Groth16 prover written in Nim

This is Groth16 prover implementation in Nim, using the constantine library as an arithmetic / curve backend.

The implementation is compatible with the circom + snarkjs ecosystem.

At the moment only the BN254 (aka. alt-bn128) curve is supported.

License

Licensed and distributed under either of the MIT license or Apache License, v2.0, at your choice.

TODO

• clean up the code
• make it a nimble package
• [/] refactor bn128.nim into smaller files
• [/] proper MSM implementation (at first I couldn't make constantine's one to work)
• compare .r1cs to the "coeffs" section of .zkey
• generate fake circuit-specific setup ourselves
• multithreading support (MSM, and possibly also FFT)
• add Groth16 notes
• document the snarkjs circuit-specific setup H points convention
• make it work for different curves