sonobe/folding-schemes/src/folding/nova/decider_circuits.rs
folding-schemes/src/folding/nova/decider_circuits.rsRaw
1/// This file implements the offchain decider circuit. For ethereum use cases, use the
2/// DeciderEthCircuit.
3/// More details can be found at the documentation page:
4/// https://privacy-scaling-explorations.github.io/sonobe-docs/design/nova-decider-offchain.html
5use ark_crypto_primitives::sponge::{
6 constraints::CryptographicSpongeVar,
7 poseidon::{constraints::PoseidonSpongeVar, PoseidonConfig, PoseidonSponge},
8 Absorb, CryptographicSponge,
9};
10use ark_ec::{CurveGroup, Group};
11use ark_ff::{BigInteger, PrimeField};
12use ark_poly::Polynomial;
13use ark_r1cs_std::{
14 alloc::AllocVar,
15 boolean::Boolean,
16 eq::EqGadget,
17 fields::{fp::FpVar, FieldVar},
18 groups::GroupOpsBounds,
19 prelude::CurveVar,
20 ToConstraintFieldGadget,
21};
22use ark_relations::r1cs::{ConstraintSynthesizer, ConstraintSystemRef, SynthesisError};
23use ark_std::Zero;
24use core::marker::PhantomData;
25
26use super::{
27 circuits::{ChallengeGadget, CommittedInstanceVar},
28 decider_eth_circuit::{KZGChallengesGadget, R1CSVar, RelaxedR1CSGadget, WitnessVar},
29 nifs::NIFS,
30 CommittedInstance, Nova, Witness,
31};
32use crate::arith::r1cs::R1CS;
33use crate::commitment::CommitmentScheme;
34use crate::folding::circuits::{
35 cyclefold::{
36 CycleFoldCommittedInstance, CycleFoldCommittedInstanceVar, CycleFoldConfig,
37 CycleFoldWitness,
38 },
39 nonnative::{affine::NonNativeAffineVar, uint::NonNativeUintVar},
40 CF1, CF2,
41};
42use crate::folding::nova::NovaCycleFoldConfig;
43use crate::folding::traits::{CommittedInstanceVarOps, Dummy};
44use crate::frontend::FCircuit;
45use crate::utils::vec::poly_from_vec;
46use crate::Error;
47
48/// Circuit that implements part of the in-circuit checks needed for the offchain verification over
49/// the Curve2's BaseField (=Curve1's ScalarField).
50#[derive(Clone, Debug)]
51pub struct DeciderCircuit1<C1, C2, GC2>
52where
53 C1: CurveGroup,
54 C2: CurveGroup,
55 GC2: CurveVar<C2, CF2<C2>>,
56{
57 _c1: PhantomData<C1>,
58 _c2: PhantomData<C2>,
59 _gc2: PhantomData<GC2>,
60
61 /// E vector's length of the Nova instance witness
62 pub E_len: usize,
63 /// E vector's length of the CycleFold instance witness
64 pub cf_E_len: usize,
65 /// R1CS of the Augmented Function circuit
66 pub r1cs: R1CS<C1::ScalarField>,
67 pub poseidon_config: PoseidonConfig<CF1<C1>>,
68 /// public params hash
69 pub pp_hash: Option<C1::ScalarField>,
70 pub i: Option<CF1<C1>>,
71 /// initial state
72 pub z_0: Option<Vec<C1::ScalarField>>,
73 /// current i-th state
74 pub z_i: Option<Vec<C1::ScalarField>>,
75 /// Nova instances
76 pub u_i: Option<CommittedInstance<C1>>,
77 pub w_i: Option<Witness<C1>>,
78 pub U_i: Option<CommittedInstance<C1>>,
79 pub W_i: Option<Witness<C1>>,
80 pub U_i1: Option<CommittedInstance<C1>>,
81 pub W_i1: Option<Witness<C1>>,
82 pub cmT: Option<C1>,
83 pub r: Option<C1::ScalarField>,
84 /// CycleFold running instance
85 pub cf_U_i: Option<CycleFoldCommittedInstance<C2>>,
86
87 /// Commitment Scheme challenges
88 pub cs_c_W: Option<C1::ScalarField>,
89 pub cs_c_E: Option<C1::ScalarField>,
90 /// Evaluations of the committed polynomials at the challenge
91 pub eval_W: Option<C1::ScalarField>,
92 pub eval_E: Option<C1::ScalarField>,
93}
94impl<C1, C2, GC2> DeciderCircuit1<C1, C2, GC2>
95where
96 C1: CurveGroup,
97 <C1 as CurveGroup>::BaseField: PrimeField,
98 <C1 as Group>::ScalarField: Absorb,
99 C2: CurveGroup,
100 GC2: CurveVar<C2, CF2<C2>> + ToConstraintFieldGadget<CF2<C2>>,
101 for<'b> &'b GC2: GroupOpsBounds<'b, C2, GC2>,
102{
103 pub fn from_nova<GC1, CS1, CS2, const H: bool, FC: FCircuit<C1::ScalarField>>(
104 nova: Nova<C1, GC1, C2, GC2, FC, CS1, CS2, H>,
105 ) -> Result<Self, Error>
106 where
107 C2: CurveGroup,
108 GC1: CurveVar<C1, CF2<C1>> + ToConstraintFieldGadget<CF2<C1>>,
109 GC2: CurveVar<C2, CF2<C2>> + ToConstraintFieldGadget<CF2<C2>>,
110 CS1: CommitmentScheme<C1, H>,
111 CS2: CommitmentScheme<C2, H>,
112 {
113 let mut transcript = PoseidonSponge::<C1::ScalarField>::new(&nova.poseidon_config);
114 // pp_hash is absorbed to transcript at the ChallengeGadget::get_challenge_native call
115
116 // compute the U_{i+1}, W_{i+1}
117 let (T, cmT) = NIFS::<C1, CS1, H>::compute_cmT(
118 &nova.cs_pp,
119 &nova.r1cs.clone(),
120 &nova.w_i.clone(),
121 &nova.u_i.clone(),
122 &nova.W_i.clone(),
123 &nova.U_i.clone(),
124 )?;
125 let r_bits = ChallengeGadget::<C1>::get_challenge_native(
126 &mut transcript,
127 nova.pp_hash,
128 nova.U_i.clone(),
129 nova.u_i.clone(),
130 cmT,
131 );
132 let r_Fr = C1::ScalarField::from_bigint(BigInteger::from_bits_le(&r_bits))
133 .ok_or(Error::OutOfBounds)?;
134 let (W_i1, U_i1) = NIFS::<C1, CS1, H>::fold_instances(
135 r_Fr, &nova.W_i, &nova.U_i, &nova.w_i, &nova.u_i, &T, cmT,
136 )?;
137
138 // compute the commitment scheme challenges used as inputs in the circuit
139 let (cs_challenge_W, cs_challenge_E) =
140 KZGChallengesGadget::<C1>::get_challenges_native(&mut transcript, U_i1.clone());
141
142 // get evals of the committed polys at the challenges
143 let mut W = W_i1.W.clone();
144 W.extend(
145 std::iter::repeat(C1::ScalarField::zero())
146 .take(W_i1.W.len().next_power_of_two() - W_i1.W.len()),
147 );
148 let mut E = W_i1.E.clone();
149 E.extend(
150 std::iter::repeat(C1::ScalarField::zero())
151 .take(W_i1.E.len().next_power_of_two() - W_i1.E.len()),
152 );
153 let p_W = poly_from_vec(W.to_vec())?;
154 let eval_W = p_W.evaluate(&cs_challenge_W);
155 let p_E = poly_from_vec(E.to_vec())?;
156 let eval_E = p_E.evaluate(&cs_challenge_E);
157
158 Ok(Self {
159 _c1: PhantomData,
160 _c2: PhantomData,
161 _gc2: PhantomData,
162
163 E_len: nova.W_i.E.len(),
164 cf_E_len: nova.cf_W_i.E.len(),
165 r1cs: nova.r1cs,
166 poseidon_config: nova.poseidon_config,
167 pp_hash: Some(nova.pp_hash),
168 i: Some(nova.i),
169 z_0: Some(nova.z_0),
170 z_i: Some(nova.z_i),
171 u_i: Some(nova.u_i),
172 w_i: Some(nova.w_i),
173 U_i: Some(nova.U_i),
174 W_i: Some(nova.W_i),
175 U_i1: Some(U_i1),
176 W_i1: Some(W_i1),
177 cmT: Some(cmT),
178 r: Some(r_Fr),
179 cf_U_i: Some(nova.cf_U_i),
180 cs_c_W: Some(cs_challenge_W),
181 cs_c_E: Some(cs_challenge_E),
182 eval_W: Some(eval_W),
183 eval_E: Some(eval_E),
184 })
185 }
186}
187
188impl<C1, C2, GC2> ConstraintSynthesizer<CF1<C1>> for DeciderCircuit1<C1, C2, GC2>
189where
190 C1: CurveGroup,
191 <C1 as CurveGroup>::BaseField: PrimeField,
192 <C1 as Group>::ScalarField: Absorb,
193 C2: CurveGroup,
194 <C2 as CurveGroup>::BaseField: PrimeField,
195 <C2 as Group>::ScalarField: Absorb,
196 C1: CurveGroup<BaseField = C2::ScalarField, ScalarField = C2::BaseField>,
197 GC2: CurveVar<C2, CF2<C2>> + ToConstraintFieldGadget<CF2<C2>>,
198 for<'b> &'b GC2: GroupOpsBounds<'b, C2, GC2>,
199{
200 fn generate_constraints(self, cs: ConstraintSystemRef<CF1<C1>>) -> Result<(), SynthesisError> {
201 let r1cs =
202 R1CSVar::<C1::ScalarField, CF1<C1>, FpVar<CF1<C1>>>::new_witness(cs.clone(), || {
203 Ok(self.r1cs.clone())
204 })?;
205
206 let pp_hash = FpVar::<CF1<C1>>::new_input(cs.clone(), || {
207 Ok(self.pp_hash.unwrap_or_else(CF1::<C1>::zero))
208 })?;
209 let i =
210 FpVar::<CF1<C1>>::new_input(cs.clone(), || Ok(self.i.unwrap_or_else(CF1::<C1>::zero)))?;
211 let z_0 = Vec::<FpVar<CF1<C1>>>::new_input(cs.clone(), || {
212 Ok(self.z_0.unwrap_or(vec![CF1::<C1>::zero()]))
213 })?;
214 let z_i = Vec::<FpVar<CF1<C1>>>::new_input(cs.clone(), || {
215 Ok(self.z_i.unwrap_or(vec![CF1::<C1>::zero()]))
216 })?;
217
218 let u_dummy_native = CommittedInstance::<C1>::dummy(&self.r1cs);
219 let w_dummy_native = Witness::<C1>::dummy(&self.r1cs);
220
221 let u_i = CommittedInstanceVar::<C1>::new_witness(cs.clone(), || {
222 Ok(self.u_i.unwrap_or(u_dummy_native.clone()))
223 })?;
224 let U_i = CommittedInstanceVar::<C1>::new_witness(cs.clone(), || {
225 Ok(self.U_i.unwrap_or(u_dummy_native.clone()))
226 })?;
227 // here (U_i1, W_i1) = NIFS.P( (U_i,W_i), (u_i,w_i))
228 let U_i1 = CommittedInstanceVar::<C1>::new_input(cs.clone(), || {
229 Ok(self.U_i1.unwrap_or(u_dummy_native.clone()))
230 })?;
231 let W_i1 = WitnessVar::<C1>::new_witness(cs.clone(), || {
232 Ok(self.W_i1.unwrap_or(w_dummy_native.clone()))
233 })?;
234
235 // allocate the inputs for the check 6
236 let cs_c_W = FpVar::<CF1<C1>>::new_input(cs.clone(), || {
237 Ok(self.cs_c_W.unwrap_or_else(CF1::<C1>::zero))
238 })?;
239 let cs_c_E = FpVar::<CF1<C1>>::new_input(cs.clone(), || {
240 Ok(self.cs_c_E.unwrap_or_else(CF1::<C1>::zero))
241 })?;
242 let _eval_W = FpVar::<CF1<C1>>::new_input(cs.clone(), || {
243 Ok(self.eval_W.unwrap_or_else(CF1::<C1>::zero))
244 })?;
245 let _eval_E = FpVar::<CF1<C1>>::new_input(cs.clone(), || {
246 Ok(self.eval_E.unwrap_or_else(CF1::<C1>::zero))
247 })?;
248
249 // `sponge` is for digest computation.
250 let sponge = PoseidonSpongeVar::<C1::ScalarField>::new(cs.clone(), &self.poseidon_config);
251 // `transcript` is for challenge generation.
252 let mut transcript = sponge.clone();
253 // notice that the `pp_hash` is absorbed inside the ChallengeGadget::get_challenge_gadget call
254
255 // 2. u_i.cmE==cm(0), u_i.u==1
256 // Here zero is the x & y coordinates of the zero point affine representation.
257 let zero = NonNativeUintVar::new_constant(cs.clone(), C1::BaseField::zero())?;
258 u_i.cmE.x.enforce_equal_unaligned(&zero)?;
259 u_i.cmE.y.enforce_equal_unaligned(&zero)?;
260 (u_i.u.is_one()?).enforce_equal(&Boolean::TRUE)?;
261
262 // 3.a u_i.x[0] == H(i, z_0, z_i, U_i)
263 let (u_i_x, U_i_vec) = U_i.clone().hash(&sponge, &pp_hash, &i, &z_0, &z_i)?;
264 (u_i.x[0]).enforce_equal(&u_i_x)?;
265
266 // 3.b u_i.x[1] == H(cf_U_i)
267 let cf_u_dummy_native =
268 CycleFoldCommittedInstance::<C2>::dummy(NovaCycleFoldConfig::<C1>::IO_LEN);
269 let cf_U_i = CycleFoldCommittedInstanceVar::<C2, GC2>::new_input(cs.clone(), || {
270 Ok(self.cf_U_i.unwrap_or_else(|| cf_u_dummy_native.clone()))
271 })?;
272 let (cf_u_i_x, _) = cf_U_i.clone().hash(&sponge, pp_hash.clone())?;
273 (u_i.x[1]).enforce_equal(&cf_u_i_x)?;
274
275 // 4. check RelaxedR1CS of U_{i+1}
276 let z_U1: Vec<FpVar<CF1<C1>>> =
277 [vec![U_i1.u.clone()], U_i1.x.to_vec(), W_i1.W.to_vec()].concat();
278 RelaxedR1CSGadget::check_native(r1cs, W_i1.E.clone(), U_i1.u.clone(), z_U1)?;
279
280 // 1.1.a, 5.1 compute NIFS.V and Commitment Scheme challenges.
281 // We need to ensure the order of challenge generation is the same as
282 // the native counterpart, so we first compute the challenges here and
283 // do the actual checks later.
284 let cmT =
285 NonNativeAffineVar::new_input(cs.clone(), || Ok(self.cmT.unwrap_or_else(C1::zero)))?;
286 let r_bits = ChallengeGadget::<C1>::get_challenge_gadget(
287 &mut transcript,
288 pp_hash,
289 U_i_vec,
290 u_i.clone(),
291 cmT.clone(),
292 )?;
293 // 5.1.
294 let (incircuit_c_W, incircuit_c_E) =
295 KZGChallengesGadget::<C1>::get_challenges_gadget(&mut transcript, U_i1.clone())?;
296 incircuit_c_W.enforce_equal(&cs_c_W)?;
297 incircuit_c_E.enforce_equal(&cs_c_E)?;
298
299 // Check 5.2 is temporary disabled due
300 // https://github.com/privacy-scaling-explorations/sonobe/issues/80
301 log::warn!("[WARNING]: issue #80 (https://github.com/privacy-scaling-explorations/sonobe/issues/80) is not resolved yet.");
302 //
303 // 5.2. check eval_W==p_W(c_W) and eval_E==p_E(c_E)
304 // let incircuit_eval_W = evaluate_gadget::<CF1<C1>>(W_i1.W, incircuit_c_W)?;
305 // let incircuit_eval_E = evaluate_gadget::<CF1<C1>>(W_i1.E, incircuit_c_E)?;
306 // incircuit_eval_W.enforce_equal(&eval_W)?;
307 // incircuit_eval_E.enforce_equal(&eval_E)?;
308
309 // 1.1.b check that the NIFS.V challenge matches the one from the public input (so we avoid
310 // the verifier computing it)
311 let r_Fr = Boolean::le_bits_to_fp_var(&r_bits)?;
312 // check that the in-circuit computed r is equal to the inputted r
313 let r =
314 FpVar::<CF1<C1>>::new_input(cs.clone(), || Ok(self.r.unwrap_or_else(CF1::<C1>::zero)))?;
315 r_Fr.enforce_equal(&r)?;
316
317 Ok(())
318 }
319}
320
321/// Circuit that implements part of the in-circuit checks needed for the offchain verification over
322/// the Curve1's BaseField (=Curve2's ScalarField).
323#[derive(Clone, Debug)]
324pub struct DeciderCircuit2<C1, GC1, C2>
325where
326 C1: CurveGroup,
327 C2: CurveGroup,
328{
329 _c1: PhantomData<C1>,
330 _gc1: PhantomData<GC1>,
331 _c2: PhantomData<C2>,
332
333 /// E vector's length of the CycleFold instance witness
334 pub cf_E_len: usize,
335 /// R1CS of the CycleFold circuit
336 pub cf_r1cs: R1CS<C2::ScalarField>,
337 pub poseidon_config: PoseidonConfig<CF1<C2>>,
338 /// public params hash
339 pub pp_hash: Option<C2::ScalarField>,
340
341 /// CycleFold running instance. Notice that here we use Nova's CommittedInstance (instead of
342 /// CycleFoldCommittedInstance), since we are over C2::Fr, so that the CycleFold instances can
343 /// be computed natively
344 pub cf_U_i: Option<CommittedInstance<C2>>,
345 pub cf_W_i: Option<CycleFoldWitness<C2>>,
346 /// Commitment Scheme challenges
347 pub cs_c_W: Option<C2::ScalarField>,
348 pub cs_c_E: Option<C2::ScalarField>,
349 /// Evaluations of the committed polynomials at the challenge
350 pub eval_W: Option<C2::ScalarField>,
351 pub eval_E: Option<C2::ScalarField>,
352}
353impl<C1, GC1, C2> DeciderCircuit2<C1, GC1, C2>
354where
355 C1: CurveGroup,
356 C2: CurveGroup,
357 <C1 as CurveGroup>::BaseField: PrimeField,
358 <C1 as Group>::ScalarField: Absorb,
359 <C2 as CurveGroup>::BaseField: PrimeField,
360 <C2 as Group>::ScalarField: Absorb,
361 GC1: CurveVar<C1, CF2<C1>> + ToConstraintFieldGadget<CF2<C1>>,
362{
363 pub fn from_nova<GC2, CS1, CS2, const H: bool, FC: FCircuit<C1::ScalarField>>(
364 nova: Nova<C1, GC1, C2, GC2, FC, CS1, CS2, H>,
365 ) -> Result<Self, Error>
366 where
367 GC2: CurveVar<C2, CF2<C2>> + ToConstraintFieldGadget<CF2<C2>>,
368 CS1: CommitmentScheme<C1, H>,
369 CS2: CommitmentScheme<C2, H>,
370 {
371 // compute the Commitment Scheme challenges of the CycleFold instance commitments, used as
372 // inputs in the circuit
373 let poseidon_config =
374 crate::transcript::poseidon::poseidon_canonical_config::<C2::ScalarField>();
375 let mut transcript = PoseidonSponge::<C2::ScalarField>::new(&poseidon_config);
376 let pp_hash_Fq =
377 C2::ScalarField::from_le_bytes_mod_order(&nova.pp_hash.into_bigint().to_bytes_le());
378 transcript.absorb(&pp_hash_Fq);
379
380 let (cs_challenge_W, cs_challenge_E) =
381 KZGChallengesGadget::<C2>::get_challenges_native(&mut transcript, nova.cf_U_i.clone());
382
383 // get evals of the committed polynomials at the challenge
384 let mut W = nova.cf_W_i.W.clone();
385 W.extend(
386 std::iter::repeat(C2::ScalarField::zero())
387 .take(nova.cf_W_i.W.len().next_power_of_two() - nova.cf_W_i.W.len()),
388 );
389 let mut E = nova.cf_W_i.E.clone();
390 E.extend(
391 std::iter::repeat(C2::ScalarField::zero())
392 .take(nova.cf_W_i.E.len().next_power_of_two() - nova.cf_W_i.E.len()),
393 );
394 let p_W = poly_from_vec(W.to_vec())?;
395 let eval_W = p_W.evaluate(&cs_challenge_W);
396 let p_E = poly_from_vec(E.to_vec())?;
397 let eval_E = p_E.evaluate(&cs_challenge_E);
398
399 Ok(Self {
400 _c1: PhantomData,
401 _gc1: PhantomData,
402 _c2: PhantomData,
403
404 cf_E_len: nova.cf_W_i.E.len(),
405 cf_r1cs: nova.cf_r1cs,
406 poseidon_config,
407 pp_hash: Some(pp_hash_Fq),
408
409 cf_U_i: Some(nova.cf_U_i),
410 cf_W_i: Some(nova.cf_W_i),
411
412 // CycleFold instance commitments challenges
413 cs_c_W: Some(cs_challenge_W),
414 cs_c_E: Some(cs_challenge_E),
415 eval_W: Some(eval_W),
416 eval_E: Some(eval_E),
417 })
418 }
419}
420
421impl<C1, GC1, C2> ConstraintSynthesizer<CF1<C2>> for DeciderCircuit2<C1, GC1, C2>
422where
423 C1: CurveGroup,
424 C2: CurveGroup,
425 <C1 as CurveGroup>::BaseField: PrimeField,
426 <C2 as CurveGroup>::BaseField: PrimeField,
427 <C1 as Group>::ScalarField: Absorb,
428 <C2 as Group>::ScalarField: Absorb,
429 C1: CurveGroup<BaseField = C2::ScalarField, ScalarField = C2::BaseField>,
430 GC1: CurveVar<C1, CF2<C1>> + ToConstraintFieldGadget<CF2<C1>>,
431 for<'a> &'a GC1: GroupOpsBounds<'a, C1, GC1>,
432{
433 fn generate_constraints(self, cs: ConstraintSystemRef<CF1<C2>>) -> Result<(), SynthesisError> {
434 let pp_hash = FpVar::<CF1<C2>>::new_input(cs.clone(), || {
435 Ok(self.pp_hash.unwrap_or_else(CF1::<C2>::zero))
436 })?;
437
438 let cf_u_dummy_native = CommittedInstance::<C2>::dummy(&self.cf_r1cs);
439 let w_dummy_native = Witness::<C2>::dummy(&self.cf_r1cs);
440 let cf_U_i = CommittedInstanceVar::<C2>::new_input(cs.clone(), || {
441 Ok(self.cf_U_i.unwrap_or_else(|| cf_u_dummy_native.clone()))
442 })?;
443 let cf_W_i = WitnessVar::<C2>::new_witness(cs.clone(), || {
444 Ok(self.cf_W_i.unwrap_or(w_dummy_native.clone()))
445 })?;
446
447 let cf_r1cs =
448 R1CSVar::<C2::ScalarField, CF1<C2>, FpVar<CF1<C2>>>::new_witness(cs.clone(), || {
449 Ok(self.cf_r1cs.clone())
450 })?;
451
452 // 6. check RelaxedR1CS of cf_U_i
453 let cf_z_U = [vec![cf_U_i.u.clone()], cf_U_i.x.to_vec(), cf_W_i.W.to_vec()].concat();
454 RelaxedR1CSGadget::check_native(cf_r1cs, cf_W_i.E, cf_U_i.u.clone(), cf_z_U)?;
455
456 // `transcript` is for challenge generation.
457 let mut transcript =
458 PoseidonSpongeVar::<C2::ScalarField>::new(cs.clone(), &self.poseidon_config);
459 transcript.absorb(&pp_hash)?;
460
461 // allocate the inputs for the check 7.1
462 let cs_c_W = FpVar::<CF1<C2>>::new_input(cs.clone(), || {
463 Ok(self.cs_c_W.unwrap_or_else(CF1::<C2>::zero))
464 })?;
465 let cs_c_E = FpVar::<CF1<C2>>::new_input(cs.clone(), || {
466 Ok(self.cs_c_E.unwrap_or_else(CF1::<C2>::zero))
467 })?;
468 // allocate the inputs for the check 7.2
469 let _eval_W = FpVar::<CF1<C2>>::new_input(cs.clone(), || {
470 Ok(self.eval_W.unwrap_or_else(CF1::<C2>::zero))
471 })?;
472 let _eval_E = FpVar::<CF1<C2>>::new_input(cs.clone(), || {
473 Ok(self.eval_E.unwrap_or_else(CF1::<C2>::zero))
474 })?;
475
476 // 7.1. check the commitment scheme challenges correct computation
477 let (incircuit_c_W, incircuit_c_E) =
478 KZGChallengesGadget::<C2>::get_challenges_gadget(&mut transcript, cf_U_i.clone())?;
479 incircuit_c_W.enforce_equal(&cs_c_W)?;
480 incircuit_c_E.enforce_equal(&cs_c_E)?;
481
482 // Check 7.2 is temporary disabled due
483 // https://github.com/privacy-scaling-explorations/sonobe/issues/80
484 log::warn!("[WARNING]: issue #80 (https://github.com/privacy-scaling-explorations/sonobe/issues/80) is not resolved yet.");
485 // 7.2. check eval_W==p_W(c_W) and eval_E==p_E(c_E)
486 // let incircuit_eval_W = evaluate_gadget::<CF1<C1>>(W_i1.W, incircuit_c_W)?;
487 // let incircuit_eval_E = evaluate_gadget::<CF1<C1>>(W_i1.E, incircuit_c_E)?;
488 // incircuit_eval_W.enforce_equal(&eval_W)?;
489 // incircuit_eval_E.enforce_equal(&eval_E)?;
490
491 Ok(())
492 }
493}
494
495#[cfg(test)]
496pub mod tests {
497 use ark_pallas::{constraints::GVar, Fq, Fr, Projective};
498 use ark_relations::r1cs::ConstraintSystem;
499 use ark_std::One;
500 use ark_vesta::{constraints::GVar as GVar2, Projective as Projective2};
501
502 use super::*;
503 use crate::commitment::pedersen::Pedersen;
504 use crate::folding::nova::PreprocessorParam;
505 use crate::frontend::utils::CubicFCircuit;
506 use crate::transcript::poseidon::poseidon_canonical_config;
507 use crate::FoldingScheme;
508
509 #[test]
510 fn test_decider_circuits() {
511 let mut rng = ark_std::test_rng();
512 let poseidon_config = poseidon_canonical_config::<Fr>();
513
514 let F_circuit = CubicFCircuit::<Fr>::new(()).unwrap();
515 let z_0 = vec![Fr::from(3_u32)];
516
517 type N = Nova<
518 Projective,
519 GVar,
520 Projective2,
521 GVar2,
522 CubicFCircuit<Fr>,
523 Pedersen<Projective>,
524 Pedersen<Projective2>,
525 false,
526 >;
527
528 let prep_param = PreprocessorParam::<
529 Projective,
530 Projective2,
531 CubicFCircuit<Fr>,
532 Pedersen<Projective>,
533 Pedersen<Projective2>,
534 false,
535 >::new(poseidon_config, F_circuit);
536 let nova_params = N::preprocess(&mut rng, &prep_param).unwrap();
537
538 // generate a Nova instance and do a step of it
539 let mut nova = N::init(&nova_params, F_circuit, z_0.clone()).unwrap();
540 nova.prove_step(&mut rng, vec![], None).unwrap();
541 let ivc_v = nova.clone();
542 let (running_instance, incoming_instance, cyclefold_instance) = ivc_v.instances();
543 N::verify(
544 nova_params.1, // verifier_params
545 z_0,
546 ivc_v.z_i,
547 Fr::one(),
548 running_instance,
549 incoming_instance,
550 cyclefold_instance,
551 )
552 .unwrap();
553
554 // load the DeciderCircuit 1 & 2 from the Nova instance
555 let decider_circuit1 =
556 DeciderCircuit1::<Projective, Projective2, GVar2>::from_nova(nova.clone()).unwrap();
557 let decider_circuit2 =
558 DeciderCircuit2::<Projective, GVar, Projective2>::from_nova(nova).unwrap();
559
560 // generate the constraints of both circuits and check that are satisfied by the inputs
561 let cs1 = ConstraintSystem::<Fr>::new_ref();
562 decider_circuit1.generate_constraints(cs1.clone()).unwrap();
563 assert!(cs1.is_satisfied().unwrap());
564 let cs2 = ConstraintSystem::<Fq>::new_ref();
565 decider_circuit2.generate_constraints(cs2.clone()).unwrap();
566 assert!(cs2.is_satisfied().unwrap());
567 }
568}