gistfile1.txt

pragma circom 2.0.0;

include "../node_modules/circomlib/circuits/pedersen.circom";

template Cashbag() {
  signal input password;
  signal input address;
  signal input salt;
  signal output passwordHash;
  signal output addressCopy;
  
  component p = Pedersen(256);
  var p_idx = 0;
  
  // Consume 160 bits from pass (sha-1)
  component n_pass = Num2Bits(160);
  n_pass.in <== password;
  for (var i = 0; i < 160; i++) {
    p.in[p_idx] <== n_pass.out[i];
    p_idx++;
  }

  // Consume 96 bits from salt
  component n_salt = Num2Bits(96);
  n_salt.in <== salt;
  for (var i = 0; i < 96; i++) {
    p.in[p_idx] <== n_salt.out[i];
    p_idx++;
  }

  passwordHash <== p.out[0];

  // We use the tx sender address in the circuit here to prevent replaying
  // proofs from other transactions.
  // Example from tornado cash which has been audited:
  // @see https://github.com/tornadocash/tornado-core/blob/896fc224ffd3619dfe3f09aad90e0021a8d41dd7/circuits/withdraw.circom#L54
  // @see https://github.com/tornadocash/tornado-core/blob/896fc224ffd3619dfe3f09aad90e0021a8d41dd7/contracts/Tornado.sol#L91
  // @see https://tornado.cash/audits/TornadoCash_circuit_audit_ABDK.pdf
  addressCopy <== address;
}

component main {public [salt]} = Cashbag();