Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Zero padding for expand_message_xmd should be 128 bytes, not 64 bytes #7

Closed
4 tasks done
daira opened this issue Mar 22, 2021 · 1 comment
Closed
4 tasks done

Zero padding for expand_message_xmd should be 128 bytes, not 64 bytes #7

daira opened this issue Mar 22, 2021 · 1 comment

Comments

@daira
Copy link
Contributor

daira commented Mar 22, 2021 •
edited
Loading

As pointed out by NCC, it should be the length of an input block for the hash, which is 128 bytes for BLAKE2b-512.
@str4d str4d transferred this issue from zcash/orchard Mar 22, 2021
daira added a commit to daira/zips that referenced this issue Mar 26, 2021
@daira
NCC audit: Fix a discrepancy between \crossref{concretegrouphashpalla…
9d62142 
…sandvesta} and \cite{ID-hashtocurve}.

The zero padding in expand_message_xmd should be 128 bytes (matching the input block size of
BLAKE2b), rather than 64 bytes.

See also zcash/pasta#2 and zcash/pasta_curves#7

Signed-off-by: Daira Hopwood <daira@jacaranda.org>
@daira
Copy link
Contributor Author

daira commented Jun 2, 2021

This was fixed for the test vectors even before the first commit of zcash/zcash-test-vectors#17:

zcash/zcash-test-vectors@c3a70e2#diff-c4db7d0019e6a3e3a7c3f97e21a263aec65512eda597831777b2cc4109448e14R23

@daira daira closed this as completed Jun 2, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@daira