pruned lead proof abit, and replaced rho2 pedersen with poseidon

example/lead.rs

@@ -34,7 +34,6 @@ use darkfi::{
 };
 
 fn main() {
-    println!("--> starting lead example");
     let k: u32 = 13;
     //
 
@@ -59,9 +58,9 @@ fn main() {
         ].to_vec(),
     };
     let consensus = EpochConsensus::new(Some(22), Some(3), Some(22), Some(0));
-    println!("--> block on stakeholder future");
-    let stakeholder : Stakeholder = block_on(Stakeholder::new(consensus, settings, Some(13))).unwrap();
-    println!("block on stakeholder future <--|");
+
+    let stakeholder : Stakeholder = block_on(Stakeholder::new(consensus, settings, Some(k))).unwrap();
+
     let eta : pallas::Base = stakeholder.get_eta();
     let mut epoch = Epoch {
         len: Some(LEN),

src/blockchain/epoch.rs

@@ -190,21 +190,18 @@ impl Epoch {
             let c_pk_pt_x: pallas::Base = *c_pk_pt.x();
             let c_pk_pt_y: pallas::Base = *c_pk_pt.y();
 
-            //
-            let lead_coin_msg = [
-                //TODO (fix)
-                pallas::Scalar::one(),
-                //c_pk_pt_x.clone(),
+
+            //let lead_coin_msg = [
+              //  c_pk_pt_x.clone(),
                 //c_pk_pt_y.clone(),
                 //c_v,
-                //*c_seed_pt.x(), //TODO(fix) will be c_seed(base) only after calculating c_seed as hash
+                // *c_seed_pt.x(), //TODO(fix) will be c_seed(base) only after calculating c_seed as hash
                 //*c_seed_pt.y(),
-            ];
-            let lead_coin_msg_hash : pallas::Scalar = poseidon::Hash::<_, poseidon::P128Pow5T3, poseidon::ConstantLength<1>, 3, 2>::init().hash(lead_coin_msg);
-            //TODO (FIX) THIS PANICS, ONLY PANICS ON LARGE VALUES!
-            let c_cm: pallas::Point = pedersen_commitment_scalar(lead_coin_msg_hash, c_cm1_blind);
-
+            //];
+            //let lead_coin_msg_hash : pallas::Scalar = poseidon::Hash::<_, poseidon::P128Pow5T3, poseidon::ConstantLength<1>, 3, 2>::init().hash(lead_coin_msg);
 
+            let coin_commit_msg = c_pk_pt_x*c_pk_pt_y*c_v*c_seed;
+            let c_cm: pallas::Point = pedersen_commitment_scalar(mod_r_p(coin_commit_msg), c_cm1_blind);
             let c_cm_coordinates = c_cm.to_affine().coordinates().unwrap();
             let c_cm_base: pallas::Base = c_cm_coordinates.x() * c_cm_coordinates.y();
             let c_cm_node = MerkleNode(c_cm_base);
@@ -212,25 +209,32 @@ impl Epoch {
             let leaf_position = tree_cm.witness();
             let c_root_cm = tree_cm.root(0).unwrap();
             let c_cm_path = tree_cm.authentication_path(leaf_position.unwrap(), &c_root_cm).unwrap();
-            // lead coin commitment
-            let c_seed2 = pedersen_commitment_base(c_seed, mod_r_p(c_root_sk.inner()));
-            let c_seed2_pt = c_seed2.to_affine().coordinates().unwrap();
 
-            let lead_coin_msg = [
+            let coin_nonce2_msg = [
+                c_seed,
+                c_root_sk.inner()
+            ];
+            let c_seed2 : pallas::Base = poseidon::Hash::<_, poseidon::P128Pow5T3, poseidon::ConstantLength<2>, 3, 2>::init().hash(coin_nonce2_msg);
+
+            let c_seed2_pt_x = c_seed2.clone();
+            let c_seed2_pt_y = c_seed2.clone();
+
+            //let lead_coin_msg = [
                 //c_pk_pt_y.clone(),
                 //c_pk_pt_x.clone(),
                 //c_v,
                 //c_seed,
-                pallas::Base::one(),
-            ];
-            let lead_coin_msg_hash : pallas::Base = poseidon::Hash::<_, poseidon::P128Pow5T3, poseidon::ConstantLength<1>, 3, 2>::init().hash(lead_coin_msg);
-            let c_cm2 = pedersen_commitment_base(lead_coin_msg_hash, c_cm2_blind);
+            //pallas::Base::one(),
+            //];
+            //let lead_coin_msg_hash : pallas::Base = poseidon::Hash::<_, poseidon::P128Pow5T3, poseidon::ConstantLength<1>, 3, 2>::init().hash(lead_coin_msg);
+            let coin2_commit_msg = c_pk_pt_x*c_pk_pt_y*c_seed2_pt_x*c_seed2_pt_y*c_v;
+            let c_cm2 = pedersen_commitment_base(coin2_commit_msg, c_cm2_blind);
 
             let c_root_sk = root_sks[i];
 
             let c_root_sk_bytes: [u8; 32] = c_root_sk.inner().to_repr();
             let mut c_root_sk_base_bytes: [u8; 32] = [0; 32];
-            //TODO (fix) using only first 24, use the whoel root
+            //TODO (fix) using only first 24, use the whole root
             c_root_sk_base_bytes[..23].copy_from_slice(&c_root_sk_bytes[..23]);
             let _c_root_sk_base = pallas::Base::from_repr(c_root_sk_base_bytes);
 

src/crypto/leadcoin.rs

@@ -24,7 +24,7 @@ pub struct LeadCoin {
     pub sl: Option<pallas::Base>, //slot id
     pub tau: Option<pallas::Base>,
     pub nonce: Option<pallas::Base>,
-    pub nonce_cm: Option<pallas::Point>,
+    pub nonce_cm: Option<pallas::Base>,
     pub sn: Option<pallas::Point>, // coin's serial number
     //sk : Option<SecretKey>,
     pub pk: Option<pallas::Point>,
@@ -43,8 +43,7 @@ pub struct LeadCoin {
 
 impl LeadCoin {
     pub fn public_inputs(&self) -> Vec<pallas::Base> {
-        let po_nonce = self.nonce_cm.unwrap().to_affine().coordinates().unwrap();
-
+        let po_nonce = self.nonce_cm.unwrap();
         let _po_tau = pedersen_commitment_scalar(mod_r_p(self.tau.unwrap()), self.root_cm.unwrap())
             .to_affine()
             .coordinates()
@@ -77,17 +76,16 @@ impl LeadCoin {
             current
         };
         let public_inputs: Vec<pallas::Base> = vec![
-            *po_nonce.x(),
-            *po_nonce.y(),
+            po_nonce,
             *po_pk.x(),
             *po_pk.y(),
             *po_sn.x(),
             *po_sn.y(),
             *po_cm.x(),
             *po_cm.y(),
-            //*po_cm2.x(),
-            //*po_cm2.y(),
-            //cm_root.0,
+            *po_cm2.x(),
+            *po_cm2.y(),
+            cm_root.0,
             //po_cmp,
         ];
         public_inputs

src/stakeholder/stakeholder.rs

@@ -118,25 +118,23 @@ impl Stakeholder
     pub async fn new(consensus: EpochConsensus, settings: Settings, k: Option<u32>) -> Result<Self>
     {
         let path = "tmp";
-        println!("opening db");
         let db = sled::open(path).unwrap();
-        println!("opened db");
+
         let ts = Timestamp::current_time();
         let genesis_hash = blake3::hash(b"");
         //TODO lisen and add transactions
-        println!("--> new blockchain");
+
         let bc = Blockchain::new(&db, ts, genesis_hash).unwrap();
-        println!("--> bc initialized");
+
         //TODO replace with const
         let eta = pallas::Base::one();
         let epoch = Epoch::new(consensus, eta);
-        println!("--> building zk proving key");
+
         let lead_pk = ProvingKey::build(k.unwrap(), &LeadContract::default());
-        println!("--> building zk veryfing key ");
+
         let lead_vk = VerifyingKey::build(k.unwrap(), &LeadContract::default());
-        println!("-->new network");
         let p2p = P2p::new(settings.clone()).await;
-        println!("--> network initialized");
+
         //TODO
         let workspace = SlotWorkspace::default();
 

src/zk/circuit/lead_contract.rs

@@ -89,8 +89,7 @@ impl LeadConfig {
     }
 }
 
-const LEAD_COIN_NONCE2_X_OFFSET: usize = 0;
-const LEAD_COIN_NONCE2_Y_OFFSET: usize = 1;
+const LEAD_COIN_NONCE2_OFFSET: usize = 0;
 const LEAD_COIN_PK_X_OFFSET: usize = 2;
 const LEAD_COIN_PK_Y_OFFSET: usize = 3;
 const LEAD_COIN_SERIAL_NUMBER_X_OFFSET: usize = 4;
@@ -283,8 +282,7 @@ impl Circuit<pallas::Base> for LeadContract {
             Value::known(pallas::Base::zero()),
         )?;
 
-        // coin_timestamp tau
-
+        // coin_timestamp
         let coin_timestamp = self.load_private(
             layouter.namespace(|| "load coin time stamp"),
             config.advices[0],
@@ -320,42 +318,27 @@ impl Circuit<pallas::Base> for LeadContract {
             self.load_private(layouter.namespace(|| ""), config.advices[0], self.root_sk)?;
 
         // ===============
-        // coin 2 nonce
+        // nonce2  =  PRF_{root_sk}(coin_nonce)
         // ===============
-        // m*G_1
-        let (com, _) = {
-            let nonce2_commit_v = ValueCommitV;
-            let nonce2_commit_v = FixedPointShort::from_inner(ecc_chip.clone(), nonce2_commit_v);
-            let coin_nonce = ScalarFixedShort::new(
-                ecc_chip.clone(),
-                layouter.namespace(|| "coin_nonce*1"),
-                (coin_nonce.clone(), one.clone()),
-            )?;
-            nonce2_commit_v.mul(layouter.namespace(|| "coin_pk commit v"), coin_nonce)?
-        };
-        // r*G_2
-        let (blind, _) = {
-            let nonce2_commit_r = OrchardFixedBasesFull::ValueCommitR;
-            let nonce2_commit_r = FixedPoint::from_inner(ecc_chip.clone(), nonce2_commit_r);
-            let root_sk = ScalarFixed::new(
-                ecc_chip.clone(),
-                layouter.namespace(|| "root_sk scalar"),
-                self.sf_root_sk,
+        let coin2_nonce : AssignedCell<Fp,Fp> = {
+            let poseidon_message = [
+                coin_nonce.clone(),
+                _root_sk.clone()
+            ];
+            let poseidon_hasher = PoseidonHash::<_, _, poseidon::P128Pow5T3, poseidon::ConstantLength<2>, 3, 2>::init(
+                config.poseidon_chip(),
+                layouter.namespace(|| "Poseidon init"),
             )?;
-            nonce2_commit_r.mul(layouter.namespace(|| "nonce2 commit R"), root_sk)?
-        };
-        let coin2_nonce = com.add(layouter.namespace(|| "nonce2 commit"), &blind)?;
 
+            let poseidon_output =
+                poseidon_hasher.hash(layouter.namespace(|| "Poseidon hash"), poseidon_message)?;
+            let poseidon_output: AssignedCell<Fp, Fp> = poseidon_output;
+            poseidon_output
+        };
         layouter.constrain_instance(
-            coin2_nonce.inner().x().cell(),
-            config.primary,
-            LEAD_COIN_NONCE2_X_OFFSET,
-        )?;
-        // constrain coin's pub key y value
-        layouter.constrain_instance(
-            coin2_nonce.inner().y().cell(),
+            coin2_nonce.cell(),
             config.primary,
-            LEAD_COIN_NONCE2_Y_OFFSET,
+            LEAD_COIN_NONCE2_OFFSET,
         )?;
 
         // ================
@@ -412,13 +395,13 @@ impl Circuit<pallas::Base> for LeadContract {
         let (com, _) = {
             let sn_commit_v = ValueCommitV;
             let sn_commit_v = FixedPointShort::from_inner(ecc_chip.clone(), sn_commit_v);
-            let coin_nonce = ScalarFixedShort::new(
+            let rcv = ScalarFixedShort::new(
                 ecc_chip.clone(),
                 layouter.namespace(|| "coin nonce * 1"),
                 (coin_nonce.clone(), one.clone()),
             )?;
 
-            sn_commit_v.mul(layouter.namespace(|| "coin serial number commit v"), coin_nonce)?
+            sn_commit_v.mul(layouter.namespace(|| "coin serial number commit v"), rcv)?
         };
         // r*G_2
         let (blind, _) = {
@@ -447,64 +430,17 @@ impl Circuit<pallas::Base> for LeadContract {
             LEAD_COIN_SERIAL_NUMBER_Y_OFFSET,
         )?;
 
-        // ==========================
-        // commitment of coins c1,c2
-        // ==========================
-        //TODO (res) should the reward be added to new minted coin?
-        /*
-        let coin_val = {
-        let coin_val_pt = ar_chip.mul(layouter.namespace(|| ""), &coin_pk_y, &coin_pk_x)?;
-
-        //TODO (FIX)
-        //let coin_val0 = ar_chip.mul(layouter.namespace(|| ""), &coin_nonce, &coin_value)?;
-        let coin_val0 = ar_chip.mul(layouter.namespace(|| ""), &one.clone(), &zero.clone())?;
-        ar_chip.mul(layouter.namespace(|| ""), &coin_val_pt, &coin_val0)?
-    };
-         */
-
-
-        /*
-        let coin_hash : AssignedCell<Fp,Fp> = {
-            let poseidon_message = [
-                //TODO (fix)
-                //coin_pk_x.clone(),
-                //coin_pk_y.clone(),
-                //coin_value.clone(),
-                //coin_nonce.clone(),  //TODO (fix) nocne need to be for (x,y), or if the seed is changed to hash it can be just pallas
-                one.clone(),
-            ];
-
-            let poseidon_hasher = PoseidonHash::<_, _, poseidon::P128Pow5T3, poseidon::ConstantLength<1>, 3, 2>::init(
-                config.poseidon_chip(),
-                layouter.namespace(|| "Poseidon init"),
-            )?;
-
-            let poseidon_output =
-                poseidon_hasher.hash(layouter.namespace(|| "Poseidon hash"), poseidon_message)?;
-
-            let poseidon_output: AssignedCell<Fp, Fp> = poseidon_output;
-            poseidon_output
-        };
-        */
         let coin_val = {
-            let coin_val_pt = ar_chip.mul(layouter.namespace(|| ""), &coin_pk_y, &coin_pk_x)?;
-
-            let coin_val0 = ar_chip.mul(layouter.namespace(|| ""), &coin_nonce, &coin_value)?;
-            ar_chip.mul(layouter.namespace(|| ""), &coin_val_pt, &coin_val0)?
+            let coin_pk_mul = ar_chip.mul(layouter.namespace(|| ""), &coin_pk_y, &coin_pk_x)?;
+            let coin_val_mul = ar_chip.mul(layouter.namespace(|| ""), &coin_pk_mul, &coin_value)?;
+            //let coin_nonce_mul = ar_chip.mul(layouter.namespace(|| ""), &coin_val_mul, coin_nonce)?;
+            let coin_val0 = ar_chip.mul(layouter.namespace(|| ""), &coin_nonce, &coin_val_mul)?;
+            coin_val0
+            //ar_chip.mul(layouter.namespace(|| ""), &coin_val_pt, &coin_val0)?
         };
         let (com, _) = {
             let coin_commit_v = ValueCommitV;
             let coin_commit_v = FixedPointShort::from_inner(ecc_chip.clone(), coin_commit_v);
-            //TODO (FIX) THIS PANICS, ONLY PANICS ON LARGE VALUES!
-            /*
-            let coin_hash_pt = ScalarFixedShort::new(
-            ecc_chip.clone(),
-            layouter.namespace(|| "coin_val*1"),
-            (coin_hash, one.clone()),
-            )?;
-             */
-            //note c_v is set to zero, should work
-
 
             let coin_hash_pt = ScalarFixedShort::new(
                 ecc_chip.clone(),
@@ -543,46 +479,21 @@ impl Circuit<pallas::Base> for LeadContract {
             LEAD_COIN_COMMIT_Y_OFFSET,
         )?;
 
-        //
-        /*
-        let coin2_hash = {
-            let poseidon_message = [
-                //coin_pk_commit.inner().x(),
-                //coin_pk_commit.inner().y(),
-                //coin_value.clone(),
-                //coin2_nonce.inner().x(),
-                //coin2_nonce.inner().y(),
-                zero.clone(),
-            ];
 
-            let poseidon_hasher = PoseidonHash::<_, _, poseidon::P128Pow5T3, poseidon::ConstantLength<5>, 3, 2>::init(
-                config.poseidon_chip(),
-                layouter.namespace(|| "Poseidon init"),
-            )?;
 
-            let poseidon_output =
-                poseidon_hasher.hash(layouter.namespace(|| "Poseidon hash"), poseidon_message)?;
-
-            let poseidon_output: AssignedCell<Fp, Fp> = poseidon_output;
-            poseidon_output
-        };
-        /*
-        let coin2_hash0 = ar_chip.mul(
+        let coin2_hash_cm = ar_chip.mul(
             layouter.namespace(|| ""),
             &coin_pk_commit.inner().x(),
             &coin_pk_commit.inner().y(),
         )?;
-        let coin2_hash1 = ar_chip.mul(
+        let coin2_hash_nonce = ar_chip.mul(
             layouter.namespace(|| ""),
-            &coin2_nonce.inner().x(),
-            &coin2_nonce.inner().y(),
+            &coin2_nonce,
+            &coin2_nonce,
         )?;
-        let coin2_hash2 = ar_chip.mul(layouter.namespace(|| ""), &coin2_hash0, &coin2_hash1)?;
+        let coin2_hash_mul = ar_chip.mul(layouter.namespace(|| ""), &coin2_hash_cm, &coin2_hash_nonce)?;
+        let coin2_hash = ar_chip.mul(layouter.namespace(|| ""), &coin_value.clone(), &coin2_hash_mul)?;
 
-        //TODO (fix)
-        //let coin2_hash = ar_chip.mul(layouter.namespace(|| ""), &coin_value.clone(), &coin2_hash2)?;
-        let coin2_hash = ar_chip.mul(layouter.namespace(|| ""), &one.clone(), &zero.clone())?;
-        */
         let (com, _) = {
             let coin_commit_v = ValueCommitV;
             let coin_commit_v = FixedPointShort::from_inner(ecc_chip.clone(), coin_commit_v);
@@ -655,12 +566,10 @@ impl Circuit<pallas::Base> for LeadContract {
         //let serialized = serde_json::to_string(&node).unwrap();
         //println!("root_sk: {}", serialized);
 
-        //TODO (research) this multiplication panics!
         let y_commit_exp = ar_chip.mul(
         layouter.namespace(|| ""),
-        //root_sk.clone(), //(fix)
+            &_root_sk.clone(),
             &coin_nonce,
-            &one,
         )?;
 
         let (com, _) = {
@@ -688,43 +597,18 @@ impl Circuit<pallas::Base> for LeadContract {
         let y_commit = com.add(layouter.namespace(|| "nonce commit"), &blind)?;
         let y_commit_base = y_commit.inner().x();
 
-        // ============================
-        //let _y_commit_bytes : [u8;32] = y_commit.inner().point().inner().unwrap().to_repr();
-
-        //TODO (fix) temp abuse until even_bits is fixed.
-        let zero_base_bytes : [u8;32] = [0;32];
-        let y_commit_base_temp = pallas::Base::from_repr(zero_base_bytes).unwrap();
-        let y_commit_base = self.load_private(
-            layouter.namespace(|| "load coin y commit as pallas::base"),
-            config.advices[0],
-            Value::known(y_commit_base_temp),
-        )?;
-        /*
-        let y_commit_base_bytes: [u8; 32] = [0; 32];
-        //note! due to 24bytes size limitation in the comparision gate we need first 24bytes
-        for i in 0..23 {
-            y_commit_base_bytes[i] = y_commit_base_bytes[i];
-        }
-        let y_commit_base_temp = pallas::Base::from_repr(y_commit_base_bytes).unwrap();
-
-        let y_commit_base = self.load_private(
-            layouter.namespace(|| "load coin y commit as pallas::base"),
-            config.advices[0],
-            Value::known(y_commit_base_temp),
-        )?;
-        */
         // ============================
         // constraint rho
         // ============================
         let (com, _) = {
             let rho_commit_v = ValueCommitV;
             let rho_commit_v = FixedPointShort::from_inner(ecc_chip.clone(), rho_commit_v);
-            let y_commit_base = ScalarFixedShort::new(
+            let rcv = ScalarFixedShort::new(
                 ecc_chip.clone(),
                 layouter.namespace(|| "y_commit_base*1"),
                 (y_commit_base.clone(), one.clone()),
             )?;
-            rho_commit_v.mul(layouter.namespace(|| "coin commit v"), y_commit_base)?
+            rho_commit_v.mul(layouter.namespace(|| "coin commit v"), rcv)?
         };
         // r*G_2
         let (blind, _) = {
@@ -743,18 +627,18 @@ impl Circuit<pallas::Base> for LeadContract {
             Value::known(pallas::Base::from(1024)),
         )?;
         //leadership coefficient
+
         let c = self.load_private(
             layouter.namespace(|| ""),
             config.advices[0],
             Value::known(pallas::Base::one()), // note! this parameter to be tuned.
         )?;
-        let ord = ar_chip.mul(layouter.namespace(|| ""), &scalar, &c)?;
-        //TODO (fix)
+        //let ord = ar_chip.mul(layouter.namespace(|| ""), &scalar, &c)?;
+
         //let target = ar_chip.mul(layouter.namespace(|| "calculate target"), &ord, &coin_value.clone())?;
-        let target = ar_chip.mul(layouter.namespace(|| "calculate target"), &one.clone(), &zero.clone())?;
-        eb_chip.decompose(layouter.namespace(|| "target range check"), target.clone())?;
-        eb_chip.decompose(layouter.namespace(|| "y_commit  range check"), y_commit_base.clone())?;
-        */
+        //eb_chip.decompose(layouter.namespace(|| "target range check"), target.clone())?;
+        //eb_chip.decompose(layouter.namespace(|| "y_commit  range check"), y_commit_base.clone())?;
+
         //let (helper, is_gt) = greater_than_chip.greater_than(
         //  layouter.namespace(|| "t>y"),
         //target.into(),