Struct MarlinKZG10 

pub struct MarlinKZG10<E: Pairing, P: DenseUVPolynomial<E::ScalarField>> { /* private fields */ }

Polynomial commitment based on [KZG10], with degree enforcement, batching, and (optional) hiding property taken from [CHMMVW20, “Marlin”].

Degree bound enforcement requires that (at least one of) the points at which a committed polynomial is evaluated are from a distribution that is random conditioned on the polynomial. This is because degree bound enforcement relies on checking a polynomial identity at this point. More formally, the points must be sampled from an admissible query sampler, as detailed in [CHMMVW20].

Trait Implementations

impl<E, P> PolynomialCommitment<<E as Pairing>::ScalarField, P> for MarlinKZG10<E, P>

where E: Pairing, P: DenseUVPolynomial<E::ScalarField, Point = E::ScalarField>, for<'a, 'b> &'a P: Div<&'b P, Output = P>,

fn setup<R: RngCore>( max_degree: usize, _num_vars: Option<usize>, rng: &mut R, ) -> Result<Self::UniversalParams, Self::Error>

Constructs public parameters when given as input the maximum degree max_degree for the polynomial commitment scheme.

fn commit<'a>( ck: &Self::CommitterKey, polynomials: impl IntoIterator<Item = &'a LabeledPolynomial<E::ScalarField, P>>, rng: Option<&mut dyn RngCore>, ) -> Result<(Vec<LabeledCommitment<Self::Commitment>>, Vec<Self::CommitmentState>), Self::Error>

where P: 'a,

Outputs a commitment to polynomial.

fn open<'a>( ck: &Self::CommitterKey, labeled_polynomials: impl IntoIterator<Item = &'a LabeledPolynomial<E::ScalarField, P>>, _commitments: impl IntoIterator<Item = &'a LabeledCommitment<Self::Commitment>>, point: &'a P::Point, sponge: &mut impl CryptographicSponge, states: impl IntoIterator<Item = &'a Self::CommitmentState>, _rng: Option<&mut dyn RngCore>, ) -> Result<Self::Proof, Self::Error>

where P: 'a, Self::CommitmentState: 'a, Self::Commitment: 'a,

On input a polynomial p and a point point, outputs a proof for the same.

fn check<'a>( vk: &Self::VerifierKey, commitments: impl IntoIterator<Item = &'a LabeledCommitment<Self::Commitment>>, point: &'a P::Point, values: impl IntoIterator<Item = E::ScalarField>, proof: &Self::Proof, sponge: &mut impl CryptographicSponge, _rng: Option<&mut dyn RngCore>, ) -> Result<bool, Self::Error>

where Self::Commitment: 'a,

Verifies that value is the evaluation at x of the polynomial committed inside comm.

fn check_combinations<'a, R: RngCore>( vk: &Self::VerifierKey, lc_s: impl IntoIterator<Item = &'a LinearCombination<E::ScalarField>>, commitments: impl IntoIterator<Item = &'a LabeledCommitment<Self::Commitment>>, query_set: &QuerySet<P::Point>, evaluations: &Evaluations<E::ScalarField, P::Point>, proof: &BatchLCProof<E::ScalarField, Self::BatchProof>, sponge: &mut impl CryptographicSponge, rng: &mut R, ) -> Result<bool, Self::Error>

where Self::Commitment: 'a,

Checks that values are the true evaluations at query_set of the polynomials committed in labeled_commitments.

fn batch_open<'a>( ck: &CommitterKey<E>, labeled_polynomials: impl IntoIterator<Item = &'a LabeledPolynomial<E::ScalarField, P>>, commitments: impl IntoIterator<Item = &'a LabeledCommitment<Commitment<E>>>, query_set: &QuerySet<P::Point>, sponge: &mut impl CryptographicSponge, states: impl IntoIterator<Item = &'a Self::CommitmentState>, rng: Option<&mut dyn RngCore>, ) -> Result<Vec<Proof<E>>, Error>

where P: 'a, Self::CommitmentState: 'a, Self::Commitment: 'a,

On input a list of labeled polynomials and a query set, open outputs a proof of evaluation of the polynomials at the points in the query set.

type UniversalParams = UniversalParams<E>

The universal parameters for the commitment scheme. These are “trimmed” down to Self::CommitterKey and Self::VerifierKey by Self::trim.

type CommitterKey = CommitterKey<E>

The committer key for the scheme; used to commit to a polynomial and then open the commitment to produce an evaluation proof.

type VerifierKey = VerifierKey<E>

The verifier key for the scheme; used to check an evaluation proof.

type Commitment = Commitment<E>

The commitment to a polynomial.

type CommitmentState = Randomness<<E as Pairing>::ScalarField, P>

Auxiliary state of the commitment, output by the commit phase. It contains information that can be reused by the committer during the open phase, such as the commitment randomness. Not to be shared with the verifier.

type Proof = Proof<E>

The evaluation proof for a single point.

type BatchProof = Vec<<MarlinKZG10<E, P> as PolynomialCommitment<<E as Pairing>::ScalarField, P>>::Proof>

The evaluation proof for a query set.

type Error = Error

The error type for the scheme.

fn trim( pp: &Self::UniversalParams, supported_degree: usize, supported_hiding_bound: usize, enforced_degree_bounds: Option<&[usize]>, ) -> Result<(Self::CommitterKey, Self::VerifierKey), Self::Error>

Specializes the public parameters for polynomials up to the given supported_degree and for enforcing degree bounds in the range 1..=supported_degree.

fn batch_check<'a, R: RngCore>( vk: &Self::VerifierKey, commitments: impl IntoIterator<Item = &'a LabeledCommitment<Self::Commitment>>, query_set: &QuerySet<P::Point>, values: &Evaluations<E::ScalarField, P::Point>, proof: &Self::BatchProof, sponge: &mut impl CryptographicSponge, rng: &mut R, ) -> Result<bool, Self::Error>

where Self::Commitment: 'a,

Verify opening proofs for several polynomials at one or more points each (possibly different for each polynomial). Each entry in the query set of points contains the label of the polynomial which was queried at that point.

fn open_combinations<'a>( ck: &Self::CommitterKey, lc_s: impl IntoIterator<Item = &'a LinearCombination<E::ScalarField>>, polynomials: impl IntoIterator<Item = &'a LabeledPolynomial<E::ScalarField, P>>, commitments: impl IntoIterator<Item = &'a LabeledCommitment<Self::Commitment>>, query_set: &QuerySet<P::Point>, sponge: &mut impl CryptographicSponge, states: impl IntoIterator<Item = &'a Self::CommitmentState>, rng: Option<&mut dyn RngCore>, ) -> Result<BatchLCProof<E::ScalarField, Self::BatchProof>, Self::Error>

where P: 'a, Self::CommitmentState: 'a, Self::Commitment: 'a,

Open commitments to all polynomials involved in a number of linear combinations (LC) simultaneously.