1/// Implements the scheme described in [Nova](https://eprint.iacr.org/2021/370.pdf)
  2use ark_crypto_primitives::{
  3    crh::{poseidon::CRH, CRHScheme},
  4    sponge::{poseidon::PoseidonConfig, Absorb},
  5};
  6use ark_ec::{CurveGroup, Group};
  7use ark_std::fmt::Debug;
  8use ark_std::{One, Zero};
  9
 10use crate::folding::circuits::nonnative::point_to_nonnative_limbs;
 11use crate::pedersen::{Params as PedersenParams, Pedersen};
 12use crate::utils::vec::is_zero_vec;
 13use crate::Error;
 14
 15pub mod circuits;
 16pub mod cyclefold;
 17pub mod ivc;
 18pub mod nifs;
 19pub mod traits;
 20
 21#[derive(Debug, Clone, Eq, PartialEq)]
 22pub struct CommittedInstance<C: CurveGroup> {
 23    pub cmE: C,
 24    pub u: C::ScalarField,
 25    pub cmW: C,
 26    pub x: Vec<C::ScalarField>,
 27}
 28
 29impl<C: CurveGroup> CommittedInstance<C> {
 30    pub fn dummy(io_len: usize) -> Self {
 31        Self {
 32            cmE: C::zero(),
 33            u: C::ScalarField::zero(),
 34            cmW: C::zero(),
 35            x: vec![C::ScalarField::zero(); io_len],
 36        }
 37    }
 38}
 39
 40impl<C: CurveGroup> CommittedInstance<C>
 41where
 42    <C as Group>::ScalarField: Absorb,
 43    <C as ark_ec::CurveGroup>::BaseField: ark_ff::PrimeField,
 44{
 45    /// hash implements the committed instance hash compatible with the gadget implemented in
 46    /// nova/circuits.rs::CommittedInstanceVar.hash.
 47    /// Returns `H(i, z_0, z_i, U_i)`, where `i` can be `i` but also `i+1`, and `U` is the
 48    /// `CommittedInstance`.
 49    pub fn hash(
 50        &self,
 51        poseidon_config: &PoseidonConfig<C::ScalarField>,
 52        i: C::ScalarField,
 53        z_0: Vec<C::ScalarField>,
 54        z_i: Vec<C::ScalarField>,
 55    ) -> Result<C::ScalarField, Error> {
 56        let (cmE_x, cmE_y) = point_to_nonnative_limbs::<C>(self.cmE)?;
 57        let (cmW_x, cmW_y) = point_to_nonnative_limbs::<C>(self.cmW)?;
 58
 59        CRH::<C::ScalarField>::evaluate(
 60            poseidon_config,
 61            vec![
 62                vec![i],
 63                z_0,
 64                z_i,
 65                vec![self.u],
 66                self.x.clone(),
 67                cmE_x,
 68                cmE_y,
 69                cmW_x,
 70                cmW_y,
 71            ]
 72            .concat(),
 73        )
 74        .map_err(|e| Error::Other(e.to_string()))
 75    }
 76}
 77
 78#[derive(Debug, Clone, Eq, PartialEq)]
 79pub struct Witness<C: CurveGroup> {
 80    pub E: Vec<C::ScalarField>,
 81    pub rE: C::ScalarField,
 82    pub W: Vec<C::ScalarField>,
 83    pub rW: C::ScalarField,
 84}
 85
 86impl<C: CurveGroup> Witness<C>
 87where
 88    <C as Group>::ScalarField: Absorb,
 89{
 90    pub fn new(w: Vec<C::ScalarField>, e_len: usize) -> Self {
 91        Self {
 92            E: vec![C::ScalarField::zero(); e_len],
 93            rE: C::ScalarField::zero(), // because we use C::zero() as cmE
 94            W: w,
 95            rW: C::ScalarField::one(),
 96        }
 97    }
 98    pub fn commit(
 99        &self,
100        params: &PedersenParams<C>,
101        x: Vec<C::ScalarField>,
102    ) -> Result<CommittedInstance<C>, Error> {
103        let mut cmE = C::zero();
104        if !is_zero_vec::<C::ScalarField>(&self.E) {
105            cmE = Pedersen::commit(params, &self.E, &self.rE)?;
106        }
107        let cmW = Pedersen::commit(params, &self.W, &self.rW)?;
108        Ok(CommittedInstance {
109            cmE,
110            u: C::ScalarField::one(),
111            cmW,
112            x,
113        })
114    }
115}