Golf aes gcm fold

.github/workflows/test.yml → .github/workflows/circom.yml

@@ -32,4 +32,16 @@ jobs:
         circom --version
 
     - name: Run tests
-      run: npm run test
+      run: npm run test
+
+    - name: Setup circom-witnesscalc
+      run: | 
+        cd .. && git clone https://github.com/iden3/circom-witnesscalc.git
+        cd circom-witnesscalc
+        cargo install --path .
+        echo $(which build-circuit)
+
+    - name: Build witness for aes-gcm
+      run: |
+        build-circuit circuits/aes-gcm/aes-gcm-fold.circom aes-gcm-fold.bin -l node_modules
+

.github/workflows/ci.yml → .github/workflows/rust.yml

@@ -26,17 +26,6 @@ jobs:
       - run: rustup update ${{ matrix.toolchain }} && rustup default ${{ matrix.toolchain }}
       - run: rustup component add clippy
       - run: cargo clippy -- -Dwarnings
-  # test:
-  #   name: test project
-  #   runs-on: ubuntu-latest
-  #   strategy:
-  #     matrix:
-  #       toolchain:
-  #         - nightly
-  #   steps:
-  #     - uses: actions/checkout@v4
-  #     - run: rustup update ${{ matrix.toolchain }} && rustup default ${{ matrix.toolchain }}
-  #     - run: cargo test --all-features --verbose
 
   fmt:
     name: fmt project

.gitignore

@@ -13,4 +13,6 @@ circuits/test/*.circom
 circuits/main/*
 ir_log/*
 log_input_signals.txt
-*.bin
+*.bin
+ghash_gmul.r1cs
+main.r1cs

circuits/aes-gcm/aes-gcm-fold.circom

@@ -3,15 +3,14 @@ pragma circom 2.1.9;
 include "./aes-gcm-foldable.circom";
 
 // Compute AES-GCM 
-template AESGCMFOLD(bytesPerFold, totalBytes) {
+template AESGCMFOLD(totalBytes) {
     // cannot fold outside chunk boundaries.
-    assert(bytesPerFold % 16 == 0);
     assert(totalBytes % 16 == 0);
 
     signal input key[16];
     signal input iv[12];
     signal input aad[16];
-    signal input plainText[bytesPerFold];
+    signal input plainText[16];
 
     // Output from the last encryption step
     // Always use last bytes for inputs which are not same size.
@@ -20,8 +19,8 @@ template AESGCMFOLD(bytesPerFold, totalBytes) {
     // step_in[20]    => foldedBlocks
     signal input step_in[21]; 
 
-    // For now, attempt to support variable fold size. Potential fix at 16 in the future.
-    component aes = AESGCMFOLDABLE(bytesPerFold, totalBytes\16);
+    // pass in number of 16 byte blocks.
+    component aes = AESGCMFOLDABLE(totalBytes\16);
     aes.key       <== key;
     aes.iv        <== iv;
     aes.aad       <== aad;
@@ -34,7 +33,6 @@ template AESGCMFOLD(bytesPerFold, totalBytes) {
     for(var i = 0; i < 16; i++) {
         aes.lastTag[i] <== step_in[4 + i];
     }
-    // TODO:tracy range check, assertions, stuff.
     aes.foldedBlocks <== step_in[20];
 
     // Fold Outputs
@@ -45,8 +43,8 @@ template AESGCMFOLD(bytesPerFold, totalBytes) {
     for(var i = 0; i < 16; i++) {
         step_out[4 + i] <== aes.authTag[i];
     }
-    step_out[20] <== step_in[20] + bytesPerFold \ 16;
+    step_out[20] <== step_in[20] + 16 \ 16;
 
     signal output authTag[16] <== aes.authTag;
-    signal output cipherText[bytesPerFold] <== aes.cipherText;
-}
+    signal output cipherText[16] <== aes.cipherText;
+}

circuits/aes-gcm/aes-gcm-foldable.circom

@@ -24,11 +24,12 @@ include "gctr.circom";
 /// cipherText: encrypted ciphertext
 /// authTag: authentication tag
 /// 
-template AESGCMFOLDABLE(l, TOTAL_BLOCKS) {
+/// in thoery this should just do a single block,
+template AESGCMFOLDABLE(TOTAL_BLOCKS) {
     // Inputs
     signal input key[16]; // 128-bit key
     signal input iv[12]; // IV length is 96 bits (12 bytes)
-    signal input plainText[l];
+    signal input plainText[16]; // only fold 16 bytes at a time.
     signal input aad[16]; // AAD length is 128 bits (16 bytes)
 
     // Fold inputs
@@ -40,42 +41,39 @@ template AESGCMFOLDABLE(l, TOTAL_BLOCKS) {
     signal output counter[4];      
 
     // Outputs
-    signal output cipherText[l];
-    signal output authTag[16]; //   Authentication tag length is 128 bits (16 bytes)
+    signal output cipherText[16];
+    signal output authTag[16];
 
     component zeroBlock = ToBlocks(16);
     for (var i = 0; i < 16; i++) {
         zeroBlock.stream[i] <== 0;
     }
 
-    // Step 1: Let H = CIPHK(0128)
-    component cipherH = Cipher(); // 128-bit key -> 4 32-bit words -> 10 rounds
+    // Step 1: Let HashKey = aes(key, zeroBlock)
+    component cipherH = Cipher(); 
     cipherH.key <== key;
     cipherH.block <== zeroBlock.blocks[0];
 
     // Step 2: Define a block, J0 with 96 bits of iv and 32 bits of 0s
-    // you can of the 96bits as a nonce and the 32 bits of 0s as an integer counter
     component J0builder = ToBlocks(16);
     for (var i = 0; i < 12; i++) {
         J0builder.stream[i] <== iv[i];
     }
-    // NOTE: Use the fold counter as input. 
+    // Use the fold counter as input. 
     for (var i = 12; i < 16; i++) {
         J0builder.stream[i] <== lastCounter[i%4]; // initialize to 0001. 
     }
     component J0WordIncrementer = IncrementWord();
     J0WordIncrementer.in <== J0builder.blocks[0][3];
 
-    // NOTE: With folding, start at counter 0001 always, then increment by 1. Same amount of work in every fold.
-
     signal J0[4][4];
     for (var i = 0; i < 3; i++) {
         J0[i] <== J0builder.blocks[0][i];
     }
     J0[3] <== J0WordIncrementer.out;
 
     // Step 3: Let C = GCTRK(inc32(J0), P)
-    component gctr = GCTR(l);
+    component gctr = GCTR(16);
     gctr.key <== key;
     gctr.initialCounterBlock <== J0;
     gctr.plainText <== plainText;
@@ -89,28 +87,30 @@ template AESGCMFOLDABLE(l, TOTAL_BLOCKS) {
     // len(A) => u64
     // len(b) => u64 (together, 1 block)
     // 
-    var blockCount  = l\16 + (l%16 > 0 ? 1 : 0); // blocksize is 16 bytes
-    var ghashBlocks = 1 + blockCount + 1; 
+    // block count is aways 1 when folding a single block. 
+    // var blockCount  = 1 + (16%16 > 0 ? 1 : 0); // blocksize is 16 bytes
+    // var ghashBlocks = 3; // always 3 blocks for single block ?
 
-    component targetMode    = SelectGhashMode(TOTAL_BLOCKS, blockCount, ghashBlocks);
+    component targetMode    = SelectGhashMode(TOTAL_BLOCKS);
     targetMode.foldedBlocks <== foldedBlocks;
 
-    // TODO(CR 2024-10-18): THIS BLOCK IS PROBLEM CHILD SO FAR
     // S = GHASHH (A || 0^v || C || 0^u || [len(A)] || [len(C)]).
-    component selectedBlocks = SelectGhashBlocks(l, ghashBlocks, TOTAL_BLOCKS);
+    component selectedBlocks = SelectGhashBlocks(TOTAL_BLOCKS);
     selectedBlocks.aad        <== aad;
     selectedBlocks.cipherText <== gctr.cipherText;
     selectedBlocks.targetMode <== targetMode.mode;
 
     // Step 5: Define a block, S
-    // TODO: Remove this blocks-to-stream translation by migrating the ghash select
-    // logic to using streams by default. 
-    component ghash = GHASHFOLDABLE(ghashBlocks);
+    component ghash = GHASHFOLDABLE();
     component cipherToStream = ToStream(1, 16);
     cipherToStream.blocks[0] <== cipherH.cipher;
     ghash.HashKey <== cipherToStream.stream;
-    component selectedBlocksToStream[ghashBlocks];
-    for(var i = 0; i < ghashBlocks; i++) {
+
+
+    // TODO: Remove this blocks-to-stream translation by migrating the ghash select
+    // logic to using streams by default. 
+    component selectedBlocksToStream[3];
+    for(var i = 0; i < 3; i++) {
         selectedBlocksToStream[i] = ToStream(1, 16);
         selectedBlocksToStream[i].blocks[0] <== selectedBlocks.blocks[i];
         ghash.msg[i] <== selectedBlocksToStream[i].stream;
@@ -123,11 +123,10 @@ template AESGCMFOLDABLE(l, TOTAL_BLOCKS) {
     // lengths of the AAD and the ciphertext, and the GHASH function is applied to the result to
     // produce a single output block.
 
-    component selectTag = SelectGhashTag(ghashBlocks);
+    component selectTag = SelectGhashTag();
     selectTag.possibleTags <== ghash.possibleTags;
     selectTag.targetMode <== targetMode.mode;
 
-    // TODO: Cleanup, in the end always encrypt with 0001.
     component StartJ0 = ToBlocks(16);
     for (var i = 0; i < 12; i++) {
         StartJ0.stream[i] <== iv[i];
@@ -163,47 +162,47 @@ template GhashModes() {
     signal output END_MODE       <== 3;
 }
 
-template SelectGhashBlocks(l, ghashBlocks, totalBlocks) {
+template SelectGhashBlocks(totalBlocks) {
     signal input aad[16];
-    signal input cipherText[l]; 
+    signal input cipherText[16]; 
     signal input targetMode;
-    signal output blocks[ghashBlocks][4][4];
+    signal output blocks[3][4][4];
 
-    signal targetBlocks[3][ghashBlocks*4*4];
+    signal targetBlocks[3][3*4*4];
     signal modeToBlocks[4] <== [0, 0, 1, 2];
 
-    component start  = GhashStartMode(l, totalBlocks, ghashBlocks);
+    component start  = GhashStartMode(totalBlocks);
     start.aad        <== aad;
     start.cipherText <== cipherText;
     targetBlocks[0]  <== start.blocks;
 
-    component stream  = GhashStreamMode(l, ghashBlocks);
+    component stream  = GhashStreamMode();
     stream.cipherText <== cipherText;
     targetBlocks[1]   <== stream.blocks;
 
-    component end   = GhashEndMode(l, totalBlocks, ghashBlocks);
+    component end   = GhashEndMode(totalBlocks);
     end.cipherText  <== cipherText;
     targetBlocks[2] <== end.blocks;
 
     component mapModeToArray = Selector(4);
     mapModeToArray.in        <== modeToBlocks;
     mapModeToArray.index     <== targetMode;
 
-    component chooseBlocks = ArraySelector(3, ghashBlocks*4*4);
+    component chooseBlocks = ArraySelector(3, 3*4*4);
     chooseBlocks.in        <== targetBlocks;
     chooseBlocks.index     <== mapModeToArray.out;
 
-    component toBlocks = ToBlocks(ghashBlocks*4*4);
+    component toBlocks = ToBlocks(3*4*4);
     toBlocks.stream    <== chooseBlocks.out;
     blocks             <== toBlocks.blocks;
 }
 
-template SelectGhashTag(ghashBlocks) {
-    signal input possibleTags[ghashBlocks][16];
+template SelectGhashTag() {
+    signal input possibleTags[3][16];
     signal input targetMode;
     signal output tag[16];
 
-    // Intermediate tag choosing log
+    // Intermediate tag choosing logic
     // 
     // case 1: If we are in start_mode: Choose ghashblocks-2 (skip end tag)
     // case 2: If we are in start_end_mode: Choose ghashblocks-1 (skip none)
@@ -215,22 +214,22 @@ template SelectGhashTag(ghashBlocks) {
     mapModeToIndex.in <== modeToIndex;
     mapModeToIndex.index <== targetMode;
 
-    signal tagIndex <== ghashBlocks - mapModeToIndex.out;
+    signal tagIndex <== 3 - mapModeToIndex.out;
 
-    component s = ArraySelector(ghashBlocks, 16);
+    component s = ArraySelector(3, 16);
     s.in <== possibleTags;
     s.index <== tagIndex; 
 
     tag <== s.out;
 }
 
-template SelectGhashMode(totalBlocks, blocksPerFold, ghashBlocks) {
+template SelectGhashMode(totalBlocks) {
     signal input foldedBlocks;
     signal output mode;
 
     // May need to compute these differently due to foldedBlocks. 
     // i.e. using GT operator, Equal operator, etc. 
-    signal isFinish <-- (blocksPerFold >= totalBlocks-foldedBlocks) ? 1 : 0;
+    signal isFinish <-- (1 >= totalBlocks-foldedBlocks) ? 1 : 0;
     signal isStart <-- (foldedBlocks == 0) ? 1: 0; 
 
     isFinish * (isFinish - 1) === 0;
@@ -246,21 +245,13 @@ template SelectGhashMode(totalBlocks, blocksPerFold, ghashBlocks) {
     component choice = Mux2();
     choice.c <== [m.STREAM_MODE, m.START_MODE, m.END_MODE, m.START_END_MODE];
     choice.s <== [isStart, isFinish];
-
-    signal isStartEndMode <== IsEqual()([choice.out, m.START_END_MODE]);
-    signal isStartMode    <== IsEqual()([choice.out, m.START_MODE]);
-    signal isStreamMode   <== IsEqual()([choice.out, m.STREAM_MODE]);
-    signal isEndMode      <== IsEqual()([choice.out, m.END_MODE]);
-
-    isStartEndMode + isStartMode + isStreamMode + isEndMode === 1;
-
     mode <== choice.out;
 }
 
-template GhashStartMode(l, totalBlocks, ghashBlocks) {
+template GhashStartMode(totalBlocks) {
     signal input aad[16];
-    signal input cipherText[l];
-    signal output blocks[ghashBlocks*4*4];
+    signal input cipherText[16];
+    signal output blocks[3*4*4];
 
     // set aad as first block (16 bytes)
     var blockIndex = 0;
@@ -270,7 +261,7 @@ template GhashStartMode(l, totalBlocks, ghashBlocks) {
     }
 
     // layout blocks of cipherText (l*16 bytes)
-    for (var i=0; i<l; i++) {
+    for (var i=0; i<16; i++) {
         blocks[blockIndex] <== cipherText[i];
         blockIndex += 1;
     }
@@ -302,30 +293,30 @@ template GhashStartMode(l, totalBlocks, ghashBlocks) {
 // TODO: Mildly more efficient if we add this, maybe it's needed?
 // template GhashStartAndEndMode(l, blockCount, ghashBlocks) {}
 
-template GhashStreamMode(l, ghashBlocks) {
-    signal input cipherText[l];
-    signal output blocks[ghashBlocks*4*4];
+template GhashStreamMode() {
+    signal input cipherText[16];
+    signal output blocks[3*4*4];
 
     var blockIndex = 0;
     // layout ciphertext (l*16 bytes)
-    for (var i=0; i<l; i++) {
+    for (var i=0; i<16; i++) {
         blocks[blockIndex] <== cipherText[i];
         blockIndex += 1;
     }
 
     // pad remainder 
-    for (var i=blockIndex; i<ghashBlocks*4*4; i++) {
+    for (var i=blockIndex; i<3*4*4; i++) {
         blocks[i] <== 0x00; 
     }
 }
 
-template GhashEndMode(l, totalBlocks, ghashBlocks) {
-    signal input cipherText[l];
-    signal output blocks[ghashBlocks*4*4];
+template GhashEndMode(totalBlocks) {
+    signal input cipherText[16];
+    signal output blocks[3*4*4];
 
     var blockIndex = 0;
     // layout ciphertext (l*16 bytes)
-    for (var i=0; i<l; i++) {
+    for (var i=0; i<16; i++) {
         blocks[blockIndex] <== cipherText[i];
         blockIndex += 1;
     }
@@ -355,4 +346,4 @@ template GhashEndMode(l, totalBlocks, ghashBlocks) {
         blocks[blockIndex] <== 0;
         blockIndex += 1;
     }
-}
+}

circuits/aes-gcm/aes-gcm.circom

@@ -71,7 +71,7 @@ template AESGCM(l) {
 
 
     // Step 4: Let u and v (v is always zero with out key size and aad length)
-    var u = 128 * (l \ 128) - l;
+    // var u = 128 * (l \ 128) - l;
     var blockCount = l\16;
     if(l%16 > 0){
         blockCount = blockCount + 1;
@@ -149,3 +149,6 @@ template AESGCM(l) {
     authTag <== gctrT.cipherText;
     cipherText <== gctr.cipherText;
 }
+
+
+component main = AESGCM(16);