go-snark/README.md
README.mdRaw
1### Warning
2Implementation of the zkSNARK [Pinocchio protocol](https://eprint.iacr.org/2013/279.pdf) and [Groth16 protocol](https://eprint.iacr.org/2016/260.pdf) from scratch in Go done in my free time to understand the concepts. Do not use in production.
3
4If you want to generate proofs & verify them from Go, you can try https://github.com/vocdoni/go-snark, which is implemented using the [bn256](https://github.com/ethereum/go-ethereum/tree/master/crypto/bn256/cloudflare) for the Pairing curve operations for the Groth16 zkSNARK, and it is compatible with [circom](https://github.com/iden3/circom).
5
6# go-snark [](https://goreportcard.com/report/github.com/arnaucube/go-snark) [](https://godoc.org/github.com/arnaucube/go-snark)
7
8zkSNARK library implementation in Go
9
10- `Succinct Non-Interactive Zero Knowledge for a von Neumann Architecture`, Eli Ben-Sasson, Alessandro Chiesa, Eran Tromer, Madars Virza https://eprint.iacr.org/2013/879.pdf
11- `Pinocchio: Nearly practical verifiable computation`, Bryan Parno, Craig Gentry, Jon Howell, Mariana Raykova https://eprint.iacr.org/2013/279.pdf
12- `On the Size of Pairing-based Non-interactive Arguments`, Jens Groth https://eprint.iacr.org/2016/260.pdf
13
14## Features
15Currently allows to do the complete path with [Pinocchio protocol](https://eprint.iacr.org/2013/279.pdf) and [Groth16 protocol](https://eprint.iacr.org/2016/260.pdf) :
16
170. write circuit
181. compile circuit
192. generate trusted setup
203. calculate witness
214. generate proofs
225. verify proofs
23
24Minimal complete flow implementation:
25- [x] Finite Fields (1, 2, 6, 12) operations
26- [x] G1 and G2 curve operations
27- [x] BN128 Pairing
28- [x] circuit flat code compiler
29- [x] circuit to R1CS
30- [x] polynomial operations
31- [x] R1CS to QAP
32- [x] generate trusted setup
33- [x] generate proofs
34- [x] verify proofs with BN128 pairing
35
36## WASM usage
37Experimentation with go-snark compiled to wasm: https://github.com/arnaucube/go-snark/tree/master/wasm
38
39## Usage
40- [](https://godoc.org/github.com/arnaucube/go-snark) zkSnark
41- [](https://godoc.org/github.com/arnaucube/go-snark/groth16) zkSnark Groth16
42- [](https://godoc.org/github.com/arnaucube/go-snark/bn128) bn128 (more details: https://github.com/arnaucube/go-snark/tree/master/bn128)
43- [](https://godoc.org/github.com/arnaucube/go-snark/fields) Finite Fields operations
44- [](https://godoc.org/github.com/arnaucube/go-snark/r1csqap) R1CS to QAP (more details: https://github.com/arnaucube/go-snark/tree/master/r1csqap)
45- [](https://godoc.org/github.com/arnaucube/go-snark/circuitcompiler) Circuit Compiler
46
47### CLI usage
48*The cli still needs some improvements, such as seting input files, etc.*
49
50In this example we will follow the equation example from [Vitalik](https://medium.com/@VitalikButerin/quadratic-arithmetic-programs-from-zero-to-hero-f6d558cea649)'s article: `y = x^3 + x + 5`, where `y==35` and `x==3`. So we want to prove that we know a secret `x` such as the result of the equation is `35`.
51
52#### Compile circuit
53Having a circuit file `test.circuit`:
54```
55func exp3(private a):
56 b = a * a
57 c = a * b
58 return c
59
60func main(private s0, public s1):
61 s3 = exp3(s0)
62 s4 = s3 + s0
63 s5 = s4 + 5
64 equals(s1, s5)
65 out = 1 * 1
66```
67And a private inputs file `privateInputs.json`
68```
69[
70 3
71]
72```
73And a public inputs file `publicInputs.json`
74```
75[
76 35
77]
78```
79
80In the command line, execute:
81```
82> ./go-snark-cli compile test.circuit
83```
84If you want to have the wasm input ready also, add the flag `wasm`
85```
86> ./go-snark-cli compile test.circuit wasm
87```
88
89This will output the `compiledcircuit.json` file.
90
91#### Trusted Setup
92Having the `compiledcircuit.json`, now we can generate the `TrustedSetup`:
93```
94> ./go-snark-cli trustedsetup
95```
96This will create the file `trustedsetup.json` with the TrustedSetup data, and also a `toxic.json` file, with the parameters to delete from the `Trusted Setup`.
97
98If you want to have the wasm input ready also, add the flag `wasm`
99```
100> ./go-snark-cli trustedsetup wasm
101```
102
103#### Generate Proofs
104Assumming that we have the `compiledcircuit.json`, `trustedsetup.json`, `privateInputs.json` and the `publicInputs.json` we can now generate the `Proofs` with the following command:
105```
106> ./go-snark-cli genproofs
107```
108
109This will store the file `proofs.json`, that contains all the SNARK proofs.
110
111#### Verify Proofs
112Having the `proofs.json`, `compiledcircuit.json`, `trustedsetup.json` `publicInputs.json` files, we can now verify the `Pairings` of the proofs, in order to verify the proofs.
113```
114> ./go-snark-cli verify
115```
116This will return a `true` if the proofs are verified, or a `false` if the proofs are not verified.
117
118### Cli using Groth16
119All this process can be done using [Groth16 protocol](https://eprint.iacr.org/2016/260.pdf) protocol:
120```
121> ./go-snark-cli compile test.circuit
122> ./go-snark-cli groth16 trustedsetup
123> ./go-snark-cli groth16 genproofs
124> ./go-snark-cli verify
125```
126
127
128
129### Library usage
130
131Example:
132```go
133// compile circuit and get the R1CS
134flatCode := `
135func exp3(private a):
136 b = a * a
137 c = a * b
138 return c
139
140func main(private s0, public s1):
141 s3 = exp3(s0)
142 s4 = s3 + s0
143 s5 = s4 + 5
144 equals(s1, s5)
145 out = 1 * 1
146`
147
148// parse the code
149parser := circuitcompiler.NewParser(strings.NewReader(flatCode))
150circuit, err := parser.Parse()
151assert.Nil(t, err)
152fmt.Println(circuit)
153
154
155b3 := big.NewInt(int64(3))
156privateInputs := []*big.Int{b3}
157b35 := big.NewInt(int64(35))
158publicSignals := []*big.Int{b35}
159
160// witness
161w, err := circuit.CalculateWitness(privateInputs, publicSignals)
162assert.Nil(t, err)
163fmt.Println("witness", w)
164
165// now we have the witness:
166// w = [1 35 3 9 27 30 35 1]
167
168// flat code to R1CS
169fmt.Println("generating R1CS from flat code")
170a, b, c := circuit.GenerateR1CS()
171
172/*
173now we have the R1CS from the circuit:
174a: [[0 0 1 0 0 0 0 0] [0 0 1 0 0 0 0 0] [0 0 1 0 1 0 0 0] [5 0 0 0 0 1 0 0] [0 0 0 0 0 0 1 0] [0 1 0 0 0 0 0 0] [1 0 0 0 0 0 0 0]]
175b: [[0 0 1 0 0 0 0 0] [0 0 0 1 0 0 0 0] [1 0 0 0 0 0 0 0] [1 0 0 0 0 0 0 0] [1 0 0 0 0 0 0 0] [1 0 0 0 0 0 0 0] [1 0 0 0 0 0 0 0]]
176c: [[0 0 0 1 0 0 0 0] [0 0 0 0 1 0 0 0] [0 0 0 0 0 1 0 0] [0 0 0 0 0 0 1 0] [0 1 0 0 0 0 0 0] [0 0 0 0 0 0 1 0] [0 0 0 0 0 0 0 1]]
177*/
178
179
180alphas, betas, gammas, _ := snark.Utils.PF.R1CSToQAP(a, b, c)
181
182
183ax, bx, cx, px := Utils.PF.CombinePolynomials(w, alphas, betas, gammas)
184
185// calculate trusted setup
186setup, err := GenerateTrustedSetup(len(w), *circuit, alphas, betas, gammas)
187
188hx := Utils.PF.DivisorPolynomial(px, setup.Pk.Z)
189
190proof, err := GenerateProofs(*circuit, setup, w, px)
191
192b35Verif := big.NewInt(int64(35))
193publicSignalsVerif := []*big.Int{b35Verif}
194assert.True(t, VerifyProof(*circuit, setup, proof, publicSignalsVerif, true))
195```
196
197##### Verify Proof generated from [snarkjs](https://github.com/iden3/snarkjs)
198Is possible with `go-snark` to verify proofs generated by `snarkjs`
199
200Example:
201```go
202verified, err := VerifyFromCircom("circom-test/verification_key.json", "circom-test/proof.json", "circom-test/public.json")
203assert.Nil(t, err)
204assert.True(t, verified)
205```
206
207
208## Versions
209History of versions & tags of this project:
210- v0.0.1: zkSnark complete flow working with Pinocchio protocol
211- v0.0.2: circuit language improved (allow function calls and file imports)
212- v0.0.3: Groth16 zkSnark protocol added
213
214## Test
215```
216go test ./... -v
217```
218
219## vim/nvim circuit syntax highlighter
220For more details and installation instructions see https://github.com/arnaucube/go-snark/tree/master/vim-syntax
221
222---
223
224
225Thanks to [@jbaylina](https://github.com/jbaylina), [@bellesmarta](https://github.com/bellesmarta), [@adriamb](https://github.com/adriamb) for their explanations that helped to understand this a little bit. Also thanks to [@vbuterin](https://github.com/vbuterin) for all the published articles explaining the zkSNARKs.