How about integrate with Plonky2 into Orchard?

adust09 · June 16, 2023, 7:42am

I am considering rewriting current Orchard circuit (Halo2) with Plonky2.
This would have the following two advantages

1. Recursive Proof
When calculating the Commitment tree, the use of Plonky2’s Recursive system is expected to significantly reduce the proof time.
However, it will be necessary to replace the Sinsemilla Hash with the Poseidon Hash.

2. Quantum resistance
For this, daira has suggested using Plonky2 for the same.

github.com/zcash/zcash

Fully post-quantum Zcash

opened 11:43AM - 28 Mar 16 UTC

daira

I-SECURITY C-research A-crypto I-performance I-privacy A-consensus C-future-proofing A-circuit not in 1.0 special to Daira Threat Model protocol spec M-requires-zip elliptic curves

There are three components necessary for a post-quantum Zcash: - a post-quantum… public key encryption scheme; - reanalysis of symmetric crypto parameter choices against quantum attacks; - a practical post-quantum zkSNARK. (For spend authorization, there are two options: use a post-quantum public key signature scheme, or incorporate spend authorization fully into the SNARK circuit. So only the three components above are strictly necessary.) The first of these is already available, for example using [New Hope](https://eprint.iacr.org/2015/1092) [edit: or [CRYSTALS-Kyber as suggested below](https://github.com/zcash/zcash/issues/805#issuecomment-1219687266)] key exchange in place of Curve25519 elliptic curve key exchange. A complication is that New Hope has larger public keys and larger ciphertexts (2048 bytes each; see section 7.1 of the New Hope paper). The public key size means that a New Hope key can't be encoded directly in an address, but that is not a fundamental obstacle: it might be possible to use an address registration protocol as described in #340, for example. The ciphertext size is quite large compared to the rest of a Pour description (and remember that we need two of them), but not totally impractical. Alternatively some other scheme may have shorter ciphertexts. For the zkSNARK, in principle the existence of one-way functions is sufficient for the existence of ZK proof systems. The issue is practicality: practical zkSNARKs use pairing-based cryptography, and it is not clear whether or not that is available for PQ public key cryptosystems. Note that even though lacking a PQ-zkSNARK means that arbitrary currency could be forged by a quantum attacker (if quantum computers are ever practical), there is still value in switching to a PQ encryption scheme and ensuring that the symmetric parameter choices are sufficient. This is because a quantum attacker could otherwise break the Curve25519-based encryption (for known addresses) and obtain past transaction metadata. It is also useful to reanalyse the symmetric parameter choices in order to check whether Zcash already achieves post-quantum past privacy for payments to addresses that have been kept secret. If this were the case then it would allow Zcash to be used now by people who require that property.

Having said that, is it possible to rewrite Orchard with Plonky2?
My current understanding is not certain about the following 3 points.

Is there a problem with just replacing Poseidon Hash for the Commitment tree calculation, or is there a problem with PRF also using Poseidon Hash?
The whole thing is designed around Pallas and Vesta curve, but is there any problem if we define the ZKP part with Plonky2’s Goldilocks Field, so that the defined area of Pallas and Vesta and the defined area of Goldilocks Field coexist?
Halo2 allows Recursive system, but as far as I can tell from checking the ZCash specs, it doesn’t seem to get that benefit, why?

Topic		Replies	Views
Halo2 prover time Technology	1	1020	June 1, 2021
Accelerating Zcash on FPGA clusters Community Grants	3	665	August 23, 2022
Snarky Uses and an Unfamiliar DEX. Help? General	2	893	November 27, 2018
Announcing Halo: Recursive Proof Composition without a Trusted Setup Technology	23	3173	July 16, 2020
Using Halo/Halo 2 for short-term improvements to Zcash's Scalability Technology	10	1412	September 14, 2023

How about integrate with Plonky2 into Orchard?

Related topics