feat: Add BLS signature verification for BN254

halo2-base/Cargo.toml

@@ -17,7 +17,12 @@ serde_json = "1.0"
 log = "0.4"
 
 # Use Axiom's custom halo2 monorepo for faster proving when feature = "halo2-axiom" is on
-halo2_proofs_axiom = { git = "https://github.com/axiom-crypto/halo2.git", branch = "axiom/dev", package = "halo2_proofs", optional = true }
+# halo2_proofs_axiom = { git = "https://github.com/axiom-crypto/halo2.git", branch = "axiom/dev", package = "halo2_proofs", optional = true }
+# Use below before Axiom's PR is merged
+halo2_proofs_axiom = { git = "https://github.com/flyingnobita/halo2.git", branch = "bls12-381/dev", package = "halo2_proofs", optional = true }
+# Use below for local development
+# halo2_proofs_axiom = { path = "../../flyingnobita-halo2/halo2_proofs", package = "halo2_proofs", optional = true }
+
 # Use PSE halo2 and halo2curves for compatibility when feature = "halo2-pse" is on
 halo2_proofs = { git = "https://github.com/privacy-scaling-explorations/halo2.git", tag = "v2023_02_02", optional = true }
 

halo2-ecc/configs/bn254/bench_bls_signature.config

@@ -0,0 +1,15 @@
+{"strategy":"Simple","degree":14,"num_advice":211,"num_lookup_advice":27,"num_fixed":1,"lookup_bits":13,"limb_bits":91,"num_limbs":3,"num_aggregation":2}
+{"strategy":"Simple","degree":15,"num_advice":105,"num_lookup_advice":14,"num_fixed":1,"lookup_bits":14,"limb_bits":90,"num_limbs":3,"num_aggregation":2}
+{"strategy":"Simple","degree":16,"num_advice":50,"num_lookup_advice":6,"num_fixed":1,"lookup_bits":15,"limb_bits":90,"num_limbs":3,"num_aggregation":2}
+{"strategy":"Simple","degree":17,"num_advice":25,"num_lookup_advice":3,"num_fixed":1,"lookup_bits":16,"limb_bits":88,"num_limbs":3,"num_aggregation":2}
+{"strategy":"Simple","degree":18,"num_advice":13,"num_lookup_advice":2,"num_fixed":1,"lookup_bits":17,"limb_bits":88,"num_limbs":3,"num_aggregation":2}
+{"strategy":"Simple","degree":19,"num_advice":6,"num_lookup_advice":1,"num_fixed":1,"lookup_bits":18,"limb_bits":90,"num_limbs":3,"num_aggregation":2}
+{"strategy":"Simple","degree":20,"num_advice":3,"num_lookup_advice":1,"num_fixed":1,"lookup_bits":19,"limb_bits":88,"num_limbs":3,"num_aggregation":2}
+{"strategy":"Simple","degree":21,"num_advice":2,"num_lookup_advice":1,"num_fixed":1,"lookup_bits":20,"limb_bits":88,"num_limbs":3,"num_aggregation":2}
+{"strategy":"Simple","degree":22,"num_advice":1,"num_lookup_advice":1,"num_fixed":1,"lookup_bits":21,"limb_bits":88,"num_limbs":3,"num_aggregation":2}
+{"strategy":"Simple","degree":17,"num_advice":25,"num_lookup_advice":3,"num_fixed":1,"lookup_bits":16,"limb_bits":88,"num_limbs":3,"num_aggregation":20}
+{"strategy":"Simple","degree":17,"num_advice":25,"num_lookup_advice":3,"num_fixed":1,"lookup_bits":16,"limb_bits":88,"num_limbs":3,"num_aggregation":200}
+{"strategy":"Simple","degree":17,"num_advice":25,"num_lookup_advice":3,"num_fixed":1,"lookup_bits":16,"limb_bits":88,"num_limbs":3,"num_aggregation":2000}
+{"strategy":"Simple","degree":17,"num_advice":25,"num_lookup_advice":3,"num_fixed":1,"lookup_bits":16,"limb_bits":88,"num_limbs":3,"num_aggregation":20000}
+{"strategy":"Simple","degree":17,"num_advice":25,"num_lookup_advice":3,"num_fixed":1,"lookup_bits":16,"limb_bits":88,"num_limbs":3,"num_aggregation":40000}
+{"strategy":"Simple","degree":17,"num_advice":25,"num_lookup_advice":3,"num_fixed":1,"lookup_bits":16,"limb_bits":88,"num_limbs":3,"num_aggregation":80000}

halo2-ecc/configs/bn254/bls_signature_circuit.config

@@ -0,0 +1 @@
+{"strategy":"Simple","degree":19,"num_advice":6,"num_lookup_advice":1,"num_fixed":1,"lookup_bits":18,"limb_bits":90,"num_limbs":3,"num_aggregation":30}

halo2-ecc/src/bn254/bls_signature.rs

@@ -0,0 +1,108 @@
+#![allow(non_snake_case)]
+
+use super::pairing::PairingChip;
+use super::{Fp12Chip, Fp2Chip, FpChip, FqPoint};
+use crate::ecc::EccChip;
+use crate::fields::{FieldChip, PrimeField};
+use crate::halo2_proofs::halo2curves::bn256::{G1Affine, G2Affine};
+use halo2_base::Context;
+
+// To avoid issues with mutably borrowing twice (not allowed in Rust), we only store fp_chip and construct g2_chip and fp12_chip in scope when needed for temporary mutable borrows
+pub struct BlsSignatureChip<'chip, F: PrimeField> {
+    pub fp_chip: &'chip FpChip<'chip, F>,
+    pub pairing_chip: &'chip PairingChip<'chip, F>,
+}
+
+impl<'chip, F: PrimeField> BlsSignatureChip<'chip, F> {
+    pub fn new(fp_chip: &'chip FpChip<F>, pairing_chip: &'chip PairingChip<F>) -> Self {
+        Self { fp_chip, pairing_chip }
+    }
+
+    // Verifies that e(g1, signature) = e(pubkey, H(m)) by checking e(g1, signature)*e(pubkey, -H(m)) === 1
+    // where e(,) is optimal Ate pairing
+    // G1: {g1, pubkey}, G2: {signature, message}
+    // TODO add support for aggregating signatures over different messages
+    pub fn bls_signature_verify(
+        &self,
+        ctx: &mut Context<F>,
+        g1: G1Affine,
+        signatures: &[G2Affine],
+        pubkeys: &[G1Affine],
+        msghash: G2Affine,
+    ) -> FqPoint<F> {
+        assert!(
+            signatures.len() == pubkeys.len(),
+            "signatures and pubkeys must be the same length"
+        );
+        assert!(!signatures.is_empty(), "signatures must not be empty");
+        assert!(!pubkeys.is_empty(), "pubkeys must not be empty");
+
+        let g1_chip = EccChip::new(self.fp_chip);
+        let fp2_chip = Fp2Chip::<F>::new(self.fp_chip);
+        let g2_chip = EccChip::new(&fp2_chip);
+
+        let g1_assigned = self.pairing_chip.load_private_g1_unchecked(ctx, g1);
+        // Checking element from G1 is on curve also check that it's in subgroup G1 since G1 has cofactor of 1
+        g1_chip.assert_is_on_curve::<halo2_base::halo2_proofs::halo2curves::bn256::G1Affine>(
+            ctx,
+            &g1_assigned,
+        );
+
+        let hash_m_assigned = self.pairing_chip.load_private_g2_unchecked(ctx, msghash);
+        g2_chip.assert_is_on_curve::<halo2_base::halo2_proofs::halo2curves::bn256::G2Affine>(
+            ctx,
+            &hash_m_assigned,
+        );
+
+        let mut signature_agg_assigned =
+            self.pairing_chip.load_private_g2_unchecked(ctx, signatures[0]);
+        g2_chip.field_chip.enforce_less_than(ctx, signature_agg_assigned.x().clone());
+        let mut pubkey_agg_assigned = self.pairing_chip.load_private_g1_unchecked(ctx, pubkeys[0]);
+        g1_chip.field_chip.enforce_less_than(ctx, pubkey_agg_assigned.x().clone());
+
+        // loop through signatures and aggregate them
+        for (index, signature) in signatures.iter().enumerate() {
+            if index > 0 {
+                let signature_assigned =
+                    self.pairing_chip.load_private_g2_unchecked(ctx, *signature);
+                g2_chip.field_chip.enforce_less_than(ctx, signature_assigned.x().clone());
+                g2_chip
+                    .assert_is_on_curve::<halo2_base::halo2_proofs::halo2curves::bn256::G2Affine>(
+                        ctx,
+                        &signature_assigned,
+                    );
+                signature_agg_assigned =
+                    g2_chip.add_unequal(ctx, &signature_agg_assigned, &signature_assigned, false);
+            }
+        }
+
+        // loop through pubkeys and aggregate them
+        for (index, pubkey) in pubkeys.iter().enumerate() {
+            if index > 0 {
+                let pubkey_assigned = self.pairing_chip.load_private_g1_unchecked(ctx, *pubkey);
+                g1_chip.field_chip.enforce_less_than(ctx, pubkey_assigned.x().clone());
+                g1_chip
+                    .assert_is_on_curve::<halo2_base::halo2_proofs::halo2curves::bn256::G1Affine>(
+                        ctx,
+                        &pubkey_assigned,
+                    );
+                pubkey_agg_assigned =
+                    g1_chip.add_unequal(ctx, &pubkey_agg_assigned, &pubkey_assigned, false);
+            }
+        }
+
+        let fp12_chip = Fp12Chip::<F>::new(self.fp_chip);
+        let g12_chip = EccChip::new(&fp12_chip);
+        let neg_signature_assigned_g12 = g12_chip.negate(ctx, &signature_agg_assigned);
+
+        let multi_paired = self.pairing_chip.multi_miller_loop(
+            ctx,
+            vec![
+                (&g1_assigned, &neg_signature_assigned_g12),
+                (&pubkey_agg_assigned, &hash_m_assigned),
+            ],
+        );
+        let result = fp12_chip.final_exp(ctx, multi_paired);
+        result
+    }
+}

halo2-ecc/src/bn254/mod.rs

@@ -3,6 +3,7 @@ use crate::fields::vector::FieldVector;
 use crate::fields::{fp, fp12, fp2};
 use crate::halo2_proofs::halo2curves::bn256::{Fq, Fq12, Fq2};
 
+pub mod bls_signature;
 pub mod final_exp;
 pub mod pairing;
 

halo2-ecc/src/bn254/tests/bls_signature.rs

@@ -0,0 +1,244 @@
+use std::{
+    fs::{self, File},
+    io::{BufRead, BufReader},
+};
+
+use super::*;
+use crate::{
+    fields::{FieldChip, FpStrategy},
+    halo2_proofs::halo2curves::bn256::G2Affine,
+};
+use halo2_base::{
+    gates::{
+        builder::{
+            CircuitBuilderStage, GateThreadBuilder, MultiPhaseThreadBreakPoints,
+            RangeCircuitBuilder,
+        },
+        RangeChip,
+    },
+    halo2_proofs::{
+        halo2curves::{
+            bn256::{multi_miller_loop, G2Prepared},
+            pairing::MillerLoopResult,
+        },
+        poly::kzg::multiopen::{ProverGWC, VerifierGWC},
+    },
+    utils::fs::gen_srs,
+    Context,
+};
+use rand_core::OsRng;
+
+#[derive(Clone, Copy, Debug, Serialize, Deserialize)]
+struct BlsSignatureCircuitParams {
+    strategy: FpStrategy,
+    degree: u32,
+    num_advice: usize,
+    num_lookup_advice: usize,
+    num_fixed: usize,
+    lookup_bits: usize,
+    limb_bits: usize,
+    num_limbs: usize,
+    num_aggregation: u32,
+}
+
+/// Verify e(g1, signature_agg) = e(pubkey_agg, H(m))
+fn bls_signature_test<F: PrimeField>(
+    ctx: &mut Context<F>,
+    params: BlsSignatureCircuitParams,
+    g1: G1Affine,
+    signatures: &[G2Affine],
+    pubkeys: &[G1Affine],
+    msghash: G2Affine,
+) {
+    // Calculate halo2 pairing by multipairing
+    std::env::set_var("LOOKUP_BITS", params.lookup_bits.to_string());
+    let range = RangeChip::<F>::default(params.lookup_bits);
+    let fp_chip_1 = FpChip::<F>::new(&range, params.limb_bits, params.num_limbs);
+    let fp_chip_2 = FpChip::<F>::new(&range, params.limb_bits, params.num_limbs);
+    let pairing_chip = PairingChip::new(&fp_chip_1);
+    let bls_signature_chip = BlsSignatureChip::new(&fp_chip_2, &pairing_chip);
+    let result = bls_signature_chip.bls_signature_verify(ctx, g1, signatures, pubkeys, msghash);
+
+    // Calculate non-halo2 pairing by multipairing
+    let signature_g2_prepared = G2Prepared::from(signatures.iter().sum::<G2Affine>());
+    let pubkey_aggregated = pubkeys.iter().sum::<G1Affine>();
+    let hash_m_prepared = G2Prepared::from(-msghash);
+    let actual_result =
+        multi_miller_loop(&[(&g1, &signature_g2_prepared), (&pubkey_aggregated, &hash_m_prepared)])
+            .final_exponentiation();
+
+    // Compare the 2 results
+    let fp12_chip = Fp12Chip::new(&fp_chip_1);
+    assert_eq!(
+        format!("Gt({:?})", fp12_chip.get_assigned_value(&result.into())),
+        format!("{actual_result:?}"),
+        "Signatures do not match!"
+    );
+}
+
+fn random_bls_signature_circuit(
+    params: BlsSignatureCircuitParams,
+    stage: CircuitBuilderStage,
+    break_points: Option<MultiPhaseThreadBreakPoints>,
+) -> RangeCircuitBuilder<Fr> {
+    let k = params.degree as usize;
+    let mut builder = match stage {
+        CircuitBuilderStage::Mock => GateThreadBuilder::mock(),
+        CircuitBuilderStage::Prover => GateThreadBuilder::prover(),
+        CircuitBuilderStage::Keygen => GateThreadBuilder::keygen(),
+    };
+
+    assert!(params.num_aggregation > 0, "Cannot aggregate 0 signatures!");
+
+    // TODO: Implement hash_to_curve(msg) for arbitrary message
+    let msg_hash = G2Affine::random(OsRng);
+    let g1 = G1Affine::generator();
+
+    let mut sks: Vec<Fr> = Vec::new();
+    let mut signatures: Vec<G2Affine> = Vec::new();
+    let mut pubkeys: Vec<G1Affine> = Vec::new();
+
+    for _ in 0..params.num_aggregation {
+        let sk = Fr::random(OsRng);
+        let signature = G2Affine::from(msg_hash * sk);
+        let pubkey = G1Affine::from(G1Affine::generator() * sk);
+
+        sks.push(sk);
+        signatures.push(signature);
+        pubkeys.push(pubkey);
+    }
+
+    let start0 = start_timer!(|| format!("Witness generation for circuit in {stage:?} stage"));
+    bls_signature_test::<Fr>(builder.main(0), params, g1, &signatures, &pubkeys, msg_hash);
+
+    let circuit = match stage {
+        CircuitBuilderStage::Mock => {
+            builder.config(k, Some(20));
+            RangeCircuitBuilder::mock(builder)
+        }
+        CircuitBuilderStage::Keygen => {
+            builder.config(k, Some(20));
+            RangeCircuitBuilder::keygen(builder)
+        }
+        CircuitBuilderStage::Prover => RangeCircuitBuilder::prover(builder, break_points.unwrap()),
+    };
+    end_timer!(start0);
+    circuit
+}
+
+#[test]
+fn test_bls_signature() {
+    let run_path = "configs/bn254/bls_signature_circuit.config";
+    let path = run_path;
+    let params: BlsSignatureCircuitParams = serde_json::from_reader(
+        File::open(path).unwrap_or_else(|e| panic!("{path} does not exist: {e:?}")),
+    )
+    .unwrap();
+    println!("num_advice: {num_advice}", num_advice = params.num_advice);
+    let circuit = random_bls_signature_circuit(params, CircuitBuilderStage::Mock, None);
+    MockProver::run(params.degree, &circuit, vec![]).unwrap().assert_satisfied();
+}
+
+#[test]
+fn bench_bls_signature() -> Result<(), Box<dyn std::error::Error>> {
+    let rng = OsRng;
+    let config_path = "configs/bn254/bench_bls_signature.config";
+    let bench_params_file =
+        File::open(config_path).unwrap_or_else(|e| panic!("{config_path} does not exist: {e:?}"));
+    fs::create_dir_all("results/bn254").unwrap();
+    fs::create_dir_all("data").unwrap();
+
+    let results_path = "results/bn254/bls_signature_bench.csv";
+    let mut fs_results = File::create(results_path).unwrap();
+    writeln!(fs_results, "degree,num_advice,num_lookup,num_fixed,lookup_bits,limb_bits,num_limbs,num_aggregation,proof_time,proof_size,verify_time")?;
+
+    let bench_params_reader = BufReader::new(bench_params_file);
+    for line in bench_params_reader.lines() {
+        let bench_params: BlsSignatureCircuitParams =
+            serde_json::from_str(line.unwrap().as_str()).unwrap();
+        let k = bench_params.degree;
+        println!("---------------------- degree = {k} ------------------------------",);
+
+        let params = gen_srs(k);
+        let circuit = random_bls_signature_circuit(bench_params, CircuitBuilderStage::Keygen, None);
+
+        let vk_time = start_timer!(|| "Generating vkey");
+        let vk = keygen_vk(&params, &circuit)?;
+        end_timer!(vk_time);
+
+        let pk_time = start_timer!(|| "Generating pkey");
+        let pk = keygen_pk(&params, vk, &circuit)?;
+        end_timer!(pk_time);
+
+        let break_points = circuit.0.break_points.take();
+        drop(circuit);
+        // create a proof
+        let proof_time = start_timer!(|| "Proving time");
+        let circuit = random_bls_signature_circuit(
+            bench_params,
+            CircuitBuilderStage::Prover,
+            Some(break_points),
+        );
+        let mut transcript = Blake2bWrite::<_, _, Challenge255<_>>::init(vec![]);
+        create_proof::<
+            KZGCommitmentScheme<Bn256>,
+            ProverGWC<'_, Bn256>,
+            Challenge255<G1Affine>,
+            _,
+            Blake2bWrite<Vec<u8>, G1Affine, Challenge255<G1Affine>>,
+            _,
+        >(&params, &pk, &[circuit], &[&[]], rng, &mut transcript)?;
+        let proof = transcript.finalize();
+        end_timer!(proof_time);
+
+        let proof_size = {
+            let path = format!(
+                "data/bls_signature_bn254_circuit_proof_{}_{}_{}_{}_{}_{}_{}_{}.data",
+                bench_params.degree,
+                bench_params.num_advice,
+                bench_params.num_lookup_advice,
+                bench_params.num_fixed,
+                bench_params.lookup_bits,
+                bench_params.limb_bits,
+                bench_params.num_limbs,
+                bench_params.num_aggregation
+            );
+            let mut fd = File::create(&path)?;
+            fd.write_all(&proof)?;
+            let size = fd.metadata().unwrap().len();
+            fs::remove_file(path)?;
+            size
+        };
+
+        let verify_time = start_timer!(|| "Verify time");
+        let verifier_params = params.verifier_params();
+        let strategy = SingleStrategy::new(&params);
+        let mut transcript = Blake2bRead::<_, _, Challenge255<_>>::init(&proof[..]);
+        verify_proof::<
+            KZGCommitmentScheme<Bn256>,
+            VerifierGWC<'_, Bn256>,
+            Challenge255<G1Affine>,
+            Blake2bRead<&[u8], G1Affine, Challenge255<G1Affine>>,
+            SingleStrategy<'_, Bn256>,
+        >(verifier_params, pk.get_vk(), strategy, &[&[]], &mut transcript)
+        .unwrap();
+        end_timer!(verify_time);
+
+        writeln!(
+            fs_results,
+            "{},{},{},{},{},{},{},{},{:?},{},{:?}",
+            bench_params.degree,
+            bench_params.num_advice,
+            bench_params.num_lookup_advice,
+            bench_params.num_fixed,
+            bench_params.lookup_bits,
+            bench_params.limb_bits,
+            bench_params.num_limbs,
+            bench_params.num_aggregation,
+            proof_time.time.elapsed(),
+            proof_size,
+            verify_time.time.elapsed()
+        )?;
+    }
+    Ok(())
+}