Longfellow ZK 0290cb32

Loading...
Searching...
No Matches
zk_testing.h
1// Copyright 2025 Google LLC.
2//
3// Licensed under the Apache License, Version 2.0 (the "License");
4// you may not use this file except in compliance with the License.
5// You may obtain a copy of the License at
6//
7// http://www.apache.org/licenses/LICENSE-2.0
8//
9// Unless required by applicable law or agreed to in writing, software
10// distributed under the License is distributed on an "AS IS" BASIS,
11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12// See the License for the specific language governing permissions and
13// limitations under the License.
14
15#ifndef PRIVACY_PROOFS_ZK_LIB_ZK_ZK_TESTING_H_
16#define PRIVACY_PROOFS_ZK_LIB_ZK_ZK_TESTING_H_
17
18#include <cstddef>
19#include <cstdint>
20#include <vector>
21
22#include "algebra/convolution.h"
23#include "algebra/fp2.h"
24#include "algebra/reed_solomon.h"
25#include "arrays/dense.h"
26#include "random/secure_random_engine.h"
27#include "random/transcript.h"
28#include "sumcheck/circuit.h"
29#include "util/log.h"
30#include "util/readbuffer.h"
31#include "zk/zk_proof.h"
32#include "zk/zk_prover.h"
33#include "zk/zk_verifier.h"
34#include "gtest/gtest.h"
35
36 namespace proofs {
37
38 constexpr size_t kLigeroRate = 4;
39 constexpr size_t kLigeroNreq = 189;
40 constexpr size_t kVersion = 4;
41
42// Runs a zk prover and verifier for a field that requires a field extension
43// to perform the commitment.
44 template <class Field>
45 void run2_test_zk(const Circuit<Field>& circuit, Dense<Field>& W,
46 const Dense<Field>& pub, const Field& base,
47 const typename Field::Elt& root_x,
48 const typename Field::Elt& root_y, size_t root_order) {
49 // Build the relevant algebra objects.
50 using Field2 = Fp2<Field>;
51 using Elt2 = typename Field2::Elt;
52 using FftExtConvolutionFactory = FFTExtConvolutionFactory<Field, Field2>;
53 using RSFactory = ReedSolomonFactory<Field, FftExtConvolutionFactory>;
54
55 const Field2 base_2(base);
56 const Elt2 omega{root_x, root_y};
57 const FftExtConvolutionFactory fft(base, base_2, omega, root_order);
58 const RSFactory rsf(fft, base);
59
60 ZkProof<Field> zkpr(circuit, kLigeroRate, kLigeroNreq);
61
62 Transcript tp((uint8_t*)"zk_test", 7, kVersion);
63 SecureRandomEngine rng;
64 ZkProver<Field, RSFactory> prover(circuit, base, rsf);
65 prover.commit(zkpr, W, tp, rng);
66 EXPECT_TRUE(prover.prove(zkpr, W, tp));
67 log(INFO, "ZK Prover done");
68
69 std::vector<uint8_t> zbuf;
70 zkpr.write(zbuf, base);
71 log(INFO, "zkp len: %zu bytes", zbuf.size());
72
73 // ======= run verifier =============
74 // Re-parse the proof to simulate a different client.
75 ZkProof<Field> zkpv(circuit, kLigeroRate, kLigeroNreq);
76 ReadBuffer rb(zbuf);
77 EXPECT_TRUE(zkpv.read(rb, base));
78
79 ZkVerifier<Field, RSFactory> verifier(circuit, rsf, kLigeroRate, kLigeroNreq,
80 base);
81 Transcript tv((uint8_t*)"zk_test", 7, kVersion);
82 verifier.recv_commitment(zkpv, tv);
83 EXPECT_TRUE(verifier.verify(zkpv, pub, tv));
84 log(INFO, "ZK Verify done");
85}
86
87 template <class Field>
88 void run_failing_test_zk2(const Circuit<Field>& circuit, Dense<Field>& W,
89 const Dense<Field>& pub, const Field& base,
90 const typename Field::Elt& root_x,
91 const typename Field::Elt& root_y,
92 size_t root_order) {
93 // Build the relevant algebra objects.
94 using Field2 = Fp2<Field>;
95 using Elt2 = typename Field2::Elt;
96 using FftExtConvolutionFactory = FFTExtConvolutionFactory<Field, Field2>;
97 using RSFactory = ReedSolomonFactory<Field, FftExtConvolutionFactory>;
98
99 const Field2 base_2(base);
100 const Elt2 omega{root_x, root_y};
101 const FftExtConvolutionFactory fft(base, base_2, omega, root_order);
102 const RSFactory rsf(fft, base);
103
104 ZkProof<Field> zkpr(circuit, kLigeroRate, kLigeroNreq);
105
106 Transcript tp((uint8_t*)"zk_test", 7, kVersion);
107 SecureRandomEngine rng;
108 ZkProver<Field, RSFactory> prover(circuit, base, rsf);
109 prover.commit(zkpr, W, tp, rng);
110 bool p_ok = prover.prove(zkpr, W, tp);
111 EXPECT_FALSE(p_ok);
112}
113
114// Runs a zk prover and verifier for a field that has a suitable root of unity.
115 template <class Field>
116 void run_test_zk(const Circuit<Field>& circuit, Dense<Field>& W,
117 const Dense<Field>& pub, const typename Field::Elt& omega,
118 uint64_t omega_order, const Field& F) {
119 using FftConvolutionFactory = FFTConvolutionFactory<Field>;
120
121 FftConvolutionFactory fft(F, omega, omega_order);
122 using RSFactory = ReedSolomonFactory<Field, FftConvolutionFactory>;
123 const RSFactory rsf(fft, F);
124
125 ZkProof<Field> zkpr(circuit, kLigeroRate, kLigeroNreq);
126
127 Transcript tp((uint8_t*)"zk_test", 7, kVersion);
128 SecureRandomEngine rng;
129 ZkProver<Field, RSFactory> prover(circuit, F, rsf);
130 prover.commit(zkpr, W, tp, rng);
131 EXPECT_TRUE(prover.prove(zkpr, W, tp));
132
133 log(INFO, "ZK Prover done");
134
135 std::vector<uint8_t> zbuf;
136 zkpr.write(zbuf, F);
137 log(INFO, "zkp len: %zu bytes", zbuf.size());
138
139 // ======= zk verifier =============
140 // Re-parse the proof to simulate a different client.
141 ZkProof<Field> zkpv(circuit, kLigeroRate, kLigeroNreq);
142 ReadBuffer rb(zbuf);
143 EXPECT_TRUE(zkpv.read(rb, F));
144
145 ZkVerifier<Field, RSFactory> verifier(circuit, rsf, kLigeroRate, kLigeroNreq,
146 F);
147 Transcript tv((uint8_t*)"zk_test", 7, kVersion);
148 verifier.recv_commitment(zkpv, tv);
149 EXPECT_TRUE(verifier.verify(zkpv, pub, tv));
150}
151
152} // namespace proofs
153
154#endif // PRIVACY_PROOFS_ZK_LIB_ZK_ZK_TESTING_H_
proofs::Dense
Definition dense.h:37
proofs::FFTConvolutionFactory
Definition convolution.h:109
proofs::FFTExtConvolutionFactory
Definition convolution.h:195
proofs::Fp2
Definition fp2.h:34
proofs::ReadBuffer
Definition readbuffer.h:26
proofs::ReedSolomonFactory
Definition reed_solomon.h:133
proofs::SecureRandomEngine
Definition secure_random_engine.h:29
proofs::Transcript
Definition transcript.h:70
proofs::ZkProver
Definition zk_prover.h:53
proofs::ZkVerifier
Definition zk_verifier.h:41
proofs::Circuit
Definition circuit.h:45
proofs::GF2_128::Elt
Definition gf2_128.h:63
proofs::ZkProof
Definition zk_proof.h:47