Halo2 zk-SNARK "Digit sum" circuit example 🔒

Introduction

This project is a very simple example implementation of a zk-SNARK circuit with Halo 2 proof system.

Goal

In simple words, Alice wants to convince Bob:

• that she knows a number she does not want to reveal to Bob (and which can be represented with 8 digits).
• that the sum of the digits of this number is equal to another public number that Bob knows.

sequenceDiagram
    actor Alice
    actor Bob
    Bob->>Alice: Do you know a number which sum of digits is X?
    Alice->>Bob: Yes! And here is a zero-knowledge proof (i.e. I will keep this number secret).
    Bob->>Alice: Thanks! I am convinced by your proof (if proof is valid).
    Bob-->>Alice: Sorry! I am not convinced by your proof (if proof is invalid)

Loading

Pre-requisites

• Have a correctly configured Rust toolchain (latest stable version, at least 1.77).

Build the CLI

Download source

$ git clone https://github.com/jpraynaud/halo2-digitsum
$ cd halo2-digitsum

Run the tests

$ make test

Build the documentation

$ make doc

Build the binary

Compile the binary

$ make build

Available commands

$ ./digitsum --help
This program proves and verifies the computation of the sum of the digits of a number.

Usage: digitsum [OPTIONS] <COMMAND>

Commands:
  prove   Run the prover for the digit sum circuit
  verify  Run the verifier for the digit sum circuit
  graph   Run the graph exporter for the digit sum circuit
  help    Print this message or the help of the given subcommand(s)

Options:
  -v, --verbose...  Verbosity level (-v=warning, -vv=info, -vvv=debug)
  -h, --help        Print help
  -V, --version     Print version

Here are the available commands:

Command	Performed action
prove	Run the prover for the digit sum circuit
verify	Run the verifier for the digit sum circuit
graph	Run the graph exporter for the digit sum circuit

prove command

$ ./digitsum prove --help
Run the prover for the digit sum circuit

Usage: digitsum prove [OPTIONS] --witness <WITNESS> --public-input <PUBLIC_INPUT>

Options:
  -w, --witness <WITNESS>
          Secret number that Alice knows (a.k.a. the witness)
  -p, --public-input <PUBLIC_INPUT>
          Public number that Bob knows and which represents the sum of the digits of the witness (a.k.a. the public input)
      --proof-file-name <PROOF_FILE_NAME>
          Proof export filename [default: proof.hex]
      --proof-export-dir <PROOF_EXPORT_DIR>
          Proof export directory [default: ./]
  -h, --help
          Print help

verify command

$ ./digitsum verify --help
Run the verifier for the digit sum circuit

Usage: digitsum verify [OPTIONS] --public-input <PUBLIC_INPUT>

Options:
  -p, --public-input <PUBLIC_INPUT>
          Public number that Bob knows and which represents the sum of the digits of the witness (a.k.a. the public input)
      --proof-file-name <PROOF_FILE_NAME>
          Proof import filename [default: proof.hex]
      --proof-import-dir <PROOF_IMPORT_DIR>
          Proof import directory [default: ./]
  -h, --help
          Print help

graph command

$ ./digitsum graph --help
Run the graph exporter for the digit sum circuit

Usage: digitsum graph [OPTIONS]

Options:
      --graph-file-name <GRAPH_FILE_NAME>
          Circuit layout export filename [default: circuit-layout.png]
      --graph-export-dir <GRAPH_EXPORT_DIR>
          Circuit layout export directory [default: ./]
      --graph-with-labels
          Circuit layout with labels
      --graph-mark-equality-cells
          Circuit layout mark equality cells
      --graph-show-equality-constraints
          Circuit layout show equality constraints
      --graph-width <GRAPH_WIDTH>
          Circuit layout width [default: 1024]
      --graph-height <GRAPH_HEIGHT>
          Circuit layout height [default: 768]
  -h, --help
          Print help

Run the protocol

Create a proof

Create a proof with the prove sub-command:

$ ./digitsum prove --witness 123 --public-input 6 --proof-file-name proof.hex
>> Proof generated to "./proof.hex"

Verify a proof

Verify a proof with the verify sub-command:

$ ./digitsum verify --public-input 6 --proof-file-name proof.hex
>> Proof verified!

Generate the circuit layout

Generate the layout of the circuit with the graph sub-command:

$ ./digitsum graph --graph-file-name circuit-layout.png
>> Circuit layout generated to "./circuit-layout.png"

And visualize the rendered circuit layout: