fix: debugged integration of feature into didmultisigcontroler contract, finalized readme for setup, usage, and testing

Author: sid030sid

packages/trust-anchor-did-ethr/.gitignore

@@ -61,4 +61,8 @@ build/
 
 # --- Testing ---
 reports/
-.nyc_output/
+.nyc_output/
+
+# Ignore files generated by circom-ecdsa fork in order to comply with gpl-3 license
+contracts/verifiers/*
+circom-zkp-generator/*

packages/trust-anchor-did-ethr/README.md

@@ -15,6 +15,29 @@
 4. only all trust anchor admins together can call the changeOwner function of their companys' did:ethr identifier (stage of feature: Implemented, Tested, Reviewed)
 5. one trust anchor admin uses the deployed DIDMultisigController contract of its trust anchor to add a static pointer to a smart contract that enables company admins to change the CID of BFC of company's CRSet by calling the setAttribute function on the "service" section of the company's did:ethr identifier (stage of feature: Implemented, Tested, Reviewed)
 
+## Desired feature for private digital asset publication
+This feature of the DIDMultisigController smart contract enables a company admin to show a Zero-Knowledge Proof that authorizes the DIDMultisigController to act as a relayer and digital asset publisher without revealing the identity of the authorizing company admin.
+
+### Set up and testing private digital asset publication
+To unlock the feature for private digital asset publication, the Zero-Knowledge Proof generator must be added to this ``trust-anchor-did-ethr`` package, which can be done following the steps described in the ``README`` of the [ASCS circom-ecdsa fork](https://github.com/ASCS-eV/circom-ecdsa?tab=readme-ov-file#private-secure-on-chain-group-signature-verification-with-variable-group-size). After adding the Zero-Knowledge Proof generator to the folder `./circom-zkp-generator`, the feature for private digital asset publicaiton can be tested by running `npx hardhat test ./test/DIDMultisigController.privatePublish.test.ts` in the terminal while in the folder `./packages/trust-anchor-did-ethr`.
+
+### Workflow of private digital asset publication
+1. **Preparation**: The Trust Anchor admin uses the [ASCS circom-ecdsa fork](https://github.com/ASCS-eV/circom-ecdsa) to create ZKP-verifier smart contracts (see `./contracts/verifiers`) and ZKP generator (see `./circom-zkp-generator`) specific to different group sizes. To create both, follow the [instructions from above](#set-up-and-testing-private-digital-asset-publication).
+2. **Registration**: The Trust Anchor deploys these verifier smart contracts and stores their addresses in the `verifiers` mapping within the `DIDMultisigController`.
+3. **Generation**: Company admins (or a DApp) generate a ZKP off-chain using the ASCS toolset (see `./circom-zkp-generator`).
+4. **Publication**: Admins call `privatelyPublishMarketplaceData` to publish digital data assets to the ASCS marketplace (simulated via `DigitalAssetMarketplaceStub`).
+
+**Note:** see test script `./test/DIDMultisigController.privatePublish.test.ts` to understand the code behind the workflow steps of *registration*, *generation*, and *publication*.
+
+### Improvements for future
+The goal is to make verifier registration obsolete by making membership proofs independent of group size, as discussed in the [ASCS circom-ecdsa fork](https://github.com/ASCS-eV/circom-ecdsa) under "Membership Proof Is O(m)". 
+
+Alternatively, a **Fixed-Size Padding** model could be used:
+* **Simpler contract architecture**: Only one verifier contract (e.g., fixed at 100 slots) is maintained.
+* **Easier extensibility**: Smaller groups are padded with null-address placeholders.
+* **Reduced complexity**: Client-side logic remains consistent across all group sizes.
+* **Lower overhead**: Fewer artifacts (WASM, zkey) need to be managed.
+
 ## Desired security features for production
 ### ... for identity of trust anchor
 1. trust anchor admins cannot administer company DID of other trust anchor
@@ -24,45 +47,10 @@
 1. company admins cannot administer DID of trust anchor or other company
 2. ...
 
-## Usage of Hardhat
-
-### Running Tests
-
-To run all the tests in the project, execute the following command:
-
-```shell
-npx hardhat test
-```
-
-You can also selectively run the Solidity or `node:test` tests:
-
-```shell
-npx hardhat test solidity
-npx hardhat test nodejs
-```
-
-### Make a deployment to Sepolia
-
-This project includes an example Ignition module to deploy the contract. You can deploy this module to a locally simulated chain or to Sepolia.
-
-To run the deployment to a local chain:
-
-```shell
-npx hardhat ignition deploy ignition/modules/Counter.ts
-```
-
-To run the deployment to Sepolia, you need an account with funds to send the transaction. The provided Hardhat configuration includes a Configuration Variable called `SEPOLIA_PRIVATE_KEY`, which you can use to set the private key of the account you want to use.
-
-You can set the `SEPOLIA_PRIVATE_KEY` variable using the `hardhat-keystore` plugin or by setting it as an environment variable.
-
-To set the `SEPOLIA_PRIVATE_KEY` config variable using `hardhat-keystore`:
-
-```shell
-npx hardhat keystore set SEPOLIA_PRIVATE_KEY
-```
+## Acknowledgements
+We extend our gratitude to **0xParc** for their pioneering work on [circom-ecdsa](https://github.com/0xPARC/circom-ecdsa). Their implementation served as the foundational building block for the ZKP-based private digital asset publication system featured in this repository.
 
-After setting the variable, you can run the deployment with the Sepolia network:
+To meet the specific requirements of the `trust-anchor-did-ethr` software system, we have adapted 0xParc's original code within our own [fork of circom-ecdsa](https://github.com/ASCS-eV/circom-ecdsa). This fork is instrumental in our workflow, specifically for:
 
-```shell
-npx hardhat ignition deploy --network sepolia ignition/modules/Counter.ts
-```
+* **Verifier Smart Contracts**: Generating the ZK-SNARK verification logic located in `./contracts/verifiers`.
+* **ZKP Artifacts**: Producing the circuit compilation and proving keys found within the `./circom-zkp-generator` directory.

packages/trust-anchor-did-ethr/contracts/DIDMultisigController.sol

@@ -14,6 +14,34 @@ interface IDigitalAssetMarketplaceStub {
     function publishData(string calldata data, address assetOwner) external;
 }
 
+// Interface for Groth16 verifier of group with size 2 to 4
+interface IVerifierM2 {
+    function verifyProof(
+        uint256[2] calldata a,
+        uint256[2][2] calldata b,
+        uint256[2] calldata c,
+        uint256[6] calldata input
+    ) external view returns (bool);
+}
+
+interface IVerifierM3 {
+    function verifyProof(
+        uint256[2] calldata a,
+        uint256[2][2] calldata b,
+        uint256[2] calldata c,
+        uint256[8] calldata input
+    ) external view returns (bool);
+}
+
+interface IVerifierM4 {
+    function verifyProof(
+        uint256[2] calldata a,
+        uint256[2][2] calldata b,
+        uint256[2] calldata c,
+        uint256[8] calldata input
+    ) external view returns (bool);
+}
+
 contract DIDMultisigController {
     /*//////////////////////////////////////////////////////////////
                                 STORAGE
@@ -35,6 +63,8 @@ contract DIDMultisigController {
     }
 
     mapping(bytes32 => Proposal) public proposals;
+    mapping(uint256 => bool) public usedNonces; // For tracking used nonces in private publishing of digital data assets
+    mapping(uint256 => address) public verifiers; // maps group size to respectively responsible zkp verifier contract address
 
     /*//////////////////////////////////////////////////////////////
                                 EVENTS
@@ -270,7 +300,8 @@ contract DIDMultisigController {
     }
 
     /*//////////////////////////////////////////////////////////////
-                     5. COMPANY ADMIN ACTIONS VIA MULTISIG
+                    5. COMPANY ADMIN ACTION: 
+                    Public Publishing of Digital Data Assets
     //////////////////////////////////////////////////////////////*/
 
     // verifiable delegated execution of publishing data to a marketplace (WITHOUT privacy of company admin!)
@@ -331,34 +362,200 @@ contract DIDMultisigController {
         return ecrecover(ethSignedMessageHash, v, r, s);
     }
 
-    function privatelyPublishMarketplaceData(
-        address marketplace,
-        string calldata data,
-        address company,
-        address[] calldata companyAdmins
-    ) external onlyOwner {
+    /*//////////////////////////////////////////////////////////////
+                    6. COMPANY ADMIN ACTION: 
+                    Privately Publishing of Digital Data Assets
+    //////////////////////////////////////////////////////////////*/
 
-        // require at least 1 company admin
-        require(companyAdmins.length > 0, "no_company_admins");
+    // Register or update verifier for a specific group size
+    function setVerifier(uint256 m, address verifier) external onlyOwner {
+        require(verifier != address(0), "invalid_verifier");
+        verifiers[m] = verifier;
+    }
+
+    // Remove a verifier
+    function removeVerifier(uint256 m) external onlyOwner {
+        delete verifiers[m];
+    }
 
-        // require all provided company admins to be valid delegates
-        for (uint i = 0; i < companyAdmins.length; i++) {
+    struct ZKProofInput {
+        address marketplace;
+        string cid;
+        address company;
+        address[] companyAdmins;
+        uint256 inputNonce;
+        uint256[2] a;
+        uint256[2][2] b;
+        uint256[2] c;
+        uint256[] input;
+    }
+
+    function privatelyPublishMarketplaceData(ZKProofInput calldata zkInput) external onlyOwner{
+        uint256 m = zkInput.companyAdmins.length;
+
+        require(m > 0, "no_admins");
+        require(!usedNonces[zkInput.inputNonce], "nonce_used"); // protect against replay attacks by ensuring nonce is unique and unused
+
+        /* ---------------------------------------------------------
+        1. Validate admins via registry
+        ----------------------------------------------------------*/
+        for (uint256 i = 0; i < m; i++) {
             require(
                 registry.validDelegate(
-                    company,
+                    zkInput.company,
                     keccak256("CompanyAdmin"),
-                    companyAdmins[i]
+                    zkInput.companyAdmins[i]
                 ),
-                "invalid_list_of_company_admins"
+                "invalid_company_admin"
             );
         }
 
-        // verify ZKP that proves that...
-        // 1. the trust anchor knows a signature over the message authorizing the publication of data
-        // 2. one of the company admins signed the message authorizing the publication of data
-        // 3. without revealing which company admin signed the message
+        /* ---------------------------------------------------------
+        2. Get ZKP verifier for group size m
+        ----------------------------------------------------------*/
+        address verifierAddr = verifiers[m];
+        require(verifierAddr != address(0), "verifier_not_set");
+
+        /* ---------------------------------------------------------
+        3. Compute message hash (must match circuit)
+        ----------------------------------------------------------*/
+        (uint256 hi, uint256 lo) = hashPublishMessage(
+            zkInput.inputNonce,
+            zkInput.cid,
+            zkInput.company,
+            zkInput.marketplace
+        );
 
-        // publish asset with company as owner
-        IDigitalAssetMarketplaceStub(marketplace).publishData(data, company);
+        /* ---------------------------------------------------------
+        4. Validate public inputs
+        Circuit order:
+        [ attestation,
+            addr0..addr(m-1),
+            hi,
+            lo,
+            nonce ]
+        ----------------------------------------------------------*/
+
+        // todo in future: attestation / domain separator
+        
+        // admins
+        for (uint256 i = 0; i < m; i++) {
+            require(
+                zkInput.input[i + 1]
+                    == uint256(uint160(zkInput.companyAdmins[i])),
+                "admin_mismatch"
+            );
+        }
+
+        // hash hi / lo
+        require(
+            zkInput.input[m + 1] == hi,
+            "hash_hi_mismatch"
+        );
+
+        require(
+            zkInput.input[m + 2] == lo,
+            "hash_lo_mismatch"
+        );
+
+        // nonce
+        require(
+            zkInput.input[m + 3] == zkInput.inputNonce,
+            "nonce_mismatch"
+        );
+
+        /* ---------------------------------------------------------
+        5. Verify ZK proof
+        ----------------------------------------------------------*/
+        bool ok = _verifyProof(m, zkInput);
+        require(ok, "invalid_zk_proof");
+
+        /* ---------------------------------------------------------
+        6. Consume nonce BEFORE external call (reentrancy safety)
+        ----------------------------------------------------------*/
+        usedNonces[zkInput.inputNonce] = true;
+
+        /* ---------------------------------------------------------
+        7. Publish
+        ----------------------------------------------------------*/
+        IDigitalAssetMarketplaceStub(zkInput.marketplace)
+            .publishData(zkInput.cid, zkInput.company);
+    }
+
+    // Helper to convert dynamic input to the fixed size the Verifier interface expects
+    function _verifyProof(uint256 m, ZKProofInput calldata zkInput)
+        internal
+        view
+        returns (bool)
+    {
+        address verifier = verifiers[m];
+
+        require(verifier != address(0), "unsupported_group_size");
+
+        if (m == 2) {
+            uint256[6] memory signals;
+
+            for (uint256 i = 0; i < 6; i++) {
+                signals[i] = zkInput.input[i];
+            }
+
+            return IVerifierM2(verifier).verifyProof(
+                zkInput.a,
+                zkInput.b,
+                zkInput.c,
+                signals
+            );
+        }
+
+        if (m == 3) {
+            uint256[8] memory signals;
+
+            for (uint256 i = 0; i < 8; i++) {
+                signals[i] = zkInput.input[i];
+            }
+
+            return IVerifierM3(verifier).verifyProof(
+                zkInput.a,
+                zkInput.b,
+                zkInput.c,
+                signals
+            );
+        }
+
+        if (m == 4) {
+            uint256[8] memory signals;
+
+            for (uint256 i = 0; i < 8; i++) {
+                signals[i] = zkInput.input[i];
+            }
+
+            return IVerifierM4(verifier).verifyProof(
+                zkInput.a,
+                zkInput.b,
+                zkInput.c,
+                signals
+            );
+        }
+
+        revert("invalid_group_size");
+    }
+
+    function hashPublishMessage(
+        uint256 nonce,
+        string memory cid,
+        address company,
+        address marketplace
+    ) public pure returns (uint256 hi, uint256 lo) {
+        bytes memory data = abi.encodePacked(
+            "ZK_PUBLISH_V1",
+            nonce,
+            cid,
+            company,
+            marketplace
+        );
+        bytes32 h = keccak256(data);
+        uint256 x = uint256(h);
+        lo = x & ((1 << 128) - 1);
+        hi = x >> 128;
     }
 }