@maci-protocol/circuits 0.0.0-ci.044d30d

package/circom/coordinator/qv/tallyVotes.circom

@@ -0,0 +1,279 @@
+pragma circom 2.0.0;
+
+// circomlib import
+include "./comparators.circom";
+// zk-kit import
+include "./unpack-element.circom";
+// local imports
+include "../../utils/trees/CheckRoot.circom";
+include "../../utils/trees/MerkleGeneratePathIndices.circom";
+include "../../utils/trees/LeafExists.circom";
+include "../../utils/trees/incrementalQuinaryTree.circom";
+include "../../utils/calculateTotal.circom";
+include "../../utils/hashers.circom";
+
+/**
+ * Processes batches of votes and verifies their validity in a Merkle tree structure.
+ * This template supports Quadratic Voting (QV).
+ */
+template TallyVotes(
+    stateTreeDepth,
+    intStateTreeDepth,
+    voteOptionTreeDepth
+) {
+    // Ensure there's at least one level in the vote option tree.
+    assert(voteOptionTreeDepth > 0);
+    // Ensure the intermediate state tree has at least one level.
+    assert(intStateTreeDepth > 0);
+    // The intermediate state tree must be smaller than the full state tree.
+    assert(intStateTreeDepth < stateTreeDepth); 
+
+    // Number of children per node in the tree, defining the tree's branching factor.
+    var TREE_ARITY = 5;
+    var BALLOT_TREE_ARITY = 2;
+
+    // The number of ballots processed at once, determined by the depth of the intermediate state tree.
+    var batchSize = BALLOT_TREE_ARITY ** intStateTreeDepth;
+    // Number of voting options available, determined by the depth of the vote option tree.
+    var numVoteOptions = TREE_ARITY ** voteOptionTreeDepth;
+
+    // Number of elements in each ballot.
+    var BALLOT_LENGTH = 2;
+    // Index for the nonce in the ballot array.
+    var BALLOT_NONCE_IDX = 0;
+    // Index for the voting option root in the ballot array.
+    var BALLOT_VO_ROOT_IDX = 1;
+    // Difference in tree depths, used in path calculations.
+    var k = stateTreeDepth - intStateTreeDepth;
+
+    // Root of the state Merkle tree, representing the overall state before voting.
+    signal input stateRoot;
+    // Root of the ballot Merkle tree, representing the submitted ballots.
+    signal input ballotRoot;
+    // Salt used in commitment to secure the ballot data.
+    signal input sbSalt;
+    // Commitment to the state and ballots.
+    signal input sbCommitment;
+    // Commitment to the current tally before this batch.
+    signal input currentTallyCommitment;
+    // Commitment to the new tally after processing this batch.
+    signal input newTallyCommitment;
+    // Start index of given batch
+    signal input index;
+    // Number of users that signup
+    signal input numSignUps;
+    // Ballots and their corresponding path elements for verification in the tree.
+    signal input ballots[batchSize][BALLOT_LENGTH];
+    signal input ballotPathElements[k][BALLOT_TREE_ARITY - 1];
+    signal input votes[batchSize][numVoteOptions];
+    // Current results for each vote option.
+    signal input currentResults[numVoteOptions];
+    // Salt for the root of the current results.
+    signal input currentResultsRootSalt;
+    // Total voice credits spent so far.
+    signal input currentSpentVoiceCreditSubtotal;
+    // Salt for the total spent voice credits.
+    signal input currentSpentVoiceCreditSubtotalSalt;
+    // Spent voice credits per vote option.
+    signal input currentPerVOSpentVoiceCredits[numVoteOptions];
+    // Salt for the root of spent credits per option.
+    signal input currentPerVOSpentVoiceCreditsRootSalt;
+    // Salt for the root of the new results.
+    signal input newResultsRootSalt;
+    // Salt for the new spent credits per vote option root.
+    signal input newPerVOSpentVoiceCreditsRootSalt;
+    // Salt for the new total spent voice credits root. 
+    signal input newSpentVoiceCreditSubtotalSalt;
+
+    // Verify sbCommitment.
+    var computedSbCommitment = PoseidonHasher(3)([stateRoot, ballotRoot, sbSalt]);
+    computedSbCommitment === sbCommitment;
+
+    // Validates that the index is within the valid range of sign-ups.
+    var numSignUpsValid = LessEqThan(50)([index, numSignUps]);
+    numSignUpsValid === 1;
+
+    // Hashes each ballot for subroot generation, and checks the existence of the leaf in the Merkle tree.    
+    var computedBallotHashers[batchSize];
+    
+    for (var i = 0; i < batchSize; i++) {
+        computedBallotHashers[i] = PoseidonHasher(2)([ballots[i][BALLOT_NONCE_IDX], ballots[i][BALLOT_VO_ROOT_IDX]]);
+    }
+
+    var computedBallotSubroot = CheckRoot(intStateTreeDepth)(computedBallotHashers);
+    var computedBallotPathIndices[k] = MerkleGeneratePathIndices(k)(index / batchSize);
+
+    // Verifies each ballot's existence within the ballot tree.
+    LeafExists(k)(
+        computedBallotSubroot,
+        ballotPathElements,
+        computedBallotPathIndices,
+        ballotRoot
+    );
+
+    // Processes vote options, verifying each against its declared root.
+    var computedVoteTree[batchSize];
+    for (var i = 0; i < batchSize; i++) {
+        computedVoteTree[i] = QuinCheckRoot(voteOptionTreeDepth)(votes[i]);
+        computedVoteTree[i] === ballots[i][BALLOT_VO_ROOT_IDX];
+    }
+
+    // Calculates new results and spent voice credits based on the current and incoming votes.
+    var computedIsFirstBatch = IsZero()(index);
+    var computedIsZero = IsZero()(computedIsFirstBatch);
+
+    // Tally the new results.
+    var computedCalculateTotalResult[numVoteOptions];
+    for (var i = 0; i < numVoteOptions; i++) {
+        var numsRC[batchSize + 1];
+        numsRC[batchSize] = currentResults[i] * computedIsZero;
+        for (var j = 0; j < batchSize; j++) {
+            numsRC[j] = votes[j][i];
+        }
+
+        computedCalculateTotalResult[i] = CalculateTotal(batchSize + 1)(numsRC);
+    }
+
+    // Tally the new spent voice credit total.
+    var numsSVC[batchSize * numVoteOptions + 1];
+    numsSVC[batchSize * numVoteOptions] = currentSpentVoiceCreditSubtotal * computedIsZero;
+    for (var i = 0; i < batchSize; i++) {
+        for (var j = 0; j < numVoteOptions; j++) {
+            numsSVC[i * numVoteOptions + j] = votes[i][j] * votes[i][j];
+        }
+    }
+
+    var computedNewSpentVoiceCreditSubtotal = CalculateTotal(batchSize * numVoteOptions + 1)(numsSVC);
+
+    // Tally the spent voice credits per vote option.
+    var computedNewPerVOSpentVoiceCredits[numVoteOptions];
+
+    for (var i = 0; i < numVoteOptions; i++) {
+        var computedNumsSVC[batchSize + 1];
+        computedNumsSVC[batchSize] = currentPerVOSpentVoiceCredits[i] * computedIsZero;
+        for (var j = 0; j < batchSize; j++) {
+            computedNumsSVC[j] = votes[j][i] * votes[j][i];
+        }
+
+        computedNewPerVOSpentVoiceCredits[i] = CalculateTotal(batchSize + 1)(computedNumsSVC);
+    }
+    
+    // Verifies the updated results and spent credits, ensuring consistency and correctness of tally updates.
+    ResultCommitmentVerifier(voteOptionTreeDepth)(
+        computedIsFirstBatch,
+        currentTallyCommitment,
+        newTallyCommitment,
+        currentResults,
+        currentResultsRootSalt,
+        computedCalculateTotalResult,
+        newResultsRootSalt,
+        currentSpentVoiceCreditSubtotal,
+        currentSpentVoiceCreditSubtotalSalt,
+        computedNewSpentVoiceCreditSubtotal,
+        newSpentVoiceCreditSubtotalSalt,
+        currentPerVOSpentVoiceCredits,
+        currentPerVOSpentVoiceCreditsRootSalt,
+        computedNewPerVOSpentVoiceCredits,
+        newPerVOSpentVoiceCreditsRootSalt        
+    );
+}
+
+/** 
+ * Performs verifications and computations related to current voting results. 
+ * Also, computes and outputs a commitment to the new results.
+ * This template supports the Quadratic Voting (QV).
+ */
+template ResultCommitmentVerifier(voteOptionTreeDepth) {
+    // Number of children per node in the tree, defining the tree's branching factor.
+    var TREE_ARITY = 5;
+    // Number of voting options available, determined by the depth of the vote option tree.
+    var numVoteOptions = TREE_ARITY ** voteOptionTreeDepth;
+
+    // Equal to 1 if this is the first batch, otherwise 0.
+    signal input isFirstBatch;
+    // Commitment to the current tally before this batch.
+    signal input currentTallyCommitment;
+    // Commitment to the new tally after processing this batch.
+    signal input newTallyCommitment;
+
+    // Current results for each vote option.
+    signal input currentResults[numVoteOptions];
+    // Salt for the root of the current results.
+    signal input currentResultsRootSalt;
+
+    // New results for each vote option.
+    signal input newResults[numVoteOptions];
+    // Salt for the root of the new results.
+    signal input newResultsRootSalt;
+
+    // Total voice credits spent so far.
+    signal input currentSpentVoiceCreditSubtotal;
+    // Salt for the total spent voice credits.
+    signal input currentSpentVoiceCreditSubtotalSalt;
+
+    // Total new voice credits spent.
+    signal input newSpentVoiceCreditSubtotal;
+    // Salt for the new total spent voice credits.
+    signal input newSpentVoiceCreditSubtotalSalt;
+
+    // Spent voice credits per vote option.
+    signal input currentPerVOSpentVoiceCredits[numVoteOptions];
+    // Salt for the root of spent credits per option.
+    signal input currentPerVOSpentVoiceCreditsRootSalt;
+
+    // New spent voice credits per vote option.
+    signal input newPerVOSpentVoiceCredits[numVoteOptions];
+    // Salt for the root of new spent credits per option.
+    signal input newPerVOSpentVoiceCreditsRootSalt;
+
+    // Compute the commitment to the current results.
+    var computedCurrentResultsRoot = QuinCheckRoot(voteOptionTreeDepth)(currentResults);
+
+    // Verify currentResultsCommitmentHash.
+    var computedCurrentResultsCommitment = PoseidonHasher(2)([computedCurrentResultsRoot, currentResultsRootSalt]);
+
+    // Compute the commitment to the current spent voice credits.
+    var computedCurrentSpentVoiceCreditsCommitment = PoseidonHasher(2)([currentSpentVoiceCreditSubtotal, currentSpentVoiceCreditSubtotalSalt]);
+
+    // Compute the root of the spent voice credits per vote option.
+    var computedCurrentPerVOSpentVoiceCreditsRoot = QuinCheckRoot(voteOptionTreeDepth)(currentPerVOSpentVoiceCredits);
+    var computedCurrentPerVOSpentVoiceCreditsCommitment = PoseidonHasher(2)([computedCurrentPerVOSpentVoiceCreditsRoot, currentPerVOSpentVoiceCreditsRootSalt]);
+
+    // Commit to the current tally.
+    var computedCurrentTallyCommitment = PoseidonHasher(3)([
+        computedCurrentResultsCommitment, 
+        computedCurrentSpentVoiceCreditsCommitment, 
+        computedCurrentPerVOSpentVoiceCreditsCommitment
+    ]);
+
+    // Check if the current tally commitment is correct only if this is not the first batch.
+    // computedIsZero.out is 1 if this is not the first batch.
+    // computedIsZero.out is 0 if this is the first batch.
+    var computedIsZero = IsZero()(isFirstBatch);
+
+    // hz is 0 if this is the first batch, currentTallyCommitment should be 0 if this is the first batch.
+    // hz is 1 if this is not the first batch, currentTallyCommitment should not be 0 if this is the first batch.
+    signal hz;
+    hz <== computedIsZero * computedCurrentTallyCommitment;
+    hz === currentTallyCommitment;
+
+    // Compute the root of the new results.
+    var computedNewResultsRoot = QuinCheckRoot(voteOptionTreeDepth)(newResults);
+    var computedNewResultsCommitment = PoseidonHasher(2)([computedNewResultsRoot, newResultsRootSalt]);
+
+    // Compute the commitment to the new spent voice credits value.
+    var computedNewSpentVoiceCreditsCommitment = PoseidonHasher(2)([newSpentVoiceCreditSubtotal, newSpentVoiceCreditSubtotalSalt]);
+
+    // Compute the root of the spent voice credits per vote option.
+    var computedNewPerVOSpentVoiceCreditsRoot = QuinCheckRoot(voteOptionTreeDepth)(newPerVOSpentVoiceCredits);
+    var computedNewPerVOSpentVoiceCreditsCommitment = PoseidonHasher(2)([computedNewPerVOSpentVoiceCreditsRoot, newPerVOSpentVoiceCreditsRootSalt]);
+
+    // Commit to the new tally.
+    var computedNewTallyCommitment = PoseidonHasher(3)([
+        computedNewResultsCommitment,
+        computedNewSpentVoiceCreditsCommitment,
+        computedNewPerVOSpentVoiceCreditsCommitment
+    ]);
+    
+    computedNewTallyCommitment === newTallyCommitment;
+}

package/circom/utils/calculateTotal.circom

@@ -0,0 +1,22 @@
+pragma circom 2.0.0;
+
+/**
+ * Computes the cumulative sum of an array of n input signals.
+ * It iterates through each input, aggregating the sum up to that point,
+ * and outputs the total sum of all inputs. This template is useful for
+ * operations requiring the total sum of multiple signals, ensuring the
+ * final output reflects the cumulative total of the inputs provided.
+ */
+template CalculateTotal(n) {
+    signal input nums[n];
+    signal output sum;
+
+    signal sums[n];
+    sums[0] <== nums[0];
+
+    for (var i = 1; i < n; i++) {
+        sums[i] <== sums[i - 1] + nums[i];
+    }
+
+    sum <== sums[n - 1];
+}

package/circom/utils/hashers.circom

@@ -0,0 +1,78 @@
+pragma circom 2.0.0;
+
+// zk-kit imports
+include "./poseidon-cipher.circom";
+
+/**
+ * Computes the Poseidon hash for an array of n inputs, including a default initial state 
+ * of zero not counted in n. First, extends the inputs by prepending a zero, creating an array [0, inputs]. 
+ * Then, the Poseidon hash of the extended inputs is calculated, with the first element of the 
+ * result assigned as the output. 
+ */
+template PoseidonHasher(n) {
+    signal input inputs[n];
+    signal output out;
+
+    // [0, inputs].
+    var computedExtendedInputs[n + 1];
+    computedExtendedInputs[0] = 0;
+
+    for (var i = 0; i < n; i++) {
+        computedExtendedInputs[i + 1] = inputs[i];
+    }
+
+    // Compute the Poseidon hash of the extended inputs.
+    var computedPoseidonPerm[n + 1]; 
+    computedPoseidonPerm = PoseidonPerm(n + 1)(computedExtendedInputs);
+
+    out <== computedPoseidonPerm[0];
+}
+
+/**
+ * Hashes a MACI message and the public key used for message encryption. 
+ * This template processes 10 message inputs and a 2-element public key
+ * combining them using the Poseidon hash function. The hashing process involves two stages: 
+ * 1. hashing message parts in groups of five and,
+ * 2. hashing the grouped results alongside the first message input and 
+ * the encryption public key to produce a final hash output. 
+ */
+template MessageHasher() {
+    // The MACI message is composed of 10 parts.
+    signal input in[10];
+    // the public key used to encrypt the message.
+    signal input encPubKey[2];
+    // we output an hash.
+    signal output hash;
+
+    // Hasher4(
+    //     Hasher5_1(in[1], in[2], in[3], in[4], in[5]),
+    //     Hasher5_2(in[6], in[7], in[8], in[9], in[10])
+    //     in[11],
+    //     in[12]
+    // )
+
+    var computedHasher5_1;
+    computedHasher5_1 = PoseidonHasher(5)([
+        in[0],
+        in[1],
+        in[2],
+        in[3],
+        in[4]
+    ]);
+
+    var computedHasher5_2;
+    computedHasher5_2 = PoseidonHasher(5)([
+        in[5],        
+        in[6],
+        in[7],
+        in[8],
+        in[9]
+    ]);
+
+    hash <== PoseidonHasher(4)([
+        computedHasher5_1,
+        computedHasher5_2,
+        encPubKey[0],
+        encPubKey[1]        
+    ]);
+}

package/circom/utils/messageToCommand.circom

@@ -0,0 +1,78 @@
+pragma circom 2.0.0;
+
+// circomlib import
+include "./bitify.circom";
+// zk-kit imports
+include "./ecdh.circom";
+include "./unpack-element.circom";
+include "./poseidon-cipher.circom";
+// local imports
+include "./hashers.circom";
+
+/**
+ * Converts a MACI message to a command by decrypting it.
+ * Processes encrypted MACI messages into structured MACI commands 
+ * by decrypting using a shared key derived from ECDH. After decryption, 
+ * unpacks and assigns decrypted values to specific command components. 
+ */
+template MessageToCommand() {
+    var MSG_LENGTH = 7;
+    var PACKED_CMD_LENGTH = 4;
+    var UNPACKED_CMD_LENGTH = 8;
+    var UNPACK_ELEM_LENGTH = 5;
+    var DECRYPTED_LENGTH = 9;
+    var MESSAGE_PARTS = 10;
+
+    // The message is an array of 10 parts.
+    signal input message[MESSAGE_PARTS];
+    signal input encPrivKey;
+    signal input encPubKey[2];
+
+    // Command parts.
+    signal output stateIndex;
+    signal output newPubKey[2];
+    signal output voteOptionIndex;
+    signal output newVoteWeight;
+    signal output nonce;
+    signal output pollId;
+    signal output salt;
+    signal output sigR8[2];
+    signal output sigS;
+    // Packed command. 
+    signal output packedCommandOut[PACKED_CMD_LENGTH];
+
+    // Generate the shared key for decrypting the message.
+    var computedEcdh[2] = Ecdh()(encPrivKey, encPubKey);
+
+    // Decrypt the message using Poseidon decryption.
+    var computedDecryptor[DECRYPTED_LENGTH] = PoseidonDecryptWithoutCheck(MSG_LENGTH)(
+        message,
+        0, 
+        computedEcdh
+    );
+
+    // Save the decrypted message into a packed command signal.
+    signal packedCommand[PACKED_CMD_LENGTH];
+    for (var i = 0; i < PACKED_CMD_LENGTH; i++) {
+        packedCommand[i] <== computedDecryptor[i];
+    }
+
+    var computedUnpackElement[UNPACK_ELEM_LENGTH] = UnpackElement(UNPACK_ELEM_LENGTH)(packedCommand[0]);
+
+    // Everything below were packed into the first element.
+    stateIndex <== computedUnpackElement[4];
+    voteOptionIndex <== computedUnpackElement[3];
+    newVoteWeight <== computedUnpackElement[2];
+    nonce <== computedUnpackElement[1];
+    pollId <== computedUnpackElement[0];
+
+    newPubKey[0] <== packedCommand[1];
+    newPubKey[1] <== packedCommand[2];
+    salt <== packedCommand[3];
+
+    sigR8[0] <== computedDecryptor[4];
+    sigR8[1] <== computedDecryptor[5];
+    sigS <== computedDecryptor[6];
+
+    packedCommandOut <== packedCommand;
+}

package/circom/utils/non-qv/messageValidator.circom

@@ -0,0 +1,89 @@
+pragma circom 2.0.0;
+
+// zk-kit imports
+include "./safe-comparators.circom";
+// local imports
+include "../verifySignature.circom";
+
+/**
+ * Checks if a MACI message is valid or not.
+ * This template does not support Quadratic Voting (QV).
+ */
+template MessageValidatorNonQv() {
+    // Length of the packed command.
+    var PACKED_CMD_LENGTH = 4;
+
+    // State index of the user.
+    signal input stateTreeIndex;
+    // Number of user sign-ups in the state tree.
+    signal input numSignUps;
+    // Vote option index.
+    signal input voteOptionIndex;
+    // Number of valid vote options for the poll.
+    signal input voteOptions;
+    // Ballot nonce.
+    signal input originalNonce;
+    // Command nonce.
+    signal input nonce;
+    // Packed command.
+    signal input cmd[PACKED_CMD_LENGTH];
+    // Public key of the state leaf (user).
+    signal input pubKey[2];
+    // ECDSA signature of the command (R part).
+    signal input sigR8[2];
+    // ECDSA signature of the command (S part).
+    signal input sigS;
+    // State leaf current voice credit balance.
+    signal input currentVoiceCreditBalance;
+    // Current number of votes for specific option. 
+    signal input currentVotesForOption;
+    // Vote weight.
+    signal input voteWeight;
+
+    // True when the command is valid; otherwise false.
+    signal output isValid;
+    // True if the state leaf index is valid
+    signal output isStateLeafIndexValid;
+    // True if the vote option index is valid
+    signal output isVoteOptionIndexValid;
+
+    // Check (1) - The state leaf index must be valid.
+    // The check ensure that the stateTreeIndex < numSignUps as first validation.
+    // Must be < because the stateTreeIndex is 0-based. Zero is for blank state leaf
+    // while 1 is for the first actual user.
+    var computedIsStateLeafIndexValid = SafeLessThan(252)([stateTreeIndex, numSignUps]);
+
+    // Check (2) - The vote option index must be less than the number of valid vote options (0 indexed).
+    var computedIsVoteOptionIndexValid = SafeLessThan(252)([voteOptionIndex, voteOptions]);
+
+    // Check (3) - The nonce must be correct.    
+    var computedIsNonceValid = IsEqual()([originalNonce + 1, nonce]);
+
+    // Check (4) - The signature must be correct.    
+    var computedIsSignatureValid = VerifySignature()(pubKey, sigR8, sigS, cmd);
+ 
+    // Check (5) - There must be sufficient voice credits.
+    // The check ensure that currentVoiceCreditBalance + (currentVotesForOption) >= (voteWeight).
+    var computedAreVoiceCreditsSufficient = SafeGreaterEqThan(252)(
+        [
+            currentVotesForOption + currentVoiceCreditBalance,
+            voteWeight
+        ]
+    );
+
+    // When all five checks are correct, then isValid = 1.
+    var computedIsUpdateValid = IsEqual()(
+        [
+            5,
+            computedIsSignatureValid + 
+            computedAreVoiceCreditsSufficient +
+            computedIsNonceValid +
+            computedIsStateLeafIndexValid +
+            computedIsVoteOptionIndexValid
+        ]
+    );
+
+    isValid <== computedIsUpdateValid;
+    isStateLeafIndexValid <== computedIsStateLeafIndexValid;
+    isVoteOptionIndexValid <== computedIsVoteOptionIndexValid;
+}

package/circom/utils/non-qv/stateLeafAndBallotTransformer.circom

@@ -0,0 +1,105 @@
+pragma circom 2.0.0;
+
+// circomlib import
+include "./mux1.circom";
+// local import
+include "./messageValidator.circom";
+
+/**
+ * Processes a command by verifying its validity and updates the state leaf and ballot accordingly. 
+ * If the message is correct, updates the public key in the state leaf and the nonce 
+ * in the ballot using multiplexer components.
+ * This template does not support Quadratic Voting (QV).
+ */
+template StateLeafAndBallotTransformerNonQv() {
+    // Length of the packed command.
+    var PACKED_CMD_LENGTH = 4;
+
+    // Number of user sign-ups in the state tree.
+    signal input numSignUps;
+    // Number of valid vote options for the poll.
+    signal input voteOptions;
+
+    // The following signals represents a state leaf (signed up user).
+    // Public key.
+    signal input slPubKey[2];
+    // Current voice credit balance.
+    signal input slVoiceCreditBalance;
+
+    // The following signals represents a ballot.
+    // Nonce.
+    signal input ballotNonce;
+    // Current number of votes for specific option. 
+    signal input ballotCurrentVotesForOption;
+
+    // The following signals represents a command.
+    // State index of the user.
+    signal input cmdStateIndex;
+    // Public key of the user.
+    signal input cmdNewPubKey[2];
+    // Vote option index.
+    signal input cmdVoteOptionIndex;
+    // Vote weight.
+    signal input cmdNewVoteWeight;
+    // Nonce.
+    signal input cmdNonce;
+    // Poll identifier.
+    signal input cmdPollId;
+    // Salt.
+    signal input cmdSalt;
+    // ECDSA signature of the command (R part).
+    signal input cmdSigR8[2];
+    // ECDSA signature of the command (S part).
+    signal input cmdSigS;
+    // Packed command. 
+    // nb. we are assuming that the packedCommand is always valid.
+    signal input packedCommand[PACKED_CMD_LENGTH];
+
+    // New state leaf (if the command is valid).
+    signal output newSlPubKey[2];
+    // New ballot (if the command is valid).
+    signal output newBallotNonce;
+    
+    // True when the command is valid; otherwise false.
+    signal output isValid;
+    // True if the state leaf index is valid
+    signal output isStateLeafIndexValid;
+    // True if the vote option index is valid
+    signal output isVoteOptionIndexValid;
+
+    // Check if the command / message is valid.
+    var (computedMessageValidator, computedIsStateLeafIndexValid, computedIsVoteOptionIndexValid) = MessageValidatorNonQv()(
+        cmdStateIndex,
+        numSignUps,
+        cmdVoteOptionIndex,
+        voteOptions,
+        ballotNonce,
+        cmdNonce,
+        packedCommand,
+        slPubKey,
+        cmdSigR8,
+        cmdSigS,
+        slVoiceCreditBalance,
+        ballotCurrentVotesForOption,
+        cmdNewVoteWeight
+    );
+
+    // If the message is valid then we swap out the public key.
+    // This means using a Mux1() for pubKey[0] and another one
+    // for pubKey[1].
+    var computedNewSlPubKey0Mux = Mux1()([slPubKey[0], cmdNewPubKey[0]], computedMessageValidator);
+    var computedNewSlPubKey1Mux = Mux1()([slPubKey[1], cmdNewPubKey[1]], computedMessageValidator);
+
+    newSlPubKey[0] <== computedNewSlPubKey0Mux;
+    newSlPubKey[1] <== computedNewSlPubKey1Mux;
+
+    // If the message is valid, then we swap out the ballot nonce
+    // using a Mux1().
+    var computedNewBallotNonceMux = Mux1()([ballotNonce, cmdNonce], computedMessageValidator);
+
+    newBallotNonce <== computedNewBallotNonceMux;
+
+    isValid <== computedMessageValidator;
+    isStateLeafIndexValid <== computedIsStateLeafIndexValid;
+    isVoteOptionIndexValid <== computedIsVoteOptionIndexValid;
+}

package/circom/utils/privToPubKey.circom

@@ -0,0 +1,36 @@
+pragma circom 2.0.0;
+
+// circomlib imports
+include "./bitify.circom";
+include "./comparators.circom";
+include "./escalarmulfix.circom";
+
+/**
+ * Converts a private key to a public key on the BabyJubJub curve.
+ * The input private key needs to be hashed and then pruned before.
+ */
+template PrivToPubKey() {
+    // The base point of the BabyJubJub curve.
+    var BASE8[2] = [
+        5299619240641551281634865583518297030282874472190772894086521144482721001553,
+        16950150798460657717958625567821834550301663161624707787222815936182638968203
+    ];
+
+    // Prime subgroup order 'l'.
+    var l = 2736030358979909402780800718157159386076813972158567259200215660948447373041;
+
+    signal input privKey;
+    signal output pubKey[2];
+
+    // Check if private key is in the prime subgroup order 'l'
+    var isLessThan = LessThan(251)([privKey, l]);
+    isLessThan === 1;
+
+    // Convert the private key to bits.
+    var computedPrivBits[253] = Num2Bits(253)(privKey);
+
+    // Perform scalar multiplication with the basepoint.
+    var computedEscalarMulFix[2] = EscalarMulFix(253, BASE8)(computedPrivBits);
+
+    pubKey <== computedEscalarMulFix;
+}