Add 'bellman/' from commit '10c5010fd9c2ca69442dc9775ea271e286e776d8'

git-subtree-dir: bellman
git-subtree-mainline: e924247e73
git-subtree-split: 10c5010fd9

bellman/src/groth16/tests/dummy_engine.rs

@@ -0,0 +1,451 @@
+use pairing::{
+    Engine,
+    PrimeField,
+    PrimeFieldRepr,
+    Field,
+    SqrtField,
+    LegendreSymbol,
+    CurveProjective,
+    CurveAffine,
+    PrimeFieldDecodingError,
+    GroupDecodingError,
+    EncodedPoint
+};
+
+use std::cmp::Ordering;
+use std::fmt;
+use rand::{Rand, Rng};
+use std::num::Wrapping;
+
+const MODULUS_R: Wrapping<u32> = Wrapping(64513);
+
+#[derive(Copy, Clone, Debug, PartialEq, Eq)]
+pub struct Fr(Wrapping<u32>);
+
+impl fmt::Display for Fr {
+    fn fmt(&self, f: &mut fmt::Formatter) -> Result<(), fmt::Error> {
+        write!(f, "{}", (self.0).0)
+    }
+}
+
+impl Rand for Fr {
+    fn rand<R: Rng>(rng: &mut R) -> Self {
+        Fr(Wrapping(rng.gen()) % MODULUS_R)
+    }
+}
+
+impl Field for Fr {
+    fn zero() -> Self {
+        Fr(Wrapping(0))
+    }
+
+    fn one() -> Self {
+        Fr(Wrapping(1))
+    }
+
+    fn is_zero(&self) -> bool {
+        (self.0).0 == 0
+    }
+
+    fn square(&mut self) {
+        self.0 = (self.0 * self.0) % MODULUS_R;
+    }
+
+    fn double(&mut self) {
+        self.0 = (self.0 << 1) % MODULUS_R;
+    }
+
+    fn negate(&mut self) {
+        if !<Fr as Field>::is_zero(self) {
+            self.0 = MODULUS_R - self.0;
+        }
+    }
+
+    fn add_assign(&mut self, other: &Self) {
+        self.0 = (self.0 + other.0) % MODULUS_R;
+    }
+
+    fn sub_assign(&mut self, other: &Self) {
+        self.0 = ((MODULUS_R + self.0) - other.0) % MODULUS_R;
+    }
+
+    fn mul_assign(&mut self, other: &Self) {
+        self.0 = (self.0 * other.0) % MODULUS_R;
+    }
+
+    fn inverse(&self) -> Option<Self> {
+        if <Fr as Field>::is_zero(self) {
+            None
+        } else {
+            Some(self.pow(&[(MODULUS_R.0 as u64) - 2]))
+        }
+    }
+
+    fn frobenius_map(&mut self, _: usize) {
+        // identity
+    }
+}
+
+impl SqrtField for Fr {
+    fn legendre(&self) -> LegendreSymbol {
+        // s = self^((r - 1) // 2)
+        let s = self.pow([32256]);
+        if s == <Fr as Field>::zero() { LegendreSymbol::Zero }
+        else if s == <Fr as Field>::one() { LegendreSymbol::QuadraticResidue }
+        else { LegendreSymbol::QuadraticNonResidue }
+    }
+
+    fn sqrt(&self) -> Option<Self> {
+        // Tonelli-Shank's algorithm for q mod 16 = 1
+        // https://eprint.iacr.org/2012/685.pdf (page 12, algorithm 5)
+        match self.legendre() {
+            LegendreSymbol::Zero => Some(*self),
+            LegendreSymbol::QuadraticNonResidue => None,
+            LegendreSymbol::QuadraticResidue => {
+                let mut c = Fr::root_of_unity();
+                // r = self^((t + 1) // 2)
+                let mut r = self.pow([32]);
+                // t = self^t
+                let mut t = self.pow([63]);
+                let mut m = Fr::S;
+
+                while t != <Fr as Field>::one() {
+                let mut i = 1;
+                    {
+                        let mut t2i = t;
+                        t2i.square();
+                        loop {
+                            if t2i == <Fr as Field>::one() {
+                                break;
+                            }
+                            t2i.square();
+                            i += 1;
+                        }
+                    }
+
+                    for _ in 0..(m - i - 1) {
+                        c.square();
+                    }
+                    <Fr as Field>::mul_assign(&mut r, &c);
+                    c.square();
+                    <Fr as Field>::mul_assign(&mut t, &c);
+                    m = i;
+                }
+
+                Some(r)
+            }
+        }
+    }
+}
+
+#[derive(Copy, Clone, Debug, Eq, PartialEq)]
+pub struct FrRepr([u64; 1]);
+
+impl Ord for FrRepr {
+    fn cmp(&self, other: &FrRepr) -> Ordering {
+        (self.0)[0].cmp(&(other.0)[0])
+    }
+}
+
+impl PartialOrd for FrRepr {
+    fn partial_cmp(&self, other: &FrRepr) -> Option<Ordering> {
+        Some(self.cmp(other))
+    }
+}
+
+impl Rand for FrRepr {
+    fn rand<R: Rng>(rng: &mut R) -> Self {
+        FrRepr([rng.gen()])
+    }
+}
+
+impl fmt::Display for FrRepr {
+    fn fmt(&self, f: &mut fmt::Formatter) -> Result<(), fmt::Error> {
+        write!(f, "{}", (self.0)[0])
+    }
+}
+
+impl From<u64> for FrRepr {
+    fn from(v: u64) -> FrRepr {
+        FrRepr([v])
+    }
+}
+
+impl From<Fr> for FrRepr {
+    fn from(v: Fr) -> FrRepr {
+        FrRepr([(v.0).0 as u64])
+    }
+}
+
+impl AsMut<[u64]> for FrRepr {
+    fn as_mut(&mut self) -> &mut [u64] {
+        &mut self.0[..]
+    }
+}
+
+impl AsRef<[u64]> for FrRepr {
+    fn as_ref(&self) -> &[u64] {
+        &self.0[..]
+    }
+}
+
+impl Default for FrRepr {
+    fn default() -> FrRepr {
+        FrRepr::from(0u64)
+    }
+}
+
+impl PrimeFieldRepr for FrRepr {
+    fn sub_noborrow(&mut self, other: &Self) {
+        self.0[0] = self.0[0].wrapping_sub(other.0[0]);
+    }
+    fn add_nocarry(&mut self, other: &Self) {
+        self.0[0] = self.0[0].wrapping_add(other.0[0]);
+    }
+    fn num_bits(&self) -> u32 {
+        64 - self.0[0].leading_zeros()
+    }
+    fn is_zero(&self) -> bool {
+        self.0[0] == 0
+    }
+    fn is_odd(&self) -> bool {
+        !self.is_even()
+    }
+    fn is_even(&self) -> bool {
+        self.0[0] % 2 == 0
+    }
+    fn div2(&mut self) {
+        self.shr(1)
+    }
+    fn shr(&mut self, amt: u32) {
+        self.0[0] >>= amt;
+    }
+    fn mul2(&mut self) {
+        self.shl(1)
+    }
+    fn shl(&mut self, amt: u32) {
+        self.0[0] <<= amt;
+    }
+}
+
+impl PrimeField for Fr {
+    type Repr = FrRepr;
+
+    const NUM_BITS: u32 = 16;
+    const CAPACITY: u32 = 15;
+    const S: u32 = 10;
+
+    fn from_repr(repr: FrRepr) -> Result<Self, PrimeFieldDecodingError> {
+        if repr.0[0] >= (MODULUS_R.0 as u64) {
+            Err(PrimeFieldDecodingError::NotInField(format!("{}", repr)))
+        } else {
+            Ok(Fr(Wrapping(repr.0[0] as u32)))
+        }
+    }
+
+    fn into_repr(&self) -> FrRepr {
+        FrRepr::from(*self)
+    }
+
+    fn char() -> FrRepr {
+        Fr(MODULUS_R).into()
+    }
+
+    fn multiplicative_generator() -> Fr {
+        Fr(Wrapping(5))
+    }
+
+    fn root_of_unity() -> Fr {
+        Fr(Wrapping(57751))
+    }
+}
+
+#[derive(Clone)]
+pub struct DummyEngine;
+
+impl Engine for DummyEngine {
+    type Fr = Fr;
+    type G1 = Fr;
+    type G1Affine = Fr;
+    type G2 = Fr;
+    type G2Affine = Fr;
+    type Fq = Fr;
+    type Fqe = Fr;
+    
+    // TODO: This should be F_645131 or something. Doesn't matter for now.
+    type Fqk = Fr;
+
+    fn miller_loop<'a, I>(i: I) -> Self::Fqk
+        where I: IntoIterator<Item=&'a (
+                                    &'a <Self::G1Affine as CurveAffine>::Prepared,
+                                    &'a <Self::G2Affine as CurveAffine>::Prepared
+                               )>
+    {
+        let mut acc = <Fr as Field>::zero();
+
+        for &(a, b) in i {
+            let mut tmp = *a;
+            <Fr as Field>::mul_assign(&mut tmp, b);
+            <Fr as Field>::add_assign(&mut acc, &tmp);
+        }
+
+        acc
+    }
+
+    /// Perform final exponentiation of the result of a miller loop.
+    fn final_exponentiation(this: &Self::Fqk) -> Option<Self::Fqk>
+    {
+        Some(*this)
+    }
+}
+
+impl CurveProjective for Fr {
+    type Affine = Fr;
+    type Base = Fr;
+    type Scalar = Fr;
+    type Engine = DummyEngine;
+
+    fn zero() -> Self {
+        <Fr as Field>::zero()
+    }
+
+    fn one() -> Self {
+        <Fr as Field>::one()
+    }
+
+    fn is_zero(&self) -> bool {
+        <Fr as Field>::is_zero(self)
+    }
+
+    fn batch_normalization(_: &mut [Self]) {
+        
+    }
+
+    fn is_normalized(&self) -> bool {
+        true
+    }
+
+    fn double(&mut self) {
+        <Fr as Field>::double(self);
+    }
+
+    fn add_assign(&mut self, other: &Self) {
+        <Fr as Field>::add_assign(self, other);
+    }
+
+    fn add_assign_mixed(&mut self, other: &Self) {
+        <Fr as Field>::add_assign(self, other);
+    }
+
+    fn negate(&mut self) {
+        <Fr as Field>::negate(self);
+    }
+
+    fn mul_assign<S: Into<<Self::Scalar as PrimeField>::Repr>>(&mut self, other: S)
+    {
+        let tmp = Fr::from_repr(other.into()).unwrap();
+
+        <Fr as Field>::mul_assign(self, &tmp);
+    }
+
+    fn into_affine(&self) -> Fr {
+        *self
+    }
+
+    fn recommended_wnaf_for_scalar(_: <Self::Scalar as PrimeField>::Repr) -> usize {
+        3
+    }
+
+    fn recommended_wnaf_for_num_scalars(_: usize) -> usize {
+        3
+    }
+}
+
+#[derive(Copy, Clone)]
+pub struct FakePoint;
+
+impl AsMut<[u8]> for FakePoint {
+    fn as_mut(&mut self) -> &mut [u8] {
+        unimplemented!()
+    }
+}
+
+impl AsRef<[u8]> for FakePoint {
+    fn as_ref(&self) -> &[u8] {
+        unimplemented!()
+    }
+}
+
+impl EncodedPoint for FakePoint {
+    type Affine = Fr;
+
+    fn empty() -> Self {
+        unimplemented!()
+    }
+
+    fn size() -> usize {
+        unimplemented!()
+    }
+
+    fn into_affine(&self) -> Result<Self::Affine, GroupDecodingError> {
+        unimplemented!()
+    }
+
+    fn into_affine_unchecked(&self) -> Result<Self::Affine, GroupDecodingError> {
+        unimplemented!()
+    }
+
+    fn from_affine(_: Self::Affine) -> Self {
+        unimplemented!()
+    }
+}
+
+impl CurveAffine for Fr {
+    type Pair = Fr;
+    type PairingResult = Fr;
+    type Compressed = FakePoint;
+    type Uncompressed = FakePoint;
+    type Prepared = Fr;
+    type Projective = Fr;
+    type Base = Fr;
+    type Scalar = Fr;
+    type Engine = DummyEngine;
+
+    fn zero() -> Self {
+        <Fr as Field>::zero()
+    }
+
+    fn one() -> Self {
+        <Fr as Field>::one()
+    }
+
+    fn is_zero(&self) -> bool {
+        <Fr as Field>::is_zero(self)
+    }
+
+    fn negate(&mut self) {
+        <Fr as Field>::negate(self);
+    }
+
+    fn mul<S: Into<<Self::Scalar as PrimeField>::Repr>>(&self, other: S) -> Self::Projective
+    {
+        let mut res = *self;
+        let tmp = Fr::from_repr(other.into()).unwrap();
+
+        <Fr as Field>::mul_assign(&mut res, &tmp);
+
+        res
+    }
+
+    fn prepare(&self) -> Self::Prepared {
+        *self
+    }
+
+    fn pairing_with(&self, other: &Self::Pair) -> Self::PairingResult {
+        self.mul(*other)
+    }
+
+    fn into_projective(&self) -> Self::Projective {
+        *self
+    }
+}

bellman/src/groth16/tests/mod.rs

@@ -0,0 +1,400 @@
+use pairing::{
+    Engine,
+    Field,
+    PrimeField
+};
+
+mod dummy_engine;
+use self::dummy_engine::*;
+
+use std::marker::PhantomData;
+
+use ::{
+    Circuit,
+    ConstraintSystem,
+    SynthesisError
+};
+
+use super::{
+    generate_parameters,
+    prepare_verifying_key,
+    create_proof,
+    verify_proof
+};
+
+struct XORDemo<E: Engine> {
+    a: Option<bool>,
+    b: Option<bool>,
+    _marker: PhantomData<E>
+}
+
+impl<E: Engine> Circuit<E> for XORDemo<E> {
+    fn synthesize<CS: ConstraintSystem<E>>(
+        self,
+        cs: &mut CS
+    ) -> Result<(), SynthesisError>
+    {
+        let a_var = cs.alloc(|| "a", || {
+            if self.a.is_some() {
+                if self.a.unwrap() {
+                    Ok(E::Fr::one())
+                } else {
+                    Ok(E::Fr::zero())
+                }
+            } else {
+                Err(SynthesisError::AssignmentMissing)
+            }
+        })?;
+
+        cs.enforce(
+            || "a_boolean_constraint",
+            |lc| lc + CS::one() - a_var,
+            |lc| lc + a_var,
+            |lc| lc
+        );
+
+        let b_var = cs.alloc(|| "b", || {
+            if self.b.is_some() {
+                if self.b.unwrap() {
+                    Ok(E::Fr::one())
+                } else {
+                    Ok(E::Fr::zero())
+                }
+            } else {
+                Err(SynthesisError::AssignmentMissing)
+            }
+        })?;
+
+        cs.enforce(
+            || "b_boolean_constraint",
+            |lc| lc + CS::one() - b_var,
+            |lc| lc + b_var,
+            |lc| lc
+        );
+
+        let c_var = cs.alloc_input(|| "c", || {
+            if self.a.is_some() && self.b.is_some() {
+                if self.a.unwrap() ^ self.b.unwrap() {
+                    Ok(E::Fr::one())
+                } else {
+                    Ok(E::Fr::zero())
+                }
+            } else {
+                Err(SynthesisError::AssignmentMissing)
+            }
+        })?;
+
+        cs.enforce(
+            || "c_xor_constraint",
+            |lc| lc + a_var + a_var,
+            |lc| lc + b_var,
+            |lc| lc + a_var + b_var - c_var
+        );
+
+        Ok(())
+    }
+}
+
+#[test]
+fn test_xordemo() {
+    let g1 = Fr::one();
+    let g2 = Fr::one();
+    let alpha = Fr::from_str("48577").unwrap();
+    let beta = Fr::from_str("22580").unwrap();
+    let gamma = Fr::from_str("53332").unwrap();
+    let delta = Fr::from_str("5481").unwrap();
+    let tau = Fr::from_str("3673").unwrap();
+
+    let params = {
+        let c = XORDemo::<DummyEngine> {
+            a: None,
+            b: None,
+            _marker: PhantomData
+        };
+
+        generate_parameters(
+            c,
+            g1,
+            g2,
+            alpha,
+            beta,
+            gamma,
+            delta,
+            tau
+        ).unwrap()
+    };
+
+    // This will synthesize the constraint system:
+    //
+    // public inputs: a_0 = 1, a_1 = c
+    // aux inputs: a_2 = a, a_3 = b
+    // constraints:
+    //     (a_0 - a_2) * (a_2) = 0
+    //     (a_0 - a_3) * (a_3) = 0
+    //     (a_2 + a_2) * (a_3) = (a_2 + a_3 - a_1)
+    //     (a_0) * 0 = 0
+    //     (a_1) * 0 = 0
+
+    // The evaluation domain is 8. The H query should
+    // have 7 elements (it's a quotient polynomial)
+    assert_eq!(7, params.h.len());
+
+    let mut root_of_unity = Fr::root_of_unity();
+
+    // We expect this to be a 2^10 root of unity
+    assert_eq!(Fr::one(), root_of_unity.pow(&[1 << 10]));
+
+    // Let's turn it into a 2^3 root of unity.
+    root_of_unity = root_of_unity.pow(&[1 << 7]);
+    assert_eq!(Fr::one(), root_of_unity.pow(&[1 << 3]));
+    assert_eq!(Fr::from_str("20201").unwrap(), root_of_unity);
+
+    // Let's compute all the points in our evaluation domain.
+    let mut points = Vec::with_capacity(8);
+    for i in 0..8 {
+        points.push(root_of_unity.pow(&[i]));
+    }
+
+    // Let's compute t(tau) = (tau - p_0)(tau - p_1)...
+    //                      = tau^8 - 1
+    let mut t_at_tau = tau.pow(&[8]);
+    t_at_tau.sub_assign(&Fr::one());
+    {
+        let mut tmp = Fr::one();
+        for p in &points {
+            let mut term = tau;
+            term.sub_assign(p);
+            tmp.mul_assign(&term);
+        }
+        assert_eq!(tmp, t_at_tau);
+    }
+
+    // We expect our H query to be 7 elements of the form...
+    // {tau^i t(tau) / delta}
+    let delta_inverse = delta.inverse().unwrap();
+    let gamma_inverse = gamma.inverse().unwrap();
+    {
+        let mut coeff = delta_inverse;
+        coeff.mul_assign(&t_at_tau);
+
+        let mut cur = Fr::one();
+        for h in params.h.iter() {
+            let mut tmp = cur;
+            tmp.mul_assign(&coeff);
+
+            assert_eq!(*h, tmp);
+
+            cur.mul_assign(&tau);
+        }
+    }
+
+    // The density of the IC query is 2 (2 inputs)
+    assert_eq!(2, params.vk.ic.len());
+
+    // The density of the L query is 2 (2 aux variables)
+    assert_eq!(2, params.l.len());
+
+    // The density of the A query is 4 (each variable is in at least one A term)
+    assert_eq!(4, params.a.len());
+
+    // The density of the B query is 2 (two variables are in at least one B term)
+    assert_eq!(2, params.b_g1.len());
+    assert_eq!(2, params.b_g2.len());
+
+    /*
+    Lagrange interpolation polynomials in our evaluation domain:
+
+    ,-------------------------------. ,-------------------------------. ,-------------------------------.
+    |            A TERM             | |            B TERM             | |            C TERM             |
+    `-------------------------------. `-------------------------------' `-------------------------------'
+    | a_0   | a_1   | a_2   | a_3   | | a_0   | a_1   | a_2   | a_3   | | a_0   | a_1   | a_2   | a_3   |
+    | 1     | 0     | 64512 | 0     | | 0     | 0     | 1     | 0     | | 0     | 0     | 0     | 0     |
+    | 1     | 0     | 0     | 64512 | | 0     | 0     | 0     | 1     | | 0     | 0     | 0     | 0     |
+    | 0     | 0     | 2     | 0     | | 0     | 0     | 0     | 1     | | 0     | 64512 | 1     | 1     |
+    | 1     | 0     | 0     | 0     | | 0     | 0     | 0     | 0     | | 0     | 0     | 0     | 0     |
+    | 0     | 1     | 0     | 0     | | 0     | 0     | 0     | 0     | | 0     | 0     | 0     | 0     |
+    `-------'-------'-------'-------' `-------'-------'-------'-------' `-------'-------'-------'-------'
+
+    Example for u_0:
+
+    sage: r = 64513
+    sage: Fr = GF(r)
+    sage: omega = (Fr(5)^63)^(2^7)
+    sage: tau = Fr(3673)
+    sage: R.<x> = PolynomialRing(Fr, 'x')
+    sage: def eval(tau, c0, c1, c2, c3, c4):
+    ....:     p = R.lagrange_polynomial([(omega^0, c0), (omega^1, c1), (omega^2, c2), (omega^3, c3), (omega^4, c4), (omega^5, 0), (omega^6, 0), (omega^7, 0)])
+    ....:     return p.substitute(tau)
+    sage: eval(tau, 1, 1, 0, 1, 0)
+    59158
+    */
+
+    let u_i = [59158, 48317, 21767, 10402].iter().map(|e| {
+        Fr::from_str(&format!("{}", e)).unwrap()
+    }).collect::<Vec<Fr>>();
+    let v_i = [0, 0, 60619, 30791].iter().map(|e| {
+        Fr::from_str(&format!("{}", e)).unwrap()
+    }).collect::<Vec<Fr>>();
+    let w_i = [0, 23320, 41193, 41193].iter().map(|e| {
+        Fr::from_str(&format!("{}", e)).unwrap()
+    }).collect::<Vec<Fr>>();
+
+    for (u, a) in u_i.iter()
+                     .zip(&params.a[..])
+    {
+        assert_eq!(u, a);
+    }
+
+    for (v, b) in v_i.iter()
+                     .filter(|&&e| e != Fr::zero())
+                     .zip(&params.b_g1[..])
+    {
+        assert_eq!(v, b);
+    }
+
+    for (v, b) in v_i.iter()
+                     .filter(|&&e| e != Fr::zero())
+                     .zip(&params.b_g2[..])
+    {
+        assert_eq!(v, b);
+    }
+
+    for i in 0..4 {
+        let mut tmp1 = beta;
+        tmp1.mul_assign(&u_i[i]);
+
+        let mut tmp2 = alpha;
+        tmp2.mul_assign(&v_i[i]);
+
+        tmp1.add_assign(&tmp2);
+        tmp1.add_assign(&w_i[i]);
+
+        if i < 2 {
+            // Check the correctness of the IC query elements
+            tmp1.mul_assign(&gamma_inverse);
+
+            assert_eq!(tmp1, params.vk.ic[i]);
+        } else {
+            // Check the correctness of the L query elements
+            tmp1.mul_assign(&delta_inverse);
+
+            assert_eq!(tmp1, params.l[i - 2]);
+        }
+    }
+
+    // Check consistency of the other elements
+    assert_eq!(alpha, params.vk.alpha_g1);
+    assert_eq!(beta, params.vk.beta_g1);
+    assert_eq!(beta, params.vk.beta_g2);
+    assert_eq!(gamma, params.vk.gamma_g2);
+    assert_eq!(delta, params.vk.delta_g1);
+    assert_eq!(delta, params.vk.delta_g2);
+
+    let pvk = prepare_verifying_key(&params.vk);
+
+    let r = Fr::from_str("27134").unwrap();
+    let s = Fr::from_str("17146").unwrap();
+
+    let proof = {
+        let c = XORDemo {
+            a: Some(true),
+            b: Some(false),
+            _marker: PhantomData
+        };
+
+        create_proof(
+            c,
+            &params,
+            r,
+            s
+        ).unwrap()
+    };
+
+    // A(x) =
+    //  a_0 * (44865*x^7 + 56449*x^6 + 44865*x^5 + 8064*x^4 + 3520*x^3 + 56449*x^2 + 3520*x + 40321) +
+    //  a_1 * (8064*x^7 + 56449*x^6 + 8064*x^5 + 56449*x^4 + 8064*x^3 + 56449*x^2 + 8064*x + 56449) +
+    //  a_2 * (16983*x^7 + 24192*x^6 + 63658*x^5 + 56449*x^4 + 16983*x^3 + 24192*x^2 + 63658*x + 56449) +
+    //  a_3 * (5539*x^7 + 27797*x^6 + 6045*x^5 + 56449*x^4 + 58974*x^3 + 36716*x^2 + 58468*x + 8064) +
+    {
+        // proof A = alpha + A(tau) + delta * r
+        let mut expected_a = delta;
+        expected_a.mul_assign(&r);
+        expected_a.add_assign(&alpha);
+        expected_a.add_assign(&u_i[0]); // a_0 = 1
+        expected_a.add_assign(&u_i[1]); // a_1 = 1
+        expected_a.add_assign(&u_i[2]); // a_2 = 1
+        // a_3 = 0
+        assert_eq!(proof.a, expected_a);
+    }
+
+    // B(x) =
+    // a_0 * (0) +
+    // a_1 * (0) +
+    // a_2 * (56449*x^7 + 56449*x^6 + 56449*x^5 + 56449*x^4 + 56449*x^3 + 56449*x^2 + 56449*x + 56449) +
+    // a_3 * (31177*x^7 + 44780*x^6 + 21752*x^5 + 42255*x^3 + 35861*x^2 + 33842*x + 48385)
+    {
+        // proof B = beta + B(tau) + delta * s
+        let mut expected_b = delta;
+        expected_b.mul_assign(&s);
+        expected_b.add_assign(&beta);
+        expected_b.add_assign(&v_i[0]); // a_0 = 1
+        expected_b.add_assign(&v_i[1]); // a_1 = 1
+        expected_b.add_assign(&v_i[2]); // a_2 = 1
+        // a_3 = 0
+        assert_eq!(proof.b, expected_b);
+    }
+
+    // C(x) =
+    // a_0 * (0) +
+    // a_1 * (27797*x^7 + 56449*x^6 + 36716*x^5 + 8064*x^4 + 27797*x^3 + 56449*x^2 + 36716*x + 8064) +
+    // a_2 * (36716*x^7 + 8064*x^6 + 27797*x^5 + 56449*x^4 + 36716*x^3 + 8064*x^2 + 27797*x + 56449) +
+    // a_3 * (36716*x^7 + 8064*x^6 + 27797*x^5 + 56449*x^4 + 36716*x^3 + 8064*x^2 + 27797*x + 56449)
+    //
+    // If A * B = C at each point in the domain, then the following polynomial...
+    // P(x) = A(x) * B(x) - C(x)
+    //      = 49752*x^14 + 13914*x^13 + 29243*x^12 + 27227*x^11 + 62362*x^10 + 35703*x^9 + 4032*x^8 + 14761*x^6 + 50599*x^5 + 35270*x^4 + 37286*x^3 + 2151*x^2 + 28810*x + 60481
+    //
+    // ... should be divisible by t(x), producing the quotient polynomial:
+    // h(x) = P(x) / t(x)
+    //      = 49752*x^6 + 13914*x^5 + 29243*x^4 + 27227*x^3 + 62362*x^2 + 35703*x + 4032
+    {
+        let mut expected_c = Fr::zero();
+
+        // A * s
+        let mut tmp = proof.a;
+        tmp.mul_assign(&s);
+        expected_c.add_assign(&tmp);
+
+        // B * r
+        let mut tmp = proof.b;
+        tmp.mul_assign(&r);
+        expected_c.add_assign(&tmp);
+
+        // delta * r * s
+        let mut tmp = delta;
+        tmp.mul_assign(&r);
+        tmp.mul_assign(&s);
+        expected_c.sub_assign(&tmp);
+
+        // L query answer
+        // a_2 = 1, a_3 = 0
+        expected_c.add_assign(&params.l[0]);
+
+        // H query answer
+        for (i, coeff) in [5040, 11763, 10755, 63633, 128, 9747, 8739].iter().enumerate() {
+            let coeff = Fr::from_str(&format!("{}", coeff)).unwrap();
+
+            let mut tmp = params.h[i];
+            tmp.mul_assign(&coeff);
+            expected_c.add_assign(&tmp);
+        }
+
+        assert_eq!(expected_c, proof.c);
+    }
+
+    assert!(verify_proof(
+        &pvk,
+        &proof,
+        &[Fr::one()]
+    ).unwrap());
+}