Does an example loading a BN128 Groth16 constraint system generated into Snark.js, into Gnark for proving, exist?

[ash-burnt]

I am using circuits that are implemented in circom/snarkjs, and don't have the time or resources to port them. Is there an example of taking the .r1cs file generated by snark.js, and loading it as a Gnark constraint system? It seems like it should be possible, but when I try:

buf, err = os.ReadFile(filename)
r1cs = groth16.NewCS(ecc.BN254)
if _, err := r1cs.ReadFrom(bytes.NewBuffer(buf)); err != nil {
	return nil, err
}

the error is:
unsupported gnark version 8589934595.815276040.37752762531841
which makes it seem like Gnark can only read files that it has formatted itself

Is there a working example of loading an R1CS from another proving system?

[ivokub]

Gnark doesn't directly read circom circuits unfortunately. I think I have seen a few projects trying to achieve this goal. See for example:

• https://github.com/liyue201/gnark-circomlib

There is also a way to transpiler circom circuits into gnark circuits. See for reference https://www.notamonadtutorial.com/how-to-use-the-consenyss-gnark-zero-knowledge-proof-library-and-disclosure-of-a-ddos-bug/#:~:text=the%20dark%20side-,Low%2Dlevel%20API,-Located%20in%20the where they construct constraints manually. You could extend the idea by reading the circom circuit description and then manually creating a circuit from every circom row. I think I have seen such transpiler in the wild, but currently cannot find it anymore. I definitely recommend searching Github for it (a la circom to gnark, r1cs to gnark etc.).

[ivokub]

So - gnark's version of Groth16 has some additional features imo not available in the rapidsnark prover. I'd guess if you would try to rewrite the circuits in gnark using gnark's standard gadgets (package gnark/std), then the circuits could probably be smaller depending on what you compute. For example we have ECDSA signature verification, recursive PLONK/Groth16 verifier etc.

But otherwise I'm not sure who to turn to. If you are really interested then I could give you a few pointers how to approach it from gnark side assuming you are able to read circom constraints. I think the easiest approach would be if there would be a circom constraint yielder which outputs the linear relations A_j(x) * B_j(X) = C_j(X) with A_j(X) = \sum a_{i,j} x_i etc.

[cliff0412]

is the other way possible? i.e generate r1cs using gnark, but proving on rapidsnark?

[ivokub]

I think it is highly unlikely - we have amended our Groth16 proof backend with one additional operation which allows to improve prover time significantly. I'm not sure that rapidsnark has the same modification.

Other way is more probable as gnark prover is able to prove vanilla Groth16, but our compiler may output non-vanilla R1CS depending if the circuit uses advanced features.

[cliff0412]

could you provide some technical details of the optimization u mentioned to boost the prover time?

[ivokub]

This is the best writeup: https://www.zellic.io/blog/gnark-bug-groth16-commitments/

[p4u]

This might help you @cliff0412 https://github.com/vocdoni/circom2gnark