veredise audit fix: Add warning in documentation about skipped elements in interstitial hash start

README.md

@@ -17,7 +17,6 @@ The library exports the following functions:
 - `headers::constrain_header_field` - constrain an index/ length in the header to be the correct name, full, and uninterrupted
 - `partial_hash::partial_sha256_var_end` - finish a precomputed sha256 hash over the body
 - `masking::mask_text` - apply a byte mask to the header or body to selectively reveal parts of the entire email
-- `standard_outputs` - returns the hash of the DKIM pubkey and a nullifier for the email (`hash(signature)`)
 
 Additionally, the `@zk-email/zkemail-nr` JS library exports an ergonomic API for easily deriving circuit inputs needed to utilize the Noir library.
 
@@ -28,9 +27,9 @@ A basic email verifier will often look like this:
 ```rust
 use dep::zkemail::{
     KEY_LIMBS_1024, dkim::RSAPubkey, get_body_hash_by_index,     
-    base64::body_hash_base64_decode, standard_outputs
+    base64::body_hash_base64_decode
 };
-use dep::std::hash::sha256_var;
+use dep::std::hash::{sha256_var, pedersen_hash};
 
 // Somewhere in your function
 ...

examples/email_mask/src/main.nr

@@ -1,8 +1,8 @@
 use dep::zkemail::{
     KEY_LIMBS_2048, dkim::RSAPubkey, headers::body_hash::get_body_hash,
-    standard_outputs, Sequence, masking::mask_text
+    Sequence, masking::mask_text
 };
-use dep::std::{collections::bounded_vec::BoundedVec, hash::sha256_var};
+use dep::std::{collections::bounded_vec::BoundedVec, hash::{pedersen_hash, sha256_var}};
 
 global MAX_EMAIL_HEADER_LENGTH: u32 = 512;
 global MAX_EMAIL_BODY_LENGTH: u32 = 1024;
@@ -55,6 +55,7 @@ fn main(
     let masked_body = mask_text(body, body_mask);
 
     // hash the pubkey and signature for the standard outputs
-    let standard_out = standard_outputs(pubkey.modulus, signature);
+    let email_nullifier = pedersen_hash(signature);
+    let standard_out = [pubkey.hash(), email_nullifier];
     (standard_out, masked_header, masked_body)
 }

examples/extract_addresses/src/main.nr

@@ -1,12 +1,10 @@
 use dep::zkemail::{
-    KEY_LIMBS_2048, dkim::RSAPubkey,
-    headers::{body_hash::get_body_hash, email_address::get_email_address}, standard_outputs, Sequence,
-    MAX_EMAIL_ADDRESS_LENGTH
+    KEY_LIMBS_2048, dkim::RSAPubkey, headers::email_address::get_email_address, Sequence,
+    MAX_EMAIL_ADDRESS_LENGTH,
 };
-use dep::std::{collections::bounded_vec::BoundedVec, hash::sha256_var};
+use dep::std::{collections::bounded_vec::BoundedVec, hash::pedersen_hash};
 
 global MAX_EMAIL_HEADER_LENGTH: u32 = 512;
-global MAX_EMAIL_BODY_LENGTH: u32 = 1024;
 
 /**
  * Verify an arbitrary email signed by a 2048-bit RSA DKIM signature and extract sender and recipient addresses
@@ -30,26 +28,23 @@ fn main(
     from_header_sequence: Sequence,
     from_address_sequence: Sequence,
     to_header_sequence: Sequence,
-    to_address_sequence: Sequence
-) -> pub ([Field; 2], BoundedVec<u8, MAX_EMAIL_ADDRESS_LENGTH>, BoundedVec<u8, MAX_EMAIL_ADDRESS_LENGTH>) {
+    to_address_sequence: Sequence,
+    ) -> pub ([Field; 2], BoundedVec<u8, MAX_EMAIL_ADDRESS_LENGTH>, BoundedVec<u8, MAX_EMAIL_ADDRESS_LENGTH>) {
     // check the body and header lengths are within bounds
     assert(header.len() <= MAX_EMAIL_HEADER_LENGTH);
 
     // verify the dkim signature over the header
     pubkey.verify_dkim_signature(header, signature);
 
     // extract to and from email addresses
-    let from = comptime {
-        "from".as_bytes()
-    };
-    let to = comptime {
-        "to".as_bytes()
-    };
+    let from = comptime { "from".as_bytes() };
+    let to = comptime { "to".as_bytes() };
     // 16k gate cost? has to be able to be brought down
     let from_address = get_email_address(header, from_header_sequence, from_address_sequence, from);
     let to_address = get_email_address(header, to_header_sequence, to_address_sequence, to);
 
     // hash the pubkey and signature for the standard outputs
-    let standard_out = standard_outputs(pubkey.modulus, signature);
+    let email_nullifier = pedersen_hash(signature);
+    let standard_out = [pubkey.hash(), email_nullifier];
     (standard_out, from_address, to_address)
 }

examples/partial_hash/src/main.nr

@@ -1,7 +1,8 @@
 use dep::zkemail::{
     KEY_LIMBS_2048, dkim::RSAPubkey, headers::body_hash::get_body_hash,
-    partial_hash::partial_sha256_var_end, standard_outputs, Sequence
+    partial_hash::partial_sha256_var_end, Sequence
 };
+use std::hash::pedersen_hash;
 
 global MAX_EMAIL_HEADER_LENGTH: u32 = 512;
 global MAX_PARTIAL_EMAIL_BODY_LENGTH: u32 = 192;
@@ -52,5 +53,6 @@ fn main(
     );
 
     // hash the pubkey and signature for the standard outputs
-    standard_outputs(pubkey.modulus, signature)
+    let email_nullifier = pedersen_hash(signature);
+    [pubkey.hash(), email_nullifier]
 }

examples/remove_soft_line_breaks/src/main.nr

@@ -1,8 +1,8 @@
 use zkemail::{
-    KEY_LIMBS_2048, dkim::RSAPubkey, headers::body_hash::get_body_hash,
-    standard_outputs, Sequence, remove_soft_line_breaks::remove_soft_line_breaks
+    KEY_LIMBS_2048, dkim::RSAPubkey, headers::body_hash::get_body_hash, Sequence,
+    remove_soft_line_breaks::remove_soft_line_breaks,
 };
-use std::hash::sha256_var;
+use std::hash::{pedersen_hash, sha256_var};
 
 global MAX_EMAIL_HEADER_LENGTH: u32 = 512;
 global MAX_EMAIL_BODY_LENGTH: u32 = 1024;
@@ -28,7 +28,7 @@ fn main(
     pubkey: RSAPubkey<KEY_LIMBS_2048>,
     signature: [Field; KEY_LIMBS_2048],
     body_hash_index: u32,
-    dkim_header_sequence: Sequence
+    dkim_header_sequence: Sequence,
 ) -> pub [Field; 2] {
     // check the body and header lengths are within bounds
     assert(header.len() <= MAX_EMAIL_HEADER_LENGTH);
@@ -48,17 +48,19 @@ fn main(
 
     // compare the body hashes
     assert(
-        signed_body_hash == computed_body_hash, "SHA256 hash computed over body does not match body hash found in DKIM-signed header"
+        signed_body_hash == computed_body_hash,
+        "SHA256 hash computed over body does not match body hash found in DKIM-signed header",
     );
 
     // ~ 37,982 constraints
     // ensure the decoded body is the same as the original body
     assert(
         remove_soft_line_breaks(body.storage(), decoded_body.storage()),
-        "Decoded body does not properly remove soft line breaks"
+        "Decoded body does not properly remove soft line breaks",
     );
 
     // ~ 10,255 constraints
     // hash the pubkey and signature for the standard outputs
-    standard_outputs(pubkey.modulus, signature)
+    let email_nullifier = pedersen_hash(signature);
+    [pubkey.hash(), email_nullifier]
 }

examples/verify_email_1024_bit_dkim/src/main.nr

@@ -1,8 +1,8 @@
 use dep::zkemail::{
     KEY_LIMBS_1024, dkim::RSAPubkey, headers::body_hash::get_body_hash,
-    standard_outputs, Sequence
+    Sequence
 };
-use dep::std::{collections::bounded_vec::BoundedVec, hash::sha256_var};
+use dep::std::{collections::bounded_vec::BoundedVec, hash::{sha256_var, pedersen_hash}};
 
 global MAX_EMAIL_HEADER_LENGTH: u32 = 512;
 global MAX_EMAIL_BODY_LENGTH: u32 = 1024;
@@ -48,5 +48,6 @@ fn main(
     );
 
     // hash the pubkey and signature for the standard outputs
-    standard_outputs(pubkey.modulus, signature)
+    let email_nullifier = pedersen_hash(signature);
+    [pubkey.hash(), email_nullifier]
 }

examples/verify_email_2048_bit_dkim/Prover.toml

@@ -0,0 +1,18 @@
+signature = ['0x5779c85587e51cb8de5c29d7fdfeb0', '0xcd7ea8b6119f76f117ecb5042f8fc0', '0xeb7ac32b81d5a87bc2046fa0004e27', '0x62708c43b0c07a8fe8bdc97c479138', '0xc1e90d184f22a80be4a484a6ebd462', '0x39f3ff00e47728aaf74802d2d1d07b', '0x0f39de2cf99bf20dab7b8ae9240acd', '0xf4875cb76ce2538f255d70476136d6', '0xde151a5005ca614d6af7dd01e2a083', '0x6fe12b286f3195cae005fd7d2a1766', '0xd6e43a3060eccc555f2ee1e2929932', '0x0d5fa7cc79c794ae80310b491a1b40', '0x9cff415204cbc05c772ede05903440', '0xe7190ccff38575ae70dd055cd892d2', '0xf34bb777c0c842b0e88738eafdf634', '0x21040437e1e945a201ff58e542be68', '0x12f254fa4a0fb776ffe8759eb9eefa', '0x12']
+body_hash_index = '363'
+
+[header]
+storage = ['102', '114', '111', '109', '58', '114', '117', '110', '110', '105', '101', '114', '46', '108', '101', '97', '103', '117', '101', '115', '46', '48', '106', '64', '105', '99', '108', '111', '117', '100', '46', '99', '111', '109', '13', '10', '99', '111', '110', '116', '101', '110', '116', '45', '116', '121', '112', '101', '58', '116', '101', '120', '116', '47', '112', '108', '97', '105', '110', '59', '32', '99', '104', '97', '114', '115', '101', '116', '61', '117', '115', '45', '97', '115', '99', '105', '105', '13', '10', '109', '105', '109', '101', '45', '118', '101', '114', '115', '105', '111', '110', '58', '49', '46', '48', '32', '40', '77', '97', '99', '32', '79', '83', '32', '88', '32', '77', '97', '105', '108', '32', '49', '54', '46', '48', '32', '92', '40', '51', '55', '51', '49', '46', '53', '48', '48', '46', '50', '51', '49', '92', '41', '41', '13', '10', '115', '117', '98', '106', '101', '99', '116', '58', '72', '101', '108', '108', '111', '13', '10', '109', '101', '115', '115', '97', '103', '101', '45', '105', '100', '58', '60', '56', '70', '56', '49', '57', '68', '51', '50', '45', '66', '54', '65', '67', '45', '52', '56', '57', '68', '45', '57', '55', '55', '70', '45', '52', '51', '56', '66', '66', '67', '52', '67', '65', '66', '50', '55', '64', '109', '101', '46', '99', '111', '109', '62', '13', '10', '100', '97', '116', '101', '58', '83', '97', '116', '44', '32', '50', '54', '32', '65', '117', '103', '32', '50', '48', '50', '51', '32', '49', '50', '58', '50', '53', '58', '50', '50', '32', '43', '48', '52', '48', '48', '13', '10', '116', '111', '58', '122', '107', '101', '119', '116', '101', '115', '116', '64', '103', '109', '97', '105', '108', '46', '99', '111', '109', '13', '10', '100', '107', '105', '109', '45', '115', '105', '103', '110', '97', '116', '117', '114', '101', '58', '118', '61', '49', '59', '32', '97', '61', '114', '115', '97', '45', '115', '104', '97', '50', '53', '54', '59', '32', '99', '61', '114', '101', '108', '97', '120', '101', '100', '47', '114', '101', '108', '97', '120', '101', '100', '59', '32', '100', '61', '105', '99', '108', '111', '117', '100', '46', '99', '111', '109', '59', '32', '115', '61', '49', '97', '49', '104', '97', '105', '59', '32', '116', '61', '49', '54', '57', '51', '48', '51', '56', '51', '51', '55', '59', '32', '98', '104', '61', '55', '120', '81', '77', '68', '117', '111', '86', '86', '85', '52', '109', '48', '87', '48', '87', '82', '86', '83', '114', '86', '88', '77', '101', '71', '83', '73', '65', '83', '115', '110', '117', '99', '75', '57', '100', '74', '115', '114', '99', '43', '118', '85', '61', '59', '32', '104', '61', '102', '114', '111', '109', '58', '67', '111', '110', '116', '101', '110', '116', '45', '84', '121', '112', '101', '58', '77', '105', '109', '101', '45', '86', '101', '114', '115', '105', '111', '110', '58', '83', '117', '98', '106', '101', '99', '116', '58', '77', '101', '115', '115', '97', '103', '101', '45', '73', '100', '58', '68', '97', '116', '101', '58', '116', '111', '59', '32', '98', '61', '128', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '14', '192']
+len = '472'
+
+[pubkey]
+modulus = ['0xe5cf995b5ef59ce9943d1f4209b6ab', '0xe0caf03235e91a2db27e9ed214bcc6', '0xafe1309f87414bd36ed296dacfade2', '0xbeff3f19046a43adce46c932514988', '0x324041af8736e87de4358860fff057', '0xadcc6669dfa346f322717851a8c22a', '0x8b2a193089e6bf951c553b5a6f71aa', '0x0a570fe582918c4f731a0002068df2', '0x39419a433d6bfdd1978356cbca4b60', '0x550d695a514d38b45c862320a00ea5', '0x1c56ac1dfbf1beea31e8a613c2a51f', '0x6a30c9f22d2e5cb6934263d0838809', '0x0a281f268a44b21a4f77a91a52f960', '0x5134dc3966c8e91402669a47cc8597', '0x71590781df114ec072e641cdc5d224', '0xa1bc0f0937489c806c1944fd029dc9', '0x911f6e47f84db3b64c3648ebb5a127', '0xd5']
+redc = ['0xa48a824e4ebc7e0f1059f3ecfa57c4', '0x05c1db23f3c7d47ad7e7d7cfda5189', '0x79bb6bbbd8facf011f022fa9051aec', '0x24faa4cef474bed639362ea71f7a21', '0x1503aa50b77e24b030841a7d061581', '0x5bbf4e62805e1860a904c0f66a5fad', '0x5cbd24b72442d2ce647dd7d0a44368', '0x074a8839a4460c169dce7138efdaef', '0x0f06e09e3191b995b08e5b45182f65', '0x51fad4a89f8369fe10e5d4b6e149a1', '0xdc778b15982d11ebf7fe23b4e15f10', '0xa09ff3a4567077510c474e4ac0a21a', '0xb37e69e5dbb77167b73065e4c5ad6a', '0xecf4774e22e7fe3a38642186f7ae74', '0x16e72b5eb4c813a3b37998083aab81', '0xa48e7050aa8abedce5a45c16985376', '0xdd3285e53b322b221f7bcf4f8f8ad8', '0x0132']
+
+[dkim_header_sequence]
+index = '269'
+length = '203'
+
+[body]
+storage = ['72', '101', '108', '108', '111', '44', '13', '10', '13', '10', '72', '111', '119', '32', '97', '114', '101', '32', '121', '111', '117', '63', '13', '10', '128', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '192', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0', '0']
+len = '24'

examples/verify_email_2048_bit_dkim/src/main.nr

@@ -1,8 +1,8 @@
 use dep::zkemail::{
     KEY_LIMBS_2048, dkim::RSAPubkey, headers::body_hash::get_body_hash,
-    standard_outputs, Sequence
+    Sequence
 };
-use dep::std::{collections::bounded_vec::BoundedVec, hash::sha256_var};
+use dep::std::{collections::bounded_vec::BoundedVec, hash::{sha256_var, pedersen_hash}};
 
 global MAX_EMAIL_HEADER_LENGTH: u32 = 512;
 global MAX_EMAIL_BODY_LENGTH: u32 = 1024;
@@ -52,5 +52,6 @@ fn main(
 
     // ~ 10,255 constraints
     // hash the pubkey and signature for the standard outputs
-    standard_outputs(pubkey.modulus, signature)
+    let email_nullifier = pedersen_hash(signature);
+    [pubkey.hash(), email_nullifier]
 }

js/package.json

@@ -13,8 +13,8 @@
   "dependencies": {
     "@mach-34/noir-bignum-paramgen": "^1.1.0",
     "@noir-lang/backend_barretenberg": "=0.36.0",
-    "@noir-lang/noir_js": "=0.36.0",
-    "@noir-lang/noirc_abi": "^0.36.0",
+    "@noir-lang/noir_js": "=0.38.0",
+    "@noir-lang/noirc_abi": "=0.36.0",
     "@zk-email/helpers": "=6.1.5"
   },
   "devDependencies": {