Crate p3_binary_pcs 

p3-binary-pcs

A multilinear polynomial commitment scheme over the binary tower, committing via an additive-domain Reed–Solomon code (the Cantor domain from p3-binary-dft) and proving proximity BaseFold-style, folding the codeword in lockstep with a multilinear sumcheck. See Diamond, Posen, Succinct Arguments over Towers of Binary Fields (Binius), https://eprint.iacr.org/2023/1784, and Diamond, Posen, Polylogarithmic Proofs for Multilinears over Binary Towers (FRI-Binius, ring switching), https://eprint.iacr.org/2024/504. Parameters are derived only in the unique-decoding regime. The capacity bound is refuted over characteristic 2 with F_2-subspace domains, and the Cantor domain is one. The classical Johnson list-decoding radius remains unconditional; using it in a folding argument additionally needs the proven Reed–Solomon mutual-correlated-agreement bound. This BaseFold implementation nevertheless stays in unique decoding by design; the WHIR adapter below also accepts the Johnson regime.

The committed alphabet and the challenge field are separate choices. Columns and the base codeword live in the alphabet; every challenge, every folded codeword and every claimed value live in the challenge field. A narrower alphabet halves the bytes of the largest Merkle tree in the proof without moving a single soundness term, because every error is charged against the challenge field’s width. Two constraints follow from the alphabet alone: the grinding witness is one of its elements, so its width caps the difficulty, and the base codeword lives on its additive domain, so num_variables + log_inv_rate must not exceed its bit width.

Two obligations the types do not carry:

• Binding, not hiding. The final codeword travels in the clear and every query opening is a raw codeword symbol, so this must not be used where zero-knowledge is required.
• Collision resistance is the caller’s. The derived schedule prices the field’s width and the query count, never the Merkle tree it is paired with.

BinaryPcsConfig delegates its algebraic budget to p3_security::binary::BinaryPcsRegime. The target covers the sum of opening-claim batching, every fold and sumcheck round, and query error. Query grinding applies only to queries; it runs after the alpha challenge, every fold, and absorption of the entire final codeword. This final-codeword binding changes the Fiat–Shamir transcript: proofs generated without it are not guaranteed to verify, although the proof’s serialization layout is unchanged. When every base coset is queried, query error is zero and its reserved budget is released. PrescribedPointPcs::prescribed_security supplies this composed bound and the unique-decoding candidate bound to security-checked multi-STARK callers, which also need collision evidence.

This tightens previously accepted configurations and can change the derived query count and proof transcript. Opening protocols must also fit BinaryPcsConfig::max_opening_claims(); each current or successor-column evaluation consumes one claim. The limit is conservative, not a tight attack threshold. Use BinaryPcs::validate_opening_protocol to preflight a protocol, or try_open / try_open_at to receive typed errors without changing the challenger on rejection. The existing infallible open / open_at traits panic on invalid or over-budget protocols. Existing callers must handle this new rejection or choose a feasible target and protocol before opening.

WHIR over the additive domain

The whir module connects WHIR to the Cantor additive code. Commitments use the 64-bit polynomial-basis field. Challenges use its 192-bit cubic extension.

Queries follow a transcript-bound stratified schedule. Use recommended_cap_height to stop Merkle paths at its deepest stratum.

Unique decoding and the Johnson regime use proven bounds. The capacity regime is unsupported because its assumption is refuted for this domain.

This adapter is binding, not hiding.

Part of Plonky3, dual-licensed under MIT and Apache 2.0.

Modules

transcript

Fiat-Shamir transcript of one binary-tower PCS run.

whir

WHIR over the additive binary domain, and the adapters that feed it narrow traces.

Structs

BinaryPcs

A multilinear polynomial commitment scheme over a binary tower field: an additive-domain Reed-Solomon codeword folded in lockstep with a residual sumcheck.

BinaryPcsConfig

The round schedule derived from BinaryPcsParams and the polynomial’s arity.

BinaryPcsParams

Parameters chosen by the caller.

BinaryPcsProof

A full opening proof.

BinaryPcsProverData

Data produced by committing the base codeword: the layout used to build the residual sumcheck, and the base commitment’s Merkle prover data.

BitOpening

One claim about the bit witness: a point, and the readings asked for there.

BitReadings

The readings one BitOpening asked for, and nothing where it asked for nothing.

BooleanPcs

A Boolean commitment built from the packing, the bit ring switch and the binary PCS.

BooleanProof

One Boolean opening: the reductions, and the commitment opening that discharges them.

BooleanTraceCommitment

A commitment to a batch of Boolean trace tables, packed into one bit witness.

BooleanTraceCommitmentData

The committed trace tables, held until the commitment is opened.

BooleanTraceCommitmentProof

One opening of a Boolean trace: the column values, and the bit proof behind them.

GroupedCodewordMmcs

Groups adjacent codeword symbols into wider Merkle leaves without changing symbol queries.

PackedStack

Equal-height columns over a narrow alphabet, held as the elements a commitment takes.

RoundProof

One intermediate fold batch: the commitment to that round’s folded codeword, and its query openings.

Enums

BinaryPcsConfigError

Why a BinaryPcsConfig could not be derived.

BinaryPcsError

Why an opening proof was rejected.

BooleanPcsError

Why a Boolean commitment or opening was refused.

BooleanTraceCommitmentError

Why a Boolean trace could not be committed or opened.

PackError

Why a run of columns could not be packed.

Traits

BooleanBackend

What a bit commitment keeps and sends, named without reference to a transcript.

BooleanMultilinearPcs

A commitment to a function from the hypercube to {0, 1}.

ChallengeField

A challenge field and the arithmetic representation used by its residual sumcheck.

Coordinates

A value whose bytes are a run of F_2 coordinates, lowest coordinate first.

FoldAlphabet

A codeword alphabet, together with the field its folds are challenged from.

Functions

coordinate_bytes

The byte view of a run of cells, which is the same bytes the packing holds.

fold_codeword

Fold a whole codeword, halving its length.

fold_pair

Fold one pair of the codeword.

pack

Read a run of cells as the wide elements holding the same coordinates.

unpack

Read a run of wide elements back as the cells whose coordinates they hold.

Type Aliases

BooleanTraceData

The retained data of a trace behind the folding-only bit commitment.

BooleanTraceError

Why a trace behind the folding-only bit commitment could not be committed or opened.

BooleanTracePcs

The trace commitment discharged through the folding-only bit commitment.

BooleanTraceProof

One opening of a trace behind the folding-only bit commitment.