Custom Noir Circuits for Input Validation

[package]
name = "binary_input"
type = "bin"
 
[dependencies]
interfold_lib = { git = "https://github.com/theinterfold/interfold", tag = "v0.18.0", directory = "circuits/lib" }

use interfold_lib::configs::default::threshold::{
    L, N, Q_MOD_T_CENTERED, USER_DATA_ENCRYPTION_BIT_CT, USER_DATA_ENCRYPTION_BIT_K,
};
use interfold_lib::math::{
    commitments::{
        compute_ciphertext_commitment, compute_single_polynomial_commitment,
        DS_USER_DATA_ENCRYPTION_COMMITMENT,
    },
    polynomial::Polynomial,
};

/// Proves that a ciphertext encrypts 0 or 1.
///
/// Returns the ciphertext commitment and the plaintext commitment. The fold circuit compares both
/// values with the outputs of the user_data_encryption proof.
fn main(
    ct0is: [Polynomial<N>; L],
    ct1is: [Polynomial<N>; L],
    k1: Polynomial<N>,
) -> pub (Field, Field) {
    let ct_commitment =
        compute_ciphertext_commitment::<N, L, USER_DATA_ENCRYPTION_BIT_CT>(ct0is, ct1is);
    let k1_commitment = compute_single_polynomial_commitment::<N, USER_DATA_ENCRYPTION_BIT_K>(
        k1,
        DS_USER_DATA_ENCRYPTION_COMMITMENT,
    );

    // `k1` holds the message coefficients in descending order. `encryptNumber` writes the value
    // into message coefficient 0, which is `k1.coefficients[N - 1]`. All other coefficients are 0.
    for i in 0..N - 1 {
        assert(k1.coefficients[i] == 0);
    }

    // A message bit of 1 appears in `k1` as `Q_MOD_T_CENTERED`. A bit of 0 appears as 0.
    let value = k1.coefficients[N - 1];
    assert(value * (Q_MOD_T_CENTERED - value) == 0);

    (ct_commitment, k1_commitment)
}

cd circuits/binary_input && nargo check

[package]
name = "binary_input_fold"
type = "bin"
 
[dependencies]
interfold_lib = { git = "https://github.com/theinterfold/interfold", tag = "v0.18.0", directory = "circuits/lib" }
bb_proof_verification = { git = "https://github.com/AztecProtocol/aztec-packages/", tag = "v5.1.0", directory = "barretenberg/noir/bb_proof_verification" }

use bb_proof_verification::{UltraHonkProof, UltraHonkVerificationKey, verify_honk_proof_non_zk};
use interfold_lib::math::commitments::compute_vk_hash;

/// The ordered SAFE hash of the four canonical inner verification-key hashes.
pub global EXPECTED_KEY_HASH: Field = 0;

fn main(
    // The user_data_encryption proof. Its public inputs are
    // [ct0_key_hash, ct1_key_hash, pk_commitment, ct_commitment, k1_commitment].
    user_data_encryption_verification_key: UltraHonkVerificationKey,
    user_data_encryption_proof: UltraHonkProof,
    user_data_encryption_public_inputs: [Field; 5],
    user_data_encryption_key_hash: Field,
    // The binary_input proof. Its public inputs are [ct_commitment, k1_commitment].
    binary_input_verification_key: UltraHonkVerificationKey,
    binary_input_proof: UltraHonkProof,
    binary_input_key_hash: Field,
    ct_commitment: pub Field,
    k1_commitment: Field,
) -> pub Field {
    verify_honk_proof_non_zk(
        user_data_encryption_verification_key,
        user_data_encryption_proof,
        user_data_encryption_public_inputs,
        user_data_encryption_key_hash,
    );
    verify_honk_proof_non_zk(
        binary_input_verification_key,
        binary_input_proof,
        [ct_commitment, k1_commitment],
        binary_input_key_hash,
    );

    // Both proofs must describe the same ciphertext and the same plaintext.
    assert(ct_commitment == user_data_encryption_public_inputs[3]);
    assert(k1_commitment == user_data_encryption_public_inputs[4]);

    // Pin the four inner circuits. Without this check, a prover can supply any circuit.
    let vk_hashes = [
        user_data_encryption_key_hash,
        binary_input_key_hash,
        user_data_encryption_public_inputs[0],
        user_data_encryption_public_inputs[1],
    ]
        .as_vector();
    assert(compute_vk_hash(vk_hashes) == EXPECTED_KEY_HASH);

    // The committee public key commitment. The E3 program compares it with e3.committeePublicKey.
    user_data_encryption_public_inputs[2]
}

cd <interfold>/circuits/bin/threshold
(cd user_data_encryption_ct0 && nargo compile)
(cd user_data_encryption_ct1 && nargo compile)
(cd user_data_encryption && nargo compile)

T=<interfold>/circuits/bin/threshold/target
for name in user_data_encryption_ct0 user_data_encryption_ct1 user_data_encryption; do
  bb write_vk -b "$T/$name.json" -o "$T" -t noir-recursive-no-zk
  mv "$T/vk" "$T/$name.vk_recursive"
  mv "$T/vk_hash" "$T/$name.vk_recursive_hash"
done

cd circuits/binary_input
nargo compile
bb write_vk -b target/binary_input.json -o target -t noir-recursive-no-zk
mv target/vk target/binary_input.vk_recursive
mv target/vk_hash target/binary_input.vk_recursive_hash

cd circuits/binary_input_fold && nargo compile

cd circuits/binary_input_fold
bb write_vk -b target/binary_input_fold.json -o target --oracle_hash keccak
mkdir -p ../../contracts/verifiers
bb write_solidity_verifier -k target/vk -o ../../contracts/verifiers/BinaryInputVerifier.sol

import { ICircuitVerifier } from '@interfold/contracts/contracts/interfaces/ICircuitVerifier.sol';
 
contract MyProgram is IE3Program, IE3ProgramDataAvailability, IERC165, Ownable {
  // ...
  ICircuitVerifier public immutable inputVerifier;
 
  error KeyNotPublished(uint256 e3Id);
  error InputWindowNotOpen(uint256 e3Id);
  error InvalidInputProof();
 
  constructor(
    IInterfold _interfold,
    IOpenVmReceiptVerifier _verifier,
    ICircuitVerifier _inputVerifier,
    bytes32 _imageId
  ) Ownable(msg.sender) {
    require(address(_verifier) != address(0), VerifierAddressZero());
    require(address(_inputVerifier) != address(0), VerifierAddressZero());
    inputVerifier = _inputVerifier;
    // ... the rest of the template constructor
  }
 
  function publishInput(uint256 e3Id, bytes memory data) external override {
    E3 memory e3 = interfold.getE3(e3Id);
 
    if (interfold.getE3Stage(e3Id) != IInterfold.E3Stage.KeyPublished) revert KeyNotPublished(e3Id);
    if (block.timestamp < e3.inputWindow[0]) revert InputWindowNotOpen(e3Id);
    if (block.timestamp > e3.inputWindow[1]) revert InputDeadlineReached();
 
    (bytes memory ciphertext, bytes32 ciphertextCommitment, bytes memory proof) = abi.decode(
      data,
      (bytes, bytes32, bytes)
    );
    if (ciphertext.length == 0) revert EmptyInputData();
 
    // The order must match the public inputs of the fold circuit.
    bytes32[] memory publicInputs = new bytes32[](2);
    publicInputs[0] = ciphertextCommitment;
    publicInputs[1] = e3.committeePublicKey;
    if (!inputVerifier.verify(proof, publicInputs)) revert InvalidInputProof();
 
    uint256 index = inputs[e3Id].numberOfLeaves;
    inputs[e3Id]._insert(uint256(ciphertextCommitment));
 
    emit InputPublished(e3Id, ciphertext, index);
  }
  // ...
}

const source = 'contracts/verifiers/BinaryInputVerifier.sol'
 
const zkTranscriptLib = await ethers.deployContract(`${source}:ZKTranscriptLib`)
await zkTranscriptLib.waitForDeployment()
const relationsLib = await ethers.deployContract(`${source}:RelationsLib`)
await relationsLib.waitForDeployment()
 
const inputVerifierFactory = await ethers.getContractFactory(`${source}:HonkVerifier`, {
  libraries: {
    [`project/${source}:ZKTranscriptLib`]: await zkTranscriptLib.getAddress(),
    [`project/${source}:RelationsLib`]: await relationsLib.getAddress(),
  },
})
const inputVerifier = await inputVerifierFactory.deploy()
await inputVerifier.waitForDeployment()
 
// Pass the verifier as the new third constructor argument.
const e3Program = await e3ProgramFactory.deploy(
  await interfold.getAddress(),
  await verifier.getAddress(),
  await inputVerifier.getAddress(),
  programId,
)

import { Barretenberg, UltraHonkBackend } from '@aztec/bb.js'
import { Noir, type CompiledCircuit } from '@noir-lang/noir_js'
import type { InterfoldSDK } from '@interfold/sdk'
import { bytesToHex, encodeAbiParameters, parseAbiParameters } from 'viem'
import ct0Circuit from '@/circuits/user_data_encryption_ct0.json'
import ct1Circuit from '@/circuits/user_data_encryption_ct1.json'
import udeCircuit from '@/circuits/user_data_encryption.json'
import binaryInputCircuit from '@/circuits/binary_input.json'
import foldCircuit from '@/circuits/binary_input_fold.json'
 
const proofToFields = (proof: Uint8Array): string[] => {
  const fields: string[] = []
  for (let i = 0; i < proof.length; i += 32) fields.push(bytesToHex(proof.slice(i, i + 32)))
  return fields
}
 
export async function proveBinaryInput(sdk: InterfoldSDK, value: bigint, publicKey: Uint8Array) {
  const { encryptedData, circuitInputs: c } = await sdk.encryptNumberAndGenInputs(value, publicKey)
 
  // The fold circuit needs 2^21 points. In the browser, a later `initSRSChonk` call does not
  // enlarge the SRS that `new` loads, so pass the size here.
  const api = await Barretenberg.new({ srsSize: 2 ** 21 })
  const inner = { verifierTarget: 'noir-recursive-no-zk' } as const
 
  const prove = async (circuit: CompiledCircuit, inputs: Record<string, unknown>) => {
    const { witness, returnValue } = await new Noir(circuit).execute(inputs as any)
    const backend = new UltraHonkBackend(circuit.bytecode, api)
    const proof = await backend.generateProof(witness, inner)
    const artifacts = await backend.generateRecursiveProofArtifacts(
      proof.proof,
      proof.publicInputs.length,
      inner,
    )
    return { proof, artifacts, returnValue }
  }
 
  try {
    const ct0 = await prove(ct0Circuit as CompiledCircuit, {
      pk0is: c.pk0is,
      ct0is: c.ct0is,
      u: c.u,
      e0: c.e0,
      k1: c.k1,
      r: c.r,
    })
    const ct1 = await prove(ct1Circuit as CompiledCircuit, {
      pk1is: c.pk1is,
      ct1is: c.ct1is,
      u: c.u,
      e1: c.e1,
      r_ct1: c.r_ct1,
    })
    const ude = await prove(udeCircuit as CompiledCircuit, {
      ct0_verification_key: ct0.artifacts.vkAsFields,
      ct0_proof: proofToFields(ct0.proof.proof),
      ct0_public_inputs: ct0.proof.publicInputs,
      ct0_key_hash: ct0.artifacts.vkHash,
      ct1_verification_key: ct1.artifacts.vkAsFields,
      ct1_proof: proofToFields(ct1.proof.proof),
      ct1_public_inputs: ct1.proof.publicInputs,
      ct1_key_hash: ct1.artifacts.vkHash,
    })
    const rule = await prove(binaryInputCircuit as CompiledCircuit, {
      ct0is: c.ct0is,
      ct1is: c.ct1is,
      k1: c.k1,
    })
    const [ctCommitment, k1Commitment] = rule.returnValue as string[]
 
    const { witness } = await new Noir(foldCircuit as CompiledCircuit).execute({
      user_data_encryption_verification_key: ude.artifacts.vkAsFields,
      user_data_encryption_proof: proofToFields(ude.proof.proof),
      user_data_encryption_public_inputs: ude.proof.publicInputs,
      user_data_encryption_key_hash: ude.artifacts.vkHash,
      binary_input_verification_key: rule.artifacts.vkAsFields,
      binary_input_proof: proofToFields(rule.proof.proof),
      binary_input_key_hash: rule.artifacts.vkHash,
      ct_commitment: String(ctCommitment),
      k1_commitment: String(k1Commitment),
    })
    const fold = await new UltraHonkBackend(
      (foldCircuit as CompiledCircuit).bytecode,
      api,
    ).generateProof(witness, {
      verifierTarget: 'evm',
    })
 
    // publicInputs[0] is ct_commitment, the value that publishInput inserts into its tree.
    return encodeAbiParameters(parseAbiParameters('bytes, bytes32, bytes'), [
      bytesToHex(encryptedData),
      fold.publicInputs[0] as `0x${string}`,
      bytesToHex(fold.proof),
    ])
  } finally {
    await api.destroy()
  }
}