The Pedersen hash is a low constraints friendly hash for Zk-Snarks.
Unlike many algorithms, the Pedersen hash returns a point
P = (x,y) on a curve as a hash. Depending on the selected curve, there can exist a fast deterministic way to compute a different input that yields
−P=(x,−y) using the Weierstrass form or
−P=(−x,y) in the twisted Edwards form like the case here with BabyJubJub.
But in the current variant that interests me,
M is hashed into individual segments of 200Bits and each coordinate/hash is added over the BabyJubJub curve. But more importantly, each 200bits segment is seeded by a different static Montgomery point/initialisation vector.
Does the use of different initialisation vector, means it’s that time impossible to modify
M to get
P even in the Edwards form ?
There are potentials issues with this approach where collisions can happen only possible if
M’s length isn’t a multiple of 4 ?