uzkge 0.1.2

App-specific PlonK with various gadgets & primitives
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131

use ark_ff::PrimeField;
use itertools::Itertools;

use crate::{
    plonk::constraint_system::{turbo::N_WIRE_SELECTORS, TurboCS},
    shuffle::RemarkTrace,
};

use super::CardVar;

impl<F: PrimeField> TurboCS<F> {
    /// Insert the 'remark' operation within the constraint system.
    pub fn eval_card_remark(&mut self, trace: &RemarkTrace<F>, input_var: &CardVar) -> CardVar {
        assert_eq!(trace.bits.len(), trace.n_round);
        assert_eq!(trace.intermediate_values.len(), trace.n_round);
        assert_eq!(self.n_iteration_shuffle_scalar_mul, trace.n_round);

        // Wire selector variables are not allocated in the constraint system,
        // because they do not have copy constraints.
        let bits = (0..N_WIRE_SELECTORS)
            .map(|i| trace.bits.iter().map(|x| x[i]).collect_vec())
            .collect_vec();
        self.attach_shuffle_remark_constraints_to_gate(bits.try_into().unwrap());

        let mut intermediate_value_vars = Vec::with_capacity(trace.n_round);
        for values in trace.intermediate_values.iter() {
            let mut vars = vec![];
            for x in values.iter() {
                vars.push(self.new_variable(*x));
            }
            intermediate_value_vars.push(vars);
        }

        let zero = F::zero();

        {
            //  Create gates for input values.
            self.push_add_selectors(zero, zero, zero, zero);
            self.push_mul_selectors(zero, zero);
            self.push_constant_selector(zero);
            self.push_ecc_selector(zero);
            self.push_out_selector(zero);

            self.wiring[0].push(input_var.get_first_x()); // input_0
            self.wiring[1].push(input_var.get_first_y()); // input_1
            self.wiring[2].push(input_var.get_second_x()); // input_2
            self.wiring[3].push(input_var.get_second_y()); // input_3
            self.wiring[4].push(intermediate_value_vars[0][3]); // g_y_0

            self.finish_new_gate();
        }

        //  Create gates for all intermediate values except the last one.
        for r in 0..trace.n_round - 1 {
            self.push_add_selectors(zero, zero, zero, zero);
            self.push_mul_selectors(zero, zero);
            self.push_constant_selector(zero);
            self.push_ecc_selector(zero);
            self.push_out_selector(zero);

            self.wiring[0].push(intermediate_value_vars[r][0]); // pk_x_r
            self.wiring[1].push(intermediate_value_vars[r][1]); // pk_y_r
            self.wiring[2].push(intermediate_value_vars[r][2]); // g_x_r
            self.wiring[3].push(intermediate_value_vars[r][3]); // g_y_r
            self.wiring[4].push(intermediate_value_vars[r + 1][3]); // g_y_{r+1}

            self.finish_new_gate();
        }

        //  Create the last gate with its output wire equal to 0.
        {
            self.push_add_selectors(zero, zero, zero, zero);
            self.push_mul_selectors(zero, zero);
            self.push_constant_selector(zero);
            self.push_ecc_selector(zero);
            self.push_out_selector(zero);

            self.wiring[0].push(intermediate_value_vars[trace.n_round - 1][0]); // pk_x_{r+1}
            self.wiring[1].push(intermediate_value_vars[trace.n_round - 1][1]); // pk_y_{r+1}
            self.wiring[2].push(intermediate_value_vars[trace.n_round - 1][2]); // g_x_{r+1}
            self.wiring[3].push(intermediate_value_vars[trace.n_round - 1][3]); // g_y_{r+1}
            self.wiring[4].push(self.zero_var()); // zero

            self.finish_new_gate();
        }

        CardVar::new(
            &intermediate_value_vars[trace.n_round - 1]
                .clone()
                .try_into()
                .unwrap(),
        )
    }
}

#[cfg(test)]
mod test {
    use ark_ec::PrimeGroup;
    use ark_ed_on_bn254::{EdwardsProjective, Fr};
    use ark_std::{rand::SeedableRng, UniformRand};
    use rand_chacha::ChaChaRng;

    use crate::{
        plonk::constraint_system::TurboCS,
        shuffle::{BabyJubjubShuffle, Ciphertext, Remark},
    };

    #[test]
    fn test_remark_constraint_system() {
        let mut prng = ChaChaRng::from_entropy();

        let secret = Fr::rand(&mut prng);
        let public = EdwardsProjective::generator() * secret;

        let m = EdwardsProjective::rand(&mut prng);
        let input = Ciphertext::encrypt(&mut prng, &m, &public);

        let bits = BabyJubjubShuffle::sample_random_scalar_bits(&mut prng);
        let trace = BabyJubjubShuffle::eval_remark_with_trace(&input, &bits, &public);

        let mut cs = TurboCS::new();
        cs.load_shuffle_remark_parameters::<_, BabyJubjubShuffle>(&public);

        let input_vars = cs.new_card_variable(&input);
        let output_vars = cs.eval_card_remark(&trace, &input_vars);
        cs.prepare_pi_card_variable(&output_vars);

        let witness = cs.get_and_clear_witness();
        cs.verify_witness(&witness, &trace.output).unwrap();
    }
}