ExportSolidity Public Input Size Problem

[SherLzp]

Hi sir, @ivokub

func exportMultiECDSACircuit(size int64) {
	var circuit ecdsa.MultiEcdsaCircuit[emulated.Secp256r1Fp, emulated.Secp256r1Fr]
	circuit.Ecdsas = make([]ecdsa.EcdsaCircuit[emulated.Secp256r1Fp, emulated.Secp256r1Fr], size)
	oR1cs, err := frontend.Compile(ecc.BN254.ScalarField(), r1cs.NewBuilder, &circuit, frontend.IgnoreUnconstrainedInputs())
	if err != nil {
		panic(err)
	}

	pk, vk, err := groth16.Setup(oR1cs)
	if err != nil {
		panic(err)
	}
	{
		f, err := os.Create("./keys/ecdsa/kontos-ecdsa-" + fmt.Sprint(size) + ".vk")
		if err != nil {
			panic(err)
		}
		_, err = vk.WriteRawTo(f)
		if err != nil {
			panic(err)
		}
	}
	{
		f, err := os.Create("./keys/ecdsa/kontos-ecdsa-" + fmt.Sprint(size) + ".pk")
		if err != nil {
			panic(err)
		}
		_, err = pk.WriteRawTo(f)
		if err != nil {
			panic(err)
		}
	}

	{
		f, err := os.Create("./keys/ecdsa/KontosECDSAVerifier-" + fmt.Sprint(size) + ".sol")
		if err != nil {
			panic(err)
		}
		err = vk.ExportSolidity(f)
		if err != nil {
			panic(err)
		}
	}
}

I want to verify ECDSA circuit with solidity, then I try the above method, why it has 21 public inputs?

function verifyProof(
    uint256[2] memory a,
    uint256[2][2] memory b,
    uint256[2] memory c,
    uint256[21] calldata input
) public view returns (bool r)

[ivokub]

Can you give the circuit type definition (type Circuit struct ...)? If you provide as an input the public key, message, signature, then this amounts to approximately this amount of public inputs (key 8 vars, message 4 vars, signature 9 vars).

This can theoretically be reduced, but it depends on your use-case. E.g. you can provide signature as a private input (statement "there is a valid signature for message by public key") or you can provide the public key as an address (but then have to hash public key into address in-circuit).

[SherLzp]

Credit where it is due, @ThomasPiellard has done most of it. Is Groth16 commitments in Solidity a priority for you guys?

Yes! Reduce the gas on-chain is the most important part for verifying.

[zhengjunhe]

@ivokub could you pls tell me how to fill the extra 32 byte info

[ivokub]

Groth16 Solidity verifier still does not support verifying the commitments. It is right now blocked by not having hash-to-field in Solidity smart contract verifier.

PLONK verifier should work though. The prover is slower, but at least we have smart contract verifier for it.

[danivilardell]

Hi @ivokub, is there any plan to implement commitment verification on Solidity verifier some time soon?

[ivokub]

Hi, gnark latest release v0.10 supports commitment verification in Solidity Groth16 verifier. However, for it to work you have to provide sha2-256 as the hash function during proving time:

groth16.Prove(r1cs, pk, witness, backend.WithProverHashToFieldFunction(sha256.New()))

(keep in mind the backend.WithProverHashToFieldFunction option. And for formatting the calldata see the example

[SherLzp]

Hi sir, @ivokub
@gbotrel @yelhousni
One more question here.

I mark here as public:
https://github.com/ConsenSys/gnark/blob/master/std/signature/ecdsa/ecdsa_test.go#L18

I add one line here:

assert.ProverSucceeded(&circuit, &witness, test.WithCurves(ecc.BN254), test.WithBackends(backend.GROTH16))

to this part: https://github.com/ConsenSys/gnark/blob/master/std/signature/ecdsa/ecdsa_test.go#L68

However, it will occur the following problems:

panic: runtime error: slice bounds out of range [:768] with capacity 704 [recovered]
	panic: runtime error: slice bounds out of range [:768] with capacity 704

[ivokub]

May be a bug. Will have a look in the issue later.

[SherLzp]

Sir, @ivokub
Find the bug here: https://github.com/ConsenSys/gnark/blob/develop/constraint/commitment.go#L41

func (i *Commitment) SerializeCommitment(privateCommitment []byte, publicCommitted []*big.Int, fieldByteLen int) []byte {

	res := make([]byte, len(privateCommitment)+len(publicCommitted)*fieldByteLen)
	copy(res, privateCommitment)

	offset := len(privateCommitment)
	for j, inJ := range publicCommitted {
		offset += j * fieldByteLen
		inJ.FillBytes(res[offset : offset+fieldByteLen])
	}

	return res
}

I think it should be changed to:

func (i *Commitment) SerializeCommitment(privateCommitment []byte, publicCommitted []*big.Int, fieldByteLen int) []byte {

	res := make([]byte, len(privateCommitment)+len(publicCommitted)*fieldByteLen)
	copy(res, privateCommitment)

	offset := len(privateCommitment)
	for _, inJ := range publicCommitted {
		inJ.FillBytes(res[offset : offset+fieldByteLen])
		offset += fieldByteLen
	}

	return res
}

then it works.

I make a PR here: #651

[SherLzp]

However, I met another bug here:

When I just use the following code to prove/verify, it works:

pk, vk, err := groth16.Setup(oR1cs)
assert.NoError(err)
witnessData, err := frontend.NewWitness(&witness, ecc.BN254.ScalarField())
assert.NoError(err)

proof, err := groth16.Prove(oR1cs, pk, witnessData)
assert.NoError(err)

publicWitnessData, err := frontend.NewWitness(&witness, ecc.BN254.ScalarField())
assert.NoError(err)
err = groth16.Verify(proof, vk, publicWitnessData)
assert.NoError(err)

However, when I write pk/vk to file and read it again, it will fail, I think that's the bug for marshal/unmarshal:

Error:      	Received unexpected error:
        	   constraint #309736 is not satisfied: [div] 59521/0 == <unsolved>
        	   r1cs.(*builder).DivUnchecked
        	    api.go:257
        	   rangecheck.(*commitChecker).commit.func2
        	    rangecheck_commit.go:99

The keys are not match:

	vkRead := groth16.NewVerifyingKey(ecc.BN254)
	readVkFile, err := os.Open("xx.vk")
	if err != nil {
		panic(err)
	}
	_, err = vkRead.ReadFrom(readVkFile)
	if err != nil {
		panic(err)
	}

	isEqual := reflect.DeepEqual(pk, pkRead)
	if !isEqual {
		panic("unequal key")
	}

[hussein-aitlahcen]

Proving/verifying keys are missing commitment info when serialized, see #580

[SherLzp]

Proving/verifying keys are missing commitment info when serialized, see #580

Thank you! Got it. And already fixed it on my branch.