1/// Implements the scheme described in [Nova](https://eprint.iacr.org/2021/370.pdf)
  2use ark_crypto_primitives::{
  3    crh::{poseidon::CRH, CRHScheme},
  4    sponge::{poseidon::PoseidonConfig, Absorb},
  5};
  6use ark_ec::{CurveGroup, Group};
  7use ark_std::fmt::Debug;
  8use ark_std::{One, Zero};
  9
 10use crate::folding::circuits::nonnative::point_to_nonnative_limbs;
 11use crate::pedersen::{Params as PedersenParams, Pedersen};
 12use crate::utils::vec::is_zero_vec;
 13use crate::Error;
 14
 15pub mod circuits;
 16pub mod cyclefold;
 17pub mod decider;
 18pub mod ivc;
 19pub mod nifs;
 20pub mod traits;
 21
 22#[derive(Debug, Clone, Eq, PartialEq)]
 23pub struct CommittedInstance<C: CurveGroup> {
 24    pub cmE: C,
 25    pub u: C::ScalarField,
 26    pub cmW: C,
 27    pub x: Vec<C::ScalarField>,
 28}
 29
 30impl<C: CurveGroup> CommittedInstance<C> {
 31    pub fn dummy(io_len: usize) -> Self {
 32        Self {
 33            cmE: C::zero(),
 34            u: C::ScalarField::zero(),
 35            cmW: C::zero(),
 36            x: vec![C::ScalarField::zero(); io_len],
 37        }
 38    }
 39}
 40
 41impl<C: CurveGroup> CommittedInstance<C>
 42where
 43    <C as Group>::ScalarField: Absorb,
 44    <C as ark_ec::CurveGroup>::BaseField: ark_ff::PrimeField,
 45{
 46    /// hash implements the committed instance hash compatible with the gadget implemented in
 47    /// nova/circuits.rs::CommittedInstanceVar.hash.
 48    /// Returns `H(i, z_0, z_i, U_i)`, where `i` can be `i` but also `i+1`, and `U` is the
 49    /// `CommittedInstance`.
 50    pub fn hash(
 51        &self,
 52        poseidon_config: &PoseidonConfig<C::ScalarField>,
 53        i: C::ScalarField,
 54        z_0: Vec<C::ScalarField>,
 55        z_i: Vec<C::ScalarField>,
 56    ) -> Result<C::ScalarField, Error> {
 57        let (cmE_x, cmE_y) = point_to_nonnative_limbs::<C>(self.cmE)?;
 58        let (cmW_x, cmW_y) = point_to_nonnative_limbs::<C>(self.cmW)?;
 59
 60        CRH::<C::ScalarField>::evaluate(
 61            poseidon_config,
 62            vec![
 63                vec![i],
 64                z_0,
 65                z_i,
 66                vec![self.u],
 67                self.x.clone(),
 68                cmE_x,
 69                cmE_y,
 70                cmW_x,
 71                cmW_y,
 72            ]
 73            .concat(),
 74        )
 75        .map_err(|e| Error::Other(e.to_string()))
 76    }
 77}
 78
 79#[derive(Debug, Clone, Eq, PartialEq)]
 80pub struct Witness<C: CurveGroup> {
 81    pub E: Vec<C::ScalarField>,
 82    pub rE: C::ScalarField,
 83    pub W: Vec<C::ScalarField>,
 84    pub rW: C::ScalarField,
 85}
 86
 87impl<C: CurveGroup> Witness<C>
 88where
 89    <C as Group>::ScalarField: Absorb,
 90{
 91    pub fn new(w: Vec<C::ScalarField>, e_len: usize) -> Self {
 92        Self {
 93            E: vec![C::ScalarField::zero(); e_len],
 94            rE: C::ScalarField::zero(), // because we use C::zero() as cmE
 95            W: w,
 96            rW: C::ScalarField::one(),
 97        }
 98    }
 99    pub fn commit(
100        &self,
101        params: &PedersenParams<C>,
102        x: Vec<C::ScalarField>,
103    ) -> Result<CommittedInstance<C>, Error> {
104        let mut cmE = C::zero();
105        if !is_zero_vec::<C::ScalarField>(&self.E) {
106            cmE = Pedersen::commit(params, &self.E, &self.rE)?;
107        }
108        let cmW = Pedersen::commit(params, &self.W, &self.rW)?;
109        Ok(CommittedInstance {
110            cmE,
111            u: C::ScalarField::one(),
112            cmW,
113            x,
114        })
115    }
116}