feat!: Separate public inputs from proof in acir composer

barretenberg/acir_tests/browser-test-app/src/index.ts

@@ -27,14 +27,14 @@ async function runTest(
   );
 
   const acirComposer = await api.acirNewAcirComposer(CIRCUIT_SIZE);
-  const proof = await api.acirCreateProof(
+  const [publicInputs, proof] = await api.acirCreateProof(
     acirComposer,
     bytecode,
     witness,
     true
   );
   debug(`verifying...`);
-  const verified = await api.acirVerifyProof(acirComposer, proof, true);
+  const verified = await api.acirVerifyProof(acirComposer, publicInputs, proof, true);
   debug(`verified: ${verified}`);
 
   await api.destroy();

barretenberg/acir_tests/flows/all_cmds.sh

@@ -20,7 +20,7 @@ $BIN verify -k vk -p proof $FLAGS
 # Grep to determine success.
 $BIN contract -k vk $BFLAG -o - | grep "Verification Key Hash" > /dev/null
 # Use jq to determine success, and also check result not empty.
-OUTPUT=$($BIN proof_as_fields -k vk -p proof -o - | jq .)
+OUTPUT=$($BIN proof_as_fields -p proof -o - | jq .)
 [ -n "$OUTPUT" ] || exit 1
 OUTPUT=$($BIN vk_as_fields -k vk -o - | jq .)
-[ -n "$OUTPUT" ] || exit 1
+[ -n "$OUTPUT" ] || exit 1

barretenberg/cpp/src/barretenberg/bb/file_io.hpp

@@ -1,28 +1,39 @@
 #pragma once
 #include <barretenberg/common/log.hpp>
+#include <cstdint>
 #include <fstream>
 #include <ios>
 #include <vector>
 
-inline std::vector<uint8_t> read_file(const std::string& filename, size_t bytes = 0)
+inline std::streamsize get_file_size(const std::string& filename)
 {
     // Open the file in binary mode and move to the end.
     std::ifstream file(filename, std::ios::binary | std::ios::ate);
     if (!file) {
         throw std::runtime_error("Unable to open file: " + filename);
     }
 
-    // Get the file size.
-    std::streamsize size = bytes == 0 ? (std::streamsize)file.tellg() : (std::streamsize)bytes;
+    return file.tellg();
+}
+
+inline std::vector<uint8_t> read_file(const std::string& filename, size_t bytes = 0)
+{
+    std::streamsize size;
+    if (bytes == 0) {
+        size = get_file_size(filename);
+    } else {
+        size = (std::streamsize)bytes;
+    }
+
     if (size <= 0) {
         throw std::runtime_error("File is empty or there's an error reading it: " + filename);
     }
 
-    // Create a vector with enough space for the file data.
-    std::vector<uint8_t> fileData((size_t)size);
+    std::vector<uint8_t> fileData(static_cast<size_t>(size));
 
-    // Go back to the start of the file and read all its contents.
-    file.seekg(0, std::ios::beg);
+    // Since the file was closed after getting its size,
+    // we need to open it again.
+    std::ifstream file(filename, std::ios::binary);
     file.read(reinterpret_cast<char*>(fileData.data()), size);
 
     return fileData;

barretenberg/cpp/src/barretenberg/bb/main.cpp

@@ -7,6 +7,7 @@
 #include <barretenberg/dsl/acir_format/acir_to_constraint_buf.hpp>
 #include <barretenberg/dsl/acir_proofs/acir_composer.hpp>
 #include <barretenberg/srs/global_crs.hpp>
+#include <cstddef>
 #include <iostream>
 #include <stdexcept>
 #include <string>
@@ -47,7 +48,49 @@ acir_format::WitnessVector get_witness(std::string const& witness_path)
 acir_format::acir_format get_constraint_system(std::string const& bytecode_path)
 {
     auto bytecode = get_bytecode(bytecode_path);
-    return acir_format::circuit_buf_to_acir_format(bytecode);
+    auto constraint_system = acir_format::circuit_buf_to_acir_format(bytecode);
+
+    auto remove_duplicates = [](std::vector<uint32_t>& vec) {
+        std::sort(vec.begin(), vec.end());
+        auto lastUnique = std::unique(vec.begin(), vec.end());
+        vec.erase(lastUnique, vec.end());
+    };
+
+    // The deserialized acir can have duplicate public inputs.
+    //
+    // This can happen if for example, the input to a function is a public input and
+    // then this input is returned as a public output.
+    //
+    // One solution for this, is to have ACIR introduce the concept of a public output
+    // which would be different to the public input. A public input would be the public values
+    // which are inputted to the program and the public output would be the public values
+    // which are returned when the program terminates.
+    remove_duplicates(constraint_system.public_inputs);
+
+    return constraint_system;
+}
+
+std::vector<uint8_t> read_public_inputs(std::string const& public_inputs_path)
+{
+    // If the number of public inputs is 0, then read_file will trigger a failure
+    // because the file will be empty. We therefore check if the file is empty
+    // before trying to read it.
+    if (get_file_size(public_inputs_path) == 0) {
+        return {};
+    }
+    return read_file(public_inputs_path);
+}
+
+// When given a proof path, we simply append "-public_inputs" to it.
+// to derive a file path for the public inputs.
+//
+// The alternative is to have the user pass in a path for their proof
+// and a path for their public inputs. This is more verbose and
+// its likely that the user will want their public inputs to be
+// in the same directory as their proof.
+std::string public_inputs_path_from_proof_path(std::string const& proof_path)
+{
+    return proof_path + "_public_inputs";
 }
 
 /**
@@ -69,8 +112,8 @@ bool proveAndVerify(const std::string& bytecodePath, const std::string& witnessP
     auto witness = get_witness(witnessPath);
     auto acir_composer = init(constraint_system);
 
-    auto proof = acir_composer.create_proof(constraint_system, witness, recursive);
-    auto verified = acir_composer.verify_proof(proof, recursive);
+    auto [public_inputs, proof] = acir_composer.create_proof(constraint_system, witness, recursive);
+    auto verified = acir_composer.verify_proof(public_inputs, proof, recursive);
 
     vinfo("verified: ", verified);
     return verified;
@@ -86,24 +129,28 @@ bool proveAndVerify(const std::string& bytecodePath, const std::string& witnessP
  * @param bytecodePath Path to the file containing the serialized circuit
  * @param witnessPath Path to the file containing the serialized witness
  * @param recursive Whether to use recursive proof generation of non-recursive
- * @param outputPath Path to write the proof to
+ * @param outputProofPath Path to write the proof to - The proof does not contain public inputs
  */
 void prove(const std::string& bytecodePath,
            const std::string& witnessPath,
            bool recursive,
-           const std::string& outputPath)
+           const std::string& outputProofPath)
 {
     auto constraint_system = get_constraint_system(bytecodePath);
     auto witness = get_witness(witnessPath);
     auto acir_composer = init(constraint_system);
-    auto proof = acir_composer.create_proof(constraint_system, witness, recursive);
+    auto [public_inputs, proof] = acir_composer.create_proof(constraint_system, witness, recursive);
 
-    if (outputPath == "-") {
+    if (outputProofPath == "-") {
+        writeRawBytesToStdout(public_inputs);
         writeRawBytesToStdout(proof);
-        vinfo("proof written to stdout");
+        vinfo("proof and public inputs written to stdout");
     } else {
-        write_file(outputPath, proof);
-        vinfo("proof written to: ", outputPath);
+        auto outputPublicInputsPath = public_inputs_path_from_proof_path(outputProofPath);
+        write_file(outputPublicInputsPath, public_inputs);
+        write_file(outputProofPath, proof);
+        vinfo("proof written to: ", outputProofPath);
+        vinfo("public inputs written to: ", outputPublicInputsPath);
     }
 }
 
@@ -135,7 +182,7 @@ void gateCount(const std::string& bytecodePath)
  * - proc_exit: A boolean value is returned indicating whether the proof is valid.
  *   an exit code of 0 will be returned for success and 1 for failure.
  *
- * @param proof_path Path to the file containing the serialized proof
+ * @param proof_path Path to the file containing the serialized proof without public inputs preprended
  * @param recursive Whether to use recursive proof generation of non-recursive
  * @param vk_path Path to the file containing the serialized verification key
  * @return true If the proof is valid
@@ -146,7 +193,11 @@ bool verify(const std::string& proof_path, bool recursive, const std::string& vk
     auto acir_composer = init();
     auto vk_data = from_buffer<plonk::verification_key_data>(read_file(vk_path));
     acir_composer.load_verification_key(std::move(vk_data));
-    auto verified = acir_composer.verify_proof(read_file(proof_path), recursive);
+
+    auto public_inputs_path = public_inputs_path_from_proof_path(proof_path);
+    std::vector<uint8_t> public_inputs = read_public_inputs(public_inputs_path);
+    auto proof = read_file(proof_path);
+    auto verified = acir_composer.verify_proof(public_inputs, proof, recursive);
 
     vinfo("verified: ", verified);
 
@@ -230,14 +281,17 @@ void contract(const std::string& output_path, const std::string& vk_path)
  *
  *
  * @param proof_path Path to the file containing the serialized proof
- * @param vk_path Path to the file containing the serialized verification key
  * @param output_path Path to write the proof to
  */
-void proofAsFields(const std::string& proof_path, std::string const& vk_path, const std::string& output_path)
+void proofAsFields(const std::string& proof_path, const std::string& output_path)
 {
+
+    auto public_inputs_path = public_inputs_path_from_proof_path(proof_path);
+    auto proof = read_file(proof_path);
+    std::vector<uint8_t> public_inputs = read_public_inputs(public_inputs_path);
+
     auto acir_composer = init();
-    auto vk_data = from_buffer<plonk::verification_key_data>(read_file(vk_path));
-    auto data = acir_composer.serialize_proof_into_fields(read_file(proof_path), vk_data.num_public_inputs);
+    auto data = acir_composer.serialize_proof_into_fields(public_inputs, proof);
     auto json = format("[", join(map(data, [](auto fr) { return format("\"", fr, "\""); })), "]");
 
     if (output_path == "-") {
@@ -375,7 +429,7 @@ int main(int argc, char* argv[])
             writeVk(bytecode_path, output_path);
         } else if (command == "proof_as_fields") {
             std::string output_path = getOption(args, "-o", proof_path + "_fields.json");
-            proofAsFields(proof_path, vk_path, output_path);
+            proofAsFields(proof_path, output_path);
         } else if (command == "vk_as_fields") {
             std::string output_path = getOption(args, "-o", vk_path + "_fields.json");
             vkAsFields(vk_path, output_path);

barretenberg/cpp/src/barretenberg/dsl/acir_proofs/acir_composer.cpp

@@ -1,4 +1,5 @@
 #include "acir_composer.hpp"
+#include "barretenberg/common/container.hpp"
 #include "barretenberg/common/serialize.hpp"
 #include "barretenberg/common/throw_or_abort.hpp"
 #include "barretenberg/dsl/acir_format/acir_format.hpp"
@@ -16,6 +17,33 @@ AcirComposer::AcirComposer(size_t size_hint, bool verbose)
     , verbose_(verbose)
 {}
 
+/**
+ * @brief Splits the proof into two vectors.
+ *
+ * Barretenberg returns a proof that is concatenated with the public inputs.
+ * This function splits the proof into two vectors, one containing the public inputs,
+ * and the other containing the proof without the public inputs.
+ *
+ * @param proof - proof with the public inputs preprended
+ * @param num_public_inputs - the number of public inputs prepended to the proof
+ * @return std::pair<std::vector<uint8_t>, std::vector<uint8_t>>
+ */
+std::pair<std::vector<uint8_t>, std::vector<uint8_t>> split_proof(std::vector<uint8_t>& proof,
+                                                                  uint32_t num_public_inputs)
+{
+
+    uint32_t numBytesToRemove = 32 * num_public_inputs;
+
+    if (proof.size() < numBytesToRemove) {
+        throw_or_abort("Not enough bytes in the proof to remove the desired number of public inputs.");
+    }
+
+    std::vector<uint8_t> public_inputs = slice(proof, 0, numBytesToRemove);
+    std::vector<uint8_t> proof_without_public_inputs = slice(proof, numBytesToRemove);
+
+    return { public_inputs, proof_without_public_inputs };
+}
+
 void AcirComposer::create_circuit(acir_format::acir_format& constraint_system)
 {
     if (builder_.get_num_gates() > 1) {
@@ -38,9 +66,8 @@ void AcirComposer::init_proving_key(acir_format::acir_format& constraint_system)
     proving_key_ = composer.compute_proving_key(builder_);
 }
 
-std::vector<uint8_t> AcirComposer::create_proof(acir_format::acir_format& constraint_system,
-                                                acir_format::WitnessVector& witness,
-                                                bool is_recursive)
+std::pair<std::vector<uint8_t>, std::vector<uint8_t>> AcirComposer::create_proof(
+    acir_format::acir_format& constraint_system, acir_format::WitnessVector& witness, bool is_recursive)
 {
     vinfo("building circuit with witness...");
     builder_ = acir_format::Builder(size_hint_);
@@ -69,7 +96,9 @@ std::vector<uint8_t> AcirComposer::create_proof(acir_format::acir_format& constr
         proof = prover.construct_proof().proof_data;
     }
     vinfo("done.");
-    return proof;
+
+    auto num_public_inputs = static_cast<uint32_t>(constraint_system.public_inputs.size());
+    return split_proof(proof, num_public_inputs);
 }
 
 std::shared_ptr<proof_system::plonk::verification_key> AcirComposer::init_verification_key()
@@ -90,8 +119,11 @@ void AcirComposer::load_verification_key(proof_system::plonk::verification_key_d
         std::move(data), srs::get_crs_factory()->get_verifier_crs());
 }
 
-bool AcirComposer::verify_proof(std::vector<uint8_t> const& proof, bool is_recursive)
+bool AcirComposer::verify_proof(std::vector<uint8_t> const& public_inputs,
+                                std::vector<uint8_t> const& proof_without_public_inputs,
+                                bool is_recursive)
 {
+    auto proof = join({ public_inputs, proof_without_public_inputs });
     acir_format::Composer composer(proving_key_, verification_key_);
 
     if (!verification_key_) {
@@ -100,8 +132,8 @@ bool AcirComposer::verify_proof(std::vector<uint8_t> const& proof, bool is_recur
         vinfo("done.");
     }
 
-    // Hack. Shouldn't need to do this. 2144 is size with no public inputs.
-    builder_.public_inputs.resize((proof.size() - 2144) / 32);
+    auto numPublicInputs = public_inputs.size() / 32;
+    builder_.public_inputs.resize(numPublicInputs);
 
     if (is_recursive) {
         auto verifier = composer.create_verifier(builder_);
@@ -125,12 +157,13 @@ std::string AcirComposer::get_solidity_verifier()
  *        Use this method to get the witness values!
  *
  * @param proof
- * @param num_inner_public_inputs - number of public inputs on the proof being serialized
+ * @param public_inputs - number of public inputs associated with the proof
  */
-std::vector<barretenberg::fr> AcirComposer::serialize_proof_into_fields(std::vector<uint8_t> const& proof,
-                                                                        size_t num_inner_public_inputs)
+std::vector<barretenberg::fr> AcirComposer::serialize_proof_into_fields(std::vector<uint8_t> const& public_inputs,
+                                                                        std::vector<uint8_t> const& proof)
 {
-    transcript::StandardTranscript transcript(proof,
+    auto num_inner_public_inputs = public_inputs.size() / 32;
+    transcript::StandardTranscript transcript(join({ public_inputs, proof }),
                                               acir_format::Composer::create_manifest(num_inner_public_inputs),
                                               transcript::HashType::PlookupPedersenBlake3s,
                                               16);

barretenberg/cpp/src/barretenberg/dsl/acir_proofs/acir_composer.hpp

@@ -16,23 +16,23 @@ class AcirComposer {
 
     void init_proving_key(acir_format::acir_format& constraint_system);
 
-    std::vector<uint8_t> create_proof(acir_format::acir_format& constraint_system,
-                                      acir_format::WitnessVector& witness,
-                                      bool is_recursive);
+    std::pair<std::vector<uint8_t>, std::vector<uint8_t>> create_proof(acir_format::acir_format& constraint_system,
+                                                                       acir_format::WitnessVector& witness,
+                                                                       bool is_recursive);
 
     void load_verification_key(proof_system::plonk::verification_key_data&& data);
 
     std::shared_ptr<proof_system::plonk::verification_key> init_verification_key();
 
-    bool verify_proof(std::vector<uint8_t> const& proof, bool is_recursive);
+    bool verify_proof(std::vector<uint8_t> const& public_inputs, std::vector<uint8_t> const& proof, bool is_recursive);
 
     std::string get_solidity_verifier();
     size_t get_exact_circuit_size() { return exact_circuit_size_; };
     size_t get_total_circuit_size() { return total_circuit_size_; };
     size_t get_circuit_subgroup_size() { return circuit_subgroup_size_; };
 
-    std::vector<barretenberg::fr> serialize_proof_into_fields(std::vector<uint8_t> const& proof,
-                                                              size_t num_inner_public_inputs);
+    std::vector<barretenberg::fr> serialize_proof_into_fields(std::vector<uint8_t> const& public_inputs,
+                                                              std::vector<uint8_t> const& proof);
 
     std::vector<barretenberg::fr> serialize_verification_key_into_fields();