Pedersen Hash Function

\(H\) is a Pedersen hash on two field elements \(a, b\), represented as \(252\)-bit integers, defined as follows:

\[H(a, b) = [P_0 + a_{\text{low}} \cdot P_1 + a_{\text{high}} \cdot P_2 + b_{\text{low}} \cdot P_3 + b_{\text{high}} \cdot P_4]_x,\]

where \(a_{\text{low}}\) is the \(248\) low bits of \(a\), \(a_{\text{high}}\) is the 4 high bits of \(a\) (and similarly for \(b\)). \([P]_x\) denotes the \(x\)-coordinate of an elliptic-curve point \(P\). \(P_0, P_1, P_2, P_3, P_4\) are constant points on the elliptic curve, derived from the decimal digits of \(\pi\). The shift point \(P_0\) was added for technical reasons to make sure the point at infinity on the elliptic curve does not appear during the computation.

Constant Points

\[\begin{split}P_0 = (2089986280348253421170679821480865132823066470938446095505822317253594081284, \\ 1713931329540660377023406109199410414810705867260802078187082345529207694986)\end{split}\]
\[\begin{split}P_1 = (996781205833008774514500082376783249102396023663454813447423147977397232763, \\ 1668503676786377725805489344771023921079126552019160156920634619255970485781)\end{split}\]
\[\begin{split}P_2 = (2251563274489750535117886426533222435294046428347329203627021249169616184184, \\ 1798716007562728905295480679789526322175868328062420237419143593021674992973)\end{split}\]
\[\begin{split}P_3 = (2138414695194151160943305727036575959195309218611738193261179310511854807447, \\ 113410276730064486255102093846540133784865286929052426931474106396135072156)\end{split}\]
\[\begin{split}P_4 = (2379962749567351885752724891227938183011949129833673362440656643086021394946, \\ 776496453633298175483985398648758586525933812536653089401905292063708816422)\end{split}\]