From 46029b64fa77bda739a3987a1c489d5b6ad1dd55 Mon Sep 17 00:00:00 2001 From: nikkolasg Date: Tue, 14 Feb 2023 17:50:55 +0100 Subject: [PATCH 1/7] adding nizk blst test --- src/nizk/mod.rs | 29 ++++++++++++++++++++--------- 1 file changed, 20 insertions(+), 9 deletions(-) diff --git a/src/nizk/mod.rs b/src/nizk/mod.rs index ffafabbe..b966f381 100644 --- a/src/nizk/mod.rs +++ b/src/nizk/mod.rs @@ -182,29 +182,40 @@ where #[cfg(test)] mod tests { - use crate::parameters::poseidon_params; + use crate::parameters::PoseidonConfiguration; use super::*; + use ark_ec::CurveGroup; use ark_std::UniformRand; - type F = ark_bls12_377::Fr; - type G = ark_bls12_377::G1Projective; #[test] - fn check_dotproductproof_log() { + fn check_dotproductproof_log_blst() { + check_dotproductproof_log::(); + } + + #[test] + fn check_dotproductproof_log_arkworks_bls12_381() { + check_dotproductproof_log::(); + } + + fn check_dotproductproof_log() + where + G::ScalarField: PoseidonConfiguration + Absorb, + { let mut rng = ark_std::rand::thread_rng(); let n = 1024; let gens = DotProductProofGens::::new(n, b"test-1024"); - let x: Vec = (0..n).map(|_i| F::rand(&mut rng)).collect(); - let a: Vec = (0..n).map(|_i| F::rand(&mut rng)).collect(); + let x: Vec = (0..n).map(|_i| G::ScalarField::rand(&mut rng)).collect(); + let a: Vec = (0..n).map(|_i| G::ScalarField::rand(&mut rng)).collect(); let y = crate::dot_product(&x, &a); - let r_x = F::rand(&mut rng); - let r_y = F::rand(&mut rng); + let r_x = G::ScalarField::rand(&mut rng); + let r_y = G::ScalarField::rand(&mut rng); - let params = poseidon_params(); + let params = G::ScalarField::poseidon_params(); let mut prover_transcript = PoseidonTranscript::new(¶ms); let (proof, Cx, Cy) = DotProductProofLog::::prove(&gens, &mut prover_transcript, &x, &r_x, &a, &y, &r_y); From ed3121f7e27a306c68c57e890451c43600daac5b Mon Sep 17 00:00:00 2001 From: nikkolasg Date: Tue, 14 Feb 2023 18:12:50 +0100 Subject: [PATCH 2/7] failing test with blst --- Cargo.toml | 2 +- src/lib.rs | 27 ++++++++++++++++++++------- 2 files changed, 21 insertions(+), 8 deletions(-) diff --git a/Cargo.toml b/Cargo.toml index 61c3cea8..f38dcf89 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -23,7 +23,7 @@ ark-ec = { version = "^0.4.0", default-features = false } ark-std = { version = "^0.4.0"} ark-bls12-377 = { version = "^0.4.0", features = ["r1cs","curve"] } ark-bls12-381 = { version = "^0.4.0", features = ["curve"] } -ark-blst = { git = "https://github.com/nikkolasg/ark-blst" , branch = "feat/absorb" } +ark-blst = { git = "https://github.com/nikkolasg/ark-blst" } ark-serialize = { version = "^0.4.0", features = ["derive"] } ark-crypto-primitives = {version = "^0.4.0", features = ["sponge","r1cs","snark"] } ark-r1cs-std = { version = "^0.4.0", default-features = false } diff --git a/src/lib.rs b/src/lib.rs index e25a2ad5..1eee92b4 100644 --- a/src/lib.rs +++ b/src/lib.rs @@ -682,16 +682,28 @@ pub(crate) fn dot_product(a: &[F], b: &[F]) -> F { #[cfg(test)] mod tests { - use crate::parameters::poseidon_params; + use crate::parameters::{poseidon_params, PoseidonConfiguration}; use super::*; use crate::ark_std::Zero; + use ark_bls12_381::Bls12_381; use ark_ff::{BigInteger, One, PrimeField}; - type F = ark_bls12_377::Fr; - type E = ark_bls12_377::Bls12_377; #[test] - pub fn check_snark() { + fn check_snark_arkworks_bls12_381() { + check_snark::(); + } + + #[test] + fn check_snark_arkworks_blst() { + check_snark::(); + } + + pub fn check_snark() + where + E: Pairing, + E::ScalarField: PoseidonConfiguration + Absorb, + { let num_vars = 256; let num_cons = num_vars; let num_inputs = 10; @@ -705,7 +717,7 @@ mod tests { // create a commitment to R1CSInstance let (comm, decomm) = SNARK::encode(&inst, &gens); - let params = poseidon_params(); + let params = E::ScalarField::poseidon_params(); // produce a proof let mut prover_transcript = PoseidonTranscript::new(¶ms); @@ -727,11 +739,13 @@ mod tests { &inputs, &mut verifier_transcript, &gens, - poseidon_params() + E::ScalarField::poseidon_params() ) .is_ok()); } + type E = ark_bls12_377::Bls12_377; + type F = ark_bls12_377::Fr; #[test] pub fn check_r1cs_invalid_index() { let num_cons = 4; @@ -776,7 +790,6 @@ mod tests { assert!(inst.is_err()); assert_eq!(inst.err(), Some(R1CSError::InvalidScalar)); } - #[test] fn test_padded_constraints() { // parameters of the R1CS instance From a1ad4dc371489407ca786703ba82bf546394103c Mon Sep 17 00:00:00 2001 From: nikkolasg Date: Tue, 14 Feb 2023 21:32:12 +0100 Subject: [PATCH 3/7] failing snark_mixed test --- src/commitments.rs | 3 +- src/dense_mlpoly.rs | 2 +- src/lib.rs | 76 +++++++++++++++++++++++++++++++++++++++++++- src/nizk/mod.rs | 2 +- src/r1csinstance.rs | 1 + src/r1csproof.rs | 2 +- src/sparse_mlpoly.rs | 1 + 7 files changed, 82 insertions(+), 5 deletions(-) diff --git a/src/commitments.rs b/src/commitments.rs index 458a8397..87e0e761 100644 --- a/src/commitments.rs +++ b/src/commitments.rs @@ -3,10 +3,11 @@ use crate::parameters::*; use ark_crypto_primitives::sponge::poseidon::PoseidonSponge; use ark_crypto_primitives::sponge::CryptographicSponge; use ark_ec::{CurveGroup, VariableBaseMSM}; +use ark_serialize::{CanonicalDeserialize, CanonicalSerialize}; use rand::SeedableRng; use std::ops::Mul; -#[derive(Debug, Clone)] +#[derive(Debug, CanonicalSerialize, CanonicalDeserialize, Clone)] pub struct MultiCommitGens { pub n: usize, pub G: Vec, diff --git a/src/dense_mlpoly.rs b/src/dense_mlpoly.rs index 63e1f4ae..6c88b7b5 100644 --- a/src/dense_mlpoly.rs +++ b/src/dense_mlpoly.rs @@ -175,7 +175,7 @@ impl<'a, 'b, F: PrimeField> SubAssign<&'a DensePolynomial> for DensePolynomia } } -#[derive(Clone)] +#[derive(Clone, Debug, CanonicalSerialize, CanonicalDeserialize)] pub struct PolyCommitmentGens { pub gens: DotProductProofGens, pub ck: CommitterKey, diff --git a/src/lib.rs b/src/lib.rs index 1eee92b4..ef466520 100644 --- a/src/lib.rs +++ b/src/lib.rs @@ -59,6 +59,7 @@ use ark_ec::CurveGroup; use timer::Timer; /// `ComputationCommitment` holds a public preprocessed NP statement (e.g., R1CS) +#[derive(Debug, CanonicalSerialize, CanonicalDeserialize)] pub struct ComputationCommitment { comm: R1CSCommitment, } @@ -70,7 +71,7 @@ pub struct ComputationDecommitment { } /// `Assignment` holds an assignment of values to either the inputs or variables in an `Instance` -#[derive(Clone)] +#[derive(Clone, CanonicalSerialize, CanonicalDeserialize)] pub struct Assignment { assignment: Vec, } @@ -292,6 +293,7 @@ impl Instance { } /// `SNARKGens` holds public parameters for producing and verifying proofs with the Spartan SNARK +#[derive(Debug, CanonicalSerialize, CanonicalDeserialize)] pub struct SNARKGens { gens_r1cs_sat: R1CSGens, gens_r1cs_eval: R1CSCommitmentGens, @@ -689,6 +691,78 @@ mod tests { use ark_bls12_381::Bls12_381; use ark_ff::{BigInteger, One, PrimeField}; + #[test] + fn check_snark_mixed() { + type E1 = ark_bls12_381::Bls12_381; + type E2 = ark_blst::Bls12; + type F1 = ark_bls12_381::Fr; + type F2 = ark_blst::Scalar; + type P1 = ark_bls12_381::G1Projective; + type P2 = ark_blst::G1Projective; + + let num_vars = 256; + let num_cons = num_vars; + let num_inputs = 10; + + // produce public generators + let gens = SNARKGens::::new(num_cons, num_vars, num_inputs, num_cons); + + // produce a synthetic R1CSInstance + let (inst, vars, inputs) = Instance::produce_synthetic_r1cs(num_cons, num_vars, num_inputs); + + // create a commitment to R1CSInstance + let (comm, decomm) = SNARK::encode(&inst, &gens); + + let params = F2::poseidon_params(); + + // produce a proof + let mut prover_transcript = PoseidonTranscript::new(¶ms); + let proof = SNARK::prove( + &inst, + &comm, + &decomm, + vars, + &inputs, + &gens, + &mut prover_transcript, + ); + + let mut proof_buffer = Vec::new(); + proof + .serialize_compressed(&mut proof_buffer) + .expect("invalid serial"); + let blst_proof = SNARK::::deserialize_compressed(&proof_buffer[..]).unwrap(); + + let mut comm_buffer = Vec::new(); + comm + .serialize_compressed(&mut comm_buffer) + .expect("invalid serial"); + let blst_comm = ComputationCommitment::::deserialize_compressed(&comm_buffer[..]).unwrap(); + + let mut inputs_buffer = Vec::new(); + inputs + .serialize_compressed(&mut inputs_buffer) + .expect("invalid serial"); + let blst_inputs = Assignment::::deserialize_compressed(&inputs_buffer[..]).unwrap(); + + let mut gens_buffer = Vec::new(); + gens + .serialize_compressed(&mut gens_buffer) + .expect("invalid serial"); + let blst_gens = SNARKGens::::deserialize_compressed(&gens_buffer[..]).unwrap(); + // verify the proof + let mut verifier_transcript = PoseidonTranscript::new(&F1::poseidon_params()); + assert!(blst_proof + .verify( + &blst_comm, + &blst_inputs, + &mut verifier_transcript, + &blst_gens, + F1::poseidon_params() + ) + .is_ok()); + } + #[test] fn check_snark_arkworks_bls12_381() { check_snark::(); diff --git a/src/nizk/mod.rs b/src/nizk/mod.rs index b966f381..534bd3ab 100644 --- a/src/nizk/mod.rs +++ b/src/nizk/mod.rs @@ -14,7 +14,7 @@ use std::ops::Mul; mod bullet; use bullet::BulletReductionProof; -#[derive(Clone)] +#[derive(Clone, Debug, CanonicalSerialize, CanonicalDeserialize)] pub struct DotProductProofGens { n: usize, pub gens_n: MultiCommitGens, diff --git a/src/r1csinstance.rs b/src/r1csinstance.rs index c83bc5d9..6ff24fff 100644 --- a/src/r1csinstance.rs +++ b/src/r1csinstance.rs @@ -26,6 +26,7 @@ pub struct R1CSInstance { C: SparseMatPolynomial, } +#[derive(CanonicalDeserialize, CanonicalSerialize, Debug)] pub struct R1CSCommitmentGens { gens: SparseMatPolyCommitmentGens, } diff --git a/src/r1csproof.rs b/src/r1csproof.rs index 25617549..7121d6f3 100644 --- a/src/r1csproof.rs +++ b/src/r1csproof.rs @@ -49,7 +49,7 @@ pub struct R1CSProof { pub mipp_proof: MippProof, } -#[derive(Clone)] +#[derive(Clone, Debug, CanonicalSerialize, CanonicalDeserialize)] pub struct R1CSGens { gens_pc: PolyCommitmentGens, } diff --git a/src/sparse_mlpoly.rs b/src/sparse_mlpoly.rs index 5df7b267..5e6dbe00 100644 --- a/src/sparse_mlpoly.rs +++ b/src/sparse_mlpoly.rs @@ -283,6 +283,7 @@ pub struct MultiSparseMatPolynomialAsDense { comb_mem: DensePolynomial, } +#[derive(CanonicalSerialize,CanonicalDeserialize,Debug)] pub struct SparseMatPolyCommitmentGens { gens_ops: PolyCommitmentGens, gens_mem: PolyCommitmentGens, From 4758c62a5374979f5312e8b4195756ea0411dda1 Mon Sep 17 00:00:00 2001 From: nikkolasg Date: Wed, 15 Feb 2023 10:19:12 +0100 Subject: [PATCH 4/7] invalid test --- src/lib.rs | 27 ++++++++------------------- 1 file changed, 8 insertions(+), 19 deletions(-) diff --git a/src/lib.rs b/src/lib.rs index ef466520..cb697e06 100644 --- a/src/lib.rs +++ b/src/lib.rs @@ -396,12 +396,6 @@ where ) }; - let mut proof_encoded: Vec = Vec::new(); - proof - .serialize_with_mode(&mut proof_encoded, Compress::Yes) - .unwrap(); - Timer::print(&format!("len_r1cs_sat_proof {:?}", proof_encoded.len())); - (proof, rx, ry) }; @@ -434,11 +428,6 @@ where transcript, ); - let mut proof_encoded: Vec = Vec::new(); - proof - .serialize_with_mode(&mut proof_encoded, Compress::Yes) - .unwrap(); - Timer::print(&format!("len_r1cs_eval_proof {:?}", proof_encoded.len())); proof }; @@ -705,7 +694,7 @@ mod tests { let num_inputs = 10; // produce public generators - let gens = SNARKGens::::new(num_cons, num_vars, num_inputs, num_cons); + let gens = SNARKGens::::new(num_cons, num_vars, num_inputs, num_cons); // produce a synthetic R1CSInstance let (inst, vars, inputs) = Instance::produce_synthetic_r1cs(num_cons, num_vars, num_inputs); @@ -713,7 +702,7 @@ mod tests { // create a commitment to R1CSInstance let (comm, decomm) = SNARK::encode(&inst, &gens); - let params = F2::poseidon_params(); + let params = F1::poseidon_params(); // produce a proof let mut prover_transcript = PoseidonTranscript::new(¶ms); @@ -731,34 +720,34 @@ mod tests { proof .serialize_compressed(&mut proof_buffer) .expect("invalid serial"); - let blst_proof = SNARK::::deserialize_compressed(&proof_buffer[..]).unwrap(); + let blst_proof = SNARK::::deserialize_compressed(&proof_buffer[..]).unwrap(); let mut comm_buffer = Vec::new(); comm .serialize_compressed(&mut comm_buffer) .expect("invalid serial"); - let blst_comm = ComputationCommitment::::deserialize_compressed(&comm_buffer[..]).unwrap(); + let blst_comm = ComputationCommitment::::deserialize_compressed(&comm_buffer[..]).unwrap(); let mut inputs_buffer = Vec::new(); inputs .serialize_compressed(&mut inputs_buffer) .expect("invalid serial"); - let blst_inputs = Assignment::::deserialize_compressed(&inputs_buffer[..]).unwrap(); + let blst_inputs = Assignment::::deserialize_compressed(&inputs_buffer[..]).unwrap(); let mut gens_buffer = Vec::new(); gens .serialize_compressed(&mut gens_buffer) .expect("invalid serial"); - let blst_gens = SNARKGens::::deserialize_compressed(&gens_buffer[..]).unwrap(); + let blst_gens = SNARKGens::::deserialize_compressed(&gens_buffer[..]).unwrap(); // verify the proof - let mut verifier_transcript = PoseidonTranscript::new(&F1::poseidon_params()); + let mut verifier_transcript = PoseidonTranscript::new(&F2::poseidon_params()); assert!(blst_proof .verify( &blst_comm, &blst_inputs, &mut verifier_transcript, &blst_gens, - F1::poseidon_params() + F2::poseidon_params() ) .is_ok()); } From 19d46ca70745f17f5fbd4e0edb1bddb2ae5fb4b2 Mon Sep 17 00:00:00 2001 From: nikkolasg Date: Wed, 15 Feb 2023 22:46:13 +0100 Subject: [PATCH 5/7] working test --- Cargo.toml | 1 + src/commitments.rs | 4 ++- src/dense_mlpoly.rs | 68 ++++++++++++++++++++++++++++++-------- src/lib.rs | 20 +++++++++++ src/nizk/bullet.rs | 36 +++++++++++++++++++- src/nizk/mod.rs | 16 +++++++-- src/poseidon_transcript.rs | 22 ++++++++++++ src/sparse_mlpoly.rs | 6 +++- 8 files changed, 155 insertions(+), 18 deletions(-) diff --git a/Cargo.toml b/Cargo.toml index f38dcf89..1ad843b1 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -50,6 +50,7 @@ tracing-subscriber = { version = "0.2" } serde = { version = "1.0", features = ["derive"] } csv = "1.1.5" criterion = "0.3.6" +hex = "0.4.3" [lib] name = "libspartan" diff --git a/src/commitments.rs b/src/commitments.rs index 87e0e761..f8c96560 100644 --- a/src/commitments.rs +++ b/src/commitments.rs @@ -2,6 +2,7 @@ use crate::ark_std::UniformRand; use crate::parameters::*; use ark_crypto_primitives::sponge::poseidon::PoseidonSponge; use ark_crypto_primitives::sponge::CryptographicSponge; +use ark_ec::AffineRepr; use ark_ec::{CurveGroup, VariableBaseMSM}; use ark_serialize::{CanonicalDeserialize, CanonicalSerialize}; use rand::SeedableRng; @@ -30,6 +31,7 @@ impl MultiCommitGens { let mut prng = rand::rngs::StdRng::from_seed(uniform_bytes); G::Affine::rand(&mut prng) }) + .inspect(|e| assert!(!e.is_zero(), "multicommitgen zero element")) .collect::>(); MultiCommitGens { @@ -83,6 +85,6 @@ impl PedersenCommit { gens_n: &MultiCommitGens, ) -> G { assert_eq!(scalars.len(), gens_n.n); - ::msm_unchecked(&gens_n.G, scalars) + gens_n.h.mul(blind) + ::msm_unchecked(&gens_n.G, scalars) //+ gens_n.h.mul(blind) } } diff --git a/src/dense_mlpoly.rs b/src/dense_mlpoly.rs index 6c88b7b5..3fd395aa 100644 --- a/src/dense_mlpoly.rs +++ b/src/dense_mlpoly.rs @@ -7,7 +7,7 @@ use super::nizk::{DotProductProofGens, DotProductProofLog}; use crate::poseidon_transcript::{PoseidonTranscript, TranscriptWriter}; use ark_crypto_primitives::sponge::Absorb; use ark_ec::scalar_mul::variable_base::VariableBaseMSM; -use ark_ec::{pairing::Pairing, CurveGroup}; +use ark_ec::{pairing::Pairing, AffineRepr, CurveGroup}; use ark_ff::{PrimeField, Zero}; use ark_poly::MultilinearExtension; use ark_poly_commit::multilinear_pc::data_structures::{CommitterKey, VerifierKey}; @@ -191,7 +191,7 @@ impl PolyCommitmentGens { // Generates the SRS and trims it based on the number of variables in the // multilinear polynomial. - let mut rng = ark_std::test_rng(); + let mut rng = rand::thread_rng(); let pst_gens = MultilinearPC::::setup(num_vars / 2, &mut rng); let (ck, vk) = MultilinearPC::::trim(&pst_gens, num_vars / 2); @@ -205,7 +205,7 @@ pub struct PolyCommitmentBlinds { #[derive(Debug, CanonicalSerialize, CanonicalDeserialize)] pub struct PolyCommitment { - C: Vec, + C: Vec, } #[derive(Debug, CanonicalSerialize, CanonicalDeserialize)] @@ -321,9 +321,20 @@ impl DensePolynomial { let R_size = self.Z.len() / L_size; assert_eq!(L_size * R_size, self.Z.len()); let C = (0..L_size) - .into_par_iter() + .into_iter() .map(|i| { - PedersenCommit::commit_slice(&self.Z[R_size * i..R_size * (i + 1)], &blinds[i], gens) + let slice = &self.Z[R_size * i..R_size * (i + 1)]; + slice + .iter() + .inspect(|e| assert!(!e.is_zero(), "scalars are zero")); + gens + .G + .iter() + .inspect(|e| assert!(!e.is_zero(), "generators are zero")); + let p = + PedersenCommit::commit_slice(&self.Z[R_size * i..R_size * (i + 1)], &blinds[i], gens) + .into_affine(); + p }) .collect(); PolyCommitment { C } @@ -340,8 +351,11 @@ impl DensePolynomial { let C = (0..L_size) .map(|i| { self.Z[R_size * i..R_size * (i + 1)] - .commit(&blinds[i], gens) - .compress() + .iter() + .inspect(|e| assert!(!e.is_zero(), "scalars are zero")); + + PedersenCommit::commit_slice(&self.Z[R_size * i..R_size * (i + 1)], &blinds[i], gens) + .into_affine() }) .collect(); PolyCommitment { C } @@ -465,7 +479,7 @@ impl Index for DensePolynomial { impl TranscriptWriter for PolyCommitment { fn write_to_transcript(&self, transcript: &mut PoseidonTranscript) { for i in 0..self.C.len() { - transcript.append_point(b"", &self.C[i]); + transcript.append_point(b"", &self.C[i].into_group()); } } } @@ -549,12 +563,40 @@ where let (L, R) = eq.compute_factored_evals(); // compute a weighted sum of commitments and L - let C_decompressed = &comm.C; - - let C_LZ = - ::msm(&::normalize_batch(C_decompressed), &L) - .unwrap(); + //let C_decompressed = &comm.C; + //let c_decompressed_affines = ::normalize_batch(C_decompressed); + //let C_LZ = ::msm(&c_decompressed_affines, &L) + let (c, s) : (Vec<_>,Vec<_>) = comm + .C + .iter() + .zip(L.iter()) + .filter(|(c, _)| !c.is_zero()) + .unzip(); + let C_LZ = ::msm(&c, &s).expect("msm of different length"); + + #[cfg(test)] + { + // Good + //crate::tests::hexprint("C_Zr", C_Zr); + //crate::tests::hexprint("C_decompressed", &comm.C); + //crate::tests::hexprint("C_decompressed_affines", &c_decompressed_affines); + crate::tests::hexprint("L", &L); + let zero_indices = comm + .C + .iter() + .enumerate() + .fold(Vec::new(), |mut agg, (i, e)| { + if e.is_zero() { + agg.push(i); + } + agg + }); + println!("zero_indices: {:?}", zero_indices); + crate::tests::hexprint("C_LZ", &C_LZ.into_affine()); + // Good + //crate::tests::hexprint("R", &R); + } self .proof .verify(R.len(), &gens.gens, transcript, &R, &C_LZ, C_Zr) diff --git a/src/lib.rs b/src/lib.rs index cb697e06..ea2e3d3d 100644 --- a/src/lib.rs +++ b/src/lib.rs @@ -716,6 +716,19 @@ mod tests { &mut prover_transcript, ); + println!(" VERIFYING WITH ARKWORKS BLS12_381"); + let mut verifier_transcript = PoseidonTranscript::new(&F1::poseidon_params()); + assert!(proof + .verify( + &comm, + &inputs, + &mut verifier_transcript, + &gens, + F1::poseidon_params() + ) + .is_ok()); + + println!(" VERIFYING WITH BLST"); let mut proof_buffer = Vec::new(); proof .serialize_compressed(&mut proof_buffer) @@ -741,6 +754,7 @@ mod tests { let blst_gens = SNARKGens::::deserialize_compressed(&gens_buffer[..]).unwrap(); // verify the proof let mut verifier_transcript = PoseidonTranscript::new(&F2::poseidon_params()); + assert!(blst_proof .verify( &blst_comm, @@ -950,4 +964,10 @@ mod tests { ) .is_ok()); } + + pub fn hexprint(s: &str, t: &T) { + let mut v = Vec::new(); + t.serialize_compressed(&mut v).unwrap(); + println!("{}: {}", s, hex::encode(v)); + } } diff --git a/src/nizk/bullet.rs b/src/nizk/bullet.rs index 5d84b679..debf4e2f 100644 --- a/src/nizk/bullet.rs +++ b/src/nizk/bullet.rs @@ -193,6 +193,25 @@ impl BulletReductionProof { allinv.mul_assign(c); } allinv = allinv.inverse().unwrap(); + #[cfg(test)] + { + let to_str = |e: G| -> String { + let mut v = Vec::new(); + e.serialize_compressed(&mut v).unwrap(); + format!("{:?}", hex::encode(v)) + }; + let to_strf = |e: G::ScalarField| -> String { + let mut v = Vec::new(); + e.serialize_compressed(&mut v).unwrap(); + format!("{:?}", hex::encode(v)) + }; + println!( + "challenges: {:?}", + challenges.iter().map(|e| to_strf(*e)).collect::>() + ); + println!("allinv: {}", to_strf(allinv)); + println!(" ----- ") + } // 3. Compute u_i^2 and (1/u_i)^2 for i in 0..lg_n { @@ -236,7 +255,22 @@ impl BulletReductionProof { let G_hat = G::msm(Gs, s.as_slice()).map_err(|_| ProofVerifyError::InternalError)?; let a_hat = inner_product(a, &s); - + #[cfg(test)] + { + // let to_str = |e: G| -> String { + // let mut v = Vec::new(); + // e.serialize_compressed(&mut v).unwrap(); + // format!("{:?}", hex::encode(v)) + // }; + // let to_strf = |e: G::ScalarField| -> String { + // let mut v = Vec::new(); + // e.serialize_compressed(&mut v).unwrap(); + // format!("{:?}", hex::encode(v)) + // }; + // println!("G_hat: {:?}", to_str(G_hat)); + // println!("a_hat : {:?}", to_strf(a_hat)); + // println!(" ----- ") + } let Gamma_hat = G::msm( &G::normalize_batch( &Ls diff --git a/src/nizk/mod.rs b/src/nizk/mod.rs index 534bd3ab..128c279e 100644 --- a/src/nizk/mod.rs +++ b/src/nizk/mod.rs @@ -168,8 +168,20 @@ where let lhs = (Gamma_hat.mul(c_s) + beta_s).mul(a_hat_s) + delta_s; let rhs = (g_hat + gens.gens_1.G[0].mul(a_hat_s)).mul(z1_s) + gens.gens_1.h.mul(z2_s); - - assert_eq!(lhs, rhs); + #[cfg(test)] + { + // let to_str = |e: G| -> String { + // let mut v = Vec::new(); + // e.serialize_compressed(&mut v).unwrap(); + // format!("{:?}", hex::encode(v)) + // }; + // println!("Gamma_hat: {:?}", to_str(Gamma_hat)); + // println!("beta_s : {:?}", to_str(beta_s)); + // println!("delta_s : {:?}", to_str(delta_s)); + // println!("lhs: {:?}", to_str(lhs)); + // println!("rhs: {:?}", to_str(rhs)); + } + debug_assert_eq!(lhs, rhs); if lhs == rhs { Ok(()) diff --git a/src/poseidon_transcript.rs b/src/poseidon_transcript.rs index 4ac33768..bd766739 100644 --- a/src/poseidon_transcript.rs +++ b/src/poseidon_transcript.rs @@ -103,6 +103,28 @@ mod test { use ark_bls12_381::Fr; use ark_ff::PrimeField; use poseidon_paramgen; + + use super::*; + use crate::ark_std::UniformRand; + use crate::parameters::PoseidonConfiguration; + + #[test] + fn poseidon_compatibility() { + let mut f1 = PoseidonTranscript::new(&ark_bls12_381::Fr::poseidon_params()); + let mut f2 = PoseidonTranscript::new(&ark_blst::Scalar::poseidon_params()); + + let r1 = ark_bls12_381::Fr::rand(&mut rand::thread_rng()); + let r2 = ark_blst::Scalar::from(r1); + + f1.append_scalar(b"", &r1); + f2.append_scalar(b"", &r2); + + let c1: ark_bls12_381::Fr = f1.challenge_scalar(b""); + let c2: ark_blst::Scalar = f2.challenge_scalar(b""); + + let c22 = ark_blst::Scalar::from(c1); + assert!(c2 == c22); + } #[test] fn poseidon_parameters_generation() { print_modulus::(); diff --git a/src/sparse_mlpoly.rs b/src/sparse_mlpoly.rs index 5e6dbe00..170987e6 100644 --- a/src/sparse_mlpoly.rs +++ b/src/sparse_mlpoly.rs @@ -283,7 +283,7 @@ pub struct MultiSparseMatPolynomialAsDense { comb_mem: DensePolynomial, } -#[derive(CanonicalSerialize,CanonicalDeserialize,Debug)] +#[derive(CanonicalSerialize, CanonicalDeserialize, Debug)] pub struct SparseMatPolyCommitmentGens { gens_ops: PolyCommitmentGens, gens_mem: PolyCommitmentGens, @@ -950,6 +950,8 @@ where transcript.append_scalar_vector(b"", &evals_ops); // evals_ops.append_to_transcript(b"claim_evals_ops", transcript); let challenges_ops = transcript.challenge_scalar_vec(b"", evals_ops.len().log_2()); + #[cfg(test)] + crate::tests::hexprint("challenge_ops", &challenges_ops); let mut poly_evals_ops = DensePolynomial::new(evals_ops); for i in (0..challenges_ops.len()).rev() { @@ -1542,6 +1544,8 @@ where // produce a random element from the transcript for hash function let r_mem_check = transcript.challenge_scalar_vec(b"", 2); + #[cfg(test)] + crate::tests::hexprint("r_mem_check", &r_mem_check); self.poly_eval_network_proof.verify( comm, &self.comm_derefs, From 682ba97cc9933943212570bf5a0973b87b4bad93 Mon Sep 17 00:00:00 2001 From: nikkolasg Date: Wed, 15 Feb 2023 22:52:23 +0100 Subject: [PATCH 6/7] corrected --- src/dense_mlpoly.rs | 46 ++++---------------------------------------- src/nizk/bullet.rs | 35 --------------------------------- src/nizk/mod.rs | 15 +-------------- src/sparse_mlpoly.rs | 4 ---- 4 files changed, 5 insertions(+), 95 deletions(-) diff --git a/src/dense_mlpoly.rs b/src/dense_mlpoly.rs index 3fd395aa..d2fbcf06 100644 --- a/src/dense_mlpoly.rs +++ b/src/dense_mlpoly.rs @@ -324,17 +324,7 @@ impl DensePolynomial { .into_iter() .map(|i| { let slice = &self.Z[R_size * i..R_size * (i + 1)]; - slice - .iter() - .inspect(|e| assert!(!e.is_zero(), "scalars are zero")); - gens - .G - .iter() - .inspect(|e| assert!(!e.is_zero(), "generators are zero")); - let p = - PedersenCommit::commit_slice(&self.Z[R_size * i..R_size * (i + 1)], &blinds[i], gens) - .into_affine(); - p + PedersenCommit::commit_slice(slice, &blinds[i], gens).into_affine() }) .collect(); PolyCommitment { C } @@ -350,10 +340,6 @@ impl DensePolynomial { assert_eq!(L_size * R_size, self.Z.len()); let C = (0..L_size) .map(|i| { - self.Z[R_size * i..R_size * (i + 1)] - .iter() - .inspect(|e| assert!(!e.is_zero(), "scalars are zero")); - PedersenCommit::commit_slice(&self.Z[R_size * i..R_size * (i + 1)], &blinds[i], gens) .into_affine() }) @@ -563,11 +549,9 @@ where let (L, R) = eq.compute_factored_evals(); // compute a weighted sum of commitments and L - //let C_decompressed = &comm.C; - - //let c_decompressed_affines = ::normalize_batch(C_decompressed); - //let C_LZ = ::msm(&c_decompressed_affines, &L) - let (c, s) : (Vec<_>,Vec<_>) = comm + // NOTE: This is necessary because of blst not supporting 0 points in msm + // TODO: fix the polycommit generators not being 0 - this should not have to be + let (c, s): (Vec<_>, Vec<_>) = comm .C .iter() .zip(L.iter()) @@ -575,28 +559,6 @@ where .unzip(); let C_LZ = ::msm(&c, &s).expect("msm of different length"); - #[cfg(test)] - { - // Good - //crate::tests::hexprint("C_Zr", C_Zr); - //crate::tests::hexprint("C_decompressed", &comm.C); - //crate::tests::hexprint("C_decompressed_affines", &c_decompressed_affines); - crate::tests::hexprint("L", &L); - let zero_indices = comm - .C - .iter() - .enumerate() - .fold(Vec::new(), |mut agg, (i, e)| { - if e.is_zero() { - agg.push(i); - } - agg - }); - println!("zero_indices: {:?}", zero_indices); - crate::tests::hexprint("C_LZ", &C_LZ.into_affine()); - // Good - //crate::tests::hexprint("R", &R); - } self .proof .verify(R.len(), &gens.gens, transcript, &R, &C_LZ, C_Zr) diff --git a/src/nizk/bullet.rs b/src/nizk/bullet.rs index debf4e2f..c6f46038 100644 --- a/src/nizk/bullet.rs +++ b/src/nizk/bullet.rs @@ -193,25 +193,6 @@ impl BulletReductionProof { allinv.mul_assign(c); } allinv = allinv.inverse().unwrap(); - #[cfg(test)] - { - let to_str = |e: G| -> String { - let mut v = Vec::new(); - e.serialize_compressed(&mut v).unwrap(); - format!("{:?}", hex::encode(v)) - }; - let to_strf = |e: G::ScalarField| -> String { - let mut v = Vec::new(); - e.serialize_compressed(&mut v).unwrap(); - format!("{:?}", hex::encode(v)) - }; - println!( - "challenges: {:?}", - challenges.iter().map(|e| to_strf(*e)).collect::>() - ); - println!("allinv: {}", to_strf(allinv)); - println!(" ----- ") - } // 3. Compute u_i^2 and (1/u_i)^2 for i in 0..lg_n { @@ -255,22 +236,6 @@ impl BulletReductionProof { let G_hat = G::msm(Gs, s.as_slice()).map_err(|_| ProofVerifyError::InternalError)?; let a_hat = inner_product(a, &s); - #[cfg(test)] - { - // let to_str = |e: G| -> String { - // let mut v = Vec::new(); - // e.serialize_compressed(&mut v).unwrap(); - // format!("{:?}", hex::encode(v)) - // }; - // let to_strf = |e: G::ScalarField| -> String { - // let mut v = Vec::new(); - // e.serialize_compressed(&mut v).unwrap(); - // format!("{:?}", hex::encode(v)) - // }; - // println!("G_hat: {:?}", to_str(G_hat)); - // println!("a_hat : {:?}", to_strf(a_hat)); - // println!(" ----- ") - } let Gamma_hat = G::msm( &G::normalize_batch( &Ls diff --git a/src/nizk/mod.rs b/src/nizk/mod.rs index 128c279e..e878278a 100644 --- a/src/nizk/mod.rs +++ b/src/nizk/mod.rs @@ -168,20 +168,7 @@ where let lhs = (Gamma_hat.mul(c_s) + beta_s).mul(a_hat_s) + delta_s; let rhs = (g_hat + gens.gens_1.G[0].mul(a_hat_s)).mul(z1_s) + gens.gens_1.h.mul(z2_s); - #[cfg(test)] - { - // let to_str = |e: G| -> String { - // let mut v = Vec::new(); - // e.serialize_compressed(&mut v).unwrap(); - // format!("{:?}", hex::encode(v)) - // }; - // println!("Gamma_hat: {:?}", to_str(Gamma_hat)); - // println!("beta_s : {:?}", to_str(beta_s)); - // println!("delta_s : {:?}", to_str(delta_s)); - // println!("lhs: {:?}", to_str(lhs)); - // println!("rhs: {:?}", to_str(rhs)); - } - debug_assert_eq!(lhs, rhs); + assert_eq!(lhs, rhs); if lhs == rhs { Ok(()) diff --git a/src/sparse_mlpoly.rs b/src/sparse_mlpoly.rs index 170987e6..fde8b858 100644 --- a/src/sparse_mlpoly.rs +++ b/src/sparse_mlpoly.rs @@ -950,8 +950,6 @@ where transcript.append_scalar_vector(b"", &evals_ops); // evals_ops.append_to_transcript(b"claim_evals_ops", transcript); let challenges_ops = transcript.challenge_scalar_vec(b"", evals_ops.len().log_2()); - #[cfg(test)] - crate::tests::hexprint("challenge_ops", &challenges_ops); let mut poly_evals_ops = DensePolynomial::new(evals_ops); for i in (0..challenges_ops.len()).rev() { @@ -1544,8 +1542,6 @@ where // produce a random element from the transcript for hash function let r_mem_check = transcript.challenge_scalar_vec(b"", 2); - #[cfg(test)] - crate::tests::hexprint("r_mem_check", &r_mem_check); self.poly_eval_network_proof.verify( comm, &self.comm_derefs, From 2b2c37ef856e42d013f0a541ec739db2be899808 Mon Sep 17 00:00:00 2001 From: Nicolas Gailly Date: Thu, 2 Mar 2023 16:05:05 +0100 Subject: [PATCH 7/7] Delete testudo_blst --- testudo_blst | 2 -- 1 file changed, 2 deletions(-) delete mode 100644 testudo_blst diff --git a/testudo_blst b/testudo_blst deleted file mode 100644 index b0e15329..00000000 --- a/testudo_blst +++ /dev/null @@ -1,2 +0,0 @@ -power,input_constraints,testudo_proving_time,testudo_verification_time,sat_proof_size,eval_proof_size,total_proof_size -4,16,779,99,4048,10904,15352