@maci-protocol/circuits 0.0.0-ci.00107eb

package/circom/coordinator/qv/VoteTallyWithIndividualCounts.circom

@@ -0,0 +1,226 @@
+pragma circom 2.0.0;
+
+// circomlib import
+include "./comparators.circom";
+// zk-kit import
+include "./unpack-element.circom";
+// local imports
+include "../../utils/trees/CheckRoot.circom";
+include "../../utils/trees/LeafExists.circom";
+include "../../utils/trees/QuinaryCheckRoot.circom";
+include "../../utils/qv/ResultCommitmentVerifier.circom";
+include "../../utils/CalculateTotal.circom";
+include "../../utils/PoseidonHasher.circom";
+
+/**
+ * Processes batches of votes and verifies their validity in a Merkle tree structure.
+ * This template supports Quadratic Voting (QV) with individual vote counting.
+ * Note: this circuit is not using right now, this is a part of individual vote counts functionality.
+ * Not finished yet, don't use it in production. It is kept here for future use.
+ */
+template VoteTallyWithIndividualCountsQv(
+    stateTreeDepth,
+    tallyProcessingStateTreeDepth,
+    voteOptionTreeDepth
+) {
+    // Ensure there's at least one level in the vote option tree.
+    assert(voteOptionTreeDepth > 0);
+    // Ensure the intermediate state tree has at least one level.
+    assert(tallyProcessingStateTreeDepth > 0);
+    // The intermediate state tree must be smaller than the full state tree.
+    assert(tallyProcessingStateTreeDepth < stateTreeDepth); 
+
+    // Number of children per node in the tree, defining the tree's branching factor.
+    var TREE_ARITY = 5;
+    var BALLOT_TREE_ARITY = 2;
+    var VOTE_COUNTS_TREE_ARITY = 2;
+
+    // The number of ballots processed at once, determined by the depth of the intermediate state tree.
+    var ballotBatchSize = BALLOT_TREE_ARITY ** tallyProcessingStateTreeDepth;
+    var voteCountsBatchSize = VOTE_COUNTS_TREE_ARITY ** tallyProcessingStateTreeDepth;
+    // Number of voting options available, determined by the depth of the vote option tree.
+    var totalVoteOptions = TREE_ARITY ** voteOptionTreeDepth;
+
+    // Number of elements in each ballot.
+    var BALLOT_LENGTH = 2;
+    // Index for the nonce in the ballot array.
+    var BALLOT_NONCE_INDEX = 0;
+    // Index for the voting option root in the ballot array.
+    var BALLOT_VOTE_OPTION_ROOT_INDEX = 1;
+    // Difference in tree depths, used in path calculations.
+    var STATE_TREE_DEPTH_DIFFERENCE = stateTreeDepth - tallyProcessingStateTreeDepth;
+    // Number of elements in each vote count leaf.
+    var VOTE_COUNTS_LENGTH = 2;
+    // Index for the voting option index.
+    var VOTE_COUNTS_NONCE_INDEX = 0;
+    // Index for root of the vote count per option.
+    var VOTE_COUNTS_ROOT_INDEX = 1;
+
+    // Root of the state Merkle tree, representing the overall state before voting.
+    signal input stateRoot;
+    // Root of the ballot Merkle tree, representing the submitted ballots.
+    signal input ballotRoot;
+    // Root of the vote counts Merkle tree, representing the counts of votes for each option.
+    signal input voteCountsRoot;
+    // Salt used in commitment to secure the ballot data.
+    signal input sbSalt;
+    // Commitment to the state and ballots.
+    signal input sbCommitment;
+    // Commitment to the current tally before this batch.
+    signal input currentTallyCommitment;
+    // Commitment to the new tally after processing this batch.
+    signal input newTallyCommitment;
+    // Start index of given batch
+    signal input index;
+    // Number of users that signup
+    signal input totalSignups;
+    // Ballots and their corresponding path elements for verification in the tree.
+    signal input ballots[ballotBatchSize][BALLOT_LENGTH];
+    signal input ballotPathElements[STATE_TREE_DEPTH_DIFFERENCE][BALLOT_TREE_ARITY - 1];
+    signal input votes[ballotBatchSize][totalVoteOptions];
+    // Individual vote count tree and their corresponding path elements for verification in the tree.
+    signal input voteCounts[voteCountsBatchSize][VOTE_COUNTS_LENGTH];
+    signal input voteCountsPathElements[STATE_TREE_DEPTH_DIFFERENCE][VOTE_COUNTS_TREE_ARITY - 1];
+    signal input voteCountsData[voteCountsBatchSize][totalVoteOptions];
+    // Current results for each vote option.
+    signal input currentResults[totalVoteOptions];
+    // Salt for the root of the current results.
+    signal input currentResultsRootSalt;
+    // Total voice credits spent so far.
+    signal input currentSpentVoiceCreditSubtotal;
+    // Salt for the total spent voice credits.
+    signal input currentSpentVoiceCreditSubtotalSalt;
+    // Spent voice credits per vote option.
+    signal input currentPerVoteOptionSpentVoiceCredits[totalVoteOptions];
+    // Salt for the root of spent credits per option.
+    signal input currentPerVoteOptionSpentVoiceCreditsRootSalt;
+    // Salt for the root of the new results.
+    signal input newResultsRootSalt;
+    // Salt for the new spent credits per vote option root.
+    signal input newPerVoteOptionSpentVoiceCreditsRootSalt;
+    // Salt for the new total spent voice credits root. 
+    signal input newSpentVoiceCreditSubtotalSalt;
+
+    // Verify sbCommitment.
+    var computedSbCommitment = PoseidonHasher(3)([stateRoot, ballotRoot, sbSalt]);
+    computedSbCommitment === sbCommitment;
+
+    // Validates that the index is within the valid range of sign-ups.
+    var totalSignupsValid = LessEqThan(50)([index, totalSignups]);
+    totalSignupsValid === 1;
+
+    // Hashes each ballot for subroot generation, and checks the existence of the leaf in the Merkle tree.    
+    var computedBallotHashers[ballotBatchSize];
+    var computedVoteCountsHashers[voteCountsBatchSize];
+    
+    for (var i = 0; i < ballotBatchSize; i++) {
+        computedBallotHashers[i] = PoseidonHasher(2)([
+            ballots[i][BALLOT_NONCE_INDEX],
+            ballots[i][BALLOT_VOTE_OPTION_ROOT_INDEX]
+        ]);
+    }
+
+    for (var i = 0; i < voteCountsBatchSize; i++) {
+        computedVoteCountsHashers[i] = PoseidonHasher(2)([
+            voteCounts[i][VOTE_COUNTS_NONCE_INDEX],
+            voteCounts[i][VOTE_COUNTS_ROOT_INDEX]
+        ]);
+    }
+
+    var computedBallotSubroot = CheckRoot(tallyProcessingStateTreeDepth)(computedBallotHashers);
+    var computedBallotPathIndices[STATE_TREE_DEPTH_DIFFERENCE] = Num2Bits(STATE_TREE_DEPTH_DIFFERENCE)(index / ballotBatchSize);
+
+    var computedVoteCountsSubroot = CheckRoot(tallyProcessingStateTreeDepth)(computedVoteCountsHashers);
+    var computedVoteCountsPathIndices[STATE_TREE_DEPTH_DIFFERENCE] = Num2Bits(STATE_TREE_DEPTH_DIFFERENCE)(index / voteCountsBatchSize);
+
+    // Verifies each ballot's existence within the ballot tree.
+    LeafExists(STATE_TREE_DEPTH_DIFFERENCE)(
+        computedBallotSubroot,
+        ballotPathElements,
+        computedBallotPathIndices,
+        ballotRoot
+    );
+
+    // Verifies each vote count's existence within the vote count tree.
+    LeafExists(STATE_TREE_DEPTH_DIFFERENCE)(
+        computedVoteCountsSubroot,
+        voteCountsPathElements,
+        computedVoteCountsPathIndices,
+        voteCountsRoot
+    );
+
+    // Processes vote options, verifying each against its declared root.
+    var computedVoteTree[ballotBatchSize];
+
+    for (var i = 0; i < ballotBatchSize; i++) {
+        computedVoteTree[i] = QuinaryCheckRoot(voteOptionTreeDepth)(votes[i]);
+        computedVoteTree[i] === ballots[i][BALLOT_VOTE_OPTION_ROOT_INDEX];
+    }
+
+    // Processes vote counts, verifying each against its declared root.
+    var computedVoteCountsTree[voteCountsBatchSize];
+
+    for (var i = 0; i < voteCountsBatchSize; i++) {
+        computedVoteCountsTree[i] = QuinaryCheckRoot(voteOptionTreeDepth)(voteCountsData[i]);
+        computedVoteCountsTree[i] === voteCounts[i][VOTE_COUNTS_ROOT_INDEX];
+    }
+
+    // Calculates new results and spent voice credits based on the current and incoming votes.
+    var computedIsFirstBatch = IsZero()(index);
+    var computedIsZero = IsZero()(computedIsFirstBatch);
+
+    // Tally the new results.
+    var computedCalculateTotalResult[totalVoteOptions];
+    for (var i = 0; i < totalVoteOptions; i++) {
+        var numsRC[ballotBatchSize + 1];
+        numsRC[ballotBatchSize] = currentResults[i] * computedIsZero;
+        for (var j = 0; j < ballotBatchSize; j++) {
+            numsRC[j] = votes[j][i];
+        }
+
+        computedCalculateTotalResult[i] = CalculateTotal(ballotBatchSize + 1)(numsRC);
+    }
+
+    // Tally the new spent voice credit total.
+    var numsSVC[ballotBatchSize * totalVoteOptions + 1];
+    numsSVC[ballotBatchSize * totalVoteOptions] = currentSpentVoiceCreditSubtotal * computedIsZero;
+    for (var i = 0; i < ballotBatchSize; i++) {
+        for (var j = 0; j < totalVoteOptions; j++) {
+            numsSVC[i * totalVoteOptions + j] = votes[i][j] * votes[i][j];
+        }
+    }
+
+    var computedNewSpentVoiceCreditSubtotal = CalculateTotal(ballotBatchSize * totalVoteOptions + 1)(numsSVC);
+
+    // Tally the spent voice credits per vote option.
+    var computedNewPerVOSpentVoiceCredits[totalVoteOptions];
+
+    for (var i = 0; i < totalVoteOptions; i++) {
+        var computedTotalVoiceCreditSpent[ballotBatchSize + 1];
+        computedTotalVoiceCreditSpent[ballotBatchSize] = currentPerVoteOptionSpentVoiceCredits[i] * computedIsZero;
+        for (var j = 0; j < ballotBatchSize; j++) {
+            computedTotalVoiceCreditSpent[j] = votes[j][i] * votes[j][i];
+        }
+
+        computedNewPerVOSpentVoiceCredits[i] = CalculateTotal(ballotBatchSize + 1)(computedTotalVoiceCreditSpent);
+    }
+    
+    // Verifies the updated results and spent credits, ensuring consistency and correctness of tally updates.
+    ResultCommitmentVerifierQv(voteOptionTreeDepth)(
+        computedIsFirstBatch,
+        currentTallyCommitment,
+        newTallyCommitment,
+        currentResults,
+        currentResultsRootSalt,
+        computedCalculateTotalResult,
+        newResultsRootSalt,
+        currentSpentVoiceCreditSubtotal,
+        currentSpentVoiceCreditSubtotalSalt,
+        computedNewSpentVoiceCreditSubtotal,
+        newSpentVoiceCreditSubtotalSalt,
+        currentPerVoteOptionSpentVoiceCredits,
+        currentPerVoteOptionSpentVoiceCreditsRootSalt,
+        computedNewPerVOSpentVoiceCredits,
+        newPerVoteOptionSpentVoiceCreditsRootSalt        
+    );
+}

package/circom/utils/CalculateTotal.circom

@@ -0,0 +1,24 @@
+pragma circom 2.0.0;
+
+/**
+ * Computes the cumulative sum of an array of length input signals.
+ * It iterates through each input, aggregating the sum up to that point,
+ * and outputs the total sum of all inputs. This template is useful for
+ * operations requiring the total sum of multiple signals, ensuring the
+ * final output reflects the cumulative total of the inputs provided.
+ */
+template CalculateTotal(length) {
+    // Array of values.
+    signal input nums[length];
+    // Total sum.
+    signal output sum;
+
+    signal sums[length];
+    sums[0] <== nums[0];
+
+    for (var i = 1; i < length; i++) {
+        sums[i] <== sums[i - 1] + nums[i];
+    }
+
+    sum <== sums[length - 1];
+}

package/circom/utils/EdDSAPoseidonVerifier.circom

@@ -0,0 +1,91 @@
+pragma circom 2.0.0;
+
+// circomlib imports
+include "./compconstant.circom";
+include "./comparators.circom";
+include "./pointbits.circom";
+include "./bitify.circom";
+include "./escalarmulany.circom";
+include "./escalarmulfix.circom";
+// local imports
+include "./PoseidonHasher.circom";
+
+/**
+ * Variant of the EdDSAPoseidonVerifier template from circomlib
+ * https://github.com/iden3/circomlib/blob/master/circuits/eddsa.circom
+ */
+template EdDSAPoseidonVerifier() {
+    // The prime subgroup order.
+    var SUBGROUP_ORDER = 2736030358979909402780800718157159386076813972158567259200215660948447373041;
+
+    // The base point of the BabyJubJub curve.
+    var BASE8[2] = [
+        5299619240641551281634865583518297030282874472190772894086521144482721001553,
+        16950150798460657717958625567821834550301663161624707787222815936182638968203
+    ];
+
+    // The x and y coordinates of the public key.
+    signal input publicKeyX;
+    signal input publicKeyY;
+    // Signature scalar.
+    signal input signatureScalar;
+    // The x and y coordinates of the signature point.
+    signal input signaturePointX;
+    signal input signaturePointY;
+    // Message hash.
+    signal input messageHash;
+    // Output signal for the validity of the signature.
+    signal output isValid;
+
+    // Ensure signatureScalar<Subgroup Order.
+    // convert the signature scalar signatureScalar into its binary representation.
+    var computedNum2Bits[254] = Num2Bits(254)(signatureScalar);
+
+    var computedCompConstantIn[254] = computedNum2Bits;
+    computedCompConstantIn[253] = 0;
+
+    // A component that ensures signatureScalar is within a valid range, 
+    // comparing it against a constant representing the subgroup order.
+    var computedCompConstant = CompConstant(SUBGROUP_ORDER - 1)(computedCompConstantIn);
+
+    // Calculate the h = H(R, A, msg).
+    var computedH2Bits[254] = Num2Bits_strict()(PoseidonHasher(5)([
+      signaturePointX,
+      signaturePointY,
+      publicKeyX,
+      publicKeyY,
+      messageHash
+    ]));
+
+    // These components perform point doubling operations on the public key
+    // to align it within the correct subgroup as part of the verification process.
+    var (computedDouble1XOut, computedDouble1YOut) = BabyDbl()(publicKeyX, publicKeyY);
+    var (computedDouble2XOut, computedDouble2YOut) = BabyDbl()(computedDouble1XOut, computedDouble1YOut);
+    var (computedDouble3XOut, computedDouble3YOut) = BabyDbl()(computedDouble2XOut, computedDouble2YOut);
+
+    // A component that performs scalar multiplication of the 
+    // adjusted public key by the hash output, essential for the verification calculation.
+    var computedEscalarMulAny[2] = EscalarMulAny(254)(computedH2Bits, [computedDouble3XOut, computedDouble3YOut]);
+
+    // Compute the right side: right =  R8 + right2.
+    var (computedAddRightXOut, computedAddRightYOut) = BabyAdd()(signaturePointX, signaturePointY, computedEscalarMulAny[0], computedEscalarMulAny[1]);
+    
+    // Fixed-base scalar multiplication of a base point by signatureScalar.
+    var computedEscalarMulFix[2] = EscalarMulFix(254, BASE8)(computedNum2Bits);
+
+    // Components to check the equality of x and y coordinates 
+    // between the computed and expected points of the signature.
+    var computedIsRightValid = IsEqual()([computedEscalarMulFix[0], computedAddRightXOut]);
+    var computedIsLeftValid = IsEqual()([computedEscalarMulFix[1], computedAddRightYOut]);
+    var computedIsLeftRightValid = IsEqual()([computedIsRightValid + computedIsLeftValid, 2]);
+
+    // Components to handle edge cases and ensure that all conditions 
+    // for a valid signature are met, including the 
+    // public key not being zero and other integrity checks.
+    var computedIsAxZero = IsZero()(publicKeyX);
+    var computedIsAxEqual = IsEqual()([computedIsAxZero, 0]);
+    var computedIsCcZero = IsZero()(computedCompConstant);
+    var computedIsValid = IsEqual()([computedIsLeftRightValid + computedIsAxEqual + computedIsCcZero, 3]);
+
+    isValid <== computedIsValid;
+}

package/circom/utils/MessageHasher.circom

@@ -0,0 +1,57 @@
+pragma circom 2.0.0;
+
+include "./PoseidonHasher.circom";
+
+/**
+ * Hashes a MACI message and the public key used for message encryption. 
+ * This template processes 10 message inputs and a 2-element public key
+ * combining them using the Poseidon hash function. The hashing process involves two stages: 
+ * 1. hashing message parts data groups of five and,
+ * 2. hashing the grouped results alongside the first message input and 
+ * the encryption public key to produce a final hash output. 
+ */
+template MessageHasher() {
+    // Message parts
+    var MESSAGE_PARTS = 10;
+    var STATE_INDEX = 0;
+    var VOTE_OPTION_INDEX = 1;
+    var NEW_VOTE_WEIGHT = 2;
+    var NONCE = 3;
+    var POLL_ID = 4;
+    var SIGNATURE_POINT_X = 5;
+    var SIGNATURE_POINT_Y = 6;
+    var SIGNATURE_SCALAR = 7;
+    var ENCRYPTED_PUBLIC_KEY_X = 8;
+    var ENCRYPTED_PUBLIC_KEY_Y = 9;
+
+    // The MACI message is composed of 10 parts.
+    signal input data[MESSAGE_PARTS];
+    // the public key used to encrypt the message.
+    signal input encryptionPublicKey[2];
+
+    // we output an hash.
+    signal output hash;
+
+    var computedHasherPart1 = PoseidonHasher(5)([
+        data[STATE_INDEX],
+        data[VOTE_OPTION_INDEX],
+        data[NEW_VOTE_WEIGHT],
+        data[NONCE],
+        data[POLL_ID]
+    ]);
+
+    var computedHasherPart2 = PoseidonHasher(5)([
+        data[SIGNATURE_POINT_X],        
+        data[SIGNATURE_POINT_Y],
+        data[SIGNATURE_SCALAR],
+        data[ENCRYPTED_PUBLIC_KEY_X],
+        data[ENCRYPTED_PUBLIC_KEY_Y]
+    ]);
+
+    hash <== PoseidonHasher(4)([
+        computedHasherPart1,
+        computedHasherPart2,
+        encryptionPublicKey[0],
+        encryptionPublicKey[1]        
+    ]);
+}

package/circom/utils/MessageToCommand.circom

@@ -0,0 +1,107 @@
+pragma circom 2.0.0;
+
+// circomlib import
+include "./bitify.circom";
+// zk-kit imports
+include "./ecdh.circom";
+include "./unpack-element.circom";
+include "./poseidon-cipher.circom";
+
+/**
+ * Converts a MACI message to a command by decrypting it.
+ * Processes encrypted MACI messages into structured MACI commands 
+ * by decrypting using a shared key derived from ECDH. After decryption, 
+ * unpacks and assigns decrypted values to specific command components. 
+ */
+template MessageToCommand() {
+    var MESSAGE_LENGTH = 7;
+    var PACKED_COMMAND_LENGTH = 4;
+    var UNPACK_ELEMENT_LENGTH = 5;
+    var DECRYPTED_LENGTH = 9;
+    var MESSAGE_PARTS = 10;
+    
+    // Element indices.
+    var ELEMENT_POLL_ID = 0;
+    var ELEMENT_NONCE = 1;
+    var ELEMENT_NEW_VOTE_WEIGHT = 2;
+    var ELEMENT_VOTE_OPTION_INDEX = 3;
+    var ELEMENT_STATE_INDEX = 4;
+
+    // Command indices.
+    var COMMAND_STATE_INDEX = 0;
+    var COMMAND_PUBLIC_KEY_X = 1;
+    var COMMAND_PUBLIC_KEY_Y = 2;
+    var COMMAND_SALT = 3;
+
+    // Decryptor indices.
+    var SIGNATURE_POINT_X = 4;
+    var SIGNATURE_POINT_Y = 5;
+    var SIGNATURE_SCALAR = 6;
+
+    // The message is an array of 10 parts.
+    signal input message[MESSAGE_PARTS];
+    // The encryption private key
+    signal input encryptionPrivateKey;
+    // The encryption public key
+    signal input encryptionPublicKey[2];
+
+    // Command parts.
+    signal output stateIndex;
+    // The new public key.
+    signal output newPublicKey[2];
+    // The vote option index.
+    signal output voteOptionIndex;
+    // The new vote weight.
+    signal output newVoteWeight;
+    // The nonce.
+    signal output nonce;
+    // The poll id.
+    signal output pollId;
+    // The salt.
+    signal output salt;
+    // The signature point.
+    signal output signaturePoint[2];
+    // The signature scalar.
+    signal output signatureScalar;
+
+    // Packed command. 
+    signal output packedCommandOut[PACKED_COMMAND_LENGTH];
+
+    // Generate the shared key for decrypting the message.
+    var computedEcdh[2] = Ecdh()(encryptionPrivateKey, encryptionPublicKey);
+
+    // Decrypt the message using Poseidon decryption.
+    var computedDecryptor[DECRYPTED_LENGTH] = PoseidonDecryptWithoutCheck(MESSAGE_LENGTH)(
+        message,
+        0, 
+        computedEcdh
+    );
+
+    // Save the decrypted message into a packed command signal.
+    signal packedCommand[PACKED_COMMAND_LENGTH];
+
+    for (var i = 0; i < PACKED_COMMAND_LENGTH; i++) {
+        packedCommand[i] <== computedDecryptor[i];
+    }
+
+    var computedUnpackElement[UNPACK_ELEMENT_LENGTH] = UnpackElement(UNPACK_ELEMENT_LENGTH)(
+        packedCommand[COMMAND_STATE_INDEX]
+    );
+
+    // Everything below were packed into the first element.
+    pollId <== computedUnpackElement[ELEMENT_POLL_ID];
+    nonce <== computedUnpackElement[ELEMENT_NONCE];
+    newVoteWeight <== computedUnpackElement[ELEMENT_NEW_VOTE_WEIGHT];
+    voteOptionIndex <== computedUnpackElement[ELEMENT_VOTE_OPTION_INDEX];
+    stateIndex <== computedUnpackElement[ELEMENT_STATE_INDEX];
+
+    newPublicKey[0] <== packedCommand[COMMAND_PUBLIC_KEY_X];
+    newPublicKey[1] <== packedCommand[COMMAND_PUBLIC_KEY_Y];
+    salt <== packedCommand[COMMAND_SALT];
+
+    signaturePoint[0] <== computedDecryptor[SIGNATURE_POINT_X];
+    signaturePoint[1] <== computedDecryptor[SIGNATURE_POINT_Y];
+    signatureScalar <== computedDecryptor[SIGNATURE_SCALAR];
+
+    packedCommandOut <== packedCommand;
+}

package/circom/utils/PoseidonHasher.circom

@@ -0,0 +1,29 @@
+pragma circom 2.0.0;
+
+// zk-kit imports
+include "./poseidon-cipher.circom";
+
+/**
+ * Computes the Poseidon hash for an array of n inputs, including a default initial state 
+ * of zero not counted in n. First, extends the inputs by prepending a zero, creating an array [0, inputs]. 
+ * Then, the Poseidon hash of the extended inputs is calculated, with the first element of the 
+ * result assigned as the output. 
+ */
+template PoseidonHasher(n) {
+    signal input inputs[n];
+    signal output out;
+
+    // [0, inputs].
+    var computedExtendedInputs[n + 1];
+    computedExtendedInputs[0] = 0;
+
+    for (var i = 0; i < n; i++) {
+        computedExtendedInputs[i + 1] = inputs[i];
+    }
+
+    // Compute the Poseidon hash of the extended inputs.
+    var computedPoseidonPerm[n + 1]; 
+    computedPoseidonPerm = PoseidonPerm(n + 1)(computedExtendedInputs);
+
+    out <== computedPoseidonPerm[0];
+}

package/circom/utils/PrivateToPublicKey.circom

@@ -0,0 +1,38 @@
+pragma circom 2.0.0;
+
+// circomlib imports
+include "./bitify.circom";
+include "./comparators.circom";
+include "./escalarmulfix.circom";
+
+/**
+ * Converts a private key to a public key on the BabyJubJub curve.
+ * The input private key needs to be hashed and then pruned before.
+ */
+template PrivateToPublicKey() {
+    // The base point of the BabyJubJub curve.
+    var BASE8[2] = [
+        5299619240641551281634865583518297030282874472190772894086521144482721001553,
+        16950150798460657717958625567821834550301663161624707787222815936182638968203
+    ];
+
+    // The prime subgroup order.
+    var SUBGROUP_ORDER = 2736030358979909402780800718157159386076813972158567259200215660948447373041;
+
+    // The private key
+    signal input privateKey;
+    // The public key
+    signal output publicKey[2];
+
+    // Check if private key is in the prime subgroup order
+    var isLessThan = LessThan(251)([privateKey, SUBGROUP_ORDER]);
+    isLessThan === 1;
+
+    // Convert the private key to bits.
+    var computedPrivateBits[253] = Num2Bits(253)(privateKey);
+
+    // Perform scalar multiplication with the basepoint.
+    var computedPublicKey[2] = EscalarMulFix(253, BASE8)(computedPrivateBits);
+
+    publicKey <== computedPublicKey;
+}

package/circom/utils/VerifySignature.circom

@@ -0,0 +1,39 @@
+pragma circom 2.0.0;
+
+// local imports
+include "./EdDSAPoseidonVerifier.circom";
+include "./PoseidonHasher.circom";
+
+/**
+ * Verifies the EdDSA signature for a given command, which has exactly four elements in the hash preimage.
+ */
+template VerifySignature() {
+    // Number of elements in the hash preimage.
+    var PRE_IMAGE_LENGTH = 4;
+
+    // Public key of the signer, consisting of two coordinates [x, y].
+    signal input publicKey[2];
+    // signaturePoint point from the signature, consisting of two coordinates [x, y]. 
+    signal input signaturePoint[2];
+    // Scalar component of the signature.
+    signal input signatureScalar;
+    // The preimage data that was hashed, an array of four elements.
+    signal input preimage[PRE_IMAGE_LENGTH];
+    // The validity of the signature.
+    signal output isValid;
+
+    // Hash the preimage using the Poseidon hashing function configured for four inputs.
+    var computedPreimage = PoseidonHasher(4)(preimage);
+
+    // Instantiate the patched EdDSA Poseidon verifier with the necessary inputs.
+    var computedIsValid = EdDSAPoseidonVerifier()(
+        publicKey[0],
+        publicKey[1],
+        signatureScalar,
+        signaturePoint[0],
+        signaturePoint[1],
+        computedPreimage
+    );
+
+    isValid <== computedIsValid;
+}