Is there an algebraic transformation `p = f(x) mod q` s.t. it is intractable to find `x` given `p` (with `q` prime > 3)? E.g. `p = x + 1/x` or something. Looking at this for a payment channel issue.

<kayabanerve:matrix.org> UkoeHB: g^x, though that likely isn't helpful

Yeah it has to be provable without revealing `x`, e.g. with a composition proof from start/end keys `[x G, p G]`.

<kayabanerve:matrix.org> I mean, you can prove a square-and-mul ladder in a simple enough BP, but sure, it isn't linear

<kayabanerve:matrix.org> I'd be more concerned with the hardness of the computational DLP over a 256-bit prime field

<kayabanerve:matrix.org> *computational hardness of the DLP

<kayabanerve:matrix.org> It seems there's a demo of a DLP solve over a 768-bit safe prime, so yes, I believe you're limited to an arithmetic hash or approximate :/

<loop.ster:matrix.org> It sounds like you're venturing near the path I went down coming up with the VCOF for Grease. After several dead ends, I ended up at SNARKS - github.com/grease-xmr/grease/blob/9…legacy/v1/15_channel_update.typ#L43 > <UkoeHB> Yeah it has to be provable without revealing `x`, e.g. with a composition proof from start/end keys `[x G, p G]`.

@loop.ster oh perfect, doesn't that directly solve monero-project/research-lab #161#issuecomment-5396778447 ? Not sure why CjS77 mentioned it as a problem.

<kayabanerve:matrix.org> So we are now at an arithmetic hash and a BP to prove it?

<kayabanerve:matrix.org> Poseidon or reducing some linear combination of Ed25519 x coordinates into an Ed25519 scalar and arguing its sufficiently close to uniform?