Constant-time note commitment for ZEC and ZSA

[ConstanceBeguier]

We would like to have a constant-time evaluation of the note commitment for both ZEC and ZSA.
ZEC_note_commitment=Extract_P(SinsemillaHashToPoint(zec_personalization, common_bits) + [rcm]R)
ZSA_note_commitment=Extract_P(SinsemillaHashToPoint(zsa_personalization, common_bits || asset) + [rcm]R)

R is the same constant for ZEC and ZSA note commitments.

[PaulLaux]

I think there is no need to compute the mutual part twice. Somthing like this should work:

        let common_note_bits = iter::empty()
                    .chain(g_d_bits.iter().by_vals())
                    .chain(pk_d_bits.iter().by_vals())
                    .chain(v_bits.iter().by_vals())
                    .chain(rho_bits.iter().by_vals().take(L_ORCHARD_BASE))
                    .chain(psi_bits.iter().by_vals().take(L_ORCHARD_BASE));

        let zec_note_bits = common_note_bits.cloned();

        let type_bits = BitArray::<_, Lsb0>::new(asset.to_bytes());
        let zsa_note_bits = 
            common_note_bits
            .chain(type_bits.iter().by_vals());

[ConstanceBeguier]

I have some difficulties to clone the Chain.
I could convert the chain into a vector, then clone it and then convert it back into an iterator... (see my last commit)
We could discuss about it Monday morning.

[PaulLaux]

Also blocked by QED-it/zcash-test-vectors#8 (review)

[PaulLaux]

we should rename it to sinsemilla::CommitDomain::new_with_blind_personalization(). Either now or remember to do it after ECC review for our PR.

[ConstanceBeguier]

If I rename it, I have also to rename it in qedit/halo2 but the PR in qedit/halo2 has already been merged on zsa1.
I prefer to rename it after ECC review for our PR.

[PaulLaux]

As previously mentioned, this does not test derive(). This seems to be a lower-level test, am I missing something?

[ConstanceBeguier]

Yes it is a lower level test. It just tests that splitting the commitment evaluation into hashing and blinding gives the same result than directly evaluating the commitment.

[ConstanceBeguier]

I renamed this test