Justify indifferentiability of mapHashOutputsToCurve from an RO wrt the hash_to_field outputs #25

Activity

1. daira

   added 2 commits that reference this issue on Aug 11, 2026

   feat(Hashing): mapHashOutputsToCurve, the deployed construction after…

   ...

   05c6100

   docs(Hashing): sharpen the analysis-boundary claims

   ...

   3032da2
2. daira commented on Aug 13, 2026

   

   daira

   on Aug 13, 2026

   OwnerAuthor

   More actions

   Re-scoped after PR #19 merged: the proof is split across the two repos so that CompElliptic contains no probability and ironwood contains no new counting. The game-theoretic side — the simulator, the single-query bias lemma, the adaptive-hybrid headline over OracleComp query trees, the costed simulator, and the book page — now lives at zcash/ironwood#198, built on ironwood's existing oracle machinery.

   This issue now tracks the counting-side deliverables, in this repo's exact-Finset register:

   • a per-point fibre bound for the single-term mapToCurve (the isogeny is injective on rational points, so this is a bound on SSWU fibres: per target abscissa, a linear and a cubic branch equation in t = Z·u² give at most 4 values of t, each with at most two roots u, and oddness pairs ±u between P and -P);
   • the unsquared L¹ corollary of sq_sum_abs_prob_dev_le, with denominator-cleared exact forms convenient for ℝ≥0∞ consumption, and the pre-Cauchy–Schwarz L² bound (sum_sq_dev_le) exported for bad-set counting (regularity does not lower-bound individual fibres, so the sampler's acceptance constant holds only outside a small bad set);
   • the deployed-vs-zero-repaired transport as pure pair counting (the two two-term sums differ on at most 2·#F - 1 of (#F)² pairs).

   These ship as one PR against main, iterated in parallel with the ironwood side so that the exported interface is confirmed sufficient before it merges.

   Posted with the assistance of Claude Fable 5
3. daira commented on Aug 20, 2026

   

   daira

   on Aug 20, 2026

   OwnerAuthor

   More actions

   The CompElliptic side of this landed in #27 (fibre counting and the two-term regularity budget) and #29 (the Weil-bound reduction discharging WeilBounded at the deployed mappings). The indifferentiability endpoints that consume them — pallas_indiffFromRO/vesta_indiffFromRO, at advantage q/2^{120} after q queries with hash_to_field modelled as a random oracle — are on zcash/ironwood#199.

   Posted with the assistance of Claude Fable 5
4. daira

   closed this as completedon Aug 20, 2026