Struct IntMulProver 

pub struct IntMulProver<'a, 'alloc, A: Allocator, P, Channel> { /* private fields */ }

A helper structure that encapsulates switchover settings and the prover channel for the integer multiplication protocol.

Implementations

impl<'a, 'alloc, A: Allocator, P, Channel> IntMulProver<'a, 'alloc, A, P, Channel>

pub const fn new( switchover: usize, channel: &'a mut Channel, alloc: &'alloc A, ) -> Self

impl<'alloc, A, F, P, Channel> IntMulProver<'_, 'alloc, A, P, Channel>

where A: Allocator, F: BinaryField<Underlier: Divisible<u64>>, P: PackedField<Scalar = F>, Channel: IOPProverChannel<P, A>,

pub fn prove(&mut self, witness: Witness<'_, 'alloc, A, P>) -> IntMulOutput<F>

Prove an integer multiplication statement.

This method consumes a Witness in order to reduce integer multiplication statement to evaluation claims on 1-bit multilinears. More formally:

• witness contains po2-sized integer arrays a, b, c_lo and c_hi that satisfy a * b = c_lo | c_hi << Word::BITS, as well as the layers of the constant- and variable-base GKR product check circuits
• The proving consists of five phases:
  • Phase 1: GKR tree roots for B & C are evaluated at a sampled point, after which reductions are performed to obtain evaluation claims on $(b * (G^{a_i} - 1) + 1)^{2^i}$
  • Phase 2: Frobenius twist is applied to obtain claims on $b * (G^{a_i} - 1) + 1$
  • Phase 3: Two batched sumchecks:
    • Selector mlecheck to reduce claims on $b * (G^{a_i} - 1) + 1$ to claims on $G^{a_i}$ and $b$, then recombine the $2^k$ per-bit b claims into one via a sampled $r_I^b$
    • First layer of GPA reduction for the c_lo || c_hi combined c tree
  • Phase 4: Batched product check over the three depth-LOG_N_LIMBS constant-base trees (a, c_lo, c_hi), reducing the roots to per-limb evaluation claims
  • Phase 5: The per-limb claims are Frobenius-twisted onto the shared power table i ↦ G^i and read from it via a committed logup* lookup; a final batched sumcheck brings the reduced index claim, a single-claim rerandomization (MLE-eval) of the recombined b exponent claim from phase 3, and the overflow parity zerocheck to one shared point

The output of this protocol is a set of evaluation claims on the b selectors representing all of a, b, c_lo and c_hi as column-major bit matrices, at a common evaluation point. The logup* pushforward commitment carries its two relations into the channel inside phase 5.