Auto merge of #994 - ebfull:remove-redundant-constraints, r=ebfull

Final changes to the circuit

* Remove [redundant](https://github.com/scipr-lab/libsnark/issues/37) bitness constraints that I pointed out in #908.
* The depth is increased from 20 to 29. I chose 29 because the QAP degree ends up being a power of two, which is probably going to be useful for the FFT in our MPC. (Closes #16)

If we're happy with depth 29 (over 268 million possible joinsplits), this will probably be the final change to the constraint system before 1.0.

src/gtest/test_merkletree.cpp

@@ -256,7 +256,7 @@ TEST(merkletree, emptyroot) {
     // This literal is the depth-20 empty tree root with the bytes reversed to
     // account for the fact that uint256S() loads a big-endian representation of
     // an integer which converted to little-endian internally.
-    uint256 expected = uint256S("6af0c4cedfb34a98469ecb5af4909116c77e05a6095c4c4b4f44f30b85f22303");
+    uint256 expected = uint256S("59d2cde5e65c1414c32ba54f0fe4bdb3d67618125286e6a191317917c812c6d7");
 
     ASSERT_TRUE(ZCIncrementalMerkleTree::empty_root() == expected);
 }

src/init.cpp

@@ -603,8 +603,8 @@ static void ZC_LoadParams()
     struct timeval tv_start, tv_end;
     float elapsed;
 
-    boost::filesystem::path pk_path = ZC_GetParamsDir() / "z4-proving.key";
-    boost::filesystem::path vk_path = ZC_GetParamsDir() / "z4-verification.key";
+    boost::filesystem::path pk_path = ZC_GetParamsDir() / "z5-proving.key";
+    boost::filesystem::path vk_path = ZC_GetParamsDir() / "z5-verifying.key";
 
     pzcashParams = ZCJoinSplit::Unopened();
 

src/zcash/Zcash.h

@@ -3,7 +3,7 @@
 
 #define ZC_NUM_JS_INPUTS 2
 #define ZC_NUM_JS_OUTPUTS 2
-#define INCREMENTAL_MERKLE_TREE_DEPTH 20
+#define INCREMENTAL_MERKLE_TREE_DEPTH 29
 #define INCREMENTAL_MERKLE_TREE_DEPTH_TESTING 4
 
 #define ZC_NOTEPLAINTEXT_LEADING 1

src/zcash/circuit/commitment.tcc

@@ -89,10 +89,6 @@ public:
     }
 
     void generate_r1cs_constraints() {
-        // TODO: This may not be necessary if SHA256 constrains
-        // its output digests to be boolean anyway.
-        intermediate_hash->generate_r1cs_constraints();
-
         hasher1->generate_r1cs_constraints();
         hasher2->generate_r1cs_constraints();
     }

src/zcash/circuit/note.tcc

@@ -96,11 +96,6 @@ public:
         a_sk->generate_r1cs_constraints();
         rho->generate_r1cs_constraints();
 
-        // TODO: These constraints may not be necessary if SHA256
-        // already boolean constrains its outputs.
-        a_pk->generate_r1cs_constraints();
-        commitment->generate_r1cs_constraints();
-
         spend_authority->generate_r1cs_constraints();
         expose_nullifiers->generate_r1cs_constraints();
 
@@ -222,10 +217,6 @@ public:
 
         a_pk->generate_r1cs_constraints();
 
-        // TODO: This constraint may not be necessary if SHA256
-        // already boolean constrains its outputs.
-        rho->generate_r1cs_constraints();
-
         prevent_faerie_gold->generate_r1cs_constraints();
 
         commit_to_outputs->generate_r1cs_constraints();

src/zcbenchmarks.cpp

@@ -44,8 +44,8 @@ double benchmark_sleep()
 double benchmark_parameter_loading()
 {
     // FIXME: this is duplicated with the actual loading code
-    boost::filesystem::path pk_path = ZC_GetParamsDir() / "z4-proving.key";
-    boost::filesystem::path vk_path = ZC_GetParamsDir() / "z4-verification.key";
+    boost::filesystem::path pk_path = ZC_GetParamsDir() / "z5-proving.key";
+    boost::filesystem::path vk_path = ZC_GetParamsDir() / "z5-verifying.key";
 
     timer_start();