Pedersen hash function
\(H\) is a Pedersen hash on two field elements, \((a, b)\) represented as \(252\)-bit integers, defined as follows:
\[H(a, b) = [P_0 + a_{\text{low}} \cdot P_1 + a_{\text{high}} \cdot P_2 + b_{\text{low}} \cdot P_3 + b_{\text{high}} \cdot P_4]_x\]
Where:
-
\(a_{\text{low}}\) is the \(248\) low bits of \(a\)
-
\(a_{\text{high}}\)is the \(4\)high bits of \(a\)(and similarly for \(b\)).
-
\([P]_x\) denotes the \(x\)-coordinate of an elliptic-curve point \(P\).
-
\(P_0, P_1, P_2, P_3, P_4\) are constant points on the elliptic curve, derived from the decimal digits of \(\pi\).
The shift point \(P_0\) was added for technical reasons to make sure the point at infinity on the elliptic curve does not appear during the computation.
Constant points
\[\begin{split}P_0 = (2089986280348253421170679821480865132823066470938446095505822317253594081284, \\ 1713931329540660377023406109199410414810705867260802078187082345529207694986)\\
~\\
P_1 = (996781205833008774514500082376783249102396023663454813447423147977397232763, \ \\ 1668503676786377725805489344771023921079126552019160156920634619255970485781)\\
~\\
P_2 = (2251563274489750535117886426533222435294046428347329203627021249169616184184, \\ 1798716007562728905295480679789526322175868328062420237419143593021674992973)\\
~\\
P_3=(2138414695194151160943305727036575959195309218611738193261179310511854807447,\\ 113410276730064486255102093846540133784865286929052426931474106396135072156)\\
~\\
P_4 = (2379962749567351885752724891227938183011949129833673362440656643086021394946, \\ 776496453633298175483985398648758586525933812536653089401905292063708816422)\end{split}\]