A frontend.Variable is a bigInt. If I have a bytes max then a bigint, How do I handle it?

[Bart200c]

var msgs [32]frondend.Variable

var size = msgs[0].(int) // error here

for i := 1; i < 32; i ++ {
    if i >= size {
        break
    }
    hasher.Write(msgs[i]) // only hash the actual msg
}

I have a msg that size can be up to 32*4 bytes, but if a msg not 32 * 4 bytes, I need to know the actual size. So I assign the msgs[0] as the length and msgs[1:] as the msg content.
But the var size = msgs[0].(int) will throw an error parse circuit: interface conversion: frontend.Variable is expr.LinearExpression, not int at the circuit compile stage
So my question is:

1. How to convert a frondend.Variable to int?
2. Any best practice for passing bytes to the circuit (bytes > 4bytes)?

[Tabaie]

Compilation happens at a stage before the witness (and therefore values of the frontend.Variabes used in the Define method) are available. It's a common step used by all parties involved (prover, verifier, setters-up) and also common among all executions of the circuit (possibly with different witnesses.)
For your application I think your best bet is to write a hint that attempts to decompose a message into four byte-sized variables (this we can do because hints are only run at solving time and therefore the numerical value of the witness is available) and then prove that the results are indeed actually bytes using a lookup table. You can probably experiment with this decomposition chunk size and find what results in best performance for your use-case.

[jiakun9707]

Can you give me an example or show me an example in source code?
Thank you!

[ivokub]

Please have a look at the uints package which supports representing bytes in a circuit.

[readygo67]

@bart200, jiakun9707
I write a example for reference. in * TestHash_Multi_Plonk_BN254* different inputs are verified on same circuit.

import (
	"crypto/sha256"
	"encoding/hex"
	"fmt"
	"testing"
	"time"

	"github.com/consensys/gnark-crypto/ecc"
	"github.com/consensys/gnark/backend/plonk"
	"github.com/consensys/gnark/frontend"
	"github.com/consensys/gnark/frontend/cs/scs"
	"github.com/consensys/gnark/std/hash/sha2"
	"github.com/consensys/gnark/std/math/uints"
	"github.com/consensys/gnark/std/selector"
	"github.com/consensys/gnark/test"
	"github.com/consensys/gnark/test/unsafekzg"
)

// MAX_LENGTH is the maximum length of the input
const MaxLength = 128

type HashCircuit struct {
	Input       [MaxLength]uints.U8
	InputLength frontend.Variable //indicates actual number of bytes
	Output      [32]uints.U8      `gnark:",public"`
}

func (c *HashCircuit) Define(api frontend.API) error {
	var digests [MaxLength][]uints.U8

	//calculated all possible digest
	for i := 0; i < MaxLength; i++ {
		h, err := sha2.New(api)
		if err != nil {
			return err
		}

		h.Write(c.Input[:i])
		o := h.Sum()
		digests[i] = o
	}
	//select
	var res [32]frontend.Variable
	for i := 0; i < len(c.Output); i++ {
		var muxs []frontend.Variable
		for j := 0; j < MaxLength; j++ {
			muxs = append(muxs, digests[j][i].Val)
		}
		res[i] = selector.Mux(api, c.InputLength, muxs...)
	}

	//assert
	for i := range c.Output {
		api.AssertIsEqual(c.Output[i].Val, res[i])
	}
	return nil
}

func TestHash_Single_Simulated(t *testing.T) {
	assert := test.NewAssert(t)
	field := ecc.BN254.ScalarField()

	msg := []byte("hello, world")
	digest := sha256.Sum256(msg)

	var input [MaxLength]uints.U8
	var output [32]uints.U8
	for i := 0; i < len(msg); i++ {
		input[i] = uints.NewU8(msg[i])
	}
	for i, d := range digest {
		output[i] = uints.NewU8(d)
	}

	assignment := &HashCircuit{
		Input:       input,
		InputLength: len(msg),
		Output:      output,
	}

	err := test.IsSolved(&HashCircuit{}, assignment, field)
	assert.NoError(err)
}

func TestHash_Single_Plonk_BN254(t *testing.T) {
	assert := test.NewAssert(t)
	field := ecc.BN254.ScalarField()

	msg := []byte("hello, world")
	digest := sha256.Sum256(msg)
	fmt.Printf("%v\n", hex.EncodeToString(digest[:]))

	var input [MaxLength]uints.U8
	var output [32]uints.U8
	for i := 0; i < len(msg); i++ {
		input[i] = uints.NewU8(msg[i])
	}
	for i, d := range digest {
		output[i] = uints.NewU8(d)
	}

	assignment := &HashCircuit{
		Input:       input,
		InputLength: len(msg),
		Output:      output,
	}

	ccs, err := frontend.Compile(field, scs.NewBuilder, &HashCircuit{})
	assert.NoError(err)
	fmt.Printf("inner Ccs nbConstraints:%v, nbSecretWitness:%v, nbPublicInstance:%v\n", ccs.GetNbConstraints(), ccs.GetNbSecretVariables(), ccs.GetNbPublicVariables())

	// NB! UNSAFE! Use MPC.
	srs, srsLagrange, err := unsafekzg.NewSRS(ccs)
	assert.NoError(err)

	pk, vk, err := plonk.Setup(ccs, srs, srsLagrange)
	assert.NoError(err)

	witness, err := frontend.NewWitness(assignment, field)

	proof, err := plonk.Prove(ccs, pk, witness)
	assert.NoError(err)

	publicWitness, err := witness.Public()
	assert.NoError(err)

	err = plonk.Verify(proof, vk, publicWitness)
	assert.NoError(err)

}

func TestHash_Multi_Simulated(t *testing.T) {
	assert := test.NewAssert(t)
	field := ecc.BN254.ScalarField()

	msgs := [][]byte{
		[]byte("a"),
		[]byte("abc"),
		[]byte("hello, world"),
		[]byte("ciao, keep"),
		[]byte("gnark is an excellent zkp library"),
	}

	for _, msg := range msgs {
		var input [MaxLength]uints.U8
		var output [32]uints.U8
		for i := 0; i < len(msg); i++ {
			input[i] = uints.NewU8(msg[i])
		}
		digest := sha256.Sum256(msg)

		for i, d := range digest {
			output[i] = uints.NewU8(d)
		}
		assignment := &HashCircuit{
			Input:       input,
			InputLength: len(msg),
			Output:      output,
		}

		err := test.IsSolved(&HashCircuit{}, assignment, field)
		assert.NoError(err)
	}
}

func TestHash_Multi_Plonk_BN254(t *testing.T) {
	assert := test.NewAssert(t)
	msgs := [][]byte{
		[]byte("a"),
		[]byte("abc"),
		[]byte("hello, world"),
		[]byte("ciao, keep"),
		[]byte("gnark is an excellent zkp library"),
	}

	compileStart := time.Now()
	fmt.Printf("compile start...\n")
	field := ecc.BN254.ScalarField()
	ccs, err := frontend.Compile(field, scs.NewBuilder, &HashCircuit{})
	assert.NoError(err)
	compileDuration := time.Since(compileStart)
	fmt.Printf("compile duration:%v\n", compileDuration)
	fmt.Printf("inner Ccs nbConstraints:%v, nbSecretWitness:%v, nbPublicInstance:%v\n", ccs.GetNbConstraints(), ccs.GetNbSecretVariables(), ccs.GetNbPublicVariables())

	// NB! UNSAFE! Use MPC.
	generateSRSStart := time.Now()
	fmt.Printf("generate srs start@%v...\n", generateSRSStart)
	srs, srsLagrange, err := unsafekzg.NewSRS(ccs)
	assert.NoError(err)
	generateSRSDuration := time.Since(generateSRSStart)
	fmt.Printf("generate srs duration:%v\n", generateSRSDuration)

	setupStart := time.Now()
	fmt.Printf("setup start@%v...\n", setupStart)
	pk, vk, err := plonk.Setup(ccs, srs, srsLagrange)
	assert.NoError(err)
	setupDuration := time.Since(setupStart)
	fmt.Printf("setup duration:%v\n", setupDuration)

	for _, msg := range msgs {
		var input [MaxLength]uints.U8
		var output [32]uints.U8
		for i := 0; i < len(msg); i++ {
			input[i] = uints.NewU8(msg[i])
		}

		digest := sha256.Sum256(msg)
		for i, d := range digest {
			output[i] = uints.NewU8(d)
		}

		assignment := &HashCircuit{
			Input:       input,
			InputLength: len(msg),
			Output:      output,
		}

		witness, err := frontend.NewWitness(assignment, field)

		fmt.Printf("----------------------------------------------\n")
		fmt.Printf("msg:%v\n", msg)
		proveStart := time.Now()
		fmt.Printf("prove start@%v...\n", proveStart)
		proof, err := plonk.Prove(ccs, pk, witness)
		assert.NoError(err)
		proveDuration := time.Since(proveStart)
		fmt.Printf("prove duration:%v\n", proveDuration)

		publicWitness, err := witness.Public()
		assert.NoError(err)

		verifyStart := time.Now()
		fmt.Printf("verify start@%v...\n", verifyStart)
		err = plonk.Verify(proof, vk, publicWitness)
		assert.NoError(err)
		verifyDuration := time.Since(verifyStart)
		fmt.Printf("verify duration:%v\n", verifyDuration)
	}
}

=== RUN   TestHash_Multi_Plonk_BN254
compile start...
compile duration:9.787437958s
inner Ccs nbConstraints:16351260, nbSecretWitness:129, nbPublicInstance:32
generate srs start@2024-01-22 00:20:54.611356 +0800 CST m=+9.796623168...
generate srs duration:3m28.330968458s
setup start@2024-01-22 00:24:22.94439 +0800 CST m=+218.127609168...
setup duration:29.435305208s
----------------------------------------------
msg:[97]
prove start@2024-01-22 00:24:52.380213 +0800 CST m=+247.563143168...
prove duration:2m49.096187375s
verify start@2024-01-22 00:27:41.478083 +0800 CST m=+416.659350584...
verify duration:7.78425ms
----------------------------------------------
msg:[97 98 99]
prove start@2024-01-22 00:27:41.486049 +0800 CST m=+416.667317293...
prove duration:2m47.16387725s
verify start@2024-01-22 00:30:28.651601 +0800 CST m=+583.831226001...
verify duration:1.771292ms
----------------------------------------------
msg:[104 101 108 108 111 44 32 119 111 114 108 100]
prove start@2024-01-22 00:30:28.653589 +0800 CST m=+583.833214001...
prove duration:2m51.094770708s
verify start@2024-01-22 00:50:33.315181 +0800 CST m=+754.928012209...
verify duration:20.756084ms
----------------------------------------------
msg:[99 105 97 111 44 32 107 101 101 112]
prove start@2024-01-22 00:50:33.336123 +0800 CST m=+754.948953959...
prove duration:2m51.26875625s
verify start@2024-01-22 00:53:24.606675 +0800 CST m=+926.217728793...
verify duration:1.807208ms
----------------------------------------------
msg:[103 110 97 114 107 32 105 115 32 97 110 32 101 120 99 101 108 108 101 110 116 32 122 107 112 32 108 105 98 114 97 114 121]
prove start@2024-01-22 00:53:24.608717 +0800 CST m=+926.219770251...
prove duration:2m50.268597208s
verify start@2024-01-22 00:56:14.879105 +0800 CST m=+1096.488390084...
verify duration:3.4785ms
--- PASS: TestHash_Multi_Plonk_BN254 (1096.48s)
PASS