zcash / sapling-crypto

Zcash "Sapling" cryptography
Other
79 stars 65 forks source link

Allow the authentication path to be not enforced #60

Closed ebfull closed 6 years ago

ebfull commented 6 years ago

In the Sprout circuit, zero-valued input notes can bypass the check against the anchor. These are so-called "dummy notes" as they don't affect the balance equation.

We need this in Sapling too, so that input arity can be hidden. Otherwise, it's a privacy regression from Sprout, strictly speaking. (Output arity can be hidden already; you can cheaply create zero-valued output notes.)