Assessment reports>Nocturne>Discussion>Redundant order-l check

The StealthAddrOwnership implements redundant order-l check

In lib.circom, StealthAddrOwnership computes GG = vk * H1 - H2 and then applies the following constraints on GG:

(GG2X, GG2Y) <== BabyDbl()(GGX, GGY);
(GG4X, GG4Y) <== BabyDbl()(GG2X, GG2Y);
(GG8X, GG8Y) <== BabyDbl()(GG4X, GG4Y);

GG8X === 0;
GG8Y === 1;

But, since the input points to StealthAddrOwnership, H1 and H2 are already range checked to be in the order-l subgroup of the curve, these constraints are redundant and can be removed.

Zellic © 2023Back to top ↑