round constants

144 Goldilocks field elements, self-bootstrapped from genesis seed [0x63, 0x79, 0x62, 0x65, 0x72] via Hemera₀. see bootstrap for the derivation procedure.

layout

RC_FULL[128]     — 8 full rounds × 16 elements per round
RC_PARTIAL[16]   — 16 partial rounds × 1 element per round
total: 144

the permutation consumes constants in this order: 4 initial full rounds (64 elements), 16 partial rounds (16 elements), 4 terminal full rounds (64 elements). see permutation for indexing.

full round constants (RC_FULL)

round 0

0xD5CCEAC23026433F  0xE3578901A12C12D8  0xF69C218E10D83177  0x580252688A8C5A9D
0x8999AFADA4E74D8D  0x3A2986E4C8DF69F6  0x0EBFA3B512BC1EC0  0xAF162E8CDB5C5623
0xE54C582CAC713C96  0x1315A26ADDD52EA8  0x3F25886824102630  0x9609688FDB08100D
0xDE8A94BAA77948E8  0x3F1FD8F452908B58  0x2AAE2B41B6077AC0  0xB4A485338025F44F

round 1

0xCD18F0ACD84C0EEF  0xD2CE5135B673FBBE  0x914D073BC9BBE383  0x2826B3047F095DF8
0x56AEF8D57FEA34F2  0x7EC90485940AD963  0xFB789EBBDB30148B  0x76EEADEDF60E077E
0x542E0A6DCDDD2086  0x664E1F25561B629C  0x60D6F6D18B216806  0xAAC73D2DAC4DA2B8
0x9C0DEB970BCABF0E  0x9541543C548F6AFC  0x3C948BE6275C0983  0xE4C5D4D43422F0A4

round 2

0xD5A49B121F4976E4  0x51F536D940E58FF8  0xE227580FAE99E0B7  0x9051ACDF94C83017
0x7A03F3F60AB89AC5  0xC30EB0CE37C6FF7B  0x99565812FC6879F5  0x1B5919AD633AC835
0x6E387DA77D36855A  0xE7F108962DB39112  0xBD5ED6526E19F143  0x02F37EC89CBBF9CA
0x4F2AFEF8A60F7648  0x92073A4D954A0CE8  0x086721740F66CD47  0xFF21BBC9843474CF

round 3

0x5432FF4DC29FFA86  0x3545EF171C39F663  0x77B99EBB4AAD5D83  0x84A4868DD6D6633D
0xFDD268BFCB1CC81B  0x10FF93EE7699D69E  0xB45C530AFFB9087A  0x6637E6403268B78C
0xB30E74F61EDFDA60  0x86D732A43435D83F  0xFA88770BD6C92812  0x95D57C718FA631E8
0x661D2145E899982D  0x06458EB77BDAEC84  0xAC5E268E58525ECE  0xA234D1A33A75BEFD

round 4

0x24E9696F740F24D9  0x632C53F7C3C31CE9  0x4EC8EC7074ACF53B  0xF153D18F4116F1BE
0xE55D87672B4447E9  0x1B536BBBEA29BC5D  0x064FA5B24A94E367  0x99E86B6CE58589BE
0xD78E8FF6FA7C446F  0x26DC0C0278E7B74B  0xB603FFAE4CBDC2EE  0xB8C2A07F7258C118
0x75850DEFB9C91BE8  0xEDC67DE6CA914A05  0xC242735E64F81C97  0xDEC20D2942EBB607

round 5

0xE5525BD6C1F65B65  0xF48DB1E5FDA0176E  0x64EC11E470F5D158  0x9FDFE61922628C9A
0x63364D568A43A56D  0x74D9CB38F6E49130  0x1D407D6681A77A00  0x4C29F27B847828F1
0xD032BD5C54F6D9A8  0xCD182FAF42568134  0xF1A38914210A1DED  0x8C62C1EDF8AA43BB
0xD948E7C1359B6812  0xCB56477F8762C218  0xA607ACD0DABF616F  0x5AF7ECC8CC7358C8

round 6

0x88A8A0EF484D3E97  0xDE6C0BE57F5757A2  0x6EB62FDC6B8D02EA  0x99B1BB56096FFAD6
0xDEACFFCFA94CB72C  0xE3A75889FDA6FFC3  0x938A417DB1B283CC  0x947B438A83A2311D
0x0FBC91A69FE32B0C  0xFA56D3AEE09CC571  0xCDACBA4AA8500229  0x5EF5CCF955F5CA56
0x965085B4E9EEF0B7  0x7340F975CB869707  0x510A32FF6311C65F  0xDE14B97DCE6DB04E

round 7

0xE4A67862BAA30FDE  0x9332AD038E1F8C27  0xC64493389B918794  0xA96D8E273AFF45EB
0x143A4BB343B33BA2  0x2515A9FE8F39F795  0xD05D9C3BFC3E857B  0xB78E2961052468E2
0x7DF16657BD5B42D6  0x279311212173D900  0xC9E5FD0828D8007E  0x9A8F04EA65E31466
0xB18A04DDC473F891  0x4F436C22F47AF6BC  0x3E70EA68CA962CF6  0x178EC9C512384268

partial round constants (RC_PARTIAL)

 0: 0x51CF92D329EC3F2D    1: 0x60B6D7977812ED41    2: 0x6ACA07D4FDD7ED7C    3: 0x7C39D4A5A0B398CF
 4: 0x390818DE0BB16A9C    5: 0x6786D9CF32F70018    6: 0xD718F771C0BDCBC1    7: 0xE90565D5D30F4ECA
 8: 0x0FEABF48AAC74E6A    9: 0x65E5626024EBCAE3   10: 0x7DB692749E936229   11: 0xFCDC183BF5BD57B5
12: 0x6D057F8998AB265A   13: 0x76705CB4AE3F709A   14: 0xD2CAD0EDA18FD3D8   15: 0xE93D7D6EB7C9AF97

verification

all 144 values are canonical Goldilocks elements (< p = 0xFFFFFFFF00000001). any implementation can verify these constants by running the bootstrap procedure independently — same seed, same Hemera₀, same output.

hemera/specs/constants.md