1package gocircomprover
  2
  3import (
  4	"crypto/rand"
  5	"fmt"
  6	"math/big"
  7
  8	bn256 "github.com/ethereum/go-ethereum/crypto/bn256/cloudflare"
  9)
 10
 11// Proof is the data structure of the Groth16 zkSNARK proof
 12type Proof struct {
 13	A *bn256.G1
 14	B *bn256.G2
 15	C *bn256.G1
 16}
 17
 18// ProvingKey holds the data structure of the provingKey
 19type ProvingKey struct {
 20	A          []*bn256.G1
 21	B2         []*bn256.G2
 22	B1         []*bn256.G1
 23	C          []*bn256.G1
 24	NVars      int
 25	NPublic    int
 26	VkAlpha1   *bn256.G1
 27	VkDelta1   *bn256.G1
 28	VkBeta1    *bn256.G1
 29	VkBeta2    *bn256.G2
 30	VkDelta2   *bn256.G2
 31	HExps      []*bn256.G1
 32	DomainSize int
 33	PolsA      []map[int]*big.Int
 34	PolsB      []map[int]*big.Int
 35	PolsC      []map[int]*big.Int
 36}
 37
 38// Witness contains the witness
 39type Witness []*big.Int
 40
 41// R is the mod of the finite field
 42var R, _ = new(big.Int).SetString("21888242871839275222246405745257275088548364400416034343698204186575808495617", 10)
 43
 44func randBigInt() (*big.Int, error) {
 45	maxbits := R.BitLen()
 46	b := make([]byte, (maxbits/8)-1)
 47	_, err := rand.Read(b)
 48	if err != nil {
 49		return nil, err
 50	}
 51	r := new(big.Int).SetBytes(b)
 52	rq := new(big.Int).Mod(r, R)
 53
 54	return rq, nil
 55}
 56
 57// GenerateProof generates the Groth16 zkSNARK proof
 58func GenerateProof(pk *ProvingKey, w Witness) (*Proof, []*big.Int, error) {
 59	var proof Proof
 60
 61	r, err := randBigInt()
 62	if err != nil {
 63		return nil, nil, err
 64	}
 65	s, err := randBigInt()
 66	if err != nil {
 67		return nil, nil, err
 68	}
 69
 70	proof.A = new(bn256.G1).ScalarBaseMult(big.NewInt(0))
 71	proof.B = new(bn256.G2).ScalarBaseMult(big.NewInt(0))
 72	proof.C = new(bn256.G1).ScalarBaseMult(big.NewInt(0))
 73	proofBG1 := new(bn256.G1).ScalarBaseMult(big.NewInt(0))
 74
 75	for i := 0; i < pk.NVars; i++ {
 76		proof.A = new(bn256.G1).Add(proof.A, new(bn256.G1).ScalarMult(pk.A[i], w[i]))
 77		proof.B = new(bn256.G2).Add(proof.B, new(bn256.G2).ScalarMult(pk.B2[i], w[i]))
 78		proofBG1 = new(bn256.G1).Add(proofBG1, new(bn256.G1).ScalarMult(pk.B1[i], w[i]))
 79	}
 80
 81	for i := pk.NPublic + 1; i < pk.NVars; i++ {
 82		proof.C = new(bn256.G1).Add(proof.C, new(bn256.G1).ScalarMult(pk.C[i], w[i]))
 83	}
 84
 85	proof.A = new(bn256.G1).Add(proof.A, pk.VkAlpha1)
 86	proof.A = new(bn256.G1).Add(proof.A, new(bn256.G1).ScalarMult(pk.VkDelta1, r))
 87
 88	proof.B = new(bn256.G2).Add(proof.B, pk.VkBeta2)
 89	proof.B = new(bn256.G2).Add(proof.B, new(bn256.G2).ScalarMult(pk.VkDelta2, s))
 90
 91	proofBG1 = new(bn256.G1).Add(proofBG1, pk.VkBeta1)
 92	proofBG1 = new(bn256.G1).Add(proofBG1, new(bn256.G1).ScalarMult(pk.VkDelta1, s))
 93
 94	// TODO
 95	// h := calculateH(pk, w)
 96	h := []*big.Int{} // TMP
 97
 98	for i := 0; i < len(h); i++ {
 99		proof.C = new(bn256.G1).Add(proof.C, new(bn256.G1).ScalarMult(pk.HExps[i], h[i]))
100	}
101	proof.C = new(bn256.G1).Add(proof.C, new(bn256.G1).ScalarMult(proof.A, s))
102	proof.C = new(bn256.G1).Add(proof.C, new(bn256.G1).ScalarMult(proofBG1, r))
103	rsneg := new(big.Int).Mod(new(big.Int).Neg(new(big.Int).Mul(r, s)), R) // fAdd & fMul
104	proof.C = new(bn256.G1).Add(proof.C, new(bn256.G1).ScalarMult(pk.VkDelta1, rsneg))
105
106	pubSignals := w[1 : pk.NPublic+1]
107
108	return &proof, pubSignals, nil
109}
110
111func calculateH(pk *ProvingKey, w Witness) []*big.Int {
112	m := pk.DomainSize
113	polAT := arrayOfZeroes(m)
114	polBT := arrayOfZeroes(m)
115	polCT := arrayOfZeroes(m)
116
117	for i := 0; i < pk.NVars; i++ {
118		for j := range pk.PolsA[i] {
119			polAT[j] = fAdd(polAT[j], fMul(w[i], pk.PolsA[i][j]))
120			fmt.Println(polAT[j])
121		}
122		for j := range pk.PolsB[i] {
123			polBT[j] = fAdd(polBT[j], fMul(w[i], pk.PolsB[i][j]))
124		}
125		for j := range pk.PolsC[i] {
126			polCT[j] = fAdd(polCT[j], fMul(w[i], pk.PolsC[i][j]))
127		}
128	}
129	polAS := ifft(polAT)
130	polBS := ifft(polBT)
131
132	polABS := polynomialMul(polAS, polBS)
133	polCS := ifft(polCT)
134	polABCS := polynomialSub(polABS, polCS)
135
136	hS := polABCS[m:]
137	return hS
138}