# Nullifiers

The nullifier design we use for Orchard is

nf=ExtractP​([(Fnk​(ρ)+ψ)modp]G+cm),

where:

- F is a keyed circuit-efficient PRF (such as Rescue or Poseidon).
- ρ is unique to this output. As with hSig​ in Sprout, ρ includes the nullifiers of any Orchard notes being spent in the same action. Given that an action consists of a single spend and a single output, we set ρ to be the nullifier of the spent note.
- ψ is sender-controlled randomness. It is not required to be unique, and in practice is derived from both ρ and a sender-selected random value rseed: ψ=KDFψ(ρ,rseed).
- G is a fixed independent base.
- ExtractP​ extracts the x-coordinate of a Pallas curve point.

This gives a note structure of

(addr,v,ρ,ψ,rcm).

The note plaintext includes rseed in place of ψ and rcm, and omits ρ (which is a public part of the action).

## Security properties

We care about several security properties for our nullifiers:

- Balance: can I forge money?

- Note Privacy: can I gain information about notes only from the public block chain?

  - This describes notes sent in-band.

- Note Privacy (OOB): can I gain information about notes sent out-of-band, only from the public block chain?

  - In this case, we assume privacy of the channel over which the note is sent, and that the adversary does not have access to any notes sent to the same address which are then spent (so that the nullifier is on the block chain somewhere).

- Spend Unlinkability: given the incoming viewing key for an address, and not the full viewing key, can I (possibly the sender) detect spends of any notes sent to that address?

  - We're giving ivk to the attacker and allowing it to be the sender in order to make this property as strong as possible: they will have all the notes sent to that address.

- Faerie Resistance: can I perform a Faerie Gold attack (i.e. cause notes to be accepted that are unspendable)?

  - We're giving the full viewing key to the attacker and allowing it to be the sender in order to make this property as strong as possible: they will have all the notes sent to that address, and be able to derive every nullifier.

We assume (and instantiate elsewhere) the following primitives:

- GH is a cryptographic hash into the group (such as BLAKE2s with simplified SWU), used to derive all fixed independent bases.
- E is an elliptic curve (such as Pallas).
- KDF is the note encryption key derivation function.

For our chosen design, our desired security properties rely on the following assumptions:

BalanceNote PrivacyNote Privacy (OOB)Spend UnlinkabilityFaerie Resistance​DLE​HashDHEKDF​Near perfect‡DDHE†​∨PRFF​DLE​​​

HashDHEKDF​ is computational Diffie-Hellman using KDF for the key derivation, with one-time ephemeral keys. This assumption is heuristically weaker than DDHE​ but stronger than DLE​.

We omit ROGH​ as a security assumption because we only rely on the random oracle applied to fixed inputs defined by the protocol, i.e. to generate the fixed base G, not to attacker-specified inputs.

> † We additionally assume that for any input x, {Fnk​(x):nk∈E} gives a scalar in an adequate range for DDHE​. (Otherwise, F could be trivial, e.g. independent of nk.)

> ‡ Statistical distance <2−167.8 from perfect.

## Considered alternatives

⚠ Caution: be skeptical of the claims in this table about what problem(s) each security property depends on. They may not be accurate and are definitely not fully rigorous.

The entries in this table omit the application of ExtractP​, which is an optimization to halve the nullifier length. That optimization requires its own security analysis, but because it is a deterministic mapping, only Faerie Resistance could be affected by it.

nf[nk][θ]H[nk]H+[rnf]IHash([nk][θ]H)Hash([nk]H+[rnf]I)[Fnk​(ψ)][θ]H[Fnk​(ψ)]H+[rnf]I[Fnk​(ψ)]G+[θ]H[Fnk​(ψ)]H+cm[Fnk​(ρ,ψ)]G+cm[Fnk​(ρ)]G+cm[Fnk​(ρ,ψ)]Gv​+[rnf]I[Fnk​(ρ)]Gv​+[rnf]I[(Fnk​(ρ)+ψ)modp]Gv​[Fnk​(ρ,ψ)]G+Commitrnfnf​(v,ρ)[Fnk​(ρ)]G+Commitrnfnf​(v,ρ)​Note(addr,v,H,θ,rcm)(addr,v,H,rnf,rcm)(addr,v,H,θ,rcm)(addr,v,H,rnf,rcm)(addr,v,H,θ,ψ,rcm)(addr,v,H,rnf,ψ,rcm)(addr,v,H,θ,ψ,rcm)(addr,v,H,ψ,rcm)(addr,v,ρ,ψ,rcm)(addr,v,ρ,rcm)(addr,v,ρ,rnf,ψ,rcm)(addr,v,ρ,rnf,rcm)(addr,v,ρ,ψ,rcm)(addr,v,ρ,rnf,ψ,rcm)(addr,v,ρ,rnf,rcm)​BalanceDLE​DLE​DLE​DLE​DLE​DLE​DLE​DLE​DLE​DLE​DLE​DLE​DLE​DLE​DLE​​Note PrivacyHashDHEKDF​HashDHEKDF​HashDHEKDF​HashDHEKDF​HashDHEKDF​HashDHEKDF​HashDHEKDF​HashDHEKDF​HashDHEKDF​HashDHEKDF​HashDHEKDF​HashDHEKDF​HashDHEKDF​HashDHEKDF​HashDHEKDF​​Note Priv OOBPerfectPerfectPerfectPerfectPerfectPerfectPerfectDDHE†​DDHE†​DDHE†​PerfectPerfectNear perfect‡PerfectPerfect​Spend UnlinkabilityDDHE​DDHE​DDHE​∨PreHash​DDHE​∨PreHash​DDHE†​∨PRFF​DDHE†​∨PRFF​DDHE†​∨PRFF​DDHE†​∨PRFF​DDHE†​∨PRFF​DDHE†​∨PRFF​DDHE†​∨PRFF​DDHE†​∨PRFF​DDHE†​∨PRFF​DDHE†​∨PRFF​DDHE†​∨PRFF​​Faerie ResistanceROGH​∧DLE​ROGH​∧DLE​CollHash​∧ROGH​∧DLE​CollHash​∧ROGH​∧DLE​ROGH​∧DLE​ROGH​∧DLE​ROGH​∧DLE​ROGH​∧DLE​DLE​DLE​CollF​∧DLE​CollF​∧DLE​brokenDLE​DLE​​Reason not to useNo SU for DL-breakingNo SU for DL-breakingCollHash​ for FRCollHash​ for FRPerf. (2 var-base)Perf. (1 var+1 fix-base)Perf. (1 var+1 fix-base)NP(OOB) not perfectNP(OOB) not perfectNP(OOB) not perfectCollF​ for FRCollF​ for FRbroken for FRPerf. (2 fix-base)Perf. (2 fix-base)​​

In the above alternatives:

- Hash is a keyed circuit-efficient hash (such as Rescue).

- I is an fixed independent base, independent of G and any others returned by GH.

- Gv​ is a pair of fixed independent bases (independent of all others), where the specific choice of base depends on whether the note has zero value.

- H is a base unique to this output.

  - For non-zero-valued notes, H=GH(ρ). As with hSig​ in Sprout, ρ includes the nullifiers of any Orchard notes being spent in the same action.
  - For zero-valued notes, H is constrained by the circuit to a fixed base independent of I and any others returned by GH.

## Rationale

In order to satisfy the Balance security property, we require that the circuit must be able to enforce that only one nullifier is accepted for a given note. As in Sprout and Sapling, we achieve this by ensuring that the nullifier deterministically depends only on values committed to (directly or indirectly) by the note commitment. As in Sapling, this involves arguing that:

- There can be only one ivk for a given addr. This is true because the circuit checks that pkd​=[ivk]gd​, and the mapping ivk↦[ivk]gd​ is an injection for any gd​. (ivk is in the base field of E, which must be smaller than its scalar field, as is the case for Pallas.)
- There can be only one nk for a given ivk. This is true because the circuit checks that ivk=ShortCommitrivkivk​(ak,nk) where ShortCommit is binding (see Commitments).

### Use of ρ

Faerie Resistance requires that nullifiers be unique. This is primarily achieved by taking a unique value (checked for uniqueness by the public consensus rules) as an input to the nullifier. However, it is also necessary to ensure that the transformations applied to this value preserve its uniqueness. Meanwhile, to achieve Spend Unlinkability, we require that the nullifier does not reveal any information about the unique value it is derived from.

The design alternatives fall into two categories in terms of how they balance these requirements:

- Publish a unique value ρ at note creation time, and blind that value within the nullifier computation.

  - This is similar to the approach taken in Sprout and Sapling, which both implemented nullifiers as PRF outputs; Sprout uses the compression function from SHA-256, while Sapling uses BLAKE2s.

- Derive a unique base H from some unique value, publish that unique base at note creation time, and then blind the base (either additively or multiplicatively) during nullifier computation.

For Spend Unlinkability, the only value unknown to the adversary is nk, and the cryptographic assumptions only involve the first term (other terms like cm or [rnf]I cannot be extracted directly from the observed nullifiers, but can be subtracted from them). We therefore ensure that the first term does not commit directly to the note (to avoid a DL-breaking adversary from immediately breaking SU).

We were considering using a design involving H with the goal of eliminating all usages of a PRF inside the circuit, for two reasons:

- Instantiating PRFF​ with a traditional hash function is expensive in the circuit.
- We didn't want to solely rely on an algebraic hash function satisfying PRFF​ to achieve Spend Unlinkability.

However, those designs rely on both ROGH​ and DLE​ for Faerie Resistance, while still requiring DDHE​ for Spend Unlinkability. (There are two designs for which this is not the case, but they rely on DDHE†​ for Note Privacy (OOB) which was not acceptable).

By contrast, several designs involving ρ (including the chosen design) have weaker assumptions for Faerie Resistance (only relying on DLE​), and Spend Unlinkability does not require PRFF​ to hold: they can fall back on the same DDHE​ assumption as the H designs (along with an additional assumption about the output of F which is easily satisfied).

### Use of ψ

Most of the designs include either a multiplicative blinding term [θ]H, or an additive blinding term [rnf]I, in order to achieve perfect Note Privacy (OOB) (to an adversary who does not know the note). The chosen design is effectively using [ψ]G for this purpose; a DL-breaking adversary only learns Fnk​(ρ)+ψ(modp). This reduces Note Privacy (OOB) from perfect to statistical, but given that ψ is from a distribution statistically close to uniform on [0,q), this is statistically close to better than 2−128. The benefit is that it does not require an additional scalar multiplication, making it more efficient inside the circuit.

ψ's derivation has two motivations:

- Deriving from a random value rseed enables multiple derived values to be conveyed to the recipient within an action (such as the ephemeral secret esk, per ZIP 212), while keeping the note plaintext short.
- Mixing ρ into the derivation ensures that the sender can't repeat ψ across two notes, which could have enabled spend linkability attacks in some designs.

The note that is committed to, and which the circuit takes as input, only includes ψ (i.e. the circuit does not check the derivation from rseed). However, an adversarial sender is still constrained by this derivation, because the recipient recomputes ψ during note decryption. If an action were created using an arbitrary ψ (for which the adversary did not have a corresponding rseed), the recipient would derive a note commitment that did not match the action's commitment field, and reject it (as in Sapling).

### Use of cm

The nullifier commits to the note value via cm for two reasons:

- It domain-separates nullifiers for zero-valued notes from other notes. This is necessary because we do not require zero-valued notes to exist in the commitment tree.
- Designs that bind the nullifier to Fnk​(ρ) require CollF​ to achieve Faerie Resistance (and similarly where Hash is applied to a value derived from H). Adding cm to the nullifier avoids this assumption: all of the bases used to derive cm are fixed and independent of G, and so the nullifier can be viewed as a Pedersen hash where the input includes ρ directly.

The Commitnf variants were considered to avoid directly depending on cm (which in its native type is a base field element, not a group element). We decided instead to follow Sapling by defining an intermediate representation of cm as a group element, that is only used in nullifier computation. The circuit already needs to compute cm, so this improves performance by removing an additional commitment calculation from the circuit.

We also considered variants that used a choice of fixed bases Gv​ to provide domain separation for zero-valued notes. The most performant design (similar to the chosen design) does not achieve Faerie Resistance for an adversary that knows the recipient's full viewing key (ψ could be brute-forced to cancel out Fnk​(ρ), causing a collision), and the other variants require assuming CollF​ as mentioned above.