Error when trying to compile circuit and create witness

[beegmon]

I am loosely following the eddsa tutorial and attempting to compile my circuit and create a new witness

I am getting the following error

cannot use ecc.BN254 (constant 1 of type ecc.ID) as *big.Int value in argument to frontend.Compile
cannot use ecc.BN254 (constant 1 of type ecc.ID) as *big.Int value in argument to frontend.NewWitness

I am doing the following in code where ecc is importing from gnark-crypto/ecc

CompiledCircuit, err := frontend.Compile(ecc.BN254, r1cs.NewBuilder, &circuit)
PrivateWitness, _ := frontend.NewWitness(&Assignment, ecc.BN254)

[gbotrel]

hi -- we need to update the doc / tutorial, use

ecc.BN254.ScalarField()

for first parameter.

[beegmon]

Awesome!

One more question if I may.

I am having this error when attempting to use one of the circuit Variables in the following example

Where computedPk is a ecdsa.PublicKey

computedPk.A.ScalarMultiplication(&g, circuit.Sk)

And I am getting this error

cannot use circuit.Sk (variable of type frontend.Variable) as *big.Int value in argument to computedPk.A.ScalarMultiplication: need type assertion

I am unsure how to convert the circuit.Sk which is a frontend.Variable type to a *big.Int so I can use it for the above operation in the circuit.

[ivokub]

It is difficult to see from only error messages. Can you post a minimal example which I could compile and run? It looks like that instead of using frontend.API for in-circuit operations you are using out-circuit operations, but I cannot be completely sure.

[beegmon]

Abosolutely and my appoligies for the extra questions I am still trying to wrap my head around all of this from a gnark, zk, and golang standpoint.

Problem Statement: For a given BLS12-381 Secret Key, which is generated by (https://github.com/ethereum/staking-deposit-cli) the Ethereuem Beacon Chain toolset; compute the public key and compare it to a given PublicKey.

Purpose: I want to be able to prove of ownership of a Beacon chain validator public key which is a BLS12-381 public key. I also want to ensure the computation done can't be modified by the user. Thus the reason for using gnark, so the proof provided means they didn't just modify the code and tell me they did the work to check to see if their SK resulted in the PK they are telling me they own.

Approaches:

1. I could verfiy a signature against a public key but at present gnark /std/signature/ecdsa does not have support SHA256 hash to curve function. it also doesn't appear to support the BLS12-381 curve but I very well could be wrong about that.

2. I could take a given Secret Key and compute the Public Key from the Secret Key and compare it to given Public key. This is do-able with gnark-crypto now and is a simple Pk = Sk * G where G is the G1 generator for BLS12-381 I think.

I am attempting to implement a very basic version of (2)

My first attempt at (2) with gnark to just get things working and I have made more progress I think since my last message.

package main

import (
        "github.com/consensys/gnark/frontend"
        "github.com/consensys/gnark/frontend/cs/r1cs"
        "github.com/consensys/gnark/backend/groth16"
        "github.com/consensys/gnark-crypto/ecc/bls12-381/ecdsa"
        "github.com/consensys/gnark-crypto/ecc/bls12-381"
        "github.com/consensys/gnark-crypto/ecc"
        "math/big"
        "fmt"
)

type Circuit struct {
        Pk big.Int `gnark:",public"` //Public Validator Key
        Sk big.Int `gnark:",private"` //Private Validator Key
}

func (circuit *Circuit) Define(api frontend.API) error {

        computedPk := new(ecdsa.PublicKey)
        _, _, g, _ := bls12381.Generators()

        Sk := &circuit.Sk
        Pk := &circuit.Pk

        computedPk.A.ScalarMultiplication(&g, Sk)

        computedPkBigInt := new(big.Int)
        computedPkBigInt.SetBytes(computedPk.Bytes())

        api.AssertIsEqual(Pk, computedPkBigInt)

        return nil
}

func main() {
        InputPk := "a9f8927a6148e18f2daf0192262c9b86d0dff76ac4e62a7920911dc85d5f34f3ad10d9794f2ce0fe414afafac75d9e95"
        InputSk := "<REDACTED>"

        InputPublicKeyBigInt := new(big.Int)
        InputPublicKeyBigInt.SetString(InputPk, 16)

        InputSecretKeyBigInt := new(big.Int)
        InputSecretKeyBigInt.SetString(InputSk, 16)


        //compile the circuit
        var circuit Circuit
        CompiledCircuit, err := frontend.Compile(ecc.BLS12_381.ScalarField(), r1cs.NewBuilder, &circuit)
        if err != nil {
                fmt.Println(err)
        }

        fmt.Println(CompiledCircuit)

        // Generate provingKey, and verifyKey
        ProvingKey, VerifyKey, err := groth16.Setup(CompiledCircuit)

        //Witeness definition
        var Assignment Circuit
        Assignment.Pk = *InputPublicKeyBigInt
        Assignment.Sk = *InputSecretKeyBigInt

        PrivateWitness, _ := frontend.NewWitness(&Assignment, ecc.BLS12_381.ScalarField())
        PublicWitness, _ := PrivateWitness.Public()

        fmt.Println(PublicWitness)

        // groth16: Prove and Verify
        Proof, _ := groth16.Prove(CompiledCircuit, ProvingKey, PrivateWitness)
        groth16.Verify(Proof, VerifyKey, PublicWitness)
}

This compiles without errors but when running I get this:

17:12:02 INF compiling circuit
17:12:02 INF parsed circuit inputs nbPublic=0 nbSecret=0
17:12:02 INF building constraint builder nbConstraints=1
17:12:02 WRN circuit has unconstrained inputs
invalid constraint system: no input defined
<nil>
panic: unrecognized R1CS curve type

goroutine 1 [running]:
github.com/consensys/gnark/backend/groth16.Setup({0x0?, 0x0?})
        /home/bgraham/go/pkg/mod/github.com/consensys/gnark@v0.8.0/backend/groth16/groth16.go:286 +0x4a5
main.main()
        /home/bgraham/code/gnark-stuff/testSk.go:58 +0x1a8

Some interesting things that don't make sense to me

INF parsed circuit inputs nbPublic=0 nbSecret=0

Per my struct I have things tagged as public and private. If I change these to frontend.Variables the public and private inputs are reported correctly but I run into the issue that that my ScalarMultiply needs a *big.Int type, and AssertIsEqual does as well.

I know I am thinking about this backwards/wrongly so I am hoping to have some light shed on why my mental model is wrong. In my mind, I want to feed inputs into the circuit, were the circuit does the critical computation to derive Pk from Sk and asserts that ComputedPk matches the inputed Pk. This removes the need to trust user input and worry about the user modifying code to "cheat".

I did sort of riff off of this -- #59 -- which is an older issue which wont work out of the box due to the changes in gnark and gnark-crypto it seems but from my untrained eye seems close to what I am attempting to do.

Much thanks for any input and guidance.

[ivokub]

Oh, I see your example and understand now.

So, when writing a SNARK circuit, we have to think slightly differently when performing computation in-circuit. All the operations in-circuit are done by variables of type frontend.Variable. If there are concrete numeric types (e.g. *big.Int, uint, fr.Element etc.), then in essence they are constants. So in your example in the circuit definition:

Pk big.Int `gnark:",public"` //Public Validator Key
Sk big.Int `gnark:",private"` //Private Validator Key

are constants and not variables. And the constants are always public. That is why you also get the INF parsed circuit inputs nbPublic=0 nbSecret=0 message as you do not have any fields of type frontend.Variable in your circuit definition.

Now, when working with frontend.Variable type, you can not usually call out-circuit methods (e.g. methods to compute scalar multiplication in gnark-crypto) directly, but there has to be an implementation in-circuit. This is for several reasons, but mainly because that with each computation step we have to record the step in something called constraint system. A constraint system stores the computations in suitable way for the proving backend (e.g. Groth16, PLONK etc.). And porting out-circuit implementations to in-circuit isn't straightforward, as we work on a different field (scalar field of the elliptic curve vs uint64 etc.).

That said, we right now do not have in-circuit implementation of SHA2-256 and BLS12-381 (G1 scalar multiplication, in particular). They are in shortlist to be implemented though, but I really cannot give any schedules or deadlines. I recommend to hang around and keep an eye on the releases, meanwhile trying implementing the same circuit with BN254 and Keccak for example (just to get used to the concepts).

[beegmon]

Thank you SOO much for the pointers an feedback!

I will keep my eye out for support and in the mean time keep playing.