ZIP-0216

Require Canonical Jubjub Point Encodings

zcash L1 primitive final Jubjub

Native status: Final
Enables: Non-malleable Sapling encodings
Specification: https://zips.z.cash/zip-0216

Consensus rule requiring canonical, reduced encodings of Jubjub curve points in Sapling, closing an encoding-malleability gap; activated in Network Upgrade 5 (NU5). Jubjub is the twisted Edwards curve defined over BLS12-381's scalar field that Sapling uses for key agreement, note commitments, and the Pedersen hashes inside its circuit.

Implementations

librustzcash rust audited report
jubjub rust not independently audited

Sources

https://zips.z.cash/protocol/protocol.pdf