#include <cstddef>
#include <cstdint>
#include <gtest/gtest.h>
#include <vector>
#include "barretenberg/commitment_schemes/ipa/ipa.hpp"
#include "barretenberg/commitment_schemes/verification_key.hpp"
#include "barretenberg/eccvm/eccvm_circuit_builder.hpp"
#include "barretenberg/eccvm/eccvm_prover.hpp"
#include "barretenberg/eccvm/eccvm_test_utils.hpp"
#include "barretenberg/eccvm/eccvm_verifier.hpp"
#include "barretenberg/flavor/test_utils/proof_structures.hpp"
#include "barretenberg/honk/library/grand_product_delta.hpp"
#include "barretenberg/numeric/uint256/uint256.hpp"
#include "barretenberg/relations/ecc_vm/ecc_bools_relation_impl.hpp"
#include "barretenberg/relations/ecc_vm/ecc_lookup_relation_impl.hpp"
#include "barretenberg/relations/ecc_vm/ecc_msm_relation_impl.hpp"
#include "barretenberg/relations/ecc_vm/ecc_point_table_relation_impl.hpp"
#include "barretenberg/relations/ecc_vm/ecc_set_relation_impl.hpp"
#include "barretenberg/relations/ecc_vm/ecc_transcript_relation_impl.hpp"
#include "barretenberg/relations/ecc_vm/ecc_wnaf_relation_impl.hpp"
#include "barretenberg/relations/permutation_relation.hpp"
#include "barretenberg/relations/relation_parameters.hpp"
#include "barretenberg/srs/factories/grumpkin_srs_gen.hpp"
#include "barretenberg/srs/global_crs.hpp"
#include "barretenberg/sumcheck/sumcheck.hpp"
#include "barretenberg/sumcheck/sumcheck_round.hpp"

Classes
class	ECCVMTests

Typedefs
using	FF = ECCVMFlavor::FF

using	PK = ECCVMFlavor::ProvingKey

using	Transcript = ECCVMFlavor::Transcript

using	ECCVMVerifier = ECCVMVerifier_< ECCVMFlavor >

using	PCS = IPA< ECCVMFlavor::Curve, CONST_ECCVM_LOG_N >

Functions
ECCVMFlavor::VerificationKey	create_vk_from_proving_key (const std::shared_ptr< PK > &proving_key)

ECCVMFlavor::BF	compute_eccvm_vk_hash ()

ECCVMCircuitBuilder	generate_circuit (numeric::RNG *engine=nullptr)
	Adds operations in BN254 to the op_queue and then constructs and ECCVM circuit from the op_queue.

ECCVMCircuitBuilder	generate_zero_circuit (numeric::RNG *engine=nullptr, bool zero_scalars=1)

void	complete_proving_key_for_test (bb::RelationParameters< FF > &relation_parameters, std::shared_ptr< PK > &pk, std::vector< FF > &gate_challenges)

	TEST_F (ECCVMTests, ZeroesCoefficients)

	TEST_F (ECCVMTests, MissingHidingOpThrows)

	TEST_F (ECCVMTests, NullOpQUeue)

	TEST_F (ECCVMTests, PointAtInfinity)

	TEST_F (ECCVMTests, ShortMonomialProverVerifies)

	TEST_F (ECCVMTests, ShortMonomialRelationsMatchFullEdgeRelations)

	TEST_F (ECCVMTests, ScalarEdgeCase)

	TEST_F (ECCVMTests, ProofLengthCheck)
	Check that size of a ECCVM proof matches the corresponding constant.

	TEST_F (ECCVMTests, BaseCaseFixedSize)

	TEST_F (ECCVMTests, EqFailsFixedSize)

	TEST_F (ECCVMTests, CommittedSumcheck)

	TEST_F (ECCVMTests, BaseInfinityForgedCoordinatesRejected)
	Regression test: transcript_base_infinity soundness vulnerability.

	TEST_F (ECCVMTests, FixedVK)
	Test that the fixed VK from the default constructor agrees with the one computed for an arbitrary circuit.

	TEST_F (ECCVMTests, WitnessPolynomialsMasked)
	Verify that every ECCVM witness polynomial has masking values in the reserved head region.

Typedef Documentation

◆ ECCVMVerifier

using ECCVMVerifier = ECCVMVerifier_<ECCVMFlavor>

Definition at line 33 of file eccvm.test.cpp.

◆ FF

using FF = ECCVMFlavor::FF

Definition at line 30 of file eccvm.test.cpp.

◆ PCS

using PCS = IPA<ECCVMFlavor::Curve, CONST_ECCVM_LOG_N>

Definition at line 34 of file eccvm.test.cpp.

◆ PK

using PK = ECCVMFlavor::ProvingKey

Definition at line 31 of file eccvm.test.cpp.

◆ Transcript

using Transcript = ECCVMFlavor::Transcript

Definition at line 32 of file eccvm.test.cpp.

Function Documentation

◆ complete_proving_key_for_test()

void complete_proving_key_for_test	(	bb::RelationParameters< FF > &	relation_parameters,
		std::shared_ptr< PK > &	pk,
		std::vector< FF > &	gate_challenges
	)

Definition at line 145 of file eccvm.test.cpp.

◆ compute_eccvm_vk_hash()

ECCVMFlavor::BF compute_eccvm_vk_hash ( )

Definition at line 49 of file eccvm.test.cpp.

◆ create_vk_from_proving_key()

ECCVMFlavor::VerificationKey create_vk_from_proving_key ( const std::shared_ptr< PK > & proving_key )

Definition at line 38 of file eccvm.test.cpp.

◆ generate_circuit()

ECCVMCircuitBuilder generate_circuit ( numeric::RNG * engine = nullptr )

Adds operations in BN254 to the op_queue and then constructs and ECCVM circuit from the op_queue.

Parameters

engine

Returns: ECCVMCircuitBuilder

Definition at line 84 of file eccvm.test.cpp.

◆ generate_zero_circuit()

ECCVMCircuitBuilder generate_zero_circuit	(	numeric::RNG *	engine = `nullptr`,
		bool	zero_scalars = `1`
	)

Definition at line 119 of file eccvm.test.cpp.

◆ TEST_F() [1/14]

TEST_F	(	ECCVMTests	,
		BaseCaseFixedSize
	)

Definition at line 415 of file eccvm.test.cpp.

◆ TEST_F() [2/14]

TEST_F	(	ECCVMTests	,
		BaseInfinityForgedCoordinatesRejected
	)

Regression test: transcript_base_infinity soundness vulnerability.

Constructs 2 MULs: mul(a, x) and mul(infinity, y). The honest computation yields a*x (since infinity*y contributes nothing). After building the prover, we replace transcript_Px/Py at the infinity-mul row with a valid on-curve point b. This makes the committed transcript look like: mul(a, x), mul(b, y), eq(a*x) where the honest result should be a*x + b*y, not a*x.

We then generate a full ECCVM proof and verify it (IPA included). Before the fix (constraining Px/Py = 0 when base_infinity = 1), this proof would VERIFY, demonstrating a soundness break. After the fix, the proof must FAIL verification.

Definition at line 526 of file eccvm.test.cpp.

◆ TEST_F() [3/14]

TEST_F	(	ECCVMTests	,
		CommittedSumcheck
	)

Definition at line 451 of file eccvm.test.cpp.

◆ TEST_F() [4/14]

TEST_F	(	ECCVMTests	,
		EqFailsFixedSize
	)

Definition at line 432 of file eccvm.test.cpp.

◆ TEST_F() [5/14]

TEST_F	(	ECCVMTests	,
		FixedVK
	)

Test that the fixed VK from the default constructor agrees with the one computed for an arbitrary circuit.

Note: If this test fails, it may be because the constant ECCVM_FIXED_SIZE has changed and the fixed VK commitments in ECCVMHardcodedVKAndHash must be updated accordingly. Their values can be taken right from the output of this test.

Definition at line 598 of file eccvm.test.cpp.

◆ TEST_F() [6/14]

TEST_F	(	ECCVMTests	,
		MissingHidingOpThrows
	)

Definition at line 193 of file eccvm.test.cpp.

◆ TEST_F() [7/14]

TEST_F	(	ECCVMTests	,
		NullOpQUeue
	)

Definition at line 202 of file eccvm.test.cpp.

◆ TEST_F() [8/14]

TEST_F	(	ECCVMTests	,
		PointAtInfinity
	)

Definition at line 218 of file eccvm.test.cpp.

◆ TEST_F() [9/14]

TEST_F	(	ECCVMTests	,
		ProofLengthCheck
	)

Check that size of a ECCVM proof matches the corresponding constant.

If this test FAILS, then the following (non-exhaustive) list should probably be updated as well:

Proof length formula in eccvm_flavor.hpp, etc...
eccvm_transcript.test.cpp
constants in yarn-project in: constants.nr, constants.gen.ts, ConstantsGen.sol

Definition at line 405 of file eccvm.test.cpp.

◆ TEST_F() [10/14]

TEST_F	(	ECCVMTests	,
		ScalarEdgeCase
	)

Definition at line 373 of file eccvm.test.cpp.

◆ TEST_F() [11/14]

TEST_F	(	ECCVMTests	,
		ShortMonomialProverVerifies
	)

Definition at line 233 of file eccvm.test.cpp.

◆ TEST_F() [12/14]

TEST_F	(	ECCVMTests	,
		ShortMonomialRelationsMatchFullEdgeRelations
	)

Definition at line 339 of file eccvm.test.cpp.

◆ TEST_F() [13/14]

TEST_F	(	ECCVMTests	,
		WitnessPolynomialsMasked
	)

Verify that every ECCVM witness polynomial has masking values in the reserved head region.

All witness polynomials (wires, z_perm, lookup_inverses) should have non-zero random values at rows 1..NUM_MASKED_ROWS (the masking region). Precomputed polynomials should NOT be masked.

Definition at line 640 of file eccvm.test.cpp.

◆ TEST_F() [14/14]

TEST_F	(	ECCVMTests	,
		ZeroesCoefficients
	)

Definition at line 177 of file eccvm.test.cpp.

Classes

Typedefs

Functions