Longfellow ZK 0290cb32

Loading...
Searching...
No Matches
zk_verifier.h
1// Copyright 2025 Google LLC.
2//
3// Licensed under the Apache License, Version 2.0 (the "License");
4// you may not use this file except in compliance with the License.
5// You may obtain a copy of the License at
6//
7// http://www.apache.org/licenses/LICENSE-2.0
8//
9// Unless required by applicable law or agreed to in writing, software
10// distributed under the License is distributed on an "AS IS" BASIS,
11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12// See the License for the specific language governing permissions and
13// limitations under the License.
14
15#ifndef PRIVACY_PROOFS_ZK_LIB_ZK_ZK_VERIFIER_H_
16#define PRIVACY_PROOFS_ZK_LIB_ZK_ZK_VERIFIER_H_
17
18#include <stddef.h>
19
20#include <vector>
21
22#include "arrays/dense.h"
23#include "ligero/ligero_param.h"
24#include "ligero/ligero_verifier.h"
25#include "random/transcript.h"
26#include "sumcheck/circuit.h"
27#include "util/log.h"
28#include "zk/zk_common.h"
29#include "zk/zk_proof.h"
30
31 namespace proofs {
32// ZK Verifier
33//
34// Verifies a zk proof. See note in the prover for the design.
35// To verify a proof, instantiate the class, then call recv_commitment with
36// the commitment, and finally call verify. It is possible to receive several
37// commitments, or run other protocols between the recv_commitment and verify
38// calls. This allows composing two proofs in parallel.
39// To support this, the interface to both accepts a raw Transcript.
40 template <class Field, class RSFactory>
41 class ZkVerifier {
42 using Elt = typename Field::Elt;
43
44 public:
45 explicit ZkVerifier(const Circuit<Field>& c, const RSFactory& rsf,
46 size_t rate, size_t nreq, const Field& F)
47 : circ_(c),
48 n_witness_(c.ninputs - c.npub_in),
49 param_(n_witness_ + ZkCommon<Field>::pad_size(c), c.nl, rate, nreq),
50 lqc_(c.nl),
51 rsf_(rsf),
52 f_(F) {
53 ZkCommon<Field>::setup_lqc(c, lqc_, n_witness_);
54 }
55
56 explicit ZkVerifier(const Circuit<Field>& c, const RSFactory& rsf,
57 size_t rate, size_t nreq, size_t block_enc,
58 const Field& F)
59 : circ_(c),
60 n_witness_(c.ninputs - c.npub_in),
61 param_(n_witness_ + ZkCommon<Field>::pad_size(c), c.nl, rate, nreq,
62 block_enc),
63 lqc_(c.nl),
64 rsf_(rsf),
65 f_(F) {
66 ZkCommon<Field>::setup_lqc(c, lqc_, n_witness_);
67 }
68
69 void recv_commitment(const ZkProof<Field>& zk, Transcript& t) const {
70 log(INFO, "verifier: recv commit");
71 LigeroVerifier<Field, RSFactory>::receive_commitment(zk.com, t);
72 }
73
74 // Verifies the proof.
75 bool verify(const ZkProof<Field>& zk, const Dense<Field>& pub,
76 Transcript& tv) const {
77 log(INFO, "verifier: verify");
78
79 ZkCommon<Field>::initialize_sumcheck_fiat_shamir(tv, circ_, pub, f_);
80
81 // Derive constraints on the witness.
82 using Llc = LigeroLinearConstraint<Field>;
83 std::vector<Llc> A;
84 std::vector<Elt> b;
85 const LigeroHash hash_of_A{0xde, 0xad, 0xbe, 0xef};
86 size_t cn = ZkCommon<Field>::verifier_constraints(circ_, pub, zk.proof,
87 /*aux=*/nullptr, A, b, tv,
88 n_witness_, f_);
89
90 const char* why = "";
91 bool ok = LigeroVerifier<Field, RSFactory>::verify(
92 &why, param_, zk.com, zk.com_proof, tv, cn, A.size(), &A[0], hash_of_A,
93 &b[0], &lqc_[0], rsf_, f_);
94
95 log(INFO, "verify done: %s", why);
96 return ok;
97 }
98
99 private:
100 const Circuit<Field>& circ_;
101 const size_t n_witness_;
102 const LigeroParam<Field> param_;
103 std::vector<LigeroQuadraticConstraint> lqc_;
104 const RSFactory& rsf_;
105 const Field& f_;
106};
107} // namespace proofs
108
109#endif // PRIVACY_PROOFS_ZK_LIB_ZK_ZK_VERIFIER_H_
proofs::Dense
Definition dense.h:37
proofs::Transcript
Definition transcript.h:70
proofs::Circuit
Definition circuit.h:45
proofs::GF2_128::Elt
Definition gf2_128.h:63
proofs::LigeroHash
Definition ligero_param.h:442
proofs::LigeroLinearConstraint
Definition ligero_param.h:360
proofs::LigeroParam
Definition ligero_param.h:117
proofs::ZkProof
Definition zk_proof.h:47