fix script for build-dsc-circuit

circuits/README.md

@@ -71,17 +71,19 @@ yarn test
 
 This will run tests with sample data generated on the fly.
 
-
 ## OpenPassport Prove circuit
+
 OpenPassport Prove is the main circuit of the project.
 It is used for these 3 different `circuit modes`:
+
 - prove offChain
 - prove onChain
 - register
 
 Learn more on these 3 use cases on [OpenPassport documentation.](https://docs.openpassport.app/docs/use-openpassport/quickstart)
 
 The circuit achieves the following actions:
+
 - verify the signature of the passport and the integrity of the datagroups
 - disclose attributes
 - verify that user's name is not part of the OFAC list
@@ -93,23 +95,21 @@ If this "everything circuit" is executing all those actions each time, we want a
 
 In order to achieve that we will input a bitmap `selector_mode[2]` that will ensure that the circuit can only disclose the attributes related to the `circuit mode` selected.
 
-| Circuit Mode | selector_mode[0] | selector_mode[1] |
-| --- | --- | --- |
-| prove offChain | 1 | 1 |
-| prove onChain | 1 | 0 |
-| register | 0 | 0 |
+| Circuit Mode   | selector_mode[0] | selector_mode[1] |
+| -------------- | ---------------- | ---------------- |
+| prove offChain | 1                | 1                |
+| prove onChain  | 1                | 0                |
+| register       | 0                | 0                |
 
 Using the value [0,1] for `selector_mode` will fail proof generation.
 
-
 Here are the attributes disclosed according to the `circuit_mode`:
 
-| Circuit Mode | Attributes Disclosed |
-| --- | --- |
-| prove offChain | packedReveal-dg1, older than, OFAC, countryIsNotInList, pubKey |
-| prove onChain | packedReveal-dg1, older than, OFAC, countryIsNotInList, blinded DSC commitment |
-| register | blinded DSC commitment, commitment |
-
+| Circuit Mode   | Attributes Disclosed                                                           |
+| -------------- | ------------------------------------------------------------------------------ |
+| prove offChain | packedReveal-dg1, older than, OFAC, countryIsNotInList, pubKey                 |
+| prove onChain  | packedReveal-dg1, older than, OFAC, countryIsNotInList, blinded DSC commitment |
+| register       | blinded DSC commitment, commitment                                             |
 
 ## Certificate Chain verification
 
@@ -119,7 +119,9 @@ Both DSC and CSCA lists are published on online registry of the ICAO, however ma
 In order to maximize passport readability we need to verify the full certificate chain.
 
 ### On chain
+
 To avoid huge proving time and (too) heavy zkeys, the signature of the passport data is verified on the mobile (the passport data never leaves the device) and the certificate chain verification is done on a remote modal server. A `blindedDscCommitment` is generated on both sides to link proofs.
 
 ### Off chain
-In off chain setup users will send their DSC to the verifier along with their passport proof. The pubKey will be revealed as an output of the proof.
+
+In off chain setup users will send their DSC to the verifier along with their passport proof. The pubKey will be revealed as an output of the proof.

circuits/scripts/build_dsc_2048_circuits.sh

@@ -19,7 +19,7 @@ build_circuit() {
     local START_TIME=$(date +%s)
 
     echo -e "\033[34mcompiling circuit: $CIRCUIT_NAME\033[0m"
-    circom circuits/tests/dsc/${CIRCUIT_NAME}.circom -l node_modules -l ./node_modules/@zk-kit/binary-merkle-root.circom/src -l ./node_modules/circomlib/circuits --r1cs --O1 --wasm -c --output build
+    circom circuits/dsc/instances/${CIRCUIT_NAME}.circom -l node_modules -l ./node_modules/@zk-kit/binary-merkle-root.circom/src -l ./node_modules/circomlib/circuits --r1cs --O1 --wasm -c --output build
 
     echo -e "\033[34mbuilding zkey\033[0m"
     yarn snarkjs groth16 setup build/${CIRCUIT_NAME}.r1cs build/powersOfTau28_hez_final_20.ptau build/${CIRCUIT_NAME}.zkey
@@ -51,9 +51,9 @@ build_circuit() {
 # Define circuits and their deployment flags
 # name:deploy_flag
 CIRCUITS=(
-    "dsc_sha256_rsapss_2048:true"
-    "dsc_sha256_rsa_2048:true"
-    "dsc_sha1_rsa_2048:true"
+    "dsc_rsapss_65537_sha256_2048:true"
+    "dsc_rsa_65537_sha256_2048:true"
+    "dsc_rsa_65537_sha1_2048:true"
 )
 
 for circuit in "${CIRCUITS[@]}"; do

contracts/contracts/Verifier_dsc_rsa_65537_sha1_2048.sol

@@ -0,0 +1,170 @@
+// SPDX-License-Identifier: GPL-3.0
+/*
+    Copyright 2021 0KIMS association.
+
+    This file is generated with [snarkJS](https://github.com/iden3/snarkjs).
+
+    snarkJS is a free software: you can redistribute it and/or modify it
+    under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    snarkJS is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
+    License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with snarkJS. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+pragma solidity >=0.7.0 <0.9.0;
+
+contract Verifier_dsc_rsa_65537_sha1_2048 {
+    // Scalar field size
+    uint256 constant r    = 21888242871839275222246405745257275088548364400416034343698204186575808495617;
+    // Base field size
+    uint256 constant q   = 21888242871839275222246405745257275088696311157297823662689037894645226208583;
+
+    // Verification Key data
+    uint256 constant alphax  = 20491192805390485299153009773594534940189261866228447918068658471970481763042;
+    uint256 constant alphay  = 9383485363053290200918347156157836566562967994039712273449902621266178545958;
+    uint256 constant betax1  = 4252822878758300859123897981450591353533073413197771768651442665752259397132;
+    uint256 constant betax2  = 6375614351688725206403948262868962793625744043794305715222011528459656738731;
+    uint256 constant betay1  = 21847035105528745403288232691147584728191162732299865338377159692350059136679;
+    uint256 constant betay2  = 10505242626370262277552901082094356697409835680220590971873171140371331206856;
+    uint256 constant gammax1 = 11559732032986387107991004021392285783925812861821192530917403151452391805634;
+    uint256 constant gammax2 = 10857046999023057135944570762232829481370756359578518086990519993285655852781;
+    uint256 constant gammay1 = 4082367875863433681332203403145435568316851327593401208105741076214120093531;
+    uint256 constant gammay2 = 8495653923123431417604973247489272438418190587263600148770280649306958101930;
+    uint256 constant deltax1 = 4766268115133206610314787630727129782489543590682761993451136553076851288119;
+    uint256 constant deltax2 = 5420341533856142605013760188859731968341404568362419753467612950662716807764;
+    uint256 constant deltay1 = 13706411952733720514666924887158015540827903380267122705868403115221572932078;
+    uint256 constant deltay2 = 5543766965060474591092859527533560466945832976132663949845703590160092130664;
+
+
+    uint256 constant IC0x = 17908967629137052474112707496771758069322926085845015877922295002210990593304;
+    uint256 constant IC0y = 6383432980722921245980814464336880189669518810415631731311068271009200302026;
+
+    uint256 constant IC1x = 1868911144786195980344314843465071030593505744917955591036688774879590238260;
+    uint256 constant IC1y = 19547389766187324141997638990895875380087036691764223886503999972786274818899;
+
+
+    // Memory data
+    uint16 constant pVk = 0;
+    uint16 constant pPairing = 128;
+
+    uint16 constant pLastMem = 896;
+
+    function verifyProof(uint[2] calldata _pA, uint[2][2] calldata _pB, uint[2] calldata _pC, uint[1] calldata _pubSignals) public view returns (bool) {
+        assembly {
+            function checkField(v) {
+                if iszero(lt(v, q)) {
+                    mstore(0, 0)
+                    return(0, 0x20)
+                }
+            }
+
+            // G1 function to multiply a G1 value(x,y) to value in an address
+            function g1_mulAccC(pR, x, y, s) {
+                let success
+                let mIn := mload(0x40)
+                mstore(mIn, x)
+                mstore(add(mIn, 32), y)
+                mstore(add(mIn, 64), s)
+
+                success := staticcall(sub(gas(), 2000), 7, mIn, 96, mIn, 64)
+
+                if iszero(success) {
+                    mstore(0, 0)
+                    return(0, 0x20)
+                }
+
+                mstore(add(mIn, 64), mload(pR))
+                mstore(add(mIn, 96), mload(add(pR, 32)))
+
+                success := staticcall(sub(gas(), 2000), 6, mIn, 128, pR, 64)
+
+                if iszero(success) {
+                    mstore(0, 0)
+                    return(0, 0x20)
+                }
+            }
+
+            function checkPairing(pA, pB, pC, pubSignals, pMem) -> isOk {
+                let _pPairing := add(pMem, pPairing)
+                let _pVk := add(pMem, pVk)
+
+                mstore(_pVk, IC0x)
+                mstore(add(_pVk, 32), IC0y)
+
+                // Compute the linear combination vk_x
+
+                g1_mulAccC(_pVk, IC1x, IC1y, calldataload(add(pubSignals, 0)))
+
+
+                // -A
+                mstore(_pPairing, calldataload(pA))
+                mstore(add(_pPairing, 32), mod(sub(q, calldataload(add(pA, 32))), q))
+
+                // B
+                mstore(add(_pPairing, 64), calldataload(pB))
+                mstore(add(_pPairing, 96), calldataload(add(pB, 32)))
+                mstore(add(_pPairing, 128), calldataload(add(pB, 64)))
+                mstore(add(_pPairing, 160), calldataload(add(pB, 96)))
+
+                // alpha1
+                mstore(add(_pPairing, 192), alphax)
+                mstore(add(_pPairing, 224), alphay)
+
+                // beta2
+                mstore(add(_pPairing, 256), betax1)
+                mstore(add(_pPairing, 288), betax2)
+                mstore(add(_pPairing, 320), betay1)
+                mstore(add(_pPairing, 352), betay2)
+
+                // vk_x
+                mstore(add(_pPairing, 384), mload(add(pMem, pVk)))
+                mstore(add(_pPairing, 416), mload(add(pMem, add(pVk, 32))))
+
+
+                // gamma2
+                mstore(add(_pPairing, 448), gammax1)
+                mstore(add(_pPairing, 480), gammax2)
+                mstore(add(_pPairing, 512), gammay1)
+                mstore(add(_pPairing, 544), gammay2)
+
+                // C
+                mstore(add(_pPairing, 576), calldataload(pC))
+                mstore(add(_pPairing, 608), calldataload(add(pC, 32)))
+
+                // delta2
+                mstore(add(_pPairing, 640), deltax1)
+                mstore(add(_pPairing, 672), deltax2)
+                mstore(add(_pPairing, 704), deltay1)
+                mstore(add(_pPairing, 736), deltay2)
+
+
+                let success := staticcall(sub(gas(), 2000), 8, _pPairing, 768, _pPairing, 0x20)
+
+                isOk := and(success, mload(_pPairing))
+            }
+
+            let pMem := mload(0x40)
+            mstore(0x40, add(pMem, pLastMem))
+
+            // Validate that all evaluations ∈ F
+
+            checkField(calldataload(add(_pubSignals, 0)))
+
+            checkField(calldataload(add(_pubSignals, 32)))
+
+
+            // Validate all evaluations
+            let isValid := checkPairing(_pA, _pB, _pC, _pubSignals, pMem)
+
+            mstore(0, isValid)
+             return(0, 0x20)
+         }
+     }
+ }