
|||
|
|||
#[cfg(test)]
|
|||
mod tests {
|
|||
use super::*;
|
|||
use ark_ff::{BigInteger, PrimeField};
|
|||
use ark_pallas::{constraints::GVar, Fq, Fr, Projective};
|
|||
use ark_r1cs_std::{alloc::AllocVar, eq::EqGadget};
|
|||
use ark_relations::r1cs::ConstraintSystem;
|
|||
use ark_std::UniformRand;
|
|||
use std::ops::Mul;
|
|||
|
|||
/// Let Curve1=pallas and Curve2=vesta. Here our constraints system will work over Curve2::Fr =
|
|||
/// vesta::Fr (=pallas::Fq), thus our points are P_i \in Curve1 (=pasta).
|
|||
#[test]
|
|||
fn test_ecrlc_check() {
|
|||
let mut rng = ark_std::test_rng();
|
|||
|
|||
let r = Fr::rand(&mut rng);
|
|||
let p1 = Projective::rand(&mut rng);
|
|||
let p2 = Projective::rand(&mut rng);
|
|||
let p3 = p1 + p2.mul(r);
|
|||
|
|||
let cs = ConstraintSystem::<Fq>::new_ref(); // CS over Curve2::Fr = Curve1::Fq
|
|||
|
|||
// prepare circuit inputs
|
|||
let rbitsVar: Vec<Boolean<Fq>> =
|
|||
Vec::new_witness(cs.clone(), || Ok(r.into_bigint().to_bits_le())).unwrap();
|
|||
|
|||
let p1Var = GVar::new_witness(cs.clone(), || Ok(p1)).unwrap();
|
|||
let p2Var = GVar::new_witness(cs.clone(), || Ok(p2)).unwrap();
|
|||
let p3Var = GVar::new_witness(cs.clone(), || Ok(p3)).unwrap();
|
|||
|
|||
// check ECRLC circuit
|
|||
let check_pass = ECRLC::<Projective, GVar>::check(rbitsVar, p1Var, p2Var, p3Var).unwrap();
|
|||
check_pass.enforce_equal(&Boolean::<Fq>::TRUE).unwrap();
|
|||
assert!(cs.is_satisfied().unwrap());
|
|||
}
|
|||
}
|
|||
@ -0,0 +1,566 @@ |
|||
/// contains [CycleFold](https://eprint.iacr.org/2023/1192.pdf) related circuits
|
|||
use ark_crypto_primitives::sponge::{
|
|||
constraints::CryptographicSpongeVar,
|
|||
poseidon::{constraints::PoseidonSpongeVar, PoseidonConfig, PoseidonSponge},
|
|||
Absorb, CryptographicSponge,
|
|||
};
|
|||
use ark_ec::CurveGroup;
|
|||
use ark_ff::PrimeField;
|
|||
use ark_r1cs_std::{
|
|||
alloc::{AllocVar, AllocationMode},
|
|||
bits::uint8::UInt8,
|
|||
boolean::Boolean,
|
|||
eq::EqGadget,
|
|||
fields::{fp::FpVar, nonnative::NonNativeFieldVar},
|
|||
groups::GroupOpsBounds,
|
|||
prelude::CurveVar,
|
|||
ToBytesGadget,
|
|||
};
|
|||
use ark_relations::r1cs::{ConstraintSynthesizer, ConstraintSystemRef, Namespace, SynthesisError};
|
|||
use ark_serialize::CanonicalSerialize;
|
|||
use ark_std::fmt::Debug;
|
|||
use ark_std::Zero;
|
|||
use core::{borrow::Borrow, marker::PhantomData};
|
|||
|
|||
use super::circuits::CF2;
|
|||
use super::CommittedInstance;
|
|||
use crate::constants::N_BITS_RO;
|
|||
use crate::Error;
|
|||
|
|||
// publi inputs length for the CycleFoldCircuit, |[u_i, U_i, U_{i+1}]|
|
|||
pub const CF_IO_LEN: usize = 12;
|
|||
|
|||
/// CycleFoldCommittedInstanceVar is the CycleFold CommittedInstance representation in the Nova
|
|||
/// circuit.
|
|||
#[derive(Debug, Clone)]
|
|||
pub struct CycleFoldCommittedInstanceVar<C: CurveGroup, GC: CurveVar<C, CF2<C>>>
|
|||
where
|
|||
for<'a> &'a GC: GroupOpsBounds<'a, C, GC>,
|
|||
{
|
|||
_c: PhantomData<C>,
|
|||
pub cmE: GC,
|
|||
pub u: NonNativeFieldVar<C::ScalarField, CF2<C>>,
|
|||
pub cmW: GC,
|
|||
pub x: Vec<NonNativeFieldVar<C::ScalarField, CF2<C>>>,
|
|||
}
|
|||
impl<C, GC> AllocVar<CommittedInstance<C>, CF2<C>> for CycleFoldCommittedInstanceVar<C, GC>
|
|||
where
|
|||
C: CurveGroup,
|
|||
GC: CurveVar<C, CF2<C>>,
|
|||
<C as ark_ec::CurveGroup>::BaseField: ark_ff::PrimeField,
|
|||
for<'a> &'a GC: GroupOpsBounds<'a, C, GC>,
|
|||
{
|
|||
fn new_variable<T: Borrow<CommittedInstance<C>>>(
|
|||
cs: impl Into<Namespace<CF2<C>>>,
|
|||
f: impl FnOnce() -> Result<T, SynthesisError>,
|
|||
mode: AllocationMode,
|
|||
) -> Result<Self, SynthesisError> {
|
|||
f().and_then(|val| {
|
|||
let cs = cs.into();
|
|||
|
|||
let cmE = GC::new_variable(cs.clone(), || Ok(val.borrow().cmE), mode)?;
|
|||
let cmW = GC::new_variable(cs.clone(), || Ok(val.borrow().cmW), mode)?;
|
|||
let u = NonNativeFieldVar::<C::ScalarField, CF2<C>>::new_variable(
|
|||
cs.clone(),
|
|||
|| Ok(val.borrow().u),
|
|||
mode,
|
|||
)?;
|
|||
let x = Vec::<NonNativeFieldVar<C::ScalarField, CF2<C>>>::new_variable(
|
|||
cs.clone(),
|
|||
|| Ok(val.borrow().x.clone()),
|
|||
mode,
|
|||
)?;
|
|||
|
|||
Ok(Self {
|
|||
_c: PhantomData,
|
|||
cmE,
|
|||
u,
|
|||
cmW,
|
|||
x,
|
|||
})
|
|||
})
|
|||
}
|
|||
}
|
|||
|
|||
/// CommittedInstanceInCycleFoldVar represents the Nova CommittedInstance in the CycleFold circuit,
|
|||
/// where the commitments to E and W (cmW and cmW) from the CommittedInstance on the E2,
|
|||
/// represented as native points, which are folded on the auxiliary curve constraints field (E2::Fr
|
|||
/// = E1::Fq).
|
|||
#[derive(Debug, Clone)]
|
|||
pub struct CommittedInstanceInCycleFoldVar<C: CurveGroup, GC: CurveVar<C, CF2<C>>>
|
|||
where
|
|||
for<'a> &'a GC: GroupOpsBounds<'a, C, GC>,
|
|||
{
|
|||
_c: PhantomData<C>,
|
|||
pub cmE: GC,
|
|||
pub cmW: GC,
|
|||
}
|
|||
|
|||
impl<C, GC> AllocVar<CommittedInstance<C>, CF2<C>> for CommittedInstanceInCycleFoldVar<C, GC>
|
|||
where
|
|||
C: CurveGroup,
|
|||
GC: CurveVar<C, CF2<C>>,
|
|||
for<'a> &'a GC: GroupOpsBounds<'a, C, GC>,
|
|||
{
|
|||
fn new_variable<T: Borrow<CommittedInstance<C>>>(
|
|||
cs: impl Into<Namespace<CF2<C>>>,
|
|||
f: impl FnOnce() -> Result<T, SynthesisError>,
|
|||
mode: AllocationMode,
|
|||
) -> Result<Self, SynthesisError> {
|
|||
f().and_then(|val| {
|
|||
let cs = cs.into();
|
|||
|
|||
let cmE = GC::new_variable(cs.clone(), || Ok(val.borrow().cmE), mode)?;
|
|||
let cmW = GC::new_variable(cs.clone(), || Ok(val.borrow().cmW), mode)?;
|
|||
|
|||
Ok(Self {
|
|||
_c: PhantomData,
|
|||
cmE,
|
|||
cmW,
|
|||
})
|
|||
})
|
|||
}
|
|||
}
|
|||
|
|||
/// NIFSinCycleFoldGadget performs the Nova NIFS.V elliptic curve points relation checks in the other
|
|||
/// curve (natively) following [CycleFold](https://eprint.iacr.org/2023/1192.pdf).
|
|||
pub struct NIFSinCycleFoldGadget<C: CurveGroup, GC: CurveVar<C, CF2<C>>> {
|
|||
_c: PhantomData<C>,
|
|||
_gc: PhantomData<GC>,
|
|||
}
|
|||
impl<C: CurveGroup, GC: CurveVar<C, CF2<C>>> NIFSinCycleFoldGadget<C, GC>
|
|||
where
|
|||
C: CurveGroup,
|
|||
GC: CurveVar<C, CF2<C>>,
|
|||
<C as ark_ec::CurveGroup>::BaseField: ark_ff::PrimeField,
|
|||
for<'a> &'a GC: GroupOpsBounds<'a, C, GC>,
|
|||
{
|
|||
pub fn verify(
|
|||
r_bits: Vec<Boolean<CF2<C>>>,
|
|||
cmT: GC,
|
|||
ci1: CommittedInstanceInCycleFoldVar<C, GC>,
|
|||
ci2: CommittedInstanceInCycleFoldVar<C, GC>,
|
|||
ci3: CommittedInstanceInCycleFoldVar<C, GC>,
|
|||
) -> Result<Boolean<CF2<C>>, SynthesisError> {
|
|||
// cm(E) check: ci3.cmE == ci1.cmE + r * cmT + r^2 * ci2.cmE
|
|||
let first_check = ci3.cmE.is_eq(
|
|||
&((ci2.cmE.scalar_mul_le(r_bits.iter())? + cmT).scalar_mul_le(r_bits.iter())?
|
|||
+ ci1.cmE),
|
|||
)?;
|
|||
// cm(W) check: ci3.cmW == ci1.cmW + r * ci2.cmW
|
|||
let second_check = ci3
|
|||
.cmW
|
|||
.is_eq(&(ci1.cmW + ci2.cmW.scalar_mul_le(r_bits.iter())?))?;
|
|||
|
|||
first_check.and(&second_check)
|
|||
}
|
|||
}
|
|||
|
|||
/// This is the gadget used in the AugmentedFCircuit to verify the CycleFold instances folding,
|
|||
/// which checks the correct RLC of u,x,cmE,cmW (hence the name containing 'Full', since it checks
|
|||
/// all the RLC values, not only the native ones). It assumes that ci2.cmE=0, ci2.u=1.
|
|||
pub struct NIFSFullGadget<C: CurveGroup, GC: CurveVar<C, CF2<C>>> {
|
|||
_c: PhantomData<C>,
|
|||
_gc: PhantomData<GC>,
|
|||
}
|
|||
impl<C: CurveGroup, GC: CurveVar<C, CF2<C>>> NIFSFullGadget<C, GC>
|
|||
where
|
|||
C: CurveGroup,
|
|||
GC: CurveVar<C, CF2<C>>,
|
|||
<C as ark_ec::CurveGroup>::BaseField: ark_ff::PrimeField,
|
|||
for<'a> &'a GC: GroupOpsBounds<'a, C, GC>,
|
|||
{
|
|||
pub fn verify(
|
|||
r_bits: Vec<Boolean<CF2<C>>>,
|
|||
r_nonnat: NonNativeFieldVar<C::ScalarField, CF2<C>>,
|
|||
cmT: GC,
|
|||
// ci1 is assumed to be always with cmE=0, u=1 (checks done previous to this method)
|
|||
ci1: CycleFoldCommittedInstanceVar<C, GC>,
|
|||
ci2: CycleFoldCommittedInstanceVar<C, GC>,
|
|||
ci3: CycleFoldCommittedInstanceVar<C, GC>,
|
|||
) -> Result<Boolean<CF2<C>>, SynthesisError> {
|
|||
// cm(E) check: ci3.cmE == ci1.cmE + r * cmT (ci2.cmE=0)
|
|||
let first_check = ci3
|
|||
.cmE
|
|||
.is_eq(&(cmT.scalar_mul_le(r_bits.iter())? + ci1.cmE))?;
|
|||
|
|||
// cm(W) check: ci3.cmW == ci1.cmW + r * ci2.cmW
|
|||
let second_check = ci3
|
|||
.cmW
|
|||
.is_eq(&(ci1.cmW + ci2.cmW.scalar_mul_le(r_bits.iter())?))?;
|
|||
|
|||
let u_rlc: NonNativeFieldVar<C::ScalarField, CF2<C>> = ci1.u + r_nonnat.clone();
|
|||
let third_check = u_rlc.is_eq(&ci3.u)?;
|
|||
|
|||
// ensure that: ci3.x == ci1.x + r * ci2.x
|
|||
let x_rlc: Vec<NonNativeFieldVar<C::ScalarField, CF2<C>>> = ci1
|
|||
.x
|
|||
.iter()
|
|||
.zip(ci2.x)
|
|||
.map(|(a, b)| a + &r_nonnat * &b)
|
|||
.collect::<Vec<NonNativeFieldVar<C::ScalarField, CF2<C>>>>();
|
|||
let fourth_check = x_rlc.is_eq(&ci3.x)?;
|
|||
|
|||
first_check
|
|||
.and(&second_check)?
|
|||
.and(&third_check)?
|
|||
.and(&fourth_check)
|
|||
}
|
|||
}
|
|||
|
|||
/// ChallengeGadget computes the RO challenge used for the CycleFold instances NIFS, it contains a
|
|||
/// rust-native and a in-circuit compatible versions.
|
|||
pub struct CycleFoldChallengeGadget<C: CurveGroup, GC: CurveVar<C, CF2<C>>> {
|
|||
_c: PhantomData<C>, // Nova's Curve2, the one used for the CycleFold circuit
|
|||
_gc: PhantomData<GC>,
|
|||
}
|
|||
impl<C, GC> CycleFoldChallengeGadget<C, GC>
|
|||
where
|
|||
C: CurveGroup,
|
|||
GC: CurveVar<C, CF2<C>>,
|
|||
<C as CurveGroup>::BaseField: PrimeField,
|
|||
<C as CurveGroup>::BaseField: Absorb,
|
|||
for<'a> &'a GC: GroupOpsBounds<'a, C, GC>,
|
|||
{
|
|||
pub fn get_challenge_native(
|
|||
poseidon_config: &PoseidonConfig<C::BaseField>,
|
|||
u_i: CommittedInstance<C>,
|
|||
U_i: CommittedInstance<C>,
|
|||
cmT: C,
|
|||
) -> Result<Vec<bool>, Error> {
|
|||
let mut sponge = PoseidonSponge::<C::BaseField>::new(poseidon_config);
|
|||
|
|||
let u_i_cmE_bytes = point_to_bytes(u_i.cmE);
|
|||
let u_i_cmW_bytes = point_to_bytes(u_i.cmW);
|
|||
let U_i_cmE_bytes = point_to_bytes(U_i.cmE);
|
|||
let U_i_cmW_bytes = point_to_bytes(U_i.cmW);
|
|||
let cmT_bytes = point_to_bytes(cmT);
|
|||
|
|||
let mut u_i_u_bytes = Vec::new();
|
|||
u_i.u.serialize_uncompressed(&mut u_i_u_bytes)?;
|
|||
let mut u_i_x_bytes = Vec::new();
|
|||
u_i.x.serialize_uncompressed(&mut u_i_x_bytes)?;
|
|||
u_i_x_bytes = u_i_x_bytes[8..].to_vec();
|
|||
let mut U_i_u_bytes = Vec::new();
|
|||
U_i.u.serialize_uncompressed(&mut U_i_u_bytes)?;
|
|||
let mut U_i_x_bytes = Vec::new();
|
|||
U_i.x.serialize_uncompressed(&mut U_i_x_bytes)?;
|
|||
U_i_x_bytes = U_i_x_bytes[8..].to_vec();
|
|||
|
|||
let input: Vec<u8> = [
|
|||
u_i_cmE_bytes,
|
|||
u_i_u_bytes,
|
|||
u_i_cmW_bytes,
|
|||
u_i_x_bytes,
|
|||
U_i_cmE_bytes,
|
|||
U_i_u_bytes,
|
|||
U_i_cmW_bytes,
|
|||
U_i_x_bytes,
|
|||
cmT_bytes,
|
|||
]
|
|||
.concat();
|
|||
sponge.absorb(&input);
|
|||
let bits = sponge.squeeze_bits(N_BITS_RO);
|
|||
Ok(bits)
|
|||
}
|
|||
// compatible with the native get_challenge_native
|
|||
pub fn get_challenge_gadget(
|
|||
cs: ConstraintSystemRef<C::BaseField>,
|
|||
poseidon_config: &PoseidonConfig<C::BaseField>,
|
|||
u_i: CycleFoldCommittedInstanceVar<C, GC>,
|
|||
U_i: CycleFoldCommittedInstanceVar<C, GC>,
|
|||
cmT: GC,
|
|||
) -> Result<Vec<Boolean<C::BaseField>>, SynthesisError> {
|
|||
let mut sponge = PoseidonSpongeVar::<C::BaseField>::new(cs, poseidon_config);
|
|||
|
|||
let u_i_x_bytes: Vec<UInt8<CF2<C>>> = u_i
|
|||
.x
|
|||
.iter()
|
|||
.flat_map(|e| e.to_bytes().unwrap_or(vec![]))
|
|||
.collect::<Vec<UInt8<CF2<C>>>>();
|
|||
let U_i_x_bytes: Vec<UInt8<CF2<C>>> = U_i
|
|||
.x
|
|||
.iter()
|
|||
.flat_map(|e| e.to_bytes().unwrap_or(vec![]))
|
|||
.collect::<Vec<UInt8<CF2<C>>>>();
|
|||
|
|||
let input: Vec<UInt8<CF2<C>>> = [
|
|||
u_i.cmE.to_bytes()?,
|
|||
u_i.u.to_bytes()?,
|
|||
u_i.cmW.to_bytes()?,
|
|||
u_i_x_bytes,
|
|||
U_i.cmE.to_bytes()?,
|
|||
U_i.u.to_bytes()?,
|
|||
U_i.cmW.to_bytes()?,
|
|||
U_i_x_bytes,
|
|||
cmT.to_bytes()?,
|
|||
// TODO instead of bytes, use field elements, but needs x,y coordinates from
|
|||
// u_i.{cmE,cmW}, U_i.{cmE,cmW}, cmT. Depends exposing x,y coordinates of GC. Issue to
|
|||
// keep track of this:
|
|||
// https://github.com/privacy-scaling-explorations/folding-schemes/issues/44
|
|||
]
|
|||
.concat();
|
|||
sponge.absorb(&input)?;
|
|||
let bits = sponge.squeeze_bits(N_BITS_RO)?;
|
|||
Ok(bits)
|
|||
}
|
|||
}
|
|||
|
|||
/// returns the bytes being compatible with the ark_r1cs_std `.to_bytes` approach
|
|||
fn point_to_bytes<C: CurveGroup>(p: C) -> Vec<u8> {
|
|||
let l = p.uncompressed_size();
|
|||
let mut b = Vec::new();
|
|||
p.serialize_uncompressed(&mut b).unwrap();
|
|||
b[l - 1] = 0;
|
|||
if p.is_zero() {
|
|||
b[l / 2] = 1;
|
|||
b[l - 1] = 1;
|
|||
}
|
|||
b
|
|||
}
|
|||
|
|||
/// CycleFoldCircuit contains the constraints that check the correct fold of the committed
|
|||
/// instances from Curve1. Namely, it checks the random linear combinations of the elliptic curve
|
|||
/// (Curve1) points of u_i, U_i leading to U_{i+1}
|
|||
#[derive(Debug, Clone)]
|
|||
pub struct CycleFoldCircuit<C: CurveGroup, GC: CurveVar<C, CF2<C>>> {
|
|||
pub _gc: PhantomData<GC>,
|
|||
pub r_bits: Option<Vec<bool>>,
|
|||
pub cmT: Option<C>,
|
|||
// u_i,U_i,U_i1 are the nova instances from AugmentedFCircuit which will be (their elliptic
|
|||
// curve points) checked natively in CycleFoldCircuit
|
|||
pub u_i: Option<CommittedInstance<C>>,
|
|||
pub U_i: Option<CommittedInstance<C>>,
|
|||
pub U_i1: Option<CommittedInstance<C>>,
|
|||
pub x: Option<Vec<CF2<C>>>, // public inputs (cf_u_{i+1}.x)
|
|||
}
|
|||
impl<C: CurveGroup, GC: CurveVar<C, CF2<C>>> CycleFoldCircuit<C, GC> {
|
|||
pub fn empty() -> Self {
|
|||
Self {
|
|||
_gc: PhantomData,
|
|||
r_bits: None,
|
|||
cmT: None,
|
|||
u_i: None,
|
|||
U_i: None,
|
|||
U_i1: None,
|
|||
x: None,
|
|||
}
|
|||
}
|
|||
}
|
|||
impl<C, GC> ConstraintSynthesizer<CF2<C>> for CycleFoldCircuit<C, GC>
|
|||
where
|
|||
C: CurveGroup,
|
|||
GC: CurveVar<C, CF2<C>>,
|
|||
<C as ark_ec::CurveGroup>::BaseField: ark_ff::PrimeField,
|
|||
for<'a> &'a GC: GroupOpsBounds<'a, C, GC>,
|
|||
{
|
|||
fn generate_constraints(self, cs: ConstraintSystemRef<CF2<C>>) -> Result<(), SynthesisError> {
|
|||
let r_bits: Vec<Boolean<CF2<C>>> = Vec::new_witness(cs.clone(), || {
|
|||
Ok(self.r_bits.unwrap_or(vec![false; N_BITS_RO]))
|
|||
})?;
|
|||
let cmT = GC::new_witness(cs.clone(), || Ok(self.cmT.unwrap_or(C::zero())))?;
|
|||
|
|||
let u_dummy_native = CommittedInstance::<C>::dummy(1);
|
|||
|
|||
let u_i = CommittedInstanceInCycleFoldVar::<C, GC>::new_witness(cs.clone(), || {
|
|||
Ok(self.u_i.unwrap_or(u_dummy_native.clone()))
|
|||
})?;
|
|||
let U_i = CommittedInstanceInCycleFoldVar::<C, GC>::new_witness(cs.clone(), || {
|
|||
Ok(self.U_i.unwrap_or(u_dummy_native.clone()))
|
|||
})?;
|
|||
let U_i1 = CommittedInstanceInCycleFoldVar::<C, GC>::new_witness(cs.clone(), || {
|
|||
Ok(self.U_i1.unwrap_or(u_dummy_native.clone()))
|
|||
})?;
|
|||
let _x = Vec::<FpVar<CF2<C>>>::new_input(cs.clone(), || {
|
|||
Ok(self.x.unwrap_or(vec![CF2::<C>::zero(); CF_IO_LEN]))
|
|||
})?;
|
|||
#[cfg(test)]
|
|||
assert_eq!(_x.len(), CF_IO_LEN); // non-constrained sanity check
|
|||
|
|||
// fold the original Nova instances natively in CycleFold
|
|||
let v =
|
|||
NIFSinCycleFoldGadget::<C, GC>::verify(r_bits.clone(), cmT, u_i.clone(), U_i, U_i1)?;
|
|||
v.enforce_equal(&Boolean::TRUE)?;
|
|||
|
|||
// check that x == [u_i, U_i, U_{i+1}], check that the cmW & cmW from u_i, U_i, U_{i+1} in
|
|||
// the CycleFoldCircuit are the sames used in the public inputs 'x', which come from the
|
|||
// AugmentedFCircuit.
|
|||
// TODO: Issue to keep track of this: https://github.com/privacy-scaling-explorations/folding-schemes/issues/44
|
|||
|
|||
Ok(())
|
|||
}
|
|||
}
|
|||
|
|||
#[cfg(test)]
|
|||
pub mod tests {
|
|||
use super::*;
|
|||
use ark_ff::BigInteger;
|
|||
use ark_pallas::{constraints::GVar, Fq, Fr, Projective};
|
|||
use ark_r1cs_std::{alloc::AllocVar, R1CSVar};
|
|||
use ark_relations::r1cs::ConstraintSystem;
|
|||
use ark_std::UniformRand;
|
|||
|
|||
use crate::folding::nova::nifs::tests::prepare_simple_fold_inputs;
|
|||
use crate::transcript::poseidon::tests::poseidon_test_config;
|
|||
|
|||
#[test]
|
|||
fn test_committed_instance_cyclefold_var() {
|
|||
let mut rng = ark_std::test_rng();
|
|||
|
|||
let ci = CommittedInstance::<Projective> {
|
|||
cmE: Projective::rand(&mut rng),
|
|||
u: Fr::rand(&mut rng),
|
|||
cmW: Projective::rand(&mut rng),
|
|||
x: vec![Fr::rand(&mut rng); 1],
|
|||
};
|
|||
|
|||
// check the instantiation of the CycleFold side:
|
|||
let cs = ConstraintSystem::<Fq>::new_ref();
|
|||
let ciVar =
|
|||
CommittedInstanceInCycleFoldVar::<Projective, GVar>::new_witness(cs.clone(), || {
|
|||
Ok(ci.clone())
|
|||
})
|
|||
.unwrap();
|
|||
assert_eq!(ciVar.cmE.value().unwrap(), ci.cmE);
|
|||
assert_eq!(ciVar.cmW.value().unwrap(), ci.cmW);
|
|||
}
|
|||
|
|||
#[test]
|
|||
fn test_nifs_gadget_cyclefold() {
|
|||
let (_, _, _, _, ci1, _, ci2, _, ci3, _, cmT, r_bits, _) = prepare_simple_fold_inputs();
|
|||
|
|||
// cs is the Constraint System on the Curve Cycle auxiliary curve constraints field
|
|||
// (E2::Fr)
|
|||
let cs = ConstraintSystem::<Fq>::new_ref();
|
|||
|
|||
let r_bitsVar = Vec::<Boolean<Fq>>::new_witness(cs.clone(), || Ok(r_bits)).unwrap();
|
|||
|
|||
let cmTVar = GVar::new_witness(cs.clone(), || Ok(cmT)).unwrap();
|
|||
let ci1Var =
|
|||
CommittedInstanceInCycleFoldVar::<Projective, GVar>::new_witness(cs.clone(), || {
|
|||
Ok(ci1.clone())
|
|||
})
|
|||
.unwrap();
|
|||
let ci2Var =
|
|||
CommittedInstanceInCycleFoldVar::<Projective, GVar>::new_witness(cs.clone(), || {
|
|||
Ok(ci2.clone())
|
|||
})
|
|||
.unwrap();
|
|||
let ci3Var =
|
|||
CommittedInstanceInCycleFoldVar::<Projective, GVar>::new_witness(cs.clone(), || {
|
|||
Ok(ci3.clone())
|
|||
})
|
|||
.unwrap();
|
|||
|
|||
let nifs_cf_check = NIFSinCycleFoldGadget::<Projective, GVar>::verify(
|
|||
r_bitsVar, cmTVar, ci1Var, ci2Var, ci3Var,
|
|||
)
|
|||
.unwrap();
|
|||
nifs_cf_check.enforce_equal(&Boolean::<Fq>::TRUE).unwrap();
|
|||
assert!(cs.is_satisfied().unwrap());
|
|||
dbg!(cs.num_constraints());
|
|||
}
|
|||
|
|||
#[test]
|
|||
fn test_nifs_full_gadget() {
|
|||
let (_, _, _, _, ci1, _, ci2, _, ci3, _, cmT, r_bits, r_Fr) = prepare_simple_fold_inputs();
|
|||
|
|||
let cs = ConstraintSystem::<Fq>::new_ref();
|
|||
|
|||
let r_nonnatVar =
|
|||
NonNativeFieldVar::<Fr, Fq>::new_witness(cs.clone(), || Ok(r_Fr)).unwrap();
|
|||
let r_bitsVar = Vec::<Boolean<Fq>>::new_witness(cs.clone(), || Ok(r_bits)).unwrap();
|
|||
|
|||
let ci1Var =
|
|||
CycleFoldCommittedInstanceVar::<Projective, GVar>::new_witness(cs.clone(), || {
|
|||
Ok(ci1.clone())
|
|||
})
|
|||
.unwrap();
|
|||
let ci2Var =
|
|||
CycleFoldCommittedInstanceVar::<Projective, GVar>::new_witness(cs.clone(), || {
|
|||
Ok(ci2.clone())
|
|||
})
|
|||
.unwrap();
|
|||
let ci3Var =
|
|||
CycleFoldCommittedInstanceVar::<Projective, GVar>::new_witness(cs.clone(), || {
|
|||
Ok(ci3.clone())
|
|||
})
|
|||
.unwrap();
|
|||
let cmTVar = GVar::new_witness(cs.clone(), || Ok(cmT)).unwrap();
|
|||
|
|||
let nifs_check = NIFSFullGadget::<Projective, GVar>::verify(
|
|||
r_bitsVar,
|
|||
r_nonnatVar,
|
|||
cmTVar,
|
|||
ci1Var,
|
|||
ci2Var,
|
|||
ci3Var,
|
|||
)
|
|||
.unwrap();
|
|||
nifs_check.enforce_equal(&Boolean::<Fq>::TRUE).unwrap();
|
|||
assert!(cs.is_satisfied().unwrap());
|
|||
dbg!(cs.num_constraints());
|
|||
}
|
|||
|
|||
#[test]
|
|||
fn test_cyclefold_challenge_gadget() {
|
|||
let mut rng = ark_std::test_rng();
|
|||
let poseidon_config = poseidon_test_config::<Fq>();
|
|||
|
|||
let u_i = CommittedInstance::<Projective> {
|
|||
cmE: Projective::zero(), // zero on purpose, so we test also the zero point case
|
|||
u: Fr::zero(),
|
|||
cmW: Projective::rand(&mut rng),
|
|||
x: std::iter::repeat_with(|| Fr::rand(&mut rng))
|
|||
.take(CF_IO_LEN)
|
|||
.collect(),
|
|||
};
|
|||
let U_i = CommittedInstance::<Projective> {
|
|||
cmE: Projective::rand(&mut rng),
|
|||
u: Fr::rand(&mut rng),
|
|||
cmW: Projective::rand(&mut rng),
|
|||
x: std::iter::repeat_with(|| Fr::rand(&mut rng))
|
|||
.take(CF_IO_LEN)
|
|||
.collect(),
|
|||
};
|
|||
let cmT = Projective::rand(&mut rng);
|
|||
|
|||
// compute the challenge natively
|
|||
let r_bits = CycleFoldChallengeGadget::<Projective, GVar>::get_challenge_native(
|
|||
&poseidon_config,
|
|||
u_i.clone(),
|
|||
U_i.clone(),
|
|||
cmT,
|
|||
)
|
|||
.unwrap();
|
|||
|
|||
let cs = ConstraintSystem::<Fq>::new_ref();
|
|||
let u_iVar =
|
|||
CycleFoldCommittedInstanceVar::<Projective, GVar>::new_witness(cs.clone(), || {
|
|||
Ok(u_i.clone())
|
|||
})
|
|||
.unwrap();
|
|||
let U_iVar =
|
|||
CycleFoldCommittedInstanceVar::<Projective, GVar>::new_witness(cs.clone(), || {
|
|||
Ok(U_i.clone())
|
|||
})
|
|||
.unwrap();
|
|||
let cmTVar = GVar::new_witness(cs.clone(), || Ok(cmT)).unwrap();
|
|||
|
|||
let r_bitsVar = CycleFoldChallengeGadget::<Projective, GVar>::get_challenge_gadget(
|
|||
cs.clone(),
|
|||
&poseidon_config,
|
|||
u_iVar,
|
|||
U_iVar,
|
|||
cmTVar,
|
|||
)
|
|||
.unwrap();
|
|||
assert!(cs.is_satisfied().unwrap());
|
|||
|
|||
// check that the natively computed and in-circuit computed hashes match
|
|||
let rVar = Boolean::le_bits_to_fp_var(&r_bitsVar).unwrap();
|
|||
let r = Fq::from_bigint(BigInteger::from_bits_le(&r_bits)).unwrap();
|
|||
assert_eq!(rVar.value().unwrap(), r);
|
|||
assert_eq!(r_bitsVar.value().unwrap(), r_bits);
|
|||
}
|
|||
}
|
|||