M README.md → README.md

@@ -4,3 +4,5 @@ - AES: https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.197-upd1.pdf
 - AES-GCM (Galois Counter Mode): https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf
 
 > Warning: this code is unaudited.
+
+Example of usage at [examples](https://github.com/0xPARC/plonky2-aes/blob/main/examples) directory.

A examples/aes_gcm_128.rs

@@ -0,0 +1,45 @@
+//! Run in real mode: `cargo run --release --example aes_gcm_128`
+#![feature(generic_const_exprs)]
+
+use anyhow::Result;
+use plonky2::{
+    field::goldilocks_field::GoldilocksField as F,
+    iop::witness::PartialWitness,
+    plonk::{
+        circuit_builder::CircuitBuilder, circuit_data::CircuitConfig,
+        config::PoseidonGoldilocksConfig,
+    },
+};
+
+use plonky2_aes::{AesGcm128Target, D, KEY_LEN_128};
+
+fn main() -> Result<()> {
+    const L: usize = 42; // size (bytes) of plaintext to encrypt
+
+    let key: &[u8; KEY_LEN_128] = &[42; KEY_LEN_128];
+    let nonce: &[u8; 12] = &[111; 12];
+    let pt: &[u8; L] = &[42u8; L];
+
+    let (ct, tag) = plonky2_aes::native_gcm::encrypt::<4, 4, 10>(key, nonce, pt);
+
+    // Circuit declaration
+    let config = CircuitConfig::standard_recursion_config();
+    let mut builder = CircuitBuilder::<F, D>::new(config);
+    let aes_targets = AesGcm128Target::<L>::new_virtual(&mut builder);
+    aes_targets.build_circuit(&mut builder);
+
+    println!(
+        "AES-GCM-128 circuit (L:{}) num_gates: {}",
+        L,
+        builder.num_gates()
+    );
+
+    let data = builder.build::<PoseidonGoldilocksConfig>();
+
+    // set values to circuit
+    let mut pw = PartialWitness::<F>::new();
+    aes_targets.set_targets(&mut pw, key, nonce, pt, &ct, &tag)?;
+
+    let proof = data.prove(pw)?;
+    data.verify(proof)
+}

A examples/aes_gcm_256.rs

@@ -0,0 +1,45 @@
+//! Run in real mode: `cargo run --release --example aes_gcm_256`
+#![feature(generic_const_exprs)]
+
+use anyhow::Result;
+use plonky2::{
+    field::goldilocks_field::GoldilocksField as F,
+    iop::witness::PartialWitness,
+    plonk::{
+        circuit_builder::CircuitBuilder, circuit_data::CircuitConfig,
+        config::PoseidonGoldilocksConfig,
+    },
+};
+
+use plonky2_aes::{AesGcm256Target, D, KEY_LEN_256};
+
+fn main() -> Result<()> {
+    const L: usize = 42; // size (bytes) of plaintext to encrypt
+
+    let key: &[u8; KEY_LEN_256] = &[42; KEY_LEN_256];
+    let nonce: &[u8; 12] = &[111; 12];
+    let pt: &[u8; L] = &[42u8; L];
+
+    let (ct, tag) = plonky2_aes::native_gcm::encrypt::<8, 4, 14>(key, nonce, pt);
+
+    // Circuit declaration
+    let config = CircuitConfig::standard_recursion_config();
+    let mut builder = CircuitBuilder::<F, D>::new(config);
+    let aes_targets = AesGcm256Target::<L>::new_virtual(&mut builder);
+    aes_targets.build_circuit(&mut builder);
+
+    println!(
+        "AES-GCM-256 circuit (L:{}) num_gates: {}",
+        L,
+        builder.num_gates()
+    );
+
+    let data = builder.build::<PoseidonGoldilocksConfig>();
+
+    // set values to circuit
+    let mut pw = PartialWitness::<F>::new();
+    aes_targets.set_targets(&mut pw, key, nonce, pt, &ct, &tag)?;
+
+    let proof = data.prove(pw)?;
+    data.verify(proof)
+}

M src/lib.rs → src/lib.rs

@@ -12,43 +12,15 @@
 /// D defines the extension degree of the field used in the Plonky2 proofs (quadratic extension).
 pub const D: usize = 2;
 
-pub use circuit_aes::{ByteTarget, PartialWitnessByteArray};
+pub use circuit_gcm::AesGcmTarget;
 
-use circuit_gcm::AesGcmTarget;
-// use native_gcm::TAG_LEN;
-// use plonky2::{
-//     field::goldilocks_field::GoldilocksField as F, plonk::circuit_builder::CircuitBuilder,
-// };
+// expose pre-defined configurations (AES 128, 192, 256):
 
 pub type AesGcm128Target<const L: usize> = AesGcmTarget<4, 4, 10, L, false>;
 pub const KEY_LEN_128: usize = 4 * 4;
-// pub fn aes128_encrypt_target<const L: usize>(
-//     builder: &mut CircuitBuilder<F, D>,
-//     key: [ByteTarget; 4 * 4],
-//     nonce: &[ByteTarget; 12],
-//     pt: &[ByteTarget; L],
-// ) -> ([ByteTarget; L], [ByteTarget; TAG_LEN / 8]) {
-//     encrypt_target::<4, 4, 10, L, false>(builder, key, &nonce, &pt)
-// }
 
+pub const KEY_LEN_192: usize = 6 * 4;
 pub type AesGcm192Target<const L: usize> = AesGcmTarget<6, 4, 12, L, false>;
-// pub const KEY_LEN_192: usize = 6 * 4;
-// pub fn aes192_encrypt_target<const L: usize>(
-//     builder: &mut CircuitBuilder<F, D>,
-//     key: [ByteTarget; 6 * 4],
-//     nonce: &[ByteTarget; 12],
-//     pt: &[ByteTarget; L],
-// ) -> ([ByteTarget; L], [ByteTarget; TAG_LEN / 8]) {
-//     encrypt_target::<6, 4, 12, L, false>(builder, key, &nonce, &pt)
-// }
 
+pub const KEY_LEN_256: usize = 8 * 4;
 pub type AesGcm256Target<const L: usize> = AesGcmTarget<8, 4, 14, L, false>;
-// pub const KEY_LEN_256: usize = 8 * 4;
-// pub fn aes256_encrypt_target<const L: usize>(
-//     builder: &mut CircuitBuilder<F, D>,
-//     key: [ByteTarget; 8 * 4],
-//     nonce: &[ByteTarget; 12],
-//     pt: &[ByteTarget; L],
-// ) -> ([ByteTarget; L], [ByteTarget; TAG_LEN / 8]) {
-//     encrypt_target::<8, 4, 14, L, false>(builder, key, &nonce, &pt)
-// }