Starkad and Poseidon: New Hash Functions for Zero Knowledge Proof Systems

The area of practical computational integrity proof systems, like SNARKs, STARKs, Bulletproofs, is seeing a very dynamic development with several constructions appeared in 2019 with improved properties and relaxed setup requirements. Many use cases of such systems involve, often as their most expensive apart, proving the knowledge of a preimage under a certain cryptographic hash function, which is expressed as a circuit over a large prime (sometimes binary) field. A zero-knowledge proof of coin ownership in the Zcash cryptocurrency is a notable example, where the inadequacy of SHA-256 hash function for such a circuit caused a huge computational penalty. In this paper, we present a modular framework and concrete instances of cryptographic hash functions which either work natively with GF (p) objects or on binary field elements. Our GF (p) hash-function Poseidon uses up to 8x fewer constraints per message bit than Pedersen Hash, whereas our binary hash-function Starkad wins by a substantial margin over the other recent designs. Our construction is not only expressed compactly as a circuit, but also can be tailored for various proof systems using specially crafted polynomials, thus bringing another boost in performance. We demonstrate this by implementing a 1-out-of-a-billion membership proof using Merkle-trees in less than a second.