readding groth16 proofs

Author: Ryan Quinn Ford

src/cfg.rs

@@ -9,7 +9,6 @@ use config::{builder::DefaultState, ConfigBuilder, File};
 use dirs::home_dir;
 use dotenvy::dotenv;
 use serde::{Deserialize, Serialize};
-use std::path::PathBuf;
 use std::{fs, path::Path, sync::Arc};
 
 use crate::da::{celestia::CelestiaConnection, DataAvailabilityLayer};

src/circuits/hashchain.rs

@@ -0,0 +1,55 @@
+use crate::common::HashchainEntry;
+use anyhow::Result;
+use bellman::{Circuit, ConstraintSystem, SynthesisError};
+use bls12_381::Scalar;
+use indexed_merkle_tree::sha256_mod;
+
+/// HashChainEntryCircuit is a circuit that verifies that a given value is present in a hashchain.
+#[derive(Clone)]
+pub struct HashChainEntryCircuit {
+    pub value: Scalar,
+    /// Represents the hashchain in the form of a vector of Scalars.
+    /// Each Scalar is sha256_mod(hashchain_entry.value())
+    pub chain: Vec<Scalar>,
+}
+
+impl HashChainEntryCircuit {
+    pub fn create(value: &str, hashchain: Vec<HashchainEntry>) -> Result<HashChainEntryCircuit> {
+        let hashed_value = sha256_mod(value.as_bytes());
+        let parsed_value = hashed_value.try_into()?;
+        let mut parsed_hashchain: Vec<Scalar> = vec![];
+        for entry in hashchain {
+            let hashed_entry_value = sha256_mod(entry.operation.value().as_bytes());
+            parsed_hashchain.push(hashed_entry_value.try_into()?)
+        }
+        Ok(HashChainEntryCircuit {
+            value: parsed_value,
+            chain: parsed_hashchain,
+        })
+    }
+}
+
+impl Circuit<Scalar> for HashChainEntryCircuit {
+    fn synthesize<CS: ConstraintSystem<Scalar>>(self, cs: &mut CS) -> Result<(), SynthesisError> {
+        if self.chain.is_empty() {
+            return Err(SynthesisError::AssignmentMissing);
+        }
+
+        let provided_value = cs.alloc_input(|| "provided hashed value", || Ok(self.value))?;
+
+        for entry in self.chain {
+            if entry == self.value {
+                let found_value = cs.alloc(|| "found hashed value", || Ok(entry))?;
+                // found_value * (1) = provided_value
+                cs.enforce(
+                    || "found value check",
+                    |lc| lc + found_value,
+                    |lc| lc + CS::one(),
+                    |lc| lc + provided_value,
+                );
+                return Ok(());
+            }
+        }
+        Err(SynthesisError::Unsatisfiable)
+    }
+}

src/circuits/less_than.rs

@@ -0,0 +1,66 @@
+use anyhow::Result;
+use bellman::{gadgets::boolean::Boolean, Circuit, ConstraintSystem, SynthesisError};
+use bls12_381::Scalar;
+use ff::PrimeFieldBits;
+
+#[derive(Clone)]
+pub struct LessThanCircuit {
+    a: Scalar,
+    b: Scalar,
+}
+
+impl LessThanCircuit {
+    pub fn new(a: Scalar, b: Scalar) -> LessThanCircuit {
+        LessThanCircuit { a, b }
+    }
+}
+
+impl Circuit<Scalar> for LessThanCircuit {
+    fn synthesize<CS: ConstraintSystem<Scalar>>(self, cs: &mut CS) -> Result<(), SynthesisError> {
+        let a_bits = self.a.to_le_bits();
+        let b_bits = self.b.to_le_bits();
+
+        let mut result = Boolean::constant(false);
+
+        // Iterate over the bits from most significant to least significant
+        for i in (0..a_bits.len()).rev() {
+            let a_val = Boolean::constant(a_bits[i]);
+            let b_val = Boolean::constant(b_bits[i]);
+            let not_a = a_val.not();
+            let not_b = b_val.not();
+
+            // Check if bits are equal (both 1 or both 0)
+            let a_and_b = Boolean::and(cs.namespace(|| format!("a_and_b_{}", i)), &a_val, &b_val)?;
+            let not_a_and_not_b = Boolean::and(
+                cs.namespace(|| format!("not_a_and_not_b_{}", i)),
+                &not_a,
+                &not_b,
+            )?;
+
+            // If the bits are equal, continue to the next bit
+            if not_a_and_not_b.get_value().unwrap() || a_and_b.get_value().unwrap() {
+                continue;
+            } else {
+                // If bits differ: b > a if b_bit = 1 && a_bit = 0
+                result = Boolean::and(
+                    cs.namespace(|| format!("b_and_not_a_{}", i)),
+                    &b_val,
+                    &not_a,
+                )?;
+                break;
+            }
+        }
+
+        // Enforce the constraint that the result is correct
+        // If result is true, then a < b, otherwise a >= b
+        // result * (1) = 1
+        cs.enforce(
+            || "a < b",
+            |_| result.lc(CS::one(), Scalar::one()),
+            |lc| lc + CS::one(),
+            |lc| lc + CS::one(),
+        );
+
+        Ok(())
+    }
+}

src/circuits/merkle_batch.rs

@@ -0,0 +1,149 @@
+use crate::{
+    circuits::{
+        merkle_insertion::prove_insertion, merkle_update::prove_update, InsertMerkleProofCircuit,
+        ProofVariantCircuit, UpdateMerkleProofCircuit,
+    },
+    tree::Digest,
+    utils::create_and_verify_snark,
+};
+use anyhow::Result;
+use bellman::{groth16, Circuit, ConstraintSystem, SynthesisError};
+use bls12_381::{Bls12, Scalar};
+use indexed_merkle_tree::tree::Proof;
+
+/// BatchMerkleProofCircuit represents a circuit for proving a batch of merkle proof circuits.
+#[derive(Clone)]
+pub struct BatchMerkleProofCircuit {
+    pub old_commitment: Scalar,
+    pub new_commitment: Scalar,
+    pub proofs: Vec<ProofVariantCircuit>,
+}
+
+impl BatchMerkleProofCircuit {
+    pub fn new(
+        old_commitment: &Digest,
+        new_commitment: &Digest,
+        proofs: Vec<Proof>,
+    ) -> Result<BatchMerkleProofCircuit> {
+        let parsed_old_commitment: Scalar = (*old_commitment).try_into()?;
+        let parsed_new_commitment: Scalar = (*new_commitment).try_into()?;
+        let mut proof_circuit_array: Vec<ProofVariantCircuit> = vec![];
+        for proof in proofs {
+            match proof {
+                Proof::Update(update_proof) => {
+                    proof_circuit_array.push(ProofVariantCircuit::Update(
+                        UpdateMerkleProofCircuit::new(&update_proof)?,
+                    ));
+                }
+                Proof::Insert(insertion_proof) => {
+                    proof_circuit_array.push(ProofVariantCircuit::Insert(
+                        InsertMerkleProofCircuit::new(&insertion_proof)?,
+                    ));
+                }
+            }
+        }
+        Ok(BatchMerkleProofCircuit {
+            old_commitment: parsed_old_commitment,
+            new_commitment: parsed_new_commitment,
+            proofs: proof_circuit_array,
+        })
+    }
+
+    pub fn create_and_verify_snark(
+        &self,
+    ) -> Result<(groth16::Proof<Bls12>, groth16::VerifyingKey<Bls12>)> {
+        let scalars: Vec<Scalar> = vec![self.old_commitment, self.new_commitment];
+
+        create_and_verify_snark(ProofVariantCircuit::Batch(self.clone()), scalars)
+    }
+}
+
+impl Circuit<Scalar> for BatchMerkleProofCircuit {
+    fn synthesize<CS: ConstraintSystem<Scalar>>(self, cs: &mut CS) -> Result<(), SynthesisError> {
+        // If the proofs are empty, we just verify that the commitments are equal
+        if self.proofs.is_empty() {
+            let provided_old_commitment =
+                cs.alloc_input(|| "provided old commitment", || Ok(self.old_commitment))?;
+            let provided_new_commitment =
+                cs.alloc_input(|| "provided new commitment", || Ok(self.new_commitment))?;
+
+            // provided_old_commitment * (1) = provided_new_commitment
+            cs.enforce(
+                || "old commitment check",
+                |lc| lc + provided_old_commitment,
+                |lc| lc + CS::one(),
+                |lc| lc + provided_new_commitment,
+            );
+
+            return Ok(());
+        }
+
+        // before the calculations make sure that the old root is that of the first proof
+        let old_root = match &self.proofs[0] {
+            ProofVariantCircuit::Update(update_proof_circuit) => update_proof_circuit.old_root,
+            ProofVariantCircuit::Insert(insert_proof_circuit) => {
+                insert_proof_circuit.pre_insertion_root
+            }
+            ProofVariantCircuit::Batch(batch_proof_circuit) => batch_proof_circuit.old_commitment,
+        };
+
+        let provided_old_commitment =
+            cs.alloc_input(|| "provided old commitment", || Ok(self.old_commitment))?;
+        let old_commitment_from_proofs =
+            cs.alloc(|| "old commitment from proofs", || Ok(old_root))?;
+
+        // old_commitment_from_proofs * (1) = provided_old_commitment
+        cs.enforce(
+            || "old commitment check",
+            |lc| lc + old_commitment_from_proofs,
+            |lc| lc + CS::one(),
+            |lc| lc + provided_old_commitment,
+        );
+
+        let mut new_commitment: Scalar = Scalar::zero();
+        for proof in self.proofs {
+            // update the new_commitment for every proof, applying the constraints of the circuit each time
+            match proof {
+                ProofVariantCircuit::Update(update_proof_circuit) => {
+                    new_commitment = prove_update(
+                        cs,
+                        update_proof_circuit.old_root,
+                        &update_proof_circuit.old_path,
+                        update_proof_circuit.updated_root,
+                        &update_proof_circuit.updated_path,
+                    )?;
+                }
+                ProofVariantCircuit::Insert(insert_proof_circuit) => {
+                    new_commitment = prove_insertion(
+                        cs,
+                        insert_proof_circuit.pre_insertion_root,
+                        &insert_proof_circuit.insertion_path,
+                        insert_proof_circuit.new_leaf_node,
+                        insert_proof_circuit.existing_leaf_update,
+                        insert_proof_circuit.new_leaf_activation,
+                    )?;
+                }
+                ProofVariantCircuit::Batch(_) => {
+                    // Batches cannot be recursively constructed
+                    // TODO: Should they be able to?
+                    return Err(SynthesisError::Unsatisfiable);
+                }
+            }
+        }
+
+        let provided_new_commitment =
+            cs.alloc_input(|| "provided commitment", || Ok(self.new_commitment))?;
+        let recalculated_new_commitment =
+            cs.alloc(|| "recalculated commitment", || Ok(new_commitment))?;
+
+        // recalculated_commitment * (1) = provided_commitment
+        cs.enforce(
+            || "new commitment check",
+            |lc| lc + recalculated_new_commitment,
+            |lc| lc + CS::one(),
+            |lc| lc + provided_new_commitment,
+        );
+
+        Ok(())
+    }
+}