Skip to main content

FiatShamirTranscript

Trait FiatShamirTranscript 

Source
pub trait FiatShamirTranscript<SC>:
    Clone
    + Send
    + Sync{
    // Required methods
    fn observe(&mut self, value: SC::F);
    fn sample(&mut self) -> SC::F;
    fn observe_commit(&mut self, digest: SC::Digest);

    // Provided methods
    fn observe_ext(&mut self, value: SC::EF) { ... }
    fn sample_ext(&mut self) -> SC::EF { ... }
    fn sample_bits(&mut self, bits: usize) -> u64 { ... }
    fn check_witness(&mut self, bits: usize, witness: SC::F) -> bool { ... }
    fn grind(&mut self, bits: usize) -> SC::F { ... }
}
Expand description

Unified trait describing the interface for the Fiat-Shamir transcript needed by the SWIRL protocol.

Required Methods§

Source

fn observe(&mut self, value: SC::F)

Source

fn sample(&mut self) -> SC::F

Source

fn observe_commit(&mut self, digest: SC::Digest)

Implementations should pass through to Self::observe, but no default implementation is provided since an explicit conversion from Digest to array of F is required.

Provided Methods§

Source

fn observe_ext(&mut self, value: SC::EF)

Source

fn sample_ext(&mut self) -> SC::EF

Source

fn sample_bits(&mut self, bits: usize) -> u64

Samples and returns an integer in the range [0, 2^bits).

§Sampling bias

The sampling is not uniform over [0, 2^bits); it works by sampling a random field element, using its canonical embedding, and then reducing it mod 2^bits. Writing the field order as p = c * 2^bits + r with 0 <= r < 2^bits, the r “heavy” residues 0..r each occur with probability (c + 1) / p while the remaining 2^bits - r “light” residues occur with probability c / p. Equivalently, residues 0..r are favored by a factor of (c + 1) / c. Note residue 0 is always heavy.

For BabyBear, p - 1 = 2^27 * 15, so p ≡ 1 (mod 2^bits) and thus r = 1 for every bits <= 27—exactly one heavy residue (the all-zero one).

Source

fn check_witness(&mut self, bits: usize, witness: SC::F) -> bool

Checks a proof-of-work witness: observes witness into the transcript and accepts iff the next Self::sample_bits is zero (probability ≈ 2^{-bits} for a random witness, so Self::grind tries ≈ 2^bits witnesses to find one).

The work is done with the transcript hash (the observe/sample_bits sponge permutation), so bits counts hash evaluations; the attacker’s wall-clock cost is ≈ 2^bits · cost(H) for that hash H. Soundness targets in bits are therefore comparable only across configs that share a grinding hash.

Source

fn grind(&mut self, bits: usize) -> SC::F

Finds a proof-of-work witness w such that Self::check_witness(bits, w) holds, by brute force over the base field.

Dyn Compatibility§

This trait is not dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors§

Source§

impl<SC, F, P, const WIDTH: usize, const RATE: usize> FiatShamirTranscript<SC> for DuplexSponge<F, P, WIDTH, RATE>
where F: PrimeField, SC: StarkProtocolConfig<Digest = [F; RATE], F = F>, P: CryptographicPermutation<[F; WIDTH]> + Send + Sync,

Source§

impl<SC, F, P, const WIDTH: usize, const RATE: usize> FiatShamirTranscript<SC> for DuplexSpongeRecorder<F, P, WIDTH, RATE>
where F: PrimeField, SC: StarkProtocolConfig<Digest = [F; RATE], F = F>, P: CryptographicPermutation<[F; WIDTH]> + Send + Sync,

Source§

impl<SC, F, P, const WIDTH: usize, const RATE: usize> FiatShamirTranscript<SC> for DuplexSpongeValidator<F, P, WIDTH, RATE>
where F: PrimeField, SC: StarkProtocolConfig<Digest = [F; RATE], F = F>, P: CryptographicPermutation<[F; WIDTH]> + Send + Sync,

Source§

impl<SC, F, const WIDTH: usize, const RATE: usize> FiatShamirTranscript<SC> for ReadOnlyTranscript<'_, F, [F; WIDTH]>
where F: PrimeField, SC: StarkProtocolConfig<F = F, Digest = [F; RATE]>,