Ring-Switching Core Interaction Phase #
This module implements the core interactive sumcheck phase of the ring-switching protocol.
Iterated Sumcheck Steps #
- P and V execute the following loop:
for
i ∈ {0, ..., ℓ'-1}do P sends V the polynomialhᵢ(X) := Σ_{w ∈ {0,1}^{ℓ'-i-1}} h(r'₀, ..., r'_{i-1}, X, w₀, ..., w_{ℓ'-i-2}). V requiressᵢ ?= hᵢ(0) + hᵢ(1). V samplesr'ᵢ ← L, setss_{i+1} := hᵢ(r'ᵢ), and sends Pr'ᵢ.
Each iteration of the loop constitutes a single round:
- Round i (for i = 1, ..., ℓ'):
- Prover sends sumcheck polynomial h_i(X) over large field L
- Verifier samples challenge α_i ∈ L
- Prover & verifier updates state based on challenge
This is the core computational phase with ℓ' rounds, each with 2 messages, and is the main source of RBR knowledge soundness error.
Final Sumcheck Step #
Pcomputess' := t'(r'_0, ..., r'_{ℓ'-1})and sendsVs'.Vsetse := eq̃(φ₀(r_κ), ..., φ₀(r_{ℓ-1}), φ₁(r'_0), ..., φ₁(r'_{ℓ'-1}))and decomposese =: Σ_{u ∈ {0,1}^κ} β_u ⊗ e_u.Vrequiress_{ℓ'} ?= (Σ_{u ∈ {0,1}^κ} eq̃(u_0, ..., u_{κ-1}, r''_0, ..., r''_{κ-1}) ⋅ e_u) ⋅ s'.
Per-round prover / verifier (re-exported from Sumcheck.Structured.SingleRound) #
The per-round protocol code was lifted to ArkLib.ProofSystem.Sumcheck.Structured.SingleRound
as round{PrvState, OracleProver, OracleVerifier, OracleReduction},
getRoundProverFinalOutput, and roundKnowledgeError, parameterized over a generic
Context : Type and OStmtIn : ιₛᵢ → Type.
For backwards compatibility, the wrappers below preserve the original autobound signature
(via the surrounding variable block — κ L K ℓ ℓ' aOStmtIn) by specializing
Context := RingSwitchingBaseContext κ L K ℓ and OStmtIn := aOStmtIn.OStmtIn. They keep
the iteratedSumcheck* names (these are what the sumcheck loop iterates over) and are
@[reducible] so that subsequent soundness proofs and the seqCompose loop can still
access fields like .KnowledgeStateFunction / .rbrKnowledgeSoundness through them.
Instances For
Instances For
Instances For
Instances For
Instances For
Instances For
This follows the KState of foldKStateProp
Instances For
Knowledge state function (KState) for single round
Instances For
RBR knowledge soundness for a single round oracle verifier
Final Sumcheck Step #
The prover for the final sumcheck step
Instances For
The verifier for the final sumcheck step
Instances For
The oracle reduction for the final sumcheck step
Instances For
Perfect completeness for the final sumcheck step
RBR knowledge error for the final sumcheck step
Instances For
The round-by-round extractor for the final sumcheck step
Instances For
Instances For
The knowledge state function for the final sumcheck step
Instances For
Round-by-round knowledge soundness for the final sumcheck step
Composed oracle verifier for the SumcheckStep (seqCompose over ℓ')
Instances For
Composed oracle reduction for the SumcheckStep (seqCompose over ℓ')
Instances For
Large-field reduction verifier: Sumcheck seqCompose, then append FinalSum
Instances For
Large-field reduction: Sumcheck seqCompose, then append FinalSum
Instances For
RBR Knowledge Soundness Components for Single Round #
Perfect completeness for large-field reduction (Sumcheck ++ FinalSum)
RBR knowledge error for a degree-d sumcheck loop, obtained from the seqCompose
challenge-index decomposition.
Instances For
Instances For
RBR knowledge error for the core interaction with a degree-d sumcheck loop. The loop
contributes d / |L| per sumcheck challenge; the final sumcheck contributes 1 / |L|.
Instances For
Standard Binius ring-switching RBR knowledge error (d = 2) with exact final-step splitting.
Instances For
RBR knowledge soundness for large-field reduction (Sumcheck ++ FinalSum)