Custom Modulus & External R1CS

[BeratOz01]

Hello, firstly, thank you for this beautiful library!

I have two questions:

Firstly, I couldn't figure out how to use mod operation with gnark. In circom:

Var xer = balance % r_prime;
What is the equivalent of this in the gnark circuit?

Secondly, I have written and compiled my circuit in circom, now I have my r1cs and witness. Is it possible to use gnark only as a prover and also can I generate my witness from my r1cs (or sym etc.) of circom circuit, using gnark?

Thank you!!

[ivokub]

See https://pkg.go.dev/github.com/consensys/gnark@v0.8.0/std/math/emulated.

Yes, it is possible. We don't have transpiler from circom, but you can build R1CS circuit manually. See for example https://www.notamonadtutorial.com/how-to-use-the-consenyss-gnark-zero-knowledge-proof-library-and-disclosure-of-a-ddos-bug/

[BeratOz01]

@ivokub Any updates?

[ivokub]

We do not have it. You have to understand that in circuit we work in a finite field (so all variables are modulus the scalar field of the curve). So the result after the mod operation is still in the native field. And what could happen if you multiply two small values (lets say (r-1)/2, where r is the modulus of the scalar field) you overflow the native field. Then when you run api.Mod you get unexpected result (because the temp variable is already overflow the scalar field and reduced there).

That is why you would in general want to use std/math/emulated. Using that gadget we use a multi-precision arithmetic to ensure there is no overflow in the underlying native field. And I think the examples there are sufficient to start.

[ivokub]

And yes, using std/math/emulated the variables stay private if you initialise the elements from private vars.

[furkan-ux]

Thank you!!

[ivokub]

Another approach, if you want to do only modulus for the small example is to use hint. But then you have to be careful that the hint output is constrained. In pseudocode:

1. instead of el % modulus = res compute res, k using hints such that res + k * modulus = el
2. assert in-circuit that api.AssertIsEqual(x, api.Add(res, api.Mul(k. modulus)))

I leave the implementation do you for practice ;)

[gbotrel]

re: using circom circuit with gnark; as @ivokub said, possible, but not trivial to implement I think. The mapping of the constraints should be straightforward, but the "solver hint" part I have no idea.

[BeratOz01]

Okay, how about modulus operation with two frontend.Variables ?

[BeratOz01]

Any updates on modulus ?