@semaphore-protocol/proof 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2022 Ethereum Foundation
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,87 @@
+<p align="center">
+    <h1 align="center">
+        Semaphore proof
+    </h1>
+    <p align="center">A library for generating and verifying Semaphore proofs.</p>
+</p>
+
+<p align="center">
+    <a href="https://github.com/semaphore-protocol/semaphore.js">
+        <img src="https://img.shields.io/badge/project-semaphore.js-blue.svg?style=flat-square">
+    </a>
+    <a href="https://github.com/semaphore-protocol/semaphore.js/blob/main/packages/proof/LICENSE">
+        <img alt="Github license" src="https://img.shields.io/github/license/semaphore-protocol/semaphore.js.svg?style=flat-square">
+    </a>
+    <a href="https://www.npmjs.com/package/@semaphore-protocol/proof">
+        <img alt="NPM version" src="https://img.shields.io/npm/v/@semaphore-protocol/proof?style=flat-square" />
+    </a>
+    <a href="https://npmjs.org/package/@semaphore-protocol/proof">
+        <img alt="Downloads" src="https://img.shields.io/npm/dm/@semaphore-protocol/proof.svg?style=flat-square" />
+    </a>
+    <a href="https://eslint.org/">
+        <img alt="Linter eslint" src="https://img.shields.io/badge/linter-eslint-8080f2?style=flat-square&logo=eslint" />
+    </a>
+    <a href="https://prettier.io/">
+        <img alt="Code style prettier" src="https://img.shields.io/badge/code%20style-prettier-f8bc45?style=flat-square&logo=prettier" />
+    </a>
+</p>
+
+<div align="center">
+    <h4>
+        <a href="https://t.me/joinchat/B-PQx1U3GtAh--Z4Fwo56A">
+            🗣️ Chat &amp; Support
+        </a>
+        <span>&nbsp;&nbsp;|&nbsp;&nbsp;</span>
+        <a href="https://semaphore-protocol.github.io/semaphore.js/proof">
+            📘 Docs
+        </a>
+    </h4>
+</div>
+
+---
+
+## 🛠 Install
+
+### npm or yarn
+
+Install the `@semaphore-protocol/proof` package with npm:
+
+```bash
+npm i @semaphore-protocol/proof
+```
+
+or yarn:
+
+```bash
+yarn add @semaphore-protocol/proof
+```
+
+## 📜 Usage
+
+### Generating Merkle proofs
+
+```typescript
+import { Identity } from "@semaphore-protocol/identity"
+import { generateMerkleProof } from "@semaphore-protocol/proof"
+
+const depth = 20
+const zeroValue = BigInt(0)
+const identity = new Identity()
+const identityCommitment = identity.genIdentityCommitment()
+const identityCommitments = [BigInt(1), identityCommitment, BigInt(2)]
+
+const merkleProof = generateMerkleProof(depth, zeroValue, identityCommitments, 1)
+```
+
+### Creating Semaphore proofs
+
+```typescript
+import { Semaphore } from "@semaphore-protocol/protocols"
+
+const signal = "Hello world"
+const externalNullifier = BigInt(1)
+const witness = Semaphore.genWitness(identity, merkleProof, externalNullifier, signal)
+
+const { proof, publicSignals } = await Semaphore.genProof(witness, "./semaphore.wasm", "./semaphore.zkey")
+const solidityProof = Semaphore.packToSolidityProof(proof)
+```

package/dist/index.mjs

@@ -0,0 +1,218 @@
+/**
+ * @module @semaphore-protocol/proof
+ * @version 0.1.0
+ * @file A library for generating and verifying Semaphore proofs.
+ * @copyright Ethereum Foundation 2022
+ * @license MIT
+ * @see [Github]{@link https://github.com/semaphore-protocol/semaphore.js/tree/main/packages/proof}
+*/
+import { keccak256 } from '@ethersproject/solidity';
+import { formatBytes32String } from '@ethersproject/strings';
+import { poseidon } from 'circomlibjs';
+import { groth16 } from 'snarkjs';
+import { IncrementalMerkleTree } from '@zk-kit/incremental-merkle-tree';
+
+/*! *****************************************************************************
+Copyright (c) Microsoft Corporation.
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.
+***************************************************************************** */
+
+function __awaiter(thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+}
+
+function __generator(thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (_) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+}
+
+var Semaphore = /** @class */ (function () {
+    function Semaphore() {
+    }
+    /**
+     * Generates a SnarkJS full proof with Groth16.
+     * @param witness The parameters for creating the proof.
+     * @param wasmFilePath The WASM file path.
+     * @param finalZkeyPath The ZKey file path.
+     * @returns The full SnarkJS proof.
+     */
+    /* istanbul ignore next */
+    Semaphore.genProof = function (witness, wasmFilePath, finalZkeyPath) {
+        return __awaiter(this, void 0, void 0, function () {
+            var _a, proof, publicSignals;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0: return [4 /*yield*/, groth16.fullProve(witness, wasmFilePath, finalZkeyPath, null)];
+                    case 1:
+                        _a = _b.sent(), proof = _a.proof, publicSignals = _a.publicSignals;
+                        return [2 /*return*/, {
+                                proof: proof,
+                                publicSignals: {
+                                    merkleRoot: publicSignals[0],
+                                    nullifierHash: publicSignals[1],
+                                    signalHash: publicSignals[2],
+                                    externalNullifier: publicSignals[3]
+                                }
+                            }];
+                }
+            });
+        });
+    };
+    /**
+     * Verifies a zero-knowledge SnarkJS proof.
+     * @param verificationKey The zero-knowledge verification key.
+     * @param fullProof The SnarkJS full proof.
+     * @returns True if the proof is valid, false otherwise.
+     */
+    /* istanbul ignore next */
+    Semaphore.verifyProof = function (verificationKey, _a) {
+        var proof = _a.proof, publicSignals = _a.publicSignals;
+        return groth16.verify(verificationKey, [
+            publicSignals.merkleRoot,
+            publicSignals.nullifierHash,
+            publicSignals.signalHash,
+            publicSignals.externalNullifier
+        ], proof);
+    };
+    /**
+     * Creates a Semaphore witness for the Semaphore ZK proof.
+     * @param identityTrapdoor The identity trapdoor.
+     * @param identityNullifier The identity nullifier.
+     * @param merkleProof The Merkle proof that identity exists in Semaphore tree.
+     * @param externalNullifier The topic on which vote should be broadcasted.
+     * @param signal The signal that should be broadcasted.
+     * @returns The Semaphore witness.
+     */
+    Semaphore.genWitness = function (identityTrapdoor, identityNullifier, merkleProof, externalNullifier, signal) {
+        return {
+            identityNullifier: identityNullifier,
+            identityTrapdoor: identityTrapdoor,
+            treePathIndices: merkleProof.pathIndices,
+            treeSiblings: merkleProof.siblings,
+            externalNullifier: externalNullifier,
+            signalHash: Semaphore.genSignalHash(signal)
+        };
+    };
+    /**
+     * Generates a nullifier by hashing the external and the identity nullifiers.
+     * @param externalNullifier The external nullifier.
+     * @param identityNullifier The identity nullifier.
+     * @returns The nullifier hash.
+     */
+    Semaphore.genNullifierHash = function (externalNullifier, identityNullifier) {
+        return poseidon([BigInt(externalNullifier), BigInt(identityNullifier)]);
+    };
+    /**
+     * Hashes a signal string with Keccak256.
+     * @param signal The Semaphore signal.
+     * @returns The signal hash.
+     */
+    Semaphore.genSignalHash = function (signal) {
+        return BigInt(keccak256(["bytes32"], [formatBytes32String(signal)])) >> BigInt(8);
+    };
+    /**
+     * Converts a full proof in a proof compatible with the Verifier.sol method inputs.
+     * @param proof The proof generated with SnarkJS.
+     * @returns The Solidity compatible proof.
+     */
+    /* istanbul ignore next */
+    Semaphore.packToSolidityProof = function (proof) {
+        return [
+            proof.pi_a[0],
+            proof.pi_a[1],
+            proof.pi_b[0][1],
+            proof.pi_b[0][0],
+            proof.pi_b[1][1],
+            proof.pi_b[1][0],
+            proof.pi_c[0],
+            proof.pi_c[1]
+        ];
+    };
+    return Semaphore;
+}());
+
+BigInt("21888242871839275222246405745257275088548364400416034343698204186575808495617");
+function genExternalNullifier(plaintext) {
+    var hashed = keccak256(["string"], [plaintext]);
+    var hexStr = "0x".concat(hashed.slice(8));
+    var len = 32 * 2;
+    var h = hexStr.slice(2, len + 2);
+    return "0x".concat(h.padStart(len, "0"));
+}
+/**
+ * Creates a Merkle tree.
+ * @param depth The depth of the tree.
+ * @param zeroValue The zero value of the tree.
+ * @param leaves The list of the leaves of the tree.
+ * @returns The Merkle tree.
+ */
+function generateMerkleTree(depth, zeroValue, leaves) {
+    var tree = new IncrementalMerkleTree(poseidon, depth, zeroValue, 2);
+    for (var _i = 0, leaves_1 = leaves; _i < leaves_1.length; _i++) {
+        var leaf = leaves_1[_i];
+        tree.insert(BigInt(leaf));
+    }
+    return tree;
+}
+/**
+ * Creates a Merkle proof.
+ * @param depth The depth of the tree.
+ * @param zeroValue The zero value of the tree.
+ * @param leaves The list of the leaves of the tree.
+ * @param leaf The leaf for which Merkle proof should be created.
+ * @returns The Merkle proof.
+ */
+function generateMerkleProof(depth, zeroValue, leaves, leaf) {
+    if (leaf === zeroValue) {
+        throw new Error("Can't generate a proof for a zero leaf");
+    }
+    var tree = generateMerkleTree(depth, zeroValue, leaves);
+    var leafIndex = tree.leaves.indexOf(BigInt(leaf));
+    if (leafIndex === -1) {
+        throw new Error("The leaf does not exist");
+    }
+    var merkleProof = tree.createProof(leafIndex);
+    merkleProof.siblings = merkleProof.siblings.map(function (s) { return s[0]; });
+    return merkleProof;
+}
+
+export { Semaphore, genExternalNullifier, generateMerkleProof, generateMerkleTree };

package/dist/index.node.js

@@ -0,0 +1,225 @@
+/**
+ * @module @semaphore-protocol/proof
+ * @version 0.1.0
+ * @file A library for generating and verifying Semaphore proofs.
+ * @copyright Ethereum Foundation 2022
+ * @license MIT
+ * @see [Github]{@link https://github.com/semaphore-protocol/semaphore.js/tree/main/packages/proof}
+*/
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+var solidity = require('@ethersproject/solidity');
+var strings = require('@ethersproject/strings');
+var circomlibjs = require('circomlibjs');
+var snarkjs = require('snarkjs');
+var incrementalMerkleTree = require('@zk-kit/incremental-merkle-tree');
+
+/*! *****************************************************************************
+Copyright (c) Microsoft Corporation.
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.
+***************************************************************************** */
+
+function __awaiter(thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+}
+
+function __generator(thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (_) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+}
+
+var Semaphore = /** @class */ (function () {
+    function Semaphore() {
+    }
+    /**
+     * Generates a SnarkJS full proof with Groth16.
+     * @param witness The parameters for creating the proof.
+     * @param wasmFilePath The WASM file path.
+     * @param finalZkeyPath The ZKey file path.
+     * @returns The full SnarkJS proof.
+     */
+    /* istanbul ignore next */
+    Semaphore.genProof = function (witness, wasmFilePath, finalZkeyPath) {
+        return __awaiter(this, void 0, void 0, function () {
+            var _a, proof, publicSignals;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0: return [4 /*yield*/, snarkjs.groth16.fullProve(witness, wasmFilePath, finalZkeyPath, null)];
+                    case 1:
+                        _a = _b.sent(), proof = _a.proof, publicSignals = _a.publicSignals;
+                        return [2 /*return*/, {
+                                proof: proof,
+                                publicSignals: {
+                                    merkleRoot: publicSignals[0],
+                                    nullifierHash: publicSignals[1],
+                                    signalHash: publicSignals[2],
+                                    externalNullifier: publicSignals[3]
+                                }
+                            }];
+                }
+            });
+        });
+    };
+    /**
+     * Verifies a zero-knowledge SnarkJS proof.
+     * @param verificationKey The zero-knowledge verification key.
+     * @param fullProof The SnarkJS full proof.
+     * @returns True if the proof is valid, false otherwise.
+     */
+    /* istanbul ignore next */
+    Semaphore.verifyProof = function (verificationKey, _a) {
+        var proof = _a.proof, publicSignals = _a.publicSignals;
+        return snarkjs.groth16.verify(verificationKey, [
+            publicSignals.merkleRoot,
+            publicSignals.nullifierHash,
+            publicSignals.signalHash,
+            publicSignals.externalNullifier
+        ], proof);
+    };
+    /**
+     * Creates a Semaphore witness for the Semaphore ZK proof.
+     * @param identityTrapdoor The identity trapdoor.
+     * @param identityNullifier The identity nullifier.
+     * @param merkleProof The Merkle proof that identity exists in Semaphore tree.
+     * @param externalNullifier The topic on which vote should be broadcasted.
+     * @param signal The signal that should be broadcasted.
+     * @returns The Semaphore witness.
+     */
+    Semaphore.genWitness = function (identityTrapdoor, identityNullifier, merkleProof, externalNullifier, signal) {
+        return {
+            identityNullifier: identityNullifier,
+            identityTrapdoor: identityTrapdoor,
+            treePathIndices: merkleProof.pathIndices,
+            treeSiblings: merkleProof.siblings,
+            externalNullifier: externalNullifier,
+            signalHash: Semaphore.genSignalHash(signal)
+        };
+    };
+    /**
+     * Generates a nullifier by hashing the external and the identity nullifiers.
+     * @param externalNullifier The external nullifier.
+     * @param identityNullifier The identity nullifier.
+     * @returns The nullifier hash.
+     */
+    Semaphore.genNullifierHash = function (externalNullifier, identityNullifier) {
+        return circomlibjs.poseidon([BigInt(externalNullifier), BigInt(identityNullifier)]);
+    };
+    /**
+     * Hashes a signal string with Keccak256.
+     * @param signal The Semaphore signal.
+     * @returns The signal hash.
+     */
+    Semaphore.genSignalHash = function (signal) {
+        return BigInt(solidity.keccak256(["bytes32"], [strings.formatBytes32String(signal)])) >> BigInt(8);
+    };
+    /**
+     * Converts a full proof in a proof compatible with the Verifier.sol method inputs.
+     * @param proof The proof generated with SnarkJS.
+     * @returns The Solidity compatible proof.
+     */
+    /* istanbul ignore next */
+    Semaphore.packToSolidityProof = function (proof) {
+        return [
+            proof.pi_a[0],
+            proof.pi_a[1],
+            proof.pi_b[0][1],
+            proof.pi_b[0][0],
+            proof.pi_b[1][1],
+            proof.pi_b[1][0],
+            proof.pi_c[0],
+            proof.pi_c[1]
+        ];
+    };
+    return Semaphore;
+}());
+
+BigInt("21888242871839275222246405745257275088548364400416034343698204186575808495617");
+function genExternalNullifier(plaintext) {
+    var hashed = solidity.keccak256(["string"], [plaintext]);
+    var hexStr = "0x".concat(hashed.slice(8));
+    var len = 32 * 2;
+    var h = hexStr.slice(2, len + 2);
+    return "0x".concat(h.padStart(len, "0"));
+}
+/**
+ * Creates a Merkle tree.
+ * @param depth The depth of the tree.
+ * @param zeroValue The zero value of the tree.
+ * @param leaves The list of the leaves of the tree.
+ * @returns The Merkle tree.
+ */
+function generateMerkleTree(depth, zeroValue, leaves) {
+    var tree = new incrementalMerkleTree.IncrementalMerkleTree(circomlibjs.poseidon, depth, zeroValue, 2);
+    for (var _i = 0, leaves_1 = leaves; _i < leaves_1.length; _i++) {
+        var leaf = leaves_1[_i];
+        tree.insert(BigInt(leaf));
+    }
+    return tree;
+}
+/**
+ * Creates a Merkle proof.
+ * @param depth The depth of the tree.
+ * @param zeroValue The zero value of the tree.
+ * @param leaves The list of the leaves of the tree.
+ * @param leaf The leaf for which Merkle proof should be created.
+ * @returns The Merkle proof.
+ */
+function generateMerkleProof(depth, zeroValue, leaves, leaf) {
+    if (leaf === zeroValue) {
+        throw new Error("Can't generate a proof for a zero leaf");
+    }
+    var tree = generateMerkleTree(depth, zeroValue, leaves);
+    var leafIndex = tree.leaves.indexOf(BigInt(leaf));
+    if (leafIndex === -1) {
+        throw new Error("The leaf does not exist");
+    }
+    var merkleProof = tree.createProof(leafIndex);
+    merkleProof.siblings = merkleProof.siblings.map(function (s) { return s[0]; });
+    return merkleProof;
+}
+
+exports.Semaphore = Semaphore;
+exports.genExternalNullifier = genExternalNullifier;
+exports.generateMerkleProof = generateMerkleProof;
+exports.generateMerkleTree = generateMerkleTree;

package/dist/types/index.d.ts

@@ -0,0 +1,5 @@
+import { MerkleProof } from "@zk-kit/incremental-merkle-tree";
+import Semaphore from "./semaphore";
+import { generateMerkleProof, generateMerkleTree, genExternalNullifier } from "./utils";
+export { Semaphore, generateMerkleProof, generateMerkleTree, genExternalNullifier, MerkleProof };
+export * from "./types";

package/dist/types/semaphore.d.ts

@@ -0,0 +1,48 @@
+import { MerkleProof } from "@zk-kit/incremental-merkle-tree";
+import { Proof, SemaphoreFullProof, SemaphoreSolidityProof, SemaphoreWitness, StrBigInt } from "./types";
+export default class Semaphore {
+    /**
+     * Generates a SnarkJS full proof with Groth16.
+     * @param witness The parameters for creating the proof.
+     * @param wasmFilePath The WASM file path.
+     * @param finalZkeyPath The ZKey file path.
+     * @returns The full SnarkJS proof.
+     */
+    static genProof(witness: any, wasmFilePath: string, finalZkeyPath: string): Promise<SemaphoreFullProof>;
+    /**
+     * Verifies a zero-knowledge SnarkJS proof.
+     * @param verificationKey The zero-knowledge verification key.
+     * @param fullProof The SnarkJS full proof.
+     * @returns True if the proof is valid, false otherwise.
+     */
+    static verifyProof(verificationKey: string, { proof, publicSignals }: SemaphoreFullProof): Promise<boolean>;
+    /**
+     * Creates a Semaphore witness for the Semaphore ZK proof.
+     * @param identityTrapdoor The identity trapdoor.
+     * @param identityNullifier The identity nullifier.
+     * @param merkleProof The Merkle proof that identity exists in Semaphore tree.
+     * @param externalNullifier The topic on which vote should be broadcasted.
+     * @param signal The signal that should be broadcasted.
+     * @returns The Semaphore witness.
+     */
+    static genWitness(identityTrapdoor: StrBigInt, identityNullifier: StrBigInt, merkleProof: MerkleProof, externalNullifier: StrBigInt, signal: string): SemaphoreWitness;
+    /**
+     * Generates a nullifier by hashing the external and the identity nullifiers.
+     * @param externalNullifier The external nullifier.
+     * @param identityNullifier The identity nullifier.
+     * @returns The nullifier hash.
+     */
+    static genNullifierHash(externalNullifier: StrBigInt, identityNullifier: StrBigInt): bigint;
+    /**
+     * Hashes a signal string with Keccak256.
+     * @param signal The Semaphore signal.
+     * @returns The signal hash.
+     */
+    static genSignalHash(signal: string): bigint;
+    /**
+     * Converts a full proof in a proof compatible with the Verifier.sol method inputs.
+     * @param proof The proof generated with SnarkJS.
+     * @returns The Solidity compatible proof.
+     */
+    static packToSolidityProof(proof: Proof): SemaphoreSolidityProof;
+}

package/dist/types/semaphore.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/types/types/index.d.ts

@@ -0,0 +1,36 @@
+export declare type StrBigInt = string | bigint;
+export declare type Proof = {
+    pi_a: StrBigInt[];
+    pi_b: StrBigInt[][];
+    pi_c: StrBigInt[];
+    protocol: string;
+    curve: string;
+};
+export declare type SemaphoreFullProof = {
+    proof: Proof;
+    publicSignals: SemaphorePublicSignals;
+};
+export declare type SemaphorePublicSignals = {
+    merkleRoot: StrBigInt;
+    nullifierHash: StrBigInt;
+    signalHash: StrBigInt;
+    externalNullifier: StrBigInt;
+};
+export declare type SemaphoreSolidityProof = [
+    StrBigInt,
+    StrBigInt,
+    StrBigInt,
+    StrBigInt,
+    StrBigInt,
+    StrBigInt,
+    StrBigInt,
+    StrBigInt
+];
+export declare type SemaphoreWitness = {
+    identityNullifier: StrBigInt;
+    identityTrapdoor: StrBigInt;
+    treeSiblings: StrBigInt[];
+    treePathIndices: number[];
+    externalNullifier: StrBigInt;
+    signalHash: StrBigInt;
+};

package/dist/types/utils.d.ts

@@ -0,0 +1,21 @@
+import { IncrementalMerkleTree, MerkleProof } from "@zk-kit/incremental-merkle-tree";
+import { StrBigInt } from "./types";
+export declare const SNARK_FIELD_SIZE: bigint;
+export declare function genExternalNullifier(plaintext: string): string;
+/**
+ * Creates a Merkle tree.
+ * @param depth The depth of the tree.
+ * @param zeroValue The zero value of the tree.
+ * @param leaves The list of the leaves of the tree.
+ * @returns The Merkle tree.
+ */
+export declare function generateMerkleTree(depth: number, zeroValue: StrBigInt, leaves: StrBigInt[]): IncrementalMerkleTree;
+/**
+ * Creates a Merkle proof.
+ * @param depth The depth of the tree.
+ * @param zeroValue The zero value of the tree.
+ * @param leaves The list of the leaves of the tree.
+ * @param leaf The leaf for which Merkle proof should be created.
+ * @returns The Merkle proof.
+ */
+export declare function generateMerkleProof(depth: number, zeroValue: StrBigInt, leaves: StrBigInt[], leaf: StrBigInt): MerkleProof;

package/package.json

@@ -0,0 +1,44 @@
+{
+    "name": "@semaphore-protocol/proof",
+    "version": "0.1.0",
+    "description": "A library for generating and verifying Semaphore proofs.",
+    "license": "MIT",
+    "main": "dist/index.node.js",
+    "exports": {
+        "import": "./dist/index.mjs",
+        "require": "./dist/index.node.js"
+    },
+    "types": "dist/types/index.d.ts",
+    "files": [
+        "dist/",
+        "src/",
+        "LICENSE",
+        "README.md"
+    ],
+    "repository": "https://github.com/semaphore-protocol/semaphore.js",
+    "homepage": "https://github.com/semaphore-protocol/semaphore.js/tree/main/packages/proof",
+    "scripts": {
+        "build:watch": "rollup -c rollup.config.ts -w --configPlugin typescript",
+        "build": "rimraf dist && rollup -c rollup.config.ts --configPlugin typescript",
+        "prepublishOnly": "yarn build",
+        "docs": "typedoc src/index.ts --out ../../docs/protocols"
+    },
+    "publishConfig": {
+        "access": "public"
+    },
+    "devDependencies": {
+        "ffjavascript": "^0.2.54",
+        "rollup-plugin-cleanup": "^3.2.1",
+        "rollup-plugin-typescript2": "^0.31.2",
+        "typedoc": "^0.22.11"
+    },
+    "dependencies": {
+        "@ethersproject/bytes": "^5.5.0",
+        "@ethersproject/solidity": "^5.5.0",
+        "@ethersproject/strings": "^5.5.0",
+        "@zk-kit/incremental-merkle-tree": "^0.4.3",
+        "circomlibjs": "0.0.8",
+        "snarkjs": "^0.4.13"
+    },
+    "gitHead": "6c1b469a4b5ffaac562f478fc2bbc78731734e81"
+}

package/src/index.ts

@@ -0,0 +1,6 @@
+import { MerkleProof } from "@zk-kit/incremental-merkle-tree"
+import Semaphore from "./semaphore"
+import { generateMerkleProof, generateMerkleTree, genExternalNullifier } from "./utils"
+
+export { Semaphore, generateMerkleProof, generateMerkleTree, genExternalNullifier, MerkleProof }
+export * from "./types"

package/src/semaphore.test.ts

@@ -0,0 +1,72 @@
+import { Identity } from "@semaphore-protocol/identity"
+import { getCurveFromName } from "ffjavascript"
+import fs from "fs"
+import path from "path"
+import Semaphore from "./semaphore"
+import { generateMerkleProof, genExternalNullifier } from "./utils"
+
+describe("Semaphore", () => {
+    const assets = "./packages/proof/assets"
+
+    let curve: any
+
+    beforeAll(async () => {
+        curve = await getCurveFromName("bn128")
+    })
+
+    afterAll(async () => {
+        await curve.terminate()
+    })
+
+    describe("Generate and verify proof", () => {
+        it("Should generate a Semaphore witness", async () => {
+            const identity = new Identity()
+            const identityCommitment = identity.genIdentityCommitment()
+            const externalNullifier = genExternalNullifier("voting_1")
+            const leaves = [BigInt(3), BigInt(2), identityCommitment, BigInt(4)]
+            const signal = "0x111"
+
+            const merkleProof = generateMerkleProof(20, BigInt(0), leaves, identityCommitment)
+
+            const witness = Semaphore.genWitness(
+                identity.getTrapdoor(),
+                identity.getNullifier(),
+                merkleProof,
+                externalNullifier,
+                signal
+            )
+
+            expect(typeof witness).toBe("object")
+        })
+
+        // eslint-disable-next-line jest/no-disabled-tests
+        it.skip("Should generate and verify Semaphore proof", async () => {
+            const identity = new Identity()
+            const identityCommitment = identity.genIdentityCommitment()
+            const externalNullifier = genExternalNullifier("voting_1")
+            const leaves = [BigInt(3), BigInt(2), identityCommitment, BigInt(4)]
+            const signal = "0x111"
+
+            const merkleProof = generateMerkleProof(20, BigInt(0), leaves, identityCommitment)
+
+            const witness = Semaphore.genWitness(
+                identity.getTrapdoor(),
+                identity.getNullifier(),
+                merkleProof,
+                externalNullifier,
+                signal
+            )
+
+            const wasmFilePath = path.join(assets, "semaphore", "semaphore.wasm")
+            const zkeyFilePath = path.join(assets, "semaphore", "semaphore.zkey")
+            const fullProof = await Semaphore.genProof(witness, wasmFilePath, zkeyFilePath)
+
+            const vkeyPath = path.join(assets, "semaphore", "verification_key.json")
+            const vKey = JSON.parse(fs.readFileSync(vkeyPath, "utf-8"))
+
+            const response = await Semaphore.verifyProof(vKey, fullProof)
+
+            expect(response).toBe(true)
+        }, 30000)
+    })
+})

package/src/semaphore.ts

@@ -0,0 +1,118 @@
+import { keccak256 } from "@ethersproject/solidity"
+import { formatBytes32String } from "@ethersproject/strings"
+import { MerkleProof } from "@zk-kit/incremental-merkle-tree"
+import { poseidon } from "circomlibjs"
+import { groth16 } from "snarkjs"
+import { Proof, SemaphoreFullProof, SemaphoreSolidityProof, SemaphoreWitness, StrBigInt } from "./types"
+
+export default class Semaphore {
+    /**
+     * Generates a SnarkJS full proof with Groth16.
+     * @param witness The parameters for creating the proof.
+     * @param wasmFilePath The WASM file path.
+     * @param finalZkeyPath The ZKey file path.
+     * @returns The full SnarkJS proof.
+     */
+    /* istanbul ignore next */
+    public static async genProof(
+        witness: any,
+        wasmFilePath: string,
+        finalZkeyPath: string
+    ): Promise<SemaphoreFullProof> {
+        const { proof, publicSignals } = await groth16.fullProve(witness, wasmFilePath, finalZkeyPath, null)
+
+        return {
+            proof,
+            publicSignals: {
+                merkleRoot: publicSignals[0],
+                nullifierHash: publicSignals[1],
+                signalHash: publicSignals[2],
+                externalNullifier: publicSignals[3]
+            }
+        }
+    }
+
+    /**
+     * Verifies a zero-knowledge SnarkJS proof.
+     * @param verificationKey The zero-knowledge verification key.
+     * @param fullProof The SnarkJS full proof.
+     * @returns True if the proof is valid, false otherwise.
+     */
+    /* istanbul ignore next */
+    public static verifyProof(verificationKey: string, { proof, publicSignals }: SemaphoreFullProof): Promise<boolean> {
+        return groth16.verify(
+            verificationKey,
+            [
+                publicSignals.merkleRoot,
+                publicSignals.nullifierHash,
+                publicSignals.signalHash,
+                publicSignals.externalNullifier
+            ],
+            proof
+        )
+    }
+
+    /**
+     * Creates a Semaphore witness for the Semaphore ZK proof.
+     * @param identityTrapdoor The identity trapdoor.
+     * @param identityNullifier The identity nullifier.
+     * @param merkleProof The Merkle proof that identity exists in Semaphore tree.
+     * @param externalNullifier The topic on which vote should be broadcasted.
+     * @param signal The signal that should be broadcasted.
+     * @returns The Semaphore witness.
+     */
+    public static genWitness(
+        identityTrapdoor: StrBigInt,
+        identityNullifier: StrBigInt,
+        merkleProof: MerkleProof,
+        externalNullifier: StrBigInt,
+        signal: string
+    ): SemaphoreWitness {
+        return {
+            identityNullifier,
+            identityTrapdoor,
+            treePathIndices: merkleProof.pathIndices,
+            treeSiblings: merkleProof.siblings,
+            externalNullifier,
+            signalHash: Semaphore.genSignalHash(signal)
+        }
+    }
+
+    /**
+     * Generates a nullifier by hashing the external and the identity nullifiers.
+     * @param externalNullifier The external nullifier.
+     * @param identityNullifier The identity nullifier.
+     * @returns The nullifier hash.
+     */
+    public static genNullifierHash(externalNullifier: StrBigInt, identityNullifier: StrBigInt): bigint {
+        return poseidon([BigInt(externalNullifier), BigInt(identityNullifier)])
+    }
+
+    /**
+     * Hashes a signal string with Keccak256.
+     * @param signal The Semaphore signal.
+     * @returns The signal hash.
+     */
+    public static genSignalHash(signal: string): bigint {
+        return BigInt(keccak256(["bytes32"], [formatBytes32String(signal)])) >> BigInt(8)
+    }
+
+    /**
+     * Converts a full proof in a proof compatible with the Verifier.sol method inputs.
+     * @param proof The proof generated with SnarkJS.
+     * @returns The Solidity compatible proof.
+     */
+    /* istanbul ignore next */
+    public static packToSolidityProof(proof: Proof): SemaphoreSolidityProof {
+        return [
+            proof.pi_a[0],
+            proof.pi_a[1],
+            proof.pi_b[0][1],
+            proof.pi_b[0][0],
+            proof.pi_b[1][1],
+            proof.pi_b[1][0],
+            proof.pi_c[0],
+            proof.pi_c[1]
+        ]
+    }
+}

package/src/types/index.ts

@@ -0,0 +1,41 @@
+export type StrBigInt = string | bigint
+
+export type Proof = {
+    pi_a: StrBigInt[]
+    pi_b: StrBigInt[][]
+    pi_c: StrBigInt[]
+    protocol: string
+    curve: string
+}
+
+export type SemaphoreFullProof = {
+    proof: Proof
+    publicSignals: SemaphorePublicSignals
+}
+
+export type SemaphorePublicSignals = {
+    merkleRoot: StrBigInt
+    nullifierHash: StrBigInt
+    signalHash: StrBigInt
+    externalNullifier: StrBigInt
+}
+
+export type SemaphoreSolidityProof = [
+    StrBigInt,
+    StrBigInt,
+    StrBigInt,
+    StrBigInt,
+    StrBigInt,
+    StrBigInt,
+    StrBigInt,
+    StrBigInt
+]
+
+export type SemaphoreWitness = {
+    identityNullifier: StrBigInt
+    identityTrapdoor: StrBigInt
+    treeSiblings: StrBigInt[]
+    treePathIndices: number[]
+    externalNullifier: StrBigInt
+    signalHash: StrBigInt
+}

package/src/utils.ts

@@ -0,0 +1,65 @@
+import { keccak256 } from "@ethersproject/solidity"
+import { IncrementalMerkleTree, MerkleProof } from "@zk-kit/incremental-merkle-tree"
+import { poseidon } from "circomlibjs"
+import { StrBigInt } from "./types"
+
+export const SNARK_FIELD_SIZE = BigInt("21888242871839275222246405745257275088548364400416034343698204186575808495617")
+
+export function genExternalNullifier(plaintext: string): string {
+    const hashed = keccak256(["string"], [plaintext])
+    const hexStr = `0x${hashed.slice(8)}`
+    const len = 32 * 2
+    const h = hexStr.slice(2, len + 2)
+
+    return `0x${h.padStart(len, "0")}`
+}
+
+/**
+ * Creates a Merkle tree.
+ * @param depth The depth of the tree.
+ * @param zeroValue The zero value of the tree.
+ * @param leaves The list of the leaves of the tree.
+ * @returns The Merkle tree.
+ */
+export function generateMerkleTree(depth: number, zeroValue: StrBigInt, leaves: StrBigInt[]): IncrementalMerkleTree {
+    const tree = new IncrementalMerkleTree(poseidon, depth, zeroValue, 2)
+
+    for (const leaf of leaves) {
+        tree.insert(BigInt(leaf))
+    }
+
+    return tree
+}
+
+/**
+ * Creates a Merkle proof.
+ * @param depth The depth of the tree.
+ * @param zeroValue The zero value of the tree.
+ * @param leaves The list of the leaves of the tree.
+ * @param leaf The leaf for which Merkle proof should be created.
+ * @returns The Merkle proof.
+ */
+export function generateMerkleProof(
+    depth: number,
+    zeroValue: StrBigInt,
+    leaves: StrBigInt[],
+    leaf: StrBigInt
+): MerkleProof {
+    if (leaf === zeroValue) {
+        throw new Error("Can't generate a proof for a zero leaf")
+    }
+
+    const tree = generateMerkleTree(depth, zeroValue, leaves)
+
+    const leafIndex = tree.leaves.indexOf(BigInt(leaf))
+
+    if (leafIndex === -1) {
+        throw new Error("The leaf does not exist")
+    }
+
+    const merkleProof = tree.createProof(leafIndex)
+
+    merkleProof.siblings = merkleProof.siblings.map((s) => s[0])
+
+    return merkleProof
+}