1package prover
  2
  3import (
  4	"crypto/rand"
  5	"math/big"
  6
  7	bn256 "github.com/ethereum/go-ethereum/crypto/bn256/cloudflare"
  8	"github.com/iden3/go-circom-prover-verifier/types"
  9	"github.com/iden3/go-iden3-crypto/utils"
 10)
 11
 12// Proof is the data structure of the Groth16 zkSNARK proof
 13type Proof struct {
 14	A *bn256.G1
 15	B *bn256.G2
 16	C *bn256.G1
 17}
 18
 19// Pk holds the data structure of the ProvingKey
 20type Pk struct {
 21	A          []*bn256.G1
 22	B2         []*bn256.G2
 23	B1         []*bn256.G1
 24	C          []*bn256.G1
 25	NVars      int
 26	NPublic    int
 27	VkAlpha1   *bn256.G1
 28	VkDelta1   *bn256.G1
 29	VkBeta1    *bn256.G1
 30	VkBeta2    *bn256.G2
 31	VkDelta2   *bn256.G2
 32	HExps      []*bn256.G1
 33	DomainSize int
 34	PolsA      []map[int]*big.Int
 35	PolsB      []map[int]*big.Int
 36	PolsC      []map[int]*big.Int
 37}
 38
 39// Witness contains the witness
 40type Witness []*big.Int
 41
 42// R is the mod of the finite field
 43var R, _ = new(big.Int).SetString("21888242871839275222246405745257275088548364400416034343698204186575808495617", 10)
 44
 45func randBigInt() (*big.Int, error) {
 46	maxbits := R.BitLen()
 47	b := make([]byte, (maxbits/8)-1)
 48	_, err := rand.Read(b)
 49	if err != nil {
 50		return nil, err
 51	}
 52	r := new(big.Int).SetBytes(b)
 53	rq := new(big.Int).Mod(r, R)
 54
 55	return rq, nil
 56}
 57
 58// GenerateProof generates the Groth16 zkSNARK proof
 59func GenerateProof(pk *types.Pk, w types.Witness) (*types.Proof, []*big.Int, error) {
 60	var proof types.Proof
 61
 62	r, err := randBigInt()
 63	if err != nil {
 64		return nil, nil, err
 65	}
 66	s, err := randBigInt()
 67	if err != nil {
 68		return nil, nil, err
 69	}
 70
 71	proof.A = new(bn256.G1).ScalarBaseMult(big.NewInt(0))
 72	proof.B = new(bn256.G2).ScalarBaseMult(big.NewInt(0))
 73	proof.C = new(bn256.G1).ScalarBaseMult(big.NewInt(0))
 74	proofBG1 := new(bn256.G1).ScalarBaseMult(big.NewInt(0))
 75
 76	for i := 0; i < pk.NVars; i++ {
 77		proof.A = new(bn256.G1).Add(proof.A, new(bn256.G1).ScalarMult(pk.A[i], w[i]))
 78		proof.B = new(bn256.G2).Add(proof.B, new(bn256.G2).ScalarMult(pk.B2[i], w[i]))
 79		proofBG1 = new(bn256.G1).Add(proofBG1, new(bn256.G1).ScalarMult(pk.B1[i], w[i]))
 80	}
 81
 82	for i := pk.NPublic + 1; i < pk.NVars; i++ {
 83		proof.C = new(bn256.G1).Add(proof.C, new(bn256.G1).ScalarMult(pk.C[i], w[i]))
 84	}
 85
 86	proof.A = new(bn256.G1).Add(proof.A, pk.VkAlpha1)
 87	proof.A = new(bn256.G1).Add(proof.A, new(bn256.G1).ScalarMult(pk.VkDelta1, r))
 88
 89	proof.B = new(bn256.G2).Add(proof.B, pk.VkBeta2)
 90	proof.B = new(bn256.G2).Add(proof.B, new(bn256.G2).ScalarMult(pk.VkDelta2, s))
 91
 92	proofBG1 = new(bn256.G1).Add(proofBG1, pk.VkBeta1)
 93	proofBG1 = new(bn256.G1).Add(proofBG1, new(bn256.G1).ScalarMult(pk.VkDelta1, s))
 94
 95	h := calculateH(pk, w)
 96
 97	for i := 0; i < len(h); i++ {
 98		proof.C = new(bn256.G1).Add(proof.C, new(bn256.G1).ScalarMult(pk.HExps[i], h[i]))
 99	}
100	proof.C = new(bn256.G1).Add(proof.C, new(bn256.G1).ScalarMult(proof.A, s))
101	proof.C = new(bn256.G1).Add(proof.C, new(bn256.G1).ScalarMult(proofBG1, r))
102	rsneg := new(big.Int).Mod(new(big.Int).Neg(new(big.Int).Mul(r, s)), R) // fAdd & fMul
103	proof.C = new(bn256.G1).Add(proof.C, new(bn256.G1).ScalarMult(pk.VkDelta1, rsneg))
104
105	pubSignals := w[1 : pk.NPublic+1]
106
107	return &proof, pubSignals, nil
108}
109
110func calculateH(pk *types.Pk, w types.Witness) []*big.Int {
111	m := pk.DomainSize
112	polAT := arrayOfZeroes(m)
113	polBT := arrayOfZeroes(m)
114	polCT := arrayOfZeroes(m)
115
116	for i := 0; i < pk.NVars; i++ {
117		for j := range pk.PolsA[i] {
118			polAT[j] = fAdd(polAT[j], fMul(w[i], pk.PolsA[i][j]))
119		}
120		for j := range pk.PolsB[i] {
121			polBT[j] = fAdd(polBT[j], fMul(w[i], pk.PolsB[i][j]))
122		}
123		for j := range pk.PolsC[i] {
124			polCT[j] = fAdd(polCT[j], fMul(w[i], pk.PolsC[i][j]))
125		}
126	}
127	polATe := utils.BigIntArrayToElementArray(polAT)
128	polBTe := utils.BigIntArrayToElementArray(polBT)
129	polCTe := utils.BigIntArrayToElementArray(polCT)
130
131	polASe := ifft(polATe)
132	polBSe := ifft(polBTe)
133	polABSe := polynomialMulE(polASe, polBSe)
134
135	polCSe := ifft(polCTe)
136
137	polABCSe := polynomialSubE(polABSe, polCSe)
138
139	hSe := polABCSe[m:]
140	return ElementArrayToBigIntArray(hSe)
141}