darkfi/proofs/jubjub.psm

constant a 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000000
constant d 0x2a9318e74bfa2b48f5fd9207e6bd7fd4292d7f6d37579d2601065fd6d6343eb1
constant one 0x0000000000000000000000000000000000000000000000000000000000000001

{% macro jubjub_add(P, x1, y1, x2, y2) -%}
    # Compute U = (x1 + y1) * (y2 - EDWARDS_A*x2)
    #           = (x1 + y1) * (x2 + y2)
    private {{P}}_U
    set {{P}}_U {{ x1 }}
    add {{P}}_U {{ y1 }}
    local {{P}}_tmp
    set {{P}}_tmp {{ x2 }}
    add {{P}}_tmp {{ y2 }}
    mul {{P}}_U {{P}}_tmp

    # assert (x1 + y1) * (x2 + y2) == U
    lc0_add {{ x1 }}
    lc0_add {{ y1 }}
    lc1_add {{ x2 }}
    lc1_add {{ y2 }}
    lc2_add {{P}}_U
    enforce

    # Compute A = y2 * x1
    private {{P}}_A
    set {{P}}_A {{ y2 }}
    mul {{P}}_A {{ x1 }}
    # Compute B = x2 * y1
    private {{P}}_B
    set {{P}}_B {{ x2 }}
    mul {{P}}_B {{ y1 }}
    # Compute C = d*A*B
    private {{P}}_C
    load {{P}}_C d
    mul {{P}}_C {{P}}_A
    mul {{P}}_C {{P}}_B

    # assert (d * A) * (B) == C
    lc0_add_coeff d {{P}}_A
    lc1_add {{P}}_B
    lc2_add {{P}}_C
    enforce

    # Compute P.x = (A + B) / (1 + C)
    private {{P}}_x
    set {{P}}_x {{P}}_A
    add {{P}}_x {{P}}_B
    local {{P}}_x_denom
    load {{P}}_x_denom one
    add {{P}}_x_denom {{P}}_C
    divide {{P}}_x {{P}}_x_denom

    lc0_add_one
    lc0_add {{P}}_C
    lc1_add {{P}}_x
    lc2_add {{P}}_A
    lc2_add {{P}}_B
    enforce

    # Compute P.y = (U - A - B) / (1 - C)
    private {{P}}_y
    set {{P}}_y {{P}}_U
    sub {{P}}_y {{P}}_A
    sub {{P}}_y {{P}}_B
    local {{P}}_y_denom
    load {{P}}_y_denom one
    sub {{P}}_y_denom {{P}}_C
    divide {{P}}_y {{P}}_y_denom

    lc0_add_one
    lc0_sub {{P}}_C
    lc1_add {{P}}_y
    lc2_add {{P}}_U
    lc2_sub {{P}}_A
    lc2_sub {{P}}_B
    enforce
{%- endmacro %}

contract input_spend
    param x1
    param y1

    param x2
    param y2

    {{ jubjub_add("P", "x1", "y1", "x2", "y2") }}

    public x3
    set x3 P_x
    public y3
    set y3 P_y

    lc0_add x3
    lc1_add_one
    lc2_add P_x
    enforce

    lc0_add y3
    lc1_add_one
    lc2_add P_y
    enforce
end