Closed cedoor closed 4 months ago
The BabyPbk Circomlib's template needs a check on the input to make sure s (secret scalar defined here: https://www.rfc-editor.org/rfc/rfc8032.html#section-5.1.5) is < l (prime number of 251 bits defined here https://eips.ethereum.org/EIPS/eip-2494). This PR adds that check.
BabyPbk
s
l
The secret scalar is generated outside circuits, with the @zk-kit/eddsa-poseidon package (deriveSecretScalar function), and according to the EdDSA standard it is derived from a private key hashed with sha-3. ZK-Kit is currently using blake1.
@zk-kit/eddsa-poseidon
deriveSecretScalar
This PR is also related to https://github.com/privacy-scaling-explorations/zk-kit/issues/239, which aims to make sure the secret scalar is always < l.
Fixes #744 Re https://github.com/privacy-scaling-explorations/zk-kit/issues/239
This bug was found by the Geometry team. More info in #744.
The SNARK artifacts need to be generated again after this PR.
yarn prettier
yarn lint
Description
The
BabyPbk
Circomlib's template needs a check on the input to make sures
(secret scalar defined here: https://www.rfc-editor.org/rfc/rfc8032.html#section-5.1.5) is <l
(prime number of 251 bits defined here https://eips.ethereum.org/EIPS/eip-2494). This PR adds that check.The secret scalar is generated outside circuits, with the
@zk-kit/eddsa-poseidon
package (deriveSecretScalar
function), and according to the EdDSA standard it is derived from a private key hashed with sha-3. ZK-Kit is currently using blake1.This PR is also related to https://github.com/privacy-scaling-explorations/zk-kit/issues/239, which aims to make sure the secret scalar is always <
l
.Related Issue(s)
Fixes #744 Re https://github.com/privacy-scaling-explorations/zk-kit/issues/239
Other information
This bug was found by the Geometry team. More info in #744.
The SNARK artifacts need to be generated again after this PR.
Checklist
yarn prettier
andyarn lint
without getting any errors