Recursive Merkle proofs

src/gadgets/hash.rs

@@ -7,6 +7,7 @@ use crate::hash::GMIMC_ROUNDS;
 use crate::target::Target;
 use crate::wire::Wire;
 
+// TODO: Move to be next to native `permute`?
 impl<F: Field> CircuitBuilder<F> {
     pub fn permute(&mut self, inputs: [Target; 12]) -> [Target; 12] {
         let zero = self.zero();

src/gadgets/mod.rs

@@ -1,4 +1,3 @@
 pub mod arithmetic;
 pub mod hash;
-pub(crate) mod merkle_proofs;
 pub(crate) mod split_join;

src/hash.rs

@@ -6,8 +6,10 @@ use rayon::prelude::*;
 
 use crate::field::field::Field;
 use crate::gmimc::gmimc_permute_array;
-use crate::proof::Hash;
+use crate::proof::{Hash, HashTarget};
 use crate::util::reverse_index_bits_in_place;
+use crate::circuit_builder::CircuitBuilder;
+use crate::target::Target;
 
 pub(crate) const SPONGE_RATE: usize = 8;
 pub(crate) const SPONGE_CAPACITY: usize = 4;
@@ -25,7 +27,7 @@ const ELEMS_PER_CHUNK: usize = 1 << 8;
 
 /// Hash the vector if necessary to reduce its length to ~256 bits. If it already fits, this is a
 /// no-op.
-pub fn hash_or_noop<F: Field>(mut inputs: Vec<F>) -> Hash<F> {
+pub fn hash_or_noop<F: Field>(inputs: Vec<F>) -> Hash<F> {
     if inputs.len() <= 4 {
         Hash::from_partial(inputs)
     } else {
@@ -33,6 +35,21 @@ pub fn hash_or_noop<F: Field>(mut inputs: Vec<F>) -> Hash<F> {
     }
 }
 
+impl<F: Field> CircuitBuilder<F> {
+    pub fn hash_or_noop(&mut self, inputs: Vec<Target>) -> HashTarget {
+        let zero = self.zero();
+        if inputs.len() <= 4 {
+            HashTarget::from_partial(inputs, zero)
+        } else {
+            self.hash_n_to_hash(inputs, false)
+        }
+    }
+
+    pub fn hash_n_to_hash(&mut self, inputs: Vec<Target>, pad: bool) -> HashTarget {
+        todo!()
+    }
+}
+
 /// A one-way compression function which takes two ~256 bit inputs and returns a ~256 bit output.
 pub fn compress<F: Field>(x: Hash<F>, y: Hash<F>) -> Hash<F> {
     let mut inputs = Vec::with_capacity(8);

src/lib.rs

@@ -8,6 +8,7 @@ pub mod gates;
 pub mod generator;
 pub mod gmimc;
 pub mod hash;
+pub mod merkle_proofs;
 pub mod plonk_challenger;
 pub mod plonk_common;
 pub mod polynomial;

src/merkle_proofs.rs

@@ -53,7 +53,8 @@ impl<F: Field> CircuitBuilder<F> {
         let height = proof.siblings.len();
         let purported_index_bits = self.split_le_virtual(leaf_index, height);
 
-        let mut state: Vec<Target> = todo!(); // hash leaf data
+        let mut state: HashTarget = self.hash_or_noop(leaf_data);
+        let mut acc_leaf_index = zero;
 
         for (bit, sibling) in purported_index_bits.into_iter().zip(proof.siblings) {
             let gate = self.add_gate_no_constants(
@@ -63,26 +64,39 @@ impl<F: Field> CircuitBuilder<F> {
             let swap_wire = Target::Wire(Wire { gate, input: swap_wire });
             self.generate_copy(bit, swap_wire);
 
+            let old_acc_wire = GMiMCGate::<F, GMIMC_ROUNDS>::WIRE_INDEX_ACCUMULATOR_OLD;
+            let old_acc_wire = Target::Wire(Wire { gate, input: old_acc_wire });
+            self.route(acc_leaf_index, old_acc_wire);
+
+            let new_acc_wire = GMiMCGate::<F, GMIMC_ROUNDS>::WIRE_INDEX_ACCUMULATOR_NEW;
+            let new_acc_wire = Target::Wire(Wire { gate, input: new_acc_wire });
+            acc_leaf_index = new_acc_wire;
+
             let input_wires = (0..12)
                 .map(|i| Target::Wire(
                     Wire { gate, input: GMiMCGate::<F, GMIMC_ROUNDS>::wire_input(i) }))
                 .collect::<Vec<_>>();
 
             for i in 0..4 {
-                self.route(state[i], input_wires[i]);
+                self.route(state.elements[i], input_wires[i]);
                 self.route(sibling.elements[i], input_wires[4 + i]);
                 self.route(zero, input_wires[8 + i]);
             }
 
-            state = (0..4)
+            state = HashTarget::from_vec((0..4)
                 .map(|i| Target::Wire(
                     Wire { gate, input: GMiMCGate::<F, GMIMC_ROUNDS>::wire_output(i) }))
-                .collect::<Vec<_>>()
-                .try_into()
-                .unwrap();
+                .collect())
         }
 
-        // TODO: Verify that weighted sum of bits matches index.
-        // TODO: Verify that state matches merkle root.
+        self.assert_equal(acc_leaf_index, leaf_index);
+
+        self.assert_hashes_equal(state, merkle_root)
+    }
+
+    pub(crate) fn assert_hashes_equal(&mut self, x: HashTarget, y: HashTarget) {
+        for i in 0..4 {
+            self.assert_equal(x.elements[i], y.elements[i]);
+        }
     }
 }

src/proof.rs

@@ -1,6 +1,7 @@
 use crate::field::field::Field;
 use crate::target::Target;
-use crate::gadgets::merkle_proofs::{MerkleProofTarget, MerkleProof};
+use crate::merkle_proofs::{MerkleProofTarget, MerkleProof};
+use std::convert::TryInto;
 
 /// Represents a ~256 bit hash output.
 #[derive(Copy, Clone, Debug, Eq, PartialEq)]
@@ -20,7 +21,22 @@ impl<F: Field> Hash<F> {
 
 /// Represents a ~256 bit hash output.
 pub struct HashTarget {
-    pub(crate) elements: Vec<Target>,
+    pub(crate) elements: [Target; 4],
+}
+
+impl HashTarget {
+    pub(crate) fn from_vec(elements: Vec<Target>) -> Self {
+        debug_assert!(elements.len() == 4);
+        HashTarget { elements: elements.try_into().unwrap() }
+    }
+
+    pub(crate) fn from_partial(mut elements: Vec<Target>, zero: Target) -> Self {
+        debug_assert!(elements.len() <= 4);
+        while elements.len() < 4 {
+            elements.push(zero);
+        }
+        Self { elements: [elements[0], elements[1], elements[2], elements[3]] }
+    }
 }
 
 pub struct Proof<F: Field> {