diff --git a/build/main.ses.cjs b/build/main.ses.cjs
new file mode 100644
index 00000000..bcb46e79
--- /dev/null
+++ b/build/main.ses.cjs
@@ -0,0 +1,7742 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+var binFileUtils = require('@iden3/binfileutils');
+var ffjavascript = require('ffjavascript');
+var Blake2b = require('blake2b-wasm');
+require('readline');
+var crypto = require('crypto');
+var fastFile = require('fastfile');
+var circom_runtime = require('circom_runtime');
+var r1csfile = require('r1csfile');
+var jsSha3 = require('js-sha3');
+
+function _interopDefaultLegacy (e) { return e && typeof e === 'object' && 'default' in e ? e : { 'default': e }; }
+
+function _interopNamespace(e) {
+    if (e && e.__esModule) return e;
+    var n = Object.create(null);
+    if (e) {
+        Object.keys(e).forEach(function (k) {
+            if (k !== 'default') {
+                var d = Object.getOwnPropertyDescriptor(e, k);
+                Object.defineProperty(n, k, d.get ? d : {
+                    enumerable: true,
+                    get: function () { return e[k]; }
+                });
+            }
+        });
+    }
+    n["default"] = e;
+    return Object.freeze(n);
+}
+
+var binFileUtils__namespace = /*#__PURE__*/_interopNamespace(binFileUtils);
+var Blake2b__default = /*#__PURE__*/_interopDefaultLegacy(Blake2b);
+var crypto__default = /*#__PURE__*/_interopDefaultLegacy(crypto);
+var fastFile__namespace = /*#__PURE__*/_interopNamespace(fastFile);
+var jsSha3__default = /*#__PURE__*/_interopDefaultLegacy(jsSha3);
+
+ffjavascript.Scalar.e("73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001", 16);
+ffjavascript.Scalar.e("21888242871839275222246405745257275088548364400416034343698204186575808495617");
+
+const bls12381q = ffjavascript.Scalar.e("1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab", 16);
+const bn128q = ffjavascript.Scalar.e("21888242871839275222246405745257275088696311157297823662689037894645226208583");
+
+const singleThread = true;
+
+async function getCurveFromQ(q) {
+    let curve;
+    if (ffjavascript.Scalar.eq(q, bn128q)) {
+        curve = await ffjavascript.buildBn128(singleThread);
+    } else if (ffjavascript.Scalar.eq(q, bls12381q)) {
+        curve = await ffjavascript.buildBls12381(singleThread);
+    } else {
+        throw new Error(`Curve not supported: ${ffjavascript.Scalar.toString(q)}`);
+    }
+    return curve;
+}
+
+async function getCurveFromName(name) {
+    let curve;
+    const normName = normalizeName(name);
+    if (["BN128", "BN254", "ALTBN128"].indexOf(normName) >= 0) {
+        curve = await ffjavascript.buildBn128(singleThread);
+    } else if (["BLS12381"].indexOf(normName) >= 0) {
+        curve = await ffjavascript.buildBls12381(singleThread);
+    } else {
+        throw new Error(`Curve not supported: ${name}`);
+    }
+    return curve;
+
+    function normalizeName(n) {
+        return n.toUpperCase().match(/[A-Za-z0-9]+/g).join("");
+    }
+
+}
+
+/*
+    Copyright 2018 0KIMS association.
+
+    This file is part of snarkJS.
+
+    snarkJS is a free software: you can redistribute it and/or modify it
+    under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    snarkJS is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
+    License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with snarkJS. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+const _revTable = [];
+for (let i=0; i<256; i++) {
+    _revTable[i] = _revSlow(i, 8);
+}
+
+function _revSlow(idx, bits) {
+    let res =0;
+    let a = idx;
+    for (let i=0; i<bits; i++) {
+        res <<= 1;
+        res = res | (a &1);
+        a >>=1;
+    }
+    return res;
+}
+
+
+function log2( V )
+{
+    return( ( ( V & 0xFFFF0000 ) !== 0 ? ( V &= 0xFFFF0000, 16 ) : 0 ) | ( ( V & 0xFF00FF00 ) !== 0 ? ( V &= 0xFF00FF00, 8 ) : 0 ) | ( ( V & 0xF0F0F0F0 ) !== 0 ? ( V &= 0xF0F0F0F0, 4 ) : 0 ) | ( ( V & 0xCCCCCCCC ) !== 0 ? ( V &= 0xCCCCCCCC, 2 ) : 0 ) | ( ( V & 0xAAAAAAAA ) !== 0 ) );
+}
+
+
+function formatHash(b, title) {
+    const a = new DataView(b.buffer, b.byteOffset, b.byteLength);
+    let S = "";
+    for (let i=0; i<4; i++) {
+        if (i>0) S += "\n";
+        S += "\t\t";
+        for (let j=0; j<4; j++) {
+            if (j>0) S += " ";
+            S += a.getUint32(i*16+j*4).toString(16).padStart(8, "0");
+        }
+    }
+    if (title) S = title + "\n" + S;
+    return S;
+}
+
+function hashIsEqual(h1, h2) {
+    if (h1.byteLength != h2.byteLength) return false;
+    var dv1 = new Int8Array(h1);
+    var dv2 = new Int8Array(h2);
+    for (var i = 0 ; i != h1.byteLength ; i++)
+    {
+        if (dv1[i] != dv2[i]) return false;
+    }
+    return true;
+}
+
+function cloneHasher(h) {
+    const ph = h.getPartialHash();
+    const res = Blake2b__default["default"](64);
+    res.setPartialHash(ph);
+    return res;
+}
+
+async function sameRatio$2(curve, g1s, g1sx, g2s, g2sx) {
+    if (curve.G1.isZero(g1s)) return false;
+    if (curve.G1.isZero(g1sx)) return false;
+    if (curve.G2.isZero(g2s)) return false;
+    if (curve.G2.isZero(g2sx)) return false;
+    // return curve.F12.eq(curve.pairing(g1s, g2sx), curve.pairing(g1sx, g2s));
+    const res = await curve.pairingEq(g1s, g2sx, curve.G1.neg(g1sx), g2s);
+    return res;
+}
+
+
+function askEntropy() {
+    {
+        return window.prompt("Enter a random text. (Entropy): ", "");
+    }
+}
+
+async function getRandomRng(entropy) {
+    // Generate a random Rng
+    while (!entropy) {
+        entropy = await askEntropy();
+    }
+    const hasher = Blake2b__default["default"](64);
+    hasher.update(crypto__default["default"].randomBytes(64));
+    const enc = new TextEncoder(); // always utf-8
+    hasher.update(enc.encode(entropy));
+    const hash = Buffer.from(hasher.digest());
+
+    const seed = [];
+    for (let i=0;i<8;i++) {
+        seed[i] = hash.readUInt32BE(i*4);
+    }
+    const rng = new ffjavascript.ChaCha(seed);
+    return rng;
+}
+
+function rngFromBeaconParams(beaconHash, numIterationsExp) {
+    let nIterationsInner;
+    let nIterationsOuter;
+    if (numIterationsExp<32) {
+        nIterationsInner = (1 << numIterationsExp) >>> 0;
+        nIterationsOuter = 1;
+    } else {
+        nIterationsInner = 0x100000000;
+        nIterationsOuter = (1 << (numIterationsExp-32)) >>> 0;
+    }
+
+    let curHash = beaconHash;
+    for (let i=0; i<nIterationsOuter; i++) {
+        for (let j=0; j<nIterationsInner; j++) {
+            curHash = crypto__default["default"].createHash("sha256").update(curHash).digest();
+        }
+    }
+
+    const curHashV = new DataView(curHash.buffer, curHash.byteOffset, curHash.byteLength);
+    const seed = [];
+    for (let i=0; i<8; i++) {
+        seed[i] = curHashV.getUint32(i*4, false);
+    }
+
+    const rng = new ffjavascript.ChaCha(seed);
+
+    return rng;
+}
+
+function hex2ByteArray(s) {
+    if (s instanceof Uint8Array) return s;
+    if (s.slice(0,2) == "0x") s= s.slice(2);
+    return new Uint8Array(s.match(/[\da-f]{2}/gi).map(function (h) {
+        return parseInt(h, 16);
+    }));
+}
+
+function byteArray2hex(byteArray) {
+    return Array.prototype.map.call(byteArray, function(byte) {
+        return ("0" + (byte & 0xFF).toString(16)).slice(-2);
+    }).join("");
+}
+
+/*
+    Copyright 2018 0KIMS association.
+
+    This file is part of snarkJS.
+
+    snarkJS is a free software: you can redistribute it and/or modify it
+    under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    snarkJS is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
+    License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with snarkJS. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+async function writeHeader(fd, zkey) {
+
+    // Write the header
+    ///////////
+    await binFileUtils__namespace.startWriteSection(fd, 1);
+    await fd.writeULE32(1); // Groth
+    await binFileUtils__namespace.endWriteSection(fd);
+
+    // Write the Groth header section
+    ///////////
+
+    const curve = await getCurveFromQ(zkey.q);
+
+    await binFileUtils__namespace.startWriteSection(fd, 2);
+    const primeQ = curve.q;
+    const n8q = (Math.floor( (ffjavascript.Scalar.bitLength(primeQ) - 1) / 64) +1)*8;
+
+    const primeR = curve.r;
+    const n8r = (Math.floor( (ffjavascript.Scalar.bitLength(primeR) - 1) / 64) +1)*8;
+
+    await fd.writeULE32(n8q);
+    await binFileUtils__namespace.writeBigInt(fd, primeQ, n8q);
+    await fd.writeULE32(n8r);
+    await binFileUtils__namespace.writeBigInt(fd, primeR, n8r);
+    await fd.writeULE32(zkey.nVars);                         // Total number of bars
+    await fd.writeULE32(zkey.nPublic);                       // Total number of public vars (not including ONE)
+    await fd.writeULE32(zkey.domainSize);                  // domainSize
+    await writeG1(fd, curve, zkey.vk_alpha_1);
+    await writeG1(fd, curve, zkey.vk_beta_1);
+    await writeG2(fd, curve, zkey.vk_beta_2);
+    await writeG2(fd, curve, zkey.vk_gamma_2);
+    await writeG1(fd, curve, zkey.vk_delta_1);
+    await writeG2(fd, curve, zkey.vk_delta_2);
+
+    await binFileUtils__namespace.endWriteSection(fd);
+
+
+}
+
+async function writeG1(fd, curve, p) {
+    const buff = new Uint8Array(curve.G1.F.n8*2);
+    curve.G1.toRprLEM(buff, 0, p);
+    await fd.write(buff);
+}
+
+async function writeG2(fd, curve, p) {
+    const buff = new Uint8Array(curve.G2.F.n8*2);
+    curve.G2.toRprLEM(buff, 0, p);
+    await fd.write(buff);
+}
+
+async function readG1(fd, curve, toObject) {
+    const buff = await fd.read(curve.G1.F.n8*2);
+    const res = curve.G1.fromRprLEM(buff, 0);
+    return toObject ? curve.G1.toObject(res) : res;
+}
+
+async function readG2(fd, curve, toObject) {
+    const buff = await fd.read(curve.G2.F.n8*2);
+    const res = curve.G2.fromRprLEM(buff, 0);
+    return toObject ? curve.G2.toObject(res) : res;
+}
+
+
+async function readHeader$1(fd, sections, toObject) {
+    // Read Header
+    /////////////////////
+    await binFileUtils__namespace.startReadUniqueSection(fd, sections, 1);
+    const protocolId = await fd.readULE32();
+    await binFileUtils__namespace.endReadSection(fd);
+
+    if (protocolId == 1) {
+        return await readHeaderGroth16(fd, sections, toObject);
+    } else if (protocolId == 2) {
+        return await readHeaderPlonk(fd, sections);
+    } else {
+        throw new Error("Protocol not supported: ");
+    }        
+}
+
+
+
+
+async function readHeaderGroth16(fd, sections, toObject) {
+    const zkey = {};
+
+    zkey.protocol = "groth16";
+
+    // Read Groth Header
+    /////////////////////
+    await binFileUtils__namespace.startReadUniqueSection(fd, sections, 2);
+    const n8q = await fd.readULE32();
+    zkey.n8q = n8q;
+    zkey.q = await binFileUtils__namespace.readBigInt(fd, n8q);
+
+    const n8r = await fd.readULE32();
+    zkey.n8r = n8r;
+    zkey.r = await binFileUtils__namespace.readBigInt(fd, n8r);
+
+    let curve = await getCurveFromQ(zkey.q);
+
+    zkey.nVars = await fd.readULE32();
+    zkey.nPublic = await fd.readULE32();
+    zkey.domainSize = await fd.readULE32();
+    zkey.power = log2(zkey.domainSize);
+    zkey.vk_alpha_1 = await readG1(fd, curve, toObject);
+    zkey.vk_beta_1 = await readG1(fd, curve, toObject);
+    zkey.vk_beta_2 = await readG2(fd, curve, toObject);
+    zkey.vk_gamma_2 = await readG2(fd, curve, toObject);
+    zkey.vk_delta_1 = await readG1(fd, curve, toObject);
+    zkey.vk_delta_2 = await readG2(fd, curve, toObject);
+    await binFileUtils__namespace.endReadSection(fd);
+
+    return zkey;
+
+}
+
+
+
+
+async function readHeaderPlonk(fd, sections, protocol, toObject) {
+    const zkey = {};
+
+    zkey.protocol = "plonk";
+
+    // Read Plonk Header
+    /////////////////////
+    await binFileUtils__namespace.startReadUniqueSection(fd, sections, 2);
+    const n8q = await fd.readULE32();
+    zkey.n8q = n8q;
+    zkey.q = await binFileUtils__namespace.readBigInt(fd, n8q);
+
+    const n8r = await fd.readULE32();
+    zkey.n8r = n8r;
+    zkey.r = await binFileUtils__namespace.readBigInt(fd, n8r);
+
+    let curve = await getCurveFromQ(zkey.q);
+
+    zkey.nVars = await fd.readULE32();
+    zkey.nPublic = await fd.readULE32();
+    zkey.domainSize = await fd.readULE32();
+    zkey.power = log2(zkey.domainSize);
+    zkey.nAdditions = await fd.readULE32();
+    zkey.nConstrains = await fd.readULE32();
+    zkey.k1 = await fd.read(n8r);
+    zkey.k2 = await fd.read(n8r);
+
+    zkey.Qm = await readG1(fd, curve, toObject);
+    zkey.Ql = await readG1(fd, curve, toObject);
+    zkey.Qr = await readG1(fd, curve, toObject);
+    zkey.Qo = await readG1(fd, curve, toObject);
+    zkey.Qc = await readG1(fd, curve, toObject);
+    zkey.S1 = await readG1(fd, curve, toObject);
+    zkey.S2 = await readG1(fd, curve, toObject);
+    zkey.S3 = await readG1(fd, curve, toObject);
+    zkey.X_2 = await readG2(fd, curve, toObject);
+
+    await binFileUtils__namespace.endReadSection(fd);
+
+    return zkey;
+}
+
+async function readZKey(fileName, toObject) {
+    const {fd, sections} = await binFileUtils__namespace.readBinFile(fileName, "zkey", 1);
+
+    const zkey = await readHeader$1(fd, sections, "groth16");
+
+    const Fr = new ffjavascript.F1Field(zkey.r);
+    const Rr = ffjavascript.Scalar.mod(ffjavascript.Scalar.shl(1, zkey.n8r*8), zkey.r);
+    const Rri = Fr.inv(Rr);
+    const Rri2 = Fr.mul(Rri, Rri);
+
+    let curve = await getCurveFromQ(zkey.q);
+
+    // Read IC Section
+    ///////////
+    await binFileUtils__namespace.startReadUniqueSection(fd, sections, 3);
+    zkey.IC = [];
+    for (let i=0; i<= zkey.nPublic; i++) {
+        const P = await readG1(fd, curve, toObject);
+        zkey.IC.push(P);
+    }
+    await binFileUtils__namespace.endReadSection(fd);
+
+
+    // Read Coefs
+    ///////////
+    await binFileUtils__namespace.startReadUniqueSection(fd, sections, 4);
+    const nCCoefs = await fd.readULE32();
+    zkey.ccoefs = [];
+    for (let i=0; i<nCCoefs; i++) {
+        const m = await fd.readULE32();
+        const c = await fd.readULE32();
+        const s = await fd.readULE32();
+        const v = await readFr2();
+        zkey.ccoefs.push({
+            matrix: m,
+            constraint: c,
+            signal: s,
+            value: v
+        });
+    }
+    await binFileUtils__namespace.endReadSection(fd);
+
+    // Read A points
+    ///////////
+    await binFileUtils__namespace.startReadUniqueSection(fd, sections, 5);
+    zkey.A = [];
+    for (let i=0; i<zkey.nVars; i++) {
+        const A = await readG1(fd, curve, toObject);
+        zkey.A[i] = A;
+    }
+    await binFileUtils__namespace.endReadSection(fd);
+
+
+    // Read B1
+    ///////////
+    await binFileUtils__namespace.startReadUniqueSection(fd, sections, 6);
+    zkey.B1 = [];
+    for (let i=0; i<zkey.nVars; i++) {
+        const B1 = await readG1(fd, curve, toObject);
+
+        zkey.B1[i] = B1;
+    }
+    await binFileUtils__namespace.endReadSection(fd);
+
+
+    // Read B2 points
+    ///////////
+    await binFileUtils__namespace.startReadUniqueSection(fd, sections, 7);
+    zkey.B2 = [];
+    for (let i=0; i<zkey.nVars; i++) {
+        const B2 = await readG2(fd, curve, toObject);
+        zkey.B2[i] = B2;
+    }
+    await binFileUtils__namespace.endReadSection(fd);
+
+
+    // Read C points
+    ///////////
+    await binFileUtils__namespace.startReadUniqueSection(fd, sections, 8);
+    zkey.C = [];
+    for (let i=zkey.nPublic+1; i<zkey.nVars; i++) {
+        const C = await readG1(fd, curve, toObject);
+
+        zkey.C[i] = C;
+    }
+    await binFileUtils__namespace.endReadSection(fd);
+
+
+    // Read H points
+    ///////////
+    await binFileUtils__namespace.startReadUniqueSection(fd, sections, 9);
+    zkey.hExps = [];
+    for (let i=0; i<zkey.domainSize; i++) {
+        const H = await readG1(fd, curve, toObject);
+        zkey.hExps.push(H);
+    }
+    await binFileUtils__namespace.endReadSection(fd);
+
+    await fd.close();
+
+    return zkey;
+
+    async function readFr2(/* toObject */) {
+        const n = await binFileUtils__namespace.readBigInt(fd, zkey.n8r);
+        return Fr.mul(n, Rri2);
+    }
+
+}
+
+
+async function readContribution$1(fd, curve, toObject) {
+    const c = {delta:{}};
+    c.deltaAfter = await readG1(fd, curve, toObject);
+    c.delta.g1_s = await readG1(fd, curve, toObject);
+    c.delta.g1_sx = await readG1(fd, curve, toObject);
+    c.delta.g2_spx = await readG2(fd, curve, toObject);
+    c.transcript = await fd.read(64);
+    c.type = await fd.readULE32();
+
+    const paramLength = await fd.readULE32();
+    const curPos = fd.pos;
+    let lastType =0;
+    while (fd.pos-curPos < paramLength) {
+        const buffType = await fd.read(1);
+        if (buffType[0]<= lastType) throw new Error("Parameters in the contribution must be sorted");
+        lastType = buffType[0];
+        if (buffType[0]==1) {     // Name
+            const buffLen = await fd.read(1);
+            const buffStr = await fd.read(buffLen[0]);
+            c.name = new TextDecoder().decode(buffStr);
+        } else if (buffType[0]==2) {
+            const buffExp = await fd.read(1);
+            c.numIterationsExp = buffExp[0];
+        } else if (buffType[0]==3) {
+            const buffLen = await fd.read(1);
+            c.beaconHash = await fd.read(buffLen[0]);
+        } else {
+            throw new Error("Parameter not recognized");
+        }
+    }
+    if (fd.pos != curPos + paramLength) {
+        throw new Error("Parametes do not match");
+    }
+
+    return c;
+}
+
+
+async function readMPCParams(fd, curve, sections) {
+    await binFileUtils__namespace.startReadUniqueSection(fd, sections, 10);
+    const res = { contributions: []};
+    res.csHash = await fd.read(64);
+    const n = await fd.readULE32();
+    for (let i=0; i<n; i++) {
+        const c = await readContribution$1(fd, curve);
+        res.contributions.push(c);
+    }
+    await binFileUtils__namespace.endReadSection(fd);
+
+    return res;
+}
+
+async function writeContribution$1(fd, curve, c) {
+    await writeG1(fd, curve, c.deltaAfter);
+    await writeG1(fd, curve, c.delta.g1_s);
+    await writeG1(fd, curve, c.delta.g1_sx);
+    await writeG2(fd, curve, c.delta.g2_spx);
+    await fd.write(c.transcript);
+    await fd.writeULE32(c.type || 0);
+
+    const params = [];
+    if (c.name) {
+        params.push(1);      // Param Name
+        const nameData = new TextEncoder("utf-8").encode(c.name.substring(0,64));
+        params.push(nameData.byteLength);
+        for (let i=0; i<nameData.byteLength; i++) params.push(nameData[i]);
+    }
+    if (c.type == 1) {
+        params.push(2);      // Param numIterationsExp
+        params.push(c.numIterationsExp);
+
+        params.push(3);      // Beacon Hash
+        params.push(c.beaconHash.byteLength);
+        for (let i=0; i<c.beaconHash.byteLength; i++) params.push(c.beaconHash[i]);
+    }
+    if (params.length>0) {
+        const paramsBuff = new Uint8Array(params);
+        await fd.writeULE32(paramsBuff.byteLength);
+        await fd.write(paramsBuff);
+    } else {
+        await fd.writeULE32(0);
+    }
+
+}
+
+async function writeMPCParams(fd, curve, mpcParams) {
+    await binFileUtils__namespace.startWriteSection(fd, 10);
+    await fd.write(mpcParams.csHash);
+    await fd.writeULE32(mpcParams.contributions.length);
+    for (let i=0; i<mpcParams.contributions.length; i++) {
+        await writeContribution$1(fd, curve,mpcParams.contributions[i]);
+    }
+    await binFileUtils__namespace.endWriteSection(fd);
+}
+
+function hashG1(hasher, curve, p) {
+    const buff = new Uint8Array(curve.G1.F.n8*2);
+    curve.G1.toRprUncompressed(buff, 0, p);
+    hasher.update(buff);
+}
+
+function hashG2(hasher,curve, p) {
+    const buff = new Uint8Array(curve.G2.F.n8*2);
+    curve.G2.toRprUncompressed(buff, 0, p);
+    hasher.update(buff);
+}
+
+function hashPubKey(hasher, curve, c) {
+    hashG1(hasher, curve, c.deltaAfter);
+    hashG1(hasher, curve, c.delta.g1_s);
+    hashG1(hasher, curve, c.delta.g1_sx);
+    hashG2(hasher, curve, c.delta.g2_spx);
+    hasher.update(c.transcript);
+}
+
+/*
+    Copyright 2018 0KIMS association.
+
+    This file is part of snarkJS.
+
+    snarkJS is a free software: you can redistribute it and/or modify it
+    under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    snarkJS is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
+    License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with snarkJS. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+
+async function write(fd, witness, prime) {
+
+    await binFileUtils__namespace.startWriteSection(fd, 1);
+    const n8 = (Math.floor( (ffjavascript.Scalar.bitLength(prime) - 1) / 64) +1)*8;
+    await fd.writeULE32(n8);
+    await binFileUtils__namespace.writeBigInt(fd, prime, n8);
+    await fd.writeULE32(witness.length);
+    await binFileUtils__namespace.endWriteSection(fd);
+
+    await binFileUtils__namespace.startWriteSection(fd, 2);
+    for (let i=0; i<witness.length; i++) {
+        await binFileUtils__namespace.writeBigInt(fd, witness[i], n8);
+    }
+    await binFileUtils__namespace.endWriteSection(fd, 2);
+
+
+}
+
+async function writeBin(fd, witnessBin, prime) {
+
+    await binFileUtils__namespace.startWriteSection(fd, 1);
+    const n8 = (Math.floor( (ffjavascript.Scalar.bitLength(prime) - 1) / 64) +1)*8;
+    await fd.writeULE32(n8);
+    await binFileUtils__namespace.writeBigInt(fd, prime, n8);
+    if (witnessBin.byteLength % n8 != 0) {
+        throw new Error("Invalid witness length");
+    }
+    await fd.writeULE32(witnessBin.byteLength / n8);
+    await binFileUtils__namespace.endWriteSection(fd);
+
+
+    await binFileUtils__namespace.startWriteSection(fd, 2);
+    await fd.write(witnessBin);
+    await binFileUtils__namespace.endWriteSection(fd);
+
+}
+
+async function readHeader(fd, sections) {
+
+    await binFileUtils__namespace.startReadUniqueSection(fd, sections, 1);
+    const n8 = await fd.readULE32();
+    const q = await binFileUtils__namespace.readBigInt(fd, n8);
+    const nWitness = await fd.readULE32();
+    await binFileUtils__namespace.endReadSection(fd);
+
+    return {n8, q, nWitness};
+
+}
+
+async function read(fileName) {
+
+    const {fd, sections} = await binFileUtils__namespace.readBinFile(fileName, "wtns", 2);
+
+    const {n8, nWitness} = await readHeader(fd, sections);
+
+    await binFileUtils__namespace.startReadUniqueSection(fd, sections, 2);
+    const res = [];
+    for (let i=0; i<nWitness; i++) {
+        const v = await binFileUtils__namespace.readBigInt(fd, n8);
+        res.push(v);
+    }
+    await binFileUtils__namespace.endReadSection(fd);
+
+    await fd.close();
+
+    return res;
+}
+
+/*
+    Copyright 2018 0KIMS association.
+
+    This file is part of snarkJS.
+
+    snarkJS is a free software: you can redistribute it and/or modify it
+    under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    snarkJS is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
+    License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with snarkJS. If not, see <https://www.gnu.org/licenses/>.
+*/
+const {stringifyBigInts: stringifyBigInts$3} = ffjavascript.utils;
+
+async function groth16Prove(zkeyFileName, witnessFileName, logger) {
+    const {fd: fdWtns, sections: sectionsWtns} = await binFileUtils__namespace.readBinFile(witnessFileName, "wtns", 2, 1<<25, 1<<23);
+
+    const wtns = await readHeader(fdWtns, sectionsWtns);
+
+    const {fd: fdZKey, sections: sectionsZKey} = await binFileUtils__namespace.readBinFile(zkeyFileName, "zkey", 2, 1<<25, 1<<23);
+
+    const zkey = await readHeader$1(fdZKey, sectionsZKey);
+
+    if (zkey.protocol != "groth16") {
+        throw new Error("zkey file is not groth16");
+    }
+
+    if (!ffjavascript.Scalar.eq(zkey.r,  wtns.q)) {
+        throw new Error("Curve of the witness does not match the curve of the proving key");
+    }
+
+    if (wtns.nWitness != zkey.nVars) {
+        throw new Error(`Invalid witness length. Circuit: ${zkey.nVars}, witness: ${wtns.nWitness}`);
+    }
+
+    const curve = await getCurveFromQ(zkey.q);
+    const Fr = curve.Fr;
+    const G1 = curve.G1;
+    const G2 = curve.G2;
+
+    const power = log2(zkey.domainSize);
+
+    if (logger) logger.debug("Reading Wtns");
+    const buffWitness = await binFileUtils__namespace.readSection(fdWtns, sectionsWtns, 2);
+    if (logger) logger.debug("Reading Coeffs");
+    const buffCoeffs = await binFileUtils__namespace.readSection(fdZKey, sectionsZKey, 4);
+
+    if (logger) logger.debug("Building ABC");
+    const [buffA_T, buffB_T, buffC_T] = await buildABC1(curve, zkey, buffWitness, buffCoeffs, logger);
+
+    const inc = power == Fr.s ? curve.Fr.shift : curve.Fr.w[power+1];
+
+    const buffA = await Fr.ifft(buffA_T, "", "", logger, "IFFT_A");
+    const buffAodd = await Fr.batchApplyKey(buffA, Fr.e(1), inc);
+    const buffAodd_T = await Fr.fft(buffAodd, "", "", logger, "FFT_A");
+
+    const buffB = await Fr.ifft(buffB_T, "", "", logger, "IFFT_B");
+    const buffBodd = await Fr.batchApplyKey(buffB, Fr.e(1), inc);
+    const buffBodd_T = await Fr.fft(buffBodd, "", "", logger, "FFT_B");
+
+    const buffC = await Fr.ifft(buffC_T, "", "", logger, "IFFT_C");
+    const buffCodd = await Fr.batchApplyKey(buffC, Fr.e(1), inc);
+    const buffCodd_T = await Fr.fft(buffCodd, "", "", logger, "FFT_C");
+
+    if (logger) logger.debug("Join ABC");
+    const buffPodd_T = await joinABC(curve, zkey, buffAodd_T, buffBodd_T, buffCodd_T, logger);
+
+    let proof = {};
+
+    if (logger) logger.debug("Reading A Points");
+    const buffBasesA = await binFileUtils__namespace.readSection(fdZKey, sectionsZKey, 5);
+    proof.pi_a = await curve.G1.multiExpAffine(buffBasesA, buffWitness, logger, "multiexp A");
+
+    if (logger) logger.debug("Reading B1 Points");
+    const buffBasesB1 = await binFileUtils__namespace.readSection(fdZKey, sectionsZKey, 6);
+    let pib1 = await curve.G1.multiExpAffine(buffBasesB1, buffWitness, logger, "multiexp B1");
+
+    if (logger) logger.debug("Reading B2 Points");
+    const buffBasesB2 = await binFileUtils__namespace.readSection(fdZKey, sectionsZKey, 7);
+    proof.pi_b = await curve.G2.multiExpAffine(buffBasesB2, buffWitness, logger, "multiexp B2");
+
+    if (logger) logger.debug("Reading C Points");
+    const buffBasesC = await binFileUtils__namespace.readSection(fdZKey, sectionsZKey, 8);
+    proof.pi_c = await curve.G1.multiExpAffine(buffBasesC, buffWitness.slice((zkey.nPublic+1)*curve.Fr.n8), logger, "multiexp C");
+
+    if (logger) logger.debug("Reading H Points");
+    const buffBasesH = await binFileUtils__namespace.readSection(fdZKey, sectionsZKey, 9);
+    const resH = await curve.G1.multiExpAffine(buffBasesH, buffPodd_T, logger, "multiexp H");
+
+    const r = curve.Fr.random();
+    const s = curve.Fr.random();
+
+    proof.pi_a  = G1.add( proof.pi_a, zkey.vk_alpha_1 );
+    proof.pi_a  = G1.add( proof.pi_a, G1.timesFr( zkey.vk_delta_1, r ));
+
+    proof.pi_b  = G2.add( proof.pi_b, zkey.vk_beta_2 );
+    proof.pi_b  = G2.add( proof.pi_b, G2.timesFr( zkey.vk_delta_2, s ));
+
+    pib1 = G1.add( pib1, zkey.vk_beta_1 );
+    pib1 = G1.add( pib1, G1.timesFr( zkey.vk_delta_1, s ));
+
+    proof.pi_c = G1.add(proof.pi_c, resH);
+
+
+    proof.pi_c  = G1.add( proof.pi_c, G1.timesFr( proof.pi_a, s ));
+    proof.pi_c  = G1.add( proof.pi_c, G1.timesFr( pib1, r ));
+    proof.pi_c  = G1.add( proof.pi_c, G1.timesFr( zkey.vk_delta_1, Fr.neg(Fr.mul(r,s) )));
+
+
+    let publicSignals = [];
+
+    for (let i=1; i<= zkey.nPublic; i++) {
+        const b = buffWitness.slice(i*Fr.n8, i*Fr.n8+Fr.n8);
+        publicSignals.push(ffjavascript.Scalar.fromRprLE(b));
+    }
+
+    proof.pi_a = G1.toObject(G1.toAffine(proof.pi_a));
+    proof.pi_b = G2.toObject(G2.toAffine(proof.pi_b));
+    proof.pi_c = G1.toObject(G1.toAffine(proof.pi_c));
+
+    proof.protocol = "groth16";
+    proof.curve = curve.name;
+
+    await fdZKey.close();
+    await fdWtns.close();
+
+    proof = stringifyBigInts$3(proof);
+    publicSignals = stringifyBigInts$3(publicSignals);
+
+    return {proof, publicSignals};
+}
+
+
+async function buildABC1(curve, zkey, witness, coeffs, logger) {
+    const n8 = curve.Fr.n8;
+    const sCoef = 4*3 + zkey.n8r;
+    const nCoef = (coeffs.byteLength-4) / sCoef;
+
+    const outBuffA = new ffjavascript.BigBuffer(zkey.domainSize * n8);
+    const outBuffB = new ffjavascript.BigBuffer(zkey.domainSize * n8);
+    const outBuffC = new ffjavascript.BigBuffer(zkey.domainSize * n8);
+
+    const outBuf = [ outBuffA, outBuffB ];
+    for (let i=0; i<nCoef; i++) {
+        if ((logger)&&(i%1000000 == 0)) logger.debug(`QAP AB: ${i}/${nCoef}`);
+        const buffCoef = coeffs.slice(4+i*sCoef, 4+i*sCoef+sCoef);
+        const buffCoefV = new DataView(buffCoef.buffer);
+        const m= buffCoefV.getUint32(0, true);
+        const c= buffCoefV.getUint32(4, true);
+        const s= buffCoefV.getUint32(8, true);
+        const coef = buffCoef.slice(12, 12+n8);
+        outBuf[m].set(
+            curve.Fr.add(
+                outBuf[m].slice(c*n8, c*n8+n8),
+                curve.Fr.mul(coef, witness.slice(s*n8, s*n8+n8))
+            ),
+            c*n8
+        );
+    }
+
+    for (let i=0; i<zkey.domainSize; i++) {
+        if ((logger)&&(i%1000000 == 0)) logger.debug(`QAP C: ${i}/${zkey.domainSize}`);
+        outBuffC.set(
+            curve.Fr.mul(
+                outBuffA.slice(i*n8, i*n8+n8),
+                outBuffB.slice(i*n8, i*n8+n8),
+            ),
+            i*n8
+        );
+    }
+
+    return [outBuffA, outBuffB, outBuffC];
+
+}
+
+/*
+async function buldABC(curve, zkey, witness, coeffs, logger) {
+    const concurrency = curve.tm.concurrency;
+    const sCoef = 4*3 + zkey.n8r;
+
+    let getUint32;
+
+    if (coeffs instanceof BigBuffer) {
+        const coeffsDV = [];
+        const PAGE_LEN = coeffs.buffers[0].length;
+        for (let i=0; i< coeffs.buffers.length; i++) {
+            coeffsDV.push(new DataView(coeffs.buffers[i].buffer));
+        }
+        getUint32 = function (pos) {
+            return coeffsDV[Math.floor(pos/PAGE_LEN)].getUint32(pos % PAGE_LEN, true);
+        };
+    } else {
+        const coeffsDV = new DataView(coeffs.buffer, coeffs.byteOffset, coeffs.byteLength);
+        getUint32 = function (pos) {
+            return coeffsDV.getUint32(pos, true);
+        };
+    }
+
+    const elementsPerChunk = Math.floor(zkey.domainSize/concurrency);
+    const promises = [];
+
+    const cutPoints = [];
+    for (let i=0; i<concurrency; i++) {
+        cutPoints.push( getCutPoint( Math.floor(i*elementsPerChunk) ));
+    }
+    cutPoints.push(coeffs.byteLength);
+
+    const chunkSize = 2**26;
+    for (let s=0 ; s<zkey.nVars ; s+= chunkSize) {
+        if (logger) logger.debug(`QAP ${s}: ${s}/${zkey.nVars}`);
+        const ns= Math.min(zkey.nVars-s, chunkSize );
+
+        for (let i=0; i<concurrency; i++) {
+            let n;
+            if (i< concurrency-1) {
+                n = elementsPerChunk;
+            } else {
+                n = zkey.domainSize - i*elementsPerChunk;
+            }
+            if (n==0) continue;
+
+            const task = [];
+
+            task.push({cmd: "ALLOCSET", var: 0, buff: coeffs.slice(cutPoints[i], cutPoints[i+1])});
+            task.push({cmd: "ALLOCSET", var: 1, buff: witness.slice(s*curve.Fr.n8, (s+ns)*curve.Fr.n8)});
+            task.push({cmd: "ALLOC", var: 2, len: n*curve.Fr.n8});
+            task.push({cmd: "ALLOC", var: 3, len: n*curve.Fr.n8});
+            task.push({cmd: "ALLOC", var: 4, len: n*curve.Fr.n8});
+            task.push({cmd: "CALL", fnName: "qap_buildABC", params:[
+                {var: 0},
+                {val: (cutPoints[i+1] - cutPoints[i])/sCoef},
+                {var: 1},
+                {var: 2},
+                {var: 3},
+                {var: 4},
+                {val: i*elementsPerChunk},
+                {val: n},
+                {val: s},
+                {val: ns}
+            ]});
+            task.push({cmd: "GET", out: 0, var: 2, len: n*curve.Fr.n8});
+            task.push({cmd: "GET", out: 1, var: 3, len: n*curve.Fr.n8});
+            task.push({cmd: "GET", out: 2, var: 4, len: n*curve.Fr.n8});
+            promises.push(curve.tm.queueAction(task));
+        }
+    }
+
+    let result = await Promise.all(promises);
+
+    const nGroups = result.length / concurrency;
+    if (nGroups>1) {
+        const promises2 = [];
+        for (let i=0; i<concurrency; i++) {
+            const task=[];
+            task.push({cmd: "ALLOC", var: 0, len: result[i][0].byteLength});
+            task.push({cmd: "ALLOC", var: 1, len: result[i][0].byteLength});
+            for (let m=0; m<3; m++) {
+                task.push({cmd: "SET", var: 0, buff: result[i][m]});
+                for (let s=1; s<nGroups; s++) {
+                    task.push({cmd: "SET", var: 1, buff: result[s*concurrency + i][m]});
+                    task.push({cmd: "CALL", fnName: "qap_batchAdd", params:[
+                        {var: 0},
+                        {var: 1},
+                        {val: result[i][m].length/curve.Fr.n8},
+                        {var: 0}
+                    ]});
+                }
+                task.push({cmd: "GET", out: m, var: 0, len: result[i][m].length});
+            }
+            promises2.push(curve.tm.queueAction(task));
+        }
+        result = await Promise.all(promises2);
+    }
+
+    const outBuffA = new BigBuffer(zkey.domainSize * curve.Fr.n8);
+    const outBuffB = new BigBuffer(zkey.domainSize * curve.Fr.n8);
+    const outBuffC = new BigBuffer(zkey.domainSize * curve.Fr.n8);
+    let p=0;
+    for (let i=0; i<result.length; i++) {
+        outBuffA.set(result[i][0], p);
+        outBuffB.set(result[i][1], p);
+        outBuffC.set(result[i][2], p);
+        p += result[i][0].byteLength;
+    }
+
+    return [outBuffA, outBuffB, outBuffC];
+
+    function getCutPoint(v) {
+        let m = 0;
+        let n = getUint32(0);
+        while (m < n) {
+            var k = Math.floor((n + m) / 2);
+            const va = getUint32(4 + k*sCoef + 4);
+            if (va > v) {
+                n = k - 1;
+            } else if (va < v) {
+                m = k + 1;
+            } else {
+                n = k;
+            }
+        }
+        return 4 + m*sCoef;
+    }
+}
+*/
+
+async function joinABC(curve, zkey, a, b, c, logger) {
+    const MAX_CHUNK_SIZE = 1 << 22;
+
+    const n8 = curve.Fr.n8;
+    const nElements = Math.floor(a.byteLength / curve.Fr.n8);
+
+    const promises = [];
+
+    for (let i=0; i<nElements; i += MAX_CHUNK_SIZE) {
+        if (logger) logger.debug(`JoinABC: ${i}/${nElements}`);
+        const n= Math.min(nElements - i, MAX_CHUNK_SIZE);
+
+        const task = [];
+
+        const aChunk = a.slice(i*n8, (i + n)*n8 );
+        const bChunk = b.slice(i*n8, (i + n)*n8 );
+        const cChunk = c.slice(i*n8, (i + n)*n8 );
+
+        task.push({cmd: "ALLOCSET", var: 0, buff: aChunk});
+        task.push({cmd: "ALLOCSET", var: 1, buff: bChunk});
+        task.push({cmd: "ALLOCSET", var: 2, buff: cChunk});
+        task.push({cmd: "ALLOC", var: 3, len: n*n8});
+        task.push({cmd: "CALL", fnName: "qap_joinABC", params:[
+            {var: 0},
+            {var: 1},
+            {var: 2},
+            {val: n},
+            {var: 3},
+        ]});
+        task.push({cmd: "CALL", fnName: "frm_batchFromMontgomery", params:[
+            {var: 3},
+            {val: n},
+            {var: 3}
+        ]});
+        task.push({cmd: "GET", out: 0, var: 3, len: n*n8});
+        promises.push(curve.tm.queueAction(task));
+    }
+
+    const result = await Promise.all(promises);
+
+    let outBuff;
+    if (a instanceof ffjavascript.BigBuffer) {
+        outBuff = new ffjavascript.BigBuffer(a.byteLength);
+    } else {
+        outBuff = new Uint8Array(a.byteLength);
+    }
+
+    let p=0;
+    for (let i=0; i<result.length; i++) {
+        outBuff.set(result[i][0], p);
+        p += result[i][0].byteLength;
+    }
+
+    return outBuff;
+}
+
+/*
+    Copyright 2018 0KIMS association.
+
+    This file is part of snarkJS.
+
+    snarkJS is a free software: you can redistribute it and/or modify it
+    under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    snarkJS is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
+    License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with snarkJS. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+async function wtnsCalculate(input, wasmFileName, wtnsFileName, options) {
+
+    const fdWasm = await fastFile__namespace.readExisting(wasmFileName);
+    const wasm = await fdWasm.read(fdWasm.totalSize);
+    await fdWasm.close();
+
+    const wc = await circom_runtime.WitnessCalculatorBuilder(wasm);
+    if (wc.circom_version() == 1) {
+        const w = await wc.calculateBinWitness(input);
+
+        const fdWtns = await binFileUtils__namespace.createBinFile(wtnsFileName, "wtns", 2, 2);
+
+        await writeBin(fdWtns, w, wc.prime);
+        await fdWtns.close();
+    } else {
+        const fdWtns = await fastFile__namespace.createOverride(wtnsFileName);
+
+        const w = await wc.calculateWTNSBin(input);
+
+        await fdWtns.write(w);
+        await fdWtns.close();
+    }
+}
+
+/*
+    Copyright 2018 0KIMS association.
+
+    This file is part of snarkJS.
+
+    snarkJS is a free software: you can redistribute it and/or modify it
+    under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    snarkJS is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
+    License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with snarkJS. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+async function groth16FullProve(input, wasmFile, zkeyFileName, logger) {
+    const wtns= {
+        type: "mem"
+    };
+    await wtnsCalculate(input, wasmFile, wtns);
+    return await groth16Prove(zkeyFileName, wtns, logger);
+}
+
+/*
+    Copyright 2018 0kims association.
+
+    This file is part of snarkjs.
+
+    snarkjs is a free software: you can redistribute it and/or
+    modify it under the terms of the GNU General Public License as published by the
+    Free Software Foundation, either version 3 of the License, or (at your option)
+    any later version.
+
+    snarkjs is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+    more details.
+
+    You should have received a copy of the GNU General Public License along with
+    snarkjs. If not, see <https://www.gnu.org/licenses/>.
+*/
+const {unstringifyBigInts: unstringifyBigInts$1} = ffjavascript.utils;
+
+async function groth16Verify(vk_verifier, publicSignals, proof, logger) {
+/*
+    let cpub = vk_verifier.IC[0];
+    for (let s= 0; s< vk_verifier.nPublic; s++) {
+        cpub  = G1.add( cpub, G1.timesScalar( vk_verifier.IC[s+1], publicSignals[s]));
+    }
+*/
+
+    vk_verifier = unstringifyBigInts$1(vk_verifier);
+    proof = unstringifyBigInts$1(proof);
+    publicSignals = unstringifyBigInts$1(publicSignals);
+
+    const curve = await getCurveFromName(vk_verifier.curve);
+
+    const IC0 = curve.G1.fromObject(vk_verifier.IC[0]);
+    const IC = new Uint8Array(curve.G1.F.n8*2 * publicSignals.length);
+    const w = new Uint8Array(curve.Fr.n8 * publicSignals.length);
+
+    for (let i=0; i<publicSignals.length; i++) {
+        const buffP = curve.G1.fromObject(vk_verifier.IC[i+1]);
+        IC.set(buffP, i*curve.G1.F.n8*2);
+        ffjavascript.Scalar.toRprLE(w, curve.Fr.n8*i, publicSignals[i], curve.Fr.n8);
+    }
+
+    let cpub = await curve.G1.multiExpAffine(IC, w);
+    cpub = curve.G1.add(cpub, IC0);
+
+    const pi_a = curve.G1.fromObject(proof.pi_a);
+    const pi_b = curve.G2.fromObject(proof.pi_b);
+    const pi_c = curve.G1.fromObject(proof.pi_c);
+
+    const vk_gamma_2 = curve.G2.fromObject(vk_verifier.vk_gamma_2);
+    const vk_delta_2 = curve.G2.fromObject(vk_verifier.vk_delta_2);
+    const vk_alpha_1 = curve.G1.fromObject(vk_verifier.vk_alpha_1);
+    const vk_beta_2 = curve.G2.fromObject(vk_verifier.vk_beta_2);
+
+    const res = await curve.pairingEq(
+        curve.G1.neg(pi_a) , pi_b,
+        cpub , vk_gamma_2,
+        pi_c , vk_delta_2,
+
+        vk_alpha_1, vk_beta_2
+    );
+
+    if (! res) {
+        if (logger) logger.error("Invalid proof");
+        return false;
+    }
+
+    if (logger) logger.info("OK!");
+    return true;
+}
+
+/*
+    Copyright 2018 0KIMS association.
+
+    This file is part of snarkJS.
+
+    snarkJS is a free software: you can redistribute it and/or modify it
+    under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    snarkJS is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
+    License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with snarkJS. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+function p256$1(n) {
+    let nstr = n.toString(16);
+    while (nstr.length < 64) nstr = "0"+nstr;
+    nstr = `"0x${nstr}"`;
+    return nstr;
+}
+
+async function groth16ExportSolidityCallData(proof, pub) {
+
+    let inputs = "";
+    for (let i=0; i<pub.length; i++) {
+        if (inputs != "") inputs = inputs + ",";
+        inputs = inputs + p256$1(pub[i]);
+    }
+
+    let S;
+    S=`[${p256$1(proof.pi_a[0])}, ${p256$1(proof.pi_a[1])}],` +
+        `[[${p256$1(proof.pi_b[0][1])}, ${p256$1(proof.pi_b[0][0])}],[${p256$1(proof.pi_b[1][1])}, ${p256$1(proof.pi_b[1][0])}]],` +
+        `[${p256$1(proof.pi_c[0])}, ${p256$1(proof.pi_c[1])}],` +
+        `[${inputs}]`;
+
+    return S;
+}
+
+/*
+    Copyright 2018 0KIMS association.
+
+    This file is part of snarkJS.
+
+    snarkJS is a free software: you can redistribute it and/or modify it
+    under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    snarkJS is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
+    License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with snarkJS. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+var groth16 = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    fullProve: groth16FullProve,
+    prove: groth16Prove,
+    verify: groth16Verify,
+    exportSolidityCallData: groth16ExportSolidityCallData
+});
+
+/*
+    Copyright 2018 0KIMS association.
+
+    This file is part of snarkJS.
+
+    snarkJS is a free software: you can redistribute it and/or modify it
+    under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    snarkJS is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
+    License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with snarkJS. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+function hashToG2(curve, hash) {
+    const hashV = new DataView(hash.buffer, hash.byteOffset, hash.byteLength);
+    const seed = [];
+    for (let i=0; i<8; i++) {
+        seed[i] = hashV.getUint32(i*4);
+    }
+
+    const rng = new ffjavascript.ChaCha(seed);
+
+    const g2_sp = curve.G2.fromRng(rng);
+
+    return g2_sp;
+}
+
+function getG2sp(curve, persinalization, challenge, g1s, g1sx) {
+
+    const h = Blake2b__default["default"](64);
+    const b1 = new Uint8Array([persinalization]);
+    h.update(b1);
+    h.update(challenge);
+    const b3 = curve.G1.toUncompressed(g1s);
+    h.update( b3);
+    const b4 = curve.G1.toUncompressed(g1sx);
+    h.update( b4);
+    const hash =h.digest();
+
+    return hashToG2(curve, hash);
+}
+
+function calculatePubKey(k, curve, personalization, challengeHash, rng ) {
+    k.g1_s = curve.G1.toAffine(curve.G1.fromRng(rng));
+    k.g1_sx = curve.G1.toAffine(curve.G1.timesFr(k.g1_s, k.prvKey));
+    k.g2_sp = curve.G2.toAffine(getG2sp(curve, personalization, challengeHash, k.g1_s, k.g1_sx));
+    k.g2_spx = curve.G2.toAffine(curve.G2.timesFr(k.g2_sp, k.prvKey));
+    return k;
+}
+
+function createPTauKey(curve, challengeHash, rng) {
+    const key = {
+        tau: {},
+        alpha: {},
+        beta: {}
+    };
+    key.tau.prvKey = curve.Fr.fromRng(rng);
+    key.alpha.prvKey = curve.Fr.fromRng(rng);
+    key.beta.prvKey = curve.Fr.fromRng(rng);
+    calculatePubKey(key.tau, curve, 0, challengeHash, rng);
+    calculatePubKey(key.alpha, curve, 1, challengeHash, rng);
+    calculatePubKey(key.beta, curve, 2, challengeHash, rng);
+    return key;
+}
+
+/*
+    Copyright 2018 0KIMS association.
+
+    This file is part of snarkJS.
+
+    snarkJS is a free software: you can redistribute it and/or modify it
+    under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    snarkJS is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
+    License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with snarkJS. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+async function writePTauHeader(fd, curve, power, ceremonyPower) {
+    // Write the header
+    ///////////
+
+    if (! ceremonyPower) ceremonyPower = power;
+    await fd.writeULE32(1); // Header type
+    const pHeaderSize = fd.pos;
+    await fd.writeULE64(0); // Temporally set to 0 length
+
+    await fd.writeULE32(curve.F1.n64*8);
+
+    const buff = new Uint8Array(curve.F1.n8);
+    ffjavascript.Scalar.toRprLE(buff, 0, curve.q, curve.F1.n8);
+    await fd.write(buff);
+    await fd.writeULE32(power);                    // power
+    await fd.writeULE32(ceremonyPower);               // power
+
+    const headerSize = fd.pos - pHeaderSize - 8;
+
+    const oldPos = fd.pos;
+
+    await fd.writeULE64(headerSize, pHeaderSize);
+
+    fd.pos = oldPos;
+}
+
+async function readPTauHeader(fd, sections) {
+    if (!sections[1])  throw new Error(fd.fileName + ": File has no  header");
+    if (sections[1].length>1) throw new Error(fd.fileName +": File has more than one header");
+
+    fd.pos = sections[1][0].p;
+    const n8 = await fd.readULE32();
+    const buff = await fd.read(n8);
+    const q = ffjavascript.Scalar.fromRprLE(buff);
+
+    const curve = await getCurveFromQ(q);
+
+    if (curve.F1.n64*8 != n8) throw new Error(fd.fileName +": Invalid size");
+
+    const power = await fd.readULE32();
+    const ceremonyPower = await fd.readULE32();
+
+    if (fd.pos-sections[1][0].p != sections[1][0].size) throw new Error("Invalid PTau header size");
+
+    return {curve, power, ceremonyPower};
+}
+
+
+async function readPtauPubKey(fd, curve, montgomery) {
+
+    const buff = await fd.read(curve.F1.n8*2*6 + curve.F2.n8*2*3);
+
+    return fromPtauPubKeyRpr(buff, 0, curve, montgomery);
+}
+
+function fromPtauPubKeyRpr(buff, pos, curve, montgomery) {
+
+    const key = {
+        tau: {},
+        alpha: {},
+        beta: {}
+    };
+
+    key.tau.g1_s = readG1();
+    key.tau.g1_sx = readG1();
+    key.alpha.g1_s = readG1();
+    key.alpha.g1_sx = readG1();
+    key.beta.g1_s = readG1();
+    key.beta.g1_sx = readG1();
+    key.tau.g2_spx = readG2();
+    key.alpha.g2_spx = readG2();
+    key.beta.g2_spx = readG2();
+
+    return key;
+
+    function readG1() {
+        let p;
+        if (montgomery) {
+            p = curve.G1.fromRprLEM( buff, pos );
+        } else {
+            p = curve.G1.fromRprUncompressed( buff, pos );
+        }
+        pos += curve.G1.F.n8*2;
+        return p;
+    }
+
+    function readG2() {
+        let p;
+        if (montgomery) {
+            p = curve.G2.fromRprLEM( buff, pos );
+        } else {
+            p = curve.G2.fromRprUncompressed( buff, pos );
+        }
+        pos += curve.G2.F.n8*2;
+        return p;
+    }
+}
+
+function toPtauPubKeyRpr(buff, pos, curve, key, montgomery) {
+
+    writeG1(key.tau.g1_s);
+    writeG1(key.tau.g1_sx);
+    writeG1(key.alpha.g1_s);
+    writeG1(key.alpha.g1_sx);
+    writeG1(key.beta.g1_s);
+    writeG1(key.beta.g1_sx);
+    writeG2(key.tau.g2_spx);
+    writeG2(key.alpha.g2_spx);
+    writeG2(key.beta.g2_spx);
+
+    async function writeG1(p) {
+        if (montgomery) {
+            curve.G1.toRprLEM(buff, pos, p);
+        } else {
+            curve.G1.toRprUncompressed(buff, pos, p);
+        }
+        pos += curve.F1.n8*2;
+    }
+
+    async function writeG2(p) {
+        if (montgomery) {
+            curve.G2.toRprLEM(buff, pos, p);
+        } else {
+            curve.G2.toRprUncompressed(buff, pos, p);
+        }
+        pos += curve.F2.n8*2;
+    }
+
+    return buff;
+}
+
+async function writePtauPubKey(fd, curve, key, montgomery) {
+    const buff = new Uint8Array(curve.F1.n8*2*6 + curve.F2.n8*2*3);
+    toPtauPubKeyRpr(buff, 0, curve, key, montgomery);
+    await fd.write(buff);
+}
+
+async function readContribution(fd, curve) {
+    const c = {};
+
+    c.tauG1 = await readG1();
+    c.tauG2 = await readG2();
+    c.alphaG1 = await readG1();
+    c.betaG1 = await readG1();
+    c.betaG2 = await readG2();
+    c.key = await readPtauPubKey(fd, curve, true);
+    c.partialHash = await fd.read(216);
+    c.nextChallenge = await fd.read(64);
+    c.type = await fd.readULE32();
+
+    const buffV  = new Uint8Array(curve.G1.F.n8*2*6+curve.G2.F.n8*2*3);
+    toPtauPubKeyRpr(buffV, 0, curve, c.key, false);
+
+    const responseHasher = Blake2b__default["default"](64);
+    responseHasher.setPartialHash(c.partialHash);
+    responseHasher.update(buffV);
+    c.responseHash = responseHasher.digest();
+
+    const paramLength = await fd.readULE32();
+    const curPos = fd.pos;
+    let lastType =0;
+    while (fd.pos-curPos < paramLength) {
+        const buffType = await readDV(1);
+        if (buffType[0]<= lastType) throw new Error("Parameters in the contribution must be sorted");
+        lastType = buffType[0];
+        if (buffType[0]==1) {     // Name
+            const buffLen = await readDV(1);
+            const buffStr = await readDV(buffLen[0]);
+            c.name = new TextDecoder().decode(buffStr);
+        } else if (buffType[0]==2) {
+            const buffExp = await readDV(1);
+            c.numIterationsExp = buffExp[0];
+        } else if (buffType[0]==3) {
+            const buffLen = await readDV(1);
+            c.beaconHash = await readDV(buffLen[0]);
+        } else {
+            throw new Error("Parameter not recognized");
+        }
+    }
+    if (fd.pos != curPos + paramLength) {
+        throw new Error("Parametes do not match");
+    }
+
+    return c;
+
+    async function readG1() {
+        const pBuff = await fd.read(curve.G1.F.n8*2);
+        return curve.G1.fromRprLEM( pBuff );
+    }
+
+    async function readG2() {
+        const pBuff = await fd.read(curve.G2.F.n8*2);
+        return curve.G2.fromRprLEM( pBuff );
+    }
+
+    async function readDV(n) {
+        const b = await fd.read(n);
+        return new Uint8Array(b);
+    }
+}
+
+async function readContributions(fd, curve, sections) {
+    if (!sections[7])  throw new Error(fd.fileName + ": File has no  contributions");
+    if (sections[7][0].length>1) throw new Error(fd.fileName +": File has more than one contributions section");
+
+    fd.pos = sections[7][0].p;
+    const nContributions = await fd.readULE32();
+    const contributions = [];
+    for (let i=0; i<nContributions; i++) {
+        const c = await readContribution(fd, curve);
+        c.id = i+1;
+        contributions.push(c);
+    }
+
+    if (fd.pos-sections[7][0].p != sections[7][0].size) throw new Error("Invalid contribution section size");
+
+    return contributions;
+}
+
+async function writeContribution(fd, curve, contribution) {
+
+    const buffG1 = new Uint8Array(curve.F1.n8*2);
+    const buffG2 = new Uint8Array(curve.F2.n8*2);
+    await writeG1(contribution.tauG1);
+    await writeG2(contribution.tauG2);
+    await writeG1(contribution.alphaG1);
+    await writeG1(contribution.betaG1);
+    await writeG2(contribution.betaG2);
+    await writePtauPubKey(fd, curve, contribution.key, true);
+    await fd.write(contribution.partialHash);
+    await fd.write(contribution.nextChallenge);
+    await fd.writeULE32(contribution.type || 0);
+
+    const params = [];
+    if (contribution.name) {
+        params.push(1);      // Param Name
+        const nameData = new TextEncoder("utf-8").encode(contribution.name.substring(0,64));
+        params.push(nameData.byteLength);
+        for (let i=0; i<nameData.byteLength; i++) params.push(nameData[i]);
+    }
+    if (contribution.type == 1) {
+        params.push(2);      // Param numIterationsExp
+        params.push(contribution.numIterationsExp);
+
+        params.push(3);      // Beacon Hash
+        params.push(contribution.beaconHash.byteLength);
+        for (let i=0; i<contribution.beaconHash.byteLength; i++) params.push(contribution.beaconHash[i]);
+    }
+    if (params.length>0) {
+        const paramsBuff = new Uint8Array(params);
+        await fd.writeULE32(paramsBuff.byteLength);
+        await fd.write(paramsBuff);
+    } else {
+        await fd.writeULE32(0);
+    }
+
+
+    async function writeG1(p) {
+        curve.G1.toRprLEM(buffG1, 0, p);
+        await fd.write(buffG1);
+    }
+
+    async function writeG2(p) {
+        curve.G2.toRprLEM(buffG2, 0, p);
+        await fd.write(buffG2);
+    }
+
+}
+
+async function writeContributions(fd, curve, contributions) {
+
+    await fd.writeULE32(7); // Header type
+    const pContributionsSize = fd.pos;
+    await fd.writeULE64(0); // Temporally set to 0 length
+
+    await fd.writeULE32(contributions.length);
+    for (let i=0; i< contributions.length; i++) {
+        await writeContribution(fd, curve, contributions[i]);
+    }
+    const contributionsSize = fd.pos - pContributionsSize - 8;
+
+    const oldPos = fd.pos;
+
+    await fd.writeULE64(contributionsSize, pContributionsSize);
+    fd.pos = oldPos;
+}
+
+function calculateFirstChallengeHash(curve, power, logger) {
+    if (logger) logger.debug("Calculating First Challenge Hash");
+
+    const hasher = new Blake2b__default["default"](64);
+
+    const vG1 = new Uint8Array(curve.G1.F.n8*2);
+    const vG2 = new Uint8Array(curve.G2.F.n8*2);
+    curve.G1.toRprUncompressed(vG1, 0, curve.G1.g);
+    curve.G2.toRprUncompressed(vG2, 0, curve.G2.g);
+
+    hasher.update(Blake2b__default["default"](64).digest());
+
+    let n;
+
+    n=(2 ** power)*2 -1;
+    if (logger) logger.debug("Calculate Initial Hash: tauG1");
+    hashBlock(vG1, n);
+    n= 2 ** power;
+    if (logger) logger.debug("Calculate Initial Hash: tauG2");
+    hashBlock(vG2, n);
+    if (logger) logger.debug("Calculate Initial Hash: alphaTauG1");
+    hashBlock(vG1, n);
+    if (logger) logger.debug("Calculate Initial Hash: betaTauG1");
+    hashBlock(vG1, n);
+    hasher.update(vG2);
+
+    return hasher.digest();
+
+    function hashBlock(buff, n) {
+        const blockSize = 500000;
+        const nBlocks = Math.floor(n / blockSize);
+        const rem = n % blockSize;
+        const bigBuff = new Uint8Array(blockSize * buff.byteLength);
+        for (let i=0; i<blockSize; i++) {
+            bigBuff.set(buff, i*buff.byteLength);
+        }
+        for (let i=0; i<nBlocks; i++) {
+            hasher.update(bigBuff);
+            if (logger) logger.debug("Initial hash: " +i*blockSize);
+        }
+        for (let i=0; i<rem; i++) {
+            hasher.update(buff);
+        }
+    }
+}
+
+
+function keyFromBeacon(curve, challengeHash, beaconHash, numIterationsExp) {
+
+    const rng = rngFromBeaconParams(beaconHash, numIterationsExp);
+
+    const key = createPTauKey(curve, challengeHash, rng);
+
+    return key;
+}
+
+/*
+    Copyright 2018 0KIMS association.
+
+    This file is part of snarkJS.
+
+    snarkJS is a free software: you can redistribute it and/or modify it
+    under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    snarkJS is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
+    License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with snarkJS. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+async function newAccumulator(curve, power, fileName, logger) {
+
+    await Blake2b__default["default"].ready();
+
+    const fd = await binFileUtils__namespace.createBinFile(fileName, "ptau", 1, 7);
+
+    await writePTauHeader(fd, curve, power, 0);
+
+    const buffG1 = curve.G1.oneAffine;
+    const buffG2 = curve.G2.oneAffine;
+
+    // Write tauG1
+    ///////////
+    await binFileUtils__namespace.startWriteSection(fd, 2);
+    const nTauG1 = (2 ** power) * 2 -1;
+    for (let i=0; i< nTauG1; i++) {
+        await fd.write(buffG1);
+        if ((logger)&&((i%100000) == 0)&&i) logger.log("tauG1: " + i);
+    }
+    await binFileUtils__namespace.endWriteSection(fd);
+
+    // Write tauG2
+    ///////////
+    await binFileUtils__namespace.startWriteSection(fd, 3);
+    const nTauG2 = (2 ** power);
+    for (let i=0; i< nTauG2; i++) {
+        await fd.write(buffG2);
+        if ((logger)&&((i%100000) == 0)&&i) logger.log("tauG2: " + i);
+    }
+    await binFileUtils__namespace.endWriteSection(fd);
+
+    // Write alphaTauG1
+    ///////////
+    await binFileUtils__namespace.startWriteSection(fd, 4);
+    const nAlfaTauG1 = (2 ** power);
+    for (let i=0; i< nAlfaTauG1; i++) {
+        await fd.write(buffG1);
+        if ((logger)&&((i%100000) == 0)&&i) logger.log("alphaTauG1: " + i);
+    }
+    await binFileUtils__namespace.endWriteSection(fd);
+
+    // Write betaTauG1
+    ///////////
+    await binFileUtils__namespace.startWriteSection(fd, 5);
+    const nBetaTauG1 = (2 ** power);
+    for (let i=0; i< nBetaTauG1; i++) {
+        await fd.write(buffG1);
+        if ((logger)&&((i%100000) == 0)&&i) logger.log("betaTauG1: " + i);
+    }
+    await binFileUtils__namespace.endWriteSection(fd);
+
+    // Write betaG2
+    ///////////
+    await binFileUtils__namespace.startWriteSection(fd, 6);
+    await fd.write(buffG2);
+    await binFileUtils__namespace.endWriteSection(fd);
+
+    // Contributions
+    ///////////
+    await binFileUtils__namespace.startWriteSection(fd, 7);
+    await fd.writeULE32(0); // 0 Contributions
+    await binFileUtils__namespace.endWriteSection(fd);
+
+    await fd.close();
+
+    const firstChallengeHash = calculateFirstChallengeHash(curve, power, logger);
+
+    if (logger) logger.debug(formatHash(Blake2b__default["default"](64).digest(), "Blank Contribution Hash:"));
+
+    if (logger) logger.info(formatHash(firstChallengeHash, "First Contribution Hash:"));
+
+    return firstChallengeHash;
+
+}
+
+// Format of the outpu
+
+async function exportChallenge(pTauFilename, challengeFilename, logger) {
+    await Blake2b__default["default"].ready();
+    const {fd: fdFrom, sections} = await binFileUtils__namespace.readBinFile(pTauFilename, "ptau", 1);
+
+    const {curve, power} = await readPTauHeader(fdFrom, sections);
+
+    const contributions = await readContributions(fdFrom, curve, sections);
+    let lastResponseHash, curChallengeHash;
+    if (contributions.length == 0) {
+        lastResponseHash = Blake2b__default["default"](64).digest();
+        curChallengeHash = calculateFirstChallengeHash(curve, power);
+    } else {
+        lastResponseHash = contributions[contributions.length-1].responseHash;
+        curChallengeHash = contributions[contributions.length-1].nextChallenge;
+    }
+
+    if (logger) logger.info(formatHash(lastResponseHash, "Last Response Hash: "));
+
+    if (logger) logger.info(formatHash(curChallengeHash, "New Challenge Hash: "));
+
+
+    const fdTo = await fastFile__namespace.createOverride(challengeFilename);
+
+    const toHash = Blake2b__default["default"](64);
+    await fdTo.write(lastResponseHash);
+    toHash.update(lastResponseHash);
+
+    await exportSection(2, "G1", (2 ** power) * 2 -1, "tauG1");
+    await exportSection(3, "G2", (2 ** power)       , "tauG2");
+    await exportSection(4, "G1", (2 ** power)       , "alphaTauG1");
+    await exportSection(5, "G1", (2 ** power)       , "betaTauG1");
+    await exportSection(6, "G2", 1                  , "betaG2");
+
+    await fdFrom.close();
+    await fdTo.close();
+
+    const calcCurChallengeHash = toHash.digest();
+
+    if (!hashIsEqual (curChallengeHash, calcCurChallengeHash)) {
+        if (logger) logger.info(formatHash(calcCurChallengeHash, "Calc Curret Challenge Hash: "));
+
+        if (logger) logger.error("PTau file is corrupted. Calculated new challenge hash does not match with the eclared one");
+        throw new Error("PTau file is corrupted. Calculated new challenge hash does not match with the eclared one");
+    }
+
+    return curChallengeHash;
+
+    async function exportSection(sectionId, groupName, nPoints, sectionName) {
+        const G = curve[groupName];
+        const sG = G.F.n8*2;
+        const nPointsChunk = Math.floor((1<<24)/sG);
+
+        await binFileUtils__namespace.startReadUniqueSection(fdFrom, sections, sectionId);
+        for (let i=0; i< nPoints; i+= nPointsChunk) {
+            if (logger) logger.debug(`Exporting ${sectionName}: ${i}/${nPoints}`);
+            const n = Math.min(nPoints-i, nPointsChunk);
+            let buff;
+            buff = await fdFrom.read(n*sG);
+            buff = await G.batchLEMtoU(buff);
+            await fdTo.write(buff);
+            toHash.update(buff);
+        }
+        await binFileUtils__namespace.endReadSection(fdFrom);
+    }
+
+
+}
+
+/*
+    Copyright 2018 0KIMS association.
+
+    This file is part of snarkJS.
+
+    snarkJS is a free software: you can redistribute it and/or modify it
+    under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    snarkJS is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
+    License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with snarkJS. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+async function importResponse(oldPtauFilename, contributionFilename, newPTauFilename, name, importPoints, logger) {
+
+    await Blake2b__default["default"].ready();
+
+    const noHash = new Uint8Array(64);
+    for (let i=0; i<64; i++) noHash[i] = 0xFF;
+
+    const {fd: fdOld, sections} = await binFileUtils__namespace.readBinFile(oldPtauFilename, "ptau", 1);
+    const {curve, power} = await readPTauHeader(fdOld, sections);
+    const contributions = await readContributions(fdOld, curve, sections);
+    const currentContribution = {};
+
+    if (name) currentContribution.name = name;
+
+    const sG1 = curve.F1.n8*2;
+    const scG1 = curve.F1.n8; // Compresed size
+    const sG2 = curve.F2.n8*2;
+    const scG2 = curve.F2.n8; // Compresed size
+
+    const fdResponse = await fastFile__namespace.readExisting(contributionFilename);
+
+    if  (fdResponse.totalSize !=
+        64 +                            // Old Hash
+        ((2 ** power)*2-1)*scG1 +
+        (2 ** power)*scG2 +
+        (2 ** power)*scG1 +
+        (2 ** power)*scG1 +
+        scG2 +
+        sG1*6 + sG2*3)
+        throw new Error("Size of the contribution is invalid");
+
+    let lastChallengeHash;
+
+    if (contributions.length>0) {
+        lastChallengeHash = contributions[contributions.length-1].nextChallenge;
+    } else {
+        lastChallengeHash = calculateFirstChallengeHash(curve, power, logger);
+    }
+
+    const fdNew = await binFileUtils__namespace.createBinFile(newPTauFilename, "ptau", 1, importPoints ? 7: 2);
+    await writePTauHeader(fdNew, curve, power);
+
+    const contributionPreviousHash = await fdResponse.read(64);
+
+    if (hashIsEqual(noHash,lastChallengeHash)) {
+        lastChallengeHash = contributionPreviousHash;
+        contributions[contributions.length-1].nextChallenge = lastChallengeHash;
+    }
+
+    if(!hashIsEqual(contributionPreviousHash,lastChallengeHash))
+        throw new Error("Wrong contribution. this contribution is not based on the previus hash");
+
+    const hasherResponse = new Blake2b__default["default"](64);
+    hasherResponse.update(contributionPreviousHash);
+
+    const startSections = [];
+    let res;
+    res = await processSection(fdResponse, fdNew, "G1", 2, (2 ** power) * 2 -1, [1], "tauG1");
+    currentContribution.tauG1 = res[0];
+    res = await processSection(fdResponse, fdNew, "G2", 3, (2 ** power)       , [1], "tauG2");
+    currentContribution.tauG2 = res[0];
+    res = await processSection(fdResponse, fdNew, "G1", 4, (2 ** power)       , [0], "alphaG1");
+    currentContribution.alphaG1 = res[0];
+    res = await processSection(fdResponse, fdNew, "G1", 5, (2 ** power)       , [0], "betaG1");
+    currentContribution.betaG1 = res[0];
+    res = await processSection(fdResponse, fdNew, "G2", 6, 1                  , [0], "betaG2");
+    currentContribution.betaG2 = res[0];
+
+    currentContribution.partialHash = hasherResponse.getPartialHash();
+
+
+    const buffKey = await fdResponse.read(curve.F1.n8*2*6+curve.F2.n8*2*3);
+
+    currentContribution.key = fromPtauPubKeyRpr(buffKey, 0, curve, false);
+
+    hasherResponse.update(new Uint8Array(buffKey));
+    const hashResponse = hasherResponse.digest();
+
+    if (logger) logger.info(formatHash(hashResponse, "Contribution Response Hash imported: "));
+
+    if (importPoints) {
+        const nextChallengeHasher = new Blake2b__default["default"](64);
+        nextChallengeHasher.update(hashResponse);
+
+        await hashSection(nextChallengeHasher, fdNew, "G1", 2, (2 ** power) * 2 -1, "tauG1", logger);
+        await hashSection(nextChallengeHasher, fdNew, "G2", 3, (2 ** power)       , "tauG2", logger);
+        await hashSection(nextChallengeHasher, fdNew, "G1", 4, (2 ** power)       , "alphaTauG1", logger);
+        await hashSection(nextChallengeHasher, fdNew, "G1", 5, (2 ** power)       , "betaTauG1", logger);
+        await hashSection(nextChallengeHasher, fdNew, "G2", 6, 1                  , "betaG2", logger);
+
+        currentContribution.nextChallenge = nextChallengeHasher.digest();
+
+        if (logger) logger.info(formatHash(currentContribution.nextChallenge, "Next Challenge Hash: "));
+    } else {
+        currentContribution.nextChallenge = noHash;
+    }
+
+    contributions.push(currentContribution);
+
+    await writeContributions(fdNew, curve, contributions);
+
+    await fdResponse.close();
+    await fdNew.close();
+    await fdOld.close();
+
+    return currentContribution.nextChallenge;
+
+    async function processSection(fdFrom, fdTo, groupName, sectionId, nPoints, singularPointIndexes, sectionName) {
+        if (importPoints) {
+            return await processSectionImportPoints(fdFrom, fdTo, groupName, sectionId, nPoints, singularPointIndexes, sectionName);
+        } else {
+            return await processSectionNoImportPoints(fdFrom, fdTo, groupName, sectionId, nPoints, singularPointIndexes, sectionName);
+        }
+    }
+
+    async function processSectionImportPoints(fdFrom, fdTo, groupName, sectionId, nPoints, singularPointIndexes, sectionName) {
+
+        const G = curve[groupName];
+        const scG = G.F.n8;
+        const sG = G.F.n8*2;
+
+        const singularPoints = [];
+
+        await binFileUtils__namespace.startWriteSection(fdTo, sectionId);
+        const nPointsChunk = Math.floor((1<<24)/sG);
+
+        startSections[sectionId] = fdTo.pos;
+
+        for (let i=0; i< nPoints; i += nPointsChunk) {
+            if (logger) logger.debug(`Importing ${sectionName}: ${i}/${nPoints}`);
+            const n = Math.min(nPoints-i, nPointsChunk);
+
+            const buffC = await fdFrom.read(n * scG);
+            hasherResponse.update(buffC);
+
+            const buffLEM = await G.batchCtoLEM(buffC);
+
+            await fdTo.write(buffLEM);
+            for (let j=0; j<singularPointIndexes.length; j++) {
+                const sp = singularPointIndexes[j];
+                if ((sp >=i) && (sp < i+n)) {
+                    const P = G.fromRprLEM(buffLEM, (sp-i)*sG);
+                    singularPoints.push(P);
+                }
+            }
+        }
+
+        await binFileUtils__namespace.endWriteSection(fdTo);
+
+        return singularPoints;
+    }
+
+
+    async function processSectionNoImportPoints(fdFrom, fdTo, groupName, sectionId, nPoints, singularPointIndexes, sectionName) {
+
+        const G = curve[groupName];
+        const scG = G.F.n8;
+
+        const singularPoints = [];
+
+        const nPointsChunk = Math.floor((1<<24)/scG);
+
+        for (let i=0; i< nPoints; i += nPointsChunk) {
+            if (logger) logger.debug(`Importing ${sectionName}: ${i}/${nPoints}`);
+            const n = Math.min(nPoints-i, nPointsChunk);
+
+            const buffC = await fdFrom.read(n * scG);
+            hasherResponse.update(buffC);
+
+            for (let j=0; j<singularPointIndexes.length; j++) {
+                const sp = singularPointIndexes[j];
+                if ((sp >=i) && (sp < i+n)) {
+                    const P = G.fromRprCompressed(buffC, (sp-i)*scG);
+                    singularPoints.push(P);
+                }
+            }
+        }
+
+        return singularPoints;
+    }
+
+
+    async function hashSection(nextChallengeHasher, fdTo, groupName, sectionId, nPoints, sectionName, logger) {
+
+        const G = curve[groupName];
+        const sG = G.F.n8*2;
+        const nPointsChunk = Math.floor((1<<24)/sG);
+
+        const oldPos = fdTo.pos;
+        fdTo.pos = startSections[sectionId];
+
+        for (let i=0; i< nPoints; i += nPointsChunk) {
+            if (logger) logger.debug(`Hashing ${sectionName}: ${i}/${nPoints}`);
+            const n = Math.min(nPoints-i, nPointsChunk);
+
+            const buffLEM = await fdTo.read(n * sG);
+
+            const buffU = await G.batchLEMtoU(buffLEM);
+
+            nextChallengeHasher.update(buffU);
+        }
+
+        fdTo.pos = oldPos;
+    }
+
+}
+
+/*
+    Copyright 2018 0KIMS association.
+
+    This file is part of snarkJS.
+
+    snarkJS is a free software: you can redistribute it and/or modify it
+    under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    snarkJS is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
+    License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with snarkJS. If not, see <https://www.gnu.org/licenses/>.
+*/
+const sameRatio$1 = sameRatio$2;
+
+async function verifyContribution(curve, cur, prev, logger) {
+    let sr;
+    if (cur.type == 1) {    // Verify the beacon.
+        const beaconKey = keyFromBeacon(curve, prev.nextChallenge, cur.beaconHash, cur.numIterationsExp);
+
+        if (!curve.G1.eq(cur.key.tau.g1_s, beaconKey.tau.g1_s)) {
+            if (logger) logger.error(`BEACON key (tauG1_s) is not generated correctly in challenge #${cur.id}  ${cur.name || ""}` );
+            return false;
+        }
+        if (!curve.G1.eq(cur.key.tau.g1_sx, beaconKey.tau.g1_sx)) {
+            if (logger) logger.error(`BEACON key (tauG1_sx) is not generated correctly in challenge #${cur.id}  ${cur.name || ""}` );
+            return false;
+        }
+        if (!curve.G2.eq(cur.key.tau.g2_spx, beaconKey.tau.g2_spx)) {
+            if (logger) logger.error(`BEACON key (tauG2_spx) is not generated correctly in challenge #${cur.id}  ${cur.name || ""}` );
+            return false;
+        }
+
+        if (!curve.G1.eq(cur.key.alpha.g1_s, beaconKey.alpha.g1_s)) {
+            if (logger) logger.error(`BEACON key (alphaG1_s) is not generated correctly in challenge #${cur.id}  ${cur.name || ""}` );
+            return false;
+        }
+        if (!curve.G1.eq(cur.key.alpha.g1_sx, beaconKey.alpha.g1_sx)) {
+            if (logger) logger.error(`BEACON key (alphaG1_sx) is not generated correctly in challenge #${cur.id}  ${cur.name || ""}` );
+            return false;
+        }
+        if (!curve.G2.eq(cur.key.alpha.g2_spx, beaconKey.alpha.g2_spx)) {
+            if (logger) logger.error(`BEACON key (alphaG2_spx) is not generated correctly in challenge #${cur.id}  ${cur.name || ""}` );
+            return false;
+        }
+
+        if (!curve.G1.eq(cur.key.beta.g1_s, beaconKey.beta.g1_s)) {
+            if (logger) logger.error(`BEACON key (betaG1_s) is not generated correctly in challenge #${cur.id}  ${cur.name || ""}` );
+            return false;
+        }
+        if (!curve.G1.eq(cur.key.beta.g1_sx, beaconKey.beta.g1_sx)) {
+            if (logger) logger.error(`BEACON key (betaG1_sx) is not generated correctly in challenge #${cur.id}  ${cur.name || ""}` );
+            return false;
+        }
+        if (!curve.G2.eq(cur.key.beta.g2_spx, beaconKey.beta.g2_spx)) {
+            if (logger) logger.error(`BEACON key (betaG2_spx) is not generated correctly in challenge #${cur.id}  ${cur.name || ""}` );
+            return false;
+        }
+    }
+
+    cur.key.tau.g2_sp = curve.G2.toAffine(getG2sp(curve, 0, prev.nextChallenge, cur.key.tau.g1_s, cur.key.tau.g1_sx));
+    cur.key.alpha.g2_sp = curve.G2.toAffine(getG2sp(curve, 1, prev.nextChallenge, cur.key.alpha.g1_s, cur.key.alpha.g1_sx));
+    cur.key.beta.g2_sp = curve.G2.toAffine(getG2sp(curve, 2, prev.nextChallenge, cur.key.beta.g1_s, cur.key.beta.g1_sx));
+
+    sr = await sameRatio$1(curve, cur.key.tau.g1_s, cur.key.tau.g1_sx, cur.key.tau.g2_sp, cur.key.tau.g2_spx);
+    if (sr !== true) {
+        if (logger) logger.error("INVALID key (tau) in challenge #"+cur.id);
+        return false;
+    }
+
+    sr = await sameRatio$1(curve, cur.key.alpha.g1_s, cur.key.alpha.g1_sx, cur.key.alpha.g2_sp, cur.key.alpha.g2_spx);
+    if (sr !== true) {
+        if (logger) logger.error("INVALID key (alpha) in challenge #"+cur.id);
+        return false;
+    }
+
+    sr = await sameRatio$1(curve, cur.key.beta.g1_s, cur.key.beta.g1_sx, cur.key.beta.g2_sp, cur.key.beta.g2_spx);
+    if (sr !== true) {
+        if (logger) logger.error("INVALID key (beta) in challenge #"+cur.id);
+        return false;
+    }
+
+    sr = await sameRatio$1(curve, prev.tauG1, cur.tauG1, cur.key.tau.g2_sp, cur.key.tau.g2_spx);
+    if (sr !== true) {
+        if (logger) logger.error("INVALID tau*G1. challenge #"+cur.id+" It does not follow the previous contribution");
+        return false;
+    }
+
+    sr = await sameRatio$1(curve,  cur.key.tau.g1_s, cur.key.tau.g1_sx, prev.tauG2, cur.tauG2);
+    if (sr !== true) {
+        if (logger) logger.error("INVALID tau*G2. challenge #"+cur.id+" It does not follow the previous contribution");
+        return false;
+    }
+
+    sr = await sameRatio$1(curve, prev.alphaG1, cur.alphaG1, cur.key.alpha.g2_sp, cur.key.alpha.g2_spx);
+    if (sr !== true) {
+        if (logger) logger.error("INVALID alpha*G1. challenge #"+cur.id+" It does not follow the previous contribution");
+        return false;
+    }
+
+    sr = await sameRatio$1(curve, prev.betaG1, cur.betaG1, cur.key.beta.g2_sp, cur.key.beta.g2_spx);
+    if (sr !== true) {
+        if (logger) logger.error("INVALID beta*G1. challenge #"+cur.id+" It does not follow the previous contribution");
+        return false;
+    }
+
+    sr = await sameRatio$1(curve,  cur.key.beta.g1_s, cur.key.beta.g1_sx, prev.betaG2, cur.betaG2);
+    if (sr !== true) {
+        if (logger) logger.error("INVALID beta*G2. challenge #"+cur.id+"It does not follow the previous contribution");
+        return false;
+    }
+
+    if (logger) logger.info("Powers Of tau file OK!");
+    return true;
+}
+
+async function verify(tauFilename, logger) {
+    let sr;
+    await Blake2b__default["default"].ready();
+
+    const {fd, sections} = await binFileUtils__namespace.readBinFile(tauFilename, "ptau", 1);
+    const {curve, power, ceremonyPower} = await readPTauHeader(fd, sections);
+    const contrs = await readContributions(fd, curve, sections);
+
+    if (logger) logger.debug("power: 2**" + power);
+    // Verify Last contribution
+
+    if (logger) logger.debug("Computing initial contribution hash");
+    const initialContribution = {
+        tauG1: curve.G1.g,
+        tauG2: curve.G2.g,
+        alphaG1: curve.G1.g,
+        betaG1: curve.G1.g,
+        betaG2: curve.G2.g,
+        nextChallenge: calculateFirstChallengeHash(curve, ceremonyPower, logger),
+        responseHash: Blake2b__default["default"](64).digest()
+    };
+
+    if (contrs.length == 0) {
+        if (logger) logger.error("This file has no contribution! It cannot be used in production");
+        return false;
+    }
+
+    let prevContr;
+    if (contrs.length>1) {
+        prevContr = contrs[contrs.length-2];
+    } else {
+        prevContr = initialContribution;
+    }
+    const curContr = contrs[contrs.length-1];
+    if (logger) logger.debug("Validating contribution #"+contrs[contrs.length-1].id);
+    const res = await verifyContribution(curve, curContr, prevContr, logger);
+    if (!res) return false;
+
+
+    const nextContributionHasher = Blake2b__default["default"](64);
+    nextContributionHasher.update(curContr.responseHash);
+
+    // Verify powers and compute nextChallengeHash
+
+    // await test();
+
+    // Verify Section tau*G1
+    if (logger) logger.debug("Verifying powers in tau*G1 section");
+    const rTau1 = await processSection(2, "G1", "tauG1", (2 ** power)*2-1, [0, 1], logger);
+    sr = await sameRatio$1(curve, rTau1.R1, rTau1.R2, curve.G2.g, curContr.tauG2);
+    if (sr !== true) {
+        if (logger) logger.error("tauG1 section. Powers do not match");
+        return false;
+    }
+    if (!curve.G1.eq(curve.G1.g, rTau1.singularPoints[0])) {
+        if (logger) logger.error("First element of tau*G1 section must be the generator");
+        return false;
+    }
+    if (!curve.G1.eq(curContr.tauG1, rTau1.singularPoints[1])) {
+        if (logger) logger.error("Second element of tau*G1 section does not match the one in the contribution section");
+        return false;
+    }
+
+    // await test();
+
+    // Verify Section tau*G2
+    if (logger) logger.debug("Verifying powers in tau*G2 section");
+    const rTau2 = await processSection(3, "G2", "tauG2", 2 ** power, [0, 1],  logger);
+    sr = await sameRatio$1(curve, curve.G1.g, curContr.tauG1, rTau2.R1, rTau2.R2);
+    if (sr !== true) {
+        if (logger) logger.error("tauG2 section. Powers do not match");
+        return false;
+    }
+    if (!curve.G2.eq(curve.G2.g, rTau2.singularPoints[0])) {
+        if (logger) logger.error("First element of tau*G2 section must be the generator");
+        return false;
+    }
+    if (!curve.G2.eq(curContr.tauG2, rTau2.singularPoints[1])) {
+        if (logger) logger.error("Second element of tau*G2 section does not match the one in the contribution section");
+        return false;
+    }
+
+    // Verify Section alpha*tau*G1
+    if (logger) logger.debug("Verifying powers in alpha*tau*G1 section");
+    const rAlphaTauG1 = await processSection(4, "G1", "alphatauG1", 2 ** power, [0], logger);
+    sr = await sameRatio$1(curve, rAlphaTauG1.R1, rAlphaTauG1.R2, curve.G2.g, curContr.tauG2);
+    if (sr !== true) {
+        if (logger) logger.error("alphaTauG1 section. Powers do not match");
+        return false;
+    }
+    if (!curve.G1.eq(curContr.alphaG1, rAlphaTauG1.singularPoints[0])) {
+        if (logger) logger.error("First element of alpha*tau*G1 section (alpha*G1) does not match the one in the contribution section");
+        return false;
+    }
+
+    // Verify Section beta*tau*G1
+    if (logger) logger.debug("Verifying powers in beta*tau*G1 section");
+    const rBetaTauG1 = await processSection(5, "G1", "betatauG1", 2 ** power, [0], logger);
+    sr = await sameRatio$1(curve, rBetaTauG1.R1, rBetaTauG1.R2, curve.G2.g, curContr.tauG2);
+    if (sr !== true) {
+        if (logger) logger.error("betaTauG1 section. Powers do not match");
+        return false;
+    }
+    if (!curve.G1.eq(curContr.betaG1, rBetaTauG1.singularPoints[0])) {
+        if (logger) logger.error("First element of beta*tau*G1 section (beta*G1) does not match the one in the contribution section");
+        return false;
+    }
+
+    //Verify Beta G2
+    const betaG2 = await processSectionBetaG2(logger);
+    if (!curve.G2.eq(curContr.betaG2, betaG2)) {
+        if (logger) logger.error("betaG2 element in betaG2 section does not match the one in the contribution section");
+        return false;
+    }
+
+
+    const nextContributionHash = nextContributionHasher.digest();
+
+    // Check the nextChallengeHash
+    if (power == ceremonyPower) {
+        if (!hashIsEqual(nextContributionHash,curContr.nextChallenge)) {
+            if (logger) logger.error("Hash of the values does not match the next challenge of the last contributor in the contributions section");
+            return false;
+        }
+    }
+
+    if (logger) logger.info(formatHash(nextContributionHash, "Next challenge hash: "));
+
+    // Verify Previous contributions
+
+    printContribution(curContr, prevContr);
+    for (let i = contrs.length-2; i>=0; i--) {
+        const curContr = contrs[i];
+        const prevContr =  (i>0) ? contrs[i-1] : initialContribution;
+        const res = await verifyContribution(curve, curContr, prevContr, logger);
+        if (!res) return false;
+        printContribution(curContr, prevContr);
+    }
+    if (logger) logger.info("-----------------------------------------------------");
+
+    if ((!sections[12]) || (!sections[13]) || (!sections[14]) || (!sections[15])) {
+        if (logger) logger.warn(
+            "this file does not contain phase2 precalculated values. Please run: \n" +
+            "   snarkjs \"powersoftau preparephase2\" to prepare this file to be used in the phase2 ceremony."
+        );
+    } else {
+        let res;
+        res = await verifyLagrangeEvaluations("G1", 2, 12, "tauG1", logger);
+        if (!res) return false;
+        res = await verifyLagrangeEvaluations("G2", 3, 13, "tauG2", logger);
+        if (!res) return false;
+        res = await verifyLagrangeEvaluations("G1", 4, 14, "alphaTauG1", logger);
+        if (!res) return false;
+        res = await verifyLagrangeEvaluations("G1", 5, 15, "betaTauG1", logger);
+        if (!res) return false;
+    }
+
+    await fd.close();
+
+    if (logger) logger.info("Powers of Tau Ok!");
+
+    return true;
+
+    function printContribution(curContr, prevContr) {
+        if (!logger) return;
+        logger.info("-----------------------------------------------------");
+        logger.info(`Contribution #${curContr.id}: ${curContr.name ||""}`);
+
+        logger.info(formatHash(curContr.nextChallenge, "Next Challenge: "));
+
+        const buffV  = new Uint8Array(curve.G1.F.n8*2*6+curve.G2.F.n8*2*3);
+        toPtauPubKeyRpr(buffV, 0, curve, curContr.key, false);
+
+        const responseHasher = Blake2b__default["default"](64);
+        responseHasher.setPartialHash(curContr.partialHash);
+        responseHasher.update(buffV);
+        const responseHash = responseHasher.digest();
+
+        logger.info(formatHash(responseHash, "Response Hash:"));
+
+        logger.info(formatHash(prevContr.nextChallenge, "Response Hash:"));
+
+        if (curContr.type == 1) {
+            logger.info(`Beacon generator: ${byteArray2hex(curContr.beaconHash)}`);
+            logger.info(`Beacon iterations Exp: ${curContr.numIterationsExp}`);
+        }
+
+    }
+
+    async function processSectionBetaG2(logger) {
+        const G = curve.G2;
+        const sG = G.F.n8*2;
+        const buffUv = new Uint8Array(sG);
+
+        if (!sections[6])  {
+            logger.error("File has no BetaG2 section");
+            throw new Error("File has no BetaG2 section");
+        }
+        if (sections[6].length>1) {
+            logger.error("File has no BetaG2 section");
+            throw new Error("File has more than one GetaG2 section");
+        }
+        fd.pos = sections[6][0].p;
+
+        const buff = await fd.read(sG);
+        const P = G.fromRprLEM(buff);
+
+        G.toRprUncompressed(buffUv, 0, P);
+        nextContributionHasher.update(buffUv);
+
+        return P;
+    }
+
+    async function processSection(idSection, groupName, sectionName, nPoints, singularPointIndexes, logger) {
+        const MAX_CHUNK_SIZE = 1<<16;
+        const G = curve[groupName];
+        const sG = G.F.n8*2;
+        await binFileUtils__namespace.startReadUniqueSection(fd, sections, idSection);
+
+        const singularPoints = [];
+
+        let R1 = G.zero;
+        let R2 = G.zero;
+
+        let lastBase = G.zero;
+
+        for (let i=0; i<nPoints; i += MAX_CHUNK_SIZE) {
+            if (logger) logger.debug(`points relations: ${sectionName}: ${i}/${nPoints} `);
+            const n = Math.min(nPoints - i, MAX_CHUNK_SIZE);
+            const bases = await fd.read(n*sG);
+
+            const basesU = await G.batchLEMtoU(bases);
+            nextContributionHasher.update(basesU);
+
+            const scalars = new Uint8Array(4*(n-1));
+            crypto__default["default"].randomFillSync(scalars);
+
+
+            if (i>0) {
+                const firstBase = G.fromRprLEM(bases, 0);
+                const r = crypto__default["default"].randomBytes(4).readUInt32BE(0, true);
+
+                R1 = G.add(R1, G.timesScalar(lastBase, r));
+                R2 = G.add(R2, G.timesScalar(firstBase, r));
+            }
+
+            const r1 = await G.multiExpAffine(bases.slice(0, (n-1)*sG), scalars);
+            const r2 = await G.multiExpAffine(bases.slice(sG), scalars);
+
+            R1 = G.add(R1, r1);
+            R2 = G.add(R2, r2);
+
+            lastBase = G.fromRprLEM( bases, (n-1)*sG);
+
+            for (let j=0; j<singularPointIndexes.length; j++) {
+                const sp = singularPointIndexes[j];
+                if ((sp >=i) && (sp < i+n)) {
+                    const P = G.fromRprLEM(bases, (sp-i)*sG);
+                    singularPoints.push(P);
+                }
+            }
+
+        }
+        await binFileUtils__namespace.endReadSection(fd);
+
+        return {
+            R1: R1,
+            R2: R2,
+            singularPoints: singularPoints
+        };
+
+    }
+
+    async function verifyLagrangeEvaluations(gName, tauSection, lagrangeSection, sectionName, logger) {
+
+        if (logger) logger.debug(`Verifying phase2 calculated values ${sectionName}...`);
+        const G = curve[gName];
+        const sG = G.F.n8*2;
+
+        const seed= new Array(8);
+        for (let i=0; i<8; i++) {
+            seed[i] = crypto__default["default"].randomBytes(4).readUInt32BE(0, true);
+        }
+
+        for (let p=0; p<= power; p ++) {
+            const res = await verifyPower(p);
+            if (!res) return false;
+        }
+
+        if (tauSection == 2) {
+            const res = await verifyPower(power+1);
+            if (!res) return false;
+        }
+
+        return true;
+
+        async function verifyPower(p) {
+            if (logger) logger.debug(`Power ${p}...`);
+            const n8r = curve.Fr.n8;
+            const nPoints = 2 ** p;
+            let buff_r = new Uint32Array(nPoints);
+            let buffG;
+
+            let rng = new ffjavascript.ChaCha(seed);
+
+            if (logger) logger.debug(`Creating random numbers Powers${p}...`);
+            for (let i=0; i<nPoints; i++) {
+                if ((p == power+1)&&(i == nPoints-1)) {
+                    buff_r[i] = 0;
+                } else {
+                    buff_r[i] = rng.nextU32();
+                }
+            }
+
+            buff_r = new Uint8Array(buff_r.buffer, buff_r.byteOffset, buff_r.byteLength);
+
+            if (logger) logger.debug(`reading points Powers${p}...`);
+            await binFileUtils__namespace.startReadUniqueSection(fd, sections, tauSection);
+            buffG = new ffjavascript.BigBuffer(nPoints*sG);
+            if (p == power+1) {
+                await fd.readToBuffer(buffG, 0, (nPoints-1)*sG);
+                buffG.set(curve.G1.zeroAffine, (nPoints-1)*sG);
+            } else {
+                await fd.readToBuffer(buffG, 0, nPoints*sG);
+            }
+            await binFileUtils__namespace.endReadSection(fd, true);
+
+            const resTau = await G.multiExpAffine(buffG, buff_r, logger, sectionName + "_" + p);
+
+            buff_r = new ffjavascript.BigBuffer(nPoints * n8r);
+
+            rng = new ffjavascript.ChaCha(seed);
+
+            const buff4 = new Uint8Array(4);
+            const buff4V = new DataView(buff4.buffer);
+
+            if (logger) logger.debug(`Creating random numbers Powers${p}...`);
+            for (let i=0; i<nPoints; i++) {
+                if ((i != nPoints-1) || (p != power+1)) {
+                    buff4V.setUint32(0, rng.nextU32(), true);
+                    buff_r.set(buff4, i*n8r);
+                }
+            }
+
+            if (logger) logger.debug(`batchToMontgomery ${p}...`);
+            buff_r = await curve.Fr.batchToMontgomery(buff_r);
+            if (logger) logger.debug(`fft ${p}...`);
+            buff_r = await curve.Fr.fft(buff_r);
+            if (logger) logger.debug(`batchFromMontgomery ${p}...`);
+            buff_r = await curve.Fr.batchFromMontgomery(buff_r);
+
+            if (logger) logger.debug(`reading points Lagrange${p}...`);
+            await binFileUtils__namespace.startReadUniqueSection(fd, sections, lagrangeSection);
+            fd.pos += sG*((2 ** p)-1);
+            await fd.readToBuffer(buffG, 0, nPoints*sG);
+            await binFileUtils__namespace.endReadSection(fd, true);
+
+            const resLagrange = await G.multiExpAffine(buffG, buff_r, logger, sectionName + "_" + p + "_transformed");
+
+            if (!G.eq(resTau, resLagrange)) {
+                if (logger) logger.error("Phase2 caclutation does not match with powers of tau");
+                return false;
+            }
+
+            return true;
+        }
+    }
+}
+
+/*
+    Copyright 2018 0KIMS association.
+
+    This file is part of snarkJS.
+
+    snarkJS is a free software: you can redistribute it and/or modify it
+    under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    snarkJS is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
+    License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with snarkJS. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+/*
+    This function creates a new section in the fdTo file with id idSection.
+    It multiplies the pooints in fdFrom by first, first*inc, first*inc^2, ....
+    nPoint Times.
+    It also updates the newChallengeHasher with the new points
+*/
+
+async function applyKeyToSection(fdOld, sections, fdNew, idSection, curve, groupName, first, inc, sectionName, logger) {
+    const MAX_CHUNK_SIZE = 1 << 16;
+    const G = curve[groupName];
+    const sG = G.F.n8*2;
+    const nPoints = sections[idSection][0].size / sG;
+
+    await binFileUtils__namespace.startReadUniqueSection(fdOld, sections,idSection );
+    await binFileUtils__namespace.startWriteSection(fdNew, idSection);
+
+    let t = first;
+    for (let i=0; i<nPoints; i += MAX_CHUNK_SIZE) {
+        if (logger) logger.debug(`Applying key: ${sectionName}: ${i}/${nPoints}`);
+        const n= Math.min(nPoints - i, MAX_CHUNK_SIZE);
+        let buff;
+        buff = await fdOld.read(n*sG);
+        buff = await G.batchApplyKey(buff, t, inc);
+        await fdNew.write(buff);
+        t = curve.Fr.mul(t, curve.Fr.exp(inc, n));
+    }
+
+    await binFileUtils__namespace.endWriteSection(fdNew);
+    await binFileUtils__namespace.endReadSection(fdOld);
+}
+
+
+
+async function applyKeyToChallengeSection(fdOld, fdNew, responseHasher, curve, groupName, nPoints, first, inc, formatOut, sectionName, logger) {
+    const G = curve[groupName];
+    const sG = G.F.n8*2;
+    const chunkSize = Math.floor((1<<20) / sG);   // 128Mb chunks
+    let t = first;
+    for (let i=0 ; i<nPoints ; i+= chunkSize) {
+        if (logger) logger.debug(`Applying key ${sectionName}: ${i}/${nPoints}`);
+        const n= Math.min(nPoints-i, chunkSize );
+        const buffInU = await fdOld.read(n * sG);
+        const buffInLEM = await G.batchUtoLEM(buffInU);
+        const buffOutLEM = await G.batchApplyKey(buffInLEM, t, inc);
+        let buffOut;
+        if (formatOut == "COMPRESSED") {
+            buffOut = await G.batchLEMtoC(buffOutLEM);
+        } else {
+            buffOut = await G.batchLEMtoU(buffOutLEM);
+        }
+
+        if (responseHasher) responseHasher.update(buffOut);
+        await fdNew.write(buffOut);
+        t = curve.Fr.mul(t, curve.Fr.exp(inc, n));
+    }
+}
+
+/*
+    Copyright 2018 0KIMS association.
+
+    This file is part of snarkJS.
+
+    snarkJS is a free software: you can redistribute it and/or modify it
+    under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    snarkJS is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
+    License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with snarkJS. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+async function challengeContribute(curve, challengeFilename, responesFileName, entropy, logger) {
+    await Blake2b__default["default"].ready();
+
+    const fdFrom = await fastFile__namespace.readExisting(challengeFilename);
+
+
+    const sG1 = curve.F1.n64*8*2;
+    const sG2 = curve.F2.n64*8*2;
+    const domainSize = (fdFrom.totalSize + sG1 - 64 - sG2) / (4*sG1 + sG2);
+    let e = domainSize;
+    let power = 0;
+    while (e>1) {
+        e = e /2;
+        power += 1;
+    }
+
+    if (2 ** power != domainSize) throw new Error("Invalid file size");
+    if (logger) logger.debug("Power to tau size: "+power);
+
+    const rng = await getRandomRng(entropy);
+
+    const fdTo = await fastFile__namespace.createOverride(responesFileName);
+
+    // Calculate the hash
+    const challengeHasher = Blake2b__default["default"](64);
+    for (let i=0; i<fdFrom.totalSize; i+= fdFrom.pageSize) {
+        if (logger) logger.debug(`Hashing challenge ${i}/${fdFrom.totalSize}`);
+        const s = Math.min(fdFrom.totalSize - i, fdFrom.pageSize);
+        const buff = await fdFrom.read(s);
+        challengeHasher.update(buff);
+    }
+
+    const claimedHash = await fdFrom.read(64, 0);
+    if (logger) logger.info(formatHash(claimedHash, "Claimed Previous Response Hash: "));
+
+    const challengeHash = challengeHasher.digest();
+    if (logger) logger.info(formatHash(challengeHash, "Current Challenge Hash: "));
+
+    const key = createPTauKey(curve, challengeHash, rng);
+
+    if (logger) {
+        ["tau", "alpha", "beta"].forEach( (k) => {
+            logger.debug(k + ".g1_s: " + curve.G1.toString(key[k].g1_s, 16));
+            logger.debug(k + ".g1_sx: " + curve.G1.toString(key[k].g1_sx, 16));
+            logger.debug(k + ".g2_sp: " + curve.G2.toString(key[k].g2_sp, 16));
+            logger.debug(k + ".g2_spx: " + curve.G2.toString(key[k].g2_spx, 16));
+            logger.debug("");
+        });
+    }
+
+    const responseHasher = Blake2b__default["default"](64);
+
+    await fdTo.write(challengeHash);
+    responseHasher.update(challengeHash);
+
+    await applyKeyToChallengeSection(fdFrom, fdTo, responseHasher, curve, "G1", (2 ** power)*2-1, curve.Fr.one    , key.tau.prvKey, "COMPRESSED", "tauG1"     , logger );
+    await applyKeyToChallengeSection(fdFrom, fdTo, responseHasher, curve, "G2", (2 ** power)    , curve.Fr.one    , key.tau.prvKey, "COMPRESSED", "tauG2"     , logger );
+    await applyKeyToChallengeSection(fdFrom, fdTo, responseHasher, curve, "G1", (2 ** power)    , key.alpha.prvKey, key.tau.prvKey, "COMPRESSED", "alphaTauG1", logger );
+    await applyKeyToChallengeSection(fdFrom, fdTo, responseHasher, curve, "G1", (2 ** power)    , key.beta.prvKey , key.tau.prvKey, "COMPRESSED", "betaTauG1" , logger );
+    await applyKeyToChallengeSection(fdFrom, fdTo, responseHasher, curve, "G2", 1             , key.beta.prvKey , key.tau.prvKey, "COMPRESSED", "betaTauG2" , logger );
+
+    // Write and hash key
+    const buffKey = new Uint8Array(curve.F1.n8*2*6+curve.F2.n8*2*3);
+    toPtauPubKeyRpr(buffKey, 0, curve, key, false);
+    await fdTo.write(buffKey);
+    responseHasher.update(buffKey);
+    const responseHash = responseHasher.digest();
+    if (logger) logger.info(formatHash(responseHash, "Contribution Response Hash: "));
+
+    await fdTo.close();
+    await fdFrom.close();
+}
+
+/*
+    Copyright 2018 0KIMS association.
+
+    This file is part of snarkJS.
+
+    snarkJS is a free software: you can redistribute it and/or modify it
+    under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    snarkJS is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
+    License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with snarkJS. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+async function beacon$1(oldPtauFilename, newPTauFilename, name,  beaconHashStr,numIterationsExp, logger) {
+    const beaconHash = hex2ByteArray(beaconHashStr);
+    if (   (beaconHash.byteLength == 0)
+        || (beaconHash.byteLength*2 !=beaconHashStr.length))
+    {
+        if (logger) logger.error("Invalid Beacon Hash. (It must be a valid hexadecimal sequence)");
+        return false;
+    }
+    if (beaconHash.length>=256) {
+        if (logger) logger.error("Maximum lenght of beacon hash is 255 bytes");
+        return false;
+    }
+
+    numIterationsExp = parseInt(numIterationsExp);
+    if ((numIterationsExp<10)||(numIterationsExp>63)) {
+        if (logger) logger.error("Invalid numIterationsExp. (Must be between 10 and 63)");
+        return false;
+    }
+
+
+    await Blake2b__default["default"].ready();
+
+    const {fd: fdOld, sections} = await binFileUtils__namespace.readBinFile(oldPtauFilename, "ptau", 1);
+    const {curve, power, ceremonyPower} = await readPTauHeader(fdOld, sections);
+    if (power != ceremonyPower) {
+        if (logger) logger.error("This file has been reduced. You cannot contribute into a reduced file.");
+        return false;
+    }
+    if (sections[12]) {
+        if (logger) logger.warn("Contributing into a file that has phase2 calculated. You will have to prepare phase2 again.");
+    }
+    const contributions = await readContributions(fdOld, curve, sections);
+    const curContribution = {
+        name: name,
+        type: 1, // Beacon
+        numIterationsExp: numIterationsExp,
+        beaconHash: beaconHash
+    };
+
+    let lastChallengeHash;
+
+    if (contributions.length>0) {
+        lastChallengeHash = contributions[contributions.length-1].nextChallenge;
+    } else {
+        lastChallengeHash = calculateFirstChallengeHash(curve, power, logger);
+    }
+
+    curContribution.key = keyFromBeacon(curve, lastChallengeHash, beaconHash, numIterationsExp);
+
+    const responseHasher = new Blake2b__default["default"](64);
+    responseHasher.update(lastChallengeHash);
+
+    const fdNew = await binFileUtils__namespace.createBinFile(newPTauFilename, "ptau", 1, 7);
+    await writePTauHeader(fdNew, curve, power);
+
+    const startSections = [];
+
+    let firstPoints;
+    firstPoints = await processSection(2, "G1",  (2 ** power) * 2 -1, curve.Fr.e(1), curContribution.key.tau.prvKey, "tauG1", logger );
+    curContribution.tauG1 = firstPoints[1];
+    firstPoints = await processSection(3, "G2",  (2 ** power) , curve.Fr.e(1), curContribution.key.tau.prvKey, "tauG2", logger );
+    curContribution.tauG2 = firstPoints[1];
+    firstPoints = await processSection(4, "G1",  (2 ** power) , curContribution.key.alpha.prvKey, curContribution.key.tau.prvKey, "alphaTauG1", logger );
+    curContribution.alphaG1 = firstPoints[0];
+    firstPoints = await processSection(5, "G1",  (2 ** power) , curContribution.key.beta.prvKey, curContribution.key.tau.prvKey, "betaTauG1", logger );
+    curContribution.betaG1 = firstPoints[0];
+    firstPoints = await processSection(6, "G2",  1, curContribution.key.beta.prvKey, curContribution.key.tau.prvKey, "betaTauG2", logger );
+    curContribution.betaG2 = firstPoints[0];
+
+    curContribution.partialHash = responseHasher.getPartialHash();
+
+    const buffKey = new Uint8Array(curve.F1.n8*2*6+curve.F2.n8*2*3);
+
+    toPtauPubKeyRpr(buffKey, 0, curve, curContribution.key, false);
+
+    responseHasher.update(new Uint8Array(buffKey));
+    const hashResponse = responseHasher.digest();
+
+    if (logger) logger.info(formatHash(hashResponse, "Contribution Response Hash imported: "));
+
+    const nextChallengeHasher = new Blake2b__default["default"](64);
+    nextChallengeHasher.update(hashResponse);
+
+    await hashSection(fdNew, "G1", 2, (2 ** power) * 2 -1, "tauG1", logger);
+    await hashSection(fdNew, "G2", 3, (2 ** power)       , "tauG2", logger);
+    await hashSection(fdNew, "G1", 4, (2 ** power)       , "alphaTauG1", logger);
+    await hashSection(fdNew, "G1", 5, (2 ** power)       , "betaTauG1", logger);
+    await hashSection(fdNew, "G2", 6, 1                  , "betaG2", logger);
+
+    curContribution.nextChallenge = nextChallengeHasher.digest();
+
+    if (logger) logger.info(formatHash(curContribution.nextChallenge, "Next Challenge Hash: "));
+
+    contributions.push(curContribution);
+
+    await writeContributions(fdNew, curve, contributions);
+
+    await fdOld.close();
+    await fdNew.close();
+
+    return hashResponse;
+
+    async function processSection(sectionId, groupName, NPoints, first, inc, sectionName, logger) {
+        const res = [];
+        fdOld.pos = sections[sectionId][0].p;
+
+        await binFileUtils__namespace.startWriteSection(fdNew, sectionId);
+
+        startSections[sectionId] = fdNew.pos;
+
+        const G = curve[groupName];
+        const sG = G.F.n8*2;
+        const chunkSize = Math.floor((1<<20) / sG);   // 128Mb chunks
+        let t = first;
+        for (let i=0 ; i<NPoints ; i+= chunkSize) {
+            if (logger) logger.debug(`applying key${sectionName}: ${i}/${NPoints}`);
+            const n= Math.min(NPoints-i, chunkSize );
+            const buffIn = await fdOld.read(n * sG);
+            const buffOutLEM = await G.batchApplyKey(buffIn, t, inc);
+
+            /* Code to test the case where we don't have the 2^m-2 component
+            if (sectionName== "tauG1") {
+                const bz = new Uint8Array(64);
+                buffOutLEM.set(bz, 64*((2 ** power) - 1 ));
+            }
+            */
+
+            const promiseWrite = fdNew.write(buffOutLEM);
+            const buffOutC = await G.batchLEMtoC(buffOutLEM);
+
+            responseHasher.update(buffOutC);
+            await promiseWrite;
+            if (i==0)   // Return the 2 first points.
+                for (let j=0; j<Math.min(2, NPoints); j++)
+                    res.push(G.fromRprLEM(buffOutLEM, j*sG));
+            t = curve.Fr.mul(t, curve.Fr.exp(inc, n));
+        }
+
+        await binFileUtils__namespace.endWriteSection(fdNew);
+
+        return res;
+    }
+
+
+    async function hashSection(fdTo, groupName, sectionId, nPoints, sectionName, logger) {
+
+        const G = curve[groupName];
+        const sG = G.F.n8*2;
+        const nPointsChunk = Math.floor((1<<24)/sG);
+
+        const oldPos = fdTo.pos;
+        fdTo.pos = startSections[sectionId];
+
+        for (let i=0; i< nPoints; i += nPointsChunk) {
+            if (logger) logger.debug(`Hashing ${sectionName}: ${i}/${nPoints}`);
+            const n = Math.min(nPoints-i, nPointsChunk);
+
+            const buffLEM = await fdTo.read(n * sG);
+
+            const buffU = await G.batchLEMtoU(buffLEM);
+
+            nextChallengeHasher.update(buffU);
+        }
+
+        fdTo.pos = oldPos;
+    }
+}
+
+/*
+    Copyright 2018 0KIMS association.
+
+    This file is part of snarkJS.
+
+    snarkJS is a free software: you can redistribute it and/or modify it
+    under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    snarkJS is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
+    License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with snarkJS. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+async function contribute(oldPtauFilename, newPTauFilename, name, entropy, logger) {
+    await Blake2b__default["default"].ready();
+
+    const {fd: fdOld, sections} = await binFileUtils__namespace.readBinFile(oldPtauFilename, "ptau", 1);
+    const {curve, power, ceremonyPower} = await readPTauHeader(fdOld, sections);
+    if (power != ceremonyPower) {
+        if (logger) logger.error("This file has been reduced. You cannot contribute into a reduced file.");
+        throw new Error("This file has been reduced. You cannot contribute into a reduced file.");
+    }
+    if (sections[12]) {
+        if (logger) logger.warn("WARNING: Contributing into a file that has phase2 calculated. You will have to prepare phase2 again.");
+    }
+    const contributions = await readContributions(fdOld, curve, sections);
+    const curContribution = {
+        name: name,
+        type: 0, // Beacon
+    };
+
+    let lastChallengeHash;
+
+    const rng = await getRandomRng(entropy);
+
+    if (contributions.length>0) {
+        lastChallengeHash = contributions[contributions.length-1].nextChallenge;
+    } else {
+        lastChallengeHash = calculateFirstChallengeHash(curve, power, logger);
+    }
+
+    // Generate a random key
+
+
+    curContribution.key = createPTauKey(curve, lastChallengeHash, rng);
+
+
+    const responseHasher = new Blake2b__default["default"](64);
+    responseHasher.update(lastChallengeHash);
+
+    const fdNew = await binFileUtils__namespace.createBinFile(newPTauFilename, "ptau", 1, 7);
+    await writePTauHeader(fdNew, curve, power);
+
+    const startSections = [];
+
+    let firstPoints;
+    firstPoints = await processSection(2, "G1",  (2 ** power) * 2 -1, curve.Fr.e(1), curContribution.key.tau.prvKey, "tauG1" );
+    curContribution.tauG1 = firstPoints[1];
+    firstPoints = await processSection(3, "G2",  (2 ** power) , curve.Fr.e(1), curContribution.key.tau.prvKey, "tauG2" );
+    curContribution.tauG2 = firstPoints[1];
+    firstPoints = await processSection(4, "G1",  (2 ** power) , curContribution.key.alpha.prvKey, curContribution.key.tau.prvKey, "alphaTauG1" );
+    curContribution.alphaG1 = firstPoints[0];
+    firstPoints = await processSection(5, "G1",  (2 ** power) , curContribution.key.beta.prvKey, curContribution.key.tau.prvKey, "betaTauG1" );
+    curContribution.betaG1 = firstPoints[0];
+    firstPoints = await processSection(6, "G2",  1, curContribution.key.beta.prvKey, curContribution.key.tau.prvKey, "betaTauG2" );
+    curContribution.betaG2 = firstPoints[0];
+
+    curContribution.partialHash = responseHasher.getPartialHash();
+
+    const buffKey = new Uint8Array(curve.F1.n8*2*6+curve.F2.n8*2*3);
+
+    toPtauPubKeyRpr(buffKey, 0, curve, curContribution.key, false);
+
+    responseHasher.update(new Uint8Array(buffKey));
+    const hashResponse = responseHasher.digest();
+
+    if (logger) logger.info(formatHash(hashResponse, "Contribution Response Hash imported: "));
+
+    const nextChallengeHasher = new Blake2b__default["default"](64);
+    nextChallengeHasher.update(hashResponse);
+
+    await hashSection(fdNew, "G1", 2, (2 ** power) * 2 -1, "tauG1");
+    await hashSection(fdNew, "G2", 3, (2 ** power)       , "tauG2");
+    await hashSection(fdNew, "G1", 4, (2 ** power)       , "alphaTauG1");
+    await hashSection(fdNew, "G1", 5, (2 ** power)       , "betaTauG1");
+    await hashSection(fdNew, "G2", 6, 1                  , "betaG2");
+
+    curContribution.nextChallenge = nextChallengeHasher.digest();
+
+    if (logger) logger.info(formatHash(curContribution.nextChallenge, "Next Challenge Hash: "));
+
+    contributions.push(curContribution);
+
+    await writeContributions(fdNew, curve, contributions);
+
+    await fdOld.close();
+    await fdNew.close();
+
+    return hashResponse;
+
+    async function processSection(sectionId, groupName, NPoints, first, inc, sectionName) {
+        const res = [];
+        fdOld.pos = sections[sectionId][0].p;
+
+        await binFileUtils__namespace.startWriteSection(fdNew, sectionId);
+
+        startSections[sectionId] = fdNew.pos;
+
+        const G = curve[groupName];
+        const sG = G.F.n8*2;
+        const chunkSize = Math.floor((1<<20) / sG);   // 128Mb chunks
+        let t = first;
+        for (let i=0 ; i<NPoints ; i+= chunkSize) {
+            if (logger) logger.debug(`processing: ${sectionName}: ${i}/${NPoints}`);
+            const n= Math.min(NPoints-i, chunkSize );
+            const buffIn = await fdOld.read(n * sG);
+            const buffOutLEM = await G.batchApplyKey(buffIn, t, inc);
+
+            /* Code to test the case where we don't have the 2^m-2 component
+            if (sectionName== "tauG1") {
+                const bz = new Uint8Array(64);
+                buffOutLEM.set(bz, 64*((2 ** power) - 1 ));
+            }
+            */
+
+            const promiseWrite = fdNew.write(buffOutLEM);
+            const buffOutC = await G.batchLEMtoC(buffOutLEM);
+
+            responseHasher.update(buffOutC);
+            await promiseWrite;
+            if (i==0)   // Return the 2 first points.
+                for (let j=0; j<Math.min(2, NPoints); j++)
+                    res.push(G.fromRprLEM(buffOutLEM, j*sG));
+            t = curve.Fr.mul(t, curve.Fr.exp(inc, n));
+        }
+
+        await binFileUtils__namespace.endWriteSection(fdNew);
+
+        return res;
+    }
+
+
+    async function hashSection(fdTo, groupName, sectionId, nPoints, sectionName) {
+
+        const G = curve[groupName];
+        const sG = G.F.n8*2;
+        const nPointsChunk = Math.floor((1<<24)/sG);
+
+        const oldPos = fdTo.pos;
+        fdTo.pos = startSections[sectionId];
+
+        for (let i=0; i< nPoints; i += nPointsChunk) {
+            if ((logger)&&i) logger.debug(`Hashing ${sectionName}: ` + i);
+            const n = Math.min(nPoints-i, nPointsChunk);
+
+            const buffLEM = await fdTo.read(n * sG);
+
+            const buffU = await G.batchLEMtoU(buffLEM);
+
+            nextChallengeHasher.update(buffU);
+        }
+
+        fdTo.pos = oldPos;
+    }
+
+
+}
+
+/*
+    Copyright 2018 0KIMS association.
+
+    This file is part of snarkJS.
+
+    snarkJS is a free software: you can redistribute it and/or modify it
+    under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    snarkJS is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
+    License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with snarkJS. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+async function preparePhase2(oldPtauFilename, newPTauFilename, logger) {
+
+    const {fd: fdOld, sections} = await binFileUtils__namespace.readBinFile(oldPtauFilename, "ptau", 1);
+    const {curve, power} = await readPTauHeader(fdOld, sections);
+
+    const fdNew = await binFileUtils__namespace.createBinFile(newPTauFilename, "ptau", 1, 11);
+    await writePTauHeader(fdNew, curve, power);
+
+    await binFileUtils__namespace.copySection(fdOld, sections, fdNew, 2);
+    await binFileUtils__namespace.copySection(fdOld, sections, fdNew, 3);
+    await binFileUtils__namespace.copySection(fdOld, sections, fdNew, 4);
+    await binFileUtils__namespace.copySection(fdOld, sections, fdNew, 5);
+    await binFileUtils__namespace.copySection(fdOld, sections, fdNew, 6);
+    await binFileUtils__namespace.copySection(fdOld, sections, fdNew, 7);
+
+    await processSection(2, 12, "G1", "tauG1" );
+    await processSection(3, 13, "G2", "tauG2" );
+    await processSection(4, 14, "G1", "alphaTauG1" );
+    await processSection(5, 15, "G1", "betaTauG1" );
+
+    await fdOld.close();
+    await fdNew.close();
+
+    // await fs.promises.unlink(newPTauFilename+ ".tmp");
+
+    return;
+
+    async function processSection(oldSectionId, newSectionId, Gstr, sectionName) {
+        if (logger) logger.debug("Starting section: "+sectionName);
+
+        await binFileUtils__namespace.startWriteSection(fdNew, newSectionId);
+
+        for (let p=0; p<=power; p++) {
+            await processSectionPower(p);
+        }
+
+        if (oldSectionId == 2) {
+            await processSectionPower(power+1);
+        }
+
+        await binFileUtils__namespace.endWriteSection(fdNew);
+
+
+        async function processSectionPower(p) {
+            const nPoints = 2 ** p;
+            const G = curve[Gstr];
+            curve.Fr;
+            const sGin = G.F.n8*2;
+            G.F.n8*3;
+
+            let buff;
+            buff = new ffjavascript.BigBuffer(nPoints*sGin);
+
+            await binFileUtils__namespace.startReadUniqueSection(fdOld, sections, oldSectionId);
+            if ((oldSectionId == 2)&&(p==power+1)) {
+                await fdOld.readToBuffer(buff, 0,(nPoints-1)*sGin );
+                buff.set(curve.G1.zeroAffine, (nPoints-1)*sGin );
+            } else {
+                await fdOld.readToBuffer(buff, 0,nPoints*sGin );
+            }
+            await binFileUtils__namespace.endReadSection(fdOld, true);
+
+
+            buff = await G.lagrangeEvaluations(buff, "affine", "affine", logger, sectionName);
+            await fdNew.write(buff);
+
+/*
+            if (p <= curve.Fr.s) {
+                buff = await G.ifft(buff, "affine", "affine", logger, sectionName);
+                await fdNew.write(buff);
+            } else if (p == curve.Fr.s+1) {
+                const smallM = 1<<curve.Fr.s;
+                let t0 = new BigBuffer( smallM * sGmid );
+                let t1 = new BigBuffer( smallM * sGmid );
+
+                const shift_to_small_m = Fr.exp(Fr.shift, smallM);
+                const one_over_denom = Fr.inv(Fr.sub(shift_to_small_m, Fr.one));
+
+                let sInvAcc = Fr.one;
+                for (let i=0; i<smallM; i++) {
+                    const ti =  buff.slice(i*sGin, (i+1)*sGin);
+                    const tmi = buff.slice((i+smallM)*sGin, (i+smallM+1)*sGin);
+
+                    t0.set(
+                        G.timesFr(
+                            G.sub(
+                                G.timesFr(ti , shift_to_small_m),
+                                tmi
+                            ),
+                            one_over_denom
+                        ),
+                        i*sGmid
+                    );
+                    t1.set(
+                        G.timesFr(
+                            G.sub( tmi, ti),
+                            Fr.mul(sInvAcc, one_over_denom)
+                        ),
+                        i*sGmid
+                    );
+
+
+                    sInvAcc = Fr.mul(sInvAcc, Fr.shiftInv);
+                }
+                t0 = await G.ifft(t0, "jacobian", "affine", logger, sectionName + " t0");
+                await fdNew.write(t0);
+                t0 = null;
+                t1 = await G.ifft(t1, "jacobian", "affine", logger, sectionName + " t0");
+                await fdNew.write(t1);
+
+            } else {
+                if (logger) logger.error("Power too big");
+                throw new Error("Power to big");
+            }
+*/
+        }
+    }
+}
+
+/*
+    Copyright 2018 0KIMS association.
+
+    This file is part of snarkJS.
+
+    snarkJS is a free software: you can redistribute it and/or modify it
+    under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    snarkJS is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
+    License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with snarkJS. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+async function truncate(ptauFilename, template, logger) {
+
+    const {fd: fdOld, sections} = await binFileUtils__namespace.readBinFile(ptauFilename, "ptau", 1);
+    const {curve, power, ceremonyPower} = await readPTauHeader(fdOld, sections);
+
+    const sG1 = curve.G1.F.n8*2;
+    const sG2 = curve.G2.F.n8*2;
+
+    for (let p=1; p<power; p++) {
+        await generateTruncate(p);
+    }
+
+    await fdOld.close();
+
+    return true;
+
+    async function generateTruncate(p) {
+
+        let sP = p.toString();
+        while (sP.length<2) sP = "0" + sP;
+
+        if (logger) logger.debug("Writing Power: "+sP);
+
+        const fdNew = await binFileUtils__namespace.createBinFile(template + sP + ".ptau", "ptau", 1, 11);
+        await writePTauHeader(fdNew, curve, p, ceremonyPower);
+
+        await binFileUtils__namespace.copySection(fdOld, sections, fdNew, 2, ((2 ** p)*2-1) * sG1 ); // tagG1
+        await binFileUtils__namespace.copySection(fdOld, sections, fdNew, 3, (2 ** p) * sG2); // tauG2
+        await binFileUtils__namespace.copySection(fdOld, sections, fdNew, 4, (2 ** p) * sG1); // alfaTauG1
+        await binFileUtils__namespace.copySection(fdOld, sections, fdNew, 5, (2 ** p) * sG1); // betaTauG1
+        await binFileUtils__namespace.copySection(fdOld, sections, fdNew, 6,  sG2); // betaTauG2
+        await binFileUtils__namespace.copySection(fdOld, sections, fdNew, 7); // contributions
+        await binFileUtils__namespace.copySection(fdOld, sections, fdNew, 12, ((2 ** (p+1))*2 -1) * sG1); // L_tauG1
+        await binFileUtils__namespace.copySection(fdOld, sections, fdNew, 13, ((2 ** p)*2 -1) * sG2); // L_tauG2
+        await binFileUtils__namespace.copySection(fdOld, sections, fdNew, 14, ((2 ** p)*2 -1) * sG1); // L_alfaTauG1
+        await binFileUtils__namespace.copySection(fdOld, sections, fdNew, 15, ((2 ** p)*2 -1) * sG1); // L_betaTauG1
+
+        await fdNew.close();
+    }
+
+
+}
+
+/*
+    Copyright 2018 0KIMS association.
+
+    This file is part of snarkJS.
+
+    snarkJS is a free software: you can redistribute it and/or modify it
+    under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    snarkJS is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
+    License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with snarkJS. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+async function convert(oldPtauFilename, newPTauFilename, logger) {
+
+    const {fd: fdOld, sections} = await binFileUtils__namespace.readBinFile(oldPtauFilename, "ptau", 1);
+    const {curve, power} = await readPTauHeader(fdOld, sections);
+
+    const fdNew = await binFileUtils__namespace.createBinFile(newPTauFilename, "ptau", 1, 11);
+    await writePTauHeader(fdNew, curve, power);
+
+    // const fdTmp = await fastFile.createOverride(newPTauFilename+ ".tmp");
+
+    await binFileUtils__namespace.copySection(fdOld, sections, fdNew, 2);
+    await binFileUtils__namespace.copySection(fdOld, sections, fdNew, 3);
+    await binFileUtils__namespace.copySection(fdOld, sections, fdNew, 4);
+    await binFileUtils__namespace.copySection(fdOld, sections, fdNew, 5);
+    await binFileUtils__namespace.copySection(fdOld, sections, fdNew, 6);
+    await binFileUtils__namespace.copySection(fdOld, sections, fdNew, 7);
+
+    await processSection(2, 12, "G1", "tauG1" );
+    await binFileUtils__namespace.copySection(fdOld, sections, fdNew, 13);
+    await binFileUtils__namespace.copySection(fdOld, sections, fdNew, 14);
+    await binFileUtils__namespace.copySection(fdOld, sections, fdNew, 15);
+
+    await fdOld.close();
+    await fdNew.close();
+
+    // await fs.promises.unlink(newPTauFilename+ ".tmp");
+
+    return;
+
+    async function processSection(oldSectionId, newSectionId, Gstr, sectionName) {
+        if (logger) logger.debug("Starting section: "+sectionName);
+
+        await binFileUtils__namespace.startWriteSection(fdNew, newSectionId);
+
+        const size = sections[newSectionId][0].size;
+        const chunkSize = fdOld.pageSize;
+        await binFileUtils__namespace.startReadUniqueSection(fdOld, sections, newSectionId);
+        for (let p=0; p<size; p+=chunkSize) {
+            const l = Math.min(size -p, chunkSize);
+            const buff = await fdOld.read(l);
+            await fdNew.write(buff);
+        }
+        await binFileUtils__namespace.endReadSection(fdOld);
+
+        if (oldSectionId == 2) {
+            await processSectionPower(power+1);
+        }
+
+        await binFileUtils__namespace.endWriteSection(fdNew);
+
+        async function processSectionPower(p) {
+            const nPoints = 2 ** p;
+            const G = curve[Gstr];
+            const sGin = G.F.n8*2;
+
+            let buff;
+            buff = new ffjavascript.BigBuffer(nPoints*sGin);
+
+            await binFileUtils__namespace.startReadUniqueSection(fdOld, sections, oldSectionId);
+            if ((oldSectionId == 2)&&(p==power+1)) {
+                await fdOld.readToBuffer(buff, 0,(nPoints-1)*sGin );
+                buff.set(curve.G1.zeroAffine, (nPoints-1)*sGin );
+            } else {
+                await fdOld.readToBuffer(buff, 0,nPoints*sGin );
+            }
+            await binFileUtils__namespace.endReadSection(fdOld, true);
+
+            buff = await G.lagrangeEvaluations(buff, "affine", "affine", logger, sectionName);
+            await fdNew.write(buff);
+
+/*
+            if (p <= curve.Fr.s) {
+                buff = await G.ifft(buff, "affine", "affine", logger, sectionName);
+                await fdNew.write(buff);
+            } else if (p == curve.Fr.s+1) {
+                const smallM = 1<<curve.Fr.s;
+                let t0 = new BigBuffer( smallM * sGmid );
+                let t1 = new BigBuffer( smallM * sGmid );
+
+                const shift_to_small_m = Fr.exp(Fr.shift, smallM);
+                const one_over_denom = Fr.inv(Fr.sub(shift_to_small_m, Fr.one));
+
+                let sInvAcc = Fr.one;
+                for (let i=0; i<smallM; i++) {
+                    if (i%10000) logger.debug(`sectionName prepare L calc: ${sectionName}, ${i}/${smallM}`);
+                    const ti =  buff.slice(i*sGin, (i+1)*sGin);
+                    const tmi = buff.slice((i+smallM)*sGin, (i+smallM+1)*sGin);
+
+                    t0.set(
+                        G.timesFr(
+                            G.sub(
+                                G.timesFr(ti , shift_to_small_m),
+                                tmi
+                            ),
+                            one_over_denom
+                        ),
+                        i*sGmid
+                    );
+                    t1.set(
+                        G.timesFr(
+                            G.sub( tmi, ti),
+                            Fr.mul(sInvAcc, one_over_denom)
+                        ),
+                        i*sGmid
+                    );
+
+
+                    sInvAcc = Fr.mul(sInvAcc, Fr.shiftInv);
+                }
+                t0 = await G.ifft(t0, "jacobian", "affine", logger, sectionName + " t0");
+                await fdNew.write(t0);
+                t0 = null;
+                t1 = await G.ifft(t1, "jacobian", "affine", logger, sectionName + " t1");
+                await fdNew.write(t1);
+
+            } else {
+                if (logger) logger.error("Power too big");
+                throw new Error("Power to big");
+            }
+*/
+        }
+
+
+    }
+}
+
+/*
+    Copyright 2018 0KIMS association.
+
+    This file is part of snarkJS.
+
+    snarkJS is a free software: you can redistribute it and/or modify it
+    under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    snarkJS is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
+    License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with snarkJS. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+async function exportJson(pTauFilename, verbose) {
+    const {fd, sections} = await binFileUtils__namespace.readBinFile(pTauFilename, "ptau", 1);
+
+    const {curve, power} = await readPTauHeader(fd, sections);
+
+    const pTau = {};
+    pTau.q = curve.q;
+    pTau.power = power;
+    pTau.contributions = await readContributions(fd, curve, sections);
+
+    pTau.tauG1 = await exportSection(2, "G1", (2 ** power)*2 -1, "tauG1");
+    pTau.tauG2 = await exportSection(3, "G2", (2 ** power), "tauG2");
+    pTau.alphaTauG1 = await exportSection(4, "G1", (2 ** power), "alphaTauG1");
+    pTau.betaTauG1 = await exportSection(5, "G1", (2 ** power), "betaTauG1");
+    pTau.betaG2 = await exportSection(6, "G2", 1, "betaG2");
+
+    pTau.lTauG1 = await exportLagrange(12, "G1", "lTauG1");
+    pTau.lTauG2 = await exportLagrange(13, "G2", "lTauG2");
+    pTau.lAlphaTauG1 = await exportLagrange(14, "G1", "lAlphaTauG2");
+    pTau.lBetaTauG1 = await exportLagrange(15, "G1", "lBetaTauG2");
+
+    await fd.close();
+
+    return pTau;
+
+
+
+    async function exportSection(sectionId, groupName, nPoints, sectionName) {
+        const G = curve[groupName];
+        const sG = G.F.n8*2;
+
+        const res = [];
+        await binFileUtils__namespace.startReadUniqueSection(fd, sections, sectionId);
+        for (let i=0; i< nPoints; i++) {
+            if ((verbose)&&i&&(i%10000 == 0)) console.log(`${sectionName}: ` + i);
+            const buff = await fd.read(sG);
+            res.push(G.fromRprLEM(buff, 0));
+        }
+        await binFileUtils__namespace.endReadSection(fd);
+
+        return res;
+    }
+
+    async function exportLagrange(sectionId, groupName, sectionName) {
+        const G = curve[groupName];
+        const sG = G.F.n8*2;
+
+        const res = [];
+        await binFileUtils__namespace.startReadUniqueSection(fd, sections, sectionId);
+        for (let p=0; p<=power; p++) {
+            if (verbose) console.log(`${sectionName}: Power: ${p}`);
+            res[p] = [];
+            const nPoints = (2 ** p);
+            for (let i=0; i<nPoints; i++) {
+                if ((verbose)&&i&&(i%10000 == 0)) console.log(`${sectionName}: ${i}/${nPoints}`);
+                const buff = await fd.read(sG);
+                res[p].push(G.fromRprLEM(buff, 0));
+            }
+        }
+        await binFileUtils__namespace.endReadSection(fd);
+        return res;
+    }
+
+
+}
+
+/*
+    Copyright 2018 0KIMS association.
+
+    This file is part of snarkJS.
+
+    snarkJS is a free software: you can redistribute it and/or modify it
+    under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    snarkJS is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
+    License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with snarkJS. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+var powersoftau = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    newAccumulator: newAccumulator,
+    exportChallenge: exportChallenge,
+    importResponse: importResponse,
+    verify: verify,
+    challengeContribute: challengeContribute,
+    beacon: beacon$1,
+    contribute: contribute,
+    preparePhase2: preparePhase2,
+    truncate: truncate,
+    convert: convert,
+    exportJson: exportJson
+});
+
+/*
+    Copyright 2018 0KIMS association.
+
+    This file is part of snarkJS.
+
+    snarkJS is a free software: you can redistribute it and/or modify it
+    under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    snarkJS is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
+    License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with snarkJS. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+function r1csPrint(r1cs, syms, logger) {
+    for (let i=0; i<r1cs.constraints.length; i++) {
+        printCostraint(r1cs.constraints[i]);
+    }
+    function printCostraint(c) {
+        const lc2str = (lc) => {
+            let S = "";
+            const keys = Object.keys(lc);
+            keys.forEach( (k) => {
+                let name = syms.varIdx2Name[k];
+                if (name == "one") name = "";
+
+                let vs = r1cs.curve.Fr.toString(lc[k]);
+                if (vs == "1") vs = "";  // Do not show ones
+                if (vs == "-1") vs = "-";  // Do not show ones
+                if ((S!="")&&(vs[0]!="-")) vs = "+"+vs;
+                if (S!="") vs = " "+vs;
+                S= S + vs   + name;
+            });
+            return S;
+        };
+        const S = `[ ${lc2str(c[0])} ] * [ ${lc2str(c[1])} ] - [ ${lc2str(c[2])} ] = 0`;
+        if (logger) logger.info(S);
+    }
+
+}
+
+/*
+    Copyright 2018 0KIMS association.
+
+    This file is part of snarkJS.
+
+    snarkJS is a free software: you can redistribute it and/or modify it
+    under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    snarkJS is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
+    License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with snarkJS. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+const bls12381r = ffjavascript.Scalar.e("73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001", 16);
+const bn128r = ffjavascript.Scalar.e("21888242871839275222246405745257275088548364400416034343698204186575808495617");
+
+async function r1csInfo(r1csName, logger) {
+
+    const cir = await r1csfile.readR1cs(r1csName);
+
+    if (ffjavascript.Scalar.eq(cir.prime, bn128r)) {
+        if (logger) logger.info("Curve: bn-128");
+    } else if (ffjavascript.Scalar.eq(cir.prime, bls12381r)) {
+        if (logger) logger.info("Curve: bls12-381");
+    } else {
+        if (logger) logger.info(`Unknown Curve. Prime: ${ffjavascript.Scalar.toString(cir.prime)}`);
+    }
+    if (logger) logger.info(`# of Wires: ${cir.nVars}`);
+    if (logger) logger.info(`# of Constraints: ${cir.nConstraints}`);
+    if (logger) logger.info(`# of Private Inputs: ${cir.nPrvInputs}`);
+    if (logger) logger.info(`# of Public Inputs: ${cir.nPubInputs}`);
+    if (logger) logger.info(`# of Labels: ${cir.nLabels}`);
+    if (logger) logger.info(`# of Outputs: ${cir.nOutputs}`);
+
+    return cir;
+}
+
+/*
+    Copyright 2018 0KIMS association.
+
+    This file is part of snarkJS.
+
+    snarkJS is a free software: you can redistribute it and/or modify it
+    under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    snarkJS is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
+    License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with snarkJS. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+function stringifyBigInts$2(Fr, o) {
+    if (o instanceof Uint8Array)  {
+        return Fr.toString(o);
+    } else if (Array.isArray(o)) {
+        return o.map(stringifyBigInts$2.bind(null, Fr));
+    } else if (typeof o == "object") {
+        const res = {};
+        const keys = Object.keys(o);
+        keys.forEach( (k) => {
+            res[k] = stringifyBigInts$2(Fr, o[k]);
+        });
+        return res;
+    } else if ((typeof(o) == "bigint") || o.eq !== undefined)  {
+        return o.toString(10);
+    } else {
+        return o;
+    }
+}
+
+
+async function r1csExportJson(r1csFileName, logger) {
+
+    const cir = await r1csfile.readR1cs(r1csFileName, true, true, true, logger);
+    const Fr=cir.curve.Fr;
+    delete cir.curve;
+
+    return stringifyBigInts$2(Fr, cir);
+}
+
+/*
+    Copyright 2018 0KIMS association.
+
+    This file is part of snarkJS.
+
+    snarkJS is a free software: you can redistribute it and/or modify it
+    under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    snarkJS is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
+    License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with snarkJS. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+var r1cs = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    print: r1csPrint,
+    info: r1csInfo,
+    exportJson: r1csExportJson
+});
+
+/*
+    Copyright 2018 0KIMS association.
+
+    This file is part of snarkJS.
+
+    snarkJS is a free software: you can redistribute it and/or modify it
+    under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    snarkJS is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
+    License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with snarkJS. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+async function loadSymbols(symFileName) {
+    const sym = {
+        labelIdx2Name: [ "one" ],
+        varIdx2Name: [ "one" ],
+        componentIdx2Name: []
+    };
+    const fd = await fastFile__namespace.readExisting(symFileName);
+    const buff = await fd.read(fd.totalSize);
+    const symsStr = new TextDecoder("utf-8").decode(buff);
+    const lines = symsStr.split("\n");
+    for (let i=0; i<lines.length; i++) {
+        const arr = lines[i].split(",");
+        if (arr.length!=4) continue;
+        if (sym.varIdx2Name[arr[1]]) {
+            sym.varIdx2Name[arr[1]] += "|" + arr[3];
+        } else {
+            sym.varIdx2Name[arr[1]] = arr[3];
+        }
+        sym.labelIdx2Name[arr[0]] = arr[3];
+        if (!sym.componentIdx2Name[arr[2]]) {
+            sym.componentIdx2Name[arr[2]] = extractComponent(arr[3]);
+        }
+    }
+
+    await fd.close();
+
+    return sym;
+
+    function extractComponent(name) {
+        const arr = name.split(".");
+        arr.pop(); // Remove the lasr element
+        return arr.join(".");
+    }
+}
+
+/*
+    Copyright 2018 0KIMS association.
+
+    This file is part of snarkJS.
+
+    snarkJS is a free software: you can redistribute it and/or modify it
+    under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    snarkJS is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
+    License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with snarkJS. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+async function wtnsDebug(input, wasmFileName, wtnsFileName, symName, options, logger) {
+
+    const fdWasm = await fastFile__namespace.readExisting(wasmFileName);
+    const wasm = await fdWasm.read(fdWasm.totalSize);
+    await fdWasm.close();
+
+
+    let wcOps = {
+        sanityCheck: true
+    };
+    let sym = await loadSymbols(symName);
+    if (options.set) {
+        if (!sym) sym = await loadSymbols(symName);
+        wcOps.logSetSignal= function(labelIdx, value) {
+            if (logger) logger.info("SET " + sym.labelIdx2Name[labelIdx] + " <-- " + value.toString());
+        };
+    }
+    if (options.get) {
+        if (!sym) sym = await loadSymbols(symName);
+        wcOps.logGetSignal= function(varIdx, value) {
+            if (logger) logger.info("GET " + sym.labelIdx2Name[varIdx] + " --> " + value.toString());
+        };
+    }
+    if (options.trigger) {
+        if (!sym) sym = await loadSymbols(symName);
+        wcOps.logStartComponent= function(cIdx) {
+            if (logger) logger.info("START: " + sym.componentIdx2Name[cIdx]);
+        };
+        wcOps.logFinishComponent= function(cIdx) {
+            if (logger) logger.info("FINISH: " + sym.componentIdx2Name[cIdx]);
+        };
+    }
+    wcOps.sym = sym;
+
+    const wc = await circom_runtime.WitnessCalculatorBuilder(wasm, wcOps);
+    const w = await wc.calculateWitness(input);
+
+    const fdWtns = await binFileUtils__namespace.createBinFile(wtnsFileName, "wtns", 2, 2);
+
+    await write(fdWtns, w, wc.prime);
+
+    await fdWtns.close();
+}
+
+/*
+    Copyright 2018 0KIMS association.
+
+    This file is part of snarkJS.
+
+    snarkJS is a free software: you can redistribute it and/or modify it
+    under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    snarkJS is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
+    License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with snarkJS. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+async function wtnsExportJson(wtnsFileName) {
+
+    const w = await read(wtnsFileName);
+
+    return w;
+}
+
+/*
+    Copyright 2018 0KIMS association.
+
+    This file is part of snarkJS.
+
+    snarkJS is a free software: you can redistribute it and/or modify it
+    under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    snarkJS is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
+    License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with snarkJS. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+var wtns = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    calculate: wtnsCalculate,
+    debug: wtnsDebug,
+    exportJson: wtnsExportJson
+});
+
+/*
+    Copyright 2018 0KIMS association.
+
+    This file is part of snarkJS.
+
+    snarkJS is a free software: you can redistribute it and/or modify it
+    under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    snarkJS is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
+    License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with snarkJS. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+const SUBARRAY_SIZE = 0x40000;
+
+const BigArrayHandler = {
+    get: function(obj, prop) {
+        if (!isNaN(prop)) {
+            return obj.getElement(prop);
+        } else return obj[prop];
+    },
+    set: function(obj, prop, value) {
+        if (!isNaN(prop)) {
+            return obj.setElement(prop, value);
+        } else {
+            obj[prop] = value;
+            return true;
+        }
+    }
+};
+
+class _BigArray {
+    constructor (initSize) {
+        this.length = initSize || 0;
+        this.arr = new Array(SUBARRAY_SIZE);
+
+        for (let i=0; i<initSize; i+=SUBARRAY_SIZE) {
+            this.arr[i/SUBARRAY_SIZE] = new Array(Math.min(SUBARRAY_SIZE, initSize - i));
+        }
+        return this;
+    }
+    push () {
+        for (let i=0; i<arguments.length; i++) {
+            this.setElement (this.length, arguments[i]);
+        }
+    }
+
+    slice (f, t) {
+        const arr = new Array(t-f);
+        for (let i=f; i< t; i++) arr[i-f] = this.getElement(i);
+        return arr;
+    }
+    getElement(idx) {
+        idx = parseInt(idx);
+        const idx1 = Math.floor(idx / SUBARRAY_SIZE);
+        const idx2 = idx % SUBARRAY_SIZE;
+        return this.arr[idx1] ? this.arr[idx1][idx2] : undefined;
+    }
+    setElement(idx, value) {
+        idx = parseInt(idx);
+        const idx1 = Math.floor(idx / SUBARRAY_SIZE);
+        if (!this.arr[idx1]) {
+            this.arr[idx1] = new Array(SUBARRAY_SIZE);
+        }
+        const idx2 = idx % SUBARRAY_SIZE;
+        this.arr[idx1][idx2] = value;
+        if (idx >= this.length) this.length = idx+1;
+        return true;
+    }
+    getKeys() {
+        const newA = new BigArray();
+        for (let i=0; i<this.arr.length; i++) {
+            if (this.arr[i]) {
+                for (let j=0; j<this.arr[i].length; j++) {
+                    if (typeof this.arr[i][j] !== "undefined") {
+                        newA.push(i*SUBARRAY_SIZE+j);
+                    }
+                }
+            }
+        }
+        return newA;
+    }
+}
+
+class BigArray {
+    constructor( initSize ) {
+        const obj = new _BigArray(initSize);
+        const extObj = new Proxy(obj, BigArrayHandler);
+        return extObj;
+    }
+}
+
+/*
+    Copyright 2018 0KIMS association.
+
+    This file is part of snarkJS.
+
+    snarkJS is a free software: you can redistribute it and/or modify it
+    under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    snarkJS is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
+    License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with snarkJS. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+
+async function newZKey(r1csName, ptauName, zkeyName, logger) {
+
+    const TAU_G1 = 0;
+    const TAU_G2 = 1;
+    const ALPHATAU_G1 = 2;
+    const BETATAU_G1 = 3;
+    await Blake2b__default["default"].ready();
+    const csHasher = Blake2b__default["default"](64);
+
+    const {fd: fdPTau, sections: sectionsPTau} = await binFileUtils.readBinFile(ptauName, "ptau", 1, 1<<22, 1<<24);
+    const {curve, power} = await readPTauHeader(fdPTau, sectionsPTau);
+    const {fd: fdR1cs, sections: sectionsR1cs} = await binFileUtils.readBinFile(r1csName, "r1cs", 1, 1<<22, 1<<24);
+    const r1cs = await r1csfile.readR1csHeader(fdR1cs, sectionsR1cs, false);
+
+    const fdZKey = await binFileUtils.createBinFile(zkeyName, "zkey", 1, 10, 1<<22, 1<<24);
+
+    const sG1 = curve.G1.F.n8*2;
+    const sG2 = curve.G2.F.n8*2;
+
+    if (r1cs.prime != curve.r) {
+        if (logger) logger.error("r1cs curve does not match powers of tau ceremony curve");
+        return -1;
+    }
+
+    const cirPower = log2(r1cs.nConstraints + r1cs.nPubInputs + r1cs.nOutputs +1 -1) +1;
+
+    if (cirPower > power) {
+        if (logger) logger.error(`circuit too big for this power of tau ceremony. ${r1cs.nConstraints}*2 > 2**${power}`);
+        return -1;
+    }
+
+    if (!sectionsPTau[12]) {
+        if (logger) logger.error("Powers of tau is not prepared.");
+        return -1;
+    }
+
+    const nPublic = r1cs.nOutputs + r1cs.nPubInputs;
+    const domainSize = 2 ** cirPower;
+
+    // Write the header
+    ///////////
+    await binFileUtils.startWriteSection(fdZKey, 1);
+    await fdZKey.writeULE32(1); // Groth
+    await binFileUtils.endWriteSection(fdZKey);
+
+    // Write the Groth header section
+    ///////////
+
+    await binFileUtils.startWriteSection(fdZKey, 2);
+    const primeQ = curve.q;
+    const n8q = (Math.floor( (ffjavascript.Scalar.bitLength(primeQ) - 1) / 64) +1)*8;
+
+    const primeR = curve.r;
+    const n8r = (Math.floor( (ffjavascript.Scalar.bitLength(primeR) - 1) / 64) +1)*8;
+    const Rr = ffjavascript.Scalar.mod(ffjavascript.Scalar.shl(1, n8r*8), primeR);
+    const R2r = curve.Fr.e(ffjavascript.Scalar.mod(ffjavascript.Scalar.mul(Rr,Rr), primeR));
+
+    await fdZKey.writeULE32(n8q);
+    await binFileUtils.writeBigInt(fdZKey, primeQ, n8q);
+    await fdZKey.writeULE32(n8r);
+    await binFileUtils.writeBigInt(fdZKey, primeR, n8r);
+    await fdZKey.writeULE32(r1cs.nVars);                         // Total number of bars
+    await fdZKey.writeULE32(nPublic);                       // Total number of public vars (not including ONE)
+    await fdZKey.writeULE32(domainSize);                  // domainSize
+
+    let bAlpha1;
+    bAlpha1 = await fdPTau.read(sG1, sectionsPTau[4][0].p);
+    await fdZKey.write(bAlpha1);
+    bAlpha1 = await curve.G1.batchLEMtoU(bAlpha1);
+    csHasher.update(bAlpha1);
+
+    let bBeta1;
+    bBeta1 = await fdPTau.read(sG1, sectionsPTau[5][0].p);
+    await fdZKey.write(bBeta1);
+    bBeta1 = await curve.G1.batchLEMtoU(bBeta1);
+    csHasher.update(bBeta1);
+
+    let bBeta2;
+    bBeta2 = await fdPTau.read(sG2, sectionsPTau[6][0].p);
+    await fdZKey.write(bBeta2);
+    bBeta2 = await curve.G2.batchLEMtoU(bBeta2);
+    csHasher.update(bBeta2);
+
+    const bg1 = new Uint8Array(sG1);
+    curve.G1.toRprLEM(bg1, 0, curve.G1.g);
+    const bg2 = new Uint8Array(sG2);
+    curve.G2.toRprLEM(bg2, 0, curve.G2.g);
+    const bg1U = new Uint8Array(sG1);
+    curve.G1.toRprUncompressed(bg1U, 0, curve.G1.g);
+    const bg2U = new Uint8Array(sG2);
+    curve.G2.toRprUncompressed(bg2U, 0, curve.G2.g);
+
+    await fdZKey.write(bg2);        // gamma2
+    await fdZKey.write(bg1);        // delta1
+    await fdZKey.write(bg2);        // delta2
+    csHasher.update(bg2U);      // gamma2
+    csHasher.update(bg1U);      // delta1
+    csHasher.update(bg2U);      // delta2
+    await binFileUtils.endWriteSection(fdZKey);
+
+    if (logger) logger.info("Reading r1cs");
+    let sR1cs = await binFileUtils.readSection(fdR1cs, sectionsR1cs, 2);
+
+    const A = new BigArray(r1cs.nVars);
+    const B1 = new BigArray(r1cs.nVars);
+    const B2 = new BigArray(r1cs.nVars);
+    const C = new BigArray(r1cs.nVars- nPublic -1);
+    const IC = new Array(nPublic+1);
+
+    if (logger) logger.info("Reading tauG1");
+    let sTauG1 = await binFileUtils.readSection(fdPTau, sectionsPTau, 12, (domainSize -1)*sG1, domainSize*sG1);
+    if (logger) logger.info("Reading tauG2");
+    let sTauG2 = await binFileUtils.readSection(fdPTau, sectionsPTau, 13, (domainSize -1)*sG2, domainSize*sG2);
+    if (logger) logger.info("Reading alphatauG1");
+    let sAlphaTauG1 = await binFileUtils.readSection(fdPTau, sectionsPTau, 14, (domainSize -1)*sG1, domainSize*sG1);
+    if (logger) logger.info("Reading betatauG1");
+    let sBetaTauG1 = await binFileUtils.readSection(fdPTau, sectionsPTau, 15, (domainSize -1)*sG1, domainSize*sG1);
+
+    await processConstraints();
+
+    await composeAndWritePoints(3, "G1", IC, "IC");
+
+    await writeHs();
+
+    await hashHPoints();
+
+    await composeAndWritePoints(8, "G1", C, "C");
+    await composeAndWritePoints(5, "G1", A, "A");
+    await composeAndWritePoints(6, "G1", B1, "B1");
+    await composeAndWritePoints(7, "G2", B2, "B2");
+
+    const csHash = csHasher.digest();
+    // Contributions section
+    await binFileUtils.startWriteSection(fdZKey, 10);
+    await fdZKey.write(csHash);
+    await fdZKey.writeULE32(0);
+    await binFileUtils.endWriteSection(fdZKey);
+
+    if (logger) logger.info(formatHash(csHash, "Circuit hash: "));
+
+
+    await fdZKey.close();
+    await fdR1cs.close();
+    await fdPTau.close();
+
+    return csHash;
+
+    async function writeHs() {
+        await binFileUtils.startWriteSection(fdZKey, 9);
+        const buffOut = new ffjavascript.BigBuffer(domainSize*sG1);
+        if (cirPower < curve.Fr.s) {
+            let sTauG1 = await binFileUtils.readSection(fdPTau, sectionsPTau, 12, (domainSize*2-1)*sG1, domainSize*2*sG1);
+            for (let i=0; i< domainSize; i++) {
+                if ((logger)&&(i%10000 == 0)) logger.debug(`spliting buffer: ${i}/${domainSize}`);
+                const buff = sTauG1.slice( (i*2+1)*sG1, (i*2+1)*sG1 + sG1 );
+                buffOut.set(buff, i*sG1);
+            }
+        } else if (cirPower == curve.Fr.s) {
+            const o = sectionsPTau[12][0].p + ((2 ** (cirPower+1)) -1)*sG1;
+            await fdPTau.readToBuffer(buffOut, 0, domainSize*sG1, o + domainSize*sG1);
+        } else {
+            if (logger) logger.error("Circuit too big");
+            throw new Error("Circuit too big for this curve");
+        }
+        await fdZKey.write(buffOut);
+        await binFileUtils.endWriteSection(fdZKey);
+    }
+
+    async function processConstraints() {
+        const buffCoeff = new Uint8Array(12 + curve.Fr.n8);
+        const buffCoeffV = new DataView(buffCoeff.buffer);
+        const bOne = new Uint8Array(curve.Fr.n8);
+        curve.Fr.toRprLE(bOne, 0, curve.Fr.e(1));
+
+        let r1csPos = 0;
+
+        function r1cs_readULE32() {
+            const buff = sR1cs.slice(r1csPos, r1csPos+4);
+            r1csPos += 4;
+            const buffV = new DataView(buff.buffer);
+            return buffV.getUint32(0, true);
+        }
+
+        const coefs = new BigArray();
+        for (let c=0; c<r1cs.nConstraints; c++) {
+            if ((logger)&&(c%10000 == 0)) logger.debug(`processing constraints: ${c}/${r1cs.nConstraints}`);
+            const nA = r1cs_readULE32();
+            for (let i=0; i<nA; i++) {
+                const s = r1cs_readULE32();
+                const coefp = r1csPos;
+                r1csPos += curve.Fr.n8;
+
+                const l1t = TAU_G1;
+                const l1 = sG1*c;
+                const l2t = BETATAU_G1;
+                const l2 = sG1*c;
+                if (typeof A[s] === "undefined") A[s] = [];
+                A[s].push([l1t, l1, coefp]);
+
+                if (s <= nPublic) {
+                    if (typeof IC[s] === "undefined") IC[s] = [];
+                    IC[s].push([l2t, l2, coefp]);
+                } else {
+                    if (typeof C[s- nPublic -1] === "undefined") C[s- nPublic -1] = [];
+                    C[s - nPublic -1].push([l2t, l2, coefp]);
+                }
+                coefs.push([0, c, s, coefp]);
+            }
+
+            const nB = r1cs_readULE32();
+            for (let i=0; i<nB; i++) {
+                const s = r1cs_readULE32();
+                const coefp = r1csPos;
+                r1csPos += curve.Fr.n8;
+
+                const l1t = TAU_G1;
+                const l1 = sG1*c;
+                const l2t = TAU_G2;
+                const l2 = sG2*c;
+                const l3t = ALPHATAU_G1;
+                const l3 = sG1*c;
+                if (typeof B1[s] === "undefined") B1[s] = [];
+                B1[s].push([l1t, l1, coefp]);
+                if (typeof B2[s] === "undefined") B2[s] = [];
+                B2[s].push([l2t, l2, coefp]);
+
+                if (s <= nPublic) {
+                    if (typeof IC[s] === "undefined") IC[s] = [];
+                    IC[s].push([l3t, l3, coefp]);
+                } else {
+                    if (typeof C[s- nPublic -1] === "undefined") C[s- nPublic -1] = [];
+                    C[s- nPublic -1].push([l3t, l3, coefp]);
+                }
+
+                coefs.push([1, c, s, coefp]);
+            }
+
+            const nC = r1cs_readULE32();
+            for (let i=0; i<nC; i++) {
+                const s = r1cs_readULE32();
+                const coefp = r1csPos;
+                r1csPos += curve.Fr.n8;
+
+                const l1t = TAU_G1;
+                const l1 = sG1*c;
+                if (s <= nPublic) {
+                    if (typeof IC[s] === "undefined") IC[s] = [];
+                    IC[s].push([l1t, l1, coefp]);
+                } else {
+                    if (typeof C[s- nPublic -1] === "undefined") C[s- nPublic -1] = [];
+                    C[s- nPublic -1].push([l1t, l1, coefp]);
+                }
+            }
+        }
+
+        for (let s = 0; s <= nPublic ; s++) {
+            const l1t = TAU_G1;
+            const l1 = sG1*(r1cs.nConstraints + s);
+            const l2t = BETATAU_G1;
+            const l2 = sG1*(r1cs.nConstraints + s);
+            if (typeof A[s] === "undefined") A[s] = [];
+            A[s].push([l1t, l1, -1]);
+            if (typeof IC[s] === "undefined") IC[s] = [];
+            IC[s].push([l2t, l2, -1]);
+            coefs.push([0, r1cs.nConstraints + s, s, -1]);
+        }
+
+
+        await binFileUtils.startWriteSection(fdZKey, 4);
+
+        const buffSection = new ffjavascript.BigBuffer(coefs.length*(12+curve.Fr.n8) + 4);
+
+        const buff4 = new Uint8Array(4);
+        const buff4V = new DataView(buff4.buffer);
+        buff4V.setUint32(0, coefs.length, true);
+        buffSection.set(buff4);
+        let coefsPos = 4;
+        for (let i=0; i<coefs.length; i++) {
+            if ((logger)&&(i%100000 == 0)) logger.debug(`writing coeffs: ${i}/${coefs.length}`);
+            writeCoef(coefs[i]);
+        }
+
+        await fdZKey.write(buffSection);
+        await binFileUtils.endWriteSection(fdZKey);
+
+        function writeCoef(c) {
+            buffCoeffV.setUint32(0, c[0], true);
+            buffCoeffV.setUint32(4, c[1], true);
+            buffCoeffV.setUint32(8, c[2], true);
+            let n;
+            if (c[3]>=0) {
+                n = curve.Fr.fromRprLE(sR1cs.slice(c[3], c[3] + curve.Fr.n8), 0);
+            } else {
+                n = curve.Fr.fromRprLE(bOne, 0);
+            }
+            const nR2 = curve.Fr.mul(n, R2r);
+            curve.Fr.toRprLE(buffCoeff, 12, nR2);
+            buffSection.set(buffCoeff, coefsPos);
+            coefsPos += buffCoeff.length;
+        }
+
+    }
+
+    async function composeAndWritePoints(idSection, groupName, arr, sectionName) {
+        const CHUNK_SIZE= 1<<15;
+        const G = curve[groupName];
+
+        hashU32(arr.length);
+        await binFileUtils.startWriteSection(fdZKey, idSection);
+
+        let opPromises = [];
+
+        let i=0;
+        while (i<arr.length) {
+
+            let t=0;
+            while ((i<arr.length)&&(t<curve.tm.concurrency)) {
+                if (logger)  logger.debug(`Writing points start ${sectionName}: ${i}/${arr.length}`);
+                let n = 1;
+                let nP = (arr[i] ? arr[i].length : 0);
+                while ((i + n < arr.length) && (nP + (arr[i+n] ? arr[i+n].length : 0) < CHUNK_SIZE) && (n<CHUNK_SIZE)) {
+                    nP += (arr[i+n] ? arr[i+n].length : 0);
+                    n ++;
+                }
+                const subArr = arr.slice(i, i + n);
+                const _i = i;
+                opPromises.push(composeAndWritePointsThread(groupName, subArr, logger, sectionName).then( (r) => {
+                    if (logger)  logger.debug(`Writing points end ${sectionName}: ${_i}/${arr.length}`);
+                    return r;
+                }));
+                i += n;
+                t++;
+            }
+
+            const result = await Promise.all(opPromises);
+
+            for (let k=0; k<result.length; k++) {
+                await fdZKey.write(result[k][0]);
+                const buff = await G.batchLEMtoU(result[k][0]);
+                csHasher.update(buff);
+            }
+            opPromises = [];
+
+        }
+        await binFileUtils.endWriteSection(fdZKey);
+
+    }
+
+    async function composeAndWritePointsThread(groupName, arr, logger, sectionName) {
+        const G = curve[groupName];
+        const sGin = G.F.n8*2;
+        const sGmid = G.F.n8*3;
+        const sGout = G.F.n8*2;
+        let fnExp, fnMultiExp, fnBatchToAffine, fnZero;
+        if (groupName == "G1") {
+            fnExp = "g1m_timesScalarAffine";
+            fnMultiExp = "g1m_multiexpAffine";
+            fnBatchToAffine = "g1m_batchToAffine";
+            fnZero = "g1m_zero";
+        } else if (groupName == "G2") {
+            fnExp = "g2m_timesScalarAffine";
+            fnMultiExp = "g2m_multiexpAffine";
+            fnBatchToAffine = "g2m_batchToAffine";
+            fnZero = "g2m_zero";
+        } else {
+            throw new Error("Invalid group");
+        }
+        let acc =0;
+        for (let i=0; i<arr.length; i++) acc += arr[i] ? arr[i].length : 0;
+        let bBases, bScalars;
+        if (acc> 2<<14) {
+            bBases = new ffjavascript.BigBuffer(acc*sGin);
+            bScalars = new ffjavascript.BigBuffer(acc*curve.Fr.n8);
+        } else {
+            bBases = new Uint8Array(acc*sGin);
+            bScalars = new Uint8Array(acc*curve.Fr.n8);
+        }
+        let pB =0;
+        let pS =0;
+
+        const sBuffs = [
+            sTauG1,
+            sTauG2,
+            sAlphaTauG1,
+            sBetaTauG1
+        ];
+
+        const bOne = new Uint8Array(curve.Fr.n8);
+        curve.Fr.toRprLE(bOne, 0, curve.Fr.e(1));
+
+        let offset = 0;
+        for (let i=0; i<arr.length; i++) {
+            if (!arr[i]) continue;
+            for (let j=0; j<arr[i].length; j++) {
+                if ((logger)&&(j)&&(j%10000 == 0))  logger.debug(`Configuring big array ${sectionName}: ${j}/${arr[i].length}`);
+                bBases.set(
+                    sBuffs[arr[i][j][0]].slice(
+                        arr[i][j][1],
+                        arr[i][j][1] + sGin
+                    ), offset*sGin
+                );
+                if (arr[i][j][2]>=0) {
+                    bScalars.set(
+                        sR1cs.slice(
+                            arr[i][j][2],
+                            arr[i][j][2] + curve.Fr.n8
+                        ),
+                        offset*curve.Fr.n8
+                    );
+                } else {
+                    bScalars.set(bOne, offset*curve.Fr.n8);
+                }
+                offset ++;
+            }
+        }
+
+        if (arr.length>1) {
+            const task = [];
+            task.push({cmd: "ALLOCSET", var: 0, buff: bBases});
+            task.push({cmd: "ALLOCSET", var: 1, buff: bScalars});
+            task.push({cmd: "ALLOC", var: 2, len: arr.length*sGmid});
+            pB = 0;
+            pS = 0;
+            let pD =0;
+            for (let i=0; i<arr.length; i++) {
+                if (!arr[i]) {
+                    task.push({cmd: "CALL", fnName: fnZero, params: [
+                        {var: 2, offset: pD}
+                    ]});
+                    pD += sGmid;
+                    continue;
+                }
+                if (arr[i].length == 1) {
+                    task.push({cmd: "CALL", fnName: fnExp, params: [
+                        {var: 0, offset: pB},
+                        {var: 1, offset: pS},
+                        {val: curve.Fr.n8},
+                        {var: 2, offset: pD}
+                    ]});
+                } else {
+                    task.push({cmd: "CALL", fnName: fnMultiExp, params: [
+                        {var: 0, offset: pB},
+                        {var: 1, offset: pS},
+                        {val: curve.Fr.n8},
+                        {val: arr[i].length},
+                        {var: 2, offset: pD}
+                    ]});
+                }
+                pB += sGin*arr[i].length;
+                pS += curve.Fr.n8*arr[i].length;
+                pD += sGmid;
+            }
+            task.push({cmd: "CALL", fnName: fnBatchToAffine, params: [
+                {var: 2},
+                {val: arr.length},
+                {var: 2},
+            ]});
+            task.push({cmd: "GET", out: 0, var: 2, len: arr.length*sGout});
+
+            const res = await curve.tm.queueAction(task);
+            return res;
+        } else {
+            let res = await G.multiExpAffine(bBases, bScalars, logger, sectionName);
+            res = [ G.toAffine(res) ];
+            return res;
+        }
+    }
+
+
+    async function hashHPoints() {
+        const CHUNK_SIZE = 1<<14;
+
+        hashU32(domainSize-1);
+
+        for (let i=0; i<domainSize-1; i+= CHUNK_SIZE) {
+            if (logger)  logger.debug(`HashingHPoints: ${i}/${domainSize}`);
+            const n = Math.min(domainSize-1, CHUNK_SIZE);
+            await hashHPointsChunk(i, n);
+        }
+    }
+
+    async function hashHPointsChunk(offset, nPoints) {
+        const buff1 = await fdPTau.read(nPoints *sG1, sectionsPTau[2][0].p + (offset + domainSize)*sG1);
+        const buff2 = await fdPTau.read(nPoints *sG1, sectionsPTau[2][0].p + offset*sG1);
+        const concurrency= curve.tm.concurrency;
+        const nPointsPerThread = Math.floor(nPoints / concurrency);
+        const opPromises = [];
+        for (let i=0; i<concurrency; i++) {
+            let n;
+            if (i< concurrency-1) {
+                n = nPointsPerThread;
+            } else {
+                n = nPoints - i*nPointsPerThread;
+            }
+            if (n==0) continue;
+
+            const subBuff1 = buff1.slice(i*nPointsPerThread*sG1, (i*nPointsPerThread+n)*sG1);
+            const subBuff2 = buff2.slice(i*nPointsPerThread*sG1, (i*nPointsPerThread+n)*sG1);
+            opPromises.push(hashHPointsThread(subBuff1, subBuff2));
+        }
+
+
+        const result = await Promise.all(opPromises);
+
+        for (let i=0; i<result.length; i++) {
+            csHasher.update(result[i][0]);
+        }
+    }
+
+    async function hashHPointsThread(buff1, buff2) {
+        const nPoints = buff1.byteLength/sG1;
+        const sGmid = curve.G1.F.n8*3;
+        const task = [];
+        task.push({cmd: "ALLOCSET", var: 0, buff: buff1});
+        task.push({cmd: "ALLOCSET", var: 1, buff: buff2});
+        task.push({cmd: "ALLOC", var: 2, len: nPoints*sGmid});
+        for (let i=0; i<nPoints; i++) {
+            task.push({
+                cmd: "CALL",
+                fnName: "g1m_subAffine",
+                params: [
+                    {var: 0, offset: i*sG1},
+                    {var: 1, offset: i*sG1},
+                    {var: 2, offset: i*sGmid},
+                ]
+            });
+        }
+        task.push({cmd: "CALL", fnName: "g1m_batchToAffine", params: [
+            {var: 2},
+            {val: nPoints},
+            {var: 2},
+        ]});
+        task.push({cmd: "CALL", fnName: "g1m_batchLEMtoU", params: [
+            {var: 2},
+            {val: nPoints},
+            {var: 2},
+        ]});
+        task.push({cmd: "GET", out: 0, var: 2, len: nPoints*sG1});
+
+        const res = await curve.tm.queueAction(task);
+
+        return res;
+    }
+
+    function hashU32(n) {
+        const buff = new Uint8Array(4);
+        const buffV = new DataView(buff.buffer, buff.byteOffset, buff.byteLength);
+        buffV.setUint32(0, n, false);
+        csHasher.update(buff);
+    }
+
+}
+
+async function phase2exportMPCParams(zkeyName, mpcparamsName, logger) {
+
+    const {fd: fdZKey, sections: sectionsZKey} = await binFileUtils__namespace.readBinFile(zkeyName, "zkey", 2);
+    const zkey = await readHeader$1(fdZKey, sectionsZKey);
+    if (zkey.protocol != "groth16") {
+        throw new Error("zkey file is not groth16");
+    }
+
+    const curve = await getCurveFromQ(zkey.q);
+    const sG1 = curve.G1.F.n8*2;
+    const sG2 = curve.G2.F.n8*2;
+
+    const mpcParams = await readMPCParams(fdZKey, curve, sectionsZKey);
+
+    const fdMPCParams = await fastFile__namespace.createOverride(mpcparamsName);
+
+    /////////////////////
+    // Verification Key Section
+    /////////////////////
+    await writeG1(zkey.vk_alpha_1);
+    await writeG1(zkey.vk_beta_1);
+    await writeG2(zkey.vk_beta_2);
+    await writeG2(zkey.vk_gamma_2);
+    await writeG1(zkey.vk_delta_1);
+    await writeG2(zkey.vk_delta_2);
+
+    // IC
+    let buffBasesIC;
+    buffBasesIC = await binFileUtils__namespace.readSection(fdZKey, sectionsZKey, 3);
+    buffBasesIC = await curve.G1.batchLEMtoU(buffBasesIC);
+
+    await writePointArray("G1", buffBasesIC);
+
+    /////////////////////
+    // h Section
+    /////////////////////
+    const buffBasesH_Lodd = await binFileUtils__namespace.readSection(fdZKey, sectionsZKey, 9);
+
+    let buffBasesH_Tau;
+    buffBasesH_Tau = await curve.G1.fft(buffBasesH_Lodd, "affine", "jacobian", logger);
+    buffBasesH_Tau = await curve.G1.batchApplyKey(buffBasesH_Tau, curve.Fr.neg(curve.Fr.e(2)), curve.Fr.w[zkey.power+1], "jacobian", "affine", logger);
+
+    // Remove last element.  (The degree of H will be allways m-2)
+    buffBasesH_Tau = buffBasesH_Tau.slice(0, buffBasesH_Tau.byteLength - sG1);
+    buffBasesH_Tau = await curve.G1.batchLEMtoU(buffBasesH_Tau);
+    await writePointArray("G1", buffBasesH_Tau);
+
+    /////////////////////
+    // L section
+    /////////////////////
+    let buffBasesC;
+    buffBasesC = await binFileUtils__namespace.readSection(fdZKey, sectionsZKey, 8);
+    buffBasesC = await curve.G1.batchLEMtoU(buffBasesC);
+    await writePointArray("G1", buffBasesC);
+
+    /////////////////////
+    // A Section (C section)
+    /////////////////////
+    let buffBasesA;
+    buffBasesA = await binFileUtils__namespace.readSection(fdZKey, sectionsZKey, 5);
+    buffBasesA = await curve.G1.batchLEMtoU(buffBasesA);
+    await writePointArray("G1", buffBasesA);
+
+    /////////////////////
+    // B1 Section
+    /////////////////////
+    let buffBasesB1;
+    buffBasesB1 = await binFileUtils__namespace.readSection(fdZKey, sectionsZKey, 6);
+    buffBasesB1 = await curve.G1.batchLEMtoU(buffBasesB1);
+    await writePointArray("G1", buffBasesB1);
+
+    /////////////////////
+    // B2 Section
+    /////////////////////
+    let buffBasesB2;
+    buffBasesB2 = await binFileUtils__namespace.readSection(fdZKey, sectionsZKey, 7);
+    buffBasesB2 = await curve.G2.batchLEMtoU(buffBasesB2);
+    await writePointArray("G2", buffBasesB2);
+
+    await fdMPCParams.write(mpcParams.csHash);
+    await writeU32(mpcParams.contributions.length);
+
+    for (let i=0; i<mpcParams.contributions.length; i++) {
+        const c = mpcParams.contributions[i];
+        await writeG1(c.deltaAfter);
+        await writeG1(c.delta.g1_s);
+        await writeG1(c.delta.g1_sx);
+        await writeG2(c.delta.g2_spx);
+        await fdMPCParams.write(c.transcript);
+    }
+
+    await fdZKey.close();
+    await fdMPCParams.close();
+
+    async function writeG1(P) {
+        const buff = new Uint8Array(sG1);
+        curve.G1.toRprUncompressed(buff, 0, P);
+        await fdMPCParams.write(buff);
+    }
+
+    async function writeG2(P) {
+        const buff = new Uint8Array(sG2);
+        curve.G2.toRprUncompressed(buff, 0, P);
+        await fdMPCParams.write(buff);
+    }
+
+    async function writePointArray(groupName, buff) {
+        let sG;
+        if (groupName == "G1") {
+            sG = sG1;
+        } else {
+            sG = sG2;
+        }
+
+        const buffSize = new Uint8Array(4);
+        const buffSizeV = new DataView(buffSize.buffer, buffSize.byteOffset, buffSize.byteLength);
+        buffSizeV.setUint32(0, buff.byteLength / sG, false);
+
+        await fdMPCParams.write(buffSize);
+        await fdMPCParams.write(buff);
+    }
+
+    async function writeU32(n) {
+        const buffSize = new Uint8Array(4);
+        const buffSizeV = new DataView(buffSize.buffer, buffSize.byteOffset, buffSize.byteLength);
+        buffSizeV.setUint32(0, n, false);
+
+        await fdMPCParams.write(buffSize);
+    }
+
+
+
+}
+
+/*
+    Copyright 2018 0KIMS association.
+
+    This file is part of snarkJS.
+
+    snarkJS is a free software: you can redistribute it and/or modify it
+    under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    snarkJS is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
+    License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with snarkJS. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+async function phase2importMPCParams(zkeyNameOld, mpcparamsName, zkeyNameNew, name, logger) {
+
+    const {fd: fdZKeyOld, sections: sectionsZKeyOld} = await binFileUtils__namespace.readBinFile(zkeyNameOld, "zkey", 2);
+    const zkeyHeader = await readHeader$1(fdZKeyOld, sectionsZKeyOld, false);
+    if (zkeyHeader.protocol != "groth16") {
+        throw new Error("zkey file is not groth16");
+    }
+
+    const curve = await getCurveFromQ(zkeyHeader.q);
+    const sG1 = curve.G1.F.n8*2;
+    const sG2 = curve.G2.F.n8*2;
+
+    const oldMPCParams = await readMPCParams(fdZKeyOld, curve, sectionsZKeyOld);
+    const newMPCParams = {};
+
+    const fdMPCParams = await fastFile__namespace.readExisting(mpcparamsName);
+
+    fdMPCParams.pos =
+        sG1*3 + sG2*3 +                     // vKey
+        8 + sG1*zkeyHeader.nVars +              // IC + C
+        4 + sG1*(zkeyHeader.domainSize-1) +     // H
+        4 + sG1*zkeyHeader.nVars +              // A
+        4 + sG1*zkeyHeader.nVars +              // B1
+        4 + sG2*zkeyHeader.nVars;               // B2
+
+    // csHash
+    newMPCParams.csHash =  await fdMPCParams.read(64);
+
+    const nConttributions = await fdMPCParams.readUBE32();
+    newMPCParams.contributions = [];
+    for (let i=0; i<nConttributions; i++) {
+        const c = { delta:{} };
+        c.deltaAfter = await readG1(fdMPCParams);
+        c.delta.g1_s = await readG1(fdMPCParams);
+        c.delta.g1_sx = await readG1(fdMPCParams);
+        c.delta.g2_spx = await readG2(fdMPCParams);
+        c.transcript = await fdMPCParams.read(64);
+        if (i<oldMPCParams.contributions.length) {
+            c.type = oldMPCParams.contributions[i].type;
+            if (c.type==1) {
+                c.beaconHash = oldMPCParams.contributions[i].beaconHash;
+                c.numIterationsExp = oldMPCParams.contributions[i].numIterationsExp;
+            }
+            if (oldMPCParams.contributions[i].name) {
+                c.name = oldMPCParams.contributions[i].name;
+            }
+        }
+        newMPCParams.contributions.push(c);
+    }
+
+    if (!hashIsEqual(newMPCParams.csHash, oldMPCParams.csHash)) {
+        if (logger) logger.error("Hash of the original circuit does not match with the MPC one");
+        return false;
+    }
+
+    if (oldMPCParams.contributions.length > newMPCParams.contributions.length) {
+        if (logger) logger.error("The impoerted file does not include new contributions");
+        return false;
+    }
+
+    for (let i=0; i<oldMPCParams.contributions.length; i++) {
+        if (!contributionIsEqual(oldMPCParams.contributions[i], newMPCParams.contributions[i])) {
+            if (logger) logger.error(`Previos contribution ${i} does not match`);
+            return false;
+        }
+    }
+
+
+    // Set the same name to all new controbutions
+    if (name) {
+        for (let i=oldMPCParams.contributions.length; i<newMPCParams.contributions.length; i++) {
+            newMPCParams.contributions[i].name = name;
+        }
+    }
+
+    const fdZKeyNew = await binFileUtils__namespace.createBinFile(zkeyNameNew, "zkey", 1, 10);
+    fdMPCParams.pos = 0;
+
+    // Header
+    fdMPCParams.pos += sG1;  // ignore alpha1 (keep original)
+    fdMPCParams.pos += sG1;  // ignore beta1
+    fdMPCParams.pos += sG2;  // ignore beta2
+    fdMPCParams.pos += sG2;  // ignore gamma2
+    zkeyHeader.vk_delta_1 = await readG1(fdMPCParams);
+    zkeyHeader.vk_delta_2 = await readG2(fdMPCParams);
+    await writeHeader(fdZKeyNew, zkeyHeader);
+
+    // IC (Keep original)
+    const nIC = await fdMPCParams.readUBE32();
+    if (nIC != zkeyHeader.nPublic +1) {
+        if (logger) logger.error("Invalid number of points in IC");
+        await fdZKeyNew.discard();
+        return false;
+    }
+    fdMPCParams.pos += sG1*(zkeyHeader.nPublic+1);
+    await binFileUtils__namespace.copySection(fdZKeyOld, sectionsZKeyOld, fdZKeyNew, 3);
+
+    // Coeffs (Keep original)
+    await binFileUtils__namespace.copySection(fdZKeyOld, sectionsZKeyOld, fdZKeyNew, 4);
+
+    // H Section
+    const nH = await fdMPCParams.readUBE32();
+    if (nH != zkeyHeader.domainSize-1) {
+        if (logger) logger.error("Invalid number of points in H");
+        await fdZKeyNew.discard();
+        return false;
+    }
+    let buffH;
+    const buffTauU = await fdMPCParams.read(sG1*(zkeyHeader.domainSize-1));
+    const buffTauLEM = await curve.G1.batchUtoLEM(buffTauU);
+    buffH = new Uint8Array(zkeyHeader.domainSize*sG1);
+    buffH.set(buffTauLEM);   // Let the last one to zero.
+    curve.G1.toRprLEM(buffH, sG1*(zkeyHeader.domainSize-1), curve.G1.zeroAffine);
+    const n2Inv = curve.Fr.neg(curve.Fr.inv(curve.Fr.e(2)));
+    const wInv = curve.Fr.inv(curve.Fr.w[zkeyHeader.power+1]);
+    buffH = await curve.G1.batchApplyKey(buffH, n2Inv, wInv, "affine", "jacobian", logger);
+    buffH = await curve.G1.ifft(buffH, "jacobian", "affine", logger);
+    await binFileUtils__namespace.startWriteSection(fdZKeyNew, 9);
+    await fdZKeyNew.write(buffH);
+    await binFileUtils__namespace.endWriteSection(fdZKeyNew);
+
+    // C Secion (L section)
+    const nL = await fdMPCParams.readUBE32();
+    if (nL != (zkeyHeader.nVars-zkeyHeader.nPublic-1)) {
+        if (logger) logger.error("Invalid number of points in L");
+        await fdZKeyNew.discard();
+        return false;
+    }
+    let buffL;
+    buffL = await fdMPCParams.read(sG1*(zkeyHeader.nVars-zkeyHeader.nPublic-1));
+    buffL = await curve.G1.batchUtoLEM(buffL);
+    await binFileUtils__namespace.startWriteSection(fdZKeyNew, 8);
+    await fdZKeyNew.write(buffL);
+    await binFileUtils__namespace.endWriteSection(fdZKeyNew);
+
+    // A Section
+    const nA = await fdMPCParams.readUBE32();
+    if (nA != zkeyHeader.nVars) {
+        if (logger) logger.error("Invalid number of points in A");
+        await fdZKeyNew.discard();
+        return false;
+    }
+    fdMPCParams.pos += sG1*(zkeyHeader.nVars);
+    await binFileUtils__namespace.copySection(fdZKeyOld, sectionsZKeyOld, fdZKeyNew, 5);
+
+    // B1 Section
+    const nB1 = await fdMPCParams.readUBE32();
+    if (nB1 != zkeyHeader.nVars) {
+        if (logger) logger.error("Invalid number of points in B1");
+        await fdZKeyNew.discard();
+        return false;
+    }
+    fdMPCParams.pos += sG1*(zkeyHeader.nVars);
+    await binFileUtils__namespace.copySection(fdZKeyOld, sectionsZKeyOld, fdZKeyNew, 6);
+
+    // B2 Section
+    const nB2 = await fdMPCParams.readUBE32();
+    if (nB2 != zkeyHeader.nVars) {
+        if (logger) logger.error("Invalid number of points in B2");
+        await fdZKeyNew.discard();
+        return false;
+    }
+    fdMPCParams.pos += sG2*(zkeyHeader.nVars);
+    await binFileUtils__namespace.copySection(fdZKeyOld, sectionsZKeyOld, fdZKeyNew, 7);
+
+    await writeMPCParams(fdZKeyNew, curve, newMPCParams);
+
+    await fdMPCParams.close();
+    await fdZKeyNew.close();
+    await fdZKeyOld.close();
+
+    return true;
+
+    async function readG1(fd) {
+        const buff = await fd.read(curve.G1.F.n8*2);
+        return curve.G1.fromRprUncompressed(buff, 0);
+    }
+
+    async function readG2(fd) {
+        const buff = await fd.read(curve.G2.F.n8*2);
+        return curve.G2.fromRprUncompressed(buff, 0);
+    }
+
+
+    function contributionIsEqual(c1, c2) {
+        if (!curve.G1.eq(c1.deltaAfter   , c2.deltaAfter)) return false;
+        if (!curve.G1.eq(c1.delta.g1_s   , c2.delta.g1_s)) return false;
+        if (!curve.G1.eq(c1.delta.g1_sx  , c2.delta.g1_sx)) return false;
+        if (!curve.G2.eq(c1.delta.g2_spx , c2.delta.g2_spx)) return false;
+        if (!hashIsEqual(c1.transcript, c2.transcript)) return false;
+        return true;
+    }
+
+
+}
+
+/*
+    Copyright 2018 0KIMS association.
+
+    This file is part of snarkJS.
+
+    snarkJS is a free software: you can redistribute it and/or modify it
+    under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    snarkJS is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
+    License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with snarkJS. If not, see <https://www.gnu.org/licenses/>.
+*/
+const sameRatio = sameRatio$2;
+
+
+
+async function phase2verifyFromInit(initFileName, pTauFileName, zkeyFileName, logger) {
+
+    let sr;
+    await Blake2b__default["default"].ready();
+
+    const {fd, sections} = await binFileUtils__namespace.readBinFile(zkeyFileName, "zkey", 2);
+    const zkey = await readHeader$1(fd, sections, false);
+    if (zkey.protocol != "groth16") {
+        throw new Error("zkey file is not groth16");
+    }
+
+    const curve = await getCurveFromQ(zkey.q);
+    const sG1 = curve.G1.F.n8*2;
+
+    const mpcParams = await readMPCParams(fd, curve, sections);
+
+    const accumulatedHasher = Blake2b__default["default"](64);
+    accumulatedHasher.update(mpcParams.csHash);
+    let curDelta = curve.G1.g;
+    for (let i=0; i<mpcParams.contributions.length; i++) {
+        const c = mpcParams.contributions[i];
+        const ourHasher = cloneHasher(accumulatedHasher);
+
+        hashG1(ourHasher, curve, c.delta.g1_s);
+        hashG1(ourHasher, curve, c.delta.g1_sx);
+
+        if (!hashIsEqual(ourHasher.digest(), c.transcript)) {
+            console.log(`INVALID(${i}): Inconsistent transcript `);
+            return false;
+        }
+
+        const delta_g2_sp = hashToG2(curve, c.transcript);
+
+        sr = await sameRatio(curve, c.delta.g1_s, c.delta.g1_sx, delta_g2_sp, c.delta.g2_spx);
+        if (sr !== true) {
+            console.log(`INVALID(${i}): public key G1 and G2 do not have the same ration `);
+            return false;
+        }
+
+        sr = await sameRatio(curve, curDelta, c.deltaAfter, delta_g2_sp, c.delta.g2_spx);
+        if (sr !== true) {
+            console.log(`INVALID(${i}): deltaAfter does not fillow the public key `);
+            return false;
+        }
+
+        if (c.type == 1) {
+            const rng = rngFromBeaconParams(c.beaconHash, c.numIterationsExp);
+            const expected_prvKey = curve.Fr.fromRng(rng);
+            const expected_g1_s = curve.G1.toAffine(curve.G1.fromRng(rng));
+            const expected_g1_sx = curve.G1.toAffine(curve.G1.timesFr(expected_g1_s, expected_prvKey));
+            if (curve.G1.eq(expected_g1_s, c.delta.g1_s) !== true) {
+                console.log(`INVALID(${i}): Key of the beacon does not match. g1_s `);
+                return false;
+            }
+            if (curve.G1.eq(expected_g1_sx, c.delta.g1_sx) !== true) {
+                console.log(`INVALID(${i}): Key of the beacon does not match. g1_sx `);
+                return false;
+            }
+        }
+
+        hashPubKey(accumulatedHasher, curve, c);
+
+        const contributionHasher = Blake2b__default["default"](64);
+        hashPubKey(contributionHasher, curve, c);
+
+        c.contributionHash = contributionHasher.digest();
+
+        curDelta = c.deltaAfter;
+    }
+
+
+    const {fd: fdInit, sections: sectionsInit} = await binFileUtils__namespace.readBinFile(initFileName, "zkey", 2);
+    const zkeyInit = await readHeader$1(fdInit, sectionsInit, false);
+
+    if (zkeyInit.protocol != "groth16") {
+        throw new Error("zkeyinit file is not groth16");
+    }
+
+    if (  (!ffjavascript.Scalar.eq(zkeyInit.q, zkey.q))
+        ||(!ffjavascript.Scalar.eq(zkeyInit.r, zkey.r))
+        ||(zkeyInit.n8q != zkey.n8q)
+        ||(zkeyInit.n8r != zkey.n8r))
+    {
+        if (logger) logger.error("INVALID:  Different curves");
+        return false;
+    }
+
+    if (  (zkeyInit.nVars != zkey.nVars)
+        ||(zkeyInit.nPublic !=  zkey.nPublic)
+        ||(zkeyInit.domainSize != zkey.domainSize))
+    {
+        if (logger) logger.error("INVALID:  Different circuit parameters");
+        return false;
+    }
+
+    if (!curve.G1.eq(zkey.vk_alpha_1, zkeyInit.vk_alpha_1)) {
+        if (logger) logger.error("INVALID:  Invalid alpha1");
+        return false;
+    }
+    if (!curve.G1.eq(zkey.vk_beta_1, zkeyInit.vk_beta_1)) {
+        if (logger) logger.error("INVALID:  Invalid beta1");
+        return false;
+    }
+    if (!curve.G2.eq(zkey.vk_beta_2, zkeyInit.vk_beta_2)) {
+        if (logger) logger.error("INVALID:  Invalid beta2");
+        return false;
+    }
+    if (!curve.G2.eq(zkey.vk_gamma_2, zkeyInit.vk_gamma_2)) {
+        if (logger) logger.error("INVALID:  Invalid gamma2");
+        return false;
+    }
+    if (!curve.G1.eq(zkey.vk_delta_1, curDelta)) {
+        if (logger) logger.error("INVALID:  Invalid delta1");
+        return false;
+    }
+    sr = await sameRatio(curve, curve.G1.g, curDelta, curve.G2.g, zkey.vk_delta_2);
+    if (sr !== true) {
+        if (logger) logger.error("INVALID:  Invalid delta2");
+        return false;
+    }
+
+    const mpcParamsInit = await readMPCParams(fdInit, curve, sectionsInit);
+    if (!hashIsEqual(mpcParams.csHash, mpcParamsInit.csHash)) {
+        if (logger) logger.error("INVALID:  Circuit does not match");
+        return false;
+    }
+
+    // Check sizes of sections
+    if (sections[8][0].size != sG1*(zkey.nVars-zkey.nPublic-1)) {
+        if (logger) logger.error("INVALID:  Invalid L section size");
+        return false;
+    }
+
+    if (sections[9][0].size != sG1*(zkey.domainSize)) {
+        if (logger) logger.error("INVALID:  Invalid H section size");
+        return false;
+    }
+
+    let ss;
+    ss = await binFileUtils__namespace.sectionIsEqual(fd, sections, fdInit, sectionsInit, 3);
+    if (!ss) {
+        if (logger) logger.error("INVALID:  IC section is not identical");
+        return false;
+    }
+
+    ss = await binFileUtils__namespace.sectionIsEqual(fd, sections, fdInit, sectionsInit, 4);
+    if (!ss) {
+        if (logger) logger.error("Coeffs section is not identical");
+        return false;
+    }
+
+    ss = await binFileUtils__namespace.sectionIsEqual(fd, sections, fdInit, sectionsInit, 5);
+    if (!ss) {
+        if (logger) logger.error("A section is not identical");
+        return false;
+    }
+
+    ss = await binFileUtils__namespace.sectionIsEqual(fd, sections, fdInit, sectionsInit, 6);
+    if (!ss) {
+        if (logger) logger.error("B1 section is not identical");
+        return false;
+    }
+
+    ss = await binFileUtils__namespace.sectionIsEqual(fd, sections, fdInit, sectionsInit, 7);
+    if (!ss) {
+        if (logger) logger.error("B2 section is not identical");
+        return false;
+    }
+
+    // Check L
+    sr = await sectionHasSameRatio("G1", fdInit, sectionsInit, fd, sections, 8, zkey.vk_delta_2, zkeyInit.vk_delta_2, "L section");
+    if (sr!==true) {
+        if (logger) logger.error("L section does not match");
+        return false;
+    }
+
+    // Check H
+    sr = await sameRatioH();
+    if (sr!==true) {
+        if (logger) logger.error("H section does not match");
+        return false;
+    }
+
+    if (logger) logger.info(formatHash(mpcParams.csHash, "Circuit Hash: "));
+
+    await fd.close();
+    await fdInit.close();
+
+    for (let i=mpcParams.contributions.length-1; i>=0; i--) {
+        const c = mpcParams.contributions[i];
+        if (logger) logger.info("-------------------------");
+        if (logger) logger.info(formatHash(c.contributionHash, `contribution #${i+1} ${c.name ? c.name : ""}:`));
+        if (c.type == 1) {
+            if (logger) logger.info(`Beacon generator: ${byteArray2hex(c.beaconHash)}`);
+            if (logger) logger.info(`Beacon iterations Exp: ${c.numIterationsExp}`);
+        }
+    }
+    if (logger) logger.info("-------------------------");
+
+    if (logger) logger.info("ZKey Ok!");
+
+    return true;
+
+
+    async function sectionHasSameRatio(groupName, fd1, sections1, fd2, sections2, idSection, g2sp, g2spx, sectionName) {
+        const MAX_CHUNK_SIZE = 1<<20;
+        const G = curve[groupName];
+        const sG = G.F.n8*2;
+        await binFileUtils__namespace.startReadUniqueSection(fd1, sections1, idSection);
+        await binFileUtils__namespace.startReadUniqueSection(fd2, sections2, idSection);
+
+        let R1 = G.zero;
+        let R2 = G.zero;
+
+        const nPoints = sections1[idSection][0].size / sG;
+
+        for (let i=0; i<nPoints; i += MAX_CHUNK_SIZE) {
+            if (logger) logger.debug(`Same ratio check ${sectionName}:  ${i}/${nPoints}`);
+            const n = Math.min(nPoints - i, MAX_CHUNK_SIZE);
+            const bases1 = await fd1.read(n*sG);
+            const bases2 = await fd2.read(n*sG);
+
+            const scalars = new Uint8Array(4*n);
+            crypto__default["default"].randomFillSync(scalars);
+
+
+            const r1 = await G.multiExpAffine(bases1, scalars);
+            const r2 = await G.multiExpAffine(bases2, scalars);
+
+            R1 = G.add(R1, r1);
+            R2 = G.add(R2, r2);
+        }
+        await binFileUtils__namespace.endReadSection(fd1);
+        await binFileUtils__namespace.endReadSection(fd2);
+
+        if (nPoints == 0) return true;
+
+        sr = await sameRatio(curve, R1, R2, g2sp, g2spx);
+        if (sr !== true) return false;
+
+        return true;
+    }
+
+    async function sameRatioH() {
+        const MAX_CHUNK_SIZE = 1<<20;
+        const G = curve.G1;
+        const Fr = curve.Fr;
+        const sG = G.F.n8*2;
+
+        const {fd: fdPTau, sections: sectionsPTau} = await binFileUtils__namespace.readBinFile(pTauFileName, "ptau", 1);
+
+        let buff_r = new ffjavascript.BigBuffer(zkey.domainSize * zkey.n8r);
+
+        const seed= new Array(8);
+        for (let i=0; i<8; i++) {
+            seed[i] = crypto__default["default"].randomBytes(4).readUInt32BE(0, true);
+        }
+        const rng = new ffjavascript.ChaCha(seed);
+        for (let i=0; i<zkey.domainSize-1; i++) {   // Note that last one is zero
+            const e = Fr.fromRng(rng);
+            Fr.toRprLE(buff_r, i*zkey.n8r, e);
+        }
+        Fr.toRprLE(buff_r, (zkey.domainSize-1)*zkey.n8r, Fr.zero);
+
+        let R1 = G.zero;
+        for (let i=0; i<zkey.domainSize; i += MAX_CHUNK_SIZE) {
+            if (logger) logger.debug(`H Verificaition(tau):  ${i}/${zkey.domainSize}`);
+            const n = Math.min(zkey.domainSize - i, MAX_CHUNK_SIZE);
+
+            const buff1 = await fdPTau.read(sG*n, sectionsPTau[2][0].p + zkey.domainSize*sG + i*sG);
+            const buff2 = await fdPTau.read(sG*n, sectionsPTau[2][0].p + i*sG);
+
+            const buffB = await batchSubstract(buff1, buff2);
+            const buffS = buff_r.slice(i*zkey.n8r, (i+n)*zkey.n8r);
+            const r = await G.multiExpAffine(buffB, buffS);
+
+            R1 = G.add(R1, r);
+        }
+
+        // Caluclate odd coeficients in transformed domain
+
+        buff_r = await Fr.batchToMontgomery(buff_r);
+        // const first = curve.Fr.neg(curve.Fr.inv(curve.Fr.e(2)));
+        // Works*2   const first = curve.Fr.neg(curve.Fr.e(2));
+
+
+        let first;
+
+        if (zkey.power < Fr.s) {
+            first = Fr.neg(Fr.e(2));
+        } else {
+            const small_m  = 2 ** Fr.s;
+            const shift_to_small_m = Fr.exp(Fr.shift, small_m);
+            first = Fr.sub( shift_to_small_m, Fr.one);
+        }
+
+        // const inc = curve.Fr.inv(curve.PFr.w[zkey.power+1]);
+        const inc = zkey.power < Fr.s ? Fr.w[zkey.power+1] : Fr.shift;
+        buff_r = await Fr.batchApplyKey(buff_r, first, inc);
+        buff_r = await Fr.fft(buff_r);
+        buff_r = await Fr.batchFromMontgomery(buff_r);
+
+        await binFileUtils__namespace.startReadUniqueSection(fd, sections, 9);
+        let R2 = G.zero;
+        for (let i=0; i<zkey.domainSize; i += MAX_CHUNK_SIZE) {
+            if (logger) logger.debug(`H Verificaition(lagrange):  ${i}/${zkey.domainSize}`);
+            const n = Math.min(zkey.domainSize - i, MAX_CHUNK_SIZE);
+
+            const buff = await fd.read(sG*n);
+            const buffS = buff_r.slice(i*zkey.n8r, (i+n)*zkey.n8r);
+            const r = await G.multiExpAffine(buff, buffS);
+
+            R2 = G.add(R2, r);
+        }
+        await binFileUtils__namespace.endReadSection(fd);
+
+        sr = await sameRatio(curve, R1, R2, zkey.vk_delta_2, zkeyInit.vk_delta_2);
+        if (sr !== true) return false;
+
+
+        return true;
+
+    }
+
+    async function batchSubstract(buff1, buff2) {
+        const sG = curve.G1.F.n8*2;
+        const nPoints = buff1.byteLength / sG;
+        const concurrency= curve.tm.concurrency;
+        const nPointsPerThread = Math.floor(nPoints / concurrency);
+        const opPromises = [];
+        for (let i=0; i<concurrency; i++) {
+            let n;
+            if (i< concurrency-1) {
+                n = nPointsPerThread;
+            } else {
+                n = nPoints - i*nPointsPerThread;
+            }
+            if (n==0) continue;
+
+            const subBuff1 = buff1.slice(i*nPointsPerThread*sG1, (i*nPointsPerThread+n)*sG1);
+            const subBuff2 = buff2.slice(i*nPointsPerThread*sG1, (i*nPointsPerThread+n)*sG1);
+            opPromises.push(batchSubstractThread(subBuff1, subBuff2));
+        }
+
+
+        const result = await Promise.all(opPromises);
+
+        const fullBuffOut = new Uint8Array(nPoints*sG);
+        let p =0;
+        for (let i=0; i<result.length; i++) {
+            fullBuffOut.set(result[i][0], p);
+            p+=result[i][0].byteLength;
+        }
+
+        return fullBuffOut;
+    }
+
+
+    async function batchSubstractThread(buff1, buff2) {
+        const sG1 = curve.G1.F.n8*2;
+        const sGmid = curve.G1.F.n8*3;
+        const nPoints = buff1.byteLength/sG1;
+        const task = [];
+        task.push({cmd: "ALLOCSET", var: 0, buff: buff1});
+        task.push({cmd: "ALLOCSET", var: 1, buff: buff2});
+        task.push({cmd: "ALLOC", var: 2, len: nPoints*sGmid});
+        for (let i=0; i<nPoints; i++) {
+            task.push({
+                cmd: "CALL",
+                fnName: "g1m_subAffine",
+                params: [
+                    {var: 0, offset: i*sG1},
+                    {var: 1, offset: i*sG1},
+                    {var: 2, offset: i*sGmid},
+                ]
+            });
+        }
+        task.push({cmd: "CALL", fnName: "g1m_batchToAffine", params: [
+            {var: 2},
+            {val: nPoints},
+            {var: 2},
+        ]});
+        task.push({cmd: "GET", out: 0, var: 2, len: nPoints*sG1});
+
+        const res = await curve.tm.queueAction(task);
+
+        return res;
+    }
+
+}
+
+/*
+    Copyright 2018 0KIMS association.
+
+    This file is part of snarkJS.
+
+    snarkJS is a free software: you can redistribute it and/or modify it
+    under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    snarkJS is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
+    License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with snarkJS. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+async function phase2verifyFromR1cs(r1csFileName, pTauFileName, zkeyFileName, logger) {
+
+    // const initFileName = "~" + zkeyFileName + ".init";
+    const initFileName = {type: "bigMem"};
+    await newZKey(r1csFileName, pTauFileName, initFileName, logger);
+
+    return await phase2verifyFromInit(initFileName, pTauFileName, zkeyFileName, logger);
+}
+
+/*
+    Copyright 2018 0KIMS association.
+
+    This file is part of snarkJS.
+
+    snarkJS is a free software: you can redistribute it and/or modify it
+    under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    snarkJS is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
+    License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with snarkJS. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+async function phase2contribute(zkeyNameOld, zkeyNameNew, name, entropy, logger) {
+    await Blake2b__default["default"].ready();
+
+    const {fd: fdOld, sections: sections} = await binFileUtils__namespace.readBinFile(zkeyNameOld, "zkey", 2);
+    const zkey = await readHeader$1(fdOld, sections);
+    if (zkey.protocol != "groth16") {
+        throw new Error("zkey file is not groth16");
+    }
+
+    const curve = await getCurveFromQ(zkey.q);
+
+    const mpcParams = await readMPCParams(fdOld, curve, sections);
+
+    const fdNew = await binFileUtils__namespace.createBinFile(zkeyNameNew, "zkey", 1, 10);
+
+
+    const rng = await getRandomRng(entropy);
+
+    const transcriptHasher = Blake2b__default["default"](64);
+    transcriptHasher.update(mpcParams.csHash);
+    for (let i=0; i<mpcParams.contributions.length; i++) {
+        hashPubKey(transcriptHasher, curve, mpcParams.contributions[i]);
+    }
+
+    const curContribution = {};
+    curContribution.delta = {};
+    curContribution.delta.prvKey = curve.Fr.fromRng(rng);
+    curContribution.delta.g1_s = curve.G1.toAffine(curve.G1.fromRng(rng));
+    curContribution.delta.g1_sx = curve.G1.toAffine(curve.G1.timesFr(curContribution.delta.g1_s, curContribution.delta.prvKey));
+    hashG1(transcriptHasher, curve, curContribution.delta.g1_s);
+    hashG1(transcriptHasher, curve, curContribution.delta.g1_sx);
+    curContribution.transcript = transcriptHasher.digest();
+    curContribution.delta.g2_sp = hashToG2(curve, curContribution.transcript);
+    curContribution.delta.g2_spx = curve.G2.toAffine(curve.G2.timesFr(curContribution.delta.g2_sp, curContribution.delta.prvKey));
+
+    zkey.vk_delta_1 = curve.G1.timesFr(zkey.vk_delta_1, curContribution.delta.prvKey);
+    zkey.vk_delta_2 = curve.G2.timesFr(zkey.vk_delta_2, curContribution.delta.prvKey);
+
+    curContribution.deltaAfter = zkey.vk_delta_1;
+
+    curContribution.type = 0;
+    if (name) curContribution.name = name;
+
+    mpcParams.contributions.push(curContribution);
+
+    await writeHeader(fdNew, zkey);
+
+    // IC
+    await binFileUtils__namespace.copySection(fdOld, sections, fdNew, 3);
+
+    // Coeffs (Keep original)
+    await binFileUtils__namespace.copySection(fdOld, sections, fdNew, 4);
+
+    // A Section
+    await binFileUtils__namespace.copySection(fdOld, sections, fdNew, 5);
+
+    // B1 Section
+    await binFileUtils__namespace.copySection(fdOld, sections, fdNew, 6);
+
+    // B2 Section
+    await binFileUtils__namespace.copySection(fdOld, sections, fdNew, 7);
+
+    const invDelta = curve.Fr.inv(curContribution.delta.prvKey);
+    await applyKeyToSection(fdOld, sections, fdNew, 8, curve, "G1", invDelta, curve.Fr.e(1), "L Section", logger);
+    await applyKeyToSection(fdOld, sections, fdNew, 9, curve, "G1", invDelta, curve.Fr.e(1), "H Section", logger);
+
+    await writeMPCParams(fdNew, curve, mpcParams);
+
+    await fdOld.close();
+    await fdNew.close();
+
+    const contributionHasher = Blake2b__default["default"](64);
+    hashPubKey(contributionHasher, curve, curContribution);
+
+    const contribuionHash = contributionHasher.digest();
+
+    if (logger) logger.info(formatHash(mpcParams.csHash, "Circuit Hash: "));
+    if (logger) logger.info(formatHash(contribuionHash, "Contribution Hash: "));
+
+    return contribuionHash;
+}
+
+/*
+    Copyright 2018 0KIMS association.
+
+    This file is part of snarkJS.
+
+    snarkJS is a free software: you can redistribute it and/or modify it
+    under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    snarkJS is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
+    License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with snarkJS. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+
+async function beacon(zkeyNameOld, zkeyNameNew, name, beaconHashStr, numIterationsExp, logger) {
+    await Blake2b__default["default"].ready();
+
+    const beaconHash = hex2ByteArray(beaconHashStr);
+    if (   (beaconHash.byteLength == 0)
+        || (beaconHash.byteLength*2 !=beaconHashStr.length))
+    {
+        if (logger) logger.error("Invalid Beacon Hash. (It must be a valid hexadecimal sequence)");
+        return false;
+    }
+    if (beaconHash.length>=256) {
+        if (logger) logger.error("Maximum lenght of beacon hash is 255 bytes");
+        return false;
+    }
+
+    numIterationsExp = parseInt(numIterationsExp);
+    if ((numIterationsExp<10)||(numIterationsExp>63)) {
+        if (logger) logger.error("Invalid numIterationsExp. (Must be between 10 and 63)");
+        return false;
+    }
+
+
+    const {fd: fdOld, sections: sections} = await binFileUtils__namespace.readBinFile(zkeyNameOld, "zkey", 2);
+    const zkey = await readHeader$1(fdOld, sections);
+
+    if (zkey.protocol != "groth16") {
+        throw new Error("zkey file is not groth16");
+    }
+
+
+    const curve = await getCurveFromQ(zkey.q);
+
+    const mpcParams = await readMPCParams(fdOld, curve, sections);
+
+    const fdNew = await binFileUtils__namespace.createBinFile(zkeyNameNew, "zkey", 1, 10);
+
+    const rng = await rngFromBeaconParams(beaconHash, numIterationsExp);
+
+    const transcriptHasher = Blake2b__default["default"](64);
+    transcriptHasher.update(mpcParams.csHash);
+    for (let i=0; i<mpcParams.contributions.length; i++) {
+        hashPubKey(transcriptHasher, curve, mpcParams.contributions[i]);
+    }
+
+    const curContribution = {};
+    curContribution.delta = {};
+    curContribution.delta.prvKey = curve.Fr.fromRng(rng);
+    curContribution.delta.g1_s = curve.G1.toAffine(curve.G1.fromRng(rng));
+    curContribution.delta.g1_sx = curve.G1.toAffine(curve.G1.timesFr(curContribution.delta.g1_s, curContribution.delta.prvKey));
+    hashG1(transcriptHasher, curve, curContribution.delta.g1_s);
+    hashG1(transcriptHasher, curve, curContribution.delta.g1_sx);
+    curContribution.transcript = transcriptHasher.digest();
+    curContribution.delta.g2_sp = hashToG2(curve, curContribution.transcript);
+    curContribution.delta.g2_spx = curve.G2.toAffine(curve.G2.timesFr(curContribution.delta.g2_sp, curContribution.delta.prvKey));
+
+    zkey.vk_delta_1 = curve.G1.timesFr(zkey.vk_delta_1, curContribution.delta.prvKey);
+    zkey.vk_delta_2 = curve.G2.timesFr(zkey.vk_delta_2, curContribution.delta.prvKey);
+
+    curContribution.deltaAfter = zkey.vk_delta_1;
+
+    curContribution.type = 1;
+    curContribution.numIterationsExp = numIterationsExp;
+    curContribution.beaconHash = beaconHash;
+
+    if (name) curContribution.name = name;
+
+    mpcParams.contributions.push(curContribution);
+
+    await writeHeader(fdNew, zkey);
+
+    // IC
+    await binFileUtils__namespace.copySection(fdOld, sections, fdNew, 3);
+
+    // Coeffs (Keep original)
+    await binFileUtils__namespace.copySection(fdOld, sections, fdNew, 4);
+
+    // A Section
+    await binFileUtils__namespace.copySection(fdOld, sections, fdNew, 5);
+
+    // B1 Section
+    await binFileUtils__namespace.copySection(fdOld, sections, fdNew, 6);
+
+    // B2 Section
+    await binFileUtils__namespace.copySection(fdOld, sections, fdNew, 7);
+
+    const invDelta = curve.Fr.inv(curContribution.delta.prvKey);
+    await applyKeyToSection(fdOld, sections, fdNew, 8, curve, "G1", invDelta, curve.Fr.e(1), "L Section", logger);
+    await applyKeyToSection(fdOld, sections, fdNew, 9, curve, "G1", invDelta, curve.Fr.e(1), "H Section", logger);
+
+    await writeMPCParams(fdNew, curve, mpcParams);
+
+    await fdOld.close();
+    await fdNew.close();
+
+    const contributionHasher = Blake2b__default["default"](64);
+    hashPubKey(contributionHasher, curve, curContribution);
+
+    const contribuionHash = contributionHasher.digest();
+
+    if (logger) logger.info(formatHash(contribuionHash, "Contribution Hash: "));
+
+    return contribuionHash;
+}
+
+async function zkeyExportJson(zkeyFileName) {
+
+    const zKey = await readZKey(zkeyFileName, true);
+
+    return zKey;
+}
+
+/*
+    Copyright 2018 0KIMS association.
+
+    This file is part of snarkJS.
+
+    snarkJS is a free software: you can redistribute it and/or modify it
+    under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    snarkJS is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
+    License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with snarkJS. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+async function bellmanContribute(curve, challengeFilename, responesFileName, entropy, logger) {
+    await Blake2b__default["default"].ready();
+
+    const rng = await getRandomRng(entropy);
+
+    const delta = curve.Fr.fromRng(rng);
+    const invDelta = curve.Fr.inv(delta);
+
+    const sG1 = curve.G1.F.n8*2;
+    const sG2 = curve.G2.F.n8*2;
+
+    const fdFrom = await fastFile__namespace.readExisting(challengeFilename);
+    const fdTo = await fastFile__namespace.createOverride(responesFileName);
+
+
+    await copy(sG1); // alpha1
+    await copy(sG1); // beta1
+    await copy(sG2); // beta2
+    await copy(sG2); // gamma2
+    const oldDelta1 = await readG1();
+    const delta1 = curve.G1.timesFr(oldDelta1, delta);
+    await writeG1(delta1);
+    const oldDelta2 = await readG2();
+    const delta2 = curve.G2.timesFr(oldDelta2, delta);
+    await writeG2(delta2);
+
+    // IC
+    const nIC = await fdFrom.readUBE32();
+    await fdTo.writeUBE32(nIC);
+    await copy(nIC*sG1);
+
+    // H
+    const nH = await fdFrom.readUBE32();
+    await fdTo.writeUBE32(nH);
+    await applyKeyToChallengeSection(fdFrom, fdTo, null, curve, "G1", nH, invDelta, curve.Fr.e(1), "UNCOMPRESSED", "H", logger);
+
+    // L
+    const nL = await fdFrom.readUBE32();
+    await fdTo.writeUBE32(nL);
+    await applyKeyToChallengeSection(fdFrom, fdTo, null, curve, "G1", nL, invDelta, curve.Fr.e(1), "UNCOMPRESSED", "L", logger);
+
+    // A
+    const nA = await fdFrom.readUBE32();
+    await fdTo.writeUBE32(nA);
+    await copy(nA*sG1);
+
+    // B1
+    const nB1 = await fdFrom.readUBE32();
+    await fdTo.writeUBE32(nB1);
+    await copy(nB1*sG1);
+
+    // B2
+    const nB2 = await fdFrom.readUBE32();
+    await fdTo.writeUBE32(nB2);
+    await copy(nB2*sG2);
+
+
+    //////////
+    /// Read contributions
+    //////////
+    const transcriptHasher = Blake2b__default["default"](64);
+
+    const mpcParams = {};
+    // csHash
+    mpcParams.csHash =  await fdFrom.read(64);
+    transcriptHasher.update(mpcParams.csHash);
+
+    const nConttributions = await fdFrom.readUBE32();
+    mpcParams.contributions = [];
+    for (let i=0; i<nConttributions; i++) {
+        const c = { delta:{} };
+        c.deltaAfter = await readG1();
+        c.delta.g1_s = await readG1();
+        c.delta.g1_sx = await readG1();
+        c.delta.g2_spx = await readG2();
+        c.transcript = await fdFrom.read(64);
+        mpcParams.contributions.push(c);
+        hashPubKey(transcriptHasher, curve, c);
+    }
+
+    const curContribution = {};
+    curContribution.delta = {};
+    curContribution.delta.prvKey = delta;
+    curContribution.delta.g1_s = curve.G1.toAffine(curve.G1.fromRng(rng));
+    curContribution.delta.g1_sx = curve.G1.toAffine(curve.G1.timesFr(curContribution.delta.g1_s, delta));
+    hashG1(transcriptHasher, curve, curContribution.delta.g1_s);
+    hashG1(transcriptHasher, curve, curContribution.delta.g1_sx);
+    curContribution.transcript = transcriptHasher.digest();
+    curContribution.delta.g2_sp = hashToG2(curve, curContribution.transcript);
+    curContribution.delta.g2_spx = curve.G2.toAffine(curve.G2.timesFr(curContribution.delta.g2_sp, delta));
+    curContribution.deltaAfter = delta1;
+    curContribution.type = 0;
+    mpcParams.contributions.push(curContribution);
+
+
+    //////////
+    /// Write COntribution
+    //////////
+
+    await fdTo.write(mpcParams.csHash);
+    await fdTo.writeUBE32(mpcParams.contributions.length);
+
+    for (let i=0; i<mpcParams.contributions.length; i++) {
+        const c = mpcParams.contributions[i];
+        await writeG1(c.deltaAfter);
+        await writeG1(c.delta.g1_s);
+        await writeG1(c.delta.g1_sx);
+        await writeG2(c.delta.g2_spx);
+        await fdTo.write(c.transcript);
+    }
+
+    const contributionHasher = Blake2b__default["default"](64);
+    hashPubKey(contributionHasher, curve, curContribution);
+
+    const contributionHash = contributionHasher.digest();
+
+    if (logger) logger.info(formatHash(contributionHash, "Contribution Hash: "));
+
+    await fdTo.close();
+    await fdFrom.close();
+
+    return contributionHash;
+
+    async function copy(nBytes) {
+        const CHUNK_SIZE = fdFrom.pageSize*2;
+        for (let i=0; i<nBytes; i+= CHUNK_SIZE) {
+            const n = Math.min(nBytes -i, CHUNK_SIZE);
+            const buff = await fdFrom.read(n);
+            await fdTo.write(buff);
+        }
+    }
+
+    async function readG1() {
+        const buff = await fdFrom.read(curve.G1.F.n8*2);
+        return curve.G1.fromRprUncompressed(buff, 0);
+    }
+
+    async function readG2() {
+        const buff = await fdFrom.read(curve.G2.F.n8*2);
+        return curve.G2.fromRprUncompressed(buff, 0);
+    }
+
+    async function writeG1(P) {
+        const buff = new Uint8Array(sG1);
+        curve.G1.toRprUncompressed(buff, 0, P);
+        await fdTo.write(buff);
+    }
+
+    async function writeG2(P) {
+        const buff = new Uint8Array(sG2);
+        curve.G2.toRprUncompressed(buff, 0, P);
+        await fdTo.write(buff);
+    }
+
+
+}
+
+/*
+    Copyright 2018 0KIMS association.
+
+    This file is part of snarkJS.
+
+    snarkJS is a free software: you can redistribute it and/or modify it
+    under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    snarkJS is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
+    License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with snarkJS. If not, see <https://www.gnu.org/licenses/>.
+*/
+const {stringifyBigInts: stringifyBigInts$1} = ffjavascript.utils;
+
+async function zkeyExportVerificationKey(zkeyName, /* logger */ ) {
+
+    const {fd, sections} = await binFileUtils__namespace.readBinFile(zkeyName, "zkey", 2);
+    const zkey = await readHeader$1(fd, sections);
+
+    let res;
+    if (zkey.protocol == "groth16") {
+        res = await groth16Vk(zkey, fd, sections);
+    } else if (zkey.protocol == "plonk") {
+        res = await plonkVk(zkey);
+    } else {
+        throw new Error("zkey file is not groth16");
+    }
+
+    await fd.close();
+
+    return res;
+}
+
+
+async function groth16Vk(zkey, fd, sections) {
+    const curve = await getCurveFromQ(zkey.q);
+    const sG1 = curve.G1.F.n8*2;
+
+    const alphaBeta = await curve.pairing( zkey.vk_alpha_1 , zkey.vk_beta_2 );
+
+    let vKey = {
+        protocol: zkey.protocol,
+        curve: curve.name,
+        nPublic: zkey.nPublic,
+
+        vk_alpha_1: curve.G1.toObject(zkey.vk_alpha_1),
+
+        vk_beta_2: curve.G2.toObject(zkey.vk_beta_2),
+        vk_gamma_2:  curve.G2.toObject(zkey.vk_gamma_2),
+        vk_delta_2:  curve.G2.toObject(zkey.vk_delta_2),
+
+        vk_alphabeta_12: curve.Gt.toObject(alphaBeta)
+    };
+
+    // Read IC Section
+    ///////////
+    await binFileUtils__namespace.startReadUniqueSection(fd, sections, 3);
+    vKey.IC = [];
+    for (let i=0; i<= zkey.nPublic; i++) {
+        const buff = await fd.read(sG1);
+        const P = curve.G1.toObject(buff);
+        vKey.IC.push(P);
+    }
+    await binFileUtils__namespace.endReadSection(fd);
+
+    vKey = stringifyBigInts$1(vKey);
+
+    return vKey;
+}
+
+
+async function plonkVk(zkey) {
+    const curve = await getCurveFromQ(zkey.q);
+
+    let vKey = {
+        protocol: zkey.protocol,
+        curve: curve.name,
+        nPublic: zkey.nPublic,
+        power: zkey.power,
+
+        k1: curve.Fr.toObject(zkey.k1),
+        k2: curve.Fr.toObject(zkey.k2),
+
+        Qm: curve.G1.toObject(zkey.Qm),
+        Ql: curve.G1.toObject(zkey.Ql),
+        Qr: curve.G1.toObject(zkey.Qr),
+        Qo: curve.G1.toObject(zkey.Qo),
+        Qc: curve.G1.toObject(zkey.Qc),
+        S1: curve.G1.toObject(zkey.S1),
+        S2: curve.G1.toObject(zkey.S2),
+        S3: curve.G1.toObject(zkey.S3),
+
+        X_2: curve.G2.toObject(zkey.X_2),
+
+        w: curve.Fr.toObject(curve.Fr.w[zkey.power])
+    };
+
+    vKey = stringifyBigInts$1(vKey);
+
+    return vKey;
+}
+
+var ejs = {};
+
+// Not ready yet
+// module.exports.generateVerifier_kimleeoh = generateVerifier_kimleeoh;
+
+
+
+async function exportSolidityVerifier(zKeyName, templates, logger) {
+
+    const verificationKey = await zkeyExportVerificationKey(zKeyName);
+
+    let template = templates[verificationKey.protocol];
+
+    return ejs.render(template ,  verificationKey);
+}
+
+/*
+    Copyright 2018 0KIMS association.
+
+    This file is part of snarkJS.
+
+    snarkJS is a free software: you can redistribute it and/or modify it
+    under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    snarkJS is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
+    License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with snarkJS. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+var zkey = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    newZKey: newZKey,
+    exportBellman: phase2exportMPCParams,
+    importBellman: phase2importMPCParams,
+    verifyFromR1cs: phase2verifyFromR1cs,
+    verifyFromInit: phase2verifyFromInit,
+    contribute: phase2contribute,
+    beacon: beacon,
+    exportJson: zkeyExportJson,
+    bellmanContribute: bellmanContribute,
+    exportVerificationKey: zkeyExportVerificationKey,
+    exportSolidityVerifier: exportSolidityVerifier
+});
+
+/*
+    Copyright 2021 0kims association.
+
+    This file is part of snarkjs.
+
+    snarkjs is a free software: you can redistribute it and/or
+    modify it under the terms of the GNU General Public License as published by the
+    Free Software Foundation, either version 3 of the License, or (at your option)
+    any later version.
+
+    snarkjs is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+    more details.
+
+    You should have received a copy of the GNU General Public License along with
+    snarkjs. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+
+async function plonkSetup(r1csName, ptauName, zkeyName, logger) {
+
+    await Blake2b__default["default"].ready();
+
+    const {fd: fdPTau, sections: sectionsPTau} = await binFileUtils.readBinFile(ptauName, "ptau", 1, 1<<22, 1<<24);
+    const {curve, power} = await readPTauHeader(fdPTau, sectionsPTau);
+    const {fd: fdR1cs, sections: sectionsR1cs} = await binFileUtils.readBinFile(r1csName, "r1cs", 1, 1<<22, 1<<24);
+    const r1cs = await r1csfile.readR1csHeader(fdR1cs, sectionsR1cs, false);
+
+    const sG1 = curve.G1.F.n8*2;
+    const G1 = curve.G1;
+    const sG2 = curve.G2.F.n8*2;
+    const Fr = curve.Fr;
+    const n8r = curve.Fr.n8;
+
+    if (logger) logger.info("Reading r1cs");
+    let sR1cs = await binFileUtils.readSection(fdR1cs, sectionsR1cs, 2);
+
+    const plonkConstraints = new BigArray();
+    const plonkAdditions = new BigArray();
+    let plonkNVars = r1cs.nVars;
+
+    const nPublic = r1cs.nOutputs + r1cs.nPubInputs;
+
+    await processConstraints();
+
+    const fdZKey = await binFileUtils.createBinFile(zkeyName, "zkey", 1, 14, 1<<22, 1<<24);
+
+
+    if (r1cs.prime != curve.r) {
+        if (logger) logger.error("r1cs curve does not match powers of tau ceremony curve");
+        return -1;
+    }
+
+    let cirPower = log2(plonkConstraints.length -1) +1;
+    if (cirPower < 3) cirPower = 3;   // As the t polinomal is n+5 whe need at least a power of 4
+    const domainSize = 2 ** cirPower;
+
+    if (logger) logger.info("Plonk constraints: " + plonkConstraints.length);
+    if (cirPower > power) {
+        if (logger) logger.error(`circuit too big for this power of tau ceremony. ${plonkConstraints.length} > 2**${power}`);
+        return -1;
+    }
+
+    if (!sectionsPTau[12]) {
+        if (logger) logger.error("Powers of tau is not prepared.");
+        return -1;
+    }
+
+
+    const LPoints = new ffjavascript.BigBuffer(domainSize*sG1);
+    const o = sectionsPTau[12][0].p + ((2 ** (cirPower)) -1)*sG1;
+    await fdPTau.readToBuffer(LPoints, 0, domainSize*sG1, o);
+
+    const [k1, k2] = getK1K2();
+
+    const vk = {};
+
+
+    await writeAdditions(3, "Additions");
+    await writeWitnessMap(4, 0, "Amap");
+    await writeWitnessMap(5, 1, "Bmap");
+    await writeWitnessMap(6, 2, "Cmap");
+    await writeQMap(7, 3, "Qm");
+    await writeQMap(8, 4, "Ql");
+    await writeQMap(9, 5, "Qr");
+    await writeQMap(10, 6, "Qo");
+    await writeQMap(11, 7, "Qc");
+    await writeSigma(12, "sigma");
+    await writeLs(13, "lagrange polynomials");
+
+    // Write PTau points
+    ////////////
+
+    await binFileUtils.startWriteSection(fdZKey, 14);
+    const buffOut = new ffjavascript.BigBuffer((domainSize+6)*sG1);
+    await fdPTau.readToBuffer(buffOut, 0, (domainSize+6)*sG1, sectionsPTau[2][0].p);
+    await fdZKey.write(buffOut);
+    await binFileUtils.endWriteSection(fdZKey);
+
+
+    await writeHeaders();
+
+    await fdZKey.close();
+    await fdR1cs.close();
+    await fdPTau.close();
+
+    if (logger) logger.info("Setup Finished");
+
+    return ;
+
+    async function processConstraints() {
+
+        let r1csPos = 0;
+
+        function r1cs_readULE32() {
+            const buff = sR1cs.slice(r1csPos, r1csPos+4);
+            r1csPos += 4;
+            const buffV = new DataView(buff.buffer);
+            return buffV.getUint32(0, true);
+        }
+
+        function r1cs_readCoef() {
+            const res = Fr.fromRprLE(sR1cs.slice(r1csPos, r1csPos+curve.Fr.n8));
+            r1csPos += curve.Fr.n8;
+            return res;
+        }
+
+        function r1cs_readCoefs() {
+            const coefs = [];
+            const res = {
+                k: curve.Fr.zero
+            };
+            const nA = r1cs_readULE32();
+            for (let i=0; i<nA; i++) {
+                const s = r1cs_readULE32();
+                const coefp = r1cs_readCoef();
+
+                if (s==0) {
+                    res.k = coefp;
+                } else {
+                    coefs.push([s, coefp]);
+                }
+            }
+
+            const resCoef = reduceCoef(coefs);
+            res.s = resCoef[0];
+            res.coef = resCoef[1];
+            return res;
+        }
+
+        function reduceCoef(coefs) {
+            if (coefs.length == 0) {
+                return [0, curve.Fr.zero];
+            }
+            if (coefs.length == 1) {
+                return coefs[0];
+            }
+            const arr1 = coefs.slice(0, coefs.length >> 1);
+            const arr2 = coefs.slice(coefs.length >> 1);
+            const coef1 = reduceCoef(arr1);
+            const coef2 = reduceCoef(arr2);
+
+            const sl = coef1[0];
+            const sr = coef2[0];
+            const so = plonkNVars++;
+            const qm = curve.Fr.zero;
+            const ql = Fr.neg(coef1[1]);
+            const qr = Fr.neg(coef2[1]);
+            const qo = curve.Fr.one;
+            const qc = curve.Fr.zero;
+
+            plonkConstraints.push([sl, sr, so, qm, ql, qr, qo, qc]);
+
+            plonkAdditions.push([sl, sr, coef1[1], coef2[1]]);
+
+            return [so, curve.Fr.one];
+        }
+
+        for (let s = 1; s <= nPublic ; s++) {
+            const sl = s;
+            const sr = 0;
+            const so = 0;
+            const qm = curve.Fr.zero;
+            const ql = curve.Fr.one;
+            const qr = curve.Fr.zero;
+            const qo = curve.Fr.zero;
+            const qc = curve.Fr.zero;
+
+            plonkConstraints.push([sl, sr, so, qm, ql, qr, qo, qc]);
+        }
+
+        for (let c=0; c<r1cs.nConstraints; c++) {
+            if ((logger)&&(c%10000 == 0)) logger.debug(`processing constraints: ${c}/${r1cs.nConstraints}`);
+            const A = r1cs_readCoefs();
+            const B = r1cs_readCoefs();
+            const C = r1cs_readCoefs();
+
+            const sl = A.s;
+            const sr = B.s;
+            const so = C.s;
+            const qm = curve.Fr.mul(A.coef, B.coef);
+            const ql = curve.Fr.mul(A.coef, B.k);
+            const qr = curve.Fr.mul(A.k, B.coef);
+            const qo = curve.Fr.neg(C.coef);
+            const qc = curve.Fr.sub(curve.Fr.mul(A.k, B.k) , C.k);
+
+            plonkConstraints.push([sl, sr, so, qm, ql, qr, qo, qc]);
+        }
+
+    }
+
+    async function writeWitnessMap(sectionNum, posConstraint, name) {
+        await binFileUtils.startWriteSection(fdZKey, sectionNum);
+        for (let i=0; i<plonkConstraints.length; i++) {
+            await fdZKey.writeULE32(plonkConstraints[i][posConstraint]);
+            if ((logger)&&(i%1000000 == 0)) logger.debug(`writing ${name}: ${i}/${plonkConstraints.length}`);
+        }
+        await binFileUtils.endWriteSection(fdZKey);
+    }
+
+    async function writeQMap(sectionNum, posConstraint, name) {
+        let Q = new ffjavascript.BigBuffer(domainSize*n8r);
+        for (let i=0; i<plonkConstraints.length; i++) {
+            Q.set(plonkConstraints[i][posConstraint], i*n8r);
+            if ((logger)&&(i%1000000 == 0)) logger.debug(`writing ${name}: ${i}/${plonkConstraints.length}`);
+        }
+        await binFileUtils.startWriteSection(fdZKey, sectionNum);
+        await writeP4(Q);
+        await binFileUtils.endWriteSection(fdZKey);
+        Q = await Fr.batchFromMontgomery(Q);
+        vk[name]= await curve.G1.multiExpAffine(LPoints, Q, logger, "multiexp "+name);
+    }
+
+    async function writeP4(buff) {
+        const q = await Fr.ifft(buff);
+        const q4 = new ffjavascript.BigBuffer(domainSize*n8r*4);
+        q4.set(q, 0);
+        const Q4 = await Fr.fft(q4);
+        await fdZKey.write(q);
+        await fdZKey.write(Q4);
+    }
+
+    async function writeAdditions(sectionNum, name) {
+        await binFileUtils.startWriteSection(fdZKey, sectionNum);
+        const buffOut = new Uint8Array((2*4+2*n8r));
+        const buffOutV = new DataView(buffOut.buffer);
+        for (let i=0; i<plonkAdditions.length; i++) {
+            const addition=plonkAdditions[i];
+            let o=0;
+            buffOutV.setUint32(o, addition[0], true); o+=4;
+            buffOutV.setUint32(o, addition[1], true); o+=4;
+            // The value is storen in  Montgomery. stored = v*R
+            // so when montgomery multiplicated by the witness  it result = v*R*w/R = v*w 
+            buffOut.set(addition[2], o); o+= n8r;
+            buffOut.set(addition[3], o); o+= n8r;
+            await fdZKey.write(buffOut);
+            if ((logger)&&(i%1000000 == 0)) logger.debug(`writing ${name}: ${i}/${plonkAdditions.length}`);
+        }
+        await binFileUtils.endWriteSection(fdZKey);
+    }
+
+    async function writeSigma(sectionNum, name) {
+        const sigma = new ffjavascript.BigBuffer(n8r*domainSize*3);
+        const lastAparence =  new BigArray(plonkNVars);
+        const firstPos = new BigArray(plonkNVars);
+        let w = Fr.one;
+        for (let i=0; i<domainSize;i++) {
+            if (i<plonkConstraints.length) {
+                buildSigma(plonkConstraints[i][0], i);
+                buildSigma(plonkConstraints[i][1], domainSize + i);
+                buildSigma(plonkConstraints[i][2], domainSize*2 + i);
+            } else {
+                buildSigma(0, i);
+                buildSigma(0, domainSize + i);
+                buildSigma(0, domainSize*2 + i);
+            }
+            w = Fr.mul(w, Fr.w[cirPower]);
+            if ((logger)&&(i%1000000 == 0)) logger.debug(`writing ${name} phase1: ${i}/${plonkConstraints.length}`);
+        }
+        for (let s=0; s<plonkNVars; s++) {
+            if (typeof firstPos[s] !== "undefined") {
+                sigma.set(lastAparence[s], firstPos[s]*n8r);
+            } else {
+                throw new Error("Variable not used");
+            }
+            if ((logger)&&(s%1000000 == 0)) logger.debug(`writing ${name} phase2: ${s}/${plonkNVars}`);
+        }
+        await binFileUtils.startWriteSection(fdZKey, sectionNum);
+        let S1 = sigma.slice(0, domainSize*n8r);
+        await writeP4(S1);
+        let S2 = sigma.slice(domainSize*n8r, domainSize*n8r*2);
+        await writeP4(S2);
+        let S3 = sigma.slice(domainSize*n8r*2, domainSize*n8r*3);
+        await writeP4(S3);
+        await binFileUtils.endWriteSection(fdZKey);
+
+        S1 = await Fr.batchFromMontgomery(S1);
+        S2 = await Fr.batchFromMontgomery(S2);
+        S3 = await Fr.batchFromMontgomery(S3);
+
+        vk.S1= await curve.G1.multiExpAffine(LPoints, S1, logger, "multiexp S1");
+        vk.S2= await curve.G1.multiExpAffine(LPoints, S2, logger, "multiexp S2");
+        vk.S3= await curve.G1.multiExpAffine(LPoints, S3, logger, "multiexp S3");
+
+        function buildSigma(s, p) {
+            if (typeof lastAparence[s] === "undefined") {
+                firstPos[s] = p;
+            } else {
+                sigma.set(lastAparence[s], p*n8r);
+            }
+            let v;
+            if (p<domainSize) {
+                v = w;
+            } else if (p<2*domainSize) {
+                v = Fr.mul(w, k1);
+            } else {
+                v = Fr.mul(w, k2);
+            }
+            lastAparence[s]=v;
+        }
+    }
+
+    async function writeLs(sectionNum, name) {
+        await binFileUtils.startWriteSection(fdZKey, sectionNum);
+        const l=Math.max(nPublic, 1);
+        for (let i=0; i<l; i++) {
+            let buff = new ffjavascript.BigBuffer(domainSize*n8r);
+            buff.set(Fr.one, i*n8r);
+            await writeP4(buff);
+            if (logger) logger.debug(`writing ${name} ${i}/${l}`);
+        }
+        await binFileUtils.endWriteSection(fdZKey);
+    }
+
+    async function writeHeaders() {
+
+        // Write the header
+        ///////////
+        await binFileUtils.startWriteSection(fdZKey, 1);
+        await fdZKey.writeULE32(2); // Plonk
+        await binFileUtils.endWriteSection(fdZKey);
+
+        // Write the Plonk header section
+        ///////////
+
+        await binFileUtils.startWriteSection(fdZKey, 2);
+        const primeQ = curve.q;
+        const n8q = (Math.floor( (ffjavascript.Scalar.bitLength(primeQ) - 1) / 64) +1)*8;
+
+        const primeR = curve.r;
+        const n8r = (Math.floor( (ffjavascript.Scalar.bitLength(primeR) - 1) / 64) +1)*8;
+
+        await fdZKey.writeULE32(n8q);
+        await binFileUtils.writeBigInt(fdZKey, primeQ, n8q);
+        await fdZKey.writeULE32(n8r);
+        await binFileUtils.writeBigInt(fdZKey, primeR, n8r);
+        await fdZKey.writeULE32(plonkNVars);                         // Total number of bars
+        await fdZKey.writeULE32(nPublic);                       // Total number of public vars (not including ONE)
+        await fdZKey.writeULE32(domainSize);                  // domainSize
+        await fdZKey.writeULE32(plonkAdditions.length);                  // domainSize
+        await fdZKey.writeULE32(plonkConstraints.length); 
+
+        await fdZKey.write(k1);
+        await fdZKey.write(k2);
+
+        await fdZKey.write(G1.toAffine(vk.Qm));
+        await fdZKey.write(G1.toAffine(vk.Ql));
+        await fdZKey.write(G1.toAffine(vk.Qr));
+        await fdZKey.write(G1.toAffine(vk.Qo));
+        await fdZKey.write(G1.toAffine(vk.Qc));
+
+        await fdZKey.write(G1.toAffine(vk.S1));
+        await fdZKey.write(G1.toAffine(vk.S2));
+        await fdZKey.write(G1.toAffine(vk.S3));
+
+        let bX_2;
+        bX_2 = await fdPTau.read(sG2, sectionsPTau[3][0].p + sG2);
+        await fdZKey.write(bX_2);
+
+        await binFileUtils.endWriteSection(fdZKey);
+    }
+
+    function getK1K2() {
+        let k1 = Fr.two;
+        while (isIncluded(k1, [], cirPower)) Fr.add(k1, Fr.one);
+        let k2 = Fr.add(k1, Fr.one);
+        while (isIncluded(k2, [k1], cirPower)) Fr.add(k2, Fr.one);
+        return [k1, k2];
+
+
+        function isIncluded(k, kArr, pow) {
+            const domainSize= 2**pow;
+            let w = Fr.one;
+            for (let i=0; i<domainSize; i++) {
+                if (Fr.eq(k, w)) return true;
+                for (let j=0; j<kArr.length; j++) {
+                    if (Fr.eq(k, Fr.mul(kArr[j], w))) return true;
+                }
+                w = Fr.mul(w, Fr.w[pow]);
+            }
+            return false;
+        }
+    }
+}
+
+/*
+    Copyright 2021 0kims association.
+
+    This file is part of snarkjs.
+
+    snarkjs is a free software: you can redistribute it and/or
+    modify it under the terms of the GNU General Public License as published by the
+    Free Software Foundation, either version 3 of the License, or (at your option)
+    any later version.
+
+    snarkjs is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+    more details.
+
+    You should have received a copy of the GNU General Public License along with
+    snarkjs. If not, see <https://www.gnu.org/licenses/>.
+*/
+const {stringifyBigInts} = ffjavascript.utils;
+const { keccak256: keccak256$1 } = jsSha3__default["default"];
+
+async function plonk16Prove(zkeyFileName, witnessFileName, logger) {
+    const {fd: fdWtns, sections: sectionsWtns} = await binFileUtils__namespace.readBinFile(witnessFileName, "wtns", 2, 1<<25, 1<<23);
+
+    const wtns = await readHeader(fdWtns, sectionsWtns);
+
+    const {fd: fdZKey, sections: sectionsZKey} = await binFileUtils__namespace.readBinFile(zkeyFileName, "zkey", 2, 1<<25, 1<<23);
+
+    const zkey = await readHeader$1(fdZKey, sectionsZKey);
+    if (zkey.protocol != "plonk") {
+        throw new Error("zkey file is not groth16");
+    }
+
+    if (!ffjavascript.Scalar.eq(zkey.r,  wtns.q)) {
+        throw new Error("Curve of the witness does not match the curve of the proving key");
+    }
+
+    if (wtns.nWitness != zkey.nVars -zkey.nAdditions) {
+        throw new Error(`Invalid witness length. Circuit: ${zkey.nVars}, witness: ${wtns.nWitness}, ${zkey.nAdditions}`);
+    }
+
+    const curve = await getCurveFromQ(zkey.q);
+    const Fr = curve.Fr;
+    const G1 = curve.G1;
+    const n8r = curve.Fr.n8;
+
+    if (logger) logger.debug("Reading Wtns");
+    const buffWitness = await binFileUtils__namespace.readSection(fdWtns, sectionsWtns, 2);
+    // First element in plonk is not used and can be any value. (But always the same).
+    // We set it to zero to go faster in the exponentiations.
+    buffWitness.set(Fr.zero, 0);
+    const buffInternalWitness = new ffjavascript.BigBuffer(n8r*zkey.nAdditions);
+
+    await calculateAdditions();
+
+    let A,B,C,Z;
+    let A4, B4, C4, Z4;
+    let pol_a,pol_b,pol_c, pol_z, pol_t, pol_r;
+    let proof = {};
+
+    const sigmaBuff = new ffjavascript.BigBuffer(zkey.domainSize*n8r*4*3);
+    let o = sectionsZKey[12][0].p + zkey.domainSize*n8r;
+    await fdZKey.readToBuffer(sigmaBuff, 0 , zkey.domainSize*n8r*4, o);
+    o += zkey.domainSize*n8r*5;
+    await fdZKey.readToBuffer(sigmaBuff, zkey.domainSize*n8r*4 , zkey.domainSize*n8r*4, o);
+    o += zkey.domainSize*n8r*5;
+    await fdZKey.readToBuffer(sigmaBuff, zkey.domainSize*n8r*8 , zkey.domainSize*n8r*4, o);
+
+    const pol_s1 = new ffjavascript.BigBuffer(zkey.domainSize*n8r);
+    await fdZKey.readToBuffer(pol_s1, 0 , zkey.domainSize*n8r, sectionsZKey[12][0].p);
+
+    const pol_s2 = new ffjavascript.BigBuffer(zkey.domainSize*n8r);
+    await fdZKey.readToBuffer(pol_s2, 0 , zkey.domainSize*n8r, sectionsZKey[12][0].p + 5*zkey.domainSize*n8r);
+
+    const PTau = await binFileUtils__namespace.readSection(fdZKey, sectionsZKey, 14);
+
+
+    const ch = {};
+
+    await round1();
+    await round2();
+    await round3();
+    await round4();
+    await round5();
+
+
+    ///////////////////////
+    // Final adjustments //
+    ///////////////////////
+
+    proof.protocol = "plonk";
+    proof.curve = curve.name;
+
+    await fdZKey.close();
+    await fdWtns.close();
+
+    let publicSignals = [];
+
+    for (let i=1; i<= zkey.nPublic; i++) {
+        const pub = buffWitness.slice(i*Fr.n8, i*Fr.n8+Fr.n8);
+        publicSignals.push(ffjavascript.Scalar.fromRprLE(pub));
+    }
+
+    proof.A = G1.toObject(proof.A);
+    proof.B = G1.toObject(proof.B);
+    proof.C = G1.toObject(proof.C);
+    proof.Z = G1.toObject(proof.Z);
+
+    proof.T1 = G1.toObject(proof.T1);
+    proof.T2 = G1.toObject(proof.T2);
+    proof.T3 = G1.toObject(proof.T3);
+
+    proof.eval_a = Fr.toObject(proof.eval_a);
+    proof.eval_b = Fr.toObject(proof.eval_b);
+    proof.eval_c = Fr.toObject(proof.eval_c);
+    proof.eval_s1 = Fr.toObject(proof.eval_s1);
+    proof.eval_s2 = Fr.toObject(proof.eval_s2);
+    proof.eval_zw = Fr.toObject(proof.eval_zw);
+    proof.eval_t = Fr.toObject(proof.eval_t);
+    proof.eval_r = Fr.toObject(proof.eval_r);
+
+    proof.Wxi = G1.toObject(proof.Wxi);
+    proof.Wxiw = G1.toObject(proof.Wxiw);
+
+    delete proof.eval_t;
+
+    proof = stringifyBigInts(proof);
+    publicSignals = stringifyBigInts(publicSignals);
+
+    return {proof, publicSignals};
+
+    async function calculateAdditions() {
+        const additionsBuff = await binFileUtils__namespace.readSection(fdZKey, sectionsZKey, 3);
+
+        const sSum = 8+curve.Fr.n8*2;
+
+        for (let i=0; i<zkey.nAdditions; i++) {
+            const ai= readUInt32(additionsBuff, i*sSum);
+            const bi= readUInt32(additionsBuff, i*sSum+4);
+            const ac= additionsBuff.slice(i*sSum+8, i*sSum+8+n8r);
+            const bc= additionsBuff.slice(i*sSum+8+n8r, i*sSum+8+n8r*2);
+            const aw= getWitness(ai);
+            const bw= getWitness(bi);
+
+            const r = curve.Fr.add(
+                curve.Fr.mul(ac, aw),
+                curve.Fr.mul(bc, bw)
+            );
+            buffInternalWitness.set(r, n8r*i);
+        }
+
+    }
+
+    async function buildABC() {
+        let A = new ffjavascript.BigBuffer(zkey.domainSize * n8r);
+        let B = new ffjavascript.BigBuffer(zkey.domainSize * n8r);
+        let C = new ffjavascript.BigBuffer(zkey.domainSize * n8r);
+
+        const aMap = await binFileUtils__namespace.readSection(fdZKey, sectionsZKey, 4);
+        const bMap = await binFileUtils__namespace.readSection(fdZKey, sectionsZKey, 5);
+        const cMap = await binFileUtils__namespace.readSection(fdZKey, sectionsZKey, 6);
+
+        for (let i=0; i<zkey.nConstrains; i++) {
+            const iA = readUInt32(aMap, i*4);
+            A.set(getWitness(iA), i*n8r);
+            const iB = readUInt32(bMap, i*4);
+            B.set(getWitness(iB), i*n8r);
+            const iC = readUInt32(cMap, i*4);
+            C.set(getWitness(iC), i*n8r);
+        }
+
+        A = await Fr.batchToMontgomery(A);
+        B = await Fr.batchToMontgomery(B);
+        C = await Fr.batchToMontgomery(C);
+
+        return [A,B,C];
+    }
+
+    function readUInt32(b, o) {
+        const buff = b.slice(o, o+4);
+        const buffV = new DataView(buff.buffer, buff.byteOffset, buff.byteLength);
+        return buffV.getUint32(0, true);
+    }
+
+    function getWitness(idx) {
+        if (idx < zkey.nVars-zkey.nAdditions) {
+            return buffWitness.slice(idx*n8r, idx*n8r+n8r);
+        } else if (idx < zkey.nVars) {
+            return buffInternalWitness.slice((idx - (zkey.nVars-zkey.nAdditions))*n8r, (idx-(zkey.nVars-zkey.nAdditions))*n8r + n8r);
+        } else {
+            return curve.Fr.zero;
+        }
+    }
+
+    async function round1() {
+        ch.b = [];
+        for (let i=1; i<=9; i++) {
+            ch.b[i] = curve.Fr.random();
+        }
+    
+        [A, B, C] = await buildABC();
+
+        [pol_a, A4] = await to4T(A, [ch.b[2], ch.b[1]]);
+        [pol_b, B4] = await to4T(B, [ch.b[4], ch.b[3]]);
+        [pol_c, C4] = await to4T(C, [ch.b[6], ch.b[5]]);
+
+                
+        proof.A = await expTau(pol_a, "multiexp A");
+        proof.B = await expTau(pol_b, "multiexp B");
+        proof.C = await expTau(pol_c, "multiexp C");
+    }
+
+    async function round2() {
+
+        const transcript1 = new Uint8Array(G1.F.n8*2*3);
+        G1.toRprUncompressed(transcript1, 0, proof.A);
+        G1.toRprUncompressed(transcript1, G1.F.n8*2, proof.B);
+        G1.toRprUncompressed(transcript1, G1.F.n8*4, proof.C);
+
+        ch.beta = hashToFr(transcript1);
+        if (logger) logger.debug("beta: " + Fr.toString(ch.beta));
+    
+        const transcript2 = new Uint8Array(n8r);
+        Fr.toRprBE(transcript2, 0, ch.beta);
+        ch.gamma = hashToFr(transcript2);
+        if (logger) logger.debug("gamma: " + Fr.toString(ch.gamma));
+    
+        let numArr = new ffjavascript.BigBuffer(Fr.n8*zkey.domainSize);
+        let denArr = new ffjavascript.BigBuffer(Fr.n8*zkey.domainSize);
+
+        numArr.set(Fr.one, 0);
+        denArr.set(Fr.one, 0);
+
+        let w = Fr.one;
+        for (let i=0; i<zkey.domainSize; i++) {
+            let n1 = A.slice(i*n8r, (i+1)*n8r);
+            n1 = Fr.add( n1, Fr.mul(ch.beta, w) );
+            n1 = Fr.add( n1, ch.gamma );
+
+            let n2 = B.slice(i*n8r, (i+1)*n8r);
+            n2 = Fr.add( n2, Fr.mul(zkey.k1, Fr.mul(ch.beta, w) ));
+            n2 = Fr.add( n2, ch.gamma );
+
+            let n3 = C.slice(i*n8r, (i+1)*n8r);
+            n3 = Fr.add( n3, Fr.mul(zkey.k2, Fr.mul(ch.beta, w) ));
+            n3 = Fr.add( n3, ch.gamma );
+
+            const num = Fr.mul(n1, Fr.mul(n2, n3));
+
+            let d1 = A.slice(i*n8r, (i+1)*n8r);
+            d1 = Fr.add(d1, Fr.mul( sigmaBuff.slice(i*n8r*4, i*n8r*4 + n8r) , ch.beta));
+            d1 = Fr.add(d1, ch.gamma);
+
+            let d2 = B.slice(i*n8r, (i+1)*n8r);
+            d2 = Fr.add(d2, Fr.mul( sigmaBuff.slice((zkey.domainSize + i)*4*n8r, (zkey.domainSize + i)*4*n8r+n8r) , ch.beta));
+            d2 = Fr.add(d2, ch.gamma);
+
+            let d3 = C.slice(i*n8r, (i+1)*n8r);
+            d3 = Fr.add(d3, Fr.mul( sigmaBuff.slice((zkey.domainSize*2 + i)*4*n8r, (zkey.domainSize*2 + i)*4*n8r + n8r) , ch.beta));
+            d3 = Fr.add(d3, ch.gamma);
+
+            const den = Fr.mul(d1, Fr.mul(d2, d3));
+
+            numArr.set(  
+                Fr.mul( 
+                    numArr.slice(i*n8r,(i+1)*n8r) , 
+                    num
+                ),
+                ((i+1)%zkey.domainSize)*n8r
+            );
+
+            denArr.set(  
+                Fr.mul( 
+                    denArr.slice(i*n8r,(i+1)*n8r) , 
+                    den
+                ),
+                ((i+1)%zkey.domainSize)*n8r
+            );
+
+            w = Fr.mul(w, Fr.w[zkey.power]);
+        }
+
+        denArr = await Fr.batchInverse(denArr);
+
+        // TODO: Do it in assembly and in parallel
+        for (let i=0; i<zkey.domainSize; i++) {
+            numArr.set(   Fr.mul( numArr.slice(i*n8r, (i+1)*n8r), denArr.slice(i*n8r, (i+1)*n8r) )      ,i*n8r);
+        }
+
+        if (!Fr.eq(numArr.slice(0, n8r), Fr.one)) {
+            throw new Error("Copy constraints does not match");
+        }
+
+        Z = numArr;
+
+        [pol_z, Z4] = await to4T(Z, [ch.b[9], ch.b[8], ch.b[7]]);
+
+        proof.Z = await expTau( pol_z, "multiexp Z");
+    }
+
+    async function round3() {
+
+        /*
+        async function checkDegree(P) {
+            const p = await curve.Fr.ifft(P);
+            let deg = (P.byteLength/n8r)-1;
+            while ((deg>0)&&(Fr.isZero(p.slice(deg*n8r, deg*n8r+n8r)))) deg--;
+            return deg;
+        }
+
+        function printPol(P) {
+            const n=(P.byteLength/n8r);
+            console.log("[");
+            for (let i=0; i<n; i++) {
+                console.log(Fr.toString(P.slice(i*n8r, i*n8r+n8r)));
+            }
+            console.log("]");
+        }
+        */
+
+        if (logger) logger.debug("phse3: Reading QM4");    
+        const QM4 = new ffjavascript.BigBuffer(zkey.domainSize*4*n8r);
+        await fdZKey.readToBuffer(QM4, 0 , zkey.domainSize*n8r*4, sectionsZKey[7][0].p + zkey.domainSize*n8r);
+
+        if (logger) logger.debug("phse3: Reading QL4");    
+        const QL4 = new ffjavascript.BigBuffer(zkey.domainSize*4*n8r);
+        await fdZKey.readToBuffer(QL4, 0 , zkey.domainSize*n8r*4, sectionsZKey[8][0].p + zkey.domainSize*n8r);
+
+        if (logger) logger.debug("phse3: Reading QR4");    
+        const QR4 = new ffjavascript.BigBuffer(zkey.domainSize*4*n8r);
+        await fdZKey.readToBuffer(QR4, 0 , zkey.domainSize*n8r*4, sectionsZKey[9][0].p + zkey.domainSize*n8r);
+
+        if (logger) logger.debug("phse3: Reading QO4");    
+        const QO4 = new ffjavascript.BigBuffer(zkey.domainSize*4*n8r);
+        await fdZKey.readToBuffer(QO4, 0 , zkey.domainSize*n8r*4, sectionsZKey[10][0].p + zkey.domainSize*n8r);
+
+        if (logger) logger.debug("phse3: Reading QC4");    
+        const QC4 = new ffjavascript.BigBuffer(zkey.domainSize*4*n8r);
+        await fdZKey.readToBuffer(QC4, 0 , zkey.domainSize*n8r*4, sectionsZKey[11][0].p + zkey.domainSize*n8r);
+
+        const lPols = await binFileUtils__namespace.readSection(fdZKey, sectionsZKey, 13);
+
+        const transcript3 = new Uint8Array(G1.F.n8*2);
+        G1.toRprUncompressed(transcript3, 0, proof.Z);
+
+        ch.alpha = hashToFr(transcript3);
+
+        if (logger) logger.debug("alpha: " + Fr.toString(ch.alpha));    
+
+
+        const Z1 = [
+            Fr.zero,
+            Fr.add(Fr.e(-1), Fr.w[2]),
+            Fr.e(-2),
+            Fr.sub(Fr.e(-1), Fr.w[2]),
+        ];
+
+        const Z2 = [
+            Fr.zero,
+            Fr.add(Fr.zero, Fr.mul(Fr.e(-2), Fr.w[2])),
+            Fr.e(4),
+            Fr.sub(Fr.zero, Fr.mul(Fr.e(-2), Fr.w[2])),
+        ];
+
+        const Z3 = [
+            Fr.zero,
+            Fr.add(Fr.e(2), Fr.mul(Fr.e(2), Fr.w[2])),
+            Fr.e(-8),
+            Fr.sub(Fr.e(2), Fr.mul(Fr.e(2), Fr.w[2])),
+        ];
+
+        const T = new ffjavascript.BigBuffer(zkey.domainSize*4*n8r);
+        const Tz = new ffjavascript.BigBuffer(zkey.domainSize*4*n8r);
+
+        let w = Fr.one;
+        for (let i=0; i<zkey.domainSize*4; i++) {
+            if ((i%4096 == 0)&&(logger)) logger.debug(`calculating t ${i}/${zkey.domainSize*4}`);
+
+            const a = A4.slice(i*n8r, i*n8r+n8r);
+            const b = B4.slice(i*n8r, i*n8r+n8r);
+            const c = C4.slice(i*n8r, i*n8r+n8r);
+            const z = Z4.slice(i*n8r, i*n8r+n8r);
+            const zw = Z4.slice(((i+zkey.domainSize*4+4)%(zkey.domainSize*4)) *n8r, ((i+zkey.domainSize*4+4)%(zkey.domainSize*4)) *n8r +n8r);
+            const qm = QM4.slice(i*n8r, i*n8r+n8r);
+            const ql = QL4.slice(i*n8r, i*n8r+n8r);
+            const qr = QR4.slice(i*n8r, i*n8r+n8r);
+            const qo = QO4.slice(i*n8r, i*n8r+n8r);
+            const qc = QC4.slice(i*n8r, i*n8r+n8r);
+            const s1 = sigmaBuff.slice(i*n8r, i*n8r+n8r);
+            const s2 = sigmaBuff.slice((i+zkey.domainSize*4)*n8r, (i+zkey.domainSize*4)*n8r+n8r);
+            const s3 = sigmaBuff.slice((i+zkey.domainSize*8)*n8r, (i+zkey.domainSize*8)*n8r+n8r);
+            const ap = Fr.add(ch.b[2], Fr.mul(ch.b[1], w));
+            const bp = Fr.add(ch.b[4], Fr.mul(ch.b[3], w));
+            const cp = Fr.add(ch.b[6], Fr.mul(ch.b[5], w));
+            const w2 = Fr.square(w);
+            const zp = Fr.add(Fr.add(Fr.mul(ch.b[7], w2), Fr.mul(ch.b[8], w)), ch.b[9]);
+            const wW = Fr.mul(w, Fr.w[zkey.power]);
+            const wW2 = Fr.square(wW);
+            const zWp = Fr.add(Fr.add(Fr.mul(ch.b[7], wW2), Fr.mul(ch.b[8], wW)), ch.b[9]);
+
+            let pl = Fr.zero;
+            for (let j=0; j<zkey.nPublic; j++) {
+                pl = Fr.sub(pl, Fr.mul( 
+                    lPols.slice( (j*5*zkey.domainSize+ zkey.domainSize+ i)*n8r, (j*5*zkey.domainSize+ zkey.domainSize + i+1)*n8r),
+                    A.slice(j*n8r, (j+1)*n8r)
+                ));
+            }
+
+            let [e1, e1z] = mul2(a, b, ap, bp, i%4);
+            e1 = Fr.mul(e1, qm);
+            e1z = Fr.mul(e1z, qm);
+
+            e1 = Fr.add(e1, Fr.mul(a, ql));
+            e1z = Fr.add(e1z, Fr.mul(ap, ql));
+
+            e1 = Fr.add(e1, Fr.mul(b, qr));
+            e1z = Fr.add(e1z, Fr.mul(bp, qr));
+
+            e1 = Fr.add(e1, Fr.mul(c, qo));
+            e1z = Fr.add(e1z, Fr.mul(cp, qo));
+
+            e1 = Fr.add(e1, pl);
+            e1 = Fr.add(e1, qc);
+
+            const betaw = Fr.mul(ch.beta, w);
+            let e2a =a;
+            e2a = Fr.add(e2a, betaw);
+            e2a = Fr.add(e2a, ch.gamma);
+
+            let e2b =b;
+            e2b = Fr.add(e2b, Fr.mul(betaw, zkey.k1));
+            e2b = Fr.add(e2b, ch.gamma);
+
+            let e2c =c;
+            e2c = Fr.add(e2c, Fr.mul(betaw, zkey.k2));
+            e2c = Fr.add(e2c, ch.gamma);
+
+            let e2d = z;
+
+            let [e2, e2z] = mul4(e2a, e2b, e2c, e2d, ap, bp, cp, zp, i%4);
+            e2 = Fr.mul(e2, ch.alpha);
+            e2z = Fr.mul(e2z, ch.alpha);
+
+            let e3a = a;
+            e3a = Fr.add(e3a, Fr.mul(ch.beta, s1));
+            e3a = Fr.add(e3a, ch.gamma);
+
+            let e3b = b;
+            e3b = Fr.add(e3b, Fr.mul(ch.beta,s2));
+            e3b = Fr.add(e3b, ch.gamma);
+
+            let e3c = c;
+            e3c = Fr.add(e3c, Fr.mul(ch.beta,s3));
+            e3c = Fr.add(e3c, ch.gamma);
+
+            let e3d = zw;
+            let [e3, e3z] = mul4(e3a, e3b, e3c, e3d, ap, bp, cp, zWp, i%4);
+
+            e3 = Fr.mul(e3, ch.alpha);
+            e3z = Fr.mul(e3z, ch.alpha);
+
+            let e4 = Fr.sub(z, Fr.one);
+            e4 = Fr.mul(e4, lPols.slice( (zkey.domainSize + i)*n8r, (zkey.domainSize+i+1)*n8r));
+            e4 = Fr.mul(e4, Fr.mul(ch.alpha, ch.alpha));
+
+            let e4z = Fr.mul(zp, lPols.slice( (zkey.domainSize + i)*n8r, (zkey.domainSize+i+1)*n8r));
+            e4z = Fr.mul(e4z, Fr.mul(ch.alpha, ch.alpha));
+
+            let e = Fr.add(Fr.sub(Fr.add(e1, e2), e3), e4);
+            let ez = Fr.add(Fr.sub(Fr.add(e1z, e2z), e3z), e4z);
+
+            T.set(e, i*n8r);
+            Tz.set(ez, i*n8r);
+
+            w = Fr.mul(w, Fr.w[zkey.power+2]);
+        }
+
+        if (logger) logger.debug("ifft T");    
+        let t = await Fr.ifft(T);
+
+        if (logger) logger.debug("dividing T/Z");    
+        for (let i=0; i<zkey.domainSize; i++) {
+            t.set(Fr.neg(t.slice(i*n8r, i*n8r+n8r)), i*n8r);
+        }
+
+        for (let i=zkey.domainSize; i<zkey.domainSize*4; i++) {
+            const a = Fr.sub(
+                t.slice((i-zkey.domainSize)*n8r, (i-zkey.domainSize)*n8r + n8r),
+                t.slice(i*n8r, i*n8r+n8r)
+            );
+            t.set(a, i*n8r);
+            if (i > (zkey.domainSize*3 -4) ) {
+                if (!Fr.isZero(a)) {
+                    throw new Error("T Polynomial is not divisible");
+                }
+            }
+        }
+
+        if (logger) logger.debug("ifft Tz");    
+        const tz = await Fr.ifft(Tz);
+        for (let i=0; i<zkey.domainSize*4; i++) {
+            const a = tz.slice(i*n8r, (i+1)*n8r);
+            if (i > (zkey.domainSize*3 +5) ) {
+                if (!Fr.isZero(a)) {
+                    throw new Error("Tz Polynomial is not well calculated");
+                }
+            } else {
+                t.set(  
+                    Fr.add(
+                        t.slice(i*n8r, (i+1)*n8r),
+                        a
+                    ),
+                    i*n8r
+                );
+            }
+        }
+
+        pol_t = t.slice(0, (zkey.domainSize*3+6)*n8r);
+
+        proof.T1 = await expTau( t.slice(0, zkey.domainSize*n8r) , "multiexp T1");
+        proof.T2 = await expTau( t.slice(zkey.domainSize*n8r, zkey.domainSize*2*n8r) , "multiexp T2");
+        proof.T3 = await expTau( t.slice(zkey.domainSize*2*n8r, (zkey.domainSize*3+6)*n8r) , "multiexp T3");
+
+        function mul2(a,b, ap, bp,  p) {
+            let r, rz;
+
+            
+            const a_b = Fr.mul(a,b);
+            const a_bp = Fr.mul(a,bp);
+            const ap_b = Fr.mul(ap,b);
+            const ap_bp = Fr.mul(ap,bp);
+
+            r = a_b;
+
+            let a0 = Fr.add(a_bp, ap_b);
+
+            let a1 = ap_bp;
+
+            rz = a0;
+            if (p) {
+                rz = Fr.add(rz, Fr.mul(Z1[p], a1));
+            }
+
+            return [r, rz];
+        }
+
+        function mul4(a,b,c,d, ap, bp, cp, dp, p) {
+            let r, rz;
+
+            
+            const a_b = Fr.mul(a,b);
+            const a_bp = Fr.mul(a,bp);
+            const ap_b = Fr.mul(ap,b);
+            const ap_bp = Fr.mul(ap,bp);
+
+            const c_d = Fr.mul(c,d);
+            const c_dp = Fr.mul(c,dp);
+            const cp_d = Fr.mul(cp,d);
+            const cp_dp = Fr.mul(cp,dp);
+
+            r = Fr.mul(a_b, c_d);
+
+            let a0 = Fr.mul(ap_b, c_d);
+            a0 = Fr.add(a0, Fr.mul(a_bp, c_d));
+            a0 = Fr.add(a0, Fr.mul(a_b, cp_d));
+            a0 = Fr.add(a0, Fr.mul(a_b, c_dp));
+
+            let a1 = Fr.mul(ap_bp, c_d);
+            a1 = Fr.add(a1, Fr.mul(ap_b, cp_d));
+            a1 = Fr.add(a1, Fr.mul(ap_b, c_dp));
+            a1 = Fr.add(a1, Fr.mul(a_bp, cp_d));
+            a1 = Fr.add(a1, Fr.mul(a_bp, c_dp));
+            a1 = Fr.add(a1, Fr.mul(a_b, cp_dp));
+
+            let a2 = Fr.mul(a_bp, cp_dp);
+            a2 = Fr.add(a2, Fr.mul(ap_b, cp_dp));
+            a2 = Fr.add(a2, Fr.mul(ap_bp, c_dp));
+            a2 = Fr.add(a2, Fr.mul(ap_bp, cp_d));
+
+            let a3 = Fr.mul(ap_bp, cp_dp);
+
+            rz = a0;
+            if (p) {
+                rz = Fr.add(rz, Fr.mul(Z1[p], a1));
+                rz = Fr.add(rz, Fr.mul(Z2[p], a2));
+                rz = Fr.add(rz, Fr.mul(Z3[p], a3));
+            }
+
+            return [r, rz];
+        }
+    }
+
+    async function round4() {
+        const pol_qm = new ffjavascript.BigBuffer(zkey.domainSize*n8r);
+        await fdZKey.readToBuffer(pol_qm, 0 , zkey.domainSize*n8r, sectionsZKey[7][0].p);
+
+        const pol_ql = new ffjavascript.BigBuffer(zkey.domainSize*n8r);
+        await fdZKey.readToBuffer(pol_ql, 0 , zkey.domainSize*n8r, sectionsZKey[8][0].p);
+
+        const pol_qr = new ffjavascript.BigBuffer(zkey.domainSize*n8r);
+        await fdZKey.readToBuffer(pol_qr, 0 , zkey.domainSize*n8r, sectionsZKey[9][0].p);
+
+        const pol_qo = new ffjavascript.BigBuffer(zkey.domainSize*n8r);
+        await fdZKey.readToBuffer(pol_qo, 0 , zkey.domainSize*n8r, sectionsZKey[10][0].p);
+
+        const pol_qc = new ffjavascript.BigBuffer(zkey.domainSize*n8r);
+        await fdZKey.readToBuffer(pol_qc, 0 , zkey.domainSize*n8r, sectionsZKey[11][0].p);
+
+        const pol_s3 = new ffjavascript.BigBuffer(zkey.domainSize*n8r);
+        await fdZKey.readToBuffer(pol_s3, 0 , zkey.domainSize*n8r, sectionsZKey[12][0].p + 10*zkey.domainSize*n8r);
+
+        const transcript4 = new Uint8Array(G1.F.n8*2*3);
+        G1.toRprUncompressed(transcript4, 0, proof.T1);
+        G1.toRprUncompressed(transcript4, G1.F.n8*2, proof.T2);
+        G1.toRprUncompressed(transcript4, G1.F.n8*4, proof.T3);
+        ch.xi = hashToFr(transcript4);
+
+        if (logger) logger.debug("xi: " + Fr.toString(ch.xi));    
+
+        proof.eval_a = evalPol(pol_a, ch.xi);
+        proof.eval_b = evalPol(pol_b, ch.xi);
+        proof.eval_c = evalPol(pol_c, ch.xi);
+        proof.eval_s1 = evalPol(pol_s1, ch.xi);
+        proof.eval_s2 = evalPol(pol_s2, ch.xi);
+        proof.eval_t = evalPol(pol_t, ch.xi);
+        proof.eval_zw = evalPol(pol_z, Fr.mul(ch.xi, Fr.w[zkey.power]));
+
+        const coef_ab = Fr.mul(proof.eval_a, proof.eval_b);
+        
+        let e2a = proof.eval_a;
+        const betaxi = Fr.mul(ch.beta, ch.xi);
+        e2a = Fr.add( e2a, betaxi);
+        e2a = Fr.add( e2a, ch.gamma);
+
+        let e2b = proof.eval_b;
+        e2b = Fr.add( e2b, Fr.mul(betaxi, zkey.k1));
+        e2b = Fr.add( e2b, ch.gamma);
+
+        let e2c = proof.eval_c;
+        e2c = Fr.add( e2c, Fr.mul(betaxi, zkey.k2));
+        e2c = Fr.add( e2c, ch.gamma);
+
+        const e2 = Fr.mul(Fr.mul(Fr.mul(e2a, e2b), e2c), ch.alpha);
+
+        let e3a = proof.eval_a;
+        e3a = Fr.add( e3a, Fr.mul(ch.beta, proof.eval_s1));
+        e3a = Fr.add( e3a, ch.gamma);
+
+        let e3b = proof.eval_b;
+        e3b = Fr.add( e3b, Fr.mul(ch.beta, proof.eval_s2));
+        e3b = Fr.add( e3b, ch.gamma);
+
+        let e3 = Fr.mul(e3a, e3b);
+        e3 = Fr.mul(e3, ch.beta);
+        e3 = Fr.mul(e3, proof.eval_zw);
+        e3 = Fr.mul(e3, ch.alpha);
+
+        ch.xim= ch.xi;
+        for (let i=0; i<zkey.power; i++) ch.xim = Fr.mul(ch.xim, ch.xim);
+        const eval_l1 = Fr.div(
+            Fr.sub(ch.xim, Fr.one),
+            Fr.mul(Fr.sub(ch.xi, Fr.one), Fr.e(zkey.domainSize))
+        );
+
+        const e4 = Fr.mul(eval_l1, Fr.mul(ch.alpha, ch.alpha));
+
+        const coefs3 = e3;
+        const coefz = Fr.add(e2, e4);
+
+        pol_r = new ffjavascript.BigBuffer((zkey.domainSize+3)*n8r);
+
+        for (let i = 0; i<zkey.domainSize+3; i++) {
+            let v = Fr.mul(coefz, pol_z.slice(i*n8r,(i+1)*n8r));
+            if (i<zkey.domainSize) {
+                v = Fr.add(v, Fr.mul(coef_ab, pol_qm.slice(i*n8r,(i+1)*n8r)));
+                v = Fr.add(v, Fr.mul(proof.eval_a, pol_ql.slice(i*n8r,(i+1)*n8r)));
+                v = Fr.add(v, Fr.mul(proof.eval_b, pol_qr.slice(i*n8r,(i+1)*n8r)));
+                v = Fr.add(v, Fr.mul(proof.eval_c, pol_qo.slice(i*n8r,(i+1)*n8r)));
+                v = Fr.add(v, pol_qc.slice(i*n8r,(i+1)*n8r));
+                v = Fr.sub(v, Fr.mul(coefs3, pol_s3.slice(i*n8r,(i+1)*n8r)));
+            }
+            pol_r.set(v, i*n8r);
+        }
+
+        proof.eval_r = evalPol(pol_r, ch.xi);
+    }
+
+    async function round5() {
+        const transcript5 = new Uint8Array(n8r*7);
+        Fr.toRprBE(transcript5, 0, proof.eval_a);
+        Fr.toRprBE(transcript5, n8r, proof.eval_b);
+        Fr.toRprBE(transcript5, n8r*2, proof.eval_c);
+        Fr.toRprBE(transcript5, n8r*3, proof.eval_s1);
+        Fr.toRprBE(transcript5, n8r*4, proof.eval_s2);
+        Fr.toRprBE(transcript5, n8r*5, proof.eval_zw);
+        Fr.toRprBE(transcript5, n8r*6, proof.eval_r);
+        ch.v = [];
+        ch.v[1] = hashToFr(transcript5);
+        if (logger) logger.debug("v: " + Fr.toString(ch.v[1]));    
+
+        for (let i=2; i<=6; i++ ) ch.v[i] = Fr.mul(ch.v[i-1], ch.v[1]);
+        
+        let pol_wxi = new ffjavascript.BigBuffer((zkey.domainSize+6)*n8r);
+
+        const xi2m = Fr.mul(ch.xim, ch.xim);
+
+        for (let i=0; i<zkey.domainSize+6; i++) {
+            let w = Fr.zero;
+            w = Fr.add(w, Fr.mul(xi2m,  pol_t.slice( (zkey.domainSize*2+i)*n8r, (zkey.domainSize*2+i+1)*n8r )));
+
+            if (i<zkey.domainSize+3) {
+                w = Fr.add(w, Fr.mul(ch.v[1],  pol_r.slice(i*n8r, (i+1)*n8r)));
+            }
+
+            if (i<zkey.domainSize+2) {
+                w = Fr.add(w, Fr.mul(ch.v[2],  pol_a.slice(i*n8r, (i+1)*n8r)));
+                w = Fr.add(w, Fr.mul(ch.v[3],  pol_b.slice(i*n8r, (i+1)*n8r)));
+                w = Fr.add(w, Fr.mul(ch.v[4],  pol_c.slice(i*n8r, (i+1)*n8r)));
+            }
+            
+            if (i<zkey.domainSize) {
+                w = Fr.add(w, pol_t.slice(i*n8r, (i+1)*n8r));
+                w = Fr.add(w, Fr.mul(ch.xim,  pol_t.slice( (zkey.domainSize+i)*n8r, (zkey.domainSize+i+1)*n8r )));
+                w = Fr.add(w, Fr.mul(ch.v[5],  pol_s1.slice(i*n8r, (i+1)*n8r)));
+                w = Fr.add(w, Fr.mul(ch.v[6],  pol_s2.slice(i*n8r, (i+1)*n8r)));
+            }
+
+            pol_wxi.set(w, i*n8r);
+        }
+
+        let w0 = pol_wxi.slice(0, n8r);
+        w0 = Fr.sub(w0, proof.eval_t);
+        w0 = Fr.sub(w0, Fr.mul(ch.v[1], proof.eval_r));
+        w0 = Fr.sub(w0, Fr.mul(ch.v[2], proof.eval_a));
+        w0 = Fr.sub(w0, Fr.mul(ch.v[3], proof.eval_b));
+        w0 = Fr.sub(w0, Fr.mul(ch.v[4], proof.eval_c));
+        w0 = Fr.sub(w0, Fr.mul(ch.v[5], proof.eval_s1));
+        w0 = Fr.sub(w0, Fr.mul(ch.v[6], proof.eval_s2));
+        pol_wxi.set(w0, 0);
+
+        pol_wxi= divPol1(pol_wxi, ch.xi);
+
+        proof.Wxi = await expTau(pol_wxi, "multiexp Wxi");
+
+        let pol_wxiw = new ffjavascript.BigBuffer((zkey.domainSize+3)*n8r);
+        for (let i=0; i<zkey.domainSize+3; i++) {
+            const w = pol_z.slice(i*n8r, (i+1)*n8r);
+            pol_wxiw.set(w, i*n8r);
+        }
+        w0 = pol_wxiw.slice(0, n8r);
+        w0 = Fr.sub(w0, proof.eval_zw);
+        pol_wxiw.set(w0, 0);
+
+        pol_wxiw= divPol1(pol_wxiw, Fr.mul(ch.xi, Fr.w[zkey.power]));
+        proof.Wxiw = await expTau(pol_wxiw, "multiexp Wxiw");
+    }
+
+    function hashToFr(transcript) {
+        const v = ffjavascript.Scalar.fromRprBE(new Uint8Array(keccak256$1.arrayBuffer(transcript)));
+        return Fr.e(v);
+    }
+
+
+    function evalPol(P, x) {
+        const n = P.byteLength / n8r;
+        if (n == 0) return Fr.zero;
+        let res = P.slice((n-1)*n8r, n*n8r);
+        for (let i=n-2; i>=0; i--) {
+            res = Fr.add(Fr.mul(res, x), P.slice(i*n8r, (i+1)*n8r));
+        }
+        return res;
+    }
+
+    function divPol1(P, d) {
+        const n = P.byteLength/n8r;
+        const res = new ffjavascript.BigBuffer(n*n8r);
+        res.set(Fr.zero, (n-1) *n8r);
+        res.set(P.slice((n-1)*n8r, n*n8r), (n-2)*n8r);
+        for (let i=n-3; i>=0; i--) {
+            res.set(
+                Fr.add(
+                    P.slice((i+1)*n8r, (i+2)*n8r), 
+                    Fr.mul(
+                        d, 
+                        res.slice((i+1)*n8r, (i+2)*n8r)
+                    )
+                ),
+                i*n8r
+            );
+        }
+        if (!Fr.eq(
+            P.slice(0, n8r),
+            Fr.mul(
+                Fr.neg(d),
+                res.slice(0, n8r)
+            )
+        )) {
+            throw new Error("Polinomial does not divide");
+        }
+        return res;
+    }
+
+    async function expTau(b, name) {
+        const n = b.byteLength/n8r;
+        const PTauN = PTau.slice(0, n*curve.G1.F.n8*2);
+        const bm = await curve.Fr.batchFromMontgomery(b);
+        let res = await curve.G1.multiExpAffine(PTauN, bm, logger, name);
+        res = curve.G1.toAffine(res);
+        return res;
+    }
+
+
+    async function to4T(A, pz) {
+        pz = pz || []; 
+        let a = await Fr.ifft(A);
+        const a4 = new ffjavascript.BigBuffer(n8r*zkey.domainSize*4);
+        a4.set(a, 0);
+
+        const a1 = new ffjavascript.BigBuffer(n8r*(zkey.domainSize + pz.length));
+        a1.set(a, 0);
+        for (let i= 0; i<pz.length; i++) {
+            a1.set(
+                Fr.add(
+                    a1.slice((zkey.domainSize+i)*n8r, (zkey.domainSize+i+1)*n8r),
+                    pz[i]
+                ),
+                (zkey.domainSize+i)*n8r
+            );
+            a1.set(
+                Fr.sub(
+                    a1.slice(i*n8r, (i+1)*n8r),
+                    pz[i]
+                ),
+                i*n8r
+            );
+        }
+        const A4 = await Fr.fft(a4);
+        return [a1, A4];
+    }
+
+
+}
+
+/*
+    Copyright 2021 0KIMS association.
+
+    This file is part of snarkJS.
+
+    snarkJS is a free software: you can redistribute it and/or modify it
+    under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    snarkJS is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
+    License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with snarkJS. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+async function plonkFullProve(input, wasmFile, zkeyFileName, logger) {
+    const wtns= {
+        type: "mem"
+    };
+    await wtnsCalculate(input, wasmFile, wtns);
+    return await plonk16Prove(zkeyFileName, wtns, logger);
+}
+
+/*
+    Copyright 2021 0kims association.
+
+    This file is part of snarkjs.
+
+    snarkjs is a free software: you can redistribute it and/or
+    modify it under the terms of the GNU General Public License as published by the
+    Free Software Foundation, either version 3 of the License, or (at your option)
+    any later version.
+
+    snarkjs is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+    more details.
+
+    You should have received a copy of the GNU General Public License along with
+    snarkjs. If not, see <https://www.gnu.org/licenses/>.
+*/
+const {unstringifyBigInts} = ffjavascript.utils;
+const { keccak256 } = jsSha3__default["default"];
+
+
+async function plonkVerify(vk_verifier, publicSignals, proof, logger) {
+    vk_verifier = unstringifyBigInts(vk_verifier);
+    proof = unstringifyBigInts(proof);
+    publicSignals = unstringifyBigInts(publicSignals);
+
+    const curve = await getCurveFromName(vk_verifier.curve);
+
+    const Fr = curve.Fr;
+    const G1 = curve.G1;
+
+    proof = fromObjectProof(curve,proof);
+    vk_verifier = fromObjectVk(curve, vk_verifier);
+    if (!isWellConstructed(curve, proof)) {
+        logger.error("Proof is not well constructed");
+        return false;
+    }
+    const challanges = calculateChallanges(curve, proof);
+    if (logger) {
+        logger.debug("beta: " + Fr.toString(challanges.beta, 16));    
+        logger.debug("gamma: " + Fr.toString(challanges.gamma, 16));    
+        logger.debug("alpha: " + Fr.toString(challanges.alpha, 16));    
+        logger.debug("xi: " + Fr.toString(challanges.xi, 16));    
+        logger.debug("v1: " + Fr.toString(challanges.v[1], 16));    
+        logger.debug("v6: " + Fr.toString(challanges.v[6], 16));    
+        logger.debug("u: " + Fr.toString(challanges.u, 16));    
+    }
+    const L = calculateLagrangeEvaluations(curve, challanges, vk_verifier);
+    if (logger) {
+        logger.debug("Lagrange Evaluations: ");
+        for (let i=1; i<L.length; i++) {
+            logger.debug(`L${i}(xi)=` + Fr.toString(L[i], 16));    
+        }
+    }
+    
+    if (publicSignals.length != vk_verifier.nPublic) {
+        logger.error("Number of public signals does not match with vk");
+        return false;
+    }
+
+    const pl = calculatePl(curve, publicSignals, L);
+    if (logger) {
+        logger.debug("Pl: " + Fr.toString(pl, 16));
+    }
+
+    const t = calculateT(curve, proof, challanges, pl, L[1]);
+    if (logger) {
+        logger.debug("t: " + Fr.toString(t, 16));
+    }
+
+    const D = calculateD(curve, proof, challanges, vk_verifier, L[1]);
+    if (logger) {
+        logger.debug("D: " + G1.toString(G1.toAffine(D), 16));
+    }
+
+    const F = calculateF(curve, proof, challanges, vk_verifier, D);
+    if (logger) {
+        logger.debug("F: " + G1.toString(G1.toAffine(F), 16));
+    }
+
+    const E = calculateE(curve, proof, challanges, vk_verifier, t);
+    if (logger) {
+        logger.debug("E: " + G1.toString(G1.toAffine(E), 16));
+    }
+
+    const res = await isValidPairing(curve, proof, challanges, vk_verifier, E, F);
+
+    if (logger) {
+        if (res) {
+            logger.info("OK!");
+        } else {
+            logger.warn("Invalid Proof");
+        }
+    }
+
+    return res;
+
+}
+
+
+function fromObjectProof(curve, proof) {
+    const G1 = curve.G1;
+    const Fr = curve.Fr;
+    const res = {};
+    res.A = G1.fromObject(proof.A);
+    res.B = G1.fromObject(proof.B);
+    res.C = G1.fromObject(proof.C);
+    res.Z = G1.fromObject(proof.Z);
+    res.T1 = G1.fromObject(proof.T1);
+    res.T2 = G1.fromObject(proof.T2);
+    res.T3 = G1.fromObject(proof.T3);
+    res.eval_a = Fr.fromObject(proof.eval_a);
+    res.eval_b = Fr.fromObject(proof.eval_b);
+    res.eval_c = Fr.fromObject(proof.eval_c);
+    res.eval_zw = Fr.fromObject(proof.eval_zw);
+    res.eval_s1 = Fr.fromObject(proof.eval_s1);
+    res.eval_s2 = Fr.fromObject(proof.eval_s2);
+    res.eval_r = Fr.fromObject(proof.eval_r);
+    res.Wxi = G1.fromObject(proof.Wxi);
+    res.Wxiw = G1.fromObject(proof.Wxiw);
+    return res;
+}
+
+function fromObjectVk(curve, vk) {
+    const G1 = curve.G1;
+    const G2 = curve.G2;
+    const Fr = curve.Fr;
+    const res = vk;
+    res.Qm = G1.fromObject(vk.Qm);
+    res.Ql = G1.fromObject(vk.Ql);
+    res.Qr = G1.fromObject(vk.Qr);
+    res.Qo = G1.fromObject(vk.Qo);
+    res.Qc = G1.fromObject(vk.Qc);
+    res.S1 = G1.fromObject(vk.S1);
+    res.S2 = G1.fromObject(vk.S2);
+    res.S3 = G1.fromObject(vk.S3);
+    res.k1 = Fr.fromObject(vk.k1);
+    res.k2 = Fr.fromObject(vk.k2);
+    res.X_2 = G2.fromObject(vk.X_2);
+
+    return res;
+}
+
+function isWellConstructed(curve, proof) {
+    const G1 = curve.G1;
+    if (!G1.isValid(proof.A)) return false;
+    if (!G1.isValid(proof.B)) return false;
+    if (!G1.isValid(proof.C)) return false;
+    if (!G1.isValid(proof.Z)) return false;
+    if (!G1.isValid(proof.T1)) return false;
+    if (!G1.isValid(proof.T2)) return false;
+    if (!G1.isValid(proof.T3)) return false;
+    if (!G1.isValid(proof.Wxi)) return false;
+    if (!G1.isValid(proof.Wxiw)) return false;
+    return true;
+}
+
+function calculateChallanges(curve, proof) {
+    const G1 = curve.G1;
+    const Fr = curve.Fr;
+    const n8r = curve.Fr.n8;
+    const res = {};
+
+    const transcript1 = new Uint8Array(G1.F.n8*2*3);
+    G1.toRprUncompressed(transcript1, 0, proof.A);
+    G1.toRprUncompressed(transcript1, G1.F.n8*2, proof.B);
+    G1.toRprUncompressed(transcript1, G1.F.n8*4, proof.C);
+    res.beta = hashToFr(curve, transcript1);
+
+    const transcript2 = new Uint8Array(n8r);
+    Fr.toRprBE(transcript2, 0, res.beta);
+    res.gamma = hashToFr(curve, transcript2);
+
+    const transcript3 = new Uint8Array(G1.F.n8*2);
+    G1.toRprUncompressed(transcript3, 0, proof.Z);
+    res.alpha = hashToFr(curve, transcript3);
+
+    const transcript4 = new Uint8Array(G1.F.n8*2*3);
+    G1.toRprUncompressed(transcript4, 0, proof.T1);
+    G1.toRprUncompressed(transcript4, G1.F.n8*2, proof.T2);
+    G1.toRprUncompressed(transcript4, G1.F.n8*4, proof.T3);
+    res.xi = hashToFr(curve, transcript4);
+
+    const transcript5 = new Uint8Array(n8r*7);
+    Fr.toRprBE(transcript5, 0, proof.eval_a);
+    Fr.toRprBE(transcript5, n8r, proof.eval_b);
+    Fr.toRprBE(transcript5, n8r*2, proof.eval_c);
+    Fr.toRprBE(transcript5, n8r*3, proof.eval_s1);
+    Fr.toRprBE(transcript5, n8r*4, proof.eval_s2);
+    Fr.toRprBE(transcript5, n8r*5, proof.eval_zw);
+    Fr.toRprBE(transcript5, n8r*6, proof.eval_r);
+    res.v = [];
+    res.v[1] = hashToFr(curve, transcript5);
+
+    for (let i=2; i<=6; i++ ) res.v[i] = Fr.mul(res.v[i-1], res.v[1]);
+
+    const transcript6 = new Uint8Array(G1.F.n8*2*2);
+    G1.toRprUncompressed(transcript6, 0, proof.Wxi);
+    G1.toRprUncompressed(transcript6, G1.F.n8*2, proof.Wxiw);
+    res.u = hashToFr(curve, transcript6);
+
+    return res;
+}
+
+function calculateLagrangeEvaluations(curve, challanges, vk) {
+    const Fr = curve.Fr;
+
+    let xin = challanges.xi;
+    let domainSize = 1;
+    for (let i=0; i<vk.power; i++) {
+        xin = Fr.square(xin);
+        domainSize *= 2;
+    }
+    challanges.xin = xin;
+
+    challanges.zh = Fr.sub(xin, Fr.one);
+    const L = [];
+
+    const n = Fr.e(domainSize);
+    let w = Fr.one;
+    for (let i=1; i<=Math.max(1, vk.nPublic); i++) {
+        L[i] = Fr.div(Fr.mul(w, challanges.zh), Fr.mul(n, Fr.sub(challanges.xi, w)));
+        w = Fr.mul(w, Fr.w[vk.power]);
+    }
+
+    return L;
+}
+
+function hashToFr(curve, transcript) {
+    const v = ffjavascript.Scalar.fromRprBE(new Uint8Array(keccak256.arrayBuffer(transcript)));
+    return curve.Fr.e(v);
+}
+
+function calculatePl(curve, publicSignals, L) {
+    const Fr = curve.Fr;
+
+    let pl = Fr.zero;
+    for (let i=0; i<publicSignals.length; i++) {
+        const w = Fr.e(publicSignals[i]);
+        pl = Fr.sub(pl, Fr.mul(w, L[i+1]));
+    }
+    return pl;
+}
+
+function calculateT(curve, proof, challanges, pl, l1) {
+    const Fr = curve.Fr;
+    let num = proof.eval_r;
+    num = Fr.add(num, pl);
+
+    let e1 = proof.eval_a;
+    e1 = Fr.add(e1, Fr.mul(challanges.beta, proof.eval_s1));
+    e1 = Fr.add(e1, challanges.gamma);
+
+    let e2 = proof.eval_b;
+    e2 = Fr.add(e2, Fr.mul(challanges.beta, proof.eval_s2));
+    e2 = Fr.add(e2, challanges.gamma);
+
+    let e3 = proof.eval_c;
+    e3 = Fr.add(e3, challanges.gamma);
+
+    let e = Fr.mul(Fr.mul(e1, e2), e3);
+    e = Fr.mul(e, proof.eval_zw);
+    e = Fr.mul(e, challanges.alpha);
+
+    num = Fr.sub(num, e);
+
+    num = Fr.sub(num, Fr.mul(l1, Fr.square(challanges.alpha)));
+
+    const t = Fr.div(num, challanges.zh);
+
+    return t;
+}
+
+function calculateD(curve, proof, challanges, vk, l1) {
+    const G1 = curve.G1;
+    const Fr = curve.Fr;
+
+    let s1 = Fr.mul(Fr.mul(proof.eval_a, proof.eval_b), challanges.v[1]);
+    let res = G1.timesFr(vk.Qm, s1);
+
+    let s2 = Fr.mul(proof.eval_a, challanges.v[1]);
+    res = G1.add(res, G1.timesFr(vk.Ql, s2));
+
+    let s3 = Fr.mul(proof.eval_b, challanges.v[1]);
+    res = G1.add(res, G1.timesFr(vk.Qr, s3));
+
+    let s4 = Fr.mul(proof.eval_c, challanges.v[1]);
+    res = G1.add(res, G1.timesFr(vk.Qo, s4));
+
+    res = G1.add(res, G1.timesFr(vk.Qc, challanges.v[1]));
+
+    const betaxi = Fr.mul(challanges.beta, challanges.xi);
+    let s6a = proof.eval_a;
+    s6a = Fr.add(s6a, betaxi);
+    s6a = Fr.add(s6a, challanges.gamma);
+
+    let s6b = proof.eval_b;
+    s6b = Fr.add(s6b, Fr.mul(betaxi, vk.k1));
+    s6b = Fr.add(s6b, challanges.gamma);
+
+    let s6c = proof.eval_c;
+    s6c = Fr.add(s6c, Fr.mul(betaxi, vk.k2));
+    s6c = Fr.add(s6c, challanges.gamma);
+
+    let s6 = Fr.mul(Fr.mul(s6a, s6b), s6c);
+    s6 = Fr.mul(s6, Fr.mul(challanges.alpha, challanges.v[1]));
+
+    let s6d = Fr.mul(Fr.mul(l1, Fr.square(challanges.alpha)), challanges.v[1]);
+    s6 = Fr.add(s6, s6d);
+
+    s6 = Fr.add(s6, challanges.u);
+    res = G1.add(res, G1.timesFr(proof.Z, s6));
+
+
+    let s7a = proof.eval_a;
+    s7a = Fr.add(s7a, Fr.mul(challanges.beta, proof.eval_s1));
+    s7a = Fr.add(s7a, challanges.gamma);
+
+    let s7b = proof.eval_b;
+    s7b = Fr.add(s7b, Fr.mul(challanges.beta, proof.eval_s2));
+    s7b = Fr.add(s7b, challanges.gamma);
+
+    let s7 = Fr.mul(s7a, s7b);
+    s7 = Fr.mul(s7, challanges.alpha);
+    s7 = Fr.mul(s7, challanges.v[1]);
+    s7 = Fr.mul(s7, challanges.beta);
+    s7 = Fr.mul(s7, proof.eval_zw);
+    res = G1.sub(res, G1.timesFr(vk.S3, s7));
+
+    return res;
+}
+
+function calculateF(curve, proof, challanges, vk, D) {
+    const G1 = curve.G1;
+    const Fr = curve.Fr;
+
+    let res = proof.T1;
+
+    res = G1.add(res, G1.timesFr(proof.T2, challanges.xin));
+    res = G1.add(res, G1.timesFr(proof.T3, Fr.square(challanges.xin)));
+    res = G1.add(res, D);
+    res = G1.add(res, G1.timesFr(proof.A, challanges.v[2]));
+    res = G1.add(res, G1.timesFr(proof.B, challanges.v[3]));
+    res = G1.add(res, G1.timesFr(proof.C, challanges.v[4]));
+    res = G1.add(res, G1.timesFr(vk.S1, challanges.v[5]));
+    res = G1.add(res, G1.timesFr(vk.S2, challanges.v[6]));
+
+    return res;
+}
+
+
+function calculateE(curve, proof, challanges, vk, t) {
+    const G1 = curve.G1;
+    const Fr = curve.Fr;
+
+    let s = t;
+
+    s = Fr.add(s, Fr.mul(challanges.v[1], proof.eval_r));
+    s = Fr.add(s, Fr.mul(challanges.v[2], proof.eval_a));
+    s = Fr.add(s, Fr.mul(challanges.v[3], proof.eval_b));
+    s = Fr.add(s, Fr.mul(challanges.v[4], proof.eval_c));
+    s = Fr.add(s, Fr.mul(challanges.v[5], proof.eval_s1));
+    s = Fr.add(s, Fr.mul(challanges.v[6], proof.eval_s2));
+    s = Fr.add(s, Fr.mul(challanges.u, proof.eval_zw));
+
+    const res = G1.timesFr(G1.one, s);
+
+    return res;
+}
+
+async function isValidPairing(curve, proof, challanges, vk, E, F) {
+    const G1 = curve.G1;
+    const Fr = curve.Fr;
+
+    let A1 = proof.Wxi;
+    A1 = G1.add(A1, G1.timesFr(proof.Wxiw, challanges.u));
+
+    let B1 = G1.timesFr(proof.Wxi, challanges.xi);
+    const s = Fr.mul(Fr.mul(challanges.u, challanges.xi), Fr.w[vk.power]);
+    B1 = G1.add(B1, G1.timesFr(proof.Wxiw, s));
+    B1 = G1.add(B1, F);
+    B1 = G1.sub(B1, E);
+
+    const res = await curve.pairingEq(
+        G1.neg(A1) , vk.X_2,
+        B1 , curve.G2.one
+    );
+
+    return res;
+
+}
+
+/*
+    Copyright 2021 0KIMS association.
+
+    This file is part of snarkJS.
+
+    snarkJS is a free software: you can redistribute it and/or modify it
+    under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    snarkJS is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
+    License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with snarkJS. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+function i2hex(i) {
+    return ("0" + i.toString(16)).slice(-2);
+}
+
+function p256(n) {
+    let nstr = n.toString(16);
+    while (nstr.length < 64) nstr = "0"+nstr;
+    nstr = `"0x${nstr}"`;
+    return nstr;
+}
+
+async function plonkExportSolidityCallData(proof, pub) {
+
+    const curve = await getCurveFromName(proof.curve);
+    const G1 = curve.G1;
+    const Fr = curve.Fr;
+
+    let inputs = "";
+    for (let i=0; i<pub.length; i++) {
+        if (inputs != "") inputs = inputs + ",";
+        inputs = inputs + p256(pub[i]);
+    }
+
+    const proofBuff = new Uint8Array(G1.F.n8*2*9 + Fr.n8*7);
+    G1.toRprUncompressed(proofBuff, 0, G1.e(proof.A));
+    G1.toRprUncompressed(proofBuff, G1.F.n8*2, G1.e(proof.B));
+    G1.toRprUncompressed(proofBuff, G1.F.n8*4, G1.e(proof.C));
+    G1.toRprUncompressed(proofBuff, G1.F.n8*6, G1.e(proof.Z));
+    G1.toRprUncompressed(proofBuff, G1.F.n8*8, G1.e(proof.T1));
+    G1.toRprUncompressed(proofBuff, G1.F.n8*10, G1.e(proof.T2));
+    G1.toRprUncompressed(proofBuff, G1.F.n8*12, G1.e(proof.T3));
+    G1.toRprUncompressed(proofBuff, G1.F.n8*14, G1.e(proof.Wxi));
+    G1.toRprUncompressed(proofBuff, G1.F.n8*16, G1.e(proof.Wxiw));
+    Fr.toRprBE(proofBuff, G1.F.n8*18 , Fr.e(proof.eval_a));
+    Fr.toRprBE(proofBuff, G1.F.n8*18 + Fr.n8, Fr.e(proof.eval_b));
+    Fr.toRprBE(proofBuff, G1.F.n8*18 + Fr.n8*2, Fr.e(proof.eval_c));
+    Fr.toRprBE(proofBuff, G1.F.n8*18 + Fr.n8*3, Fr.e(proof.eval_s1));
+    Fr.toRprBE(proofBuff, G1.F.n8*18 + Fr.n8*4, Fr.e(proof.eval_s2));
+    Fr.toRprBE(proofBuff, G1.F.n8*18 + Fr.n8*5, Fr.e(proof.eval_zw));
+    Fr.toRprBE(proofBuff, G1.F.n8*18 + Fr.n8*6, Fr.e(proof.eval_r));
+
+    const proofHex = Array.from(proofBuff).map(i2hex).join("");
+
+    const S="0x"+proofHex+",["+inputs+"]";
+
+    return S;
+}
+
+/*
+    Copyright 2018 0KIMS association.
+
+    This file is part of snarkJS.
+
+    snarkJS is a free software: you can redistribute it and/or modify it
+    under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    snarkJS is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
+    License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with snarkJS. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+var plonk = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    setup: plonkSetup,
+    fullProve: plonkFullProve,
+    prove: plonk16Prove,
+    verify: plonkVerify,
+    exportSolidityCallData: plonkExportSolidityCallData
+});
+
+exports.groth16 = groth16;
+exports.plonk = plonk;
+exports.powersOfTau = powersoftau;
+exports.r1cs = r1cs;
+exports.wtns = wtns;
+exports.zKey = zkey;
diff --git a/config/rollup.ses.config.js b/config/rollup.ses.config.js
new file mode 100644
index 00000000..e5de4af6
--- /dev/null
+++ b/config/rollup.ses.config.js
@@ -0,0 +1,31 @@
+import config from './rollup.iife.config';
+import fs from "fs";
+import { builtinModules as builtin } from "module";
+import jscc from 'rollup-plugin-jscc';
+import replace from "@rollup/plugin-replace";
+
+const pkg = JSON.parse(fs.readFileSync("./package.json"));
+delete pkg.dependencies["ejs"];
+
+export default {
+    input: "main.js",
+    output: {
+        file: "build/main.ses.cjs",
+        format: "cjs",
+    },
+    external: [
+        ...Object.keys(pkg.dependencies),
+        ...builtin,
+    ],
+    plugins:[
+        ...config.plugins,
+        jscc({
+            values: { _SES: process.env.SES },
+        }),
+        replace({
+            // To silence to warning, the current default is false, but they are changing it next version
+            preventAssignment: false,
+            "process.ses": !!process.env.SES
+        }),
+    ]
+};
diff --git a/package-lock.json b/package-lock.json
index 62d35b4a..589746ba 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -33,6 +33,7 @@
         "eslint": "^8.7.0",
         "mocha": "^9.1.4",
         "rollup": "^2.36.2",
+        "rollup-plugin-jscc": "^2.0.0",
         "rollup-plugin-terser": "^7.0.2",
         "rollup-plugin-visualizer": "^4.2.0"
       }
@@ -206,6 +207,24 @@
         "ffjavascript": "^0.2.48"
       }
     },
+    "node_modules/@jsbits/escape-regex-str": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@jsbits/escape-regex-str/-/escape-regex-str-1.0.3.tgz",
+      "integrity": "sha512-0800vYI2fg1nuUq/T9Tqv8DMOLLNiRAltxFbKIbR7szrvW6qTuI2+zGK51hV7NAAmUr4G83Kvpj2R6Yyg07iIw==",
+      "dev": true,
+      "engines": {
+        "node": ">=4.2"
+      }
+    },
+    "node_modules/@jsbits/get-package-version": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@jsbits/get-package-version/-/get-package-version-1.0.3.tgz",
+      "integrity": "sha512-IJy1jRL01x7p6UEpgKa1lVLstMUx8EiIR8pPoS5sBfsHEoeLkzYiNpAfxPx8zLDUJyS1yBbChJjcWdPqyH285w==",
+      "dev": true,
+      "engines": {
+        "node": ">=4.2"
+      }
+    },
     "node_modules/@rollup/plugin-commonjs": {
       "version": "17.1.0",
       "resolved": "https://registry.npmjs.org/@rollup/plugin-commonjs/-/plugin-commonjs-17.1.0.tgz",
@@ -1514,6 +1533,22 @@
         "js-yaml": "bin/js-yaml.js"
       }
     },
+    "node_modules/jscc": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/jscc/-/jscc-1.1.1.tgz",
+      "integrity": "sha512-anpZkTXwZbxfxLEBMciKxXMHx2xOLK2qhynIhTnoSyC+wGOEPrAoofxnADgblbarn0kijVMt1U71cQGmRF/1Og==",
+      "dev": true,
+      "dependencies": {
+        "@jsbits/escape-regex-str": "^1.0.2",
+        "@jsbits/get-package-version": "^1.0.2",
+        "magic-string": "^0.25.1",
+        "perf-regexes": "^1.0.1",
+        "skip-regex": "^1.0.2"
+      },
+      "engines": {
+        "node": ">=6.0"
+      }
+    },
     "node_modules/json-schema-traverse": {
       "version": "0.4.1",
       "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
@@ -1878,6 +1913,15 @@
         "node": "*"
       }
     },
+    "node_modules/perf-regexes": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/perf-regexes/-/perf-regexes-1.0.1.tgz",
+      "integrity": "sha512-L7MXxUDtqr4PUaLFCDCXBfGV/6KLIuSEccizDI7JxT+c9x1G1v04BQ4+4oag84SHaCdrBgQAIs/Cqn+flwFPng==",
+      "dev": true,
+      "engines": {
+        "node": ">=6.14"
+      }
+    },
     "node_modules/picomatch": {
       "version": "2.3.1",
       "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz",
@@ -2022,6 +2066,23 @@
         "fsevents": "~2.3.2"
       }
     },
+    "node_modules/rollup-plugin-jscc": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/rollup-plugin-jscc/-/rollup-plugin-jscc-2.0.0.tgz",
+      "integrity": "sha512-5jG9q79K2u5uRBTKA+GA4gqt1zA7qHQRpcabZMoVs913gr75s428O7K3r58n2vADDzwIhiOKMo7rCMhOyks6dw==",
+      "dev": true,
+      "dependencies": {
+        "@jsbits/get-package-version": "^1.0.3",
+        "jscc": "^1.1.1",
+        "rollup-pluginutils": "^2.8.2"
+      },
+      "engines": {
+        "node": ">=10.12.0"
+      },
+      "peerDependencies": {
+        "rollup": ">=2"
+      }
+    },
     "node_modules/rollup-plugin-terser": {
       "version": "7.0.2",
       "resolved": "https://registry.npmjs.org/rollup-plugin-terser/-/rollup-plugin-terser-7.0.2.tgz",
@@ -2067,6 +2128,21 @@
         "rollup": ">=1.20.0"
       }
     },
+    "node_modules/rollup-pluginutils": {
+      "version": "2.8.2",
+      "resolved": "https://registry.npmjs.org/rollup-pluginutils/-/rollup-pluginutils-2.8.2.tgz",
+      "integrity": "sha512-EEp9NhnUkwY8aif6bxgovPHMoMoNr2FulJziTndpt5H9RdwC47GSGuII9XxpSdzVGM0GWrNPHV6ie1LTNJPaLQ==",
+      "dev": true,
+      "dependencies": {
+        "estree-walker": "^0.6.1"
+      }
+    },
+    "node_modules/rollup-pluginutils/node_modules/estree-walker": {
+      "version": "0.6.1",
+      "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-0.6.1.tgz",
+      "integrity": "sha512-SqmZANLWS0mnatqbSfRP5g8OXZC12Fgg1IwNtLsyHDzJizORW4khDfjPqJZsemPWBB2uqykUah5YpQ6epsqC/w==",
+      "dev": true
+    },
     "node_modules/safe-buffer": {
       "version": "5.2.1",
       "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
@@ -2117,6 +2193,15 @@
         "node": ">=8"
       }
     },
+    "node_modules/skip-regex": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/skip-regex/-/skip-regex-1.0.2.tgz",
+      "integrity": "sha512-pEjMUbwJ5Pl/6Vn6FsamXHXItJXSRftcibixDmNCWbWhic0hzHrwkMZo0IZ7fMRH9KxcWDFSkzhccB4285PutA==",
+      "dev": true,
+      "engines": {
+        "node": ">=4.2"
+      }
+    },
     "node_modules/source-map": {
       "version": "0.7.3",
       "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.7.3.tgz",
@@ -2584,6 +2669,18 @@
         "ffjavascript": "^0.2.48"
       }
     },
+    "@jsbits/escape-regex-str": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@jsbits/escape-regex-str/-/escape-regex-str-1.0.3.tgz",
+      "integrity": "sha512-0800vYI2fg1nuUq/T9Tqv8DMOLLNiRAltxFbKIbR7szrvW6qTuI2+zGK51hV7NAAmUr4G83Kvpj2R6Yyg07iIw==",
+      "dev": true
+    },
+    "@jsbits/get-package-version": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@jsbits/get-package-version/-/get-package-version-1.0.3.tgz",
+      "integrity": "sha512-IJy1jRL01x7p6UEpgKa1lVLstMUx8EiIR8pPoS5sBfsHEoeLkzYiNpAfxPx8zLDUJyS1yBbChJjcWdPqyH285w==",
+      "dev": true
+    },
     "@rollup/plugin-commonjs": {
       "version": "17.1.0",
       "resolved": "https://registry.npmjs.org/@rollup/plugin-commonjs/-/plugin-commonjs-17.1.0.tgz",
@@ -3572,6 +3669,19 @@
         "argparse": "^2.0.1"
       }
     },
+    "jscc": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/jscc/-/jscc-1.1.1.tgz",
+      "integrity": "sha512-anpZkTXwZbxfxLEBMciKxXMHx2xOLK2qhynIhTnoSyC+wGOEPrAoofxnADgblbarn0kijVMt1U71cQGmRF/1Og==",
+      "dev": true,
+      "requires": {
+        "@jsbits/escape-regex-str": "^1.0.2",
+        "@jsbits/get-package-version": "^1.0.2",
+        "magic-string": "^0.25.1",
+        "perf-regexes": "^1.0.1",
+        "skip-regex": "^1.0.2"
+      }
+    },
     "json-schema-traverse": {
       "version": "0.4.1",
       "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
@@ -3846,6 +3956,12 @@
       "integrity": "sha512-Dp6zGqpTdETdR63lehJYPeIOqpiNBNtc7BpWSLrOje7UaIsE5aY92r/AunQA7rsXvet3lrJ3JnZX29UPTKXyKQ==",
       "dev": true
     },
+    "perf-regexes": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/perf-regexes/-/perf-regexes-1.0.1.tgz",
+      "integrity": "sha512-L7MXxUDtqr4PUaLFCDCXBfGV/6KLIuSEccizDI7JxT+c9x1G1v04BQ4+4oag84SHaCdrBgQAIs/Cqn+flwFPng==",
+      "dev": true
+    },
     "picomatch": {
       "version": "2.3.1",
       "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz",
@@ -3945,6 +4061,17 @@
         "fsevents": "~2.3.2"
       }
     },
+    "rollup-plugin-jscc": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/rollup-plugin-jscc/-/rollup-plugin-jscc-2.0.0.tgz",
+      "integrity": "sha512-5jG9q79K2u5uRBTKA+GA4gqt1zA7qHQRpcabZMoVs913gr75s428O7K3r58n2vADDzwIhiOKMo7rCMhOyks6dw==",
+      "dev": true,
+      "requires": {
+        "@jsbits/get-package-version": "^1.0.3",
+        "jscc": "^1.1.1",
+        "rollup-pluginutils": "^2.8.2"
+      }
+    },
     "rollup-plugin-terser": {
       "version": "7.0.2",
       "resolved": "https://registry.npmjs.org/rollup-plugin-terser/-/rollup-plugin-terser-7.0.2.tgz",
@@ -3980,6 +4107,23 @@
         "yargs": "^16.2.0"
       }
     },
+    "rollup-pluginutils": {
+      "version": "2.8.2",
+      "resolved": "https://registry.npmjs.org/rollup-pluginutils/-/rollup-pluginutils-2.8.2.tgz",
+      "integrity": "sha512-EEp9NhnUkwY8aif6bxgovPHMoMoNr2FulJziTndpt5H9RdwC47GSGuII9XxpSdzVGM0GWrNPHV6ie1LTNJPaLQ==",
+      "dev": true,
+      "requires": {
+        "estree-walker": "^0.6.1"
+      },
+      "dependencies": {
+        "estree-walker": {
+          "version": "0.6.1",
+          "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-0.6.1.tgz",
+          "integrity": "sha512-SqmZANLWS0mnatqbSfRP5g8OXZC12Fgg1IwNtLsyHDzJizORW4khDfjPqJZsemPWBB2uqykUah5YpQ6epsqC/w==",
+          "dev": true
+        }
+      }
+    },
     "safe-buffer": {
       "version": "5.2.1",
       "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
@@ -4010,6 +4154,12 @@
       "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
       "dev": true
     },
+    "skip-regex": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/skip-regex/-/skip-regex-1.0.2.tgz",
+      "integrity": "sha512-pEjMUbwJ5Pl/6Vn6FsamXHXItJXSRftcibixDmNCWbWhic0hzHrwkMZo0IZ7fMRH9KxcWDFSkzhccB4285PutA==",
+      "dev": true
+    },
     "source-map": {
       "version": "0.7.3",
       "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.7.3.tgz",
diff --git a/package.json b/package.json
index 63bf6b4c..af748d19 100644
--- a/package.json
+++ b/package.json
@@ -9,12 +9,14 @@
     "import": "./main.js",
     "require": "./build/main.cjs"
   },
+  "browser": "./build/main.ses.cjs",
   "scripts": {
     "test": "mocha",
     "build": "rollup -c config/rollup.cjs.config.js",
     "buildcli": "rollup -c config/rollup.cli.config.js",
     "buildiife": "BROWSER=true rollup -c config/rollup.iife.config.js",
-    "buildiifemin": "BROWSER=true rollup -c config/rollup.iife_min.config.js"
+    "buildiifemin": "BROWSER=true rollup -c config/rollup.iife_min.config.js",
+    "buildses": "BROWSER=true SES=true rollup -c config/rollup.ses.config.js"
   },
   "bin": {
     "snarkjs": "build/cli.cjs"
@@ -59,6 +61,7 @@
     "eslint": "^8.7.0",
     "mocha": "^9.1.4",
     "rollup": "^2.36.2",
+    "rollup-plugin-jscc": "^2.0.0",
     "rollup-plugin-terser": "^7.0.2",
     "rollup-plugin-visualizer": "^4.2.0"
   }
diff --git a/src/curves.js b/src/curves.js
index 156e6bfa..54019530 100644
--- a/src/curves.js
+++ b/src/curves.js
@@ -6,12 +6,14 @@ const bn128r = Scalar.e("2188824287183927522224640574525727508854836440041603434
 const bls12381q = Scalar.e("1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab", 16);
 const bn128q = Scalar.e("21888242871839275222246405745257275088696311157297823662689037894645226208583");
 
+const singleThread = process.ses
+
 export async function getCurveFromR(r) {
     let curve;
     if (Scalar.eq(r, bn128r)) {
-        curve = await buildBn128();
+        curve = await buildBn128(singleThread);
     } else if (Scalar.eq(r, bls12381r)) {
-        curve = await buildBls12381();
+        curve = await buildBls12381(singleThrread);
     } else {
         throw new Error(`Curve not supported: ${Scalar.toString(r)}`);
     }
@@ -21,9 +23,9 @@ export async function getCurveFromR(r) {
 export async function getCurveFromQ(q) {
     let curve;
     if (Scalar.eq(q, bn128q)) {
-        curve = await buildBn128();
+        curve = await buildBn128(singleThread);
     } else if (Scalar.eq(q, bls12381q)) {
-        curve = await buildBls12381();
+        curve = await buildBls12381(singleThread);
     } else {
         throw new Error(`Curve not supported: ${Scalar.toString(q)}`);
     }
@@ -34,9 +36,9 @@ export async function getCurveFromName(name) {
     let curve;
     const normName = normalizeName(name);
     if (["BN128", "BN254", "ALTBN128"].indexOf(normName) >= 0) {
-        curve = await buildBn128();
+        curve = await buildBn128(singleThread);
     } else if (["BLS12381"].indexOf(normName) >= 0) {
-        curve = await buildBls12381();
+        curve = await buildBls12381(singleThread);
     } else {
         throw new Error(`Curve not supported: ${name}`);
     }