Merge branch 'asset-id'

proofs/tutorial.psm

@@ -0,0 +1,52 @@
+constant one 0x0000000000000000000000000000000000000000000000000000000000000001
+
+contract tutorial_contract
+    param w
+    param a
+    param b
+
+    private m
+    set m a
+    mul m b
+
+    # ab = m
+    lc0_add a
+    lc1_add b
+    lc2_add m
+    enforce
+
+    # v = wab ...
+    public v
+    set v w
+    mul v a
+    mul v b
+
+    # v = wab + a + b ...
+    add v a
+    add v b
+
+    # v = wab + a + b - v'
+    # v' = w(a + b)
+    local vprime
+    set vprime a
+    add vprime b
+    mul vprime w
+    sub v vprime
+
+    # w(m - a - b) = v - a - b
+    lc0_add w
+    lc1_add m
+    lc1_sub a
+    lc1_sub b
+    lc2_add v
+    lc2_sub a
+    lc2_sub b
+    enforce
+
+    # Binary check that w^2 = w
+    lc0_add w
+    lc1_add w
+    lc2_add w
+    enforce
+end
+

scripts/elliptic_curves/curve.py

@@ -0,0 +1,40 @@
+from finite_fields import finitefield
+
+def add(x_1, y_1, x_2, y_2):
+    if (x_1, y_1) == (x_2, y_2):
+        if y_1 == 0:
+            return None
+
+        # slope of the tangent line
+        m = (3 * x_1 * x_1 + a) / (2 * y_1)
+        return None
+    else:
+        if x_1 == x_2:
+            return None
+
+        # slope of the secant line
+        m = (y_2 - y_1) / (x_2 - x_1)
+
+    x_3 = m*m - x_1 - x_2
+    y_3 = m*(x_1 - x_3) - y_1
+
+    return (x_3, y_3)
+
+if __name__ == "__main__":
+    # Vesta
+    q = 0x40000000000000000000000000000000224698fc0994a8dd8c46eb2100000001
+    fq = finitefield.IntegersModP(q)
+
+    a, b = fq(0x00), fq(0x05)
+
+    p = 0x40000000000000000000000000000000224698fc094cf91b992d30ed00000001
+
+    C = (fq(0x1ca18c7c3fcb110f9e92c694ce552238f95e9f9b911599cedaff6018cfc5ed52), fq(0x3ad6133a791e41f3e062d370b40e97e77d20effc00b7ee88c4bb097d245cb438))
+    D = (fq(0x3e544e611bb895166afe1a46c6e551c47968daf962d824f79f795cb53585b098), fq(0x2fd03c4da47baf2dfd251e85d18864d4885ddd0e8df648550565b850b79349e3))
+    C_plus_D = (fq(0x06f822cbde350215558c46aac9e60eee31afd942ca6da568845ca4f8fe911e17), fq(0x3e294e73970abc197dfff1a14e74cb20c11b81422d9f920c7b0b0c63affdf67b))
+
+    result = add(C[0], C[1], D[0], D[1])
+    print(result)
+    print(list("%x" % x.n for x in result))
+    assert result[0] == C_plus_D[0]
+    assert result[1] == C_plus_D[1]

scripts/elliptic_curves/finite_fields

@@ -0,0 +1 @@
+../finite_fields/

scripts/halo/finite_fields

@@ -0,0 +1 @@
+../finite_fields/

scripts/halo/misc.py

@@ -1,6 +1,6 @@
 import random
 
-def sample_random(fp, seed):
+def sample_random(fp, seed=None):
     rnd = random.Random(seed)
     # Range of the field is 0 ... p - 1
     return fp(rnd.randint(0, fp.p - 1))

scripts/halo/pasta.py

@@ -1,5 +1,5 @@
 from finite_fields import finitefield
 
-p = 0x40000000000000000000000000000000224698fc094cf91b992d30ed00000001
-fp = finitefield.IntegersModP(p)
+q = 0x40000000000000000000000000000000224698fc094cf91b992d30ed00000001
+fq = finitefield.IntegersModP(q)
 

scripts/halo/test.py

@@ -1,6 +1,3 @@
-import sys
-sys.path.append("..")
-
 import random
 import misc
 import pasta
@@ -110,9 +107,9 @@ def setup(wires, gates_matrix):
     # The copy permuation applied to a, b, c
     # Returns the permuted index value (corresponding root of unity coset)
     # when evaluated on the domain.
-    ssigma_1 = PolyEvalRep(ROOT, permuted_domain_a)
-    ssigma_2 = PolyEvalRep(ROOT, permuted_domain_b)
-    ssigma_3 = PolyEvalRep(ROOT, permuted_domain_c)
+    ssigma_1 = PolyEvalRep(ROOTS, permuted_domain_a)
+    ssigma_2 = PolyEvalRep(ROOTS, permuted_domain_b)
+    ssigma_3 = PolyEvalRep(ROOTS, permuted_domain_c)
     copy_permutes = [ssigma_1, ssigma_2, ssigma_3]
 
 setup(wires, gates_matrix)

scripts/pasta/Cargo.toml

@@ -8,6 +8,7 @@ edition = "2018"
 pasta_curves = { path = "/home/narodnik/src/sw/zectings/pasta_curves" }
 ff = "0.9"
 group = "0.9"
+rand = "0.8.4"
 
 [[bin]]
 name = "pasta"

scripts/pasta/main.rs

@@ -1,14 +1,21 @@
 use pasta_curves as pasta;
 use group::{Group, Curve};
+use rand::rngs::OsRng;
 
 fn main() {
-    let a = pasta::vesta::Point::generator();
-    println!("a = {:?}", a.to_affine());
+    let g = pasta::vesta::Point::generator();
+    println!("G = {:?}", g.to_affine());
     let x = pasta::vesta::Scalar::from(87u64);
-    println!("x = {:?}", x);
-    let b = a * x;
-    println!("b = {:?}", b.to_affine());
+    println!("x = 87 = {:?}", x);
+    let b = g * x;
+    println!("B = xG = {:?}", b.to_affine());
 
     let y = x - pasta::vesta::Scalar::from(90u64);
-    println!("y = {:?}", y);
+    println!("y = x - 90 = {:?}", y);
+
+    let c = pasta::vesta::Point::random(&mut OsRng);
+    let d = pasta::vesta::Point::random(&mut OsRng);
+    println!("C = {:?}", c.to_affine());
+    println!("D = {:?}", d.to_affine());
+    println!("C + D = {:?}", (c + d).to_affine());
 }

src/bin/tutorial.rs

@@ -0,0 +1,87 @@
+// This tutorial example corresponds to the VM proof in proofs/tutorial.psm
+// It encodes the same function as the one in zk-explainer document.
+use bls12_381::Scalar;
+use drk::{BlsStringConversion, Decodable, Encodable, ZKContract, ZKProof};
+use std::fs::File;
+use std::time::Instant;
+
+type Result<T> = std::result::Result<T, failure::Error>;
+
+fn main() -> Result<()> {
+    {
+        // Load the contract from file
+
+        let start = Instant::now();
+        let file = File::open("tutorial.zcd")?;
+        let mut contract = ZKContract::decode(file)?;
+        println!(
+            "Loaded contract '{}': [{:?}]",
+            contract.name,
+            start.elapsed()
+        );
+
+        println!("Stats:");
+        println!("    Constants: {}", contract.vm.constants.len());
+        println!("    Alloc: {}", contract.vm.alloc.len());
+        println!("    Operations: {}", contract.vm.ops.len());
+        println!(
+            "    Constraint Instructions: {}",
+            contract.vm.constraints.len()
+        );
+
+        // Do the trusted setup
+
+        contract.setup("tutorial.zts")?;
+    }
+
+    // Load the contract from file
+
+    let start = Instant::now();
+    let file = File::open("tutorial.zcd")?;
+    let mut contract = ZKContract::decode(file)?;
+    println!(
+        "Loaded contract '{}': [{:?}]",
+        contract.name,
+        start.elapsed()
+    );
+
+    contract.load_setup("tutorial.zts")?;
+
+    {
+        // Put in our input parameters
+
+        contract.set_param(
+            "w",
+            Scalar::from_string("0000000000000000000000000000000000000000000000000000000000000001"),
+        )?;
+        contract.set_param(
+            "a",
+            Scalar::from_string("0000000000000000000000000000000000000000000000000000000000000001"),
+        )?;
+        contract.set_param(
+            "b",
+            Scalar::from_string("0000000000000000000000000000000000000000000000000000000000000004"),
+        )?;
+
+        // Generate the ZK proof
+
+        let proof = contract.prove()?;
+
+        // Test and show our output values
+
+        assert_eq!(proof.public.len(), 1);
+        println!("v = {:?}", proof.public.get("v").unwrap());
+
+        let mut file = File::create("tutorial.prf")?;
+        proof.encode(&mut file)?;
+    }
+
+    // Verify the proof
+
+    let file = File::open("tutorial.prf")?;
+    let proof = ZKProof::decode(file)?;
+    assert!(contract.verify(&proof));
+
+    Ok(())
+}
+