# NoteCommit

## Message decomposition

SinsemillaCommit is used in the NoteCommit function. The input to SinsemillaCommit is:

g⋆d​∣∣pk⋆d​∣∣I2LEBSP 64​(v)∣∣I2LEBSP ℓ base Orchard p​​(ρ)∣∣I2LEBSP ℓ base Orchard p​​(ψ),

where:

- g⋆d​,pk⋆d​ are representations of Pallas curve points, with 255 bits used for the x-coordinate and 1 bit used for the y-coordinate.
- ρ,ψ are Pallas base field elements.
- v is a 64-bit value.
- ℓ base Orchard p​=255.

Sinsemilla operates on multiples of 10 bits, so we start by decomposing the message into chunks:

g⋆d​pk⋆d​I2LEBSP 64​(v)I2LEBSP ℓ base Orchard p​​(ρ)I2LEBSP ℓ base Orchard p​​(ψ)​=a∣∣b 0​∣∣b 1​∣∣b 2​=(bits 0..=249 of x(g d​))∣∣(bits 250..=253 of x(g d​))∣∣(bit 254 of x(g d​))∣∣(y​ bit of g d​)=b 3​∣∣c∣∣d 0​∣∣d 1​=(bits 0..=3 of x(p k d​))∣∣(bits 4..=253 of x(p k d​))∣∣(bit 254 of x(p k d​))∣∣(y​ bit of p k d​)=d 2​∣∣d 3​∣∣e 0​=(bits 0..=7 of v)∣∣(bits 8..=57 of v)∣∣(bits 58..=63 of v)=e 1​∣∣f∣∣g 0​=(bits 0..=3 of ρ)∣∣(bits 4..=253 of ρ)∣∣(bit 254 of ρ)=g 1​∣∣g 2​∣∣h 0​∣∣h 1​=(bits 0..=8 of ψ)∣∣(bits 9..=248 of ψ)∣∣(bits 249..=253 of ψ)∣∣(bit 254 of ψ)​

Then we recompose the chunks into message pieces:

Length (bits)250 10 250 60 10 250 250 10​Piece a b=b 0​∣∣b 1​∣∣b 2​∣∣b 3​c d=d 0​∣∣d 1​∣∣d 2​∣∣d 3​e=e 0​∣∣e 1​f g=g 0​∣∣g 1​∣∣g 2​h=h 0​∣∣h 1​∣∣h 2​​​

where h 2​ is 4 zero bits (corresponding to the padding applied by the Sinsemilla pad function).

Each message piece is constrained by SinsemillaHash to its stated length. Additionally:

- g d​ and p k d​ are witnessed and checked to be valid elliptic curve points.
- v is witnessed as a field element, but its decomposition is sufficient to constrain it to be a 64-bit value.
- ρ and ψ are witnessed as field elements, so we know they are canonical.

However, we need additional constraints to enforce that:

- The chunks are the correct bit lengths (or else they could overlap in the decompositions and allow the prover to witness an arbitrary SinsemillaCommit message).
- The chunks contain the canonical decompositions of g d​, p k d​, ρ, and ψ (or else the prover could witness multiple equivalent inputs to SinsemillaCommit).

Some of these constraints are implemented with a reusable circuit gadget, short_lookup_range_check(). We define custom gates for the remainder. Since these gates use simple boolean selectors activated on different rows, their selectors are eligible for combining, reducing the overall proof size.

## Message piece decomposition

We check the decomposition of each message piece in its own region. There is no need to check the whole pieces:

- a (250 bits) is witnessed and constrained outside the gate;
- c (250 bits) is witnessed and constrained outside the gate;
- f (250 bits) is witnessed and constrained outside the gate;

The following helper gates are defined:

- bool_check(x)=x⋅(1−x).
- short_lookup_range_check() is a short lookup range check.

### b=b 0​∣∣b 1​∣∣b 2​∣∣b 3​

b has been constrained to be 10 bits by the Sinsemilla hash.

#### Region layout

A 6​b​A 7​b 0​b 2​​A 8​b 1​b 3​​q NoteCommit,b​1 0​​

#### Constraints

Degree 3 3 2​Constraint q NoteCommit,b​⋅bool_check(b 1​)=0 q NoteCommit,b​⋅bool_check(b 2​)=0 q NoteCommit,b​⋅(b−(b 0​+b 1​⋅2 4+b 2​⋅2 5+b 3​⋅2 6))=0​​

Outside this gate, we have constrained:

- short_lookup_range_check(b 0​,4)
- short_lookup_range_check(b 3​,4)

### d=d 0​∣∣d 1​∣∣d 2​∣∣d 3​

d has been constrained to be 60 bits by the SinsemillaHash.

#### Region layout

A 6​d​A 7​d 0​d 2​​A 8​d 1​d 3​​q NoteCommit,d​1 0​​

#### Constraints

Degree 3 3 2​Constraint q NoteCommit,d​⋅bool_check(d 0​)=0 q NoteCommit,d​⋅bool_check(d 1​)=0 q NoteCommit,d​⋅(d−(d 0​+d 1​⋅2+d 2​⋅2 2+d 3​⋅2 10))=0​​

Outside this gate, we have constrained:

- short_lookup_range_check(d 2​,8)
- d 3​ is equality-constrained to z d,1​, where the latter is the index-1 running sum output of SinsemillaHash(d), constrained by the hash to be 50 bits.

### e=e 0​∣∣e 1​

e has been constrained to be 10 bits by the SinsemillaHash.

#### Region layout

A 6​e​A 7​e 0​​A 8​e 1​​q NoteCommit,e​1​​

#### Constraints

Degree 2​Constraint q NoteCommit,e​⋅(e−(e 0​+e 1​⋅2 6))=0​​

Outside this gate, we have constrained:

- short_lookup_range_check(e 0​,6)
- short_lookup_range_check(e 1​,4)

### g=g 0​∣∣g 1​∣∣g 2​

g has been constrained to be 250 bits by the SinsemillaHash.

#### Region layout

A 6​g g 1​​A 7​g 0​g 2​​q NoteCommit,g​1 0​​

#### Constraints

Degree 3 2​Constraint q NoteCommit,g​⋅bool_check(g 0​)=0 q NoteCommit,g​⋅(g−(g 0​+g 1​⋅2+g 2​⋅2 10))=0​​

Outside this gate, we have constrained:

- short_lookup_range_check(g 1​,9)
- g 2​ is equality-constrained to z g,1​, where the latter is the index-1 running sum output of SinsemillaHash(g), constrained by the hash to be 240 bits.

### h=h 0​∣∣h 1​∣∣h 2​

h has been constrained to be 10 bits by the SinsemillaHash.

#### Region layout

A 6​h​A 7​h 0​​A 8​h 1​​q NoteCommit,h​1​​

#### Constraints

Degree 3 2​Constraint q NoteCommit,h​⋅bool_check(h 1​)=0 q NoteCommit,h​⋅(h−(h 0​+h 1​⋅2 5))=0​​

Outside this gate, we have constrained:

- short_lookup_range_check(h 0​,5)

## Field element checks

All message pieces and subpieces have been range-constrained by the earlier decomposition gates. They are now used to:

- constrain each field element I2LEBSP ℓ base Orchard p​​(x(g d​)), I2LEBSP ℓ base Orchard p​​(x(p k d​)), I2LEBSP ℓ base Orchard p​​(ρ), and I2LEBSP ℓ base Orchard p​​(ψ) to be 255-bit values, with top bits b 1​, d 0​, g 0​, and h 1​ respectively.
- constrain I2LEBSP ℓ base Orchard p​​(x(g d​))I2LEBSP ℓ base Orchard p​​(x(p k d​))I2LEBSP ℓ base Orchard p​​(ρ)I2LEBSP ℓ base Orchard p​​(ψ)​=x(g d​)(mod q P​)=x(p k d​)(mod q P​)=ρ(mod q P​)=ψ(mod q P​)​​ where q P​ is the Pallas base field modulus.
- check that these are indeed canonically-encoded field elements, i.e. I2LEBSP ℓ base Orchard p​​(x(g d​))I2LEBSP ℓ base Orchard p​​(x(p k d​))I2LEBSP ℓ base Orchard p​​(ρ)I2LEBSP ℓ base Orchard p​​(ψ)​<q P​<q P​<q P​<q P​​​

The Pallas base field modulus has the form q P​=2 254+t P​, where t P​=0x224698fc094cf91b992d30ed00000001 is 126 bits. We therefore know that if the top bit is not set, then the remaining bits will always comprise a canonical encoding of a field element. Thus the canonicity checks below are enforced if and only if the corresponding top bit is set to 1.

> In the constraints below we use a base-2 10 variant of the method used in libsnark (originally from [SVPBABW2012, Appendix C.1]) for range constraints 0≤x<t:

> - Let t′ be the smallest power of 2 10 greater than t.
> - Enforce 0≤x<t′.
> - Let x′=x+t′−t.
> - Enforce 0≤x′<t′.

### x(g d​) with b 1​=1⟹x(g d​)≥2 254

Recall that x(g d​)=a+2 250⋅b 0​+2 254⋅b 1​. When the top bit b 1​ is set, we check that x(g d​)0..=253​<t P​:

1. b 1​=1⟹b 0​=0.

   Since b 1​=1⟹x(g d​)0..=253​<t P​<2 126, we know that x(g d​)126..=253​=0, and in particular b 0​:=x(g d​)250..=253​=0.

2. b 1​=1⟹0≤a<t P​.

   To check that a<t P​, we use two constraints:

   a) 0≤a<2 130. This is expressed in the custom gate as b 1​⋅z a,13​=0, where z a,13​ is the index-13 running sum output by SinsemillaHash(a).

   b) 0≤a+2 130−t P​<2 130. To check this, we decompose a′=a+2 130−t P​ into thirteen 10-bit words (little-endian) using a running sum z a′​, looking up each word in a 10-bit lookup table. We then enforce in the custom gate that b 1​⋅z a′,13​=0.

#### Region layout

A 6​x(g d​)​A 7​b 0​b 1​​A 8​a a′​A 9​z a,13​z a′,13​​q NoteCommit,x(g d​)​1 0​​

#### Constraints

Degree 2 3 3 2 3​Constraint q NoteCommit,x(g d​)​⋅(a+b 0​⋅2 250+b 1​⋅2 254−x(g d​))=0 q NoteCommit,x(g d​)​⋅b 1​⋅b 0​=0 q NoteCommit,x(g d​)​⋅b 1​⋅z a,13​=0 q NoteCommit,x(g d​)​⋅(a+2 130−t P​−a′)=0 q NoteCommit,x(g d​)​⋅b 1​⋅z a′,13​=0​​

### x(p k d​) with d 0​=1⟹x(p k d​)≥2 254

Recall that x(p k d​)=b 3​+2 4⋅c+2 254⋅d 0​. When the top bit d 0​ is set, we check that x(p k d​)0..=253​<t P​:

1. d 0​=1⟹0≤b 3​+2 4⋅c<t P​.

   To check that 0≤b 3​+2 4⋅c<t P​, we use two constraints:

   a) 0≤b 3​+2 4⋅c<2 140. b 3​ is already constrained individually to be a 4-bit value. z c,13​ is the index-13 running sum output by SinsemillaHash(c). By constraining d 0​⋅z c,13​=0, we constrain b 3​+2 4⋅c<2 134<2 140.

   b) 0≤b 3​+2 4⋅c+2 140−t P​<2 140. To check this, we decompose b 3​c′=b 3​+2 4⋅c+2 140−t P​ into fourteen 10-bit words (little-endian) using a running sum z b 3​c′​, looking up each word in a 10-bit lookup table. We then enforce in the custom gate that d 0​⋅z b 3​c′,14​=0.

#### Region layout

A 6​x(p k d​)​A 7​b 3​d 0​​A 8​c b 3​c′​A 9​z c,13​z b 3​c′,14​​q NoteCommit,x(p k d​)​1 0​​

#### Constraints

Degree 2 3 2 3​Constraint q NoteCommit,x(p k d​)​⋅(b 3​+c⋅2 4+d 0​⋅2 254−x(p k d​))=0 q NoteCommit,x(p k d​)​⋅d 0​⋅z c,13​=0 q NoteCommit,x(p k d​)​⋅(b 3​+c⋅2 4+2 140−t P​−b 3​c′)=0 q NoteCommit,x(p k d​)​⋅d 0​⋅z b 3​c′,14​=0​​

### v=d 2​+2 8⋅d 3​+2 58⋅e 0​

#### Region layout

A 6​v a l u e​A 7​d 2​​A 8​d 3​​A 9​e 0​​q NoteCommit,v a l u e​1​​

#### Constraints

Degree 2​Constraint q NoteCommit,v a l u e​⋅(d 2​+d 3​⋅2 8+e 0​⋅2 58−value)=0​​

### ρ with g 0​=1⟹ρ≥2 254

Recall that ρ=e 1​+2 4⋅f+2 254⋅g 0​. When the top bit g 0​ is set, we check that ρ 0..=253​<t P​:

1. g 0​=1⟹0≤e 1​+2 4⋅f<t P​.

   To check that 0≤e 1​+2 4⋅f<t P​, we use two constraints:

   a) 0≤e 1​+2 4⋅f<2 140. e 1​ is already constrained individually to be a 4-bit value. z f,13​ is the index-13 running sum output by SinsemillaHash(f). By constraining g 0​⋅z f,13​=0, we constrain e 1​+2 4⋅f<2 134<2 140.

   b) 0≤e 1​+2 4⋅f+2 140−t P​<2 140. To check this, we decompose e 1​f′=e 1​+2 4⋅f+2 140−t P​ into fourteen 10-bit words (little-endian) using a running sum z e 1​f′​, looking up each word in a 10-bit lookup table. We then enforce in the custom gate that g 0​⋅z e 1​f′,14​=0.

#### Region layout

A 6​ρ​A 7​e 1​g 0​​A 8​f e 1​f′​A 9​z f,13​z e 1​f′,14​​q NoteCommit,ρ​1 0​​

#### Constraints

Degree 2 3 2 3​Constraint q NoteCommit,ρ​⋅(e 1​+f⋅2 4+g 0​⋅2 254−ρ)=0 q NoteCommit,ρ​⋅g 0​⋅z f,13​=0 q NoteCommit,ρ​⋅(e 1​+f⋅2 4+2 140−t P​−e 1​f′)=0 q NoteCommit,ρ​⋅g 0​⋅z e 1​f′,14​=0​​

### ψ with h 1​=1⟹ψ≥2 254

Recall that ψ=g 1​+2 9⋅g 2​+2 249⋅h 0​+2 254⋅h 1​. When the top bit h 1​ is set, we check that ψ 0..=253​<t P​:

1. h 1​=1⟹h 0​=0.

   Since h 1​=1⟹ψ 0..=253​<t P​<2 126, we know that ψ 126..=253​=0, and in particular h 0​:=ψ 249..=253​=0.

2. h 1​=1⟹0≤g 1​+2 9⋅g 2​<t P​.

   To check that 0≤g 1​+2 9⋅g 2​<t P​, we use two constraints:

   a) 0≤g 1​+2 9⋅g 2​<2 140. g 1​ is already constrained individually to be a 9-bit value. z g,13​ is the index-13 running sum output by SinsemillaHash(g). By constraining h 1​⋅z g,13​=0, we constrain g 1​+2 9⋅g 2​<2 129<2 130.

   b) 0≤g 1​+2 9⋅g 2​+2 130−t P​<2 130. To check this, we decompose g 1​g 2​′=g 1​+2 9⋅g 2​+2 130−t P​ into thirteen 10-bit words (little-endian) using a running sum z g 1​g 2​′​, looking up each word in a 10-bit lookup table. We then enforce in the custom gate that h 1​⋅z g 1​g 2​′,13​=0.

#### Region layout

A 6​ψ h 0​​A 7​g 1​h 1​​A 8​g 2​g 1​g 2′​​A 9​z g,13​z g 1​g 2′​,13​​q NoteCommit,ψ​1 0​​

#### Constraints

Degree 2 3 3 2 3​Constraint q NoteCommit,ψ​⋅(g 1​+g 2​⋅2 9+h 0​⋅2 249+h 1​⋅2 254−ψ)=0 q NoteCommit,ψ​⋅h 1​⋅h 0​=0 q NoteCommit,ψ​⋅h 1​⋅z g,13​=0 q NoteCommit,ψ​⋅(g 1​+g 2​⋅2 9+2 130−t P​−g 1​g 2​′)=0 q NoteCommit,ψ​⋅h 1​⋅z g 1​g 2​′,13​=0​​

### y-coordinate checks

Note that only the y​ LSB of the y-coordinates y(g d​),y(p k d​) was input to the hash, while the other bits of the y-coordinate were unused. However, we must still check that the witnessed y​ bit matches the original point's y-coordinate. The checks for y(g d​),y(p k d​) will follow the same format. For each y-coordinate, we witness:

y​=LSB∣∣k 0​∣∣k 1​∣∣k 2​∣∣k 3​=LSB∣∣ (bits 1..=9 of y) ∣∣ (bits 10..=249 of y) ∣∣ (bits 250..=253 of y) ∣∣ (bit 254 of y) ,​​

where LSB is b 2​ for y(g d​), and d 1​ for y(p k d​). Let j=LSB+2⋅k 0​+2 10⋅k 1​. We decompose j to be 250 bits using a strict 25−word ten-bit lookup. The running sum outputs allow us to susbstitute k 1​=z j,1​.

Recall that b 2​=y​(g d​) and d 1​=y​(p k d​) were pieces input to the Sinsemilla hash and have already been boolean-constrained. k 0​ and k 2​ are constrained outside this gate to 9 and 4 bits respectively. To constrain the remaining chunks, we use the following constraints:

Degree 3​Constraint q NoteCommit,y​⋅bool_check(k 3​)=0​​

Then, to check that the decomposition was correct: Degree 2 2​Constraint q NoteCommit,y​⋅(j−(LSB+k 0​⋅2+k 1​⋅2 10))=0 q NoteCommit,y​⋅(y−(j+k 2​⋅2 250+k 3​⋅2 254))=0​​

### y(g d​) with k 3​=1⟹y(g d​)≥2 254

In these cases, we check that y(g d​)0..=253​<t P​:

1. k 3​=1⟹k 2​=0.

   Since k 3​=1⟹y(g d​)0..=253​<t P​<2 126, we know that y(g d​)126..=253​=0, and in particular k 2​:=y(g d​)250..=253​=0.

2. k 3​=1⟹0≤j<t P​.

   To check that j<t P​, we use two constraints:

   a) 0≤j<2 130. This is expressed in the custom gate as k 3​⋅z j,13​=0, where z j,13​ is the index-13 running sum output by the 10-bit lookup decomposition of j.

   b) 0≤j+2 130−t P​<2 130. To check this, we decompose j′=j+2 130−t P​ into thirteen 10-bit words (little-endian) using a running sum z j′​, looking up each word in a 10-bit lookup table. We then enforce in the custom gate that k 3​⋅z j′,13​=0.

#### Region layout

A 5​y j​A 6​y~​k 1​​A 7​k 0​z j,13​​A 8​k 2​j′​A 9​k 3​z j′,13​​q NoteCommit,y​1 0​​

#### Constraints

Degree 3 3 2 3​Constraint q NoteCommit,y​⋅k 3​⋅k 2​=0 q NoteCommit,y​⋅k 3​⋅z j,13​=0 q NoteCommit,y​⋅(j+2 130−t P​−j′)=0 q NoteCommit,y​⋅k 3​⋅z j′,13​=0​​

Outside this gate, we have constrained:

- short_lookup_range_check(k 0​,9)
- short_lookup_range_check(k 2​,4)

### y(p k d​)

This can be checked in exactly the same way as y(g d​), with b 2​ replaced by d 1​.