Function prove_fri

Source
pub fn prove_fri<Folding, Val, Challenge, InputMmcs, FriMmcs, Challenger>(
    folding: &Folding,
    params: &FriParameters<FriMmcs>,
    inputs: Vec<Vec<Challenge>>,
    challenger: &mut Challenger,
    log_global_max_height: usize,
    prover_data_with_opening_points: &[ProverDataWithOpeningPoints<'_, Challenge, InputMmcs::ProverData<RowMajorMatrix<Val>>>],
    input_mmcs: &InputMmcs,
) -> FriProof<Challenge, FriMmcs, Challenger::Witness, Folding::InputProof>
where Val: TwoAdicField, Challenge: ExtensionField<Val>, InputMmcs: Mmcs<Val>, FriMmcs: Mmcs<Challenge>, Challenger: FieldChallenger<Val> + GrindingChallenger + CanObserve<FriMmcs::Commitment>, Folding: FriFoldingStrategy<Val, Challenge, InputProof = Vec<BatchOpening<Val, InputMmcs>>>,
Expand description

Create a proof that an opening f(zeta) is correct by proving that the function (f(x) - f(zeta))/(x - zeta) is low degree.

This further supports proving a batch of these claims for a collection of polynomials of shrinking degrees. Polynomials of equal degree can be combined using randomness before calling this function.

The Soundness error from prove_fri comes from the paper: Proximity Gaps for Reed-Solomon Codes (https://eprint.iacr.org/2020/654) and is either rate^{num_queries} or rate^{num_queries/2} depending on if you rely on conjectured or proven soundness. Particularly safety conscious users may want to set num_queries slightly higher than this to account for the fact that most implementations batch inputs using a single random challenge instead of one challenge for each polynomial and due to the birthday paradox, there is a non trivial chance that two queried indices will be equal.

Arguments:

  • folding: The FRI folding scheme to use.
  • params: The parameters for the specific FRI protocol instance.
  • inputs: The evaluation vectors of all polynomials we are applying FRI to. The function assumes that commitments to these vectors have been produced and observed by the challenger earlier in the protocol.
  • challenger: The Fiat-Shamir challenger to use for sampling challenges.
  • log_global_max_height: The log of the maximum height of the input matrices.
  • prover_data_with_opening_points: A list of pairs of a batch commitment to a collection of matrices and a list of points to open those matrices at.