feat: add BIP-340 Schnorr verification circuit with native secp256k1 CRT proving

[jaromil]

BIP-340 Schnorr signature verification circuit proved over the native secp256k1 base field using the CRT Reed-Solomon backend.

C++ circuit (lib/circuits/bip340/)

Proves the Schnorr relation s·G - e·P = R with x-only keys, covering:

• Double-and-add trace for both s·G and e·P
• Point-on-curve checks for P and R
• Canonical scalar range 0 ≤ s < n
• Projective equality and finite-R check (R.z · rz_inv = 1)
• 256 ry-bitness gates (each ry_bits[i] ∈ {0,1})
• Even-y LSB-zero gate (canonical BIP-340 parity)

Circuit metrics: 26,802 wires, 41,443 quad terms, depth=9

Test suite (22 tests)

• Evaluation, full 19-vector Bitcoin Core validation
• ZK prover/verifier lifecycle with CRT backend
• Adversarial soundness mutations (public-input tampering, private-witness tampering, signature malleability)
• CRT capacity guard and parameter validation
• Multi-instance scaling
• Malformed-hex fixture hardening

Sage reference (docs/specs/code/)

• Standalone BIP-340 verification using Sage EC arithmetic
• Simplified Sage circuit with parity/bitness constraints
• Sumcheck prover/verifier lifecycle test
• Golden-fact tests comparing Sage invariants against JSON
• Mypy type stubs for sage.all, EllipticCurve, FiniteRingElement
• Fixture generator with strict upstream CSV header validation

[abhvious]

can you also add a readme explaining the purpose, and the circuit metrics.
in addition # of gates, what is the depth and # of witnesses ?

[jaromil]

Dear abhi, thanks for your prompt review! this is an holiday project so please consider I'll be a bit slow to answer. Just a heads up about the purpose of this circuit: I am trying to do a usable implementation of this paper: Improved Concurrent-Secure
Blind Schnorr Signatures by colleagues at Universita' La Sapienza in Rome. They used circom in their proof of concept and I'm fascinated by the opportunity to replace it with longfellow-zk and see this fairly complex construction work in real use-cases with decent timing. FTR I'm not using longfellow-zk only for Fuchsbauer & Wolf's PBS over BIP340, which is the part I'm hereby contributing upstream. Through my zkcc DSL on top of longfellow-zk I'm also implementing Niwi, but that's inside the final product which I'll ship in Zenroom. At last, my community version of longfellow-zk already includes this BIP340 circuit, so I'm not urging you to merge as it is already quite easy for me to maintain there. I'll follow up on other details before EOM, again very grateful for your review.

[jaromil]

Added lib/circuits/bip340/README.md with the circuit boundary, backend, and test commands. The circuit has 26,802 wires, 41,443 quadratic terms, depth 9, and 2,301 private witness elements.

[abhvious]

We would like to incorporate this circuit into the repository. Would you be willing to make the following changes:

(a) try to minimize the # of changes needed to support this circuit, e.g., do not include changes that are not necessary to convolution.h, etc.
(b) move the files that define the circuit and tests to lib/circuits/tests/contrib/bip340
(c) add a readme.md to that directory explaining what the circuit does, references to the paper, and perf numbers as a summary
(d) move all of the new files in the docs/specs dir to a specs dir under bip340. The docs/specs are meant as a spec of the longfellow system, not any of its circuits

we intend to make the contrib dir a place where experimental, contributed circuits are kept

-- i indeed also was interested in the blind-schnorr application from Georg, and more recently Ivan + students. I'm glad that you worked it out, but please give some more summary details on the performance, and in particular the design decisions that you made for selecting the primitives that Ivan uses to describe the scheme (e.g., the special commitment, etc).

[jaromil]

@abhvious addressed all your last remarks, hope it suffices.

[edit] just to be clear, this is not the blind-schnorr implementation of the construction by Della Monica & Visconti, which is way more complex and requires RPBSch + NIWI which I've implemented in Zenroom using the zkcc DSL to overcome its complexity. This is just what the README says and it is a useful primitive for that paper and other future developments.