longfellow 0.1.0

data/vendor/longfellow-zk/lib/proto/circuit_test.cc

@@ -0,0 +1,202 @@
+// Copyright 2026 Google LLC.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "proto/circuit.h"
+
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <memory>
+#include <vector>
+
+#include "algebra/fp_p128.h"
+#include "circuits/compiler/circuit_dump.h"
+#include "circuits/compiler/compiler.h"
+#include "circuits/ecdsa/verify_circuit.h"
+#include "circuits/logic/bit_plucker.h"
+#include "circuits/logic/compiler_backend.h"
+#include "circuits/logic/logic.h"
+#include "circuits/sha/flatsha256_circuit.h"
+#include "ec/p256.h"
+#include "sumcheck/circuit.h"
+#include "util/log.h"
+#include "util/readbuffer.h"
+#include "gtest/gtest.h"
+
+namespace proofs {
+namespace {
+
+template <class Field>
+void expect_same_id(const Circuit<Field>& c0, const Circuit<Field>& c1,
+                    const Field& F) {
+  std::array<uint8_t, 32> id0;
+  circuit_id(id0.data(), c0, F);
+  std::array<uint8_t, 32> id1;
+  circuit_id(id1.data(), c1, F);
+  EXPECT_EQ(id0, id1);
+}
+
+template <class FF>
+void serialize_test2(const Circuit<FF>& circuit, const FF& F,
+                     FieldID field_id) {
+  std::vector<uint8_t> bytes;
+  log(INFO, "Serializing2");
+  CircuitRep<FF> cr(F, field_id);
+  cr.to_bytes(circuit, bytes);
+  size_t sz = bytes.size();
+  log(INFO, "size: %zu", sz);
+
+  CircuitRep<FF> cr2(F, field_id);
+
+  log(INFO, "Deserializing2");
+  ReadBuffer rb(bytes);
+  auto c2 = cr2.from_bytes(rb, /*enforce_circuit_id=*/true);
+  log(INFO, "Parsed from bytes");
+  EXPECT_TRUE(c2 != nullptr);
+  expect_same_id(*c2, circuit, F);
+
+  // Test truncated inputs.
+  ReadBuffer rb1(bytes.data(), sz - 1);
+  auto bad = cr2.from_bytes(rb1, /*enforce_circuit_id=*/true);
+  EXPECT_TRUE(bad == nullptr);
+
+  ReadBuffer rb2(bytes.data() + 1, sz - 1);
+  bad = cr2.from_bytes(rb2, /*enforce_circuit_id=*/true);
+  EXPECT_TRUE(bad == nullptr);
+
+  uint8_t tmp[32];
+  // Test corrupted numconsts
+  ReadBuffer rb3(bytes);
+  size_t clobber = CircuitRep<FF>::kBytesPerSizeT * 7 - 1;
+  tmp[0] = bytes[clobber];
+  bytes[clobber] = 1;
+  bad = cr2.from_bytes(rb3, /*enforce_circuit_id=*/true);
+  EXPECT_TRUE(bad == nullptr);
+  bytes[clobber] = tmp[0];
+
+  // Test corrupted constant table Elt
+  ReadBuffer rb4(bytes);
+  for (size_t i = 0; i < 32; ++i) {
+    tmp[i] = bytes[clobber + 1 + i];
+    bytes[clobber + 1 + i] = 0xff;
+  }
+  bad = cr2.from_bytes(rb4, /*enforce_circuit_id=*/true);
+  EXPECT_TRUE(bad == nullptr);
+  for (size_t i = 0; i < 32; ++i) {
+    bytes[clobber + 1 + i] = tmp[i];
+  }
+}
+
+template <class FF>
+void serialize_test3(Circuit<FF>& circuit, const FF& F, FieldID field_id) {
+  // corrupt the circuit id
+  circuit.id[0] ^= 1u;
+
+  std::vector<uint8_t> bytes;
+  log(INFO, "Serializing3");
+  CircuitRep<FF> cr(F, field_id);
+  cr.to_bytes(circuit, bytes);
+  size_t sz = bytes.size();
+  log(INFO, "size: %zu", sz);
+
+  // restore circuit id
+  circuit.id[0] ^= 1u;
+
+  CircuitRep<FF> cr2(F, field_id);
+
+  log(INFO, "Deserializing3");
+  ReadBuffer rb(bytes);
+  auto c2 = cr2.from_bytes(rb, /*enforce_circuit_id=*/true);
+  log(INFO, "Parsed from bytes");
+  EXPECT_TRUE(c2 == nullptr);
+}
+
+TEST(circuit_io, ecdsa) {
+  using CompilerBackend = CompilerBackend<Fp256Base>;
+  using LogicCircuit = Logic<Fp256Base, CompilerBackend>;
+  using EltW = LogicCircuit::EltW;
+  using Verc = VerifyCircuit<LogicCircuit, Fp256Base, P256>;
+
+  set_log_level(INFO);
+
+  std::unique_ptr<Circuit<Fp256Base>> circuit;
+
+  /*scope to delimit compile-time for ecdsa verification circuit */ {
+    QuadCircuit<Fp256Base> Q(p256_base);
+    CompilerBackend cbk(&Q);
+    const LogicCircuit LC(&cbk, p256_base);
+
+    using Nat = Fp256Base::N;
+    const Nat order = Nat(
+        "0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551");
+
+    Verc verc(LC, p256, order);
+    Verc::Witness vwc;
+
+    EltW pkx = LC.eltw_input(), pky = LC.eltw_input(), e = LC.eltw_input();
+    vwc.input(LC);
+
+    verc.verify_signature3(pkx, pky, e, vwc);
+
+    circuit = Q.mkcircuit(1);
+    dump_info("ecdsa", 1, Q);
+  }
+
+  serialize_test2<Fp256Base>(*circuit, p256_base, P256_ID);
+  serialize_test3<Fp256Base>(*circuit, p256_base, P256_ID);
+}
+
+TEST(circuit_io, SHA) {
+  using Fp128 = Fp128<>;
+  using CompilerBackend = CompilerBackend<Fp128>;
+  using LogicCircuit = Logic<Fp128, CompilerBackend>;
+  using v8C = LogicCircuit::v8;
+  using FlatShaC = FlatSHA256Circuit<LogicCircuit, BitPlucker<LogicCircuit, 1>>;
+  set_log_level(INFO);
+
+  const Fp128 Fg;
+  constexpr size_t kBlocks = 15;
+
+  std::unique_ptr<Circuit<Fp128>> circuit;
+
+  /*scope to delimit compile-time for sha hash circuit*/ {
+    QuadCircuit<Fp128> Q(Fg);
+    const CompilerBackend cbk(&Q);
+    const LogicCircuit lc(&cbk, Fg);
+    FlatShaC fsha(lc);
+
+    v8C numbW = lc.vinput<8>();
+
+    std::vector<v8C> inW(64 * kBlocks);
+    for (size_t i = 0; i < kBlocks * 64; ++i) {
+      inW[i] = lc.vinput<8>();
+    }
+
+    std::vector<FlatShaC::BlockWitness> bwW(kBlocks);
+    for (size_t j = 0; j < kBlocks; j++) {
+      bwW[j].input(lc);
+    }
+
+    fsha.assert_message(kBlocks, numbW, inW.data(), bwW.data());
+
+    circuit = Q.mkcircuit(1);
+    dump_info("assert_message", kBlocks, Q);
+  }
+
+  serialize_test2<Fp128>(*circuit, Fg, FP128_ID);
+  serialize_test3<Fp128>(*circuit, Fg, FP128_ID);
+}
+
+}  // namespace
+}  // namespace proofs

data/vendor/longfellow-zk/lib/random/random.h

@@ -0,0 +1,119 @@
+// Copyright 2026 Google LLC.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef PRIVACY_PROOFS_ZK_LIB_RANDOM_RANDOM_H_
+#define PRIVACY_PROOFS_ZK_LIB_RANDOM_RANDOM_H_
+
+#include <cstdint>
+#include <cstdlib>
+#include <optional>
+#include <utility>
+#include <vector>
+
+#include "util/panic.h"
+
+namespace proofs {
+
+// Our protocols require random coins; this interface provides both prover
+// and verifier components with those coins. Re-implementing this interface
+// allows easily supporting the Fiat-Shamir transform, or for sampling using
+// a system provided RNG such as openssl.
+class RandomEngine {
+ public:
+  virtual ~RandomEngine() = default;
+  virtual void bytes(uint8_t* buf, size_t n) = 0;  // pure virtual
+
+  // Sample a random field element.
+  template <class Field>
+  typename Field::Elt elt(const Field& F) {
+    return F.sample([this](size_t n, uint8_t* buf) { bytes(buf, n); });
+  }
+
+  template <class Field>
+  typename Field::Elt subfield_elt(const Field& F) {
+    return F.sample_subfield([this](size_t n, uint8_t* buf) {
+      bytes(buf, n);
+    });
+  }
+
+  // Convenience method to sample an array of random field elements.
+  template <class Field>
+  void elt(typename Field::Elt e[/*n*/], size_t n, const Field& F) {
+    for (size_t i = 0; i < n; ++i) e[i] = elt(F);
+  }
+
+  // random size_t < n
+  size_t nat(size_t n) {
+    check(n > 0, "nat(0)");
+
+    // compute the minimum number of random bytes needed
+    size_t l = 0;
+    size_t nn = n;
+    while (nn != 0) {
+      nn >>= 8;
+      ++l;
+    }
+    check(l <= sizeof(size_t), "l <= sizeof(size_t)");
+
+    size_t msk = mask(n);
+    size_t r;
+    uint8_t buf[sizeof(size_t)];
+
+    // rejection sampling
+    do {
+      // consume L random bytes
+      bytes(buf, l);
+
+      // little-endian read
+      r = 0;
+      for (size_t i = l; i-- > 0;) {
+        r = (r << 8) | buf[i];
+      }
+
+      // mask off high bits
+      r &= msk;
+    } while (r >= n);
+
+    return r;
+  }
+
+  // Choose K distinct random naturals in [0..N).
+  // Textbook algorithm requiring O(N) space
+  void choose(size_t res[/*k*/], size_t n, size_t k) {
+    check(n >= k, "n >= k");
+
+    std::vector<size_t> A(n);
+    for (size_t i = 0; i < n; ++i) {
+      A[i] = i;
+    }
+    for (size_t i = 0; i < k; ++i) {
+      size_t j = i + nat(n - i);
+      std::swap(A[i], A[j]);
+      res[i] = A[i];
+    }
+  }
+
+  // the minimal bitmask such that (n & mask) == n
+  size_t mask(size_t n) {
+    size_t mask = 0;
+    while ((n & mask) != n) {
+      mask <<= 1;
+      mask |= 1u;
+    }
+    return mask;
+  }
+};
+}  // namespace proofs
+
+#endif  // PRIVACY_PROOFS_ZK_LIB_RANDOM_RANDOM_H_

data/vendor/longfellow-zk/lib/random/random_test.cc

@@ -0,0 +1,189 @@
+// Copyright 2026 Google LLC.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "random/random.h"
+
+#include <stdio.h>
+#include <stdlib.h>
+
+#include <algorithm>
+#include <cstdint>
+#include <vector>
+
+#include "algebra/fp.h"
+#include "algebra/fp24.h"
+#include "gf2k/gf2_128.h"
+#include "random/secure_random_engine.h"
+#include "random/transcript.h"
+#include "gtest/gtest.h"
+
+namespace proofs {
+namespace {
+typedef Fp<1> Field;
+typedef Field::Elt Elt;
+static const Field F("18446744069414584321");
+
+static void test_bytes(RandomEngine *e) {
+  // check that no bit is stuck at 0 or 1.
+  constexpr size_t N = 100;
+  uint8_t buf[N];
+
+  e->bytes(buf, N);
+  uint8_t band = 0xFFu, bor = 0x00u;
+  for (size_t i = 0; i < N; ++i) {
+    band &= buf[i];
+    bor |= buf[i];
+  }
+  EXPECT_EQ(band, 0x00u);
+  EXPECT_EQ(bor, 0xFFu);
+}
+
+static void test_nat(RandomEngine *e, size_t ub) {
+  // check that no bit is stuck at 0 or 1.
+  constexpr size_t N = 100;
+
+  size_t bor = 0;
+  size_t band = ~bor;
+  for (size_t i = 0; i < N; ++i) {
+    size_t u = e->nat(ub);
+    EXPECT_LT(u, ub);
+    band &= u;
+    bor |= u;
+  }
+  EXPECT_EQ(band, 0u);
+  EXPECT_EQ(bor, e->mask(ub - 1));
+}
+
+static void test_elt(RandomEngine *e) {
+  // Basic sanity test: Generate an array of elements and check that they
+  // are not all the same.  Beware of the birthday paradox.
+  constexpr size_t N = 30;
+  Elt x[N];
+  e->elt(x, N, F);
+  for (size_t i = 0; i < N; ++i) {
+    for (size_t j = 0; j < N; ++j) {
+      if (i != j) {
+        // Generated elements in an array shouldn't equal to each other.
+        EXPECT_NE(x[i], x[j]);
+      }
+    }
+  }
+}
+
+static void test_choose(RandomEngine *e, size_t n, size_t k) {
+  std::vector<size_t> r(k);
+  e->choose(r.data(), n, k);
+  for (size_t i = 0; i < k; ++i) {
+    EXPECT_LT(r[i], n);
+  }
+
+  // sort the array and check that all elements
+  // are distinct
+  std::sort(r.begin(), r.end());
+  for (size_t i = 1; i < k; ++i) {
+    EXPECT_LT(r[i - 1], r[i]);
+  }
+}
+
+static void test_all(RandomEngine *e) {
+  test_bytes(e);
+  test_nat(e, 7);
+  test_nat(e, 8);
+  test_nat(e, 9);
+  test_nat(e, (1u << 31) + ((1u << 31) - 1u));
+  test_elt(e);
+  for (size_t k = 0; k <= 32; ++k) {
+    test_choose(e, 32, k);
+  }
+  test_choose(e, 10000, 42);
+  test_choose(e, 10000, 10000);
+}
+
+static void test_mask(RandomEngine *e) {
+  for (size_t n = 0; n < 1000; ++n) {
+    size_t m = e->mask(n);
+    EXPECT_TRUE(n == (n & m));
+    EXPECT_TRUE((m == 0) || (n != (n & (m >> 1))));
+  }
+}
+
+TEST(Random, FSPRF) {
+  Transcript ts((uint8_t *)"test", 4);
+  test_all(&ts);
+  test_mask(&ts);
+}
+
+TEST(Random, SmallPrime24Bit) {
+  // 24-bit prime: 2^24 - 3
+  typedef Fp<1> Field24;
+  Field24 F("16777213");
+  SecureRandomEngine e;
+  constexpr size_t N = 100;
+  for (size_t i = 0; i < N; ++i) {
+    Field24::Elt x = e.elt(F);
+    EXPECT_LT(x.n, F.m_);
+    x = e.subfield_elt(F);
+    EXPECT_LT(x.n, F.m_);
+  }
+}
+
+TEST(Random, Fp24) {
+  // 24-bit prime: 2^24 - 3
+  Fp24 F(8380417);
+  SecureRandomEngine e;
+  constexpr size_t N = 100;
+  for (size_t i = 0; i < N; ++i) {
+    Fp24::Elt x = e.elt(F);
+    EXPECT_LT(x.n, F.m_);
+    x = e.subfield_elt(F);
+    EXPECT_LT(x.n, F.m_);
+  }
+}
+
+TEST(Random, LargePrime80Bit) {
+  // 80-bit prime: 2^80 - 65
+  typedef Fp<2> Field80;
+  Field80 F("1208925819614629174706111");
+  SecureRandomEngine e;
+  constexpr size_t N = 100;
+  for (size_t i = 0; i < N; ++i) {
+    Field80::Elt x = e.elt(F);
+    EXPECT_LT(x.n, F.m_);
+    x = e.subfield_elt(F);
+    EXPECT_LT(x.n, F.m_);
+  }
+}
+
+TEST(Random, GF2_128) {
+  typedef GF2_128<> FieldGF;
+  FieldGF F;
+  SecureRandomEngine e;
+  constexpr size_t N = 100;
+  for (size_t i = 0; i < N; ++i) {
+    FieldGF::Elt x = e.elt(F);
+    // Every array of 128 bits is a valid element of GF2_128.
+    // The main point here is verifying `elt` compiles.
+    EXPECT_TRUE(x == x);
+    x = e.subfield_elt(F);
+    EXPECT_TRUE(x == x);
+  }
+}
+
+TEST(Random, SecureRandomEngine) {
+  SecureRandomEngine e;
+  test_all(&e);
+}
+
+}  // namespace
+}  // namespace proofs

data/vendor/longfellow-zk/lib/random/secure_random_engine.h

@@ -0,0 +1,37 @@
+// Copyright 2026 Google LLC.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef PRIVACY_PROOFS_ZK_LIB_RANDOM_SECURE_RANDOM_ENGINE_H_
+#define PRIVACY_PROOFS_ZK_LIB_RANDOM_SECURE_RANDOM_ENGINE_H_
+
+#include <stdlib.h>
+
+#include <cstddef>
+#include <cstdint>
+
+#include "random/random.h"
+#include "util/crypto.h"
+
+namespace proofs {
+
+// SecureRandomEngine is a RandomEngine that uses openssl.
+class SecureRandomEngine : public RandomEngine {
+ public:
+  SecureRandomEngine() = default;
+  void bytes(uint8_t* buf, size_t n) override { rand_bytes(buf, n); }
+};
+
+}  // namespace proofs
+
+#endif  // PRIVACY_PROOFS_ZK_LIB_RANDOM_SECURE_RANDOM_ENGINE_H_