zec
/
orchard
mirror of https://github.com/zcash/orchard.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
orchard/print.html

618 lines
264 KiB
HTML
Raw Normal View History

deploy: 6614e800d94bdf7414739beefd82d6a49982781c
2020-10-20 15:04:07 -07:00
<!DOCTYPE HTML>
<html lang="en" class="sidebar-visible no-js light">
<head>
<!-- Book generated using mdBook -->
<meta charset="UTF-8">
deploy: f2d74158740e609744e2c6fe460107b91d525a42
2021-01-08 08:58:47 -08:00
<title>The Orchard Book</title>
deploy: 6614e800d94bdf7414739beefd82d6a49982781c
2020-10-20 15:04:07 -07:00
<meta name="robots" content="noindex" />
<!-- Custom HTML head -->
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
<meta name="description" content="">
<meta name="viewport" content="width=device-width, initial-scale=1">
<meta name="theme-color" content="#ffffff" />
<link rel="icon" href="favicon.svg">
<link rel="shortcut icon" href="favicon.png">
<link rel="stylesheet" href="css/variables.css">
<link rel="stylesheet" href="css/general.css">
<link rel="stylesheet" href="css/chrome.css">
<link rel="stylesheet" href="css/print.css" media="print">
<!-- Fonts -->
<link rel="stylesheet" href="FontAwesome/css/font-awesome.css">
<link rel="stylesheet" href="fonts/fonts.css">
<!-- Highlight.js Stylesheets -->
<link rel="stylesheet" href="highlight.css">
<link rel="stylesheet" href="tomorrow-night.css">
<link rel="stylesheet" href="ayu-highlight.css">
<!-- Custom theme stylesheets -->
</head>
<body>
<!-- Provide site root to javascript -->
<script type="text/javascript">
var path_to_root = "";
var default_theme = window.matchMedia("(prefers-color-scheme: dark)").matches ? "navy" : "light";
</script>
<!-- Work around some values being stored in localStorage wrapped in quotes -->
<script type="text/javascript">
try {
var theme = localStorage.getItem('mdbook-theme');
var sidebar = localStorage.getItem('mdbook-sidebar');
if (theme.startsWith('"') && theme.endsWith('"')) {
localStorage.setItem('mdbook-theme', theme.slice(1, theme.length - 1));
}
if (sidebar.startsWith('"') && sidebar.endsWith('"')) {
localStorage.setItem('mdbook-sidebar', sidebar.slice(1, sidebar.length - 1));
}
} catch (e) { }
</script>
<!-- Set the theme before any content is loaded, prevents flash -->
<script type="text/javascript">
var theme;
try { theme = localStorage.getItem('mdbook-theme'); } catch(e) { }
if (theme === null || theme === undefined) { theme = default_theme; }
var html = document.querySelector('html');
html.classList.remove('no-js')
html.classList.remove('light')
html.classList.add(theme);
html.classList.add('js');
</script>
<!-- Hide / unhide sidebar before it is displayed -->
<script type="text/javascript">
var html = document.querySelector('html');
var sidebar = 'hidden';
if (document.body.clientWidth >= 1080) {
try { sidebar = localStorage.getItem('mdbook-sidebar'); } catch(e) { }
sidebar = sidebar || 'visible';
}
html.classList.remove('sidebar-visible');
html.classList.add("sidebar-" + sidebar);
</script>
<nav id="sidebar" class="sidebar" aria-label="Table of contents">
<div class="sidebar-scrollbox">
deploy: a4fb24b724aba340595b71da9b8936b0fd4cace1
2021-01-08 09:28:54 -08:00
<ol class="chapter"><li class="chapter-item expanded affix "><a href="index.html">Orchard</a></li><li class="chapter-item expanded "><a href="concepts.html"><strong aria-hidden="true">1.</strong> Concepts</a></li><li><ol class="section"><li class="chapter-item expanded "><a href="concepts/preliminaries.html"><strong aria-hidden="true">1.1.</strong> Preliminaries</a></li></ol></li><li class="chapter-item expanded "><a href="user.html"><strong aria-hidden="true">2.</strong> User Documentation</a></li><li><ol class="section"><li class="chapter-item expanded "><a href="user/keys.html"><strong aria-hidden="true">2.1.</strong> Creating keys and addresses</a></li><li class="chapter-item expanded "><a href="user/creating-notes.html"><strong aria-hidden="true">2.2.</strong> Creating notes</a></li><li class="chapter-item expanded "><a href="user/spending-notes.html"><strong aria-hidden="true">2.3.</strong> Spending notes</a></li><li class="chapter-item expanded "><a href="user/integration.html"><strong aria-hidden="true">2.4.</strong> Integration into an existing chain</a></li></ol></li><li class="chapter-item expanded "><a href="design.html"><strong aria-hidden="true">3.</strong> Design</a></li><li><ol class="section"><li class="chapter-item expanded "><a href="design/actions.html"><strong aria-hidden="true">3.1.</strong> Actions</a></li><li class="chapter-item expanded "><a href="design/commitments.html"><strong aria-hidden="true">3.2.</strong> Commitments</a></li><li class="chapter-item expanded "><a href="design/commitment-tree.html"><strong aria-hidden="true">3.3.</strong> Commitment tree</a></li><li class="chapter-item expanded "><a href="design/nullifiers.html"><strong aria-hidden="true">3.4.</strong> Nullifiers</a></li><li class="chapter-item expanded "><a href="design/signatures.html"><strong aria-hidden="true">3.5.</strong> Signatures</a></li><li class="chapter-item expanded "><a href="design/circuit.html"><strong aria-hidden="true">3.6.</strong> Circuit</a></li></ol></li></ol>
deploy: 6614e800d94bdf7414739beefd82d6a49982781c
2020-10-20 15:04:07 -07:00
</div>
<div id="sidebar-resize-handle" class="sidebar-resize-handle"></div>
</nav>
<div id="page-wrapper" class="page-wrapper">
<div class="page">
<div id="menu-bar-hover-placeholder"></div>
<div id="menu-bar" class="menu-bar sticky bordered">
<div class="left-buttons">
<button id="sidebar-toggle" class="icon-button" type="button" title="Toggle Table of Contents" aria-label="Toggle Table of Contents" aria-controls="sidebar">
<i class="fa fa-bars"></i>
</button>
<button id="theme-toggle" class="icon-button" type="button" title="Change theme" aria-label="Change theme" aria-haspopup="true" aria-expanded="false" aria-controls="theme-list">
<i class="fa fa-paint-brush"></i>
</button>
<ul id="theme-list" class="theme-popup" aria-label="Themes" role="menu">
<li role="none"><button role="menuitem" class="theme" id="light">Light (default)</button></li>
<li role="none"><button role="menuitem" class="theme" id="rust">Rust</button></li>
<li role="none"><button role="menuitem" class="theme" id="coal">Coal</button></li>
<li role="none"><button role="menuitem" class="theme" id="navy">Navy</button></li>
<li role="none"><button role="menuitem" class="theme" id="ayu">Ayu</button></li>
</ul>
<button id="search-toggle" class="icon-button" type="button" title="Search. (Shortkey: s)" aria-label="Toggle Searchbar" aria-expanded="false" aria-keyshortcuts="S" aria-controls="searchbar">
<i class="fa fa-search"></i>
</button>
</div>
deploy: f2d74158740e609744e2c6fe460107b91d525a42
2021-01-08 08:58:47 -08:00
<h1 class="menu-title">The Orchard Book</h1>
deploy: 6614e800d94bdf7414739beefd82d6a49982781c
2020-10-20 15:04:07 -07:00
<div class="right-buttons">
<a href="print.html" title="Print this book" aria-label="Print this book">
<i id="print-button" class="fa fa-print"></i>
</a>
</div>
</div>
<div id="search-wrapper" class="hidden">
<form id="searchbar-outer" class="searchbar-outer">
<input type="search" name="search" id="searchbar" name="searchbar" placeholder="Search this book ..." aria-controls="searchresults-outer" aria-describedby="searchresults-header">
</form>
<div id="searchresults-outer" class="searchresults-outer hidden">
<div id="searchresults-header" class="searchresults-header"></div>
<ul id="searchresults">
</ul>
</div>
</div>
<!-- Apply ARIA attributes after the sidebar and the sidebar toggle button are added to the DOM -->
<script type="text/javascript">
document.getElementById('sidebar-toggle').setAttribute('aria-expanded', sidebar === 'visible');
document.getElementById('sidebar').setAttribute('aria-hidden', sidebar !== 'visible');
Array.from(document.querySelectorAll('#sidebar a')).forEach(function(link) {
link.setAttribute('tabIndex', sidebar === 'visible' ? 0 : -1);
});
</script>
<div id="content" class="content">
<main>
deploy: a4fb24b724aba340595b71da9b8936b0fd4cace1
2021-01-08 09:28:54 -08:00
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.12.0/dist/katex.min.css" integrity="sha384-AfEj0r4/OFrOo5t7NnNe46zW/tFgW6x/bCJG8FqQCEo3+Aro6EYUG4+cU+KJWu/X" crossorigin="anonymous">
<h1><a class="header" href="#orchard-a-hrefhttpscratesiocratesorchardimg-srchttpsimgshieldsiocratesvorchardsvg-altcratesio-a" id="orchard-a-hrefhttpscratesiocratesorchardimg-srchttpsimgshieldsiocratesvorchardsvg-altcratesio-a">orchard <a href="https://crates.io/crates/orchard"><img src="https://img.shields.io/crates/v/orchard.svg" alt="Crates.io" /></a></a></h1>
deploy: 4a4d7ea8188836be2ea8cf224e6838b2c3283598
2020-10-28 11:08:29 -07:00
<p><strong>IMPORTANT</strong>: This library is being actively developed and should not be used in production software.</p>
<h2><a class="header" href="#documentation" id="documentation">Documentation</a></h2>
<ul>
deploy: f2d74158740e609744e2c6fe460107b91d525a42
2021-01-08 08:58:47 -08:00
<li><a href="https://zcash.github.io/orchard/">The Orchard Book</a></li>
<li><a href="https://docs.rs/orchard">Crate documentation</a></li>
deploy: 4a4d7ea8188836be2ea8cf224e6838b2c3283598
2020-10-28 11:08:29 -07:00
</ul>
<h2><a class="header" href="#license" id="license">License</a></h2>
<p>Copyright 2020 The Electric Coin Company.</p>
<p>You may use this package under the Transitive Grace Period Public Licence,
version 1.0, or at your option, any later version. See the file
<a href="LICENSE-TGPPL"><code>LICENSE-TGPPL</code></a> for the terms of the Transitive Grace Period
Public Licence, version 1.0.</p>
<p>The purpose of the TGPPL is to allow commercial improvements to the package
while ensuring that all improvements are eventually open source. See
<a href="https://tahoe-lafs.org/%7Ezooko/tgppl.pdf">here</a> for why the TGPPL exists,
graphically illustrated on three slides.</p>
deploy: a4fb24b724aba340595b71da9b8936b0fd4cace1
2021-01-08 09:28:54 -08:00
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.12.0/dist/katex.min.css" integrity="sha384-AfEj0r4/OFrOo5t7NnNe46zW/tFgW6x/bCJG8FqQCEo3+Aro6EYUG4+cU+KJWu/X" crossorigin="anonymous">
deploy: 4a4d7ea8188836be2ea8cf224e6838b2c3283598
2020-10-28 11:08:29 -07:00
<h1><a class="header" href="#concepts" id="concepts">Concepts</a></h1>
deploy: a4fb24b724aba340595b71da9b8936b0fd4cace1
2021-01-08 09:28:54 -08:00
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.12.0/dist/katex.min.css" integrity="sha384-AfEj0r4/OFrOo5t7NnNe46zW/tFgW6x/bCJG8FqQCEo3+Aro6EYUG4+cU+KJWu/X" crossorigin="anonymous">
deploy: 4a4d7ea8188836be2ea8cf224e6838b2c3283598
2020-10-28 11:08:29 -07:00
<h1><a class="header" href="#preliminaries" id="preliminaries">Preliminaries</a></h1>
deploy: a4fb24b724aba340595b71da9b8936b0fd4cace1
2021-01-08 09:28:54 -08:00
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.12.0/dist/katex.min.css" integrity="sha384-AfEj0r4/OFrOo5t7NnNe46zW/tFgW6x/bCJG8FqQCEo3+Aro6EYUG4+cU+KJWu/X" crossorigin="anonymous">
deploy: 4a4d7ea8188836be2ea8cf224e6838b2c3283598
2020-10-28 11:08:29 -07:00
<h1><a class="header" href="#user-documentation" id="user-documentation">User Documentation</a></h1>
deploy: a4fb24b724aba340595b71da9b8936b0fd4cace1
2021-01-08 09:28:54 -08:00
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.12.0/dist/katex.min.css" integrity="sha384-AfEj0r4/OFrOo5t7NnNe46zW/tFgW6x/bCJG8FqQCEo3+Aro6EYUG4+cU+KJWu/X" crossorigin="anonymous">
deploy: 4a4d7ea8188836be2ea8cf224e6838b2c3283598
2020-10-28 11:08:29 -07:00
<h1><a class="header" href="#creating-keys-and-addresses" id="creating-keys-and-addresses">Creating keys and addresses</a></h1>
deploy: a4fb24b724aba340595b71da9b8936b0fd4cace1
2021-01-08 09:28:54 -08:00
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.12.0/dist/katex.min.css" integrity="sha384-AfEj0r4/OFrOo5t7NnNe46zW/tFgW6x/bCJG8FqQCEo3+Aro6EYUG4+cU+KJWu/X" crossorigin="anonymous">
deploy: 4a4d7ea8188836be2ea8cf224e6838b2c3283598
2020-10-28 11:08:29 -07:00
<h1><a class="header" href="#creating-notes" id="creating-notes">Creating notes</a></h1>
deploy: a4fb24b724aba340595b71da9b8936b0fd4cace1
2021-01-08 09:28:54 -08:00
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.12.0/dist/katex.min.css" integrity="sha384-AfEj0r4/OFrOo5t7NnNe46zW/tFgW6x/bCJG8FqQCEo3+Aro6EYUG4+cU+KJWu/X" crossorigin="anonymous">
deploy: 4a4d7ea8188836be2ea8cf224e6838b2c3283598
2020-10-28 11:08:29 -07:00
<h1><a class="header" href="#spending-notes" id="spending-notes">Spending notes</a></h1>
deploy: a4fb24b724aba340595b71da9b8936b0fd4cace1
2021-01-08 09:28:54 -08:00
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.12.0/dist/katex.min.css" integrity="sha384-AfEj0r4/OFrOo5t7NnNe46zW/tFgW6x/bCJG8FqQCEo3+Aro6EYUG4+cU+KJWu/X" crossorigin="anonymous">
deploy: 4a4d7ea8188836be2ea8cf224e6838b2c3283598
2020-10-28 11:08:29 -07:00
<h1><a class="header" href="#integration-into-an-existing-chain" id="integration-into-an-existing-chain">Integration into an existing chain</a></h1>
deploy: a4fb24b724aba340595b71da9b8936b0fd4cace1
2021-01-08 09:28:54 -08:00
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.12.0/dist/katex.min.css" integrity="sha384-AfEj0r4/OFrOo5t7NnNe46zW/tFgW6x/bCJG8FqQCEo3+Aro6EYUG4+cU+KJWu/X" crossorigin="anonymous">
deploy: 4a4d7ea8188836be2ea8cf224e6838b2c3283598
2020-10-28 11:08:29 -07:00
<h1><a class="header" href="#design" id="design">Design</a></h1>
deploy: a4fb24b724aba340595b71da9b8936b0fd4cace1
2021-01-08 09:28:54 -08:00
<h2><a class="header" href="#general-design-notes" id="general-design-notes">General design notes</a></h2>
<h3><a class="header" href="#requirements" id="requirements">Requirements</a></h3>
<ul>
<li>Keep the design close to Sapling, while eliminating aspects we don't like.</li>
</ul>
<h3><a class="header" href="#non-requirements" id="non-requirements">Non-requirements</a></h3>
<ul>
<li>Delegated proving with privacy from the prover.
<ul>
<li>We know how to do this, but it would require a discrete log equality proof, and the
most efficient way to do this would be to do RedDSA and this at the same time, which
means more work for e.g. hardware wallets.</li>
</ul>
</li>
</ul>
<h3><a class="header" href="#open-issues" id="open-issues">Open issues</a></h3>
<ul>
<li>Should we have one memo per output, or one memo per transaction, or 0..n memos?
<ul>
<li>Variable, or (1 or n), is a potential privacy leak.</li>
<li>Need to consider the privacy issue related to light clients requesting individual
memos vs being able to fetch all memos.</li>
</ul>
</li>
</ul>
<h3><a class="header" href="#key-structure" id="key-structure">Key structure</a></h3>
<p>Provisional proposal: exactly the same key structure as Sapling.</p>
<p>Group hashing uses the isogeny.</p>
<ul>
<li>nsk goes away; <code>nk</code> is now a field element</li>
<li>TODO: ak / nk split enables splitting the security argument, but could consider merging.
Merging would help with ivk derivation perf (though as a commitment now it's pretty cheap)</li>
</ul>
<p>ZIP 32 integration</p>
<ul>
<li>Use same Sapling design?</li>
<li>Simpler &quot;hardened-only&quot; derivation structure?</li>
<li>Improve diversifier integration / documentation</li>
</ul>
<h3><a class="header" href="#note-structure" id="note-structure">Note structure</a></h3>
<ul>
<li>TODO: UDAs: arbitrary vs whitelisted</li>
</ul>
<h3><a class="header" href="#typed-variables-vs-byte-encodings" id="typed-variables-vs-byte-encodings">Typed variables vs byte encodings</a></h3>
<p>For Sapling, we have encountered multiple places where the specification uses typed
variables to define the consensus rules, but the C++ implementation in zcashd relied on
byte encodings to implement them. This resulted in subtly-different consensus rules being
deployed than were intended, for example where a particular type was not round-trip
encodable.</p>
<p>In Orchard, we avoid this by defining the consensus rules in terms of the byte encodings
of all variables, and being explicit about any types that are not round-trip encodable.
This makes consensus compatibility between strongly-typed implementations (such as this
crate) and byte-oriented implementations easier to achieve.</p>
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.12.0/dist/katex.min.css" integrity="sha384-AfEj0r4/OFrOo5t7NnNe46zW/tFgW6x/bCJG8FqQCEo3+Aro6EYUG4+cU+KJWu/X" crossorigin="anonymous">
<h1><a class="header" href="#actions" id="actions">Actions</a></h1>
<p>In Sprout, we had a single proof that represented two spent notes and two new notes. This
was necessary in order to faciliate spending multiple notes in a single transaction (to
balance value, an output of one JoinSplit could be spent in the next one), but also
provided a minimal level of arity-hiding: single-JoinSplit transactions all looked like
2-in 2-out transactions, and in multi-JoinSplit transactions each JoinSplit looked like a
1-in 1-out.</p>
<p>In Sapling, we switched to using value commitments to balance the transaction, removing
the min-2 arity requirement. We opted for one proof per spent note and one (much simpler)
proof per output note, which greatly improved the performance of generating outputs, but
removed any arity-hiding from the proofs (instead having the transaction builder pad
transactions to 1-in, 2-out).</p>
<p>For Orchard, we take a combined approach: we define an Orchard transaction as containing a
bundle of actions, where each action is both a spend and an output. This provides the same
inherent arity-hiding as multi-JoinSplit Sprout, but using Sapling value commitments to
balance the transaction without doubling its size.</p>
<p>TODO: Depending on the circuit cost, we <em>may</em> switch to having an action internally
represent either a spend or an output. Externally spends and outputs would still be
indistinguishable, but the transaction would be larger.</p>
<h2><a class="header" href="#memo-fields" id="memo-fields">Memo fields</a></h2>
<p>TODO: One memo per tx vs one memo per output</p>
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.12.0/dist/katex.min.css" integrity="sha384-AfEj0r4/OFrOo5t7NnNe46zW/tFgW6x/bCJG8FqQCEo3+Aro6EYUG4+cU+KJWu/X" crossorigin="anonymous">
<h1><a class="header" href="#commitments" id="commitments">Commitments</a></h1>
deploy: fe32db4be17566f28733ae21266f1a03982602a4
2021-01-21 04:15:54 -08:00
<p>As in Sapling, we require two kinds of commitment schemes in Orchard:</p>
deploy: a4fb24b724aba340595b71da9b8936b0fd4cace1
2021-01-08 09:28:54 -08:00
<ul>
deploy: fe32db4be17566f28733ae21266f1a03982602a4
2021-01-21 04:15:54 -08:00
<li><span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.8888799999999999em;vertical-align:-0.19444em;"></span><span class="mord"><span class="mord mathit">H</span><span class="mord mathit">o</span><span class="mord mathit">m</span><span class="mord mathit">o</span><span class="mord mathit">m</span><span class="mord mathit">o</span><span class="mord mathit">r</span><span class="mord mathit">p</span><span class="mord mathit">h</span><span class="mord mathit">i</span><span class="mord mathit">c</span><span class="mord mathit">C</span><span class="mord mathit">o</span><span class="mord mathit">m</span><span class="mord mathit">m</span><span class="mord mathit">i</span><span class="mord mathit">t</span></span></span></span></span> is a linearly homomorphic commitment scheme with perfect hiding,
and strong binding reducible to DL.</li>
<li><span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.68333em;vertical-align:0em;"></span><span class="mord"><span class="mord mathit">C</span><span class="mord mathit">o</span><span class="mord mathit">m</span><span class="mord mathit">m</span><span class="mord mathit">i</span><span class="mord mathit">t</span></span></span></span></span> and <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.69444em;vertical-align:0em;"></span><span class="mord"><span class="mord mathit">S</span><span class="mord mathit">h</span><span class="mord mathit">o</span><span class="mord mathit">r</span><span class="mord mathit">t</span><span class="mord mathit">C</span><span class="mord mathit">o</span><span class="mord mathit">m</span><span class="mord mathit">m</span><span class="mord mathit">i</span><span class="mord mathit">t</span></span></span></span></span> are commitment schemes with perfect hiding, and
deploy: a4fb24b724aba340595b71da9b8936b0fd4cace1
2021-01-08 09:28:54 -08:00
strong binding reducible to DL.</li>
</ul>
<p>By &quot;strong binding&quot; we mean that the scheme is collision resistant on the input and
randomness.</p>
deploy: fe32db4be17566f28733ae21266f1a03982602a4
2021-01-21 04:15:54 -08:00
<p>We instantiate <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.8888799999999999em;vertical-align:-0.19444em;"></span><span class="mord"><span class="mord mathit">H</span><span class="mord mathit">o</span><span class="mord mathit">m</span><span class="mord mathit">o</span><span class="mord mathit">m</span><span class="mord mathit">o</span><span class="mord mathit">r</span><span class="mord mathit">p</span><span class="mord mathit">h</span><span class="mord mathit">i</span><span class="mord mathit">c</span><span class="mord mathit">C</span><span class="mord mathit">o</span><span class="mord mathit">m</span><span class="mord mathit">m</span><span class="mord mathit">i</span><span class="mord mathit">t</span></span></span></span></span> with a Pedersen commitment, and use it for
value commitments:</p>
<p><span class="katex-display"><span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.44444em;vertical-align:0em;"></span><span class="mord"><span class="mord mathsf">c</span><span class="mord mathsf" style="margin-right:0.01389em;">v</span></span><span class="mspace" style="margin-right:0.2777777777777778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right:0.2777777777777778em;"></span></span><span class="base"><span class="strut" style="height:1.008448em;vertical-align:-0.25em;"></span><span class="mord"><span class="mord"><span class="mord mathit">H</span><span class="mord mathit">o</span><span class="mord mathit">m</span><span class="mord mathit">o</span><span class="mord mathit">m</span><span class="mord mathit">o</span><span class="mord mathit">r</span><span class="mord mathit">p</span><span class="mord mathit">h</span><span class="mord mathit">i</span><span class="mord mathit">c</span><span class="mord mathit">C</span><span class="mord mathit">o</span><span class="mord mathit">m</span><span class="mord mathit">m</span><span class="mord mathit">i</span><span class="mord mathit">t</span></span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:0.758448em;"><span style="top:-2.4530000000000003em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mtight"><span class="mord mathsf mtight" style="margin-right:0.01389em;">r</span><span class="mord mathsf mtight">c</span><span class="mord mathsf mtight" style="margin-right:0.01389em;">v</span></span></span></span></span><span style="top:-3.1473400000000002em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mtight"><span class="mord mathsf mtight">c</span><span class="mord mathsf mtight" style="margin-right:0.01389em;">v</span></span></span></span></span></span><span class="vlist-s">​</span></span><span class="vlist-r"><span class="vlist" style="height:0.247em;"><span></span></span></span></span></span></span><span class="mopen">(</span><span class="mord mathnormal" style="margin-right:0.03588em;">v</span><span class="mclose">)</span></span></span></span></span></p>
<p>We instantiate <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.68333em;vertical-align:0em;"></span><span class="mord"><span class="mord mathit">C</span><span class="mord mathit">o</span><span class="mord mathit">m</span><span class="mord mathit">m</span><span class="mord mathit">i</span><span class="mord mathit">t</span></span></span></span></span> and <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.69444em;vertical-align:0em;"></span><span class="mord"><span class="mord mathit">S</span><span class="mord mathit">h</span><span class="mord mathit">o</span><span class="mord mathit">r</span><span class="mord mathit">t</span><span class="mord mathit">C</span><span class="mord mathit">o</span><span class="mord mathit">m</span><span class="mord mathit">m</span><span class="mord mathit">i</span><span class="mord mathit">t</span></span></span></span></span> with Sinsemilla, and use them
for all other commitments:</p>
<p><span class="katex-display"><span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.69444em;vertical-align:0em;"></span><span class="mord"><span class="mord mathsf">i</span><span class="mord mathsf" style="margin-right:0.01389em;">v</span><span class="mord mathsf">k</span></span><span class="mspace" style="margin-right:0.2777777777777778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right:0.2777777777777778em;"></span></span><span class="base"><span class="strut" style="height:1.1834479999999998em;vertical-align:-0.25em;"></span><span class="mord"><span class="mord"><span class="mord mathit">S</span><span class="mord mathit">h</span><span class="mord mathit">o</span><span class="mord mathit">r</span><span class="mord mathit">t</span><span class="mord mathit">C</span><span class="mord mathit">o</span><span class="mord mathit">m</span><span class="mord mathit">m</span><span class="mord mathit">i</span><span class="mord mathit">t</span></span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:0.9334479999999998em;"><span style="top:-2.4530000000000003em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mtight"><span class="mord mathsf mtight" style="margin-right:0.01389em;">r</span><span class="mord mathsf mtight">i</span><span class="mord mathsf mtight" style="margin-right:0.01389em;">v</span><span class="mord mathsf mtight">k</span></span></span></span></span><span style="top:-3.1473400000000002em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mtight"><span class="mord mathsf mtight">i</span><span class="mord mathsf mtight" style="margin-right:0.01389em;">v</span><span class="mord mathsf mtight">k</span></span></span></span></span></span><span class="vlist-s">​</span></span><span class="vlist-r"><span class="vlist" style="height:0.247em;"><span></span></span></span></span></span></span><span class="mopen">(</span><span class="mord"><span class="mord mathsf">a</span><span class="mord mathsf">k</span></span><span class="mpunct">,</span><span class="mspace" style="margin-right:0.16666666666666666em;"></span><span class="mord"><span class="mord mathsf">n</span><span class="mord mathsf">k</span></span><span class="mclose">)</span></span></span></span></span>
<span class="katex-display"><span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.44444em;vertical-align:0em;"></span><span class="mord"><span class="mord mathsf">c</span><span class="mord mathsf">m</span></span><span class="mspace" style="margin-right:0.2777777777777778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right:0.2777777777777778em;"></span></span><span class="base"><span class="strut" style="height:1em;vertical-align:-0.25em;"></span><span class="mord"><span class="mord"><span class="mord mathit">C</span><span class="mord mathit">o</span><span class="mord mathit">m</span><span class="mord mathit">m</span><span class="mord mathit">i</span><span class="mord mathit">t</span></span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:0.7473380000000001em;"><span style="top:-2.4530000000000003em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mtight"><span class="mord mathsf mtight" style="margin-right:0.01389em;">r</span><span class="mord mathsf mtight">c</span><span class="mord mathsf mtight">m</span></span></span></span></span><span style="top:-3.1362300000000003em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mtight"><span class="mord mathsf mtight">c</span><span class="mord mathsf mtight">m</span></span></span></span></span></span><span class="vlist-s">​</span></span><span class="vlist-r"><span class="vlist" style="height:0.247em;"><span></span></span></span></span></span></span><span class="mopen">(</span><span class="mord text"><span class="mord">rest of note</span></span><span class="mclose">)</span></span></span></span></span></p>
deploy: a4fb24b724aba340595b71da9b8936b0fd4cace1
2021-01-08 09:28:54 -08:00
<p>This is the same split (and rationale) as in Sapling, but using the more PLONK-efficient
deploy: fe32db4be17566f28733ae21266f1a03982602a4
2021-01-21 04:15:54 -08:00
Sinsemilla instead of Bowe--Hopwood Pedersen hashes.</p>
<p>Note that we also deviate from Sapling by using <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.69444em;vertical-align:0em;"></span><span class="mord"><span class="mord mathit">S</span><span class="mord mathit">h</span><span class="mord mathit">o</span><span class="mord mathit">r</span><span class="mord mathit">t</span><span class="mord mathit">C</span><span class="mord mathit">o</span><span class="mord mathit">m</span><span class="mord mathit">m</span><span class="mord mathit">i</span><span class="mord mathit">t</span></span></span></span></span> to deriving <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.69444em;vertical-align:0em;"></span><span class="mord"><span class="mord mathsf">i</span><span class="mord mathsf" style="margin-right:0.01389em;">v</span><span class="mord mathsf">k</span></span></span></span></span>
deploy: a4fb24b724aba340595b71da9b8936b0fd4cace1
2021-01-08 09:28:54 -08:00
instead of a full PRF. This removes an unnecessary (large) PRF primitive from the circuit,
at the cost of requiring <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.69444em;vertical-align:0em;"></span><span class="mord"><span class="mord mathsf" style="margin-right:0.01389em;">r</span><span class="mord mathsf">i</span><span class="mord mathsf" style="margin-right:0.01389em;">v</span><span class="mord mathsf">k</span></span></span></span></span> to be part of the full viewing key.</p>
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.12.0/dist/katex.min.css" integrity="sha384-AfEj0r4/OFrOo5t7NnNe46zW/tFgW6x/bCJG8FqQCEo3+Aro6EYUG4+cU+KJWu/X" crossorigin="anonymous">
<h1><a class="header" href="#commitment-tree" id="commitment-tree">Commitment tree</a></h1>
<p>One of the things we learned from Sapling is that having a single global commitment tree
makes life hard for light client wallets. When a new note is received, the wallet derives
its incremental witness from the state of the global tree at the point when the note's
commitment is appended; this incremental state then needs to be updated with every
subsequent commitment in the block in-order. It isn't efficient for a server to
pre-compute and send over the necessary incremental updates for every new note in a block,
and if a wallet requested a specific update from the server it would leak the specific
note that was received.</p>
<p>Orchard addresses this by splitting the commitment tree into several sub-trees:</p>
<ul>
<li>Bundle tree, that accumulates the commitments within a single bundle (and thus a single
transaction).</li>
<li>Block tree, that accumulates the bundle tree roots within a single block.</li>
<li>Global tree, that accumulates the block tree roots.</li>
</ul>
<p>Each of these trees has a fixed depth (necessary for being able to create proofs).</p>
<p>Chains that integrate Orchard can decouple the limits on commitments-per-subtree from
higher-layer constraints like block size, by enabling their blocks and transactions to be
structured internally as a series of Orchard blocks or txs (e.g. a Zcash block would
contain a <code>Vec&lt;BlockTreeRoot&gt;</code>, that each get appended in-order).</p>
<p>Zcash level: we also bind these roots into the FlyClient history leaves, so that light
clients can assert they are valid independently of the full block.</p>
<p>TODO: Sean is pretty sure we can just improve the Incremental Merkle Tree implementation
to work around this, without domain-separating the tree. If we can do that instead, it may
be simpler.</p>
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.12.0/dist/katex.min.css" integrity="sha384-AfEj0r4/OFrOo5t7NnNe46zW/tFgW6x/bCJG8FqQCEo3+Aro6EYUG4+cU+KJWu/X" crossorigin="anonymous">
<h1><a class="header" href="#nullifiers" id="nullifiers">Nullifiers</a></h1>
<p>The nullifier design we use for Orchard is</p>
deploy: fe32db4be17566f28733ae21266f1a03982602a4
2021-01-21 04:15:54 -08:00
<p><span class="katex-display"><span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.69444em;vertical-align:0em;"></span><span class="mord"><span class="mord mathsf">n</span><span class="mord mathsf" style="margin-right:0.06944em;">f</span></span><span class="mspace" style="margin-right:0.2777777777777778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right:0.2777777777777778em;"></span></span><span class="base"><span class="strut" style="height:1em;vertical-align:-0.25em;"></span><span class="mopen">[</span><span class="mord"><span class="mord mathnormal" style="margin-right:0.13889em;">F</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:0.33610799999999996em;"><span style="top:-2.5500000000000003em;margin-left:-0.13889em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mtight"><span class="mord mathsf mtight">n</span><span class="mord mathsf mtight">k</span></span></span></span></span></span><span class="vlist-s">​</span></span><span class="vlist-r"><span class="vlist" style="height:0.15em;"><span></span></span></span></span></span></span><span class="mopen">(</span><span class="mord mathnormal">ρ</span><span class="mclose">)</span><span class="mspace" style="margin-right:0.2222222222222222em;"></span><span class="mbin">+</span><span class="mspace" style="margin-right:0.2222222222222222em;"></span></span><span class="base"><span class="strut" style="height:0.8888799999999999em;vertical-align:-0.19444em;"></span><span class="mord mathnormal" style="margin-right:0.03588em;">ψ</span><span class="mspace allowbreak"></span><span class="mspace" style="margin-right:1em;"></span></span><span class="base"><span class="strut" style="height:1em;vertical-align:-0.25em;"></span><span class="mopen">(</span><span class="mord"><span class="mord"><span class="mord mathrm">m</span><span class="mord mathrm">o</span><span class="mord mathrm">d</span></span></span><span class="mspace" style="margin-right:0.3333333333333333em;"></span><span class="mord mathnormal">p</span><span class="mclose">)</span><span class="mclose">]</span><span class="mord"><span class="mord mathcal" style="margin-right:0.0593em;">G</span></span><span class="mspace" style="margin-right:0.2222222222222222em;"></span><span class="mbin">+</span><span class="mspace" style="margin-right:0.2222222222222222em;"></span></span><span class="base"><span class="strut" style="height:0.63888em;vertical-align:-0.19444em;"></span><span class="mord"><span class="mord mathsf">c</span><span class="mord mathsf">m</span></span><span class="mpunct">,</span></span></span></span></span></p>
deploy: a4fb24b724aba340595b71da9b8936b0fd4cace1
2021-01-08 09:28:54 -08:00
<p>where:</p>
<ul>
deploy: fe32db4be17566f28733ae21266f1a03982602a4
2021-01-21 04:15:54 -08:00
<li><span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.68333em;vertical-align:0em;"></span><span class="mord mathnormal" style="margin-right:0.13889em;">F</span></span></span></span> is a keyed circuit-efficient PRF (such as Rescue or Poseidon).</li>
<li><span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.625em;vertical-align:-0.19444em;"></span><span class="mord mathnormal">ρ</span></span></span></span> is unique to this output. As with <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.980548em;vertical-align:-0.286108em;"></span><span class="mord"><span class="mord"><span class="mord mathsf">h</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:0.3361079999999999em;"><span style="top:-2.5500000000000003em;margin-left:0em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mathsf mtight">S</span><span class="mord mathsf mtight">i</span><span class="mord mathsf mtight" style="margin-right:0.01389em;">g</span></span></span></span></span><span class="vlist-s">​</span></span><span class="vlist-r"><span class="vlist" style="height:0.286108em;"><span></span></span></span></span></span></span></span></span></span></span> in Sprout, <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.625em;vertical-align:-0.19444em;"></span><span class="mord mathnormal">ρ</span></span></span></span> includes
the nullifiers of any Orchard notes being spent in the same action. Given that an action
consists of a single spend and a single output, we set <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.625em;vertical-align:-0.19444em;"></span><span class="mord mathnormal">ρ</span></span></span></span> to be the nullifier of the
spent note.</li>
deploy: a4fb24b724aba340595b71da9b8936b0fd4cace1
2021-01-08 09:28:54 -08:00
<li><span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.8888799999999999em;vertical-align:-0.19444em;"></span><span class="mord mathnormal" style="margin-right:0.03588em;">ψ</span></span></span></span> is sender-controlled randomness. It is not required to be unique, and in practice
deploy: f3a51fa6f420ec0d21bb92e6eddab84316432055
2021-01-08 17:01:47 -08:00
is derived from both <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.625em;vertical-align:-0.19444em;"></span><span class="mord mathnormal">ρ</span></span></span></span> and a sender-selected random value <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.69444em;vertical-align:0em;"></span><span class="mord"><span class="mord mathsf" style="margin-right:0.01389em;">r</span><span class="mord mathsf">s</span><span class="mord mathsf">e</span><span class="mord mathsf">e</span><span class="mord mathsf">d</span></span></span></span></span>:
deploy: fe32db4be17566f28733ae21266f1a03982602a4
2021-01-21 04:15:54 -08:00
<span class="katex-display"><span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.8888799999999999em;vertical-align:-0.19444em;"></span><span class="mord mathnormal" style="margin-right:0.03588em;">ψ</span><span class="mspace" style="margin-right:0.2777777777777778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right:0.2777777777777778em;"></span></span><span class="base"><span class="strut" style="height:1.149108em;vertical-align:-0.25em;"></span><span class="mord mathnormal" style="margin-right:0.07153em;">K</span><span class="mord mathnormal" style="margin-right:0.02778em;">D</span><span class="mord"><span class="mord mathnormal" style="margin-right:0.13889em;">F</span><span class="msupsub"><span class="vlist-t"><span class="vlist-r"><span class="vlist" style="height:0.8991079999999999em;"><span style="top:-3.1130000000000004em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight" style="margin-right:0.03588em;">ψ</span></span></span></span></span></span></span></span><span class="mopen">(</span><span class="mord mathnormal">ρ</span><span class="mpunct">,</span><span class="mspace" style="margin-right:0.16666666666666666em;"></span><span class="mord"><span class="mord mathsf" style="margin-right:0.01389em;">r</span><span class="mord mathsf">s</span><span class="mord mathsf">e</span><span class="mord mathsf">e</span><span class="mord mathsf">d</span></span><span class="mclose">)</span><span class="mord">.</span></span></span></span></span></li>
<li><span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.78055em;vertical-align:-0.09722em;"></span><span class="mord"><span class="mord mathcal" style="margin-right:0.0593em;">G</span></span></span></span></span> is a fixed independent base.</li>
deploy: a4fb24b724aba340595b71da9b8936b0fd4cace1
2021-01-08 09:28:54 -08:00
</ul>
<p>This gives a note structure of</p>
deploy: fe32db4be17566f28733ae21266f1a03982602a4
2021-01-21 04:15:54 -08:00
<p><span class="katex-display"><span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:1em;vertical-align:-0.25em;"></span><span class="mopen">(</span><span class="mord mathnormal">a</span><span class="mord mathnormal">d</span><span class="mord mathnormal">d</span><span class="mord mathnormal" style="margin-right:0.02778em;">r</span><span class="mpunct">,</span><span class="mspace" style="margin-right:0.16666666666666666em;"></span><span class="mord mathnormal" style="margin-right:0.03588em;">v</span><span class="mpunct">,</span><span class="mspace" style="margin-right:0.16666666666666666em;"></span><span class="mord mathnormal">ρ</span><span class="mpunct">,</span><span class="mspace" style="margin-right:0.16666666666666666em;"></span><span class="mord mathnormal" style="margin-right:0.03588em;">ψ</span><span class="mpunct">,</span><span class="mspace" style="margin-right:0.16666666666666666em;"></span><span class="mord"><span class="mord mathsf" style="margin-right:0.01389em;">r</span><span class="mord mathsf">c</span><span class="mord mathsf">m</span></span><span class="mclose">)</span><span class="mord">.</span></span></span></span></span></p>
<p>The note plaintext includes <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.69444em;vertical-align:0em;"></span><span class="mord"><span class="mord mathsf" style="margin-right:0.01389em;">r</span><span class="mord mathsf">s</span><span class="mord mathsf">e</span><span class="mord mathsf">e</span><span class="mord mathsf">d</span></span></span></span></span> in place of <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.8888799999999999em;vertical-align:-0.19444em;"></span><span class="mord mathnormal" style="margin-right:0.03588em;">ψ</span></span></span></span> and <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.44444em;vertical-align:0em;"></span><span class="mord"><span class="mord mathsf" style="margin-right:0.01389em;">r</span><span class="mord mathsf">c</span><span class="mord mathsf">m</span></span></span></span></span>, and
omits <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.625em;vertical-align:-0.19444em;"></span><span class="mord mathnormal">ρ</span></span></span></span> (which is a public part of the action).</p>
deploy: a4fb24b724aba340595b71da9b8936b0fd4cace1
2021-01-08 09:28:54 -08:00
<h2><a class="header" href="#security-properties" id="security-properties">Security properties</a></h2>
<p>We care about several security properties for our nullifiers:</p>
<ul>
<li>
<p><strong>Balance:</strong> can I forge money?</p>
</li>
<li>
<p><strong>Note Privacy:</strong> can I gain information about notes only from the public block chain?</p>
<ul>
<li>This describes notes sent in-band.</li>
</ul>
</li>
<li>
<p><strong>Note Privacy (OOB):</strong> can I gain information about notes sent out-of-band, only from
the public block chain?</p>
<ul>
<li>In this case, we assume privacy of the channel over which the note is sent, and that
the adversary does not have access to any notes sent to the same address which are
then spent (so that the nullifier is on the block chain somewhere).</li>
</ul>
</li>
<li>
<p><strong>Spend Unlinkability:</strong> given the incoming viewing key for an address, and not the full
viewing key, can I (possibly the sender) detect spends of any notes sent to that address?</p>
<ul>
deploy: fe32db4be17566f28733ae21266f1a03982602a4
2021-01-21 04:15:54 -08:00
<li>We're giving <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.69444em;vertical-align:0em;"></span><span class="mord"><span class="mord mathsf">i</span><span class="mord mathsf" style="margin-right:0.01389em;">v</span><span class="mord mathsf">k</span></span></span></span></span> to the attacker and allowing it to be the sender in order
to make this property as strong as possible: they will have <em>all</em> the notes sent to that
deploy: a4fb24b724aba340595b71da9b8936b0fd4cace1
2021-01-08 09:28:54 -08:00
address.</li>
</ul>
</li>
<li>
<p><strong>Faerie Resistance:</strong> can I perform a Faerie Gold attack (i.e. cause notes to be
accepted that are unspendable)?</p>
deploy: f3a51fa6f420ec0d21bb92e6eddab84316432055
2021-01-08 17:01:47 -08:00
<ul>
<li>We're giving the full viewing key to the attacker and allowing it to be the sender in
order to make this property as strong as possible: they will have <em>all</em> the notes sent
to that address, and be able to derive <em>every</em> nullifier.</li>
</ul>
deploy: a4fb24b724aba340595b71da9b8936b0fd4cace1
2021-01-08 09:28:54 -08:00
</li>
</ul>
<p>We assume (and instantiate elsewhere) the following primitives:</p>
<ul>
deploy: fe32db4be17566f28733ae21266f1a03982602a4
2021-01-21 04:15:54 -08:00
<li><span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.68333em;vertical-align:0em;"></span><span class="mord mathnormal">G</span><span class="mord mathnormal" style="margin-right:0.08125em;">H</span></span></span></span> is a cryptographic hash into the group (such as BLAKE2s with simplified SWU), used
to derive all fixed independent bases.</li>
deploy: a4fb24b724aba340595b71da9b8936b0fd4cace1
2021-01-08 09:28:54 -08:00
<li><span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.68333em;vertical-align:0em;"></span><span class="mord mathnormal" style="margin-right:0.05764em;">E</span></span></span></span> is an elliptic curve (such as Pallas).</li>
<li><span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.68333em;vertical-align:0em;"></span><span class="mord mathnormal" style="margin-right:0.07153em;">K</span><span class="mord mathnormal" style="margin-right:0.02778em;">D</span><span class="mord mathnormal" style="margin-right:0.13889em;">F</span></span></span></span> is the note encryption key derivation function.</li>
</ul>
<p>For our chosen design, our desired security properties rely on the following assumptions:</p>
deploy: fe32db4be17566f28733ae21266f1a03982602a4
2021-01-21 04:15:54 -08:00
<p><span class="katex-display"><span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:6.252687em;vertical-align:-2.8563434999999995em;"></span><span class="mord"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:3.3963435000000004em;"><span style="top:-5.3563434999999995em;"><span class="pstrut" style="height:5.3563434999999995em;"></span><span class="mtable"><span class="vertical-separator" style="height:6.212687em;border-right-width:0.04em;border-right-style:solid;margin:0 -0.02em;vertical-align:-2.8563435em;"></span><span class="arraycolsep" style="width:0.5em;"></span><span class="col-align-l"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:3.3563435em;"><span style="top:-5.5163435000000005em;"><span class="pstrut" style="height:3em;"></span><span class="mord"><span class="mord text"><span class="mord">Balance</span></span></span></span><span style="top:-4.2306725em;"><span class="pstrut" style="height:3em;"></span><span class="mord"><span class="mord text"><span class="mord">Note Privacy</span></span></span></span><span style="top:-3.0306725em;"><span class="pstrut" style="height:3em;"></span><span class="mord"><span class="mord text"><span class="mord">Note Privacy (OOB)</span></span></span></span><span style="top:-1.7036565000000008em;"><span class="pstrut" style="height:3em;"></span><span class="mord"><span class="mord text"><span class="mord">Spend Unlinkability</span></span></span></span><span style="top:-0.5036565000000006em;"><span class="pstrut" style="height:3em;"></span><span class="mord"><span class="mord text"><span class="mord">Faerie Resistance</span></span></span></span></span><span class="vlist-s">​</span></span><span class="vlist-r"><span class="vlist" style="height:2.8563434999999995em;"><span></span></span></span></span></span><span class="arraycolsep" style="width:0.5em;"></span><span class="vertical-separator" style="height:6.212687em;border-right-width:0.04em;border-right-style:solid;margin:0 -0.02em;vertical-align:-2.8563435em;"></span><span class="arraycolsep" style="width:0.5em;"></span><span class="col-align-l"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:3.3563435em;"><span style="top:-5.5163435000000005em;"><span class="pstrut" style="height:3em;"></span><span class="mord"><span class="mord mathnormal" style="margin-right:0.02778em;">D</span><span class="mord"><span class="mord mathnormal">L</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:0.32833099999999993em;"><span style="top:-2.5500000000000003em;margin-left:0em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight" style="margin-right:0.05764em;">E</span></span></span></span><span class="vlist-s">​</span></span><span class="vlist-r"><span class="vlist" style="height:0.15em;"><span></span></span></span></span></span></span></span></span><span style="top:-4.2306725em;"><span class="pstrut" style="height:3em;"></span><span class="mord"><span class="mord"><span class="mord"><span class="mord mathit">H</span><span class="mord mathit">a</span><span class="mord mathit">s</span><span class="mord mathit">h</span><span class="mord mathit">D</span><span class="mord mathit">H</span></span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:0.9256709999999999em;"><span style="top:-2.4530000000000003em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight" style="margin-right:0.05764em;">E</span></span></span><span style="top:-3.1473400000000002em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mathnormal mtight" style="margin-righ
<p><span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:1.1726709999999998em;vertical-align:-0.247em;"></span><span class="mord"><span class="mord"><span class="mord mathit">H</span><span class="mord mathit">a</span><span class="mord mathit">s</span><span class="mord mathit">h</span><span class="mord mathit">D</span><span class="mord mathit">H</span></span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:0.9256709999999999em;"><span style="top:-2.4530000000000003em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight" style="margin-right:0.05764em;">E</span></span></span><span style="top:-3.1473400000000002em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mathnormal mtight" style="margin-right:0.07153em;">K</span><span class="mord mathnormal mtight" style="margin-right:0.02778em;">D</span><span class="mord mathnormal mtight" style="margin-right:0.13889em;">F</span></span></span></span></span><span class="vlist-s">​</span></span><span class="vlist-r"><span class="vlist" style="height:0.247em;"><span></span></span></span></span></span></span></span></span></span> is computational Diffie-Hellman using <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.68333em;vertical-align:0em;"></span><span class="mord mathnormal" style="margin-right:0.07153em;">K</span><span class="mord mathnormal" style="margin-right:0.02778em;">D</span><span class="mord mathnormal" style="margin-right:0.13889em;">F</span></span></span></span> for the key derivation, with
deploy: a4fb24b724aba340595b71da9b8936b0fd4cace1
2021-01-08 09:28:54 -08:00
one-time ephemeral keys. This assumption is heuristically weaker than <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.83333em;vertical-align:-0.15em;"></span><span class="mord mathnormal" style="margin-right:0.02778em;">D</span><span class="mord mathnormal" style="margin-right:0.02778em;">D</span><span class="mord"><span class="mord mathnormal" style="margin-right:0.08125em;">H</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:0.32833099999999993em;"><span style="top:-2.5500000000000003em;margin-left:-0.08125em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight" style="margin-right:0.05764em;">E</span></span></span></span><span class="vlist-s">​</span></span><span class="vlist-r"><span class="vlist" style="height:0.15em;"><span></span></span></span></span></span></span></span></span></span> but stronger
than <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.83333em;vertical-align:-0.15em;"></span><span class="mord mathnormal" style="margin-right:0.02778em;">D</span><span class="mord"><span class="mord mathnormal">L</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:0.32833099999999993em;"><span style="top:-2.5500000000000003em;margin-left:0em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight" style="margin-right:0.05764em;">E</span></span></span></span><span class="vlist-s">​</span></span><span class="vlist-r"><span class="vlist" style="height:0.15em;"><span></span></span></span></span></span></span></span></span></span>.</p>
deploy: fe32db4be17566f28733ae21266f1a03982602a4
2021-01-21 04:15:54 -08:00
<p>We omit <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.83333em;vertical-align:-0.15em;"></span><span class="mord mathnormal" style="margin-right:0.00773em;">R</span><span class="mord"><span class="mord mathnormal" style="margin-right:0.02778em;">O</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:0.32833099999999993em;"><span style="top:-2.5500000000000003em;margin-left:-0.02778em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mathnormal mtight">G</span><span class="mord mathnormal mtight" style="margin-right:0.08125em;">H</span></span></span></span></span><span class="vlist-s">​</span></span><span class="vlist-r"><span class="vlist" style="height:0.15em;"><span></span></span></span></span></span></span></span></span></span> as a security assumption because we only rely on the random oracle
applied to fixed inputs defined by the protocol, i.e. to generate the fixed base
<span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.78055em;vertical-align:-0.09722em;"></span><span class="mord"><span class="mord mathcal" style="margin-right:0.0593em;">G</span></span></span></span></span>, not to attacker-specified inputs.</p>
deploy: a4fb24b724aba340595b71da9b8936b0fd4cace1
2021-01-08 09:28:54 -08:00
<blockquote>
deploy: f3a51fa6f420ec0d21bb92e6eddab84316432055
2021-01-08 17:01:47 -08:00
<p><span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.8888799999999999em;vertical-align:-0.19444em;"></span><span class="mord">†</span></span></span></span> We additionally assume that for any input <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.43056em;vertical-align:0em;"></span><span class="mord mathnormal">x</span></span></span></span>,
deploy: fe32db4be17566f28733ae21266f1a03982602a4
2021-01-21 04:15:54 -08:00
<span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:1em;vertical-align:-0.25em;"></span><span class="mopen">{</span><span class="mord"><span class="mord mathnormal" style="margin-right:0.13889em;">F</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:0.33610799999999996em;"><span style="top:-2.5500000000000003em;margin-left:-0.13889em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mtight"><span class="mord mathsf mtight">n</span><span class="mord mathsf mtight">k</span></span></span></span></span></span><span class="vlist-s">​</span></span><span class="vlist-r"><span class="vlist" style="height:0.15em;"><span></span></span></span></span></span></span><span class="mopen">(</span><span class="mord mathnormal">x</span><span class="mclose">)</span><span class="mspace" style="margin-right:0.2777777777777778em;"></span><span class="mrel">:</span><span class="mspace" style="margin-right:0.2777777777777778em;"></span></span><span class="base"><span class="strut" style="height:0.73354em;vertical-align:-0.0391em;"></span><span class="mord"><span class="mord mathsf">n</span><span class="mord mathsf">k</span></span><span class="mspace" style="margin-right:0.2777777777777778em;"></span><span class="mrel">∈</span><span class="mspace" style="margin-right:0.2777777777777778em;"></span></span><span class="base"><span class="strut" style="height:1em;vertical-align:-0.25em;"></span><span class="mord mathnormal" style="margin-right:0.05764em;">E</span><span class="mclose">}</span></span></span></span> gives a scalar in an adequate range for
<span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.83333em;vertical-align:-0.15em;"></span><span class="mord mathnormal" style="margin-right:0.02778em;">D</span><span class="mord mathnormal" style="margin-right:0.02778em;">D</span><span class="mord"><span class="mord mathnormal" style="margin-right:0.08125em;">H</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:0.32833099999999993em;"><span style="top:-2.5500000000000003em;margin-left:-0.08125em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight" style="margin-right:0.05764em;">E</span></span></span></span><span class="vlist-s">​</span></span><span class="vlist-r"><span class="vlist" style="height:0.15em;"><span></span></span></span></span></span></span></span></span></span>. (Otherwise, <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.68333em;vertical-align:0em;"></span><span class="mord mathnormal" style="margin-right:0.13889em;">F</span></span></span></span> could be trivial, e.g. independent of <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.69444em;vertical-align:0em;"></span><span class="mord"><span class="mord mathsf">n</span><span class="mord mathsf">k</span></span></span></span></span>.)</p>
<p><span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.8888799999999999em;vertical-align:-0.19444em;"></span><span class="mord">‡</span></span></span></span> Statistical distance <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.5782em;vertical-align:-0.0391em;"></span><span class="mrel">&lt;</span><span class="mspace" style="margin-right:0.2777777777777778em;"></span></span><span class="base"><span class="strut" style="height:0.8141079999999999em;vertical-align:0em;"></span><span class="mord"><span class="mord">2</span><span class="msupsub"><span class="vlist-t"><span class="vlist-r"><span class="vlist" style="height:0.8141079999999999em;"><span style="top:-3.063em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mtight">−</span><span class="mord mtight">1</span><span class="mord mtight">6</span><span class="mord mtight">7</span><span class="mord mtight">.</span><span class="mord mtight">8</span></span></span></span></span></span></span></span></span></span></span></span> from perfect.</p>
deploy: a4fb24b724aba340595b71da9b8936b0fd4cace1
2021-01-08 09:28:54 -08:00
</blockquote>
<h2><a class="header" href="#considered-alternatives" id="considered-alternatives">Considered alternatives</a></h2>
<p><span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.69444em;vertical-align:0em;"></span><span class="mord" style="color:red;"><span class="mord text" style="color:red;"><span class="mord" style="color:red;">⚠</span><span class="mord textsf" style="color:red;"> Caution</span></span></span></span></span></span>: be skeptical of the claims in this table about what
problem(s) each security property depends on. They may not be accurate and are definitely
not fully rigorous.</p>
deploy: fe32db4be17566f28733ae21266f1a03982602a4
2021-01-21 04:15:54 -08:00
<p><span class="katex-display"><span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:20.979859999999995em;vertical-align:-10.219929999999998em;"></span><span class="mord"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:10.759929999999997em;"><span style="top:-12.719929999999998em;"><span class="pstrut" style="height:12.719929999999998em;"></span><span class="mtable"><span class="vertical-separator" style="height:20.939859999999996em;border-right-width:0.04em;border-right-style:solid;margin:0 -0.02em;vertical-align:-10.219929999999998em;"></span><span class="arraycolsep" style="width:0.5em;"></span><span class="col-align-c"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:10.719929999999998em;"><span style="top:-12.879929999999998em;"><span class="pstrut" style="height:3em;"></span><span class="mord"><span class="mord"><span class="mord mathsf">n</span><span class="mord mathsf" style="margin-right:0.06944em;">f</span></span></span></span><span style="top:-11.594258999999996em;"><span class="pstrut" style="height:3em;"></span><span class="mord"><span class="mopen">[</span><span class="mord"><span class="mord mathsf">n</span><span class="mord mathsf">k</span></span><span class="mclose">]</span><span class="mopen">[</span><span class="mord mathnormal" style="margin-right:0.02778em;">θ</span><span class="mclose">]</span><span class="mord mathnormal" style="margin-right:0.08125em;">H</span></span></span><span style="top:-10.308587999999997em;"><span class="pstrut" style="height:3em;"></span><span class="mord"><span class="mopen">[</span><span class="mord"><span class="mord mathsf">n</span><span class="mord mathsf">k</span></span><span class="mclose">]</span><span class="mord mathnormal" style="margin-right:0.08125em;">H</span><span class="mspace" style="margin-right:0.2222222222222222em;"></span><span class="mbin">+</span><span class="mspace" style="margin-right:0.2222222222222222em;"></span><span class="mopen">[</span><span class="mord"><span class="mord mathsf" style="margin-right:0.01389em;">r</span><span class="mord mathsf">n</span><span class="mord mathsf" style="margin-right:0.06944em;">f</span></span><span class="mclose">]</span><span class="mord"><span class="mord mathcal" style="margin-right:0.07382em;">I</span></span></span></span><span style="top:-9.022916999999996em;"><span class="pstrut" style="height:3em;"></span><span class="mord"><span class="mord"><span class="mord mathit">H</span><span class="mord mathit">a</span><span class="mord mathit">s</span><span class="mord mathit">h</span></span><span class="mopen">(</span><span class="mopen">[</span><span class="mord"><span class="mord mathsf">n</span><span class="mord mathsf">k</span></span><span class="mclose">]</span><span class="mopen">[</span><span class="mord mathnormal" style="margin-right:0.02778em;">θ</span><span class="mclose">]</span><span class="mord mathnormal" style="margin-right:0.08125em;">H</span><span class="mclose">)</span></span></span><span style="top:-7.737245999999997em;"><span class="pstrut" style="height:3em;"></span><span class="mord"><span class="mord"><span class="mord mathit">H</span><span class="mord mathit">a</span><span class="mord mathit">s</span><span class="mord mathit">h</span></span><span class="mopen">(</span><span class="mopen">[</span><span class="mord"><span class="mord mathsf">n</span><span class="mord mathsf">k</span></span><span class="mclose">]</span><span class="mord mathnormal" style="margin-right:0.08125em;">H</span><span class="mspace" style="margin-right:0.2222222222222222em;"></span><span class="mbin">+</span><span class="mspace" style="margin-right:0.2222222222222222em;"></span><span class="mopen">[</span><span class="mord"><span class="mord mathsf" style="margin-right:0.01389em;">r</span><span class="mord mathsf">n</span><span class="mord mathsf" style="margin-right:0.06944em;">f</span></span><span class="mclose">]</span><span class="mord"><span class="mord mathcal" style="m
deploy: a4fb24b724aba340595b71da9b8936b0fd4cace1
2021-01-08 09:28:54 -08:00
<p>In the above alternatives:</p>
<ul>
deploy: fe32db4be17566f28733ae21266f1a03982602a4
2021-01-21 04:15:54 -08:00
<li>
<p><span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.69444em;vertical-align:0em;"></span><span class="mord"><span class="mord mathit">H</span><span class="mord mathit">a</span><span class="mord mathit">s</span><span class="mord mathit">h</span></span></span></span></span> is a keyed circuit-efficient hash (such as Rescue).</p>
</li>
<li>
<p><span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.68333em;vertical-align:0em;"></span><span class="mord"><span class="mord mathcal" style="margin-right:0.07382em;">I</span></span></span></span></span> is an fixed independent base, independent of <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.78055em;vertical-align:-0.09722em;"></span><span class="mord"><span class="mord mathcal" style="margin-right:0.0593em;">G</span></span></span></span></span> and any others
returned by <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.68333em;vertical-align:0em;"></span><span class="mord mathnormal">G</span><span class="mord mathnormal" style="margin-right:0.08125em;">H</span></span></span></span>.</p>
</li>
<li>
<p><span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.83333em;vertical-align:-0.15em;"></span><span class="mord"><span class="mord"><span class="mord mathcal" style="margin-right:0.0593em;">G</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:0.151392em;"><span style="top:-2.5500000000000003em;margin-left:-0.0593em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight" style="margin-right:0.03588em;">v</span></span></span></span><span class="vlist-s">​</span></span><span class="vlist-r"><span class="vlist" style="height:0.15em;"><span></span></span></span></span></span></span></span></span></span></span> is a pair of fixed independent bases (independent of all others), where
the specific choice of base depends on whether the note has zero value.</p>
</li>
<li>
<p><span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.68333em;vertical-align:0em;"></span><span class="mord mathnormal" style="margin-right:0.08125em;">H</span></span></span></span> is a base unique to this output.</p>
<ul>
<li>For non-zero-valued notes, <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.68333em;vertical-align:0em;"></span><span class="mord mathnormal" style="margin-right:0.08125em;">H</span><span class="mspace" style="margin-right:0.2777777777777778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right:0.2777777777777778em;"></span></span><span class="base"><span class="strut" style="height:1em;vertical-align:-0.25em;"></span><span class="mord mathnormal">G</span><span class="mord mathnormal" style="margin-right:0.08125em;">H</span><span class="mopen">(</span><span class="mord mathnormal">ρ</span><span class="mclose">)</span></span></span></span>. As with <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.980548em;vertical-align:-0.286108em;"></span><span class="mord"><span class="mord"><span class="mord mathsf">h</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:0.3361079999999999em;"><span style="top:-2.5500000000000003em;margin-left:0em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mathsf mtight">S</span><span class="mord mathsf mtight">i</span><span class="mord mathsf mtight" style="margin-right:0.01389em;">g</span></span></span></span></span><span class="vlist-s">​</span></span><span class="vlist-r"><span class="vlist" style="height:0.286108em;"><span></span></span></span></span></span></span></span></span></span></span> in Sprout,
<span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.625em;vertical-align:-0.19444em;"></span><span class="mord mathnormal">ρ</span></span></span></span> includes the nullifiers of any Orchard notes being spent in the same action.</li>
<li>For zero-valued notes, <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.68333em;vertical-align:0em;"></span><span class="mord mathnormal" style="margin-right:0.08125em;">H</span></span></span></span> is constrained by the circuit to a fixed base independent
of <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.68333em;vertical-align:0em;"></span><span class="mord"><span class="mord mathcal" style="margin-right:0.07382em;">I</span></span></span></span></span> and any others returned by <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.68333em;vertical-align:0em;"></span><span class="mord mathnormal">G</span><span class="mord mathnormal" style="margin-right:0.08125em;">H</span></span></span></span>.</li>
</ul>
</li>
</ul>
<h2><a class="header" href="#rationale" id="rationale">Rationale</a></h2>
<p>In order to satisfy the <strong>Balance</strong> security property, we require that the circuit must be
able to enforce that only one nullifier is accepted for a given note. As in Sprout and
Sapling, we achieve this by ensuring that the nullifier deterministically depends only on
values committed to (directly or indirectly) by the note commitment. As in Sapling,
this involves arguing that:</p>
<ul>
<li>There can be only one <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.69444em;vertical-align:0em;"></span><span class="mord"><span class="mord mathsf">i</span><span class="mord mathsf" style="margin-right:0.01389em;">v</span><span class="mord mathsf">k</span></span></span></span></span> for a given <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.69444em;vertical-align:0em;"></span><span class="mord"><span class="mord mathit">a</span><span class="mord mathit">d</span><span class="mord mathit">d</span><span class="mord mathit">r</span></span></span></span></span>. This is true because
the circuit checks that <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.8888799999999999em;vertical-align:-0.19444em;"></span><span class="mord"><span class="mord mathsf">p</span><span class="mord"><span class="mord mathsf">k</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:0.33610799999999996em;"><span style="top:-2.5500000000000003em;margin-left:0em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathsf mtight">d</span></span></span></span><span class="vlist-s">​</span></span><span class="vlist-r"><span class="vlist" style="height:0.15em;"><span></span></span></span></span></span></span></span><span class="mspace" style="margin-right:0.2777777777777778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right:0.2777777777777778em;"></span></span><span class="base"><span class="strut" style="height:1em;vertical-align:-0.25em;"></span><span class="mopen">[</span><span class="mord"><span class="mord mathsf">i</span><span class="mord mathsf" style="margin-right:0.01389em;">v</span><span class="mord mathsf">k</span></span><span class="mclose">]</span><span class="mord"><span class="mord"><span class="mord mathsf" style="margin-right:0.01389em;">g</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:0.33610799999999996em;"><span style="top:-2.5500000000000003em;margin-left:-0.01389em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathsf mtight">d</span></span></span></span><span class="vlist-s">​</span></span><span class="vlist-r"><span class="vlist" style="height:0.15em;"><span></span></span></span></span></span></span></span></span></span></span>, and the mapping
<span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.70544em;vertical-align:-0.011em;"></span><span class="mord"><span class="mord mathsf">i</span><span class="mord mathsf" style="margin-right:0.01389em;">v</span><span class="mord mathsf">k</span></span><span class="mspace" style="margin-right:0.2777777777777778em;"></span><span class="mrel">↦</span><span class="mspace" style="margin-right:0.2777777777777778em;"></span></span><span class="base"><span class="strut" style="height:1em;vertical-align:-0.25em;"></span><span class="mopen">[</span><span class="mord"><span class="mord mathsf">i</span><span class="mord mathsf" style="margin-right:0.01389em;">v</span><span class="mord mathsf">k</span></span><span class="mclose">]</span><span class="mord"><span class="mord"><span class="mord mathsf" style="margin-right:0.01389em;">g</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:0.33610799999999996em;"><span style="top:-2.5500000000000003em;margin-left:-0.01389em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathsf mtight">d</span></span></span></span><span class="vlist-s">​</span></span><span class="vlist-r"><span class="vlist" style="height:0.15em;"><span></span></span></span></span></span></span></span></span></span></span> is an injection for any <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.63888em;vertical-align:-0.19444em;"></span><span class="mord"><span class="mord"><span class="mord mathsf" style="margin-right:0.01389em;">g</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:0.33610799999999996em;"><span style="top:-2.5500000000000003em;margin-left:-0.01389em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathsf mtight">d</span></span></span></span><span class="vlist-s">​</span></span><span class="vlist-r"><span class="vlist" style="height:0.15em;"><span></span></span></span></span></span></span></span></span></span></span>.
(<span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.69444em;vertical-align:0em;"></span><span class="mord"><span class="mord mathsf">i</span><span class="mord mathsf" style="margin-right:0.01389em;">v</span><span class="mord mathsf">k</span></span></span></span></span> is in the base field of <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.68333em;vertical-align:0em;"></span><span class="mord mathnormal" style="margin-right:0.05764em;">E</span></span></span></span>, which must be smaller than its scalar field,
as is the case for Pallas.)</li>
<li>There can be only one <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.69444em;vertical-align:0em;"></span><span class="mord"><span class="mord mathsf">n</span><span class="mord mathsf">k</span></span></span></span></span> for a given <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.69444em;vertical-align:0em;"></span><span class="mord"><span class="mord mathsf">i</span><span class="mord mathsf" style="margin-right:0.01389em;">v</span><span class="mord mathsf">k</span></span></span></span></span>. This is true because the
circuit checks that <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.69444em;vertical-align:0em;"></span><span class="mord"><span class="mord mathsf">i</span><span class="mord mathsf" style="margin-right:0.01389em;">v</span><span class="mord mathsf">k</span></span><span class="mspace" style="margin-right:0.2777777777777778em;"></span><span class="mrel">=</span><span class="mspace" style="margin-right:0.2777777777777778em;"></span></span><span class="base"><span class="strut" style="height:1.1834479999999998em;vertical-align:-0.25em;"></span><span class="mord"><span class="mord"><span class="mord mathit">S</span><span class="mord mathit">h</span><span class="mord mathit">o</span><span class="mord mathit">r</span><span class="mord mathit">t</span><span class="mord mathit">C</span><span class="mord mathit">o</span><span class="mord mathit">m</span><span class="mord mathit">m</span><span class="mord mathit">i</span><span class="mord mathit">t</span></span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:0.9334479999999998em;"><span style="top:-2.4530000000000003em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mtight"><span class="mord mathsf mtight" style="margin-right:0.01389em;">r</span><span class="mord mathsf mtight">i</span><span class="mord mathsf mtight" style="margin-right:0.01389em;">v</span><span class="mord mathsf mtight">k</span></span></span></span></span><span style="top:-3.1473400000000002em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mtight"><span class="mord mathsf mtight">i</span><span class="mord mathsf mtight" style="margin-right:0.01389em;">v</span><span class="mord mathsf mtight">k</span></span></span></span></span></span><span class="vlist-s">​</span></span><span class="vlist-r"><span class="vlist" style="height:0.247em;"><span></span></span></span></span></span></span><span class="mopen">(</span><span class="mord"><span class="mord mathsf">a</span><span class="mord mathsf">k</span></span><span class="mpunct">,</span><span class="mspace" style="margin-right:0.16666666666666666em;"></span><span class="mord"><span class="mord mathsf">n</span><span class="mord mathsf">k</span></span><span class="mclose">)</span></span></span></span>
where <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.69444em;vertical-align:0em;"></span><span class="mord"><span class="mord mathit">S</span><span class="mord mathit">h</span><span class="mord mathit">o</span><span class="mord mathit">r</span><span class="mord mathit">t</span><span class="mord mathit">C</span><span class="mord mathit">o</span><span class="mord mathit">m</span><span class="mord mathit">m</span><span class="mord mathit">i</span><span class="mord mathit">t</span></span></span></span></span> is binding (see <a href="design/commitments.html">Commitments</a>).</li>
deploy: a4fb24b724aba340595b71da9b8936b0fd4cace1
2021-01-08 09:28:54 -08:00
</ul>
deploy: fe32db4be17566f28733ae21266f1a03982602a4
2021-01-21 04:15:54 -08:00
<h3><a class="header" href="#use-of-span-classkatexspan-classkatex-html-aria-hiddentruespan-classbasespan-classstrut-styleheight0625emvertical-align-019444emspanspan-classmord-mathnormalρspanspanspanspan" id="use-of-span-classkatexspan-classkatex-html-aria-hiddentruespan-classbasespan-classstrut-styleheight0625emvertical-align-019444emspanspan-classmord-mathnormalρspanspanspanspan">Use of <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.625em;vertical-align:-0.19444em;"></span><span class="mord mathnormal">ρ</span></span></span></span></a></h3>
<p><strong>Faerie Resistance</strong> requires that nullifiers be unique. This is primarily achieved by
taking a unique value (checked for uniqueness by the public consensus rules) as an input
to the nullifier. However, it is also necessary to ensure that the transformations applied
to this value preserve its uniqueness. Meanwhile, to achieve <strong>Spend Unlinkability</strong>, we
require that the nullifier does not reveal any information about the unique value it is
derived from.</p>
<p>The design alternatives fall into two categories in terms of how they balance these
requirements:</p>
<ul>
<li>
<p>Publish a unique value <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.625em;vertical-align:-0.19444em;"></span><span class="mord mathnormal">ρ</span></span></span></span> at note creation time, and blind that value within the
deploy: a4fb24b724aba340595b71da9b8936b0fd4cace1
2021-01-08 09:28:54 -08:00
nullifier computation.</p>
deploy: fe32db4be17566f28733ae21266f1a03982602a4
2021-01-21 04:15:54 -08:00
<ul>
<li>This is similar to the approach taken in Sprout and Sapling, which both implemented
nullifiers as PRF outputs; Sprout uses the compression function from SHA-256, while
Sapling uses BLAKE2s.</li>
</ul>
</li>
<li>
<p>Derive a unique base <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.68333em;vertical-align:0em;"></span><span class="mord mathnormal" style="margin-right:0.08125em;">H</span></span></span></span> from some unique value, publish that unique base at note
creation time, and then blind the base (either additively or multiplicatively) during
nullifier computation.</p>
</li>
</ul>
<p>For <strong>Spend Unlinkability</strong>, the only value unknown to the adversary is <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.69444em;vertical-align:0em;"></span><span class="mord"><span class="mord mathsf">n</span><span class="mord mathsf">k</span></span></span></span></span>, and
the cryptographic assumptions only involve the first term (other terms like <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.44444em;vertical-align:0em;"></span><span class="mord"><span class="mord mathsf">c</span><span class="mord mathsf">m</span></span></span></span></span>
or <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:1em;vertical-align:-0.25em;"></span><span class="mopen">[</span><span class="mord"><span class="mord mathsf" style="margin-right:0.01389em;">r</span><span class="mord mathsf">n</span><span class="mord mathsf" style="margin-right:0.06944em;">f</span></span><span class="mclose">]</span><span class="mord"><span class="mord mathcal" style="margin-right:0.07382em;">I</span></span></span></span></span> cannot be extracted directly from the observed nullifiers,
but can be subtracted from them). We therefore ensure that the first term does not commit
directly to the note (to avoid a DL-breaking adversary from immediately breaking <strong>SU</strong>).</p>
<p>We were considering using a design involving <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.68333em;vertical-align:0em;"></span><span class="mord mathnormal" style="margin-right:0.08125em;">H</span></span></span></span> with the goal of eliminating all usages
of a PRF inside the circuit, for two reasons:</p>
<ul>
<li>Instantiating <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.83333em;vertical-align:-0.15em;"></span><span class="mord mathnormal" style="margin-right:0.13889em;">P</span><span class="mord mathnormal" style="margin-right:0.00773em;">R</span><span class="mord"><span class="mord mathnormal" style="margin-right:0.13889em;">F</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:0.32833099999999993em;"><span style="top:-2.5500000000000003em;margin-left:-0.13889em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight" style="margin-right:0.13889em;">F</span></span></span></span><span class="vlist-s">​</span></span><span class="vlist-r"><span class="vlist" style="height:0.15em;"><span></span></span></span></span></span></span></span></span></span> with a traditional hash function is expensive in the circuit.</li>
<li>We didn't want to solely rely on an algebraic hash function satisfying <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.83333em;vertical-align:-0.15em;"></span><span class="mord mathnormal" style="margin-right:0.13889em;">P</span><span class="mord mathnormal" style="margin-right:0.00773em;">R</span><span class="mord"><span class="mord mathnormal" style="margin-right:0.13889em;">F</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:0.32833099999999993em;"><span style="top:-2.5500000000000003em;margin-left:-0.13889em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight" style="margin-right:0.13889em;">F</span></span></span></span><span class="vlist-s">​</span></span><span class="vlist-r"><span class="vlist" style="height:0.15em;"><span></span></span></span></span></span></span></span></span></span> to
achieve <strong>Spend Unlinkability</strong>.</li>
</ul>
<p>However, those designs rely on both <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.83333em;vertical-align:-0.15em;"></span><span class="mord mathnormal" style="margin-right:0.00773em;">R</span><span class="mord"><span class="mord mathnormal" style="margin-right:0.02778em;">O</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:0.32833099999999993em;"><span style="top:-2.5500000000000003em;margin-left:-0.02778em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mathnormal mtight">G</span><span class="mord mathnormal mtight" style="margin-right:0.08125em;">H</span></span></span></span></span><span class="vlist-s">​</span></span><span class="vlist-r"><span class="vlist" style="height:0.15em;"><span></span></span></span></span></span></span></span></span></span> and <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.83333em;vertical-align:-0.15em;"></span><span class="mord mathnormal" style="margin-right:0.02778em;">D</span><span class="mord"><span class="mord mathnormal">L</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:0.32833099999999993em;"><span style="top:-2.5500000000000003em;margin-left:0em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight" style="margin-right:0.05764em;">E</span></span></span></span><span class="vlist-s">​</span></span><span class="vlist-r"><span class="vlist" style="height:0.15em;"><span></span></span></span></span></span></span></span></span></span> for <strong>Faerie Resistance</strong>, while
still requiring <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.83333em;vertical-align:-0.15em;"></span><span class="mord mathnormal" style="margin-right:0.02778em;">D</span><span class="mord mathnormal" style="margin-right:0.02778em;">D</span><span class="mord"><span class="mord mathnormal" style="margin-right:0.08125em;">H</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:0.32833099999999993em;"><span style="top:-2.5500000000000003em;margin-left:-0.08125em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight" style="margin-right:0.05764em;">E</span></span></span></span><span class="vlist-s">​</span></span><span class="vlist-r"><span class="vlist" style="height:0.15em;"><span></span></span></span></span></span></span></span></span></span> for <strong>Spend Unlinkability</strong>. (There are two designs for which this
is not the case, but they rely on <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:1.2605469999999999em;vertical-align:-0.293531em;"></span><span class="mord mathnormal" style="margin-right:0.02778em;">D</span><span class="mord mathnormal" style="margin-right:0.02778em;">D</span><span class="mord"><span class="mord mathnormal" style="margin-right:0.08125em;">H</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:0.9670159999999999em;"><span style="top:-2.4064690000000004em;margin-left:-0.08125em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight" style="margin-right:0.05764em;">E</span></span></span><span style="top:-3.1809080000000005em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mbin mtight">†</span></span></span></span><span class="vlist-s">​</span></span><span class="vlist-r"><span class="vlist" style="height:0.293531em;"><span></span></span></span></span></span></span></span></span></span> for <strong>Note Privacy (OOB)</strong> which was not
acceptable).</p>
<p>By contrast, several designs involving <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.625em;vertical-align:-0.19444em;"></span><span class="mord mathnormal">ρ</span></span></span></span> (including the chosen design) have weaker
assumptions for <strong>Faerie Resistance</strong> (only relying on <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.83333em;vertical-align:-0.15em;"></span><span class="mord mathnormal" style="margin-right:0.02778em;">D</span><span class="mord"><span class="mord mathnormal">L</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:0.32833099999999993em;"><span style="top:-2.5500000000000003em;margin-left:0em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight" style="margin-right:0.05764em;">E</span></span></span></span><span class="vlist-s">​</span></span><span class="vlist-r"><span class="vlist" style="height:0.15em;"><span></span></span></span></span></span></span></span></span></span>), and <strong>Spend Unlinkability</strong>
does not require <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.83333em;vertical-align:-0.15em;"></span><span class="mord mathnormal" style="margin-right:0.13889em;">P</span><span class="mord mathnormal" style="margin-right:0.00773em;">R</span><span class="mord"><span class="mord mathnormal" style="margin-right:0.13889em;">F</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:0.32833099999999993em;"><span style="top:-2.5500000000000003em;margin-left:-0.13889em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight" style="margin-right:0.13889em;">F</span></span></span></span><span class="vlist-s">​</span></span><span class="vlist-r"><span class="vlist" style="height:0.15em;"><span></span></span></span></span></span></span></span></span></span> to hold: they can fall back on the same <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.83333em;vertical-align:-0.15em;"></span><span class="mord mathnormal" style="margin-right:0.02778em;">D</span><span class="mord mathnormal" style="margin-right:0.02778em;">D</span><span class="mord"><span class="mord mathnormal" style="margin-right:0.08125em;">H</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:0.32833099999999993em;"><span style="top:-2.5500000000000003em;margin-left:-0.08125em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight" style="margin-right:0.05764em;">E</span></span></span></span><span class="vlist-s">​</span></span><span class="vlist-r"><span class="vlist" style="height:0.15em;"><span></span></span></span></span></span></span></span></span></span> assumption as the
<span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.68333em;vertical-align:0em;"></span><span class="mord mathnormal" style="margin-right:0.08125em;">H</span></span></span></span> designs (along with an additional assumption about the output of <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.68333em;vertical-align:0em;"></span><span class="mord mathnormal" style="margin-right:0.13889em;">F</span></span></span></span> which is easily
satisfied).</p>
<h3><a class="header" href="#use-of-span-classkatexspan-classkatex-html-aria-hiddentruespan-classbasespan-classstrut-styleheight08888799999999999emvertical-align-019444emspanspan-classmord-mathnormal-stylemargin-right003588emψspanspanspanspan" id="use-of-span-classkatexspan-classkatex-html-aria-hiddentruespan-classbasespan-classstrut-styleheight08888799999999999emvertical-align-019444emspanspan-classmord-mathnormal-stylemargin-right003588emψspanspanspanspan">Use of <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.8888799999999999em;vertical-align:-0.19444em;"></span><span class="mord mathnormal" style="margin-right:0.03588em;">ψ</span></span></span></span></a></h3>
<p>Most of the designs include either a multiplicative blinding term <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:1em;vertical-align:-0.25em;"></span><span class="mopen">[</span><span class="mord mathnormal" style="margin-right:0.02778em;">θ</span><span class="mclose">]</span><span class="mord mathnormal" style="margin-right:0.08125em;">H</span></span></span></span>, or an
additive blinding term <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:1em;vertical-align:-0.25em;"></span><span class="mopen">[</span><span class="mord"><span class="mord mathsf" style="margin-right:0.01389em;">r</span><span class="mord mathsf">n</span><span class="mord mathsf" style="margin-right:0.06944em;">f</span></span><span class="mclose">]</span><span class="mord"><span class="mord mathcal" style="margin-right:0.07382em;">I</span></span></span></span></span>, in order to achieve perfect
<strong>Note Privacy (OOB)</strong> (to an adversary who does not know the note). The chosen design is
effectively using <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:1em;vertical-align:-0.25em;"></span><span class="mopen">[</span><span class="mord mathnormal" style="margin-right:0.03588em;">ψ</span><span class="mclose">]</span><span class="mord"><span class="mord mathcal" style="margin-right:0.0593em;">G</span></span></span></span></span> for this purpose; a DL-breaking adversary only
learns <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:1em;vertical-align:-0.25em;"></span><span class="mord"><span class="mord mathnormal" style="margin-right:0.13889em;">F</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:0.33610799999999996em;"><span style="top:-2.5500000000000003em;margin-left:-0.13889em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mtight"><span class="mord mathsf mtight">n</span><span class="mord mathsf mtight">k</span></span></span></span></span></span><span class="vlist-s">​</span></span><span class="vlist-r"><span class="vlist" style="height:0.15em;"><span></span></span></span></span></span></span><span class="mopen">(</span><span class="mord mathnormal">ρ</span><span class="mclose">)</span><span class="mspace" style="margin-right:0.2222222222222222em;"></span><span class="mbin">+</span><span class="mspace" style="margin-right:0.2222222222222222em;"></span></span><span class="base"><span class="strut" style="height:0.8888799999999999em;vertical-align:-0.19444em;"></span><span class="mord mathnormal" style="margin-right:0.03588em;">ψ</span><span class="mspace allowbreak"></span><span class="mspace" style="margin-right:0.4444444444444444em;"></span></span><span class="base"><span class="strut" style="height:1em;vertical-align:-0.25em;"></span><span class="mopen">(</span><span class="mord"><span class="mord"><span class="mord mathrm">m</span><span class="mord mathrm">o</span><span class="mord mathrm">d</span></span></span><span class="mspace" style="margin-right:0.3333333333333333em;"></span><span class="mord mathnormal">p</span><span class="mclose">)</span></span></span></span>. This reduces <strong>Note Privacy (OOB)</strong> from
perfect to statistical, but given that <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.8888799999999999em;vertical-align:-0.19444em;"></span><span class="mord mathnormal" style="margin-right:0.03588em;">ψ</span></span></span></span> is from a distribution statistically close
to uniform on <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:1em;vertical-align:-0.25em;"></span><span class="mopen">[</span><span class="mord">0</span><span class="mpunct">,</span><span class="mspace" style="margin-right:0.16666666666666666em;"></span><span class="mord mathnormal" style="margin-right:0.03588em;">q</span><span class="mclose">)</span></span></span></span>, this is statistically close to better than <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.8141079999999999em;vertical-align:0em;"></span><span class="mord"><span class="mord">2</span><span class="msupsub"><span class="vlist-t"><span class="vlist-r"><span class="vlist" style="height:0.8141079999999999em;"><span style="top:-3.063em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mtight">−</span><span class="mord mtight">1</span><span class="mord mtight">2</span><span class="mord mtight">8</span></span></span></span></span></span></span></span></span></span></span></span>. The benefit
is that it does not require an additional scalar multiplication, making it more efficient
inside the circuit.</p>
<p><span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.8888799999999999em;vertical-align:-0.19444em;"></span><span class="mord mathnormal" style="margin-right:0.03588em;">ψ</span></span></span></span>'s derivation has two motivations:</p>
<ul>
<li>Deriving from a random value <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.69444em;vertical-align:0em;"></span><span class="mord"><span class="mord mathsf" style="margin-right:0.01389em;">r</span><span class="mord mathsf">s</span><span class="mord mathsf">e</span><span class="mord mathsf">e</span><span class="mord mathsf">d</span></span></span></span></span> enables multiple derived values to be
conveyed to the recipient within an action (such as the ephemeral secret <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.69444em;vertical-align:0em;"></span><span class="mord"><span class="mord mathsf">e</span><span class="mord mathsf">s</span><span class="mord mathsf">k</span></span></span></span></span>,
per <a href="https://zips.z.cash/zip-0212">ZIP 212</a>), while keeping the note plaintext short.</li>
<li>Mixing <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.625em;vertical-align:-0.19444em;"></span><span class="mord mathnormal">ρ</span></span></span></span> into the derivation ensures that the sender can't repeat <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.8888799999999999em;vertical-align:-0.19444em;"></span><span class="mord mathnormal" style="margin-right:0.03588em;">ψ</span></span></span></span> across two
notes, which could have enabled spend linkability attacks in some designs.</li>
</ul>
<p>The note that is committed to, and which the circuit takes as input, only includes <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.8888799999999999em;vertical-align:-0.19444em;"></span><span class="mord mathnormal" style="margin-right:0.03588em;">ψ</span></span></span></span>
(i.e. the circuit does not check the derivation from <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.69444em;vertical-align:0em;"></span><span class="mord"><span class="mord mathsf" style="margin-right:0.01389em;">r</span><span class="mord mathsf">s</span><span class="mord mathsf">e</span><span class="mord mathsf">e</span><span class="mord mathsf">d</span></span></span></span></span>). However, an
adversarial sender is still constrained by this derivation, because the recipient
recomputes <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.8888799999999999em;vertical-align:-0.19444em;"></span><span class="mord mathnormal" style="margin-right:0.03588em;">ψ</span></span></span></span> during note decryption. If an action were created using an arbitrary
<span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.8888799999999999em;vertical-align:-0.19444em;"></span><span class="mord mathnormal" style="margin-right:0.03588em;">ψ</span></span></span></span> (for which the adversary did not have a corresponding <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.69444em;vertical-align:0em;"></span><span class="mord"><span class="mord mathsf" style="margin-right:0.01389em;">r</span><span class="mord mathsf">s</span><span class="mord mathsf">e</span><span class="mord mathsf">e</span><span class="mord mathsf">d</span></span></span></span></span>), the
recipient would derive a note commitment that did not match the action's commitment field,
and reject it (as in Sapling).</p>
<h3><a class="header" href="#use-of-span-classkatexspan-classkatex-html-aria-hiddentruespan-classbasespan-classstrut-styleheight044444emvertical-align0emspanspan-classmordspan-classmord-mathsfcspanspan-classmord-mathsfmspanspanspanspanspan" id="use-of-span-classkatexspan-classkatex-html-aria-hiddentruespan-classbasespan-classstrut-styleheight044444emvertical-align0emspanspan-classmordspan-classmord-mathsfcspanspan-classmord-mathsfmspanspanspanspanspan">Use of <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.44444em;vertical-align:0em;"></span><span class="mord"><span class="mord mathsf">c</span><span class="mord mathsf">m</span></span></span></span></span></a></h3>
<p>The nullifier commits to the note value via <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.44444em;vertical-align:0em;"></span><span class="mord"><span class="mord mathsf">c</span><span class="mord mathsf">m</span></span></span></span></span> for two reasons:</p>
<ul>
<li>It domain-separates nullifiers for zero-valued notes from other notes. This is necessary
because we do not require zero-valued notes to exist in the commitment tree.</li>
<li>Designs that bind the nullifier to <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:1em;vertical-align:-0.25em;"></span><span class="mord"><span class="mord mathnormal" style="margin-right:0.13889em;">F</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:0.33610799999999996em;"><span style="top:-2.5500000000000003em;margin-left:-0.13889em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mtight"><span class="mord mathsf mtight">n</span><span class="mord mathsf mtight">k</span></span></span></span></span></span><span class="vlist-s">​</span></span><span class="vlist-r"><span class="vlist" style="height:0.15em;"><span></span></span></span></span></span></span><span class="mopen">(</span><span class="mord mathnormal">ρ</span><span class="mclose">)</span></span></span></span> require <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.84444em;vertical-align:-0.15em;"></span><span class="mord mathnormal" style="margin-right:0.07153em;">C</span><span class="mord mathnormal">o</span><span class="mord mathnormal" style="margin-right:0.01968em;">l</span><span class="mord"><span class="mord mathnormal" style="margin-right:0.01968em;">l</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:0.32833099999999993em;"><span style="top:-2.5500000000000003em;margin-left:-0.01968em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight" style="margin-right:0.13889em;">F</span></span></span></span><span class="vlist-s">​</span></span><span class="vlist-r"><span class="vlist" style="height:0.15em;"><span></span></span></span></span></span></span></span></span></span> to achieve
<strong>Faerie Resistance</strong> (and similarly where <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.69444em;vertical-align:0em;"></span><span class="mord"><span class="mord mathit">H</span><span class="mord mathit">a</span><span class="mord mathit">s</span><span class="mord mathit">h</span></span></span></span></span> is applied to a value derived from
<span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.68333em;vertical-align:0em;"></span><span class="mord mathnormal" style="margin-right:0.08125em;">H</span></span></span></span>). Adding <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.44444em;vertical-align:0em;"></span><span class="mord"><span class="mord mathsf">c</span><span class="mord mathsf">m</span></span></span></span></span> to the nullifier avoids this assumption: all of the bases
used to derive <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.44444em;vertical-align:0em;"></span><span class="mord"><span class="mord mathsf">c</span><span class="mord mathsf">m</span></span></span></span></span> are fixed and independent of <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.78055em;vertical-align:-0.09722em;"></span><span class="mord"><span class="mord mathcal" style="margin-right:0.0593em;">G</span></span></span></span></span>, and so the
nullifier can be viewed as a Pedersen hash where the input includes <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.625em;vertical-align:-0.19444em;"></span><span class="mord mathnormal">ρ</span></span></span></span> directly.</li>
</ul>
<p>The <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.9223379999999999em;vertical-align:0em;"></span><span class="mord"><span class="mord"><span class="mord mathit">C</span><span class="mord mathit">o</span><span class="mord mathit">m</span><span class="mord mathit">m</span><span class="mord mathit">i</span><span class="mord mathit">t</span></span><span class="msupsub"><span class="vlist-t"><span class="vlist-r"><span class="vlist" style="height:0.9223379999999999em;"><span style="top:-3.1362300000000003em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mtight"><span class="mord mathsf mtight">n</span><span class="mord mathsf mtight" style="margin-right:0.06944em;">f</span></span></span></span></span></span></span></span></span></span></span></span></span> variants were considered to avoid directly depending on
<span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.44444em;vertical-align:0em;"></span><span class="mord"><span class="mord mathsf">c</span><span class="mord mathsf">m</span></span></span></span></span> (which in its native type is a base field element, not a group element). We
decided instead to follow Sapling by defining an intermediate representation of
<span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.44444em;vertical-align:0em;"></span><span class="mord"><span class="mord mathsf">c</span><span class="mord mathsf">m</span></span></span></span></span> as a group element, that is only used in nullifier computation. The circuit
already needs to compute <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.44444em;vertical-align:0em;"></span><span class="mord"><span class="mord mathsf">c</span><span class="mord mathsf">m</span></span></span></span></span>, so this improves performance by removing</p>
<p>We also considered variants that used a choice of fixed bases <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.83333em;vertical-align:-0.15em;"></span><span class="mord"><span class="mord"><span class="mord mathcal" style="margin-right:0.0593em;">G</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:0.151392em;"><span style="top:-2.5500000000000003em;margin-left:-0.0593em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight" style="margin-right:0.03588em;">v</span></span></span></span><span class="vlist-s">​</span></span><span class="vlist-r"><span class="vlist" style="height:0.15em;"><span></span></span></span></span></span></span></span></span></span></span> to provide
domain separation for zero-valued notes. The most performant design (similar to the chosen
design) does not achieve <strong>Faerie Resistance</strong> for an adversary that knows the recipient's
full viewing key (<span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.8888799999999999em;vertical-align:-0.19444em;"></span><span class="mord mathnormal" style="margin-right:0.03588em;">ψ</span></span></span></span> could be brute-forced to cancel out <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:1em;vertical-align:-0.25em;"></span><span class="mord"><span class="mord mathnormal" style="margin-right:0.13889em;">F</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:0.33610799999999996em;"><span style="top:-2.5500000000000003em;margin-left:-0.13889em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mtight"><span class="mord mtight"><span class="mord mathsf mtight">n</span><span class="mord mathsf mtight">k</span></span></span></span></span></span><span class="vlist-s">​</span></span><span class="vlist-r"><span class="vlist" style="height:0.15em;"><span></span></span></span></span></span></span><span class="mopen">(</span><span class="mord mathnormal">ρ</span><span class="mclose">)</span></span></span></span>,
causing a collision), and the other variants require assuming <span class="katex"><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.84444em;vertical-align:-0.15em;"></span><span class="mord mathnormal" style="margin-right:0.07153em;">C</span><span class="mord mathnormal">o</span><span class="mord mathnormal" style="margin-right:0.01968em;">l</span><span class="mord"><span class="mord mathnormal" style="margin-right:0.01968em;">l</span><span class="msupsub"><span class="vlist-t vlist-t2"><span class="vlist-r"><span class="vlist" style="height:0.32833099999999993em;"><span style="top:-2.5500000000000003em;margin-left:-0.01968em;margin-right:0.05em;"><span class="pstrut" style="height:2.7em;"></span><span class="sizing reset-size6 size3 mtight"><span class="mord mathnormal mtight" style="margin-right:0.13889em;">F</span></span></span></span><span class="vlist-s">​</span></span><span class="vlist-r"><span class="vlist" style="height:0.15em;"><span></span></span></span></span></span></span></span></span></span> as mentioned above.</p>
deploy: a4fb24b724aba340595b71da9b8936b0fd4cace1
2021-01-08 09:28:54 -08:00
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.12.0/dist/katex.min.css" integrity="sha384-AfEj0r4/OFrOo5t7NnNe46zW/tFgW6x/bCJG8FqQCEo3+Aro6EYUG4+cU+KJWu/X" crossorigin="anonymous">
<h1><a class="header" href="#signatures" id="signatures">Signatures</a></h1>
<p>Orchard signatures are an instantiation of RedDSA with a cofactor of 1.</p>
<p>TODO:</p>
<ul>
<li>Should it be possible to sign partial transactions?
<ul>
<li>If we're going to merge down all the signatures into a single one, and also want this, we need to ensure there's a feasible MPC.</li>
</ul>
</li>
</ul>
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.12.0/dist/katex.min.css" integrity="sha384-AfEj0r4/OFrOo5t7NnNe46zW/tFgW6x/bCJG8FqQCEo3+Aro6EYUG4+cU+KJWu/X" crossorigin="anonymous">
<h1><a class="header" href="#circuit" id="circuit">Circuit</a></h1>
deploy: 6614e800d94bdf7414739beefd82d6a49982781c
2020-10-20 15:04:07 -07:00
</main>
<nav class="nav-wrapper" aria-label="Page navigation">
<!-- Mobile navigation buttons -->
<div style="clear: both"></div>
</nav>
</div>
</div>
<nav class="nav-wide-wrapper" aria-label="Page navigation">
</nav>
</div>
<script type="text/javascript">
window.playground_copyable = true;
</script>
<script src="elasticlunr.min.js" type="text/javascript" charset="utf-8"></script>
<script src="mark.min.js" type="text/javascript" charset="utf-8"></script>
<script src="searcher.js" type="text/javascript" charset="utf-8"></script>
<script src="clipboard.min.js" type="text/javascript" charset="utf-8"></script>
<script src="highlight.js" type="text/javascript" charset="utf-8"></script>
<script src="book.js" type="text/javascript" charset="utf-8"></script>
<!-- Custom JS scripts -->
<script type="text/javascript">
window.addEventListener('load', function() {
window.setTimeout(window.print, 100);
});
</script>
</body>
</html>