MDS Matrix Parameters might be weak

[moCello]

Summary

The Poseidon paper does not specify a specific MDS Matrix to use. Instead, it provides an algorithm for generating MDS Matrices which requires two starting vectors x and y. Additionally, the paper emphasizes that not all MDS Matrices provide the same level of security.

In Dusk’s implementation, x=[0,1,2,3,4] and y=[5,6,7,8,9].
In Aztec’s implementation, x and y are randomly generated, and then further subjected to three additional checks suggested in the Poseidon paper.

Aztec probably has a reason for randomly generating parameters, as opposed to just picking the first possible vectors and Dusk’s parameters may provide insufficient mixing, which in turn might reduce the security level of this Poseidon implementation.

But more research needs to be done to check if our specific MDS parameters are safe.

Relevant Context

Finding from the plonk audit.

[moCello]

After some further investigation by the auditor of the plonk implementation, it was found that the MDS matrix parameters aren't weak.