Pickles Field Naming & Usage Conventions

The Pasta Curves

Both curves: y² = x³ + 5

The cycle: Pallas.ScalarField = Vesta.BaseField = Fq and vice versa.

Source: mina/src/lib/crypto/kimchi_backend/pasta/basic/kimchi_pasta_basic.ml:73-74

module Fp = Kimchi_pasta_snarky_backend.Vesta_based_plonk.Field
module Fq = Kimchi_pasta_snarky_backend.Pallas_based_plonk.Field

Backend Definitions

Source: mina/src/lib/pickles/backend/backend.ml

module Tick = struct
  include Kimchi_backend.Pasta.Vesta_based_plonk
  module Inner_curve = Kimchi_backend.Pasta.Pasta.Pallas
end

module Tock = struct
  include Kimchi_backend.Pasta.Pallas_based_plonk
  module Inner_curve = Kimchi_backend.Pasta.Pasta.Vesta
end

Source: mina/src/lib/crypto/kimchi_backend/pasta/vesta_based_plonk.ml:4-5

module Field = Fp
module Curve = Vesta

Source: mina/src/lib/crypto/kimchi_backend/pasta/pallas_based_plonk.ml:4-5

module Field = Fq
module Curve = Pallas

Master Mapping Table

• •Circuit field = IPA curve's scalar field (where polynomial coefficients live)
• •Inner curve = curve whose points can be represented natively (base field = circuit field)

Our Implementation Mapping

Type1 vs Type2 Shifted Values

Source: mina/src/lib/crypto/plonkish_prelude/shifted_value.ml

Type1 (lines 98-149): Single field element

type 'f t = Shifted_value of 'f
(* t = (s - 2^n - 1) / 2, so s = 2*t + 2^n + 1 *)

Type2 (lines 151-211): For when scalar field > circuit field

(* Comment at line 151-161: encode scalar s as (s >> 1, s & 1) *)
type 'f t = Shifted_value of 'f

Poseidon / Sponge Operations

All sponge operations happen in native circuit field. Foreign field elements are absorbed via their Type1/Type2 representation.

Source: mina/src/lib/pickles/step_verifier.ml:60-69

let absorb sponge ty t =
  absorb
    ~absorb_field:(fun x -> Sponge.absorb sponge (`Field x))
    ~g1_to_field_elements:Inner_curve.to_field_elements
    ~absorb_scalar:(fun (x, (b : Boolean.var)) ->
      Sponge.absorb sponge (`Field x) ;
      Sponge.absorb sponge (`Bits [ b ]) )
    ...

When absorbing a Type2 scalar {sDiv2, sOdd}:

• •sDiv2 absorbed as native field element
• •sOdd absorbed as bit

No foreign field arithmetic — the Type2 split is already native field elements.

Deferred Values Pattern

Challenges are computed outside the circuit, passed in as witness values.

Source: mina/src/lib/pickles/wrap_deferred_values.ml:128-166

let absorb, squeeze =
  let open Tick_field_sponge.Bits in
  let sponge =
    let s = create Tick_field_sponge.params in
    absorb s (Digest.Constant.to_tick_field proof_state.sponge_digest_before_evaluations) ;
    s
  in
  ...
in
...
let xi_chal = squeeze () in
let xi = sc xi_chal in
let r_chal = squeeze () in
let r = sc r_chal in

This happens outside any circuit. Results become deferred_values passed into the verification circuit.

Poseidon Parameters

Source: mina/src/lib/crypto/kimchi_backend/pasta/basic/kimchi_pasta_basic.ml:138-142

let poseidon_params_fp =
  Kimchi_pasta_snarky_backend.Vesta_based_plonk.poseidon_params

let poseidon_params_fq =
  Kimchi_pasta_snarky_backend.Pallas_based_plonk.poseidon_params

Source: vendor/proof-systems/poseidon/src/pasta/fp_kimchi.rs — params over mina_curves::pasta::Fp Source: vendor/proof-systems/poseidon/src/pasta/fq_kimchi.rs — params over mina_curves::pasta::Fq

Quick Reference

"What field am I in?"