Open hammdist opened 3 years ago
Update: By playing with it some more, I discovered that it works with the curves flipped around - mnt6 works in mnt4 but not vice versa (the way I have them above). Isn't it supposed to work either way though, and that's how recursive proofs are done?
Here I have put together a simple example that just checks a SHA256 preimage in the inner snark, but using primary inputs. The proof is supposed to be checked in an outer snark. It fails during proof generation for the outer snark (full error below):
I have tried with a different inner snark that allows scaling the complexity more smoothly than SHA256. Specifically, I looked at the knapsack hash function, where it starts to fail at 16-bits of preimage combined with 32-bits of output hash (I was trying only with 1:2 ratio).
Well here is the failing SHA-256 snark at any rate:
Result: