Skip to content
/ gkr Public

zero knowledge proof aggregator for general circuit

Notifications You must be signed in to change notification settings

jeong0982/gkr

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Proof aggregator using recursive GKR scheme

This is Cli tool for generation of aggregated proof for multiple inputs.

In this version, it supports circom circuit.

Preliminaries

circom and snarkjs should be installed already.

You can check that by this command:

snarkjs --help
circom --help

How to use

1. Install gkr

cargo install --path ./rust

2. Move to ./rust

cd rust

3. Write a circuit in ./rust and inputs in ./rust/example/ (/example is not mandatory)

4. Create GKR proof for inputs

You can give inputs by commands:

gkr-aggregator prove -c circuit.circom -i ./example/input1.json ./example/input2.json ./example/input3.json

You can get a message from cli:

Proving by groth16 can be done

4. Prepare zkey

You should prepare an appropriate ptau file.

snarkjs groth16 setup aggregated.r1cs pot.ptau c0.zkey
snarkjs zkey contribute c0.zkey c1.zkey --name=“mock” -v

Give random string for contribution, and then

snarkjs zkey beacon c1.zkey c.zkey 0102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f 10 -n="Final Beacon phase2"

5. Create aggregated Groth16 proof

gkr-aggregator mock-groth -z c.zkey

You can get proof.json and public.json.

Implementation details

Internal

Initial round

Get input from input.json, make d in proof with it.
Parse r1cs file and convert it to GKRCircuit. (Let's call this $C$)
Make proof $\pi_0$ from d and GKRCircuit.

Iterative round (0 < $i$ < n)

There are two circuit $C_i$ and $C_{v_{i - 1}}$. $C_{v_{i - 1}}$ is circuit that can verify $C_{i - 1}$.
$C_{v_i}$ can be different form for each circuit $C_i$. To make aggregated proof for previous proof and current round's proof, we need

  • input (for $C_i$)
  • proof $\pi_{i - 1}$

Make integrated circuit $C'_i$.

Use those inputs, make proof $\pi_i$. To be specific, input and proof $\pi_{i - 1}$

Last round

Also there are two circuit $C_n$ and $C_{v_{n - 1}}$. To send aggregated proof to on-chain verifier, we can use groth16 prover in snarkjs.
Integrated circuit $C'_{n}$ can be proved with snarkjs also.
So final proof $\pi_n$ is groth16 or plonk proof

About

zero knowledge proof aggregator for general circuit

Topics

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published