go-circom-prover-verifier/parsers/parsers.go
parsers/parsers.goRaw
1package parsers
2
3import (
4 "bufio"
5 "bytes"
6 "encoding/binary"
7 "encoding/hex"
8 "encoding/json"
9 "fmt"
10 "io"
11 "math/big"
12 "os"
13 "strconv"
14 "strings"
15
16 bn256 "github.com/ethereum/go-ethereum/crypto/bn256/cloudflare"
17 "github.com/iden3/go-circom-prover-verifier/types"
18)
19
20// PkString is the equivalent to the Pk struct in string representation, containing the ProvingKey
21type PkString struct {
22 A [][]string `json:"A"`
23 B2 [][][]string `json:"B2"`
24 B1 [][]string `json:"B1"`
25 C [][]string `json:"C"`
26 NVars int `json:"nVars"`
27 NPublic int `json:"nPublic"`
28 VkAlpha1 []string `json:"vk_alfa_1"`
29 VkDelta1 []string `json:"vk_delta_1"`
30 VkBeta1 []string `json:"vk_beta_1"`
31 VkBeta2 [][]string `json:"vk_beta_2"`
32 VkDelta2 [][]string `json:"vk_delta_2"`
33 HExps [][]string `json:"hExps"`
34 DomainSize int `json:"domainSize"`
35 PolsA []map[string]string `json:"polsA"`
36 PolsB []map[string]string `json:"polsB"`
37 PolsC []map[string]string `json:"polsC"`
38}
39
40// WitnessString contains the Witness in string representation
41type WitnessString []string
42
43// ProofString is the equivalent to the Proof struct in string representation
44type ProofString struct {
45 A []string `json:"pi_a"`
46 B [][]string `json:"pi_b"`
47 C []string `json:"pi_c"`
48 Protocol string `json:"protocol"`
49}
50
51// VkString is the Verification Key data structure in string format (from json)
52type VkString struct {
53 Alpha []string `json:"vk_alfa_1"`
54 Beta [][]string `json:"vk_beta_2"`
55 Gamma [][]string `json:"vk_gamma_2"`
56 Delta [][]string `json:"vk_delta_2"`
57 IC [][]string `json:"IC"`
58}
59
60// ParseWitness parses the json []byte data into the Witness struct
61func ParseWitness(wJson []byte) (types.Witness, error) {
62 var ws WitnessString
63 err := json.Unmarshal(wJson, &ws)
64 if err != nil {
65 return nil, err
66 }
67
68 var w types.Witness
69 for i := 0; i < len(ws); i++ {
70 bi, err := stringToBigInt(ws[i])
71 if err != nil {
72 return nil, err
73 }
74 w = append(w, bi)
75 }
76 return w, nil
77}
78
79// ParsePk parses the json []byte data into the Pk struct
80func ParsePk(pkJson []byte) (*types.Pk, error) {
81 var pkStr PkString
82 err := json.Unmarshal(pkJson, &pkStr)
83 if err != nil {
84 return nil, err
85 }
86 pk, err := pkStringToPk(pkStr)
87 return pk, err
88}
89
90func pkStringToPk(ps PkString) (*types.Pk, error) {
91 var p types.Pk
92 var err error
93
94 p.A, err = arrayStringToG1(ps.A)
95 if err != nil {
96 return nil, err
97 }
98 p.B2, err = arrayStringToG2(ps.B2)
99 if err != nil {
100 return nil, err
101 }
102 p.B1, err = arrayStringToG1(ps.B1)
103 if err != nil {
104 return nil, err
105 }
106 p.C, err = arrayStringToG1(ps.C)
107 if err != nil {
108 return nil, err
109 }
110
111 p.NVars = ps.NVars
112 p.NPublic = ps.NPublic
113
114 p.VkAlpha1, err = stringToG1(ps.VkAlpha1)
115 if err != nil {
116 return nil, err
117 }
118
119 p.VkDelta1, err = stringToG1(ps.VkDelta1)
120 if err != nil {
121 return nil, err
122 }
123
124 p.VkBeta1, err = stringToG1(ps.VkBeta1)
125 if err != nil {
126 return nil, err
127 }
128 p.VkBeta2, err = stringToG2(ps.VkBeta2)
129 if err != nil {
130 return nil, err
131 }
132 p.VkDelta2, err = stringToG2(ps.VkDelta2)
133 if err != nil {
134 return nil, err
135 }
136
137 p.HExps, err = arrayStringToG1(ps.HExps)
138 if err != nil {
139 return nil, err
140 }
141
142 p.DomainSize = ps.DomainSize
143
144 p.PolsA, err = polsStringToBigInt(ps.PolsA)
145 if err != nil {
146 return nil, err
147 }
148 p.PolsB, err = polsStringToBigInt(ps.PolsB)
149 if err != nil {
150 return nil, err
151 }
152 p.PolsC, err = polsStringToBigInt(ps.PolsC)
153 if err != nil {
154 return nil, err
155 }
156
157 return &p, nil
158}
159
160func proofStringToProof(pr ProofString) (*types.Proof, error) {
161 var p types.Proof
162 var err error
163 p.A, err = stringToG1(pr.A)
164 if err != nil {
165 return nil, err
166 }
167
168 p.B, err = stringToG2(pr.B)
169 if err != nil {
170 return nil, err
171 }
172
173 p.C, err = stringToG1(pr.C)
174 if err != nil {
175 return nil, err
176 }
177
178 return &p, nil
179}
180
181// ParseProof takes a json []byte and outputs the *Proof struct
182func ParseProof(pj []byte) (*types.Proof, error) {
183 var pr ProofString
184 err := json.Unmarshal(pj, &pr)
185 if err != nil {
186 return nil, err
187 }
188 p, err := proofStringToProof(pr)
189 return p, err
190}
191
192// ParsePublicSignals takes a json []byte and outputs the []*big.Int struct
193func ParsePublicSignals(pj []byte) ([]*big.Int, error) {
194 var pr []string
195 err := json.Unmarshal(pj, &pr)
196 if err != nil {
197 return nil, err
198 }
199 var public []*big.Int
200 for _, s := range pr {
201 sb, err := stringToBigInt(s)
202 if err != nil {
203 return nil, err
204 }
205 public = append(public, sb)
206 }
207 return public, nil
208}
209
210// ParseVk takes a json []byte and outputs the *Vk struct
211func ParseVk(vj []byte) (*types.Vk, error) {
212 var vr VkString
213 err := json.Unmarshal(vj, &vr)
214 if err != nil {
215 return nil, err
216 }
217 v, err := vkStringToVk(vr)
218 return v, err
219}
220
221func vkStringToVk(vr VkString) (*types.Vk, error) {
222 var v types.Vk
223 var err error
224 v.Alpha, err = stringToG1(vr.Alpha)
225 if err != nil {
226 return nil, err
227 }
228
229 v.Beta, err = stringToG2(vr.Beta)
230 if err != nil {
231 return nil, err
232 }
233
234 v.Gamma, err = stringToG2(vr.Gamma)
235 if err != nil {
236 return nil, err
237 }
238
239 v.Delta, err = stringToG2(vr.Delta)
240 if err != nil {
241 return nil, err
242 }
243
244 for i := 0; i < len(vr.IC); i++ {
245 p, err := stringToG1(vr.IC[i])
246 if err != nil {
247 return nil, err
248 }
249 v.IC = append(v.IC, p)
250 }
251
252 return &v, nil
253}
254
255// polsStringToBigInt is for taking string polynomials and converting it to *big.Int polynomials
256func polsStringToBigInt(s []map[string]string) ([]map[int]*big.Int, error) {
257 var o []map[int]*big.Int
258 for i := 0; i < len(s); i++ {
259 // var oi map[int]*big.Int
260 oi := make(map[int]*big.Int)
261 for j, v := range s[i] {
262 si, err := stringToBigInt(v)
263 if err != nil {
264 return o, err
265 }
266 // oi = append(oi, si)
267 jInt, err := strconv.Atoi(j)
268 if err != nil {
269 return o, err
270 }
271 oi[jInt] = si
272 }
273 o = append(o, oi)
274 }
275 return o, nil
276}
277
278// ArrayBigIntToString converts an []*big.Int into []string, used to output the Public Signals
279func ArrayBigIntToString(bi []*big.Int) []string {
280 var s []string
281 for i := 0; i < len(bi); i++ {
282 s = append(s, bi[i].String())
283 }
284 return s
285}
286
287func arrayStringToBigInt(s []string) ([]*big.Int, error) {
288 var o []*big.Int
289 for i := 0; i < len(s); i++ {
290 si, err := stringToBigInt(s[i])
291 if err != nil {
292 return o, nil
293 }
294 o = append(o, si)
295 }
296 return o, nil
297}
298
299func stringToBigInt(s string) (*big.Int, error) {
300 base := 10
301 if bytes.HasPrefix([]byte(s), []byte("0x")) {
302 base = 16
303 s = strings.TrimPrefix(s, "0x")
304 }
305 n, ok := new(big.Int).SetString(s, base)
306 if !ok {
307 return nil, fmt.Errorf("Can not parse string to *big.Int: %s", s)
308 }
309 return n, nil
310}
311
312func addZPadding(b []byte) []byte {
313 var z [32]byte
314 var r []byte
315 r = append(r, z[len(b):]...) // add padding on the left
316 r = append(r, b...)
317 return r[:32]
318}
319
320func stringToBytes(s string) ([]byte, error) {
321 if s == "1" {
322 s = "0"
323 }
324 bi, ok := new(big.Int).SetString(s, 10)
325 if !ok {
326 return nil, fmt.Errorf("error parsing bigint stringToBytes")
327 }
328 b := bi.Bytes()
329 if len(b) != 32 {
330 b = addZPadding(b)
331 }
332 return b, nil
333
334}
335
336func arrayStringToG1(h [][]string) ([]*bn256.G1, error) {
337 var o []*bn256.G1
338 for i := 0; i < len(h); i++ {
339 hi, err := stringToG1(h[i])
340 if err != nil {
341 return o, err
342 }
343 o = append(o, hi)
344 }
345 return o, nil
346}
347
348func arrayStringToG2(h [][][]string) ([]*bn256.G2, error) {
349 var o []*bn256.G2
350 for i := 0; i < len(h); i++ {
351 hi, err := stringToG2(h[i])
352 if err != nil {
353 return o, err
354 }
355 o = append(o, hi)
356 }
357 return o, nil
358}
359
360func stringToG1(h []string) (*bn256.G1, error) {
361 if len(h) <= 2 {
362 return nil, fmt.Errorf("not enought data for stringToG1")
363 }
364 h = h[:2]
365 hexa := false
366 if len(h[0]) > 1 {
367 if "0x" == h[0][:2] {
368 hexa = true
369 }
370 }
371 in := ""
372
373 var b []byte
374 var err error
375 if hexa {
376 for i := range h {
377 in += strings.TrimPrefix(h[i], "0x")
378 }
379 b, err = hex.DecodeString(in)
380 if err != nil {
381 return nil, err
382 }
383 } else {
384 // TODO TMP
385 // TODO use stringToBytes()
386 if h[0] == "1" {
387 h[0] = "0"
388 }
389 if h[1] == "1" {
390 h[1] = "0"
391 }
392 bi0, ok := new(big.Int).SetString(h[0], 10)
393 if !ok {
394 return nil, fmt.Errorf("error parsing stringToG1")
395 }
396 bi1, ok := new(big.Int).SetString(h[1], 10)
397 if !ok {
398 return nil, fmt.Errorf("error parsing stringToG1")
399 }
400 b0 := bi0.Bytes()
401 b1 := bi1.Bytes()
402 if len(b0) != 32 {
403 b0 = addZPadding(b0)
404 }
405 if len(b1) != 32 {
406 b1 = addZPadding(b1)
407 }
408
409 b = append(b, b0...)
410 b = append(b, b1...)
411 }
412 p := new(bn256.G1)
413 _, err = p.Unmarshal(b)
414
415 return p, err
416}
417
418func stringToG2(h [][]string) (*bn256.G2, error) {
419 if len(h) <= 2 {
420 return nil, fmt.Errorf("not enought data for stringToG2")
421 }
422 h = h[:2]
423 hexa := false
424 if len(h[0][0]) > 1 {
425 if "0x" == h[0][0][:2] {
426 hexa = true
427 }
428 }
429 in := ""
430 var b []byte
431 var err error
432 if hexa {
433 for i := 0; i < len(h); i++ {
434 for j := 0; j < len(h[i]); j++ {
435 in += strings.TrimPrefix(h[i][j], "0x")
436 }
437 }
438 b, err = hex.DecodeString(in)
439 if err != nil {
440 return nil, err
441 }
442 } else {
443 // TODO TMP
444 bH, err := stringToBytes(h[0][1])
445 if err != nil {
446 return nil, err
447 }
448 b = append(b, bH...)
449 bH, err = stringToBytes(h[0][0])
450 if err != nil {
451 return nil, err
452 }
453 b = append(b, bH...)
454 bH, err = stringToBytes(h[1][1])
455 if err != nil {
456 return nil, err
457 }
458 b = append(b, bH...)
459 bH, err = stringToBytes(h[1][0])
460 if err != nil {
461 return nil, err
462 }
463 b = append(b, bH...)
464 }
465
466 p := new(bn256.G2)
467 _, err = p.Unmarshal(b)
468 return p, err
469}
470
471// ProofStringToSmartContractFormat converts the ProofString to a ProofString in the SmartContract format in a ProofString structure
472func ProofStringToSmartContractFormat(s ProofString) ProofString {
473 var rs ProofString
474 rs.A = make([]string, 2)
475 rs.B = make([][]string, 2)
476 rs.B[0] = make([]string, 2)
477 rs.B[1] = make([]string, 2)
478 rs.C = make([]string, 2)
479
480 rs.A[0] = s.A[0]
481 rs.A[1] = s.A[1]
482 rs.B[0][0] = s.B[0][1]
483 rs.B[0][1] = s.B[0][0]
484 rs.B[1][0] = s.B[1][1]
485 rs.B[1][1] = s.B[1][0]
486 rs.C[0] = s.C[0]
487 rs.C[1] = s.C[1]
488 rs.Protocol = s.Protocol
489 return rs
490}
491
492// ProofToSmartContractFormat converts the *types.Proof to a ProofString in the SmartContract format in a ProofString structure
493func ProofToSmartContractFormat(p *types.Proof) ProofString {
494 s := ProofToString(p)
495 return ProofStringToSmartContractFormat(s)
496}
497
498// ProofToString converts the Proof to ProofString
499func ProofToString(p *types.Proof) ProofString {
500 var ps ProofString
501 ps.A = make([]string, 3)
502 ps.B = make([][]string, 3)
503 ps.B[0] = make([]string, 2)
504 ps.B[1] = make([]string, 2)
505 ps.B[2] = make([]string, 2)
506 ps.C = make([]string, 3)
507
508 a := p.A.Marshal()
509 ps.A[0] = new(big.Int).SetBytes(a[:32]).String()
510 ps.A[1] = new(big.Int).SetBytes(a[32:64]).String()
511 ps.A[2] = "1"
512
513 b := p.B.Marshal()
514 ps.B[0][1] = new(big.Int).SetBytes(b[:32]).String()
515 ps.B[0][0] = new(big.Int).SetBytes(b[32:64]).String()
516 ps.B[1][1] = new(big.Int).SetBytes(b[64:96]).String()
517 ps.B[1][0] = new(big.Int).SetBytes(b[96:128]).String()
518 ps.B[2][0] = "1"
519 ps.B[2][1] = "0"
520
521 c := p.C.Marshal()
522 ps.C[0] = new(big.Int).SetBytes(c[:32]).String()
523 ps.C[1] = new(big.Int).SetBytes(c[32:64]).String()
524 ps.C[2] = "1"
525
526 ps.Protocol = "groth"
527
528 return ps
529}
530
531// ProofToJson outputs the Proof i Json format
532func ProofToJson(p *types.Proof) ([]byte, error) {
533 ps := ProofToString(p)
534 return json.Marshal(ps)
535}
536
537// ProofToHex converts the Proof to ProofString with hexadecimal strings
538func ProofToHex(p *types.Proof) ProofString {
539 var ps ProofString
540 ps.A = make([]string, 3)
541 ps.B = make([][]string, 3)
542 ps.B[0] = make([]string, 2)
543 ps.B[1] = make([]string, 2)
544 ps.B[2] = make([]string, 2)
545 ps.C = make([]string, 3)
546
547 a := p.A.Marshal()
548 ps.A[0] = "0x" + hex.EncodeToString(new(big.Int).SetBytes(a[:32]).Bytes())
549 ps.A[1] = "0x" + hex.EncodeToString(new(big.Int).SetBytes(a[32:64]).Bytes())
550 ps.A[2] = "1"
551
552 b := p.B.Marshal()
553 ps.B[0][1] = "0x" + hex.EncodeToString(new(big.Int).SetBytes(b[:32]).Bytes())
554 ps.B[0][0] = "0x" + hex.EncodeToString(new(big.Int).SetBytes(b[32:64]).Bytes())
555 ps.B[1][1] = "0x" + hex.EncodeToString(new(big.Int).SetBytes(b[64:96]).Bytes())
556 ps.B[1][0] = "0x" + hex.EncodeToString(new(big.Int).SetBytes(b[96:128]).Bytes())
557 ps.B[2][0] = "1"
558 ps.B[2][1] = "0"
559
560 c := p.C.Marshal()
561 ps.C[0] = "0x" + hex.EncodeToString(new(big.Int).SetBytes(c[:32]).Bytes())
562 ps.C[1] = "0x" + hex.EncodeToString(new(big.Int).SetBytes(c[32:64]).Bytes())
563 ps.C[2] = "1"
564
565 ps.Protocol = "groth"
566
567 return ps
568}
569
570// ProofToJsonHex outputs the Proof i Json format with hexadecimal strings
571func ProofToJsonHex(p *types.Proof) ([]byte, error) {
572 ps := ProofToHex(p)
573 return json.Marshal(ps)
574}
575
576// ParseWitnessBin parses binary file representation of the Witness into the Witness struct
577func ParseWitnessBin(f *os.File) (types.Witness, error) {
578 var w types.Witness
579 r := bufio.NewReader(f)
580 for {
581 b := make([]byte, 32)
582 n, err := r.Read(b)
583 if err == io.EOF {
584 return w, nil
585 } else if err != nil {
586 return nil, err
587 }
588 if n != 32 {
589 return nil, fmt.Errorf("error on value format, expected 32 bytes, got %v", n)
590 }
591 w = append(w, new(big.Int).SetBytes(swapEndianness(b[0:32])))
592 }
593}
594
595// swapEndianness swaps the order of the bytes in the slice.
596func swapEndianness(b []byte) []byte {
597 o := make([]byte, len(b))
598 for i := range b {
599 o[len(b)-1-i] = b[i]
600 }
601 return o
602}
603
604func readNBytes(r io.Reader, n int) ([]byte, error) {
605 b := make([]byte, n)
606 _, err := io.ReadFull(r, b)
607 if err != nil {
608 return b, err
609 }
610 return b, nil
611}
612
613// ParsePkBin parses binary file representation of the ProvingKey into the ProvingKey struct
614func ParsePkBin(f *os.File) (*types.Pk, error) {
615 o := 0
616 var pk types.Pk
617 r := bufio.NewReader(f)
618
619 b, err := readNBytes(r, 12)
620 if err != nil {
621 return nil, err
622 }
623 pk.NVars = int(binary.LittleEndian.Uint32(b[:4]))
624 pk.NPublic = int(binary.LittleEndian.Uint32(b[4:8]))
625 pk.DomainSize = int(binary.LittleEndian.Uint32(b[8:12]))
626 o += 12
627
628 b, err = readNBytes(r, 8)
629 if err != nil {
630 return nil, err
631 }
632 pPolsA := int(binary.LittleEndian.Uint32(b[:4]))
633 pPolsB := int(binary.LittleEndian.Uint32(b[4:8]))
634 o += 8
635
636 b, err = readNBytes(r, 20)
637 if err != nil {
638 return nil, err
639 }
640 pPointsA := int(binary.LittleEndian.Uint32(b[:4]))
641 pPointsB1 := int(binary.LittleEndian.Uint32(b[4:8]))
642 pPointsB2 := int(binary.LittleEndian.Uint32(b[8:12]))
643 pPointsC := int(binary.LittleEndian.Uint32(b[12:16]))
644 pPointsHExps := int(binary.LittleEndian.Uint32(b[16:20]))
645 o += 20
646
647 b, err = readNBytes(r, 64)
648 if err != nil {
649 return nil, err
650 }
651 pk.VkAlpha1 = new(bn256.G1)
652 _, err = pk.VkAlpha1.Unmarshal(fromMont1Q(b))
653 if err != nil {
654 return nil, err
655 }
656
657 b, err = readNBytes(r, 64)
658 if err != nil {
659 return nil, err
660 }
661 pk.VkBeta1 = new(bn256.G1)
662 _, err = pk.VkBeta1.Unmarshal(fromMont1Q(b))
663 if err != nil {
664 return nil, err
665 }
666
667 b, err = readNBytes(r, 64)
668 if err != nil {
669 return nil, err
670 }
671 pk.VkDelta1 = new(bn256.G1)
672 _, err = pk.VkDelta1.Unmarshal(fromMont1Q(b))
673 if err != nil {
674 return nil, err
675 }
676 b, err = readNBytes(r, 128)
677 if err != nil {
678 return nil, err
679 }
680 pk.VkBeta2 = new(bn256.G2)
681 _, err = pk.VkBeta2.Unmarshal(fromMont2Q(b))
682 if err != nil {
683 return nil, err
684 }
685 b, err = readNBytes(r, 128)
686 if err != nil {
687 return nil, err
688 }
689 pk.VkDelta2 = new(bn256.G2)
690 _, err = pk.VkDelta2.Unmarshal(fromMont2Q(b))
691 if err != nil {
692 return nil, err
693 }
694 o += 448
695 if o != pPolsA {
696 return nil, fmt.Errorf("Unexpected offset, expected: %v, actual: %v", pPolsA, o)
697 }
698
699 // PolsA
700 for i := 0; i < pk.NVars; i++ {
701 b, err = readNBytes(r, 4)
702 if err != nil {
703 return nil, err
704 }
705 keysLength := int(binary.LittleEndian.Uint32(b[:4]))
706 o += 4
707 polsMap := make(map[int]*big.Int)
708 for j := 0; j < keysLength; j++ {
709 bK, err := readNBytes(r, 4)
710 if err != nil {
711 return nil, err
712 }
713 key := int(binary.LittleEndian.Uint32(bK[:4]))
714 o += 4
715
716 b, err := readNBytes(r, 32)
717 if err != nil {
718 return nil, err
719 }
720 polsMap[key] = new(big.Int).SetBytes(fromMont1R(b[:32]))
721 o += 32
722 }
723 pk.PolsA = append(pk.PolsA, polsMap)
724 }
725 if o != pPolsB {
726 return nil, fmt.Errorf("Unexpected offset, expected: %v, actual: %v", pPolsB, o)
727 }
728 // PolsB
729 for i := 0; i < pk.NVars; i++ {
730 b, err = readNBytes(r, 4)
731 if err != nil {
732 return nil, err
733 }
734 keysLength := int(binary.LittleEndian.Uint32(b[:4]))
735 o += 4
736 polsMap := make(map[int]*big.Int)
737 for j := 0; j < keysLength; j++ {
738 bK, err := readNBytes(r, 4)
739 if err != nil {
740 return nil, err
741 }
742 key := int(binary.LittleEndian.Uint32(bK[:4]))
743 o += 4
744
745 b, err := readNBytes(r, 32)
746 if err != nil {
747 return nil, err
748 }
749 polsMap[key] = new(big.Int).SetBytes(fromMont1R(b[:32]))
750 o += 32
751 }
752 pk.PolsB = append(pk.PolsB, polsMap)
753 }
754 if o != pPointsA {
755 return nil, fmt.Errorf("Unexpected offset, expected: %v, actual: %v", pPointsA, o)
756 }
757 // A
758 for i := 0; i < pk.NVars; i++ {
759 b, err = readNBytes(r, 64)
760 if err != nil {
761 return nil, err
762 }
763 p1 := new(bn256.G1)
764 _, err = p1.Unmarshal(fromMont1Q(b))
765 if err != nil {
766 return nil, err
767 }
768 pk.A = append(pk.A, p1)
769 o += 64
770 }
771 if o != pPointsB1 {
772 return nil, fmt.Errorf("Unexpected offset, expected: %v, actual: %v", pPointsB1, o)
773 }
774 // B1
775 for i := 0; i < pk.NVars; i++ {
776 b, err = readNBytes(r, 64)
777 if err != nil {
778 return nil, err
779 }
780 p1 := new(bn256.G1)
781 _, err = p1.Unmarshal(fromMont1Q(b))
782 if err != nil {
783 return nil, err
784 }
785 pk.B1 = append(pk.B1, p1)
786 o += 64
787 }
788 if o != pPointsB2 {
789 return nil, fmt.Errorf("Unexpected offset, expected: %v, actual: %v", pPointsB2, o)
790 }
791 // B2
792 for i := 0; i < pk.NVars; i++ {
793 b, err = readNBytes(r, 128)
794 if err != nil {
795 return nil, err
796 }
797 p2 := new(bn256.G2)
798 _, err = p2.Unmarshal(fromMont2Q(b))
799 if err != nil {
800 return nil, err
801 }
802 pk.B2 = append(pk.B2, p2)
803 o += 128
804 }
805 if o != pPointsC {
806 return nil, fmt.Errorf("Unexpected offset, expected: %v, actual: %v", pPointsC, o)
807 }
808 // C
809 zb := make([]byte, 64)
810 z := new(bn256.G1)
811 _, err = z.Unmarshal(zb)
812 if err != nil {
813 return nil, err
814 }
815 pk.C = append(pk.C, z) // circom behaviour (3x null==["0", "0", "0"])
816 pk.C = append(pk.C, z)
817 pk.C = append(pk.C, z)
818 for i := pk.NPublic + 1; i < pk.NVars; i++ {
819 b, err = readNBytes(r, 64)
820 if err != nil {
821 return nil, err
822 }
823 p1 := new(bn256.G1)
824 _, err = p1.Unmarshal(fromMont1Q(b))
825 if err != nil {
826 return nil, err
827 }
828 pk.C = append(pk.C, p1)
829 o += 64
830 }
831 if o != pPointsHExps {
832 return nil, fmt.Errorf("Unexpected offset, expected: %v, actual: %v", pPointsHExps, o)
833 }
834 for i := 0; i < pk.DomainSize; i++ {
835 b, err = readNBytes(r, 64)
836 if err != nil {
837 return nil, err
838 }
839 p1 := new(bn256.G1)
840 _, err = p1.Unmarshal(fromMont1Q(b))
841 if err != nil {
842 return nil, err
843 }
844 pk.HExps = append(pk.HExps, p1)
845 }
846 return &pk, nil
847}
848
849func fromMont1Q(m []byte) []byte {
850 a := new(big.Int).SetBytes(swapEndianness(m[:32]))
851 b := new(big.Int).SetBytes(swapEndianness(m[32:64]))
852
853 x := coordFromMont(a, types.Q)
854 y := coordFromMont(b, types.Q)
855 if bytes.Equal(x.Bytes(), big.NewInt(1).Bytes()) {
856 x = big.NewInt(0)
857 }
858 if bytes.Equal(y.Bytes(), big.NewInt(1).Bytes()) {
859 y = big.NewInt(0)
860 }
861
862 xBytes := x.Bytes()
863 yBytes := y.Bytes()
864 if len(xBytes) != 32 {
865 xBytes = addZPadding(xBytes)
866 }
867 if len(yBytes) != 32 {
868 yBytes = addZPadding(yBytes)
869 }
870
871 var p []byte
872 p = append(p, xBytes...)
873 p = append(p, yBytes...)
874
875 return p
876}
877
878func fromMont2Q(m []byte) []byte {
879 a := new(big.Int).SetBytes(swapEndianness(m[:32]))
880 b := new(big.Int).SetBytes(swapEndianness(m[32:64]))
881 c := new(big.Int).SetBytes(swapEndianness(m[64:96]))
882 d := new(big.Int).SetBytes(swapEndianness(m[96:128]))
883
884 x := coordFromMont(a, types.Q)
885 y := coordFromMont(b, types.Q)
886 z := coordFromMont(c, types.Q)
887 t := coordFromMont(d, types.Q)
888
889 if bytes.Equal(x.Bytes(), big.NewInt(1).Bytes()) {
890 x = big.NewInt(0)
891 }
892 if bytes.Equal(y.Bytes(), big.NewInt(1).Bytes()) {
893 y = big.NewInt(0)
894 }
895 if bytes.Equal(z.Bytes(), big.NewInt(1).Bytes()) {
896 z = big.NewInt(0)
897 }
898 if bytes.Equal(t.Bytes(), big.NewInt(1).Bytes()) {
899 t = big.NewInt(0)
900 }
901
902 xBytes := x.Bytes()
903 yBytes := y.Bytes()
904 zBytes := z.Bytes()
905 tBytes := t.Bytes()
906 if len(xBytes) != 32 {
907 xBytes = addZPadding(xBytes)
908 }
909 if len(yBytes) != 32 {
910 yBytes = addZPadding(yBytes)
911 }
912 if len(zBytes) != 32 {
913 zBytes = addZPadding(zBytes)
914 }
915 if len(tBytes) != 32 {
916 tBytes = addZPadding(tBytes)
917 }
918
919 var p []byte
920 p = append(p, yBytes...) // swap
921 p = append(p, xBytes...)
922 p = append(p, tBytes...)
923 p = append(p, zBytes...)
924
925 return p
926}
927
928func fromMont1R(m []byte) []byte {
929 a := new(big.Int).SetBytes(swapEndianness(m[:32]))
930
931 x := coordFromMont(a, types.R)
932
933 return x.Bytes()
934}
935
936func fromMont2R(m []byte) []byte {
937 a := new(big.Int).SetBytes(swapEndianness(m[:32]))
938 b := new(big.Int).SetBytes(swapEndianness(m[32:64]))
939 c := new(big.Int).SetBytes(swapEndianness(m[64:96]))
940 d := new(big.Int).SetBytes(swapEndianness(m[96:128]))
941
942 x := coordFromMont(a, types.R)
943 y := coordFromMont(b, types.R)
944 z := coordFromMont(c, types.R)
945 t := coordFromMont(d, types.R)
946
947 var p []byte
948 p = append(p, y.Bytes()...) // swap
949 p = append(p, x.Bytes()...)
950 p = append(p, t.Bytes()...)
951 p = append(p, z.Bytes()...)
952
953 return p
954}
955
956func coordFromMont(u, q *big.Int) *big.Int {
957 return new(big.Int).Mod(
958 new(big.Int).Mul(
959 u,
960 new(big.Int).ModInverse(
961 new(big.Int).Lsh(big.NewInt(1), 256),
962 q,
963 ),
964 ),
965 q,
966 )
967}