pub trait FiatShamirTranscript<SC>:
Clone
+ Send
+ Syncwhere
SC: StarkProtocolConfig,{
// Required methods
fn observe(&mut self, value: SC::F);
fn sample(&mut self) -> SC::F;
fn observe_commit(&mut self, digest: SC::Digest);
// Provided methods
fn observe_ext(&mut self, value: SC::EF) { ... }
fn sample_ext(&mut self) -> SC::EF { ... }
fn sample_bits(&mut self, bits: usize) -> u64 { ... }
fn check_witness(&mut self, bits: usize, witness: SC::F) -> bool { ... }
fn grind(&mut self, bits: usize) -> SC::F { ... }
}Expand description
Unified trait describing the interface for the Fiat-Shamir transcript needed by the SWIRL protocol.
Required Methods§
fn observe(&mut self, value: SC::F)
fn sample(&mut self) -> SC::F
Sourcefn observe_commit(&mut self, digest: SC::Digest)
fn observe_commit(&mut self, digest: SC::Digest)
Implementations should pass through to Self::observe, but no default implementation is
provided since an explicit conversion from Digest to array of F is required.
Provided Methods§
fn observe_ext(&mut self, value: SC::EF)
fn sample_ext(&mut self) -> SC::EF
Sourcefn sample_bits(&mut self, bits: usize) -> u64
fn sample_bits(&mut self, bits: usize) -> u64
Samples and returns an integer in the range [0, 2^bits).
§Sampling bias
The sampling is not uniform over [0, 2^bits); it works by sampling a random field element,
using its canonical embedding, and then reducing it mod 2^bits. Writing the field order as
p = c * 2^bits + r with 0 <= r < 2^bits, the r “heavy” residues 0..r each occur with
probability (c + 1) / p while the remaining 2^bits - r “light” residues occur with
probability c / p. Equivalently, residues 0..r are favored by a factor of (c + 1) / c.
Note residue 0 is always heavy.
For BabyBear, p - 1 = 2^27 * 15, so p ≡ 1 (mod 2^bits) and thus r = 1 for every
bits <= 27—exactly one heavy residue (the all-zero one).
Sourcefn check_witness(&mut self, bits: usize, witness: SC::F) -> bool
fn check_witness(&mut self, bits: usize, witness: SC::F) -> bool
Checks a proof-of-work witness: observes witness into the transcript and accepts iff the
next Self::sample_bits is zero (probability ≈ 2^{-bits} for a random witness, so
Self::grind tries ≈ 2^bits witnesses to find one).
The work is done with the transcript hash (the observe/sample_bits sponge permutation),
so bits counts hash evaluations; the attacker’s wall-clock cost is ≈ 2^bits · cost(H)
for that hash H. Soundness targets in bits are therefore comparable only across configs
that share a grinding hash.
Sourcefn grind(&mut self, bits: usize) -> SC::F
fn grind(&mut self, bits: usize) -> SC::F
Finds a proof-of-work witness w such that Self::check_witness(bits, w) holds, by
brute force over the base field.
Dyn Compatibility§
This trait is not dyn compatible.
In older versions of Rust, dyn compatibility was called "object safety".