Poseidon2
Poseidon2 is a recently released optimized version of Poseidon. The two versions differ in two crucial points. First, Poseidon is a sponge hash function, while Poseidon2 can be either a sponge or a compression function depending on the use case. Secondly, Poseidon2 is instantiated by new and more efficient linear layers with respect to Poseidon. These changes decrease the number of multiplications in the linear layer by up to 90% and the number of constraints in Plonk circuits by up to 70%. This makes Poseidon2 currently the fastest arithmetization-oriented hash function without lookups. Since the compression mode is efficient it is ideal for use in Merkle trees as well.
An overview of the Poseidon2 hash is provided in the diagram below
Description
Round constants
- In the first full round and last full rounds Round constants are of the structure , where
- In the partial rounds the round constants is only added to first element , where
Poseidon2 is also extremely customizable and using different constants will produce different hashes, security levels and performance results.
We support pre-calculated constants for each of the supported curves. The constants can be found here and are labeled clearly per curve <curve_name>_poseidon2.h
.
You can also use your own set of constants as shown here
S box
Allowed values of for a given prime is the smallest integer such that
For ICICLE supported curves/fields
- Mersene
- Babybear
- Bls12-377
- Bls12-381
- BN254
- Grumpkin
- Stark252
MDS matrix structure
There are only two matrices: There is one type of matrix for full round and another for partial round. There are two cases available one for state size and another for .
where is an integer
Full Matrix (Referred in paper as ). These are hard coded (same for all primes ) for any fixed state size where is an integer.
5 & 7 & 1 & 3 \\ 4& 6 & 1 & 1 \\ 1 & 3 & 5 & 7\\ 1 & 1 & 4 & 6\\ \end{pmatrix}As per the paper this structure is always maintained and is always MDS for any prime .
eg for the matrix looks like