How to calculate the hash of vk in the circuit？

[doubiliu]

I am writing a multi-layer recursive circuit, and I need to ensure that VK is not replaced during the recursive process. How do I calculate the hash of the VK （public input） in circuit?

@ivokub

[ivokub]

There are several options:

• use a fixed verification key if it is already known ahead of time. In this case this can be embedded in the circuits themselves. In addition to ensuring that it is not replace it also gives some performance improvement as gnark circuit compiler can optimize for constant verification key. For this, you can use the https://pkg.go.dev/github.com/consensys/gnark@v0.14.0/std/recursion/groth16#ValueOfVerifyingKeyFixed or look at a example in tests https://github.com/Consensys/gnark/blob/v0.14.0/std/recursion/groth16/verifier_test.go#L307-L329
• Lets say you have 2-layered circuit. Then you can provide the verification key to the inner circuit from the outer circuit

In principle you can also provide hash of the verification key as public input to the inner circuit and then the key itself as private input. Although we don't have currently natively implemented hashing between different fields (in case you're using field emulation). We have some helper utilities https://pkg.go.dev/github.com/consensys/gnark@v0.14.0/std/recursion, I'd suggest looking at https://github.com/Consensys/gnark/blob/v0.14.0/std/recursion/plonk/verifier_test.go#L484-L518 to see how it can be used.

[doubiliu]

There are several options:

• use a fixed verification key if it is already known ahead of time. In this case this can be embedded in the circuits themselves. In addition to ensuring that it is not replace it also gives some performance improvement as gnark circuit compiler can optimize for constant verification key. For this, you can use the https://pkg.go.dev/github.com/consensys/gnark@v0.14.0/std/recursion/groth16#ValueOfVerifyingKeyFixed or look at a example in tests https://github.com/Consensys/gnark/blob/v0.14.0/std/recursion/groth16/verifier_test.go#L307-L329
• Lets say you have 2-layered circuit. Then you can provide the verification key to the inner circuit from the outer circuit

In principle you can also provide hash of the verification key as public input to the inner circuit and then the key itself as private input. Although we don't have currently natively implemented hashing between different fields (in case you're using field emulation). We have some helper utilities https://pkg.go.dev/github.com/consensys/gnark@v0.14.0/std/recursion, I'd suggest looking at https://github.com/Consensys/gnark/blob/v0.14.0/std/recursion/plonk/verifier_test.go#L484-L518 to see how it can be used.

Thanks for the reply. The way I currently use it is to use vk hash as public input and vk as private input. I can't solidify the inner circuit vk into the outer circuit because I need the circuit to recurse on itself, so I can't get the vk at the beginning. I implemented a vk serializer in the circuit to calculate the corresponding hash and compare it with the incoming vk. But the problem I currently encounter is: ValueOfVerifyingKeysw_bn254.G1Affine, sw_bn254.G2Affine, sw_bn254.GTEl. This is the field inconsistency between the packaged vk and the external original groth16_bn254.VerifyingKey. If I implement another serializer externally and the serialization result is a front.varible array, how can I restore it to a byte array?

[ivokub]

I'll need to check for a bit. I'll come back next week

[doubiliu]

RecursiveCircuit.txt

[ivokub]

I refactored a bit:

package dkim

import (
	"github.com/consensys/gnark/frontend"
	"github.com/consensys/gnark/std/algebra/emulated/sw_bn254"
	"github.com/consensys/gnark/std/hash/sha2"
	"github.com/consensys/gnark/std/math/emulated"
	"github.com/consensys/gnark/std/math/uints"
	stdgroth16 "github.com/consensys/gnark/std/recursion/groth16"
)

type RecursiveCircuit struct {
	VerifyingKey stdgroth16.VerifyingKey[sw_bn254.G1Affine, sw_bn254.G2Affine, sw_bn254.GTEl]
	Proof        stdgroth16.Proof[sw_bn254.G1Affine, sw_bn254.G2Affine]
	InnerWitness InnerWitness

	CurrentDepth frontend.Variable `gnark:",public"`
	VKHash       [32]uints.U8      `gnark:",public"`
	BaseVKHash   [32]uints.U8      `gnark:"_"`
}

type InnerWitness struct {
	Depth  frontend.Variable
	VKHash [32]uints.U8
}

func (c *RecursiveCircuit) Define(api frontend.API) error {
	binaryApi, err := uints.New[uints.U32](api)
	if err != nil {
		return err
	}
	emulatedApi, err := emulated.NewField[sw_bn254.ScalarField](api)
	if err != nil {
		return err
	}
	api.AssertIsLessOrEqual(frontend.Variable(0), c.CurrentDepth)
	nextDepth := api.Sub(c.CurrentDepth, frontend.Variable(1))
	isBaseCase := api.IsZero(api.Cmp(nextDepth, frontend.Variable(0)))
	actualVKHash := c.computeVKHash(api, c.VerifyingKey)
	effectiveVKHash := make([]uints.U8, len(actualVKHash))
	for i := 0; i < len(actualVKHash); i++ {
		effectiveVKHash[i] = binaryApi.Select(isBaseCase, c.BaseVKHash[i], c.VKHash[i])
	}
	for i := 0; i < len(actualVKHash); i++ {
		api.AssertIsEqual(effectiveVKHash[i], actualVKHash[i])
	}
	verifier, err := stdgroth16.NewVerifier[sw_bn254.ScalarField, sw_bn254.G1Affine, sw_bn254.G2Affine, sw_bn254.GTEl](api)
	if err != nil {
		return err
	}
	innerPublicInputs := make([]emulated.Element[sw_bn254.ScalarField], len(c.InnerWitness.VKHash)+1)
	innerPublicInputs[0] = *emulatedApi.NewElement(c.InnerWitness.Depth)
	for i := 0; i < len(effectiveVKHash); i++ {
		innerPublicInputs[i+1] = *emulatedApi.NewElement(binaryApi.Value(effectiveVKHash[i]))
	}
	err = verifier.AssertProof(c.VerifyingKey, c.Proof, stdgroth16.Witness[sw_bn254.ScalarField]{Public: innerPublicInputs}, stdgroth16.WithCompleteArithmetic())
	if err != nil {
		panic(err)
	}
	return nil
}

func (c *RecursiveCircuit) computeVKHash(api frontend.API, vk stdgroth16.VerifyingKey[sw_bn254.G1Affine, sw_bn254.G2Affine, sw_bn254.GTEl]) []uints.U8 {
	serializer, err := NewVKSerializer(api)
	if err != nil {
		panic(err)
	}
	serializeVK := serializer.SerializeVK(vk)
	hasher, err := sha2.New(api)
	if err != nil {
		panic(err)
	}
	hasher.Write(serializeVK[:])
	sumHash := hasher.Sum()

	// api.Println doesn't work with array of uints.U8
	// api.Println("VKHash:")
	// api.Println(sumHash)
	return sumHash
}

type VKSerializer struct {
	api   frontend.API
	field *emulated.Field[sw_bn254.BaseField]
}

func NewVKSerializer(api frontend.API) (*VKSerializer, error) {
	f, err := emulated.NewField[sw_bn254.BaseField](api)
	if err != nil {
		return nil, err
	}
	return &VKSerializer{api: api, field: f}, nil
}

func (s *VKSerializer) SerializeVK(vk stdgroth16.VerifyingKey[sw_bn254.G1Affine, sw_bn254.G2Affine, sw_bn254.GTEl]) []uints.U8 {

	var allBits []frontend.Variable
	allBits = append(allBits, s.gtToBits(vk.E)...)
	for _, p := range vk.G1.K {
		allBits = append(allBits, s.g1ToBits(p)...)
	}
	allBits = append(allBits, s.g2ToBits(vk.G2.GammaNeg)...)
	allBits = append(allBits, s.g2ToBits(vk.G2.DeltaNeg)...)
	for _, pvk := range vk.CommitmentKeys {
		allBits = append(allBits, s.g2ToBits(pvk.G)...)
		allBits = append(allBits, s.g2ToBits(pvk.GSigmaNeg)...)
	}
	for _, outer := range vk.PublicAndCommitmentCommitted {
		for _, val := range outer {
			valVar := frontend.Variable(val)
			bits := s.api.ToBinary(valVar, 32)
			allBits = append(allBits, bits...)
		}
	}
	return s.bitsToBytes(allBits)
}

func (s *VKSerializer) g1ToBits(p sw_bn254.G1Affine) []frontend.Variable {
	bitsX := s.field.ToBits(&p.X)
	bitsY := s.field.ToBits(&p.Y)
	return append(bitsX, bitsY...)
}

func (s *VKSerializer) g2ToBits(p sw_bn254.G2Affine) []frontend.Variable {
	res := append(s.field.ToBits(&p.P.X.A0), s.field.ToBits(&p.P.X.A1)...)
	res = append(res, s.field.ToBits(&p.P.Y.A0)...)
	res = append(res, s.field.ToBits(&p.P.Y.A1)...)
	return res
}

func (s *VKSerializer) gtToBits(e sw_bn254.GTEl) []frontend.Variable {
	res := append(s.field.ToBits(&e.A0), s.field.ToBits(&e.A1)...)
	res = append(res, s.field.ToBits(&e.A2)...)
	res = append(res, s.field.ToBits(&e.A3)...)
	res = append(res, s.field.ToBits(&e.A4)...)
	res = append(res, s.field.ToBits(&e.A5)...)
	res = append(res, s.field.ToBits(&e.A6)...)
	res = append(res, s.field.ToBits(&e.A7)...)
	res = append(res, s.field.ToBits(&e.A8)...)
	res = append(res, s.field.ToBits(&e.A9)...)
	res = append(res, s.field.ToBits(&e.A10)...)
	res = append(res, s.field.ToBits(&e.A11)...)
	return res
}

func (s *VKSerializer) bitsToBytes(bits []frontend.Variable) []uints.U8 {
	u8Api, err := uints.New[uints.U32](s.api)
	if err != nil {
		panic(err)
	}
	nBytes := len(bits) / 8
	bytes := make([]uints.U8, nBytes)

	for i := 0; i < nBytes; i++ {
		res := frontend.Variable(0)
		for j := 0; j < 8; j++ {
			res = s.api.Add(res, s.api.Mul(bits[i*8+j], 1<<j))
		}
		bytes[i] = u8Api.ByteValueOf(res)
	}
	return bytes
}

See that the witness is in the scalar field of the curve (i.e. BN254Fr == sw_bn254.ScalarField). Perhaps you can also add a some test which fails?

[weijiguo]

You may also checkout our implementation here: https://github.com/lightec-xyz/common/blob/master/utils/fingerprint.go

If you have layers of unspecified numbers of recursion, you might find chainark useful: https://github.com/lightec-xyz/chainark. We used chainark to prove a chained relationship (such as a chain of blocks).