How to compare public fields in a Witness them to known values?

[drakstik]

Hi,

I'm trying to read public fields in a Public Witness, but I couldn't find much documentation on this and #941 wasn't clear enough. I see that Vector() returns a Public Witness' underlying fr.Vector,

// Vector returns the underlying fr.Vector slice
Vector() [any](https://pkg.go.dev/builtin#any)

However I am unable to access a specific field like this: pubWit.Vector()[2]. How do I get the specific field out of the fr.Vector?

Consider that my circuit looks like this:

type IdentityCircuit struct {
	PublicKey       eddsa.PublicKey   
	EdDSA_Signature eddsa.Signature   
	ImgBytes        frontend.Variable `gnark:",public"` // Big Endian bytes;
}

After reading #941, I am assuming that the most efficient way to read public fields for comparison-purposes is by recreating another Public_Witness_2 with the known values (i.e. ImgBytes in above circuit), and once we are able to access the specific fields from the Vector, we can then compare the known fields with public fields in the Public_Witness_1.

Thanks in advance for your help!

[drakstik]

I figured it out!

When we run public_witness.MarshallBinary(), we get the public witness's binary representation of all its public values. MarshallBinary() only returns binaries associated with public values, so the known values and recreated witness are sufficient to compare with the public values in the public witness.

Here's my comparison function:

func CompareWitnesses(witness_1 witness.Witness, witness_2 witness.Witness) (bool) {
	recreated_witness_binaries, _ := witness_1.MarshalBinary()
	public_witness_binaries, _ := witness_2.MarshalBinary()

	return bytes.Equal(recreated_witness_binaries, public_witness_binaries)
}

Once I realized this, I wondered if I could just use the recreated witness (with the known values) to run groth16.Verify(), and it worked! So you don't even need to compare witnesses, just use the recreated witness with the groth16.Proof and groth16.VerifyingKey to verify if your known values are valid.

[ivokub]

This is one option. The thing is that we return a any from the Witness (as it is not parametrized). To access the fields you need to perform type assertion. See example:

package witness

import (
	"testing"

	"github.com/consensys/gnark-crypto/ecc"
	"github.com/consensys/gnark-crypto/ecc/bn254"
	fr_bn254 "github.com/consensys/gnark-crypto/ecc/bn254/fr"
	"github.com/consensys/gnark/frontend"
	"github.com/consensys/gnark/frontend/cs/r1cs"
	"github.com/consensys/gnark/std/algebra/emulated/sw_bn254"
	"github.com/consensys/gnark/std/algebra/emulated/sw_emulated"
	"github.com/consensys/gnark/test"
)

type Circuit struct {
	A frontend.Variable `gnark:",public"`
	B frontend.Variable
	P sw_emulated.AffinePoint[sw_bn254.BaseField] `gnark:",public"`
}

func (c *Circuit) Define(api frontend.API) error {
	api.AssertIsDifferent(c.A, c.B)

	curve, err := sw_bn254.NewPairing(api)
	if err != nil {
		return err
	}
	curve.AssertIsOnG1(&c.P)
	return nil
}

func TestCircuit(t *testing.T) {
	assert := test.NewAssert(t)
	ccs, err := frontend.Compile(ecc.BN254.ScalarField(), r1cs.NewBuilder, &Circuit{})
	assert.NoError(err)

	a, b := 3, 4
	_, _, P, _ := bn254.Generators()
	t.Logf("assignment: A = %d, B = %d, P = %s", a, b, P.String())
	assignment := &Circuit{A: a, B: b, P: sw_bn254.NewG1Affine(P)}
	witness, err := frontend.NewWitness(assignment, ecc.BN254.ScalarField())
	assert.NoError(err)
	_, err = ccs.Solve(witness)
	assert.NoError(err)
	witnessVector := witness.Vector().(fr_bn254.Vector)
	for i, v := range witnessVector {
		t.Logf("witness[%d] = %s", i, v.String())
	}
	pubWitness, err := witness.Public()
	assert.NoError(err)
	pubWitnessVector := pubWitness.Vector().(fr_bn254.Vector)
	for i, v := range pubWitnessVector {
		t.Logf("public witness[%d] = %s", i, v.String())
	}
}

Running it you should see:

assignment: A = 3, B = 4, P = E([1,2])
witness[0] = 3
witness[1] = 1
witness[2] = 0
witness[3] = 0
witness[4] = 0
witness[5] = 2
witness[6] = 0
witness[7] = 0
witness[8] = 0
witness[9] = 4
public witness[0] = 3
public witness[1] = 1
public witness[2] = 0
public witness[3] = 0
public witness[4] = 0
public witness[5] = 2
public witness[6] = 0
public witness[7] = 0
public witness[8] = 0

The non-native G1 point is represented using multi-precision arithmetic with 64-bit limbs (4 limb per point), so it takes 4+4 elements in the vector.