Add Value Commitment operator

circuits/lib/linked/linkId.circom

@@ -6,7 +6,7 @@ include "../../../node_modules/circomlib/circuits/poseidon.circom";
 
 template LinkID() {
     signal input claimHash;
-    signal input linkNonce;
+    signal input linkNonce; // private random nonce to make the commitment unique and secure
 
     signal output out;
 

circuits/lib/query/modifiers.circom

@@ -7,6 +7,7 @@ include "../../../node_modules/circomlib/circuits/mux4.circom";
 /*
     Modifier/computation operators:
       16 - selective disclosure (16 = 10000 binary)
+      17 - value commitment (17 = 10001 binary)
 */
 
 // modifierValidatorOutputSelector validates modifier operation and selects output value
@@ -24,7 +25,8 @@ template modifierValidatorOutputSelector() {
     modifierOpValid.s <== [opBits[0], opBits[1], opBits[2], opBits[3]];
     modifierOpValid.c <== [
         1, // valid operator: 16 - selective disclosure (16-16 = index 0)
-        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
+        1, // valid operator: 17 - value commitment (17-1 = index 1)
+        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
     ];
 
     ForceEqualIfEnabled()(

circuits/lib/query/processQueryWithModifiers.circom

@@ -3,6 +3,7 @@ pragma circom 2.1.1;
 include "../../../node_modules/circomlib/circuits/comparators.circom";
 include "query.circom";
 include "modifiers.circom";
+include "valueCommitment.circom";
 include "../utils/claimUtils.circom";
 include "../utils/arraySizeValidator.circom";
 
@@ -18,6 +19,7 @@ template ProcessQueryWithModifiers(claimLevels, maxValueArraySize){
     signal input operator;
     signal input value[maxValueArraySize];
     signal input valueArraySize; // actual size of value array - we don't want zero filled arrays to cause false positives for 0 as input to IN/NIN operators
+    signal input commitNonce;
 
     signal input issuerClaim[8];
     signal input merklized;
@@ -111,6 +113,9 @@ template ProcessQueryWithModifiers(claimLevels, maxValueArraySize){
     // selective disclosure
     // no need to calc anything, fieldValue is just passed as an output
 
+    // value commitment
+    signal valueCommitment <== ValueCommitment()(fieldValue, commitNonce);
+
     /////////////////////////////////////////////////////////////////
     // Modifier Operator Validation & Output Preparation
     /////////////////////////////////////////////////////////////////
@@ -120,7 +125,8 @@ template ProcessQueryWithModifiers(claimLevels, maxValueArraySize){
         operator <== operator,
         modifierOutputs <== [
             fieldValue, // 16 - selective disclosure (16-16 = index 0)
-            0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 // 17-31 - not used
+            valueCommitment, // 17 - value commitment (17-16 = index 1)
+            0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 // 18-31 - not used
         ]
     );
 }

circuits/lib/query/query.circom

@@ -23,6 +23,7 @@ include "comparators.circom";
       11 - exists (true / false)
     Modifier/computation operators:
       16 - selective disclosure (16 = 10000 binary)
+      17 - value commitment (17 = 10001 binary)
 */
 
 // Query template works only with Query operators (0-15).

circuits/lib/query/valueCommitment.circom

@@ -0,0 +1,27 @@
+pragma circom 2.1.1;
+
+include "../../../node_modules/circomlib/circuits/mux1.circom";
+include "../../../node_modules/circomlib/circuits/comparators.circom";
+include "../../../node_modules/circomlib/circuits/poseidon.circom";
+
+/**
+Value commitment circuit allows to commit to a specific value and then
+reveal it later or use such a commitment in another circuits to prove that
+multiple circuits work with the same value without revealing it.
+*/
+
+template ValueCommitment() {
+    signal input value;
+    signal input commitNonce; // private random nonce to make the commitment unique and secure
+
+    signal output out;
+
+    signal isNonceZero <== IsZero()(commitNonce);
+
+    signal commit <== Poseidon(2)([value, commitNonce]);
+
+    out <== Mux1()(
+        [commit, 0],
+        isNonceZero
+    );
+}

circuits/linked/multiQuery.circom

@@ -26,6 +26,7 @@ template LinkedMultiQuery(N, claimLevels, maxValueArraySize) {
     signal input operator[N];
     signal input value[N][maxValueArraySize];
     signal input valueArraySize[N];
+    signal input commitNonce[N];
 
     // Outputs
     signal output linkID;
@@ -68,7 +69,7 @@ template LinkedMultiQuery(N, claimLevels, maxValueArraySize) {
     /////////////////////////////////////////////////////////////////
     for (var i=0; i<N; i++) {
         operatorNotNoop[i] <== NOT()(IsZero()(operator[i]));
-       
+
         // output value only if modifier operation was selected
         operatorOutput[i] <== ProcessQueryWithModifiers(claimLevels, maxValueArraySize)(
             operatorNotNoop[i], // enabled
@@ -82,6 +83,7 @@ template LinkedMultiQuery(N, claimLevels, maxValueArraySize) {
             operator[i],
             value[i],
             valueArraySize[i],
+            commitNonce[i],
             issuerClaim,
             merklized,
             merklize.out

circuits/offchain/credentialAtomicQueryV3OffChain.circom

@@ -52,6 +52,7 @@ template credentialAtomicQueryV3OffChain(issuerLevels, claimLevels, maxValueArra
     signal input operator;
     signal input value[maxValueArraySize];
     signal input valueArraySize;
+    signal input commitNonce;
     signal input issuerClaim[8];
 
     // MTP specific
@@ -227,6 +228,7 @@ template credentialAtomicQueryV3OffChain(issuerLevels, claimLevels, maxValueArra
         operator,
         value,
         valueArraySize,
+        commitNonce,
         issuerClaim,
         merklized,
         merklize.out

circuits/onchain/credentialAtomicQueryV3OnChain.circom

@@ -118,6 +118,7 @@ template credentialAtomicQueryV3OnChain(issuerLevels, claimLevels, maxValueArray
     signal input operator;
     signal input value[maxValueArraySize];
     signal input valueArraySize;
+    signal input commitNonce;
 
     // MTP specific
     signal input issuerClaimMtp[issuerLevels];
@@ -234,6 +235,7 @@ template credentialAtomicQueryV3OnChain(issuerLevels, claimLevels, maxValueArray
         operator <== operator,
         value <== value,
         valueArraySize <== valueArraySize,
+        commitNonce <== commitNonce,
         issuerClaim <== issuerClaim,
         issuerClaimMtp <== issuerClaimMtp,
         issuerClaimClaimsTreeRoot <== issuerClaimClaimsTreeRoot,

test/circuits/query/valueCommitmentTest.circom

@@ -0,0 +1,5 @@
+pragma circom 2.1.1;
+
+include "../../../circuits/lib/query/valueCommitment.circom";
+
+component main = ValueCommitment();

test/query/valueCommitment.test.ts

@@ -0,0 +1,31 @@
+import {describe} from "mocha";
+
+const path = require("path");
+const wasm_tester = require("circom_tester").wasm;
+
+
+describe("ValueCommitment test", function () {
+    let valueCommitmentCircuit;
+
+    before(async function () {
+        valueCommitmentCircuit = await wasm_tester(path.join(__dirname, "../circuits/query/", "valueCommitmentTest.circom"));
+    });
+
+    it("should commit a value with a non-zero nonce", async () => {
+        const inputs = { value: "5", commitNonce: "7" };
+        const expectedOut = { out: "21007229687521157814825902919006068496120320911167801732994749038798743998593" };
+
+        const witness = await valueCommitmentCircuit.calculateWitness(inputs, true);
+        await valueCommitmentCircuit.assertOut(witness, expectedOut);
+        await valueCommitmentCircuit.checkConstraints(witness);
+    });
+
+    it("should return zero for a commit with zero nonce", async () => {
+        const inputs = { value: "10", commitNonce: "0" };
+        const expectedOut = { out: "0" };
+
+        const witness = await valueCommitmentCircuit.calculateWitness(inputs, true);
+        await valueCommitmentCircuit.assertOut(witness, expectedOut);
+        await valueCommitmentCircuit.checkConstraints(witness);
+    });
+});