go-snark/README.md
README.mdRaw
1# go-snark [](https://goreportcard.com/report/github.com/arnaucube/go-snark) [](https://travis-ci.org/arnaucube/go-snark) [](https://gitter.im/go-snark/community?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge)
2
3zkSNARK library implementation in Go
4
5
6- `Succinct Non-Interactive Zero Knowledge for a von Neumann Architecture`, Eli Ben-Sasson, Alessandro Chiesa, Eran Tromer, Madars Virza https://eprint.iacr.org/2013/879.pdf
7- `Pinocchio: Nearly practical verifiable computation`, Bryan Parno, Craig Gentry, Jon Howell, Mariana Raykova https://eprint.iacr.org/2013/279.pdf
8- `On the Size of Pairing-based Non-interactive Arguments`, Jens Groth https://eprint.iacr.org/2016/260.pdf
9
10## Caution & Warning
11Implementation of the zkSNARK [Pinocchio protocol](https://eprint.iacr.org/2013/279.pdf) and [Groth16 protocol](https://eprint.iacr.org/2016/260.pdf) from scratch in Go to understand the concepts. Do not use in production.
12
13Not finished, implementing this in my free time to understand it better, so I don't have much time.
14
15Currently allows to do the complete path with [Pinocchio protocol](https://eprint.iacr.org/2013/279.pdf) and [Groth16 protocol](https://eprint.iacr.org/2016/260.pdf) :
16
170. write circuit
181. compile circuit
192. generate trusted setup
203. calculate witness
214. generate proofs
225. verify proofs
23
24Minimal complete flow implementation:
25- [x] Finite Fields (1, 2, 6, 12) operations
26- [x] G1 and G2 curve operations
27- [x] BN128 Pairing
28- [x] circuit flat code compiler
29- [x] circuit to R1CS
30- [x] polynomial operations
31- [x] R1CS to QAP
32- [x] generate trusted setup
33- [x] generate proofs
34- [x] verify proofs with BN128 pairing
35
36Improvements from the minimal implementation:
37- [x] allow to call functions in circuits language
38- [x] allow `import` in circuits language
39- [ ] allow `for` in circuits language
40- [ ] move witness values calculation outside the setup phase
41- [x] Groth16
42- [ ] multiple optimizations
43
44
45## Usage
46- [](https://godoc.org/github.com/arnaucube/go-snark) zkSnark
47- [](https://godoc.org/github.com/arnaucube/go-snark/groth16) zkSnark Groth16
48- [](https://godoc.org/github.com/arnaucube/go-snark/bn128) bn128 (more details: https://github.com/arnaucube/go-snark/tree/master/bn128)
49- [](https://godoc.org/github.com/arnaucube/go-snark/fields) Finite Fields operations
50- [](https://godoc.org/github.com/arnaucube/go-snark/r1csqap) R1CS to QAP (more details: https://github.com/arnaucube/go-snark/tree/master/r1csqap)
51- [](https://godoc.org/github.com/arnaucube/go-snark/circuitcompiler) Circuit Compiler
52
53### CLI usage
54*The cli still needs some improvements, such as seting input files, etc.*
55
56In this example we will follow the equation example from [Vitalik](https://medium.com/@VitalikButerin/quadratic-arithmetic-programs-from-zero-to-hero-f6d558cea649)'s article: `y = x^3 + x + 5`, where `y==35` and `x==3`. So we want to prove that we know a secret `x` such as the result of the equation is `35`.
57
58#### Compile circuit
59Having a circuit file `test.circuit`:
60```
61func exp3(private a):
62 b = a * a
63 c = a * b
64 return c
65
66func main(private s0, public s1):
67 s3 = exp3(s0)
68 s4 = s3 + s0
69 s5 = s4 + 5
70 equals(s1, s5)
71 out = 1 * 1
72```
73And a private inputs file `privateInputs.json`
74```
75[
76 3
77]
78```
79And a public inputs file `publicInputs.json`
80```
81[
82 35
83]
84```
85
86In the command line, execute:
87```
88> ./go-snark-cli compile test.circuit
89```
90
91This will output the `compiledcircuit.json` file.
92
93#### Trusted Setup
94Having the `compiledcircuit.json`, now we can generate the `TrustedSetup`:
95```
96> ./go-snark-cli trustedsetup
97```
98This will create the file `trustedsetup.json` with the TrustedSetup data, and also a `toxic.json` file, with the parameters to delete from the `Trusted Setup`.
99
100
101#### Generate Proofs
102Assumming that we have the `compiledcircuit.json`, `trustedsetup.json`, `privateInputs.json` and the `publicInputs.json` we can now generate the `Proofs` with the following command:
103```
104> ./go-snark-cli genproofs
105```
106
107This will store the file `proofs.json`, that contains all the SNARK proofs.
108
109#### Verify Proofs
110Having the `proofs.json`, `compiledcircuit.json`, `trustedsetup.json` `publicInputs.json` files, we can now verify the `Pairings` of the proofs, in order to verify the proofs.
111```
112> ./go-snark-cli verify
113```
114This will return a `true` if the proofs are verified, or a `false` if the proofs are not verified.
115
116### Cli using Groth16
117All this process can be done using [Groth16 protocol](https://eprint.iacr.org/2016/260.pdf) protocol:
118```
119> ./go-snark-cli compile test.circuit
120> ./go-snark-cli groth16 trustedsetup
121> ./go-snark-cli groth16 genproofs
122> ./go-snark-cli verify
123```
124
125
126
127### Library usage
128
129Example:
130```go
131// compile circuit and get the R1CS
132flatCode := `
133func exp3(private a):
134 b = a * a
135 c = a * b
136 return c
137
138func main(private s0, public s1):
139 s3 = exp3(s0)
140 s4 = s3 + s0
141 s5 = s4 + 5
142 equals(s1, s5)
143 out = 1 * 1
144`
145
146// parse the code
147parser := circuitcompiler.NewParser(strings.NewReader(flatCode))
148circuit, err := parser.Parse()
149assert.Nil(t, err)
150fmt.Println(circuit)
151
152
153b3 := big.NewInt(int64(3))
154privateInputs := []*big.Int{b3}
155b35 := big.NewInt(int64(35))
156publicSignals := []*big.Int{b35}
157
158// witness
159w, err := circuit.CalculateWitness(privateInputs, publicSignals)
160assert.Nil(t, err)
161fmt.Println("witness", w)
162
163// now we have the witness:
164// w = [1 35 3 9 27 30 35 1]
165
166// flat code to R1CS
167fmt.Println("generating R1CS from flat code")
168a, b, c := circuit.GenerateR1CS()
169
170/*
171now we have the R1CS from the circuit:
172a: [[0 0 1 0 0 0 0 0] [0 0 1 0 0 0 0 0] [0 0 1 0 1 0 0 0] [5 0 0 0 0 1 0 0] [0 0 0 0 0 0 1 0] [0 1 0 0 0 0 0 0] [1 0 0 0 0 0 0 0]]
173b: [[0 0 1 0 0 0 0 0] [0 0 0 1 0 0 0 0] [1 0 0 0 0 0 0 0] [1 0 0 0 0 0 0 0] [1 0 0 0 0 0 0 0] [1 0 0 0 0 0 0 0] [1 0 0 0 0 0 0 0]]
174c: [[0 0 0 1 0 0 0 0] [0 0 0 0 1 0 0 0] [0 0 0 0 0 1 0 0] [0 0 0 0 0 0 1 0] [0 1 0 0 0 0 0 0] [0 0 0 0 0 0 1 0] [0 0 0 0 0 0 0 1]]
175*/
176
177
178alphas, betas, gammas, _ := snark.Utils.PF.R1CSToQAP(a, b, c)
179
180
181ax, bx, cx, px := Utils.PF.CombinePolynomials(w, alphas, betas, gammas)
182
183// calculate trusted setup
184setup, err := GenerateTrustedSetup(len(w), *circuit, alphas, betas, gammas)
185
186hx := Utils.PF.DivisorPolynomial(px, setup.Pk.Z)
187
188proof, err := GenerateProofs(*circuit, setup, w, px)
189
190b35Verif := big.NewInt(int64(35))
191publicSignalsVerif := []*big.Int{b35Verif}
192assert.True(t, VerifyProof(*circuit, setup, proof, publicSignalsVerif, true))
193```
194
195
196## Versions
197History of versions & tags of this project:
198- v0.0.1: zkSnark complete flow working with Pinocchio protocol
199- v0.0.2: circuit language improved (allow function calls and file imports)
200- v0.0.3: Groth16 zkSnark protocol added
201
202## Test
203```
204go test ./... -v
205```
206
207## vim/nvim circuit syntax highlighter
208For more details and installation instructions see https://github.com/arnaucube/go-snark/tree/master/vim-syntax
209
210---
211
212
213Thanks to [@jbaylina](https://github.com/jbaylina), [@bellesmarta](https://github.com/bellesmarta), [@adriamb](https://github.com/adriamb) for their explanations that helped to understand this a little bit. Also thanks to [@vbuterin](https://github.com/vbuterin) for all the published articles explaining the zkSNARKs.