		Search-engine friendly clone of the ACL2 documentation.

Semaphore-specification

Pedersen-hash-base-points

Calculation of the ten base points used for the Pedersen hash.

The ten base points used for Semaphore's Pedersen hash were chosen in a pseudorandom fashion. In [Sema-Spec:5.3.2] these are called generators and are denoted g_s for s in the set \{0,..,9\}.

The description in [Sema-Spec:5.3.2] of how the base points were chosen is not quite correct. The input to \mathsf{Blake256} contains some additional punctuation, and the padding function pads a decimal string version of the number with the digit `0' (ascii 48). We believe the correct specification, checked against the Javascript source and also independently duplicated in Python, is as follows.

For each s, the generator g_s is computed as the first successful attempt, when incrementally trying indices from i = 0, at finding a \mathsf{BabyJubjub} point from a possible x coordinate calculated as $\mathsf{Blake256(}\mathtt{"PedersenGenerator\_"}
\ || \ \mathsf{decimalStringPadLeftZeros}(s,32)
\ || \ \mathtt{"\_"}
\ || \ \mathsf{decimalStringPadLeftZeros}(i,32))$ with the 255th bit set to 0.