Method new

proof_system/src/prover.rs:139–1124

Create a new proof. `nonce` is random data that needs to be hashed into the proof and it must be kept same while creating and verifying the proof. One use of `nonce` is for replay protection, here the prover might have chosen its nonce to prevent the verifier from reusing the proof as its own or the verifier might want to require the user to create fresh proof. Also returns the randomness used by

(
        rng: &mut R,
        proof_spec: ProofSpec<E>,
        witnesses: Witnesses<E>,
        nonce: Option<Vec<u8>>,
        mut config: ProverConfig<E>,
    )

    /// then be used as helpers in subsequent proof creations where these proofs are reused than
    /// creating fresh proofs.
    pub fn new<R: RngCore, D: FullDigest + Digest>(
        rng: &mut R,
        proof_spec: ProofSpec<E>,
        witnesses: Witnesses<E>,
        nonce: Option<Vec<u8>>,
        mut config: ProverConfig<E>,
    ) -> Result<(Self, BTreeMap<usize, E::ScalarField>), ProofSystemError> {
        proof_spec.validate()?;

        // There should be a witness for each statement
        expect_equality!(
            proof_spec.statements.len(),
            witnesses.len(),
            ProofSystemError::UnequalWitnessAndStatementCount
        );

        // Keep blinding for each witness reference that is part of an equality. This means that for
        // any 2 witnesses that are equal, same blinding will be stored. This will be drained during
        // proof creation and should be empty by the end.
        let mut blindings = BTreeMap::<WitnessRef, E::ScalarField>::new();

        // Prepare blindings for any witnesses that need to be proven equal.
        let mut disjoint_equalities = vec![];
        if !proof_spec.meta_statements.is_empty() {
            disjoint_equalities = proof_spec.meta_statements.disjoint_witness_equalities();
            for eq_wits in disjoint_equalities.clone() {
                let blinding = E::ScalarField::rand(rng);
                for wr in eq_wits.0 {
                    // Duplicating the same blinding for faster search
                    blindings.insert(wr, blinding);
                }
            }
        }

        // Prepare commitment keys for running Schnorr protocols of all statements.
        let (
            bound_check_lego_comm,
            ek_comm,
            chunked_comm,
            r1cs_comm_keys,
            bound_check_bpp_comm,
            bound_check_smc_comm,
            ineq_comm,
        ) = proof_spec.derive_commitment_keys()?;

        let mut sub_protocols = Vec::<SubProtocol<E>>::with_capacity(proof_spec.statements.0.len());

        // Randomness used by SAVER and LegoGroth16 proofs. This is tracked and returned so subsequent proofs for
        // the same public params and witness can reuse this randomness
        let mut commitment_randomness = BTreeMap::<usize, E::ScalarField>::new();

        let mut transcript = MerlinTranscript::new(COMPOSITE_PROOF_LABEL);
        if let Some(n) = nonce.as_ref() {
            transcript.append_message(NONCE_LABEL, n);
        }
        if let Some(ctx) = &proof_spec.context {
            transcript.append_message(CONTEXT_LABEL, ctx);
        }