mirror of
https://github.com/Qortal/pirate-librustzcash.git
synced 2025-11-03 04:47:02 +00:00
cargo fmt zcash_proofs
This commit is contained in:
Eirik Ogilvie-Wigley
@@ -1,31 +1,20 @@
|
||||
use ff::{Field, PrimeField, PrimeFieldRepr};
|
||||
|
||||
use bellman::{
|
||||
SynthesisError,
|
||||
ConstraintSystem,
|
||||
Circuit
|
||||
};
|
||||
use bellman::{Circuit, ConstraintSystem, SynthesisError};
|
||||
|
||||
use zcash_primitives::jubjub::{
|
||||
JubjubEngine,
|
||||
FixedGenerators
|
||||
};
|
||||
use zcash_primitives::jubjub::{FixedGenerators, JubjubEngine};
|
||||
|
||||
use zcash_primitives::constants;
|
||||
|
||||
use zcash_primitives::primitives::{
|
||||
ValueCommitment,
|
||||
ProofGenerationKey,
|
||||
PaymentAddress
|
||||
};
|
||||
use zcash_primitives::primitives::{PaymentAddress, ProofGenerationKey, ValueCommitment};
|
||||
|
||||
use bellman::gadgets::Assignment;
|
||||
use bellman::gadgets::boolean;
|
||||
use super::ecc;
|
||||
use super::pedersen_hash;
|
||||
use bellman::gadgets::blake2s;
|
||||
use bellman::gadgets::num;
|
||||
use bellman::gadgets::boolean;
|
||||
use bellman::gadgets::multipack;
|
||||
use bellman::gadgets::num;
|
||||
use bellman::gadgets::Assignment;
|
||||
|
||||
pub const TREE_DEPTH: usize = zcash_primitives::sapling::SAPLING_COMMITMENT_TREE_DEPTH;
|
||||
|
||||
@@ -54,7 +43,7 @@ pub struct Spend<'a, E: JubjubEngine> {
|
||||
|
||||
/// The anchor; the root of the tree. If the note being
|
||||
/// spent is zero-value, this can be anything.
|
||||
pub anchor: Option<E::Fr>
|
||||
pub anchor: Option<E::Fr>,
|
||||
}
|
||||
|
||||
/// This is an output circuit instance.
|
||||
@@ -71,7 +60,7 @@ pub struct Output<'a, E: JubjubEngine> {
|
||||
pub commitment_randomness: Option<E::Fs>,
|
||||
|
||||
/// The ephemeral secret key for DH with recipient
|
||||
pub esk: Option<E::Fs>
|
||||
pub esk: Option<E::Fs>,
|
||||
}
|
||||
|
||||
/// Exposes a Pedersen commitment to the value as an
|
||||
@@ -79,15 +68,16 @@ pub struct Output<'a, E: JubjubEngine> {
|
||||
fn expose_value_commitment<E, CS>(
|
||||
mut cs: CS,
|
||||
value_commitment: Option<ValueCommitment<E>>,
|
||||
params: &E::Params
|
||||
params: &E::Params,
|
||||
) -> Result<Vec<boolean::Boolean>, SynthesisError>
|
||||
where E: JubjubEngine,
|
||||
CS: ConstraintSystem<E>
|
||||
where
|
||||
E: JubjubEngine,
|
||||
CS: ConstraintSystem<E>,
|
||||
{
|
||||
// Booleanize the value into little-endian bit order
|
||||
let value_bits = boolean::u64_into_boolean_vec_le(
|
||||
cs.namespace(|| "value"),
|
||||
value_commitment.as_ref().map(|c| c.value)
|
||||
value_commitment.as_ref().map(|c| c.value),
|
||||
)?;
|
||||
|
||||
// Compute the note value in the exponent
|
||||
@@ -95,7 +85,7 @@ fn expose_value_commitment<E, CS>(
|
||||
cs.namespace(|| "compute the value in the exponent"),
|
||||
FixedGenerators::ValueCommitmentValue,
|
||||
&value_bits,
|
||||
params
|
||||
params,
|
||||
)?;
|
||||
|
||||
// Booleanize the randomness. This does not ensure
|
||||
@@ -103,7 +93,7 @@ fn expose_value_commitment<E, CS>(
|
||||
// it doesn't matter for security.
|
||||
let rcv = boolean::field_into_boolean_vec_le(
|
||||
cs.namespace(|| "rcv"),
|
||||
value_commitment.as_ref().map(|c| c.randomness)
|
||||
value_commitment.as_ref().map(|c| c.randomness),
|
||||
)?;
|
||||
|
||||
// Compute the randomness in the exponent
|
||||
@@ -111,15 +101,11 @@ fn expose_value_commitment<E, CS>(
|
||||
cs.namespace(|| "computation of rcv"),
|
||||
FixedGenerators::ValueCommitmentRandomness,
|
||||
&rcv,
|
||||
params
|
||||
params,
|
||||
)?;
|
||||
|
||||
// Compute the Pedersen commitment to the value
|
||||
let cv = value.add(
|
||||
cs.namespace(|| "computation of cv"),
|
||||
&rcv,
|
||||
params
|
||||
)?;
|
||||
let cv = value.add(cs.namespace(|| "computation of cv"), &rcv, params)?;
|
||||
|
||||
// Expose the commitment as an input to the circuit
|
||||
cv.inputize(cs.namespace(|| "commitment point"))?;
|
||||
@@ -128,43 +114,32 @@ fn expose_value_commitment<E, CS>(
|
||||
}
|
||||
|
||||
impl<'a, E: JubjubEngine> Circuit<E> for Spend<'a, E> {
|
||||
fn synthesize<CS: ConstraintSystem<E>>(self, cs: &mut CS) -> Result<(), SynthesisError>
|
||||
{
|
||||
fn synthesize<CS: ConstraintSystem<E>>(self, cs: &mut CS) -> Result<(), SynthesisError> {
|
||||
// Prover witnesses ak (ensures that it's on the curve)
|
||||
let ak = ecc::EdwardsPoint::witness(
|
||||
cs.namespace(|| "ak"),
|
||||
self.proof_generation_key.as_ref().map(|k| k.ak.clone()),
|
||||
self.params
|
||||
self.params,
|
||||
)?;
|
||||
|
||||
// There are no sensible attacks on small order points
|
||||
// of ak (that we're aware of!) but it's a cheap check,
|
||||
// so we do it.
|
||||
ak.assert_not_small_order(
|
||||
cs.namespace(|| "ak not small order"),
|
||||
self.params
|
||||
)?;
|
||||
ak.assert_not_small_order(cs.namespace(|| "ak not small order"), self.params)?;
|
||||
|
||||
// Rerandomize ak and expose it as an input to the circuit
|
||||
{
|
||||
let ar = boolean::field_into_boolean_vec_le(
|
||||
cs.namespace(|| "ar"),
|
||||
self.ar
|
||||
)?;
|
||||
let ar = boolean::field_into_boolean_vec_le(cs.namespace(|| "ar"), self.ar)?;
|
||||
|
||||
// Compute the randomness in the exponent
|
||||
let ar = ecc::fixed_base_multiplication(
|
||||
cs.namespace(|| "computation of randomization for the signing key"),
|
||||
FixedGenerators::SpendingKeyGenerator,
|
||||
&ar,
|
||||
self.params
|
||||
self.params,
|
||||
)?;
|
||||
|
||||
let rk = ak.add(
|
||||
cs.namespace(|| "computation of rk"),
|
||||
&ar,
|
||||
self.params
|
||||
)?;
|
||||
let rk = ak.add(cs.namespace(|| "computation of rk"), &ar, self.params)?;
|
||||
|
||||
rk.inputize(cs.namespace(|| "rk"))?;
|
||||
}
|
||||
@@ -175,7 +150,7 @@ impl<'a, E: JubjubEngine> Circuit<E> for Spend<'a, E> {
|
||||
// Witness nsk as bits
|
||||
let nsk = boolean::field_into_boolean_vec_le(
|
||||
cs.namespace(|| "nsk"),
|
||||
self.proof_generation_key.as_ref().map(|k| k.nsk.clone())
|
||||
self.proof_generation_key.as_ref().map(|k| k.nsk.clone()),
|
||||
)?;
|
||||
|
||||
// NB: We don't ensure that the bit representation of nsk
|
||||
@@ -188,7 +163,7 @@ impl<'a, E: JubjubEngine> Circuit<E> for Spend<'a, E> {
|
||||
cs.namespace(|| "computation of nk"),
|
||||
FixedGenerators::ProofGenerationKey,
|
||||
&nsk,
|
||||
self.params
|
||||
self.params,
|
||||
)?;
|
||||
}
|
||||
|
||||
@@ -196,9 +171,7 @@ impl<'a, E: JubjubEngine> Circuit<E> for Spend<'a, E> {
|
||||
let mut ivk_preimage = vec![];
|
||||
|
||||
// Place ak in the preimage for CRH^ivk
|
||||
ivk_preimage.extend(
|
||||
ak.repr(cs.namespace(|| "representation of ak"))?
|
||||
);
|
||||
ivk_preimage.extend(ak.repr(cs.namespace(|| "representation of ak"))?);
|
||||
|
||||
// This is the nullifier preimage for PRF^nf
|
||||
let mut nf_preimage = vec![];
|
||||
@@ -206,9 +179,7 @@ impl<'a, E: JubjubEngine> Circuit<E> for Spend<'a, E> {
|
||||
// Extend ivk and nf preimages with the representation of
|
||||
// nk.
|
||||
{
|
||||
let repr_nk = nk.repr(
|
||||
cs.namespace(|| "representation of nk")
|
||||
)?;
|
||||
let repr_nk = nk.repr(cs.namespace(|| "representation of nk"))?;
|
||||
|
||||
ivk_preimage.extend(repr_nk.iter().cloned());
|
||||
nf_preimage.extend(repr_nk);
|
||||
@@ -221,7 +192,7 @@ impl<'a, E: JubjubEngine> Circuit<E> for Spend<'a, E> {
|
||||
let mut ivk = blake2s::blake2s(
|
||||
cs.namespace(|| "computation of ivk"),
|
||||
&ivk_preimage,
|
||||
constants::CRH_IVK_PERSONALIZATION
|
||||
constants::CRH_IVK_PERSONALIZATION,
|
||||
)?;
|
||||
|
||||
// drop_5 to ensure it's in the field
|
||||
@@ -239,7 +210,7 @@ impl<'a, E: JubjubEngine> Circuit<E> for Spend<'a, E> {
|
||||
ecc::EdwardsPoint::witness(
|
||||
cs.namespace(|| "witness g_d"),
|
||||
self.payment_address.as_ref().and_then(|a| a.g_d(params)),
|
||||
self.params
|
||||
self.params,
|
||||
)?
|
||||
};
|
||||
|
||||
@@ -247,17 +218,10 @@ impl<'a, E: JubjubEngine> Circuit<E> for Spend<'a, E> {
|
||||
// is already done in the Output circuit, and this proof ensures
|
||||
// g_d is bound to a product of that check, but for defense in
|
||||
// depth let's check it anyway. It's cheap.
|
||||
g_d.assert_not_small_order(
|
||||
cs.namespace(|| "g_d not small order"),
|
||||
self.params
|
||||
)?;
|
||||
g_d.assert_not_small_order(cs.namespace(|| "g_d not small order"), self.params)?;
|
||||
|
||||
// Compute pk_d = g_d^ivk
|
||||
let pk_d = g_d.mul(
|
||||
cs.namespace(|| "compute pk_d"),
|
||||
&ivk,
|
||||
self.params
|
||||
)?;
|
||||
let pk_d = g_d.mul(cs.namespace(|| "compute pk_d"), &ivk, self.params)?;
|
||||
|
||||
// Compute note contents:
|
||||
// value (in big endian) followed by g_d and pk_d
|
||||
@@ -271,18 +235,14 @@ impl<'a, E: JubjubEngine> Circuit<E> for Spend<'a, E> {
|
||||
let value_bits = expose_value_commitment(
|
||||
cs.namespace(|| "value commitment"),
|
||||
self.value_commitment,
|
||||
self.params
|
||||
self.params,
|
||||
)?;
|
||||
|
||||
// Compute the note's value as a linear combination
|
||||
// of the bits.
|
||||
let mut coeff = E::Fr::one();
|
||||
for bit in &value_bits {
|
||||
value_num = value_num.add_bool_with_coeff(
|
||||
CS::one(),
|
||||
bit,
|
||||
coeff
|
||||
);
|
||||
value_num = value_num.add_bool_with_coeff(CS::one(), bit, coeff);
|
||||
coeff.double();
|
||||
}
|
||||
|
||||
@@ -291,14 +251,10 @@ impl<'a, E: JubjubEngine> Circuit<E> for Spend<'a, E> {
|
||||
}
|
||||
|
||||
// Place g_d in the note
|
||||
note_contents.extend(
|
||||
g_d.repr(cs.namespace(|| "representation of g_d"))?
|
||||
);
|
||||
note_contents.extend(g_d.repr(cs.namespace(|| "representation of g_d"))?);
|
||||
|
||||
// Place pk_d in the note
|
||||
note_contents.extend(
|
||||
pk_d.repr(cs.namespace(|| "representation of pk_d"))?
|
||||
);
|
||||
note_contents.extend(pk_d.repr(cs.namespace(|| "representation of pk_d"))?);
|
||||
|
||||
assert_eq!(
|
||||
note_contents.len(),
|
||||
@@ -312,14 +268,14 @@ impl<'a, E: JubjubEngine> Circuit<E> for Spend<'a, E> {
|
||||
cs.namespace(|| "note content hash"),
|
||||
pedersen_hash::Personalization::NoteCommitment,
|
||||
¬e_contents,
|
||||
self.params
|
||||
self.params,
|
||||
)?;
|
||||
|
||||
{
|
||||
// Booleanize the randomness for the note commitment
|
||||
let rcm = boolean::field_into_boolean_vec_le(
|
||||
cs.namespace(|| "rcm"),
|
||||
self.commitment_randomness
|
||||
self.commitment_randomness,
|
||||
)?;
|
||||
|
||||
// Compute the note commitment randomness in the exponent
|
||||
@@ -327,7 +283,7 @@ impl<'a, E: JubjubEngine> Circuit<E> for Spend<'a, E> {
|
||||
cs.namespace(|| "computation of commitment randomness"),
|
||||
FixedGenerators::NoteCommitmentRandomness,
|
||||
&rcm,
|
||||
self.params
|
||||
self.params,
|
||||
)?;
|
||||
|
||||
// Randomize the note commitment. Pedersen hashes are not
|
||||
@@ -335,7 +291,7 @@ impl<'a, E: JubjubEngine> Circuit<E> for Spend<'a, E> {
|
||||
cm = cm.add(
|
||||
cs.namespace(|| "randomization of note commitment"),
|
||||
&rcm,
|
||||
self.params
|
||||
self.params,
|
||||
)?;
|
||||
}
|
||||
|
||||
@@ -356,7 +312,7 @@ impl<'a, E: JubjubEngine> Circuit<E> for Spend<'a, E> {
|
||||
// depth of the tree.
|
||||
let cur_is_right = boolean::Boolean::from(boolean::AllocatedBit::alloc(
|
||||
cs.namespace(|| "position bit"),
|
||||
e.map(|e| e.1)
|
||||
e.map(|e| e.1),
|
||||
)?);
|
||||
|
||||
// Push this boolean for nullifier computation later
|
||||
@@ -364,19 +320,15 @@ impl<'a, E: JubjubEngine> Circuit<E> for Spend<'a, E> {
|
||||
|
||||
// Witness the authentication path element adjacent
|
||||
// at this depth.
|
||||
let path_element = num::AllocatedNum::alloc(
|
||||
cs.namespace(|| "path element"),
|
||||
|| {
|
||||
Ok(e.get()?.0)
|
||||
}
|
||||
)?;
|
||||
let path_element =
|
||||
num::AllocatedNum::alloc(cs.namespace(|| "path element"), || Ok(e.get()?.0))?;
|
||||
|
||||
// Swap the two if the current subtree is on the right
|
||||
let (xl, xr) = num::AllocatedNum::conditionally_reverse(
|
||||
cs.namespace(|| "conditional reversal of preimage"),
|
||||
&cur,
|
||||
&path_element,
|
||||
&cur_is_right
|
||||
&cur_is_right,
|
||||
)?;
|
||||
|
||||
// We don't need to be strict, because the function is
|
||||
@@ -392,20 +344,19 @@ impl<'a, E: JubjubEngine> Circuit<E> for Spend<'a, E> {
|
||||
cs.namespace(|| "computation of pedersen hash"),
|
||||
pedersen_hash::Personalization::MerkleTree(i),
|
||||
&preimage,
|
||||
self.params
|
||||
)?.get_x().clone(); // Injective encoding
|
||||
self.params,
|
||||
)?
|
||||
.get_x()
|
||||
.clone(); // Injective encoding
|
||||
}
|
||||
|
||||
{
|
||||
let real_anchor_value = self.anchor;
|
||||
|
||||
// Allocate the "real" anchor that will be exposed.
|
||||
let rt = num::AllocatedNum::alloc(
|
||||
cs.namespace(|| "conditional anchor"),
|
||||
|| {
|
||||
Ok(*real_anchor_value.get()?)
|
||||
}
|
||||
)?;
|
||||
let rt = num::AllocatedNum::alloc(cs.namespace(|| "conditional anchor"), || {
|
||||
Ok(*real_anchor_value.get()?)
|
||||
})?;
|
||||
|
||||
// (cur - rt) * value = 0
|
||||
// if value is zero, cur and rt can be different
|
||||
@@ -414,7 +365,7 @@ impl<'a, E: JubjubEngine> Circuit<E> for Spend<'a, E> {
|
||||
|| "conditionally enforce correct root",
|
||||
|lc| lc + cur.get_variable() - rt.get_variable(),
|
||||
|lc| lc + &value_num.lc(E::Fr::one()),
|
||||
|lc| lc
|
||||
|lc| lc,
|
||||
);
|
||||
|
||||
// Expose the anchor
|
||||
@@ -430,29 +381,27 @@ impl<'a, E: JubjubEngine> Circuit<E> for Spend<'a, E> {
|
||||
cs.namespace(|| "g^position"),
|
||||
FixedGenerators::NullifierPosition,
|
||||
&position_bits,
|
||||
self.params
|
||||
self.params,
|
||||
)?;
|
||||
|
||||
// Add the position to the commitment
|
||||
rho = rho.add(
|
||||
cs.namespace(|| "faerie gold prevention"),
|
||||
&position,
|
||||
self.params
|
||||
self.params,
|
||||
)?;
|
||||
}
|
||||
|
||||
|
||||
// Let's compute nf = BLAKE2s(nk || rho)
|
||||
nf_preimage.extend(
|
||||
rho.repr(cs.namespace(|| "representation of rho"))?
|
||||
);
|
||||
nf_preimage.extend(rho.repr(cs.namespace(|| "representation of rho"))?);
|
||||
|
||||
assert_eq!(nf_preimage.len(), 512);
|
||||
|
||||
|
||||
// Compute nf
|
||||
let nf = blake2s::blake2s(
|
||||
cs.namespace(|| "nf computation"),
|
||||
&nf_preimage,
|
||||
constants::PRF_NF_PERSONALIZATION
|
||||
constants::PRF_NF_PERSONALIZATION,
|
||||
)?;
|
||||
|
||||
multipack::pack_into_inputs(cs.namespace(|| "pack nullifier"), &nf)
|
||||
@@ -460,8 +409,7 @@ impl<'a, E: JubjubEngine> Circuit<E> for Spend<'a, E> {
|
||||
}
|
||||
|
||||
impl<'a, E: JubjubEngine> Circuit<E> for Output<'a, E> {
|
||||
fn synthesize<CS: ConstraintSystem<E>>(self, cs: &mut CS) -> Result<(), SynthesisError>
|
||||
{
|
||||
fn synthesize<CS: ConstraintSystem<E>>(self, cs: &mut CS) -> Result<(), SynthesisError> {
|
||||
// Let's start to construct our note, which contains
|
||||
// value (big endian)
|
||||
let mut note_contents = vec![];
|
||||
@@ -471,7 +419,7 @@ impl<'a, E: JubjubEngine> Circuit<E> for Output<'a, E> {
|
||||
note_contents.extend(expose_value_commitment(
|
||||
cs.namespace(|| "value commitment"),
|
||||
self.value_commitment,
|
||||
self.params
|
||||
self.params,
|
||||
)?);
|
||||
|
||||
// Let's deal with g_d
|
||||
@@ -483,7 +431,7 @@ impl<'a, E: JubjubEngine> Circuit<E> for Output<'a, E> {
|
||||
let g_d = ecc::EdwardsPoint::witness(
|
||||
cs.namespace(|| "witness g_d"),
|
||||
self.payment_address.as_ref().and_then(|a| a.g_d(params)),
|
||||
self.params
|
||||
self.params,
|
||||
)?;
|
||||
|
||||
// g_d is ensured to be large order. The relationship
|
||||
@@ -495,29 +443,17 @@ impl<'a, E: JubjubEngine> Circuit<E> for Output<'a, E> {
|
||||
//
|
||||
// Further, if it were small order, epk would be
|
||||
// small order too!
|
||||
g_d.assert_not_small_order(
|
||||
cs.namespace(|| "g_d not small order"),
|
||||
self.params
|
||||
)?;
|
||||
g_d.assert_not_small_order(cs.namespace(|| "g_d not small order"), self.params)?;
|
||||
|
||||
// Extend our note contents with the representation of
|
||||
// g_d.
|
||||
note_contents.extend(
|
||||
g_d.repr(cs.namespace(|| "representation of g_d"))?
|
||||
);
|
||||
note_contents.extend(g_d.repr(cs.namespace(|| "representation of g_d"))?);
|
||||
|
||||
// Booleanize our ephemeral secret key
|
||||
let esk = boolean::field_into_boolean_vec_le(
|
||||
cs.namespace(|| "esk"),
|
||||
self.esk
|
||||
)?;
|
||||
let esk = boolean::field_into_boolean_vec_le(cs.namespace(|| "esk"), self.esk)?;
|
||||
|
||||
// Create the ephemeral public key from g_d.
|
||||
let epk = g_d.mul(
|
||||
cs.namespace(|| "epk computation"),
|
||||
&esk,
|
||||
self.params
|
||||
)?;
|
||||
let epk = g_d.mul(cs.namespace(|| "epk computation"), &esk, self.params)?;
|
||||
|
||||
// Expose epk publicly.
|
||||
epk.inputize(cs.namespace(|| "epk"))?;
|
||||
@@ -534,13 +470,13 @@ impl<'a, E: JubjubEngine> Circuit<E> for Output<'a, E> {
|
||||
// endian bits (to match the representation)
|
||||
let y_contents = boolean::field_into_boolean_vec_le(
|
||||
cs.namespace(|| "pk_d bits of y"),
|
||||
pk_d.map(|e| e.1)
|
||||
pk_d.map(|e| e.1),
|
||||
)?;
|
||||
|
||||
// Witness the sign bit
|
||||
let sign_bit = boolean::Boolean::from(boolean::AllocatedBit::alloc(
|
||||
cs.namespace(|| "pk_d bit of x"),
|
||||
pk_d.map(|e| e.0.into_repr().is_odd())
|
||||
pk_d.map(|e| e.0.into_repr().is_odd()),
|
||||
)?);
|
||||
|
||||
// Extend the note with pk_d representation
|
||||
@@ -560,14 +496,14 @@ impl<'a, E: JubjubEngine> Circuit<E> for Output<'a, E> {
|
||||
cs.namespace(|| "note content hash"),
|
||||
pedersen_hash::Personalization::NoteCommitment,
|
||||
¬e_contents,
|
||||
self.params
|
||||
self.params,
|
||||
)?;
|
||||
|
||||
{
|
||||
// Booleanize the randomness
|
||||
let rcm = boolean::field_into_boolean_vec_le(
|
||||
cs.namespace(|| "rcm"),
|
||||
self.commitment_randomness
|
||||
self.commitment_randomness,
|
||||
)?;
|
||||
|
||||
// Compute the note commitment randomness in the exponent
|
||||
@@ -575,14 +511,14 @@ impl<'a, E: JubjubEngine> Circuit<E> for Output<'a, E> {
|
||||
cs.namespace(|| "computation of commitment randomness"),
|
||||
FixedGenerators::NoteCommitmentRandomness,
|
||||
&rcm,
|
||||
self.params
|
||||
self.params,
|
||||
)?;
|
||||
|
||||
// Randomize our note commitment
|
||||
cm = cm.add(
|
||||
cs.namespace(|| "randomization of note commitment"),
|
||||
&rcm,
|
||||
self.params
|
||||
self.params,
|
||||
)?;
|
||||
}
|
||||
|
||||
@@ -604,7 +540,7 @@ fn test_input_circuit_with_bls12_381() {
|
||||
use rand_core::{RngCore, SeedableRng};
|
||||
use rand_xorshift::XorShiftRng;
|
||||
use zcash_primitives::{
|
||||
jubjub::{JubjubBls12, fs, edwards},
|
||||
jubjub::{edwards, fs, JubjubBls12},
|
||||
pedersen_hash,
|
||||
primitives::{Diversifier, Note, ProofGenerationKey},
|
||||
};
|
||||
@@ -628,7 +564,7 @@ fn test_input_circuit_with_bls12_381() {
|
||||
|
||||
let proof_generation_key = ProofGenerationKey {
|
||||
ak: ak.clone(),
|
||||
nsk: nsk.clone()
|
||||
nsk: nsk.clone(),
|
||||
};
|
||||
|
||||
let viewing_key = proof_generation_key.into_viewing_key(params);
|
||||
@@ -642,11 +578,7 @@ fn test_input_circuit_with_bls12_381() {
|
||||
Diversifier(d)
|
||||
};
|
||||
|
||||
if let Some(p) = viewing_key.into_payment_address(
|
||||
diversifier,
|
||||
params
|
||||
)
|
||||
{
|
||||
if let Some(p) = viewing_key.into_payment_address(diversifier, params) {
|
||||
payment_address = p;
|
||||
break;
|
||||
}
|
||||
@@ -664,15 +596,14 @@ fn test_input_circuit_with_bls12_381() {
|
||||
value: value_commitment.value,
|
||||
g_d: g_d.clone(),
|
||||
pk_d: payment_address.pk_d.clone(),
|
||||
r: commitment_randomness.clone()
|
||||
r: commitment_randomness.clone(),
|
||||
};
|
||||
|
||||
let mut position = 0u64;
|
||||
let cm: Fr = note.cm(params);
|
||||
let mut cur = cm.clone();
|
||||
|
||||
for (i, val) in auth_path.clone().into_iter().enumerate()
|
||||
{
|
||||
for (i, val) in auth_path.clone().into_iter().enumerate() {
|
||||
let (uncle, b) = val.unwrap();
|
||||
|
||||
let mut lhs = cur;
|
||||
@@ -691,10 +622,12 @@ fn test_input_circuit_with_bls12_381() {
|
||||
cur = pedersen_hash::pedersen_hash::<Bls12, _>(
|
||||
pedersen_hash::Personalization::MerkleTree(i),
|
||||
lhs.into_iter()
|
||||
.take(Fr::NUM_BITS as usize)
|
||||
.chain(rhs.into_iter().take(Fr::NUM_BITS as usize)),
|
||||
params
|
||||
).into_xy().0;
|
||||
.take(Fr::NUM_BITS as usize)
|
||||
.chain(rhs.into_iter().take(Fr::NUM_BITS as usize)),
|
||||
params,
|
||||
)
|
||||
.into_xy()
|
||||
.0;
|
||||
|
||||
if b {
|
||||
position |= 1 << i;
|
||||
@@ -716,14 +649,17 @@ fn test_input_circuit_with_bls12_381() {
|
||||
commitment_randomness: Some(commitment_randomness),
|
||||
ar: Some(ar),
|
||||
auth_path: auth_path.clone(),
|
||||
anchor: Some(cur)
|
||||
anchor: Some(cur),
|
||||
};
|
||||
|
||||
instance.synthesize(&mut cs).unwrap();
|
||||
|
||||
assert!(cs.is_satisfied());
|
||||
assert_eq!(cs.num_constraints(), 98777);
|
||||
assert_eq!(cs.hash(), "d37c738e83df5d9b0bb6495ac96abf21bcb2697477e2c15c2c7916ff7a3b6a89");
|
||||
assert_eq!(
|
||||
cs.hash(),
|
||||
"d37c738e83df5d9b0bb6495ac96abf21bcb2697477e2c15c2c7916ff7a3b6a89"
|
||||
);
|
||||
|
||||
assert_eq!(cs.get("randomization of note commitment/x3/num"), cm);
|
||||
|
||||
@@ -731,8 +667,14 @@ fn test_input_circuit_with_bls12_381() {
|
||||
assert_eq!(cs.get_input(0, "ONE"), Fr::one());
|
||||
assert_eq!(cs.get_input(1, "rk/x/input variable"), rk.0);
|
||||
assert_eq!(cs.get_input(2, "rk/y/input variable"), rk.1);
|
||||
assert_eq!(cs.get_input(3, "value commitment/commitment point/x/input variable"), expected_value_cm.0);
|
||||
assert_eq!(cs.get_input(4, "value commitment/commitment point/y/input variable"), expected_value_cm.1);
|
||||
assert_eq!(
|
||||
cs.get_input(3, "value commitment/commitment point/x/input variable"),
|
||||
expected_value_cm.0
|
||||
);
|
||||
assert_eq!(
|
||||
cs.get_input(4, "value commitment/commitment point/y/input variable"),
|
||||
expected_value_cm.1
|
||||
);
|
||||
assert_eq!(cs.get_input(5, "anchor/input variable"), cur);
|
||||
assert_eq!(cs.get_input(6, "pack nullifier/input 0"), expected_nf[0]);
|
||||
assert_eq!(cs.get_input(7, "pack nullifier/input 1"), expected_nf[1]);
|
||||
@@ -748,7 +690,7 @@ fn test_output_circuit_with_bls12_381() {
|
||||
use rand_core::{RngCore, SeedableRng};
|
||||
use rand_xorshift::XorShiftRng;
|
||||
use zcash_primitives::{
|
||||
jubjub::{JubjubBls12, fs, edwards},
|
||||
jubjub::{edwards, fs, JubjubBls12},
|
||||
primitives::{Diversifier, ProofGenerationKey},
|
||||
};
|
||||
|
||||
@@ -769,7 +711,7 @@ fn test_output_circuit_with_bls12_381() {
|
||||
|
||||
let proof_generation_key = ProofGenerationKey {
|
||||
ak: ak.clone(),
|
||||
nsk: nsk.clone()
|
||||
nsk: nsk.clone(),
|
||||
};
|
||||
|
||||
let viewing_key = proof_generation_key.into_viewing_key(params);
|
||||
@@ -783,11 +725,7 @@ fn test_output_circuit_with_bls12_381() {
|
||||
Diversifier(d)
|
||||
};
|
||||
|
||||
if let Some(p) = viewing_key.into_payment_address(
|
||||
diversifier,
|
||||
params
|
||||
)
|
||||
{
|
||||
if let Some(p) = viewing_key.into_payment_address(diversifier, params) {
|
||||
payment_address = p;
|
||||
break;
|
||||
}
|
||||
@@ -804,30 +742,41 @@ fn test_output_circuit_with_bls12_381() {
|
||||
value_commitment: Some(value_commitment.clone()),
|
||||
payment_address: Some(payment_address.clone()),
|
||||
commitment_randomness: Some(commitment_randomness),
|
||||
esk: Some(esk.clone())
|
||||
esk: Some(esk.clone()),
|
||||
};
|
||||
|
||||
instance.synthesize(&mut cs).unwrap();
|
||||
|
||||
assert!(cs.is_satisfied());
|
||||
assert_eq!(cs.num_constraints(), 7827);
|
||||
assert_eq!(cs.hash(), "c26d5cdfe6ccd65c03390902c02e11393ea6bb96aae32a7f2ecb12eb9103faee");
|
||||
assert_eq!(
|
||||
cs.hash(),
|
||||
"c26d5cdfe6ccd65c03390902c02e11393ea6bb96aae32a7f2ecb12eb9103faee"
|
||||
);
|
||||
|
||||
let expected_cm = payment_address.create_note(
|
||||
value_commitment.value,
|
||||
commitment_randomness,
|
||||
params
|
||||
).expect("should be valid").cm(params);
|
||||
let expected_cm = payment_address
|
||||
.create_note(value_commitment.value, commitment_randomness, params)
|
||||
.expect("should be valid")
|
||||
.cm(params);
|
||||
|
||||
let expected_value_cm = value_commitment.cm(params).into_xy();
|
||||
|
||||
let expected_epk = payment_address.g_d(params).expect("should be valid").mul(esk, params);
|
||||
let expected_epk = payment_address
|
||||
.g_d(params)
|
||||
.expect("should be valid")
|
||||
.mul(esk, params);
|
||||
let expected_epk_xy = expected_epk.into_xy();
|
||||
|
||||
assert_eq!(cs.num_inputs(), 6);
|
||||
assert_eq!(cs.get_input(0, "ONE"), Fr::one());
|
||||
assert_eq!(cs.get_input(1, "value commitment/commitment point/x/input variable"), expected_value_cm.0);
|
||||
assert_eq!(cs.get_input(2, "value commitment/commitment point/y/input variable"), expected_value_cm.1);
|
||||
assert_eq!(
|
||||
cs.get_input(1, "value commitment/commitment point/x/input variable"),
|
||||
expected_value_cm.0
|
||||
);
|
||||
assert_eq!(
|
||||
cs.get_input(2, "value commitment/commitment point/y/input variable"),
|
||||
expected_value_cm.1
|
||||
);
|
||||
assert_eq!(cs.get_input(3, "epk/x/input variable"), expected_epk_xy.0);
|
||||
assert_eq!(cs.get_input(4, "epk/y/input variable"), expected_epk_xy.1);
|
||||
assert_eq!(cs.get_input(5, "commitment/input variable"), expected_cm);
|
||||
|
||||
Reference in New Issue
Block a user