Determining if a Constraint is “Necessary” in Zero-Knowledge Proof Circuits

As a beginner in cryptography and Circom, it’s not uncommon to encounter complex concepts like completeness. In zero-knowledge proof (ZKP) circuits, one of the key aspects is determining whether a given constraint or requirement is necessary for the circuit to be correct. But what exactly does this mean? Let’s dive into the world of Circom and explore how to determine if a constraint in an IsZero() circuit is “necessary”.

What is Completeness in ZKP Circuits?

Completeness in zero-knowledge proof circuits refers to the property that given a valid input (i.e., one that satisfies all constraints), the output will be deterministically computable. In other words, if you have access to an arbitrary input and can verify its validity through the constraints enforced by the circuit, you should always obtain a consistent and deterministic output.

The IsZero() Circuit: A Simple Example

Let’s take a look at the IsZero() circuit from Circomlib:

template IsZero() {

  // Define inputs and outputs

  input x;

  output y;


  // Define constraints

  constraint 1: {y = x > 0;};

  constraint 2: {y = y - 1;};


  // Use constraints to generate the output

  if (x > 0 && y >= 2) {

    y = x * y;

  } else {

    return NoCommit;

  }

}

In this example, we have two constraints:

• constraint 1: If $y$ is greater than 0, then $y – 1$ must be equal to some number.

• constraint 2: If $y$ is not greater than 0 (i.e., it’s less than or equal to 0), then $y$ must be equal to 1.

Determining if a Constraint is “Necessary”

To determine if a constraint is necessary, we need to consider the following:

• Completeness: Can we obtain a consistent and deterministic output by verifying any input? (We already verified this in IsZero(), which returns y for valid inputs.)

• Correctness

  : Does the circuit produce the correct output given all constraints?

For constraint 1, if we verify that $x > 0$ and $y \geq 2$, we can ensure that $y – 1 = x(y-1)$ holds. However, this constraint is not necessary because there are many possible values ​​of $y$ that satisfy the output.

In particular, consider an input where $x = 0$. Then $y = 0(0-1) \equiv 1 \pmod{2}$. The circuit would still produce a valid output y, but it is not deterministically computable because there are infinitely many possible values ​​of $y$ that satisfy the constraint.

Conclusion

In conclusion, determining if a constraint in an IsZero() circuit is “necessary” requires considering both completeness and correctness. If a constraint does not guarantee a deterministic output for all valid inputs, it may be necessary to include additional constraints or modify existing ones to achieve this goal.

By analyzing the IsZero() circuit and applying these principles, you can gain insight into when constraints are necessary in zero-knowledge proof circuits like IsZero(). Remember, completeness and correctness are key properties of a ZKP circuit, so make sure to verify your inputs thoroughly before relying on them. Happy coding!