# Commit ivk

## Message decomposition

SinsemillaShortCommit is used in the Commit ivk function. The input to SinsemillaShortCommit is:

I2LEBSP ℓ base Orchard p​​(ak)∣∣I2LEBSP ℓ base Orchard p​​(nk),

where ak, nk are Pallas base field elements, and ℓ base Orchard p​=255.

Sinsemilla operates on multiples of 10 bits, so we start by decomposing the message into chunks:

I2LEBSP ℓ base Orchard p​​(ak)I2LEBSP ℓ base Orchard p​​(nk)​=a∣∣b 0​∣∣b 1​=(bits 0..=249 of ak)∣∣(bits 250..=253 of ak)∣∣(bit 254 of ak)=b 2​∣∣c∣∣d 0​∣∣d 1​=(bits 0..=4 of nk)∣∣(bits 5..=244 of nk)∣∣(bits 245..=253 of nk)∣∣(bit 254 of nk)​​

Then we recompose the chunks into message pieces:

Length (bits)250 10 240 10​Piece a b=b 0​∣∣b 1​∣∣b 2​c d=d 0​∣∣d 1​​​

Each message piece is constrained by SinsemillaHash to its stated length. Additionally, ak and nk are witnessed as field elements, so we know they are canonical. However, we need additional constraints to enforce that:

- The chunks are the correct bit lengths (or else they could overlap in the decompositions and allow the prover to witness an arbitrary SinsemillaShortCommit message).
- The chunks contain the canonical decompositions of ak and nk (or else the prover could witness an input to SinsemillaShortCommit that is equivalent to ak and nk but not identical).

Some of these constraints can be implemented with reusable circuit gadgets. We define a custom gate controlled by the selector q Commit ivk​ to hold the remaining constraints.

## Bit length constraints

Chunks a and c are directly constrained by Sinsemilla. For the remaining chunks, we use the following constraints:

Degree 3 3​Constraint short_lookup_range_check(b 0​,4)short_lookup_range_check(b 2​,5)short_lookup_range_check(d 0​,9)q Commit ivk​⋅bool_check(b 1​)=0 q Commit ivk​⋅bool_check(d 1​)=0​​

where bool_check(x)=x⋅(1−x) and short_lookup_range_check() is a short lookup range check.

## Decomposition constraints

We have now derived or witnessed every subpiece, and range-constrained every subpiece:

- a (250 bits) is witnessed and constrained outside the gate;
- b 0​ (4 bits) is witnessed and constrained outside the gate;
- b 1​ (1 bits) is witnessed and boolean-constrained in the gate;
- b 2​ (5 bits) is witnessed and constrained outside the gate;
- c (240 bits) is witnessed and constrained outside the gate;
- d 0​ (9 bits) is witnessed and constrained outside the gate;
- d 1​ (1 bits) is witnessed and boolean-constrained in the gate.

We can now use them to reconstruct both the (chunked) message pieces, and the original field element inputs:

b d ak nk​=b 0​+2 4⋅b 1​+2 5⋅b 2​=d 0​+2 9⋅d 1​=a+2 250⋅b 0​+2 254⋅b 1​=b 2​+2 5⋅c+2 245⋅d 0​+2 254⋅d 1​​​

Degree 2 2 2 2​Constraint q Commit ivk​⋅(b−(b 0​+b 1​⋅2 4+b 2​⋅2 5))=0 q Commit ivk​⋅(d−(d 0​+d 1​⋅2 9))=0 q Commit ivk​⋅(a+b 0​⋅2 250+b 1​⋅2 254−ak)=0 q Commit ivk​⋅(b 2​+c⋅2 5+d 0​⋅2 245+d 1​⋅2 254−nk)=0​​

## Canonicity checks

At this point, we have constrained I2LEBSP ℓ base Orchard p​​(ak) and I2LEBSP ℓ base Orchard p​​(nk) to be 255-bit values, with top bits b 1​ and d 1​ respectively. We have also constrained:

I2LEBSP ℓ base Orchard p​​(ak)I2LEBSP ℓ base Orchard p​​(nk)​=ak(mod q P​)=nk(mod q P​)​​

where q P​ is the Pallas base field modulus. The remaining constraints will enforce that these are indeed canonically-encoded field elements, i.e.

I2LEBSP ℓ base Orchard p​​(ak)I2LEBSP ℓ base Orchard p​​(nk)​<q P​<q P​​​

The Pallas base field modulus has the form q P​=2 254+t P​, where t P​=0x224698fc094cf91b992d30ed00000001 is 126 bits. We therefore know that if the top bit is not set, then the remaining bits will always comprise a canonical encoding of a field element. Thus the canonicity checks below are enforced if and only if b 1​=1 (for ak) or d 1​=1 (for nk).

> In the constraints below we use a base-2 10 variant of the method used in libsnark (originally from [SVPBABW2012, Appendix C.1]) for range constraints 0≤x<t:

> - Let t′ be the smallest power of 2 10 greater than t.
> - Enforce 0≤x<t′.
> - Let x′=x+t′−t.
> - Enforce 0≤x′<t′.

### ak with b 1​=1⟹ak≥2 254

In these cases, we check that ak 0..=253​<t P​:

1. b 1​=1⟹b 0​=0.

   Since b 1​=1⟹ak 0..=253​<t P​<2 126, we know that ak 126..=253​=0, and in particular b 0​:=ak 250..=253​=0.

2. b 1​=1⟹0≤a<t P​.

   To check that a<t P​, we use two constraints:

   a) 0≤a<2 130. This is expressed in the custom gate as b 1​⋅z a,13​=0, where z a,13​ is the index-13 running sum output by SinsemillaHash(a).

   b) 0≤a+2 130−t P​<2 130. To check this, we decompose a′=a+2 130−t P​ into thirteen 10-bit words (little-endian) using a running sum z a′​, looking up each word in a 10-bit lookup table. We then enforce in the custom gate that b 1​⋅z a′,13​=0.

Degree 3 3 2 3​Constraint q Commit ivk​⋅b 1​⋅b 0​=0 q Commit ivk​⋅b 1​⋅z a,13​=0 q Commit ivk​⋅(a+2 130−t P​−a′)=0 q Commit ivk​⋅b 1​⋅z a′,13​=0​​

### nk with d 1​=1⟹nk≥2 254

In these cases, we check that nk 0..=253​<t P​:

1. d 1​=1⟹d 0​=0.

   Since d 1​=1⟹nk 0..=253​<t P​<2 126, we know that nk 126..=253​=0, and in particular d 0​:=nk 245..=253​=0.

2. d 1​=1⟹0≤b 2​+2 5⋅c<t P​.

   To check that 0≤b 2​+2 5⋅c<t P​, we use two constraints:

   a) 0≤b 2​+2 5⋅c<2 140. b 2​ is already constrained individually to be a 5-bit value. z c,13​ is the index-13 running sum output by SinsemillaHash(c). By constraining d 1​⋅z c,13​=0, we constrain b 2​+2 5⋅c<2 135<2 140.

   b) 0≤b 2​+2 5⋅c+2 140−t P​<2 140. To check this, we decompose b 2​c′=b 2​+2 5⋅c+2 140−t P​ into fourteen 10-bit words (little-endian) using a running sum z b 2​c′​, looking up each word in a 10-bit lookup table. We then enforce in the custom gate that d 1​⋅z b 2​c′,14​=0.

Degree 3 3 2 3​Constraint q Commit ivk​⋅d 1​⋅d 0​=0 q Commit ivk​⋅d 1​⋅z c,13​=0 q Commit ivk​⋅(b 2​+c⋅2 5+2 140−t P​−b 2​c′)=0 q Commit ivk​⋅d 1​⋅z b 2​c′,14​=0​​

## Region layout

The constraints controlled by the q Commit ivk​ selector are arranged across 9 advice columns, requiring two rows.

ak nk​a c​b d​b 0​d 0​​b 1​d 1​​b 2​​z a,13​z c,13​​a′b 2​c′​z a′,13​z b 2​c′,14​​q Commit ivk​1 0​​