Added primitive circuit abstraction, tests for sha3.

src/bit.rs

@@ -5,6 +5,7 @@ use std::cell::RefCell;
 use super::variable::*;
 use self::Bit::*;
 use self::Op::*;
+use super::circuit::*;
 
 macro_rules! mirror {
     ($a:pat, $b:pat) => (($a, $b) | ($b, $a))
@@ -206,6 +207,59 @@ pub enum Bit {
     Bin(BinaryOp, bool)
 }
 
+struct BitEquality {
+    a: Bit,
+    b: Var
+}
+
+impl Constrainable for BitEquality {
+    type Result = Var;
+
+    fn synthesize(&self, enforce: &Bit) -> Var {
+        // TODO: currently only support unconditional enforcement
+        match enforce {
+            &Bit::Constant(true) => {},
+            _ => unimplemented!()
+        }
+
+        match self.a {
+            Bin(ref binop, inverted) => {
+                // TODO: figure this out later
+                assert!(binop.resolved.borrow().is_none());
+
+                let mut op = binop.op;
+
+                if inverted {
+                    op = op.not();
+                }
+
+                gadget(&[&binop.a, &binop.b, &self.b], 0, move |vals| {
+                    let a = vals.get_input(0);
+                    let b = vals.get_input(1);
+
+                    unsafe { vals.set_input(2, op.val(a, b)) };
+                }, |i, o, cs| {
+                    cs.push(binaryop_constraint(i[0], i[1], i[2], op));
+
+                    vec![i[2]]
+                }).remove(0)
+            },
+            _ => unimplemented!()
+        }
+    }
+}
+
+impl Equals<Var> for Bit {
+    type Result = BitEquality;
+
+    fn must_equal(&self, other: &Var) -> BitEquality {
+        BitEquality {
+            a: self.clone(),
+            b: other.clone()
+        }
+    }
+}
+
 fn binaryop_constraint(a: &Var, b: &Var, c: &Var, op: Op) -> Constraint {
     match op {
         // a * b = c
@@ -286,6 +340,24 @@ fn resolve(a: &Var, b: &Var, op: Op) -> Var {
     }).remove(0)
 }
 
+impl ConstraintWalker for Bit {
+    fn walk(&self, counter: &mut usize, constraints: &mut Vec<Constraint>, witness_map: &mut WitnessMap)
+    {
+        match *self {
+            Constant(_) => {},
+            Not(ref v) => {
+                v.walk(counter, constraints, witness_map);
+            },
+            Is(ref v) => {
+                v.walk(counter, constraints, witness_map);
+            },
+            Bin(ref bin, _) => {
+                bin.walk(counter, constraints, witness_map);
+            }
+        }
+    }
+}
+
 impl Bit {
     pub fn val(&self, map: &[FieldT]) -> bool {
         match *self {
@@ -304,21 +376,6 @@ impl Bit {
         }
     }
 
-    pub fn walk(&self, counter: &mut usize, constraints: &mut Vec<Constraint>, witness_map: &mut WitnessMap) {
-        match *self {
-            Constant(_) => {},
-            Not(ref v) => {
-                v.walk(counter, constraints, witness_map);
-            },
-            Is(ref v) => {
-                v.walk(counter, constraints, witness_map);
-            },
-            Bin(ref bin, _) => {
-                bin.walk(counter, constraints, witness_map);
-            }
-        }
-    }
-
     pub fn new(v: &Var) -> Bit {
         Is(gadget(&[v], 0, |_| {}, |i, o, cs| {
             // boolean constraint:

src/circuit.rs

@@ -0,0 +1,148 @@
+use tinysnark::{Proof, Keypair, FieldT, LinearTerm, ConstraintSystem};
+use super::variable::{Var,Constraint,WitnessMap,witness_field_elements};
+use super::bit::Bit;
+
+pub trait ConstraintWalker: 'static {
+    fn walk(&self,
+            counter: &mut usize,
+            constraints: &mut Vec<Constraint>,
+            witness_map: &mut WitnessMap);
+}
+
+impl<C: ConstraintWalker> ConstraintWalker for Vec<C> {
+    fn walk(&self,
+            counter: &mut usize,
+            constraints: &mut Vec<Constraint>,
+            witness_map: &mut WitnessMap)
+    {
+        for i in self {
+            i.walk(counter, constraints, witness_map);
+        }
+    }
+}
+
+pub trait Constrainable {
+    type Result: ConstraintWalker;
+
+    fn synthesize(&self, enforce: &Bit) -> Self::Result;
+}
+
+impl<C: Constrainable> Constrainable for Vec<C> {
+    type Result = Vec<C::Result>;
+
+    fn synthesize(&self, enforce: &Bit) -> Vec<C::Result> {
+        self.iter().map(|a| a.synthesize(enforce)).collect()
+    }
+}
+
+pub trait Equals<Rhs: ?Sized> {
+    type Result: Constrainable;
+
+    fn must_equal(&self, other: &Rhs) -> Self::Result;
+}
+
+impl<Lhs, Rhs> Equals<[Rhs]> for [Lhs] where Lhs: Equals<Rhs> {
+    type Result = Vec<Lhs::Result>;
+
+    fn must_equal(&self, other: &[Rhs]) -> Vec<Lhs::Result> {
+        assert_eq!(self.len(), other.len());
+
+        self.iter().zip(other.iter()).map(|(a, b)| a.must_equal(b)).collect()
+    }
+}
+
+pub struct Circuit {
+    public_inputs: usize,
+    private_inputs: usize,
+    aux_inputs: usize,
+    keypair: Keypair,
+    witness_map: WitnessMap
+}
+
+impl Circuit {
+    pub fn verify(&self, proof: &Proof, public: &[FieldT]) -> bool
+    {
+        proof.verify(&self.keypair, public)
+    }
+
+    pub fn prove(&self, public: &[FieldT], private: &[FieldT]) -> Result<Proof, ()>
+    {
+        assert_eq!(public.len(), self.public_inputs);
+        assert_eq!(private.len(), self.private_inputs);
+
+        let mut vars = Vec::new();
+        vars.push(FieldT::one());
+        vars.extend_from_slice(public);
+        vars.extend_from_slice(private);
+
+        for i in 0..self.aux_inputs {
+            vars.push(FieldT::zero());
+        }
+
+        witness_field_elements(&mut vars, &self.witness_map);
+
+        let primary = &vars[1..public.len()+1];
+        let aux = &vars[1+public.len()..];
+
+        if !self.keypair.is_satisfied(primary, aux) {
+            return Err(())
+        }
+
+        Ok(Proof::new(&self.keypair, primary, aux))
+    }
+}
+
+pub struct CircuitBuilder {
+    public_inputs: usize,
+    private_inputs: usize,
+    constraints: Vec<Box<ConstraintWalker>>
+}
+
+impl CircuitBuilder {
+    pub fn new(num_public: usize, num_private: usize) -> (Vec<Var>, Vec<Var>, CircuitBuilder) {
+    	(
+    		(0..num_public).map(|x| Var::new(1+x)).collect(),
+    		(0..num_private).map(|x| Var::new(1+num_public+x)).collect(),
+            CircuitBuilder {
+                public_inputs: num_public,
+                private_inputs: num_private,
+                constraints: Vec::new()
+            },
+    	)
+    }
+
+    pub fn constrain<C: Constrainable>(&mut self, constraint: C) {
+        self.constraints.push(Box::new(constraint.synthesize(&Bit::constant(true))));
+    }
+
+    pub fn finalize(self) -> Circuit {
+    	let mut counter = 1 + self.public_inputs + self.private_inputs;
+        let mut constraints = vec![];
+        let mut witness_map = WitnessMap::new();
+
+        for c in self.constraints.into_iter() {
+            c.walk(&mut counter, &mut constraints, &mut witness_map);
+        }
+
+        let mut cs = ConstraintSystem::new(self.public_inputs, (counter - 1) - self.public_inputs);
+
+        for Constraint(a, b, c) in constraints {
+            let a: Vec<_> = a.into_iter().map(|x| LinearTerm { coeff: x.0, index: x.1.index() }).collect();
+            let b: Vec<_> = b.into_iter().map(|x| LinearTerm { coeff: x.0, index: x.1.index() }).collect();
+            let c: Vec<_> = c.into_iter().map(|x| LinearTerm { coeff: x.0, index: x.1.index() }).collect();
+
+            cs.add_constraint(&a, &b, &c);
+        }
+
+        let kp = Keypair::new(&cs);
+
+        Circuit {
+            public_inputs: self.public_inputs,
+            private_inputs: self.private_inputs,
+            aux_inputs: ((counter - 1) - self.public_inputs) - self.private_inputs,
+            keypair: kp,
+            witness_map: witness_map
+        }
+    }
+}
+

src/keccak.rs

@@ -191,13 +191,13 @@ fn keccakf(st: &mut [Byte], rounds: usize)
     }
 }
 
-pub fn sha3_256(message: &[Byte]) -> Vec<Byte> {
+pub fn sha3_256(message: &[Byte]) -> Vec<Bit> {
     // As defined by FIPS202
     keccak(1088, 512, message, 0x06, 32, 24)
 }
 
 fn keccak(rate: usize, capacity: usize, mut input: &[Byte], delimited_suffix: u8, mut mdlen: usize, num_rounds: usize)
-    -> Vec<Byte>
+    -> Vec<Bit>
 {
     use std::cmp::min;
 
@@ -249,11 +249,15 @@ fn keccak(rate: usize, capacity: usize, mut input: &[Byte], delimited_suffix: u8
         }
     }
 
-    output
+    output.into_iter().flat_map(|byte| byte.bits.into_iter()).collect()
 }
 
 #[test]
 fn test_sha3_256() {
+    use super::circuit::{CircuitBuilder,Equals};
+    use super::variable::Var;
+    use tinysnark::{self,FieldT};
+
     let test_vector: Vec<(Vec<u8>, [u8; 32])> = vec![
         (vec![0xff],
          [0x44,0x4b,0x89,0xec,0xce,0x39,0x5a,0xec,0x5d,0xc9,0x8f,0x19,0xde,0xfd,0x3a,0x23,0xbc,0xa0,0x82,0x2f,0xc7,0x22,0x26,0xf5,0x8c,0xa4,0x6a,0x17,0xee,0xec,0xa4,0x42]
@@ -289,7 +293,11 @@ fn test_sha3_256() {
 
     for (i, &(ref message, ref expected)) in test_vector.iter().enumerate() {
         let message: Vec<Byte> = message.iter().map(|a| Byte::new(*a)).collect();
-        let result: Vec<u8> = sha3_256(&message).into_iter().map(|a| a.unwrap_constant()).collect();
+        let result: Vec<u8> = sha3_256(&message)
+                                 .chunks(8)
+                                 .map(|a| Byte::from(a))
+                                 .map(|a| a.unwrap_constant())
+                                 .collect();
 
         if &*result != expected {
             print!("Got: ");
@@ -306,6 +314,44 @@ fn test_sha3_256() {
             println!("--- HASH {} SUCCESS ---", i+1);
         }
     }
+
+    tinysnark::init();
+
+    for (i, &(ref message, ref expected)) in test_vector.iter().enumerate() {
+        fn into_bytes(a: &[Var]) -> Vec<Byte> {
+            let a: Vec<_> = a.into_iter().map(|a| Bit::new(a)).collect();
+            
+            a.chunks(8).map(|a| Byte::from(a)).collect()
+        }
+
+        fn into_fieldt(a: &[u8], vars: &mut [FieldT]) {
+            let mut counter = 0;
+
+            for byte in a {
+                for bit in (0..8).map(|i| byte & (1 << i) != 0).rev() {
+                    if bit { vars[counter] = FieldT::one() } else { vars[counter] = FieldT::zero() }
+                    counter += 1;
+                }
+            }
+        }
+
+        let (public, private, mut circuit) = CircuitBuilder::new(expected.len() * 8, message.len() * 8);
+
+        let private = into_bytes(&private);
+
+        circuit.constrain(sha3_256(&private).must_equal(&public));
+
+        let circuit = circuit.finalize();
+
+        let mut input: Vec<FieldT> = (0..message.len() * 8).map(|_| FieldT::zero()).collect();
+        let mut output: Vec<FieldT> = (0..expected.len() * 8).map(|_| FieldT::zero()).collect();
+
+        into_fieldt(message, &mut input);
+        into_fieldt(expected, &mut output);
+
+        let proof = circuit.prove(&output, &input).unwrap();
+        assert!(circuit.verify(&proof, &output));
+    }
 }
 
 #[derive(Clone)]

src/main.rs

@@ -5,42 +5,15 @@ extern crate rand;
 
 use tinysnark::{Proof, Keypair, FieldT, LinearTerm, ConstraintSystem};
 use variable::*;
+use circuit::*;
 use keccak::*;
 use bit::*;
 
 mod variable;
 mod keccak;
 mod bit;
+mod circuit;
 
 fn main() {
-    tinysnark::init();
 
-    let inbytes = 64;
-    //for inbits in 0..1024 {
-        let inbits = inbytes * 8;
-        let input: Vec<Bit> = (0..inbits).map(|i| Bit::new(&Var::new(i+1))).collect();
-        let input: Vec<Byte> = input.chunks(8).map(|c| Byte::from(c)).collect();
-
-        let output = sha3_256(&input);
-
-        let mut counter = 1 + (8*input.len());
-        let mut constraints = vec![];
-        let mut witness_map = WitnessMap::new();
-
-        for o in output.iter().flat_map(|e| e.bits().into_iter()) {
-            o.walk(&mut counter, &mut constraints, &mut witness_map);
-        }
-
-        let mut vars: Vec<FieldT> = (0..counter).map(|_| FieldT::zero()).collect();
-        vars[0] = FieldT::one();
-
-        witness_field_elements(&mut vars, &witness_map);
-
-        for b in output.iter().flat_map(|e| e.bits()) {
-            print!("{}", if b.val(&vars) { 1 } else { 0 });
-        }
-        println!("");
-
-        println!("{}: {} constraints", inbits, constraints.len());
-    //}
 }

src/variable.rs

@@ -2,6 +2,7 @@ use tinysnark::FieldT;
 use std::cell::Cell;
 use std::rc::Rc;
 use std::collections::BTreeMap;
+use super::circuit::ConstraintWalker;
 
 pub type WitnessMap = BTreeMap<usize, Vec<(Vec<usize>, Vec<usize>, Rc<Fn(&mut VariableView) + 'static>)>>;
 
@@ -21,6 +22,14 @@ impl<'a> VariableView<'a> {
     pub fn get_input(&self, index: usize) -> FieldT {
         self.vars[self.inputs[index]]
     }
+
+    /// Sets the value of an input variable. This is unsafe
+    /// because theoretically this should not be necessary,
+    /// and could cause soundness problems, but I've temporarily
+    /// done this to make testing easier.
+    pub fn set_input(&mut self, index: usize, to: FieldT) {
+        self.vars[self.inputs[index]] = to;
+    }
 }
 
 use std::collections::Bound::Unbounded;
@@ -102,9 +111,8 @@ impl Var {
         }
     }
 
-    // make this not public or unsafe too
+    pub fn index(&self) -> usize {
-    pub fn index(&self) -> Rc<Cell<usize>> {
+        self.index.get()
-        self.index.clone()
     }
 
     pub fn val(&self, map: &[FieldT]) -> FieldT {
@@ -119,8 +127,10 @@ impl Var {
             Some(ref g) => g.group
         }
     }
+}
 
-    pub fn walk(&self, counter: &mut usize, constraints: &mut Vec<Constraint>, witness_map: &mut WitnessMap) {
+impl ConstraintWalker for Var {
+    fn walk(&self, counter: &mut usize, constraints: &mut Vec<Constraint>, witness_map: &mut WitnessMap) {
         match self.gadget {
             None => {},
             Some(ref g) => g.walk(counter, constraints, witness_map)

tinysnark/src/r1cs.rs

@@ -88,6 +88,15 @@ impl Keypair {
             aux_size: constraint_system.aux_size
         }
     }
+
+    pub fn is_satisfied(&self, primary: &[FieldT], aux: &[FieldT]) -> bool {
+        assert_eq!(primary.len(), self.primary_size);
+        assert_eq!(aux.len(), self.aux_size);
+
+        unsafe {
+            tinysnark_keypair_satisfies_test(self.kp, primary.get_unchecked(0), aux.get_unchecked(0))
+        }
+    }
 }
 
 impl Drop for Keypair {
@@ -99,6 +108,7 @@ impl Drop for Keypair {
 extern "C" {
     fn tinysnark_gen_keypair(cs: *mut R1ConstraintSystem) -> *mut R1CSKeypair;
     fn tinysnark_drop_keypair(cs: *mut R1CSKeypair);
+    fn tinysnark_keypair_satisfies_test(kp: *mut R1CSKeypair, primary: *const FieldT, aux: *const FieldT) -> bool;
 }
 
 #[repr(C)]

tinysnark/tinysnark.cpp

@@ -78,6 +78,18 @@ extern "C" void tinysnark_drop_r1cs(void * ics) {
     delete cs;
 }
 
+extern "C" bool tinysnark_keypair_satisfies_test(void * kp, FieldT* primary, FieldT* aux)
+{
+    r1cs_ppzksnark_keypair<default_r1cs_ppzksnark_pp>* keypair = static_cast<r1cs_ppzksnark_keypair<default_r1cs_ppzksnark_pp>*>(kp);
+
+    r1cs_constraint_system<FieldT>* cs = &keypair->pk.constraint_system;
+
+    r1cs_primary_input<FieldT> primary_input(primary, primary+(cs->primary_input_size));
+    r1cs_auxiliary_input<FieldT> aux_input(aux, aux+(cs->auxiliary_input_size));
+
+    return cs->is_valid() && cs->is_satisfied(primary_input, aux_input);
+}
+
 extern "C" bool tinysnark_satisfy_test(void * ics, FieldT* primary, FieldT* aux) {
     r1cs_constraint_system<FieldT>* cs = static_cast<r1cs_constraint_system<FieldT>*>(ics);