2 releases
Uses old Rust 2015
0.0.2 | Oct 26, 2018 |
---|---|
0.0.1 | Oct 26, 2018 |
#8 in #groth16
160KB
3.5K
SLoC
Zero Knowledge SNARKs
This library is not ready for production.
This crate provides functionality for creating and using zero knowledge proofs. The implementation is based on groth16.
Usage
The main functions of the alrotihm are the setup
, prove
and verify
functions in the groth16
module. Intermediate representations can be
generated from .zk files, which are written in a DSL that represents an
arithmetic circuit.
Language
The language for representing arithmetic circuits is quite basic and is
written in a lisp-esque style that uses parenthesised prefix notation. The
following is an example program for a circuit that computes a quadratic
polynomial y = ax^2 + bx + c
:
(in x a b c)
(out y)
(verify x y)
(program
(= t1
(* x a))
(= t2
(* x (+ t1 b)))
(= y
(* 1 (+ t2 c))))
The order must always follow in
, out
, verify
and then program
.
Currently parentheses are 'sticky' in that there must not be any whitespace
between them and their interior tokens. The keywords are as follows:
in
precedes the list of input wires to the circuit, excluding the constant unity wire.out
precedes the list of output wires from the circuit.verify
precedes the list of wires that the verifier will check by providing them as input in the verification process.program
precedes the list of multiplication subcircuits that constitute the entire arithmetic circuit. The multiplication subcircuits model a single multiplication gate that has fan in two, where the two inputs can be a linear combination of any number of circuit inputs and previous internal wires. They use the following keywords.=
is the assignment operator, which takes two arguments. The first is the variable that is being assigned to, and represents the output wire of the multiplication gate. The second is the expression being assigned, and represents the linear combination of input wires.*
is the multiplication operator, which is used both for the multiplication gate and also to represent the constant scaling in the linear combination inputs to the multiplication gate. It takes only two arguments; when used for a multiplication gate the order does not matter, but for constant scaling the constant must be the first argument.+
is the addition operator, and as stated before can have an arbitrary number of arguments. Each argument can either be a variable, or a scaled variable (i.e. it can either look likex
, or, for example, like(* 5 x)
).
Examples
As an example, consider the simple arithmetic expression x = 4ab + c + 6
.
We want to verify the wires x
and b
. The program file can look like the
following:
(in a b c)
(out x)
(verify b x)
(program
(= temp
(* a b))
(= x
(* 1 (+ (* 4 temp) c 6))))
Suppose that the prove wants to prove that they know values a
and c
for
which the circuit is satisfied when the verifier inputs b = 2
and x = 34
. The following code is an example of the setup, prove and verify
process.
extern crate zksnark;
use zksnark::groth16;
use zksnark::groth16::{Proof, SigmaG1, SigmaG2, QAP};
use zksnark::groth16::circuit::{ASTParser, TryParse};
use zksnark::groth16::fr::FrLocal;
use zksnark::groth16::coefficient_poly::CoefficientPoly;
// x = 4ab + c + 6
let code = &*::std::fs::read_to_string("test_programs/simple.zk").unwrap();
let qap: QAP<CoefficientPoly<FrLocal>> =
ASTParser::try_parse(code)
.unwrap()
.into();
// The assignments are the inputs to the circuit in the order they
// appear in the file
let assignments = &[
3.into(), // a
2.into(), // b
4.into(), // c
];
let weights = groth16::weights(code, assignments).unwrap();
let (sigmag1, sigmag2) = groth16::setup(&qap);
let proof = groth16::prove(&qap, (&sigmag1, &sigmag2), &weights);
assert!(groth16::verify(
&qap,
(sigmag1, sigmag2),
&vec![FrLocal::from(2), FrLocal::from(34)],
proof
));
Dependencies
~4MB
~28K SLoC