aztec-packages icon indicating copy to clipboard operation
aztec-packages copied to clipboard

Change the aztec-nr Address derivation

Open nventuro opened this issue 1 year ago • 1 comments

The AztecAddress is currently computed as poseidon2(pub_keys_hash, partial_address). This needs to change to:

let h: Field = poseidon2(pub_keys_hash, partial_address); // h is also called 'pre_address'
let mut maybe_address: Point = h * G + Ivpk_m;
if maybe_address.y > Y_HALF_RANGE { maybe_address = -maybe_address }
let address: Field = maybe_address.x; // wrap in AztecAddress

Note that this means we can no longer derive an address from just the pub keys hash and the partial address, we now also need the Ivpk_m (which part of the preimage of the pub keys hash, and we should know it in all flows in which we also know the pub keys hash).

nventuro avatar Oct 02 '24 18:10 nventuro

Contract instances also have to prove the derivation of the public keys hash to show that they Ivpk_m they're using in the final address derivation is the same as the one that's behind said hash. This prevents malleability issues as otherwise Ivpk_m is a free parameter unlinked to the keys hash (i.e. uncomitted).

nventuro avatar Oct 10 '24 18:10 nventuro