I'm looking for a one-way compression function that is secure and efficient within a zk-SNARK circuit. The motivation behind this comes from these considerations:
- SHA256-compression is highly inefficient for SNARKs
- The Pedersen hash function is efficient, but has an upper input limit of 32 bytes and outputs 32 bytes
- A Merkle-tree implementation requires a hash function that accepts an input 64 bytes (the 32-byte outputs of two hashes).
Hence I'm looking for a way to securely and efficiently combine two 32-byte values into one 32-byte value.
I'm considering the MiMC hash function for this purpose but it seems like overkill for this purpose; I am already hashing data using Pedersen. Perhaps MiMC with fewer rounds would work well, but perhaps there's a better way to do it.