Groth16 prover written in Nim

This is Groth16 prover implementation in Nim, using the constantine library as an arithmetic / curve backend.

The implementation is compatible with the circom + snarkjs ecosystem.

At the moment only the BN254 (aka. alt-bn128) curve is supported.

License

Licensed and distributed under either of the MIT license or Apache License, v2.0, at your choice.

TODO

• find and fix the second totally surreal bug
• clean up the code
• make it compatible with the latest constantine and also Nim 2.0.x
• make it a nimble package
• compare .r1cs to the "coeffs" section of .zkey
• generate fake circuit-specific setup ourselves
• make a CLI interface
• multithreading support (MSM, and possibly also FFT)
• add Groth16 notes
• document the snarkjs circuit-specific setup H points convention
• make it work for different curves