1/// Implements the scheme described in [Nova](https://eprint.iacr.org/2021/370.pdf)
  2use ark_crypto_primitives::{
  3    crh::{poseidon::CRH, CRHScheme},
  4    sponge::{poseidon::PoseidonConfig, Absorb},
  5};
  6use ark_ec::{CurveGroup, Group};
  7use ark_std::fmt::Debug;
  8use ark_std::{One, Zero};
  9
 10use crate::folding::circuits::nonnative::point_to_nonnative_limbs;
 11use crate::pedersen::{Params as PedersenParams, Pedersen};
 12use crate::utils::vec::is_zero_vec;
 13use crate::Error;
 14
 15pub mod circuits;
 16pub mod ivc;
 17pub mod nifs;
 18pub mod traits;
 19
 20#[derive(Debug, Clone, Eq, PartialEq)]
 21pub struct CommittedInstance<C: CurveGroup> {
 22    pub cmE: C,
 23    pub u: C::ScalarField,
 24    pub cmW: C,
 25    pub x: Vec<C::ScalarField>,
 26}
 27
 28impl<C: CurveGroup> CommittedInstance<C>
 29where
 30    <C as Group>::ScalarField: Absorb,
 31    <C as ark_ec::CurveGroup>::BaseField: ark_ff::PrimeField,
 32{
 33    pub fn dummy(io_len: usize) -> Self {
 34        Self {
 35            cmE: C::zero(),
 36            u: C::ScalarField::zero(),
 37            cmW: C::zero(),
 38            x: vec![C::ScalarField::zero(); io_len],
 39        }
 40    }
 41
 42    /// hash implements the committed instance hash compatible with the gadget implemented in
 43    /// nova/circuits.rs::CommittedInstanceVar.hash.
 44    /// Returns `H(i, z_0, z_i, U_i)`, where `i` can be `i` but also `i+1`, and `U` is the
 45    /// `CommittedInstance`.
 46    pub fn hash(
 47        &self,
 48        poseidon_config: &PoseidonConfig<C::ScalarField>,
 49        i: C::ScalarField,
 50        z_0: Vec<C::ScalarField>,
 51        z_i: Vec<C::ScalarField>,
 52    ) -> Result<C::ScalarField, Error> {
 53        let (cmE_x, cmE_y) = point_to_nonnative_limbs::<C>(self.cmE)?;
 54        let (cmW_x, cmW_y) = point_to_nonnative_limbs::<C>(self.cmW)?;
 55
 56        CRH::<C::ScalarField>::evaluate(
 57            poseidon_config,
 58            vec![
 59                vec![i],
 60                z_0,
 61                z_i,
 62                vec![self.u],
 63                self.x.clone(),
 64                cmE_x,
 65                cmE_y,
 66                cmW_x,
 67                cmW_y,
 68            ]
 69            .concat(),
 70        )
 71        .map_err(|e| Error::Other(e.to_string()))
 72    }
 73}
 74
 75#[derive(Debug, Clone, Eq, PartialEq)]
 76pub struct Witness<C: CurveGroup> {
 77    pub E: Vec<C::ScalarField>,
 78    pub rE: C::ScalarField,
 79    pub W: Vec<C::ScalarField>,
 80    pub rW: C::ScalarField,
 81}
 82
 83impl<C: CurveGroup> Witness<C>
 84where
 85    <C as Group>::ScalarField: Absorb,
 86{
 87    pub fn new(w: Vec<C::ScalarField>, e_len: usize) -> Self {
 88        Self {
 89            E: vec![C::ScalarField::zero(); e_len],
 90            rE: C::ScalarField::zero(), // because we use C::zero() as cmE
 91            W: w,
 92            rW: C::ScalarField::one(),
 93        }
 94    }
 95    pub fn commit(
 96        &self,
 97        params: &PedersenParams<C>,
 98        x: Vec<C::ScalarField>,
 99    ) -> Result<CommittedInstance<C>, Error> {
100        let mut cmE = C::zero();
101        if !is_zero_vec::<C::ScalarField>(&self.E) {
102            cmE = Pedersen::commit(params, &self.E, &self.rE)?;
103        }
104        let cmW = Pedersen::commit(params, &self.W, &self.rW)?;
105        Ok(CommittedInstance {
106            cmE,
107            u: C::ScalarField::one(),
108            cmW,
109            x,
110        })
111    }
112}