binius_core/protocols/
mod.rs

1// Copyright 2023-2025 Irreducible Inc.
2
3//! Implementations of various virtual polynomial protocols.
4//!
5//! A virtual polynomial protocol is subprotocol of a polynomial IOP. See [DP23] Definition 4.7 for
6//! a formal definition. Each protocol has a prover-side implementation and a verifier-side
7//! implementation. These protocols are all public-coin and made non-interactive by the Fiat-Shamir
8//! transformation. Thus, the prover-side implementations all simulate a verifier in order to
9//! accurately construct the transcript.
10//!
11//! The protocol implementations have separate functions for each round. We model the virtual
12//! polynomial protocols this way because in many settings we want the ability to batch together
13//! multiple protocols at different rounds. For example, if we had one sumcheck claim for an
14//! $\nu$-variate polynomial and one sumcheck claim for a $\nu - 1$-variate polynomial, we would
15//! want to run one sumcheck round on the first claim, then batch the remaining rounds with the
16//! second claim.
17//!
18//! Each verifier round proceeds as
19//! 1) Receive the round message (ie. read it from the non-interactive proof)
20//! 2) Send the round message to the challenger
21//! 3) Sample challenge from the challenger
22//! 4) Verify the round message and reduce old claims, message, and challenge to new claims
23//!
24//! Each prover round proceeds as
25//! 1) (Simulate verifier's last round) Send last round message to the challenger
26//! 2) (Simulate verifier's last round) Sample challenge from the challenger
27//! 3) (Simulate verifier's last round) Reduce old claims, message, and challenge to new claims
28//! 4) Compute the round message
29//!
30//! [DP23]: https://eprint.iacr.org/2023/1784
31
32pub mod evalcheck;
33pub mod fri;
34pub mod gkr_exp;
35pub mod gkr_gpa;
36pub mod greedy_evalcheck;
37pub mod sumcheck;
38
39#[allow(dead_code)]
40#[doc(hidden)]
41pub mod test_utils;