Protocol Study #9.2: Hashes, Curves, and PRFs (Part 2)

​Part 2 of Session 9 in the Zcash Protocol Study Series, a guided reading of the Zcash Protocol Specification and a sub-series of Zcash Engineering Office Hours.

​Part 1 read the hash functions (§5.4.1). Part 2 adds secret keys to them and then reads the curves underneath.

​We read §5.4.2 to §5.4.5: the pseudo-random functions behind nullifiers and key derivation, ChaCha20-Poly1305 with an all-zero nonce (and why that is safe here), the FF1 permutation that makes diversified addresses, and Diffie-Hellman key agreement on Curve25519, Jubjub and Pallas.

​Then §5.4.9: why Jubjub's coordinates live in BLS12-381's scalar field, how Pallas and Vesta form a cycle, how a point is decoded from 32 bytes, and how Zcash hashes a string onto a curve.

​Live on the Zcash Discord stage. Recorded by Zcash Brazil with Portuguese translation.

​PDF: https://zips.z.cash/protocol/protocol.pdf Series thread: https://forum.zcashcommunity.com/t/protocol-study-series-12-session-guided-reading-of-the-zcash-protocol-specification-starting-april-21/55350

​Hosted by Mark Henderson (@shieldedmark), Shielded Labs.