# Pedersen hash function

$H$ is a Pedersen hash on two field elements, $(a, b)$ represented as $252$-bit integers, defined as follows:

$H(a, b) = [P_0 + a_{\text{low}} \cdot P_1 + a_{\text{high}} \cdot P_2 + b_{\text{low}} \cdot P_3 + b_{\text{high}} \cdot P_4]_x$

Where:

• $a_{\text{low}}$ is the $248$ low bits of $a$

• $a_{\text{high}}$is the $4$high bits of $a$(and similarly for $b$).

• $[P]_x$ denotes the $x$-coordinate of an elliptic-curve point $P$.

• $P_0, P_1, P_2, P_3, P_4$ are constant points on the elliptic curve, derived from the decimal digits of $\pi$.

The shift point $P_0$ was added for technical reasons to make sure the point at infinity on the elliptic curve does not appear during the computation.

## Constant points

$\begin{split}P_0 = (2089986280348253421170679821480865132823066470938446095505822317253594081284, \\ 1713931329540660377023406109199410414810705867260802078187082345529207694986)\\ ~\\ P_1 = (996781205833008774514500082376783249102396023663454813447423147977397232763, \ \\ 1668503676786377725805489344771023921079126552019160156920634619255970485781)\\ ~\\ P_2 = (2251563274489750535117886426533222435294046428347329203627021249169616184184, \\ 1798716007562728905295480679789526322175868328062420237419143593021674992973)\\ ~\\ P_3=(2138414695194151160943305727036575959195309218611738193261179310511854807447,\\ 113410276730064486255102093846540133784865286929052426931474106396135072156)\\ ~\\ P_4 = (2379962749567351885752724891227938183011949129833673362440656643086021394946, \\ 776496453633298175483985398648758586525933812536653089401905292063708816422)\end{split}$