Groth16 prover

[Vindaar]

Edit: The PR previously contained a long description of my debugging of the Groth16 prover implementation. For anyone interested, it can still be found here.

This PR implements a Groth16 prover and verifier, which requires SnarkJS produced .wtns, .zkey and .r1cs binary files.

• Implement verifier

[Vindaar]

I just had another look at SnarkJS to see if I can figure out the double Montgomery encoding situation.

As it turns out at least I could identify the SnarkJS code that writes the coefficients as doubly Montgomery encoded. This happens here:

const nR2 = curve.Fr.mul(n, R2r);
curve.Fr.toRprLE(buffCoeff, 12, nR2);

where R2r is:

const R2r = curve.Fr.e(Scalar.mod(Scalar.mul(Rr,Rr), primeR));

Which at the very least finally ends the question of whether I'm imagining things or not.

I still have no clue why this is done to be honest. The commits touching these lines are not very illuminating either.

[Vindaar]

I guess the code at the moment only works on the 64-bit backend. That rings a bell, it was probably due to the parsing of the binary files. Need to check.

[mratsim]

LGTM.

I have added several notes for further refactoring and will follow-up with an issue once that is merged. I think the PR is too big at the moment to add further non-critical fix.

Critical if possible would be to fix the 32-bit tests.

The FFT part is not worth changing at the moment but is important to merge now because the following future work use FFT:

• FRI for zkVM acceleration
• Whir for Lean Ethereum
• PeerDAS. Ethereum 2D KZG commitments with Error Correcting Codes

[mratsim]

Suggested change

	## Stringify an elliptic curve point to Hex
	## Stringify an elliptic curve point to decimal

[mratsim]

Actually it is constant-time see low-level impl:

constantine/constantine/math/io/io_bigints.nim

Lines 371 to 385 in b3f4ebd

	func toDecimal*(a: BigInt): string =
	## Convert to a decimal string.
	##
	## This procedure is intended for configuration, prototyping, research and debugging purposes.
	## You MUST NOT use it for production.
	##
	## This function is constant-time.
	## This function does heap-allocation.
	const len = decimalLength(BigInt.bits)
	result = newString(len)
	var a = a
	for i in countdown(len-1, 0):
	let c = ord('0') + a.div10().int
	result[i] = char(c)

The mid-level impl is wrong:

constantine/constantine/math/io/io_fields.nim

Lines 110 to 117 in b3f4ebd

	func toDecimal*(f: FF): string =
	## Convert to a decimal string.
	##
	## It is intended for configuration, prototyping, research and debugging purposes.
	## You MUST NOT use it for production.
	##
	## This function is NOT constant-time at the moment.
	f.toBig().toDecimal()

But it's fine, afaik, it's only used for debugging purposes.

[mratsim]

Suggested change

	## Stringify a tower field element to hex.
	## Stringify a tower field element to decimal.

[mratsim]

Curious the PR that introduced scalarMul_vartime also rewrote this part of the FFT and the argument order should be scalarMul_vartime(EC, scalar).

[mratsim]

Ah my mistake, the argument order when out-of-place is correct. (EC out, scalar, EC in)

[mratsim]

on fields.

Note that there was an implementation here: https://github.com/mratsim/constantine/blob/v0.2.0/research/kzg/fft_fr.nim

[mratsim]

TODO: we will probably want to remove all seqs here in the future to unify with GPU impl.

Also we just don't use seq in Constantine except at the very edge for easy integration with Nim

[mratsim]

All non-var parameters should be openArray instead of seq

[mratsim]

TODO: remove seq creation and prefer the caller to pass allocated buffers if possible

[mratsim]

Note: This patterns also exist in KZG and IPA and other commitments:

See

constantine/tests/t_ethereum_verkle_ipa_test_helper.nim

Lines 36 to 52 in b3f4ebd

	func ipaEvaluate* [Fr] (res: var Fr, poly: openArray[Fr], point: Fr, n: static int) =
	var powers {.noInit.}: array[n,Fr]
	powers.asUnchecked().computePowers(point, poly.len)
	res.setZero()
	for i in 0 ..< poly.len:
	var tmp: Fr
	tmp.prod(powers[i], poly[i])
	res.sum(res,tmp)
	res.setZero()
	for i in 0 ..< poly.len:
	var tmp {.noInit.}: Fr
	tmp.prod(powers[i], poly[i])
	res.sum(res,tmp)

So there is a computePowers proc, though it does allocate more.

constantine/constantine/math/arithmetic/finite_fields.nim

Lines 841 to 854 in b3f4ebd

	func computePowers*[Name](dst: ptr UncheckedArray[FF[Name]], base: FF[Name], len: int) =
	## We need linearly independent random numbers
	## for batch proof sampling.
	## Powers are linearly independent.
	## It's also likely faster than calling a fast RNG + modular reduction
	## to be in 0 < number < curve_order
	## since modular reduction needs modular multiplication or a division anyway.
	let N = len
	if N >= 1:
	dst[0].setOne()
	if N >= 2:
	dst[1] = base
	for i in 2 ..< N:
	dst[i].prod(dst[i-1], base)

[mratsim]

TODO: This can be rewritten by negating either proof.A or proof.B then use multipairing and check that the result is the pairing group neutral element (i.e. 1 in GT/Fp12)