You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/zkEVM/concepts/circom-intro-brief.md
+13-13Lines changed: 13 additions & 13 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,37 +1,37 @@
1
1
!!!info
2
2
In this document, we describe the CIRCOM component of the zkProver. It is one of the four main components of the zkProver, as outlined [here](../architecture/zkprover/index.md). These principal components are; the Executor or Main SM, STARK Recursion, CIRCOM, and Rapid SNARK.
3
3
4
-
You may refer to the original [CIRCOM research paper](https://www.techrxiv.org/articles/preprint/CIRCOM_A_Robust_and_Scalable_Language_for_Building_Complex_Zero-Knowledge_Circuits/19374986/1) for more details.
4
+
You may refer to the original [CIRCOM paper](https://www.techrxiv.org/articles/preprint/CIRCOM_A_Robust_and_Scalable_Language_for_Building_Complex_Zero-Knowledge_Circuits/19374986/1) for more details.
5
5
6
-
As seen in the [zkProver Overview](../architecture/zkprover/index.md) document, the output of the STARK Recursion component is a STARK proof.
6
+
As seen in the [zkProver overview](../architecture/zkprover/index.md) document, the output of the STARK recursion component is a STARK proof.
7
7
8
8
The next step in the zkProver's process of providing validity proof is to produce the witness similar to the output of the STARK Recursion.
9
9
10
10
Although the zkProver is designed as a state machine emulating the EVM, in order to generate this witness, it makes use of a tool based on the Arithmetic circuits model, called CIRCOM.
11
11
12
12
CIRCOM takes the output of the STARK Recursion as input, so as to create its corresponding witness.
13
13
14
-
The witness is in turn taken as input to the Rapid SNARK, which is used to generate a SNARK proof published as the validity proof.
14
+
The witness is in turn taken as an input to the Rapid SNARK, which is used to generate a SNARK proof published as the validity proof.
15
15
16
16

17
17
18
-
In fact, CIRCOM takes a STARK proof as input and produces its corresponding Arithmetic circuit, expressed as the equivalent set of equations called Rank-1 Constraint System (R1CS).
18
+
In fact, CIRCOM takes a STARK proof as input and produces its corresponding Arithmetic circuit, expressed as the equivalent set of equations called rank-1 constraint system (R1CS).
19
19
20
20
The set of valid circuit input, intermediate and output values satisfying the R1CS is actually the witness related to the input STARK proof.
21
21
22
-
This document focuses on what CIRCOM is, its common context of implementation, and how the zkProver utilizes CIRCOM.
22
+
This document focuses on what CIRCOM is, its common implementation context, and how the zkProver utilizes CIRCOM.
23
23
24
24
## Circuit context
25
25
26
26
Arithmetic circuits are mostly used as standard models for studying the complexity of computations.
27
27
28
28
An Arithmetic circuit is composed of addition and multiplication gates, and wires that carry values that are elements of a prime finite field $\mathbb{F}_p$, where $p$ is typically a very large prime number.
29
29
30
-
In the context of ZK-Proof protocols, a prover can use an Arithmetic circuit to prove knowledge of a valid assignment to all wires of the circuit.
30
+
In the context of ZK-proof protocols, a prover can use an Arithmetic circuit to prove knowledge of a valid assignment to all wires of the circuit.
31
31
32
32
And if the proof is correct, the verifier is convinced that the computation expressed as the Arithmetic circuit is valid, but learns nothing about the wires’ assigned values.
33
33
34
-
Arithmetic circuits are commonly encoded in the form of a set of equations called Rank-1 Constraint System (R1CS).
34
+
Arithmetic circuits are commonly encoded in the form of R1CS.
35
35
36
36
Once obtained, the R1CS can later be used by a zk-SNARK protocol to generate verifiable proof.
37
37
@@ -43,7 +43,7 @@ CIRCOM was developed for the very purpose of scaling complex Arithmetic circuits
43
43
44
44
## What is CIRCOM?
45
45
46
-
CIRCOM is a Domain-Specific Language (DSL) used to define Arithmetic circuits, and it has an associated compiler of Arithmetic circuits to their respective Rank-1 Constraint System (or R1CS).
46
+
CIRCOM is a domain-specific language (DSL) used to define Arithmetic circuits, and it has an associated compiler of Arithmetic circuits to their respective R1CS.
@@ -53,9 +53,9 @@ As described in the title of its [specifications paper](https://www.techrxiv.org
53
53
54
54
It is designed as a low-level circuit language, mimicking the design of electronic circuits, for naturally defining Arithmetic circuits.
55
55
56
-
As a Domain-Specific Language (DSL), it allows programmers to design and create Arithmetic circuits of their own choice, and later on apply these circuits to ZK tools.
56
+
As a DSL, it allows programmers to design and create Arithmetic circuits of their own choice, and later on apply these circuits to ZK tools.
57
57
58
-
One of the main peculiarities of CIRCOM is its modularity as a language. It allows the definition of parameterizable small circuits called templates, which can be instantiated to form part of larger circuits.
58
+
One of the main peculiarities of CIRCOM is its modularity as a language. It allows the definition of parameterizable small circuits called _templates_, which can be instantiated to form part of larger circuits.
59
59
60
60
In this regard, CIRCOM users can use templates to create their own custom circuits with varied complexity.
61
61
@@ -86,7 +86,7 @@ $$
86
86
\texttt{a} \times \texttt{b} \texttt{ - c = 0}
87
87
$$
88
88
89
-
### The _pragma_ instruction
89
+
### The pragma instruction
90
90
91
91
The _pragma_ instruction specifies the version of the CIRCOM compiler being used. It is meant to ensure compatibility between the circuit and the compiler version. If the two are incompatible, the compiler throws a warning.
92
92
@@ -179,7 +179,7 @@ Given a circuit with the _multiplier.circom_ extension, the following line of co
179
179
circom multiplier.circom --r1cs --c --wasm --sym
180
180
```
181
181
182
-
After compiling the _.circom_ circuit, the compiler returns four files:
182
+
After compiling the _.circom_ circuit, the compiler returns four files,
183
183
184
184
- A file with the R1CS constraints (symbolic task)
185
185
- A C++ program for computing values of the circuit wires (computational task)
@@ -188,7 +188,7 @@ After compiling the _.circom_ circuit, the compiler returns four files:
188
188
189
189
At this stage, either one of the C++ or WebAssembly programs generated by the compiler can be used to compute all signals that match the set of constraints of the circuit.
190
190
191
-
Whichever program is used, needs as input, a file containing a set of valid input values.
191
+
Whichever program is used, needs as input a file containing a set of valid input values.
192
192
193
193
Recall that a valid set of circuit input, intermediate and output values is called the witness.
0 commit comments