feat: DSL recursion changes

cpp/src/barretenberg/dsl/acir_format/acir_format.cpp

@@ -89,6 +89,11 @@ void create_circuit(Composer& composer, const acir_format& constraint_system)
     for (const auto& constraint : constraint_system.hash_to_field_constraints) {
         create_hash_to_field_constraints(composer, constraint);
     }
+
+    // Add recursion constraints
+    for (const auto& constraint : constraint_system.recursion_constraints) {
+        create_recursion_constraints<false, false>(composer, constraint);
+    }
 }
 
 Composer create_circuit(const acir_format& constraint_system,
@@ -112,6 +117,7 @@ Composer create_circuit(const acir_format& constraint_system,
             composer.add_variable(0);
         }
     }
+
     // Add arithmetic gates
     for (const auto& constraint : constraint_system.constraints) {
         composer.create_poly_gate(constraint);
@@ -173,6 +179,11 @@ Composer create_circuit(const acir_format& constraint_system,
         create_hash_to_field_constraints(composer, constraint);
     }
 
+    // Add recursion constraints
+    for (const auto& constraint : constraint_system.recursion_constraints) {
+        create_recursion_constraints<false, false>(composer, constraint);
+    }
+
     return composer;
 }
 
@@ -262,6 +273,10 @@ Composer create_circuit_with_witness(const acir_format& constraint_system,
         create_hash_to_field_constraints(composer, constraint);
     }
 
+    // Add recursion constraints
+    for (const auto& constraint : constraint_system.recursion_constraints) {
+        create_recursion_constraints<true, false>(composer, constraint);
+    }
     return composer;
 }
 Composer create_circuit_with_witness(const acir_format& constraint_system, std::vector<fr> witness)
@@ -348,6 +363,10 @@ Composer create_circuit_with_witness(const acir_format& constraint_system, std::
         create_hash_to_field_constraints(composer, constraint);
     }
 
+    // Add recursion constraints
+    for (const auto& constraint : constraint_system.recursion_constraints) {
+        create_recursion_constraints<true, false>(composer, constraint);
+    }
     return composer;
 }
 void create_circuit_with_witness(Composer& composer, const acir_format& constraint_system, std::vector<fr> witness)
@@ -431,6 +450,11 @@ void create_circuit_with_witness(Composer& composer, const acir_format& constrai
     for (const auto& constraint : constraint_system.hash_to_field_constraints) {
         create_hash_to_field_constraints(composer, constraint);
     }
+
+    // Add recursion constraints
+    for (const auto& constraint : constraint_system.recursion_constraints) {
+        create_recursion_constraints<true, false>(composer, constraint);
+    }
 }
 
 } // namespace acir_format

cpp/src/barretenberg/dsl/acir_format/acir_format.hpp

@@ -8,6 +8,7 @@
 #include "schnorr_verify.hpp"
 #include "ecdsa_secp256k1.hpp"
 #include "compute_merkle_root_constraint.hpp"
+#include "recursion_constraint.hpp"
 #include "pedersen.hpp"
 #include "hash_to_field.hpp"
 #include "barretenberg/dsl/types.hpp"
@@ -31,6 +32,7 @@ struct acir_format {
     std::vector<HashToFieldConstraint> hash_to_field_constraints;
     std::vector<PedersenConstraint> pedersen_constraints;
     std::vector<ComputeMerkleRootConstraint> compute_merkle_root_constraints;
+    std::vector<RecursionConstraint> recursion_constraints;
     // A standard plonk arithmetic constraint, as defined in the poly_triple struct, consists of selector values
     // for q_M,q_L,q_R,q_O,q_C and indices of three variables taking the role of left, right and output wire
     std::vector<poly_triple> constraints;
@@ -70,6 +72,7 @@ template <typename B> inline void read(B& buf, acir_format& data)
     read(buf, data.pedersen_constraints);
     read(buf, data.hash_to_field_constraints);
     read(buf, data.fixed_base_scalar_mul_constraints);
+    read(buf, data.recursion_constraints);
     read(buf, data.constraints);
 }
 
@@ -89,6 +92,7 @@ template <typename B> inline void write(B& buf, acir_format const& data)
     write(buf, data.pedersen_constraints);
     write(buf, data.hash_to_field_constraints);
     write(buf, data.fixed_base_scalar_mul_constraints);
+    write(buf, data.recursion_constraints);
     write(buf, data.constraints);
 }
 

cpp/src/barretenberg/dsl/acir_format/acir_format.test.cpp

@@ -4,6 +4,47 @@
 #include <vector>
 #include "barretenberg/common/streams.hpp"
 
+TEST(acir_format, test_a_single_constraint_no_pub_inputs)
+{
+
+    poly_triple constraint{
+        .a = 1,
+        .b = 2,
+        .c = 3,
+        .q_m = 0,
+        .q_l = 1,
+        .q_r = 1,
+        .q_o = -1,
+        .q_c = 0,
+    };
+
+    acir_format::acir_format constraint_system{
+        .varnum = 4,
+        .public_inputs = {},
+        .fixed_base_scalar_mul_constraints = {},
+        .logic_constraints = {},
+        .range_constraints = {},
+        .schnorr_constraints = {},
+        .ecdsa_constraints = {},
+        .sha256_constraints = {},
+        .blake2s_constraints = {},
+        .hash_to_field_constraints = {},
+        .pedersen_constraints = {},
+        .compute_merkle_root_constraints = {},
+        .recursion_constraints = {},
+        .constraints = { constraint },
+    };
+
+    auto composer = acir_format::create_circuit_with_witness(constraint_system, { 0, 0, 1 });
+
+    auto prover = composer.create_ultra_with_keccak_prover();
+    auto proof = prover.construct_proof();
+
+    auto verifier = composer.create_ultra_with_keccak_verifier();
+
+    EXPECT_EQ(verifier.verify_proof(proof), false);
+}
+
 TEST(acir_format, test_logic_gate_from_noir_circuit)
 {
     /**
@@ -90,6 +131,7 @@ TEST(acir_format, test_logic_gate_from_noir_circuit)
         .hash_to_field_constraints = {},
         .pedersen_constraints = {},
         .compute_merkle_root_constraints = {},
+        .recursion_constraints = {},
         .constraints = { expr_a, expr_b, expr_c, expr_d },
     };
 
@@ -155,6 +197,7 @@ TEST(acir_format, test_schnorr_verify_pass)
         .hash_to_field_constraints = {},
         .pedersen_constraints = {},
         .compute_merkle_root_constraints = {},
+        .recursion_constraints = {},
         .constraints = { poly_triple{
             .a = schnorr_constraint.result,
             .b = schnorr_constraint.result,
@@ -225,6 +268,7 @@ TEST(acir_format, test_schnorr_verify_small_range)
         .hash_to_field_constraints = {},
         .pedersen_constraints = {},
         .compute_merkle_root_constraints = {},
+        .recursion_constraints = {},
         .constraints = { poly_triple{
             .a = schnorr_constraint.result,
             .b = schnorr_constraint.result,

cpp/src/barretenberg/dsl/acir_format/ecdsa_secp256k1.cpp

@@ -104,17 +104,24 @@ void create_ecdsa_verify_constraints(Composer& composer, const EcdsaSecp256k1Con
 
     pub_key_x_fq.assert_is_in_field();
     pub_key_y_fq.assert_is_in_field();
-
     secp256k1_ct::g1_bigfr_ct public_key = secp256k1_ct::g1_bigfr_ct(pub_key_x_fq, pub_key_y_fq);
+    for (size_t i = 0; i < 32; ++i) {
+        sig.r[i].assert_equal(field_ct::from_witness_index(&composer, input.signature[i]));
+        sig.s[i].assert_equal(field_ct::from_witness_index(&composer, input.signature[i + 32]));
+        pub_key_x_byte_arr[i].assert_equal(field_ct::from_witness_index(&composer, input.pub_x_indices[i]));
+        pub_key_y_byte_arr[i].assert_equal(field_ct::from_witness_index(&composer, input.pub_y_indices[i]));
+    }
+    for (size_t i = 0; i < input.message.size(); ++i) {
+        message[i].assert_equal(field_ct::from_witness_index(&composer, input.message[i]));
+    }
 
-    bool_ct signature_result = stdlib::ecdsa::verify_signature<Composer,
-                                                               secp256k1_ct,
-                                                               secp256k1_ct::fq_ct,
-                                                               secp256k1_ct::bigfr_ct,
-                                                               secp256k1_ct::g1_bigfr_ct>(message, public_key, sig);
-
+    bool_ct signature_result =
+        stdlib::ecdsa::verify_signature_noassert<Composer,
+                                                 secp256k1_ct,
+                                                 secp256k1_ct::fq_ct,
+                                                 secp256k1_ct::bigfr_ct,
+                                                 secp256k1_ct::g1_bigfr_ct>(message, public_key, sig);
     bool_ct signature_result_normalized = signature_result.normalize();
-
     composer.assert_equal(signature_result_normalized.witness_index, input.result);
 }
 

cpp/src/barretenberg/dsl/acir_format/ecdsa_secp256k1.test.cpp

@@ -0,0 +1,145 @@
+#include "acir_format.hpp"
+#include "ecdsa_secp256k1.hpp"
+#include "barretenberg/plonk/proof_system/types/proof.hpp"
+#include "barretenberg/plonk/proof_system/verification_key/verification_key.hpp"
+#include "barretenberg/crypto/ecdsa/ecdsa.hpp"
+
+#include <gtest/gtest.h>
+#include <vector>
+
+using namespace proof_system::plonk;
+using curve = stdlib::secp256k1<acir_format::Composer>;
+
+size_t generate_ecdsa_constraint(acir_format::EcdsaSecp256k1Constraint& ecdsa_constraint,
+                                 std::vector<fr>& witness_values)
+{
+    std::string message_string = "Instructions unclear, ask again later.";
+
+    crypto::ecdsa::key_pair<curve::fr, curve::g1> account;
+    account.private_key = curve::fr::random_element();
+    account.public_key = curve::g1::one * account.private_key;
+
+    crypto::ecdsa::signature signature =
+        crypto::ecdsa::construct_signature<Sha256Hasher, curve::fq, curve::fr, curve::g1>(message_string, account);
+
+    uint256_t pub_x_value = account.public_key.x;
+    uint256_t pub_y_value = account.public_key.y;
+
+    std::vector<uint32_t> message_in;
+    std::vector<uint32_t> pub_x_indices_in;
+    std::vector<uint32_t> pub_y_indices_in;
+    std::vector<uint32_t> signature_in;
+    size_t offset = 1;
+    for (size_t i = 0; i < message_string.size(); ++i) {
+        message_in.emplace_back(i + offset);
+        const auto byte = static_cast<uint8_t>(message_string[i]);
+        witness_values.emplace_back(byte);
+    }
+    offset += message_in.size();
+
+    for (size_t i = 0; i < 32; ++i) {
+        pub_x_indices_in.emplace_back(i + offset);
+        witness_values.emplace_back(pub_x_value.slice(248 - i * 8, 256 - i * 8));
+    }
+    offset += pub_x_indices_in.size();
+    for (size_t i = 0; i < 32; ++i) {
+        pub_y_indices_in.emplace_back(i + offset);
+        witness_values.emplace_back(pub_y_value.slice(248 - i * 8, 256 - i * 8));
+    }
+    offset += pub_y_indices_in.size();
+    for (size_t i = 0; i < 32; ++i) {
+        signature_in.emplace_back(i + offset);
+        witness_values.emplace_back(signature.r[i]);
+    }
+    offset += signature.r.size();
+    for (size_t i = 0; i < 32; ++i) {
+        signature_in.emplace_back(i + offset);
+        witness_values.emplace_back(signature.s[i]);
+    }
+    offset += signature.s.size();
+
+    witness_values.emplace_back(1);
+    const auto result_in = static_cast<uint32_t>(offset);
+    offset += 1;
+    witness_values.emplace_back(1);
+
+    ecdsa_constraint = acir_format::EcdsaSecp256k1Constraint{
+        .message = message_in,
+        .pub_x_indices = pub_x_indices_in,
+        .pub_y_indices = pub_y_indices_in,
+        .result = result_in,
+        .signature = signature_in,
+    };
+    return offset;
+}
+
+TEST(ECDSASecp256k1, TestECDSAConstraintSucceed)
+{
+    acir_format::EcdsaSecp256k1Constraint ecdsa_constraint;
+    std::vector<fr> witness_values;
+    size_t num_variables = generate_ecdsa_constraint(ecdsa_constraint, witness_values);
+    acir_format::acir_format constraint_system{
+        .varnum = static_cast<uint32_t>(num_variables),
+        .public_inputs = {},
+        .fixed_base_scalar_mul_constraints = {},
+        .logic_constraints = {},
+        .range_constraints = {},
+        .schnorr_constraints = {},
+        .ecdsa_constraints = { ecdsa_constraint },
+        .sha256_constraints = {},
+        .blake2s_constraints = {},
+        .hash_to_field_constraints = {},
+        .pedersen_constraints = {},
+        .compute_merkle_root_constraints = {},
+        .recursion_constraints = {},
+        .constraints = {},
+    };
+
+    auto composer = acir_format::create_circuit_with_witness(constraint_system, witness_values);
+
+    EXPECT_EQ(composer.get_variable(ecdsa_constraint.result), 1);
+    auto prover = composer.create_prover();
+
+    auto proof = prover.construct_proof();
+    auto verifier = composer.create_verifier();
+    EXPECT_EQ(verifier.verify_proof(proof), true);
+}
+
+TEST(ECDSASecp256k1, TestECDSAConstraintFail)
+{
+    acir_format::EcdsaSecp256k1Constraint ecdsa_constraint;
+    std::vector<fr> witness_values;
+    size_t num_variables = generate_ecdsa_constraint(ecdsa_constraint, witness_values);
+
+    // set result value to be false
+    witness_values[witness_values.size() - 1] = 0;
+
+    // tamper with signature
+    witness_values[witness_values.size() - 20] += 1;
+
+    acir_format::acir_format constraint_system{
+        .varnum = static_cast<uint32_t>(num_variables),
+        .public_inputs = {},
+        .fixed_base_scalar_mul_constraints = {},
+        .logic_constraints = {},
+        .range_constraints = {},
+        .schnorr_constraints = {},
+        .ecdsa_constraints = { ecdsa_constraint },
+        .sha256_constraints = {},
+        .blake2s_constraints = {},
+        .hash_to_field_constraints = {},
+        .pedersen_constraints = {},
+        .compute_merkle_root_constraints = {},
+        .recursion_constraints = {},
+        .constraints = {},
+    };
+
+    auto composer = acir_format::create_circuit_with_witness(constraint_system, witness_values);
+
+    EXPECT_EQ(composer.get_variable(ecdsa_constraint.result), 0);
+    auto prover = composer.create_prover();
+
+    auto proof = prover.construct_proof();
+    auto verifier = composer.create_verifier();
+    EXPECT_EQ(verifier.verify_proof(proof), true);
+}