Expand description
Additive-domain binary PCS soundness over a binary tower field.
Only unique decoding is supported. Write K for the field every challenge is drawn from.
Each independent binary fold at word length N is charged twice over. It costs (N + 1)/|K| for proximity and 2/|K| for its quadratic sumcheck.
Virtual folds between Merkle commitments are charged too. Full-coset authentication lifts agreement through each one.
See Appendix A, Theorem 8 of https://eprint.iacr.org/2024/1553. Opening k evaluations with powers of one alpha adds (k - 1)/|K|, and all errors are summed.
The sole grind precedes query sampling, after alpha and every fold challenge. It buys back only query error. An alpha grind would require a different transcript and model. Hash/transcript collision security is supplied separately by the caller.
The committed columns may live in a narrower subfield than K. Choosing one moves no term here, because a challenge is always an element of K.
Structs§
- Binary
PcsRegime - Validated mirror of the binary PCS schedule. Constructed by the protocol crate.
Constants§
- BINARY_
PCS_ FIELD_ BITS - Widest challenge alphabet the binary tower offers.
- BINARY_
PCS_ OPENING_ LABEL - Label the additive-domain opening error is reported under.