# Commitments

As in Sapling, we require two kinds of commitment schemes in Orchard:

- HomomorphicCommit is a linearly homomorphic commitment scheme with perfect hiding, and strong binding reducible to DL.
- Commit and ShortCommit are commitment schemes with perfect hiding, and strong binding reducible to DL.

By "strong binding" we mean that the scheme is collision resistant on the input and randomness.

We instantiate HomomorphicCommit with a Pedersen commitment, and use it for value commitments:

cv=HomomorphicCommitrcvcv​(v)

We instantiate Commit and ShortCommit with Sinsemilla, and use them for all other commitments:

ivk=ShortCommitrivkivk​(ak,nk) cm=Commitrcmcm​(rest of note)

This is the same split (and rationale) as in Sapling, but using the more PLONK-efficient Sinsemilla instead of Bowe--Hopwood Pedersen hashes.

Note that for ivk, we also deviate from Sapling in two ways:

- We use ShortCommit to derive ivk instead of a full PRF. This removes an unnecessary (large) PRF primitive from the circuit, at the cost of requiring rivk to be part of the full viewing key.
- We define ivk as an integer in [1,qP​); that is, we exclude ivk=0. For Sapling, we relied on BLAKE2s to make ivk=0 infeasible to produce, but it was still technically possible. For Orchard, we get this by construction:
  - 0 is not a valid x-coordinate for any Pallas point.
  - SinsemillaShortCommit internally maps points to field elements by replacing the identity (which has no affine coordinates) with 0. But SinsemillaCommit is defined using incomplete addition, and thus will never produce the identity.