`hash_to_point` should return `Result<(Self::NonIdentityPoint, Vec<Self::RunningSum>), Error>`

because any exceptional case is treated as an error, and therefore the identity cannot be returned.

Signed-off-by: Daira Hopwood <daira@jacaranda.org>

src/circuit/gadget/sinsemilla.rs

@@ -47,7 +47,7 @@ pub trait SinsemillaInstructions<C: CurveAffine, const K: usize, const MAX_WORDS
     /// The x-coordinate of a point output of [`Self::hash_to_point`].
     type X;
     /// A point output of [`Self::hash_to_point`].
-    type Point: Clone + Debug;
+    type NonIdentityPoint: Clone + Debug;
     /// A type enumerating the fixed points used in `CommitDomains`.
     type FixedPoints: Clone + Debug;
 
@@ -82,10 +82,10 @@ pub trait SinsemillaInstructions<C: CurveAffine, const K: usize, const MAX_WORDS
         layouter: impl Layouter<C::Base>,
         Q: C,
         message: Self::Message,
-    ) -> Result<(Self::Point, Vec<Self::RunningSum>), Error>;
+    ) -> Result<(Self::NonIdentityPoint, Vec<Self::RunningSum>), Error>;
 
     /// Extracts the x-coordinate of the output of a Sinsemilla hash.
-    fn extract(point: &Self::Point) -> Self::X;
+    fn extract(point: &Self::NonIdentityPoint) -> Self::X;
 }
 
 /// A message to be hashed.
@@ -238,7 +238,7 @@ pub struct HashDomain<
     SinsemillaChip: SinsemillaInstructions<C, K, MAX_WORDS> + Clone + Debug + Eq,
     EccChip: EccInstructions<
             C,
-            Point = <SinsemillaChip as SinsemillaInstructions<C, K, MAX_WORDS>>::Point,
+            NonIdentityPoint = <SinsemillaChip as SinsemillaInstructions<C, K, MAX_WORDS>>::NonIdentityPoint,
             FixedPoints = <SinsemillaChip as SinsemillaInstructions<C, K, MAX_WORDS>>::FixedPoints,
         > + Clone
         + Debug
@@ -255,7 +255,7 @@ where
     SinsemillaChip: SinsemillaInstructions<C, K, MAX_WORDS> + Clone + Debug + Eq,
     EccChip: EccInstructions<
             C,
-            Point = <SinsemillaChip as SinsemillaInstructions<C, K, MAX_WORDS>>::Point,
+            NonIdentityPoint = <SinsemillaChip as SinsemillaInstructions<C, K, MAX_WORDS>>::NonIdentityPoint,
             FixedPoints = <SinsemillaChip as SinsemillaInstructions<C, K, MAX_WORDS>>::FixedPoints,
         > + Clone
         + Debug
@@ -283,11 +283,11 @@ where
         &self,
         layouter: impl Layouter<C::Base>,
         message: Message<C, SinsemillaChip, K, MAX_WORDS>,
-    ) -> Result<(ecc::Point<C, EccChip>, Vec<SinsemillaChip::RunningSum>), Error> {
+    ) -> Result<(ecc::NonIdentityPoint<C, EccChip>, Vec<SinsemillaChip::RunningSum>), Error> {
         assert_eq!(self.sinsemilla_chip, message.chip);
         self.sinsemilla_chip
             .hash_to_point(layouter, self.Q, message.inner)
-            .map(|(point, zs)| (ecc::Point::from_inner(self.ecc_chip.clone(), point), zs))
+            .map(|(point, zs)| (ecc::NonIdentityPoint::from_inner(self.ecc_chip.clone(), point), zs))
     }
 
     /// $\mathsf{SinsemillaHash}$ from [§ 5.4.1.9][concretesinsemillahash].
@@ -334,7 +334,7 @@ pub struct CommitDomain<
     SinsemillaChip: SinsemillaInstructions<C, K, MAX_WORDS> + Clone + Debug + Eq,
     EccChip: EccInstructions<
             C,
-            Point = <SinsemillaChip as SinsemillaInstructions<C, K, MAX_WORDS>>::Point,
+            NonIdentityPoint = <SinsemillaChip as SinsemillaInstructions<C, K, MAX_WORDS>>::NonIdentityPoint,
             FixedPoints = <SinsemillaChip as SinsemillaInstructions<C, K, MAX_WORDS>>::FixedPoints,
         > + Clone
         + Debug
@@ -350,7 +350,7 @@ where
     SinsemillaChip: SinsemillaInstructions<C, K, MAX_WORDS> + Clone + Debug + Eq,
     EccChip: EccInstructions<
             C,
-            Point = <SinsemillaChip as SinsemillaInstructions<C, K, MAX_WORDS>>::Point,
+            NonIdentityPoint = <SinsemillaChip as SinsemillaInstructions<C, K, MAX_WORDS>>::NonIdentityPoint,
             FixedPoints = <SinsemillaChip as SinsemillaInstructions<C, K, MAX_WORDS>>::FixedPoints,
         > + Clone
         + Debug
@@ -387,7 +387,6 @@ where
         assert_eq!(self.M.sinsemilla_chip, message.chip);
         let (blind, _) = self.R.mul(layouter.namespace(|| "[r] R"), r)?;
         let (p, zs) = self.M.hash_to_point(layouter.namespace(|| "M"), message)?;
-        let p: ecc::NonIdentityPoint<C, EccChip> = p.try_into()?;
         let blind = blind.try_into()?;
         let commitment = p.add_incomplete(layouter.namespace(|| "M ⸭ [r] R"), &blind)?;
         Ok((commitment, zs))

src/circuit/gadget/sinsemilla/chip.rs

@@ -4,7 +4,7 @@ use super::{
 };
 use crate::{
     circuit::gadget::{
-        ecc::chip::EccPoint,
+        ecc::chip::NonIdentityEccPoint,
         utilities::{lookup_range_check::LookupRangeCheckConfig, CellValue, Var},
     },
     constants::OrchardFixedBasesFull,
@@ -247,7 +247,7 @@ impl SinsemillaInstructions<pallas::Affine, { sinsemilla::K }, { sinsemilla::C }
     type RunningSum = Vec<Self::CellValue>;
 
     type X = CellValue<pallas::Base>;
-    type Point = EccPoint;
+    type NonIdentityPoint = NonIdentityEccPoint;
     type FixedPoints = OrchardFixedBasesFull;
 
     type HashDomains = SinsemillaHashDomains;
@@ -282,14 +282,14 @@ impl SinsemillaInstructions<pallas::Affine, { sinsemilla::K }, { sinsemilla::C }
         mut layouter: impl Layouter<pallas::Base>,
         Q: pallas::Affine,
         message: Self::Message,
-    ) -> Result<(Self::Point, Vec<Self::RunningSum>), Error> {
+    ) -> Result<(Self::NonIdentityPoint, Vec<Self::RunningSum>), Error> {
         layouter.assign_region(
             || "hash_to_point",
             |mut region| self.hash_message(&mut region, Q, &message),
         )
     }
 
-    fn extract(point: &Self::Point) -> Self::X {
+    fn extract(point: &Self::NonIdentityPoint) -> Self::X {
         point.x()
     }
 }

src/circuit/gadget/sinsemilla/chip/hash_to_point.rs

@@ -1,5 +1,5 @@
 use super::super::SinsemillaInstructions;
-use super::{CellValue, EccPoint, SinsemillaChip, Var};
+use super::{CellValue, NonIdentityEccPoint, SinsemillaChip, Var};
 use crate::primitives::sinsemilla::{self, lebs2ip_k, INV_TWO_POW_K, SINSEMILLA_S};
 use halo2::{
     circuit::{Chip, Region},
@@ -26,7 +26,7 @@ impl SinsemillaChip {
             { sinsemilla::K },
             { sinsemilla::C },
         >>::Message,
-    ) -> Result<(EccPoint, Vec<Vec<CellValue<pallas::Base>>>), Error> {
+    ) -> Result<(NonIdentityEccPoint, Vec<Vec<CellValue<pallas::Base>>>), Error> {
         let config = self.config().clone();
         let mut offset = 0;
 
@@ -147,7 +147,14 @@ impl SinsemillaChip {
             }
         }
 
-        Ok((EccPoint::from_coordinates_unchecked(x_a.0, y_a), zs_sum))
+        if let Some(x_a) = x_a.value() {
+            if let Some(y_a) = y_a.value() {
+                if x_a == pallas::Base::zero() || y_a == pallas::Base::zero() {
+                    return Err(Error::SynthesisError);
+                }
+            }
+        }
+        Ok((NonIdentityEccPoint::from_coordinates_unchecked(x_a.0, y_a), zs_sum))
     }
 
     #[allow(clippy::type_complexity)]

src/circuit/gadget/sinsemilla/merkle/chip.rs

@@ -417,11 +417,11 @@ impl SinsemillaInstructions<pallas::Affine, { sinsemilla::K }, { sinsemilla::C }
         { sinsemilla::K },
         { sinsemilla::C },
     >>::X;
-    type Point = <SinsemillaChip as SinsemillaInstructions<
+    type NonIdentityPoint = <SinsemillaChip as SinsemillaInstructions<
         pallas::Affine,
         { sinsemilla::K },
         { sinsemilla::C },
-    >>::Point;
+    >>::NonIdentityPoint;
     type FixedPoints = <SinsemillaChip as SinsemillaInstructions<
         pallas::Affine,
         { sinsemilla::K },
@@ -457,13 +457,13 @@ impl SinsemillaInstructions<pallas::Affine, { sinsemilla::K }, { sinsemilla::C }
         layouter: impl Layouter<pallas::Base>,
         Q: pallas::Affine,
         message: Self::Message,
-    ) -> Result<(Self::Point, Vec<Vec<Self::CellValue>>), Error> {
+    ) -> Result<(Self::NonIdentityPoint, Vec<Vec<Self::CellValue>>), Error> {
         let config = self.config().sinsemilla_config.clone();
         let chip = SinsemillaChip::construct(config);
         chip.hash_to_point(layouter, Q, message)
     }
 
-    fn extract(point: &Self::Point) -> Self::X {
+    fn extract(point: &Self::NonIdentityPoint) -> Self::X {
         SinsemillaChip::extract(point)
     }
 }