https://github.com/oxarbitrage/sinsemilla-formal
Lean 4 formalization of Sinsemilla hash with machine-verified Pedersen equivalence and DLP security reduction
https://github.com/oxarbitrage/sinsemilla-formal
Last synced: 19 days ago
JSON representation
Lean 4 formalization of Sinsemilla hash with machine-verified Pedersen equivalence and DLP security reduction
- Host: GitHub
- URL: https://github.com/oxarbitrage/sinsemilla-formal
- Owner: oxarbitrage
- License: mit
- Created: 2026-05-01T13:44:21.000Z (3 months ago)
- Default Branch: main
- Last Pushed: 2026-05-04T15:07:44.000Z (3 months ago)
- Last Synced: 2026-05-04T16:35:48.715Z (3 months ago)
- Language: Lean
- Homepage:
- Size: 26.4 KB
- Stars: 0
- Watchers: 0
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# sinsemilla-formal
**Status:** Fully proven — zero `sorry` statements.
Lean 4 formalization of the Sinsemilla hash function from Zcash's Orchard protocol, with a machine-verified security reduction to the discrete logarithm problem on the Pallas curve.
## What's formalized
Sinsemilla splits a bit message M into 10-bit chunks and accumulates elliptic curve points: Acc_{i+1} = [2]·Accᵢ + S(mᵢ), starting from Q(D) = GroupHash(D).
**Key results:**
- **`hashToPoint_pedersen`** — the hash equals [2ⁿ]·Q(D) + Σᵢ 2^(n−1−i)·S(mᵢ): a Pedersen vector commitment.
- **`chi_injective`** — distinct equal-length chunk sequences produce distinct coefficient vectors.
- **`collision_implies_sumChunks_eq`** — a collision on equal-length messages yields a DLP relation on Pallas.
## Axioms
| Axiom | Justification |
|-------|--------------|
| `groupHash_ne_zero` | Requires full SWU map + BLAKE2b formalization |
## Build
```shell
lake build
```
## Dependencies
Lean 4 (`v4.30.0-rc2`), [Mathlib4](https://github.com/leanprover-community/mathlib4), [pasta-formal](https://github.com/oxarbitrage/pasta-formal).
## References
- [Zcash Protocol Spec §5.4.1.9](https://zips.z.cash/protocol/protocol.pdf)
- [Halo 2 — Sinsemilla gadget](https://zcash.github.io/halo2/design/gadgets/sinsemilla.html)
---
## Part of a series
Six repositories formally verifying the Zcash Orchard cryptographic stack:
| Layer | Repository |
|-------|-----------|
| Curves | [pasta-formal](https://github.com/oxarbitrage/pasta-formal) |
| Hash | [poseidon-formal](https://github.com/oxarbitrage/poseidon-formal) |
| Hash-to-curve | [sinsemilla-formal](https://github.com/oxarbitrage/sinsemilla-formal) |
| Signatures | [redpallas-formal](https://github.com/oxarbitrage/redpallas-formal) |
| Protocol | [orchard-formal](https://github.com/oxarbitrage/orchard-formal) |
| Proof system | [halo2-formal](https://github.com/oxarbitrage/halo2-formal) |