diff --git a/circuits/bin/threshold/pk_generation/src/main.nr b/circuits/bin/threshold/pk_generation/src/main.nr index ff23587900..287fbac7e2 100644 --- a/circuits/bin/threshold/pk_generation/src/main.nr +++ b/circuits/bin/threshold/pk_generation/src/main.nr @@ -18,18 +18,8 @@ fn main( r1is: [Polynomial<(2 * N) - 1>; L], r2is: [Polynomial; L], pk0is: [Polynomial; L], - pk1is: [Polynomial; L], ) -> pub (Field, Field, Field) { - let pk_generation: PkGeneration = PkGeneration::new( - PK_GENERATION_CONFIGS, - CRP, - eek, - sk, - e_sm, - r1is, - r2is, - pk0is, - pk1is, - ); + let pk_generation: PkGeneration = + PkGeneration::new(PK_GENERATION_CONFIGS, CRP, eek, sk, e_sm, r1is, r2is, pk0is); pk_generation.execute() } diff --git a/circuits/lib/src/core/threshold/pk_generation.nr b/circuits/lib/src/core/threshold/pk_generation.nr index 45b9320c14..a8d38711d8 100644 --- a/circuits/lib/src/core/threshold/pk_generation.nr +++ b/circuits/lib/src/core/threshold/pk_generation.nr @@ -45,7 +45,7 @@ impl Configs { /// Verifies: /// 1. Range checks on all secret witnesses (secret key, error, smudging noise, quotients) /// 2. Correct public key generation: pk0_i = -a_i * sk + eek + r2_i * (X^N + 1) + r1_i * q_i -/// and pk1_i = a_i +/// (pk1 is a_i from the hardcoded CRS `a`, not a separate witness) /// /// Outputs: /// - commit(threshold_sk) @@ -77,11 +77,8 @@ pub struct PkGeneration; L], - /// Threshold public key components (committed witnesses) - /// pk0[i] is the first component of the public key for modulus i + /// Threshold public key first component per modulus (committed witness). Second component is a[i]. pk0: [Polynomial; L], - /// pk1[i] is the second component of the public key for modulus i (should equal a[i]) - pk1: [Polynomial; L], } impl PkGeneration { @@ -94,9 +91,8 @@ impl; L], r2: [Polynomial; L], pk0: [Polynomial; L], - pk1: [Polynomial; L], ) -> Self { - PkGeneration { configs, a, eek, sk, e_sm, r1, r2, pk0, pk1 } + PkGeneration { configs, a, eek, sk, e_sm, r1, r2, pk0 } } /// Flattens all witness data into a single array for Fiat-Shamir challenge generation @@ -128,7 +124,7 @@ impl(self.sk); let e_sm_commitment = compute_share_computation_e_sm_commitment::(self.e_sm); - let pk_commitment = compute_threshold_pk_commitment::(self.pk0, self.pk1); + let pk_commitment = compute_threshold_pk_commitment::(self.pk0, self.a); let gamma = self.generate_challenge(sk_commitment, pk_commitment); self.verify_evaluations(gamma); @@ -182,10 +178,6 @@ impl = izip!( + let mut results: Vec<(usize, Polynomial, Polynomial, Polynomial, Polynomial)> = izip!( moduli.clone(), data.pk0_share.limbs.clone(), a.limbs.clone(), @@ -306,16 +298,15 @@ impl Computation for Inputs { let (r1, r2) = decompose_residue(&pk0_share, &pk0_share_hat, &qi, &cyclo, n); - (i, r2, r1, pk0_share.clone(), a.clone(), e_sm.clone()) + (i, r2, r1, pk0_share.clone(), e_sm.clone()) }) .collect(); - results.sort_by_key(|(i, _, _, _, _, _)| *i); + results.sort_by_key(|(i, _, _, _, _)| *i); let mut r2 = CrtPolynomial::new(vec![]); let mut r1 = CrtPolynomial::new(vec![]); let mut pk0_share = CrtPolynomial::new(vec![]); - let mut a = CrtPolynomial::new(vec![]); let mut e_sm = CrtPolynomial::new(vec![]); let mut sk = data.sk.limbs[0].clone(); @@ -326,11 +317,10 @@ impl Computation for Inputs { eek.reverse(); eek.center(&moduli[0]); - for (_i, r2i, r1i, pk0_sharei, ai, e_smi) in results { + for (_i, r2i, r1i, pk0_sharei, e_smi) in results { r2.add_limb(r2i); r1.add_limb(r1i); pk0_share.add_limb(pk0_sharei); - a.add_limb(ai); e_sm.add_limb(e_smi); } @@ -341,13 +331,11 @@ impl Computation for Inputs { r1is: r1, r2is: r2, pk0is: pk0_share, - pk1is: a, }) } fn to_json(&self) -> serde_json::Result { let pk0is = crt_polynomial_to_toml_json(&self.pk0is); - let pk1is = crt_polynomial_to_toml_json(&self.pk1is); let e = polynomial_to_toml_json(&self.eek); let sk = polynomial_to_toml_json(&self.sk); let e_sm = crt_polynomial_to_toml_json(&self.e_sm); @@ -356,7 +344,6 @@ impl Computation for Inputs { let json = serde_json::json!({ "pk0is": pk0is, - "pk1is": pk1is, "eek": e, "sk": sk, "e_sm": e_sm, diff --git a/crates/zk-helpers/src/circuits/threshold/pk_generation/mod.rs b/crates/zk-helpers/src/circuits/threshold/pk_generation/mod.rs index faff7353ed..1dbc2a60f7 100644 --- a/crates/zk-helpers/src/circuits/threshold/pk_generation/mod.rs +++ b/crates/zk-helpers/src/circuits/threshold/pk_generation/mod.rs @@ -6,7 +6,7 @@ //! Public key generation circuit. //! -//! This circuit proves public key generation with a threshold BFV public key (pk0, pk1) and produces +//! This circuit proves public key generation for pk0 (pk1 is the CRS polynomial `a`) and produces //! Prover.toml and configs.nr for the Noir prover. See [`PkGenerationCircuit`] and //! [`PkGenerationCircuitInput`]. diff --git a/crates/zk-helpers/src/circuits/threshold/pk_generation/sample.rs b/crates/zk-helpers/src/circuits/threshold/pk_generation/sample.rs index 6e8c000b95..dd05c2e4a6 100644 --- a/crates/zk-helpers/src/circuits/threshold/pk_generation/sample.rs +++ b/crates/zk-helpers/src/circuits/threshold/pk_generation/sample.rs @@ -95,7 +95,6 @@ mod tests { let inputs = Inputs::compute(BfvPreset::InsecureThreshold512, &sample).unwrap(); assert_eq!(inputs.pk0is.limbs.len(), 2); - assert_eq!(inputs.pk1is.limbs.len(), 2); assert_eq!(inputs.e_sm.limbs.len(), 2); assert_eq!(inputs.r1is.limbs.len(), 2); assert_eq!(inputs.r2is.limbs.len(), 2); diff --git a/crates/zk-prover/tests/local_e2e_tests.rs b/crates/zk-prover/tests/local_e2e_tests.rs index 2438f57452..f30f3deb81 100644 --- a/crates/zk-prover/tests/local_e2e_tests.rs +++ b/crates/zk-prover/tests/local_e2e_tests.rs @@ -21,9 +21,10 @@ use ark_ff::{PrimeField, Zero}; use common::{ extract_field, extract_field_from_end, find_bb, setup_compiled_circuit, setup_test_prover, }; -use e3_fhe_params::BfvPreset; +use e3_fhe_params::{build_pair_for_preset, BfvPreset}; use e3_zk_helpers::circuits::dkg::pk::circuit::PkCircuit; use e3_zk_helpers::circuits::dkg::pk::circuit::PkCircuitData; +use e3_zk_helpers::circuits::threshold::pk_generation::utils::deterministic_crp_crt_polynomial; use e3_zk_helpers::circuits::{commitments::compute_dkg_pk_commitment, CircuitComputation}; use e3_zk_helpers::computation::DkgInputType; use e3_zk_helpers::dkg::share_computation::{ @@ -431,9 +432,11 @@ async fn test_pk_generation_commitment_consistency() { &computation_output.inputs.sk, computation_output.bits.sk_bit, ); + let (threshold_params, _) = build_pair_for_preset(preset).expect("preset pair"); + let a = deterministic_crp_crt_polynomial(&threshold_params).expect("crp polynomial"); let pk_commitment_expected = compute_threshold_pk_commitment( &computation_output.inputs.pk0is, - &computation_output.inputs.pk1is, + &a, computation_output.bits.pk_bit, );