# Pedersen Hash Function¶

$$H$$ is a Pedersen hash on two field elements $$a, b$$, represented as $$252$$-bit integers, defined as follows:

$H(a, b) = [P_0 + a_{\text{low}} \cdot P_1 + a_{\text{high}} \cdot P_2 + b_{\text{low}} \cdot P_3 + b_{\text{high}} \cdot P_4]_x,$

where $$a_{\text{low}}$$ is the $$248$$ low bits of $$a$$, $$a_{\text{high}}$$ is the 4 high bits of $$a$$ (and similarly for $$b$$). $$[P]_x$$ denotes the $$x$$-coordinate of an elliptic-curve point $$P$$. $$P_0, P_1, P_2, P_3, P_4$$ are constant points on the elliptic curve, derived from the decimal digits of $$\pi$$. The shift point $$P_0$$ was added for technical reasons to make sure the point at infinity on the elliptic curve does not appear during the computation.

## Constant Points¶

$\begin{split}P_0 = (2089986280348253421170679821480865132823066470938446095505822317253594081284, \\ 1713931329540660377023406109199410414810705867260802078187082345529207694986)\end{split}$
$\begin{split}P_1 = (996781205833008774514500082376783249102396023663454813447423147977397232763, \\ 1668503676786377725805489344771023921079126552019160156920634619255970485781)\end{split}$
$\begin{split}P_2 = (2251563274489750535117886426533222435294046428347329203627021249169616184184, \\ 1798716007562728905295480679789526322175868328062420237419143593021674992973)\end{split}$
$\begin{split}P_3 = (2138414695194151160943305727036575959195309218611738193261179310511854807447, \\ 113410276730064486255102093846540133784865286929052426931474106396135072156)\end{split}$
$\begin{split}P_4 = (2379962749567351885752724891227938183011949129833673362440656643086021394946, \\ 776496453633298175483985398648758586525933812536653089401905292063708816422)\end{split}$