sapling-crypto
sapling-crypto copied to clipboard
zcash
Zcash "Sapling" cryptography
These would test group hash invoked with various personalizations, using vectors obtained from Python/Sagemath.
These would test pedersen_hash using vectors obtained from Python/Sagemath.
This is done in `AllocatedNum` and `EdwardsPoint`.
This has little surface area but still needs to be tested, e.g., `add_bool_with_coeff`.
These are used outside the circuit a lot, but it seems they would be very handy inside the circuit. Then, you could have a "compress" method defined only for prime...
`Spend` circuit can have "dummy" inputs that bypass the authentication path check, let's test that these constraints work correctly.
Right now it's just naive, but we can use multiexp.
Consider a 251-bit multiplication [x] P. Edwards double-and-add requires 3252 constraints: 2 to select P or the zero point initially; 250 doublings at 5 constraints each; 250 conditional additions at...
