Curve point aggregation circuit not satisfied

[seunlanlege]

I've implemented a circuit here which simply takes a list of BLS12-381 points (public keys) and tries to aggregate them into a single point and constrain the output to some expected point. The problem is my circuit isn't satisfied? Not sure what i'm doing wrong tbh.

Circuit here:

https://github.com/polytope-labs/gnark-apk-proofs/blob/main/pkg/apk/apk.go#L30

Test here:

https://github.com/polytope-labs/gnark-apk-proofs/blob/main/pkg/apk/apk_bls_test.go#L20

[ivokub]

Hi @seunlanlege, there are two issues:

in the witness assignment you're doing:

	// Calculate the expected sum (aggregate) of all points
	expectedSum := &init
	for i := 0; i < numPoints; i++ {
		expectedSum = expectedSum.Add(expectedSum, &points[i])
	}

note here that init is G1Affine value, thus expectedSum will be reference to init. And as *G1Affine.Add modifies the value inline. So you're modifying the initial seed value. Looking at it now we haven't documented it in gnark-crypto.

Secondly, in the circuit loop you're defining NumKeys as circuit witness, but it is actually a constant as its type is int. And because it is a constant, not a circuit variable, then you have to define it at circuit compile time. So instead of

	// Create circuit and witness
	circuit := APKCircuit{}
	witness := APKCircuit{
		PublicKeys:  pubKeys,
		NumKeys:     numPoints,
		ExpectedSum: sw_bls12381.NewG1Affine(*expectedSum),
		Seed: sw_bls12381.NewG1Affine(init),
	}

you should do:

	// Create circuit and witness
	circuit := APKCircuit{
		NumKeys: numPoints,
	}
	witness := APKCircuit{
		PublicKeys: pubKeys,
		// NumKeys:     numPoints,
		ExpectedSum: sw_bls12381.NewG1Affine(expectedSum),
		Seed:        sw_bls12381.NewG1Affine(init),
	}

I think gnark should be more clear when any defined circuit input witness is actually a constant at compile time (maybe even error to make it very clear), to aid the circuit developer.

With these changes the test works with the test engine. Full test routine with changes:

func testRoutineAPKG1() (circ, wit frontend.Circuit) {
	numPoints := 10

	// Get the generator point for BLS12-381 G1
	_, _, G, _ := bls12381.Generators()

	var seed fr.Element
	seed.SetRandom()

	var init bls12381.G1Affine
	init.ScalarMultiplication(&G, seed.BigInt(new(big.Int)))
	// Generate random points by multiplying the generator with random scalars
	points := make([]bls12381.G1Affine, numPoints)
	scalars := make([]fr.Element, numPoints)

	for i := 0; i < numPoints; i++ {
		scalars[i].SetRandom()
		points[i].ScalarMultiplication(&G, scalars[i].BigInt(new(big.Int)))
	}

	// Convert to sw_emulated points
	var pubKeys [10]sw_emulated.AffinePoint[emulated.BLS12381Fp]
	for i := 0; i < numPoints; i++ {
		pubKeys[i] = sw_bls12381.NewG1Affine(points[i])
	}

	// Calculate the expected sum (aggregate) of all points
	expectedSum := init
	for i := 0; i < numPoints; i++ {
		expectedSum.Add(&expectedSum, &points[i])
	}

	// log the expected sum
	fmt.Printf("testRoutineAPKG1: Final expectedSum X coordinate: %v\n", expectedSum.X.String())
	fmt.Printf("testRoutineAPKG1: Final expectedSum Y coordinate: %v\n", expectedSum.Y.String())

	// Create circuit and witness
	circuit := APKCircuit{
		NumKeys: numPoints,
	}
	witness := APKCircuit{
		PublicKeys: pubKeys,
		// NumKeys:     numPoints,
		ExpectedSum: sw_bls12381.NewG1Affine(expectedSum),
		Seed:        sw_bls12381.NewG1Affine(init),
	}

	return &circuit, &witness
}

func TestBLSG1APKCircuit(t *testing.T) {
	// Test with 3 points
	circuit, witness := testRoutineAPKG1()
	assert := test.NewAssert(t)
	err := test.IsSolved(circuit, witness, ecc.BLS12_381.ScalarField())
	assert.NoError(err)
}

[ivokub]

I'll turn the comments into issues in gnark-crypto and gnark respectively next week.

[seunlanlege]

Amazing it works now thanks! @ivokub