One of the biggest breakthroughs that zkash had was when they moved to sapling was switching it to a peterson hash which is interesting because that construction is actually not really symmetric creep to anymore. One clear requirement that you have there is of course a security of a hash function so you must not be able to find the collision or worse not pre-image faster than for example two to the 128 operations if you declare a security level of 128 bits. The second requirement that came into application was clearly sexiness in circuits so that your hash function must be short enough but even this is not really well defined.

Get the Snipd
podcast app

Unlock the knowledge in podcasts with the podcast player of the future.
App store bannerPlay store banner

AI-powered
podcast player

Listen to all your favourite podcasts with AI-powered features

Discover
highlights

Listen to the best highlights from the podcasts you love and dive into the full episode

Save any
moment

Hear something you like? Tap your headphones to save it with AI-generated key takeaways

Share
& Export

Send highlights to Twitter, WhatsApp or export them to Notion, Readwise & more

AI-powered
podcast player

Listen to all your favourite podcasts with AI-powered features

Discover
highlights

Listen to the best highlights from the podcasts you love and dive into the full episode