privacy-scaling-explorations/sonobe

Implement hash committed instance circuit

arnaucube opened this issue · 0 comments

In order to compute in-circuit

$$\mathsf{u}_i.X \stackrel{?}{=} H(vk, i, z_0, z_i, \mathsf{U}_i)$$

$$\mathsf{U}_{i+1}.X \leftarrow H(vk, i+1, z_0, z _{i+1} , U _{i+1} )$$

we need a gadget that does that logic and can be reused for both cases, which basically takes as inputs $j, z_0, z_j, U_j$ for $j \in {i, i+1}$ and returns the Poseidon hash of it.

Needs to take into account that the $x,y$ coordinates of $cm(E), cm(W)$ from $U_j$ (the committed instance) are in $\mathbb{F}_q$, while the constraint field is $\mathbb{F}_r$. Srinath Setty mentioned that the coordinates can be used as limbs in the constraint field that represent the coordinates from the base field in order to work in the constraint field.