1/// Implements the scheme described in [Nova](https://eprint.iacr.org/2021/370.pdf)
  2use ark_crypto_primitives::{
  3    crh::{poseidon::CRH, CRHScheme},
  4    sponge::{poseidon::PoseidonConfig, Absorb},
  5};
  6use ark_ec::{CurveGroup, Group};
  7use ark_std::fmt::Debug;
  8use ark_std::{One, Zero};
  9
 10use crate::commitment::{
 11    pedersen::{Params as PedersenParams, Pedersen},
 12    CommitmentProver,
 13};
 14use crate::folding::circuits::nonnative::point_to_nonnative_limbs;
 15use crate::utils::vec::is_zero_vec;
 16use crate::Error;
 17
 18pub mod circuits;
 19pub mod cyclefold;
 20pub mod decider;
 21pub mod ivc;
 22pub mod nifs;
 23pub mod traits;
 24
 25#[derive(Debug, Clone, Eq, PartialEq)]
 26pub struct CommittedInstance<C: CurveGroup> {
 27    pub cmE: C,
 28    pub u: C::ScalarField,
 29    pub cmW: C,
 30    pub x: Vec<C::ScalarField>,
 31}
 32
 33impl<C: CurveGroup> CommittedInstance<C> {
 34    pub fn dummy(io_len: usize) -> Self {
 35        Self {
 36            cmE: C::zero(),
 37            u: C::ScalarField::zero(),
 38            cmW: C::zero(),
 39            x: vec![C::ScalarField::zero(); io_len],
 40        }
 41    }
 42}
 43
 44impl<C: CurveGroup> CommittedInstance<C>
 45where
 46    <C as Group>::ScalarField: Absorb,
 47    <C as ark_ec::CurveGroup>::BaseField: ark_ff::PrimeField,
 48{
 49    /// hash implements the committed instance hash compatible with the gadget implemented in
 50    /// nova/circuits.rs::CommittedInstanceVar.hash.
 51    /// Returns `H(i, z_0, z_i, U_i)`, where `i` can be `i` but also `i+1`, and `U` is the
 52    /// `CommittedInstance`.
 53    pub fn hash(
 54        &self,
 55        poseidon_config: &PoseidonConfig<C::ScalarField>,
 56        i: C::ScalarField,
 57        z_0: Vec<C::ScalarField>,
 58        z_i: Vec<C::ScalarField>,
 59    ) -> Result<C::ScalarField, Error> {
 60        let (cmE_x, cmE_y) = point_to_nonnative_limbs::<C>(self.cmE)?;
 61        let (cmW_x, cmW_y) = point_to_nonnative_limbs::<C>(self.cmW)?;
 62
 63        CRH::<C::ScalarField>::evaluate(
 64            poseidon_config,
 65            vec![
 66                vec![i],
 67                z_0,
 68                z_i,
 69                vec![self.u],
 70                self.x.clone(),
 71                cmE_x,
 72                cmE_y,
 73                cmW_x,
 74                cmW_y,
 75            ]
 76            .concat(),
 77        )
 78        .map_err(|e| Error::Other(e.to_string()))
 79    }
 80}
 81
 82#[derive(Debug, Clone, Eq, PartialEq)]
 83pub struct Witness<C: CurveGroup> {
 84    pub E: Vec<C::ScalarField>,
 85    pub rE: C::ScalarField,
 86    pub W: Vec<C::ScalarField>,
 87    pub rW: C::ScalarField,
 88}
 89
 90impl<C: CurveGroup> Witness<C>
 91where
 92    <C as Group>::ScalarField: Absorb,
 93{
 94    pub fn new(w: Vec<C::ScalarField>, e_len: usize) -> Self {
 95        // note: at the current version, we don't use the blinding factors and we set them to 0
 96        // always.
 97        Self {
 98            E: vec![C::ScalarField::zero(); e_len],
 99            rE: C::ScalarField::zero(),
100            W: w,
101            rW: C::ScalarField::zero(),
102        }
103    }
104    pub fn commit(
105        &self,
106        params: &PedersenParams<C>,
107        x: Vec<C::ScalarField>,
108    ) -> Result<CommittedInstance<C>, Error> {
109        let mut cmE = C::zero();
110        if !is_zero_vec::<C::ScalarField>(&self.E) {
111            cmE = Pedersen::commit(params, &self.E, &self.rE)?;
112        }
113        let cmW = Pedersen::commit(params, &self.W, &self.rW)?;
114        Ok(CommittedInstance {
115            cmE,
116            u: C::ScalarField::one(),
117            cmW,
118            x,
119        })
120    }
121}