Module linearized 

F₂-linear maps on GF(2^128) as linearized polynomials Σ_j μ_j x^{2^j}, and the outer-statement gadget that proves Σ_c a_c φ(h_c) on committed pad entries with a Frobenius-Horner chain of 127 squarings.

Structs

RingGadget

Δ = Σ_c a_c φ(h_c) over the pad entries (pad, a_c) as the chain X_127 = T'_127, X_j = T'_j + X_{j+1}², T'_j = Σ_c σ^{-j}(μ_j a_c) h_c, on squaring wires first_wire + j - 1 for j = 1..128; Δ = X_0.

Constants

BITS

Functions

dual_basis

Trace-dual of the tower basis: Tr(dual_basis(u) · 2^w) = [u == w].

linearized_coeffs

μ_j with Σ_u eq(r'',u)·bit_u(x) = Σ_j μ_j x^{2^j} for every x, bits in the tower basis.