BLAKE2b gadget

src/examples/crypto/blake2b/blake2b.ts

@@ -0,0 +1,18 @@
+import { Bytes, Gadgets, ZkProgram } from 'o1js';
+
+export { BLAKE2BProgram, Bytes12 };
+
+class Bytes12 extends Bytes(12) {}
+
+let BLAKE2BProgram = ZkProgram({
+  name: 'blake2b',
+  publicOutput: Bytes(32),
+  methods: {
+    blake2b: {
+      privateInputs: [Bytes12],
+      async method(xs: Bytes12) {
+        return Gadgets.BLAKE2B.hash(xs, 32);
+      },
+    },
+  },
+});

src/examples/crypto/blake2b/run.ts

@@ -0,0 +1,23 @@
+import { Bytes12, BLAKE2BProgram } from './blake2b.js';
+
+console.time('compile');
+await BLAKE2BProgram.compile();
+console.timeEnd('compile');
+
+let preimage = Bytes12.fromString('hello world!');
+
+console.log('blake2b rows:', (await BLAKE2BProgram.analyzeMethods()).blake2b.rows);
+
+console.time('prove');
+let proof = await BLAKE2BProgram.blake2b(preimage);
+console.timeEnd('prove');
+let isValid = await BLAKE2BProgram.verify(proof);
+
+console.log('digest:', proof.publicOutput.toHex());
+
+if (
+  proof.publicOutput.toHex() !==
+  '4fccfb4d98d069558aa93e9565f997d81c33b080364efd586e77a433ddffc5e2'
+)
+  throw new Error('Invalid blake2b digest!');
+if (!isValid) throw new Error('Invalid proof');

src/lib/provable/crypto/hash.ts

@@ -138,4 +138,10 @@ const Hash = {
       return Keccak.preNist(512, bytes);
     },
   },
+
+  BLAKE2B: {
+    hash(bytes: Bytes) {
+      return Gadgets.BLAKE2B.hash(bytes);
+    },
+  },
 };

src/lib/provable/gadgets/arithmetic.ts

@@ -2,9 +2,9 @@ import { provableTuple } from '../types/struct.js';
 import { Field } from '../wrapped.js';
 import { assert } from '../../util/errors.js';
 import { Provable } from '../provable.js';
-import { rangeCheck32, rangeCheckN } from './range-check.js';
+import { rangeCheck32, rangeCheck64, rangeCheckN } from './range-check.js';
 
-export { divMod32, addMod32 };
+export { divMod32, addMod32, divMod64, addMod64 };
 
 function divMod32(n: Field, nBits = 64) {
   assert(
@@ -56,3 +56,57 @@ function divMod32(n: Field, nBits = 64) {
 function addMod32(x: Field, y: Field) {
   return divMod32(x.add(y), 33).remainder;
 }
+
+function divMod64(n: Field, nBits = 128) {
+  assert(
+    nBits >= 0 && nBits < 255,
+    `nBits must be in the range [0, 255), got ${nBits}`
+  );
+
+  // calculate the number of bits allowed for the quotient to avoid overflow
+  const quotientBits = Math.max(0, nBits - 64);
+
+  if (n.isConstant()) {
+    assert(
+      n.toBigInt() < 1n << BigInt(nBits),
+      `n needs to fit into ${nBits} bits, but got ${n.toBigInt()}`
+    );
+    let nBigInt = n.toBigInt();
+    let q = nBigInt >> 64n;
+    let r = nBigInt - (q << 64n);
+    return {
+      remainder: new Field(r),
+      quotient: new Field(q),
+    };
+  }
+
+  let [quotient, remainder] = Provable.witness(
+    provableTuple([Field, Field]),
+    () => {
+      let nBigInt = n.toBigInt();
+      let q = nBigInt >> 64n;
+      let r = nBigInt - (q << 64n);
+      return [q, r] satisfies [bigint, bigint];
+    }
+  );
+
+  if (quotientBits === 1) {
+    quotient.assertBool();
+  } else if (quotientBits === 64) {
+    rangeCheck64(quotient);
+  } else {
+    rangeCheckN(quotientBits, quotient);
+  }
+  rangeCheck64(remainder);
+
+  n.assertEquals(quotient.mul(1n << 64n).add(remainder));
+
+  return {
+    remainder,
+    quotient,
+  };
+}
+
+function addMod64(x: Field, y: Field) {
+  return divMod64(x.add(y), 65).remainder;
+}

src/lib/provable/gadgets/bitwise.ts

@@ -13,6 +13,7 @@ export {
   rotate64,
   rotate32,
   and,
+  or,
   rightShift64,
   leftShift64,
   leftShift32,
@@ -173,6 +174,10 @@ function and(a: Field, b: Field, length: number) {
   return outputAnd;
 }
 
+function or(a: Field, b: Field, length: number) {
+  return not(and(not(a, length), not(b, length), length), length);
+}
+
 function rotate64(
   field: Field,
   bits: number,