working jj mul

proofs/mint2.psm

@@ -271,27 +271,45 @@ constant G_VCV_v 0x466a7e3a82f67ab1d32294fd89774ad6bc3332d0fa1ccd18a77a81f50667c
     # Performs a scalar multiplication of this twisted Edwards
     # point by a scalar represented as a sequence of booleans
     # in little-endian bit order.
-    private {{p}}_currbase_0_u
-    set {{p}}_currbase_0_u {{u}}
-    private {{p}}_currbase_0_v
-    set {{p}}_currbase_0_v {{v}}
 
     {% for i in range(n) %}
-        {{ jubjub_conditionally_select(
-            p + "_this_base_" + i|string,
-            p + "_currbase_" + i|string + "_u",
-            p + "_currbase_" + i|string + "_v",
-            x + "_" + i|string
-        ) }}
+        {% if i == 0 %}
+            {{ jubjub_conditionally_select(
+                p + "_this_base_" + i|string,
+                u,
+                v,
+                x + "_" + i|string
+            ) }}
+
+            debug {{x + "_" + i|string}}
+            debug {{p + "_this_base_" + i|string}}_u
+            debug {{p + "_this_base_" + i|string}}_v
+        {% else %}
+            {{ jubjub_conditionally_select(
+                p + "_this_base_" + i|string,
+                p + "_currbase_" + i|string + "_u",
+                p + "_currbase_" + i|string + "_v",
+                x + "_" + i|string
+            ) }}
+
+            debug {{x + "_" + i|string}}
+            debug {{p + "_this_base_" + i|string}}_u
+            debug {{p + "_this_base_" + i|string}}_v
+        {% endif %}
 
         {% if i == 0 %}
+            # Do nothing on first round
+        {% elif i == 1 %}
             {{ jubjub_add(
-                p + "_result_" + (i + 1)|string,
-                p + "_this_base_" + i|string + "_u",
-                p + "_this_base_" + i|string + "_v",
-                u,
-                v
+                p + "_result_2",
+                p + "_this_base_1_u",
+                p + "_this_base_1_v",
+                p + "_this_base_0_u",
+                p + "_this_base_0_v"
             ) }}
+
+            debug {{p + "_result_" + (i + 1)|string}}_u
+            debug {{p + "_result_" + (i + 1)|string}}_v
         {% elif i == (n - 1) %}
             {{ jubjub_add(
                 p,
@@ -300,6 +318,9 @@ constant G_VCV_v 0x466a7e3a82f67ab1d32294fd89774ad6bc3332d0fa1ccd18a77a81f50667c
                 p + "_result_" + i|string + "_u",
                 p + "_result_" + i|string + "_v",
             ) }}
+
+            debug {{p}}_u
+            debug {{p}}_v
         {% else %}
             {{ jubjub_add(
                 p + "_result_" + (i + 1)|string,
@@ -308,13 +329,24 @@ constant G_VCV_v 0x466a7e3a82f67ab1d32294fd89774ad6bc3332d0fa1ccd18a77a81f50667c
                 p + "_result_" + i|string + "_u",
                 p + "_result_" + i|string + "_v",
             ) }}
+
+            debug {{p + "_result_" + (i + 1)|string}}_u
+            debug {{p + "_result_" + (i + 1)|string}}_v
         {% endif %}
 
-        {{ jubjub_double(
-            p + "_currbase_" + (i + 1)|string,
-            p + "_currbase_" + i|string + "_u",
-            p + "_currbase_" + i|string + "_v"
-        ) }}
+        {% if i == 0 %}
+            {{ jubjub_double(
+                p + "_currbase_" + (i + 1)|string,
+                u,
+                v
+            ) }}
+        {% else %}
+            {{ jubjub_double(
+                p + "_currbase_" + (i + 1)|string,
+                p + "_currbase_" + i|string + "_u",
+                p + "_currbase_" + i|string + "_v"
+            ) }}
+        {% endif %}
     {% endfor %}
 {% endmacro %}
 

scripts/pism.vim

@@ -15,7 +15,7 @@ endif
 syn keyword sapviKeyword constant contract start end constraint
 "syn keyword sapviAttr
 syn keyword sapviType FixedGenerator BlakePersonalization PedersenPersonalization ByteSize U64 Fr Point Bool Scalar BinarySize
-syn keyword sapviFunctionKeyword enforce lc0_add_one lc1_add_one lc2_add_one lc_coeff_reset lc_coeff_double lc0_sub_one lc1_sub_one lc2_sub_one
+syn keyword sapviFunctionKeyword enforce lc0_add_one lc1_add_one lc2_add_one lc_coeff_reset lc_coeff_double lc0_sub_one lc1_sub_one lc2_sub_one dump_alloc dump_local
 syn match sapviFunction "^[ ]*[a-z_0-9]* "
 syn match sapviComment "#.*$"
 syn match sapviNumber ' \zs\d\+\ze'

scripts/vm.py

@@ -20,6 +20,9 @@ op_commands = {
     "unpack_bits": 3,
     "load": 2,
     "local": 1,
+    "debug": 1,
+    "dump_alloc": 0,
+    "dump_local": 0,
 }
 
 constraint_commands = {

scripts/vm_export_rust.py

@@ -7,10 +7,23 @@ def to_initial_caps(snake_str):
 def display(contract):
     indent = " " * 4
 
-    print(r"""use super::vm::{ZKVirtualMachine, CryptoOperation, AllocType, ConstraintInstruction, VariableRef};
+    print(r"""use super::vm::{ZKVirtualMachine, CryptoOperation, AllocType, ConstraintInstruction, VariableIndex, VariableRef};
 use bls12_381::Scalar;
 
-pub fn load_zkvm() -> ZKVirtualMachine {
+pub fn load_params(params: Vec<Scalar>) -> Vec<(VariableIndex, Scalar)> {""")
+    params = [(symbol, var) for symbol, var in contract.alloc.items() if var.is_param]
+    print("%sassert_eq!(params.len(), %s);" % (indent, len(params)))
+    print("%slet mut result = vec![(0, Scalar::zero()); %s];" % (
+        indent, len(params)))
+    for i, (symbol, variable) in enumerate(params):
+        assert variable.is_param
+        print("%s// %s" % (indent, symbol))
+        print("%sresult[%s] = (%s, params[%s]);" % (
+            indent, i, variable.index, i))
+    print("%sresult" % indent)
+    print("}\n")
+
+    print(r"""pub fn load_zkvm() -> ZKVirtualMachine {
     ZKVirtualMachine {
         constants: vec![""")
 
@@ -65,6 +78,10 @@ pub fn load_zkvm() -> ZKVirtualMachine {
         if op.command == "load":
             assert len(op.args) == 2
             args_part = "(%s, %s)" % (var_ref_str(op.args[0]), op.args[1].index)
+        elif op.command == "debug":
+            assert len(op.args) == 1
+            args_part = '(String::from("%s"), %s)' % (
+                op.line, var_ref_str(op.args[0]))
         elif op.args:
             args_part = ", ".join(var_ref_str(var_ref) for var_ref in op.args)
             args_part = "(%s)" % args_part

src/mint2.rs

@@ -4,22 +4,26 @@ use group::{Curve, Group, GroupEncoding};
 
 mod mint2_contract;
 mod vm;
-use mint2_contract::load_zkvm;
+use mint2_contract::{load_params, load_zkvm};
 
 fn unpack<F: PrimeField>(value: F) -> Vec<Scalar> {
     let mut bits = Vec::new();
+    print!("Unpack: ");
     for (i, bit) in value.to_le_bits().into_iter().cloned().enumerate() {
         match bit {
             true => bits.push(Scalar::one()),
             false => bits.push(Scalar::zero()),
         }
+        print!("{}", if bit { 1 } else { 0 });
     }
+    println!("");
     bits
 }
 
 fn do_vcr_test(value: &jubjub::Fr) {
     let mut curbase = zcash_primitives::constants::VALUE_COMMITMENT_RANDOMNESS_GENERATOR;
-    let mut result = curbase.clone();
+    let mut result = jubjub::SubgroupPoint::identity();
+    //let value = jubjub::Fr::from(7);
     for (i, bit) in value.to_le_bits().into_iter().cloned().enumerate() {
         let thisbase = if bit {
             curbase.clone()
@@ -28,12 +32,14 @@ fn do_vcr_test(value: &jubjub::Fr) {
         };
         result += thisbase;
         curbase = curbase.double();
+        print!("{}", if bit { 1} else { 0 });
     }
+    println!("");
     let result = jubjub::ExtendedPoint::from(result).to_affine();
     println!("cvr1: {:?}", result);
     let randomness_commit =
         zcash_primitives::constants::VALUE_COMMITMENT_RANDOMNESS_GENERATOR * value;
-    let randomness_commit = jubjub::ExtendedPoint::from(result).to_affine();
+    let randomness_commit = jubjub::ExtendedPoint::from(randomness_commit).to_affine();
     println!("cvr2: {:?}", randomness_commit);
 }
 
@@ -44,6 +50,7 @@ fn main() -> std::result::Result<(), vm::ZKVMError> {
 
     let value = 110;
     let randomness_value: jubjub::Fr = jubjub::Fr::random(&mut OsRng);
+    //let randomness_value = jubjub::Fr::from(7);
     let value_commit = (zcash_primitives::constants::VALUE_COMMITMENT_VALUE_GENERATOR
         * jubjub::Fr::from(value))
         + (zcash_primitives::constants::VALUE_COMMITMENT_RANDOMNESS_GENERATOR * randomness_value);
@@ -59,13 +66,13 @@ fn main() -> std::result::Result<(), vm::ZKVMError> {
     vm.setup();
 
     let mut params = vec![
-        (0, public_affine.get_u()),
-        (1, public_affine.get_v()),
-        //(2, randomness_value),
+        public_affine.get_u(),
+        public_affine.get_v(),
     ];
     for x in unpack(randomness_value) {
-        params.push((params.len(), x));
+        params.push(x);
     }
+    let params = load_params(params);
     println!("Size of params: {}", params.len());
     vm.initialize(&params)?;
 

src/vm.rs

@@ -23,7 +23,7 @@ pub struct ZKVirtualMachine {
     pub constants: Vec<Scalar>,
 }
 
-type VariableIndex = usize;
+pub type VariableIndex = usize;
 
 pub enum VariableRef {
     Aux(VariableIndex),
@@ -42,6 +42,9 @@ pub enum CryptoOperation {
     Invert(VariableRef),
     UnpackBits(VariableRef, VariableRef, VariableRef),
     Local,
+    Debug(String, VariableRef),
+    DumpAlloc,
+    DumpLocal,
 }
 
 #[derive(Clone)]
@@ -232,6 +235,32 @@ impl ZKVirtualMachine {
                 CryptoOperation::Local => {
                     local_stack.push(Scalar::zero());
                 }
+                CryptoOperation::Debug(debug_str, self_) => {
+                    let self_ = match self_ {
+                        VariableRef::Aux(index) => &mut self.aux[*index],
+                        VariableRef::Local(index) => &mut local_stack[*index],
+                    };
+                    println!("{}", debug_str);
+                    println!("value = {:?}", self_);
+                }
+                CryptoOperation::DumpAlloc => {
+                    println!("-------------------");
+                    println!("alloc");
+                    println!("-------------------");
+                    for (i, value) in self.aux.iter().enumerate() {
+                        println!("{}: {:?}", i, value);
+                    }
+                    println!("-------------------");
+                }
+                CryptoOperation::DumpLocal => {
+                    println!("-------------------");
+                    println!("local");
+                    println!("-------------------");
+                    for (i, value) in local_stack.iter().enumerate() {
+                        println!("{}: {:?}", i, value);
+                    }
+                    println!("-------------------");
+                }
             }
         }