research: poseidon2-hash-swap - #45
Open
alexandre-mrt wants to merge 1 commit into
Open
Conversation
Measures a domain-separated Poseidon2 sponge (@taceo/circom-lib) against Veil's current circomlib Poseidon at every hash shape the three production circuits call, both in isolation and as full production-shaped variant circuits (circuits/bench/poseidon2/). Result is more nuanced than the starting hypothesis: total R1CS constraints go up ~10-12% per circuit, but measured Groth16 proving time still drops (transfer -5.4%, withdraw -13.3%, compliance a wash pending missing Poseidon2 t=5 parameters), because none of the three circuits cross a power-of-two constraint boundary and the swap's non-linear constraint count drops in every shape. A from-scratch JS Poseidon2-sponge implementation is cross-checked against the compiled circuit's actual witness (4/4 exact match) before being trusted to build any full-circuit witness. A negative test confirms no under-constrained signal was introduced (forged commitment/nullifier both rejected). No production circuit, VK, or frontend code changed — see the report's Verdict for what shipping this swap would still require. Also re-confirms on-chain gas measurement (queue item #1) as structurally blocked this session (RPC, GitHub releases, and crates.io all denied or unavailable), while discovering `git clone` of MystenLabs/sui does work, unlike release downloads — noted in EXPERIMENTS.md for a future dedicated night. Full report: docs/research/2026-08-27-poseidon2-hash-swap.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Nightly research loop, 2026-08-27. Queue item #2: measures a domain-separated Poseidon2 sponge (
@taceo/circom-lib) against Veil's current circomlib Poseidon, at every hash shapetransfer.circom/withdraw.circom/compliance.circomactually call — both in isolation (8 microbenchmark circuits) and as full production-shaped variant circuits (circuits/bench/poseidon2/full/).The headline number is more nuanced than the starting hypothesis:
transferwithdrawcompliance(partial swap — leaf hash unchanged)Total R1CS constraints go up for every circuit (the published Poseidon2 templates' matrix-multiplication layers don't fully collapse to linear combinations in circom's optimizer), but measured Groth16 proving time still goes down for
transferandwithdraw, because non-linear (witness-generation) constraints drop in every shape and none of the three circuits cross a power-of-two constraint boundary.complianceis a wash because its credential-leaf hash needs a Poseidon2 state size (t=5) that isn't published anywhere — partial swap only, called out explicitly.A from-scratch JS Poseidon2-sponge implementation is cross-checked against the compiled circuit's real witness (4/4 exact match) before being trusted to build any full-circuit witness. A negative test (forged commitment, forged nullifier against
withdraw_v2) confirms no under-constrained signal was introduced.No production circuit, VK, or frontend code is touched. These are research artifacts — the swap is validated and measured,
BASELINE.mdgets a new "Alternative constructions" section, but shipping it is a separate, scoped migration (new t=5 parameters, a real multi-contributor ceremony, VK updates via the timelock, frontend/JS rewiring) — now the top item inEXPERIMENTS.md.Also re-confirms on-chain gas (queue item #1) as structurally blocked this session (RPC + GitHub releases + crates.io all denied/unavailable), while discovering
git cloneofMystenLabs/suidoes work unlike release downloads — noted for a future dedicated night.Full report:
docs/research/2026-08-27-poseidon2-hash-swap.mdTest plan
transfer.circom/withdraw.circom/compliance.circomreal-Groth16 suites: 43/35/30 pass (production circuits untouched)withdraw_v2): both rejectedsui move test) — NOT RUN, nosuiCLI in this session (see report's note on queue item feat: Veil privacy payment protocol — full stack MVP #1)Generated by Claude Code