You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

382 lines
14 KiB

4 years ago
4 years ago
4 years ago
4 years ago
4 years ago
4 years ago
4 years ago
4 years ago
  1. # Spartan: High-speed zkSNARKs without trusted setup
  2. ![Rust](https://github.com/microsoft/Spartan/workflows/Rust/badge.svg)
  3. ![crates.io](https://img.shields.io/crates/v/spartan.svg)
  4. Spartan is a high-speed zero-knowledge proof system, a cryptographic primitive that enables a prover to prove a mathematical statement to a verifier without revealing anything besides the validity of the statement. This repository provides `libspartan,` a Rust library that implements a zero-knowledge succinct non-interactive argument of knowledge (zkSNARK), which is a type of zero-knowledge proof system with short proofs and fast verification times. The details of the Spartan proof system are described in our [paper](https://eprint.iacr.org/2019/550) published at [CRYPTO 2020](https://crypto.iacr.org/2020/). The security of the Spartan variant implemented in this library is based on the discrete logarithm problem in the random oracle model.
  5. A simple example application is proving the knowledge of a secret s such that H(s) == d for a public d, where H is a cryptographic hash function (e.g., SHA-256, Keccak). A more complex application is a database-backed cloud service that produces proofs of correct state machine transitions for auditability. See this [paper](https://eprint.iacr.org/2020/758.pdf) for an overview and this [paper](https://eprint.iacr.org/2018/907.pdf) for details.
  6. Note that this library has *not* received a security review or audit.
  7. ## Highlights
  8. We now highlight Spartan's distinctive features.
  9. * **No "toxic" waste:** Spartan is a *transparent* zkSNARK and does not require a trusted setup. So, it does not involve any trapdoors that must be kept secret or require a multi-party ceremony to produce public parameters.
  10. * **General-purpose:** Spartan produces proofs for arbitrary NP statements. `libspartan` supports NP statements expressed as rank-1 constraint satisfiability (R1CS) instances, a popular language for which there exists efficient transformations and compiler toolchains from high-level programs of interest.
  11. * **Sub-linear verification costs and linear-time proving costs:** Spartan is the first transparent proof system with sub-linear verification costs for arbitrary NP statements (e.g., R1CS). Spartan also features a linear-time prover, a property that has remained elusive for nearly all zkSNARKs in the literature.
  12. * **Standardized security:** Spartan's security relies on the hardness of computing discrete logarithms (a standard cryptographic assumption) in the random oracle model. `libspartan` uses `ristretto255`, a prime-order group abstraction atop `curve25519` (a high-speed elliptic curve). We use [`curve25519-dalek`](https://docs.rs/curve25519-dalek) for arithmetic over `ristretto255`.
  13. * **State-of-the-art performance:**
  14. Among transparent SNARKs, Spartan offers the fastest prover with speedups of 36–152× depending on the baseline, produces proofs that are shorter by 1.2–416×, and incurs the lowest verification times with speedups of 3.6–1326×. The only exception is proof sizes under Bulletproofs, but Bulletproofs incurs slower verification both asymptotically and concretely. When compared to the state-of-the-art zkSNARK with trusted setup, Spartan’s prover is 2× faster for arbitrary R1CS instances and 16× faster for data-parallel workloads.
  15. ### Implementation details
  16. `libspartan` uses [`merlin`](https://docs.rs/merlin/) to automate the Fiat-Shamir transform. We also introduce a new type called `RandomTape` that extends a `Transcript` in `merlin` to allow the prover's internal methods to produce private randomness using its private transcript without having to create `OsRng` objects throughout the code. An object of type `RandomTape` is initialized with a new random seed from `OsRng` for each proof produced by the library.
  17. ## Examples
  18. The following example shows how to use `libspartan` to create and verify a SNARK proof.
  19. Some of our public APIs' style is inspired by the underlying crates we use.
  20. ```rust
  21. # extern crate libspartan;
  22. # extern crate merlin;
  23. # use libspartan::{Instance, SNARKGens, SNARK};
  24. # use merlin::Transcript;
  25. # fn main() {
  26. // specify the size of an R1CS instance
  27. let num_vars = 1024;
  28. let num_cons = 1024;
  29. let num_inputs = 10;
  30. let num_non_zero_entries = 1024;
  31. // produce public parameters
  32. let gens = SNARKGens::new(num_cons, num_vars, num_inputs, num_non_zero_entries);
  33. // ask the library to produce a synthentic R1CS instance
  34. let (inst, vars, inputs) = Instance::produce_synthetic_r1cs(num_cons, num_vars, num_inputs);
  35. // create a commitment to the R1CS instance
  36. let (comm, decomm) = SNARK::encode(&inst, &gens);
  37. // produce a proof of satisfiability
  38. let mut prover_transcript = Transcript::new(b"snark_example");
  39. let proof = SNARK::prove(&inst, &decomm, vars, &inputs, &gens, &mut prover_transcript);
  40. // verify the proof of satisfiability
  41. let mut verifier_transcript = Transcript::new(b"snark_example");
  42. assert!(proof
  43. .verify(&comm, &inputs, &mut verifier_transcript, &gens)
  44. .is_ok());
  45. # }
  46. ```
  47. Here is another example to use the NIZK variant of the Spartan proof system:
  48. ```rust
  49. # extern crate libspartan;
  50. # extern crate merlin;
  51. # use libspartan::{Instance, NIZKGens, NIZK};
  52. # use merlin::Transcript;
  53. # fn main() {
  54. // specify the size of an R1CS instance
  55. let num_vars = 1024;
  56. let num_cons = 1024;
  57. let num_inputs = 10;
  58. // produce public parameters
  59. let gens = NIZKGens::new(num_cons, num_vars);
  60. // ask the library to produce a synthentic R1CS instance
  61. let (inst, vars, inputs) = Instance::produce_synthetic_r1cs(num_cons, num_vars, num_inputs);
  62. // produce a proof of satisfiability
  63. let mut prover_transcript = Transcript::new(b"nizk_example");
  64. let proof = NIZK::prove(&inst, vars, &inputs, &gens, &mut prover_transcript);
  65. // verify the proof of satisfiability
  66. let mut verifier_transcript = Transcript::new(b"nizk_example");
  67. assert!(proof
  68. .verify(&inst, &inputs, &mut verifier_transcript, &gens)
  69. .is_ok());
  70. # }
  71. ```
  72. Finally, we provide an example that specifies a custom R1CS instance instead of using a synthetic instance
  73. ```rust
  74. # extern crate curve25519_dalek;
  75. # extern crate libspartan;
  76. # extern crate merlin;
  77. # use curve25519_dalek::scalar::Scalar;
  78. # use libspartan::{InputsAssignment, Instance, SNARKGens, VarsAssignment, SNARK};
  79. # use merlin::Transcript;
  80. # use rand::rngs::OsRng;
  81. # fn main() {
  82. // produce a tiny instance
  83. let (
  84. num_cons,
  85. num_vars,
  86. num_inputs,
  87. num_non_zero_entries,
  88. inst,
  89. assignment_vars,
  90. assignment_inputs,
  91. ) = produce_tiny_r1cs();
  92. // produce public parameters
  93. let gens = SNARKGens::new(num_cons, num_vars, num_inputs, num_non_zero_entries);
  94. // create a commitment to the R1CS instance
  95. let (comm, decomm) = SNARK::encode(&inst, &gens);
  96. // produce a proof of satisfiability
  97. let mut prover_transcript = Transcript::new(b"snark_example");
  98. let proof = SNARK::prove(
  99. &inst,
  100. &decomm,
  101. assignment_vars,
  102. &assignment_inputs,
  103. &gens,
  104. &mut prover_transcript,
  105. );
  106. // verify the proof of satisfiability
  107. let mut verifier_transcript = Transcript::new(b"snark_example");
  108. assert!(proof
  109. .verify(&comm, &assignment_inputs, &mut verifier_transcript, &gens)
  110. .is_ok());
  111. # }
  112. # fn produce_tiny_r1cs() -> (
  113. # usize,
  114. # usize,
  115. # usize,
  116. # usize,
  117. # Instance,
  118. # VarsAssignment,
  119. # InputsAssignment,
  120. # ) {
  121. // We will use the following example, but one could construct any R1CS instance.
  122. // Our R1CS instance is three constraints over five variables and two public inputs
  123. // (Z0 + Z1) * I0 - Z2 = 0
  124. // (Z0 + I1) * Z2 - Z3 = 0
  125. // Z4 * 1 - 0 = 0
  126. // parameters of the R1CS instance rounded to the nearest power of two
  127. let num_cons = 4;
  128. let num_vars = 8;
  129. let num_inputs = 2;
  130. let num_non_zero_entries = 8;
  131. // We will encode the above constraints into three matrices, where
  132. // the coefficients in the matrix are in the little-endian byte order
  133. let mut A: Vec<(usize, usize, [u8; 32])> = Vec::new();
  134. let mut B: Vec<(usize, usize, [u8; 32])> = Vec::new();
  135. let mut C: Vec<(usize, usize, [u8; 32])> = Vec::new();
  136. // The constraint system is defined over a finite field, which in our case is
  137. // the scalar field of ristreeto255/curve25519 i.e., p = 2^{252}+27742317777372353535851937790883648493
  138. // To construct these matrices, we will use `curve25519-dalek` but one can use any other method.
  139. // a variable that holds a byte representation of 1
  140. let one = Scalar::one().to_bytes();
  141. // R1CS is a set of three sparse matrices A B C, where is a row for every
  142. // constraint and a column for every entry in z = (vars, 1, inputs)
  143. // An R1CS instance is satisfiable iff:
  144. // Az \circ Bz = Cz, where z = (vars, 1, inputs)
  145. // constraint 0 entries in (A,B,C)
  146. // constraint 0 is (Z0 + Z1) * I0 - Z2 = 0.
  147. // We set 1 in matrix A for columns that correspond to Z0 and Z1
  148. // We set 1 in matrix B for column that corresponds to I0
  149. // We set 1 in matrix C for column that corresponds to Z2
  150. A.push((0, 0, one));
  151. A.push((0, 1, one));
  152. B.push((0, num_vars + 1, one));
  153. C.push((0, 2, one));
  154. // constraint 1 entries in (A,B,C)
  155. A.push((1, 0, one));
  156. A.push((1, num_vars + 2, one));
  157. B.push((1, 2, one));
  158. C.push((1, 3, one));
  159. // constraint 3 entries in (A,B,C)
  160. A.push((2, 4, one));
  161. B.push((2, num_vars, one));
  162. let inst = Instance::new(num_cons, num_vars, num_inputs, &A, &B, &C).unwrap();
  163. // compute a satisfying assignment
  164. let mut csprng: OsRng = OsRng;
  165. let i0 = Scalar::random(&mut csprng);
  166. let i1 = Scalar::random(&mut csprng);
  167. let z0 = Scalar::random(&mut csprng);
  168. let z1 = Scalar::random(&mut csprng);
  169. let z2 = (z0 + z1) * i0; // constraint 0
  170. let z3 = (z0 + i1) * z2; // constraint 1
  171. let z4 = Scalar::zero(); //constraint 2
  172. // create a VarsAssignment
  173. let mut vars = vec![Scalar::zero().to_bytes(); num_vars];
  174. vars[0] = z0.to_bytes();
  175. vars[1] = z1.to_bytes();
  176. vars[2] = z2.to_bytes();
  177. vars[3] = z3.to_bytes();
  178. vars[4] = z4.to_bytes();
  179. let assignment_vars = VarsAssignment::new(&vars).unwrap();
  180. // create an InputsAssignment
  181. let mut inputs = vec![Scalar::zero().to_bytes(); num_inputs];
  182. inputs[0] = i0.to_bytes();
  183. inputs[1] = i1.to_bytes();
  184. let assignment_inputs = InputsAssignment::new(&inputs).unwrap();
  185. // check if the instance we created is satisfiable
  186. let res = inst.is_sat(&assignment_vars, &assignment_inputs);
  187. assert_eq!(res.unwrap(), true);
  188. (
  189. num_cons,
  190. num_vars,
  191. num_inputs,
  192. num_non_zero_entries,
  193. inst,
  194. assignment_vars,
  195. assignment_inputs,
  196. )
  197. # }
  198. ```
  199. ## Building `libspartan`
  200. Install [`rustup`](https://rustup.rs/)
  201. Switch to nightly Rust using `rustup`:
  202. ```text
  203. rustup default nightly
  204. ```
  205. Clone the repository:
  206. ```text
  207. git clone https://github.com/Microsoft/Spartan
  208. cd Spartan
  209. ```
  210. To build docs for public APIs of `libspartan`:
  211. ```text
  212. cargo doc
  213. ```
  214. To run tests:
  215. ```text
  216. RUSTFLAGS="-C target_cpu=native" cargo test
  217. ```
  218. To build `libspartan`:
  219. ```text
  220. RUSTFLAGS="-C target_cpu=native" cargo build --release
  221. ```
  222. > NOTE: We enable SIMD instructions in `curve25519-dalek` by default, so if it fails to build remove the "simd_backend" feature argument in `Cargo.toml`.
  223. ### Supported features
  224. * `profile`: enables fine-grained profiling information (see below for its use)
  225. ## Performance
  226. ### End-to-end benchmarks
  227. `libspartan` includes two benches: `benches/nizk.rs` and `benches/snark.rs`. If you report the performance of Spartan in a research paper, we recommend using these benches for higher accuracy instead of fine-grained profiling (listed below).
  228. To run end-to-end benchmarks:
  229. ```text
  230. RUSTFLAGS="-C target_cpu=native" cargo bench
  231. ```
  232. ### Fine-grained profiling
  233. Build `libspartan` with `profile` feature enabled. It creates two profilers: `./target/release/snark` and `./target/release/nizk`.
  234. These profilers report performance as depicted below (for varying R1CS instance sizes). The reported
  235. performance is from running the profilers on a Microsoft Surface Laptop 3 on a single CPU core of Intel Core i7-1065G7 running Ubuntu 20.04 (atop WSL2 on Windows 10).
  236. See Section 9 in our [paper](https://eprint.iacr.org/2019/550) to see how this compares with other zkSNARKs in the literature.
  237. ```text
  238. $ ./target/release/snark
  239. Profiler:: SNARK
  240. * number_of_constraints 1048576
  241. * number_of_variables 1048576
  242. * number_of_inputs 10
  243. * number_non-zero_entries_A 1048576
  244. * number_non-zero_entries_B 1048576
  245. * number_non-zero_entries_C 1048576
  246. * SNARK::encode
  247. * SNARK::encode 14.2644201s
  248. * SNARK::prove
  249. * R1CSProof::prove
  250. * polycommit
  251. * polycommit 2.7175848s
  252. * prove_sc_phase_one
  253. * prove_sc_phase_one 683.7481ms
  254. * prove_sc_phase_two
  255. * prove_sc_phase_two 846.1056ms
  256. * polyeval
  257. * polyeval 193.4216ms
  258. * R1CSProof::prove 4.4416193s
  259. * len_r1cs_sat_proof 47024
  260. * eval_sparse_polys
  261. * eval_sparse_polys 377.357ms
  262. * R1CSEvalProof::prove
  263. * commit_nondet_witness
  264. * commit_nondet_witness 14.4507331s
  265. * build_layered_network
  266. * build_layered_network 3.4360521s
  267. * evalproof_layered_network
  268. * len_product_layer_proof 64712
  269. * evalproof_layered_network 15.5708066s
  270. * R1CSEvalProof::prove 34.2930559s
  271. * len_r1cs_eval_proof 133720
  272. * SNARK::prove 39.1297568s
  273. * SNARK::proof_compressed_len 141768
  274. * SNARK::verify
  275. * verify_sat_proof
  276. * verify_sat_proof 20.0828ms
  277. * verify_eval_proof
  278. * verify_polyeval_proof
  279. * verify_prod_proof
  280. * verify_prod_proof 1.1847ms
  281. * verify_hash_proof
  282. * verify_hash_proof 81.06ms
  283. * verify_polyeval_proof 82.3583ms
  284. * verify_eval_proof 82.8937ms
  285. * SNARK::verify 103.0536ms
  286. ```
  287. ```text
  288. $ ./target/release/nizk
  289. Profiler:: NIZK
  290. * number_of_constraints 1048576
  291. * number_of_variables 1048576
  292. * number_of_inputs 10
  293. * number_non-zero_entries_A 1048576
  294. * number_non-zero_entries_B 1048576
  295. * number_non-zero_entries_C 1048576
  296. * NIZK::prove
  297. * R1CSProof::prove
  298. * polycommit
  299. * polycommit 2.7220635s
  300. * prove_sc_phase_one
  301. * prove_sc_phase_one 722.5487ms
  302. * prove_sc_phase_two
  303. * prove_sc_phase_two 862.6796ms
  304. * polyeval
  305. * polyeval 190.2233ms
  306. * R1CSProof::prove 4.4982305s
  307. * len_r1cs_sat_proof 47024
  308. * NIZK::prove 4.5139888s
  309. * NIZK::proof_compressed_len 48134
  310. * NIZK::verify
  311. * eval_sparse_polys
  312. * eval_sparse_polys 395.0847ms
  313. * verify_sat_proof
  314. * verify_sat_proof 19.286ms
  315. * NIZK::verify 414.5102ms
  316. ```
  317. ## LICENSE
  318. See [LICENSE](./LICENSE)
  319. ## Contributing
  320. See [CONTRIBUTING](./CONTRIBUTING.md)