[zk/circuit/lead_contract] constrain equal rho

src/crypto/leadcoin.rs

@@ -12,7 +12,7 @@ use crate::{
     zk::circuit::lead_contract::LeadContract,
 };
 
-pub const LEAD_PUBLIC_INPUT_LEN: usize = 8;
+pub const LEAD_PUBLIC_INPUT_LEN: usize = 7;
 
 #[derive(Debug, Default, Clone, Copy)]
 pub struct LeadCoin {
@@ -67,13 +67,7 @@ impl LeadCoin {
             poseidon::Hash::<_, poseidon::P128Pow5T3, poseidon::ConstantLength<2>, 3, 2>::init(
             )
             .hash(y_coord_arr);
-        //
-        let po_rho_pt: pallas::Point = pedersen_commitment_base(lottery_msg, mod_r_p(rho_mu));
-        let po_rho_x = *po_rho_pt.to_affine().coordinates().unwrap().x();
-        let po_rho_y = *po_rho_pt.to_affine().coordinates().unwrap().y();
-        let rho_coord_arr = [po_rho_x, po_rho_y];
-        let po_rho: pallas::Base =
-            poseidon::Hash::<_, poseidon::P128Pow5T3, poseidon::ConstantLength<2>, 3, 2>::init().hash(rho_coord_arr);
+
 
         let cm_pos = self.idx;
         let cm_root = {
@@ -99,7 +93,6 @@ impl LeadCoin {
             *po_pk.x(),
             *po_pk.y(),
             po_y,
-            po_rho,
         ];
         public_inputs
     }
@@ -109,6 +102,15 @@ impl LeadCoin {
     }
 
     pub fn create_contract(&self) -> LeadContract {
+        let rho_mu = self.rho_mu.unwrap();
+        let root_sk = self.root_sk.unwrap();
+        let nonce = self.nonce.unwrap();
+        let lottery_msg_input = [root_sk, nonce];
+        let lottery_msg: pallas::Base =
+            poseidon::Hash::<_, poseidon::P128Pow5T3, poseidon::ConstantLength<2>, 3, 2>::init()
+            .hash(lottery_msg_input);
+        //
+        let rho_pt: pallas::Point = pedersen_commitment_base(lottery_msg, mod_r_p(rho_mu));
         LeadContract {
             path: Value::known(self.path.unwrap()),
             sk: Value::known(self.keypair.unwrap().secret.inner()),
@@ -129,6 +131,7 @@ impl LeadCoin {
             root_cm: Value::known(self.root_cm.unwrap()),
             sigma1: Value::known(self.sigma1.unwrap()),
             sigma2: Value::known(self.sigma2.unwrap()),
+            rho: Value::known(rho_pt),
         }
     }
 }

src/zk/circuit/lead_contract.rs

@@ -95,14 +95,11 @@ impl LeadConfig {
 
 const LEAD_COIN_COMMIT_X_OFFSET: usize = 0;
 const LEAD_COIN_COMMIT_Y_OFFSET: usize = 1;
-//const LEAD_COIN_COMMIT2_X_OFFSET: usize = 2;
-//const LEAD_COIN_COMMIT2_Y_OFFSET: usize = 3;
 const LEAD_COIN_NONCE2_OFFSET: usize = 2;
 const LEAD_COIN_COMMIT_PATH_OFFSET: usize = 3;
 const LEAD_COIN_PK_X_OFFSET: usize = 4;
 const LEAD_COIN_PK_Y_OFFSET: usize = 5;
 const LEAD_Y_COMMIT_BASE_OFFSET: usize = 6;
-const LEAD_RHO_COMMIT_BASE_OFFSET: usize = 7;
 
 #[derive(Default, Debug)]
 pub struct LeadContract {
@@ -129,7 +126,7 @@ pub struct LeadContract {
     pub sigma1: Value<pallas::Base>,
     pub sigma2: Value<pallas::Base>,
     //pub eta : Option<u32>,
-    //pub rho : Option<u32>,
+    pub rho : Value<pallas::Point>,
     //pub h : Option<u32>, // hash of this data
     //pub ptr: Option<u32>, //hash of the previous block
 }
@@ -447,7 +444,7 @@ impl Circuit<pallas::Base> for LeadContract {
         let coin_commit_y: AssignedCell<Fp, Fp> = coin_commit.inner().y();
 
         // nonce2  =  PRF_{root_sk}(coin_nonce)
-        // poured coin derived nonce as a poseidon of the previous nonce, and
+        // poured coin nonce as a poseidon of the previous nonce, and
         // root of secret key.
         let coin2_nonce: AssignedCell<Fp, Fp> = {
             let poseidon_message = [coin_nonce.clone(), _root_sk.clone()];
@@ -581,9 +578,9 @@ impl Circuit<pallas::Base> for LeadContract {
             y_commit_r.mul(layouter.namespace(|| "coin serial number commit R"), mau_y)?
         };
         let y_commit = com.add(layouter.namespace(|| "nonce commit"), &blind)?;
-        let y_commit_base_x = y_commit.inner().x();
-        let y_commit_base_y = y_commit.inner().y();
         let y_commit_base: AssignedCell<Fp, Fp> = {
+            let y_commit_base_x = y_commit.inner().x();
+            let y_commit_base_y = y_commit.inner().y();
             let y_coord = [y_commit_base_x, y_commit_base_y];
             let poseidon_hasher = PoseidonHash::<
                 _,
@@ -614,26 +611,12 @@ impl Circuit<pallas::Base> for LeadContract {
             rho_commit_r.mul(layouter.namespace(|| "coin serial number commit R"), mau_rho)?
         };
         let rho_commit = com.add(layouter.namespace(|| "nonce commit"), &blind)?;
-        let rho_commit_x = rho_commit.inner().x();
-        let rho_commit_y = rho_commit.inner().y();
-        let rho_commit_base: AssignedCell<Fp, Fp> = {
-            let rho_coord = [rho_commit_x, rho_commit_y];
-            let poseidon_hasher = PoseidonHash::<
-                    _,
-                _,
-                poseidon::P128Pow5T3,
-                poseidon::ConstantLength<2>,
-                3,
-                2,
-                >::init(
-                config.poseidon_chip(), layouter.namespace(|| "Poseidon init")
-            )?;
-
-            let poseidon_output =
-                poseidon_hasher.hash(layouter.namespace(|| "Poseidon hash"), rho_coord)?;
-            let poseidon_output: AssignedCell<Fp, Fp> = poseidon_output;
-            poseidon_output
-        };
+        let rho = NonIdentityPoint::new(
+            ecc_chip.clone(),
+            layouter.namespace(|| "witness rho"),
+            self.rho.map(|x| x.to_affine()),
+        )?;
+        rho_commit.constrain_equal(layouter.namespace(||""),&rho)?;
         let term1 =
             ar_chip.mul(layouter.namespace(|| "calculate term1"), &sigma1, &coin_value.clone())?;
 
@@ -724,11 +707,6 @@ impl Circuit<pallas::Base> for LeadContract {
             LEAD_Y_COMMIT_BASE_OFFSET,
         )?;
 
-        layouter.constrain_instance(
-            rho_commit_base.cell(),
-            config.primary,
-            LEAD_RHO_COMMIT_BASE_OFFSET,
-        )?;
 
         Ok(())
     }