1const bigInt = require("big-integer");
 2
 3const ZnField = require("./znfield.js");
 4const G1Curve = require("./g1curve");
 5const G2Curve = require("./g2curve");
 6const PolField = require("./polfield.js");
 7
 8const F = new ZnField(bigInt("21888242871839275222246405745257275088548364400416034343698204186575808495617"));
 9const G1 = new G1Curve();
10const G2 = new G2Curve();
11const PolF = new PolField(F);
12
13
14module.exports = function genProof(vk_proof, witness) {
15
16    const proof = {};
17
18    proof.pi_a = G1.zero();
19    proof.pi_ap = G1.zero();
20    proof.pi_b = G2.zero();
21    proof.pi_bp = G2.zero();
22    proof.pi_c = G1.zero();
23    proof.pi_cp = G1.zero();
24    proof.pi_kp = G1.zero();
25    proof.pi_h = G1.zero();
26
27
28    // Skip public entries and the "1" signal that are forced by the verifier
29    for (let s= vk_proof.nPublic+1; s< vk_proof.nSignals; s++) {
30
31        // pi_a  = pi_a  + A[s]  * witness[s];
32        proof.pi_a  = G1.add( proof.pi_a, G1.mulEscalar( vk_proof.A[s], witness[s]));
33
34        // pi_ap = pi_ap + Ap[s] * witness[s];
35        proof.pi_ap = G1.add( proof.pi_ap, G1.mulEscalar( vk_proof.Ap[s], witness[s]));
36    }
37
38    for (let s= 0; s< vk_proof.nSignals; s++) {
39        // pi_a  = pi_a  + A[s]  * witness[s];
40        proof.pi_b  = G2.add( proof.pi_b, G1.mulEscalar( vk_proof.B[s], witness[s]));
41
42        // pi_ap = pi_ap + Ap[s] * witness[s];
43        proof.pi_bp = G1.add( proof.pi_bp, G1.mulEscalar( vk_proof.Bp[s], witness[s]));
44
45        // pi_a  = pi_a  + A[s]  * witness[s];
46        proof.pi_c  = G1.add( proof.pi_c, G1.mulEscalar( vk_proof.C[s], witness[s]));
47
48        // pi_ap = pi_ap + Ap[s] * witness[s];
49        proof.pi_cp = G1.add( proof.pi_cp, G1.mulEscalar( vk_proof.Cp[s], witness[s]));
50
51        // pi_ap = pi_ap + Ap[s] * witness[s];
52        proof.pi_kp = G1.add( proof.pi_kp, G1.mulEscalar( vk_proof.Kp[s], witness[s]));
53    }
54
55    let polA = [];
56    let polB = [];
57    let polC = [];
58
59    for (let s= 0; s< vk_proof.nSignals; s++) {
60        polA = PolF.add(
61            polA,
62            PolF.mul(
63                vk_proof.polsA[s],
64                [witness[s]] ));
65
66        polB = PolF.add(
67            polB,
68            PolF.mul(
69                vk_proof.polsB[s],
70                [witness[s]] ));
71
72        polC = PolF.add(
73            polC,
74            PolF.mul(
75                vk_proof.polsC[s],
76                [witness[s]] ));
77    }
78
79    let polFull = PolF.sub(PolF.mul( polA, polB), polC);
80
81    const h = PolF.div(polFull, vk_proof.polZ );
82
83    for (let i = 0; i < h.length; i++) {
84        proof.pi_h = G1.add( proof.pi_h, G1.mulEscalar( vk_proof.hExps[i], h[i]));
85    }
86
87};