Ironwood Guide The Zcash Orchard protocol and its Ironwood pool 7 Spend authorisation 9 The Action statement and its proof

8 Value commitments and the binding signature

This section constructs the net value commitment of an Action, defines the transparent transaction value pool, the balancing value of each pool and the fee, and constructs the binding signature. Proposition 8.10 keeps apart an algebraic identity, under which the binding validating key is a known multiple of the randomness base exactly when a pool balances modulo $p_{\mathsf{Vesta}}$ , and a knowledge statement, under which a valid binding signature forces balance modulo $p_{\mathsf{Vesta}}$ .

8.1 Value commitments

Remark 8.1 (Requirement R4).

Requirement R4 of “Requirements on a shielded payment” (§1.4) is met through the additive homomorphism of the Pedersen commitment (Crypto Guide, §“The Pedersen commitment”, Theorem “Additive homomorphism”). Each Action publishes a commitment to its net value; the group sum of a bundle’s commitments commits to the sum of the net values under the sum of the trapdoors, and a verifier compares that sum with the bundle’s public balancing value (§8.2) without learning any single value.

Definition 8.2 (Net value commitment).

Let an Action consume a note of value $v^{\mathsf{old}}$ and create a note of value $v^{\mathsf{new}}$ , both in $\{0,\dots,2^{64}-1\}$ , the value type of Definition “Note” (§4.1); a dummy side has value $0$ (§4.4). The net value of the Action is the integer

v^{\mathsf{net}}:=v^{\mathsf{old}}-v^{\mathsf{new}}\in\{-2^{64}+1,\dots,2^{64}% -1\}.

The value base and the randomness base are

	$\displaystyle V^{\mathsf{Orchard}}$	$\displaystyle:=\mathsf{GroupHash}(\texttt{z.cash:Orchard-cv},\texttt{v}),$
	$\displaystyle R^{\mathsf{Orchard}}$	$\displaystyle:=\mathsf{GroupHash}(\texttt{z.cash:Orchard-cv},\texttt{r}),$

the value-commitment rows of Table 2. For a trapdoor $\mathsf{rcv}\in\mathbb{F}_{p_{\mathsf{Vesta}}}$ , the net value commitment of the Action is the point

\mathsf{cv}^{\mathsf{net}}:=\mathsf{ValueCommit}^{\mathsf{Orchard}}_{\mathsf{% rcv}}(v^{\mathsf{net}}):=[v^{\mathsf{net}}\bmod p_{\mathsf{Vesta}}]\,V^{% \mathsf{Orchard}}+[\mathsf{rcv}]\,R^{\mathsf{Orchard}}\in\mathcal{E}(\mathbb{F% }_{p_{\mathsf{Pallas}}})

(protocol specification, §“Homomorphic Pedersen commitments (Sapling and Orchard)”).

Both bases have order $p_{\mathsf{Vesta}}$ : the protocol specification types them as points of order $p_{\mathsf{Vesta}}$ (§“Balance and Binding Signature (Orchard)”), a set that excludes $\mathcal{O}$ (§“Pallas and Vesta”). The specification defines $\mathsf{ValueCommit}^{\mathsf{Orchard}}$ on the signed integers

\Bigl{\{}-\frac{p_{\mathsf{Vesta}}-1}{2},\dots,\frac{p_{\mathsf{Vesta}}-1}{2}% \Bigr{\}}

(§“Commitment”), and a signed integer enters the scalar multiplication as its residue modulo $p_{\mathsf{Vesta}}$ (§2.1). Reduction modulo $p_{\mathsf{Vesta}}$ is injective on this domain, since two of its elements differ by at most $p_{\mathsf{Vesta}}-1$ . The domain contains every net value, and every signed $64$ -bit integer, because $p_{\mathsf{Vesta}}>2^{254}$ (§2.1) gives $(p_{\mathsf{Vesta}}-1)/2\geq 2^{253}$ .

Construction 8.3 (Value-commitment trapdoor).

For each Action the author of the transaction draws $\mathsf{rcv}$ uniformly from $\mathbb{F}_{p_{\mathsf{Vesta}}}$ , by $\mathsf{ValueCommit}^{\mathsf{Orchard}}.\mathsf{GenTrapdoor}$ , independently of every other value (protocol specification, §“Sending Notes (Orchard)” and §“Homomorphic Pedersen commitments (Sapling and Orchard)”). Unlike $\mathsf{rcm}$ , $\psi$ and $\mathsf{esk}$ , which are derived from the note seed $\mathsf{rseed}$ (§4.3), the trapdoor $\mathsf{rcv}$ is derived from no note, and no note field, note plaintext (§10.1) or transaction field (§11.2) contains it. The author retains every $\mathsf{rcv}$ of the bundle; together they determine the binding signing key (§8.3).

The specification types the trapdoor as an integer in $\{0,\dots,2^{255}-1\}$ (§“Commitment”). As for $\mathsf{rcm}$ (§4.1), this volume types it in $\mathbb{F}_{p_{\mathsf{Vesta}}}$ , the set that $\mathsf{GenTrapdoor}$ samples, since $\mathsf{rcv}$ acts only as the scalar of $[\mathsf{rcv}]$ .

Lemma 8.4 (Hiding and binding of net value commitments).

With $G:=V^{\mathsf{Orchard}}$ and $H:=R^{\mathsf{Orchard}}$ , the map $\mathsf{ValueCommit}^{\mathsf{Orchard}}$ is the Pedersen commitment of the Crypto Guide (§“The Pedersen commitment”, Construction “Pedersen commitment”), with messages the residues modulo $p_{\mathsf{Vesta}}$ .

(i)

Perfect hiding: for $\mathsf{rcv}$ uniform on $\mathbb{F}_{p_{\mathsf{Vesta}}}$ and independent of $v^{\mathsf{net}}$ , the commitment $\mathsf{cv}^{\mathsf{net}}$ is uniform on $\mathcal{E}(\mathbb{F}_{p_{\mathsf{Pallas}}})$ , whatever $v^{\mathsf{net}}$ is.
(ii)

Computational binding: under Assumptions 2.22 and 2.8, no efficient algorithm outputs, except with negligible probability, pairs $(v,\mathsf{rcv})$ and $(v^{\prime},\mathsf{rcv}^{\prime})$ of an integer and a trapdoor with $v\not\equiv v^{\prime}\pmod{p_{\mathsf{Vesta}}}$ and $[v]\,V^{\mathsf{Orchard}}+[\mathsf{rcv}]\,R^{\mathsf{Orchard}}=[v^{\prime}]\,V% ^{\mathsf{Orchard}}+[\mathsf{rcv}^{\prime}]\,R^{\mathsf{Orchard}}$ . On the domain of $\mathsf{ValueCommit}^{\mathsf{Orchard}}$ distinct integers are distinct residues, so the same bound excludes openings of one point to two distinct net values.

Proof.

(i) This is the Crypto Guide’s Theorem “Perfect hiding” (§“The Pedersen commitment”). Since $R^{\mathsf{Orchard}}\neq\mathcal{O}$ and the group has prime order, $\mathsf{rcv}\mapsto[\mathsf{rcv}]\,R^{\mathsf{Orchard}}$ is a bijection from $\mathbb{F}_{p_{\mathsf{Vesta}}}$ onto $\mathcal{E}(\mathbb{F}_{p_{\mathsf{Pallas}}})$ ; the uniform point $[\mathsf{rcv}]\,R^{\mathsf{Orchard}}$ stays uniform under translation by the fixed point $[v^{\mathsf{net}}\bmod p_{\mathsf{Vesta}}]\,V^{\mathsf{Orchard}}$ . (ii) The double-opening algebra of the Crypto Guide’s Theorem “Computational binding under DLog” (same section) gives

[v-v^{\prime}]\,V^{\mathsf{Orchard}}-[\mathsf{rcv}^{\prime}-\mathsf{rcv}]\,R^{% \mathsf{Orchard}}=\mathcal{O},

a relation with non-zero coefficient $v-v^{\prime}$ on $V^{\mathsf{Orchard}}$ . The two bases are values of $\mathsf{GroupHash}$ at distinct inputs; under Assumption 2.8 they replace the independent generators that the cited construction samples, and the lemma on relations among fixed generators (§2.4) excludes the relation except with negligible probability. The specification requires computational binding and states that the scheme is unconditionally hiding (protocol specification, §“Homomorphic Pedersen commitments (Sapling and Orchard)”). □

8.2 The balancing value

Definition 8.5 (Transparent transaction value pool).

Transparent inputs and transparent outputs are the cleartext value transfers of a transaction outside every shielded pool, with public amounts. Each transaction has a transparent transaction value pool: its transparent inputs add their values to it, and its transparent outputs remove theirs. The balancing value of each shielded pool, defined next for the two pools of the Orchard protocol, is also added to it (protocol specification, §“Transactions and Treestates”).

Definition 8.6 (Balancing value).

For each pool of the Orchard protocol, the Orchard pool or the Ironwood pool, the balancing value $v^{\mathsf{balance}}_{\mathit{pool}}$ of a transaction is its declared net value, in zatoshi, of the notes of the pool that it consumes minus those that it creates: a signed integer in $\{-2^{63},\dots,2^{63}-1\}$ , encoded in cleartext as the two’s-complement $64$ -bit field valueBalanceOrchard or valueBalanceIronwood, of type int64. It is $0$ when the transaction has no Action of the pool, and the field is then absent. A positive $v^{\mathsf{balance}}_{\mathit{pool}}$ takes net value out of the pool and adds it to the transparent transaction value pool; a negative one takes value from the transparent transaction value pool into the pool (protocol specification, §“Balance and Binding Signature (Orchard)”; ZIP 229, “Transaction Format”).

In a correctly constructed transaction, $v^{\mathsf{balance}}_{\mathit{pool}}$ equals the sum of the net values $v^{\mathsf{net}}$ of the pool’s Actions. A verifier cannot check this equation directly, since each $v^{\mathsf{net}}$ is hidden in its $\mathsf{cv}^{\mathsf{net}}$ ; the binding signature (§8.3) enforces it.

The protocol specification, §“Transactions and Treestates”, states the consensus rule: the value remaining in the transparent transaction value pool must be non-negative. For a transaction other than a coinbase transaction (Definition “Coinbase transaction”, §11.2) the remaining value is the transaction fee (ibid.); no transaction field encodes it (ZIP 229, “Transaction Format” and “Non-requirements”). The pool of a coinbase transaction also receives, as implicit inputs, the block subsidy and the fees of the block’s other transactions, and its outputs must consume all of the value in it (protocol specification, §“Transactions and Treestates” and §“Transaction Consensus Rules”). ZIP 317, “Fee calculation”, specifies the conventional fee, which wallets SHOULD pay and which is not a consensus requirement:

	$\displaystyle\mathit{marginal\_fee}\cdot\max(\mathit{grace\_actions},\,\mathit% {logical\_actions})\text{ zatoshi},$
	$\displaystyle\mathit{marginal\_fee}=5000,\qquad\mathit{grace\_actions}=2,$

where $\mathit{logical\_actions}$ is a sum of per-component contributions, in which each Ironwood-pool Action contributes one (the contribution $\mathit{nActionsIronwood}$ ). The fee of the worked payment is computed in Example 11.16 (§11.5).

Remark 8.7 (Disclosure by the balancing value).

The balancing value is cleartext, so a negative one discloses the amount that enters the pool; the field names no receiving note or address.

8.3 The binding signature

Fix a pool of the Orchard protocol and a transaction whose bundle for that pool has $n\geq 1$ Actions, with net values $v^{\mathsf{net}}_{i}$ , trapdoors $\mathsf{rcv}_{i}$ and net value commitments $\mathsf{cv}^{\mathsf{net}}_{i}$ ( $i=1,\dots,n$ ), and write $v^{\mathsf{balance}}$ for the pool’s balancing value.

Definition 8.8 (Binding signing key).

The binding signing key of the bundle is

\mathsf{bsk}:=\mathsf{rcv}_{1}+\dots+\mathsf{rcv}_{n}\in\mathbb{F}_{p_{\mathsf% {Vesta}}}

(protocol specification, §“Balance and Binding Signature (Orchard)”). By the additive homomorphism (Crypto Guide, §“The Pedersen commitment”, Theorem “Additive homomorphism”),

\sum_{i=1}^{n}\mathsf{cv}^{\mathsf{net}}_{i}=\Bigl{[}\sum_{i=1}^{n}v^{\mathsf{% net}}_{i}\Bigr{]}\,V^{\mathsf{Orchard}}+[\mathsf{bsk}]\,R^{\mathsf{Orchard}},

(6)

the integer sum entering as its residue modulo $p_{\mathsf{Vesta}}$ .

Definition 8.9 (Binding validating key).

The verifier computes, from public fields only, the binding validating key

\mathsf{bvk}:=\Bigl{(}\sum_{i=1}^{n}\mathsf{cv}^{\mathsf{net}}_{i}\Bigr{)}-[v^% {\mathsf{balance}}]\,V^{\mathsf{Orchard}},

where the subtracted point is $\mathsf{ValueCommit}^{\mathsf{Orchard}}_{0}(v^{\mathsf{balance}})$ , the commitment with zero trapdoor, and $v^{\mathsf{balance}}$ , an element of the domain of $\mathsf{ValueCommit}^{\mathsf{Orchard}}$ , enters as its residue modulo $p_{\mathsf{Vesta}}$ . No transaction field encodes $\mathsf{bvk}$ (protocol specification, §“Balance and Binding Signature (Orchard)”).

An opening of a net value commitment $\mathsf{cv}^{\mathsf{net}}_{i}$ is a pair $(v^{\prime}_{i},r^{\prime}_{i})$ of an integer $v^{\prime}_{i}$ and a scalar $r^{\prime}_{i}\in\mathbb{F}_{p_{\mathsf{Vesta}}}$ with $\mathsf{cv}^{\mathsf{net}}_{i}=[v^{\prime}_{i}\bmod p_{\mathsf{Vesta}}]\,V^{% \mathsf{Orchard}}+[r^{\prime}_{i}]\,R^{\mathsf{Orchard}}$ . In the next proposition a binding signature under a point $X$ is a signature valid under $X$ in the binding-signature instance of RedPallas, with base $R^{\mathsf{Orchard}}$ (§7.1); Construction “Binding signature” below fixes its use.

Proposition 8.10 (Balance and key knowledge).

For the bundle fixed above:

(i)

Identity. If $\mathsf{cv}^{\mathsf{net}}_{i}=\mathsf{ValueCommit}^{\mathsf{Orchard}}_{% \mathsf{rcv}_{i}}(v^{\mathsf{net}}_{i})$ for every $i$ and $\mathsf{bsk}:=\sum_{i}\mathsf{rcv}_{i}$ , then

$\mathsf{bvk}-[\mathsf{bsk}]\,R^{\mathsf{Orchard}}=\Bigl{[}\sum_{i=1}^{n}v^{% \mathsf{net}}_{i}-v^{\mathsf{balance}}\Bigr{]}\,V^{\mathsf{Orchard}};$

hence $\mathsf{bvk}=[\mathsf{bsk}]\,R^{\mathsf{Orchard}}$ if and only if $\sum_{i}v^{\mathsf{net}}_{i}\equiv v^{\mathsf{balance}}\pmod{p_{\mathsf{Vesta}}}$ .
(ii)

Knowledge. Let $(v^{\prime}_{i},r^{\prime}_{i})$ be an opening of $\mathsf{cv}^{\mathsf{net}}_{i}$ for every $i$ , and let $b\in\mathbb{F}_{p_{\mathsf{Vesta}}}$ satisfy $\mathsf{bvk}=[b]\,R^{\mathsf{Orchard}}$ . If $D:=\sum_{i}v^{\prime}_{i}-v^{\mathsf{balance}}$ is non-zero modulo $p_{\mathsf{Vesta}}$ , then

$\Bigl{(}b-\sum_{i=1}^{n}r^{\prime}_{i}\Bigr{)}D^{-1}\bmod p_{\mathsf{Vesta}}$

is the discrete logarithm of $V^{\mathsf{Orchard}}$ to the base $R^{\mathsf{Orchard}}$ , a relation between two values of $\mathsf{GroupHash}$ .

Consequently, under Assumptions 2.22, 2.8 and 7.3, an efficient party that outputs the net value commitments and the balancing value of a bundle, openings $(v^{\prime}_{i},r^{\prime}_{i})$ of every $\mathsf{cv}^{\mathsf{net}}_{i}$ and a binding signature under the resulting $\mathsf{bvk}$ on a message of its choice satisfies $\sum_{i}v^{\prime}_{i}\equiv v^{\mathsf{balance}}\pmod{p_{\mathsf{Vesta}}}$ , except with negligible probability. The proposition holds for every message.

Proof.

(i) Expanding each $\mathsf{cv}^{\mathsf{net}}_{i}$ by Definition 8.2 and applying the additive homomorphism gives (6); subtracting $[v^{\mathsf{balance}}]\,V^{\mathsf{Orchard}}$ gives the identity. Since $V^{\mathsf{Orchard}}$ has prime order $p_{\mathsf{Vesta}}$ , the point $[c]\,V^{\mathsf{Orchard}}$ is $\mathcal{O}$ if and only if $c\equiv 0\pmod{p_{\mathsf{Vesta}}}$ .

(ii) By the homomorphism, $\mathsf{bvk}=[D]\,V^{\mathsf{Orchard}}+[\sum_{i}r^{\prime}_{i}]\,R^{\mathsf{% Orchard}}$ . Equating with $[b]\,R^{\mathsf{Orchard}}$ gives

[D]\,V^{\mathsf{Orchard}}=\Bigl{[}b-\sum_{i=1}^{n}r^{\prime}_{i}\Bigr{]}\,R^{% \mathsf{Orchard}},

and $D$ is invertible modulo the prime $p_{\mathsf{Vesta}}$ . This is Part 2 of the proof of the Crypto Guide’s Theorem “The binding signature is a proof of knowledge of $\log_{P}B$ ” (§“Binding signatures as a proof of knowledge of a discrete logarithm”), with $P=R^{\mathsf{Orchard}}$ and the balancing value folded into the key as that section describes after the theorem.

Consequence. Let an efficient party $\mathcal{A}$ output, with probability $\epsilon$ , a bundle’s net value commitments and balancing value, openings of every commitment, a message and a binding signature on it under the resulting $\mathsf{bvk}$ , with $D$ non-zero modulo $p_{\mathsf{Vesta}}$ ; this event is efficiently decidable from the output. If $\mathsf{bvk}=\mathcal{O}$ , then $b:=0$ satisfies $\mathsf{bvk}=[b]\,R^{\mathsf{Orchard}}$ . Otherwise Part 1 of the proof of the same theorem, special soundness with forking in the random-oracle model for $\mathsf{H}$ (Assumption 7.3), rewinds $\mathcal{A}$ to two accepting transcripts with a common first component and distinct challenges and extracts $b$ with $\mathsf{bvk}=[b]\,R^{\mathsf{Orchard}}$ . In this volume the extraction is steps (1) and (4) to (6) of the proof of Proposition 7.12, with no signing queries ( $q_{s}=0$ ), the base $R^{\mathsf{Orchard}}$ in place of $G^{\mathsf{SpendAuth}}$ and $\mathsf{bvk}$ in place of $\mathsf{rk}^{*}$ . Key prefixing places the encoding of $\mathsf{bvk}$ in the critical query, so both runs sign under the same $\mathsf{bvk}$ , and the openings and the balancing value of the first run satisfy the hypothesis of part (ii) for it. If $\epsilon$ is non-negligible, the extraction succeeds with non-negligible probability, and part (ii) then outputs the discrete logarithm of $V^{\mathsf{Orchard}}$ to the base $R^{\mathsf{Orchard}}$ : a non-trivial relation between values of $\mathsf{GroupHash}$ at distinct inputs, which the lemma on relations among fixed generators (§2.4) excludes except with negligible probability under Assumptions 2.8 and 2.22. No argument uses the value of the message, and no concrete bound is claimed. The security argument of the protocol specification, §“Balance and Binding Signature (Orchard)”, is the deployed counterpart. □

The openings are obtained, and the congruence is promoted to an equality of integers, in Lemma 12.3 and Theorem 12.4 (§12.1).

Construction 8.11 (Binding signature).

The binding signature scheme $\mathsf{BindingSig}^{\mathsf{Orchard}}$ is the binding-signature instance of RedPallas (§7.1): RedPallas on the base $R^{\mathsf{Orchard}}$ , without key re-randomisation; its base differs from the spend-authorisation base $G^{\mathsf{SpendAuth}}$ . The author of the transaction computes $\mathsf{bsk}$ from the trapdoors it retains and signs with it; the verifier recomputes $\mathsf{bvk}$ from the public fields and validates the signature under it (protocol specification, §“Binding Signature (Sapling and Orchard)” and §“Balance and Binding Signature (Orchard)”). The signed message is the signature digest $\mathsf{SigHash}$ constructed in “Transaction digests and signatures” (§11.3); which transaction data the signatures fix is stated there, in Proposition 11.10.

For an honestly constructed bundle with $\sum_{i}v^{\mathsf{net}}_{i}=v^{\mathsf{balance}}$ , Proposition 8.10(i) gives $\mathsf{bvk}=[\mathsf{bsk}]\,R^{\mathsf{Orchard}}$ , so $(\mathsf{bsk},\mathsf{bvk})$ is a key pair of the instance and the honest signature is accepted (§7.1). Under Assumption 7.3 a valid signature is a proof of knowledge of the discrete logarithm of $\mathsf{bvk}$ to the base $R^{\mathsf{Orchard}}$ (Crypto Guide, §“Binding signatures as a proof of knowledge of a discrete logarithm”, Theorem “The binding signature is a proof of knowledge of $\log_{P}B$ ”), so, for a party that also outputs openings of every net value commitment, the consequence stated in Proposition 8.10, under Assumptions 2.22, 2.8 and 7.3, makes it certify balance modulo $p_{\mathsf{Vesta}}$ without taking any net value as input: it is computed from $\mathsf{bsk}$ , the message and fresh randomness. What the public data of a bundle hide is stated in Theorem 12.12 (§12.4).

The construction runs once for each pool of the Orchard protocol. A transaction carries a balancing value and a binding signature, bindingSigOrchard or bindingSigIronwood, for each pool whose bundle has at least one Action. Each pool’s $\mathsf{bvk}$ sums only that pool’s net value commitments and subtracts only that pool’s balancing value; both pools use $\mathsf{ValueCommit}^{\mathsf{Orchard}}$ with the bases $V^{\mathsf{Orchard}}$ and $R^{\mathsf{Orchard}}$ , and $\mathsf{BindingSig}^{\mathsf{Orchard}}$ . The consensus rule of the protocol specification, §“Transaction Consensus Rules” (ZIP 229, “Consensus Rules”), is: if a pool’s bundle has Actions, its binding signature must be a valid signature of $\mathsf{SigHash}$ under that pool’s $\mathsf{bvk}$ . Validation rejects a non-canonical encoding of the signature’s point component (§7.1; protocol specification, §“RedDSA, RedJubjub, and RedPallas”).