feat(stm): implement 'SnarkVerifierSetup' in unsafe helpers

Author: jpraynaud

mithril-stm/src/proof_system/halo2_snark/mod.rs

@@ -19,7 +19,7 @@ pub use proof::SnarkProof;
 pub(crate) use proof::SnarkProver;
 pub(crate) use signer::SnarkProofSigner;
 pub(crate) use single_signature::SingleSignatureForSnark;
-pub(crate) use unsafe_helpers::SnarkSetup;
+pub(crate) use unsafe_helpers::{SnarkSetup, SnarkVerifierSetup};
 
 /// Fixed merkle tree depth used of the merkle tree
 /// of signers for the SNARK proof. It is used to compute

mithril-stm/src/proof_system/halo2_snark/proof.rs

@@ -22,7 +22,7 @@ use crate::{
     },
 };
 
-use super::{SnarkClerk, SnarkSetup};
+use super::{SnarkClerk, SnarkSetup, SnarkVerifierSetup};
 
 /// `SnarkProof` contains a proof generated by the certificate circuit represented as a vector of
 /// bytes. It can be verified using verifier parameters derived from the srs, the circuit verification key
@@ -65,9 +65,9 @@ impl<D: MembershipDigest> SnarkProof<D> {
     /// Verify a SNARK proof given a message, an aggregate verification key for snark
     /// and a circuit verification key
     ///
-    /// For now, we generate a temporary SnarkSetup inside the function to get access
-    /// to the srs and generate the verifier parameters. This part will be removed once
-    /// the circuit is stable and the srs is stored and available.
+    /// The KZG verifier params are loaded from a hard-coded constant derived from the
+    /// deterministic unsafe SNARK setup (seed 42), so verification does not need to load
+    /// or regenerate the full SRS.
     ///
     /// This proof verifies that there exists a witness such that:
     /// * each signatures in the witness is valid for the given message
@@ -81,14 +81,14 @@ impl<D: MembershipDigest> SnarkProof<D> {
         message: &[u8],
         aggregate_verification_key_for_snark: &AggregateVerificationKeyForSnark<D>,
     ) -> StmResult<()> {
-        let snark_setup = SnarkSetup::try_new(&self.params, MERKLE_TREE_DEPTH_FOR_SNARK)?;
+        let verifier_setup = SnarkVerifierSetup::try_new()?;
 
         let merkle_root = &aggregate_verification_key_for_snark.get_merkle_tree_commitment().root;
         let proof_message = build_snark_message(merkle_root, message)?;
         let proof_instance = (proof_message[0].into(), proof_message[1].into());
 
         let verify_result = zk::verify::<StmCertificateCircuit, PoseidonState<CircuitBase>>(
-            &snark_setup.srs.verifier_params(),
+            &verifier_setup.verifier_params,
             &self.circuit_verification_key.get_midnight_vk(),
             &proof_instance,
             None,

mithril-stm/src/proof_system/halo2_snark/unsafe_helpers.rs

@@ -13,7 +13,10 @@ use std::{
 
 use anyhow::{Context, anyhow};
 use midnight_curves::Bls12;
-use midnight_proofs::{poly::kzg::params::ParamsKZG, utils::SerdeFormat};
+use midnight_proofs::{
+    poly::kzg::params::{ParamsKZG, ParamsVerifierKZG},
+    utils::SerdeFormat,
+};
 use midnight_zk_stdlib::{self as zk, MidnightCircuit, MidnightPK, MidnightVK};
 use rand_chacha::ChaCha20Rng;
 use rand_core::SeedableRng;
@@ -98,6 +101,71 @@ impl SnarkSetup {
     }
 }
 
+/// Bundles the minimal setup artifacts needed to verify SNARK proofs.
+///
+/// Only the KZG verifier parameters are required for verification, and they depend solely on the
+/// toxic secret `s = Fq::random(ChaCha20Rng::seed_from_u64(42))`. That secret is independent of
+/// the circuit degree `k`, so a single hard-coded serialization of `s_g2` suffices for every
+/// circuit produced by the deterministic unsafe setup.
+pub(crate) struct SnarkVerifierSetup {
+    /// KZG verifier parameters derived from `s_g2`.
+    pub(crate) verifier_params: ParamsVerifierKZG<Bls12>,
+}
+
+/// Serialized `s_g2` (the only material the KZG verifier needs) for the deterministic SNARK setup
+/// seeded with `ChaCha20Rng::seed_from_u64(42)`.
+///
+/// Regenerate by running the `golden_snark_verifier_params_bytes` test and copying its printed
+/// decimal byte sequence.
+const SNARK_VERIFIER_PARAMS_BYTES: [u8; 192] = [
+    9, 133, 52, 70, 100, 186, 221, 42, 162, 210, 65, 103, 250, 71, 142, 192, 58, 111, 199, 110,
+    176, 91, 161, 195, 250, 201, 221, 136, 183, 74, 68, 204, 221, 93, 8, 139, 182, 151, 92, 6, 168,
+    223, 75, 16, 6, 248, 229, 53, 10, 219, 248, 43, 58, 117, 134, 19, 245, 109, 69, 25, 218, 98,
+    249, 7, 90, 223, 221, 136, 43, 53, 243, 90, 85, 245, 50, 71, 17, 145, 52, 137, 36, 165, 195,
+    133, 133, 41, 248, 60, 251, 3, 44, 200, 150, 47, 121, 34, 9, 231, 248, 39, 163, 121, 37, 113,
+    212, 227, 126, 233, 45, 198, 96, 170, 240, 47, 77, 250, 32, 66, 193, 18, 103, 251, 89, 161,
+    202, 162, 45, 89, 203, 163, 70, 170, 27, 1, 80, 237, 9, 87, 173, 20, 38, 94, 11, 146, 14, 217,
+    151, 197, 170, 203, 108, 179, 227, 90, 187, 9, 128, 97, 0, 213, 149, 128, 132, 129, 179, 255,
+    247, 26, 178, 177, 112, 81, 142, 4, 53, 235, 114, 223, 242, 209, 244, 23, 177, 150, 185, 252,
+    175, 141, 204, 205, 242, 78,
+];
+
+impl SnarkVerifierSetup {
+    /// Build the verifier setup from the embedded constant verifier params bytes.
+    pub(crate) fn try_new() -> StmResult<Self> {
+        let verifier_params = ParamsVerifierKZG::<Bls12>::read(
+            &mut &SNARK_VERIFIER_PARAMS_BYTES[..],
+            SerdeFormat::RawBytesUnchecked,
+        )
+        .with_context(|| "Failed to read embedded SNARK verifier params bytes")?;
+
+        Ok(Self { verifier_params })
+    }
+}
+
+/// Compute the deterministic verifier params bytes for the unsafe SNARK setup seeded with
+/// `ChaCha20Rng::seed_from_u64(42)`.
+///
+/// Kept available so the embedded `SNARK_VERIFIER_PARAMS_BYTES` constant can be regenerated by
+/// running the `golden_snark_verifier_params_bytes` test.
+#[cfg(test)]
+fn compute_snark_verifier_params_bytes() -> StmResult<Vec<u8>> {
+    use ff::Field;
+    use group::Group;
+    use midnight_curves::{Fq, G2Projective};
+    use midnight_proofs::utils::helpers::ProcessedSerdeObject;
+
+    let mut rng = ChaCha20Rng::seed_from_u64(42);
+    let s = Fq::random(&mut rng);
+    let s_g2 = G2Projective::generator() * s;
+
+    let mut buf = Vec::new();
+    s_g2.write(&mut buf, SerdeFormat::RawBytesUnchecked)
+        .with_context(|| "Failed to serialize s_g2")?;
+
+    Ok(buf)
+}
+
 /// Load the KZG SRS from `path`, or generate one with an unsafe deterministic seed
 /// if the file does not exist. When generated, the result is persisted to `path` so
 /// subsequent calls can load it quickly.
@@ -183,7 +251,11 @@ mod test {
         proof_system::halo2_snark::SnarkSetup,
     };
 
-    use super::{SnarkSetupCacheKey, get_or_build_snark_keys, load_or_generate_srs, persist_srs};
+    use super::{
+        SNARK_VERIFIER_PARAMS_BYTES, SnarkSetupCacheKey, SnarkVerifierSetup,
+        compute_snark_verifier_params_bytes, get_or_build_snark_keys, load_or_generate_srs,
+        persist_srs,
+    };
 
     fn small_srs() -> ParamsKZG<Bls12> {
         ParamsKZG::unsafe_setup(3, ChaCha20Rng::seed_from_u64(42))
@@ -328,4 +400,19 @@ mod test {
             "same parameters must produce the same verification key"
         );
     }
+
+    #[test]
+    fn golden_snark_verifier_params_bytes() {
+        let bytes = compute_snark_verifier_params_bytes().unwrap();
+        println!("SNARK_VERIFIER_PARAMS_BYTES len = {}", bytes.len());
+        println!("SNARK_VERIFIER_PARAMS_BYTES hex = {}", hex::encode(&bytes));
+
+        assert_eq!(
+            bytes.as_slice(),
+            &SNARK_VERIFIER_PARAMS_BYTES,
+            "computed verifier params bytes do not match the hard-coded constant"
+        );
+
+        let _ = SnarkVerifierSetup::try_new().expect("verifier setup must build from constant");
+    }
 }