1const BN128 = require("./BN128.js");
 2const PolField = require("./polfield.js");
 3const ZqField = require("./zqfield.js");
 4
 5const bn128 = new BN128();
 6const PolF = new PolField(new ZqField(bn128.r));
 7const G1 = bn128.G1;
 8const G2 = bn128.G2;
 9
10module.exports = function genProof(vk_proof, witness) {
11
12    const proof = {};
13
14    proof.pi_a = G1.zero;
15    proof.pi_ap = G1.zero;
16    proof.pi_b = G2.zero;
17    proof.pi_bp = G1.zero;
18    proof.pi_c = G1.zero;
19    proof.pi_cp = G1.zero;
20    proof.pi_kp = G1.zero;
21    proof.pi_h = G1.zero;
22
23
24    // Skip public entries and the "1" signal that are forced by the verifier
25    for (let s= vk_proof.nPublic+1; s< vk_proof.nVars; s++) {
26
27        // pi_a  = pi_a  + A[s]  * witness[s];
28        proof.pi_a  = G1.add( proof.pi_a, G1.mulScalar( vk_proof.A[s], witness[s]));
29
30        // pi_ap = pi_ap + Ap[s] * witness[s];
31        proof.pi_ap = G1.add( proof.pi_ap, G1.mulScalar( vk_proof.Ap[s], witness[s]));
32    }
33
34    for (let s= 0; s< vk_proof.nVars; s++) {
35        // pi_a  = pi_a  + A[s]  * witness[s];
36        proof.pi_b  = G2.add( proof.pi_b, G2.mulScalar( vk_proof.B[s], witness[s]));
37
38        // pi_ap = pi_ap + Ap[s] * witness[s];
39        proof.pi_bp = G1.add( proof.pi_bp, G1.mulScalar( vk_proof.Bp[s], witness[s]));
40
41        // pi_a  = pi_a  + A[s]  * witness[s];
42        proof.pi_c  = G1.add( proof.pi_c, G1.mulScalar( vk_proof.C[s], witness[s]));
43
44        // pi_ap = pi_ap + Ap[s] * witness[s];
45        proof.pi_cp = G1.add( proof.pi_cp, G1.mulScalar( vk_proof.Cp[s], witness[s]));
46
47        // pi_ap = pi_ap + Ap[s] * witness[s];
48        proof.pi_kp = G1.add( proof.pi_kp, G1.mulScalar( vk_proof.Kp[s], witness[s]));
49    }
50
51    let polA = [];
52    let polB = [];
53    let polC = [];
54
55    for (let s= 0; s< vk_proof.nVars; s++) {
56        polA = PolF.add(
57            polA,
58            PolF.mul(
59                vk_proof.polsA[s],
60                [witness[s]] ));
61
62        polB = PolF.add(
63            polB,
64            PolF.mul(
65                vk_proof.polsB[s],
66                [witness[s]] ));
67
68        polC = PolF.add(
69            polC,
70            PolF.mul(
71                vk_proof.polsC[s],
72                [witness[s]] ));
73    }
74
75    let polFull = PolF.sub(PolF.mul( polA, polB), polC);
76
77    const h = PolF.div(polFull, vk_proof.polZ );
78
79    for (let i = 0; i < h.length; i++) {
80        proof.pi_h = G1.add( proof.pi_h, G1.mulScalar( vk_proof.hExps[i], h[i]));
81    }
82
83    proof.pi_a = G1.affine(proof.pi_a);
84    proof.pi_b = G2.affine(proof.pi_b);
85    proof.pi_c = G1.affine(proof.pi_c);
86    proof.pi_ap = G1.affine(proof.pi_ap);
87    proof.pi_bp = G1.affine(proof.pi_bp);
88    proof.pi_cp = G1.affine(proof.pi_cp);
89    proof.pi_kp = G1.affine(proof.pi_kp);
90    proof.pi_h = G1.affine(proof.pi_h);
91
92    const publicSignals = witness.slice(1, vk_proof.nPublic+1);
93
94    return {proof, publicSignals};
95};