​Session 9 of the Zcash Protocol Study Series, a 13-session guided reading of the Zcash Protocol Specification, run as a sub-series of Zcash Engineering Office Hours.

​Topic: §5.4, Concrete Cryptographic Schemes.

​Every session so far has been allowed to say "a hash function," "a commitment scheme," "a key agreement."

​Protocol Section §5.4 names the actual primitives and pins every byte: which hash, which curve, which personalization string, which generator.

​Three families of hash function, three different reasons. SHA-256 because Sprout inherited Bitcoin's tooling. BLAKE2b and BLAKE2s because they are fast and take a personalization string. Pedersen and Sinsemilla because they are cheap inside a circuit, which is a completely different cost model from cheap on a CPU. The spec says outright why Sinsemilla exists: to make efficient use of the lookups available in recent proof systems including Halo 2.

​Then domain separation, which turns out to be most of the design. PRF^expand is BLAKE2b-512 with "Zcash_ExpandSeed". PRF^ock is BLAKE2b-256 with "Zcash_Derive_ock". Sapling's nullifier PRF is BLAKE2s-256 with "Zcash_nf". Orchard's is Poseidon instead, because it has to run inside the circuit. Same idea each time, and that ASCII string is the whole of what keeps two derivations from colliding.

​Then the curves. Jubjub's base field is BLS12-381's scalar field. Pallas and Vesta form a cycle, where the base field of each is the scalar field of the other. Both exist so you can do elliptic curve arithmetic inside a proof whose field the outer curve already fixed.

​And RedDSA, one Schnorr scheme instantiated twice: spend authorization with key re-randomization, the binding signature without. That single difference is why spending does not link your transactions.

​Bring questions!

​Live on the Zcash Global Discord stage. Recorded by Zcash Brazil with Portuguese translation.

​PDF: https://zips.z.cash/protocol/protocol.pdf, we're reading §5.4.

​Catch up on Session 8 (Signatures, Balance, and Binding): (Signatures, Balance, and Binding):

​Read Session 8 notes here: https://x.com/thedrekal/status/2095928460292091932

​Full 13-session arc and canonical thread on the Zcash forum:
https://forum.zcashcommunity.com/t/protocol-study-series-12-session-guided-reading-of-the-zcash-protocol-specification-starting-april-21/55350

​Hosted by Mark Henderson (/shieldedmark), Shielded Labs.