Enum SecurityAssumption 

pub enum SecurityAssumption {
    UniqueDecoding,
    JohnsonBound,
    CapacityBound,
}

Proximity regime selector for Reed–Solomon-based IOPs.

Variants

UniqueDecoding

Unique decoding: each oracle is within the UDR. No conjectures.

JohnsonBound

Johnson bound at δ = 1 − √ρ − η, with η = √ρ / 20. No conjectures.

Reed-Solomon mutual correlated agreement is proven at this radius in [Hab25] and [BCGM26].

The line-MCA proximity-gap error uses [DKT26] Theorem 5.12 and Appendix B.1–B.2: a < 8·n·(m + 1/2)^3/(3·rho_minus) exceptional challenges, with rho_minus = (k - 1)/n. This finite-rate bound is the Johnson-regime improvement applied by this crate.

CapacityBound

Capacity bound at δ = 1 − ρ − η, with η = ρ / 20. Requires conjecturing capacity-rate list decodability and correlated agreement up to capacity.

Implementations

impl SecurityAssumption

pub const fn log_eta(&self, log_inv_rate: usize) -> f64

log₂(η), where η is the safety gap below the regime’s distance.

Panics

Undefined for SecurityAssumption::UniqueDecoding (UD uses δ = (1 − ρ)/2, no η term). Callers must branch on UD first; the panic locks down that invariant.

pub const fn log_eta_or_zero(&self, log_inv_rate: usize) -> f64

log₂(η), or 0. for Self::UniqueDecoding, where no eta term applies and every _at_log_eta formula ignores the value in its UD branch.

Public alongside the _at_log_eta family: a caller feeding those its own schedule of eta values still needs this convention to reproduce the fixed-eta entry points, and has no other way to spell “the regime’s default” for UniqueDecoding.

pub const fn list_size_bits_at_log_eta( &self, log_degree: usize, log_inv_rate: usize, log_eta: f64, ) -> f64

log₂(L⁺) for the regime’s list size at an explicit log_eta, rather than the regime’s own default safety margin (Self::log_eta).

A caller deriving its own schedule of eta values across a protocol (STIR’s per-round bisection, for instance) needs the list size at each of those working points, not just at the regime’s fixed default; Self::list_size_bits is the log_eta = self.log_eta(log_inv_rate) specialization of this.

pub const fn list_size_bits( &self, log_degree: usize, log_inv_rate: usize, ) -> f64

log₂(L⁺) for the regime’s list size at distance δ.

pub fn prox_gaps_error( &self, log_degree: usize, log_inv_rate: usize, field_size_bits: usize, num_functions: usize, ) -> f64

Proximity-gap error in bits for combining num_functions functions at the regime’s distance.

The Johnson-bound branch uses the DKT26 Theorem 5.12 line-MCA bound at the fixed safety choice m = max(ceil(sqrt(rho)/(2*eta)), 3) = 10 (η = √ρ/20, see Self::log_eta). The shared line-count helper implements 8·n·(m + 1/2)^3/(3·rho_minus) from Theorem 5.12 and Appendix B.1–B.2, with the finite rho_minus = (k - 1)/n. Use Self::prox_gaps_error_jb_at_m when the surrounding regime decodes at a different explicit m (e.g. FRI’s best_m) — the fixed m = 10 here is a WHIR-style default, not necessarily the m the caller’s list-decoding regime actually operates at.

Panics

Panics when num_functions < 2: this API bounds a nontrivial batching challenge. Callers must handle empty and singleton batches separately.

pub fn prox_gaps_error_at_log_eta( &self, log_degree: usize, log_inv_rate: usize, field_size_bits: usize, num_functions: usize, log_eta: f64, ) -> f64

Self::prox_gaps_error at an explicit log_eta, rather than the regime’s own default safety margin (Self::log_eta).

A caller deriving its own schedule of eta values across a protocol (STIR’s per-round bisection, for instance) needs the proximity-gap error at each of those working points, not just at the regime’s fixed default. On SecurityAssumption::JohnsonBound this derives the DKT26 proximity parameter m = max(ceil(√ρ / (2η)), 3) from log_eta and defers to Self::prox_gaps_error_jb_at_m — at log_eta = self.log_eta(log_inv_rate) that derivation reduces to exactly m = 10, Self::prox_gaps_error’s fixed safety choice.

Panics

Panics when num_functions < 2, as in Self::prox_gaps_error.

pub fn prox_gaps_error_jb_at_m( log_degree: usize, log_inv_rate: usize, field_size_bits: usize, num_functions: usize, m: usize, ) -> f64

Johnson-bound line-MCA error at an explicit proximity parameter m, rather than the fixed m = 10 safety choice Self::prox_gaps_error uses. DKT26 Theorem 5.12 and Appendix B.1–B.2 give the exceptional line count C = 8·n·(m + 1/2)^3/(3·rho_minus). The helper excludes the curve-degree factor, so a batch of num_functions words contributes one factor of num_functions - 1 here.

For use when the caller already knows the m the surrounding list-decoding regime decodes at (e.g. FRI’s best_m from crate::fri::best_ldr_m) and needs the batch-combination term evaluated at that same radius rather than the WHIR-style fixed safety margin.

Decoding-radius contract

The caller must use agreement at least alpha = (1 + 1/(2m)) * sqrt(k/n), where k = 2^log_degree. Writing rho_minus = (k - 1)/n, this gives eta0 = alpha - sqrt(rho_minus) >= sqrt(rho_minus)/(2m). Thus the theorem’s minimum max(3, ceil(sqrt(rho_minus)/(2*eta0))) is at most the supplied m >= 3; Appendix B.1’s interpolant remains valid, and the closed exceptional-count bound grows with m. Supplying a smaller m than the surrounding radius permits is unsound.

Unsupported m or inverse rate returns -∞ security bits through the shared helper. The batch-size precondition is checked separately.

Panics

Panics when num_functions < 2, as in Self::prox_gaps_error.

pub fn log_1_delta(&self, log_inv_rate: usize) -> f64

log₂(1 − δ) for the regime’s distance δ.

• UD: δ = (1 − ρ)/2
• JB: δ = 1 − √ρ − η
• CB: δ = 1 − ρ − η

pub fn queries( &self, protocol_security_level: usize, log_inv_rate: usize, ) -> usize

Number of queries needed for (1 − δ)^t < 2^{−λ}.

pub fn queries_error(&self, log_inv_rate: usize, num_queries: usize) -> f64

Bits of security from num_queries queries.

impl SecurityAssumption

pub fn initial_claims_error( &self, field_size_bits: usize, num_variables: usize, log_inv_rate: usize, num_claims: usize, ) -> f64

Initial claim-combination error in bits, before any folding or grinding.

Combining num_claims constraints with powers 1, alpha, ..., alpha^(N-1) can hide a false claim at at most N - 1 roots for each codeword in the initial decoding list. The bound is (N - 1) * L / |F|. The count must include both concrete openings and commitment-phase OOD claims. Zero or one claim introduces no random-combination error.

pub const fn ood_error_at_log_eta( &self, log_degree: usize, log_inv_rate: usize, field_size_bits: usize, ood_samples: usize, log_eta: f64, ) -> f64

Self::ood_error at an explicit log_eta, rather than the regime’s own default safety margin (Self::log_eta).

A caller deriving its own schedule of eta values across a protocol (STIR’s per-round bisection, for instance) needs the OOD error at each of those working points, not just at the regime’s fixed default.

pub const fn ood_error( &self, log_degree: usize, log_inv_rate: usize, field_size_bits: usize, ood_samples: usize, ) -> f64

OOD sampling error (in bits). See Lemma 4.5 in STIR: error = L⁺² · (degree / |F|)^reps. The domain size is discounted as negligible relative to |F|.

pub fn determine_ood_samples( &self, security_level: usize, log_degree: usize, log_inv_rate: usize, field_size_bits: usize, ) -> Option<usize>

Smallest number of OOD samples (from the extension field) needed for Self::ood_error to clear security_level bits.

Returns

• Some(0) for unique decoding, which uses no OOD samples.
• Some(n) for the smallest count reaching the security level.
• None when no count in range suffices, i.e. the field is too small.

pub const fn fold_sumcheck_error( &self, field_size_bits: usize, num_variables: usize, log_inv_rate: usize, ) -> f64

Sumcheck soundness term for the fold step (bits).

During folding, the verifier samples a random challenge and checks a degree-2 sumcheck identity. An adversary controlling a list of L codewords can bias the check with probability at most L / |F|:

bits = field_size_bits − (list_size_bits + 1)

The +1 is the union bound over the list.

pub const fn fold_sumcheck_error_at_log_eta( &self, field_size_bits: usize, num_variables: usize, log_inv_rate: usize, log_eta: f64, ) -> f64

Self::fold_sumcheck_error at an explicit log_eta, rather than the regime’s own default safety margin (Self::log_eta).

A caller deriving its own schedule of eta values across a protocol (STIR’s per-round bisection, for instance) needs the fold-sumcheck error at each of those working points, not just at the regime’s fixed default.

pub fn queries_combination_error( &self, field_size_bits: usize, num_variables: usize, log_inv_rate: usize, ood_samples: usize, num_queries: usize, ) -> f64

Query-combination soundness (bits). After STIR queries and OOD samples, the verifier takes a random linear combination of all evaluations; an adversary must fool this combination for every codeword in the list:

error = (ood_samples + num_queries) · L⁺ / |F|, bits = field_size_bits − (log₂(ood + queries) + list_size_bits + 1).

pub fn queries_combination_error_at_log_eta( &self, field_size_bits: usize, num_variables: usize, log_inv_rate: usize, ood_samples: usize, num_queries: usize, log_eta: f64, ) -> f64

Self::queries_combination_error at an explicit log_eta, rather than the regime’s own default safety margin (Self::log_eta).

A caller deriving its own schedule of eta values across a protocol (STIR’s per-round bisection, for instance) needs the query-combination error at each of those working points, not just at the regime’s fixed default.

pub fn folding_pow_bits( &self, security_level: usize, field_size_bits: usize, num_variables: usize, log_inv_rate: usize, ) -> f64

PoW bits needed at the fold step to bridge the weaker of the proximity-gap and fold-sumcheck bounds to security_level. Returns 0 when the algebraic bounds already meet the target.

Trait Implementations

impl Clone for SecurityAssumption

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for SecurityAssumption

impl Debug for SecurityAssumption

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for SecurityAssumption

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for SecurityAssumption

impl FromStr for SecurityAssumption

type Err = String

The associated error which can be returned from parsing.

fn from_str(s: &str) -> Result<Self, Self::Err>

Parses a string s to return a value of this type.

impl PartialEq for SecurityAssumption

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for SecurityAssumption

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for SecurityAssumption