Can pedersen_hash be point at infinity?

[fleupold]

Can pedersen_hash be point at infinity?

[str4d]

For a Pedersen hash defined over a generic elliptic curve, I think something like this might be possible, though you would need to account for the windowed encoding mechanism (it might be sufficient to just bit-shift by 3 bits instead of 1, but I haven't thought about it much).

However, pedersen_hash is defined over Jubjub, which is a twisted Edwards curve with d being a non-square. This means that addition is complete, and so there is no point at infinity.

(cc @daira because I've likely mis-explained something 😅)

[daira]

The Pedersen hash is defined in terms of the Edwards curve, which as @str4d says has no point at infinity. The zero point has an affine representation (0, 1).

The output of the hash is the u-coordinate of the resulting Edwards point. This is 0 for the zero point, which is a possible output. (If you actually find an input that gives this output, you can also find collisions in the hash. Pedersen hashes are not the only kind of hash for which this is the case; for example if you find an input to SHA-256 that results in a zero output then you can also find collisions in SHA-256, although for a different reason.)

In the circuit, the hash is implemented in terms of both the Edwards curve and the birationally equivalent Montgomery curve. The use of the latter is carefully limited to avoid occurrence of the point at infinity and other exceptional cases; this is explained and justified in appendix A.3.3.9 of the protocol spec.