mirror of
https://github.com/socathie/zkPuzzles.git
synced 2026-01-10 06:18:03 -05:00
Using PLONK instead of groth16
This commit is contained in:
Cathie So
@@ -1,255 +1,645 @@
|
||||
//
|
||||
// Copyright 2017 Christian Reitwiessner
|
||||
// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
|
||||
// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
|
||||
// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
||||
//
|
||||
// 2019 OKIMS
|
||||
// ported to solidity 0.6
|
||||
// fixed linter warnings
|
||||
// added requiere error messages
|
||||
//
|
||||
//
|
||||
// SPDX-License-Identifier: GPL-3.0
|
||||
pragma solidity ^0.8.4;
|
||||
library Pairing {
|
||||
struct G1Point {
|
||||
uint X;
|
||||
uint Y;
|
||||
}
|
||||
// Encoding of field elements is: X[0] * z + X[1]
|
||||
struct G2Point {
|
||||
uint[2] X;
|
||||
uint[2] Y;
|
||||
}
|
||||
/// @return the generator of G1
|
||||
function P1() internal pure returns (G1Point memory) {
|
||||
return G1Point(1, 2);
|
||||
}
|
||||
/// @return the generator of G2
|
||||
function P2() internal pure returns (G2Point memory) {
|
||||
// Original code point
|
||||
return G2Point(
|
||||
[11559732032986387107991004021392285783925812861821192530917403151452391805634,
|
||||
10857046999023057135944570762232829481370756359578518086990519993285655852781],
|
||||
[4082367875863433681332203403145435568316851327593401208105741076214120093531,
|
||||
8495653923123431417604973247489272438418190587263600148770280649306958101930]
|
||||
);
|
||||
|
||||
/*
|
||||
// Changed by Jordi point
|
||||
return G2Point(
|
||||
[10857046999023057135944570762232829481370756359578518086990519993285655852781,
|
||||
11559732032986387107991004021392285783925812861821192530917403151452391805634],
|
||||
[8495653923123431417604973247489272438418190587263600148770280649306958101930,
|
||||
4082367875863433681332203403145435568316851327593401208105741076214120093531]
|
||||
);
|
||||
*/
|
||||
}
|
||||
/// @return r the negation of p, i.e. p.addition(p.negate()) should be zero.
|
||||
function negate(G1Point memory p) internal pure returns (G1Point memory r) {
|
||||
// The prime q in the base field F_q for G1
|
||||
uint q = 21888242871839275222246405745257275088696311157297823662689037894645226208583;
|
||||
if (p.X == 0 && p.Y == 0)
|
||||
return G1Point(0, 0);
|
||||
return G1Point(p.X, q - (p.Y % q));
|
||||
}
|
||||
/// @return r the sum of two points of G1
|
||||
function addition(G1Point memory p1, G1Point memory p2) internal view returns (G1Point memory r) {
|
||||
uint[4] memory input;
|
||||
input[0] = p1.X;
|
||||
input[1] = p1.Y;
|
||||
input[2] = p2.X;
|
||||
input[3] = p2.Y;
|
||||
bool success;
|
||||
// solium-disable-next-line security/no-inline-assembly
|
||||
assembly {
|
||||
success := staticcall(sub(gas(), 2000), 6, input, 0xc0, r, 0x60)
|
||||
// Use "invalid" to make gas estimation work
|
||||
switch success case 0 { invalid() }
|
||||
}
|
||||
require(success,"pairing-add-failed");
|
||||
}
|
||||
/// @return r the product of a point on G1 and a scalar, i.e.
|
||||
/// p == p.scalar_mul(1) and p.addition(p) == p.scalar_mul(2) for all points p.
|
||||
function scalar_mul(G1Point memory p, uint s) internal view returns (G1Point memory r) {
|
||||
uint[3] memory input;
|
||||
input[0] = p.X;
|
||||
input[1] = p.Y;
|
||||
input[2] = s;
|
||||
bool success;
|
||||
// solium-disable-next-line security/no-inline-assembly
|
||||
assembly {
|
||||
success := staticcall(sub(gas(), 2000), 7, input, 0x80, r, 0x60)
|
||||
// Use "invalid" to make gas estimation work
|
||||
switch success case 0 { invalid() }
|
||||
}
|
||||
require (success,"pairing-mul-failed");
|
||||
}
|
||||
/// @return the result of computing the pairing check
|
||||
/// e(p1[0], p2[0]) * .... * e(p1[n], p2[n]) == 1
|
||||
/// For example pairing([P1(), P1().negate()], [P2(), P2()]) should
|
||||
/// return true.
|
||||
function pairing(G1Point[] memory p1, G2Point[] memory p2) internal view returns (bool) {
|
||||
require(p1.length == p2.length,"pairing-lengths-failed");
|
||||
uint elements = p1.length;
|
||||
uint inputSize = elements * 6;
|
||||
uint[] memory input = new uint[](inputSize);
|
||||
for (uint i = 0; i < elements; i++)
|
||||
{
|
||||
input[i * 6 + 0] = p1[i].X;
|
||||
input[i * 6 + 1] = p1[i].Y;
|
||||
input[i * 6 + 2] = p2[i].X[0];
|
||||
input[i * 6 + 3] = p2[i].X[1];
|
||||
input[i * 6 + 4] = p2[i].Y[0];
|
||||
input[i * 6 + 5] = p2[i].Y[1];
|
||||
}
|
||||
uint[1] memory out;
|
||||
bool success;
|
||||
// solium-disable-next-line security/no-inline-assembly
|
||||
assembly {
|
||||
success := staticcall(sub(gas(), 2000), 8, add(input, 0x20), mul(inputSize, 0x20), out, 0x20)
|
||||
// Use "invalid" to make gas estimation work
|
||||
switch success case 0 { invalid() }
|
||||
}
|
||||
require(success,"pairing-opcode-failed");
|
||||
return out[0] != 0;
|
||||
}
|
||||
/// Convenience method for a pairing check for two pairs.
|
||||
function pairingProd2(G1Point memory a1, G2Point memory a2, G1Point memory b1, G2Point memory b2) internal view returns (bool) {
|
||||
G1Point[] memory p1 = new G1Point[](2);
|
||||
G2Point[] memory p2 = new G2Point[](2);
|
||||
p1[0] = a1;
|
||||
p1[1] = b1;
|
||||
p2[0] = a2;
|
||||
p2[1] = b2;
|
||||
return pairing(p1, p2);
|
||||
}
|
||||
/// Convenience method for a pairing check for three pairs.
|
||||
function pairingProd3(
|
||||
G1Point memory a1, G2Point memory a2,
|
||||
G1Point memory b1, G2Point memory b2,
|
||||
G1Point memory c1, G2Point memory c2
|
||||
) internal view returns (bool) {
|
||||
G1Point[] memory p1 = new G1Point[](3);
|
||||
G2Point[] memory p2 = new G2Point[](3);
|
||||
p1[0] = a1;
|
||||
p1[1] = b1;
|
||||
p1[2] = c1;
|
||||
p2[0] = a2;
|
||||
p2[1] = b2;
|
||||
p2[2] = c2;
|
||||
return pairing(p1, p2);
|
||||
}
|
||||
/// Convenience method for a pairing check for four pairs.
|
||||
function pairingProd4(
|
||||
G1Point memory a1, G2Point memory a2,
|
||||
G1Point memory b1, G2Point memory b2,
|
||||
G1Point memory c1, G2Point memory c2,
|
||||
G1Point memory d1, G2Point memory d2
|
||||
) internal view returns (bool) {
|
||||
G1Point[] memory p1 = new G1Point[](4);
|
||||
G2Point[] memory p2 = new G2Point[](4);
|
||||
p1[0] = a1;
|
||||
p1[1] = b1;
|
||||
p1[2] = c1;
|
||||
p1[3] = d1;
|
||||
p2[0] = a2;
|
||||
p2[1] = b2;
|
||||
p2[2] = c2;
|
||||
p2[3] = d2;
|
||||
return pairing(p1, p2);
|
||||
}
|
||||
}
|
||||
contract Verifier {
|
||||
using Pairing for *;
|
||||
struct VerifyingKey {
|
||||
Pairing.G1Point alfa1;
|
||||
Pairing.G2Point beta2;
|
||||
Pairing.G2Point gamma2;
|
||||
Pairing.G2Point delta2;
|
||||
Pairing.G1Point[] IC;
|
||||
}
|
||||
struct Proof {
|
||||
Pairing.G1Point A;
|
||||
Pairing.G2Point B;
|
||||
Pairing.G1Point C;
|
||||
}
|
||||
function verifyingKey() internal pure returns (VerifyingKey memory vk) {
|
||||
vk.alfa1 = Pairing.G1Point(
|
||||
20491192805390485299153009773594534940189261866228447918068658471970481763042,
|
||||
9383485363053290200918347156157836566562967994039712273449902621266178545958
|
||||
);
|
||||
Copyright 2021 0KIMS association.
|
||||
|
||||
vk.beta2 = Pairing.G2Point(
|
||||
[4252822878758300859123897981450591353533073413197771768651442665752259397132,
|
||||
6375614351688725206403948262868962793625744043794305715222011528459656738731],
|
||||
[21847035105528745403288232691147584728191162732299865338377159692350059136679,
|
||||
10505242626370262277552901082094356697409835680220590971873171140371331206856]
|
||||
);
|
||||
vk.gamma2 = Pairing.G2Point(
|
||||
[11559732032986387107991004021392285783925812861821192530917403151452391805634,
|
||||
10857046999023057135944570762232829481370756359578518086990519993285655852781],
|
||||
[4082367875863433681332203403145435568316851327593401208105741076214120093531,
|
||||
8495653923123431417604973247489272438418190587263600148770280649306958101930]
|
||||
);
|
||||
vk.delta2 = Pairing.G2Point(
|
||||
[10515086783844107152789961699805167402839445155551290866755378361779597206636,
|
||||
20478456925122158080847030251895987938966516050421151623379311617589944939390],
|
||||
[5059157857734773241138674055892559481347493446864703000034272295347021788281,
|
||||
14375011299792210542379807625683890344610459290324370915641446570290648004409]
|
||||
);
|
||||
vk.IC = new Pairing.G1Point[](2);
|
||||
|
||||
vk.IC[0] = Pairing.G1Point(
|
||||
19246401383474815178724831592580205870572552563426897177365900472878611385139,
|
||||
15806836004560695814718000473351994090404873219496981471859448532750920040149
|
||||
);
|
||||
|
||||
vk.IC[1] = Pairing.G1Point(
|
||||
12657598428614834242888308785597800310795156498501122220767637608477504884849,
|
||||
19622962299416559836650067051023594316951893502423743678057735721709394897276
|
||||
);
|
||||
|
||||
}
|
||||
function verify(uint[] memory input, Proof memory proof) internal view returns (uint) {
|
||||
uint256 snark_scalar_field = 21888242871839275222246405745257275088548364400416034343698204186575808495617;
|
||||
VerifyingKey memory vk = verifyingKey();
|
||||
require(input.length + 1 == vk.IC.length,"verifier-bad-input");
|
||||
// Compute the linear combination vk_x
|
||||
Pairing.G1Point memory vk_x = Pairing.G1Point(0, 0);
|
||||
for (uint i = 0; i < input.length; i++) {
|
||||
require(input[i] < snark_scalar_field,"verifier-gte-snark-scalar-field");
|
||||
vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[i + 1], input[i]));
|
||||
}
|
||||
vk_x = Pairing.addition(vk_x, vk.IC[0]);
|
||||
if (!Pairing.pairingProd4(
|
||||
Pairing.negate(proof.A), proof.B,
|
||||
vk.alfa1, vk.beta2,
|
||||
vk_x, vk.gamma2,
|
||||
proof.C, vk.delta2
|
||||
)) return 1;
|
||||
return 0;
|
||||
}
|
||||
/// @return r bool true if proof is valid
|
||||
function verifyProof(
|
||||
uint[2] memory a,
|
||||
uint[2][2] memory b,
|
||||
uint[2] memory c,
|
||||
uint[1] memory input
|
||||
) public view returns (bool r) {
|
||||
Proof memory proof;
|
||||
proof.A = Pairing.G1Point(a[0], a[1]);
|
||||
proof.B = Pairing.G2Point([b[0][0], b[0][1]], [b[1][0], b[1][1]]);
|
||||
proof.C = Pairing.G1Point(c[0], c[1]);
|
||||
uint[] memory inputValues = new uint[](input.length);
|
||||
for(uint i = 0; i < input.length; i++){
|
||||
inputValues[i] = input[i];
|
||||
}
|
||||
if (verify(inputValues, proof) == 0) {
|
||||
return true;
|
||||
} else {
|
||||
return false;
|
||||
This file is generated with [snarkJS](https://github.com/iden3/snarkjs).
|
||||
|
||||
snarkJS is a free software: you can redistribute it and/or modify it
|
||||
under the terms of the GNU General Public License as published by
|
||||
the Free Software Foundation, either version 3 of the License, or
|
||||
(at your option) any later version.
|
||||
|
||||
snarkJS is distributed in the hope that it will be useful, but WITHOUT
|
||||
ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
|
||||
License for more details.
|
||||
|
||||
You should have received a copy of the GNU General Public License
|
||||
along with snarkJS. If not, see <https://www.gnu.org/licenses/>.
|
||||
*/
|
||||
|
||||
|
||||
pragma solidity >=0.7.0 <0.9.0;
|
||||
|
||||
contract PlonkVerifier {
|
||||
|
||||
uint32 constant n = 65536;
|
||||
uint16 constant nPublic = 1;
|
||||
uint16 constant nLagrange = 1;
|
||||
|
||||
uint256 constant Qmx = 21694065396366825494676569912265797173487619932367489583081899571228065723046;
|
||||
uint256 constant Qmy = 1644668406327607184693200938208150149215440684012776234506472995749714247220;
|
||||
uint256 constant Qlx = 6769196961025164888912987639479433665570651390580227093114742621165692582299;
|
||||
uint256 constant Qly = 17327372988678857382114932577216853482155565139131344335618174604364704934173;
|
||||
uint256 constant Qrx = 2804903490699965371561089191756679828426590559435478532778470344385119607508;
|
||||
uint256 constant Qry = 199438971351663586070846988840866276060861972923262796800402646067914305804;
|
||||
uint256 constant Qox = 12282894368599654927032160807645531369701057604480363218879088833198738318624;
|
||||
uint256 constant Qoy = 14903218966306233858420961186182550819946466768935148731443614262235250389041;
|
||||
uint256 constant Qcx = 8653843628513979934855560047181054051058701167538329889864311485705823117536;
|
||||
uint256 constant Qcy = 5868879518548724988606792245617812245326636316651182080558590677467671779639;
|
||||
uint256 constant S1x = 2642155308065495050668113280820919782224553840978069087151322762828998492213;
|
||||
uint256 constant S1y = 4156140296643377244319071485463868060212666851409195391561240323926083829140;
|
||||
uint256 constant S2x = 7456219571388268040490774122605485034807336381865056600892949359490263638390;
|
||||
uint256 constant S2y = 20998360971654049922200103522337066971321790791517407752305805924318590245402;
|
||||
uint256 constant S3x = 11731563971917324805225071072967467291467149386043267891630916707768495475424;
|
||||
uint256 constant S3y = 10229166041508213546514180382250762328214099404498845246643192512897813503265;
|
||||
uint256 constant k1 = 2;
|
||||
uint256 constant k2 = 3;
|
||||
uint256 constant X2x1 = 21831381940315734285607113342023901060522397560371972897001948545212302161822;
|
||||
uint256 constant X2x2 = 17231025384763736816414546592865244497437017442647097510447326538965263639101;
|
||||
uint256 constant X2y1 = 2388026358213174446665280700919698872609886601280537296205114254867301080648;
|
||||
uint256 constant X2y2 = 11507326595632554467052522095592665270651932854513688777769618397986436103170;
|
||||
|
||||
uint256 constant q = 21888242871839275222246405745257275088548364400416034343698204186575808495617;
|
||||
uint256 constant qf = 21888242871839275222246405745257275088696311157297823662689037894645226208583;
|
||||
uint256 constant w1 = 421743594562400382753388642386256516545992082196004333756405989743524594615;
|
||||
|
||||
uint256 constant G1x = 1;
|
||||
uint256 constant G1y = 2;
|
||||
uint256 constant G2x1 = 10857046999023057135944570762232829481370756359578518086990519993285655852781;
|
||||
uint256 constant G2x2 = 11559732032986387107991004021392285783925812861821192530917403151452391805634;
|
||||
uint256 constant G2y1 = 8495653923123431417604973247489272438418190587263600148770280649306958101930;
|
||||
uint256 constant G2y2 = 4082367875863433681332203403145435568316851327593401208105741076214120093531;
|
||||
uint16 constant pA = 32;
|
||||
uint16 constant pB = 96;
|
||||
uint16 constant pC = 160;
|
||||
uint16 constant pZ = 224;
|
||||
uint16 constant pT1 = 288;
|
||||
uint16 constant pT2 = 352;
|
||||
uint16 constant pT3 = 416;
|
||||
uint16 constant pWxi = 480;
|
||||
uint16 constant pWxiw = 544;
|
||||
uint16 constant pEval_a = 608;
|
||||
uint16 constant pEval_b = 640;
|
||||
uint16 constant pEval_c = 672;
|
||||
uint16 constant pEval_s1 = 704;
|
||||
uint16 constant pEval_s2 = 736;
|
||||
uint16 constant pEval_zw = 768;
|
||||
uint16 constant pEval_r = 800;
|
||||
|
||||
uint16 constant pAlpha = 0;
|
||||
uint16 constant pBeta = 32;
|
||||
uint16 constant pGamma = 64;
|
||||
uint16 constant pXi = 96;
|
||||
uint16 constant pXin = 128;
|
||||
uint16 constant pBetaXi = 160;
|
||||
uint16 constant pV1 = 192;
|
||||
uint16 constant pV2 = 224;
|
||||
uint16 constant pV3 = 256;
|
||||
uint16 constant pV4 = 288;
|
||||
uint16 constant pV5 = 320;
|
||||
uint16 constant pV6 = 352;
|
||||
uint16 constant pU = 384;
|
||||
uint16 constant pPl = 416;
|
||||
uint16 constant pEval_t = 448;
|
||||
uint16 constant pA1 = 480;
|
||||
uint16 constant pB1 = 544;
|
||||
uint16 constant pZh = 608;
|
||||
uint16 constant pZhInv = 640;
|
||||
|
||||
uint16 constant pEval_l1 = 672;
|
||||
|
||||
|
||||
|
||||
uint16 constant lastMem = 704;
|
||||
|
||||
|
||||
function verifyProof(bytes memory proof, uint[] memory pubSignals) public view returns (bool) {
|
||||
assembly {
|
||||
/////////
|
||||
// Computes the inverse using the extended euclidean algorithm
|
||||
/////////
|
||||
function inverse(a, q) -> inv {
|
||||
let t := 0
|
||||
let newt := 1
|
||||
let r := q
|
||||
let newr := a
|
||||
let quotient
|
||||
let aux
|
||||
|
||||
for { } newr { } {
|
||||
quotient := sdiv(r, newr)
|
||||
aux := sub(t, mul(quotient, newt))
|
||||
t:= newt
|
||||
newt:= aux
|
||||
|
||||
aux := sub(r,mul(quotient, newr))
|
||||
r := newr
|
||||
newr := aux
|
||||
}
|
||||
|
||||
if gt(r, 1) { revert(0,0) }
|
||||
if slt(t, 0) { t:= add(t, q) }
|
||||
|
||||
inv := t
|
||||
}
|
||||
|
||||
///////
|
||||
// Computes the inverse of an array of values
|
||||
// See https://vitalik.ca/general/2018/07/21/starks_part_3.html in section where explain fields operations
|
||||
//////
|
||||
function inverseArray(pVals, n) {
|
||||
|
||||
let pAux := mload(0x40) // Point to the next free position
|
||||
let pIn := pVals
|
||||
let lastPIn := add(pVals, mul(n, 32)) // Read n elemnts
|
||||
let acc := mload(pIn) // Read the first element
|
||||
pIn := add(pIn, 32) // Point to the second element
|
||||
let inv
|
||||
|
||||
|
||||
for { } lt(pIn, lastPIn) {
|
||||
pAux := add(pAux, 32)
|
||||
pIn := add(pIn, 32)
|
||||
}
|
||||
{
|
||||
mstore(pAux, acc)
|
||||
acc := mulmod(acc, mload(pIn), q)
|
||||
}
|
||||
acc := inverse(acc, q)
|
||||
|
||||
// At this point pAux pint to the next free position we substract 1 to point to the last used
|
||||
pAux := sub(pAux, 32)
|
||||
// pIn points to the n+1 element, we substract to point to n
|
||||
pIn := sub(pIn, 32)
|
||||
lastPIn := pVals // We don't process the first element
|
||||
for { } gt(pIn, lastPIn) {
|
||||
pAux := sub(pAux, 32)
|
||||
pIn := sub(pIn, 32)
|
||||
}
|
||||
{
|
||||
inv := mulmod(acc, mload(pAux), q)
|
||||
acc := mulmod(acc, mload(pIn), q)
|
||||
mstore(pIn, inv)
|
||||
}
|
||||
// pIn points to first element, we just set it.
|
||||
mstore(pIn, acc)
|
||||
}
|
||||
|
||||
function checkField(v) {
|
||||
if iszero(lt(v, q)) {
|
||||
mstore(0, 0)
|
||||
return(0,0x20)
|
||||
}
|
||||
}
|
||||
|
||||
function checkInput(pProof) {
|
||||
if iszero(eq(mload(pProof), 800 )) {
|
||||
mstore(0, 0)
|
||||
return(0,0x20)
|
||||
}
|
||||
checkField(mload(add(pProof, pEval_a)))
|
||||
checkField(mload(add(pProof, pEval_b)))
|
||||
checkField(mload(add(pProof, pEval_c)))
|
||||
checkField(mload(add(pProof, pEval_s1)))
|
||||
checkField(mload(add(pProof, pEval_s2)))
|
||||
checkField(mload(add(pProof, pEval_zw)))
|
||||
checkField(mload(add(pProof, pEval_r)))
|
||||
|
||||
// Points are checked in the point operations precompiled smart contracts
|
||||
}
|
||||
|
||||
function calculateChallanges(pProof, pMem) {
|
||||
|
||||
let a
|
||||
let b
|
||||
|
||||
b := mod(keccak256(add(pProof, pA), 192), q)
|
||||
mstore( add(pMem, pBeta), b)
|
||||
mstore( add(pMem, pGamma), mod(keccak256(add(pMem, pBeta), 32), q))
|
||||
mstore( add(pMem, pAlpha), mod(keccak256(add(pProof, pZ), 64), q))
|
||||
|
||||
a := mod(keccak256(add(pProof, pT1), 192), q)
|
||||
mstore( add(pMem, pXi), a)
|
||||
mstore( add(pMem, pBetaXi), mulmod(b, a, q))
|
||||
|
||||
a:= mulmod(a, a, q)
|
||||
|
||||
a:= mulmod(a, a, q)
|
||||
|
||||
a:= mulmod(a, a, q)
|
||||
|
||||
a:= mulmod(a, a, q)
|
||||
|
||||
a:= mulmod(a, a, q)
|
||||
|
||||
a:= mulmod(a, a, q)
|
||||
|
||||
a:= mulmod(a, a, q)
|
||||
|
||||
a:= mulmod(a, a, q)
|
||||
|
||||
a:= mulmod(a, a, q)
|
||||
|
||||
a:= mulmod(a, a, q)
|
||||
|
||||
a:= mulmod(a, a, q)
|
||||
|
||||
a:= mulmod(a, a, q)
|
||||
|
||||
a:= mulmod(a, a, q)
|
||||
|
||||
a:= mulmod(a, a, q)
|
||||
|
||||
a:= mulmod(a, a, q)
|
||||
|
||||
a:= mulmod(a, a, q)
|
||||
|
||||
mstore( add(pMem, pXin), a)
|
||||
a:= mod(add(sub(a, 1),q), q)
|
||||
mstore( add(pMem, pZh), a)
|
||||
mstore( add(pMem, pZhInv), a) // We will invert later together with lagrange pols
|
||||
|
||||
let v1 := mod(keccak256(add(pProof, pEval_a), 224), q)
|
||||
mstore( add(pMem, pV1), v1)
|
||||
a := mulmod(v1, v1, q)
|
||||
mstore( add(pMem, pV2), a)
|
||||
a := mulmod(a, v1, q)
|
||||
mstore( add(pMem, pV3), a)
|
||||
a := mulmod(a, v1, q)
|
||||
mstore( add(pMem, pV4), a)
|
||||
a := mulmod(a, v1, q)
|
||||
mstore( add(pMem, pV5), a)
|
||||
a := mulmod(a, v1, q)
|
||||
mstore( add(pMem, pV6), a)
|
||||
|
||||
mstore( add(pMem, pU), mod(keccak256(add(pProof, pWxi), 128), q))
|
||||
}
|
||||
|
||||
function calculateLagrange(pMem) {
|
||||
|
||||
let w := 1
|
||||
|
||||
mstore(
|
||||
add(pMem, pEval_l1),
|
||||
mulmod(
|
||||
n,
|
||||
mod(
|
||||
add(
|
||||
sub(
|
||||
mload(add(pMem, pXi)),
|
||||
w
|
||||
),
|
||||
q
|
||||
),
|
||||
q
|
||||
),
|
||||
q
|
||||
)
|
||||
)
|
||||
|
||||
|
||||
|
||||
inverseArray(add(pMem, pZhInv), 2 )
|
||||
|
||||
let zh := mload(add(pMem, pZh))
|
||||
w := 1
|
||||
|
||||
|
||||
mstore(
|
||||
add(pMem, pEval_l1 ),
|
||||
mulmod(
|
||||
mload(add(pMem, pEval_l1 )),
|
||||
zh,
|
||||
q
|
||||
)
|
||||
)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
}
|
||||
|
||||
function calculatePl(pMem, pPub) {
|
||||
let pl := 0
|
||||
|
||||
|
||||
pl := mod(
|
||||
add(
|
||||
sub(
|
||||
pl,
|
||||
mulmod(
|
||||
mload(add(pMem, pEval_l1)),
|
||||
mload(add(pPub, 32)),
|
||||
q
|
||||
)
|
||||
),
|
||||
q
|
||||
),
|
||||
q
|
||||
)
|
||||
|
||||
|
||||
mstore(add(pMem, pPl), pl)
|
||||
|
||||
|
||||
}
|
||||
|
||||
function calculateT(pProof, pMem) {
|
||||
let t
|
||||
let t1
|
||||
let t2
|
||||
t := addmod(
|
||||
mload(add(pProof, pEval_r)),
|
||||
mload(add(pMem, pPl)),
|
||||
q
|
||||
)
|
||||
|
||||
t1 := mulmod(
|
||||
mload(add(pProof, pEval_s1)),
|
||||
mload(add(pMem, pBeta)),
|
||||
q
|
||||
)
|
||||
|
||||
t1 := addmod(
|
||||
t1,
|
||||
mload(add(pProof, pEval_a)),
|
||||
q
|
||||
)
|
||||
|
||||
t1 := addmod(
|
||||
t1,
|
||||
mload(add(pMem, pGamma)),
|
||||
q
|
||||
)
|
||||
|
||||
t2 := mulmod(
|
||||
mload(add(pProof, pEval_s2)),
|
||||
mload(add(pMem, pBeta)),
|
||||
q
|
||||
)
|
||||
|
||||
t2 := addmod(
|
||||
t2,
|
||||
mload(add(pProof, pEval_b)),
|
||||
q
|
||||
)
|
||||
|
||||
t2 := addmod(
|
||||
t2,
|
||||
mload(add(pMem, pGamma)),
|
||||
q
|
||||
)
|
||||
|
||||
t1 := mulmod(t1, t2, q)
|
||||
|
||||
t2 := addmod(
|
||||
mload(add(pProof, pEval_c)),
|
||||
mload(add(pMem, pGamma)),
|
||||
q
|
||||
)
|
||||
|
||||
t1 := mulmod(t1, t2, q)
|
||||
t1 := mulmod(t1, mload(add(pProof, pEval_zw)), q)
|
||||
t1 := mulmod(t1, mload(add(pMem, pAlpha)), q)
|
||||
|
||||
t2 := mulmod(
|
||||
mload(add(pMem, pEval_l1)),
|
||||
mload(add(pMem, pAlpha)),
|
||||
q
|
||||
)
|
||||
|
||||
t2 := mulmod(
|
||||
t2,
|
||||
mload(add(pMem, pAlpha)),
|
||||
q
|
||||
)
|
||||
|
||||
t1 := addmod(t1, t2, q)
|
||||
|
||||
t := mod(sub(add(t, q), t1), q)
|
||||
t := mulmod(t, mload(add(pMem, pZhInv)), q)
|
||||
|
||||
mstore( add(pMem, pEval_t) , t)
|
||||
|
||||
}
|
||||
|
||||
function g1_set(pR, pP) {
|
||||
mstore(pR, mload(pP))
|
||||
mstore(add(pR, 32), mload(add(pP,32)))
|
||||
}
|
||||
|
||||
function g1_acc(pR, pP) {
|
||||
let mIn := mload(0x40)
|
||||
mstore(mIn, mload(pR))
|
||||
mstore(add(mIn,32), mload(add(pR, 32)))
|
||||
mstore(add(mIn,64), mload(pP))
|
||||
mstore(add(mIn,96), mload(add(pP, 32)))
|
||||
|
||||
let success := staticcall(sub(gas(), 2000), 6, mIn, 128, pR, 64)
|
||||
|
||||
if iszero(success) {
|
||||
mstore(0, 0)
|
||||
return(0,0x20)
|
||||
}
|
||||
}
|
||||
|
||||
function g1_mulAcc(pR, pP, s) {
|
||||
let success
|
||||
let mIn := mload(0x40)
|
||||
mstore(mIn, mload(pP))
|
||||
mstore(add(mIn,32), mload(add(pP, 32)))
|
||||
mstore(add(mIn,64), s)
|
||||
|
||||
success := staticcall(sub(gas(), 2000), 7, mIn, 96, mIn, 64)
|
||||
|
||||
if iszero(success) {
|
||||
mstore(0, 0)
|
||||
return(0,0x20)
|
||||
}
|
||||
|
||||
mstore(add(mIn,64), mload(pR))
|
||||
mstore(add(mIn,96), mload(add(pR, 32)))
|
||||
|
||||
success := staticcall(sub(gas(), 2000), 6, mIn, 128, pR, 64)
|
||||
|
||||
if iszero(success) {
|
||||
mstore(0, 0)
|
||||
return(0,0x20)
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
function g1_mulAccC(pR, x, y, s) {
|
||||
let success
|
||||
let mIn := mload(0x40)
|
||||
mstore(mIn, x)
|
||||
mstore(add(mIn,32), y)
|
||||
mstore(add(mIn,64), s)
|
||||
|
||||
success := staticcall(sub(gas(), 2000), 7, mIn, 96, mIn, 64)
|
||||
|
||||
if iszero(success) {
|
||||
mstore(0, 0)
|
||||
return(0,0x20)
|
||||
}
|
||||
|
||||
mstore(add(mIn,64), mload(pR))
|
||||
mstore(add(mIn,96), mload(add(pR, 32)))
|
||||
|
||||
success := staticcall(sub(gas(), 2000), 6, mIn, 128, pR, 64)
|
||||
|
||||
if iszero(success) {
|
||||
mstore(0, 0)
|
||||
return(0,0x20)
|
||||
}
|
||||
}
|
||||
|
||||
function g1_mulSetC(pR, x, y, s) {
|
||||
let success
|
||||
let mIn := mload(0x40)
|
||||
mstore(mIn, x)
|
||||
mstore(add(mIn,32), y)
|
||||
mstore(add(mIn,64), s)
|
||||
|
||||
success := staticcall(sub(gas(), 2000), 7, mIn, 96, pR, 64)
|
||||
|
||||
if iszero(success) {
|
||||
mstore(0, 0)
|
||||
return(0,0x20)
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
function calculateA1(pProof, pMem) {
|
||||
let p := add(pMem, pA1)
|
||||
g1_set(p, add(pProof, pWxi))
|
||||
g1_mulAcc(p, add(pProof, pWxiw), mload(add(pMem, pU)))
|
||||
}
|
||||
|
||||
|
||||
function calculateB1(pProof, pMem) {
|
||||
let s
|
||||
let s1
|
||||
let p := add(pMem, pB1)
|
||||
|
||||
// Calculate D
|
||||
s := mulmod( mload(add(pProof, pEval_a)), mload(add(pMem, pV1)), q)
|
||||
g1_mulSetC(p, Qlx, Qly, s)
|
||||
|
||||
s := mulmod( s, mload(add(pProof, pEval_b)), q)
|
||||
g1_mulAccC(p, Qmx, Qmy, s)
|
||||
|
||||
s := mulmod( mload(add(pProof, pEval_b)), mload(add(pMem, pV1)), q)
|
||||
g1_mulAccC(p, Qrx, Qry, s)
|
||||
|
||||
s := mulmod( mload(add(pProof, pEval_c)), mload(add(pMem, pV1)), q)
|
||||
g1_mulAccC(p, Qox, Qoy, s)
|
||||
|
||||
s :=mload(add(pMem, pV1))
|
||||
g1_mulAccC(p, Qcx, Qcy, s)
|
||||
|
||||
s := addmod(mload(add(pProof, pEval_a)), mload(add(pMem, pBetaXi)), q)
|
||||
s := addmod(s, mload(add(pMem, pGamma)), q)
|
||||
s1 := mulmod(k1, mload(add(pMem, pBetaXi)), q)
|
||||
s1 := addmod(s1, mload(add(pProof, pEval_b)), q)
|
||||
s1 := addmod(s1, mload(add(pMem, pGamma)), q)
|
||||
s := mulmod(s, s1, q)
|
||||
s1 := mulmod(k2, mload(add(pMem, pBetaXi)), q)
|
||||
s1 := addmod(s1, mload(add(pProof, pEval_c)), q)
|
||||
s1 := addmod(s1, mload(add(pMem, pGamma)), q)
|
||||
s := mulmod(s, s1, q)
|
||||
s := mulmod(s, mload(add(pMem, pAlpha)), q)
|
||||
s := mulmod(s, mload(add(pMem, pV1)), q)
|
||||
s1 := mulmod(mload(add(pMem, pEval_l1)), mload(add(pMem, pAlpha)), q)
|
||||
s1 := mulmod(s1, mload(add(pMem, pAlpha)), q)
|
||||
s1 := mulmod(s1, mload(add(pMem, pV1)), q)
|
||||
s := addmod(s, s1, q)
|
||||
s := addmod(s, mload(add(pMem, pU)), q)
|
||||
g1_mulAcc(p, add(pProof, pZ), s)
|
||||
|
||||
s := mulmod(mload(add(pMem, pBeta)), mload(add(pProof, pEval_s1)), q)
|
||||
s := addmod(s, mload(add(pProof, pEval_a)), q)
|
||||
s := addmod(s, mload(add(pMem, pGamma)), q)
|
||||
s1 := mulmod(mload(add(pMem, pBeta)), mload(add(pProof, pEval_s2)), q)
|
||||
s1 := addmod(s1, mload(add(pProof, pEval_b)), q)
|
||||
s1 := addmod(s1, mload(add(pMem, pGamma)), q)
|
||||
s := mulmod(s, s1, q)
|
||||
s := mulmod(s, mload(add(pMem, pAlpha)), q)
|
||||
s := mulmod(s, mload(add(pMem, pV1)), q)
|
||||
s := mulmod(s, mload(add(pMem, pBeta)), q)
|
||||
s := mulmod(s, mload(add(pProof, pEval_zw)), q)
|
||||
s := mod(sub(q, s), q)
|
||||
g1_mulAccC(p, S3x, S3y, s)
|
||||
|
||||
|
||||
// calculate F
|
||||
g1_acc(p , add(pProof, pT1))
|
||||
|
||||
s := mload(add(pMem, pXin))
|
||||
g1_mulAcc(p, add(pProof, pT2), s)
|
||||
|
||||
s := mulmod(s, s, q)
|
||||
g1_mulAcc(p, add(pProof, pT3), s)
|
||||
|
||||
g1_mulAcc(p, add(pProof, pA), mload(add(pMem, pV2)))
|
||||
g1_mulAcc(p, add(pProof, pB), mload(add(pMem, pV3)))
|
||||
g1_mulAcc(p, add(pProof, pC), mload(add(pMem, pV4)))
|
||||
g1_mulAccC(p, S1x, S1y, mload(add(pMem, pV5)))
|
||||
g1_mulAccC(p, S2x, S2y, mload(add(pMem, pV6)))
|
||||
|
||||
// calculate E
|
||||
s := mload(add(pMem, pEval_t))
|
||||
s := addmod(s, mulmod(mload(add(pProof, pEval_r)), mload(add(pMem, pV1)), q), q)
|
||||
s := addmod(s, mulmod(mload(add(pProof, pEval_a)), mload(add(pMem, pV2)), q), q)
|
||||
s := addmod(s, mulmod(mload(add(pProof, pEval_b)), mload(add(pMem, pV3)), q), q)
|
||||
s := addmod(s, mulmod(mload(add(pProof, pEval_c)), mload(add(pMem, pV4)), q), q)
|
||||
s := addmod(s, mulmod(mload(add(pProof, pEval_s1)), mload(add(pMem, pV5)), q), q)
|
||||
s := addmod(s, mulmod(mload(add(pProof, pEval_s2)), mload(add(pMem, pV6)), q), q)
|
||||
s := addmod(s, mulmod(mload(add(pProof, pEval_zw)), mload(add(pMem, pU)), q), q)
|
||||
s := mod(sub(q, s), q)
|
||||
g1_mulAccC(p, G1x, G1y, s)
|
||||
|
||||
|
||||
// Last part of B
|
||||
s := mload(add(pMem, pXi))
|
||||
g1_mulAcc(p, add(pProof, pWxi), s)
|
||||
|
||||
s := mulmod(mload(add(pMem, pU)), mload(add(pMem, pXi)), q)
|
||||
s := mulmod(s, w1, q)
|
||||
g1_mulAcc(p, add(pProof, pWxiw), s)
|
||||
|
||||
}
|
||||
|
||||
function checkPairing(pMem) -> isOk {
|
||||
let mIn := mload(0x40)
|
||||
mstore(mIn, mload(add(pMem, pA1)))
|
||||
mstore(add(mIn,32), mload(add(add(pMem, pA1), 32)))
|
||||
mstore(add(mIn,64), X2x2)
|
||||
mstore(add(mIn,96), X2x1)
|
||||
mstore(add(mIn,128), X2y2)
|
||||
mstore(add(mIn,160), X2y1)
|
||||
mstore(add(mIn,192), mload(add(pMem, pB1)))
|
||||
let s := mload(add(add(pMem, pB1), 32))
|
||||
s := mod(sub(qf, s), qf)
|
||||
mstore(add(mIn,224), s)
|
||||
mstore(add(mIn,256), G2x2)
|
||||
mstore(add(mIn,288), G2x1)
|
||||
mstore(add(mIn,320), G2y2)
|
||||
mstore(add(mIn,352), G2y1)
|
||||
|
||||
let success := staticcall(sub(gas(), 2000), 8, mIn, 384, mIn, 0x20)
|
||||
|
||||
isOk := and(success, mload(mIn))
|
||||
}
|
||||
|
||||
let pMem := mload(0x40)
|
||||
mstore(0x40, add(pMem, lastMem))
|
||||
|
||||
checkInput(proof)
|
||||
calculateChallanges(proof, pMem)
|
||||
calculateLagrange(pMem)
|
||||
calculatePl(pMem, pubSignals)
|
||||
calculateT(proof, pMem)
|
||||
calculateA1(proof, pMem)
|
||||
calculateB1(proof, pMem)
|
||||
let isValid := checkPairing(pMem)
|
||||
|
||||
mstore(0x40, sub(pMem, lastMem))
|
||||
mstore(0, isValid)
|
||||
return(0,0x20)
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
@@ -2,7 +2,7 @@ module.exports = async ({ getNamedAccounts, deployments }) => {
|
||||
const { deploy } = deployments;
|
||||
const { deployer } = await getNamedAccounts();
|
||||
|
||||
await deploy('Verifier', {
|
||||
await deploy('PlonkVerifier', {
|
||||
from: deployer,
|
||||
log: true
|
||||
});
|
||||
|
||||
@@ -5,11 +5,11 @@
|
||||
cd circuits
|
||||
mkdir -p build
|
||||
|
||||
if [ -f ./powersOfTau28_hez_final_14.ptau ]; then
|
||||
echo "powersOfTau28_hez_final_14.ptau already exists. Skipping."
|
||||
if [ -f ./powersOfTau28_hez_final_16.ptau ]; then
|
||||
echo "powersOfTau28_hez_final_16.ptau already exists. Skipping."
|
||||
else
|
||||
echo 'Downloading powersOfTau28_hez_final_14.ptau'
|
||||
wget https://hermez.s3-eu-west-1.amazonaws.com/powersOfTau28_hez_final_14.ptau
|
||||
echo 'Downloading powersOfTau28_hez_final_16.ptau'
|
||||
wget https://hermez.s3-eu-west-1.amazonaws.com/powersOfTau28_hez_final_16.ptau
|
||||
fi
|
||||
|
||||
echo "Compiling: sudoku..."
|
||||
@@ -30,8 +30,8 @@ fi
|
||||
if [ -f ./build/sudoku/verification_key.json ]; then
|
||||
echo "verification_key.json already exists. Skipping."
|
||||
else
|
||||
snarkjs groth16 setup build/sudoku.r1cs powersOfTau28_hez_final_14.ptau build/sudoku/circuit_0000.zkey
|
||||
snarkjs zkey contribute build/sudoku/circuit_0000.zkey build/sudoku/circuit_final.zkey --name="1st Contributor Name" -v -e="random text"
|
||||
snarkjs plonk setup build/sudoku.r1cs powersOfTau28_hez_final_16.ptau build/sudoku/circuit_final.zkey #circuit_0000.zkey
|
||||
#snarkjs zkey contribute build/sudoku/circuit_0000.zkey build/sudoku/circuit_final.zkey --name="1st Contributor Name" -v -e="random text"
|
||||
snarkjs zkey export verificationkey build/sudoku/circuit_final.zkey build/sudoku/verification_key.json
|
||||
fi
|
||||
|
||||
|
||||
@@ -9,10 +9,10 @@ mkdir -p build/sudoku
|
||||
node "build/sudoku_js/generate_witness.js" build/sudoku_js/sudoku.wasm input.json build/sudoku/witness.wtns
|
||||
|
||||
# generate proof
|
||||
snarkjs groth16 prove build/sudoku/circuit_final.zkey build/sudoku/witness.wtns build/sudoku/proof.json build/sudoku/public.json
|
||||
snarkjs plonk prove build/sudoku/circuit_final.zkey build/sudoku/witness.wtns build/sudoku/proof.json build/sudoku/public.json
|
||||
|
||||
# verify proof
|
||||
snarkjs groth16 verify build/sudoku/verification_key.json build/sudoku/public.json build/sudoku/proof.json
|
||||
snarkjs plonk verify build/sudoku/verification_key.json build/sudoku/public.json build/sudoku/proof.json
|
||||
|
||||
# generate call
|
||||
snarkjs zkey export soliditycalldata build/sudoku/public.json build/sudoku/proof.json > build/sudoku/call.json
|
||||
snarkjs zkey export soliditycalldata build/sudoku/public.json build/sudoku/proof.json > build/sudoku/call.txt
|
||||
@@ -7,20 +7,20 @@ describe("Verifier Contract", function () {
|
||||
let verifier;
|
||||
|
||||
beforeEach(async function () {
|
||||
Verifier = await ethers.getContractFactory("Verifier");
|
||||
Verifier = await ethers.getContractFactory("PlonkVerifier");
|
||||
verifier = await Verifier.deploy();
|
||||
await verifier.deployed();
|
||||
});
|
||||
|
||||
it("Should return true for correct proofs", async function () {
|
||||
var array = JSON.parse("[" + fs.readFileSync("./circuits/build/sudoku/call.json") + "]");
|
||||
expect(await verifier.verifyProof(array[0], array[1], array[2], array[3])).to.be.true;
|
||||
var text = fs.readFileSync("./circuits/build/sudoku/call.txt", 'utf-8');
|
||||
var calldata = text.split(',');
|
||||
//console.log(calldata);
|
||||
expect(await verifier.verifyProof(calldata[0], JSON.parse(calldata[1]))).to.be.true;
|
||||
});
|
||||
it("Should return false for invalid proof", async function () {
|
||||
let a = [0, 0];
|
||||
let b = [[0, 0], [0, 0]];
|
||||
let c = [0, 0];
|
||||
let d = [0];
|
||||
expect(await verifier.verifyProof(a, b, c, d)).to.be.false;
|
||||
let a = '0x00';
|
||||
let b = ['0'];
|
||||
expect(await verifier.verifyProof(a, b)).to.be.false;
|
||||
});
|
||||
});
|
||||
Reference in New Issue
Block a user