ZIP 2005: Address review comments (define-order, explicit imports, displaymath, I2LEBSP).

* In § 4.7.2, define Derive_rcm^Sapling before H^esk,Sapling (rcm-then-esk
  ordering, matching § 4.7.3).
* In § 4.8.2, add an import preamble for Derive_rcm^Sapling.
* In § 4.8.3 and § 4.20.2/§ 4.20.3, replace the stale H^{rcm,Orchard} import
  with Derive_rcm^Orchard (and add Derive_rcm^Sapling to § 4.20.x), since
  the actual derivation goes through the helpers.
* In the key-binding algebraic setup, replace the non-existent LEBSP with
  I2LEBSP_{l^Orchard} and lift the three named formulas to display math
  for readability.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: daira

zips/zip-2005.md

@@ -741,14 +741,14 @@ Add the following notes:
 
 Add after the definition of $\mathsf{leadByte}$:
 
-> Define $\mathsf{H^{esk,Sapling}_{rseed}}(\_) = \mathsf{ToScalar^{Sapling}}\big(\mathsf{PRF^{expand}_{rseed}}([\mathtt{0x05}])\kern-0.1em\big)$.
->
-> ($\mathsf{H^{esk,Sapling}}$ intentionally takes an argument that is unused.)
->
 > Define $\mathsf{Derive\_rcm^{Sapling}_{rseed}}(\mathsf{leadByte}) = \begin{cases}
 >   \mathsf{LEOS2IP}_{256}(\mathsf{rseed}),&\!\!\!\text{if } \mathsf{leadByte} = \mathtt{0x01} \\
 >   \mathsf{ToScalar^{Sapling}}\big(\mathsf{PRF^{expand}_{rseed}}([\mathtt{0x04}])\kern-0.1em\big),&\!\!\!\text{if } \mathsf{leadByte} = \mathtt{0x02}
 > \end{cases}$
+>
+> Define $\mathsf{H^{esk,Sapling}_{rseed}}(\_) = \mathsf{ToScalar^{Sapling}}\big(\mathsf{PRF^{expand}_{rseed}}([\mathtt{0x05}])\kern-0.1em\big)$.
+>
+> ($\mathsf{H^{esk,Sapling}}$ intentionally takes an argument that is unused.)
 
 Replace the lines deriving $\mathsf{rcm}$ and $\mathsf{esk}$ with
 
@@ -794,6 +794,11 @@ with
 
 #### § 4.8.2 ‘Dummy Notes (Sapling)’
 
+Add
+
+> Let $\mathsf{Derive\_rcm^{Sapling}}$ be as defined in
+> § 4.7.2 ‘Sending Notes (Sapling)’.
+
 Replace the line deriving $\mathsf{rcm}$ with
 
 > Derive $\mathsf{rcm} = \mathsf{Derive\_rcm^{Sapling}_{rseed}}(\mathsf{leadByte})$
@@ -802,7 +807,7 @@ Replace the line deriving $\mathsf{rcm}$ with
 
 Insert before "The spend-related fields ...":
 
-> Let $\mathsf{H^{rcm,Orchard}}$ and $\mathsf{H^{\text{ψ},Orchard}}$ be
+> Let $\mathsf{Derive\_rcm^{Orchard}}$ and $\mathsf{H^{\text{ψ},Orchard}}$ be
 > as defined in § 4.7.3 ‘Sending Notes (Orchard)’.
 
 Replace the lines deriving $\mathsf{rcm}$ and $\text{ψ}$ with
@@ -821,9 +826,10 @@ in the inputs to $\mathsf{NoteCommit^{Orchard}}$.
 
 For both § 4.20.2 and § 4.20.3, add before the decryption procedure:
 
-> Let $\mathsf{H^{esk,Sapling}}$ be as defined in § 4.7.2 ‘Sending Notes (Sapling)’.
+> Let $\mathsf{Derive\_rcm^{Sapling}}$ and $\mathsf{H^{esk,Sapling}}$ be
+> as defined in § 4.7.2 ‘Sending Notes (Sapling)’.
 >
-> Let $\mathsf{H^{rcm,Orchard}}$, $\mathsf{H^{esk,Orchard}}$,
+> Let $\mathsf{Derive\_rcm^{Orchard}}$, $\mathsf{H^{esk,Orchard}}$,
 > and $\mathsf{H^{\text{ψ},Orchard}}$ be as defined in
 > § 4.7.3 ‘Sending Notes (Orchard)’.
 
@@ -1434,20 +1440,20 @@ $\varepsilon_{\mathsf{kb}}(\mathcal{A}, q_{\mathsf{kb}}) \leq \frac{3\, q_{\math
 
 *Algebraic setup.*
 By § 5.4.1.10 “Sinsemilla commitments”,
-$\mathsf{Commit^{ivk}_{rivk}}(\mathsf{ak}, \mathsf{nk}) =
-\mathsf{Extract}_{\mathbb{P}}\big(M' + [\mathsf{rivk}]\, \mathcal{S}\big)$,
-where
-$\mathcal{S} := \mathsf{GroupHash}^{\mathbb{P}}(\texttt{“z.cash:Orchard-CommitIvk-r”}, \texttt{“”})$
-is the rivk-randomization base and
-$M' := \mathsf{SinsemillaHashToPoint}\big(\texttt{“z.cash:Orchard-CommitIvk-M”},\,
-\mathsf{LEBSP}(\mathsf{ak}) \,\Vert\, \mathsf{LEBSP}(\mathsf{nk})\big)$
-(see § 5.4.1.10 for the exact bit-sequence encoding).
+$$\mathsf{Commit^{ivk}_{rivk}}(\mathsf{ak}, \mathsf{nk}) =
+\mathsf{Extract}_{\mathbb{P}}\big(M' + [\mathsf{rivk}]\, \mathcal{S}\big),$$
+where $\mathcal{S}$ is the rivk-randomization base
+$$\mathcal{S} := \mathsf{GroupHash}^{\mathbb{P}}(\texttt{“z.cash:Orchard-CommitIvk-r”}, \texttt{“”}),$$
+and
+$$M' := \mathsf{SinsemillaHashToPoint}\big(\texttt{“z.cash:Orchard-CommitIvk-M”},\;
+\mathsf{I2LEBSP}_{\ell^{\mathsf{Orchard}}_{\mathsf{base}}}(\mathsf{ak}) \,\Vert\,
+\mathsf{I2LEBSP}_{\ell^{\mathsf{Orchard}}_{\mathsf{base}}}(\mathsf{nk})\big).$$
 By expanding the Sinsemilla bases used inside $\mathsf{SinsemillaHashToPoint}$
 as scalar multiples of $\mathcal{S}$, without loss of generality we have
 $M' = [h(\mathsf{ak}, \mathsf{nk})]\, \mathcal{S}$ for a Pedersen-like
-deterministic scalar hash $h$. Therefore
-$\mathsf{Commit^{ivk}_{rivk}}(\mathsf{ak}, \mathsf{nk}) =
-\mathsf{Extract}_{\mathbb{P}}\big([h(\mathsf{ak}, \mathsf{nk}) + \mathsf{rivk}]\, \mathcal{S}\big)$.
+deterministic scalar hash $h$, so
+$$\mathsf{Commit^{ivk}_{rivk}}(\mathsf{ak}, \mathsf{nk}) =
+\mathsf{Extract}_{\mathbb{P}}\big([h(\mathsf{ak}, \mathsf{nk}) + \mathsf{rivk}]\, \mathcal{S}\big).$$
 Domain separation in
 the protocol's BLAKE2b instantiations ensures $h$ does not query
 $\mathsf{H^{rivk\_ext}}$, $\mathsf{H^{rivk\_legacy}}$,