sync - #28
Merged
Merged
Conversation
# Summary
Implements cut-and-choose (C&C) protocol for secure garbled circuit evaluation of Groth16 verifier, with streaming compression and performance optimizations.
# Key Changes
Core Protocol Implementation
- Cut-and-choose module (src/groth16_cut_and_choose.rs): Full C&C protocol with garbler/evaluator roles
- Compressed streaming: New compression API for ciphertexts using Blake3/AES hashers
- Examples: Three new examples demonstrating C&C workflow:
- groth16_cut_and_choose.rs: Complete C&C protocol
- groth16_garble_with_compress.rs: Compressed garbling
- groth16_cc_eval_only.rs: Evaluation from file saved on C&C phase
# Performance Optimizations
- CPU pinning: Rayon threads pinned to physical cores for better cache locality
- Hasher improvements: Generic hasher interface with Blake3/AES options
# Infrastructure Updates
- Logging migration: log → tracing for structured logging
- Monitor improvements: Enhanced gates monitor with per-instance tracking for C&C
- API changes: Closure-driven garbling API for better flexibility
# Testing
All existing tests pass. New C&C functionality tested via examples.
# Performance Impact
Each garble now takes 4m 30s, paralleling in C&C on physical cores does not slow down the speed. So 181 instance takes about an 66m on 16 physical cores
Part of #37
* feat: vsss
- port the verifiable secret sharing implementation onto arkworks - `cac::tests::test_full_flow` runtime dropped 1.591s -> 0.162s (~9.8x faster) - move bitcoin staff into tests-only
In case you are doing a full C&C with intermediate state preservation you need all types to serialize and deserialize, this PR fixes the flaw that some types didn't do that
* opt: evaluation with interpolation * fix: comment typo
* opt: evaluation with interpolation * fix: comment typo * opt: change polynomials to the point form to eliminate elliptic curve operations * opt: msm's with tables * opt: add negative digits to msm * opt: memory usage of MSM tables
* feat: zero-pub-input * feat(c&c): hex for ark_ types in ser/deser * fix(c&c): arkwork types ser/deser problem * fix: ciphertext file handler final file size * feat(c&c): commit per each input label * fix(script): evaluated parse * feat(garbled_groth16): `EvaluatorCompressedInput::iter_active_labels` * feat(c&c): generic commit scheme for `Evaluator` * feat(groth16): optimize verification for empty public inputs Skip MSM computation when public inputs are empty, using simplified pairing equation with precomputed constants. Add comprehensive tests for this optimization path covering both valid and invalid proofs. * feat(gc): impl `Evaluator::commits` * feat(gc): impl `Garbler::output_wire` * chore: bump to v0.4.0 * revert: attempt to optimize the empty pp * refactor(c&c): simplify `trait LabelCommitHasher`
* implement multigarbling * add flag to on/off queue fix style, and some error * remove non-free queue, add MultiCiphertextHandler to optimize hashing * fix: multigarbling equivalence and add examples * fix: refactor, add some equivalence tests for gadgets and rustdoc for garble_gate_batch * fix: small fixes * chore: fmt, clippy * chore: comments
* feat(soldering): enable soldering module * chore: bump version * feat(c&c): mv nonce from evaluator to garbler state * ci: refresh workflows for sp1 toolchain * ci: prime SP1 by running full workspace build in release before clippy; clippy with all features * chore: rm redundant logs * fix(c&c): evaluator size check * fix: CI * chore: fmt * fix: CI * test(soldering): execute-test * feat(soldering): migrate rkyv -> bincode * test(soldering): `test_pp_serialization_consistency` * fix(soldering): bincode usage for public input * feat: test-utils feature * fix(ci): removed clippy duplication feat(cut-and-choose): add Garbler commitment inspection methods * feat(cut-and-choose): add Evaluator commitment inspection methods Add two new methods to Evaluator for commitment transparency: - verified_soldered_base_commitment(): Returns verified input wire commitments for base instance after soldering verification - finalized_output_label_commitment(): Returns output label commitments (true, false) for all finalized instances Methods enable external verification and audit of commitments from the Evaluator side after verification stages complete. * test: disable long tests for gadgets * refactor(cut-and-choose): rename run_regarbling to full_check_commit Rename run_regarbling() to full_check_commit() to better describe the comprehensive verification behavior. This method verifies both finalized instances (ciphertext hash) and opened instances (re-garbling + commit verification) as a critical security step in cut-and-choose protocol. Updated all call sites: - src/cut_and_choose/evaluator.rs (definition) - src/cut_and_choose/groth16.rs (wrapper) - src/cut_and_choose/tests.rs (2 test cases) - examples/groth16_cut_and_choose.rs (example usage) * test: disable long tests for gadgets * fix(ci): check unused deps without sp1 * feat: add test-utils with groth16 `dummy_vk` * feat: add public API methods for cut-and-choose protocol - Add Serialize/Deserialize to SolderingProof - Export WireDelta, Commitment, OpenCommit types - Add CommitPhaseOne::new(), CommitPhaseTwo::new() - Add Garbler methods: get_commitment(), finalized_indexes(), soldered_base_commitment(), finalized_output_label_commitment(), open_commit_without_ciphertexts() - Add Evaluator methods: get_commitment(), get_commit_phase_one(), finalized_output_label_commitment() - Add Groth16 wrapper methods - Fix Evaluator::from_raw_parts parameter type - Remove unused imports * fix(example): simplify c&c example with soldering * fix(ci): unused sp1 dependencies without feature * feat(c&c): add run_regarbling method for opened instances verification Add run_regarbling method to Evaluator that performs regarbling verification only for opened instances (non-finalized), without checking ciphertext commits. This provides a faster alternative to full_check_commit when ciphertext verification is not needed. - Add run_regarbling to generic Evaluator in evaluator.rs - Add Groth16-specific wrapper in groth16.rs - Uses same rayon-driven parallel approach as full_check_commit - Verifies both phase one and phase two commitments for opened instances * chore: cleaned up the bulk logs * feat(c&c): allow soldering & regarbling in a different order
[no ci]
) Implements native arkworks verification and proof reconstruction from compressed evaluated wire representation, enabling verification without garbled circuit execution. Added methods: - verify(): Convenient native Groth16 verification returning bool result without garbled circuit execution - to_proof(): Reconstructs full proof by converting bits to field elements and decompressing G1/G2 points from (x, y_flag) format - to_public_inputs(): Restores public parameters from evaluated wires Includes round-trip consistency tests verifying exact reconstruction and cryptographic validity of proofs.
eyusufatik
approved these changes
Dec 5, 2025
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
7 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.