This circom
compiler is written in Javascript and it will be frozen. For new projects and any further development please use new circom written in Rust.
Circom is a language designed to write arithmetic circuits that can be used in zero-knowledge proofs.
In particular, it is designed to work in zksnarks JavaScript library.
You can read the details of circom in the documentation webpage.
A good starting point is this tutorial
Also this video is a good starting point.
Creation of a circuit. This is an example of a NAND door:
template NAND() {
signal private input a;
signal input b;
signal output out;
out <== 1 - a*b;
a*(a-1) === 0;
b*(b-1) === 0;
}
component main = NAND();
The language uses mainly JavaScript/C syntax together with 5 extra operators to define the following constraints:
<==
, ==>
: These two operators are used to connect signals and at the same time imply a constraint.
As it is shown in the above example, a value is assigned to out
and a constraint is also generated. The assigned value must be of the form a*b+c where a,b and c are linear combinations of the signals.
<--
, -->
: These operators assign values to signals but do not generate any constraints. This allows to assign to a signal any value involving strange operations like shifts, divisions, modulo operations, etc. In general, these operators are used together with a ===
operator in order to force the constraint.
===
: This operator defines a constraint. The constraint must be simplificable to a constraint of the form a*b+c=0
, where a
, b
and c
are linear combinations of the signals.
In the above example, both inputs are forced to be binary by adding the constraints a*(a-1)===0
and b*(b-1) === 0
.
First of all, the compiler must be installed by typing:
npm install -g circom
The circuit is compiled with the following command:
circom mycircuit.circom -o mycircuit.json
The resulting output ( mycircuit.json
) can be used in the zksnarks JavaScript library.
In this library one can do the trusted setup, create the proofs and verify them.
In many situations, one has to convert an input to its binary representation. Therefore, the circuits can be written this way:
template Num2Bits(n) {
signal input in;
signal output out[n];
var lc1=0;
for (var i = 0; i<n; i++) {
out[i] <-- (in >> i) & 1;
out[i] * (out[i] -1 ) === 0;
lc1 += out[i] * 2**i;
}
lc1 === in;
}
component main = Num2Bits(8)
First of all, note that templates can have parameters. This allows to create libraries with templates that generate circuits in parametric ways. In this case, the circuit has an output of 8 signals, but one can easily instantiate any circuit with any number of outputs.
The inputs and outputs are defined as arrays. The programm allows multidimensional arrays for signals and variables.
Then, the values are assigned to each of the signals. In this case, the values are assigned without the constraint using the shift and & operators:
out[i] <-- (in >> i) & 1;
Afterwards, the constraints need to be defined. In this case, there is a big constraint of the form:
in === out[0]*2**0 + out[1]*2**1 + out[2]*2**2 + ... + out[n-1]*2**(n-1)
We do this by using a variable lc1
and adding each signal multiplied by its coefficient.
This variable does not hold a value at compilation time, but it holds a linear combination and it is used in the last constraint:
lc1 === in;
The last step is to force each output to be binary. This is done by adding the following constraint to each output:
out[i] * (out[i] -1 ) === 0;
Let's now create a 32bits adder.
This operation could be done directly by adding a simple constraint out === in1 + in2
,
but doing this the operation would not be module 2**32
but r
, where r
is the range of the elliptic curve. In the case of the zCash current implementation of zkSNARKs this number is typically some prime close to 2**253.
So, the strategy we will follow will be to first convert a number to binary, then do the addition using the binary representation like in regular electronic circuits, and finally change it back to a number.
To do this, we create 3 files: bitify.circom
, binsum.circom
and sum_test.circom
.
bitify.circom:
template Num2Bits(n) {
signal input in;
signal output out[n];
var lc1=0;
for (var i = 0; i<n; i++) {
out[i] <-- (in >> i) & 1;
out[i] * (out[i] -1 ) === 0;
lc1 += out[i] * 2**i;
}
lc1 === in;
}
template Bits2Num(n) {
signal input in[n];
signal output out;
var lc1=0;
for (var i = 0; i<n; i++) {
lc1 += in[i] * 2**i;
}
lc1 ==> out;
}
binsum.circom