feat: add decrypted-shares-aggregation [skip-line-limit]

Cargo.toml

@@ -153,6 +153,7 @@ lazy_static = "=1.5.0"
 num = "=0.4.3"
 num-bigint = { version = "=0.4.6" }
 num-traits = "=0.2.19"
+num-integer = "0.1.46"
 ndarray = { version = "=0.15.6", features = ["serde"] }
 once_cell = "=1.21.3"
 opentelemetry = "=0.29.0"

circuits/bin/threshold/decrypted_shares_aggregation_bn/Nargo.toml

@@ -1,5 +1,5 @@
 [package]
-name = "decrypted_shares_aggregation"
+name = "decrypted_shares_aggregation_bn"
 type = "bin"
 authors = ["Gnosis Guild / Enclave"]
 version = "1.0.0-beta.15"

circuits/bin/threshold/decrypted_shares_aggregation_mod/Nargo.toml

@@ -1,5 +1,5 @@
 [package]
-name = "decrypted_shares_aggregation"
+name = "decrypted_shares_aggregation_mod"
 type = "bin"
 authors = ["Gnosis Guild / Enclave"]
 version = "1.0.0-beta.15"

circuits/lib/src/configs/insecure/threshold.nr

@@ -14,9 +14,9 @@ use crate::core::threshold::user_data_encryption::Configs as UserDataEncryptionC
 pub global N: u32 = 512;
 pub global L: u32 = 2;
 pub global PLAINTEXT_MODULUS: Field = 100;
+pub global Q_INVERSE_MOD_T: Field = 57;
 pub global QIS: [Field; L] = [68719403009, 68719230977];
 pub global Q_MOD_T: Field = 3;
-pub global Q_INVERSE_MOD_T: Field = 7;
 pub global T_INV_MOD_Q: Field = 1416703358393105942938;
 
 /************************************
@@ -132,7 +132,7 @@ decrypted_shares_aggregation (CIRCUIT 7)
 ************************************/
 
 // decrypted_shares_aggregation - bit parameters
-pub global DECRYPTED_SHARES_AGGREGATION_BIT_NOISE: u32 = 69;
+pub global DECRYPTED_SHARES_AGGREGATION_BIT_NOISE: u32 = 65;
 
 // decrypted_shares_aggregation - configs
 pub global DECRYPTED_SHARES_AGGREGATION_CONFIGS: DecryptedSharesAggregationConfigs<L> =

circuits/lib/src/configs/secure/threshold.nr

@@ -144,7 +144,7 @@ decrypted_shares_aggregation (CIRCUIT 7)
 ************************************/
 
 // decrypted_shares_aggregation - bit parameters
-pub global DECRYPTED_SHARES_AGGREGATION_BIT_NOISE: u32 = 201;
+pub global DECRYPTED_SHARES_AGGREGATION_BIT_NOISE: u32 = 200;
 
 // decrypted_shares_aggregation - configs
 pub global DECRYPTED_SHARES_AGGREGATION_CONFIGS: DecryptedSharesAggregationConfigs<L> =

crates/zk-helpers/Cargo.toml

@@ -18,6 +18,7 @@ fhe = { workspace = true }
 fhe-math = { workspace = true }
 fhe-traits = { workspace = true }
 num-bigint = { workspace = true }
+num-integer = { workspace = true }
 num-traits = { workspace = true }
 thiserror = { workspace = true }
 rand = { workspace = true }

crates/zk-helpers/src/bin/zk_cli.rs

@@ -26,6 +26,9 @@ use e3_zk_helpers::dkg::share_decryption::{
 };
 use e3_zk_helpers::dkg::share_encryption::{ShareEncryptionCircuit, ShareEncryptionCircuitInput};
 use e3_zk_helpers::registry::{Circuit, CircuitRegistry};
+use e3_zk_helpers::threshold::decrypted_shares_aggregation::{
+    DecryptedSharesAggregationCircuit, DecryptedSharesAggregationCircuitInput,
+};
 use e3_zk_helpers::threshold::pk_aggregation::PkAggregationCircuit;
 use e3_zk_helpers::threshold::pk_aggregation::PkAggregationCircuitInput;
 use e3_zk_helpers::threshold::pk_generation::{PkGenerationCircuit, PkGenerationCircuitInput};
@@ -169,6 +172,7 @@ fn main() -> Result<()> {
     registry.register(Arc::new(DkgShareDecryptionCircuit));
     registry.register(Arc::new(PkAggregationCircuit));
     registry.register(Arc::new(ThresholdShareDecryptionCircuit));
+    registry.register(Arc::new(DecryptedSharesAggregationCircuit));
 
     // Handle list circuits flag.
     if args.list_circuits {
@@ -216,7 +220,7 @@ fn main() -> Result<()> {
     }
 
     let write_prover_toml = args.toml;
-    // Only share-computation has a witness-type choice (secret-key vs smudging-noise). pk always uses secret key.
+    // DKG circuits have a witness-type choice (secret-key vs smudging-noise) excluding `pk` or C0 circuit.
     let has_witness_type = circuit_meta.name() == ShareComputationCircuit::NAME
         || circuit_meta.name() == ShareEncryptionCircuit::NAME
         || circuit_meta.name() == DkgShareDecryptionCircuit::NAME;
@@ -269,14 +273,11 @@ fn main() -> Result<()> {
                     committee,
                     dkg_input_type,
                 );
-
                 let circuit = ShareComputationCircuit;
                 circuit.codegen(preset, &sample)?
             }
             name if name == <ShareEncryptionCircuit as Circuit>::NAME => {
-                let sd = preset.search_defaults().ok_or_else(|| {
-                    anyhow!("preset does not define search defaults for {}", name)
-                })?;
+                let sd = preset.search_defaults().unwrap();
                 let sample = ShareEncryptionCircuitInput::generate_sample(
                     preset,
                     committee,
@@ -323,6 +324,15 @@ fn main() -> Result<()> {
                 let circuit = ThresholdShareDecryptionCircuit;
                 circuit.codegen(preset, &sample)?
             }
+            name if name == <DecryptedSharesAggregationCircuit as Circuit>::NAME => {
+                let sample = DecryptedSharesAggregationCircuitInput::generate_sample(
+                    preset,
+                    CiphernodesCommitteeSize::Small.values(),
+                );
+
+                let circuit = DecryptedSharesAggregationCircuit;
+                circuit.codegen(preset, &sample)?
+            }
             name => return Err(anyhow!("circuit {} not yet implemented", name)),
         };
 

crates/zk-helpers/src/circuits/dkg/pk/computation.rs

@@ -153,8 +153,8 @@ impl Computation for Witness {
             build_pair_for_preset(preset).map_err(|e| CircuitsErrors::Sample(e.to_string()))?;
         let moduli = dkg_params.moduli();
 
-        let mut pk0is = crate::crt::fhe_poly_to_crt_centered(&input.public_key.c.c[0], moduli)?;
-        let mut pk1is = crate::crt::fhe_poly_to_crt_centered(&input.public_key.c.c[1], moduli)?;
+        let mut pk0is = crate::math::fhe_poly_to_crt_centered(&input.public_key.c.c[0], moduli)?;
+        let mut pk1is = crate::math::fhe_poly_to_crt_centered(&input.public_key.c.c[1], moduli)?;
 
         let zkp_modulus = &get_zkp_modulus();
 

crates/zk-helpers/src/circuits/dkg/share_encryption/computation.rs

@@ -15,12 +15,12 @@ use crate::circuits::commitments::{
 };
 use std::ops::Deref;
 
-use crate::crt::compute_k0is;
 use crate::dkg::share_encryption::ShareEncryptionCircuit;
 use crate::dkg::share_encryption::ShareEncryptionCircuitInput;
 use crate::get_zkp_modulus;
+use crate::math::{compute_k0is, compute_q_mod_t, compute_q_product};
+use crate::math::{cyclotomic_polynomial, decompose_residue};
 use crate::polynomial_to_toml_json;
-use crate::ring::{cyclotomic_polynomial, decompose_residue};
 use crate::utils::{compute_modulus_bit, compute_msg_bit};
 use crate::CircuitsErrors;
 use crate::{calculate_bit_width, crt_polynomial_to_toml_json};
@@ -152,12 +152,13 @@ impl Computation for Configs {
             build_pair_for_preset(preset).map_err(|e| CircuitsErrors::Sample(e.to_string()))?;
 
         let moduli = dkg_params.moduli().to_vec();
-        let ctx = dkg_params.ctx_at_level(0)?;
-        let modulus = BigInt::from(ctx.modulus().clone());
-        let t = BigInt::from(dkg_params.plaintext());
+        let plaintext = dkg_params.plaintext();
+        let q = compute_q_product(&moduli);
+        let q_mod_t_uint = compute_q_mod_t(&q, plaintext);
+        let t = BigInt::from(plaintext);
         let p = get_zkp_modulus();
 
-        let q_mod_t = center(&reduce(&modulus, &t), &t);
+        let q_mod_t = center(&BigInt::from(q_mod_t_uint), &t);
         let q_mod_t_mod_p = reduce(&q_mod_t, &p);
 
         let k0is = compute_k0is(&moduli, dkg_params.plaintext())?;

crates/zk-helpers/src/circuits/dkg/share_encryption/sample.rs

@@ -137,8 +137,8 @@ mod tests {
         let sd = BfvPreset::InsecureThreshold512.search_defaults().unwrap();
         let sample = ShareEncryptionCircuitInput::generate_sample(
             BfvPreset::InsecureThreshold512,
-            committee.clone(),
-            DkgInputType::SecretKey,
+            committee,
+            DkgInputType::SmudgingNoise,
             sd.z,
             sd.lambda,
         );

crates/zk-helpers/src/circuits/threshold/decrypted_shares_aggregation/circuit.rs

@@ -0,0 +1,35 @@
+// SPDX-License-Identifier: LGPL-3.0-only
+//
+// This file is provided WITHOUT ANY WARRANTY;
+// without even the implied warranty of MERCHANTABILITY
+// or FITNESS FOR A PARTICULAR PURPOSE.
+
+use crate::computation::DkgInputType;
+use crate::registry::Circuit;
+use crate::CiphernodesCommittee;
+use e3_fhe_params::ParameterType;
+use fhe_math::rq::Poly;
+
+/// Circuit identifier for threshold decrypted-shares aggregation (Noir circuit 7).
+#[derive(Debug)]
+pub struct DecryptedSharesAggregationCircuit;
+
+impl Circuit for DecryptedSharesAggregationCircuit {
+    const NAME: &'static str = "decrypted-shares-aggregation";
+    const PREFIX: &'static str = "DECRYPTED_SHARES_AGGREGATION";
+    const SUPPORTED_PARAMETER: ParameterType = ParameterType::THRESHOLD;
+    const DKG_INPUT_TYPE: Option<DkgInputType> = None;
+}
+
+/// Raw input for witness computation: decryption share polynomials from T+1 parties,
+/// party IDs (1-based), and decoded message. Witness::compute runs Lagrange + CRT.
+#[derive(Debug, Clone)]
+pub struct DecryptedSharesAggregationCircuitInput {
+    pub committee: CiphernodesCommittee,
+    /// Decryption shares from T+1 parties (Poly in RNS form).
+    pub d_share_polys: Vec<Poly>,
+    /// Party IDs (1-based: 1, 2, ..., T+1) for the reconstructing parties.
+    pub reconstructing_parties: Vec<usize>,
+    /// Decoded message polynomial coefficients.
+    pub message_vec: Vec<u64>,
+}

crates/zk-helpers/src/circuits/threshold/decrypted_shares_aggregation/codegen.rs

@@ -0,0 +1,128 @@
+// SPDX-License-Identifier: LGPL-3.0-only
+//
+// This file is provided WITHOUT ANY WARRANTY;
+// without even the implied warranty of MERCHANTABILITY
+// or FITNESS FOR A PARTICULAR PURPOSE.
+
+//! Code generation for the Decrypted Shares Aggregation circuit: Prover.toml and configs.nr.
+
+use e3_fhe_params::BfvPreset;
+
+use crate::circuits::computation::Computation;
+use crate::threshold::decrypted_shares_aggregation::circuit::DecryptedSharesAggregationCircuit;
+use crate::threshold::decrypted_shares_aggregation::computation::{Configs, Witness};
+use crate::threshold::decrypted_shares_aggregation::DecryptedSharesAggregationCircuitInput;
+use crate::Circuit;
+use crate::CircuitCodegen;
+use crate::CircuitsErrors;
+use crate::{Artifacts, CodegenConfigs, CodegenToml};
+
+/// Implementation of [`CircuitCodegen`] for [`DecryptedSharesAggregationCircuit`].
+impl CircuitCodegen for DecryptedSharesAggregationCircuit {
+    type Preset = BfvPreset;
+    type Input = DecryptedSharesAggregationCircuitInput;
+    type Error = CircuitsErrors;
+
+    fn codegen(&self, preset: Self::Preset, input: &Self::Input) -> Result<Artifacts, Self::Error> {
+        let witness = Witness::compute(preset, input)?;
+        let configs = Configs::compute(preset, &())?;
+
+        let toml = generate_toml(witness)?;
+        let configs_str = generate_configs(preset, &configs);
+
+        Ok(Artifacts {
+            toml,
+            configs: configs_str,
+        })
+    }
+}
+
+pub fn generate_toml(witness: Witness) -> Result<CodegenToml, CircuitsErrors> {
+    let json = witness.to_json().map_err(CircuitsErrors::SerdeJson)?;
+
+    Ok(toml::to_string(&json)?)
+}
+
+/// Generates the decrypted_shares_aggregation config fragment for threshold.nr.
+/// Emits L, QIS, PLAINTEXT_MODULUS, Q_INVERSE_MOD_T so the circuit uses the same
+/// crypto params as the witness (avoids "Cannot satisfy constraint" from config mismatch).
+pub fn generate_configs(_preset: BfvPreset, configs: &Configs) -> CodegenConfigs {
+    let prefix = <DecryptedSharesAggregationCircuit as Circuit>::PREFIX;
+    let qis_str = configs
+        .moduli
+        .iter()
+        .map(|q| q.to_string())
+        .collect::<Vec<_>>()
+        .join(", ");
+
+    format!(
+        r#"use crate::core::threshold::decrypted_shares_aggregation::Configs as DecryptedSharesAggregationConfigs;
+
+/************************************
+-------------------------------------
+decrypted_shares_aggregation (CIRCUIT 7)
+-------------------------------------
+************************************/
+
+pub global L: u32 = {};
+pub global QIS: [Field; L] = [{}];
+pub global PLAINTEXT_MODULUS: Field = {};
+pub global Q_INVERSE_MOD_T: Field = {};
+
+pub global {}_BIT_NOISE: u32 = {};
+
+pub global {}_CONFIGS: DecryptedSharesAggregationConfigs<L> =
+    DecryptedSharesAggregationConfigs::new(QIS, PLAINTEXT_MODULUS, Q_INVERSE_MOD_T);
+"#,
+        configs.l,
+        qis_str,
+        configs.plaintext_modulus,
+        configs.q_inverse_mod_t,
+        prefix,
+        configs.bits.noise_bit,
+        prefix,
+    )
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::CiphernodesCommitteeSize;
+
+    #[test]
+    fn test_configs_generation() {
+        let preset = BfvPreset::InsecureThreshold512;
+        let configs = Configs::compute(preset, &()).unwrap();
+        let prefix: &str = <DecryptedSharesAggregationCircuit as Circuit>::PREFIX;
+
+        let codegen_configs = generate_configs(preset, &configs);
+
+        assert!(codegen_configs.contains("decrypted_shares_aggregation"));
+        assert!(codegen_configs.contains(&format!(
+            "{}_BIT_NOISE: u32 = {}",
+            prefix, configs.bits.noise_bit
+        )));
+        assert!(codegen_configs.contains(&format!("{}_CONFIGS:", prefix)));
+        assert!(codegen_configs.contains(
+            "DecryptedSharesAggregationConfigs::new(QIS, PLAINTEXT_MODULUS, Q_INVERSE_MOD_T)"
+        ));
+    }
+
+    #[test]
+    fn test_codegen_with_sample() {
+        let preset = BfvPreset::InsecureThreshold512;
+        let committee = CiphernodesCommitteeSize::Small.values();
+        let input = DecryptedSharesAggregationCircuitInput::generate_sample(preset, committee);
+        let circuit = DecryptedSharesAggregationCircuit;
+
+        let artifacts = circuit.codegen(preset, &input).unwrap();
+
+        assert!(!artifacts.toml.is_empty());
+        assert!(artifacts
+            .configs
+            .contains("DECRYPTED_SHARES_AGGREGATION_BIT_NOISE"));
+        assert!(artifacts
+            .configs
+            .contains("DECRYPTED_SHARES_AGGREGATION_CONFIGS"));
+    }
+}