spec: change from blake3 to blake2b and add explainer why

doc/src/spec/contracts/dao/model.md

@@ -2,7 +2,7 @@
 
 Let $\t{Bulla}$ be defined as in the section [Bulla Commitments](../../crypto-schemes.md#bulla-commitments).
 
-Let $ℙₚ, 𝔽ₚ, \mathcal{X}, \mathcal{Y}, \t{𝔹³²2𝔽ₚ}$ be defined as in the section [Pallas and Vesta](../../crypto-schemes.md#pallas-and-vesta).
+Let $ℙₚ, 𝔽ₚ, \mathcal{X}, \mathcal{Y}, \t{𝔹⁶⁴2𝔽ₚ}$ be defined as in the section [Pallas and Vesta](../../crypto-schemes.md#pallas-and-vesta).
 
 ## DAO
 
@@ -44,7 +44,7 @@ $$ \t{Bulla}_\t{DAO}(p) = \t{Bulla}(ℕ₆₄2𝔽ₚ(p.L), ℕ₆₄2𝔽ₚ(p.
 
 Let $\t{FuncId}$ be defined as in [Function IDs](../../concepts.md#function-ids).
 
-Let $\t{BLAKE3}$ be defined as in [BLAKE3 Hash Function](../../crypto-schemes.md#blake3-hash-function).
+Let $\t{BLAKE2b}$ be defined as in [BLAKE2b Hash Function](../../crypto-schemes.md#blake2b-hash-function).
 
 Define $\t{AuthCall} = (\t{FuncId}, 𝔹^*)$. Each *authorization call* represents
 a child call made by the DAO. The *auth data* field is used by the child invoked
@@ -54,7 +54,7 @@ contract to enforce additional invariants.
 ```
 
 Define $\t{Commit}_\t{Auth} : \t{AuthCall}^* → 𝔽ₚ$ by
-$$ \t{Commit}_{\t{Auth}^*}(c) = 𝔹³²2𝔽ₚ(\t{BLAKE3}(\t{Encode}(c))) $$
+$$ \t{Commit}_{\t{Auth}^*}(c) = 𝔹⁶⁴2𝔽ₚ(\t{BLAKE2b}(\t{Encode}(c))) $$
 which commits to a `Vec<DaoAuthCall>`.
 
 ### Proposal

doc/src/spec/crypto-schemes.md

@@ -69,15 +69,23 @@ $$ \mathcal{Y}((x, y)) = y $$
 **Note:** There is no $P = (0, y) ∈ Eₚ$ so $\mathcal{X}(P) = 0 ⟹  P = ∞$.
 Likewise there is no $P = (x, 0) ∈ Eₚ$ so $\mathcal{Y}(P) = 0 ⟹  P = ∞$.
 
-### Encoding and Decoding for $𝔽ₚ$
+### Hashing to $𝔽ₚ$
 
-Define $𝔽ₚ2𝔹³² : 𝔽ₚ → 𝔹³²$ as encoding the canonical representation
-of $𝔽ₚ$ in little endian byte format.
-
-Define $𝔹³²2𝔽ₚ : 𝔹³² → 𝔽ₚ$ as the matching decoding of $𝔽ₚ$ modulo
+Define $𝔹⁶⁴2𝔽ₚ : 𝔹⁶⁴ → 𝔽ₚ$ as the matching decoding of $𝔽ₚ$ modulo
 the canonical class in little endian byte format.
 
-## BLAKE3 Hash Function
+Let there by a uniform hash function $h : X → [0, r)$ with $r ≠ p$,
+and a map $σ : [0, r) → [0, p)$ converting to the canonical representation
+of the class in $ℤ/⟨p⟩$.
+
+Let $s = σ ∘ h$ be the composition of functions, then $s$ has a non-uniform
+range. However increasing the size of $r$ relative to $p$ diminises the
+statistical significance of any overlap.
+For this reason we define the conversion from $𝔹⁶⁴$ for hash functions.
+
+## BLAKE2b Hash Function
+
+BLAKE2 is defined by [ANWW2013](https://blake2.net/#sp).
+DarkFi uses the BLAKE2b variant.
+$$ \t{BLAKE2b}: 𝔹^* → 𝔹⁶⁴ $$
 
-BLAKE3 is defined by [CANW2021](https://raw.githubusercontent.com/BLAKE3-team/BLAKE3-specs/master/blake3.pdf).
-$$ \t{BLAKE3}: 𝔹^* → 𝔹³² $$