Fix ATMS verifier for circuit reusability across signature sets (#28)

Author: dkaidalov

prover/benches/atms.rs

@@ -72,17 +72,16 @@ impl Circuit<Base> for BenchCircuitAtmsSignature {
                     .iter()
                     .map(|&signature| {
                         if let Some(sig) = signature {
-                            Some(
-                                atms_gate
-                                    .schnorr_gate
-                                    .assign_sig(&mut ctx, &Value::known(sig))
-                                    .ok()?,
-                            )
+                            atms_gate
+                                .schnorr_gate
+                                .assign_sig(&mut ctx, &Value::known(sig))
                         } else {
-                            None
+                            atms_gate
+                                .schnorr_gate
+                                .assign_dummy_sig(&mut ctx)
                         }
                     })
-                    .collect::<Vec<_>>();
+                    .collect::<Result<Vec<_>, Error>>()?;
                 let assigned_pks = self
                     .pks
                     .iter()

prover/docs/signatures/atms/example.md

@@ -69,17 +69,16 @@
                      .iter()
                      .map(|&signature| {
                          if let Some(sig) = signature {
-                             Some(
-                                 atms_gate
-                                     .schnorr_gate
-                                     .assign_sig(&mut ctx, &Value::known(sig))
-                                     .ok()?,
-                             )
+                             atms_gate
+                                 .schnorr_gate
+                                 .assign_sig(&mut ctx, &Value::known(sig))
                          } else {
-                             None
+                             atms_gate
+                                 .schnorr_gate
+                                 .assign_dummy_sig(&mut ctx)
                          }
                      })
-                     .collect::<Vec<_>>();
+                     .collect::<Result<Vec<_>, Error>>()?;
                  let assigned_pks = self
                      .pks
                      .iter()

prover/docs/signatures/atms/gate-verifier.md

@@ -1,7 +1,8 @@
 **Input:**
-- A list of signatures: `&[Option<AssignedSchnorrSignature>]`
+- A list of signatures: `&[AssignedSchnorrSignature]`
     - Collect [Schnorr signatures][AssignedSchnorrSignature].
-    - Use `Option`, because there might not be a signature for every index, but we want them to be 'indexed' in agreement with the public keys.
+    - All positions must contain a signature (either valid or dummy).
+    - Dummy signatures should be assigned for parties that did not sign to maintain circuit structure consistency.
 - A list of public keys: `&[AssignedEccPoint]`
     - Public keys of all the eligible parties even if they do not participate.
     - Public keys are [Assigned ECC points][AssignedEccPoint].
@@ -13,9 +14,10 @@
 
 **Goal of the Circuit:**
 - Verify that for the given message and public keys
-    - There are exactly a threshold amount of valid signatures
+    - There are at least a threshold amount of valid signatures
     - Given list of public keys pertain the committed public key.
-- Note that the proof must include only threshold-many valid signatures even if the prover has more valid signatures.
+- Note that the circuit verifies all signatures (including dummy ones) and counts only the valid ones.
+- The circuit ensures that at some point during iteration, the count of valid signatures reaches the threshold.
 
 **Algorithm:**
 1. Check whether given list of public keys actually produce the committed public key:
@@ -37,33 +39,57 @@
         .main_gate
         .assert_equal(ctx, &hashed_pks, commited_pks)?;
     ```
-2. Count the valid signatures.
+2. Count valid signatures and check if threshold is reached.
     * Initialize a counter and set it to `0`,
-    * Iterate through the signatures and public keys,
-    * Verify each signature with respect to the related public key and the given message,
-    * Increase the counter by `1` for each valid signature.
+    * Initialize a flag `is_enough_sigs` and set it to `0` (false),
+    * Iterate through ALL signatures and public keys (including dummy signatures),
+    * For each signature:
+        - Verify the signature with respect to the related public key and the given message,
+        - If verification succeeds, the signature contributes `1` to the counter; if it fails (dummy signature), it contributes `0`,
+        - Add the verification result to the counter,
+        - Check if `counter == threshold`,
+        - Update `is_enough_sigs` to be `is_enough_sigs OR (counter == threshold)`,
+    * After the loop, assert that `is_enough_sigs == 1`.
     ```ignore
     let mut counter = self
         .schnorr_gate
         .ecc_gate
         .main_gate
         .assign_constant(ctx, Base::ZERO)?;
 
+    let mut is_enough_sigs = self
+        .schnorr_gate
+        .ecc_gate
+        .main_gate
+        .assign_constant(ctx, Base::ZERO)?;
+
     for (sig, pk) in signatures.iter().zip(pks.iter()) {
-        if let Some(signature) = sig {
-            self.schnorr_gate.verify(ctx, signature, pk, msg)?;
-            counter = self.schnorr_gate.ecc_gate.main_gate.add_constant(
-                ctx,
-                &counter,
-                Base::one(),
-            )?;
-        }
+        // Verify signature - returns 1 if valid, 0 if invalid (dummy)
+        let is_verified = self.schnorr_gate.verify(ctx, &sig, pk, msg)?;
+
+        // Add verification result to counter
+        counter = self.schnorr_gate.ecc_gate.main_gate.add(ctx, &counter, &is_verified)?;
+
+        // Check if we've reached the threshold
+        let is_threshold_reached = self.schnorr_gate.ecc_gate.main_gate.is_equal(ctx, &counter, threshold)?;
+
+        // Update flag: once true, stays true (OR preserves the state)
+        is_enough_sigs = self.schnorr_gate.ecc_gate.main_gate.or(ctx, &is_threshold_reached, &is_enough_sigs)?;
     }
+
+    // Assert that we reached the threshold at some point
+    self.schnorr_gate
+        .ecc_gate
+        .main_gate
+        .assert_equal_to_constant(ctx, &is_enough_sigs, Base::ONE)?;
     ```
-3. Check if the resulting count and the given threshold are equal.
-```ignore
-self.schnorr_gate
-    .ecc_gate
-    .main_gate
-    .assert_equal(ctx, &counter, threshold)?;
-```
+
+    **Possible Optimizations:**
+
+    1. **Verify only threshold-many signatures (instead of all N)**
+       - Use lookup tables to match signatures to public keys, reducing verifications from N to threshold.
+       - Postponed because it increases verification cost (critical for on-chain verification).
+
+    2. **Single comparison of the counter at the end: `assert_greater(counter, threshold)`**
+       - Replace N equality checks and N OR operations with one comparison.
+       - `assert_greater` is not implemented yet, requires range proofs and bit decomposition.

prover/src/ecc/chip.rs

@@ -197,6 +197,14 @@ pub trait EccInstructions<C: AffinePoint>: Chip<C::Base> + Clone + Debug {
         b: &Self::Point,
     ) -> Result<(), Error>;
 
+    /// Returns `1` if point `a` is equal in value to point `b`, otherwise `0`.
+    fn is_equal(
+        &self,
+        ctx: &mut RegionCtx<'_, JubjubBase>,
+        a: &Self::Point,
+        b: &Self::Point,
+    ) -> Result<AssignedCondition<JubjubBase>, Error>;
+
     /// Witnesses the given point as a private input to the circuit.
     /// This allows the point to be the identity, mapped to (0, 0) in
     /// affine coordinates.
@@ -308,6 +316,19 @@ impl EccInstructions<JubjubAffine> for EccChip {
         Ok(())
     }
 
+    fn is_equal(
+        &self,
+        ctx: &mut RegionCtx<'_, JubjubBase>,
+        a: &Self::Point,
+        b: &Self::Point,
+    ) -> Result<AssignedCondition<JubjubBase>, Error> {
+        let x_is_equal = self.main_gate.is_equal(ctx, &a.x, &b.x)?;
+        let y_is_equal = self.main_gate.is_equal(ctx, &a.y, &b.y)?;
+        let both_equal = self.main_gate.and(ctx, &x_is_equal, &y_is_equal)?;
+
+        Ok(both_equal)
+    }
+
     fn witness_point(
         &self,
         ctx: &mut RegionCtx<'_, JubjubBase>,