Sec: Fix under constrained selector

.github/workflows/ci.yml

@@ -20,7 +20,7 @@ jobs:
     strategy:
       matrix:
         toolchain:
-          - nightly
+          - stable
     steps:
       - uses: actions/checkout@v4
       - run: rustup update ${{ matrix.toolchain }} && rustup default ${{ matrix.toolchain }}

circuits/aes-gcm/aes-gcm-foldable.circom

@@ -67,9 +67,6 @@ template AESGCMFOLDABLE(l, TOTAL_BLOCKS) {
     J0WordIncrementer.in <== J0builder.blocks[0][3];
 
     // NOTE: With folding, start at counter 0001 always, then increment by 1. Same amount of work in every fold.
-    // 
-    // component J0WordIncrementer2 = IncrementWord();
-    // J0WordIncrementer2.in <== J0WordIncrementer.out;
 
     signal J0[4][4];
     for (var i = 0; i < 3; i++) {

circuits/aes-gcm/aes-gcm.circom

@@ -122,9 +122,9 @@ template AESGCM(l) {
     // Step 5: Define a block, S
     // needs to take in the number of blocks
     component ghash = GHASH(ghashblocks);
-    component hashKeyToStream = ToStream(16, 16);
-    hashKeyToStream.bl <== cipherH.cipher;
-    ghash.HashKey <== hashKeyToStream.out;
+    component hashKeyToStream = ToStream(1, 16);
+    hashKeyToStream.blocks[0] <== cipherH.cipher;
+    ghash.HashKey <== hashKeyToStream.stream;
     // S = GHASHH (A || 0^v || C || 0^u || [len(A)] || [len(C)]).
     component msgToStream = ToStream(ghashblocks, 16);
     msgToStream.blocks <== ghashMessage;

circuits/aes-gcm/aes/utils.circom

@@ -5,6 +5,7 @@ include "sbox128.circom";
 include "circomlib/circuits/comparators.circom";
 include "circomlib/circuits/bitify.circom";
 include "circomlib/circuits/gates.circom";
+include "../utils.circom";
 
 // Rotates an array of bytes to the left by a specified rotation
 template Rotate(rotation, length) {

circuits/aes-gcm/utils.circom

@@ -353,27 +353,6 @@ template IncrementWord() {
     }
 }
 
-template IncrementByte() {
-    signal input in;
-    signal output out;
-    signal output carry;
-
-    component IsGreaterThan = GreaterThan(8);
-    component mux = Mux1();
-
-    // check to carry overflow
-    IsGreaterThan.in[0] <== in + 1;
-    IsGreaterThan.in[1] <== 0xFF;
-
-    mux.c[0] <== in + 1;
-    mux.c[1] <== 0x00;
-    mux.s <== IsGreaterThan.out;
-    carry <== IsGreaterThan.out;
-
-    out <== mux.out;
-
-}
-
 template Contains(n) {
     assert(n > 0);
     /*
@@ -403,15 +382,17 @@ template Contains(n) {
     out <== 1 - someEqual.out;
 }
 
+/// m is the number of arrarys, n is the length of each array
 template ArraySelector(m, n) {
     signal input in[m][n];
-    signal input index;
+    signal input index; 
     signal output out[n];
     assert(index >= 0 && index < m);
 
     signal selector[m];
+    component Equal[m];
     for (var i = 0; i < m; i++) {
-        selector[i] <-- index == i ? 1 : 0;
+        selector[i] <== IsEqual()([index, i]);
         selector[i] * (1 - selector[i]) === 0; 
     }
 

circuits/test/common/utils.test.ts

@@ -28,7 +28,7 @@ describe("reverse_byte_array", () => {
 describe("IncrementWord", () => {
   let circuit: WitnessTester<["in"], ["out"]>;
   it("should increment the word input", async () => {
-      circuit = await circomkit.WitnessTester(`IncrementByte`, {
+      circuit = await circomkit.WitnessTester(`IncrementWord`, {
           file: "aes-gcm/utils",
           template: "IncrementWord",
       });

src/main.rs

@@ -1,15 +1,10 @@
 //! This generates witnesses to test circom artifacts in the `circuits` directory.
 
-#![feature(trivial_bounds)]
-#![allow(unused_imports)]
-#![allow(unused_variables)]
 #![allow(dead_code)]
-#![allow(unreachable_code)]
 #![allow(non_snake_case)]
 #![allow(clippy::clone_on_copy)]
-#![allow(unused_mut)]
 
-use std::{io, io::Write};
+use std::io;
 
 use aes::{cipher::generic_array::GenericArray, Aes256};
 use cipher::consts::U16;
@@ -87,10 +82,8 @@ mod tests {
         let test_iv = [0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31];
 
         let mut payload: Vec<u8> = Vec::new();
-        let mut last_byte = 0;
-        for i in 0..10 {
+        for last_byte in 0..10 {
             let message = format!("testhello000000{}", last_byte);
-            last_byte += 1;
             payload.extend(message.as_bytes());
         }
         let aes_payload = Payload { msg: &payload, aad: &[] };

src/utils.rs

@@ -17,7 +17,6 @@ use crate::{
 //
 /// construct the nonce from the `iv` and `seq` as specified in RFC 8452
 /// https://www.rfc-editor.org/rfc/rfc8452
-
 /// See TLS1.3
 pub(crate) fn make_nonce(iv: [u8; 12], seq: u64) -> Nonce {
     let mut nonce = [0u8; 12];

src/witness.rs

@@ -17,9 +17,8 @@ use aes_gcm::{
     aead::{generic_array::GenericArray, Aead, NewAead, Payload},
     Aes128Gcm, Aes256Gcm,
 };
-use anyhow::{Context, Result};
-use cipher::consts::U16;
-use serde::{Deserialize, Serialize};
+use anyhow::Result;
+use serde::Serialize;
 
 use crate::{
     consts::*,