Specification 
- The Orchard protocol is specified as an update to the Zcash Protocol Specification . Given that it largely follows the design of the Sapling protocol, we provide here a list of differences, with references to their normative specifications and associated design rationale.
+ The Orchard protocol MUST be implemented as specified in the Zcash Protocol Specification .
+ Given that the Orchard protocol largely follows the design of the Sapling protocol, we provide here a list of differences, with references to their normative specifications and associated design rationale.
Curves
The Orchard protocol uses the Pallas / Vesta curve cycle, in place of BLS12-381 and its embedded curve Jubjub:
@@ -33,14 +37,14 @@ Discussions-To: <https://g
We use the "simplified SWU" algorithm to define an infallible
\(\mathsf{GroupHash}\)
- , instead of the fallible BLAKE2s-based mechanism used for Sapling. It is intended to follow (version 10 of) the IETF hash-to-curve Internet Draft (but the protocol specification takes precedence in the case of any discrepancy).
+ , instead of the fallible BLAKE2s-based mechanism used for Sapling. It is intended to follow (version 10 of) the IETF hash-to-curve Internet Draft (but the protocol specification takes precedence in the case of any discrepancy).
The presence of the curve cycle is an explicit design choice. This ZIP only uses half of the cycle (Pallas being an embedded curve of Vesta); the full cycle is expected to be leveraged by future ZIPs.
- - Curve specifications:
+ - Curve specifications:
-
\(\mathsf{GroupHash}\)
- :
- - Supporting evidence:
+ :
+ - Supporting evidence:
Circuit
Orchard uses a single circuit for both spends and outputs, similar to Sprout. An "action" contains both a single (possibly dummy) note being spent, and a single (possibly dummy) note being created.
An Orchard transaction contains a "bundle" of actions, and a single Halo 2 proof that covers all of the actions in the bundle.
- - Action description:
- - Circuit statement:
- - Design rationale:
+ - Action description:
+ - Circuit statement:
+ - Design rationale:
Commitments
The Orchard protocol has equivalent commitment schemes to Sapling. For non-homomorphic commitments, Orchard uses the UPA-efficient Sinsemilla in place of Bowe--Hopwood Pedersen hashes.
- - Sinsemilla hash function:
- - Sinsemilla commitments:
- - Design rationale:
+ - Sinsemilla hash function:
+ - Sinsemilla commitments:
+ - Design rationale:
Commitment tree
Orchard uses an identical commitment tree structure to Sapling, except that we instantiate it with Sinsemilla instead of a Bowe-Hopwood Pedersen hash.
- - Design rationale and considered alternatives:
+ - Design rationale and considered alternatives:
Signatures
Orchard uses RedPallas (RedDSA instantiated with the Pallas curve) as its signature scheme in place of Sapling's RedJubjub (RedDSA instantiated with the Jubjub curve).
- - RedPallas:
+ - RedPallas:
@@ -152,7 +156,7 @@ Discussions-To: <