sp1_sdk/

proof.rs

//! # SP1 Proof
//!
//! A library of types and functions for SP1 proofs.
#![allow(missing_docs)]

use std::{fmt::Debug, fs::File, path::Path};

use anyhow::{Context, Result};
use hashbrown::HashMap;
use p3_baby_bear::BabyBear;
use p3_field::{extension::BinomialExtensionField, AbstractField, PrimeField};
use p3_fri::{FriProof, TwoAdicFriPcsProof};
use serde::{Deserialize, Serialize};
use sp1_primitives::io::SP1PublicValues;
use sp1_prover::{Groth16Bn254Proof, HashableKey, PlonkBn254Proof, SP1ProvingKey};
use sp1_stark::{
    septic_digest::SepticDigest, SP1ReduceProof, ShardCommitment, ShardOpenedValues, ShardProof,
    StarkVerifyingKey,
};

pub use sp1_stark::{SP1Proof, SP1ProofMode};

/// A proof generated by the SP1 RISC-V zkVM bundled together with the public values and the
/// version.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct SP1ProofWithPublicValues {
    /// The raw proof generated by the SP1 RISC-V zkVM.
    pub proof: SP1Proof,
    /// The public values generated by the SP1 RISC-V zkVM.
    pub public_values: SP1PublicValues,
    /// The version of the SP1 RISC-V zkVM (not necessary but useful for detecting version
    /// mismatches).
    pub sp1_version: String,
    /// The integrity proof generated by the TEE server.
    pub tee_proof: Option<Vec<u8>>,
}

/// The proof generated by the prover network.
///
/// Since [`bincode`] is not self describing, it cannot handle "nullable" optional values.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct ProofFromNetwork {
    pub proof: SP1Proof,
    pub public_values: SP1PublicValues,
    pub sp1_version: String,
}

impl From<ProofFromNetwork> for SP1ProofWithPublicValues {
    fn from(value: ProofFromNetwork) -> Self {
        Self {
            proof: value.proof,
            public_values: value.public_values,
            sp1_version: value.sp1_version,
            tee_proof: None,
        }
    }
}

impl SP1ProofWithPublicValues {
    /// Creates a new [`SP1ProofWithPublicValues`] from the proof, public values, and SP1 version.
    ///
    /// If the [`tee`] feature is enabled, the proof field is set to none.
    pub(crate) const fn new(
        proof: SP1Proof,
        public_values: SP1PublicValues,
        sp1_version: String,
    ) -> Self {
        Self { proof, public_values, sp1_version, tee_proof: None }
    }

    /// Saves the proof to a path.
    pub fn save(&self, path: impl AsRef<Path>) -> Result<()> {
        bincode::serialize_into(
            File::create(path.as_ref()).with_context(|| {
                format!("failed to create file for saving proof: {}", path.as_ref().display())
            })?,
            self,
        )
        .map_err(Into::into)
    }

    /// Loads a proof from a path.
    pub fn load(path: impl AsRef<Path>) -> Result<Self> {
        // Try to load a [`Self`] from the file.
        let maybe_this: Result<Self> =
            bincode::deserialize_from(File::open(path.as_ref()).with_context(|| {
                format!("failed to open file for loading proof: {}", path.as_ref().display())
            })?)
            .map_err(Into::into);

        // This may be a proof from the prover network, which lacks the TEE proof field.
        match maybe_this {
            Ok(this) => Ok(this),
            Err(e) => {
                // If the file does not contain a [`Self`], try to load a [`ProofFromNetwork`]
                // instead.
                let maybe_proof_from_network: Result<ProofFromNetwork> =
                    bincode::deserialize_from(File::open(path.as_ref()).with_context(|| {
                        format!(
                            "failed to open file for loading proof: {}",
                            path.as_ref().display()
                        )
                    })?)
                    .map_err(Into::into);

                if let Ok(proof_from_network) = maybe_proof_from_network {
                    // The file contains a [`ProofFromNetwork`], which lacks the TEE proof field.
                    Ok(proof_from_network.into())
                } else {
                    // Return the original error from trying to load a [`Self`].
                    Err(e)
                }
            }
        }
    }

    /// The proof in the byte encoding the onchain verifiers accepts for [`SP1ProofMode::Groth16`]
    /// and [`SP1ProofMode::Plonk`] proofs.
    ///
    /// # Details
    /// The bytes consist of the first four bytes of Groth16/Plonk vkey hash followed by the encoded
    /// proof, in a form optimized for onchain verification.
    #[must_use]
    pub fn bytes(&self) -> Vec<u8> {
        match &self.proof {
            SP1Proof::Plonk(plonk_proof) => {
                // If the proof is empty, then this is a mock proof. The mock SP1 verifier
                // expects an empty byte array for verification, so return an empty byte array.
                if plonk_proof.encoded_proof.is_empty() {
                    return Vec::new();
                }

                let proof_bytes =
                    hex::decode(&plonk_proof.encoded_proof).expect("Invalid Plonk proof");

                if let Some(tee_proof) = &self.tee_proof {
                    return [
                        tee_proof.clone(),
                        plonk_proof.plonk_vkey_hash[..4].to_vec(),
                        proof_bytes,
                    ]
                    .concat();
                }

                [plonk_proof.plonk_vkey_hash[..4].to_vec(), proof_bytes].concat()
            }
            SP1Proof::Groth16(groth16_proof) => {
                // If the proof is empty, then this is a mock proof. The mock SP1 verifier
                // expects an empty byte array for verification, so return an empty byte array.
                if groth16_proof.encoded_proof.is_empty() {
                    return Vec::new();
                }

                let proof_bytes =
                    hex::decode(&groth16_proof.encoded_proof).expect("Invalid Groth16 proof");

                if let Some(tee_proof) = &self.tee_proof {
                    return [
                        tee_proof.clone(),
                        groth16_proof.groth16_vkey_hash[..4].to_vec(),
                        proof_bytes,
                    ]
                    .concat();
                }

                [groth16_proof.groth16_vkey_hash[..4].to_vec(), proof_bytes].concat()
            }
            proof => panic!(
                "Proof type {proof} is not supported for onchain verification. \
                Only Plonk and Groth16 proofs are verifiable onchain"
            ),
        }
    }

    /// Creates a mock proof for the specified proof mode from the public values.
    ///
    /// # Example
    /// ```rust,no_run
    /// use sp1_sdk::{
    ///     Prover, ProverClient, SP1ProofMode, SP1ProofWithPublicValues, SP1Stdin, SP1_CIRCUIT_VERSION,
    /// };
    ///
    /// let elf = &[1, 2, 3];
    /// let stdin = SP1Stdin::new();
    ///
    /// let client = ProverClient::builder().cpu().build();
    /// let (pk, vk) = client.setup(elf);
    /// let (public_values, _) = client.execute(&pk.elf, &stdin).run().unwrap();
    ///
    /// // Create a mock Plonk proof.
    /// let mock_proof = SP1ProofWithPublicValues::create_mock_proof(
    ///     &pk,
    ///     public_values,
    ///     SP1ProofMode::Plonk,
    ///     SP1_CIRCUIT_VERSION,
    /// );
    /// ```
    #[must_use]
    pub fn create_mock_proof(
        pk: &SP1ProvingKey,
        public_values: SP1PublicValues,
        mode: SP1ProofMode,
        sp1_version: &str,
    ) -> Self {
        let sp1_version = sp1_version.to_string();
        match mode {
            SP1ProofMode::Core => SP1ProofWithPublicValues {
                proof: SP1Proof::Core(vec![]),
                public_values,
                sp1_version,

                tee_proof: None,
            },
            SP1ProofMode::Compressed => {
                let shard_proof = ShardProof {
                    commitment: ShardCommitment {
                        main_commit: [BabyBear::zero(); 8].into(),
                        permutation_commit: [BabyBear::zero(); 8].into(),
                        quotient_commit: [BabyBear::zero(); 8].into(),
                    },
                    opened_values: ShardOpenedValues { chips: vec![] },
                    opening_proof: TwoAdicFriPcsProof {
                        fri_proof: FriProof {
                            commit_phase_commits: vec![],
                            query_proofs: vec![],
                            final_poly: BinomialExtensionField::default(),
                            pow_witness: BabyBear::zero(),
                        },
                        query_openings: vec![],
                    },
                    chip_ordering: HashMap::new(),
                    public_values: vec![],
                };

                let reduce_vk = StarkVerifyingKey {
                    commit: [BabyBear::zero(); 8].into(),
                    pc_start: BabyBear::zero(),
                    chip_information: vec![],
                    chip_ordering: HashMap::new(),
                    initial_global_cumulative_sum: SepticDigest::zero(),
                };

                let proof = SP1Proof::Compressed(Box::new(SP1ReduceProof {
                    vk: reduce_vk,
                    proof: shard_proof,
                }));

                SP1ProofWithPublicValues { proof, public_values, sp1_version, tee_proof: None }
            }
            SP1ProofMode::Plonk => SP1ProofWithPublicValues {
                proof: SP1Proof::Plonk(PlonkBn254Proof {
                    public_inputs: [
                        pk.vk.hash_bn254().as_canonical_biguint().to_string(),
                        public_values.hash_bn254().to_string(),
                    ],
                    encoded_proof: String::new(),
                    raw_proof: String::new(),
                    plonk_vkey_hash: [0; 32],
                }),
                public_values,
                sp1_version,

                tee_proof: None,
            },
            SP1ProofMode::Groth16 => SP1ProofWithPublicValues {
                proof: SP1Proof::Groth16(Groth16Bn254Proof {
                    public_inputs: [
                        pk.vk.hash_bn254().as_canonical_biguint().to_string(),
                        public_values.hash_bn254().to_string(),
                    ],
                    encoded_proof: String::new(),
                    raw_proof: String::new(),
                    groth16_vkey_hash: [0; 32],
                }),
                public_values,
                sp1_version,

                tee_proof: None,
            },
        }
    }
}

#[cfg(test)]
mod tests {
    #![allow(clippy::print_stdout)]

    use super::*;

    #[test]
    fn test_plonk_proof_bytes() {
        let plonk_proof = SP1ProofWithPublicValues {
            proof: SP1Proof::Plonk(PlonkBn254Proof {
                encoded_proof: "ab".to_string(),
                plonk_vkey_hash: [0; 32],
                public_inputs: [String::new(), String::new()],
                raw_proof: String::new(),
            }),
            public_values: SP1PublicValues::new(),
            sp1_version: String::new(),
            tee_proof: None,
        };
        let expected_bytes = [vec![0, 0, 0, 0], hex::decode("ab").unwrap()].concat();
        assert_eq!(plonk_proof.bytes(), expected_bytes);
    }

    #[test]
    fn test_groth16_proof_bytes() {
        let groth16_proof = SP1ProofWithPublicValues {
            proof: SP1Proof::Groth16(Groth16Bn254Proof {
                encoded_proof: "ab".to_string(),
                groth16_vkey_hash: [0; 32],
                public_inputs: [String::new(), String::new()],
                raw_proof: String::new(),
            }),
            public_values: SP1PublicValues::new(),
            sp1_version: String::new(),
            tee_proof: None,
        };
        let expected_bytes = [vec![0, 0, 0, 0], hex::decode("ab").unwrap()].concat();
        assert_eq!(groth16_proof.bytes(), expected_bytes);
    }

    #[test]
    fn test_mock_plonk_proof_bytes() {
        let mock_plonk_proof = SP1ProofWithPublicValues {
            proof: SP1Proof::Plonk(PlonkBn254Proof {
                encoded_proof: String::new(),
                plonk_vkey_hash: [0; 32],
                public_inputs: [String::new(), String::new()],
                raw_proof: String::new(),
            }),
            public_values: SP1PublicValues::new(),
            sp1_version: String::new(),
            tee_proof: None,
        };
        assert_eq!(mock_plonk_proof.bytes(), Vec::<u8>::new());
    }

    #[test]
    fn test_mock_groth16_proof_bytes() {
        let mock_groth16_proof = SP1ProofWithPublicValues {
            proof: SP1Proof::Groth16(Groth16Bn254Proof {
                encoded_proof: String::new(),
                groth16_vkey_hash: [0; 32],
                public_inputs: [String::new(), String::new()],
                raw_proof: String::new(),
            }),
            public_values: SP1PublicValues::new(),
            sp1_version: String::new(),
            tee_proof: None,
        };
        assert_eq!(mock_groth16_proof.bytes(), Vec::<u8>::new());
    }

    #[test]
    #[should_panic(
        expected = "Proof type Core is not supported for onchain verification. Only Plonk and Groth16 proofs are verifiable onchain"
    )]
    fn test_core_proof_bytes_unimplemented() {
        let core_proof = SP1ProofWithPublicValues {
            proof: SP1Proof::Core(vec![]),
            public_values: SP1PublicValues::new(),
            sp1_version: String::new(),
            tee_proof: None,
        };
        println!("{:?}", core_proof.bytes());
    }

    #[test]
    fn test_deser_backwards_compat() {
        let round_trip = SP1ProofWithPublicValues {
            proof: SP1Proof::Core(vec![]),
            public_values: SP1PublicValues::new(),
            sp1_version: String::new(),
            tee_proof: None,
        };

        let round_trip_bytes = bincode::serialize(&round_trip).unwrap();

        bincode::deserialize::<SP1ProofWithPublicValues>(&round_trip_bytes).unwrap();

        let _ = ProofFromNetwork {
            proof: SP1Proof::Core(vec![]),
            public_values: SP1PublicValues::new(),
            sp1_version: String::new(),
        };

        let _ = bincode::deserialize::<ProofFromNetwork>(&round_trip_bytes).unwrap();
    }

    #[test]
    fn test_round_trip_proof_save_load() {
        use crate::Prover;

        let prover = crate::CpuProver::new();
        let (pk, _) = prover.setup(test_artifacts::FIBONACCI_BLAKE3_ELF);
        let proof = prover.prove(&pk, &crate::SP1Stdin::new()).compressed().run().unwrap();

        // Verify the original proof
        prover.verify(&proof, &pk.vk).unwrap();

        let temp_dir = tempfile::tempdir().unwrap();
        let path = temp_dir.path().join("proof.bin");
        std::fs::File::create(&path).unwrap();
        proof.save(&path).unwrap();

        let proof_loaded = SP1ProofWithPublicValues::load(&path).unwrap();

        // Verify the loaded proof
        prover.verify(&proof_loaded, &pk.vk).unwrap();
    }
}