Struct BinaryPcs 

pub struct BinaryPcs<F: EncodableLevel, EF, MT, MX, E = <F as EncodableLevel>::Encoder> { /* private fields */ }

A multilinear polynomial commitment scheme over a binary tower field: an additive-domain Reed-Solomon codeword folded in lockstep with a residual sumcheck.

The stacked-layout binding mode is fixed rather than chosen. The codeword fold merges adjacent pairs, which only suffix-order binding matches.

The base codeword and the folded codewords live over different fields. Each therefore has its own commitment scheme.

The two schemes must report the same failure type. One commitment family instantiated at two levels does.

Implementations

impl<F: EncodableLevel, EF: TowerLevel, MT, MX> BinaryPcs<F, EF, MT, MX>

pub fn new( config: BinaryPcsConfig, mmcs: MT, round_mmcs: MX, ) -> Result<Self, BinaryPcsConfigError>

Builds a PCS instance from a derived configuration and its two commitment schemes.

The schedule carries the two widths it was derived for, and both are checked here.

Every cap the derivation applied belongs to one of those two levels:

    committed alphabet   the additive domain the codeword lives in, and the grind
    challenge field      the width every algebraic error is charged against

A schedule derived elsewhere would otherwise report a bound it cannot deliver.

Arguments

• config: the validated fold and query schedule both sides read.
• mmcs: commits the base codeword over the committed alphabet.
• round_mmcs: commits every folded codeword over the challenge field.

Errors

Returns an error unless the schedule was derived for these two levels.

pub const fn num_variables(&self) -> usize

Variables of the committed stacked polynomial.

The same number the commitment trait reports, reachable without naming a challenger.

impl<F, EF, MT, MX, Ntt> BinaryPcs<F, EF, MT, MX, AdditiveRsEncoder<F, Ntt>>

where F: EncodableLevel, EF: TowerLevel, Ntt: AdditiveNtt<F> + Sync,

pub fn with_ntt( config: BinaryPcsConfig, mmcs: MT, round_mmcs: MX, ntt: Ntt, ) -> Result<Self, BinaryPcsConfigError>

Builds an instance around an explicitly selected additive transform.

The transform encodes the base codeword only. A folded codeword the opening encodes from its bound message goes through the challenge field’s own encoder instead. Every correct transform produces the same codeword, so the choice moves no committed symbol.

Errors

Returns an error unless the schedule was derived for these two tower levels.

impl<F, EF, MT, MX, E> BinaryPcs<F, EF, MT, MX, E>

where F: EncodableLevel + TranscriptField + FoldAlphabet<EF>, EF: ChallengeField<F> + ExtensionField<F> + TowerLevel + FoldAlphabet<EF>, MT: Mmcs<F>, MX: Mmcs<EF, Error = MT::Error>, E: Encoder<F> + Sync,

pub fn validate_opening_protocol( &self, protocol: &OpeningProtocol, ) -> Result<(), BinaryPcsError<F, MT::Error>>

Check table dimensions and scalar claim capacity before committing or opening.

Security rejection is a behavior change. A protocol an older release accepted can exceed the configured target.

Use this preflight, or a fallible opening entry point, to validate one directly. The commitment traits propagate the same typed errors.

Minimum non-degenerate protocol

A protocol of empty batches passes every check here.

A table with no opening still contributes its rows, and no claim is under any budget.

Such a run reaches the terminal relation with both sides zero:

    0  ==  0 * final_value      holds whatever the final value is

That is harmless rather than unsound.

A run that claims nothing proves nothing, and asserts nothing either.

Every column it might have opened stays as unconstrained as it was.

The shape is also load-bearing in the security tests.

Only it reaches query sampling with a tampered final codeword.

That isolates the codeword’s binding from the check that otherwise rejects first.

A caller wanting a floor of one claim can read the opening count and impose it.

pub fn try_open<Challenger>( &self, prover_data: BinaryPcsProverData<F, EF, MT>, protocol: &OpeningProtocol, challenger: &mut Challenger, ) -> Result<BinaryPcsProof<F, EF, MT, MX>, BinaryPcsError<F, <MT as Mmcs<F>>::Error>>

where Challenger: FieldChallenger<F> + GrindingChallenger<Witness = F> + CanSampleUniformBits<F> + CanObserve<MT::Commitment> + CanObserve<MX::Commitment>,

Produce a sampled-point opening, returning an error for an invalid or over-budget protocol before touching the challenger. Prover data must match the committed tables.

pub fn try_open_at<Challenger>( &self, prover_data: BinaryPcsProverData<F, EF, MT>, protocol: &OpeningProtocol, points: &[Point<EF>], challenger: &mut Challenger, ) -> Result<BinaryPcsProof<F, EF, MT, MX>, BinaryPcsError<F, <MT as Mmcs<F>>::Error>>

where Challenger: FieldChallenger<F> + GrindingChallenger<Witness = F> + CanSampleUniformBits<F> + CanObserve<MT::Commitment> + CanObserve<MX::Commitment>,

Produce a prescribed-point opening with recoverable protocol and budget errors.

Points must already be transcript-bound, as the prescribed-point contract requires. Rejection leaves the challenger unchanged.

Prover data must match the committed tables.

pub fn try_open_at_known<Challenger>( &self, prover_data: BinaryPcsProverData<F, EF, MT>, protocol: &OpeningProtocol, points: &[Point<EF>], evals: &[OpeningEvals<EF>], challenger: &mut Challenger, ) -> Result<BinaryPcsProof<F, EF, MT, MX>, BinaryPcsError<F, <MT as Mmcs<F>>::Error>>

where Challenger: FieldChallenger<F> + GrindingChallenger<Witness = F> + CanSampleUniformBits<F> + CanObserve<MT::Commitment> + CanObserve<MX::Commitment>,

Produce a prescribed-point opening from evaluations the caller already holds.

As Self::try_open_at, except that each batch’s claimed values are supplied instead of read off the committed columns. A protocol whose own reduction already produced the evaluation at every prescribed point passes it here, rather than paying a pass over the columns to find a value it has.

Points must already be transcript-bound, as the prescribed-point contract requires. Rejection leaves the challenger unchanged.

Prover data must match the committed tables.

Soundness

A supplied evaluation is bound exactly as a computed one is, and a verifier recomputes its own. A wrong one therefore yields a proof that does not verify, never one that does.

Trait Implementations

impl<F, EF, MT, MX, E, Challenger> MultilinearPcs<EF, Challenger> for BinaryPcs<F, EF, MT, MX, E>

where F: EncodableLevel + TranscriptField + FoldAlphabet<EF>, EF: ChallengeField<F> + ExtensionField<F> + TowerLevel + FoldAlphabet<EF>, MT: Mmcs<F>, MX: Mmcs<EF, Error = MT::Error>, E: Encoder<F> + Sync, Challenger: FieldChallenger<F> + GrindingChallenger<Witness = F> + CanSampleUniformBits<F> + CanObserve<MT::Commitment> + CanObserve<MX::Commitment>,

fn open( &self, prover_data: Self::ProverData, protocol: Self::OpeningProtocol, challenger: &mut Challenger, ) -> Result<Self::Proof, Self::ProverError>

Rejects an over-budget protocol before touching the challenger.

type Val = F

Base field of the committed polynomials.

type Commitment = <MT as Mmcs<F>>::Commitment

Succinct binding commitment sent to the verifier.

type ProverData = BinaryPcsProverData<F, EF, MT>

Prover-side auxiliary data retained between commit and open. Never sent to the verifier.

type Proof = BinaryPcsProof<F, EF, MT, MX>

Opening proof checked by the verifier.

type Error = BinaryPcsError<F, <MT as Mmcs<F>>::Error>

Verification failure type.

type ProverError = BinaryPcsError<F, <MT as Mmcs<F>>::Error>

Configuration or budget failure during commitment or opening.

type Witness = Witness<F>

Committed witness.

type OpeningProtocol = OpeningProtocol

Public opening shapes agreed before commit.

fn num_vars(&self) -> usize

Number of variables m of the committed polynomials. Every polynomial has 2^m evaluations.

fn commit( &self, witness: Self::Witness, challenger: &mut Challenger, ) -> Result<(Self::Commitment, Self::ProverData), Self::ProverError>

Commit to a multilinear witness.

fn observe_commitment( &self, commitment: &Self::Commitment, challenger: &mut Challenger, )

Bind a commitment into the transcript.

fn verify( &self, commitment: &Self::Commitment, proof: &Self::Proof, challenger: &mut Challenger, protocol: Self::OpeningProtocol, ) -> Result<(), Self::Error>

Verify an opening proof against a public commitment and opening protocol.

impl<F, EF, MT, MX, E, Challenger> PrescribedPointPcs<EF, Challenger> for BinaryPcs<F, EF, MT, MX, E>

where F: EncodableLevel + TranscriptField + FoldAlphabet<EF>, EF: ChallengeField<F> + ExtensionField<F> + TowerLevel + FoldAlphabet<EF>, MT: Mmcs<F>, MX: Mmcs<EF, Error = MT::Error>, E: Encoder<F> + Sync, Challenger: FieldChallenger<F> + GrindingChallenger<Witness = F> + CanSampleUniformBits<F> + CanObserve<MT::Commitment> + CanObserve<MX::Commitment>,

fn open_at( &self, prover_data: Self::ProverData, protocol: &OpeningProtocol, points: &[Point<EF>], challenger: &mut Challenger, ) -> Result<Self::Proof, Self::ProverError>

Rejects invalid or over-budget protocols before touching the challenger. Points must already be transcript-bound.

fn verify_at( &self, commitment: &Self::Commitment, proof: &Self::Proof, protocol: &OpeningProtocol, points: &[Point<EF>], challenger: &mut Challenger, ) -> Result<Vec<OpeningEvals<EF>>, Self::Error>

Verifies an opening proof against points instead of sampling each opening point from the transcript.

This trait gives no Fiat-Shamir guarantee on its own. The caller must bind points to the shared transcript first, as the prover did.

This method does not absorb commitment either. The caller absorbs it once, before drawing any challenge of its own.

That absorption is what binding points to the transcript rests on.

fn prescribed_security( &self, protocol: &OpeningProtocol, ) -> Option<PrescribedOpeningSecurity>

Soundness evidence for this exact opening protocol, or None when unknown.