zk: simplified nova proof

script/research/zk/nova-ivc.sage

@@ -133,16 +133,18 @@ R2_x1 = hash2(F2(0), F2(0), F2(0), R1_accum0)
 R2_u0 = (R2_u0_E, R2_u0_s, R2_u0_W, R2_x0, R2_x1)
 
 # This should be extended to all the witness values for the calcs above
-R1_witness = (F1(0), R1_z0, R1_z0, R2_accum1, R2_u0, commit2())
+R1_witness = (F1(0), R1_z0, R1_z0, R2_accum0, R2_u0, commit2())
 # This is weird since R2_u0_s is not in F1, but s is always 1 so it works
 R1_w1 = commit1(R1_witness)
 
+R2_accum1 = R2_accum0
+
 # Now we do the actual calc!
 R1_z1 = 5*R1_z0
 
 # Remember we said hash values are in both F1 and F2? Now we use that
 R1_x0 = F1(R2_x1)
-R1_x1 = hash1(F1(1), R1_z0, R1_z1, R2_accum1)
+R1_x1 = hash1(F1(1), R1_z0, R1_z1, R2_accum0)
 
 R1_u1_E = commit1()
 R1_u1_s = F1(1)

script/research/zk/nova-simplified.sage

@@ -0,0 +1,63 @@
+#!/usr/bin/env sage
+
+"""
+Implements the simplified Nova scheme introduced in [1] Section 5.1
+
+[1] Nova: Recursive Zero-Knowledge Arguments from Folding Schemes
+    https://eprint.iacr.org/2021/370.pdf
+[2] Nova: The ZK Bug of the Year (by Wilson Nguyen)
+    https://www.youtube.com/watch?v=SOAQCL1NaYY
+"""
+
+q = 0x40000000000000000000000000000000224698fc0994a8dd8c46eb2100000001
+K = GF(q)
+
+hash_table = {}
+def hash(key):
+    if key in hash_table:
+        return hash_table[key]
+
+    c = K.random_element()
+    while c > 2**250 - 1:
+        c = K.random_element()
+    hash_table[key] = c
+    return c
+
+def fold(U, u):
+    return U + (u,)
+
+z0 = 5
+F = lambda z, ω: 5*z
+
+i = 0
+ω0 = ()
+z1 = F(z0, ω0)
+u1 = hash((1, z0, z1, ()))
+U1 = ()
+# ZK proof
+assert u1 == hash((1, z0, z1, ()))
+
+i = 1
+ω1 = ()
+U2 = fold(U1, u1)
+z2 = F(z1, ω1)
+u2 = hash((i+1, z0, z2, U2))
+assert u1 == hash((i, z0, z1, U1))
+assert U2 == fold(U1, u1)
+assert u2 == hash((i+1, z0, z2, U2))
+
+i = 2
+ω2 = ()
+U3 = fold(U2, u2)
+z3 = F(z2, ω2)
+u3 = hash((i+1, z0, z3, U3))
+assert u2 == hash((i, z0, z2, U2))
+assert U3 == fold(U2, u2)
+assert u3 == hash((i+1, z0, z3, U3))
+
+# We've now made a proof of what 5^4 is
+assert z0 == 5
+assert z1 == 5*5
+assert z2 == 5*5*5
+assert z3 == 5^(i+2)
+