Struct BindingProof 

pub struct BindingProof {
    pub member_roots: Vec<(u64, Vec<u8>)>,
    pub alg_epochs: Vec<(u64, Vec<(u64, u64)>)>,
}

A cross-algorithm binding proof.

Carries the shared structure every algorithm commits to: the member roots MR₀, MR₁, … (the active per-algorithm roots, opaque digests) and the committed epoch timeline they were bound under. The trusted binding roots BR_i are not stored here — they are supplied to Self::verify as trusted inputs, because their origin is established out of band.

Fields

member_roots: Vec<(u64, Vec<u8>)>

The shared member roots: (alg_id, MR) for each algorithm active at the committed tree size, sorted by algorithm ID. Opaque digests.

alg_epochs: Vec<(u64, Vec<(u64, u64)>)>

The committed epoch timeline these roots were bound under: (alg_id, epochs) for every registered algorithm, sorted by algorithm ID. Part of the canonical binding-root preimage.

Implementations

impl BindingProof

pub fn produce( member_roots: Vec<(u64, Vec<u8>)>, alg_epochs: Vec<(u64, Vec<(u64, u64)>)>, ) -> BindingProof

Assemble a binding proof from the shared structure committed by every algorithm: the member roots and the committed epoch timeline.

This is the produce half: a holder of the shared structure packages it for a verifier. Producing the proof does not require any binding root — the binding roots are the verifier’s trusted inputs, recomputed from this shared material at verification time.

pub fn verify( &self, trusted: &[TrustedBindingRoot<'_>], tree_size: u64, arity: u64, ) -> bool

Verify cross-algorithm binding-root consistency against trusted binding roots, reading digests only.

For each trusted binding root (alg_id, H_i, BR_i), recomputes H_i(preimage) == BR_i over the shared member-root/timeline preimage. The proof succeeds iff every algorithm’s recomputation matches its trusted BR_i. Success proves the algorithms are mutually bound (BR_i ≘ BR_j): each independently commits, under its own hash, to the identical shared structure.

No security mixing (D9)

Each algorithm’s H_i is applied only to the shared opaque preimage; the binding roots BR_i of other algorithms are never fed into H_i. A break of H_j cannot forge agreement under H_i.

Trust contract

trusted carries trusted binding roots: the verifier proves consistency given them, never their origin. Supplying an unauthenticated BR_i makes the guarantee vacuous, exactly as for a forged root in spine::verify_inclusion.

Well-formedness

Returns false for an empty trusted set (nothing to bind), for a structurally malformed committed timeline at tree_size, for member roots not strictly sorted by algorithm ID, or for any trusted binding root whose algorithm has no member root in the proof. These reject ill-formed inputs before any hashing.

Trait Implementations

impl Clone for BindingProof

fn clone(&self) -> BindingProof

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for BindingProof

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Eq for BindingProof

impl PartialEq for BindingProof

fn eq(&self, other: &BindingProof) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for BindingProof