Struct MergeProverChannel 

pub struct MergeProverChannel<'a, P, A, C>
where
    P: PackedField,
    A: Allocator,
    C: IOPProverChannel<P, A>,
{ /* private fields */ }

A prover channel decorator that merges one round’s oracles into one combined oracle.

Overview

An interaction round is the run of oracles sent between two challenge samples.

Committing each oracle separately costs one commitment per oracle. One Merkle tree per oracle, for example.

This decorator buffers a round’s oracles instead. It commits them together as one larger oracle. That cuts the cost to one commitment per round.

A round’s oracles are sorted from largest to smallest, then laid out end to end. That ordering makes every oracle’s position exact.

Every earlier oracle is at least as large as the current one. So their combined space is a whole multiple of the current oracle’s size.

A round of a single oracle needs no combining. It is forwarded unchanged, at zero cost.

A round is masked as a whole, never partly.

So a round carrying any witness data is masked in full by the underlying channel. The verifier-side decorator is where that choice is made.

Timing

A round’s oracles are committed the moment its last oracle arrives.

The OracleSchedule says where each round ends, so no challenge sample is needed to find the boundary. A real Fiat-Shamir transcript can therefore absorb the commitment before the next challenge.

The combined buffer is finalized on the underlying channel right after it is committed. So finalizing a constituent oracle here just drops the buffer handed back.

Opening

A verifier only ever holds a formula for a transparent polynomial.

This side holds the actual coefficients instead. A constituent’s own transparent polynomial becomes one for the combined oracle. It is the constituent’s values at the constituent’s own block, and zero everywhere else. This side forwards it to the underlying channel as a zero-padded structure, never writing the zeros.

That placement is the same polynomial a verifier reaches by formula. One side holds the block as explicit values. The other evaluates it on demand.

Implementations

impl<'a, P, A, C> MergeProverChannel<'a, P, A, C>

where P: PackedField, A: Allocator, C: IOPProverChannel<P, A>,

pub fn new(inner: C, schedule: &'a OracleSchedule, alloc: A) -> Self

Creates a new merging prover channel over an underlying channel.

Arguments

• inner — the channel every combined oracle is committed to, already configured with schedule.merged_specs().
• schedule — every oracle this channel’s caller will pass through, grouped into rounds.
• alloc — where this channel draws its combined buffers from.

Panics

Panics if inner is not configured with schedule.merged_specs().

pub fn into_inner(self) -> C

Returns the underlying channel.

Panics

Panics if any declared oracle has not yet been sent.

Trait Implementations

impl<'a, F, P, A, C> IOPProverChannel<P, A> for MergeProverChannel<'a, P, A, C>

where F: Field, P: PackedField<Scalar = F>, A: Allocator, C: IOPProverChannel<P, A>,

type Oracle = MergeOracle

fn remaining_oracle_specs(&self) -> &[OracleSpec]

Returns the specifications for the remaining oracles to be committed.

fn send_oracle(&mut self, buffer: FieldSlice<'_, P>) -> Self::Oracle

Commits an oracle to the verifier.

fn prove_oracle_relation( &mut self, oracle: Self::Oracle, transparent: StructuredBuffer<P, A::Vec<P>>, claim: P::Scalar, )

Generates an opening proof for one oracle linear relation.

fn finalize_oracle(&mut self, _oracle: Self::Oracle, _buffer: FieldVec<P, A>)

Gives ownership of the oracle buffer to the channel.

impl<F, P, A, C> IPProverChannel<F> for MergeProverChannel<'_, P, A, C>

where F: Field, P: PackedField<Scalar = F>, A: Allocator, C: IOPProverChannel<P, A>,

fn send_one(&mut self, elem: F)

Sends a single field element to the verifier.

fn send_many(&mut self, elems: &[F])

Sends multiple field elements to the verifier.

fn observe_one(&mut self, val: F)

Observes a single field element, feeding it into the Fiat-Shamir state.

fn observe_many(&mut self, vals: &[F])

Observes multiple field elements, feeding them into the Fiat-Shamir state.

fn sample(&mut self) -> F

Samples a random challenge.

fn send_public_claim(&mut self, elem: F)

Sends a value the verifier could compute for itself, as advice.

fn sample_many(&mut self, n: usize) -> Vec<F>

Samples n random challenges.

fn sample_array<const N: usize>(&mut self) -> [F; N]

Samples a fixed-size array of random challenges.

impl<F, P, A, C> WordIPProverChannel<F> for MergeProverChannel<'_, P, A, C>

where F: Field, P: PackedField<Scalar = F>, A: Allocator, C: IOPProverChannel<P, A> + WordIPProverChannel<F>,

type Word = <C as WordIPProverChannel<F>>::Word

The word type this channel carries.

fn observe_words(&mut self, words: &[Self::Word])

Feeds words into the Fiat-Shamir state, each as eight little-endian bytes.

fn sample_bits(&mut self, bits: usize) -> Self::Word

Samples a uniform word of the given bit width, matching what the verifier samples.