p3_security/
lib.rs

1//! Soundness analysis for STARK protocols.
2//!
3//! Decomposition is by error source, not by commitment scheme.
4//!
5//! A protocol's parameter type lives in its own crate.
6//!
7//! This crate supplies the error-bit math and the regime mirrors.
8//!
9//! The protocol assembles the regime and picks which error terms apply.
10//!
11//! It then composes them by union bound with [`ErrorBits::sum`], or by minimum with [`ErrorBits::min`].
12//!
13//! The AIR, DEEP and low-degree-test composite goes through [`stark::proven_security`].
14//!
15//! # Layering
16//!
17//! ```text
18//! protocol crate (p3-fri, p3-whir, …)
19//!         │
20//!         ▼
21//!     p3-security ── p3-air, p3-field, p3-util, libm
22//! ```
23//!
24//! Each regime mirrors the security-relevant subset of a runtime configuration.
25//!
26//! It also carries instance-shape metadata the runtime configuration does not hold.
27//!
28//! Trace length and opening counts are the usual examples.
29//!
30//! No conversion from the runtime configuration exists, and that is deliberate.
31//!
32//! Only the protocol crate can see both sides, so it assembles the regime explicitly.
33//!
34//! # References
35//! - ethSTARK ([2021/582](https://eprint.iacr.org/2021/582))
36//! - Proximity Gaps for Reed–Solomon Codes ([2020/654](https://eprint.iacr.org/2020/654))
37//! - On the Security of STARKs with FRI ([2024/1553](https://eprint.iacr.org/2024/1553))
38//! - On the Distribution of the Distances of Random Words ([2025/2010](https://eprint.iacr.org/2025/2010))
39//! - BCHKS25 — Improved LDR proximity gaps ([2025/2055](https://eprint.iacr.org/2025/2055))
40//! - DKT26 — Johnson-regime line MCA (Theorem 5.12, Appendix B.1–B.2)
41//!   ([2026/2056](https://eprint.iacr.org/2026/2056))
42//! - HVZK-WHIR ([2026/391](https://eprint.iacr.org/2026/391))
43
44#![no_std]
45#![allow(clippy::too_many_arguments)]
46
47extern crate alloc;
48
49pub mod assumption;
50pub mod budget;
51pub mod error;
52pub mod fixed;
53pub mod proximity;
54pub mod report;
55pub mod shape;
56
57pub mod air;
58pub mod deep;
59pub mod grinding;
60pub mod logup;
61pub mod multilinear;
62
63pub mod ldt;
64
65pub mod binary;
66pub mod bus;
67pub mod fri;
68pub mod whir;
69pub mod word;
70
71pub mod stark;
72
73pub use assumption::SecurityAssumption;
74pub use error::ErrorBits;
75pub use grinding::GrindingSites;
76pub use ldt::LowDegreeTest;
77pub use multilinear::{
78    BIT_RING_SWITCH_CLAIM_BATCHING_LABEL, BIT_RING_SWITCH_LABEL, COLUMN_BATCH_LABEL,
79    bit_ring_switch_claim_batching_error, bit_ring_switch_claim_batching_term,
80    bit_ring_switch_error, bit_ring_switch_tensors_error, bit_ring_switch_tensors_term,
81    bit_ring_switch_term, column_batch_error, column_batch_term,
82};
83pub use report::{CandidateSet, Regime, RegimeReport, SecurityReport, SecurityTerm};
84pub use shape::{InstanceShape, StarkAirParams};
p3_security/lib.rs

p3_security/
lib.rs
