Integrate Zexe backend and new curves

[Schaeff]

Prerequisites:

• curve-generic zokrates
• curve pragma statements

Let's sync on this issue!

Ping @iAmMichaelConnor @dark64

[iAmMichaelConnor]

@Westlad @ChaitanyaKonda

[dark64]

There is a PR currently in progress that will ease the integration of zexe backend #598. Would love to hear from you about the state of your work on this issue so we don't change something you might rely on atm. @Westlad @ChaitanyaKonda

[ChaitanyaKonda]

@dark64 These changes in #598 look good to me. I'm adding BLS12_377 and BW6_761 curves by using a zexe backend. These two curves will use Zexe backend for GM17 scheme. I will pull your changes and keep it consistent for these curves too

[Westlad]

@dark64 This looks great and doesn't cause us any problems. We're a quite an early stage and we've only been trying to understand the ZoKrates code and wondering about the best way to add Zexe-derived curves to ZoKrates.

[ChaitanyaKonda]

@dark64 Your changes seem to make the backend generic. That's very useful. I was working on similar changes by renaming the bn128 file into curve. This seems like an even cleaner way to do it.

There might be some additional changes required in the contract template in line with these changes, such as

• editing uint256 snark_scalar_field = 21888242871839275222246405745257275088548364400416034343698204186575808495617; inside verify function in CONTRACT_TEMPLATE. Currently this points to BN128 modulus. This will need to change with curve.
• Also the templates SOLIDITY_G2_ADDITION_LIB, SOLIDITY_PAIRING_LIB, SOLIDITY_PAIRING_LIB_V2 might change for a curve whose modulus is more than 256 bit. BW6_761 is one of them. These could be defined under different variable names such as SOLIDITY_G2__761_ADDITION_LIB etc in solidity.rs and called with a match statement based on curve inside gm17.rs

Please let me know what you think?

[Schaeff]

Thanks for this @ChaitanyaKonda! For now only the BN128 curve is available on Ethereum so I feel it makes sense to treat export-verifier separately and not make the Solidity contract generic.

[ChaitanyaKonda]

@Schaeff Very true! Helps to understand the thinking behind this. export-verifier could be generalised at a later stage. Good thing that ZoKrates now has verify cli command.

[Schaeff]

Yes, typically the dimension we would add is something like verification environments, each of which supports a set of curves. But, you're right, this can wait.