Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Move implementation of hash functions outside stdlib leaving just their permutation functions #6676

Open
Tracked by #1258
TomAFrench opened this issue Dec 2, 2024 · 1 comment
Assignees
Labels
enhancement New feature or request stdlib Standard library shipped with Noir tooling tracking Tracking issues
Milestone

Comments

@TomAFrench
Copy link
Member

We've been working towards removing as much code as possible which isn't necessary to be in the stdlib as part of #1258. At the same time we've been replacing black box hash functions with their permutation functions.

This means that we have a fair number of very high risk code in the stdlib which would make it difficult to mitigate any potential vulnerabilities in future (moving people off vulnerable code would require updating to a whole new version of Noir).

We should move these out to live in external libraries while maintaining the same test coverage (e.g. fuzzing).

@TomAFrench
Copy link
Member Author

As discussed in the call, we have fuzz testing for these functions in https://github.com/noir-lang/noir/blob/master/tooling/nargo_cli/tests/stdlib-props.rs.

Two potential options for how to handle this when moving the libraries out would be to maintain a test harness which will compile and execute the noir while checking against a reference implementation of the hash functions. The other option would be to use foreign calls and an RPC server which will return the output of a hash function.

#[test]
unconstrained fn test_keccak256(x: [u8; 50]) {
    let hash = keccak256(x, 50);

    assert_eq(external_keccak256(x, 50), hash);
}

#[oracle(external_keccak256)]
unconstrained fn external_keccak256(input: [u8; 50], len: u32) -> [u8; 32] {}

This just requires an RPC server which will respond with the necessary hash and it potentially easier for an external developer to replicate.

@Savio-Sou Savio-Sou added enhancement New feature or request stdlib Standard library shipped with Noir tooling tracking Tracking issues labels Dec 2, 2024
@Savio-Sou Savio-Sou moved this from 📋 Backlog to 🏗 In progress in Noir Jan 15, 2025
@Savio-Sou Savio-Sou added this to the 1.0 milestone Jan 15, 2025
@TomAFrench TomAFrench assigned TomAFrench and unassigned jtriley2p Mar 11, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request stdlib Standard library shipped with Noir tooling tracking Tracking issues
Projects
Status: 🏗 In progress
Development

No branches or pull requests

3 participants