Struct SRS 

pub struct SRS<G> {
    pub g: Vec<G>,
    pub h: G,
    pub lagrange_bases: HashMapCache<usize, Vec<PolyComm<G>>>,
}

Fields

g: Vec<G>

The vector of group elements for committing to polynomials in coefficient form.

h: G

A group element used for blinding commitments

lagrange_bases: HashMapCache<usize, Vec<PolyComm<G>>>

Commitments to Lagrange bases, per domain size

Implementations

impl<G: CommitmentCurve> SRS<G>

Additional methods for the SRS structure

pub fn verify<EFqSponge, RNG, const FULL_ROUNDS: usize>( &self, group_map: &G::Map, batch: &mut [BatchEvaluationProof<'_, G, EFqSponge, OpeningProof<G, FULL_ROUNDS>, FULL_ROUNDS>], rng: &mut RNG, ) -> bool

where EFqSponge: FqSponge<G::BaseField, G, G::ScalarField, FULL_ROUNDS>, RNG: RngCore + CryptoRng, G::BaseField: PrimeField,

Verifies a batch of polynomial commitment opening proofs.

This IPA verification method is primarily designed for integration into recursive proof systems like Pickles. In recursive proofs, IPA verification is deferred by storing accumulators (RecursionChallenge) rather than verifying immediately in-circuit. This method performs the final out-of-circuit verification of those accumulators.

The function reconstructs the challenge polynomial b(X) from the IPA challenges and uses it to verify the opening proofs. The challenge polynomial is defined as:

b(X) = prod_{i=0}^{k-1} (1 + u_{k-i} * X^{2^i})

where u_1, ..., u_k are the challenges from the k rounds of the IPA protocol. See Section 3.2 of the Halo paper.

The verification reconstructs b(X) in two forms:

• Evaluation form: b_poly(&chal, x) computes b(x) in O(k) operations
• Coefficient form: b_poly_coefficients(&chal) returns the 2^k coefficients for the MSM <s, G> that verifies the accumulated commitment

Note: The challenge polynomial reconstruction is specifically needed for recursive proof verification. For standalone (non-recursive) IPA verification, a simpler approach without b(X) reconstruction could be used.

Returns true if verification succeeds, false otherwise.

pub unsafe fn create_trusted_setup(x: G::ScalarField, depth: usize) -> Self

This function creates a trusted-setup SRS instance for circuits with number of rows up to depth.

Safety

This function is unsafe because it creates a trusted setup and the toxic waste is passed as a parameter.

impl<G: CommitmentCurve> SRS<G>

where <G as CommitmentCurve>::Map: Sync, G::BaseField: PrimeField,

pub fn create_parallel(depth: usize) -> Self

This function creates SRS instance for circuits with number of rows up to depth.

impl<G: CommitmentCurve> SRS<G>

pub fn open<EFqSponge, RNG, D: EvaluationDomain<G::ScalarField>, const FULL_ROUNDS: usize>( &self, group_map: &G::Map, plnms: &'_ [(DensePolynomialOrEvaluations<'_, G::ScalarField, D>, PolyComm<G::ScalarField>)], elm: &[G::ScalarField], polyscale: G::ScalarField, evalscale: G::ScalarField, sponge: EFqSponge, rng: &mut RNG, ) -> OpeningProof<G, FULL_ROUNDS>

where EFqSponge: Clone + FqSponge<G::BaseField, G, G::ScalarField, FULL_ROUNDS>, RNG: RngCore + CryptoRng, G::BaseField: PrimeField, G: EndoCurve,

Creates an opening proof for a batch of polynomial commitments.

This function implements the IPA (Inner Product Argument) prover. During the k = log_2(n) rounds of folding, it implicitly constructs the challenge polynomial b(X).

Note: The use of the challenge polynomial b(X) is a modification to the original IPA protocol that improves efficiency in recursive proof settings. The challenge polynomial is inspired from the “Amoritization strategy”“ from Recursive Proof Composition without a Trusted Setup, section 3.2. #[allow(clippy::type_complexity)]

fn lagrange_basis(&self, domain: D<G::ScalarField>) -> Vec<PolyComm<G>>

Trait Implementations

impl<G: Clone> Clone for SRS<G>

fn clone(&self) -> SRS<G>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<G: Debug> Debug for SRS<G>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<G: Default> Default for SRS<G>

fn default() -> SRS<G>

Returns the “default value” for a type.

impl<'de, G> Deserialize<'de> for SRS<G>

where G: CanonicalDeserialize + CanonicalSerialize,

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl<G: Clone> From<SRS<G>> for TestSRS<G>

fn from(value: SRS<G>) -> Self

Converts to this type from the input type.

impl<G> From<TestSRS<G>> for SRS<G>

fn from(value: TestSRS<G>) -> Self

Converts to this type from the input type.

impl<G> PartialEq for SRS<G>

where G: PartialEq,

fn eq(&self, other: &Self) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl<G> SRS<G> for SRS<G>

where G: CommitmentCurve,

fn max_poly_size(&self) -> usize

The maximum polynomial degree that can be committed to

fn mask( &self, comm: PolyComm<G>, rng: &mut (impl RngCore + CryptoRng), ) -> BlindedCommitment<G>

Turns a non-hiding polynomial commitment into a hiding polynomial commitment. Transforms each given <a, G> into (<a, G> + wH, w) with a random w per commitment.

fn blinding_commitment(&self) -> G

Get the group element used for blinding commitments

fn mask_custom( &self, com: PolyComm<G>, blinders: &PolyComm<G::ScalarField>, ) -> Result<BlindedCommitment<G>, CommitmentError>

Same as SRS::mask except that you can pass the blinders manually. A BlindedCommitment object is returned instead of a PolyComm object to keep the blinding factors and the commitment together. The blinded commitment is saved in the commitment field of the output. The output is wrapped into a Result to handle the case the blinders are not the same length than the number of chunks commitments have.

fn commit_non_hiding( &self, plnm: &DensePolynomial<G::ScalarField>, num_chunks: usize, ) -> PolyComm<G>

This function commits a polynomial using the SRS’ basis of size n.

fn commit( &self, plnm: &DensePolynomial<G::ScalarField>, num_chunks: usize, rng: &mut (impl RngCore + CryptoRng), ) -> BlindedCommitment<G>

Commits a polynomial, potentially splitting the result in multiple commitments. It is analogous to SRS::commit_evaluations but for polynomials. A BlindedCommitment object is returned instead of a PolyComm object to keep the blinding factors and the commitment together. The blinded commitment is saved in the commitment field of the output.

fn commit_custom( &self, plnm: &DensePolynomial<G::ScalarField>, num_chunks: usize, blinders: &PolyComm<G::ScalarField>, ) -> Result<BlindedCommitment<G>, CommitmentError>

Commit to a polynomial, with custom blinding factors. It is a combination of SRS::commit and SRS::mask_custom. It is analogous to SRS::commit_evaluations_custom but for polynomials. A BlindedCommitment object is returned instead of a PolyComm object to keep the blinding factors and the commitment together. The blinded commitment is saved in the commitment field of the output. The output is wrapped into a Result to handle the case the blinders are not the same length than the number of chunks commitments have.

fn commit_evaluations_non_hiding( &self, domain: D<G::ScalarField>, plnm: &Evaluations<G::ScalarField, D<G::ScalarField>>, ) -> PolyComm<G>

Commit to evaluations, without blinding factors. It is analogous to SRS::commit_non_hiding but for evaluations.

fn commit_evaluations( &self, domain: D<G::ScalarField>, plnm: &Evaluations<G::ScalarField, D<G::ScalarField>>, rng: &mut (impl RngCore + CryptoRng), ) -> BlindedCommitment<G>

Commit to evaluations with blinding factors, generated using the random number generator rng. It is analogous to SRS::commit but for evaluations. A BlindedCommitment object is returned instead of a PolyComm object to keep the blinding factors and the commitment together. The blinded commitment is saved in the commitment field of the output.

fn commit_evaluations_custom( &self, domain: D<G::ScalarField>, plnm: &Evaluations<G::ScalarField, D<G::ScalarField>>, blinders: &PolyComm<G::ScalarField>, ) -> Result<BlindedCommitment<G>, CommitmentError>

Commit to evaluations with custom blinding factors. It is a combination of SRS::commit_evaluations and SRS::mask_custom. It is analogous to SRS::commit_custom but for evaluations. A BlindedCommitment object is returned instead of a PolyComm object to keep the blinding factors and the commitment together. The blinded commitment is saved in the commitment field of the output. The output is wrapped into a Result to handle the case the blinders are not the same length than the number of chunks commitments have.

fn create(depth: usize) -> Self

Create an SRS of size depth.

fn get_lagrange_basis_from_domain_size( &self, domain_size: usize, ) -> &Vec<PolyComm<G>>

Same as get_lagrange_basis but only using the domain size.

fn get_lagrange_basis(&self, domain: D<G::ScalarField>) -> &Vec<PolyComm<G>>

Compute commitments to the lagrange basis corresponding to the given domain and cache them in the SRS

fn size(&self) -> usize

impl<G> Serialize for SRS<G>

where G: CanonicalDeserialize + CanonicalSerialize,

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl WithLagrangeBasis<Affine<PallasParameters>> for SRS<Pallas>

fn with_lagrange_basis(&self, domain: D<<Pallas as AffineRepr>::ScalarField>)

impl WithLagrangeBasis<Affine<VestaParameters>> for SRS<Vesta>

fn with_lagrange_basis(&self, domain: D<<Vesta as AffineRepr>::ScalarField>)