jj conditional select working

proofs/mint2.psm

@@ -1,5 +1,6 @@
 constant edwards_d 0x2a9318e74bfa2b48f5fd9207e6bd7fd4292d7f6d37579d2601065fd6d6343eb1
 constant one 0x0000000000000000000000000000000000000000000000000000000000000001
+constant zero 0x0000000000000000000000000000000000000000000000000000000000000000
 constant G_VCR_u 0x6800f4fa0f001cfc7ff6826ad58004b4d1d8da41af03744e3bce3b7793664337
 constant G_VCR_v 0x6d81d3a9cb45dedbe6fb2a6e1e22ab50ad46f1b0473b803b3caefab9380b6a8b
 constant G_VCV_u 0x273f910d9ecc1615d8618ed1d15fef4e9472c89ac043042d36183b2cb4d7ef51
@@ -146,7 +147,11 @@ constant G_VCV_v 0x466a7e3a82f67ab1d32294fd89774ad6bc3332d0fa1ccd18a77a81f50667c
     enforce
 {% endmacro %}
 
-{% macro jubjub_add(P, x1, y1, x2, y2) -%}
+{% macro jubjub_add(P, x1, y1, x2, y2) %}
+    ########################################################
+    # jubjub_add({{p}}, {{x1}}, {{y1}}, {{x2}}, {{y2}})
+    ########################################################
+
     # Compute U = (x1 + y1) * (y2 - EDWARDS_A*x2)
     #           = (x1 + y1) * (x2 + y2)
     private {{P}}_U
@@ -175,12 +180,12 @@ constant G_VCV_v 0x466a7e3a82f67ab1d32294fd89774ad6bc3332d0fa1ccd18a77a81f50667c
     mul {{P}}_B {{ y1 }}
     # Compute C = d*A*B
     private {{P}}_C
-    load {{P}}_C d
+    load {{P}}_C edwards_d
     mul {{P}}_C {{P}}_A
     mul {{P}}_C {{P}}_B
 
     # assert (d * A) * (B) == C
-    lc0_add_coeff d {{P}}_A
+    lc0_add_coeff edwards_d {{P}}_A
     lc1_add {{P}}_B
     lc2_add {{P}}_C
     enforce
@@ -218,7 +223,49 @@ constant G_VCV_v 0x466a7e3a82f67ab1d32294fd89774ad6bc3332d0fa1ccd18a77a81f50667c
     lc2_sub {{P}}_A
     lc2_sub {{P}}_B
     enforce
-{%- endmacro %}
+{% endmacro %}
+
+{% macro jubjub_conditionally_select(p, u, v, condition) %}
+    ########################################################
+    # jubjub_conditionally_select({{p}}, {{u}}, {{v}}, {{condition}})
+    ########################################################
+
+    # Compute u' = self.u if condition, and 0 otherwise
+    private {{p}}_u
+    set {{p}}_u {{u}}
+    mul {{p}}_u condition
+
+    # condition * u = u'
+    # if condition is 0, u' must be 0
+    # if condition is 1, u' must be u
+    lc0_add {{u}}
+    lc1_add {{condition}}
+    lc2_add {{p}}_u
+    enforce
+
+    # Compute v' = self.v if condition, and 1 otherwise
+    # v' = condition * v + 1 - condition
+    private {{p}}_v
+    set {{p}}_v {{v}}
+    mul {{p}}_v {{condition}}
+    local {{p}}_one
+    load {{p}}_one one
+    add {{p}}_v {{p}}_one
+    sub {{p}}_v {{condition}}
+
+    # condition * v = v' - (1 - condition)
+    # if condition is 0, v' must be 1
+    # if condition is 1, v' must be v
+    lc0_add {{v}}
+    lc1_add {{condition}}
+    lc2_add {{p}}_v
+    lc2_sub_one
+    lc2_add {{condition}}
+    enforce
+{% endmacro %}
+
+{% macro jubjub_mul(p, u, v, x, n) %}
+{% endmacro %}
 
 contract mint_contract
     param public_u
@@ -234,22 +281,26 @@ contract mint_contract
     {% endfor %}
 
     #############
-    {#
-        {{ jubjub_double("pub_dbl", "public_u", "public_v") }}
+    #{
+        {{ jubjub_double("pub_dbl_pre", "public_u", "public_v") }}
+
+        private condition
+        load condition one
+        {{ jubjub_conditionally_select("pub_dbl", "pub_dbl_pre_u", "pub_dbl_pre_v", "condition") }}
 
         # Use this code for testing point doubling
-        #public dbl_u
-        #set dbl_u pub_dbl_u
-        #lc0_add dbl_u
-        #lc1_add_one
-        #lc2_add pub_dbl_u
-        #enforce
-        #public dbl_v
-        #set dbl_v pub_dbl_v
-        #lc0_add dbl_v
-        #lc1_add_one
-        #lc2_add pub_dbl_v
-        #enforce
-    #}
+        public dbl_u
+        set dbl_u pub_dbl_u
+        lc0_add dbl_u
+        lc1_add_one
+        lc2_add pub_dbl_u
+        enforce
+        public dbl_v
+        set dbl_v pub_dbl_v
+        lc0_add dbl_v
+        lc1_add_one
+        lc2_add pub_dbl_v
+        enforce
+    #
 end
 

scripts/pism.vim

@@ -15,7 +15,7 @@ endif
 syn keyword sapviKeyword constant contract start end constraint
 "syn keyword sapviAttr
 syn keyword sapviType FixedGenerator BlakePersonalization PedersenPersonalization ByteSize U64 Fr Point Bool Scalar BinarySize
-syn keyword sapviFunctionKeyword enforce lc0_add_one lc1_add_one lc2_add_one lc_coeff_reset lc_coeff_double
+syn keyword sapviFunctionKeyword enforce lc0_add_one lc1_add_one lc2_add_one lc_coeff_reset lc_coeff_double lc0_sub_one lc1_sub_one lc2_sub_one
 syn match sapviFunction "^[ ]*[a-z_0-9]* "
 syn match sapviComment "#.*$"
 syn match sapviNumber ' \zs\d\+\ze'

scripts/vm.py

@@ -32,6 +32,9 @@ constraint_commands = {
     "lc0_add_one": 0,
     "lc1_add_one": 0,
     "lc2_add_one": 0,
+    "lc0_sub_one": 0,
+    "lc1_sub_one": 0,
+    "lc2_sub_one": 0,
     "lc0_add_coeff": 2,
     "lc1_add_coeff": 2,
     "lc2_add_coeff": 2,

src/mint2.rs

@@ -73,17 +73,17 @@ fn main() -> std::result::Result<(), vm::ZKVMError> {
 
     let public = vm.public();
 
-    assert_eq!(public.len(), 0);
+    assert_eq!(public.len(), 2);
 
     // Use this code for testing point doubling
-    //let dbl = public_point.double().to_affine();
+    let dbl = public_point.double().to_affine();
+    println!("{:?}", dbl.get_u());
+    println!("{:?}", public[0]);
+    println!("{:?}", dbl.get_v());
+    println!("{:?}", public[1]);
     //assert_eq!(public.len(), 2);
     //assert_eq!(public[0], dbl.get_u());
     //assert_eq!(public[1], dbl.get_v());
-    //println!("{:?}", dbl.get_u());
-    //println!("{:?}", public[0]);
-    //println!("{:?}", dbl.get_v());
-    //println!("{:?}", public[1]);
 
     assert!(vm.verify(&proof, &public));
     Ok(())

src/vm.rs

@@ -61,6 +61,9 @@ pub enum ConstraintInstruction {
     Lc0AddOne,
     Lc1AddOne,
     Lc2AddOne,
+    Lc0SubOne,
+    Lc1SubOne,
+    Lc2SubOne,
     Lc0AddCoeff(VariableIndex, VariableIndex),
     Lc1AddCoeff(VariableIndex, VariableIndex),
     Lc2AddCoeff(VariableIndex, VariableIndex),
@@ -360,6 +363,15 @@ impl Circuit<bls12_381::Scalar> for ZKVMCircuit {
                 ConstraintInstruction::Lc2AddOne => {
                     lc2 = lc2 + CS::one();
                 }
+                ConstraintInstruction::Lc0SubOne => {
+                    lc0 = lc0 - CS::one();
+                }
+                ConstraintInstruction::Lc1SubOne => {
+                    lc1 = lc1 - CS::one();
+                }
+                ConstraintInstruction::Lc2SubOne => {
+                    lc2 = lc2 - CS::one();
+                }
                 ConstraintInstruction::Lc0AddCoeff(const_index, index) => {
                     lc0 = lc0 + (self.constants[const_index], variables[index]);
                 }