ed255/pod2
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Progress on the MainPod circuit (#159)

Browse source 
* feat: add SignedPodVerify test

* unify circuits style

* more clear sizes

* get operation_verify test working

* be consistent with names
This commit is contained in:
Eduard S. 2025-03-21 16:53:03 +01:00 • committed by GitHub
parent 9afc43675d
commit b93187c9bb
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
11 changed files with 411 additions and 175 deletions
Download patch file Download diff file Expand all files Collapse all files

70
src/backends/plonky2/common.rs
View file

@ -1,12 +1,17 @@
//! Common functionality to build Pod circuits with plonky2
use crate::middleware::STATEMENT_ARG_F_LEN;
use crate::middleware::{Params, Value, HASH_SIZE, VALUE_SIZE};
use crate::backends::plonky2::mock_main::Statement;
use crate::backends::plonky2::mock_main::{Operation, OperationArg};
use crate::middleware::{Params, StatementArg, ToFields, Value, F, HASH_SIZE, VALUE_SIZE};
use crate::middleware::{OPERATION_ARG_F_LEN, STATEMENT_ARG_F_LEN};
use anyhow::Result;
use plonky2::field::extension::Extendable;
use plonky2::field::types::PrimeField64;
use plonky2::field::types::{Field, PrimeField64};
use plonky2::hash::hash_types::RichField;
use plonky2::iop::target::{BoolTarget, Target};
use plonky2::iop::witness::{PartialWitness, WitnessWrite};
use plonky2::plonk::circuit_builder::CircuitBuilder;
use std::iter;
#[derive(Copy, Clone)]
pub struct ValueTarget {
@ -15,25 +20,65 @@ pub struct ValueTarget {
#[derive(Clone)]
pub struct StatementTarget {
pub code: [Target; HASH_SIZE + 2],
pub predicate: [Target; Params::predicate_size()],
pub args: Vec<[Target; STATEMENT_ARG_F_LEN]>,
}
impl StatementTarget {
pub fn to_flattened(&self) -> Vec<Target> {
self.code
self.predicate
.iter()
.chain(self.args.iter().flatten())
.cloned()
.collect()
}
pub fn set_targets(
&self,
pw: &mut PartialWitness<F>,
params: &Params,
st: &Statement,
) -> Result<()> {
pw.set_target_arr(&self.predicate, &st.predicate().to_fields(params))?;
for (i, arg) in st
.args()
.iter()
.chain(iter::repeat(&StatementArg::None))
.take(params.max_statement_args)
.enumerate()
{
pw.set_target_arr(&self.args[i], &arg.to_fields(params))?;
}
Ok(())
}
}
// TODO: Implement Operation::to_field to determine the size of each element
#[derive(Clone)]
pub struct OperationTarget {
pub code: [Target; 6], // TODO: Figure out the length
pub args: Vec<[Target; STATEMENT_ARG_F_LEN]>, // TODO: Figure out the length
pub op_type: [Target; Params::operation_type_size()],
pub args: Vec<[Target; OPERATION_ARG_F_LEN]>,
}
impl OperationTarget {
pub fn set_targets(
&self,
pw: &mut PartialWitness<F>,
params: &Params,
op: &Operation,
) -> Result<()> {
pw.set_target_arr(&self.op_type, &op.op_type().to_fields(params))?;
for (i, arg) in op
.args()
.iter()
.chain(iter::repeat(&OperationArg::None))
.take(params.max_operation_args)
.enumerate()
{
pw.set_target_arr(&self.args[i], &arg.to_fields(params))?;
}
Ok(())
}
}
pub trait CircuitBuilderPod<F: RichField + Extendable<D>, const D: usize> {
@ -70,15 +115,20 @@ impl<F: RichField + Extendable<D>, const D: usize> CircuitBuilderPod<F, D>
fn add_virtual_statement(&mut self, params: &Params) -> StatementTarget {
StatementTarget {
code: self.add_virtual_target_arr::<6>(),
predicate: self.add_virtual_target_arr(),
args: (0..params.max_statement_args)
.map(|_| self.add_virtual_target_arr::<STATEMENT_ARG_F_LEN>())
.map(|_| self.add_virtual_target_arr())
.collect(),
}
}
fn add_virtual_operation(&mut self, params: &Params) -> OperationTarget {
todo!()
OperationTarget {
op_type: self.add_virtual_target_arr(),
args: (0..params.max_operation_args)
.map(|_| self.add_virtual_target_arr())
.collect(),
}
}
fn select_value(&mut self, b: BoolTarget, x: ValueTarget, y: ValueTarget) -> ValueTarget {

208
src/backends/plonky2/main.rs
View file

@ -2,11 +2,14 @@ use crate::backends::plonky2::basetypes::{Hash, Value, D, EMPTY_HASH, EMPTY_VALU
use crate::backends::plonky2::common::{
CircuitBuilderPod, OperationTarget, StatementTarget, ValueTarget,
};
use crate::backends::plonky2::primitives::merkletree::MerkleProofExistenceCircuit;
use crate::backends::plonky2::mock_main::Operation;
use crate::backends::plonky2::primitives::merkletree::{MerkleProof, MerkleTree};
use crate::backends::plonky2::primitives::merkletree::{
MerkleProofExistenceGate, MerkleProofExistenceTarget,
};
use crate::middleware::{
hash_str, AnchoredKey, NativeOperation, NativePredicate, Operation, Params, PodType, Predicate,
Statement, StatementArg, ToFields, KEY_TYPE, SELF, STATEMENT_ARG_F_LEN,
hash_str, AnchoredKey, NativeOperation, NativePredicate, Params, PodType, Predicate, Statement,
StatementArg, ToFields, KEY_TYPE, SELF, STATEMENT_ARG_F_LEN,
};
use anyhow::Result;
use itertools::Itertools;
@ -23,9 +26,7 @@ use plonky2::{
plonk::circuit_builder::CircuitBuilder,
};
use std::collections::HashMap;
/// MerkleTree Max Depth
const MD: usize = 32;
use std::iter;
//
// SignedPod verification
@ -41,7 +42,10 @@ impl SignedPodVerifyGate {
let id = builder.add_virtual_hash();
let mut mt_proofs = Vec::new();
for _ in 0..self.params.max_signed_pod_values {
let mt_proof = MerkleProofExistenceCircuit::<MD>::add_targets(builder)?;
let mt_proof = MerkleProofExistenceGate {
max_depth: self.params.max_depth_mt_gate,
}
.eval(builder)?;
builder.connect_hashes(id, mt_proof.root);
mt_proofs.push(mt_proof);
}
@ -68,7 +72,7 @@ struct SignedPodVerifyTarget {
id: HashOutTarget,
// The KEY_TYPE entry must be the first one
// The KEY_SIGNER entry must be the second one
mt_proofs: Vec<MerkleProofExistenceCircuit<MD>>,
mt_proofs: Vec<MerkleProofExistenceTarget>,
}
struct SignedPodVerifyInput {
@ -94,16 +98,22 @@ impl SignedPodVerifyTarget {
fn set_targets(&self, pw: &mut PartialWitness<F>, input: &SignedPodVerifyInput) -> Result<()> {
assert!(input.kvs.len() <= self.params.max_signed_pod_values);
let tree = MerkleTree::new(MD, &input.kvs)?;
for (i, (k, v)) in input.kvs.iter().sorted_by_key(|kv| kv.0).enumerate() {
let tree = MerkleTree::new(self.params.max_depth_mt_gate, &input.kvs)?;
// First handle the type entry, then the rest of the entries, and finally pad with
// repetitions of the type entry (which always exists)
let mut kvs = input.kvs.clone();
let key_type = Value::from(hash_str(KEY_TYPE));
let value_type = kvs.remove(&key_type).expect("KEY_TYPE");
for (i, (k, v)) in iter::once((key_type, value_type))
.chain(kvs.into_iter().sorted_by_key(|kv| kv.0))
.chain(iter::repeat((key_type, value_type)))
.take(self.params.max_signed_pod_values)
.enumerate()
{
let (_, proof) = tree.prove(&k)?;
self.mt_proofs[i].set_targets(pw, tree.root(), proof, *k, *v)?;
}
// Padding
for i in input.kvs.len()..self.params.max_signed_pod_values {
// TODO: We need to disable the proofs for the unused slots. We could add a flag
// "enable" to the MerkleTree proof circuit that skips the verification when false.
// self.mt_proofs[i].set_targets(pw, false, EMPTY_HASH, proof, *k, *v)?;
self.mt_proofs[i].set_targets(pw, tree.root(), proof, k, v)?;
}
Ok(())
}
@ -125,34 +135,55 @@ impl OperationVerifyGate {
op: &OperationTarget,
prev_statements: &[StatementTarget],
) -> Result<OperationVerifyTarget> {
let _true = builder._true();
let _false = builder._false();
let one = builder.constant(F::ONE);
// Verify that the operation `op` correctly generates the statement `st`. The operation
// can reference any of the `prev_statements`.
// The verification may require aux data which needs to be stored in the
// `OperationVerifyTarget` so that we can set during witness generation.
// TODO: Figure out the right encoding of op.code
// For now only support native operations
builder.connect(op.op_type[0], one);
let native_op = op.op_type[1];
let mut op_flags = Vec::new();
let op_none = builder.constant(F::from_canonical_u64(NativeOperation::None as u64));
let is_none = builder.is_equal(op.code[0], op_none);
let is_none = builder.is_equal(native_op, op_none);
op_flags.push(is_none);
let op_new_entry =
builder.constant(F::from_canonical_u64(NativeOperation::NewEntry as u64));
let is_new_entry = builder.is_equal(op.code[0], op_new_entry);
let is_new_entry = builder.is_equal(native_op, op_new_entry);
op_flags.push(is_new_entry);
let op_copy_statement =
builder.constant(F::from_canonical_u64(NativeOperation::CopyStatement as u64));
let is_copy_statement = builder.is_equal(op.code[0], op_copy_statement);
let is_copy_statement = builder.is_equal(native_op, op_copy_statement);
op_flags.push(is_copy_statement);
let op_eq_from_entries = builder.constant(F::from_canonical_u64(
NativeOperation::EqualFromEntries as u64,
));
let is_eq_from_entries = builder.is_equal(op.code[0], op_eq_from_entries);
let op_gt_from_entries =
builder.constant(F::from_canonical_u64(NativeOperation::GtFromEntries as u64));
let is_gt_from_entries = builder.is_equal(op.code[0], op_gt_from_entries);
let is_eq_from_entries = builder.is_equal(native_op, op_eq_from_entries);
op_flags.push(is_eq_from_entries);
let op_lt_from_entries =
builder.constant(F::from_canonical_u64(NativeOperation::LtFromEntries as u64));
let is_lt_from_entries = builder.is_equal(op.code[0], op_lt_from_entries);
let op_contains_from_entries = builder.constant(F::from_canonical_u64(
NativeOperation::ContainsFromEntries as u64,
let is_lt_from_entries = builder.is_equal(native_op, op_lt_from_entries);
op_flags.push(is_lt_from_entries);
let op_not_contains_from_entries = builder.constant(F::from_canonical_u64(
NativeOperation::NotContainsFromEntries as u64,
));
let is_contains_from_entries = builder.is_equal(op.code[0], op_contains_from_entries);
let is_not_contains_from_entries =
builder.is_equal(native_op, op_not_contains_from_entries);
op_flags.push(is_not_contains_from_entries);
// One supported operation must be used. We sum all operation flags and expect the result
// to be 1. Since the flags are boolean and at most one of them is true the sum is
// equivalent to the OR.
let or_op_flags = op_flags
.iter()
.map(|b| b.target)
.fold(_false.target, |acc, x| builder.add(acc, x));
builder.connect(or_op_flags, _true.target);
let ok = builder._true();
let none_ok = self.eval_none(builder, st, op);
@ -160,10 +191,9 @@ impl OperationVerifyGate {
let new_entry_ok = self.eval_new_entry(builder, st, op);
let ok = builder.select_bool(is_new_entry, new_entry_ok, ok);
let _true = builder._true();
builder.connect(ok.target, _true.target);
todo!()
Ok(OperationVerifyTarget {})
}
fn eval_none(
@ -184,14 +214,14 @@ impl OperationVerifyGate {
_op: &OperationTarget,
) -> BoolTarget {
let value_of_st = &Statement::ValueOf(AnchoredKey(SELF, EMPTY_HASH), EMPTY_VALUE);
let expected_code =
let expected_predicate =
builder.constants(&Predicate::Native(NativePredicate::ValueOf).to_fields(&self.params));
let code_ok = builder.is_equal_slice(&st.code, &expected_code);
let predicate_ok = builder.is_equal_slice(&st.predicate, &expected_predicate);
let expected_arg_prefix = builder.constants(
&StatementArg::Key(AnchoredKey(SELF, EMPTY_HASH)).to_fields(&self.params)[..VALUE_SIZE],
);
let arg_prefix_ok = builder.is_equal_slice(&st.args[0][..VALUE_SIZE], &expected_arg_prefix);
builder.and(code_ok, arg_prefix_ok)
builder.and(predicate_ok, arg_prefix_ok)
}
}
@ -199,13 +229,14 @@ struct OperationVerifyTarget {
// TODO
}
struct OperationVerifyInputs {
struct OperationVerifyInput {
// TODO
}
impl OperationVerifyTarget {
fn set_targets(&self, pw: &mut PartialWitness<F>, input: &OperationVerifyInputs) -> Result<()> {
todo!()
fn set_targets(&self, pw: &mut PartialWitness<F>, input: &OperationVerifyInput) -> Result<()> {
// TODO
Ok(())
}
}
@ -246,14 +277,13 @@ impl MainPodVerifyGate {
// 2. Calculate the Pod Id from the public statements
let pub_statements_flattened = pub_statements
.iter()
.map(|s| s.code.iter().chain(s.args.iter().flatten()))
.map(|s| s.predicate.iter().chain(s.args.iter().flatten()))
.flatten()
.cloned()
.collect();
let id = builder.hash_n_to_hash_no_pad::<PoseidonHash>(pub_statements_flattened);
// 3. TODO check that all `input_statements` of type `ValueOf` with origin=SELF have unique
// keys (no duplicates)
// 3. TODO check that all `input_statements` of type `ValueOf` with origin=SELF have unique keys (no duplicates). Maybe we can do this via the NewEntry operation (check that the key doesn't exist in a previous statement with ID=SELF)
// 4. Verify type
let type_statement = &pub_statements[0];
@ -324,12 +354,12 @@ impl MainPodVerifyTarget {
}
}
struct MainPodVerifyCircuit {
params: Params,
pub struct MainPodVerifyCircuit {
pub params: Params,
}
impl MainPodVerifyCircuit {
fn eval(&self, builder: &mut CircuitBuilder<F, D>) -> Result<MainPodVerifyTarget> {
pub fn eval(&self, builder: &mut CircuitBuilder<F, D>) -> Result<MainPodVerifyTarget> {
let main_pod = MainPodVerifyGate {
params: self.params.clone(),
}
@ -338,3 +368,95 @@ impl MainPodVerifyCircuit {
Ok(main_pod)
}
}
#[cfg(test)]
mod tests {
use super::*;
use crate::backends::plonky2::basetypes::C;
use crate::backends::plonky2::mock_main;
use crate::middleware::OperationType;
use plonky2::plonk::{circuit_builder::CircuitBuilder, circuit_data::CircuitConfig};
#[test]
fn test_signed_pod_verify() -> Result<()> {
let params = Params::default();
let config = CircuitConfig::standard_recursion_config();
let mut builder = CircuitBuilder::<F, D>::new(config);
let signed_pod_verify = SignedPodVerifyGate { params }.eval(&mut builder)?;
let mut pw = PartialWitness::<F>::new();
let kvs = [
(
Value::from(hash_str(KEY_TYPE)),
Value::from(PodType::MockSigned),
),
(Value::from(hash_str("foo")), Value::from(42)),
]
.into();
let input = SignedPodVerifyInput { kvs };
signed_pod_verify.set_targets(&mut pw, &input)?;
// generate & verify proof
let data = builder.build::<C>();
let proof = data.prove(pw)?;
data.verify(proof)?;
Ok(())
}
fn operation_verify(
st: mock_main::Statement,
op: mock_main::Operation,
prev_statements: Vec<mock_main::Statement>,
) -> Result<()> {
let params = Params::default();
let config = CircuitConfig::standard_recursion_config();
let mut builder = CircuitBuilder::<F, D>::new(config);
let st_target = builder.add_virtual_statement(&params);
let op_target = builder.add_virtual_operation(&params);
let prev_statements_target: Vec<_> = (0..prev_statements.len())
.map(|_| builder.add_virtual_statement(&params))
.collect();
let operation_verify = OperationVerifyGate {
params: params.clone(),
}
.eval(
&mut builder,
&st_target,
&op_target,
&prev_statements_target,
)?;
let mut pw = PartialWitness::<F>::new();
st_target.set_targets(&mut pw, &params, &st)?;
op_target.set_targets(&mut pw, &params, &op)?;
for (prev_st_target, prev_st) in prev_statements_target.iter().zip(prev_statements.iter()) {
prev_st_target.set_targets(&mut pw, &params, prev_st)?;
}
let input = OperationVerifyInput {};
operation_verify.set_targets(&mut pw, &input)?;
// generate & verify proof
let data = builder.build::<C>();
let proof = data.prove(pw)?;
data.verify(proof)?;
Ok(())
}
#[test]
fn test_operation_verify() -> Result<()> {
// None
let st: mock_main::Statement = Statement::None.into();
let op = mock_main::Operation(OperationType::Native(NativeOperation::None), vec![]);
let prev_statements = vec![Statement::None.into()];
operation_verify(st, op, prev_statements)?;
Ok(())
}
}

2
src/backends/plonky2/mock_main/mod.rs
View file

@ -260,7 +260,7 @@ impl MockMainPod {
.map(|mid_arg| Self::find_op_arg(statements, mid_arg))
.collect::<Result<Vec<_>>>()?;
Self::pad_operation_args(params, &mut args);
operations.push(Operation(op.predicate(), args));
operations.push(Operation(op.op_type(), args));
}
Ok(operations)
}

19
src/backends/plonky2/mock_main/operation.rs
View file

@ -1,6 +1,7 @@
use super::Statement;
use crate::middleware::{self, OperationType};
use crate::middleware::{self, OperationType, Params, ToFields, F};
use anyhow::Result;
use plonky2::field::types::{Field, PrimeField64};
use serde::{Deserialize, Serialize};
use std::fmt;
@ -10,6 +11,16 @@ pub enum OperationArg {
Index(usize),
}
impl ToFields for OperationArg {
fn to_fields(&self, _params: &Params) -> Vec<F> {
let f = match self {
Self::None => F::ZERO,
Self::Index(i) => F::from_canonical_usize(*i),
};
vec![f]
}
}
impl OperationArg {
pub fn is_none(&self) -> bool {
matches!(self, OperationArg::None)
@ -20,6 +31,12 @@ impl OperationArg {
pub struct Operation(pub OperationType, pub Vec<OperationArg>);
impl Operation {
pub fn op_type(&self) -> OperationType {
self.0.clone()
}
pub fn args(&self) -> &[OperationArg] {
&self.1
}
pub fn deref(&self, statements: &[Statement]) -> Result<crate::middleware::Operation> {
let deref_args = self
.1

5
src/backends/plonky2/mock_main/statement.rs
View file

@ -13,6 +13,9 @@ impl Statement {
pub fn is_none(&self) -> bool {
self.0 == Predicate::Native(NativePredicate::None)
}
pub fn predicate(&self) -> Predicate {
self.0.clone()
}
/// Argument method. Trailing Nones are filtered out.
pub fn args(&self) -> Vec<StatementArg> {
let maybe_last_arg_index = (0..self.1.len()).rev().find(|i| !self.1[*i].is_none());
@ -96,7 +99,7 @@ impl TryFrom<Statement> for middleware::Statement {
impl From<middleware::Statement> for Statement {
fn from(s: middleware::Statement) -> Self {
match s.code() {
match s.predicate() {
middleware::Predicate::Native(c) => Statement(
middleware::Predicate::Native(c),
s.args().into_iter().collect(),

180
src/backends/plonky2/primitives/merkletree_circuit.rs
View file

@ -29,11 +29,16 @@ use crate::backends::plonky2::common::{
};
use crate::backends::plonky2::primitives::merkletree::MerkleProof;
/// `MerkleProofCircuit` allows to verify both proofs of existence and proofs
/// `MerkleProofGate` allows to verify both proofs of existence and proofs
/// non-existence with the same circuit.
/// If only proofs of existence are needed, use `MerkleProofExistenceCircuit`,
/// If only proofs of existence are needed, use `MerkleProofExistenceGate`,
/// which requires less amount of constraints.
pub struct MerkleProofCircuit<const MAX_DEPTH: usize> {
pub struct MerkleProofGate {
pub max_depth: usize,
}
pub struct MerkleProofTarget {
max_depth: usize,
pub root: HashOutTarget,
pub key: ValueTarget,
pub value: ValueTarget,
@ -44,16 +49,16 @@ pub struct MerkleProofCircuit<const MAX_DEPTH: usize> {
pub other_value: ValueTarget,
}
impl<const MAX_DEPTH: usize> MerkleProofCircuit<MAX_DEPTH> {
impl MerkleProofGate {
/// creates the targets and defines the logic of the circuit
pub fn add_targets(builder: &mut CircuitBuilder<F, D>) -> Result<Self> {
pub fn eval(&self, builder: &mut CircuitBuilder<F, D>) -> Result<MerkleProofTarget> {
// create the targets
let key = builder.add_virtual_value();
let value = builder.add_virtual_value();
// from proof struct:
let existence = builder.add_virtual_bool_target_safe();
// siblings are padded till MAX_DEPTH length
let siblings = builder.add_virtual_hashes(MAX_DEPTH);
// siblings are padded till max_depth length
let siblings = builder.add_virtual_hashes(self.max_depth);
let case_ii_selector = builder.add_virtual_bool_target_safe();
let other_key = builder.add_virtual_value();
@ -107,16 +112,17 @@ impl<const MAX_DEPTH: usize> MerkleProofCircuit<MAX_DEPTH> {
);
// get key's path
let path = keypath_target::<MAX_DEPTH>(builder, &key);
let path = keypath_target(self.max_depth, builder, &key);
// compute the root for the given siblings and the computed leaf_hash
// (this is for the three cases (existence, non-existence case i, and
// non-existence case ii).
// This root will be assigned in the `set_targets` method, and it is a
// public input.
let root = compute_root_from_leaf::<MAX_DEPTH>(builder, &path, &leaf_hash, &siblings)?;
let root = compute_root_from_leaf(self.max_depth, builder, &path, &leaf_hash, &siblings)?;
Ok(Self {
Ok(MerkleProofTarget {
max_depth: self.max_depth,
existence,
root,
siblings,
@ -127,7 +133,9 @@ impl<const MAX_DEPTH: usize> MerkleProofCircuit<MAX_DEPTH> {
other_value,
})
}
}
impl MerkleProofTarget {
/// assigns the given values to the targets
pub fn set_targets(
&self,
@ -143,9 +151,9 @@ impl<const MAX_DEPTH: usize> MerkleProofCircuit<MAX_DEPTH> {
pw.set_target_arr(&self.value.elements, &value.0)?;
pw.set_bool_target(self.existence, existence)?;
// pad siblings with zeros to length MAX_DEPTH
// pad siblings with zeros to length max_depth
let mut siblings = proof.siblings.clone();
siblings.resize(MAX_DEPTH, EMPTY_HASH);
siblings.resize(self.max_depth, EMPTY_HASH);
assert_eq!(self.siblings.len(), siblings.len());
for (i, sibling) in siblings.iter().enumerate() {
@ -173,41 +181,49 @@ impl<const MAX_DEPTH: usize> MerkleProofCircuit<MAX_DEPTH> {
/// `MerkleProofExistenceCircuit` allows to verify proofs of existence only. If
/// proofs of non-existence are needed, use `MerkleProofCircuit`.
pub struct MerkleProofExistenceCircuit<const MAX_DEPTH: usize> {
pub struct MerkleProofExistenceGate {
pub max_depth: usize,
}
pub struct MerkleProofExistenceTarget {
max_depth: usize,
pub root: HashOutTarget,
pub key: ValueTarget,
pub value: ValueTarget,
pub siblings: Vec<HashOutTarget>,
}
impl<const MAX_DEPTH: usize> MerkleProofExistenceCircuit<MAX_DEPTH> {
impl MerkleProofExistenceGate {
/// creates the targets and defines the logic of the circuit
pub fn add_targets(builder: &mut CircuitBuilder<F, D>) -> Result<Self> {
pub fn eval(&self, builder: &mut CircuitBuilder<F, D>) -> Result<MerkleProofExistenceTarget> {
// create the targets
let key = builder.add_virtual_value();
let value = builder.add_virtual_value();
// siblings are padded till MAX_DEPTH length
let siblings = builder.add_virtual_hashes(MAX_DEPTH);
// siblings are padded till max_depth length
let siblings = builder.add_virtual_hashes(self.max_depth);
// get leaf's hash for the selected k & v
let leaf_hash = kv_hash_target(builder, &key, &value);
// get key's path
let path = keypath_target::<MAX_DEPTH>(builder, &key);
let path = keypath_target(self.max_depth, builder, &key);
// compute the root for the given siblings and the computed leaf_hash.
// This root will be assigned in the `set_targets` method, and it is a
// public input.
let root = compute_root_from_leaf::<MAX_DEPTH>(builder, &path, &leaf_hash, &siblings)?;
let root = compute_root_from_leaf(self.max_depth, builder, &path, &leaf_hash, &siblings)?;
Ok(Self {
Ok(MerkleProofExistenceTarget {
max_depth: self.max_depth,
root,
siblings,
key,
value,
})
}
}
impl MerkleProofExistenceTarget {
/// assigns the given values to the targets
pub fn set_targets(
&self,
@ -221,9 +237,9 @@ impl<const MAX_DEPTH: usize> MerkleProofExistenceCircuit<MAX_DEPTH> {
pw.set_target_arr(&self.key.elements, &key.0)?;
pw.set_target_arr(&self.value.elements, &value.0)?;
// pad siblings with zeros to length MAX_DEPTH
// pad siblings with zeros to length max_depth
let mut siblings = proof.siblings.clone();
siblings.resize(MAX_DEPTH, EMPTY_HASH);
siblings.resize(self.max_depth, EMPTY_HASH);
assert_eq!(self.siblings.len(), siblings.len());
for (i, sibling) in siblings.iter().enumerate() {
@ -234,13 +250,14 @@ impl<const MAX_DEPTH: usize> MerkleProofExistenceCircuit<MAX_DEPTH> {
}
}
fn compute_root_from_leaf<const MAX_DEPTH: usize>(
fn compute_root_from_leaf(
max_depth: usize,
builder: &mut CircuitBuilder<F, D>,
path: &Vec<BoolTarget>,
leaf_hash: &HashOutTarget,
siblings: &Vec<HashOutTarget>,
) -> Result<HashOutTarget> {
assert_eq!(siblings.len(), MAX_DEPTH);
assert_eq!(siblings.len(), max_depth);
// Convenience constants
let zero = builder.zero();
let one = builder.one();
@ -295,12 +312,13 @@ fn compute_root_from_leaf<const MAX_DEPTH: usize>(
// Note: this logic is in its own method for easy of reusability but
// specially to be able to test it isolated.
fn keypath_target<const MAX_DEPTH: usize>(
fn keypath_target(
max_depth: usize,
builder: &mut CircuitBuilder<F, D>,
key: &ValueTarget,
) -> Vec<BoolTarget> {
let n_complete_field_elems: usize = MAX_DEPTH / F::BITS;
let n_extra_bits: usize = MAX_DEPTH - n_complete_field_elems * F::BITS;
let n_complete_field_elems: usize = max_depth / F::BITS;
let n_extra_bits: usize = max_depth - n_complete_field_elems * F::BITS;
let path: Vec<BoolTarget> = key
.elements
@ -351,41 +369,35 @@ pub mod tests {
#[test]
fn test_keypath() -> Result<()> {
test_keypath_opt::<10>()?;
test_keypath_opt::<16>()?;
test_keypath_opt::<32>()?;
test_keypath_opt::<40>()?;
test_keypath_opt::<64>()?;
test_keypath_opt::<128>()?;
test_keypath_opt::<130>()?;
test_keypath_opt::<250>()?;
test_keypath_opt::<256>()?;
for max_depth in [10, 16, 32, 40, 64, 128, 130, 250, 256] {
test_keypath_opt(max_depth)?;
}
Ok(())
}
fn test_keypath_opt<const MD: usize>() -> Result<()> {
fn test_keypath_opt(max_depth: usize) -> Result<()> {
for i in 0..5 {
let config = CircuitConfig::standard_recursion_config();
let mut builder = CircuitBuilder::<F, D>::new(config);
let mut pw = PartialWitness::<F>::new();
let key = Value::from(hash_value(&Value::from(i)));
let expected_path = keypath(MD, key)?;
let expected_path = keypath(max_depth, key)?;
// small circuit logic to check
// expected_path_targ==keypath_target(key_targ)
let expected_path_targ: Vec<BoolTarget> = (0..MD)
let expected_path_targ: Vec<BoolTarget> = (0..max_depth)
.map(|_| builder.add_virtual_bool_target_safe())
.collect();
let key_targ = builder.add_virtual_value();
let computed_path_targ = keypath_target::<MD>(&mut builder, &key_targ);
for i in 0..MD {
let computed_path_targ = keypath_target(max_depth, &mut builder, &key_targ);
for i in 0..max_depth {
builder.connect(computed_path_targ[i].target, expected_path_targ[i].target);
}
// assign the input values to the targets
pw.set_target_arr(&key_targ.elements, &key.0)?;
for i in 0..MD {
for i in 0..max_depth {
pw.set_bool_target(expected_path_targ[i], expected_path[i])?;
}
@ -431,40 +443,28 @@ pub mod tests {
#[test]
fn test_merkleproof_verify_existence() -> Result<()> {
test_merkleproof_verify_opt::<10>(true)?;
test_merkleproof_verify_opt::<16>(true)?;
test_merkleproof_verify_opt::<32>(true)?;
test_merkleproof_verify_opt::<40>(true)?;
test_merkleproof_verify_opt::<64>(true)?;
test_merkleproof_verify_opt::<128>(true)?;
test_merkleproof_verify_opt::<130>(true)?;
test_merkleproof_verify_opt::<250>(true)?;
test_merkleproof_verify_opt::<256>(true)?;
for max_depth in [10, 16, 32, 40, 64, 128, 130, 250, 256] {
test_merkleproof_verify_opt(max_depth, true)?;
}
Ok(())
}
#[test]
fn test_merkleproof_verify_nonexistence() -> Result<()> {
test_merkleproof_verify_opt::<10>(false)?;
test_merkleproof_verify_opt::<16>(false)?;
test_merkleproof_verify_opt::<32>(false)?;
test_merkleproof_verify_opt::<40>(false)?;
test_merkleproof_verify_opt::<64>(false)?;
test_merkleproof_verify_opt::<128>(false)?;
test_merkleproof_verify_opt::<130>(false)?;
test_merkleproof_verify_opt::<250>(false)?;
test_merkleproof_verify_opt::<256>(false)?;
for max_depth in [10, 16, 32, 40, 64, 128, 130, 250, 256] {
test_merkleproof_verify_opt(max_depth, false)?;
}
Ok(())
}
// test logic to be reused both by the existence & nonexistence tests
fn test_merkleproof_verify_opt<const MD: usize>(existence: bool) -> Result<()> {
fn test_merkleproof_verify_opt(max_depth: usize, existence: bool) -> Result<()> {
let mut kvs: HashMap<Value, Value> = HashMap::new();
for i in 0..10 {
kvs.insert(Value::from(hash_value(&Value::from(i))), Value::from(i));
}
let tree = MerkleTree::new(MD, &kvs)?;
let tree = MerkleTree::new(max_depth, &kvs)?;
let (key, value, proof) = if existence {
let key = Value::from(hash_value(&Value::from(5)));
@ -478,9 +478,9 @@ pub mod tests {
assert_eq!(proof.existence, existence);
if existence {
MerkleTree::verify(MD, tree.root(), &proof, &key, &value)?;
MerkleTree::verify(max_depth, tree.root(), &proof, &key, &value)?;
} else {
MerkleTree::verify_nonexistence(MD, tree.root(), &proof, &key)?;
MerkleTree::verify_nonexistence(max_depth, tree.root(), &proof, &key)?;
}
// circuit
@ -488,7 +488,7 @@ pub mod tests {
let mut builder = CircuitBuilder::<F, D>::new(config);
let mut pw = PartialWitness::<F>::new();
let targets = MerkleProofCircuit::<MD>::add_targets(&mut builder)?;
let targets = MerkleProofGate { max_depth }.eval(&mut builder)?;
targets.set_targets(&mut pw, existence, tree.root(), proof, key, value)?;
// generate & verify proof
@ -501,39 +501,33 @@ pub mod tests {
#[test]
fn test_merkleproof_only_existence_verify() -> Result<()> {
test_merkleproof_only_existence_verify_opt::<10>()?;
test_merkleproof_only_existence_verify_opt::<16>()?;
test_merkleproof_only_existence_verify_opt::<32>()?;
test_merkleproof_only_existence_verify_opt::<40>()?;
test_merkleproof_only_existence_verify_opt::<64>()?;
test_merkleproof_only_existence_verify_opt::<128>()?;
test_merkleproof_only_existence_verify_opt::<130>()?;
test_merkleproof_only_existence_verify_opt::<250>()?;
test_merkleproof_only_existence_verify_opt::<256>()?;
for max_depth in [10, 16, 32, 40, 64, 128, 130, 250, 256] {
test_merkleproof_only_existence_verify_opt(max_depth)?;
}
Ok(())
}
fn test_merkleproof_only_existence_verify_opt<const MD: usize>() -> Result<()> {
fn test_merkleproof_only_existence_verify_opt(max_depth: usize) -> Result<()> {
let mut kvs: HashMap<Value, Value> = HashMap::new();
for i in 0..10 {
kvs.insert(Value::from(hash_value(&Value::from(i))), Value::from(i));
}
let tree = MerkleTree::new(MD, &kvs)?;
let tree = MerkleTree::new(max_depth, &kvs)?;
let key = Value::from(hash_value(&Value::from(5)));
let (value, proof) = tree.prove(&key)?;
assert_eq!(value, Value::from(5));
assert_eq!(proof.existence, true);
MerkleTree::verify(MD, tree.root(), &proof, &key, &value)?;
MerkleTree::verify(max_depth, tree.root(), &proof, &key, &value)?;
// circuit
let config = CircuitConfig::standard_recursion_config();
let mut builder = CircuitBuilder::<F, D>::new(config);
let mut pw = PartialWitness::<F>::new();
let targets = MerkleProofExistenceCircuit::<MD>::add_targets(&mut builder)?;
let targets = MerkleProofExistenceGate { max_depth }.eval(&mut builder)?;
targets.set_targets(&mut pw, tree.root(), proof, key, value)?;
// generate & verify proof
@ -564,19 +558,19 @@ pub mod tests {
kvs.insert(Value::from(5), Value::from(1005));
kvs.insert(Value::from(13), Value::from(1013));
const MD: usize = 5;
let tree = MerkleTree::new(MD, &kvs)?;
let max_depth = 5;
let tree = MerkleTree::new(max_depth, &kvs)?;
// existence
test_merkletree_edgecase_opt::<MD>(&tree, Value::from(5))?;
test_merkletree_edgecase_opt(max_depth, &tree, Value::from(5))?;
// non-existence case i) expected leaf does not exist
test_merkletree_edgecase_opt::<MD>(&tree, Value::from(1))?;
test_merkletree_edgecase_opt(max_depth, &tree, Value::from(1))?;
// non-existence case ii) expected leaf does exist but it has a different 'key'
test_merkletree_edgecase_opt::<MD>(&tree, Value::from(21))?;
test_merkletree_edgecase_opt(max_depth, &tree, Value::from(21))?;
Ok(())
}
fn test_merkletree_edgecase_opt<const MD: usize>(tree: &MerkleTree, key: Value) -> Result<()> {
fn test_merkletree_edgecase_opt(max_depth: usize, tree: &MerkleTree, key: Value) -> Result<()> {
let contains = tree.contains(&key)?;
// generate merkleproof
let (value, proof) = if contains {
@ -590,9 +584,9 @@ pub mod tests {
// verify the proof (non circuit)
if proof.existence {
MerkleTree::verify(MD, tree.root(), &proof, &key, &value)?;
MerkleTree::verify(max_depth, tree.root(), &proof, &key, &value)?;
} else {
MerkleTree::verify_nonexistence(MD, tree.root(), &proof, &key)?;
MerkleTree::verify_nonexistence(max_depth, tree.root(), &proof, &key)?;
}
// circuit
@ -600,7 +594,7 @@ pub mod tests {
let mut builder = CircuitBuilder::<F, D>::new(config);
let mut pw = PartialWitness::<F>::new();
let targets = MerkleProofCircuit::<MD>::add_targets(&mut builder)?;
let targets = MerkleProofGate { max_depth }.eval(&mut builder)?;
targets.set_targets(&mut pw, proof.existence, tree.root(), proof, key, value)?;
// generate & verify proof
@ -617,8 +611,8 @@ pub mod tests {
for i in 0..10 {
kvs.insert(Value::from(i), Value::from(i));
}
const MD: usize = 16;
let tree = MerkleTree::new(MD, &kvs)?;
let max_depth = 16;
let tree = MerkleTree::new(max_depth, &kvs)?;
let key = Value::from(3);
let (value, proof) = tree.prove(&key)?;
@ -626,11 +620,11 @@ pub mod tests {
// build another tree with an extra key-value, so that it has a
// different root
kvs.insert(Value::from(100), Value::from(100));
let tree2 = MerkleTree::new(MD, &kvs)?;
let tree2 = MerkleTree::new(max_depth, &kvs)?;
MerkleTree::verify(MD, tree.root(), &proof, &key, &value)?;
MerkleTree::verify(max_depth, tree.root(), &proof, &key, &value)?;
assert_eq!(
MerkleTree::verify(MD, tree2.root(), &proof, &key, &value)
MerkleTree::verify(max_depth, tree2.root(), &proof, &key, &value)
.unwrap_err()
.to_string(),
"proof of inclusion does not verify"
@ -641,7 +635,7 @@ pub mod tests {
let mut builder = CircuitBuilder::<F, D>::new(config);
let mut pw = PartialWitness::<F>::new();
let targets = MerkleProofCircuit::<MD>::add_targets(&mut builder)?;
let targets = MerkleProofGate { max_depth }.eval(&mut builder)?;
targets.set_targets(&mut pw, true, tree2.root(), proof, key, value)?;
// generate proof, expecting it to fail (since we're using the wrong