darkfi/script/research/rln/rlnv2/signal.zk

k = 13;
field = "pallas";

constant "RlnSignal" {}

witness "RlnSignal" {
    Base identity_nullifier,
    Base identity_trapdoor,

    MerklePath identity_path,
    Uint32 identity_leaf_pos,

    Base x, # The message hash
    Base message_id,
    Base message_limit,

    # These are public
    Base epoch,
    Base rln_identifier,
}

circuit "RlnSignal" {
    constrain_instance(message_limit);
    constrain_instance(epoch);

    external_nullifier = poseidon_hash(epoch, rln_identifier);
    constrain_instance(external_nullifier);

    a_0 = poseidon_hash(identity_nullifier, identity_trapdoor);
    a_1 = poseidon_hash(a_0, external_nullifier, message_id);

    internal_nullifier = poseidon_hash(a_1);
    constrain_instance(internal_nullifier);

    # y = a_0 + x * a_1
    x_a_1 = base_mul(x, a_1);
    y = base_add(a_0, x_a_1);
    constrain_instance(x);
    constrain_instance(y);

    identity_commitment = poseidon_hash(a_0);
    root = merkle_root(identity_leaf_pos, identity_path, identity_commitment);
    constrain_instance(root);
}