plonk_latest.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Evaluate \n",
    "$ f(x, y) = 2x^2 - x^2y^2 + 3 $\n",
    "\n",
    "$ g_0 = x ⋅ x $ \n",
    "\n",
    "$ g_1 = x ⋅ x $ \n",
    "\n",
    "$ g_2 = y ⋅ y $\n",
    "\n",
    "$ g_3 = g_0 ⋅ 2 $\n",
    "\n",
    "$ g_4 = g_1 ⋅ g_2 $\n",
    "\n",
    "$ g_5 = g_2 - g_4 $\n",
    "\n",
    "$ g_6 = g_5 + 3 $\n",
    "\n",
    "---\n",
    "\n",
    "$ c_0 = a_0 ⋅ b_0 $\n",
    "\n",
    "$ c_1 = a_1 ⋅ b_1 $\n",
    "\n",
    "$ c_2 = a_2 ⋅ b_2 $\n",
    "\n",
    "$ c_3 = a_3 ⋅ 2 $\n",
    "\n",
    "$ c_4 = a_4 ⋅ b_4 $\n",
    "\n",
    "$ c_5 = a_5 - b_5 $\n",
    "\n",
    "$ c_6 = a_6 + 3 $\n",
    "\n",
    "---\n",
    "\n",
    "$ x = a_0 = b_0 = a_1 = b_1 $\n",
    "\n",
    "$ y = a_2 = b_2 $\n",
    "\n",
    "$ g_0 = a_3 = c_0 $\n",
    "\n",
    "$ g_1 = a_4 = c_1 $\n",
    "\n",
    "$ g_2 = b_4 = c_2 $\n",
    "\n",
    "$ g_3 = a_5 = c_3 $\n",
    "\n",
    "$ g_4 = b_5 = c_4 $\n",
    "\n",
    "$ g_5 = a_6 = c_5 $\n",
    "\n",
    "$ g_6 = c_6 $\n",
    "\n",
    "### Gate constrain equation\n",
    "\n",
    "$ g_i = q_{Li}⋅a_i+q_{Ri}⋅b_i+q_{Mi}⋅(a_i⋅b_i)+q_{Ci}+q_{Oi}⋅c_i=0 $\n",
    "\n",
    "$ g_0 = 0⋅a_0 + 0⋅b_0 + 1⋅(a_0⋅b_0) + 0 + (-1)⋅c_0 = 0 $\n",
    "\n",
    "$ g_1 = 0⋅a_1 + 0⋅b_1 + 1⋅(a_1⋅b_1) + 0 + (-1)⋅c_1 = 0 $\n",
    "\n",
    "$ g_2 = 0⋅a_2 + 0⋅b_2 + 1⋅(a_2⋅b_2) + 0 + (-1)⋅c_2 = 0 $\n",
    "\n",
    "$ g_3 = 2⋅a_3 + 0⋅b_3 + 0⋅(a_3⋅b_3) + 0 + (-1)⋅c_3 = 0 $\n",
    "\n",
    "$ g_4 = 0⋅a_4 + 0⋅b_4 + 1⋅(a_4⋅b_4) + 0 + (-1)⋅c_4 = 0 $\n",
    "\n",
    "$ g_5 = 1⋅a_5 + (-1)⋅b_5 + 0⋅(a_5⋅b_5) + 0 + (-1)⋅c_5 = 0 $\n",
    "\n",
    "$ g_6 = 1⋅a_6 + 0⋅b_6 + 0⋅(a_6⋅b_6) + 3 + (-1)⋅c_6 = 0 $\n",
    "\n",
    "**selector vectors**\n",
    "\n",
    "$ g_i = [q_{Li}, q_{Ri}, q_{Mi}, q_{Ci}, q_{Oi}] $\n",
    "\n",
    "$ g_0 = [0, 0, 1, 0, -1] $\n",
    "\n",
    "$ g_1 = [0, 0, 1, 0, -1] $\n",
    "\n",
    "$ g_2 = [0, 0, 1, 0, -1] $\n",
    "\n",
    "$ g_3 = [2, 0, 0, 0, -1] $\n",
    "\n",
    "$ g_4 = [0, 0, 1, 0, -1] $\n",
    "\n",
    "$ g_5 = [1, -1, 0, 0, -1] $\n",
    "\n",
    "$ g_6 = [1, 0, 0, 3, 0] $\n",
    "\n",
    "**let x = 2 y = 3**\n",
    "\n",
    "\n",
    "| Vectors| a | b | c | qLi | qRi | qMi | qCi | qOi | PI |\n",
    "| --- | --- | --- | --- |--- | --- | --- | --- | --- | --- |\n",
    "| gate0 | 2 | 2 | 4 | 0 | 0 | 1 | 0 | -1 | 0 |\n",
    "| gate1 | 2 | 2 | 4 | 0 | 0 | 1 | 0 | -1 | 0 |\n",
    "| gate2 | 3 | 3 | 9 | 0 | 0 | 1 | 0 | -1 | 0 |\n",
    "| gate3 | 4 | 0 | 8 | 2 | 0 | 0 | 0 | -1 | 0 |\n",
    "| gate4 | 4 | 9 | 36 | 0 | 0 | 1 | 0 | -1 | 0 |\n",
    "| gate5 | 8 | 36 | -28 | 1 | -1 | 0 | 0 | -1 | 0 |\n",
    "| gate6 | -28 | 3 | -25 | 1 | 0 | 0 | 3 | 0 | 25 |"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# image \n",
    "![image](./images/circuit.webp)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Setup"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [],
   "source": [
    "import galois\n",
    "import numpy as np\n",
    "from utils import (\n",
    "    generator1,\n",
    "    generator2,\n",
    "    curve_order,\n",
    "    normalize,\n",
    "    validate_point,\n",
    "    GPoint,\n",
    "    SRS,\n",
    "    numbers_to_hash,\n",
    "    patch_galois,\n",
    "    dump_proof,\n",
    "    dump_circuit\n",
    ")\n",
    "\n",
    "G1 = generator1()\n",
    "G2 = generator2()\n",
    "\n",
    "patch_galois(galois.Poly)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "out = -25\n",
      "roots = [  1  30 177   8 240 211  64 233]\n"
     ]
    },
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "OMP: Info #270: omp_set_nested routine deprecated, please use omp_set_max_active_levels instead.\n"
     ]
    }
   ],
   "source": [
    "# initial values for x and y\n",
    "x = 2\n",
    "y = 3\n",
    "\n",
    "# to switch between encrypted (ECC) and unencrypted mode (prime field p=241)\n",
    "encrypted = False\n",
    "\n",
    "# Prime field p\n",
    "p = 241 if not encrypted else curve_order\n",
    "# p = 241\n",
    "Fp = galois.GF(p)\n",
    "\n",
    "# 2x^2 - x^2y^2 + 3\n",
    "out = 2 * x**2 - x**2 * y**2 + 3\n",
    "print(f\"out = {out}\")\n",
    "\n",
    "# We have 7 gates, next power of 2 is 8\n",
    "n = 7\n",
    "n = 2 ** int(np.ceil(np.log2(n)))\n",
    "assert n & n - 1 == 0, \"n must be a power of 2\"\n",
    "\n",
    "# Find primitive root of unity\n",
    "omega = Fp.primitive_root_of_unity(n)\n",
    "assert omega ** (n) == 1, f\"omega (ω) {omega} is not a root of unity\"\n",
    "\n",
    "roots = Fp([omega**i for i in range(n)])\n",
    "print(f\"roots = {roots}\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Witness & Gates"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "a = [2, 2, 3, 4, 4, 8, -28, 0]\n",
      "b = [2, 2, 3, 0, 9, 36, 3, 0]\n",
      "c = [4, 4, 9, 8, 36, -28, -25, 0]\n",
      "ql = [0, 0, 0, 2, 0, 1, 1, 0]\n",
      "qr = [0, 0, 0, 0, 0, -1, 0, 0]\n",
      "qm = [1, 1, 1, 1, 1, 0, 0, 0]\n",
      "qc = [0, 0, 0, 0, 0, 0, 3, 0]\n",
      "qo = [-1, -1, -1, -1, -1, -1, 0, 0]\n",
      "pi = [0, 0, 0, 0, 0, 0, 25, 0]\n"
     ]
    }
   ],
   "source": [
    "def pad_array(a, n):\n",
    "    return a + [0] * (n - len(a))\n",
    "\n",
    "\n",
    "# witness vectors\n",
    "a = [2, 2, 3, 4, 4, 8, -28]\n",
    "b = [2, 2, 3, 0, 9, 36, 3]\n",
    "c = [4, 4, 9, 8, 36, -28, -25]\n",
    "pi = [0, 0, 0, 0, 0, 0, 25]\n",
    "\n",
    "# gate vectors\n",
    "ql = [0, 0, 0, 2, 0, 1, 1]\n",
    "qr = [0, 0, 0, 0, 0, -1, 0]\n",
    "qm = [1, 1, 1, 1, 1, 0, 0]\n",
    "qc = [0, 0, 0, 0, 0, 0, 3]\n",
    "qo = [-1, -1, -1, -1, -1, -1, 0]\n",
    "\n",
    "# pad vectors to length n\n",
    "a = pad_array(a, n)\n",
    "b = pad_array(b, n)\n",
    "c = pad_array(c, n)\n",
    "pi = pad_array(pi, n)\n",
    "ql = pad_array(ql, n)\n",
    "qr = pad_array(qr, n)\n",
    "qm = pad_array(qm, n)\n",
    "qc = pad_array(qc, n)\n",
    "qo = pad_array(qo, n)\n",
    "\n",
    "print(f\"a = {a}\")\n",
    "print(f\"b = {b}\")\n",
    "print(f\"c = {c}\")\n",
    "print(f\"ql = {ql}\")\n",
    "print(f\"qr = {qr}\")\n",
    "print(f\"qm = {qm}\")\n",
    "print(f\"qc = {qc}\")\n",
    "print(f\"qo = {qo}\")\n",
    "print(f\"pi = {pi}\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Permutations"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      " w | value  | i      | sigma(i)\n",
      "a0 |      2 |      1 |      1\n",
      "a1 |      2 |     30 |     30\n",
      "a2 |      3 |    177 |    177\n",
      "a3 |      4 |      8 |      4\n",
      "a4 |      4 |    240 |    120\n",
      "a5 |      8 |    211 |     32\n",
      "a6 |    -28 |     64 |    121\n",
      "a7 |      0 |    233 |    233\n",
      "-- | --     | --     | --    \n",
      "b0 |      2 |      2 |      2\n",
      "b1 |      2 |     60 |     60\n",
      "b2 |      3 |    113 |    113\n",
      "b3 |      0 |     16 |     16\n",
      "b4 |      9 |    239 |    226\n",
      "b5 |     36 |    181 |    237\n",
      "b6 |      3 |    128 |    128\n",
      "b7 |      0 |    225 |    225\n",
      "-- | --     | --     | --    \n",
      "c0 |      4 |      4 |      8\n",
      "c1 |      4 |    120 |    240\n",
      "c2 |      9 |    226 |    239\n",
      "c3 |      8 |     32 |    211\n",
      "c4 |     36 |    237 |    181\n",
      "c5 |    -28 |    121 |     64\n",
      "c6 |    -25 |     15 |     15\n",
      "c7 |      0 |    209 |    209\n",
      "\n",
      "\n",
      "--- Cosest ---\n",
      "c0 = [  1  30 177   8 240 211  64 233]\n",
      "c1 = [  2  60 113  16 239 181 128 225]\n",
      "c2 = [  4 120 226  32 237 121  15 209]\n",
      "\n",
      "\n",
      "--- Sigma ---\n",
      "sigma1 = [  1  30 177   4 120  32 121 233]\n",
      "sigma2 = [  2  60 113  16 226 237 128 225]\n",
      "sigma3 = [  8 240 239 211 181  64  15 209]\n"
     ]
    }
   ],
   "source": [
    "def print_sigma(sigma, a, b, c, r):\n",
    "    group_size = len(sigma) // 3\n",
    "    padding = 6\n",
    "\n",
    "    print(f\"{' w'} | {'value':{padding}} | {'i':{padding}} | {'sigma(i)':{padding}}\")\n",
    "\n",
    "    for i in range(0, group_size):\n",
    "        print(f\"a{i} | {a[i]:{padding}} | {r[i]:{padding}} | {r[sigma[i]]:{padding}}\")\n",
    "\n",
    "    print(f\"-- | {'--':{padding}} | {'--':{padding}} | {'--':{padding}}\")\n",
    "\n",
    "    for i in range(group_size, 2 * group_size):\n",
    "        print(\n",
    "            f\"b{i - group_size} | {b[i - group_size]:{padding}} | {r[i]:{padding}} | {r[sigma[i]]:{padding}}\"\n",
    "        )\n",
    "\n",
    "    print(f\"-- | {'--':{padding}} | {'--':{padding}} | {'--':{padding}}\")\n",
    "\n",
    "    for i in range(2 * group_size, 3 * group_size):\n",
    "        print(\n",
    "            f\"c{i - 2 * group_size} | {c[i - 2 * group_size]:{padding}} | {r[i]:{padding}} | {r[sigma[i]]:{padding}}\"\n",
    "        )\n",
    "\n",
    "\n",
    "ai = range(0, n)\n",
    "bi = range(n, 2 * n)\n",
    "ci = range(2 * n, 3 * n)\n",
    "\n",
    "sigma = {\n",
    "    ai[0]: ai[0],\n",
    "    ai[1]: ai[1],\n",
    "    ai[2]: ai[2],\n",
    "    ai[3]: ci[0],\n",
    "    ai[4]: ci[1],\n",
    "    ai[5]: ci[3],\n",
    "    ai[6]: ci[5],\n",
    "    ai[7]: ai[7],\n",
    "    bi[0]: bi[0],\n",
    "    bi[1]: bi[1],\n",
    "    bi[2]: bi[2],\n",
    "    bi[3]: bi[3],\n",
    "    bi[4]: ci[2],\n",
    "    bi[5]: ci[4],\n",
    "    bi[6]: bi[6],\n",
    "    bi[7]: bi[7],\n",
    "    ci[0]: ai[3],\n",
    "    ci[1]: ai[4],\n",
    "    ci[2]: bi[4],\n",
    "    ci[3]: ai[5],\n",
    "    ci[4]: bi[5],\n",
    "    ci[5]: ai[6],\n",
    "    ci[6]: ci[6],\n",
    "    ci[7]: ci[7],\n",
    "}\n",
    "\n",
    "k1 = 2\n",
    "k2 = 4\n",
    "c1_roots = roots\n",
    "c2_roots = roots * k1\n",
    "c3_roots = roots * k2\n",
    "\n",
    "c_roots = np.concatenate((c1_roots, c2_roots, c3_roots))\n",
    "\n",
    "check = set()\n",
    "for r in c_roots:\n",
    "    assert not int(r) in check, f\"Duplicate root {r} in {c_roots}\"\n",
    "    check.add(int(r))\n",
    "\n",
    "sigma1 = Fp([c_roots[sigma[i]] for i in range(0, n)])\n",
    "sigma2 = Fp([c_roots[sigma[i + n]] for i in range(0, n)])\n",
    "sigma3 = Fp([c_roots[sigma[i + 2 * n]] for i in range(0, n)])\n",
    "\n",
    "print_sigma(sigma, a, b, c, c_roots)\n",
    "\n",
    "print(\"\\n\\n--- Cosest ---\")\n",
    "print(f\"c0 = {c1_roots}\")\n",
    "print(f\"c1 = {c2_roots}\")\n",
    "print(f\"c2 = {c3_roots}\")\n",
    "\n",
    "print(\"\\n\\n--- Sigma ---\")\n",
    "print(f\"sigma1 = {sigma1}\")\n",
    "print(f\"sigma2 = {sigma2}\")\n",
    "print(f\"sigma3 = {sigma3}\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Gate Polynomials"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "--- Gate Polynomials ---\n",
      "QL = 187x^7 + 38x^6 + 119x^5 + 60x^4 + 70x^3 + 22x^2 + 106x + 121\n",
      "QR = 64x^7 + 8x^6 + x^5 + 211x^4 + 177x^3 + 233x^2 + 240x + 30\n",
      "QM = 57x^7 + 211x^6 + 73x^5 + 211x^4 + 168x^3 + 211x^2 + 184x + 91\n",
      "QC = 24x^7 + 90x^6 + 217x^5 + 151x^4 + 24x^3 + 90x^2 + 217x + 151\n",
      "QO = 7x^7 + 38x^6 + 169x^5 + 9x^3 + 22x^2 + 56x + 180\n",
      "PI = 200x^7 + 27x^6 + 41x^5 + 214x^4 + 200x^3 + 27x^2 + 41x + 214\n"
     ]
    }
   ],
   "source": [
    "def to_galois_array(vector, field):\n",
    "    # normalize to positive values\n",
    "    a = [x % field.order for x in vector]\n",
    "    return field(a)\n",
    "\n",
    "\n",
    "def to_poly(x, v, field):\n",
    "    assert len(x) == len(v)\n",
    "    y = to_galois_array(v, field) if type(v) == list else v\n",
    "    return galois.lagrange_poly(x, y)\n",
    "\n",
    "\n",
    "QL = to_poly(roots, ql, Fp)\n",
    "QR = to_poly(roots, qr, Fp)\n",
    "QM = to_poly(roots, qm, Fp)\n",
    "QC = to_poly(roots, qc, Fp)\n",
    "QO = to_poly(roots, qo, Fp)\n",
    "PI = to_poly(roots, pi, Fp)\n",
    "\n",
    "print(\"--- Gate Polynomials ---\")\n",
    "print(f\"QL = {QL}\")\n",
    "print(f\"QR = {QR}\")\n",
    "print(f\"QM = {QM}\")\n",
    "print(f\"QC = {QC}\")\n",
    "print(f\"QO = {QO}\")\n",
    "print(f\"PI = {PI}\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Permutation Polynomials"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "i =   0 -->   1   I1(  1) =   1   I2(  1) =   2   I3(  1) =   4   S1(  1) =   1   S2(  1) =   2   S3(  1) =   8 \n",
      "i =   1 -->  30   I1( 30) =  30   I2( 30) =  60   I3( 30) = 120   S1( 30) =  30   S2( 30) =  60   S3( 30) = 240 \n",
      "i =   2 --> 177   I1(177) = 177   I2(177) = 113   I3(177) = 226   S1(177) = 177   S2(177) = 113   S3(177) = 239 \n",
      "i =   3 -->   8   I1(  8) =   8   I2(  8) =  16   I3(  8) =  32   S1(  8) =   4   S2(  8) =  16   S3(  8) = 211 \n",
      "i =   4 --> 240   I1(240) = 240   I2(240) = 239   I3(240) = 237   S1(240) = 120   S2(240) = 226   S3(240) = 181 \n",
      "i =   5 --> 211   I1(211) = 211   I2(211) = 181   I3(211) = 121   S1(211) =  32   S2(211) = 237   S3(211) =  64 \n",
      "i =   6 -->  64   I1( 64) =  64   I2( 64) = 128   I3( 64) =  15   S1( 64) = 121   S2( 64) = 128   S3( 64) =  15 \n",
      "i =   7 --> 233   I1(233) = 233   I2(233) = 225   I3(233) = 209   S1(233) = 233   S2(233) = 225   S3(233) = 209 \n"
     ]
    }
   ],
   "source": [
    "S1 = to_poly(roots, sigma1, Fp)\n",
    "S2 = to_poly(roots, sigma2, Fp)\n",
    "S3 = to_poly(roots, sigma3, Fp)\n",
    "\n",
    "I1 = to_poly(roots, c1_roots, Fp)\n",
    "I2 = to_poly(roots, c2_roots, Fp)\n",
    "I3 = to_poly(roots, c3_roots, Fp)\n",
    "\n",
    "padding = 3\n",
    "for i in range(0, len(roots)):\n",
    "    s = f\"i = {i:{padding}} --> {roots[i]:{padding}} \"\n",
    "    s += f\"  I1({roots[i]:{padding}}) = {I1(roots[i]):{padding}} \"\n",
    "    s += f\"  I2({roots[i]:{padding}}) = {I2(roots[i]):{padding}} \"\n",
    "    s += f\"  I3({roots[i]:{padding}}) = {I3(roots[i]):{padding}} \"\n",
    "    s += f\"  S1({roots[i]:{padding}}) = {S1(roots[i]):{padding}} \"\n",
    "    s += f\"  S2({roots[i]:{padding}}) = {S2(roots[i]):{padding}} \"\n",
    "    s += f\"  S3({roots[i]:{padding}}) = {S3(roots[i]):{padding}} \"\n",
    "    print(s)\n",
    "\n",
    "    assert I1(roots[i]) == roots[i], f\"I1({roots[i]}) != {roots[i]}\"\n",
    "    assert I2(roots[i]) == k1 * roots[i], f\"I2({roots[i]}) != {k1 * roots[i]}\"\n",
    "    assert I3(roots[i]) == k2 * roots[i], f\"I3({roots[i]}) != {k2 * roots[i]}\"\n",
    "\n",
    "    assert S1(roots[i]) == sigma1[i], f\"S1({roots[i]}) != {sigma1[i]}\"\n",
    "    assert S2(roots[i]) == sigma2[i], f\"S2({roots[i]}) != {sigma2[i]}\"\n",
    "    assert S3(roots[i]) == sigma3[i], f\"S3({roots[i]}) != {sigma3[i]}\""
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "--- Vanishing Polynomial ---\n",
      "Zh = x^8 + 240\n"
     ]
    }
   ],
   "source": [
    "def to_vanishing_poly(roots, field):\n",
    "    # Z^n - 1 = (Z - 1)(Z - w)(Z - w^2)...(Z - w^(n-1))\n",
    "    return galois.Poly.Degrees([len(roots), 0], coeffs=[1, -1], field=field)\n",
    "\n",
    "\n",
    "Zh = to_vanishing_poly(roots, Fp)\n",
    "for x in roots:\n",
    "    assert Zh(x) == 0\n",
    "\n",
    "print(\"--- Vanishing Polynomial ---\")\n",
    "print(f\"Zh = {Zh}\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## CRS Construction"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "--- Tau ---\n",
      "158\n"
     ]
    }
   ],
   "source": [
    "def generate_tau(encrypted=False):\n",
    "    return SRS(Fp.Random(), n) if encrypted else Fp.Random()\n",
    "\n",
    "\n",
    "tau = generate_tau(encrypted=encrypted)\n",
    "print(f\"--- Tau ---\")\n",
    "print(tau)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Prover"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Round 1"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "--- Gate Constraints Polynomial ---\n",
      "G = 238x^25 + 49x^24 + 97x^23 + 174x^22 + 84x^21 + 27x^20 + 204x^19 + 81x^18 + 88x^17 + 72x^16 + 125x^15 + 195x^14 + 90x^13 + 51x^12 + 26x^11 + 160x^10 + 116x^9 + 119x^8 + 19x^7 + 113x^6 + 67x^5 + 163x^4 + 11x^3 + 40x + 1\n",
      "gate #0 G(1) = 0 --> OK\n",
      "gate #1 G(30) = 0 --> OK\n",
      "gate #2 G(177) = 0 --> OK\n",
      "gate #3 G(8) = 0 --> OK\n",
      "gate #4 G(240) = 0 --> OK\n",
      "gate #5 G(211) = 0 --> OK\n",
      "gate #6 G(64) = 0 --> OK\n",
      "gate #7 G(233) = 0 --> OK\n",
      "i =   0 -->   1    A(  1) =   2    B(  1) =   2    C(  1) =   4 \n",
      "i =   1 -->  30    A( 30) =   2    B( 30) =   2    C( 30) =   4 \n",
      "i =   2 --> 177    A(177) =   3    B(177) =   3    C(177) =   9 \n",
      "i =   3 -->   8    A(  8) =   4    B(  8) =   0    C(  8) =   8 \n",
      "i =   4 --> 240    A(240) =   4    B(240) =   9    C(240) =  36 \n",
      "i =   5 --> 211    A(211) =   8    B(211) =  36    C(211) = 213 \n",
      "i =   6 -->  64    A( 64) = 213    B( 64) =   3    C( 64) = 216 \n",
      "i =   7 --> 233    A(233) =   0    B(233) =   0    C(233) =   0 \n",
      "\n",
      "\n",
      "--- Round 1 ---\n",
      "Round 1 = [GF(14, order=241), GF(161, order=241), GF(217, order=241)]\n"
     ]
    }
   ],
   "source": [
    "random_b = [Fp.Random() for i in range(0, 9)]\n",
    "\n",
    "bA = galois.Poly(random_b[:2], field=Fp)\n",
    "bB = galois.Poly(random_b[2:4], field=Fp)\n",
    "bC = galois.Poly(random_b[4:6], field=Fp)\n",
    "\n",
    "_A = to_poly(roots, a, Fp)\n",
    "_B = to_poly(roots, b, Fp)\n",
    "_C = to_poly(roots, c, Fp)\n",
    "\n",
    "A = _A + bA * Zh\n",
    "B = _B + bB * Zh\n",
    "C = _C + bC * Zh\n",
    "\n",
    "# gate constraints polynomial\n",
    "# g(x) = a(x)*ql(x) + b(x)*qr(x) + a(x)*b(x)*qm(x) + c(x)*qo(x) + qpi(x) + qc(x)\n",
    "G = A * QL + B * QR + A * B * QM + C * QO + QC + PI\n",
    "\n",
    "print(\"--- Gate Constraints Polynomial ---\")\n",
    "print(f\"G = {G}\")\n",
    "for i in range(0, len(roots)):\n",
    "    print(\n",
    "        f\"gate #{i} G({roots[i]}) = {G(roots[i])} --> {'OK' if G(roots[i]) == 0 else 'FAIL'}\"\n",
    "    )\n",
    "    assert G(roots[i]) == 0, f\"G({roots[i]}) != 0\"\n",
    "\n",
    "assert G % Zh == 0, f\"G(x) % Zh(x) != 0\"\n",
    "\n",
    "padding = 3\n",
    "for i in range(0, len(roots)):\n",
    "    s = f\"i = {i:{padding}} --> {roots[i]:{padding}} \"\n",
    "    s += f\"   A({roots[i]:{padding}}) = {A(roots[i]):{padding}} \"\n",
    "    s += f\"   B({roots[i]:{padding}}) = {B(roots[i]):{padding}} \"\n",
    "    s += f\"   C({roots[i]:{padding}}) = {C(roots[i]):{padding}} \"\n",
    "    print(s)\n",
    "\n",
    "round1 = [A(tau), B(tau), C(tau)]\n",
    "print(\"\\n\\n--- Round 1 ---\")\n",
    "print(f\"Round 1 = {round1}\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Round 2"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\n",
      "\n",
      "--- Accumulator Polynomial ---\n",
      "ACC(x) = 45x^7 + 118x^6 + 208x^5 + 93x^4 + 20x^3 + 152x^2 + 188x + 141\n",
      "bZ = 198x^2 + 171x + 178\n",
      "\n",
      "\n",
      "--- Z Polynomial ---\n",
      "Z(x) = 198x^10 + 171x^9 + 178x^8 + 45x^7 + 118x^6 + 208x^5 + 93x^4 + 20x^3 + 195x^2 + 17x + 204\n",
      "Z(1) = 1\n",
      "Z(30) = 205\n",
      "Z(177) = 229\n",
      "Z(8) = 109\n",
      "Z(240) = 43\n",
      "Z(211) = 118\n",
      "Z(64) = 181\n",
      "Z(233) = 1\n",
      "\n",
      "\n",
      "--- Round 2 ---\n",
      "Round 2 = [GF(13, order=241)]\n"
     ]
    }
   ],
   "source": [
    "beta = numbers_to_hash(round1 + [0], Fp)\n",
    "gamma = numbers_to_hash(round1 + [1], Fp)\n",
    "\n",
    "_F = (A + I1 * beta + gamma) * (B + I2 * beta + gamma) * (C + I3 * beta + gamma)\n",
    "_G = (A + S1 * beta + gamma) * (B + S2 * beta + gamma) * (C + S3 * beta + gamma)\n",
    "\n",
    "acc_eval = [Fp(1)]\n",
    "for i in range(0, n):\n",
    "    acc_eval.append(acc_eval[-1] * (_F(roots[i]) / _G(roots[i])))\n",
    "assert acc_eval.pop() == Fp(1)\n",
    "ACC = galois.lagrange_poly(roots, Fp(acc_eval))\n",
    "print(\"\\n\\n--- Accumulator Polynomial ---\")\n",
    "print(f\"ACC(x) = {ACC}\")\n",
    "\n",
    "bZ = galois.Poly(random_b[6:9], field=Fp)\n",
    "print(f\"bZ = {bZ}\")\n",
    "Z = bZ * Zh + ACC\n",
    "\n",
    "print(\"\\n\\n--- Z Polynomial ---\")\n",
    "print(f\"Z(x) = {Z}\")\n",
    "\n",
    "for r in roots:\n",
    "    print(f\"Z({r}) = {Z(r)}\")\n",
    "\n",
    "assert Z(roots[0]) == 1\n",
    "assert Z(roots[-1]) == 1\n",
    "\n",
    "round2 = [Z(tau)]\n",
    "print(\"\\n\\n--- Round 2 ---\")\n",
    "print(f\"Round 2 = {round2}\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Round 3"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Z(  1) =   1 -> Zω(  1) = 205\n",
      "Z( 30) = 205 -> Zω( 30) = 229\n",
      "Z(177) = 229 -> Zω(177) = 109\n",
      "Z(  8) = 109 -> Zω(  8) =  43\n",
      "Z(240) =  43 -> Zω(240) = 118\n",
      "Z(211) = 118 -> Zω(211) = 181\n",
      "Z( 64) = 181 -> Zω( 64) =   1\n",
      "Z(233) =   1 -> Zω(233) =   1\n",
      "\n",
      "\n",
      "--- Zω Polynomial ---\n",
      "Z(ωx) = 101x^10 + 69x^9 + 178x^8 + 122x^7 + 81x^6 + 26x^5 + 148x^4 + 160x^3 + 52x^2 + 28x + 204\n",
      "\n",
      "\n",
      "--- L1 Polynomial ---\n",
      "L1(x) = 211x^7 + 211x^6 + 211x^5 + 211x^4 + 211x^3 + 211x^2 + 211x + 211\n",
      "L1(1) = 1\n",
      "L1(30) = 0\n",
      "L1(177) = 0\n",
      "L1(8) = 0\n",
      "L1(240) = 0\n",
      "L1(211) = 0\n",
      "L1(64) = 0\n",
      "L1(233) = 0\n",
      "\n",
      "\n",
      "--- T Polynomial ---\n",
      "T(x) = 203x^29 + 130x^28 + 22x^27 + 155x^26 + 212x^25 + 93x^24 + 46x^23 + 7x^22 + 101x^21 + 68x^20 + 172x^19 + 152x^18 + 132x^17 + 148x^16 + 213x^15 + 69x^14 + 145x^13 + 200x^12 + 166x^11 + 26x^10 + 64x^9 + 53x^8 + 24x^6 + 118x^5 + 66x^4 + 233x^3 + 193x^2 + 53x + 107\n",
      "\n",
      "\n",
      "--- T' ---\n",
      "Tl(x) = 29x^8 + 24x^6 + 118x^5 + 66x^4 + 233x^3 + 193x^2 + 53x + 107\n",
      "Tm(x) = 24x^8 + 213x^7 + 69x^6 + 145x^5 + 200x^4 + 166x^3 + 26x^2 + 64x + 24\n",
      "Th(x) = 203x^13 + 130x^12 + 22x^11 + 155x^10 + 212x^9 + 93x^8 + 46x^7 + 7x^6 + 101x^5 + 68x^4 + 172x^3 + 152x^2 + 132x + 124\n",
      "\n",
      "\n",
      "--- Round 3 ---\n",
      "Round 3 = [GF(23, order=241), GF(21, order=241), GF(195, order=241)]\n"
     ]
    }
   ],
   "source": [
    "def shift_poly(poly: galois.Poly, omega: Fp):\n",
    "    coeffs = poly.coeffs[::-1]\n",
    "    coeffs = [c * omega**i for i, c in enumerate(coeffs)]\n",
    "    return galois.Poly(coeffs[::-1], field=poly.field)\n",
    "\n",
    "\n",
    "alpha = numbers_to_hash(round1 + round2, Fp)\n",
    "\n",
    "Zomega = shift_poly(Z, omega=omega)\n",
    "for r in roots:\n",
    "    print(f\"Z({r:3}) = {Z(r):3} -> Zω({r:3}) = {Zomega(r):3}\")\n",
    "\n",
    "print(\"\\n\\n--- Zω Polynomial ---\")\n",
    "print(f\"Z(ωx) = {Zomega}\")\n",
    "\n",
    "L1 = galois.lagrange_poly(roots, Fp([1] + [Fp(0)] * (n - 1)))\n",
    "\n",
    "print(\"\\n\\n--- L1 Polynomial ---\")\n",
    "print(f\"L1(x) = {L1}\")\n",
    "for i, r in enumerate(roots):\n",
    "    print(f\"L1({r}) = {L1(r)}\")\n",
    "    assert L1(r) == (Fp(1) if i == 0 else Fp(0))\n",
    "\n",
    "T0 = G\n",
    "assert T0 % Zh == 0, f\"T0(x) % Zh(x) != 0\"\n",
    "\n",
    "T1 = (_F * Z - _G * Zomega) * alpha\n",
    "assert T1 % Zh == 0, f\"T1(x) % Zh(x) != 0\"\n",
    "\n",
    "T2 = (Z - galois.Poly([1], field=Fp)) * L1 * alpha**2\n",
    "assert T2 % Zh == 0, f\"T2(x) % Zh(x) != 0\"\n",
    "\n",
    "T = T0 + T1 + T2\n",
    "assert T % Zh == 0, f\"T(x) % Zh(x) != 0\"\n",
    "\n",
    "for r in roots:\n",
    "    assert T(r) == 0, f\"T({r}) != 0\"\n",
    "\n",
    "T = T // Zh\n",
    "\n",
    "print(\"\\n\\n--- T Polynomial ---\")\n",
    "print(f\"T(x) = {T}\")\n",
    "\n",
    "t_coeffs = T.coeffs[::-1]\n",
    "\n",
    "Tl = galois.Poly(t_coeffs[:n][::-1], field=Fp)\n",
    "Tm = galois.Poly(t_coeffs[n : 2 * (n)][::-1], field=Fp)\n",
    "Th = galois.Poly(t_coeffs[2 * (n) :][::-1], field=Fp)\n",
    "\n",
    "X_n = galois.Poly.Degrees([n, 0], coeffs=[1, 0], field=Fp)\n",
    "X_2n = galois.Poly.Degrees([2 * (n), 0], coeffs=[1, 0], field=Fp)\n",
    "# make sure that T was split correctly\n",
    "# T = TL + X^n * TM + X^2n * TH\n",
    "assert T == (Tl + X_n * Tm + X_2n * Th)\n",
    "assert T.degree == 3 * n + 5\n",
    "\n",
    "b10 = Fp.Random()\n",
    "b11 = Fp.Random()\n",
    "\n",
    "Tl = Tl + b10 * X_n\n",
    "Tm = Tm - b10 + b11 * X_n\n",
    "Th = Th - b11\n",
    "assert T == (Tl + X_n * Tm + X_2n * Th)\n",
    "\n",
    "print(\"\\n\\n--- T' ---\")\n",
    "print(f\"Tl(x) = {Tl}\")\n",
    "print(f\"Tm(x) = {Tm}\")\n",
    "print(f\"Th(x) = {Th}\")\n",
    "\n",
    "round3 = [Tl(tau), Tm(tau), Th(tau)]\n",
    "print(\"\\n\\n--- Round 3 ---\")\n",
    "print(f\"Round 3 = {round3}\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Round 4"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 12,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\n",
      "\n",
      "--- Round 4 ---\n",
      "Round 4 = [GF(179, order=241), GF(30, order=241), GF(155, order=241), GF(56, order=241), GF(40, order=241), GF(142, order=241)]\n"
     ]
    }
   ],
   "source": [
    "zeta = numbers_to_hash(round1 + round2 + round3, Fp)\n",
    "\n",
    "a_zeta = A(zeta)\n",
    "b_zeta = B(zeta)\n",
    "c_zeta = C(zeta)\n",
    "s1_zeta = S1(zeta)\n",
    "s2_zeta = S2(zeta)\n",
    "z_omega_zeta = Zomega(zeta)\n",
    "\n",
    "round4 = [a_zeta, b_zeta, c_zeta, s1_zeta, s2_zeta, z_omega_zeta]\n",
    "print(\"\\n\\n--- Round 4 ---\")\n",
    "print(f\"Round 4 = {round4}\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Round 5"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\n",
      "\n",
      "--- R ---\n",
      "R(x) = 209x^13 + 8x^12 + 120x^11 + 31x^10 + 205x^9 + 108x^8 + 58x^7 + 58x^6 + 76x^5 + 200x^4 + 44x^3 + 6x^2 + 202x + 134\n",
      "X - zeta = x + 104\n",
      "X - ω*zeta = x + 228\n",
      "\n",
      "\n",
      "--- Round 5 ---\n",
      "Round 5 = [GF(1, order=241), GF(39, order=241)]\n"
     ]
    }
   ],
   "source": [
    "v = numbers_to_hash(round1 + round2 + round3 + round4, Fp)\n",
    "\n",
    "pi_zeta = PI(zeta)\n",
    "\n",
    "R = QM * a_zeta * b_zeta + QL * a_zeta + QR * b_zeta + QO * c_zeta + QC + pi_zeta\n",
    "R += (\n",
    "    Z\n",
    "    * (a_zeta + beta * zeta + gamma)\n",
    "    * (b_zeta + beta * zeta * k1 + gamma)\n",
    "    * (c_zeta + beta * zeta * k2 + gamma)\n",
    "    * alpha\n",
    ")\n",
    "R -= (\n",
    "    z_omega_zeta\n",
    "    * (a_zeta + beta * s1_zeta + gamma)\n",
    "    * (b_zeta + beta * s2_zeta + gamma)\n",
    "    * (c_zeta + beta * S3 + gamma)\n",
    "    * alpha\n",
    ")\n",
    "R += (Z - Fp(1)) * L1(zeta) * alpha**2\n",
    "R -= Zh(zeta) * (Tl + zeta**n * Tm + zeta ** (2 * n) * Th)\n",
    "\n",
    "print(\"\\n\\n--- R ---\")\n",
    "print(f\"R(x) = {R}\")\n",
    "\n",
    "X_minus_zeta = galois.Poly([1, -zeta], field=Fp)\n",
    "print(f\"X - zeta = {X_minus_zeta}\")\n",
    "\n",
    "Wzeta = (\n",
    "    R\n",
    "    + (A - a_zeta) * v\n",
    "    + (B - b_zeta) * v**2\n",
    "    + (C - c_zeta) * v**3\n",
    "    + (S1 - s1_zeta) * v**4\n",
    "    + (S2 - s2_zeta) * v**5\n",
    ")\n",
    "\n",
    "assert Wzeta % X_minus_zeta == 0, f\"Wzeta(x) % X - zeta != 0\"\n",
    "Wzeta = Wzeta // X_minus_zeta\n",
    "\n",
    "X_minus_omega_zeta = galois.Poly([1, -(omega * zeta)], field=Fp)\n",
    "print(f\"X - ω*zeta = {X_minus_omega_zeta}\")\n",
    "\n",
    "Womega_zeta = Z - z_omega_zeta\n",
    "assert Womega_zeta % X_minus_omega_zeta == 0, f\"Womega_zeta(x) % X - ω*zeta != 0\"\n",
    "Womega_zeta = Womega_zeta // X_minus_omega_zeta\n",
    "\n",
    "round5 = [Wzeta(tau), Womega_zeta(tau)]\n",
    "print(\"\\n\\n--- Round 5 ---\")\n",
    "print(f\"Round 5 = {round5}\")\n",
    "\n",
    "u = numbers_to_hash(round1 + round2 + round3 + round4 + round5, Fp)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "metadata": {},
   "outputs": [],
   "source": [
    "proof = {\n",
    "    \"A\": round1[0],\n",
    "    \"B\": round1[1],\n",
    "    \"C\": round1[2],\n",
    "    \"Z\": round2[0],\n",
    "    \"Tl\": round3[0],\n",
    "    \"Tm\": round3[1],\n",
    "    \"Th\": round3[2],\n",
    "    \"Wzeta\": round5[0],\n",
    "    \"Womega_zeta\": round5[1],\n",
    "    \"a_zeta\": round4[0],\n",
    "    \"b_zeta\": round4[1],\n",
    "    \"c_zeta\": round4[2],\n",
    "    \"s1_zeta\": round4[3],\n",
    "    \"s2_zeta\": round4[4],\n",
    "    \"z_omega_zeta\": round4[5],\n",
    "    \"Fp\": p,\n",
    "}\n",
    "\n",
    "dump_proof(proof, \"proof.json\")\n",
    "\n",
    "circuit = {\n",
    "    \"QM\": QM.coeffs,\n",
    "    \"QL\": QL.coeffs,\n",
    "    \"QR\": QR.coeffs,\n",
    "    \"QO\": QO.coeffs,\n",
    "    \"QC\": QC.coeffs,\n",
    "    \"PI\": PI.coeffs,\n",
    "    \"Zh\": Zh.coeffs,\n",
    "    \"L1\": L1.coeffs,\n",
    "    \"S1\": S1.coeffs,\n",
    "    \"S2\": S2.coeffs,\n",
    "    \"S3\": S3.coeffs,\n",
    "    \"k1\": k1,\n",
    "    \"k2\": k2,\n",
    "    \"tau\": tau.tau if encrypted else tau,\n",
    "    \"Fp\": p,\n",
    "    \"omega\": omega,\n",
    "    \"n\": n,\n",
    "    \"encrypted\": encrypted,\n",
    "}\n",
    "\n",
    "dump_circuit(circuit, \"circuit.json\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Verifier"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "metadata": {},
   "outputs": [],
   "source": [
    "# These evaluations are calculated beforehand during the setup phase\n",
    "qm_exp = QM(tau)\n",
    "ql_exp = QL(tau)\n",
    "qr_exp = QR(tau)\n",
    "qo_exp = QO(tau)\n",
    "qc_exp = QC(tau)\n",
    "s1_exp = S1(tau)\n",
    "s2_exp = S2(tau)\n",
    "s3_exp = S3(tau)\n",
    "\n",
    "# Values provided by the prover (round 1 to 5) is a proof.\n",
    "a_exp = round1[0]\n",
    "b_exp = round1[1]\n",
    "c_exp = round1[2]\n",
    "\n",
    "z_exp = round2[0]\n",
    "\n",
    "tl_exp = round3[0]\n",
    "tm_exp = round3[1]\n",
    "th_exp = round3[2]\n",
    "\n",
    "# Note: verifier has to verify that the following values are in the correct Fp field\n",
    "a_zeta, b_zeta, c_zeta, s1_zeta, s2_zeta, z_omega_zeta = round4\n",
    "\n",
    "w_zeta_exp = round5[0]\n",
    "w_omega_zeta_exp = round5[1]\n",
    "\n",
    "# Note: verifier has to verify that the following values are on the curve\n",
    "if encrypted:\n",
    "    validate_point(qm_exp)\n",
    "    validate_point(ql_exp)\n",
    "    validate_point(qr_exp)\n",
    "    validate_point(qo_exp)\n",
    "    validate_point(qc_exp)\n",
    "    validate_point(z_exp)\n",
    "    validate_point(s1_exp)\n",
    "    validate_point(s2_exp)\n",
    "    validate_point(s3_exp)\n",
    "    validate_point(tl_exp)\n",
    "    validate_point(tm_exp)\n",
    "    validate_point(th_exp)\n",
    "    validate_point(a_exp)\n",
    "    validate_point(b_exp)\n",
    "    validate_point(c_exp)\n",
    "    validate_point(w_zeta_exp)\n",
    "    validate_point(w_omega_zeta_exp)\n",
    "\n",
    "beta = numbers_to_hash(round1 + [0], Fp)\n",
    "gamma = numbers_to_hash(round1 + [1], Fp)\n",
    "alpha = numbers_to_hash(round1 + round2, Fp)\n",
    "zeta = numbers_to_hash(round1 + round2 + round3, Fp)\n",
    "v = numbers_to_hash(round1 + round2 + round3 + round4, Fp)\n",
    "u = numbers_to_hash(round1 + round2 + round3 + round4 + round5, Fp)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 16,
   "metadata": {},
   "outputs": [],
   "source": [
    "Zh_z = Zh(zeta)\n",
    "L1_z = L1(zeta)\n",
    "PI_z = PI(zeta)\n",
    "\n",
    "r0 = (\n",
    "    PI_z\n",
    "    - L1_z * alpha**2\n",
    "    - (a_zeta + beta * s1_zeta + gamma)\n",
    "    * (b_zeta + beta * s2_zeta + gamma)\n",
    "    * (c_zeta + gamma)\n",
    "    * z_omega_zeta\n",
    "    * alpha\n",
    ")"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 17,
   "metadata": {},
   "outputs": [],
   "source": [
    "D_exp = (\n",
    "    qm_exp * a_zeta * b_zeta\n",
    "    + ql_exp * a_zeta\n",
    "    + qr_exp * b_zeta\n",
    "    + qo_exp * c_zeta\n",
    "    + qc_exp\n",
    ")\n",
    "\n",
    "D_exp += z_exp * (\n",
    "    (a_zeta + beta * zeta + gamma)\n",
    "    * (b_zeta + beta * zeta * k1 + gamma)\n",
    "    * (c_zeta + beta * zeta * k2 + gamma)\n",
    "    * alpha\n",
    "    + L1_z * alpha**2\n",
    "    + u\n",
    ")\n",
    "\n",
    "D_exp -= (\n",
    "    s3_exp\n",
    "    * (a_zeta + beta * s1_zeta + gamma)\n",
    "    * (b_zeta + beta * s2_zeta + gamma)\n",
    "    * alpha\n",
    "    * beta\n",
    "    * z_omega_zeta\n",
    ")\n",
    "\n",
    "D_exp -= (tl_exp + tm_exp * zeta**n + th_exp * zeta ** (2 * n)) * Zh_z"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 18,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "F_exp = 98\n"
     ]
    }
   ],
   "source": [
    "F_exp = (\n",
    "    D_exp\n",
    "    + a_exp * v\n",
    "    + b_exp * v**2\n",
    "    + c_exp * v**3\n",
    "    + s1_exp * v**4\n",
    "    + s2_exp * v**5\n",
    ")\n",
    "\n",
    "print(f\"F_exp = {F_exp}\")"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 19,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "E_exp = 113\n"
     ]
    }
   ],
   "source": [
    "E_exp = (\n",
    "    -r0\n",
    "    + v * a_zeta\n",
    "    + v**2 * b_zeta\n",
    "    + v**3 * c_zeta\n",
    "    + v**4 * s1_zeta\n",
    "    + v**5 * s2_zeta\n",
    "    + u * z_omega_zeta\n",
    ")\n",
    "\n",
    "if encrypted:\n",
    "    E_exp = G1 * E_exp\n",
    "\n",
    "print(f\"E_exp = {E_exp}\")"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 20,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\n",
      "\n",
      "--- e1, e2 ---\n",
      "e1 = 157 = 152 * tau\n",
      "e2 = 157\n"
     ]
    }
   ],
   "source": [
    "e1 = w_zeta_exp + w_omega_zeta_exp * u\n",
    "e2 = (\n",
    "    w_zeta_exp * zeta\n",
    "    + w_omega_zeta_exp * (u * zeta * omega)\n",
    "    + F_exp\n",
    "    + (E_exp * Fp(p - 1))\n",
    ")\n",
    "\n",
    "if encrypted:\n",
    "    pairing1 = tau.tau2.pair(e1)\n",
    "    pairing2 = G2.pair(e2)\n",
    "\n",
    "    print(f\"pairing1 = {pairing1}\")\n",
    "    print(f\"pairing2 = {pairing2}\")\n",
    "\n",
    "    assert pairing1 == pairing2, f\"pairing1 != pairing2\"\n",
    "else:\n",
    "    print(\"\\n\\n--- e1, e2 ---\")\n",
    "    print(f\"e1 = {e1 * tau} = {e1} * tau\")\n",
    "    print(f\"e2 = {e2}\")\n",
    "    assert e1 * tau == e2"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.11.6"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}