Add SignedPod verification circuit (SignedPodVerifyGadget) (#170)
* add boolean selector to the MerkleProofGadget, to allow skipping proof verifications when all the slots are not used (eg. in the SignedPod circuit) * move existing signedpod's circuits draft to its own file * implement SignedPodVerify circuit
This commit is contained in:
arnaucube
GitHub
parent
0637f52573
commit
4a94b34792
7 changed files with 357 additions and 182 deletions
|
|
@ -23,103 +23,16 @@ use crate::backends::plonky2::primitives::merkletree::MerkleTree;
|
|||
use crate::backends::plonky2::primitives::merkletree::{
|
||||
MerkleProofExistenceGadget, MerkleProofExistenceTarget,
|
||||
};
|
||||
use crate::backends::plonky2::signedpod::SignedPod;
|
||||
use crate::middleware::{
|
||||
hash_str, AnchoredKey, NativeOperation, NativePredicate, Params, PodType, Statement,
|
||||
StatementArg, ToFields, KEY_TYPE, SELF,
|
||||
};
|
||||
|
||||
use super::common::Flattenable;
|
||||
|
||||
//
|
||||
// SignedPod verification
|
||||
//
|
||||
|
||||
struct SignedPodVerifyGadget {
|
||||
params: Params,
|
||||
}
|
||||
|
||||
impl SignedPodVerifyGadget {
|
||||
fn eval(&self, builder: &mut CircuitBuilder<F, D>) -> Result<SignedPodVerifyTarget> {
|
||||
// 2. Verify id
|
||||
let id = builder.add_virtual_hash();
|
||||
let mut mt_proofs = Vec::new();
|
||||
for _ in 0..self.params.max_signed_pod_values {
|
||||
let mt_proof = MerkleProofExistenceGadget {
|
||||
max_depth: self.params.max_depth_mt_gadget,
|
||||
}
|
||||
.eval(builder)?;
|
||||
builder.connect_hashes(id, mt_proof.root);
|
||||
mt_proofs.push(mt_proof);
|
||||
}
|
||||
|
||||
// 1. Verify type
|
||||
let type_mt_proof = &mt_proofs[0];
|
||||
let key_type = builder.constant_value(hash_str(KEY_TYPE).into());
|
||||
builder.connect_values(type_mt_proof.key, key_type);
|
||||
let value_type = builder.constant_value(Value::from(PodType::MockSigned));
|
||||
builder.connect_values(type_mt_proof.value, value_type);
|
||||
|
||||
// 3. TODO: Verify signature
|
||||
|
||||
Ok(SignedPodVerifyTarget {
|
||||
params: self.params.clone(),
|
||||
id,
|
||||
mt_proofs,
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
struct SignedPodVerifyTarget {
|
||||
params: Params,
|
||||
id: HashOutTarget,
|
||||
// The KEY_TYPE entry must be the first one
|
||||
// The KEY_SIGNER entry must be the second one
|
||||
mt_proofs: Vec<MerkleProofExistenceTarget>,
|
||||
}
|
||||
|
||||
struct SignedPodVerifyInput {
|
||||
kvs: HashMap<Value, Value>,
|
||||
}
|
||||
|
||||
impl SignedPodVerifyTarget {
|
||||
fn kvs(&self) -> Vec<(ValueTarget, ValueTarget)> {
|
||||
let mut kvs = Vec::new();
|
||||
for mt_proof in &self.mt_proofs {
|
||||
kvs.push((mt_proof.key, mt_proof.value));
|
||||
}
|
||||
// TODO: when the slot is unused, do we force the kv to be (EMPTY, EMPTY), and then from
|
||||
// it get a ValueOf((id, EMPTY), EMPTY)? Or should we keep some boolean flags for unused
|
||||
// slots and translate them to Statement::None instead?
|
||||
kvs
|
||||
}
|
||||
|
||||
fn pub_statements(&self) -> Vec<StatementTarget> {
|
||||
// TODO: Here we need to use the self.id in the ValueOf statements
|
||||
todo!()
|
||||
}
|
||||
|
||||
fn set_targets(&self, pw: &mut PartialWitness<F>, input: &SignedPodVerifyInput) -> Result<()> {
|
||||
assert!(input.kvs.len() <= self.params.max_signed_pod_values);
|
||||
let tree = MerkleTree::new(self.params.max_depth_mt_gadget, &input.kvs)?;
|
||||
|
||||
// First handle the type entry, then the rest of the entries, and finally pad with
|
||||
// repetitions of the type entry (which always exists)
|
||||
let mut kvs = input.kvs.clone();
|
||||
let key_type = Value::from(hash_str(KEY_TYPE));
|
||||
let value_type = kvs.remove(&key_type).expect("KEY_TYPE");
|
||||
|
||||
for (i, (k, v)) in iter::once((key_type, value_type))
|
||||
.chain(kvs.into_iter().sorted_by_key(|kv| kv.0))
|
||||
.chain(iter::repeat((key_type, value_type)))
|
||||
.take(self.params.max_signed_pod_values)
|
||||
.enumerate()
|
||||
{
|
||||
let (_, proof) = tree.prove(&k)?;
|
||||
self.mt_proofs[i].set_targets(pw, tree.root(), proof, k, v)?;
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
}
|
||||
use super::{
|
||||
common::Flattenable,
|
||||
signedpod::{SignedPodVerifyGadget, SignedPodVerifyTarget},
|
||||
};
|
||||
|
||||
//
|
||||
// MainPod verification
|
||||
|
|
@ -450,7 +363,7 @@ struct MainPodVerifyTarget {
|
|||
}
|
||||
|
||||
struct MainPodVerifyInput {
|
||||
signed_pods: Vec<SignedPodVerifyInput>,
|
||||
signed_pods: Vec<SignedPod>,
|
||||
}
|
||||
|
||||
impl MainPodVerifyTarget {
|
||||
|
|
@ -489,6 +402,8 @@ impl MainPodVerifyCircuit {
|
|||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use plonky2::plonk::{circuit_builder::CircuitBuilder, circuit_data::CircuitConfig};
|
||||
|
||||
use super::*;
|
||||
use crate::backends::plonky2::mock::mainpod;
|
||||
use crate::backends::plonky2::{
|
||||
|
|
@ -496,36 +411,6 @@ mod tests {
|
|||
mock::mainpod::{OperationArg, OperationAux},
|
||||
};
|
||||
use crate::middleware::{OperationType, PodId};
|
||||
use plonky2::plonk::{circuit_builder::CircuitBuilder, circuit_data::CircuitConfig};
|
||||
|
||||
#[test]
|
||||
fn test_signed_pod_verify() -> Result<()> {
|
||||
let params = Params::default();
|
||||
|
||||
let config = CircuitConfig::standard_recursion_config();
|
||||
let mut builder = CircuitBuilder::<F, D>::new(config);
|
||||
|
||||
let signed_pod_verify = SignedPodVerifyGadget { params }.eval(&mut builder)?;
|
||||
|
||||
let mut pw = PartialWitness::<F>::new();
|
||||
let kvs = [
|
||||
(
|
||||
Value::from(hash_str(KEY_TYPE)),
|
||||
Value::from(PodType::MockSigned),
|
||||
),
|
||||
(Value::from(hash_str("foo")), Value::from(42)),
|
||||
]
|
||||
.into();
|
||||
let input = SignedPodVerifyInput { kvs };
|
||||
signed_pod_verify.set_targets(&mut pw, &input)?;
|
||||
|
||||
// generate & verify proof
|
||||
let data = builder.build::<C>();
|
||||
let proof = data.prove(pw)?;
|
||||
data.verify(proof)?;
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
fn operation_verify(
|
||||
st: mainpod::Statement,
|
||||
|
|
|
|||
|
|
@ -1,2 +1,3 @@
|
|||
pub mod common;
|
||||
pub mod mainpod;
|
||||
pub mod signedpod;
|
||||
|
|
|
|||
202
src/backends/plonky2/circuits/signedpod.rs
Normal file
202
src/backends/plonky2/circuits/signedpod.rs
Normal file
|
|
@ -0,0 +1,202 @@
|
|||
use anyhow::Result;
|
||||
use itertools::Itertools;
|
||||
use plonky2::{
|
||||
hash::hash_types::{HashOut, HashOutTarget},
|
||||
iop::witness::{PartialWitness, WitnessWrite},
|
||||
plonk::circuit_builder::CircuitBuilder,
|
||||
};
|
||||
|
||||
use crate::backends::plonky2::{
|
||||
basetypes::{Value, D, EMPTY_VALUE, F},
|
||||
circuits::common::{CircuitBuilderPod, StatementTarget, ValueTarget},
|
||||
primitives::{
|
||||
merkletree::{MerkleProof, MerkleProofExistenceGadget, MerkleProofExistenceTarget},
|
||||
signature::{PublicKey, SignatureVerifyGadget, SignatureVerifyTarget},
|
||||
},
|
||||
signedpod::SignedPod,
|
||||
};
|
||||
use crate::middleware::{hash_str, Params, PodType, KEY_SIGNER, KEY_TYPE};
|
||||
|
||||
pub struct SignedPodVerifyGadget {
|
||||
pub params: Params,
|
||||
}
|
||||
|
||||
impl SignedPodVerifyGadget {
|
||||
pub fn eval(&self, builder: &mut CircuitBuilder<F, D>) -> Result<SignedPodVerifyTarget> {
|
||||
// 1. Verify id
|
||||
let id = builder.add_virtual_hash();
|
||||
let mut mt_proofs = Vec::new();
|
||||
for _ in 0..self.params.max_signed_pod_values {
|
||||
let mt_proof = MerkleProofExistenceGadget {
|
||||
max_depth: self.params.max_depth_mt_gadget,
|
||||
}
|
||||
.eval(builder)?;
|
||||
builder.connect_hashes(id, mt_proof.root);
|
||||
mt_proofs.push(mt_proof);
|
||||
}
|
||||
|
||||
// 2. Verify type
|
||||
let type_mt_proof = &mt_proofs[0];
|
||||
let key_type = builder.constant_value(hash_str(KEY_TYPE).into());
|
||||
builder.connect_values(type_mt_proof.key, key_type);
|
||||
let value_type = builder.constant_value(Value::from(PodType::Signed));
|
||||
builder.connect_values(type_mt_proof.value, value_type);
|
||||
|
||||
// 3.a. Verify signature
|
||||
let signature = SignatureVerifyGadget {}.eval(builder)?;
|
||||
|
||||
// 3.b. Verify signer (ie. signature.pk == merkletree.signer_leaf)
|
||||
let signer_mt_proof = &mt_proofs[1];
|
||||
let key_signer = builder.constant_value(hash_str(KEY_SIGNER).into());
|
||||
builder.connect_values(signer_mt_proof.key, key_signer);
|
||||
builder.connect_values(signer_mt_proof.value, signature.pk);
|
||||
|
||||
// 3.c. connect signed message to pod.id
|
||||
builder.connect_values(ValueTarget::from_slice(&id.elements), signature.msg);
|
||||
|
||||
Ok(SignedPodVerifyTarget {
|
||||
params: self.params.clone(),
|
||||
id,
|
||||
mt_proofs,
|
||||
signature,
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
pub struct SignedPodVerifyTarget {
|
||||
params: Params,
|
||||
id: HashOutTarget,
|
||||
// the KEY_TYPE entry must be the first one
|
||||
// the KEY_SIGNER entry must be the second one
|
||||
mt_proofs: Vec<MerkleProofExistenceTarget>,
|
||||
signature: SignatureVerifyTarget,
|
||||
}
|
||||
|
||||
impl SignedPodVerifyTarget {
|
||||
pub fn pub_statements(&self) -> Vec<StatementTarget> {
|
||||
// TODO: Here we need to use the self.id in the ValueOf statements
|
||||
todo!()
|
||||
}
|
||||
|
||||
pub fn set_targets(&self, pw: &mut PartialWitness<F>, pod: &SignedPod) -> Result<()> {
|
||||
// set the self.mt_proofs witness with the following order:
|
||||
// - KEY_TYPE leaf proof
|
||||
// - KEY_SIGNER leaf proof
|
||||
// - rest of leaves
|
||||
// - empty leaves (if needed)
|
||||
|
||||
// add proof verification of KEY_TYPE & KEY_SIGNER leaves
|
||||
let key_type_key = Value::from(hash_str(KEY_TYPE));
|
||||
let key_signer_key = Value::from(hash_str(KEY_SIGNER));
|
||||
let key_signer_value = [key_type_key, key_signer_key]
|
||||
.iter()
|
||||
.enumerate()
|
||||
.map(|(i, k)| {
|
||||
let (v, proof) = pod.dict.prove(&k)?;
|
||||
self.mt_proofs[i].set_targets(pw, true, pod.dict.commitment(), proof, *k, v)?;
|
||||
Ok(v)
|
||||
})
|
||||
.collect::<Result<Vec<Value>>>()?[1];
|
||||
|
||||
// add the verification of the rest of leaves
|
||||
let mut curr = 2; // since we already added key_type and key_signer
|
||||
for (k, v) in pod.dict.iter().sorted_by_key(|kv| kv.0) {
|
||||
if *k == key_type_key || *k == key_signer_key {
|
||||
// skip the key_type & key_signer leaves, since they have
|
||||
// already been checked
|
||||
continue;
|
||||
}
|
||||
|
||||
let (obtained_v, proof) = pod.dict.prove(&k)?;
|
||||
assert_eq!(obtained_v, *v); // sanity check
|
||||
|
||||
self.mt_proofs[curr].set_targets(pw, true, pod.dict.commitment(), proof, *k, *v)?;
|
||||
curr += 1;
|
||||
}
|
||||
// sanity check
|
||||
assert!(curr <= self.params.max_signed_pod_values);
|
||||
|
||||
// add the proofs of empty leaves (if needed), till the max_signed_pod_values
|
||||
for i in curr..self.params.max_signed_pod_values {
|
||||
self.mt_proofs[i].set_targets(
|
||||
pw,
|
||||
false, // disable verification
|
||||
pod.dict.commitment(),
|
||||
// use an empty proof:
|
||||
MerkleProof {
|
||||
existence: true,
|
||||
siblings: vec![],
|
||||
other_leaf: None,
|
||||
},
|
||||
EMPTY_VALUE,
|
||||
EMPTY_VALUE,
|
||||
)?;
|
||||
}
|
||||
|
||||
// get the signer pk
|
||||
let pk = PublicKey(key_signer_value);
|
||||
// the msg signed is the pod.id
|
||||
let msg = Value::from(pod.id.0);
|
||||
|
||||
// set signature targets values
|
||||
self.signature
|
||||
.set_targets(pw, true, pk, msg, pod.signature.clone())?;
|
||||
|
||||
// set the id target value
|
||||
pw.set_hash_target(self.id, HashOut::from_vec(pod.id.0 .0.to_vec()))?;
|
||||
|
||||
Ok(())
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
pub mod tests {
|
||||
use plonky2::plonk::{circuit_builder::CircuitBuilder, circuit_data::CircuitConfig};
|
||||
|
||||
use super::*;
|
||||
use crate::backends::plonky2::{
|
||||
basetypes::C,
|
||||
primitives::signature::SecretKey,
|
||||
signedpod::{SignedPod, Signer},
|
||||
};
|
||||
use crate::middleware::F;
|
||||
|
||||
#[test]
|
||||
fn test_signed_pod_verify() -> Result<()> {
|
||||
let mut params = Params {
|
||||
max_signed_pod_values: 6,
|
||||
..Default::default()
|
||||
};
|
||||
// set max_signed_pod_values to 6, and we insert 3 leaves, so that the
|
||||
// circuit has enough space for the 3 leaves plus the KEY_TYPE and
|
||||
// KEY_SIGNER and one empty leaf.
|
||||
|
||||
// prepare a signedpod
|
||||
let mut pod = crate::frontend::SignedPodBuilder::new(¶ms);
|
||||
pod.insert("idNumber", "4242424242");
|
||||
pod.insert("dateOfBirth", 1169909384);
|
||||
pod.insert("socialSecurityNumber", "G2121210");
|
||||
let sk = SecretKey::new();
|
||||
let mut signer = Signer(sk);
|
||||
let pod = pod.sign(&mut signer).unwrap();
|
||||
let signed_pod = pod.pod.into_any().downcast::<SignedPod>().unwrap();
|
||||
|
||||
// use the pod in the circuit
|
||||
let config = CircuitConfig::standard_recursion_config();
|
||||
let mut builder = CircuitBuilder::<F, D>::new(config);
|
||||
let mut pw = PartialWitness::<F>::new();
|
||||
|
||||
// build the circuit logic
|
||||
let signed_pod_verify = SignedPodVerifyGadget { params }.eval(&mut builder)?;
|
||||
|
||||
// set the signed_pod as target values for the circuit
|
||||
signed_pod_verify.set_targets(&mut pw, &signed_pod)?;
|
||||
|
||||
// generate & verify proof
|
||||
let data = builder.build::<C>();
|
||||
let proof = data.prove(pw)?;
|
||||
data.verify(proof)?;
|
||||
|
||||
Ok(())
|
||||
}
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue