This is my last post about
$JubJub cause then I will go silent about crypto for a while. I know I don't have enough followers for this to be interestint enough but I need to vent the lore so that I do not forget it.
So, to go back to
$JubJub, I already posted the first part of the lore in a reply to
$Zcash.
To specify it a bit more, from the original poem:
โโYou boil it in sawdust, you salt it in glue, you condense it with locusts and tape. Still keeping one principal object in viewโ To preserve its symmetrical shape.โ
we go to the cryptographic metaphor, where the poem serves as an allegorical commentary on the arduous mathematical crafting required to build an embedded curve for zk-SNARKs.
โ"Boil it in sawdust... salt it in glue... condense it with locusts and tape": Constructing a pairing-friendly SNARK system requires a primary curve (BLS12-381) and an embedded curve whose base field equals the scalar field of the first. Satisfying every cryptographic security requirement (large prime-order subgroup, embedding degree, resistance to small-subgroup attacks, efficient coordinate arithmetic) feels like stitching together bizarre, incompatible ingredients.
โ"Still keeping one principal object in viewโTo preserve its symmetrical shape": Twisted Edwards curves provide an addition law that is complete (meaning no edge cases for the identity element or point doubling) when a is square and d is nonsquare. This mathematical symmetry ensures uniform circuit constraints without branching logic, guaranteeing that exceptional points do not break circuit proofs.
$Jubjub forms the computational backbone of the Sapling shielded pool.
In earlier versions of Zcash (Sprout), proof generation required minutes and gigabytes of RAM because operations like SHA-256 had to be simulated bit-by-bit inside SNARK circuits.
$JubJub was designed to compute hashes, commitments, and signatures natively as field multiplications inside the BLS12-381 scalar field.
The Private Key Space (Scalar Field): Every private spending key (ask), proof authorizing key (nsk), signature randomizer (\alpha), and commitment trapdoor (rcm, rcv) in Sapling is an integer modulo this exact prime number (FrJ). When you perform scalar multiplication [k]P on the curve, the scalar k wraps around at rJ.