Trait UnivariateStarkPcs 

pub trait UnivariateStarkPcs<Challenge, Challenger>: Pcs<Challenge, Challenger>
where
    Challenge: ExtensionField<Val<Self::Domain>>,
{
    type EvaluationsOnDomain<'a>: Matrix<Val<Self::Domain>> + 'a;

    const ZK: bool;

    // Required methods
    fn log_max_trace_height(&self) -> usize;
    fn log_min_trace_height(&self) -> usize;
    fn get_quotient_ldes(
        &self,
        evaluations: impl IntoIterator<Item = (Self::Domain, RowMajorMatrix<Val<Self::Domain>>)>,
        num_chunks: usize,
    ) -> Result<Vec<RowMajorMatrix<Val<Self::Domain>>>, Self::ProverError>;
    fn commit_ldes(
        &self,
        ldes: Vec<RowMajorMatrix<Val<Self::Domain>>>,
    ) -> Result<(Self::Commitment, Self::ProverData), Self::ProverError>;
    fn get_evaluations_on_domain<'a>(
        &self,
        prover_data: &'a Self::ProverData,
        idx: usize,
        domain: Self::Domain,
    ) -> Self::EvaluationsOnDomain<'a>;

    // Provided methods
    fn commit_preprocessing(
        &self,
        evaluations: impl IntoIterator<Item = (Self::Domain, RowMajorMatrix<Val<Self::Domain>>)>,
    ) -> Result<(Self::Commitment, Self::ProverData), Self::ProverError> { ... }
    fn commit_quotient(
        &self,
        quotient_domain: Self::Domain,
        quotient_evaluations: RowMajorMatrix<Val<Self::Domain>>,
        num_chunks: usize,
    ) -> Result<(Self::Commitment, Self::ProverData), Self::ProverError> { ... }
    fn get_evaluations_on_domain_no_random<'a>(
        &self,
        prover_data: &'a Self::ProverData,
        idx: usize,
        domain: Self::Domain,
    ) -> Self::EvaluationsOnDomain<'a> { ... }
    fn open_with_preprocessing(
        &self,
        commitment_data_with_opening_points: Vec<OpeningRequest<'_, Self::ProverData, Challenge>>,
        fiat_shamir_challenger: &mut Challenger,
        _preprocessed_commitment: Option<usize>,
    ) -> Result<(OpenedValues<Challenge>, Self::Proof), Self::ProverError> { ... }
    fn verify_with_preprocessing(
        &self,
        rounds: Vec<CommitmentOpening<Challenge, Self::Commitment, Self::Domain>>,
        proof: &Self::Proof,
        challenger: &mut Challenger,
        _preprocessed_commitment: Option<usize>,
    ) -> Result<(), Self::Error> { ... }
    fn get_opt_randomization_poly_commitment(
        &self,
        _domain: impl IntoIterator<Item = Self::Domain>,
    ) -> Result<Option<(Self::Commitment, Self::ProverData)>, Self::ProverError> { ... }
    fn build_periodic_lde_table(
        &self,
        periodic_cols: &[Vec<Val<Self::Domain>>],
        trace_domain: Self::Domain,
        quotient_domain: Self::Domain,
    ) -> PeriodicLdeTable<Val<Self::Domain>>
       where Self::Domain: Clone,
             Val<Self::Domain>: Clone { ... }
}

Capabilities used by univariate STARK provers and verifiers.

Generic commitment clients only need Pcs. Evaluation views remain backend-specific through the GAT, so implementations can borrow committed LDEs without copying.

Required Associated Constants

const ZK: bool

Whether to activate the STARK’s randomized layout and masking protocol.

Hiding implementations must enforce their trace-size and opening budgets. The flag alone does not certify caller-supplied commitments, randomness, or an arbitrary use of the underlying opening protocol.

Required Associated Types

type EvaluationsOnDomain<'a>: Matrix<Val<Self::Domain>> + 'a

Type of the output of get_evaluations_on_domain.

Required Methods

fn log_max_trace_height(&self) -> usize

The base-2 logarithm of the largest trace domain a proof may claim.

• A verifier rejects a proof-supplied height above this bound.
• The rejection happens before any domain is derived from that height.
• A backend whose evaluation domain must fit a two-adic subgroup subtracts its blowup.

This is the upper end of the pair.

The smallest claimable height is the lower end.

fn log_min_trace_height(&self) -> usize

The base-2 logarithm of the smallest base trace domain a proof may claim.

The base trace domain carries the selectors and the periodic columns. Under zero knowledge it is one bit shorter than the committed domain.

• A verifier builds it from a proof-supplied height before the opening argument runs.
• The height is therefore rejected here or not at all.
• A positive bound keeps a malformed proof out of domain arithmetic it would break.
• Backends defined down to a single row return zero.

There is no default, so a backend with a minimum has to state it.

fn get_quotient_ldes( &self, evaluations: impl IntoIterator<Item = (Self::Domain, RowMajorMatrix<Val<Self::Domain>>)>, num_chunks: usize, ) -> Result<Vec<RowMajorMatrix<Val<Self::Domain>>>, Self::ProverError>

When committing to quotient polynomials in batch-STARK, it is simpler to first compute the LDE evaluations before batch-committing to them.

This corresponds to the first step of commit_quotient. When zk is enabled, this will additionally add randomization.

fn commit_ldes( &self, ldes: Vec<RowMajorMatrix<Val<Self::Domain>>>, ) -> Result<(Self::Commitment, Self::ProverData), Self::ProverError>

Commits to a collection of LDE evaluation matrices.

fn get_evaluations_on_domain<'a>( &self, prover_data: &'a Self::ProverData, idx: usize, domain: Self::Domain, ) -> Self::EvaluationsOnDomain<'a>

Given prover data corresponding to a commitment to a collection of evaluation matrices, return the evaluations of those matrices on the given domain.

This is essentially a no-op when called with a domain which is a subset of the evaluation domain on which the evaluation matrices are defined.

Provided Methods

fn commit_preprocessing( &self, evaluations: impl IntoIterator<Item = (Self::Domain, RowMajorMatrix<Val<Self::Domain>>)>, ) -> Result<(Self::Commitment, Self::ProverData), Self::ProverError>

Same as commit but without randomization. This is used for preprocessed columns which do not have to be randomized even when ZK is enabled. Note that the preprocessed columns still need to be padded to the extended domain height.

Returns both the commitment which should be sent to the verifier and the prover data which can be used to produce opening proofs.

fn commit_quotient( &self, quotient_domain: Self::Domain, quotient_evaluations: RowMajorMatrix<Val<Self::Domain>>, num_chunks: usize, ) -> Result<(Self::Commitment, Self::ProverData), Self::ProverError>

Commit to the quotient polynomial. We first decompose the quotient polynomial into num_chunks many smaller polynomials each of degree degree / num_chunks. This can have minor performance benefits, but is not strictly necessary in the non zk case. When zk is enabled, this commitment will additionally include some randomization process to hide the inputs.

Arguments

• quotient_domain the domain of the quotient polynomial.
• quotient_evaluations the evaluations of the quotient polynomial over the domain. This should be in standard (not bit-reversed) order.
• num_chunks the number of smaller polynomials to decompose the quotient polynomial into.

fn get_evaluations_on_domain_no_random<'a>( &self, prover_data: &'a Self::ProverData, idx: usize, domain: Self::Domain, ) -> Self::EvaluationsOnDomain<'a>

This is the same as get_evaluations_on_domain but without randomization. This is used for preprocessed columns which do not have to be randomized even when ZK is enabled.

fn open_with_preprocessing( &self, commitment_data_with_opening_points: Vec<OpeningRequest<'_, Self::ProverData, Challenge>>, fiat_shamir_challenger: &mut Challenger, _preprocessed_commitment: Option<usize>, ) -> Result<(OpenedValues<Challenge>, Self::Proof), Self::ProverError>

Open commitments with an optional commitment to unrandomized preprocessing.

preprocessed_commitment identifies a request in the batch, not a matrix within a commitment. Hiding implementations omit random codewords for that request. The caller owns the commitment ordering; PCS implementations impose no STARK layout. Non-hiding implementations behave exactly like Pcs::open.

fn verify_with_preprocessing( &self, rounds: Vec<CommitmentOpening<Challenge, Self::Commitment, Self::Domain>>, proof: &Self::Proof, challenger: &mut Challenger, _preprocessed_commitment: Option<usize>, ) -> Result<(), Self::Error>

Verify with trusted metadata identifying the unrandomized preprocessing commitment.

The index identifies a commitment request, not a matrix. It must come from the verifier’s statement or key, never from the proof or its random-opening lengths. None requires every commitment to use the ordinary PCS opening format. Non-hiding implementations behave exactly like Pcs::verify.

fn get_opt_randomization_poly_commitment( &self, _domain: impl IntoIterator<Item = Self::Domain>, ) -> Result<Option<(Self::Commitment, Self::ProverData)>, Self::ProverError>

fn build_periodic_lde_table( &self, periodic_cols: &[Vec<Val<Self::Domain>>], trace_domain: Self::Domain, quotient_domain: Self::Domain, ) -> PeriodicLdeTable<Val<Self::Domain>>

where Self::Domain: Clone, Val<Self::Domain>: Clone,

Build the compact periodic LDE table (height = max_period × blowup, width = num periodic columns).

Default: evaluate each column at the first extended_height quotient points. Backends that can compute this faster (e.g. via coset LDE) should override this method.

Dyn Compatibility

This trait is not dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors