I'm reviewing this test which prepares a zero knowledge proof of the preimage of an hash: https://github.com/mariogemoll/libsnark-tutorial/blob/sha256/src/test-knowledge-of-preimage.cpp

In my (wrong) understanding, the left-bits and the right-bits are referring to leaves of a Merkle tree from which you obtain the hash. So the left-bits and right-bits should be your private information, while the final hash, the top of the Merkle tree, is the public information you want to prove knowledge of.

I tried to obtain the same hash as given in the example, combining the right-bits and left-bits in a merkle tree. I tried to add padding as discussed here: https://gitter.im/ZoKrates/Lobby?at=5b829201ac25fd11b597e159 (look for "padding" in the page), but the resulting hash is never the one given in the example.

So what are they referring to with "sha256_two_to_one_hash" exactly?

Thank you very much!

  • $\begingroup$ delving through the library.. the culprit apparently lays in how the left and right bits are manipulated, there's a python test class which uses PyPy She 256 to generate the values to check in the cpp tests. Probably I may just be messing up the conversions. Left bits and right bits are concatenated before hashing, and 2-to-1 means that they always start from 512 bits. This being said, I still can't manage to produce the same results for the hash obtained with libsnark, I always get a different hash if I use another implementation. So I'll let this here in the meanwhile $\endgroup$
    – T. Rossi
    Jul 31 '20 at 16:38
  • $\begingroup$ Some more delving later: the libsnark proofs is built for "sha_transform", whereas "digest" makes at least 2 "sha_transform" operations, that is why results don't match with other libraries returning the digest. $\endgroup$
    – T. Rossi
    Aug 21 '20 at 19:45
  • $\begingroup$ additional finding: when the test value are generated with pypy a function is called to switch the bytes to big-endian. So apparently that is also done in the cpp libsnark library.. $\endgroup$
    – T. Rossi
    Aug 21 '20 at 21:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.