Mina中的Poseidon hash

1. 引言

Mina系列博客有：

• Mina概览
• Mina的支付流程
• Mina的zkApp
• Mina中的Pasta（Pallas和Vesta）曲线
• Mina中的Schnorr signature
• Mina中的Pickles SNARK
• Mina中的Kimchi SNARK
• Mina Kimchi SNARK 代码解析
• Mina Berkeley QANet测试网zkApp初体验

Sponge相关前序博客有：

• 密码学中的sponge函数
• POSEIDON: A New Hash Function for Zero-Knowledge Proof Systems 学习笔记
• snark/stark-friendly hash函数

Mina中的Poseidon hash代码实现见：

• https://github.com/o1-labs/proof-systems/blob/master/oracle/src/poseidon.rs

Poseidon hash函数为zk-SNARKs高效的哈希函数，其基于sponge函数：

• 其state由field elements组成
• 具有基于field element运算（加法和幂乘运算）的permutation。该permutation类似于SPN block cipher：
  • 1）具有一个S-box（对一个group element的幂乘）
  • 2）将state与一MDS矩阵进行矩阵乘法预算（乘法和加法运算）
  • 3）对state做常量加法预算

由于一个field element约为255位，单个field element足以作为sponge的capaciity。而state通常较小，如Mina中的state为4个field element，rate为3个field element。

Mina的Poseidon hash实现仍在开发中，有以下几个选项：

• 1）定义Mina自己的版本。
• 2）遵循ZCash的版本。【针对的是2011年论文《Duplexing the sponge: single-pass authenticated encryption and other applications》】
• 3）定义基于ZCash的扩展版本。

相应的伪代码为：

# modular exponentiation
def sbox(field_element):
    field_element^5

# apply MDS matrix
def apply_mds(state):
    n = [0, 0, 0]
    n[0] = state[0] * mds[0][0] + state[1] * mds[0][1] + state[2] * mds[0][2]
    n[1] = state[0] * mds[1][0] + state[1] * mds[1][1] + state[2] * mds[1][2]
    n[2] = state[0] * mds[2][0] + state[1] * mds[2][1] + state[2] * mds[2][2]
    return n
    
# a round
def full_round(round, state):
    # sbox
    state[0] = sbox(state[0])
    state[1] = sbox(state[1])
    state[2] = sbox(state[2])

    # apply MDS matrix
    state = apply_mds(state)

    # add round constant
    constant = round_constants[round]
    state[0] += constant[0]
    state[1] += constant[1]
    state[2] += constant[2]

# poseidon is just a number of rounds with different round constants
def poseidon(state, rounds):
    # ARK_INITIAL is not used usually, but if used there's 
    round_offset = 0
    if ARK_INITIAL:
        constant = round_constants[0]
        state[0] += constant[0]
        state[1] += constant[1]
        state[2] += constant[2]
        round_offset = 1
        
    for round in range(round_offset, rounds + round_offset):
        full_round(round, state)

2. Mina中的Poseidon hash代码解析

在 Mina的Poseidon hash代码 中，实现了2套Poseidon hash函数：

impl SpongeConstants for PlonkSpongeConstantsLegacy {
    const SPONGE_CAPACITY: usize = 1;
    const SPONGE_WIDTH: usize = 3;
    const SPONGE_RATE: usize = 2;
    const PERM_ROUNDS_FULL: usize = 63;
    const PERM_ROUNDS_PARTIAL: usize = 0;
    const PERM_HALF_ROUNDS_FULL: usize = 0;
    const PERM_SBOX: u32 = 5;
    const PERM_FULL_MDS: bool = true;
    const PERM_INITIAL_ARK: bool = true;
}

impl SpongeConstants for PlonkSpongeConstantsKimchi {
    const SPONGE_CAPACITY: usize = 1;
    const SPONGE_WIDTH: usize = 3;
    const SPONGE_RATE: usize = 2;
    const PERM_ROUNDS_FULL: usize = 55;
    const PERM_ROUNDS_PARTIAL: usize = 0;
    const PERM_HALF_ROUNDS_FULL: usize = 0;
    const PERM_SBOX: u32 = 7;
    const PERM_FULL_MDS: bool = true;
    const PERM_INITIAL_ARK: bool = false;
}