Struct ProverTranscript 

pub struct ProverTranscript<Challenger> { /* private fields */ }

Prover transcript over some Challenger that writes to the internal tape and CanSample<F: Field>

A Transcript is an abstraction over Fiat-Shamir so the prover and verifier can send and receive data.

Implementations

impl<Challenger_: Challenger> ProverTranscript<Challenger_>

pub fn new(challenger: Challenger_) -> Self

Creates a new prover transcript.

By default debug assertions are set to the feature flag debug_assertions.

pub fn with_opts(challenger: Challenger_, options: Options) -> Self

pub fn finalize(self) -> Vec<u8>

pub fn observe<'a, 'b>(&'a mut self) -> TranscriptWriter<'b, impl BufMut + 'b>

where 'a: 'b,

Returns a writable buffer that only observes the data written, without writing it to the proof tape.

This method should be used to observe the input statement.

pub fn decommitment(&mut self) -> TranscriptWriter<'_, impl BufMut>

Returns a writable buffer that only writes the data to the proof tape, without observing it.

This method should only be used to write openings of commitments that were already written to the transcript as an observed message. For example, in the FRI protocol, the prover sends a Merkle tree root as a commitment, and later sends leaf openings. The leaf openings should be written using Self::decommitment because they are verified with respect to the previously sent Merkle root.

pub fn message<'a, 'b>(&'a mut self) -> TranscriptWriter<'b, impl BufMut>

where 'a: 'b,

Returns a writable buffer that observes the data written and writes it to the proof tape.

This method should be used by default to write prover messages in an interactive protocol.

pub fn grind(&mut self, bits: usize) -> u64

where Challenger_: Clone,

Grinds a proof of work into the transcript, returning the nonce it found.

Searches for a nonce whose observation drives the next bits sampled bits to zero. The nonce goes out as a message, and those bits are then sampled so the challenger advances. VerifierTranscript::verify_grind is the matching check.

A prover that wants to re-roll whatever challenge comes next must redo this search first. Every term derived from that challenge therefore gains bits of soundness. That is how a protocol buys back a term no query count can touch.

The search is the obvious one: try nonces in order until one lands. A trial is one challenger observation plus one sample, and lands with probability 2^-bits. The expected cost is therefore 2^bits trials. The search is serial, so a caller pays that in wall clock.

Preconditions

• bits must be at most 32, which is the width the sampler masks to.

impl<Challenger_: Default + Challenger> ProverTranscript<Challenger_>

pub fn into_verifier(self) -> VerifierTranscript<Challenger_>

Trait Implementations

impl<F, Challenger_> CanSample<F> for ProverTranscript<Challenger_>

where F: Field, Challenger_: Challenger,

fn sample(&mut self) -> F

fn sample_array<const N: usize>(&mut self) -> [T; N]

fn sample_vec(&mut self, n: usize) -> Vec<T>

impl<Challenger_> CanSampleBits<u32> for ProverTranscript<Challenger_>

where Challenger_: Challenger,

fn sample_bits(&mut self, bits: usize) -> u32

impl<Challenger: Clone> Clone for ProverTranscript<Challenger>

fn clone(&self) -> ProverTranscript<Challenger>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<Challenger: Debug> Debug for ProverTranscript<Challenger>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<Challenger_: Default + Challenger> Default for ProverTranscript<Challenger_>

fn default() -> Self

Returns the “default value” for a type.