Closed paberr closed 1 year ago
Further investigating this, we found the root cause of the error.
The precomputed_base_multiscalar_mul_le
function used looks as follows:
for (bits, bases) in scalars.zip(bases) {
let bases = bases.borrow();
let bits = bits.to_bits_le()?;
result.precomputed_base_scalar_mul_le(bits.iter().zip(bases))?;
}
It seems to expect precomputed_base_scalar_mul_le
to add the base scalar multiplication to the original value of result
.
However, both the generic implementation and the short weierstrass implementation simply calculate the base scalar mult. and set *self = result;
. So, the variable is overwritten in every iteration of the loop.
So, the question is: what's the expected behaviour of precomputed_base_scalar_mul_le
? Should it add to self?
Or should precomputed_base_multiscalar_mul_le
instead take care of the addition?
EDIT: It seems like it is expected to add to self as done in the twisted edwards implementation.
I've tested and confirmed that this is the issue.
I noticed that the pedersen hash native equality test fails on the MNT6-753 curve. So far, I have not investigated it any further.
Here is a straightforward copy of the original test within the crate, just adapted to use the MNT6-753 curve. It fails due to the result not being equal:
I compared the result of the off-circuit hash to our reference implementation and it seems correct. Thus, the problem must occur in the ZKP version of the hash.