Struct RoundProof 

pub struct RoundProof<F>(pub RoundCoeffs<F>);

An MLE-check round proof is a univariate polynomial in monomial basis with the coefficient of the lowest-degree term truncated off.

Since the verifier knows the claimed linear extrapolation of the polynomial values at the points 0 and 1, the low-degree term coefficient can be easily recovered. Truncating the coefficient off saves a small amount of proof data.

This is an analogous struct to sumcheck::RoundProof, except that we truncate the low-degree coefficient instead of the high-degree coefficient.

In a sumcheck protocol, the verifier has a claimed sum $s$ and the round polynomial $R(X)$ must satisfy $R(0) + R(1) = s$. In an MLE-check protocol, the verifier has a claimed coordinate $\alpha$ and extrapolated value $s$ and the round polynomial must satisfy $(1 - \alpha) R(0) + \alpha R(1) = s$. This difference changes the recovery procedure and which polynomial coefficient is most convenient to truncate.

Tuple Fields

0: RoundCoeffs<F>

Implementations

impl<F> RoundProof<F>

pub fn truncate(coeffs: RoundCoeffs<F>) -> Self

Truncates the polynomial coefficients to a round proof.

Removes the first coefficient. See the struct documentation for more info.

Pre-conditions

• coeffs must not be empty

pub fn recover(self, eval: F, alpha: F) -> RoundCoeffs<F>

where F: FieldOps,

Recovers all univariate polynomial coefficients from the compressed round proof.

The prover has sent coefficients for the purported $i$’th round polynomial $R(X) = \sum_{j=0}^d a_j * X^j$.

However, the prover has not sent the lowest degree coefficient $a_0$. The verifier will need to recover this missing coefficient.

Let $s$ denote the current round’s claimed sum and $\alpha_i$ be the $i$’th coordinate of the evaluation point.

The verifier expects the round polynomial $R_i$ to satisfy the identity $s = (1 - \alpha) R(0) + \alpha R(1)$, or equivalently, $s = R(0) + (R(1) - R(0)) \alpha$.

Using $R(0) = a_0$ $R(1) = \sum_{j=0}^d a_j$ There is a unique $a_0$ that allows $R$ to satisfy the above identity. Specifically, $a_0 = s - \alpha \sum_{j=1}^d a_j$.

pub fn coeffs(&self) -> &[F]

The truncated polynomial coefficients.

Trait Implementations

impl<F: Clone> Clone for RoundProof<F>

fn clone(&self) -> RoundProof<F>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<F: Debug> Debug for RoundProof<F>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<F: Default> Default for RoundProof<F>

fn default() -> RoundProof<F>

Returns the “default value” for a type.

impl<F: Eq> Eq for RoundProof<F>

impl<F: PartialEq> PartialEq for RoundProof<F>

fn eq(&self, other: &RoundProof<F>) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl<F: PartialEq> StructuralPartialEq for RoundProof<F>