Repository navigation
Update dusk-plonk to 0.24, dusk-safe to 0.4, dusk-bls12_381 to 0.16 and dusk-jubjub to 0.16 - #305
Conversation
There was a problem hiding this comment.
🔵 Needs a closer look
Consensus-critical dependency upgrades and changed truncated-gadget verifier keys require human compatibility validation.
0 open findings
What changed in this PR
Updates Dusk cryptographic dependencies and adapts API usage while preserving existing hash outputs.
Changes:
- Upgrades
dusk-plonk,dusk-safe,dusk-bls12_381, anddusk-jubjub. - Adapts sponge tags and truncated scalar conversion.
- Updates examples, tests, benchmarks, and release notes.
| File | Description |
|---|---|
| tests/hash.rs | Adds the required Default bound. |
| tests/encryption_gadget.rs | Propagates point insertion errors. |
| src/hash.rs | Uses the scalar representation accessor. |
| src/hades/permutation/scalar.rs | Passes the explicit hash domain argument. |
| src/hades/permutation/gadget.rs | Matches the scalar tag API update. |
| src/encryption.rs | Unwraps key-exchange results in examples. |
| CHANGELOG.md | Records dependency upgrades. |
| Cargo.toml | Updates dependency versions. |
| benches/hash.rs | Propagates point insertion errors. |
🧠 Review effort: Balanced
Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.
moCello
left a comment
moCello
left a comment
There was a problem hiding this comment.
COMMENT — The call-site adaptations keep hash outputs unchanged: the sponge tag passes None, which keeps the unpersonalized derivation, and internal_repr() reads the same limbs that .0 read; approval waits on a changelog entry for the truncated gadget fix that this bump brings in.
- The issue states that the truncated hash gadgets get new verifier keys; the pull request description says only that hash outputs do not change and does not mention the keys.
- Two findings below: one changelog caution that asks for a change, and one test note.
| - Update `dusk-plonk` to `0.24` [#303] | ||
| - Update `dusk-safe` to `0.4` [#303] | ||
| - Update `dusk-bls12_381` to `0.16` [#303] | ||
| - Update `dusk-jubjub` to `0.16` [#303] |
There was a problem hiding this comment.
CAUTION: The changelog does not record that HashGadget::finalize_truncated and HashGadget::digest_truncated now bind their output to the hash, which fixes a released soundness bug.
Context: Both gadgets truncate through append_logic_xor::<125> in src/hash/gadget.rs. Before dusk-plonk #867, that gate never constrains its accumulators to the input witnesses, so the truncated output is a free witness below 2^250. dusk-plonk records the binding under ### Fixed as #867. Issue #303 states the resulting gate layout change and the new verifier keys.
Impact: A consumer of 0.41 whose circuit uses a truncated hash gadget reads only "Update dusk-plonk to 0.24". Nothing tells it that its released circuits accept any truncated value.
Fix: Add a ### Fixed section with one entry, for example "Bind the output of HashGadget::finalize_truncated and HashGadget::digest_truncated to the hash [#303]". Leave the verifier key consequence to the issue.
There was a problem hiding this comment.
Added under ### Fixed: "Bind the output of HashGadget::finalize_truncated and HashGadget::digest_truncated to the hash [#303]". The description now says that circuits using these gadgets get new verifier keys.
| ) -> Result<(), PlonkError> | ||
| where | ||
| C: Circuit, | ||
| C: Circuit + Default, |
There was a problem hiding this comment.
NOTE: No test pins the constraint count of the hash gadgets, so the layout change in the truncated gadget passes the suite with no visible signal.
Context: The gadget tests compile and verify each circuit with keys made in the same run. They show that the gadget output is correct. They cannot show that the circuit, and so the verifier key, stayed the same. The constraint reduction of #281 has the same gap.
Fix: Add a test that builds HashGadget::digest and HashGadget::digest_truncated for a fixed input length and asserts the constraint count against a fixed value, updated on purpose when a layout change is intended.
There was a problem hiding this comment.
Added hash_gadget_constraint_counts, which pins HashGadget::digest and HashGadget::digest_truncated for four inputs (655 and 889). #306 moves the truncated count to 743 in its own diff.
…nd dusk-jubjub to 0.16 Adapt to the API changes. Hash outputs are unchanged. Pass None to BlsScalar::hash_to_scalar so the sponge tag keeps the legacy derivation. Read the canonical limbs of the truncated output through internal_repr, since the BlsScalar limbs are now crate-private. Unwrap the CtOption that dhke now returns in the encryption example. Propagate the Result that Composer::append_point now returns in the tests and benchmarks, and require Default where the hash tests call Compiler::compile, since Circuit no longer has it as a supertrait.
32ef6fe to
b9895df
Compare
|
Force-pushed |
Resolves #303
dusk-plonk,dusk-safe,dusk-bls12_381anddusk-jubjubto the published 0.24, 0.4, 0.16 and 0.16 releases.dusk-plonk0.24 binds the output ofHashGadget::finalize_truncatedandHashGadget::digest_truncatedto the hash. The changelog records this underFixed, and circuits that use these gadgets get new verifier keys.hash_to_scalartakes a domain first indusk-bls12_3810.16. The sponge tag passesNone, which keeps the existing tag, so hash outputs do not change.Scalarlimbs are crate-private in 0.16, sotry_finalize_truncatedreads them throughinternal_repr().dhkereturns aCtOptionindusk-jubjub0.16, so the encryption docs unwrap it.append_pointreturns aResultindusk-plonk0.24 andCircuitno longer requiresDefault, so the tests and benches adapt.hash_gadget_constraint_countspins the gate counts ofHashGadget::digestandHashGadget::digest_truncatedfor four inputs (655 and 889), so a layout change shows in review.The public hash and encryption vectors pass unchanged.
make cq,make test,make no-stdandmake docpass locally, as do the tests per feature.