Public parameters in the groth16 recursion example

[hanneshui]

Hi all,
I was looking into recursive zk-snarks and then came across gnark and the following documentation for recursive circuits using groth16: https://pkg.go.dev/github.com/consensys/gnark/std/recursion/groth16#pkg-overview
In the example code at the top of the documentation I noticed something. The inner circuit has the variable N marked as a public variable with gnark:",public". For the outer circuit, no such variable is marked with gnark:",public", so they are all private?
In my understanding, for the proof to be sound, the public parameters of the inner witness and the VerifyingKey should also be public. As a reference in the zk-learning lecture on recursive proofs, slide number 4 and the following soundness proof: https://rdi.berkeley.edu/zk-learning/assets/lecture10.pdf
Am I missing something or is there a bug in this example implementation?

[ivokub]

There is a bug indeed. It makes sense for the proof of the outer circuit to be public witness.

For the verifying key it is a bit more complicated - it should be public, but it doesn't necessarily have to be provided as a public witness. It can be encoded inside the circuit itself if the inner circuit is always the same. This actually allows to significantly reduce the recursive verifier cost and we have taken this approach in Linea.

However, using it is a bit delicate, so we don't have an explicit example for it. But you can see how it works in the tests: https://github.com/Consensys/gnark/blob/master/std/recursion/groth16/verifier_test.go#L292-L328. Here you see:

vk           VerifyingKey[G1El, G2El, GtEl] `gnark:"-"`

and we define the verification key already at outer circuit compile time:

	outerCircuit := &OuterCircuitConstant[sw_bw6761.ScalarField, sw_bw6761.G1Affine, sw_bw6761.G2Affine, sw_bw6761.GTEl]{
		InnerWitness: PlaceholderWitness[sw_bw6761.ScalarField](innerCcs),
		vk:           circuitVk,
	}

So, for the example it would make sense to make the two fields public. You can open a PR and submit as a fix, we would like to include it 👍

[hanneshui]

Thanks for your valuable comment @ivokub , I will create a PR.
Also implementing the encoding of the vk inside the outer circuit worked, but somehow I'm not getting lower recursive verifier costs. Maybe I'm using it the wrong way. Does anyone know if there is an explanation of what the gnark:"-" tag does, or does anyone have a working code where vk is encoded inside the outer circuit?

[ivokub]

Have a look at the following examples, they should be the same except in one case the inner circuit verification key is defined as constant and otherwise it is defined as a variable:

• VK as variable
• VK as constant

The gnark:"-" tag in the circuit struct indicates that the circuit schema parser should consider these values as constant, not part of the witness. This also means that we need to define the inner circuit key during circuit compile time, notice:

	outerCircuit := &OuterCircuitConstant[sw_bw6761.ScalarField, sw_bw6761.G1Affine, sw_bw6761.G2Affine, sw_bw6761.GTEl]{
		InnerWitness: PlaceholderWitness[sw_bw6761.ScalarField](innerCcs),
		vk:           circuitVk, // defined as constant
	}

vs
outerCircuit := &OuterCircuit[sw_bw6761.ScalarField, sw_bw6761.G1Affine, sw_bw6761.G2Affine, sw_bw6761.GTEl]{
InnerWitness: PlaceholderWitnesssw_bw6761.ScalarField,
VerifyingKey: PlaceholderVerifyingKeysw_bw6761.G1Affine, sw_bw6761.G2Affine, sw_bw6761.GTEl, // we define a placeholder for compile time. It needs to be provided at proving time
}

I compiled the circuits - the variable version is 3029520 constrains and constant version 2591125 constraints.