zec
/
zips
mirror of https://github.com/zcash/zips.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

ZIP 224: Clarify that the IETF hash-to-curve ID is not normative

This commit is contained in:
Jack Grigg 2021-02-28 02:10:04 +00:00 committed by Daira Hopwood
parent 2961726557
commit 630280869e
2 changed files with 10 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
zip-0224.html
View File

@ -31,15 +31,15 @@ Discussions-To: &lt;<a href="https://github.com/zcash/zips/issues/435">https://g
<li>Pallas is used as the "application curve", on which the Orchard protocol itself is implemented (c/f Jubjub).</li>
<li>Vesta is used as the "circuit curve"; its scalar field (being the base field of Pallas) is the "word" type over which the circuit is implemented (c/f BLS12-381).</li>
</ul>
<p>We use (version 10 of) the IETF hash-to-curve Internet Draft <a id="id2" class="footnote_reference" href="#ietf-hash-to-curve">26</a> to implement
<p>We use the "simplified SWU" algorithm to define an infallible
<span class="math">\(\mathsf{GroupHash}\)</span>
, instead of the BLAKE2s-based mechanism used for Sapling. We specifically use the "simplified SWU" algorithm, which provides an infallible
<span class="math">\(\mathsf{GroupHash}\)</span>
.</p>
, instead of the fallible BLAKE2s-based mechanism used for Sapling. It is intended to follow (version 10 of) the IETF hash-to-curve Internet Draft <a id="id2" class="footnote_reference" href="#ietf-hash-to-curve">26</a> (but the protocol specification takes precedence in the case of any discrepancy).</p>
<p>The presence of the curve cycle is an explicit design choice. This ZIP only uses half of the cycle (Pallas being an embedded curve of Vesta); the full cycle is expected to be leveraged by future ZIPs.</p>
<ul>
<li>Curve specifications: <a id="id3" class="footnote_reference" href="#spec-pasta">10</a></li>
<li>Group hash: <a id="id4" class="footnote_reference" href="#spec-pasta-grouphash">11</a></li>
<li>
<span class="math">\(\mathsf{GroupHash}\)</span>
: <a id="id4" class="footnote_reference" href="#spec-pasta-grouphash">11</a></li>
<li>Supporting evidence: <a id="id5" class="footnote_reference" href="#pasta-evidence">27</a></li>
</ul>
</section>

10
zip-0224.rst
View File

@ -45,17 +45,17 @@ embedded curve Jubjub:
- Vesta is used as the "circuit curve"; its scalar field (being the base field of Pallas)
is the "word" type over which the circuit is implemented (c/f BLS12-381).
We use (version 10 of) the IETF hash-to-curve Internet Draft [#ietf-hash-to-curve]_ to
implement :math:`\mathsf{GroupHash}`, instead of the BLAKE2s-based mechanism used for
Sapling. We specifically use the "simplified SWU" algorithm, which provides an infallible
:math:`\mathsf{GroupHash}`.
We use the "simplified SWU" algorithm to define an infallible :math:`\mathsf{GroupHash}`,
instead of the fallible BLAKE2s-based mechanism used for Sapling. It is intended to follow
(version 10 of) the IETF hash-to-curve Internet Draft [#ietf-hash-to-curve]_ (but the
protocol specification takes precedence in the case of any discrepancy).
The presence of the curve cycle is an explicit design choice. This ZIP only uses half of
the cycle (Pallas being an embedded curve of Vesta); the full cycle is expected to be
leveraged by future ZIPs.
- Curve specifications: [#spec-pasta]_
- Group hash: [#spec-pasta-grouphash]_
- :math:`\mathsf{GroupHash}`: [#spec-pasta-grouphash]_
- Supporting evidence: [#pasta-evidence]_
Proving system