gnark's Groth16 commitment extension unsound for more than one commitment

Description The summary is that the proof of knowledge associated to a commitment is crucial to bind the commitment to the actual circuit variables that were supposed to be committed. However, the same σ is used for all proofs of knowledge for the commitments, which allows mixing between them,...

GHSA-Q3HW-3GM4-W5CR gnark's Groth16 commitment extension unsound for more than one commitment

Description The summary is that the proof of knowledge associated to a commitment is crucial to bind the commitment to the actual circuit variables that were supposed to be committed. However, the same σ is used for all proofs of knowledge for the commitments, which allows mixing between them,...