Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Invalid proof for circuits more than half the size of the ptau #60

Open
chancehudson opened this issue Jul 9, 2024 · 0 comments
Open

Comments

@chancehudson
Copy link

Summary of Bug

Apologies if this is not the correct repo for this.

I'm proving circom circuits on the bls12-381 curve using ark-groth16. I've run into a bug where ark-groth16 generates invalid proofs for zkeys that are built against powers of tau ceremonies that are not at least twice as big.

e.g. i have a circuit with 2500 constraints. I build the zkey using a ptau with 2^12 powers. snarkjs generates valid proofs, ark-groth16 generates invalid proofs. I build the same circuit against a ptau with 2^13 powers and both snarkjs and ark-groth16 generate valid proofs.

I've confirmed that the proofs generated by ark-groth16 are invalid in snarkjs as well. This bug does not exist for the alt_bn128 curve.

I'm using the R1CS QAP reduction in ark-circom.

I know there's lots of places where the inconsistency could come from. I wanted to post here to see if anyone has ideas off the top of their head.

Version

[email protected]

Steps to Reproduce

Build a circuit over the bls12-381 curve with N constraints and < 2*N ptau powers. Use the R1CS QAP mapping in ark-circom to generate a proof. Try to validate the proof.

This is implemented here, the relevant zkeys/witness logic is committed in the same repo. I'll break this into a minimal repro example if there's any interest.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant