xProve: Verifiable Computation on Threshold Shares

import { CircuitBuilder, buildEqualityCircuit } from '@private.me/xcompute';
import { prove, verify } from '@private.me/xprove';

// Build circuit: 8-bit equality check
const circuit = buildEqualityCircuit(8);

// Witness: A = B = 10110011 (private input, never revealed)
const witness = new Uint8Array([1,0,1,1,0,0,1,1, 1,0,1,1,0,0,1,1]);

// Generate ZKBoo proof (128-bit security = 81 repetitions)
const proofResult = await prove(circuit, witness, 128);

// Proof reveals NOTHING about the witness — only that output = 1
console.log(proofResult.ok);   // true

import { verify } from '@private.me/xprove';

// Verifier has: proof + public output + circuit definition
// Verifier does NOT have: witness, shares, or wire values
const publicOutput = new Uint8Array([1]); // Expected: equal

const valid = await verify(circuit, proof, publicOutput, 128);

if (valid.ok && valid.value) {
  console.log('Computation verified correct');
} else {
  console.log('Verification failed');
}

import { createAuditTrail, generateAuditKey, compareAuditTrails } from '@private.me/xprove';

// Each party generates an audit trail during computation
const key = generateAuditKey();
const trail = await createAuditTrail(circuit, wireValues, key);

// Parties exchange trails — any deviation detected
const match = compareAuditTrails([trail1, trail2, trail3]);
if (match.ok && match.value) console.log('All parties agree');

import { proveKKW, verifyKKW } from '@private.me/xprove';

// Same circuit, same witness — just use proveKKW instead of prove
const proof = await proveKKW(circuit, witness, {
  numParties: 16,     // N=16 parties (default)
  securityBits: 128,  // 32 repetitions (vs 81 for ZKBoo)
});

// Verify — same pattern, ~17x smaller proof
const valid = await verifyKKW(circuit, proof.value, publicOutput);
if (valid.ok && valid.value) console.log('Verified');

import { proveKKW } from '@private.me/xprove';

// Track proof generation progress for responsive UIs
const result = await proveKKW(circuit, witness, {
  securityBits: 128,
  onProgress: (p) => {
    console.log(`${p.stage}: ${p.percent}% (rep ${p.current}/${p.total})`);
    updateProgressBar(p.percent);
  }
});

// Example progress output:
// "Simulating parties: 25% (rep 8/32)"
// "Generating commitments: 50% (rep 16/32)"
// "Computing challenges: 75% (rep 24/32)"
// "Finalizing proof: 100% (rep 32/32)"

import { verifyKKW } from '@private.me/xprove';

const valid = await verifyKKW(circuit, proof, publicOutput, {
  onProgress: (p) => {
    console.log(`Verification: ${p.percent}% complete`);
  }
});

if (valid.ok && valid.value) {
  console.log('Proof verified successfully');
}

// Configuration Errors (E001-E004)
INVALID_SECURITY_BITS   // Must be 80, 96, 112, 128, or 256
INVALID_NUM_PARTIES     // Must be N ≥ 3 for KKW proofs
INVALID_CIRCUIT         // Circuit definition malformed
INVALID_WITNESS         // Witness length mismatch or type error

// Tier 1 Errors (E101-E103)
HMAC_GENERATION_FAILED  // SHA-256 HMAC failed — check input data
HMAC_CHAIN_INVALID      // Trail integrity check failed
AUDIT_KEY_INVALID       // Key must be 32 bytes

// Tier 2 Errors (E201-E203)
COMMITMENT_FAILED       // SHA-256 commitment generation failed
REVEAL_MISMATCH         // Opened value doesn't match commitment
BEAVER_OPEN_INVALID     // Triple verification failed

// Tier 3 Errors (E301-E304)
TIER3_MAC_INVALID       // SPDZ MAC verification failed — possible tampering
TIER3_MAC_GENERATION_FAILED  // IT-MAC generation error
TIER3_SHARE_INVALID     // Share integrity check failed
TIER3_KEY_INVALID       // MAC key must be in GF(2^128)

// Tier 4 Errors (E401-E408)
PROOF_TOO_LARGE         // Reduce circuit complexity or security bits
SIMULATION_FAILED       // Party simulation error — check circuit gates
CHALLENGE_DERIVATION_FAILED  // Fiat-Shamir hash failed
COMMITMENT_CHECK_FAILED // Proof commitment verification failed
OPENED_VIEW_INVALID     // Revealed party view inconsistent
CROSS_CHECK_FAILED      // Beaver triple cross-check failed
VERIFICATION_TIMEOUT    // Increase timeout or reduce proof size
UNSUPPORTED_TIER        // Tier not implemented or deprecated

import { prove, XproveErrorCode } from '@private.me/xprove';

const result = await prove(circuit, witness, 128);

if (!result.ok) {
  switch (result.error.code) {
    case XproveErrorCode.PROOF_TOO_LARGE:
      console.error('Proof too large:', result.error.message);
      console.log('Suggestion: Reduce circuit size or security bits');
      break;

    case XproveErrorCode.TIER3_MAC_INVALID:
      console.error('MAC verification failed:', result.error.message);
      console.log('Possible tampering detected — reject computation');
      break;

    case XproveErrorCode.VERIFICATION_TIMEOUT:
      console.error('Verification timed out:', result.error.message);
      console.log('Suggestion: Increase timeout or reduce proof complexity');
      break;

    default:
      console.error('Proof generation failed:', result.error);
  }
  return;
}

// Success path
const proof = result.value;

// Initialize xProve with Xid integration
import { XProveEngine } from '@private.me/xprove-cli';
import { XidClient } from '@private.me/xid';

const xid = new XidClient({ mode: 'ephemeral' });
const prover = new XProveEngine({ identityProvider: xid, tier: 'T4b' });

// Each proof derives unlinkable prover DID automatically
const proof = await prover.prove({
  computation: addTwoNumbers,
  inputs: [a_share, b_share]
});
  → [xProve] Deriving ephemeral DID from master seed...
  → [xProve] DID: did:key:z6MkE... (unique to this proof + circuit + epoch)
  → [xProve] Prover authenticated (~50µs)
  → [xProve] KKW proof generated (~30ms)
  → [xProve] Key purged (<1ms exposure)

// Proof is signed with unlinkable prover DID
// Verification works for this proof, but cross-proof correlation fails