I am writing an ECC based zkp circuit and need to express the constraints:

  1. a + b + c = d
  2. a, b, c, d >= 0

a, b, c, d will be represented by points on the curve so addition can wrap around the curve module. (Imagine d is total amount, and a, b, c are partial payments that total d)

  1. is easy, it's just a + b + c = d
  2. is more tricky, since I basically need to constrain that a+b+c does now wrap around the curve module.

My current solution is to use five constraints:

  1. a <= a + b
  2. b <= a + b
  3. c <= d
  4. a + b <= d
  5. a + b + c = d

Is this correct? And could it be done with less than five constraints?


A better solution with only three constraints:

  1. c <= d
  2. b <= d - c
  3. a = d - c - b

courtesy of https://math.stackexchange.com/a/4887804/1305190



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.