another proof script variant

proofs/sapling2.prf

@@ -0,0 +1,179 @@
+# You will need this repo:
+# https://github.com/zcash/librustzcash/
+# Then compare this code to the file:
+# librustzcash/zcash_proofs/src/circuit/sapling.rs
+
+# What is the LC stuff?
+# Difference between AllocatedNum and Num
+# Why BlsScalar vs JJScalar?
+const:
+    G_VCV: Point
+    G_VCR: Point
+    G_SPEND: Point
+    G_PROOF: Point
+    G_NOTE_COMMIT_R: Point
+    G_NULL: Point
+
+    CRH_IVK: Blake2sPersonalization
+    NOTE_COMMIT: PedersenPersonalization
+    MERKLE: list<PedersenPersonalization>
+    PRF_NF: Blake2sPersonalization
+
+def value_commit(value: u64, randomness: Scalar) -> (Point, list<bool>):
+    let value_bits: list<bool> = value as list<bool>
+    let value: Point = value * G_VCV
+
+    let rcv: list<bool> = randomness as list<bool>
+    let rcv: Point = rcv * G_VCR
+
+    let cv: Point = value + rcv
+    emit cv
+    return value_bits
+
+# The parameters to this function are the same as in:
+#   struct Spend
+proof input_burn:
+    private:
+        value: u64                  # ValueCommitment.value
+        randomness: Scalar          # ValueCommitment.randomness
+
+        ak: Point                   # from ProofGenerationKey
+        ar: Scalar 
+
+        nsk: Scalar                 # from ProofGenerationKey
+
+        g_d: Point                  # Computed from payment_address
+
+        commitment_randomness: Scalar 
+
+        auth_path: list<(Scalar, bool)>
+
+        anchor: Scalar
+
+    contract -> (Point, Point, Point, list<bool>)
+        let ak = witness(ak)
+        ak.assert_not_small_order()
+
+        let ar: list<bool> = ar as list<bool>
+        let ar: Point = ar * G_SPEND
+
+        let rk: Point = ak + ar
+        emit rk
+
+        let nsk: list<bool> = nsk as list<bool>
+        let nk: Point = nsk * G_PROOF
+
+        let mut ivk_preimage: list<bool> = []
+        # Must be list<bool> as well
+        ivk_preimage.extend(ak.repr())
+
+        let mut nf_preimage: list<bool> = []
+        let nk_repr: list<bool> = nk.repr()
+        ivk_preimage.extend(nk_repr)
+        nf_preimage.extend(nk_repr)
+
+        assert len(ivk_preimage) == 512
+        assert len(nf_preimage) == 256
+
+        let mut ivk: list<bool> = blake2s(ivk_preimage, CRH_IVK)
+        ivk.truncate(Scalar::CAPACITY)
+
+        let g_d: Point = witness g_d
+        g_d.assert_not_small_order()
+
+        let pk_d: Point = ivk * g_d
+
+        let mut note_contents: list<bool> = []
+
+        let (cv: Point, value_bits: list<bool>) = value_commit(value, randomness)
+
+        let mut value_num: Num = Num.zero()
+        let mut coeff: Scalar = Scalar.one()
+        for bit in value_bits:
+            value_num = value_num.add_bool_with_coeff(bit, coeff)
+            coeff = coeff.double()
+        # Is this equivalent?
+        let value_num = value_bits as Num
+
+        note_contents.extend(value_bits)
+        note_contents.extend(g_d)
+        note_contents.extend(pk_d)
+
+        assert len(note_contents) == 64 + 256 + 256
+
+        let mut cm: Point = pedersen_hash(NOTE_COMMIT, note_contents)
+        let rcm: list<bool> = commitment_randomness as list<bool>
+        let rcm: Point = rcm * G_NOTE_COMMIT_R
+        cm += rcm
+
+        let mut position_bits: list<bool> = []
+        let mut cur: Scalar = cm.u
+
+        for i, (node, is_right) in enumerate(auth_path):
+            position_bits.push(is_right)
+
+            let node: EncryptedNum = EncryptedNum.from(node)
+            print(node)
+            let (left: list<bool>, right: list<bool>) = Num.swap_if(is_right, cur, node)
+
+            let mut preimage: list<bool> = []
+            preimage.extend(left)
+            preimage.extend(right)
+
+            cur = pedersen_hash(MERKLE_TREE[i], preimage).u
+
+        let rt: Point = EncryptedNum.from(anchor)
+
+        enforce (cur - rt) * value_num == 0
+        emit rt
+
+        let position: Point = position_bits * G_NULL
+        let rho: Point = cm + position
+
+        nf_preimage.extend(rho)
+        assert len(nf_preimage) == 512
+        let nf: list<bool> = blake2s(nf_preimage, PRF_NF)
+        emit nf
+
+def output_mint(
+    value: u64,
+    randomness: Scalar,
+
+    g_d: Point,
+
+    esk: Scalar,
+    pk_d: Point,
+
+    commitment_randomness: Scalar
+) -> (Point, Point, Scalar):
+    let (cv: Point, value_bits: list<bool>) = value_commit(value, randomness)
+
+    let mut note_contents: list<bool> = []
+    note_contents.extend(value_bits)
+
+    let g_d: Point = witness g_d
+    assert is_not_small_order(g_d)
+
+    let esk: list<bool> = esk as list<bool>
+    let epk: Point = esk * g_d
+
+    let v_contents: list<bool> = pk_d.v as list<bool>
+
+    let sign_bit: bool = pk_d.u.is_odd() as bool
+
+    note_contents.extend(v_contents)
+    note_contents.push(sign_bit)
+
+    assert len(note_contents) == 64 + 256 + 256
+
+    let mut cm: Point = pedersen_hash(NOTE_COMMIT, note_contents)
+
+    let rcm: list<bool> = commitment_randomness as list<bool>
+    let rcm: Point = rcm * G_NOTE_COMMIT_R
+
+    cm += rcm
+
+    let cmu: Scalar = cm.u
+
+    return (cv, epk, cmu)
+

scripts/sapvi.vim

@@ -2,7 +2,7 @@ if exists('b:current_syntax')
     finish
 endif
 
-syn keyword sapviKeyword assert enforce for in def return const as let
+syn keyword sapviKeyword assert enforce for in def return const as let emit contract private proof
 syn keyword sapviAttr mut
 syn keyword sapviType Point Scalar EncryptedNum list bool u64 Num
 syn match sapviFunction "\zs[a-zA-Z0-9_]*\ze("