iden3 / circom

zkSnark circuit compiler
GNU General Public License v3.0
1.25k stars 232 forks source link

Error generating the proof in Groth16 #249

Open hdvanegasm opened 4 months ago

hdvanegasm commented 4 months ago

Hi everyone,

I have the following circuit:

// The circuit proves that we know a secret and a polynomial such that the
// Shamir shares are indeed generated from the input secret and the
// input polynomial. Parties are identified as P_1, ..., P_4. The input to the
// circuit are the secret, the coefficients of the polynomial [a_1, a_2]
// used to share the secret, and the number of parties.
pragma circom  2.0.0;

template SecretSharing() {

    signal input secret;
    signal input coefficients[2];

    signal output shares[4];

    for(var i = 1; i <= 4; i++) {
        var eval = 0;
        for(var exp = 0; exp <= 2; exp++) {
            if (exp == 0) {
                eval += secret;
            } else {
                eval += coefficients[exp - 1] * (i ** exp);
            }
        }

        shares[i - 1] <== eval;
    }
}

component main = SecretSharing();

The input of the circuit is:

{
    "secret": "4",
    "coefficients": [
        "3",
        "4"
    ]
}

The circuit compiles correctly, however, when I generate the proof with the command:

snarkjs groth16 prove secret-sharing_0001.zkey witness.wtns proof.json public.json

The output is the following error:

[ERROR] snarkJS: Error: Scalar size does not match
    at _multiExp (/usr/local/lib/node_modules/snarkjs/node_modules/ffjavascript/build/main.cjs:4971:19)
    at WasmCurve.multiExpAffine (/usr/local/lib/node_modules/snarkjs/node_modules/ffjavascript/build/main.cjs:5008:22)
    at groth16Prove$1 (/usr/local/lib/node_modules/snarkjs/build/cli.cjs:5768:33)
    at async Object.groth16Prove [as action] (/usr/local/lib/node_modules/snarkjs/build/cli.cjs:12975:36)
    at async clProcessor (/usr/local/lib/node_modules/snarkjs/build/cli.cjs:481:27)

How can I solve this error? Thanks.

miguelis commented 4 months ago

If the circuit compiles correctly as well as the witness computation, the problem is probably in the interaction with snarkJS, you should open the issue here https://github.com/iden3/snarkjs