The Pedersen hash is a low constraints friendly hash for Zk-Snarks.
Unlike many algorithms, the Pedersen hash returns a point P = (x,y) on a curve as a hash. Depending on the selected curve, there can exist a fast deterministic way to compute a different input that yields −P=(x,−y) using the Weierstrass form or −P=(−x,y) in the twisted Edwards form like the case here with BabyJubJub.
But in the current variant that interests me, M is hashed into individual segments of 200Bits and each coordinate/hash is added over the BabyJubJub curve. But more importantly, each 200bits segment is seeded by a different static Montgomery point/initialisation vector.
Does the use of different initialisation vector, means it’s that time impossible to modify M to get −P from P even in the Edwards form ?
Also, is There are potentials issues with this approach where collisions can happen only possible if M’s length isn’t a multiple of 4 ?
