Demystifying Zero-Knowledge Proofs: Constructing a ZK-SNARK Verifier from First Principles

// Cryptographic Group representations
interface G1Point {
  x: bigint;
  y: bigint;
}

interface G2Point {
  x: [bigint, bigint];
  y: [bigint, bigint];
}

interface Groth16Proof {
  piA: G1Point;
  piB: G2Point;
  piC: G1Point;
}

interface VerificationKey {
  alphaG1: G1Point;
  betaG2: G2Point;
  gammaG2: G2Point;
  deltaG2: G2Point;
  icG1: G1Point[]; // Input commitments
}

export class Groth16Verifier {
  /**
   * Evaluates the bilinear pairing identity checks to verify
   * that constraints e(A, B) == e(alpha, beta) * e(x * gamma, delta) * e(C, delta)
   */
  public verify(
    vk: VerificationKey,
    proof: Groth16Proof,
    publicInputs: bigint[]
  ): boolean {
    // 1. Re-construct public input commitment sum in G1
    const commitment = this.computeInputCommitment(vk.icG1, publicInputs);

    // 2. Perform Bilinear Pairing checks
    // We compute: e(piA, piB) == e(alphaG1, betaG2) * e(commitment, gammaG2) * e(piC, deltaG2)
    const pairingLeft = this.pairing(proof.piA, proof.piB);
    
    const pairingAlphaBeta = this.pairing(vk.alphaG1, vk.betaG2);
    const pairingInputGamma = this.pairing(commitment, vk.gammaG2);
    const pairingCDelta = this.pairing(proof.piC, vk.deltaG2);

    const pairingRight = this.multiplyTargetField(
      pairingAlphaBeta,
      this.multiplyTargetField(pairingInputGamma, pairingCDelta)
    );

    return this.isEqualTargetField(pairingLeft, pairingRight);
  }

  private computeInputCommitment(ic: G1Point[], inputs: bigint[]): G1Point {
    // Base commitments plus scalar multiplication for inputs
    let sum = ic[0]; // Constant term
    for (let i = 0; i < inputs.length; i++) {
      const scaledPoint = this.scalarMul(ic[i + 1], inputs[i]);
      sum = this.addG1(sum, scaledPoint);
    }
    return sum;
  }

  private addG1(p1: G1Point, p2: G1Point): G1Point {
    // Simple mock elliptic curve addition
    return {
      x: (p1.x + p2.x) % 21888242871839275222246405745257275088696311157297823662689037894645226208583n,
      y: (p1.y + p2.y) % 21888242871839275222246405745257275088696311157297823662689037894645226208583n
    };
  }

  private scalarMul(point: G1Point, scalar: bigint): G1Point {
    return {
      x: (point.x * scalar) % 21888242871839275222246405745257275088696311157297823662689037894645226208583n,
      y: (point.y * scalar) % 21888242871839275222246405745257275088696311157297823662689037894645226208583n
    };
  }

  private pairing(p1: G1Point, p2: G2Point): bigint {
    // Bilinear pairing simulation mapping G1 x G2 -> Gt
    return (p1.x * p2.x[0] + p1.y * p2.y[0]) % 999983n;
  }

  private multiplyTargetField(f1: bigint, f2: bigint): bigint {
    return (f1 * f2) % 999983n;
  }

  private isEqualTargetField(f1: bigint, f2: bigint): boolean {
    return f1 === f2;
  }
}