Building a Zero Knowledge Proof from an R1CS

Last updated on Oct 31, 2024

Given an arithmetic circuit encoded as a Rank 1 Constraint System, it is possible to create a ZK-proof of having a witness, albeit not a succinct one. This article describes how to accomplish that.

A zero knowledge proof for an R1CS is accomplished by converting the witness vector into finite field elliptic curve points and replacing the Hadamard product with a bilinear pairing for each row.

Given a Rank 1 Constraint System where each matrix has $n$ rows and $m$ columns, we write it as

𝐋 𝐚 \circ 𝐑 𝐚 = 𝐎 𝐚

Where $𝐋$ , $𝐑$ , $𝐎$ are matrices with $n$ rows and $m$ columns, and $𝐚$ is the witness vector (containing a satisfying assignment to each of the signals in the arithmetic circuit). The vector $𝐚$ has 1 column and $m$ rows and $\circ$ is element-wise multiplication (Hadamard product).

In expanded form, it looks like

[\begin{matrix} l_{1,1} & \dots & l_{1, m} \\ ⋮ & ⋱ & ⋮ \\ l_{n, 1} & \dots & l_{n, m} \end{matrix}] [\begin{matrix} a_{1} \\ ⋮ \\ a_{m} \end{matrix}] \circ [\begin{matrix} r_{1,1} & \dots & r_{1, m} \\ ⋮ & ⋱ & ⋮ \\ r_{n, 1} & \dots & r_{n, m} \end{matrix}] [\begin{matrix} a_{1} \\ ⋮ \\ a_{m} \end{matrix}] = [\begin{matrix} o_{1,1} & \dots & o_{1, m} \\ ⋮ & ⋱ & ⋮ \\ o_{n, 1} & \dots & o_{n, m} \end{matrix}] [\begin{matrix} a_{1} \\ ⋮ \\ a_{m} \end{matrix}]

= [\begin{matrix} a_{1} l_{1,1} + \dots + a_{m} l_{1, m} \\ ⋮ \\ a_{1} l_{n, 1} + \dots + a_{m} l_{n, m} \end{matrix}] \circ [\begin{matrix} a_{1} r_{1,1} + \dots + a_{m} r_{1, m} \\ ⋮ \\ a_{1} r_{n, 1} + \dots + a_{m} r_{n, m} \end{matrix}] = [\begin{matrix} a_{1} o_{1,1} + \dots + a_{m} o_{1, m} \\ ⋮ \\ a_{1} o_{n, 1} + \dots + a_{m} o_{n, m} \end{matrix}]

= [\begin{matrix} \sum_{i = 1}^{m} a_{i} l_{1, i} \\ \sum_{i = 1}^{m} a_{i} l_{2, i} \\ ⋮ \\ \sum_{i = 1}^{m} a_{i} l_{n, i} \end{matrix}] \circ [\begin{matrix} \sum_{i = 1}^{m} a_{i} r_{1, i} \\ \sum_{i = 1}^{m} a_{i} r_{2, i} \\ ⋮ \\ \sum_{i = 1}^{m} a_{i} r_{n, i} \end{matrix}] = [\begin{matrix} \sum_{i = 1}^{m} a_{i} o_{1, i} \\ \sum_{i = 1}^{m} a_{i} o_{2, i} \\ ⋮ \\ \sum_{i = 1}^{m} a_{i} o_{n, i} \end{matrix}]

= \begin{matrix} \sum_{i = 1}^{m} a_{i} l_{1, i} \sum_{i = 1}^{m} a_{i} r_{1, i} = \sum_{i = 1}^{m} a_{i} o_{1, i} \\ \sum_{i = 1}^{m} a_{i} l_{2, i} \sum_{i = 1}^{m} a_{i} r_{2, i} = \sum_{i = 1}^{m} a_{i} o_{2, i} \\ ⋮ \\ \sum_{i = 1}^{m} a_{i} l_{n, i} \sum_{i = 1}^{m} a_{i} r_{n, i} = \sum_{i = 1}^{m} a_{i} o_{n, i} \end{matrix}

In this setup, we can prove to a verifier that we have a witness vector $𝐚$ that satisfies the R1CS simply by giving them the vector $𝐚$ , but with the obvious drawback that this is not a zero knowledge proof!

Zero knowledge proof algorithm for an R1CS.

If we “encrypt” the witness vector by multiplying each entry with $G_{1}$ or $G_{2}$ , the math will still work properly!

To understand this, consider that if we carry out the matrix multiplication

[\begin{matrix} 1 & 2 \\ 3 & 4 \end{matrix}] [\begin{matrix} 4 \\ 5 \end{matrix}] = [\begin{matrix} 14 \\ 32 \end{matrix}]

and also

[\begin{matrix} 1 & 2 \\ 3 & 4 \end{matrix}] [\begin{matrix} 4 G_{1} \\ 5 G_{1} \end{matrix}] = [\begin{matrix} 14 G_{1} \\ 32 G_{1} \end{matrix}]

The discrete logs of the two elliptic curve points in the second matrix multiplication are the same value as the elements of the first matrix multiplication.

In other words, each time we multiply the column vector by a row in the square matrix, we carry out two elliptic curve point multiplications and one elliptic curve addition.

Notation for elliptic curves

We say ${[a G_{1}]}_{1}$ is a $𝔾_{1}$ elliptic curve point created from multiplying the field element $a$ by $G_{1}$ . We say ${[a G_{2}]}_{2}$ is a $𝔾_{2}$ elliptic curve point generated by multiplying $a$ with the generator $G_{2}$ . Because of the discrete log problem, we cannot extract $a$ given ${[a G_{1}]}_{1}$ or ${[a G_{2}]}_{2}$ . Given a $A \in 𝔾_{1}$ and $B \in 𝔾_{2}$ point, we say the pairing of the two points is $A ∙ B$ .

Prover steps

Let’s encrypt our $𝐚$ vector by multiplying each entry with the generator point $G_{1}$ to produce the elliptic curve point ${[a_{i} G_{1}]}_{1}$ .

For the matrix $𝐋$ , we are doing the following:

[\begin{matrix} l_{1,1} & \dots & l_{1, m} \\ ⋮ & ⋱ & ⋮ \\ l_{n, 1} & \dots & l_{n, m} \end{matrix}] [\begin{matrix} {[a_{1} G_{1}]}_{1} \\ ⋮ \\ {[a_{m} G_{1}]}_{1} \end{matrix}] = [\begin{matrix} l_{1,1} {[a_{1} G_{1}]}_{1} & + \dots + & l_{1, m} {[a_{m} G_{1}]}_{1} \\ ⋮ & ⋱ & ⋮ \\ l_{n, 1} {[a_{1} G_{1}]}_{1} & + \dots + & l_{n, m} {[a_{m} G_{1}]}_{1} \end{matrix}] = [\begin{matrix} \sum_{i = 1}^{m} l_{1, i} {[a_{i} G_{1}]}_{1} \\ \sum_{i = 1}^{m} l_{2, i} {[a_{i} G_{1}]}_{1} \\ ⋮ \\ \sum_{i = 1}^{m} l_{n, i} {[a_{i} G_{1}]}_{1} \end{matrix}]

In anticipation of the Hadamard product becoming a list of elliptic curve pairings, we can use $G_{2}$ points to also encrypt the $𝐚$ vector so the verifier can do the pairing.

[\begin{matrix} r_{1,1} & \dots & r_{1, m} \\ ⋮ & ⋱ & ⋮ \\ r_{n, 1} & \dots & r_{n, m} \end{matrix}] [\begin{matrix} {[a_{1} G_{2}]}_{2} \\ ⋮ \\ {[a_{m} G_{2}]}_{2} \end{matrix}] = [\begin{matrix} r_{1,1} {[a_{1} G_{2}]}_{2} & + \dots + & r_{1, m} {[a_{m} G_{2}]}_{2} \\ ⋮ & ⋱ & ⋮ \\ r_{n, 1} {[a_{1} G_{2}]}_{2} & + \dots + & r_{n, m} {[a_{m} G_{2}]}_{2} \end{matrix}] = [\begin{matrix} \sum_{i = 1}^{m} r_{1, i} {[a_{i} G_{2}]}_{2} \\ \sum_{i = 1}^{m} r_{2, i} {[a_{i} G_{2}]}_{2} \\ ⋮ \\ \sum_{i = 1}^{m} r_{n, i} {[a_{i} G_{2}]}_{2} \end{matrix}]

After this operation, we have a single column of elliptic curve points in $G_{1}$ originating from the multiplication $𝐋 𝐚$ and a single column of $G_{2}$ points from $𝐑 𝐚$ .

The naive next step would be to encrypt the $𝐚$ vector with $G_{12}$ points so that the verifier can pair the result of $𝐋 𝐚$ with $𝐑 𝐚$ to see if it equals $𝐎 𝐚$ , but $G_{12}$ points are massive, so we would rather have the verifier pair the $𝐎 𝐚$ elliptic curve points in $G_{1}$ then pair each entry with a $G_{2}$ point. Pairing with a $G_{2}$ point is, in a sense, “multiplying by one” but turning the $G_{1}$ point into a $G_{12}$ point.

The prover then hands the $G_{1}$ vector and the $G_{2}$ vector to the verifier.

Verification step

Thus, the verification step becomes

[\begin{matrix} \sum_{i = 1}^{m} l_{i, 1} {[a_{i} G_{1}]}_{1} \\ \sum_{i = 1}^{m} l_{i, 1} {[a_{i} G_{1}]}_{1} \\ ⋮ \\ \sum_{i = 1}^{m} l_{i, 1} {[a_{i} G_{1}]}_{1} \end{matrix}] \begin{matrix} ∙ \\ ∙ \\ ⋮ \\ ∙ \end{matrix} [\begin{matrix} \sum_{i = 1}^{m} r_{i, 1} {[a_{i} G_{2}]}_{2} \\ \sum_{i = 1}^{m} r_{i, 1} {[a_{i} G_{2}]}_{2} \\ ⋮ \\ \sum_{i = 1}^{m} r_{i, 1} {[a_{i} G_{2}]}_{2} \end{matrix}] \overset{?}{=} [\begin{matrix} \sum_{i = 1}^{m} o_{i, 1} {[a_{i} G_{1}]}_{1} \\ \sum_{i = 1}^{m} o_{i, 1} {[a_{i} G_{1}]}_{1} \\ ⋮ \\ \sum_{i = 1}^{m} o_{i, 1} {[a_{i} G_{1}]}_{1} \end{matrix}] \begin{matrix} ∙ \\ ∙ \\ ⋮ \\ ∙ \end{matrix} [\begin{matrix} G_{2} \\ G_{2} \\ ⋮ \\ G_{2} \end{matrix}]

= \begin{matrix} \sum_{i = 1}^{m} l_{i, 1} {[a_{i} G_{1}]}_{1} ∙ \sum_{i = 1}^{m} r_{i, 1} {[a_{i} G_{2}]}_{2} \\ \sum_{i = 1}^{m} l_{i, 2} {[a_{i} G_{1}]}_{1} ∙ \sum_{i = 1}^{m} r_{i, 2} {[a_{i} G_{2}]}_{2} \\ ⋮ \\ \sum_{i = 1}^{m} l_{i, n} {[a_{i} G_{1}]}_{1} ∙ \sum_{i = 1}^{m} r_{i, n} {[a_{i} G_{2}]}_{2} \end{matrix} \overset{?}{=} \begin{matrix} \sum_{i = 1}^{m} o_{i, 1} {[a_{i} G_{1}]}_{1} ∙ G_{2} \\ \sum_{i = 1}^{m} o_{i, 2} {[a_{i} G_{1}]}_{1} ∙ G_{2} \\ ⋮ \\ \sum_{i = 1}^{m} o_{i, n} {[a_{i} G_{1}]}_{1} ∙ G_{2} \end{matrix}

The above vectors of $G_{12}$ elements will be element-wise equal if and only if the prover has provided a valid witness.

Well, almost. We’ll get to that in a following section.

First we need to mention an important implementation detail

Public inputs

If our knowledge claim is “I know $x$ such that $x^{3} + 5 x + 5 = y$ where $y = 155$ ”, then our witness vector will probably look like the following:

[1, y, x, v]

where $v = x^{2}$ . In this case, we need $[1, y]$ to be public. To accomplish that, we simply don’t encrypt the first two elements of the witness. The verifier will check the public outputs, then encrypt the public inputs by multiplying them with a $G_{1}$ or $G_{2}$ point so that the verification formula does not change.

Dealing with a malicious prover.

Because the vectors are encrypted, the verifier cannot immediately know if the vector of $𝔾_{1}$ points encrypts the same values as the vector of $𝔾_{2}$ points.

That is, the prover is supplying $𝐚 G_{1}$ and $𝐚 G_{2}$ . Since the verifier doesn’t know the discrete logs of the vector of points, how does the verifier know that the vector of $𝔾_{1}$ points has the same discrete logs as the vector of $𝔾_{2}$ points?

The verifier can check for the equality of the discrete logs (without knowing them) by pairing both vectors of points with a vector of the opposite generator and seeing that the resulting $𝔾_{12}$ points are equal. Specifically,

[\begin{matrix} a_{1} G_{1} \\ a_{2} G_{1} \\ ⋮ \\ a_{m} G_{1} \end{matrix}] \begin{matrix} ∙ \\ ∙ \\ ⋮ \\ ∙ \end{matrix} [\begin{matrix} G_{2} \\ G_{2} \\ ⋮ \\ G_{2} \end{matrix}] \overset{?}{=} [\begin{matrix} a_{1} G_{2} \\ a_{2} G_{2} \\ ⋮ \\ a_{m} G_{2} \end{matrix}] \begin{matrix} ∙ \\ ∙ \\ ⋮ \\ ∙ \end{matrix} [\begin{matrix} G_{1} \\ G_{1} \\ ⋮ \\ G_{1} \end{matrix}]

This algorithm is mostly academic

This algorithm is very inefficient for the verifier. If the matrices in the R1CS are large (and for interesting algorithms, they will be), then the verifier has a lot of pairings and elliptic curve additions to do. Elliptic curve addition is rather fast, but elliptic curve pairings are slow (and cost a lot of gas on Ethereum).

However, it is nice to see that at this stage, zero knowledge proofs are possible, and if you have a good grasp of elliptic curve operations (and haven’t forgotten your matrix arithmetic), they aren’t hard to understand.

Making this technique truly zero knowledge

As it is right now, our witness vector cannot be decrypted, however it can be guessed. If an attacker (someone trying to discover the unencrypted witness) uses some auxiliary information to make an educated guess at the witness, they can check their work by multiplying their guessed witness vector by the elliptic curve point generators and seeing if the result is the same as the prover’s witness vectors.

We will learn how to defend against witness guessing in our coverage of Groth16.

Also, keep in mind nobody does the described algorithm in the real world, as it is too inefficient. However, if you implement it, it will help you practice implementing meaningful elliptic curve arithmetic and build a functional end-to-end (almost) zero knowledge proof.

You can see an example implementation of algorithm described here by Obront in this repo.

Learn more with RareSkills

This material is from our Zero Knowledge Course.

Originally Published August 26, 2023