This is the Dusk Network-maintained fork of Merlin 3.0.0. It preserves Merlin's transcript construction and output compatibility while keeping the Rust implementation maintained for Dusk's cryptographic stack.

Dusk relies on Merlin across its proof systems. Upstream has not published a release since 2021, so this fork provides a maintained path for toolchain, dependency and security updates. Fixed upstream vectors guard the Merlin 3.0 transcript and transcript-RNG compatibility boundary.

Merlin: composable proof transcripts for public-coin arguments of knowledge

Merlin is a STROBE-based transcript construction for zero-knowledge proofs. It automates the Fiat-Shamir transform, so that by using Merlin, non-interactive protocols can be implemented as if they were interactive.

This is significantly easier and less error-prone than performing the transformation by hand, and in addition, it also provides natural support for:

• multi-round protocols with alternating commit and challenge phases;

• natural domain separation, ensuring challenges are bound to the statements to be proved;

• automatic message framing, preventing ambiguous encoding of commitment data;

• and protocol composition, by using a common transcript for multiple protocols.

Finally, Merlin also provides a transcript-based random number generator as defense-in-depth against bad-entropy attacks (such as nonce reuse, or bias over many proofs). This RNG provides synthetic randomness derived from the entire public transcript, as well as the prover's witness data, and an auxiliary input from an external RNG.

More details on the design of Merlin and how to use it for proof systems can be found on the Merlin website.

Migrating from Merlin 3.0

Dusk Merlin 4.0.0 retains Merlin 3.0 transcript and transcript-RNG outputs. The major version marks package/build compatibility changes, not a new cryptographic protocol.

[dependencies]
merlin = { package = "dusk-merlin", version = "4.0.0" }

• Use Rust 1.96.1 or newer; this crate uses Rust 2024.
• Remove the obsolete nightly feature from dependency declarations.
• Keep use merlin::Transcript; the Rust library target is still merlin.
• Public RNG traits remain on rand_core 0.6.
• For no_std, disable default features. debug-transcript explicitly enables std and remains unsuitable for production.
• Little-endian-only support and the Merlin v1.0 protocol label are unchanged.

Features

The debug-transcript feature prints an annotated proof transcript to stdout; it is only suitable for development and testing purposes, should not be used in released crates, and should not be considered stable.

An example of an annotated transcript for a Bulletproof rangeproof can be found here.

About

Merlin is authored by Henry de Valence, with design input from Isis Lovecruft and Oleg Andreev. The construction grew out of work with Oleg Andreev and Cathie Yun on a Bulletproofs implementation. Thanks also to Trevor Perrin and Mike Hamburg for helpful discussions. Merlin is named in reference to Arthur-Merlin protocols which introduced the notion of public coin arguments.

The header image was created by Oleg Andreev as a composite of Arthur Pyle's The Enchanter Merlin and the Keccak Team's θ-step diagram.

This project is licensed under the MIT license.