Crate kbfold 

kbfold: post-quantum multilinear polynomial commitments from FRI folding in the Boolean-kernel basis.

Reference implementation of “Post-Quantum Multilinear Polynomial Commitments from FRI Folding in the Boolean-Kernel Basis”, https://github.com/qoosmo/kbfold/blob/main/paper/kbfold.pdf.

use kbfold::field::{Fp, Fp4};
use kbfold::pcs::{Params, commit, open, verify};

// m = 10 variables, rate 1/4, 6 folding rounds, 248 queries, challenges in F_{p^4}
let p = Params::post_quantum(10);
let table: Vec<Fp> = (0..1u64 << 10).map(Fp::new).collect(); // f on {0,1}^10
let z: Vec<Fp4> = (0..10u64).map(|i| Fp4::from(Fp::new(3 + i))).collect();
let (root, pd) = commit(&p, &table)?;
let (v, proof) = open(&p, &pd, &z)?; // v = f~(z)
verify(&p, &root, &z, v, &proof)?;

Modules: field (Goldilocks and its quadratic and quartic extensions), poly (kernel and monomial transforms, Moebius transform, restriction, NTT), merkle (salted Merkle trees and the Fiat-Shamir transcript), pcs (commit, open, verify, in kernel form and in the coefficient-form baseline), error.

The prover draws its salts from the operating system (getrandom). The verifier returns Result and never panics on a malformed proof. With the feature parallel the prover runs on all cores (rayon); the proofs are identical with and without it. Research code, not audited.

Modules

error

Errors returned by the verifiers and by parameter validation.

field

Goldilocks field F_p, p = 2^64 - 2^32 + 1, its quadratic extension F_p[u]/(u^2 - 7), and its quartic extension F_p[i]/(i^4 - 7) = F_{p^2}[v]/(v^2 - u) with v = i, u = i^2.

merkle

Salted BLAKE3 Merkle trees whose leaves are cosets {x : x^(2^g) = y} with merged openings (Section 3.4, “Salted Merkle commitments”), and the Fiat-Shamir transcript with the challenge maps phi and pos of Section 7.4.

pcs

The evaluation protocol Pi_eval^J of Section 6.3 (committed levels J = {0, k, 2k, …}), compiled as in Section 3.4: salted BLAKE3 Merkle trees, one round salt per round, and Fiat-Shamir challenges derived from the roots and salts of all previous rounds (the compiler BCS of Chiesa-Di-Hu-Zheng, Construction 11.7). Openings of one committed word share one merged authentication path.

poly

Boolean-kernel transforms (Corollary 3.8), multilinear helpers and the radix-2 NTT.