zec
/
zips
mirror of https://github.com/zcash/zips.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

ZIP 316: corrections to minimum lengths. 

Signed-off-by: Daira Hopwood <daira@jacaranda.org>
This commit is contained in:
Daira Hopwood 2021-04-22 23:18:34 +01:00
parent 24957b6745
commit 0168ce7ec3
2 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
zip-0316.html
View File

@ -428,14 +428,14 @@ c^{n+m}}{q}\)</span>
<span class="math">\(y' \neq y\)</span>
, all four pieces are randomized.</li>
</ul>
<p>Note that the size of each piece is at least 11 bytes.</p>
<p>Note that the size of each piece is at least 24 bytes.</p>
<p>It would be possible to make an attack more expensive by making the work done by a Producer more expensive. (This wouldn't necessarily have to increase the work done by the Sender.) However, given that Unified Addresses may need to be produced on constrained computing platforms, this was not considered to be beneficial overall.</p>
</section>
<section id="efficiency"><h4><span class="section-heading">Efficiency</span><span class="section-anchor"> <a rel="bookmark" href="#efficiency"><img width="24" height="24" src="assets/images/section-anchor.png" alt=""></a></span></h4>
<p>The cost is dominated by 4 BLAKE2b compressions for
<span class="math">\(\ell_M \leq 128\)</span>
bytes. A UA containing a Transparent Address, a Sapling Address, and an Orchard Address, would have
<span class="math">\(\ell_M = 112\)</span>
<span class="math">\(\ell_M = 128\)</span>
bytes. The restriction to a single Address with a given Typecode (and at most one Transparent Address) means that this is also the maximum length as of NU5 activation.</p>
<p>For longer UAs (when other Typecodes are added), the cost increases to 6 BLAKE2b compressions for
<span class="math">\(128 &lt; \ell_M \leq 192\)</span>

4
zip-0316.rst
View File

@ -539,7 +539,7 @@ A 4-round Feistel thwarts this and similar attacks. Defining :math:`x` and
* if :math:`x' \neq x` and :math:`y' \neq y`, all four pieces are
randomized.
Note that the size of each piece is at least 11 bytes.
Note that the size of each piece is at least 24 bytes.
It would be possible to make an attack more expensive by making the work
done by a Producer more expensive. (This wouldn't necessarily have to
@ -552,7 +552,7 @@ Efficiency
The cost is dominated by 4 BLAKE2b compressions for :math:`\ell_M \leq 128`
bytes. A UA containing a Transparent Address, a Sapling Address, and an
Orchard Address, would have :math:`\ell_M = 112` bytes. The restriction
Orchard Address, would have :math:`\ell_M = 128` bytes. The restriction
to a single Address with a given Typecode (and at most one Transparent
Address) means that this is also the maximum length as of NU5 activation.