Is "dummy square" needed in v2?

[cskiraly]

Documentation of the Semaphore circuit at https://semaphore.appliedzkp.org/docs/technical-reference/circuits#signal states that "The circuit calculates a dummy square of the signal hash to prevent any tampering with the proof."

I think this could use some more explanation. In fact, we were wondering why is this needed/useful, and if so, why squaring was chosen as the dummy operation. Wouldn't simply having the input suffice?

It might not cost too much to have the square there, but I'm interested from the theoretical point of view to know what's the reason behind it and what would change if the squaring is not done on that input.

[cedoor]

Hey @cskiraly , I think this article can be really helpful here: https://geometryresearch.xyz/notebook/groth16-malleability :)

[cskiraly]

Thanks @cedoor, I didn't know about that article! Exactly what I was looking for.