Variable-size note encryption support by PaulLaux · Pull Request #177 · zcash/sapling-crypto

PaulLaux · 2026-03-26T15:22:12Z

Adapts sapling-crypto to work with the updated zcash_note_encryption crate that supports variable-size note plaintexts, a prerequisite for the OrchardZSA protocol and related changes in librustzcash.

Motivation

The upstream zcash_note_encryption crate has been refactored to make note sizes generic via const generics and associated types, replacing the previous fixed-size arrays. This PR updates sapling-crypto to conform to that new interface while keeping Sapling's own note sizes unchanged.

Key changes

Note size constants (COMPACT_NOTE_SIZE, NOTE_PLAINTEXT_SIZE, ENC_CIPHERTEXT_SIZE, MEMO_SIZE) are now defined locally in sapling-crypto rather than imported from zcash_note_encryption, since each protocol defines its own sizes.
Domain associated types NotePlaintextBytes, NoteCiphertextBytes, CompactNotePlaintextBytes, and CompactNoteCiphertextBytes are implemented using the generic NoteBytesData<N> wrapper from the encryption crate.
enc_ciphertext fields changed from fixed-size [u8; ENC_CIPHERTEXT_SIZE] arrays to NoteBytesData<{ ENC_CIPHERTEXT_SIZE }>.
ShieldedOutput trait no longer carries a const generic size parameter - implementations now provide both enc_ciphertext() and enc_ciphertext_compact() methods.
extract_memo replaced by split_plaintext_at_memo, which splits the plaintext into compact note bytes and memo.
parse_note_plaintext_without_memo_ivk/ovk now takes typed CompactNotePlaintextBytes instead of raw &[u8] / &NotePlaintextBytes.
Hard-coded [u8; 512] memo references replaced with [u8; MEMO_SIZE] throughout.

#2) * Use updated backward compatible zcash_note_encryption (WIP) * Move constants from zcash_note_encryption * Use NoteBytes from zcash_note_encryption * Add new line * Use NoteBytesData * Synchronize with updates from zcash_note_encryption for PR #2 issues resolve * Revert toolchain Rust version back to 1.65.0 * Change zcash_note_encryption reference in Cargo.toml to point to the zsa1 branch * Remove FIXME comments and other minor changes * Move implementations of parse_... Domain trait methods to zcash_note_encryption crate --------- Co-authored-by: alexeykoren <2365507+alexeykoren@users.noreply.github.com> Co-authored-by: Dmitry Demin <dmitry@qed-it.com>

* Update ShieldedOutput/OutputDescription to return reference for enc_ciphertext These changes were discussed and suggested in PR zcash_note_encryption#2 * Fix path zcash_note_encryption in Cargo.toml * Move COMPACT_NOTE_SIZE, NOTE_PLAINTEXT_SIZE, and ENC_CIPHERTEXT_SIZE constant definitions from zcash_note_encryption to here * Trigger CI * Fix CI cargo test errors * Use NoteBytesData<{...}> instead of <SaplingDomain as Domain>::... * Add MEMO_SIZE constant and use it instead of the hardcoded 512 for the memo array size * Fix code example in comment to use MEMO_SIZE * Make MEMO_SIZE const pub to use it in the comment code example --------- Co-authored-by: Dmitry Demin <dmitry@qed-it.com>

Update zsa1 to ustream

# Conflicts: # .github/workflows/ci.yml # src/builder.rs # src/pczt.rs

Merge upstream 20260309

- Use `rev` instead of a branch in the patch section of `Cargo.toml` (to match our other repositories) - Remove `Option` from `memo`

daira · 2026-04-02T10:39:51Z

+        Some(&self.enc_ciphertext)
+    }
+
+    fn enc_ciphertext_compact(&self) -> NoteBytesData<{ COMPACT_NOTE_SIZE }> {


Using the same type for enc ciphertexts and compact enc ciphertexts seems like a type error: they don't only differ in length, but also in semantics (compact enc ciphertexts don't have a memo and don't use authenticated encryption as of NU6.1). I don't think there are cases where we'd want to use them polymorphically.

Consider splitting/renaming NoteBytesData into two types: EncCiphertext and CompactEncCiphertext. These can even be type aliases to NoteBytesData with particular lengths if you want to make the minimal change.

daira · 2026-04-02T10:45:23Z

            ephemeral_key: out.ephemeral_key,
            cmu: out.cmu,
-            enc_ciphertext: out.enc_ciphertext[..COMPACT_NOTE_SIZE].try_into().unwrap(),
+            enc_ciphertext: out.enc_ciphertext.as_ref()[..COMPACT_NOTE_SIZE]


This is not the enc ciphertext, so the field is misnamed. I realize it was misnamed before. Consider renaming it to enc_ciphertext_compact if that isn't too disruptive. Or that can be a separate PR. (It might need to be done for Orchard as well.)

Out of scope for this PR, as discussed.

daira · 2026-04-02T10:49:08Z

+    }
+
+    fn enc_ciphertext_compact(&self) -> NoteBytesData<{ COMPACT_NOTE_SIZE }> {
+        unimplemented!("This function is not required for sapling")


Why can't the truncation be implemented here rather than manually truncating in several other places? It seems as though those places could call enc_ciphertext_compact instead.

Done (implemented enc_ciphertext_compact)

daira · 2026-04-02T11:01:22Z

+    type Memo = [u8; MEMO_SIZE];
+
+    type NotePlaintextBytes = NoteBytesData<{ NOTE_PLAINTEXT_SIZE }>;
+    type NoteCiphertextBytes = NoteBytesData<{ ENC_CIPHERTEXT_SIZE }>;


This would become type EncCiphertextBytes = EncCiphertextBytes;, etc.

Out of scope for this PR, as discussed.

daira · 2026-04-02T11:10:34Z


-    fn enc_ciphertext(&self) -> &[u8; COMPACT_NOTE_SIZE] {
-        &self.enc_ciphertext
+    fn enc_ciphertext(&self) -> Option<&NoteBytesData<{ ENC_CIPHERTEXT_SIZE }>> {


Hmm. The previous API was terrible (enc_ciphertext() returning something that is not an enc ciphertext) but this also seems error-prone. Are we sure that CompactOutputDescription should impl ShieldedOutput<SaplingDomain> given that the latter has an enc_ciphertext method? Perhaps it shouldn't, and enc_ciphertext should be on a separate trait impl'd by OutputDescription.

Out of scope for this PR, as discussed.

daira

Abstracting over MEMO_SIZE isn't sufficient for memo bundles (the chunks are not in the enc ciphertext, an encryption key is); nor is it necessary for ZSAs (they don't change the memo size or type). So I wonder why this is necessary.

In any case, utACK to unblock further progress, even though I think this is definitely going to need to be refactored again.

PaulLaux · 2026-04-15T18:15:56Z

As discussed in the meeting, we will fix the issues that require no significant changes to other crates and revisit.

Update: fixed, please see last commits and comments

Merge upstream 20260428

- Add type aliases for `EncCiphertext` and `CompactEncCiphertext` - Implement `enc_ciphertext_compact` for `OutputDescription`

dmidem and others added 10 commits July 31, 2024 13:11

Update zsa1 to ustream (#4)

b0d2e4c

Update zsa1 to ustream

Update zcash_note_encryption

03b1e16

Merge branch 'main' into zsa1

a2e004a

# Conflicts: # .github/workflows/ci.yml # src/builder.rs # src/pczt.rs

Post-merge fixes

f071e0e

Fix proptest version

9393f93

Merge branch 'zcash-main' into merge_upstream_20260309

84c0e9f

Merge pull request #9 from QED-it/merge_upstream_20260309

33937b8

Merge upstream 20260309

Reduce diff with upstream (#12)

59535fb

- Use `rev` instead of a branch in the patch section of `Cargo.toml` (to match our other repositories) - Remove `Option` from `memo`

vivek-arte mentioned this pull request Mar 30, 2026

Grant Application - Feature Branch Testnet and Compatible Developer Tooling ZcashCommunityGrants/zcashcommunitygrants#256

Open

9 tasks

daira reviewed Apr 2, 2026

View reviewed changes

daira previously approved these changes Apr 2, 2026

View reviewed changes

ConstanceBeguier and others added 3 commits April 28, 2026 14:51

Merge branch 'zcash-main' into merge_upstream_20260428

8cc3eb1

Merge pull request #14 from QED-it/merge_upstream_20260428

42e3a0c

Merge upstream 20260428

Address review comments from zcash PR zcash#177 (#13)

e785faa

- Add type aliases for `EncCiphertext` and `CompactEncCiphertext` - Implement `enc_ciphertext_compact` for `OutputDescription`

ConstanceBeguier dismissed daira’s stale review via e785faa April 28, 2026 13:45

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Variable-size note encryption support#177

Variable-size note encryption support#177
PaulLaux wants to merge 13 commits into
zcash:mainfrom
QED-it:zsa1

PaulLaux commented Mar 26, 2026 •

edited

Loading

Uh oh!

daira Apr 2, 2026 •

edited

Loading

Uh oh!

ConstanceBeguier Apr 28, 2026

Uh oh!

daira Apr 2, 2026 •

edited

Loading

Uh oh!

ConstanceBeguier Apr 28, 2026

Uh oh!

daira Apr 2, 2026 •

edited

Loading

Uh oh!

ConstanceBeguier Apr 28, 2026

Uh oh!

daira Apr 2, 2026

Uh oh!

ConstanceBeguier Apr 28, 2026

Uh oh!

daira Apr 2, 2026

Uh oh!

ConstanceBeguier Apr 28, 2026

Uh oh!

daira left a comment

Uh oh!

PaulLaux commented Apr 15, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

PaulLaux commented Mar 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Motivation

Key changes

Uh oh!

daira Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ConstanceBeguier Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

daira Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ConstanceBeguier Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

daira Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ConstanceBeguier Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

daira Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

ConstanceBeguier Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

daira Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

ConstanceBeguier Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

daira left a comment

Choose a reason for hiding this comment

Uh oh!

PaulLaux commented Apr 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

PaulLaux commented Mar 26, 2026 •

edited

Loading

daira Apr 2, 2026 •

edited

Loading

daira Apr 2, 2026 •

edited

Loading

daira Apr 2, 2026 •

edited

Loading

PaulLaux commented Apr 15, 2026 •

edited

Loading