Move Sprout and Sapling circuits into zcash_proofs

zcash_proofs/Cargo.toml

@@ -16,6 +16,10 @@ rand_os = "0.2"
 sapling-crypto = { path = "../sapling-crypto" }
 zcash_primitives = { path = "../zcash_primitives" }
 
+[dev-dependencies]
+rand_core = "0.5"
+rand_xorshift = "0.2"
+
 [features]
 default = ["local-prover"]
 local-prover = ["directories"]

zcash_proofs/examples/bench.rs

@@ -0,0 +1,114 @@
+extern crate ff;
+extern crate sapling_crypto;
+extern crate bellman;
+extern crate pairing;
+extern crate rand_core;
+extern crate rand_xorshift;
+extern crate zcash_proofs;
+
+use ff::Field;
+use std::time::{Duration, Instant};
+use sapling_crypto::jubjub::{
+    JubjubBls12,
+    edwards,
+    fs,
+};
+use zcash_proofs::circuit::sapling::{
+    Spend
+};
+use sapling_crypto::primitives::{
+    Diversifier,
+    ProofGenerationKey,
+    ValueCommitment
+};
+use bellman::groth16::*;
+use rand_core::{RngCore, SeedableRng};
+use rand_xorshift::XorShiftRng;
+use pairing::bls12_381::{Bls12, Fr};
+
+const TREE_DEPTH: usize = 32;
+
+fn main() {
+    let jubjub_params = &JubjubBls12::new();
+    let rng = &mut XorShiftRng::from_seed([
+        0x59, 0x62, 0xbe, 0x3d, 0x76, 0x3d, 0x31, 0x8d, 0x17, 0xdb, 0x37, 0x32, 0x54, 0x06, 0xbc,
+        0xe5,
+    ]);
+
+    println!("Creating sample parameters...");
+    let groth_params = generate_random_parameters::<Bls12, _, _>(
+        Spend {
+            params: jubjub_params,
+            value_commitment: None,
+            proof_generation_key: None,
+            payment_address: None,
+            commitment_randomness: None,
+            ar: None,
+            auth_path: vec![None; TREE_DEPTH],
+            anchor: None
+        },
+        rng
+    ).unwrap();
+
+    const SAMPLES: u32 = 50;
+
+    let mut total_time = Duration::new(0, 0);
+    for _ in 0..SAMPLES {
+        let value_commitment = ValueCommitment {
+            value: 1,
+            randomness: fs::Fs::random(rng)
+        };
+
+        let nsk = fs::Fs::random(rng);
+        let ak = edwards::Point::rand(rng, jubjub_params).mul_by_cofactor(jubjub_params);
+
+        let proof_generation_key = ProofGenerationKey {
+            ak: ak.clone(),
+            nsk: nsk.clone()
+        };
+
+        let viewing_key = proof_generation_key.into_viewing_key(jubjub_params);
+
+        let payment_address;
+
+        loop {
+            let diversifier = {
+                let mut d = [0; 11];
+                rng.fill_bytes(&mut d);
+                Diversifier(d)
+            };
+
+            if let Some(p) = viewing_key.into_payment_address(
+                diversifier,
+                jubjub_params
+            )
+            {
+                payment_address = p;
+                break;
+            }
+        }
+
+        let commitment_randomness = fs::Fs::random(rng);
+        let auth_path = vec![Some((Fr::random(rng), rng.next_u32() % 2 != 0)); TREE_DEPTH];
+        let ar = fs::Fs::random(rng);
+        let anchor = Fr::random(rng);
+
+        let start = Instant::now();
+        let _ = create_random_proof(Spend {
+            params: jubjub_params,
+            value_commitment: Some(value_commitment),
+            proof_generation_key: Some(proof_generation_key),
+            payment_address: Some(payment_address),
+            commitment_randomness: Some(commitment_randomness),
+            ar: Some(ar),
+            auth_path: auth_path,
+            anchor: Some(anchor)
+        }, &groth_params, rng).unwrap();
+        total_time += start.elapsed();
+    }
+    let avg = total_time / SAMPLES;
+    let avg = avg.subsec_nanos() as f64 / 1_000_000_000f64
+              + (avg.as_secs() as f64);
+
+    println!("Average proving time (in seconds): {}", avg);
+}

zcash_proofs/src/circuit.rs

@@ -0,0 +1,2 @@
+pub mod sapling;
+pub mod sprout;

zcash_proofs/src/circuit/sapling.rs

@@ -0,0 +1,836 @@
+use ff::{Field, PrimeField, PrimeFieldRepr};
+
+use bellman::{
+    SynthesisError,
+    ConstraintSystem,
+    Circuit
+};
+
+use sapling_crypto::jubjub::{
+    JubjubEngine,
+    FixedGenerators
+};
+
+use sapling_crypto::constants;
+
+use sapling_crypto::primitives::{
+    ValueCommitment,
+    ProofGenerationKey,
+    PaymentAddress
+};
+
+use sapling_crypto::circuit::Assignment;
+use sapling_crypto::circuit::boolean;
+use sapling_crypto::circuit::ecc;
+use sapling_crypto::circuit::pedersen_hash;
+use sapling_crypto::circuit::blake2s;
+use sapling_crypto::circuit::num;
+use sapling_crypto::circuit::multipack;
+
+pub const TREE_DEPTH: usize = zcash_primitives::sapling::SAPLING_COMMITMENT_TREE_DEPTH;
+
+/// This is an instance of the `Spend` circuit.
+pub struct Spend<'a, E: JubjubEngine> {
+    pub params: &'a E::Params,
+
+    /// Pedersen commitment to the value being spent
+    pub value_commitment: Option<ValueCommitment<E>>,
+
+    /// Key required to construct proofs for spending notes
+    /// for a particular spending key
+    pub proof_generation_key: Option<ProofGenerationKey<E>>,
+
+    /// The payment address associated with the note
+    pub payment_address: Option<PaymentAddress<E>>,
+
+    /// The randomness of the note commitment
+    pub commitment_randomness: Option<E::Fs>,
+
+    /// Re-randomization of the public key
+    pub ar: Option<E::Fs>,
+
+    /// The authentication path of the commitment in the tree
+    pub auth_path: Vec<Option<(E::Fr, bool)>>,
+
+    /// The anchor; the root of the tree. If the note being
+    /// spent is zero-value, this can be anything.
+    pub anchor: Option<E::Fr>
+}
+
+/// This is an output circuit instance.
+pub struct Output<'a, E: JubjubEngine> {
+    pub params: &'a E::Params,
+
+    /// Pedersen commitment to the value being spent
+    pub value_commitment: Option<ValueCommitment<E>>,
+
+    /// The payment address of the recipient
+    pub payment_address: Option<PaymentAddress<E>>,
+
+    /// The randomness used to hide the note commitment data
+    pub commitment_randomness: Option<E::Fs>,
+
+    /// The ephemeral secret key for DH with recipient
+    pub esk: Option<E::Fs>
+}
+
+/// Exposes a Pedersen commitment to the value as an
+/// input to the circuit
+fn expose_value_commitment<E, CS>(
+    mut cs: CS,
+    value_commitment: Option<ValueCommitment<E>>,
+    params: &E::Params
+) -> Result<Vec<boolean::Boolean>, SynthesisError>
+    where E: JubjubEngine,
+          CS: ConstraintSystem<E>
+{
+    // Booleanize the value into little-endian bit order
+    let value_bits = boolean::u64_into_boolean_vec_le(
+        cs.namespace(|| "value"),
+        value_commitment.as_ref().map(|c| c.value)
+    )?;
+
+    // Compute the note value in the exponent
+    let value = ecc::fixed_base_multiplication(
+        cs.namespace(|| "compute the value in the exponent"),
+        FixedGenerators::ValueCommitmentValue,
+        &value_bits,
+        params
+    )?;
+
+    // Booleanize the randomness. This does not ensure
+    // the bit representation is "in the field" because
+    // it doesn't matter for security.
+    let rcv = boolean::field_into_boolean_vec_le(
+        cs.namespace(|| "rcv"),
+        value_commitment.as_ref().map(|c| c.randomness)
+    )?;
+
+    // Compute the randomness in the exponent
+    let rcv = ecc::fixed_base_multiplication(
+        cs.namespace(|| "computation of rcv"),
+        FixedGenerators::ValueCommitmentRandomness,
+        &rcv,
+        params
+    )?;
+
+    // Compute the Pedersen commitment to the value
+    let cv = value.add(
+        cs.namespace(|| "computation of cv"),
+        &rcv,
+        params
+    )?;
+
+    // Expose the commitment as an input to the circuit
+    cv.inputize(cs.namespace(|| "commitment point"))?;
+
+    Ok(value_bits)
+}
+
+impl<'a, E: JubjubEngine> Circuit<E> for Spend<'a, E> {
+    fn synthesize<CS: ConstraintSystem<E>>(self, cs: &mut CS) -> Result<(), SynthesisError>
+    {
+        // Prover witnesses ak (ensures that it's on the curve)
+        let ak = ecc::EdwardsPoint::witness(
+            cs.namespace(|| "ak"),
+            self.proof_generation_key.as_ref().map(|k| k.ak.clone()),
+            self.params
+        )?;
+
+        // There are no sensible attacks on small order points
+        // of ak (that we're aware of!) but it's a cheap check,
+        // so we do it.
+        ak.assert_not_small_order(
+            cs.namespace(|| "ak not small order"),
+            self.params
+        )?;
+
+        // Rerandomize ak and expose it as an input to the circuit
+        {
+            let ar = boolean::field_into_boolean_vec_le(
+                cs.namespace(|| "ar"),
+                self.ar
+            )?;
+
+            // Compute the randomness in the exponent
+            let ar = ecc::fixed_base_multiplication(
+                cs.namespace(|| "computation of randomization for the signing key"),
+                FixedGenerators::SpendingKeyGenerator,
+                &ar,
+                self.params
+            )?;
+
+            let rk = ak.add(
+                cs.namespace(|| "computation of rk"),
+                &ar,
+                self.params
+            )?;
+
+            rk.inputize(cs.namespace(|| "rk"))?;
+        }
+
+        // Compute nk = [nsk] ProofGenerationKey
+        let nk;
+        {
+            // Witness nsk as bits
+            let nsk = boolean::field_into_boolean_vec_le(
+                cs.namespace(|| "nsk"),
+                self.proof_generation_key.as_ref().map(|k| k.nsk.clone())
+            )?;
+
+            // NB: We don't ensure that the bit representation of nsk
+            // is "in the field" (Fs) because it's not used except to
+            // demonstrate the prover knows it. If they know a
+            // congruency then that's equivalent.
+
+            // Compute nk = [nsk] ProvingPublicKey
+            nk = ecc::fixed_base_multiplication(
+                cs.namespace(|| "computation of nk"),
+                FixedGenerators::ProofGenerationKey,
+                &nsk,
+                self.params
+            )?;
+        }
+
+        // This is the "viewing key" preimage for CRH^ivk
+        let mut ivk_preimage = vec![];
+
+        // Place ak in the preimage for CRH^ivk
+        ivk_preimage.extend(
+            ak.repr(cs.namespace(|| "representation of ak"))?
+        );
+
+        // This is the nullifier preimage for PRF^nf
+        let mut nf_preimage = vec![];
+
+        // Extend ivk and nf preimages with the representation of
+        // nk.
+        {
+            let repr_nk = nk.repr(
+                cs.namespace(|| "representation of nk")
+            )?;
+
+            ivk_preimage.extend(repr_nk.iter().cloned());
+            nf_preimage.extend(repr_nk);
+        }
+
+        assert_eq!(ivk_preimage.len(), 512);
+        assert_eq!(nf_preimage.len(), 256);
+
+        // Compute the incoming viewing key ivk
+        let mut ivk = blake2s::blake2s(
+            cs.namespace(|| "computation of ivk"),
+            &ivk_preimage,
+            constants::CRH_IVK_PERSONALIZATION
+        )?;
+
+        // drop_5 to ensure it's in the field
+        ivk.truncate(E::Fs::CAPACITY as usize);
+
+        // Witness g_d, checking that it's on the curve.
+        let g_d = {
+            // This binding is to avoid a weird edge case in Rust's
+            // ownership/borrowing rules. self is partially moved
+            // above, but the closure for and_then will have to
+            // move self (or a reference to self) to reference
+            // self.params, so we have to copy self.params here.
+            let params = self.params;
+
+            ecc::EdwardsPoint::witness(
+                cs.namespace(|| "witness g_d"),
+                self.payment_address.as_ref().and_then(|a| a.g_d(params)),
+                self.params
+            )?
+        };
+
+        // Check that g_d is not small order. Technically, this check
+        // is already done in the Output circuit, and this proof ensures
+        // g_d is bound to a product of that check, but for defense in
+        // depth let's check it anyway. It's cheap.
+        g_d.assert_not_small_order(
+            cs.namespace(|| "g_d not small order"),
+            self.params
+        )?;
+
+        // Compute pk_d = g_d^ivk
+        let pk_d = g_d.mul(
+            cs.namespace(|| "compute pk_d"),
+            &ivk,
+            self.params
+        )?;
+
+        // Compute note contents:
+        // value (in big endian) followed by g_d and pk_d
+        let mut note_contents = vec![];
+
+        // Handle the value; we'll need it later for the
+        // dummy input check.
+        let mut value_num = num::Num::zero();
+        {
+            // Get the value in little-endian bit order
+            let value_bits = expose_value_commitment(
+                cs.namespace(|| "value commitment"),
+                self.value_commitment,
+                self.params
+            )?;
+
+            // Compute the note's value as a linear combination
+            // of the bits.
+            let mut coeff = E::Fr::one();
+            for bit in &value_bits {
+                value_num = value_num.add_bool_with_coeff(
+                    CS::one(),
+                    bit,
+                    coeff
+                );
+                coeff.double();
+            }
+
+            // Place the value in the note
+            note_contents.extend(value_bits);
+        }
+
+        // Place g_d in the note
+        note_contents.extend(
+            g_d.repr(cs.namespace(|| "representation of g_d"))?
+        );
+
+        // Place pk_d in the note
+        note_contents.extend(
+            pk_d.repr(cs.namespace(|| "representation of pk_d"))?
+        );
+
+        assert_eq!(
+            note_contents.len(),
+            64 + // value
+            256 + // g_d
+            256 // p_d
+        );
+
+        // Compute the hash of the note contents
+        let mut cm = pedersen_hash::pedersen_hash(
+            cs.namespace(|| "note content hash"),
+            pedersen_hash::Personalization::NoteCommitment,
+            &note_contents,
+            self.params
+        )?;
+
+        {
+            // Booleanize the randomness for the note commitment
+            let rcm = boolean::field_into_boolean_vec_le(
+                cs.namespace(|| "rcm"),
+                self.commitment_randomness
+            )?;
+
+            // Compute the note commitment randomness in the exponent
+            let rcm = ecc::fixed_base_multiplication(
+                cs.namespace(|| "computation of commitment randomness"),
+                FixedGenerators::NoteCommitmentRandomness,
+                &rcm,
+                self.params
+            )?;
+
+            // Randomize the note commitment. Pedersen hashes are not
+            // themselves hiding commitments.
+            cm = cm.add(
+                cs.namespace(|| "randomization of note commitment"),
+                &rcm,
+                self.params
+            )?;
+        }
+
+        // This will store (least significant bit first)
+        // the position of the note in the tree, for use
+        // in nullifier computation.
+        let mut position_bits = vec![];
+
+        // This is an injective encoding, as cur is a
+        // point in the prime order subgroup.
+        let mut cur = cm.get_x().clone();
+
+        // Ascend the merkle tree authentication path
+        for (i, e) in self.auth_path.into_iter().enumerate() {
+            let cs = &mut cs.namespace(|| format!("merkle tree hash {}", i));
+
+            // Determines if the current subtree is the "right" leaf at this
+            // depth of the tree.
+            let cur_is_right = boolean::Boolean::from(boolean::AllocatedBit::alloc(
+                cs.namespace(|| "position bit"),
+                e.map(|e| e.1)
+            )?);
+
+            // Push this boolean for nullifier computation later
+            position_bits.push(cur_is_right.clone());
+
+            // Witness the authentication path element adjacent
+            // at this depth.
+            let path_element = num::AllocatedNum::alloc(
+                cs.namespace(|| "path element"),
+                || {
+                    Ok(e.get()?.0)
+                }
+            )?;
+
+            // Swap the two if the current subtree is on the right
+            let (xl, xr) = num::AllocatedNum::conditionally_reverse(
+                cs.namespace(|| "conditional reversal of preimage"),
+                &cur,
+                &path_element,
+                &cur_is_right
+            )?;
+
+            // We don't need to be strict, because the function is
+            // collision-resistant. If the prover witnesses a congruency,
+            // they will be unable to find an authentication path in the
+            // tree with high probability.
+            let mut preimage = vec![];
+            preimage.extend(xl.into_bits_le(cs.namespace(|| "xl into bits"))?);
+            preimage.extend(xr.into_bits_le(cs.namespace(|| "xr into bits"))?);
+
+            // Compute the new subtree value
+            cur = pedersen_hash::pedersen_hash(
+                cs.namespace(|| "computation of pedersen hash"),
+                pedersen_hash::Personalization::MerkleTree(i),
+                &preimage,
+                self.params
+            )?.get_x().clone(); // Injective encoding
+        }
+
+        {
+            let real_anchor_value = self.anchor;
+
+            // Allocate the "real" anchor that will be exposed.
+            let rt = num::AllocatedNum::alloc(
+                cs.namespace(|| "conditional anchor"),
+                || {
+                    Ok(*real_anchor_value.get()?)
+                }
+            )?;
+
+            // (cur - rt) * value = 0
+            // if value is zero, cur and rt can be different
+            // if value is nonzero, they must be equal
+            cs.enforce(
+                || "conditionally enforce correct root",
+                |lc| lc + cur.get_variable() - rt.get_variable(),
+                |lc| lc + &value_num.lc(E::Fr::one()),
+                |lc| lc
+            );
+
+            // Expose the anchor
+            rt.inputize(cs.namespace(|| "anchor"))?;
+        }
+
+        // Compute the cm + g^position for preventing
+        // faerie gold attacks
+        let mut rho = cm;
+        {
+            // Compute the position in the exponent
+            let position = ecc::fixed_base_multiplication(
+                cs.namespace(|| "g^position"),
+                FixedGenerators::NullifierPosition,
+                &position_bits,
+                self.params
+            )?;
+
+            // Add the position to the commitment
+            rho = rho.add(
+                cs.namespace(|| "faerie gold prevention"),
+                &position,
+                self.params
+            )?;
+        }
+        
+        // Let's compute nf = BLAKE2s(nk || rho)
+        nf_preimage.extend(
+            rho.repr(cs.namespace(|| "representation of rho"))?
+        );
+
+        assert_eq!(nf_preimage.len(), 512);
+        
+        // Compute nf
+        let nf = blake2s::blake2s(
+            cs.namespace(|| "nf computation"),
+            &nf_preimage,
+            constants::PRF_NF_PERSONALIZATION
+        )?;
+
+        multipack::pack_into_inputs(cs.namespace(|| "pack nullifier"), &nf)
+    }
+}
+
+impl<'a, E: JubjubEngine> Circuit<E> for Output<'a, E> {
+    fn synthesize<CS: ConstraintSystem<E>>(self, cs: &mut CS) -> Result<(), SynthesisError>
+    {
+        // Let's start to construct our note, which contains
+        // value (big endian)
+        let mut note_contents = vec![];
+
+        // Expose the value commitment and place the value
+        // in the note.
+        note_contents.extend(expose_value_commitment(
+            cs.namespace(|| "value commitment"),
+            self.value_commitment,
+            self.params
+        )?);
+
+        // Let's deal with g_d
+        {
+            let params = self.params;
+
+            // Prover witnesses g_d, ensuring it's on the
+            // curve.
+            let g_d = ecc::EdwardsPoint::witness(
+                cs.namespace(|| "witness g_d"),
+                self.payment_address.as_ref().and_then(|a| a.g_d(params)),
+                self.params
+            )?;
+
+            // g_d is ensured to be large order. The relationship
+            // between g_d and pk_d ultimately binds ivk to the
+            // note. If this were a small order point, it would
+            // not do this correctly, and the prover could
+            // double-spend by finding random ivk's that satisfy
+            // the relationship.
+            //
+            // Further, if it were small order, epk would be
+            // small order too!
+            g_d.assert_not_small_order(
+                cs.namespace(|| "g_d not small order"),
+                self.params
+            )?;
+
+            // Extend our note contents with the representation of
+            // g_d.
+            note_contents.extend(
+                g_d.repr(cs.namespace(|| "representation of g_d"))?
+            );
+
+            // Booleanize our ephemeral secret key
+            let esk = boolean::field_into_boolean_vec_le(
+                cs.namespace(|| "esk"),
+                self.esk
+            )?;
+
+            // Create the ephemeral public key from g_d.
+            let epk = g_d.mul(
+                cs.namespace(|| "epk computation"),
+                &esk,
+                self.params
+            )?;
+
+            // Expose epk publicly.
+            epk.inputize(cs.namespace(|| "epk"))?;
+        }
+
+        // Now let's deal with pk_d. We don't do any checks and
+        // essentially allow the prover to witness any 256 bits
+        // they would like.
+        {
+            // Just grab pk_d from the witness
+            let pk_d = self.payment_address.as_ref().map(|e| e.pk_d.into_xy());
+
+            // Witness the y-coordinate, encoded as little
+            // endian bits (to match the representation)
+            let y_contents = boolean::field_into_boolean_vec_le(
+                cs.namespace(|| "pk_d bits of y"),
+                pk_d.map(|e| e.1)
+            )?;
+
+            // Witness the sign bit
+            let sign_bit = boolean::Boolean::from(boolean::AllocatedBit::alloc(
+                cs.namespace(|| "pk_d bit of x"),
+                pk_d.map(|e| e.0.into_repr().is_odd())
+            )?);
+
+            // Extend the note with pk_d representation
+            note_contents.extend(y_contents);
+            note_contents.push(sign_bit);
+        }
+
+        assert_eq!(
+            note_contents.len(),
+            64 + // value
+            256 + // g_d
+            256 // pk_d
+        );
+
+        // Compute the hash of the note contents
+        let mut cm = pedersen_hash::pedersen_hash(
+            cs.namespace(|| "note content hash"),
+            pedersen_hash::Personalization::NoteCommitment,
+            &note_contents,
+            self.params
+        )?;
+
+        {
+            // Booleanize the randomness
+            let rcm = boolean::field_into_boolean_vec_le(
+                cs.namespace(|| "rcm"),
+                self.commitment_randomness
+            )?;
+
+            // Compute the note commitment randomness in the exponent
+            let rcm = ecc::fixed_base_multiplication(
+                cs.namespace(|| "computation of commitment randomness"),
+                FixedGenerators::NoteCommitmentRandomness,
+                &rcm,
+                self.params
+            )?;
+
+            // Randomize our note commitment
+            cm = cm.add(
+                cs.namespace(|| "randomization of note commitment"),
+                &rcm,
+                self.params
+            )?;
+        }
+
+        // Only the x-coordinate of the output is revealed,
+        // since we know it is prime order, and we know that
+        // the x-coordinate is an injective encoding for
+        // prime-order elements.
+        cm.get_x().inputize(cs.namespace(|| "commitment"))?;
+
+        Ok(())
+    }
+}
+
+#[test]
+fn test_input_circuit_with_bls12_381() {
+    use ff::{BitIterator, Field};
+    use pairing::bls12_381::*;
+    use rand_core::{RngCore, SeedableRng};
+    use rand_xorshift::XorShiftRng;
+    use sapling_crypto::{
+        circuit::test::*,
+        jubjub::{JubjubBls12, fs, edwards},
+        pedersen_hash,
+        primitives::{Diversifier, Note, ProofGenerationKey},
+    };
+
+    let params = &JubjubBls12::new();
+    let rng = &mut XorShiftRng::from_seed([
+        0x58, 0x62, 0xbe, 0x3d, 0x76, 0x3d, 0x31, 0x8d, 0x17, 0xdb, 0x37, 0x32, 0x54, 0x06, 0xbc,
+        0xe5,
+    ]);
+
+    let tree_depth = 32;
+
+    for _ in 0..10 {
+        let value_commitment = ValueCommitment {
+            value: rng.next_u64(),
+            randomness: fs::Fs::random(rng),
+        };
+
+        let nsk = fs::Fs::random(rng);
+        let ak = edwards::Point::rand(rng, params).mul_by_cofactor(params);
+
+        let proof_generation_key = ProofGenerationKey {
+            ak: ak.clone(),
+            nsk: nsk.clone()
+        };
+
+        let viewing_key = proof_generation_key.into_viewing_key(params);
+
+        let payment_address;
+
+        loop {
+            let diversifier = {
+                let mut d = [0; 11];
+                rng.fill_bytes(&mut d);
+                Diversifier(d)
+            };
+
+            if let Some(p) = viewing_key.into_payment_address(
+                diversifier,
+                params
+            )
+            {
+                payment_address = p;
+                break;
+            }
+        }
+
+        let g_d = payment_address.diversifier.g_d(params).unwrap();
+        let commitment_randomness = fs::Fs::random(rng);
+        let auth_path = vec![Some((Fr::random(rng), rng.next_u32() % 2 != 0)); tree_depth];
+        let ar = fs::Fs::random(rng);
+
+        {
+            let rk = viewing_key.rk(ar, params).into_xy();
+            let expected_value_cm = value_commitment.cm(params).into_xy();
+            let note = Note {
+                value: value_commitment.value,
+                g_d: g_d.clone(),
+                pk_d: payment_address.pk_d.clone(),
+                r: commitment_randomness.clone()
+            };
+
+            let mut position = 0u64;
+            let cm: Fr = note.cm(params);
+            let mut cur = cm.clone();
+
+            for (i, val) in auth_path.clone().into_iter().enumerate()
+            {
+                let (uncle, b) = val.unwrap();
+
+                let mut lhs = cur;
+                let mut rhs = uncle;
+
+                if b {
+                    ::std::mem::swap(&mut lhs, &mut rhs);
+                }
+
+                let mut lhs: Vec<bool> = BitIterator::new(lhs.into_repr()).collect();
+                let mut rhs: Vec<bool> = BitIterator::new(rhs.into_repr()).collect();
+
+                lhs.reverse();
+                rhs.reverse();
+
+                cur = pedersen_hash::pedersen_hash::<Bls12, _>(
+                    pedersen_hash::Personalization::MerkleTree(i),
+                    lhs.into_iter()
+                       .take(Fr::NUM_BITS as usize)
+                       .chain(rhs.into_iter().take(Fr::NUM_BITS as usize)),
+                    params
+                ).into_xy().0;
+
+                if b {
+                    position |= 1 << i;
+                }
+            }
+
+            let expected_nf = note.nf(&viewing_key, position, params);
+            let expected_nf = multipack::bytes_to_bits_le(&expected_nf);
+            let expected_nf = multipack::compute_multipacking::<Bls12>(&expected_nf);
+            assert_eq!(expected_nf.len(), 2);
+
+            let mut cs = TestConstraintSystem::<Bls12>::new();
+
+            let instance = Spend {
+                params: params,
+                value_commitment: Some(value_commitment.clone()),
+                proof_generation_key: Some(proof_generation_key.clone()),
+                payment_address: Some(payment_address.clone()),
+                commitment_randomness: Some(commitment_randomness),
+                ar: Some(ar),
+                auth_path: auth_path.clone(),
+                anchor: Some(cur)
+            };
+
+            instance.synthesize(&mut cs).unwrap();
+
+            assert!(cs.is_satisfied());
+            assert_eq!(cs.num_constraints(), 98777);
+            assert_eq!(cs.hash(), "d37c738e83df5d9b0bb6495ac96abf21bcb2697477e2c15c2c7916ff7a3b6a89");
+
+            assert_eq!(cs.get("randomization of note commitment/x3/num"), cm);
+
+            assert_eq!(cs.num_inputs(), 8);
+            assert_eq!(cs.get_input(0, "ONE"), Fr::one());
+            assert_eq!(cs.get_input(1, "rk/x/input variable"), rk.0);
+            assert_eq!(cs.get_input(2, "rk/y/input variable"), rk.1);
+            assert_eq!(cs.get_input(3, "value commitment/commitment point/x/input variable"), expected_value_cm.0);
+            assert_eq!(cs.get_input(4, "value commitment/commitment point/y/input variable"), expected_value_cm.1);
+            assert_eq!(cs.get_input(5, "anchor/input variable"), cur);
+            assert_eq!(cs.get_input(6, "pack nullifier/input 0"), expected_nf[0]);
+            assert_eq!(cs.get_input(7, "pack nullifier/input 1"), expected_nf[1]);
+        }
+    }
+}
+
+#[test]
+fn test_output_circuit_with_bls12_381() {
+    use ff::Field;
+    use pairing::bls12_381::*;
+    use rand_core::{RngCore, SeedableRng};
+    use rand_xorshift::XorShiftRng;
+    use sapling_crypto::{
+        circuit::test::*,
+        jubjub::{JubjubBls12, fs, edwards},
+        primitives::{Diversifier, ProofGenerationKey},
+    };
+
+    let params = &JubjubBls12::new();
+    let rng = &mut XorShiftRng::from_seed([
+        0x58, 0x62, 0xbe, 0x3d, 0x76, 0x3d, 0x31, 0x8d, 0x17, 0xdb, 0x37, 0x32, 0x54, 0x06, 0xbc,
+        0xe5,
+    ]);
+
+    for _ in 0..100 {
+        let value_commitment = ValueCommitment {
+            value: rng.next_u64(),
+            randomness: fs::Fs::random(rng),
+        };
+
+        let nsk = fs::Fs::random(rng);
+        let ak = edwards::Point::rand(rng, params).mul_by_cofactor(params);
+
+        let proof_generation_key = ProofGenerationKey {
+            ak: ak.clone(),
+            nsk: nsk.clone()
+        };
+
+        let viewing_key = proof_generation_key.into_viewing_key(params);
+
+        let payment_address;
+
+        loop {
+            let diversifier = {
+                let mut d = [0; 11];
+                rng.fill_bytes(&mut d);
+                Diversifier(d)
+            };
+
+            if let Some(p) = viewing_key.into_payment_address(
+                diversifier,
+                params
+            )
+            {
+                payment_address = p;
+                break;
+            }
+        }
+
+        let commitment_randomness = fs::Fs::random(rng);
+        let esk = fs::Fs::random(rng);
+
+        {
+            let mut cs = TestConstraintSystem::<Bls12>::new();
+
+            let instance = Output {
+                params: params,
+                value_commitment: Some(value_commitment.clone()),
+                payment_address: Some(payment_address.clone()),
+                commitment_randomness: Some(commitment_randomness),
+                esk: Some(esk.clone())
+            };
+
+            instance.synthesize(&mut cs).unwrap();
+
+            assert!(cs.is_satisfied());
+            assert_eq!(cs.num_constraints(), 7827);
+            assert_eq!(cs.hash(), "c26d5cdfe6ccd65c03390902c02e11393ea6bb96aae32a7f2ecb12eb9103faee");
+
+            let expected_cm = payment_address.create_note(
+                value_commitment.value,
+                commitment_randomness,
+                params
+            ).expect("should be valid").cm(params);
+
+            let expected_value_cm = value_commitment.cm(params).into_xy();
+
+            let expected_epk = payment_address.g_d(params).expect("should be valid").mul(esk, params);
+            let expected_epk_xy = expected_epk.into_xy();
+
+            assert_eq!(cs.num_inputs(), 6);
+            assert_eq!(cs.get_input(0, "ONE"), Fr::one());
+            assert_eq!(cs.get_input(1, "value commitment/commitment point/x/input variable"), expected_value_cm.0);
+            assert_eq!(cs.get_input(2, "value commitment/commitment point/y/input variable"), expected_value_cm.1);
+            assert_eq!(cs.get_input(3, "epk/x/input variable"), expected_epk_xy.0);
+            assert_eq!(cs.get_input(4, "epk/y/input variable"), expected_epk_xy.1);
+            assert_eq!(cs.get_input(5, "commitment/input variable"), expected_cm);
+        }
+    }
+}

zcash_proofs/src/circuit/sprout/commitment.rs

@@ -0,0 +1,42 @@
+use pairing::{Engine};
+use bellman::{ConstraintSystem, SynthesisError};
+use sapling_crypto::circuit::sha256::{
+    sha256
+};
+use sapling_crypto::circuit::boolean::{
+    Boolean
+};
+
+pub fn note_comm<E, CS>(
+    cs: CS,
+    a_pk: &[Boolean],
+    value: &[Boolean],
+    rho: &[Boolean],
+    r: &[Boolean]
+) -> Result<Vec<Boolean>, SynthesisError>
+    where E: Engine, CS: ConstraintSystem<E>
+{
+    assert_eq!(a_pk.len(), 256);
+    assert_eq!(value.len(), 64);
+    assert_eq!(rho.len(), 256);
+    assert_eq!(r.len(), 256);
+
+    let mut image = vec![];
+    image.push(Boolean::constant(true));
+    image.push(Boolean::constant(false));
+    image.push(Boolean::constant(true));
+    image.push(Boolean::constant(true));
+    image.push(Boolean::constant(false));
+    image.push(Boolean::constant(false));
+    image.push(Boolean::constant(false));
+    image.push(Boolean::constant(false));
+    image.extend(a_pk.iter().cloned());
+    image.extend(value.iter().cloned());
+    image.extend(rho.iter().cloned());
+    image.extend(r.iter().cloned());
+
+    sha256(
+        cs,
+        &image
+    )
+}

zcash_proofs/src/circuit/sprout/input.rs

@@ -0,0 +1,226 @@
+use pairing::{Engine};
+use bellman::{ConstraintSystem, SynthesisError};
+use sapling_crypto::circuit::sha256::{
+    sha256_block_no_padding
+};
+use sapling_crypto::circuit::boolean::{
+    AllocatedBit,
+    Boolean
+};
+
+use super::*;
+use super::prfs::*;
+use super::commitment::note_comm;
+
+pub struct InputNote {
+    pub nf: Vec<Boolean>,
+    pub mac: Vec<Boolean>,
+}
+
+impl InputNote {
+    pub fn compute<E, CS>(
+        mut cs: CS,
+        a_sk: Option<SpendingKey>,
+        rho: Option<UniqueRandomness>,
+        r: Option<CommitmentRandomness>,
+        value: &NoteValue,
+        h_sig: &[Boolean],
+        nonce: bool,
+        auth_path: [Option<([u8; 32], bool)>; TREE_DEPTH],
+        rt: &[Boolean]
+    ) -> Result<InputNote, SynthesisError>
+        where E: Engine, CS: ConstraintSystem<E>
+    {
+        let a_sk = witness_u252(
+            cs.namespace(|| "a_sk"),
+            a_sk.as_ref().map(|a_sk| &a_sk.0[..])
+        )?;
+
+        let rho = witness_u256(
+            cs.namespace(|| "rho"),
+            rho.as_ref().map(|rho| &rho.0[..])
+        )?;
+
+        let r = witness_u256(
+            cs.namespace(|| "r"),
+            r.as_ref().map(|r| &r.0[..])
+        )?;
+
+        let a_pk = prf_a_pk(
+            cs.namespace(|| "a_pk computation"),
+            &a_sk
+        )?;
+
+        let nf = prf_nf(
+            cs.namespace(|| "nf computation"),
+            &a_sk,
+            &rho
+        )?;
+
+        let mac = prf_pk(
+            cs.namespace(|| "mac computation"),
+            &a_sk,
+            h_sig,
+            nonce
+        )?;
+
+        let cm = note_comm(
+            cs.namespace(|| "cm computation"),
+            &a_pk,
+            &value.bits_le(),
+            &rho,
+            &r
+        )?;
+
+        // Witness into the merkle tree
+        let mut cur = cm.clone();
+
+        for (i, layer) in auth_path.into_iter().enumerate() {
+            let cs = &mut cs.namespace(|| format!("layer {}", i));
+
+            let cur_is_right = AllocatedBit::alloc(
+                cs.namespace(|| "cur is right"),
+                layer.as_ref().map(|&(_, p)| p)
+            )?;
+
+            let lhs = cur;
+            let rhs = witness_u256(
+                cs.namespace(|| "sibling"),
+                layer.as_ref().map(|&(ref sibling, _)| &sibling[..])
+            )?;
+
+            // Conditionally swap if cur is right
+            let preimage = conditionally_swap_u256(
+                cs.namespace(|| "conditional swap"),
+                &lhs[..],
+                &rhs[..],
+                &cur_is_right
+            )?;
+
+            cur = sha256_block_no_padding(
+                cs.namespace(|| "hash of this layer"),
+                &preimage
+            )?;
+        }
+
+        // enforce must be true if the value is nonzero
+        let enforce = AllocatedBit::alloc(
+            cs.namespace(|| "enforce"),
+            value.get_value().map(|n| n != 0)
+        )?;
+
+        // value * (1 - enforce) = 0
+        // If `value` is zero, `enforce` _can_ be zero.
+        // If `value` is nonzero, `enforce` _must_ be one.
+        cs.enforce(
+            || "enforce validity",
+            |_| value.lc(),
+            |lc| lc + CS::one() - enforce.get_variable(),
+            |lc| lc
+        );
+
+        assert_eq!(cur.len(), rt.len());
+
+        // Check that the anchor (exposed as a public input)
+        // is equal to the merkle tree root that we calculated
+        // for this note
+        for (i, (cur, rt)) in cur.into_iter().zip(rt.iter()).enumerate() {
+            // (cur - rt) * enforce = 0
+            // if enforce is zero, cur and rt can be different
+            // if enforce is one, they must be equal
+            cs.enforce(
+                || format!("conditionally enforce correct root for bit {}", i),
+                |_| cur.lc(CS::one(), E::Fr::one()) - &rt.lc(CS::one(), E::Fr::one()),
+                |lc| lc + enforce.get_variable(),
+                |lc| lc
+            );
+        }
+
+        Ok(InputNote {
+            mac: mac,
+            nf: nf
+        })
+    }
+}
+
+/// Swaps two 256-bit blobs conditionally, returning the
+/// 512-bit concatenation.
+pub fn conditionally_swap_u256<E, CS>(
+    mut cs: CS,
+    lhs: &[Boolean],
+    rhs: &[Boolean],
+    condition: &AllocatedBit
+) -> Result<Vec<Boolean>, SynthesisError>
+    where E: Engine, CS: ConstraintSystem<E>,
+{
+    assert_eq!(lhs.len(), 256);
+    assert_eq!(rhs.len(), 256);
+
+    let mut new_lhs = vec![];
+    let mut new_rhs = vec![];
+
+    for (i, (lhs, rhs)) in lhs.iter().zip(rhs.iter()).enumerate() {
+        let cs = &mut cs.namespace(|| format!("bit {}", i));
+
+        let x = Boolean::from(AllocatedBit::alloc(
+            cs.namespace(|| "x"),
+            condition.get_value().and_then(|v| {
+                if v {
+                    rhs.get_value()
+                } else {
+                    lhs.get_value()
+                }
+            })
+        )?);
+
+        // x = (1-condition)lhs + (condition)rhs
+        // x = lhs - lhs(condition) + rhs(condition)
+        // x - lhs = condition (rhs - lhs)
+        // if condition is zero, we don't swap, so
+        //   x - lhs = 0
+        //   x = lhs
+        // if condition is one, we do swap, so
+        //   x - lhs = rhs - lhs
+        //   x = rhs
+        cs.enforce(
+            || "conditional swap for x",
+            |lc| lc + &rhs.lc(CS::one(), E::Fr::one())
+                    - &lhs.lc(CS::one(), E::Fr::one()),
+            |lc| lc + condition.get_variable(),
+            |lc| lc + &x.lc(CS::one(), E::Fr::one())
+                    - &lhs.lc(CS::one(), E::Fr::one())
+        );
+
+        let y = Boolean::from(AllocatedBit::alloc(
+            cs.namespace(|| "y"),
+            condition.get_value().and_then(|v| {
+                if v {
+                    lhs.get_value()
+                } else {
+                    rhs.get_value()
+                }
+            })
+        )?);
+
+        // y = (1-condition)rhs + (condition)lhs
+        // y - rhs = condition (lhs - rhs)
+        cs.enforce(
+            || "conditional swap for y",
+            |lc| lc + &lhs.lc(CS::one(), E::Fr::one())
+                    - &rhs.lc(CS::one(), E::Fr::one()),
+            |lc| lc + condition.get_variable(),
+            |lc| lc + &y.lc(CS::one(), E::Fr::one())
+                    - &rhs.lc(CS::one(), E::Fr::one())
+        );
+
+        new_lhs.push(x);
+        new_rhs.push(y);
+    }
+
+    let mut f = new_lhs;
+    f.extend(new_rhs);
+
+    assert_eq!(f.len(), 512);
+
+    Ok(f)
+}

zcash_proofs/src/circuit/sprout/mod.rs

@@ -0,0 +1,489 @@
+use ff::Field;
+use pairing::Engine;
+use bellman::{ConstraintSystem, SynthesisError, Circuit, LinearCombination};
+use sapling_crypto::circuit::boolean::{
+    AllocatedBit,
+    Boolean
+};
+use sapling_crypto::circuit::multipack::pack_into_inputs;
+
+mod prfs;
+mod commitment;
+mod input;
+mod output;
+
+use self::input::*;
+use self::output::*;
+
+pub const TREE_DEPTH: usize = 29;
+
+pub struct SpendingKey(pub [u8; 32]);
+pub struct PayingKey(pub [u8; 32]);
+pub struct UniqueRandomness(pub [u8; 32]);
+pub struct CommitmentRandomness(pub [u8; 32]);
+
+pub struct JoinSplit {
+    pub vpub_old: Option<u64>,
+    pub vpub_new: Option<u64>,
+    pub h_sig: Option<[u8; 32]>,
+    pub phi: Option<[u8; 32]>,
+    pub inputs: Vec<JSInput>,
+    pub outputs: Vec<JSOutput>,
+    pub rt: Option<[u8; 32]>,
+}
+
+pub struct JSInput {
+    pub value: Option<u64>,
+    pub a_sk: Option<SpendingKey>,
+    pub rho: Option<UniqueRandomness>,
+    pub r: Option<CommitmentRandomness>,
+    pub auth_path: [Option<([u8; 32], bool)>; TREE_DEPTH]
+}
+
+pub struct JSOutput {
+    pub value: Option<u64>,
+    pub a_pk: Option<PayingKey>,
+    pub r: Option<CommitmentRandomness>
+}
+
+impl<E: Engine> Circuit<E> for JoinSplit {
+    fn synthesize<CS: ConstraintSystem<E>>(
+        self,
+        cs: &mut CS
+    ) -> Result<(), SynthesisError>
+    {
+        assert_eq!(self.inputs.len(), 2);
+        assert_eq!(self.outputs.len(), 2);
+
+        // vpub_old is the value entering the
+        // JoinSplit from the "outside" value
+        // pool
+        let vpub_old = NoteValue::new(
+            cs.namespace(|| "vpub_old"),
+            self.vpub_old
+        )?;
+
+        // vpub_new is the value leaving the
+        // JoinSplit into the "outside" value
+        // pool
+        let vpub_new = NoteValue::new(
+            cs.namespace(|| "vpub_new"),
+            self.vpub_new
+        )?;
+
+        // The left hand side of the balance equation
+        // vpub_old + inputs[0].value + inputs[1].value
+        let mut lhs = vpub_old.lc();
+
+        // The right hand side of the balance equation
+        // vpub_old + inputs[0].value + inputs[1].value
+        let mut rhs = vpub_new.lc();
+
+        // Witness rt (merkle tree root)
+        let rt = witness_u256(
+            cs.namespace(|| "rt"),
+            self.rt.as_ref().map(|v| &v[..])
+        ).unwrap();
+
+        // Witness h_sig
+        let h_sig = witness_u256(
+            cs.namespace(|| "h_sig"),
+            self.h_sig.as_ref().map(|v| &v[..])
+        ).unwrap();
+
+        // Witness phi
+        let phi = witness_u252(
+            cs.namespace(|| "phi"),
+            self.phi.as_ref().map(|v| &v[..])
+        ).unwrap();
+
+        let mut input_notes = vec![];
+        let mut lhs_total = self.vpub_old;
+
+        // Iterate over the JoinSplit inputs
+        for (i, input) in self.inputs.into_iter().enumerate() {
+            let cs = &mut cs.namespace(|| format!("input {}", i));
+
+            // Accumulate the value of the left hand side
+            if let Some(value) = input.value {
+                lhs_total = lhs_total.map(|v| v.wrapping_add(value));
+            }
+
+            // Allocate the value of the note
+            let value = NoteValue::new(
+                cs.namespace(|| "value"),
+                input.value
+            )?;
+
+            // Compute the nonce (for PRF inputs) which is false
+            // for the first input, and true for the second input.
+            let nonce = match i {
+                0 => false,
+                1 => true,
+                _ => unreachable!()
+            };
+
+            // Perform input note computations
+            input_notes.push(InputNote::compute(
+                cs.namespace(|| "note"),
+                input.a_sk,
+                input.rho,
+                input.r,
+                &value,
+                &h_sig,
+                nonce,
+                input.auth_path,
+                &rt
+            )?);
+
+            // Add the note value to the left hand side of
+            // the balance equation
+            lhs = lhs + &value.lc();
+        }
+
+        // Rebind lhs so that it isn't mutable anymore
+        let lhs = lhs;
+
+        // See zcash/zcash/issues/854
+        {
+            // Expected sum of the left hand side of the balance
+            // equation, expressed as a 64-bit unsigned integer
+            let lhs_total = NoteValue::new(
+                cs.namespace(|| "total value of left hand side"),
+                lhs_total
+            )?;
+
+            // Enforce that the left hand side can be expressed as a 64-bit
+            // integer
+            cs.enforce(
+                || "left hand side can be expressed as a 64-bit unsigned integer",
+                |_| lhs.clone(),
+                |lc| lc + CS::one(),
+                |_| lhs_total.lc()
+            );
+        }
+
+        let mut output_notes = vec![];
+
+        // Iterate over the JoinSplit outputs
+        for (i, output) in self.outputs.into_iter().enumerate() {
+            let cs = &mut cs.namespace(|| format!("output {}", i));
+
+            let value = NoteValue::new(
+                cs.namespace(|| "value"),
+                output.value
+            )?;
+
+            // Compute the nonce (for PRF inputs) which is false
+            // for the first output, and true for the second output.
+            let nonce = match i {
+                0 => false,
+                1 => true,
+                _ => unreachable!()
+            };
+
+            // Perform output note computations
+            output_notes.push(OutputNote::compute(
+                cs.namespace(|| "note"),
+                output.a_pk,
+                &value,
+                output.r,
+                &phi,
+                &h_sig,
+                nonce
+            )?);
+
+            // Add the note value to the right hand side of
+            // the balance equation
+            rhs = rhs + &value.lc();
+        }
+
+        // Enforce that balance is equal
+        cs.enforce(
+            || "balance equation",
+            |_| lhs.clone(),
+            |lc| lc + CS::one(),
+            |_| rhs
+        );
+
+        let mut public_inputs = vec![];
+        public_inputs.extend(rt);
+        public_inputs.extend(h_sig);
+
+        for note in input_notes {
+            public_inputs.extend(note.nf);
+            public_inputs.extend(note.mac);
+        }
+
+        for note in output_notes {
+            public_inputs.extend(note.cm);
+        }
+
+        public_inputs.extend(vpub_old.bits_le());
+        public_inputs.extend(vpub_new.bits_le());
+
+        pack_into_inputs(cs.namespace(|| "input packing"), &public_inputs)
+    }
+}
+
+pub struct NoteValue {
+    value: Option<u64>,
+    // Least significant digit first
+    bits: Vec<AllocatedBit>
+}
+
+impl NoteValue {
+    fn new<E, CS>(
+        mut cs: CS,
+        value: Option<u64>
+    ) -> Result<NoteValue, SynthesisError>
+        where E: Engine, CS: ConstraintSystem<E>,
+    {
+        let mut values;
+        match value {
+            Some(mut val) => {
+                values = vec![];
+                for _ in 0..64 {
+                    values.push(Some(val & 1 == 1));
+                    val >>= 1;
+                }
+            },
+            None => {
+                values = vec![None; 64];
+            }
+        }
+
+        let mut bits = vec![];
+        for (i, value) in values.into_iter().enumerate() {
+            bits.push(
+                AllocatedBit::alloc(
+                    cs.namespace(|| format!("bit {}", i)),
+                    value
+                )?
+            );
+        }
+
+        Ok(NoteValue {
+            value: value,
+            bits: bits
+        })
+    }
+
+    /// Encodes the bits of the value into little-endian
+    /// byte order.
+    fn bits_le(&self) -> Vec<Boolean> {
+        self.bits.chunks(8)
+                 .flat_map(|v| v.iter().rev())
+                 .cloned()
+                 .map(|e| Boolean::from(e))
+                 .collect()
+    }
+
+    /// Computes this value as a linear combination of
+    /// its bits.
+    fn lc<E: Engine>(&self) -> LinearCombination<E> {
+        let mut tmp = LinearCombination::zero();
+
+        let mut coeff = E::Fr::one();
+        for b in &self.bits {
+            tmp = tmp + (coeff, b.get_variable());
+            coeff.double();
+        }
+
+        tmp
+    }
+
+    fn get_value(&self) -> Option<u64> {
+        self.value
+    }
+}
+
+/// Witnesses some bytes in the constraint system,
+/// skipping the first `skip_bits`.
+fn witness_bits<E, CS>(
+    mut cs: CS,
+    value: Option<&[u8]>,
+    num_bits: usize,
+    skip_bits: usize
+) -> Result<Vec<Boolean>, SynthesisError>
+    where E: Engine, CS: ConstraintSystem<E>,
+{
+    let bit_values = if let Some(value) = value {
+        let mut tmp = vec![];
+        for b in value.iter()
+                      .flat_map(|&m| (0..8).rev().map(move |i| m >> i & 1 == 1))
+                      .skip(skip_bits)
+        {
+            tmp.push(Some(b));
+        }
+        tmp
+    } else {
+        vec![None; num_bits]
+    };
+    assert_eq!(bit_values.len(), num_bits);
+
+    let mut bits = vec![];
+
+    for (i, value) in bit_values.into_iter().enumerate() {
+        bits.push(Boolean::from(AllocatedBit::alloc(
+            cs.namespace(|| format!("bit {}", i)),
+            value
+        )?));
+    }
+
+    Ok(bits)
+}
+
+fn witness_u256<E, CS>(
+    cs: CS,
+    value: Option<&[u8]>,
+) -> Result<Vec<Boolean>, SynthesisError>
+    where E: Engine, CS: ConstraintSystem<E>,
+{
+    witness_bits(cs, value, 256, 0)
+}
+
+fn witness_u252<E, CS>(
+    cs: CS,
+    value: Option<&[u8]>,
+) -> Result<Vec<Boolean>, SynthesisError>
+    where E: Engine, CS: ConstraintSystem<E>,
+{
+    witness_bits(cs, value, 252, 4)
+}
+
+#[test]
+fn test_sprout_constraints() {
+    use pairing::bls12_381::{Bls12};
+    use sapling_crypto::circuit::test::*;
+
+    use byteorder::{WriteBytesExt, ReadBytesExt, LittleEndian};
+
+    let test_vector = include_bytes!("test_vectors.dat");
+    let mut test_vector = &test_vector[..];
+
+    fn get_u256<R: ReadBytesExt>(mut reader: R) -> [u8; 32] {
+        let mut result = [0u8; 32];
+
+        for i in 0..32 {
+            result[i] = reader.read_u8().unwrap();
+        }
+
+        result
+    }
+
+    while test_vector.len() != 0 {
+        let mut cs = TestConstraintSystem::<Bls12>::new();
+
+        let phi = Some(get_u256(&mut test_vector));
+        let rt = Some(get_u256(&mut test_vector));
+        let h_sig = Some(get_u256(&mut test_vector));
+
+        let mut inputs = vec![];
+        for _ in 0..2 {
+            test_vector.read_u8().unwrap();
+
+            let mut auth_path = [None; TREE_DEPTH];
+            for i in (0..TREE_DEPTH).rev() {
+                test_vector.read_u8().unwrap();
+
+                let sibling = get_u256(&mut test_vector);
+
+                auth_path[i] = Some((sibling, false));
+            }
+            let mut position = test_vector.read_u64::<LittleEndian>().unwrap();
+            for i in 0..TREE_DEPTH {
+                auth_path[i].as_mut().map(|p| {
+                    p.1 = (position & 1) == 1
+                });
+
+                position >>= 1;
+            }
+
+            // a_pk
+            let _ = Some(SpendingKey(get_u256(&mut test_vector)));
+            let value = Some(test_vector.read_u64::<LittleEndian>().unwrap());
+            let rho = Some(UniqueRandomness(get_u256(&mut test_vector)));
+            let r = Some(CommitmentRandomness(get_u256(&mut test_vector)));
+            let a_sk = Some(SpendingKey(get_u256(&mut test_vector)));
+
+            inputs.push(
+                JSInput {
+                    value: value,
+                    a_sk: a_sk,
+                    rho: rho,
+                    r: r,
+                    auth_path: auth_path
+                }
+            );
+        }
+
+        let mut outputs = vec![];
+
+        for _ in 0..2 {
+            let a_pk = Some(PayingKey(get_u256(&mut test_vector)));
+            let value = Some(test_vector.read_u64::<LittleEndian>().unwrap());
+            get_u256(&mut test_vector);
+            let r = Some(CommitmentRandomness(get_u256(&mut test_vector)));
+
+            outputs.push(
+                JSOutput {
+                    value: value,
+                    a_pk: a_pk,
+                    r: r
+                }
+            );
+        }
+
+        let vpub_old = Some(test_vector.read_u64::<LittleEndian>().unwrap());
+        let vpub_new = Some(test_vector.read_u64::<LittleEndian>().unwrap());
+
+        let nf1 = get_u256(&mut test_vector);
+        let nf2 = get_u256(&mut test_vector);
+
+        let cm1 = get_u256(&mut test_vector);
+        let cm2 = get_u256(&mut test_vector);
+
+        let mac1 = get_u256(&mut test_vector);
+        let mac2 = get_u256(&mut test_vector);
+
+        let js = JoinSplit {
+            vpub_old: vpub_old,
+            vpub_new: vpub_new,
+            h_sig: h_sig,
+            phi: phi,
+            inputs: inputs,
+            outputs: outputs,
+            rt: rt
+        };
+
+        js.synthesize(&mut cs).unwrap();
+
+        if let Some(s) = cs.which_is_unsatisfied() {
+            panic!("{:?}", s);
+        }
+        assert!(cs.is_satisfied());
+        assert_eq!(cs.num_constraints(), 1989085);
+        assert_eq!(cs.num_inputs(), 10);
+        assert_eq!(cs.hash(), "1a228d3c6377130d1778c7885811dc8b8864049cb5af8aff7e6cd46c5bc4b84c");
+
+        let mut expected_inputs = vec![];
+        expected_inputs.extend(rt.unwrap().to_vec());
+        expected_inputs.extend(h_sig.unwrap().to_vec());
+        expected_inputs.extend(nf1.to_vec());
+        expected_inputs.extend(mac1.to_vec());
+        expected_inputs.extend(nf2.to_vec());
+        expected_inputs.extend(mac2.to_vec());
+        expected_inputs.extend(cm1.to_vec());
+        expected_inputs.extend(cm2.to_vec());
+        expected_inputs.write_u64::<LittleEndian>(vpub_old.unwrap()).unwrap();
+        expected_inputs.write_u64::<LittleEndian>(vpub_new.unwrap()).unwrap();
+
+        use sapling_crypto::circuit::multipack;
+
+        let expected_inputs = multipack::bytes_to_bits(&expected_inputs);
+        let expected_inputs = multipack::compute_multipacking::<Bls12>(&expected_inputs);
+
+        assert!(cs.verify(&expected_inputs));
+    }
+}

zcash_proofs/src/circuit/sprout/output.rs

@@ -0,0 +1,54 @@
+use pairing::{Engine};
+use bellman::{ConstraintSystem, SynthesisError};
+use sapling_crypto::circuit::boolean::{Boolean};
+
+use super::*;
+use super::prfs::*;
+use super::commitment::note_comm;
+
+pub struct OutputNote {
+    pub cm: Vec<Boolean>
+}
+
+impl OutputNote {
+    pub fn compute<'a, E, CS>(
+        mut cs: CS,
+        a_pk: Option<PayingKey>,
+        value: &NoteValue,
+        r: Option<CommitmentRandomness>,
+        phi: &[Boolean],
+        h_sig: &[Boolean],
+        nonce: bool
+    ) -> Result<Self, SynthesisError>
+        where E: Engine, CS: ConstraintSystem<E>,
+    {
+        let rho = prf_rho(
+            cs.namespace(|| "rho"),
+            phi,
+            h_sig,
+            nonce
+        )?;
+
+        let a_pk = witness_u256(
+            cs.namespace(|| "a_pk"),
+            a_pk.as_ref().map(|a_pk| &a_pk.0[..])
+        )?;
+
+        let r = witness_u256(
+            cs.namespace(|| "r"),
+            r.as_ref().map(|r| &r.0[..])
+        )?;
+
+        let cm = note_comm(
+            cs.namespace(|| "cm computation"),
+            &a_pk,
+            &value.bits_le(),
+            &rho,
+            &r
+        )?;
+
+        Ok(OutputNote {
+            cm: cm
+        })
+    }
+}

zcash_proofs/src/circuit/sprout/prfs.rs

@@ -0,0 +1,79 @@
+use pairing::{Engine};
+use bellman::{ConstraintSystem, SynthesisError};
+use sapling_crypto::circuit::sha256::{
+    sha256_block_no_padding
+};
+use sapling_crypto::circuit::boolean::{
+    Boolean
+};
+
+fn prf<E, CS>(
+    cs: CS,
+    a: bool,
+    b: bool,
+    c: bool,
+    d: bool,
+    x: &[Boolean],
+    y: &[Boolean]
+) -> Result<Vec<Boolean>, SynthesisError>
+    where E: Engine, CS: ConstraintSystem<E>
+{
+    assert_eq!(x.len(), 252);
+    assert_eq!(y.len(), 256);
+
+    let mut image = vec![];
+    image.push(Boolean::constant(a));
+    image.push(Boolean::constant(b));
+    image.push(Boolean::constant(c));
+    image.push(Boolean::constant(d));
+    image.extend(x.iter().cloned());
+    image.extend(y.iter().cloned());
+
+    assert_eq!(image.len(), 512);
+
+    sha256_block_no_padding(
+        cs,
+        &image
+    )
+}
+
+pub fn prf_a_pk<E, CS>(
+    cs: CS,
+    a_sk: &[Boolean]
+) -> Result<Vec<Boolean>, SynthesisError>
+    where E: Engine, CS: ConstraintSystem<E>
+{
+    prf(cs, true, true, false, false, a_sk, &(0..256).map(|_| Boolean::constant(false)).collect::<Vec<_>>())
+}
+
+pub fn prf_nf<E, CS>(
+    cs: CS,
+    a_sk: &[Boolean],
+    rho: &[Boolean]
+) -> Result<Vec<Boolean>, SynthesisError>
+    where E: Engine, CS: ConstraintSystem<E>
+{
+    prf(cs, true, true, true, false, a_sk, rho)
+}
+
+pub fn prf_pk<E, CS>(
+    cs: CS,
+    a_sk: &[Boolean],
+    h_sig: &[Boolean],
+    nonce: bool
+) -> Result<Vec<Boolean>, SynthesisError>
+    where E: Engine, CS: ConstraintSystem<E>
+{
+    prf(cs, false, nonce, false, false, a_sk, h_sig)
+}
+
+pub fn prf_rho<E, CS>(
+    cs: CS,
+    phi: &[Boolean],
+    h_sig: &[Boolean],
+    nonce: bool
+) -> Result<Vec<Boolean>, SynthesisError>
+    where E: Engine, CS: ConstraintSystem<E>
+{
+    prf(cs, false, nonce, true, false, phi, h_sig)
+}

zcash_proofs/src/lib.rs

@@ -10,12 +10,19 @@ extern crate zcash_primitives;
 #[cfg(feature = "local-prover")]
 extern crate directories;
 
+#[cfg(test)]
+extern crate rand_core;
+
+#[cfg(test)]
+extern crate rand_xorshift;
+
 use bellman::groth16::{prepare_verifying_key, Parameters, PreparedVerifyingKey, VerifyingKey};
 use pairing::bls12_381::Bls12;
 use std::fs::File;
 use std::io::{self, BufReader};
 use std::path::Path;
 
+pub mod circuit;
 mod hashreader;
 pub mod sapling;
 

zcash_proofs/src/sapling/prover.rs

@@ -5,10 +5,7 @@ use ff::Field;
 use pairing::bls12_381::{Bls12, Fr};
 use rand_os::OsRng;
 use sapling_crypto::{
-    circuit::{
-        multipack,
-        sapling::{Output, Spend},
-    },
+    circuit::multipack,
     jubjub::{edwards, fs::Fs, FixedGenerators, JubjubBls12, Unknown},
     primitives::{Diversifier, Note, PaymentAddress, ProofGenerationKey, ValueCommitment},
 };
@@ -20,6 +17,7 @@ use zcash_primitives::{
 };
 
 use super::compute_value_balance;
+use crate::circuit::sapling::{Output, Spend};
 
 /// A context object for creating the Sapling components of a Zcash transaction.
 pub struct SaplingProvingContext {