Struct SRS 

pub struct SRS<G> {
    pub g: Vec<G>,
    pub h: G,
    pub lagrange_bases: HashMapCache<usize, Vec<PolyComm<G>>>,
}

Fields

g: Vec<G>

The vector of group elements for committing to polynomials in coefficient form.

h: G

A group element used for blinding commitments

lagrange_bases: HashMapCache<usize, Vec<PolyComm<G>>>

Commitments to Lagrange bases, per domain size

Implementations

impl<G: CommitmentCurve> SRS<G>

Additional methods for the SRS structure

pub fn verify<EFqSponge, RNG, const FULL_ROUNDS: usize>( &self, group_map: &G::Map, batch: &mut [BatchEvaluationProof<'_, G, EFqSponge, OpeningProof<G, FULL_ROUNDS>, FULL_ROUNDS>], rng: &mut RNG, ) -> bool

where EFqSponge: FqSponge<G::BaseField, G, G::ScalarField, FULL_ROUNDS>, RNG: RngCore + CryptoRng, G::BaseField: PrimeField,

Verifies a batch of polynomial commitment opening proofs.

This IPA verification method is primarily designed for integration into recursive proof systems like Pickles. In recursive proofs, IPA verification is deferred by storing accumulators (RecursionChallenge) rather than verifying immediately in-circuit. This method performs the final out-of-circuit verification of those accumulators.

The function reconstructs the challenge polynomial b(X) from the IPA challenges and uses it to verify the opening proofs. The challenge polynomial is defined as:

b(X) = prod_{i=0}^{k-1} (1 + u_{k-i} * X^{2^i})

where u_1, ..., u_k are the challenges from the k rounds of the IPA protocol. See Section 3.2 of the Halo paper.

The verification reconstructs b(X) in two forms:

• Evaluation form: b_poly(&chal, x) computes b(x) in O(k) operations
• Coefficient form: b_poly_coefficients(&chal) returns the 2^k coefficients for the MSM <s, G> that verifies the accumulated commitment

Note: The challenge polynomial reconstruction is specifically needed for recursive proof verification. For standalone (non-recursive) IPA verification, a simpler approach without b(X) reconstruction could be used.

Panics

Panics if the number of scalars does not match the number of points.

Returns true if verification succeeds, false otherwise.

pub fn create_trusted_setup_with_toxic_waste( x: G::ScalarField, depth: usize, ) -> Self

This function creates a trusted-setup SRS instance for circuits with number of rows up to depth.

Security

The internal accumulator x_pow is zeroized before returning. The caller must ensure that x is securely zeroized after use. Leaking x compromises the soundness of the proof system.

impl<G: CommitmentCurve> SRS<G>

where <G as CommitmentCurve>::Map: Sync, G::BaseField: PrimeField,

pub fn create_parallel(depth: usize) -> Self

This function creates SRS instance for circuits with number of rows up to depth.

Panics

Panics if depth exceeds u32::MAX.

impl<G: CommitmentCurve> SRS<G>

pub fn open<EFqSponge, RNG, D: EvaluationDomain<G::ScalarField>, const FULL_ROUNDS: usize>( &self, group_map: &G::Map, plnms: &'_ [(DensePolynomialOrEvaluations<'_, G::ScalarField, D>, PolyComm<G::ScalarField>)], elm: &[G::ScalarField], polyscale: G::ScalarField, evalscale: G::ScalarField, sponge: EFqSponge, rng: &mut RNG, ) -> OpeningProof<G, FULL_ROUNDS>

where EFqSponge: Clone + FqSponge<G::BaseField, G, G::ScalarField, FULL_ROUNDS>, RNG: RngCore + CryptoRng, G::BaseField: PrimeField, G: EndoCurve,

Creates an opening proof for a batch of polynomial commitments.

This function implements the IPA (Inner Product Argument) prover. During the k = log_2(n) rounds of folding, it implicitly constructs the challenge polynomial b(X).

Note: The use of the challenge polynomial b(X) is a modification to the original IPA protocol that improves efficiency in recursive proof settings. The challenge polynomial is inspired from the “Amoritization strategy”“ from Recursive Proof Composition without a Trusted Setup, section 3.2.

Panics

Panics if IPA folding does not produce single elements after log rounds, or if the challenge inverse cannot be computed.

fn lagrange_basis(&self, domain: D<G::ScalarField>) -> Vec<PolyComm<G>>

Trait Implementations

impl<G: Clone> Clone for SRS<G>

fn clone(&self) -> SRS<G>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<G: Debug> Debug for SRS<G>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<G: Default> Default for SRS<G>

fn default() -> SRS<G>

Returns the “default value” for a type.

impl<'de, G> Deserialize<'de> for SRS<G>

where G: CanonicalDeserialize + CanonicalSerialize,

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl<G: Clone> From<SRS<G>> for TestSRS<G>

fn from(value: SRS<G>) -> Self

Converts to this type from the input type.

impl<G> From<TestSRS<G>> for SRS<G>

fn from(value: TestSRS<G>) -> Self

Converts to this type from the input type.

impl<G> PartialEq for SRS<G>

where G: PartialEq,

fn eq(&self, other: &Self) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl<G> SRS<G> for SRS<G>

where G: CommitmentCurve,

fn max_poly_size(&self) -> usize

The maximum polynomial degree that can be committed to

fn mask( &self, comm: PolyComm<G>, rng: &mut (impl RngCore + CryptoRng), ) -> BlindedCommitment<G>

Turns a non-hiding polynomial commitment into a hiding polynomial commitment. Transforms each given <a, G> into (<a, G> + wH, w) with a random w per commitment.

fn blinding_commitment(&self) -> G

Get the group element used for blinding commitments

fn mask_custom( &self, com: PolyComm<G>, blinders: &PolyComm<G::ScalarField>, ) -> Result<BlindedCommitment<G>, CommitmentError>

Same as SRS::mask except you can pass blinders manually.

fn commit_non_hiding( &self, plnm: &DensePolynomial<G::ScalarField>, num_chunks: usize, ) -> PolyComm<G>

This function commits a polynomial using the SRS’ basis of size n.

fn commit( &self, plnm: &DensePolynomial<G::ScalarField>, num_chunks: usize, rng: &mut (impl RngCore + CryptoRng), ) -> BlindedCommitment<G>

Commits a polynomial, potentially splitting the result.

fn commit_custom( &self, plnm: &DensePolynomial<G::ScalarField>, num_chunks: usize, blinders: &PolyComm<G::ScalarField>, ) -> Result<BlindedCommitment<G>, CommitmentError>

Commit to a polynomial, with custom blinding factors.

fn commit_evaluations_non_hiding( &self, domain: D<G::ScalarField>, plnm: &Evaluations<G::ScalarField, D<G::ScalarField>>, ) -> PolyComm<G>

Commit to evaluations, without blinding factors.

fn commit_evaluations( &self, domain: D<G::ScalarField>, plnm: &Evaluations<G::ScalarField, D<G::ScalarField>>, rng: &mut (impl RngCore + CryptoRng), ) -> BlindedCommitment<G>

Commit to evaluations with blinding factors.

fn commit_evaluations_custom( &self, domain: D<G::ScalarField>, plnm: &Evaluations<G::ScalarField, D<G::ScalarField>>, blinders: &PolyComm<G::ScalarField>, ) -> Result<BlindedCommitment<G>, CommitmentError>

Commit to evaluations with custom blinding factors.

fn create(depth: usize) -> Self

Create an SRS of size depth.

fn get_lagrange_basis_from_domain_size( &self, domain_size: usize, ) -> &Vec<PolyComm<G>>

Same as get_lagrange_basis but only using the domain size.

fn get_lagrange_basis(&self, domain: D<G::ScalarField>) -> &Vec<PolyComm<G>>

Compute commitments to the lagrange basis corresponding to the given domain and cache them in the SRS

fn size(&self) -> usize

impl<G> Serialize for SRS<G>

where G: CanonicalDeserialize + CanonicalSerialize,

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl WithLagrangeBasis<Affine<PallasParameters>> for SRS<Pallas>

fn with_lagrange_basis(&self, domain: D<<Pallas as AffineRepr>::ScalarField>)

impl WithLagrangeBasis<Affine<VestaParameters>> for SRS<Vesta>

fn with_lagrange_basis(&self, domain: D<<Vesta as AffineRepr>::ScalarField>)