> For the complete documentation index, see [llms.txt](https://valargroup.gitbook.io/shielded-vote-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://valargroup.gitbook.io/shielded-vote-docs/circuit-components/shares-hash-integrity.md).

# Shares Hash Integrity

**Used in:** ZKP #2 (condition 10), ZKP #3 (condition 3)

## What it does

Verifies that the shares hash is correctly computed from blinded commitments over all 16 encrypted shares.

## Circuit

```
# Only in ZKP #2. The share commitments are inputs to ZKP #3
share_comm_i = Poseidon(blind_i, c1_i_x, c2_i_x, c1_i_y, c2_i_y) for i ∈ 0..16

shares_hash  = H(share_comm_0, share_comm_1, share_comm_2, share_comm_3, share_comm_4, share_comm_5... share_comm_15)
```

The shares are provided as private witnesses by the prover.

## Design choice

The blind factors are intentionally avoided to be provided since ZKP#3 is proven by helper server in our design. If the blinding factors and shares were provided to the same server, this would be an amount privacy leak

## Usage

* **ZKP #2** — The prover derives 16 blind factors deterministically (via a Blake2b-512 PRF keyed by the spending key and bound to the VAN being spent), computes blinded per-share commitments, hashes them into `shares_hash`, and uses it to construct the vote commitment. The blind factors and ciphertexts are private witnesses.
* **ZKP #3** — The prover provides 16 commitments as witnesses, recomputes `shares_hash`, and constrains equality with the `shares_hash` inside the vote commitment.