feat(aztec-nr): new BoundedVec emit private log APIs (#22064)

Author: nchamo

docs/docs-developers/docs/resources/migration_notes.md

@@ -9,6 +9,33 @@ Aztec is in active development. Each version may introduce breaking changes that
 
 ## TBD
 
+### [Aztec.nr] `emit_private_log_unsafe` / `emit_raw_note_log_unsafe` are deprecated
+
+`emit_private_log_unsafe` and `emit_raw_note_log_unsafe` are deprecated and will be removed in a future release. Migrate to the new `emit_private_log_vec_unsafe` / `emit_raw_note_log_vec_unsafe` functions, which take a `BoundedVec<Field, PRIVATE_LOG_CIPHERTEXT_LEN>` instead of the `(log: [Field; PRIVATE_LOG_CIPHERTEXT_LEN], length: u32)` pair.
+
+```diff
+- context.emit_private_log_unsafe(tag, log, length);
++ context.emit_private_log_vec_unsafe(tag, bounded_vec_log);
+- context.emit_raw_note_log_unsafe(tag, log, length, note_hash_counter);
++ context.emit_raw_note_log_vec_unsafe(tag, bounded_vec_log, note_hash_counter);
+```
+
+If you were manually padding an array and passing a shorter length, you can now create a `BoundedVec` from just the meaningful fields:
+
+```diff
+- let padded = payload.concat([0; PRIVATE_LOG_CIPHERTEXT_LEN - 2]);
+- context.emit_private_log_unsafe(tag, padded, 2);
++ let log = BoundedVec::from_array(payload);
++ context.emit_private_log_vec_unsafe(tag, log);
+```
+
+If you were passing the full array, wrap it with `BoundedVec::from_array`:
+
+```diff
+- context.emit_private_log_unsafe(tag, ciphertext, ciphertext.len());
++ context.emit_private_log_vec_unsafe(tag, BoundedVec::from_array(ciphertext));
+```
+
 ### [aztec-nr] Nullifier membership witness oracle returns split types
 
 `get_nullifier_membership_witness` and `get_low_nullifier_membership_witness` now return `(NullifierLeafPreimage, MembershipWitness<NULLIFIER_TREE_HEIGHT>)` instead of the bundled `NullifierMembershipWitness` struct (which has been removed).

noir-projects/aztec-nr/aztec/src/context/private_context.nr

@@ -909,13 +909,24 @@ impl PrivateContext {
     /// happen to share a raw tag value become indistinguishable. Prefer the higher-level APIs
     /// ([`crate::messages::message_delivery::MessageDelivery`] for messages, `self.emit(event)` for events) which
     /// handle tagging automatically.
+    // TODO(F-555): remove this function in favor of `emit_private_log_vec_unsafe`
+    #[deprecated("use `emit_private_log_vec_unsafe` instead")]
     pub fn emit_private_log_unsafe(&mut self, tag: Field, log: [Field; PRIVATE_LOG_CIPHERTEXT_LEN], length: u32) {
         let counter = self.next_counter();
         let full_log = [tag].concat(log);
         self.private_logs.push(PrivateLogData { log: PrivateLog::new(full_log, length + 1), note_hash_counter: 0 }
             .count(counter));
     }
 
+    /// `BoundedVec`-based variant of [`emit_private_log_unsafe`](PrivateContext::emit_private_log_unsafe).
+    ///
+    /// See [`emit_private_log_unsafe`](PrivateContext::emit_private_log_unsafe) for the full description of private
+    /// log semantics.
+    // TODO(F-555): once `emit_private_log_unsafe` is removed, rename this function to drop the `_vec` suffix.
+    pub fn emit_private_log_vec_unsafe(&mut self, tag: Field, log: BoundedVec<Field, PRIVATE_LOG_CIPHERTEXT_LEN>) {
+        self.emit_raw_note_log_vec_unsafe(tag, log, 0);
+    }
+
     // TODO: rename.
     /// Emits a private log that is explicitly tied to a newly-emitted note_hash, to convey to the kernel: "this log
     /// relates to this note".
@@ -938,6 +949,8 @@ impl PrivateContext {
     /// ## Safety
     ///
     /// Same as [`PrivateContext::emit_private_log_unsafe`]: the `tag` should be domain-separated.
+    // TODO(F-555): remove this function in favor of `emit_raw_note_log_vec_unsafe`
+    #[deprecated("use `emit_raw_note_log_vec_unsafe` instead")]
     pub fn emit_raw_note_log_unsafe(
         &mut self,
         tag: Field,
@@ -951,6 +964,23 @@ impl PrivateContext {
         self.private_logs.push(private_log.count(counter));
     }
 
+    /// `BoundedVec`-based variant of [`emit_raw_note_log_unsafe`](PrivateContext::emit_raw_note_log_unsafe).
+    ///
+    /// See [`emit_raw_note_log_unsafe`](PrivateContext::emit_raw_note_log_unsafe) for the full description of
+    /// note-tied private log semantics.
+    // TODO(F-555): once `emit_raw_note_log_unsafe` is removed, rename this function to drop the `_vec` suffix.
+    pub fn emit_raw_note_log_vec_unsafe(
+        &mut self,
+        tag: Field,
+        log: BoundedVec<Field, PRIVATE_LOG_CIPHERTEXT_LEN>,
+        note_hash_counter: u32,
+    ) {
+        let counter = self.next_counter();
+        let full_log = [tag].concat(log.storage());
+        let private_log = PrivateLogData { log: PrivateLog::new(full_log, log.len() + 1), note_hash_counter };
+        self.private_logs.push(private_log.count(counter));
+    }
+
     /// Emits large data blobs.
     ///
     /// This reuses the Contract Class Log channel to emit blobs of up to [`CONTRACT_CLASS_LOG_SIZE_IN_FIELDS`].

noir-projects/aztec-nr/aztec/src/messages/message_delivery.nr

@@ -192,6 +192,11 @@ pub global MessageDelivery: MessageDeliveryEnum =
 /// be created, there is no point in delivering the message.
 ///
 /// `delivery_mode` must be one of [`MessageDeliveryEnum`].
+///
+/// ## Privacy
+///
+/// The emitted log always has the same length regardless of `MESSAGE_PLAINTEXT_LEN`, because all message ciphertexts
+/// also have the same length. This prevents accidental privacy leakage via the log length.
 pub fn do_private_message_delivery<Env, let MESSAGE_PLAINTEXT_LEN: u32>(
     context: &mut PrivateContext,
     encode_into_message_plaintext: fn[Env]() -> [Field; MESSAGE_PLAINTEXT_LEN],
@@ -211,6 +216,7 @@ pub fn do_private_message_delivery<Env, let MESSAGE_PLAINTEXT_LEN: u32>(
     let _constrained_tagging = delivery_mode == MessageDelivery.ONCHAIN_CONSTRAINED;
 
     let contract_address = context.this_address();
+
     let ciphertext = remove_constraints_if(
         !constrained_encryption,
         || AES128::encrypt(encode_into_message_plaintext(), recipient, contract_address),
@@ -231,15 +237,13 @@ pub fn do_private_message_delivery<Env, let MESSAGE_PLAINTEXT_LEN: u32>(
         // we're emitting a note or non-note message.
         assert_constant(maybe_note_hash_counter.is_some());
 
+        let log = BoundedVec::from_array(ciphertext);
         if maybe_note_hash_counter.is_some() {
             // We associate the log with the note's side effect counter, so that if the note ends up being squashed in
             // the current transaction, the log will be removed as well.
-            //
-            // Note that the log always has the same length regardless of `MESSAGE_PLAINTEXT_LEN`, because all message
-            // ciphertexts also have the same length. This prevents accidental privacy leakage via the log length.
-            context.emit_raw_note_log_unsafe(log_tag, ciphertext, ciphertext.len(), maybe_note_hash_counter.unwrap());
+            context.emit_raw_note_log_vec_unsafe(log_tag, log, maybe_note_hash_counter.unwrap());
         } else {
-            context.emit_private_log_unsafe(log_tag, ciphertext, ciphertext.len());
+            context.emit_private_log_vec_unsafe(log_tag, log);
         }
     }
 }

noir-projects/aztec-nr/uint-note/src/uint_note.nr

@@ -10,10 +10,7 @@ use aztec::{
     oracle::random::random,
     protocol::{
         address::AztecAddress,
-        constants::{
-            DOM_SEP__NOTE_COMPLETION_LOG_TAG, DOM_SEP__NOTE_HASH, DOM_SEP__PARTIAL_NOTE_VALIDITY_COMMITMENT,
-            PRIVATE_LOG_CIPHERTEXT_LEN,
-        },
+        constants::{DOM_SEP__NOTE_COMPLETION_LOG_TAG, DOM_SEP__NOTE_HASH, DOM_SEP__PARTIAL_NOTE_VALIDITY_COMMITMENT},
         hash::{compute_log_tag, compute_siloed_nullifier, poseidon2_hash_with_separator},
         traits::{Deserialize, FromField, Hash, Packable, Serialize, ToField},
     },
@@ -171,8 +168,6 @@ pub struct PartialUintNote {
 }
 // docs:end:partial_uint_note_def
 
-global NOTE_COMPLETION_PAYLOAD_LENGTH: u32 = 2;
-
 impl PartialUintNote {
     /// Completes the partial note, creating a new note that can be used like any other UintNote.
     pub fn complete(self, context: PublicContext, completer: AztecAddress, storage_slot: Field, value: u128) {
@@ -228,8 +223,8 @@ impl PartialUintNote {
         // only done in private to hide the preimage of the hash that is inserted, but completed partial notes are
         // inserted in public as the public values are provided and the note hash computed.
         let log_tag = compute_log_tag(self.commitment, DOM_SEP__NOTE_COMPLETION_LOG_TAG);
-        let padded_payload = self.compute_note_completion_payload_padded_for_private_log(storage_slot, value);
-        context.emit_private_log_unsafe(log_tag, padded_payload, NOTE_COMPLETION_PAYLOAD_LENGTH);
+        let payload = BoundedVec::from_array([storage_slot, value.to_field()]);
+        context.emit_private_log_vec_unsafe(log_tag, payload);
         context.push_note_hash(self.compute_complete_note_hash(storage_slot, value));
     }
 
@@ -245,15 +240,6 @@ impl PartialUintNote {
         )
     }
 
-    fn compute_note_completion_payload_padded_for_private_log(
-        _self: Self,
-        storage_slot: Field,
-        value: u128,
-    ) -> [Field; PRIVATE_LOG_CIPHERTEXT_LEN] {
-        let payload = [storage_slot, value.to_field()];
-        payload.concat([0; PRIVATE_LOG_CIPHERTEXT_LEN - NOTE_COMPLETION_PAYLOAD_LENGTH])
-    }
-
     // docs:start:compute_complete_note_hash
     fn compute_complete_note_hash(self, storage_slot: Field, value: u128) -> Field {
         // Here we finalize the note hash by including the (public) storage slot and value into the partial note

noir-projects/noir-contracts/contracts/account/simulated_ecdsa_account_contract/src/main.nr

@@ -39,10 +39,9 @@ pub contract SimulatedEcdsaAccount {
         // and is therefore never nullified, so in practice the log will never be squashed. We
         // pass the note hash counter anyway for correctness.
         let dummy_log: [Field; MESSAGE_CIPHERTEXT_LEN] = [seed + 2; MESSAGE_CIPHERTEXT_LEN];
-        self.context.emit_raw_note_log_unsafe(
+        self.context.emit_raw_note_log_vec_unsafe(
             seed + 3,
-            dummy_log,
-            MESSAGE_CIPHERTEXT_LEN,
+            BoundedVec::from_array(dummy_log),
             self.context.side_effect_counter,
         );
     }

noir-projects/noir-contracts/contracts/account/simulated_schnorr_account_contract/src/main.nr

@@ -39,10 +39,9 @@ pub contract SimulatedSchnorrAccount {
         // and is therefore never nullified, so in practice the log will never be squashed. We
         // pass the note hash counter anyway for correctness.
         let dummy_log: [Field; MESSAGE_CIPHERTEXT_LEN] = [seed + 2; MESSAGE_CIPHERTEXT_LEN];
-        self.context.emit_raw_note_log_unsafe(
+        self.context.emit_raw_note_log_vec_unsafe(
             seed + 3,
-            dummy_log,
-            MESSAGE_CIPHERTEXT_LEN,
+            BoundedVec::from_array(dummy_log),
             self.context.side_effect_counter,
         );
     }

noir-projects/noir-contracts/contracts/test/benchmarking_contract/src/main.nr

@@ -110,11 +110,11 @@ pub contract Benchmarking {
         let random_seed = unsafe { random() };
 
         for i in 0..MAX_PRIVATE_LOGS_PER_CALL {
-            let mut log = [0; PRIVATE_LOG_CIPHERTEXT_LEN];
+            let mut log: BoundedVec<Field, PRIVATE_LOG_CIPHERTEXT_LEN> = BoundedVec::new();
             for j in 0..PRIVATE_LOG_CIPHERTEXT_LEN {
-                log[j] = random_seed + (i * MAX_PRIVATE_LOGS_PER_CALL + j) as Field;
+                log.push(random_seed + (i * MAX_PRIVATE_LOGS_PER_CALL + j) as Field);
             }
-            self.context.emit_private_log_unsafe(0, log, PRIVATE_LOG_CIPHERTEXT_LEN);
+            self.context.emit_private_log_vec_unsafe(0, log);
         }
     }
 

noir-projects/noir-contracts/contracts/test/test_contract/src/main.nr

@@ -31,7 +31,7 @@ pub contract Test {
         protocol::{
             abis::function_selector::FunctionSelector,
             address::{AztecAddress, EthAddress},
-            constants::{PRIVATE_LOG_CIPHERTEXT_LEN, MAX_PUBLIC_LOG_SIZE_IN_FIELDS},
+            constants::MAX_PUBLIC_LOG_SIZE_IN_FIELDS,
             traits::{Hash, Packable, Serialize},
         },
         // Event related
@@ -347,8 +347,8 @@ pub contract Test {
             self.call_self.emit_array_as_encrypted_log(tag, [0, 0, 0, 0, 0], owner, false);
 
             // Emit a log with non-encrypted content for testing purpose.
-            let leaky_log = event.serialize().concat([0; PRIVATE_LOG_CIPHERTEXT_LEN - 5]);
-            self.context.emit_private_log_unsafe(tag, leaky_log, 5);
+            let leaky_log = BoundedVec::from_array(event.serialize());
+            self.context.emit_private_log_vec_unsafe(tag, leaky_log);
         }
     }