diff --git a/circuits/README.md b/circuits/README.md index ecda7676..3ac16b66 100644 --- a/circuits/README.md +++ b/circuits/README.md @@ -71,10 +71,11 @@ yarn test This will run tests with sample data generated on the fly. - ## OpenPassport Prove circuit + OpenPassport Prove is the main circuit of the project. It is used for these 3 different `circuit modes`: + - prove offChain - prove onChain - register @@ -82,6 +83,7 @@ It is used for these 3 different `circuit modes`: Learn more on these 3 use cases on [OpenPassport documentation.](https://docs.openpassport.app/docs/use-openpassport/quickstart) The circuit achieves the following actions: + - verify the signature of the passport and the integrity of the datagroups - disclose attributes - verify that user's name is not part of the OFAC list @@ -93,23 +95,21 @@ If this "everything circuit" is executing all those actions each time, we want a In order to achieve that we will input a bitmap `selector_mode[2]` that will ensure that the circuit can only disclose the attributes related to the `circuit mode` selected. -| Circuit Mode | selector_mode[0] | selector_mode[1] | -| --- | --- | --- | -| prove offChain | 1 | 1 | -| prove onChain | 1 | 0 | -| register | 0 | 0 | +| Circuit Mode | selector_mode[0] | selector_mode[1] | +| -------------- | ---------------- | ---------------- | +| prove offChain | 1 | 1 | +| prove onChain | 1 | 0 | +| register | 0 | 0 | Using the value [0,1] for `selector_mode` will fail proof generation. - Here are the attributes disclosed according to the `circuit_mode`: -| Circuit Mode | Attributes Disclosed | -| --- | --- | -| prove offChain | packedReveal-dg1, older than, OFAC, countryIsNotInList, pubKey | -| prove onChain | packedReveal-dg1, older than, OFAC, countryIsNotInList, blinded DSC commitment | -| register | blinded DSC commitment, commitment | - +| Circuit Mode | Attributes Disclosed | +| -------------- | ------------------------------------------------------------------------------ | +| prove offChain | packedReveal-dg1, older than, OFAC, countryIsNotInList, pubKey | +| prove onChain | packedReveal-dg1, older than, OFAC, countryIsNotInList, blinded DSC commitment | +| register | blinded DSC commitment, commitment | ## Certificate Chain verification @@ -119,7 +119,9 @@ Both DSC and CSCA lists are published on online registry of the ICAO, however ma In order to maximize passport readability we need to verify the full certificate chain. ### On chain + To avoid huge proving time and (too) heavy zkeys, the signature of the passport data is verified on the mobile (the passport data never leaves the device) and the certificate chain verification is done on a remote modal server. A `blindedDscCommitment` is generated on both sides to link proofs. ### Off chain -In off chain setup users will send their DSC to the verifier along with their passport proof. The pubKey will be revealed as an output of the proof. \ No newline at end of file + +In off chain setup users will send their DSC to the verifier along with their passport proof. The pubKey will be revealed as an output of the proof. diff --git a/circuits/circuits/dsc/instances/dsc_rsa_65537_sha1_2048.circom b/circuits/circuits/dsc/instances/dsc_rsa_65537_sha1_2048.circom deleted file mode 100644 index 16476e05..00000000 --- a/circuits/circuits/dsc/instances/dsc_rsa_65537_sha1_2048.circom +++ /dev/null @@ -1,4 +0,0 @@ -pragma circom 2.1.9; -include "../openpassport_dsc.circom"; - -component main = OPENPASSPORT_DSC(3, 64, 32, 64, 32, 960, 256, 12); diff --git a/circuits/circuits/dsc/instances/dsc_rsa_65537_sha256_2048.circom b/circuits/circuits/dsc/instances/dsc_rsa_65537_sha256_2048.circom deleted file mode 100644 index f232ebf5..00000000 --- a/circuits/circuits/dsc/instances/dsc_rsa_65537_sha256_2048.circom +++ /dev/null @@ -1,5 +0,0 @@ -pragma circom 2.1.9; - -include "../openpassport_dsc.circom"; - -component main = OPENPASSPORT_DSC(1, 64, 32, 120, 35, 1664, 256, 12); \ No newline at end of file diff --git a/circuits/circuits/dsc/instances/dsc_rsapss_65537_sha256_2048.circom b/circuits/circuits/dsc/instances/dsc_rsapss_65537_sha256_2048.circom deleted file mode 100644 index e906e77e..00000000 --- a/circuits/circuits/dsc/instances/dsc_rsapss_65537_sha256_2048.circom +++ /dev/null @@ -1,4 +0,0 @@ -pragma circom 2.1.9; -include "../openpassport_dsc.circom"; - -component main = OPENPASSPORT_DSC(4, 64, 32, 64, 32, 960, 256, 12); diff --git a/circuits/scripts/build_disclose_circuit.sh b/circuits/scripts/build_disclose_circuit.sh new file mode 100755 index 00000000..a164d12f --- /dev/null +++ b/circuits/scripts/build_disclose_circuit.sh @@ -0,0 +1,50 @@ +#!/bin/bash + +source "scripts/download_ptau.sh" + +build_circuit() { + local CIRCUIT_NAME=$1 + local CIRCUIT_TYPE=$2 + local START_TIME=$(date +%s) + + echo "compiling circuit: $CIRCUIT_NAME" + mkdir -p build/${CIRCUIT_TYPE}/${CIRCUIT_NAME}/ + circom circuits/${CIRCUIT_TYPE}/${CIRCUIT_NAME}.circom -l node_modules -l ./node_modules/@zk-kit/binary-merkle-root.circom/src -l ./node_modules/circomlib/circuits/ --r1cs --O1 --wasm -c --output build/${CIRCUIT_TYPE}/${CIRCUIT_NAME}/ + + echo "building zkey" + yarn snarkjs groth16 setup build/${CIRCUIT_TYPE}/${CIRCUIT_NAME}/${CIRCUIT_NAME}.r1cs build/powersOfTau28_hez_final_20.ptau build/${CIRCUIT_TYPE}/${CIRCUIT_NAME}/${CIRCUIT_NAME}.zkey + + echo "building vkey" + yarn snarkjs zkey contribute build/${CIRCUIT_TYPE}/${CIRCUIT_NAME}/${CIRCUIT_NAME}.zkey build/${CIRCUIT_TYPE}/${CIRCUIT_NAME}/${CIRCUIT_NAME}_final.zkey -e="random text" + yarn snarkjs zkey export verificationkey build/${CIRCUIT_TYPE}/${CIRCUIT_NAME}/${CIRCUIT_NAME}_final.zkey build/${CIRCUIT_TYPE}/${CIRCUIT_NAME}/${CIRCUIT_NAME}_vkey.json + + yarn snarkjs zkey export solidityverifier build/${CIRCUIT_TYPE}/${CIRCUIT_NAME}/${CIRCUIT_NAME}_final.zkey build/${CIRCUIT_TYPE}/Verifier_${CIRCUIT_NAME}.sol + sed -i '' "s/Groth16Verifier/Verifier_${CIRCUIT_NAME}/g" build/${CIRCUIT_TYPE}/Verifier_${CIRCUIT_NAME}.sol + mkdir -p ../contracts/contracts/verifiers/local/${CIRCUIT_TYPE}/ + cp build/${CIRCUIT_TYPE}/${CIRCUIT_NAME}/Verifier_${CIRCUIT_NAME}.sol ../contracts/contracts/verifiers/local/${CIRCUIT_TYPE}/Verifier_${CIRCUIT_NAME}.sol + echo "copied Verifier_${CIRCUIT_NAME}.sol to contracts" + + echo "Build of $CIRCUIT_NAME completed in $(($(date +%s) - START_TIME)) seconds" + echo "Size of ${CIRCUIT_NAME}.r1cs: $(wc -c /dev/null - then - RAND_STR=$(openssl rand -hex 64) - else - RAND_STR="random text" - fi - - echo -e "\033[34mbuilding vkey\033[0m" - echo $RAND_STR | yarn snarkjs zkey contribute build/${CIRCUIT_NAME}.zkey build/${CIRCUIT_NAME}_final.zkey - yarn snarkjs zkey export verificationkey build/${CIRCUIT_NAME}_final.zkey build/${CIRCUIT_NAME}_vkey.json - - yarn snarkjs zkey export solidityverifier build/${CIRCUIT_NAME}_final.zkey build/Verifier_${CIRCUIT_NAME}.sol - sed -i '' "s/Groth16Verifier/Verifier_${CIRCUIT_NAME}/g" build/Verifier_${CIRCUIT_NAME}.sol - cp build/Verifier_${CIRCUIT_NAME}.sol ../contracts/contracts/Verifier_${CIRCUIT_NAME}.sol - echo -e "\033[34mcopied Verifier_${CIRCUIT_NAME}.sol to contracts\033[0m" - - echo -e "\033[32mBuild of $CIRCUIT_NAME completed in $(($(date +%s) - START_TIME)) seconds\033[0m" - - echo "file sizes:" - echo -e "\033[34mSize of ${CIRCUIT_NAME}.r1cs: $(wc -c /dev/null then @@ -32,12 +33,12 @@ build_circuit() { fi echo -e "\033[34mbuilding vkey\033[0m" - echo $RAND_STR | yarn snarkjs zkey contribute build/${CIRCUIT_NAME}.zkey build/${CIRCUIT_NAME}_final.zkey - yarn snarkjs zkey export verificationkey build/${CIRCUIT_NAME}_final.zkey build/${CIRCUIT_NAME}_vkey.json + echo $RAND_STR | yarn snarkjs zkey contribute build/dsc/${CIRCUIT_NAME}/${CIRCUIT_NAME}.zkey build/dsc/${CIRCUIT_NAME}/${CIRCUIT_NAME}_final.zkey + yarn snarkjs zkey export verificationkey build/dsc/${CIRCUIT_NAME}/${CIRCUIT_NAME}_final.zkey build/dsc/${CIRCUIT_NAME}/${CIRCUIT_NAME}_vkey.json - yarn snarkjs zkey export solidityverifier build/${CIRCUIT_NAME}_final.zkey build/Verifier_${CIRCUIT_NAME}.sol - sed -i '' "s/Groth16Verifier/Verifier_${CIRCUIT_NAME}/g" build/Verifier_${CIRCUIT_NAME}.sol - cp build/Verifier_${CIRCUIT_NAME}.sol ../contracts/contracts/Verifier_${CIRCUIT_NAME}.sol + yarn snarkjs zkey export solidityverifier build/dsc/${CIRCUIT_NAME}/${CIRCUIT_NAME}_final.zkey build/dsc/Verifier_${CIRCUIT_NAME}.sol + sed -i '' "s/Groth16Verifier/Verifier_${CIRCUIT_NAME}/g" build/dsc/Verifier_${CIRCUIT_NAME}.sol + cp build/dsc/Verifier_${CIRCUIT_NAME}.sol ../contracts/contracts/dsc/Verifier_${CIRCUIT_NAME}.sol echo -e "\033[34mcopied Verifier_${CIRCUIT_NAME}.sol to contracts\033[0m" echo -e "\033[32mBuild of $CIRCUIT_NAME completed in $(($(date +%s) - START_TIME)) seconds\033[0m" diff --git a/circuits/scripts/build_prove_circuits.sh b/circuits/scripts/build_prove_circuits.sh index b935e6bc..7bdddf9d 100755 --- a/circuits/scripts/build_prove_circuits.sh +++ b/circuits/scripts/build_prove_circuits.sh @@ -8,24 +8,26 @@ build_circuit() { local START_TIME=$(date +%s) echo "compiling circuit: $CIRCUIT_NAME" - circom circuits/${CIRCUIT_TYPE}/instances/${CIRCUIT_NAME}.circom -l node_modules -l ./node_modules/@zk-kit/binary-merkle-root.circom/src -l ./node_modules/circomlib/circuits --r1cs --O1 --wasm -c --output build + mkdir -p build/prove/${CIRCUIT_NAME}/ + circom circuits/${CIRCUIT_TYPE}/instances/${CIRCUIT_NAME}.circom -l node_modules -l ./node_modules/@zk-kit/binary-merkle-root.circom/src -l ./node_modules/circomlib/circuits --r1cs --O1 --wasm -c --output build/prove/${CIRCUIT_NAME}/ echo "building zkey" - yarn snarkjs groth16 setup build/${CIRCUIT_NAME}.r1cs build/powersOfTau28_hez_final_20.ptau build/${CIRCUIT_NAME}.zkey + yarn snarkjs groth16 setup build/prove/${CIRCUIT_NAME}/${CIRCUIT_NAME}.r1cs build/powersOfTau28_hez_final_20.ptau build/prove/${CIRCUIT_NAME}/${CIRCUIT_NAME}.zkey echo "building vkey" - yarn snarkjs zkey contribute build/${CIRCUIT_NAME}.zkey build/${CIRCUIT_NAME}_final.zkey -e="random text" - yarn snarkjs zkey export verificationkey build/${CIRCUIT_NAME}_final.zkey build/${CIRCUIT_NAME}_vkey.json + yarn snarkjs zkey contribute build/prove/${CIRCUIT_NAME}/${CIRCUIT_NAME}.zkey build/prove/${CIRCUIT_NAME}/${CIRCUIT_NAME}_final.zkey -e="random text" + yarn snarkjs zkey export verificationkey build/prove/${CIRCUIT_NAME}/${CIRCUIT_NAME}_final.zkey build/prove/${CIRCUIT_NAME}/${CIRCUIT_NAME}_vkey.json - yarn snarkjs zkey export solidityverifier build/${CIRCUIT_NAME}_final.zkey build/Verifier_${CIRCUIT_NAME}.sol - sed -i '' "s/Groth16Verifier/Verifier_${CIRCUIT_NAME}/g" build/Verifier_${CIRCUIT_NAME}.sol - cp build/Verifier_${CIRCUIT_NAME}.sol ../contracts/contracts/Verifier_${CIRCUIT_NAME}.sol + yarn snarkjs zkey export solidityverifier build/prove/${CIRCUIT_NAME}/${CIRCUIT_NAME}_final.zkey build/prove/${CIRCUIT_NAME}/Verifier_${CIRCUIT_NAME}.sol + sed -i '' "s/Groth16Verifier/Verifier_${CIRCUIT_NAME}/g" build/prove/${CIRCUIT_NAME}/Verifier_${CIRCUIT_NAME}.sol + mkdir -p ../contracts/contracts/verifiers/local/${CIRCUIT_TYPE}/ + cp build/prove/${CIRCUIT_NAME}/Verifier_${CIRCUIT_NAME}.sol ../contracts/contracts/verifiers/local/${CIRCUIT_TYPE}/Verifier_${CIRCUIT_NAME}.sol echo "copied Verifier_${CIRCUIT_NAME}.sol to contracts" echo "Build of $CIRCUIT_NAME completed in $(($(date +%s) - START_TIME)) seconds" - echo "Size of ${CIRCUIT_NAME}.r1cs: $(wc -c . -*/ - -pragma solidity >=0.7.0 <0.9.0; - -contract Verifier_dsc_sha1_rsa_2048 { - // Scalar field size - uint256 constant r = 21888242871839275222246405745257275088548364400416034343698204186575808495617; - // Base field size - uint256 constant q = 21888242871839275222246405745257275088696311157297823662689037894645226208583; - - // Verification Key data - uint256 constant alphax = 20491192805390485299153009773594534940189261866228447918068658471970481763042; - uint256 constant alphay = 9383485363053290200918347156157836566562967994039712273449902621266178545958; - uint256 constant betax1 = 4252822878758300859123897981450591353533073413197771768651442665752259397132; - uint256 constant betax2 = 6375614351688725206403948262868962793625744043794305715222011528459656738731; - uint256 constant betay1 = 21847035105528745403288232691147584728191162732299865338377159692350059136679; - uint256 constant betay2 = 10505242626370262277552901082094356697409835680220590971873171140371331206856; - uint256 constant gammax1 = 11559732032986387107991004021392285783925812861821192530917403151452391805634; - uint256 constant gammax2 = 10857046999023057135944570762232829481370756359578518086990519993285655852781; - uint256 constant gammay1 = 4082367875863433681332203403145435568316851327593401208105741076214120093531; - uint256 constant gammay2 = 8495653923123431417604973247489272438418190587263600148770280649306958101930; - uint256 constant deltax1 = 7430317108417703434372166794917187399554563629726410869171357915848086186466; - uint256 constant deltax2 = 19826388779896184010690202825483434764784333075120886307143470704008085111947; - uint256 constant deltay1 = 9154035024400062177217433795058622634427319727778700630309202612913706268399; - uint256 constant deltay2 = 21630179816418696841358225700326094050554890679936805812923704081130539368363; - - - uint256 constant IC0x = 1831187731753427599498427469993070156364209280093640485240081592834524392468; - uint256 constant IC0y = 12050829256101574777474042248973136015751295174251031684640298540412975356077; - - uint256 constant IC1x = 15989250193192853953023955469038227095527618030821031659456209486050774261149; - uint256 constant IC1y = 19140815564022393725535648116464535684099604482394195607409159146820730282942; - - uint256 constant IC2x = 21555315424520171925328851084937979380671543637385698302220842793631816728183; - uint256 constant IC2y = 10414306106725467828220940647025160904856936048616324661714507243150024800403; - - - // Memory data - uint16 constant pVk = 0; - uint16 constant pPairing = 128; - - uint16 constant pLastMem = 896; - - function verifyProof(uint[2] calldata _pA, uint[2][2] calldata _pB, uint[2] calldata _pC, uint[2] calldata _pubSignals) public view returns (bool) { - assembly { - function checkField(v) { - if iszero(lt(v, q)) { - mstore(0, 0) - return(0, 0x20) - } - } - - // G1 function to multiply a G1 value(x,y) to value in an address - function g1_mulAccC(pR, x, y, s) { - let success - let mIn := mload(0x40) - mstore(mIn, x) - mstore(add(mIn, 32), y) - mstore(add(mIn, 64), s) - - success := staticcall(sub(gas(), 2000), 7, mIn, 96, mIn, 64) - - if iszero(success) { - mstore(0, 0) - return(0, 0x20) - } - - mstore(add(mIn, 64), mload(pR)) - mstore(add(mIn, 96), mload(add(pR, 32))) - - success := staticcall(sub(gas(), 2000), 6, mIn, 128, pR, 64) - - if iszero(success) { - mstore(0, 0) - return(0, 0x20) - } - } - - function checkPairing(pA, pB, pC, pubSignals, pMem) -> isOk { - let _pPairing := add(pMem, pPairing) - let _pVk := add(pMem, pVk) - - mstore(_pVk, IC0x) - mstore(add(_pVk, 32), IC0y) - - // Compute the linear combination vk_x - - g1_mulAccC(_pVk, IC1x, IC1y, calldataload(add(pubSignals, 0))) - - g1_mulAccC(_pVk, IC2x, IC2y, calldataload(add(pubSignals, 32))) - - - // -A - mstore(_pPairing, calldataload(pA)) - mstore(add(_pPairing, 32), mod(sub(q, calldataload(add(pA, 32))), q)) - - // B - mstore(add(_pPairing, 64), calldataload(pB)) - mstore(add(_pPairing, 96), calldataload(add(pB, 32))) - mstore(add(_pPairing, 128), calldataload(add(pB, 64))) - mstore(add(_pPairing, 160), calldataload(add(pB, 96))) - - // alpha1 - mstore(add(_pPairing, 192), alphax) - mstore(add(_pPairing, 224), alphay) - - // beta2 - mstore(add(_pPairing, 256), betax1) - mstore(add(_pPairing, 288), betax2) - mstore(add(_pPairing, 320), betay1) - mstore(add(_pPairing, 352), betay2) - - // vk_x - mstore(add(_pPairing, 384), mload(add(pMem, pVk))) - mstore(add(_pPairing, 416), mload(add(pMem, add(pVk, 32)))) - - - // gamma2 - mstore(add(_pPairing, 448), gammax1) - mstore(add(_pPairing, 480), gammax2) - mstore(add(_pPairing, 512), gammay1) - mstore(add(_pPairing, 544), gammay2) - - // C - mstore(add(_pPairing, 576), calldataload(pC)) - mstore(add(_pPairing, 608), calldataload(add(pC, 32))) - - // delta2 - mstore(add(_pPairing, 640), deltax1) - mstore(add(_pPairing, 672), deltax2) - mstore(add(_pPairing, 704), deltay1) - mstore(add(_pPairing, 736), deltay2) - - - let success := staticcall(sub(gas(), 2000), 8, _pPairing, 768, _pPairing, 0x20) - - isOk := and(success, mload(_pPairing)) - } - - let pMem := mload(0x40) - mstore(0x40, add(pMem, pLastMem)) - - // Validate that all evaluations ∈ F - - checkField(calldataload(add(_pubSignals, 0))) - - checkField(calldataload(add(_pubSignals, 32))) - - checkField(calldataload(add(_pubSignals, 64))) - - - // Validate all evaluations - let isValid := checkPairing(_pA, _pB, _pC, _pubSignals, pMem) - - mstore(0, isValid) - return(0, 0x20) - } - } - } diff --git a/contracts/contracts/verifiers/dsc/Verifier_dsc_sha256_rsa_2048.sol b/contracts/contracts/verifiers/dsc/Verifier_dsc_sha256_rsa_2048.sol deleted file mode 100644 index c7215e90..00000000 --- a/contracts/contracts/verifiers/dsc/Verifier_dsc_sha256_rsa_2048.sol +++ /dev/null @@ -1,177 +0,0 @@ -// SPDX-License-Identifier: GPL-3.0 -/* - Copyright 2021 0KIMS association. - - This file is generated with [snarkJS](https://github.com/iden3/snarkjs). - - snarkJS is a free software: you can redistribute it and/or modify it - under the terms of the GNU General Public License as published by - the Free Software Foundation, either version 3 of the License, or - (at your option) any later version. - - snarkJS is distributed in the hope that it will be useful, but WITHOUT - ANY WARRANTY; without even the implied warranty of MERCHANTABILITY - or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public - License for more details. - - You should have received a copy of the GNU General Public License - along with snarkJS. If not, see . -*/ - -pragma solidity >=0.7.0 <0.9.0; - -contract Verifier_dsc_sha256_rsa_2048 { - // Scalar field size - uint256 constant r = 21888242871839275222246405745257275088548364400416034343698204186575808495617; - // Base field size - uint256 constant q = 21888242871839275222246405745257275088696311157297823662689037894645226208583; - - // Verification Key data - uint256 constant alphax = 20491192805390485299153009773594534940189261866228447918068658471970481763042; - uint256 constant alphay = 9383485363053290200918347156157836566562967994039712273449902621266178545958; - uint256 constant betax1 = 4252822878758300859123897981450591353533073413197771768651442665752259397132; - uint256 constant betax2 = 6375614351688725206403948262868962793625744043794305715222011528459656738731; - uint256 constant betay1 = 21847035105528745403288232691147584728191162732299865338377159692350059136679; - uint256 constant betay2 = 10505242626370262277552901082094356697409835680220590971873171140371331206856; - uint256 constant gammax1 = 11559732032986387107991004021392285783925812861821192530917403151452391805634; - uint256 constant gammax2 = 10857046999023057135944570762232829481370756359578518086990519993285655852781; - uint256 constant gammay1 = 4082367875863433681332203403145435568316851327593401208105741076214120093531; - uint256 constant gammay2 = 8495653923123431417604973247489272438418190587263600148770280649306958101930; - uint256 constant deltax1 = 10789699189802565503151410727523641117115314518647120572216097844248906379150; - uint256 constant deltax2 = 16666625715578834288009243693844339443049374518433194257623940944163988265395; - uint256 constant deltay1 = 5439536988044871326851634984289103110844569091340684053005795248561130271175; - uint256 constant deltay2 = 8938422785678649026868363329738732937627617012781015106661346383383684302795; - - - uint256 constant IC0x = 8663909813730969695050901606735915443858261088173146965807918849094360759038; - uint256 constant IC0y = 6516840185931395389595849929543854800519438291840271040132167678505860602093; - - uint256 constant IC1x = 14347577667782826978699222586871274911031776174228003720381494632052679830813; - uint256 constant IC1y = 18782683358856120780455017242604555883274038589186701898217258776271016998602; - - uint256 constant IC2x = 5294494141831465394490786638500885143294697619035859501642187291794277137345; - uint256 constant IC2y = 67899337919533090040558324465164899011547023027876223983477868216280040814; - - - // Memory data - uint16 constant pVk = 0; - uint16 constant pPairing = 128; - - uint16 constant pLastMem = 896; - - function verifyProof(uint[2] calldata _pA, uint[2][2] calldata _pB, uint[2] calldata _pC, uint[2] calldata _pubSignals) public view returns (bool) { - assembly { - function checkField(v) { - if iszero(lt(v, q)) { - mstore(0, 0) - return(0, 0x20) - } - } - - // G1 function to multiply a G1 value(x,y) to value in an address - function g1_mulAccC(pR, x, y, s) { - let success - let mIn := mload(0x40) - mstore(mIn, x) - mstore(add(mIn, 32), y) - mstore(add(mIn, 64), s) - - success := staticcall(sub(gas(), 2000), 7, mIn, 96, mIn, 64) - - if iszero(success) { - mstore(0, 0) - return(0, 0x20) - } - - mstore(add(mIn, 64), mload(pR)) - mstore(add(mIn, 96), mload(add(pR, 32))) - - success := staticcall(sub(gas(), 2000), 6, mIn, 128, pR, 64) - - if iszero(success) { - mstore(0, 0) - return(0, 0x20) - } - } - - function checkPairing(pA, pB, pC, pubSignals, pMem) -> isOk { - let _pPairing := add(pMem, pPairing) - let _pVk := add(pMem, pVk) - - mstore(_pVk, IC0x) - mstore(add(_pVk, 32), IC0y) - - // Compute the linear combination vk_x - - g1_mulAccC(_pVk, IC1x, IC1y, calldataload(add(pubSignals, 0))) - - g1_mulAccC(_pVk, IC2x, IC2y, calldataload(add(pubSignals, 32))) - - - // -A - mstore(_pPairing, calldataload(pA)) - mstore(add(_pPairing, 32), mod(sub(q, calldataload(add(pA, 32))), q)) - - // B - mstore(add(_pPairing, 64), calldataload(pB)) - mstore(add(_pPairing, 96), calldataload(add(pB, 32))) - mstore(add(_pPairing, 128), calldataload(add(pB, 64))) - mstore(add(_pPairing, 160), calldataload(add(pB, 96))) - - // alpha1 - mstore(add(_pPairing, 192), alphax) - mstore(add(_pPairing, 224), alphay) - - // beta2 - mstore(add(_pPairing, 256), betax1) - mstore(add(_pPairing, 288), betax2) - mstore(add(_pPairing, 320), betay1) - mstore(add(_pPairing, 352), betay2) - - // vk_x - mstore(add(_pPairing, 384), mload(add(pMem, pVk))) - mstore(add(_pPairing, 416), mload(add(pMem, add(pVk, 32)))) - - - // gamma2 - mstore(add(_pPairing, 448), gammax1) - mstore(add(_pPairing, 480), gammax2) - mstore(add(_pPairing, 512), gammay1) - mstore(add(_pPairing, 544), gammay2) - - // C - mstore(add(_pPairing, 576), calldataload(pC)) - mstore(add(_pPairing, 608), calldataload(add(pC, 32))) - - // delta2 - mstore(add(_pPairing, 640), deltax1) - mstore(add(_pPairing, 672), deltax2) - mstore(add(_pPairing, 704), deltay1) - mstore(add(_pPairing, 736), deltay2) - - - let success := staticcall(sub(gas(), 2000), 8, _pPairing, 768, _pPairing, 0x20) - - isOk := and(success, mload(_pPairing)) - } - - let pMem := mload(0x40) - mstore(0x40, add(pMem, pLastMem)) - - // Validate that all evaluations ∈ F - - checkField(calldataload(add(_pubSignals, 0))) - - checkField(calldataload(add(_pubSignals, 32))) - - checkField(calldataload(add(_pubSignals, 64))) - - - // Validate all evaluations - let isValid := checkPairing(_pA, _pB, _pC, _pubSignals, pMem) - - mstore(0, isValid) - return(0, 0x20) - } - } - } diff --git a/contracts/contracts/verifiers/dsc/Verifier_dsc_sha256_rsapss_2048.sol b/contracts/contracts/verifiers/dsc/Verifier_dsc_sha256_rsapss_2048.sol deleted file mode 100644 index 6e4ffede..00000000 --- a/contracts/contracts/verifiers/dsc/Verifier_dsc_sha256_rsapss_2048.sol +++ /dev/null @@ -1,177 +0,0 @@ -// SPDX-License-Identifier: GPL-3.0 -/* - Copyright 2021 0KIMS association. - - This file is generated with [snarkJS](https://github.com/iden3/snarkjs). - - snarkJS is a free software: you can redistribute it and/or modify it - under the terms of the GNU General Public License as published by - the Free Software Foundation, either version 3 of the License, or - (at your option) any later version. - - snarkJS is distributed in the hope that it will be useful, but WITHOUT - ANY WARRANTY; without even the implied warranty of MERCHANTABILITY - or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public - License for more details. - - You should have received a copy of the GNU General Public License - along with snarkJS. If not, see . -*/ - -pragma solidity >=0.7.0 <0.9.0; - -contract Verifier_dsc_sha256_rsapss_2048 { - // Scalar field size - uint256 constant r = 21888242871839275222246405745257275088548364400416034343698204186575808495617; - // Base field size - uint256 constant q = 21888242871839275222246405745257275088696311157297823662689037894645226208583; - - // Verification Key data - uint256 constant alphax = 20491192805390485299153009773594534940189261866228447918068658471970481763042; - uint256 constant alphay = 9383485363053290200918347156157836566562967994039712273449902621266178545958; - uint256 constant betax1 = 4252822878758300859123897981450591353533073413197771768651442665752259397132; - uint256 constant betax2 = 6375614351688725206403948262868962793625744043794305715222011528459656738731; - uint256 constant betay1 = 21847035105528745403288232691147584728191162732299865338377159692350059136679; - uint256 constant betay2 = 10505242626370262277552901082094356697409835680220590971873171140371331206856; - uint256 constant gammax1 = 11559732032986387107991004021392285783925812861821192530917403151452391805634; - uint256 constant gammax2 = 10857046999023057135944570762232829481370756359578518086990519993285655852781; - uint256 constant gammay1 = 4082367875863433681332203403145435568316851327593401208105741076214120093531; - uint256 constant gammay2 = 8495653923123431417604973247489272438418190587263600148770280649306958101930; - uint256 constant deltax1 = 18554310492392591676712582128838341835005924690711103884443707087300621489353; - uint256 constant deltax2 = 18601898599795148781556521129902163955307240481841048539045099403363208697265; - uint256 constant deltay1 = 3370744082220903501534492582354666495153084707875173458840002580755569024989; - uint256 constant deltay2 = 8964305547332510298822000047894858021807800763626576504695238395663847461595; - - - uint256 constant IC0x = 11223726382902143074656034322403878698578062273836049761923160711697238928012; - uint256 constant IC0y = 11854539887562035595667047433241240072109196025089427592003938316087287157832; - - uint256 constant IC1x = 14225430451078657905373564833774900134131710417967612864430022348567408748517; - uint256 constant IC1y = 6514408194298760325517351538109990379165223555664897893408597434102056053920; - - uint256 constant IC2x = 8300252733008244838222928481751855521950685809556613151339139674935471314924; - uint256 constant IC2y = 18943079161101428205617834160653232136488930194714498593950700495113057494753; - - - // Memory data - uint16 constant pVk = 0; - uint16 constant pPairing = 128; - - uint16 constant pLastMem = 896; - - function verifyProof(uint[2] calldata _pA, uint[2][2] calldata _pB, uint[2] calldata _pC, uint[2] calldata _pubSignals) public view returns (bool) { - assembly { - function checkField(v) { - if iszero(lt(v, q)) { - mstore(0, 0) - return(0, 0x20) - } - } - - // G1 function to multiply a G1 value(x,y) to value in an address - function g1_mulAccC(pR, x, y, s) { - let success - let mIn := mload(0x40) - mstore(mIn, x) - mstore(add(mIn, 32), y) - mstore(add(mIn, 64), s) - - success := staticcall(sub(gas(), 2000), 7, mIn, 96, mIn, 64) - - if iszero(success) { - mstore(0, 0) - return(0, 0x20) - } - - mstore(add(mIn, 64), mload(pR)) - mstore(add(mIn, 96), mload(add(pR, 32))) - - success := staticcall(sub(gas(), 2000), 6, mIn, 128, pR, 64) - - if iszero(success) { - mstore(0, 0) - return(0, 0x20) - } - } - - function checkPairing(pA, pB, pC, pubSignals, pMem) -> isOk { - let _pPairing := add(pMem, pPairing) - let _pVk := add(pMem, pVk) - - mstore(_pVk, IC0x) - mstore(add(_pVk, 32), IC0y) - - // Compute the linear combination vk_x - - g1_mulAccC(_pVk, IC1x, IC1y, calldataload(add(pubSignals, 0))) - - g1_mulAccC(_pVk, IC2x, IC2y, calldataload(add(pubSignals, 32))) - - - // -A - mstore(_pPairing, calldataload(pA)) - mstore(add(_pPairing, 32), mod(sub(q, calldataload(add(pA, 32))), q)) - - // B - mstore(add(_pPairing, 64), calldataload(pB)) - mstore(add(_pPairing, 96), calldataload(add(pB, 32))) - mstore(add(_pPairing, 128), calldataload(add(pB, 64))) - mstore(add(_pPairing, 160), calldataload(add(pB, 96))) - - // alpha1 - mstore(add(_pPairing, 192), alphax) - mstore(add(_pPairing, 224), alphay) - - // beta2 - mstore(add(_pPairing, 256), betax1) - mstore(add(_pPairing, 288), betax2) - mstore(add(_pPairing, 320), betay1) - mstore(add(_pPairing, 352), betay2) - - // vk_x - mstore(add(_pPairing, 384), mload(add(pMem, pVk))) - mstore(add(_pPairing, 416), mload(add(pMem, add(pVk, 32)))) - - - // gamma2 - mstore(add(_pPairing, 448), gammax1) - mstore(add(_pPairing, 480), gammax2) - mstore(add(_pPairing, 512), gammay1) - mstore(add(_pPairing, 544), gammay2) - - // C - mstore(add(_pPairing, 576), calldataload(pC)) - mstore(add(_pPairing, 608), calldataload(add(pC, 32))) - - // delta2 - mstore(add(_pPairing, 640), deltax1) - mstore(add(_pPairing, 672), deltax2) - mstore(add(_pPairing, 704), deltay1) - mstore(add(_pPairing, 736), deltay2) - - - let success := staticcall(sub(gas(), 2000), 8, _pPairing, 768, _pPairing, 0x20) - - isOk := and(success, mload(_pPairing)) - } - - let pMem := mload(0x40) - mstore(0x40, add(pMem, pLastMem)) - - // Validate that all evaluations ∈ F - - checkField(calldataload(add(_pubSignals, 0))) - - checkField(calldataload(add(_pubSignals, 32))) - - checkField(calldataload(add(_pubSignals, 64))) - - - // Validate all evaluations - let isValid := checkPairing(_pA, _pB, _pC, _pubSignals, pMem) - - mstore(0, isValid) - return(0, 0x20) - } - } - }