Pedersen Hash Function

\(H\) is a Pedersen hash on two field elements, \((a, b)\) represented as \(252\)-bit integers, defined as follows:

\[H(a, b) = [P_0 + a_{\text{low}} \cdot P_1 + a_{\text{high}} \cdot P_2 + b_{\text{low}} \cdot P_3 + b_{\text{high}} \cdot P_4]_x\]

where \(a_{\text{low}}\)is the \(248\) low bits of \(a\) , \(a_{\text{high}}\)is the \(4\)high bits of \(a\)(and similarly for \(b\)). \([P]_x\) denotes the \(x\)-coordinate of an elliptic-curve point \(P\). \(P_0, P_1, P_2, P_3, P_4\) are constant points on the elliptic curve, derived from the decimal digits of \(\pi\) . The shift point \(P_0\) was added for technical reasons to make sure the point at infinity on the elliptic curve does not appear during the computation.
You can check the python and javascript reference implementation of this function.

Constant Points

\[\begin{split}P_0 = (2089986280348253421170679821480865132823066470938446095505822317253594081284, \\ 1713931329540660377023406109199410414810705867260802078187082345529207694986)\\ ~\\ P_1 = (996781205833008774514500082376783249102396023663454813447423147977397232763, \\ 1668503676786377725805489344771023921079126552019160156920634619255970485781)\\ ~\\ P_2 = (2251563274489750535117886426533222435294046428347329203627021249169616184184, \\ 1798716007562728905295480679789526322175868328062420237419143593021674992973)\\ ~\\ P_3=(2138414695194151160943305727036575959195309218611738193261179310511854807447,\\ 113410276730064486255102093846540133784865286929052426931474106396135072156)\\ ~\\ P_4 = (2379962749567351885752724891227938183011949129833673362440656643086021394946, \\ 776496453633298175483985398648758586525933812536653089401905292063708816422)\end{split}\]