Closed HarryR closed 6 years ago
Note that the MiMC paper only analyses exponents of the forms 2t + 1 and 2t - 1 (in section 5.3), and 4 is not of either of those forms.
I have left it with an exponent of 5, because it's a bijection, and I think that property is useful, in the sense of 'dark magic serendipity'...
As per Daira's comments on https://github.com/HarryR/ethsnarks/pull/12#discussion_r211918756
It's possible to reduce the number of constraints, Daira provided an example where exponent is 5 but uses two less constraints.
It's not necessary for the exponent to create a bijection when using MiMC in Feistel mode. See §5.3
So, if there's no need for a bijection, then the exponent could be reduced to 3. Which would reduce the number of constraints anyway?
Either way, the number of constraints can be reduced:
Have confirmed this works as expected.
Awesome :D Thanks @daira - I will implement this shortly.
Changes necessary:
3
in the round count calculation is not the exponent, it is cubing. change this back to static 3 rather than the exponent.gcd(p-1, e) == 1
This will result in 644 constraints for a full round of LongsightF. And for the merkle tree (r*29) >= 322, so if we use 12 rounds that should work.
Number of rounds for LongsightF:
Another constraint can be removed by reducing the exponent to
4
, there the constraints become:or 3:
TODO for Harry, re-review MiMC paper in detail, analyse JK97 paper.