Struct UnivariateRoundProver 

pub struct UnivariateRoundProver<F, Data>
where
    F: BinaryField,
{ /* private fields */ }

Prover for the univariate-skip round of the AND constraint reduction.

It computes the round message over the two operand columns, then folds the columns at the verifier’s challenge into the MLE-check summand.

See [binius_verifier::protocols::bitand] for the protocol specification.

The columns are generic over their backing store Data (anything that dereferences to [Word]), so callers can supply pooled buffers (PoolVec) or plain Vec<Word> interchangeably.

Implementations

impl<F, Data> UnivariateRoundProver<F, Data>

where F: BinaryField + From<Rijndael8b>, Data: Deref<Target = [Word]>,

pub fn compute_message( log_words: usize, first_col: Data, second_col: Data, big_field_zerocheck_challenges: Vec<F>, prover_message_domain: &BinarySubspace<B8>, ) -> Self

Computes the univariate-skip message over the two operand columns.

The message holds the evaluations of the univariate round polynomial R₀(Z), which encodes the AND constraint across the oblong dimension.

The C operand of the AND constraint A & B ^ C = 0 is not an input. The prover derives it word-by-word as A & B.

Why deriving C is sound

• A satisfying witness makes C = A & B hold on every row.
• Folding is F2-linear on word bits.
• Equal words therefore fold to equal field elements.
• So an honest prover emits the exact same transcript as with an explicit C column.
• A cheating witness is still rejected.
• The shift reduction later checks the claimed C evaluation against the committed witness.

Arguments

• log_words - Base-2 logarithm of the constraint axis’s length
• first_col - The oblong multilinear polynomial A in the AND constraint A & B ^ C = 0
• second_col - The oblong multilinear polynomial B in the AND constraint
• big_field_zerocheck_challenges - Challenges Z_{k+1},…,Zₙ in the large field F
• prover_message_domain - The domain for evaluating the univariate polynomial

The two columns must have equal length, at most 1 << log_words. A column shorter than the axis has its remaining rows read as zero, in both the round-1 message and the fold; the reduction skips them rather than working over them.

Implementation Details

This function:

1. Computes the equality indicator polynomial from the big field challenges
2. Uses the NTT lookup to efficiently compute the univariate polynomial evaluations
3. Caches these evaluations for later use in the round_message method

pub const fn round_message(&self) -> &[F; 64]

The message to send: R₀(Z) on the extension domain.

These are exactly ROWS_PER_HYPERCUBE_VERTEX field elements that represent R₀(Z) for Z in the upper half of the univariate domain. compute_message computes them; this method returns the cached result.

pub fn univariate_claim(&self, challenge: F) -> F

The univariate round polynomial at challenge: the claim the multilinear rounds prove.

The polynomial is zero on the base half of the domain, and the round message holds its evaluations on the upper half.

pub fn fold<'alloc, PChallenge: PackedField<Scalar = F>, A: Allocator>( self, alloc: &'alloc A, challenge: F, ) -> impl MleCheckProver<F> + 'alloc

Folds A, B and the derived C = A & B at the univariate challenge.

Returns the MLE-check summand over the ℓ_and constraint variables, at the zerocheck point. Fixing Z to challenge reduces the oblong multilinears to standard multilinears over the remaining variables, and the returned prover proves the sumcheck claim: R₀(z) = ∑_{X₀,…,Xₙ₋₁ ∈ {0,1}} (A(z,X₀,…,Xₙ₋₁)·B(z,X₀,…,Xₙ₋₁) - C(z,X₀,…,Xₙ₋₁))·eq(X₀,…,Xₙ₋₁; r₀,…,rₙ₋₁)

The folded columns are allocated in alloc, which the returned prover borrows.

Process

1. Creates a fold lookup table over the univariate domain of the round message
2. Folds A, B, and the derived C = A & B at Z = challenge, in one fused pass
3. Combines the zerocheck challenges (small field + big field)
4. Evaluates the univariate polynomial at the challenge to get the sumcheck claim
5. Constructs the AND reduction sumcheck prover with the folded multilinears