Struct ZKWrappedProverChannel 

pub struct ZKWrappedProverChannel<'a, P, NTT, Channel, ReplayFn, A>
where
    P: PackedField<Scalar: BinaryField>,
    NTT: AdditiveNTT<Field = P::Scalar> + Sync,
    Channel: MerkleIPProverChannel<P::Scalar>,
    A: Allocator,
{ /* private fields */ }

A prover channel that wraps a BaseFoldProverChannel and an outer Spartan IOP prover.

This channel records all channel values. On send_*/sample/observe_*, it delegates to the inner BaseFold channel and records each value. After the inner proof is run through this channel, call finish to replay the interaction, fill the outer witness, and generate the outer proof.

The ReplayFn closure is called during finish with a ReplayChannel to replay the inner verification and fill the outer witness. This allows the channel to be generic over different inner verification protocols.

Implementations

impl<'a, F, P, NTT, Channel, ReplayFn, A> ZKWrappedProverChannel<'a, P, NTT, Channel, ReplayFn, A>

where F: BinaryField, P: PackedField<Scalar = F>, NTT: AdditiveNTT<Field = F> + Sync, Channel: MerkleIPProverChannel<F>, A: Allocator,

pub fn new( inner_channel: BaseFoldProverChannel<'a, F, P, NTT, Channel, A>, outer_prover: &'a IOPProver<F>, outer_layout: Arc<WitnessLayout<F>>, alloc: &'a A, rng: impl CryptoRng, replay_fn: ReplayFn, ) -> Self

Creates a new ZK-wrapped prover channel.

Commits the outer prover’s precommit oracle on the inner channel as part of construction: a random FieldBuffer<P> the size of the outer precommit oracle segment is sent to the channel and kept for use in Self::finish. This random buffer is the one-time-pad encryption key for the (future) outer encrypted transcript.

The inner channel’s oracle specs are expected to be laid out as [outer_precommit, inner..., outer_private, outer_mask].

Arguments

• inner_channel - The BaseFold ZK channel with oracle specs for both inner and outer proofs
• outer_prover - The IOP prover for the outer (wrapper) constraint system
• outer_layout - The witness layout for the outer constraint system
• alloc - Allocator for the outer proof’s working buffers, borrowed from the owning prover
• rng - RNG used to generate the random precommit buffer (the future OTP key)
• replay_fn - Closure called during finish with a ReplayChannel to replay the inner verification and fill the outer witness

pub fn finish(self, rng: impl CryptoRng) -> Result<(), Error>

where ReplayFn: FnOnce(&mut ReplayChannel<F>),

Consumes the channel and runs the outer proof.

This should be called after the inner proof has been run through this channel. It:

1. Creates a ReplayChannel from the recorded interaction
2. Calls the replay_fn closure to replay the inner verification and fill the outer witness
3. Validates and generates the outer IOP proof

Trait Implementations

impl<F, P, NTT, Channel, ReplayFn, A> IOPProverChannel<P, A> for ZKWrappedProverChannel<'_, P, NTT, Channel, ReplayFn, A>

where F: BinaryField, P: PackedField<Scalar = F>, NTT: AdditiveNTT<Field = F> + Sync, Channel: MerkleIPProverChannel<F>, A: Allocator,

type Oracle = BaseFoldOracle

fn remaining_oracle_specs(&self) -> &[OracleSpec]

Returns the specifications for the remaining oracles to be committed.

fn send_oracle(&mut self, buffer: FieldSlice<'_, P>) -> Self::Oracle

Commits an oracle to the verifier.

fn prove_oracle_relation( &mut self, oracle: Self::Oracle, transparent: StructuredBuffer<P, A::Vec<P>>, claim: P::Scalar, )

Generates an opening proof for one oracle linear relation.

fn finalize_oracle(&mut self, oracle: Self::Oracle, buffer: FieldVec<P, A>)

Gives ownership of the oracle buffer to the channel.

impl<F, P, NTT, Channel, ReplayFn, A> IPProverChannel<F> for ZKWrappedProverChannel<'_, P, NTT, Channel, ReplayFn, A>

where F: BinaryField, P: PackedField<Scalar = F>, NTT: AdditiveNTT<Field = F> + Sync, Channel: MerkleIPProverChannel<F>, A: Allocator,

fn send_one(&mut self, elem: F)

Sends a single field element to the verifier.

fn send_public_claim(&mut self, elem: F)

Sends a value the verifier could compute for itself, as advice.

fn observe_one(&mut self, val: F)

Observes a single field element, feeding it into the Fiat-Shamir state.

fn sample(&mut self) -> F

Samples a random challenge.

fn send_many(&mut self, elems: &[F])

Sends multiple field elements to the verifier.

fn observe_many(&mut self, vals: &[F])

Observes multiple field elements, feeding them into the Fiat-Shamir state.

fn sample_many(&mut self, n: usize) -> Vec<F>

Samples n random challenges.

fn sample_array<const N: usize>(&mut self) -> [F; N]

Samples a fixed-size array of random challenges.

impl<F, P, NTT, Channel, ReplayFn, A> WordIPProverChannel<F> for ZKWrappedProverChannel<'_, P, NTT, Channel, ReplayFn, A>

where F: BinaryField, P: PackedField<Scalar = F>, NTT: AdditiveNTT<Field = F> + Sync, Channel: MerkleIPProverChannel<F>, A: Allocator,

type Word = <Channel as WordIPProverChannel<F>>::Word

The word type this channel carries.

fn observe_words(&mut self, words: &[Self::Word])

Feeds words into the Fiat-Shamir state, each as eight little-endian bytes.

fn sample_bits(&mut self, bits: usize) -> Self::Word

Samples a uniform word of the given bit width, matching what the verifier samples.