Circuit Architecture

Circom Circuits

Main Circuits

We provide one main circuit as follows.

email_auth.circom

A circuit to verify that a message in the subject is authorized by a user of an account salt, derived from an email address in the From field and a random field value called account code.

It takes as input the following data:

1. a padded email header padded_header.
2. the bytes of the padded email header padded_header_len.
3. an RSA public key public_key.
4. an RSA signature signature.
5. the sender's account code account_code.
6. a starting position of the From field in the email header from_addr_idx.
7. a starting position of the Subject field in the email header subject_idx.
8. a starting position of the email domain in the email address of the From field domain_idx.
9. a starting position of the timestamp in the email header timestamp_idx.
10. a starting position of the invitation code in the email header code_idx.

Its instances are as follows:

1. an email domain domain_name.
2. a Poseidon hash of the RSA public key public_key_hash.
3. a nullifier of the email email_nullifier.
4. a timestamp in the email header timestamp.
5. a masked subject where characters either in the email address or in the invitation code are replaced with zero masked_subject_str.
6. an account salt account_salt.
7. a flag whether the email header contains the invitation code is_code_exist.

How to Use

Build circuits

yarn && yarn build

Run tests

At packages/circuits, make a build directory, download the zip file from the following link, and place its unzipped directory under build. https://drive.google.com/file/d/1TChinAnHr9eV8H_OV9SVReF8Rvu6h1XH/view?usp=sharing

Then, move email_auth.zkey in the unzipped directory params to build.

Then run the following command. yarn test

Generate proving keys and verifier contracts for main circuits

yarn dev-setup

Specification

The email_auth.circom makes constraints and computes the public output as follows.

1. Assert that signature is valid for padded_header and public_key.
2. Let public_key_hash be PoseidonHash(public_key).
3. Let email_nullifier be PoseidonHash(PoseidonHash(signature)).
4. Let from_addr be padded_header[from_addr_idx:from_addr_idx+256] .
5. Let subject be padded_header[subject_idx:subject_idx+MAX_SUBJECT_BYTES] .
6. Let domain_name be padded_header[domain_idx:domain_idx+255] .
7. Let is_time_exist be 1 if padded_header satisfies the regex of the timestamp field.
8. Let timestamp_str be padded_header[timestamp_idx:timestamp_idx+10].
9. If is_time_exist is 1, let timestamp be an integer parsing timestamp_str as a digit string. Otherwise, let timestamp be zero.
10. Let is_code_exist be 1 if padded_header satisfies the regex of the invitation code.
11. Let code_str be padded_header[code_idx:code_idx+64].
12. Let embedded_code be an integer parsing code_str as a hex string.
13. If is_code_exist is 1, assert that embedded_code is equal to account_code.
14. Let account_salt be PoseidonHash(from_addr|0..0, account_code, 0).
15. Let masked_subject be a string that removes the invitation code with the prefix code_str and one email address from subject, if they appear in subject.

Note that the email address in the subject is assumbed not to overlap with the invitation code.

email_auth_with_body_parsing_with_qp_encoding.circom

A circuit to verify that a message in the email body, called command, is authorized by a user of an account salt, derived from an email address in the From field and a random field value called account code. This is basically the same as the email_auth.circom described above except for the following features:

• Instead of subject_idx, it additionally takes as a private input a padded email body padded_cleaned_body and an index of the command in the email body command_idx.
• It extracts a substring command between a prefix (<div id=3D\"[^\"]*zkemail[^\"]*\"[^>]*>)" and a suffix </div> from padded_cleaned_body.
• It outputs masked_command instead of masked_subject, which removes the invitation code with the prefix and one email address from command.