# ZIP 2005: Ironwood Quantum Recoverability

Status: Proposed

Owners: Daira-Emma Hopwood, Jack Grigg

Snapshot: a34cfc091434275120ff017c92c3b50d3cef623a

Source date: 2026-10-16T02:56:04+01:00

[Source revision](https://github.com/zcash/zips/commit/a34cfc091434275120ff017c92c3b50d3cef623a)

[Official source](https://zips.z.cash/zip-2005) · [Source file](https://github.com/zcash/zips/blob/a34cfc091434275120ff017c92c3b50d3cef623a/zips/zip-2005.md) · [Discussion](https://github.com/zcash/zips/issues/1135)

## Document parts

[Part 1](https://zip-tools-web.harpocrates.workers.dev/zip/2005) · [Part 2](https://zip-tools-web.harpocrates.workers.dev/zip/2005?part=2) · [Part 3](https://zip-tools-web.harpocrates.workers.dev/zip/2005?part=3) · [Part 4](https://zip-tools-web.harpocrates.workers.dev/zip/2005?part=4)

Reading part 2 of 4. Follow all parts for the complete proposal.

> Define $\mathsf{Derive\_rcm^{Sapling}_{rseed}}(\mathsf{leadByte}) = \begin{cases}
>   \mathsf{LEOS2IP}_{256}(\mathsf{rseed}),&\!\!\!\textsf{if } \mathsf{leadByte} = \mathtt{0x01} \\
>   \mathsf{ToScalar^{Sapling}}\big(\mathsf{PRF^{expand}_{rseed}}([\mathtt{0x04}])\kern-0.1em\big),&\!\!\!\textsf{if } \mathsf{leadByte} = \mathtt{0x02}
> \end{cases}$
> 
> 
> 
> 
> Define $\mathsf{H^{esk,Sapling}_{rseed}}(\_) = \mathsf{ToScalar^{Sapling}}\big(\mathsf{PRF^{expand}_{rseed}}([\mathtt{0x05}])\kern-0.1em\big)$.
> 
> 
> 
> 
> ($\mathsf{H^{esk,Sapling}}$ intentionally takes an argument that is unused.)

Replace the lines deriving $\mathsf{rcm}$ and $\mathsf{esk}$ with

> Derive $\mathsf{rcm} = \mathsf{Derive\_rcm^{Sapling}_{rseed}}(\mathsf{leadByte})$
> 
> 
> 
> 
> Derive $\mathsf{esk} = \mathsf{H^{esk,Sapling}_{rseed}}(\bot)$

##### § 4.7.3 ‘Sending Notes (Orchard)’

Add before "For each Action description":

> Define $\mathsf{H^{rcm,Orchard}_{rseed}}(\mathsf{g}\star_{\mathsf{d}}, \mathsf{pk}\star_{\mathsf{d}}, \mathsf{v}, \underline{\text{ρ}}, \text{ψ}) =$
> $\mathsf{ToScalar^{Orchard}}\big(\mathsf{PRF^{expand}_{rseed}}(\mathsf{pre\_rcm})\kern-0.1em\big)$
> 
> 
> 
> 
> where $\mathsf{pre\_rcm} = [\mathtt{0x0B}] \,||\, \mathsf{LEBS2OSP}_{256}(\mathsf{g}\star_{\mathsf{d}}) \,||\, \mathsf{LEBS2OSP}_{256}(\mathsf{pk}\star_{\mathsf{d}}) \,||\, \mathsf{I2LEOSP}_{64}(\mathsf{v}) \,||\, \underline{\text{ρ}} \,||\, \mathsf{I2LEOSP}_{256}(\text{ψ})$.
> 
> 
> 
> 
> Define $\mathsf{Derive\_rcm^{Orchard}_{rseed}}(\mathsf{leadByte}, \mathsf{g}\star_{\mathsf{d}}, \mathsf{pk}\star_{\mathsf{d}}, \mathsf{v}, \underline{\text{ρ}}, \text{ψ}) = \begin{cases}
>   \mathsf{ToScalar^{Orchard}}\big(\mathsf{PRF^{expand}_{rseed}}([\mathtt{0x05}] \,||\, \underline{\text{ρ}})\kern-0.1em\big),&\!\!\!\textsf{if } \mathsf{leadByte} = \mathtt{0x02} \\
>   \mathsf{H^{rcm,Orchard}_{rseed}}(\mathsf{g}\star_{\mathsf{d}}, \mathsf{pk}\star_{\mathsf{d}}, \mathsf{v}, \underline{\text{ρ}}, \text{ψ}),&\!\!\!\textsf{if } \mathsf{leadByte} = \mathtt{0x03}
> \end{cases}$
> 
> 
> 
> 
> Define $\mathsf{H^{esk,Orchard}_{rseed}}(\underline{\text{ρ}}) = \mathsf{ToScalar^{Orchard}}\big(\mathsf{PRF^{expand}_{rseed}}([\mathtt{0x04}] \,||\, \underline{\text{ρ}})\kern-0.1em\big)$.
> 
> 
> 
> 
> Define $\mathsf{H^{\text{ψ},Orchard}_{rseed}}(\underline{\text{ρ}}) = \mathsf{ToBase^{Orchard}}\big(\mathsf{PRF^{expand}_{rseed}}([\mathtt{0x09}] \,||\, \underline{\text{ρ}})\kern-0.1em\big)$.

The first-byte domain separator $\mathtt{0x0A}$ for $\mathsf{PRF^{expand}}$ is reserved by this ZIP for use by split notes in ZIP 226 <a id="user-content-fnref-zip-0226-split-notes"></a>
[26](/zip/2005?part=4#user-content-fn-zip-0226-split-notes).

Insert before the derivation of $\mathsf{esk}$:

> Let $\mathsf{g}\star_{\mathsf{d}} = \mathsf{repr}_{\mathbb{P}}(\mathsf{g_d})$,
> and $\mathsf{pk}\star_{\mathsf{d}} = \mathsf{repr}_{\mathbb{P}}(\mathsf{pk_d})$.

and use these in the inputs to $\mathsf{NoteCommit^{Orchard}}$.

Replace the lines deriving $\mathsf{esk}$, $\mathsf{rcm}$, and $\text{ψ}$
with

> Derive $\mathsf{esk} = \mathsf{H^{esk,Orchard}_{rseed}}(\underline{\text{ρ}})$

> Derive $\text{ψ} = \mathsf{H^{\text{ψ},Orchard}_{rseed}}(\underline{\text{ρ}})$

> Derive $\mathsf{rcm} = \mathsf{Derive\_rcm^{Orchard}_{rseed}}(\mathsf{leadByte}, \mathsf{g}\star_{\mathsf{d}}, \mathsf{pk}\star_{\mathsf{d}}, \mathsf{v}, \underline{\text{ρ}}, \text{ψ})$

(The order of derivation has to be changed because the inputs to $\mathsf{Derive\_rcm}$
include $\text{ψ}$.)

##### § 4.8.2 ‘Dummy Notes (Sapling)’

Add

> Let $\mathsf{Derive\_rcm^{Sapling}}$ be as defined in
> § 4.7.2 ‘Sending Notes (Sapling)’.

Replace the line deriving $\mathsf{rcm}$ with

> Derive $\mathsf{rcm} = \mathsf{Derive\_rcm^{Sapling}_{rseed}}(\mathsf{leadByte})$

##### § 4.8.3 ‘Dummy Notes (Orchard)’

Insert before "The spend-related fields ...":

> Let $\mathsf{Derive\_rcm^{Orchard}}$ and $\mathsf{H^{\text{ψ},Orchard}}$ be
> as defined in § 4.7.3 ‘Sending Notes (Orchard)’.

Replace the lines deriving $\mathsf{rcm}$ and $\text{ψ}$ with

> Let $\mathsf{g}\star_{\mathsf{d}} = \mathsf{repr}_{\mathbb{P}}(\mathsf{g_d})$,
> and $\mathsf{pk}\star_{\mathsf{d}} = \mathsf{repr}_{\mathbb{P}}(\mathsf{pk_d})$.
> 
> 
> 
> 
> Derive $\text{ψ} = \mathsf{H^{\text{ψ},Orchard}_{rseed}}(\underline{\text{ρ}})$
> 
> 
> 
> 
> Derive $\mathsf{rcm} = \mathsf{Derive\_rcm^{Orchard}_{rseed}}(\mathsf{leadByte}, \mathsf{g}\star_{\mathsf{d}}, \mathsf{pk}\star_{\mathsf{d}}, \mathsf{v}, \underline{\text{ρ}}, \text{ψ})$

and use $\mathsf{g}\star_{\mathsf{d}}$, $\mathsf{pk}\star_{\mathsf{d}}$,
in the inputs to $\mathsf{NoteCommit^{Orchard}}$.

(The order of derivation has to be changed because the inputs to $\mathsf{Derive\_rcm}$
include $\text{ψ}$.)

The choice of $\mathsf{leadByte}$, as specified in § 3.2.1, is identical between
dummy and non-dummy notes.

##### § 4.20.2 and § 4.20.3 ‘Decryption using an Incoming/Full Viewing Key (Sapling and Orchard)’

For both § 4.20.2 and § 4.20.3, add before the decryption procedure:

> Let $\mathsf{Derive\_rcm^{Sapling}}$ and $\mathsf{H^{esk,Sapling}}$ be
> as defined in § 4.7.2 ‘Sending Notes (Sapling)’.
> 
> 
> 
> 
> Let $\mathsf{Derive\_rcm^{Orchard}}$, $\mathsf{H^{esk,Orchard}}$,
> and $\mathsf{H^{\text{ψ},Orchard}}$ be as defined in
> § 4.7.3 ‘Sending Notes (Orchard)’.

For § 4.20.3, replace

> $\hspace{1.0em}$ if $\mathsf{esk} \geq r_{\mathbb{G}}$ or $\mathsf{pk_d} = \bot$, return $\bot$

with

> $\hspace{1.0em}$ if $\mathsf{esk} \geq r_{\mathbb{G}}$ or $\mathsf{pk_d} = \bot$ or (for Sapling) $\mathsf{pk_d} \not\in \mathbb{J}^{(r)*}$
> (see note below), return $\bot$

and in the note containing "However, this is technically redundant with the
later check that returns $\bot$ if $\mathsf{pk_d} \not\in \mathbb{J}^{(r)*}$",
delete the word "later".

For both § 4.20.2 and § 4.20.3, replace

> $\hspace{1.0em}$ for Sapling, let $\mathsf{pre\_rcm} = [4]$ and $\mathsf{pre\_esk} = [5]$ 
> 
> $\hspace{1.0em}$ for Orchard, let $\underline{\text{ρ}} = \mathsf{I2LEOSP}_{256}(\mathsf{nf^{old}}$ from the same Action description $\!)$, $\mathsf{pre\_rcm} = [5] \,||\, \underline{\text{ρ}}$, and $\mathsf{pre\_esk} = [4] \,||\, \underline{\text{ρ}}$

with

> $\hspace{1.0em}$ let $\underline{\text{ρ}} = \mathsf{I2LEOSP}_{256}(\mathsf{nf^{old}}$ from the same Action description $\!)$

For § 4.20.2, replace

> $\hspace{1.0em}$ let $\mathsf{rcm} = \begin{cases}
>                    \mathsf{LEOS2IP}_{256}(\mathsf{rseed}),&\!\!\!\textsf{if } \mathsf{leadByte} = \mathtt{0x01} \\
>                    \mathsf{ToScalar}\big(\mathsf{PRF^{expand}_{rseed}}(\mathsf{pre\_rcm})\kern-0.1em\big),&\!\!\!\textsf{otherwise}
>                  \end{cases}$ 
> 
> $\hspace{1.0em}$ if $\mathsf{rcm} \geq r_{\mathbb{G}}$, return $\bot$ 
> 
> $\hspace{1.0em}$ let $\mathsf{g_d} = \mathsf{DiversifyHash}(\mathsf{d})$. if (for Sapling) $\mathsf{g_d} = \bot$, return $\bot$ 
> 
> $\hspace{1.0em}$ [**Canopy** onward] if $\mathsf{leadByte} \neq \mathtt{0x01}$: 
> 
> $\hspace{2.5em}$     $\mathsf{esk} = \mathsf{ToScalar^{protocol}}\big(\mathsf{PRF^{expand}_{rseed}}(\mathsf{pre\_esk})\kern-0.1em\big)$ 
> 
> $\hspace{2.5em}$     if $\mathsf{repr}_{\mathbb{G}}\big(\mathsf{KA.DerivePublic}(\mathsf{esk}, \mathsf{g_d})\kern-0.1em\big) \neq \mathtt{ephemeralKey}$, return $\bot$
> 
> 
> 
> 
> $\hspace{1.0em}$ let $\mathsf{pk_d} = \mathsf{KA.DerivePublic}(\mathsf{ivk}, \mathsf{g_d})$

with

> $\hspace{1.0em}$ let $\mathsf{g_d} = \mathsf{DiversifyHash}(\mathsf{d})$. if (for Sapling) $\mathsf{g_d} = \bot$, return $\bot$ 
> 
> $\hspace{1.0em}$ [**Canopy** onward] if $\mathsf{leadByte} \neq \mathtt{0x01}$: 
> 
> $\hspace{2.5em}$     let $\mathsf{esk} = \mathsf{H^{esk,protocol}_{rseed}}(\underline{\text{ρ}})$ 
> 
> $\hspace{2.5em}$     if $\mathsf{repr}_{\mathbb{G}}\big(\mathsf{KA.DerivePublic}(\mathsf{esk}, \mathsf{g_d})\kern-0.1em\big) \neq \mathtt{ephemeralKey}$, return $\bot$
> 
> 
> 
> 
> $\hspace{1.0em}$ let $\mathsf{pk_d} = \mathsf{KA.DerivePublic}(\mathsf{ivk}, \mathsf{g_d})$ 
> 
> $\hspace{1.0em}$ let $\mathsf{g}\star_{\mathsf{d}} = \mathsf{repr}_{\mathbb{P}}(\mathsf{g_d})$, $\mathsf{pk}\star_{\mathsf{d}} = \mathsf{repr}_{\mathbb{P}}(\mathsf{pk_d})$ 
> 
> $\hspace{1.0em}$ let $\text{ψ} = \mathsf{H^{\text{ψ},Orchard}_{rseed}}(\underline{\text{ρ}})$ for Orchard or $\bot$ for Sapling 
> 
> $\hspace{1.0em}$ let $\mathsf{rcm} = \begin{cases}
>                    \mathsf{Derive\_rcm^{Sapling}_{rseed}}(\mathsf{leadByte}),&\!\!\!\textsf{if } \mathsf{protocol} = \mathsf{Sapling} \\
>                    \mathsf{Derive\_rcm^{Orchard}_{rseed}}(\mathsf{leadByte}, \mathsf{g}\star_{\mathsf{d}}, \mathsf{pk}\star_{\mathsf{d}}, \mathsf{v}, \underline{\text{ρ}}, \text{ψ}),&\!\!\!\textsf{if } \mathsf{protocol} = \mathsf{Orchard}
>                  \end{cases}$ 
> 
> $\hspace{1.0em}$ if $\mathsf{rcm} \geq r_{\mathbb{G}}$, return $\bot$

The order of operations has to be altered because the derivation of
$\mathsf{rcm}$ can depend on $\mathsf{g_d}$ and $\mathsf{pk_d}$.
The definitions of $\mathsf{pre\_rcm}$ and $\mathsf{pre\_esk}$ are moved or inlined
into § 4.7.2 ‘Sending Notes (Sapling)’ and § 4.7.3 ‘Sending Notes (Orchard)’ which
define $\mathsf{Derive\_rcm^{\{Sapling,Orchard\}}}$ and $\mathsf{H^{esk,\{Sapling,Orchard\}}}$.

For § 4.20.3, replace

> $\hspace{1.0em}$ let $\mathsf{rcm} = \begin{cases}
>                    \mathsf{LEOS2IP}_{256}(\mathsf{rseed}),&\!\!\!\textsf{if } \mathsf{leadByte} = \mathtt{0x01} \\
>                    \mathsf{ToScalar}\big(\mathsf{PRF^{expand}_{rseed}}(\mathsf{pre\_rcm})\kern-0.1em\big),&\!\!\!\textsf{otherwise}
>                  \end{cases}$ 
> 
> $\hspace{1.0em}$ if $\mathsf{rcm} \geq r_{\mathbb{G}}$, return $\bot$ 
> 
> $\hspace{1.0em}$ let $\mathsf{g_d} = \mathsf{DiversifyHash}(\mathsf{d})$. if (for Sapling) $\mathsf{g_d} = \bot$ or $\mathsf{pk_d} \not\in \mathbb{J}^{(r)*}$ (see note below), return $\bot$

with

> $\hspace{1.0em}$ let $\mathsf{g_d} = \mathsf{DiversifyHash}(\mathsf{d})$. if (for Sapling) $\mathsf{g_d} = \bot$, return $\bot$ 
> 
> $\hspace{1.0em}$ let $\mathsf{g}\star_{\mathsf{d}} = \mathsf{repr}_{\mathbb{P}}(\mathsf{g_d})$, $\mathsf{pk}\star_{\mathsf{d}} = \mathsf{repr}_{\mathbb{P}}(\mathsf{pk_d})$ 
> 
> $\hspace{1.0em}$ let $\text{ψ} = \mathsf{H^{\text{ψ},Orchard}_{rseed}}(\underline{\text{ρ}})$ for Orchard or $\bot$ for Sapling 
> 
> $\hspace{1.0em}$ let $\mathsf{rcm} = \begin{cases}
>                    \mathsf{Derive\_rcm^{Sapling}_{rseed}}(\mathsf{leadByte}),&\!\!\!\textsf{if } \mathsf{protocol} = \mathsf{Sapling} \\
>                    \mathsf{Derive\_rcm^{Orchard}_{rseed}}(\mathsf{leadByte}, \mathsf{g}\star_{\mathsf{d}}, \mathsf{pk}\star_{\mathsf{d}}, \mathsf{v}, \underline{\text{ρ}}, \text{ψ}),&\!\!\!\textsf{if } \mathsf{protocol} = \mathsf{Orchard}
>                  \end{cases}$ 
> 
> $\hspace{1.0em}$ if $\mathsf{rcm} \geq r_{\mathbb{G}}$, return $\bot$

and delete "where $\text{ψ} = \mathsf{ToBase^{Orchard}}\big(\mathsf{PRF^{expand}_{rseed}}([9] \,||\, \underline{\text{ρ}})\kern-0.1em\big)$".

##### § 5.3 ‘Constants’

Add the definitions

> $\ell_{\mathsf{qsk}} \;{\small ⦂}\; \mathbb{N} := 256$ 
> 
> $\ell_{\mathsf{qk}} \;{\small ⦂}\; \mathbb{N} := 256$

#### Changes to ZIPs

##### ZIP 32

Add a $\ast$ to the arrows leading to $\mathsf{ask}$ and $\mathsf{rivk}$
in the diagram in section ‘Orchard internal key derivation’
<a id="user-content-fnref-zip-0032-orchard-internal-key-derivation-2"></a>
[12](/zip/2005?part=4#user-content-fn-zip-0032-orchard-internal-key-derivation), with the following note:

> $\ast$ The derivations of $\mathsf{ask}$ and $\mathsf{rivk}$ shown in
> the diagram are not the only possibility. For further detail see
> § 4.2.3 ‘Orchard Key Components’ in the protocol specification.
> However, if $\mathsf{ask}$, $\mathsf{ak}$, $\mathsf{nk}$, $\mathsf{rivk}$,
> and $\mathsf{rivk\_internal}$ are not generated as in the diagram, then
> it may not be possible to recover the resulting notes as specified in
> [ZIP 2005] in the event that attacks using quantum computers become
> practical.

##### ZIP 212

Add a note before the Abstract:

This ZIP reflects the changes made to note encryption for the Canopy upgrade.
It does not include subsequent changes in [ZIP 2005].

<a id="rationale"></a>

## Rationale

<a id="cryptographic-background"></a>

### Cryptographic background

This rationale is written primarily for cryptologists and protocol
designers familiar with the Zcash shielded protocols. It is recommended
to first read the slides of, and/or watch the following presentations:

- *Understanding Zcash Security* at Zcon3 <a id="user-content-fnref-zcash-security"></a>
  [27](/zip/2005?part=4#user-content-fn-zcash-security)

- *Post-Quantum Zcash* at ZconVI <a id="user-content-fnref-pq-zcash-2"></a>
  [8](/zip/2005?part=4#user-content-fn-pq-zcash)

To understand the modelling of hash function and commitment security
against a quantum adversary we also recommend <a id="user-content-fnref-unruh2015"></a>
[28](/zip/2005?part=4#user-content-fn-unruh2015) and <a id="user-content-fnref-unruh2016"></a>
[29](/zip/2005?part=4#user-content-fn-unruh2016).

<a id="proposed-recovery-protocol"></a>

### Proposed Recovery Protocol

The details of the protocol in this section are subject to change. This
description is meant to facilitate analysis of whether the specification
changes to be adopted now are likely to be sufficient to securely support
a Recovery Protocol.

The proposed Recovery Protocol works, roughly speaking, by enforcing the
derivations given in the [Flow diagram for the Orchard protocol], and we
suggest having that diagram open in another window to refer to it.

#### Proposed Recovery Statement

Import this definition from § 4.2.3 ‘Orchard Key Components’ <a id="user-content-fnref-protocol-updated-orchardkeycomponents-2"></a>
[15](/zip/2005?part=4#user-content-fn-protocol-updated-orchardkeycomponents):

> Define $\mathsf{H}^{\mathsf{rivk\_ext}}_{\mathsf{qk}}(\mathsf{ak}, \mathsf{nk}) = \mathsf{ToScalar^{Orchard}}\big(\mathsf{PRF^{expand}_{qk}}\big([\mathtt{0x0D}] \,||\, \mathsf{I2LEOSP}_{256}(\mathsf{ak}) \,||\, \mathsf{I2LEOSP}_{256}(\mathsf{nk})\kern-0.1em\big)\kern-0.15em\big)$.

Import this definition from ZIP 32 <a id="user-content-fnref-zip-0032-orchard-internal-key-derivation-3"></a>
[12](/zip/2005?part=4#user-content-fn-zip-0032-orchard-internal-key-derivation):

> $\mathsf{H^{rivk\_int}_{rivk\_ext}}(\mathsf{ak}, \mathsf{nk}) = \mathsf{ToScalar^{Orchard}}\big(\mathsf{PRF^{expand}_{rivk\_ext}}\big([\mathtt{0x83}] \,||\, \mathsf{I2LEOSP}_{256}(\mathsf{ak}) \,||\, \mathsf{I2LEOSP}_{256}(\mathsf{nk})\kern-0.1em\big)\kern-0.15em\big)$

Import these definitions from § 4.7.3 ‘Sending Notes (Orchard)’ <a id="user-content-fnref-protocol-updated-orchardsend"></a>
[30](/zip/2005?part=4#user-content-fn-protocol-updated-orchardsend):

> Define $\mathsf{H^{rcm,Orchard}_{rseed}}(\mathsf{g}\star_{\mathsf{d}}, \mathsf{pk}\star_{\mathsf{d}}, \mathsf{v}, \underline{\text{ρ}}, \text{ψ}) =$
> $\mathsf{ToScalar^{Orchard}}\big(\mathsf{PRF^{expand}_{rseed}}(\mathsf{pre\_rcm})\kern-0.1em\big)$
> 
> 
> 
> 
> where $\mathsf{pre\_rcm} = [\mathtt{0x0B}] \,||\, \mathsf{LEBS2OSP}_{256}(\mathsf{g}\star_{\mathsf{d}}) \,||\, \mathsf{LEBS2OSP}_{256}(\mathsf{pk}\star_{\mathsf{d}}) \,||\, \mathsf{I2LEOSP}_{64}(\mathsf{v}) \,||\, \underline{\text{ρ}} \,||\, \mathsf{I2LEOSP}_{256}(\text{ψ})$.
> 
> 
> 
> 
> Define $\mathsf{H^{\text{ψ},Orchard}_{rseed}}(\underline{\text{ρ}}) = \mathsf{ToBase^{Orchard}}\big(\mathsf{PRF^{expand}_{rseed}}([\mathtt{0x09}] \,||\, \underline{\text{ρ}})\kern-0.1em\big)$.

Import this definition from § 5.4.7.1 ‘Spend Authorization Signature (Sapling and Orchard)’ <a id="user-content-fnref-protocol-updated-concretespendauthsig"></a>
[31](/zip/2005?part=4#user-content-fn-protocol-updated-concretespendauthsig):

> Define $\mathcal{G}^{\mathsf{Orchard}} = \mathsf{GroupHash}^{\mathbb{P}}(\texttt{“z.cash:Orchard”}, \texttt{“G”})$.

A valid instance of a Recovery Statement assures that given a primary input:

$\begin{array}{rl}
  \hspace{4.1em} ( \mathsf{rt^{Orchard}} \!\!\!\!&{\small ⦂}\; \{ 0\,..\,q_{\mathbb{P}}-1 \}, \\
                             \mathsf{rk} \!\!\!\!&{\small ⦂}\; \mathsf{SpendAuthSig^{Orchard}.Public} ), \\
                             \mathsf{nf} \!\!\!\!&{\small ⦂}\; \mathbb{F}_{q_{\mathbb{P}}}, \\
                        \mathsf{SigHash} \!\!\!\!&{\small ⦂}\; \mathsf{MessageHash} )
\end{array}$

the prover knows an auxiliary input:

$\begin{array}{rl}
  \hspace{4em}           ( \mathsf{path} \!\!\!\!&{\small ⦂}\; \{ 0\,..\,q_{\mathbb{P}}-1 \}^{[\mathsf{MerkleDepth^{Orchard}}]}, \\
                            \mathsf{pos} \!\!\!\!&{\small ⦂}\; \{ 0\,..\,2^{\mathsf{MerkleDepth^{Orchard}}}-1 \}, \\
                         \mathsf{\alpha} \!\!\!\!&{\small ⦂}\; \mathbb{F}_{r_{\mathbb{P}}}, \\
                \mathsf{ak}^{\mathbb{P}} \!\!\!\!&{\small ⦂}\; \mathbb{P}^*, \\
                             \mathsf{nk} \!\!\!\!&{\small ⦂}\; \mathbb{F}_{q_{\mathbb{P}}}, \\
                      \mathsf{rivk\_ext} \!\!\!\!&{\small ⦂}\; \mathbb{F}_{r_{\mathbb{P}}}, \\
                           \mathsf{rivk} \!\!\!\!&{\small ⦂}\; \mathbb{F}_{r_{\mathbb{P}}}, \\
    (\mathsf{qk}, \sigma_{\mathsf{qsk}}) \!\!\!\!&{\small ⦂}\; \big(\mathbb{B}^{{\kern-0.1em\tiny\mathbb{Y}}[\ell_{\mathsf{qk}}/8]} \times \mathsf{SoK^{qsk}}\big((\mathsf{qk}), \mathsf{SigHash}\big)\big) \cup \{(\bot, \bot)\}, \\
                    \sigma_{\mathsf{sk}} \!\!\!\!&{\small ⦂}\; \mathsf{SoK^{sk}}\big((\mathsf{ak}^{\mathbb{P}}, \mathsf{nk}, \mathsf{rivk\_ext}), \mathsf{SigHash}\big) \cup \{\bot\}, \\
                          \mathsf{rseed} \!\!\!\!&{\small ⦂}\; \mathbb{B}^{{\kern-0.1em\tiny\mathbb{Y}}[32]}, \\
                            \mathsf{g_d} \!\!\!\!&{\small ⦂}\; \mathbb{P}^*, \\
                              \mathsf{v} \!\!\!\!&{\small ⦂}\; \{ 0\,..\,2^{\ell_{\mathsf{value}}}-1 \}, \\
                                \text{ρ} \!\!\!\!&{\small ⦂}\; \mathbb{F}_{q_{\mathbb{P}}} )
\end{array}$

where

$\begin{array}{rll}
  \hspace{1em}\mathsf{BindKeys^{sk}}(\mathsf{sk}, \mathsf{ak}^{\mathbb{P}}, \mathsf{nk}, \mathsf{rivk\_ext}) =
    \big(&\!\!\!\! \mathsf{ak}^{\mathbb{P}} = [\mathsf{H^{ask}}(\mathsf{sk})]\, \mathcal{G}^{\mathsf{Orchard}} \\
         &\!\!\!\! \wedge\; \mathsf{nk} = \mathsf{H^{nk}}(\mathsf{sk}) \\
         &\!\!\!\! \wedge\; \mathsf{rivk\_ext} = \mathsf{H^{rivk\_legacy}}(\mathsf{sk}) \,\big)
\end{array}$

and

$\begin{array}{rll}
  \hspace{1em}\mathsf{SoK^{qsk}.Statement} \!\!\!&=\, \big\{\,\mathsf{qsk} \;{\small ⦂}\; \mathbb{B}^{{\kern-0.1em\tiny\mathbb{Y}}[\ell_{\mathsf{qsk}}/8]} &\!\!\!\!|\;\, \mathsf{qk} = \mathsf{H^{qk}}(\mathsf{qsk}) \,\big\} \\
  \hspace{1em}\mathsf{SoK^{sk}.Statement}  \!\!\!&=\, \big\{\,\mathsf{sk} \;{\small ⦂}\; \mathbb{B}^{[\ell_{\mathsf{sk}}]} &\!\!\!\!|\;\, \mathsf{BindKeys^{sk}}(\mathsf{sk}, \mathsf{ak}^{\mathbb{P}}, \mathsf{nk}, \mathsf{rivk\_ext}) \,\big\}
\end{array}$

such that the following conditions hold:

$\begin{array}{l}
\{\;\,   \mathsf{rk} = \mathsf{SpendAuthSig^{Orchard}.RandomizePublic}(\alpha, \mathsf{ak}^{\mathbb{P}}) \vphantom{\big(}\\
\wedge\; \mathsf{ak} = \mathsf{Extract}_{\mathbb{P}}(\mathsf{ak}^{\mathbb{P}}) \vphantom{\Big(}\\
\wedge\; \big((\mathsf{qk}, \sigma_{\mathsf{qsk}}) = (\bot, \bot)\big) \neq \big(\sigma_{\mathsf{sk}} = \bot\big) \vphantom{\big(}\\
\wedge\; (\mathsf{qk}, \sigma_{\mathsf{qsk}}) \neq (\bot, \bot) \Rightarrow \big(\, \mathsf{SoK^{qsk}.Validate}\big((\mathsf{qk}), \mathsf{SigHash}, \sigma_{\mathsf{qsk}}\big) \kern0.05em\wedge\, \mathsf{rivk\_ext} = \mathsf{H^{rivk\_ext}_{qk}}(\mathsf{ak}, \mathsf{nk})\kern0.05em\big) \vphantom{\Big(}\\
\wedge\; \sigma_{\mathsf{sk}} \neq \bot \Rightarrow \mathsf{SoK^{sk}.Validate}\big((\mathsf{ak}^{\mathbb{P}}, \mathsf{nk}, \mathsf{rivk\_ext}), \mathsf{SigHash}, \sigma_{\mathsf{sk}}\big) \vphantom{\big(}\\
\wedge\; \mathsf{rivk} \in \big\{\, \mathsf{rivk\_ext},\, \mathsf{H^{rivk\_int}_{rivk\_ext}}(\mathsf{ak}, \mathsf{nk}) \,\big\} \vphantom{\Big(}\\
\wedge\; \text{let } \mathsf{ivk} = \mathsf{Commit^{ivk}_{rivk}}(\mathsf{ak}, \mathsf{nk}) \vphantom{\big(}\\
\wedge\; \mathsf{ivk} \not\in \{0, \bot\} \vphantom{\Big(}\\
\wedge\; \text{let } \mathsf{pk_d} = [\mathsf{ivk}]\, \mathsf{g_d} \vphantom{\big(}\\
\wedge\; \text{let } \text{ψ} = \mathsf{H^{\text{ψ},Orchard}_{rseed}}(\underline{\text{ρ}}) \vphantom{\Big(}\\
\wedge\; \text{let } \mathsf{noterepr} = \big(\mathsf{repr}_{\mathbb{P}}(\mathsf{g_d}), \mathsf{repr}_{\mathbb{P}}(\mathsf{pk_d}), \mathsf{v}, \underline{\text{ρ}}, \text{ψ}\big) \vphantom{\big(}\\
\wedge\; \text{let } \mathsf{rcm} = \mathsf{H^{rcm,Orchard}_{rseed}}\big(\mathtt{0x03}, \mathsf{noterepr}\big) \vphantom{\Big(}\\
\wedge\; \text{let } \mathsf{cm} = \mathsf{NoteCommit^{Orchard}_{rcm}}(\mathsf{noterepr}) \vphantom{\big(}\\
\wedge\; \mathsf{cm} \neq \bot \vphantom{\Big(}\\
\wedge\; \text{let } \mathsf{cm}_x = \mathsf{Extract}_{\mathbb{P}}(\mathsf{cm}) \vphantom{\big(}\\
\wedge\; \text{let } \mathsf{leaf} = \mathsf{MerkleCRH}(\mathsf{cm}_x, \text{ρ}) \vphantom{\Big(}\\
\wedge\; \mathsf{path} \textsf{ is a path to } \mathsf{leaf} \textsf{ in the rehashed commitment tree} \vphantom{\big(}\\
\wedge\; \mathsf{nf} = \mathsf{DeriveNullifier_{nk}}(\text{ρ}, \text{ψ}, \mathsf{cm}) \vphantom{\Big(}\\
\}
\end{array}$

and $\mathsf{nf}$ is the revealed nullifier.

(We don't need to check the derivation of $\mathsf{g_d}$ from $\mathsf{d}$.)

#### Cost

Note that in the "$\mathsf{use\_qsk}$" case, one BLAKE2b compression is required
to compute $\mathsf{rivk\_ext}$ (provided $\ell_{\mathsf{qk}} \leq 504$ bits, so
that the input $\mathsf{qk} \,||\, [\mathtt{0x0D}] \,||\, \mathsf{ak} \,||\, \mathsf{nk}$
fits in a single 128-byte BLAKE2b block), and in the "not $\mathsf{use\_qsk}$"
case, three BLAKE2b compressions in total are required to compute $\mathsf{H^{ask}}$,
$\mathsf{H^{nk}}$, and $\mathsf{H^{rivk\_legacy}}$. Since these cases are mutually
exclusive, it is possible to multiplex the same three compression function instances.
So, supporting "$\mathsf{use\_qsk}$" in addition to "not $\mathsf{use\_qsk}$" costs
very little extra.

All of the operations below need to be implemented with complete additions,
even if they are incomplete in the current Orchard[ZSA] statement/circuit.

In $\mathsf{SoK^{sk}}$ and the main circuit:

- 7 BLAKE2b-512 compressions:
  
  
  
  - 3 multiplexed between $\mathsf{H^{rivk\_ext}}$ when $\mathsf{use\_qsk}$ is true (1 compression),
    and $\mathsf{H^{ask}}$ + $\mathsf{H^{nk}}$ + $\mathsf{H^{rivk\_legacy}}$ when $\mathsf{use\_qsk}$ is false (3 compressions)
  
  - 1 to compute $\mathsf{H^{rivk\_int}}$
  
  - 1 to compute $\mathsf{H^{\text{ψ}}}$
  
  - 2 to compute $\mathsf{H^{rcm}}$

- 1 use of $\mathsf{Commit^{ivk}}$ ($\mathsf{SinsemillaShortCommit}$)

- 1 use of $\mathsf{NoteCommit}$ ($\mathsf{SinsemillaCommit}$)

- 1 full-width fixed-base Pallas scalar multiplication, $[\mathsf{ask}]\, \mathcal{G}^{\mathsf{Orchard}}$

- 1 full-width variable-base Pallas scalar multiplication, $[\mathsf{ivk}]\, \mathsf{g_d}$

- 1 Merkle tree path check

- 1 additional use of $\mathsf{MerkleCRH}$ to compute $\mathsf{leaf}$.

In $\mathsf{SoK^{qsk}}$:

- 1 BLAKE3 compression for $\mathsf{H^{qk}}$ (with the $\mathsf{derive\_key}$ context key precomputed as a constant)

plus, potentially, [linking commitments](/zip/2005#linking-commitments) between
the circuits.

The expensive parts of this are the 7 BLAKE2b compressions.

<a id="security-analysis"></a>

### Security analysis

Let us consider the security of the Orchard protocol against a
discrete-logarithm-breaking adversary — which by definition includes
quantum adversaries. Similar attacks apply to the Sapling protocol.

Suppose that the proof system has been replaced by one that is
post-quantum knowledge-sound.

#### Repairing the note commitment Merkle tree

$\mathsf{MerkleCRH}$ is instantiated using
$\mathsf{SinsimillaHash}$ <a id="user-content-fnref-protocol-updated-concretesinsemillahash"></a>
[32](/zip/2005?part=4#user-content-fn-protocol-updated-concretesinsemillahash).
Its collision resistance depends on the Discrete Logarithm Relation Problem
on the Pallas curve <a id="user-content-fnref-protocol-updated-sinsemillasecurity"></a>
[33](/zip/2005?part=4#user-content-fn-protocol-updated-sinsemillasecurity), and so it is not
post-quantum collision-resistant or collapsing. However, because the note
commitment tree is public, it is possible to re-hash all of its leaves to
construct a new Merkle tree using a collapsing hash function.
Suppose this has been done.

> The post-quantum security of Merkle trees —considered as position-binding
> vector commitments which is the property required by Zcash <a id="user-content-fnref-zcash-security-2"></a>
> [27](/zip/2005?part=4#user-content-fn-zcash-security)—
> is proven under reasonable assumptions in <a id="user-content-fnref-cmsz2021"></a>
> [34](/zip/2005?part=4#user-content-fn-cmsz2021), <a id="user-content-fnref-gm2022"></a>
> [35](/zip/2005?part=4#user-content-fn-gm2022), and
> <a id="user-content-fnref-cddgs2025"></a>
> [36](/zip/2005?part=4#user-content-fn-cddgs2025).

Note: when we rehash the commitment tree, we could include both $\text{ρ}$ and
$\mathsf{cm}_x$ for each note (i.e. what is currently the leaf layer becomes
$\mathsf{MerkleCRH}(\text{ρ}, \mathsf{cm}_x)$ where $\mathsf{MerkleCRH}$
is collapsing). This change might not be necessary; it just removes potential
complications due to duplicate commitments for the same note.

#### Attacks against binding of note commitments

We still face the problem that $\mathsf{NoteCommit}$ is not binding against
a discrete-logarithm-breaking adversary: given the discrete logarithm
relations between bases, we can easily write a linear equation in the
scalar field with multiple solutions of the inputs for a given commitment.

This allows an adversary to find two distinct notes corresponding to
openings of $\mathsf{NoteCommit}$ on the same commitment.
They create one note as an output and spend the other note — which may
have a greater value, or a value in a different ZSA asset, breaking the
Balance property.

#### Repairing note commitments

We prefer to fix this without changing $\mathsf{NoteCommit}$ itself.
Instead we change how $\mathsf{rcm}$ is computed to be a hash of $\mathsf{rseed}$ and
$\mathsf{noterepr} = (\mathsf{g}\star_{\mathsf{d}}, \mathsf{pk}\star_{\mathsf{d}}, \mathsf{v}, \underline{\text{ρ}}, \text{ψ})$,
as detailed in the [Specification] section.
Specifically, when $\mathsf{leadByte} = \mathtt{0x03}$ we have:

$\hspace{2em}\mathsf{rcm} = \mathsf{H^{rcm}_{rseed}}(\mathsf{noterepr}) = \mathsf{ToScalar}(\mathsf{PRF^{expand}_{rseed}}(\mathsf{pre\_rcm}))$

$\text{where } \mathsf{pre\_rcm} = [\mathtt{0x0B}] \,||\, \mathsf{encode}(\mathsf{noterepr})$

#### Informal security argument for binding of note commitments

For the formal versions of these arguments and their adaptation to the
post-quantum setting, see the [key-binding](/zip/2005?part=3#thm-key-binding-rom) and
[Spendability](/zip/2005?part=3#thm-spendability-collide) theorems below, and the
[Adaptation to the quantum setting](#adaptationtothequantumsetting) section.

We can view the output of $\mathsf{NoteCommit_{rcm}}$ for
$\mathsf{notetuple} = (\mathsf{rseed}, \mathsf{noterepr})$
as the point addition of a randomization term
$[\mathsf{H^{rcm}_{rseed}}(\mathsf{noterepr})]\, \mathcal{R}$,
and some other function of $\mathsf{notetuple}$.

Without loss of generality, we can write that function as
$[\mathsf{f}(\mathsf{notetuple})]\, \mathcal{R}$,
by expanding each of the Sinemilla bases
$\mathcal{C}_j = \mathcal{Q}(D) \textsf{ or } \mathcal{S}(j)$ used by
[$\mathsf{HashToSinsimillaPoint}$](https://zips.z.cash/protocol/protocol.pdf#concretesinsemillahash)
as $\mathcal{C}_j = [c_j]\, \mathcal{R}$ for some $c_j$. That is,
the note commitment for $\mathsf{notetuple}$ is

$[\mathsf{H^{rcm}_{rseed}}(\mathsf{noterepr}) + \mathsf{f}(\mathsf{notetuple})]\, \mathcal{R}\textsf{.}$

We will model $\mathsf{H^{rcm}}$ as a random oracle independent of $\mathsf{f}$ with
uniform output on $\mathbb{F}_{r_{\mathbb{P}}}$. This is reasonable because
$\mathsf{H^{rcm}}$ cannot depend on any of the $c_j$, and in any case it is
instantiated using BLAKE2b, a conventional hash function not related to the
Pallas curve.

> The fact that $\mathsf{NoteCommit}$ has
> $\text{ψ} = \mathsf{H}^{\text{ψ}}_{\mathsf{rseed}}(\text{ρ})$ as an
> input does not affect the analysis provided that $\mathsf{H^{rcm}}$ and
> $\mathsf{H}^{\text{ψ}}$ can be treated as independent. In practice both
> are defined in terms of $\mathsf{PRF^{expand}}$, but with strict domain
> separation, and so the assumption of independence is reasonable as long
> as BLAKE2b-512 can be modelled as a random oracle. Note that since the
> input to $\mathsf{H^{rcm}}$ needs more than one BLAKE2b input block, we
> require that a HAIFA sponge can be modelled as a random oracle which is
> justified by <a id="user-content-fnref-acmt2025"></a>
> [37](/zip/2005?part=4#user-content-fn-acmt2025). It is possible that there could be
> better-than-generic quantum attacks against BLAKE2b-512, but none have
> been published to our knowledge. In practice, we consider it reasonable to
> assume that BLAKE2b-512 has the properties needed for $\mathsf{H^{rcm}}$
> to be collapsing. Taking the 512-bit BLAKE2b output modulo
> $r_{\mathbb{P}} \approx 2^{254}$ cannot introduce a problem.

For each $\mathsf{H^{rcm}}$ oracle query the adversary chooses
$\mathsf{notetuple} = (\mathsf{rseed}, \mathsf{noterepr})$
and obtains a "random"
$\mathsf{rcm} = \mathsf{H^{rcm}_{rseed}}(\mathsf{noterepr})$.

We have $\mathsf{cm}_x = \mathsf{Extract}_{\mathbb{P}}([\mathsf{H^{rcm}_{rseed}}(\mathsf{noterepr}) + \mathsf{f}(\mathsf{notetuple})]\, \mathcal{R})$.

Over all Pallas curve points $P$, the number of outputs of
$\mathsf{Extract}_{\mathbb{P}}(P)$ is $(\mathbb{F}_{r_\mathbb{P}} + 1)/2 \approx 2^{253}$ —
one for each possible $x$-coordinate of Pallas curve points, plus one for the
zero point $\mathcal{O}_{\mathbb{P}}$ which is mapped to $0$.

> Only one point maps to $0$, as opposed to two points mapping to every
> other possible output of $\mathsf{Extract}_{\mathbb{P}}$, but that has
> negligible effect.

There are two values of $\mathsf{cm}$ that match $\mathsf{cm}_x$ in their $x$-coordinate.
Because the output of $\mathsf{NoteCommit_{rcm}}$ for $\mathsf{notetuple}$ is
of the form $\mathsf{cm} = [\mathsf{f}(\mathsf{notetuple}) + \mathsf{rcm}]\, \mathcal{R}$,
for any given note we have exactly two values of $\mathsf{rcm}$ that will pass
the commitment check.

Suppose there are $N$ legitimate notes in the tree. The adversary is trying
to find a note that will pass the commitment check without actually being a
note in the tree. As argued above, the distribution of $\mathsf{rcm}$ is
indistinguishable from uniform-random on $\mathbb{F}_{r_\mathbb{P}}$. The
success probability for each attempt in a classical search is therefore
$2N/r_{\mathbb{P}}$ where $r_{\mathbb{P}}$ is the order of the Pallas curve,
and that is negligible because $N \leq 2^{32} \ll r_{\mathbb{P}}$.

We're not finished yet because we also have to prove that the nullifier is
computed deterministically for a given note.

All of the inputs to $\mathsf{DeriveNullifier}$ are things we committed to
in the protocol so far **except** $\mathsf{nk}$. By the same argument used
pre-quantumly, there is only one $\mathsf{ivk}$ for a given
$(\mathsf{g_d}, \mathsf{pk_d})$. So in order to just use the existing
protocol for this part, we would need to prove that there is only one
$\mathsf{nk}$ (that is feasible to find) such that
$\mathsf{Commit^{ivk}_{rivk}}(\mathsf{ak}, \mathsf{nk}) = \mathsf{ivk}$.
Unfortunately that's not true; $\mathsf{Commit^{ivk}}$ is instantiated by
$\mathsf{SinsemillaShortCommit}$ which is not post-quantum binding.

There are two cases depending on which witness branch the adversary
uses (they can choose to attack either, or both simultaneously):

## Citation relationships

Cites: [ZIP 32](https://zip-tools-web.harpocrates.workers.dev/zip/32), [ZIP 200](https://zip-tools-web.harpocrates.workers.dev/zip/200), [ZIP 209](https://zip-tools-web.harpocrates.workers.dev/zip/209), [ZIP 212](https://zip-tools-web.harpocrates.workers.dev/zip/212), [ZIP 226](https://zip-tools-web.harpocrates.workers.dev/zip/226), [ZIP 227](https://zip-tools-web.harpocrates.workers.dev/zip/227), [ZIP 229](https://zip-tools-web.harpocrates.workers.dev/zip/229), [ZIP 231](https://zip-tools-web.harpocrates.workers.dev/zip/231), [ZIP 258](https://zip-tools-web.harpocrates.workers.dev/zip/258), [ZIP 312](https://zip-tools-web.harpocrates.workers.dev/zip/312), [ZIP 2003](https://zip-tools-web.harpocrates.workers.dev/zip/2003), [ZIP 2007](https://zip-tools-web.harpocrates.workers.dev/zip/2007)

Cited by: [ZIP 32](https://zip-tools-web.harpocrates.workers.dev/zip/32), [ZIP 226](https://zip-tools-web.harpocrates.workers.dev/zip/226), [ZIP 229](https://zip-tools-web.harpocrates.workers.dev/zip/229), [ZIP 230](https://zip-tools-web.harpocrates.workers.dev/zip/230), [ZIP 231](https://zip-tools-web.harpocrates.workers.dev/zip/231), [ZIP 258](https://zip-tools-web.harpocrates.workers.dev/zip/258), [ZIP 316](https://zip-tools-web.harpocrates.workers.dev/zip/316), [ZIP 326](https://zip-tools-web.harpocrates.workers.dev/zip/326), [ZIP 374](https://zip-tools-web.harpocrates.workers.dev/zip/374)