1/// Implements the scheme described in [Nova](https://eprint.iacr.org/2021/370.pdf)
  2use ark_crypto_primitives::{
  3    crh::{poseidon::CRH, CRHScheme},
  4    sponge::{poseidon::PoseidonConfig, Absorb},
  5};
  6use ark_ec::{CurveGroup, Group};
  7use ark_std::fmt::Debug;
  8use ark_std::{One, Zero};
  9
 10use crate::commitment::CommitmentProver;
 11use crate::folding::circuits::nonnative::point_to_nonnative_limbs;
 12use crate::utils::vec::is_zero_vec;
 13use crate::Error;
 14
 15pub mod circuits;
 16pub mod cyclefold;
 17pub mod decider;
 18pub mod ivc;
 19pub mod nifs;
 20pub mod traits;
 21
 22#[derive(Debug, Clone, Eq, PartialEq)]
 23pub struct CommittedInstance<C: CurveGroup> {
 24    pub cmE: C,
 25    pub u: C::ScalarField,
 26    pub cmW: C,
 27    pub x: Vec<C::ScalarField>,
 28}
 29
 30impl<C: CurveGroup> CommittedInstance<C> {
 31    pub fn dummy(io_len: usize) -> Self {
 32        Self {
 33            cmE: C::zero(),
 34            u: C::ScalarField::zero(),
 35            cmW: C::zero(),
 36            x: vec![C::ScalarField::zero(); io_len],
 37        }
 38    }
 39}
 40
 41impl<C: CurveGroup> CommittedInstance<C>
 42where
 43    <C as Group>::ScalarField: Absorb,
 44    <C as ark_ec::CurveGroup>::BaseField: ark_ff::PrimeField,
 45{
 46    /// hash implements the committed instance hash compatible with the gadget implemented in
 47    /// nova/circuits.rs::CommittedInstanceVar.hash.
 48    /// Returns `H(i, z_0, z_i, U_i)`, where `i` can be `i` but also `i+1`, and `U` is the
 49    /// `CommittedInstance`.
 50    pub fn hash(
 51        &self,
 52        poseidon_config: &PoseidonConfig<C::ScalarField>,
 53        i: C::ScalarField,
 54        z_0: Vec<C::ScalarField>,
 55        z_i: Vec<C::ScalarField>,
 56    ) -> Result<C::ScalarField, Error> {
 57        let (cmE_x, cmE_y) = point_to_nonnative_limbs::<C>(self.cmE)?;
 58        let (cmW_x, cmW_y) = point_to_nonnative_limbs::<C>(self.cmW)?;
 59
 60        CRH::<C::ScalarField>::evaluate(
 61            poseidon_config,
 62            vec![
 63                vec![i],
 64                z_0,
 65                z_i,
 66                vec![self.u],
 67                self.x.clone(),
 68                cmE_x,
 69                cmE_y,
 70                cmW_x,
 71                cmW_y,
 72            ]
 73            .concat(),
 74        )
 75        .map_err(|e| Error::Other(e.to_string()))
 76    }
 77}
 78
 79#[derive(Debug, Clone, Eq, PartialEq)]
 80pub struct Witness<C: CurveGroup> {
 81    pub E: Vec<C::ScalarField>,
 82    pub rE: C::ScalarField,
 83    pub W: Vec<C::ScalarField>,
 84    pub rW: C::ScalarField,
 85}
 86
 87impl<C: CurveGroup> Witness<C>
 88where
 89    <C as Group>::ScalarField: Absorb,
 90{
 91    pub fn new(w: Vec<C::ScalarField>, e_len: usize) -> Self {
 92        // note: at the current version, we don't use the blinding factors and we set them to 0
 93        // always.
 94        Self {
 95            E: vec![C::ScalarField::zero(); e_len],
 96            rE: C::ScalarField::zero(),
 97            W: w,
 98            rW: C::ScalarField::zero(),
 99        }
100    }
101    pub fn commit<CP: CommitmentProver<C>>(
102        &self,
103        params: &CP::Params,
104        x: Vec<C::ScalarField>,
105    ) -> Result<CommittedInstance<C>, Error> {
106        let mut cmE = C::zero();
107        if !is_zero_vec::<C::ScalarField>(&self.E) {
108            cmE = CP::commit(params, &self.E, &self.rE)?;
109        }
110        let cmW = CP::commit(params, &self.W, &self.rW)?;
111        Ok(CommittedInstance {
112            cmE,
113            u: C::ScalarField::one(),
114            cmW,
115            x,
116        })
117    }
118}