1/// Implements the scheme described in [Nova](https://eprint.iacr.org/2021/370.pdf)
  2use ark_crypto_primitives::{
  3    crh::{poseidon::CRH, CRHScheme},
  4    sponge::{poseidon::PoseidonConfig, Absorb},
  5};
  6use ark_ec::{CurveGroup, Group};
  7use ark_std::fmt::Debug;
  8use ark_std::{One, Zero};
  9
 10use crate::folding::circuits::nonnative::point_to_nonnative_limbs;
 11use crate::pedersen::{Params as PedersenParams, Pedersen};
 12use crate::Error;
 13
 14pub mod circuits;
 15pub mod nifs;
 16
 17#[derive(Debug, Clone, Eq, PartialEq)]
 18pub struct CommittedInstance<C: CurveGroup> {
 19    pub cmE: C,
 20    pub u: C::ScalarField,
 21    pub cmW: C,
 22    pub x: Vec<C::ScalarField>,
 23}
 24
 25impl<C: CurveGroup> CommittedInstance<C>
 26where
 27    <C as Group>::ScalarField: Absorb,
 28    <C as ark_ec::CurveGroup>::BaseField: ark_ff::PrimeField,
 29{
 30    pub fn empty() -> Self {
 31        CommittedInstance {
 32            cmE: C::zero(),
 33            u: C::ScalarField::one(),
 34            cmW: C::zero(),
 35            x: Vec::new(),
 36        }
 37    }
 38
 39    /// hash implements the committed instance hash compatible with the gadget implemented in
 40    /// nova/circuits.rs::CommittedInstanceVar.hash.
 41    /// Returns `H(i, z_0, z_i, U_i)`, where `i` can be `i` but also `i+1`, and `U` is the
 42    /// `CommittedInstance`.
 43    pub fn hash(
 44        &self,
 45        poseidon_config: &PoseidonConfig<C::ScalarField>,
 46        i: C::ScalarField,
 47        z_0: C::ScalarField,
 48        z_i: C::ScalarField,
 49    ) -> Result<C::ScalarField, Error> {
 50        let (cmE_x, cmE_y) = point_to_nonnative_limbs::<C>(self.cmE)?;
 51        let (cmW_x, cmW_y) = point_to_nonnative_limbs::<C>(self.cmW)?;
 52
 53        Ok(CRH::<C::ScalarField>::evaluate(
 54            poseidon_config,
 55            vec![
 56                vec![i, z_0, z_i, self.u],
 57                self.x.clone(),
 58                cmE_x,
 59                cmE_y,
 60                cmW_x,
 61                cmW_y,
 62            ]
 63            .concat(),
 64        )
 65        .unwrap())
 66    }
 67}
 68
 69#[derive(Debug, Clone, Eq, PartialEq)]
 70pub struct Witness<C: CurveGroup> {
 71    pub E: Vec<C::ScalarField>,
 72    pub rE: C::ScalarField,
 73    pub W: Vec<C::ScalarField>,
 74    pub rW: C::ScalarField,
 75}
 76
 77impl<C: CurveGroup> Witness<C>
 78where
 79    <C as Group>::ScalarField: Absorb,
 80{
 81    pub fn new(w: Vec<C::ScalarField>, e_len: usize) -> Self {
 82        Self {
 83            E: vec![C::ScalarField::zero(); e_len],
 84            rE: C::ScalarField::one(),
 85            W: w,
 86            rW: C::ScalarField::one(),
 87        }
 88    }
 89    pub fn commit(
 90        &self,
 91        params: &PedersenParams<C>,
 92        x: Vec<C::ScalarField>,
 93    ) -> CommittedInstance<C> {
 94        let cmE = Pedersen::commit(params, &self.E, &self.rE);
 95        let cmW = Pedersen::commit(params, &self.W, &self.rW);
 96        CommittedInstance {
 97            cmE,
 98            u: C::ScalarField::one(),
 99            cmW,
100            x,
101        }
102    }
103}