Crate p3_security 

Soundness analysis for STARK protocols.

Decomposition is by error source, not by commitment scheme.

A protocol’s parameter type lives in its own crate.

This crate supplies the error-bit math and the regime mirrors.

The protocol assembles the regime and picks which error terms apply.

It then composes them by union bound with ErrorBits::sum, or by minimum with ErrorBits::min.

The AIR, DEEP and low-degree-test composite goes through stark::proven_security.

Layering

protocol crate (p3-fri, p3-whir, …)
        │
        ▼
    p3-security ── p3-air, p3-field, p3-util, libm

Each regime mirrors the security-relevant subset of a runtime configuration.

It also carries instance-shape metadata the runtime configuration does not hold.

Trace length and opening counts are the usual examples.

No conversion from the runtime configuration exists, and that is deliberate.

Only the protocol crate can see both sides, so it assembles the regime explicitly.

References

• ethSTARK (2021/582)
• Proximity Gaps for Reed–Solomon Codes (2020/654)
• On the Security of STARKs with FRI (2024/1553)
• On the Distribution of the Distances of Random Words (2025/2010)
• BCHKS25 — Improved LDR proximity gaps (2025/2055)
• DKT26 — Johnson-regime line MCA (Theorem 5.12, Appendix B.1–B.2) (2026/2056)
• HVZK-WHIR (2026/391)

Re-exports

pub use assumption::SecurityAssumption;

pub use error::ErrorBits;

pub use grinding::GrindingSites;

pub use ldt::LowDegreeTest;

pub use multilinear::BIT_RING_SWITCH_CLAIM_BATCHING_LABEL;

pub use multilinear::BIT_RING_SWITCH_LABEL;

pub use multilinear::COLUMN_BATCH_LABEL;

pub use multilinear::bit_ring_switch_claim_batching_error;

pub use multilinear::bit_ring_switch_claim_batching_term;

pub use multilinear::bit_ring_switch_error;

pub use multilinear::bit_ring_switch_tensors_error;

pub use multilinear::bit_ring_switch_tensors_term;

pub use multilinear::bit_ring_switch_term;

pub use multilinear::column_batch_error;

pub use multilinear::column_batch_term;

pub use report::CandidateSet;

pub use report::Regime;

pub use report::RegimeReport;

pub use report::SecurityReport;

pub use report::SecurityTerm;

pub use shape::InstanceShape;

pub use shape::StarkAirParams;

Modules

air

AIR composition error: ε_ALI = L⁺ · num_constraints / |F|.

assumption

Security assumption (regime selector) and the Reed–Solomon proximity-gap primitives that any RS-IOP can share.

binary

Additive-domain binary PCS soundness over a binary tower field.

budget

Conjectured round budget for a lifted (multi-AIR) STARK protocol, in fixed point.

bus

Soundness terms for a binary-native multiset bus.

deep

DEEP-ALI out-of-domain sampling error.

error

Uniform currency for soundness error contributions.

fixed

Deterministic integer analog of this crate’s floating-point error-bit arithmetic.

fri

FRI low-degree-test soundness.

grinding

Grinding (proof-of-work) bits — additive contribution to security.

ldt

Typed low-degree-test boundary.

logup

LogUp (logarithmic-derivative lookup) argument soundness.

multilinear

Algebraic error sources in the multilinear AIR reduction.

proximity

Proximity-gap and list-size helpers shared across low-degree-test modules.

report

Labeled soundness breakdown produced by the composite orchestration.

shape

Protocol-instance shape: data orthogonal to the runtime config.

stark

Composite STARK soundness: AIR composition + DEEP-ALI + LDT, evaluated once per proximity regime (UDR and best-m LDR). Generic over the LDT via plain function arguments — fri.rs, whir.rs, and downstream drop-in LDTs all compose with the same orchestrator.

whir

WHIR / STIR-style composition: error terms specific to RS-IOPs that combine sumcheck-based folding with random-linear-combination queries.

word

Soundness terms for the word-level relation proof.