1/*
  2    Copyright 2018 0kims association.
  3
  4    This file is part of zksnark JavaScript library.
  5
  6    zksnark JavaScript library is a free software: you can redistribute it and/or 
  7    modify it under the terms of the GNU General Public License as published by the 
  8    Free Software Foundation, either version 3 of the License, or (at your option) 
  9    any later version.
 10
 11    zksnark JavaScript library is distributed in the hope that it will be useful,
 12    but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 
 13    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for 
 14    more details.
 15
 16    You should have received a copy of the GNU General Public License along with 
 17    zksnark JavaScript library. If not, see <https://www.gnu.org/licenses/>.
 18*/
 19
 20const BN128 = require("./bn128.js");
 21const PolField = require("./polfield.js");
 22const ZqField = require("./zqfield.js");
 23
 24const bn128 = new BN128();
 25const PolF = new PolField(new ZqField(bn128.r));
 26const G1 = bn128.G1;
 27const G2 = bn128.G2;
 28
 29module.exports = function genProof(vk_proof, witness) {
 30
 31    const proof = {};
 32
 33    proof.pi_a = G1.zero;
 34    proof.pi_ap = G1.zero;
 35    proof.pi_b = G2.zero;
 36    proof.pi_bp = G1.zero;
 37    proof.pi_c = G1.zero;
 38    proof.pi_cp = G1.zero;
 39    proof.pi_kp = G1.zero;
 40    proof.pi_h = G1.zero;
 41
 42
 43    // Skip public entries and the "1" signal that are forced by the verifier
 44    for (let s= vk_proof.nPublic+1; s< vk_proof.nVars; s++) {
 45
 46        // pi_a  = pi_a  + A[s]  * witness[s];
 47        proof.pi_a  = G1.add( proof.pi_a, G1.mulScalar( vk_proof.A[s], witness[s]));
 48
 49        // pi_ap = pi_ap + Ap[s] * witness[s];
 50        proof.pi_ap = G1.add( proof.pi_ap, G1.mulScalar( vk_proof.Ap[s], witness[s]));
 51    }
 52
 53    for (let s= 0; s< vk_proof.nVars; s++) {
 54        // pi_a  = pi_a  + A[s]  * witness[s];
 55        proof.pi_b  = G2.add( proof.pi_b, G2.mulScalar( vk_proof.B[s], witness[s]));
 56
 57        // pi_ap = pi_ap + Ap[s] * witness[s];
 58        proof.pi_bp = G1.add( proof.pi_bp, G1.mulScalar( vk_proof.Bp[s], witness[s]));
 59
 60        // pi_a  = pi_a  + A[s]  * witness[s];
 61        proof.pi_c  = G1.add( proof.pi_c, G1.mulScalar( vk_proof.C[s], witness[s]));
 62
 63        // pi_ap = pi_ap + Ap[s] * witness[s];
 64        proof.pi_cp = G1.add( proof.pi_cp, G1.mulScalar( vk_proof.Cp[s], witness[s]));
 65
 66        // pi_ap = pi_ap + Ap[s] * witness[s];
 67        proof.pi_kp = G1.add( proof.pi_kp, G1.mulScalar( vk_proof.Kp[s], witness[s]));
 68    }
 69
 70    let polA = [];
 71    let polB = [];
 72    let polC = [];
 73
 74    for (let s= 0; s< vk_proof.nVars; s++) {
 75        polA = PolF.add(
 76            polA,
 77            PolF.mul(
 78                vk_proof.polsA[s],
 79                [witness[s]] ));
 80
 81        polB = PolF.add(
 82            polB,
 83            PolF.mul(
 84                vk_proof.polsB[s],
 85                [witness[s]] ));
 86
 87        polC = PolF.add(
 88            polC,
 89            PolF.mul(
 90                vk_proof.polsC[s],
 91                [witness[s]] ));
 92    }
 93
 94    let polFull = PolF.sub(PolF.mul( polA, polB), polC);
 95
 96    const h = PolF.div(polFull, vk_proof.polZ );
 97
 98    //    console.log(h.length + "/" + vk_proof.hExps.length);
 99
100    for (let i = 0; i < h.length; i++) {
101        proof.pi_h = G1.add( proof.pi_h, G1.mulScalar( vk_proof.hExps[i], h[i]));
102    }
103
104    proof.pi_a = G1.affine(proof.pi_a);
105    proof.pi_b = G2.affine(proof.pi_b);
106    proof.pi_c = G1.affine(proof.pi_c);
107    proof.pi_ap = G1.affine(proof.pi_ap);
108    proof.pi_bp = G1.affine(proof.pi_bp);
109    proof.pi_cp = G1.affine(proof.pi_cp);
110    proof.pi_kp = G1.affine(proof.pi_kp);
111    proof.pi_h = G1.affine(proof.pi_h);
112
113    const publicSignals = witness.slice(1, vk_proof.nPublic+1);
114
115    return {proof, publicSignals};
116};