fri

package
v0.0.0-...-58399a2 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 29, 2026 License: Apache-2.0 Imports: 15 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	HashBackendPoseidon2 = "poseidon2"
	HashBackendSHA256    = "sha256"
	HashBackendBlake3    = "blake3"
)

Variables

View Source 
var (
	DefaultLeafHasher Poseidon2LeafHasher
	DefaultNodeHasher Poseidon2NodeHasher
)

--------------- default -----------------

Functions

func HashLeafPairsParallel 

func HashLeafPairsParallel(lh LeafHasher, dst []hash.Digest, src LeafSource)

HashLeafPairsParallel hashes len(dst) adjacent row-pair leaves from src. Pair k absorbs rows 2*k and 2*k+1.

func NormalizeHashBackendID 

func NormalizeHashBackendID(id string) string

func Verify 

func Verify(p Params, levelRoots []hash.Digest, levelDs []int, prf Proof, ts *fiatshamir.Transcript) error

Verify checks a multi-degree FRI proof.

levelRoots[l] is the Merkle root of levels[l].Evals (committed by the caller before invoking FRI). levelRoots[0] plays the role of "root0" in single-degree FRI.

levelDs[l] is the polynomial-size parameter D for level l; levelDs[0] must equal p.D and the slice must be ordered consistently with how Prove was called (i.e. decreasing D).

ts must be in the same state as when Prove was called.

Types

type Batch 

type Batch = []Group

Batch list of Group, one Group = one list of polynomials of the same size

type BatchClaimedValues 

type BatchClaimedValues = []GroupClaimedValues

BatchClaimedValues is one GroupClaimedValues per Group of a Batch.

type BatchPairLeafHasher 

type BatchPairLeafHasher interface {
	LeafHasher
	BatchSize() int
	HashLeafPairs(dst []hash.Digest, src LeafSource, startPair int)
}

BatchPairLeafHasher extends LeafHasher with a SIMD-width batch path. Pair k absorbs rows 2*k and 2*k+1 as lo || hi.

type BatchShapes 

type BatchShapes = []GroupShape

BatchShapes gives, for every Group in a Batch (in declaration order), the per-group shape list.

type BatchShifts 

type BatchShifts = []GroupShifts

BatchShifts gives, for every Group in a Batch (in declaration order), the per-polynomial shift list. Shape must align with the corresponding Batch: same number of Groups, same Base/Ext widths per Group.

type Blake3LeafHasher 

type Blake3LeafHasher struct{}

func (Blake3LeafHasher) HashLeafPair 

func (Blake3LeafHasher) HashLeafPair(lo, hi RawRow) hash.Digest

type Blake3NodeHasher 

type Blake3NodeHasher struct{}

func (Blake3NodeHasher) HashNode 

func (Blake3NodeHasher) HashNode(left, right hash.Digest) hash.Digest

type CommitConfig 

type CommitConfig struct {
	DomainCache *poly.DomainCache
}

CommitConfig configures RSCommit.Commit.

type CommitOption 

type CommitOption func(c *CommitConfig) error

CommitOption configures RSCommit.Commit.

func WithDomainCache 

func WithDomainCache(cache *poly.DomainCache) CommitOption

WithDomainCache reuses cache for input-polynomial FFT domains.

type Committed 

type Committed struct {
	Tree    WMerkleTree
	Sources []LeafSource
	Shapes  BatchShapes
}

Committed is the per-batch prover-side blob returned by Commit. Tree carries the Merkle root the caller binds to its transcript; Sources retains, per Group in decreasing-size order, the RS-encoded row evaluations Open will need to build the DEEP quotient and to open the committed polynomials at FRI query positions. Shapes is in Batch declaration order, so it lines up with the caller's BatchShifts and is the verifier-side shape metadata to pass to PCS.Verify.

type Config 

type Config struct {
	WoFullDomainAllocation bool
	Grinding               int // grinding bits for PoW. More grinding bits => more cpu work for the prover, but security goes from log_blowup * num_queries to log_blowup * num_queries + query_proof_of_work_bits
}

type Group 

type Group struct {
	Base []poly.Polynomial
	Ext  []poly.ExtPolynomial
}

Group bundles base- and extension-rail polynomials that share the same native size. A single Commit call accepts a slice of Groups, each with a distinct size: the largest group occupies the actual Merkle leaves and each smaller group becomes a per-level injection in the underlying merkle.Tree (see internal/merkle/tree.go).

type GroupClaimedValues 

type GroupClaimedValues struct {
	Base [][]ext.E6
	Ext  [][]ext.E6
}

GroupClaimedValues holds the claimed polynomial evaluations produced by Open for one Group of one Batch. The shape mirrors the matching GroupShifts exactly:

  • Base[i][k] is the claimed value of the i-th base polynomial at zeta * omega_N^shifts.Base[i][k];
  • Ext[i][k] is the claimed value of the i-th extension polynomial at zeta * omega_N^shifts.Ext[i][k].

type GroupShape 

type GroupShape struct {
	Rows      int
	BaseWidth int
	ExtWidth  int
}

GroupShape records the per-group layout of a committed tree, in decreasing-size order (groups[0] is the largest, hashed at the actual leaves; groups[1..] are injection levels). Rows is the number of encoded rows at this group's level, i.e. ρ · N_native. The underlying Merkle tree hashes adjacent row pairs, so its level width is Rows/2.

type GroupShifts 

type GroupShifts struct {
	Base [][]int
	Ext  [][]int
}

GroupShifts assigns a list of rotation shifts to each polynomial of a Group. Base[i] is the shift list for the i-th base polynomial of the Group; Ext[i] is the shift list for the i-th extension polynomial.

A shift s means the polynomial is opened at zeta * omega_N^s where omega_N is the generator of the polynomial's native size-N domain (the Group's size). Shift lists must be non-empty and contain no duplicate opening points modulo N; Open and Verify reject inputs violating either rule.

type HashBackend 

type HashBackend struct {
	ID         string
	LeafHasher LeafHasher
	NodeHasher NodeHasher
}

HashBackend contains every hash primitive that must agree between setup, proving, and verification.

func Blake3HashBackend 

func Blake3HashBackend() HashBackend

func DefaultHashBackend 

func DefaultHashBackend() HashBackend

func HashBackendByID 

func HashBackendByID(id string) (HashBackend, error)

func Poseidon2HashBackend 

func Poseidon2HashBackend() HashBackend

func ResolveHashBackend 

func ResolveHashBackend(configured HashBackend, keyID string) (HashBackend, error)

ResolveHashBackend returns the explicitly configured backend, or the backend identified by keyID when no explicit backend was provided. Empty IDs preserve compatibility with keys and proofs produced before backend metadata existed.

func SHA256HashBackend 

func SHA256HashBackend() HashBackend

type LeafHasher 

type LeafHasher interface {
	// HashLeafPair hashes the (lo, hi) row pair that forms one Merkle leaf.
	// Implementations must produce lo.base || hi.base || lo.ext || hi.ext
	// in that element order, with length headers 2*nBase and 2*nExt.
	HashLeafPair(lo, hi RawRow) hash.Digest
}

type LeafSource 

type LeafSource struct {
	Base []poly.Polynomial
	Ext  []poly.ExtPolynomial
}

LeafSource describes the encoded column-oriented data used to build Merkle leaves. Row i stores one encoded value at i for every base and extension polynomial.

type Level 

type Level struct {
	D     int
	Evals LevelEvals
	Tree  *merkle.Tree
}

Level holds one polynomial introduced at the folding round where the running polynomial's degree matches Level.D. Tree is the pre-built pair-leaf Merkle tree for Evals; build it with Params.BuildLevelTree or Params.BuildLevelTreeExt so the leaf/node hashers match.

type LevelEvals 

type LevelEvals struct {
	Base []koalabear.Element
	Ext  []ext.E6
}

LevelEvals stores the evaluation vector for one FRI level. Exactly one rail must be populated; callers must fold any extra same-degree polynomials before invoking FRI.

func (LevelEvals) Field 

func (e LevelEvals) Field() field.Kind

Field returns the populated rail. Invalid mixed/empty values are rejected by Prove's validation; the zero value reports field.Base.

func (LevelEvals) Len 

func (e LevelEvals) Len() int

type NodeHasher 

type NodeHasher interface {
	HashNode(left, right hash.Digest) hash.Digest
}

type OpenConfig 

type OpenConfig struct {
	DomainCache *poly.DomainCache
}

OpenConfig configures an Open call.

type OpenOption 

type OpenOption func(c *OpenConfig) error

OpenOption configures Open.

func WithOpenDomainCache 

func WithOpenDomainCache(cache *poly.DomainCache) OpenOption

WithOpenDomainCache lets Open reuse a domain cache shared with Commit so FFT-domain pre-computations are not duplicated across calls.

type OpeningProof 

type OpeningProof struct {
	ClaimedValues     []BatchClaimedValues
	DeepQuotientRoots []hash.Digest
	FRIProof          Proof
	PointSamplings    [][]WMerkleProof
}

OpeningProof bundles everything Verify needs to convince the verifier that every polynomial in every committed Batch evaluates to the listed ClaimedValues at zeta times the requested rotation shifts.

  • ClaimedValues[b] is the GroupClaimedValues slice for batches[b], in the same order Open / Verify received batches and shifts.
  • DeepQuotientRoots is one Merkle root per distinct native size in decreasing size order (same order as the per-polynomial DEEP quotient FRI levels).
  • FRIProof is the multi-degree FRI proof on the DEEP-quotient codewords.
  • PointSamplings[q][b] is the WMerkleProof opening batches[b] at the q-th FRI query position. Each WMerkleProof carries one top lo/hi RawRowPair, one top Merkle path, and one compact injected row pair per smaller Group in decreasing-size order.

type Option 

type Option func(c *Config) error

func WithGrinding 

func WithGrinding(nbBits int) Option

WithGrinding forces the folding challenges to start with nbBits at zeroes, to increase security It lowers the space <wrong proof x miraculously valid challenges>. Security goes from log_blowup * num_queries to log_blowup * num_queries + query_proof_of_work_bits.

func WoFullDomainAllocation 

func WoFullDomainAllocation() Option

WoFullDomainAllocation useful for the verifier -> only the generator of the domain is needed, no need to pre-compute the twiddles.

type PCS 

type PCS struct {
	// contains filtered or unexported fields
}

PCS is a batch polynomial commitment scheme built on top of RSCommit and multi-degree FRI. It is the entry point intended to subsume direct use of RSCommit and the prover-side DEEP/FRI machinery: callers Commit each independent batch of polynomials, bind the returned root to their transcript at the appropriate Fiat-Shamir round, and hand the whole list to Open at zeta to produce one OpeningProof.

PCS keeps no global state across Commit calls -- the per-batch Committed blob carries the Merkle tree and the per-Group RS-encoded LeafSources that Open consumes.

Open requires multi-degree FRI parameters; build the PCS via NewPCSWithParams when Open will be called. The minimal NewPCS constructor is enough for Commit-only callers (e.g. setup-time fixed column commitments).

func NewPCS 

func NewPCS(rate uint64, leafHasher LeafHasher, nodeHasher NodeHasher) PCS

NewPCS constructs a PCS bound to a Reed-Solomon blowup factor (rate) and the leaf/node hashers used at every Merkle tree level. Suitable for Commit-only callers. Open and Verify require Params -- use NewPCSWithParams when the PCS will be opened or verified.

func NewPCSWithParams 

func NewPCSWithParams(params Params) PCS

NewPCSWithParams constructs a PCS bound to the multi-degree FRI parameters (carrying the leaf/node hashers and the rate = params.N / params.D). The returned PCS supports Commit, Open, and Verify.

func (*PCS) ClaimedValuesOnly 

func (pcs *PCS) ClaimedValuesOnly(
	batches []Batch,
	shifts []BatchShifts,
	zeta ext.E6,
	opts ...OpenOption,
) ([]BatchClaimedValues, error)

ClaimedValuesOnly evaluates every polynomial in batches at every shift listed in shifts and returns the per-batch BatchClaimedValues. No transcript activity, no DEEP-quotient construction, no FRI. Suited to SkipFRI-style smoke tests where the caller wants the AIR-check-side values without paying for the PCS proof.

The output shape mirrors shifts: a value per (batch, group, base/ext rail, polyIdx, kth_shift) tuple, evaluated at zeta * omega_N^shift. Identical content to the OpeningProof.ClaimedValues that pcs.Open would have produced for the same inputs.

func (*PCS) Commit 

func (pcs *PCS) Commit(batch Batch, opts ...CommitOption) (Committed, error)

Commit commits to one Batch of polynomials and returns the per-batch prover-side blob. The current implementation is a thin wrapper over RSCommit; PCS keeps no state across Commit calls -- callers stash one Committed per Commit invocation and hand the whole slice to Open.

The caller is responsible for binding committed.Tree.Root() to the shared Fiat-Shamir transcript at the appropriate round before invoking Open: Commit does not bind anything itself.

func (*PCS) Open 

func (pcs *PCS) Open(
	batches []Batch,
	committed []Committed,
	shifts []BatchShifts,
	zeta ext.E6,
	fs *fiatshamir.Transcript,
	opts ...OpenOption,
) (OpeningProof, error)

Open produces an OpeningProof that every polynomial in batches evaluates to the listed values at zeta and at the rotation shifts in shifts. committed[b] must have been returned by Commit(batches[b], ...). The shared Fiat-Shamir transcript fs must already have absorbed each committed[b].Tree.Root() at the round the caller chose, and must have sampled zeta.

Open registers alpha_DEEP and FRI-internal challenge names on fs itself; the caller MUST NOT pre-register any of those names. Open is responsible for binding claimed values in per-polynomial DEEP order, sampling alpha_DEEP, building per-size DEEP-quotient codewords, committing them as multi-degree FRI levels, running fri.Prove, and packaging per-query / per-batch Merkle openings.

func (*PCS) Verify 

func (pcs *PCS) Verify(
	roots []hash.Digest,
	shapes []BatchShapes,
	shifts []BatchShifts,
	zeta ext.E6,
	proof OpeningProof,
	fs *fiatshamir.Transcript,
) error

PCS.Verify checks an OpeningProof produced by PCS.Open against:

  • roots: one Merkle root per Batch (in the same declaration order the prover handed to Open). The caller is responsible for assembling setup roots (from a verification key) and witness roots (from the outer proof) into the right slice.
  • shapes: the per-Batch / per-Group shape descriptor (Rows, BaseWidth, ExtWidth). The verifier reconstructs every Group's native size from Rows and the PCS's rate.
  • shifts: the same per-poly shift schedule the prover used.
  • zeta: the out-of-domain evaluation point.
  • fs: a transcript already in the same state the prover's transcript was in when Open was invoked. Verify registers alpha_DEEP and the FRI-internal challenge names itself; the caller MUST NOT have pre-registered any of those names.

Verify performs four checks in sequence:

  1. Shape validation against the proof.
  2. Re-derives alpha_DEEP by replaying the same per-polynomial binding sequence Open used.
  3. Multi-degree FRI verification on the DEEP-quotient roots.
  4. The bridge: for every FRI query position and every distinct native size, recompute DQ_N(omega^x) and DQ_N(-omega^x) from the opened raw rows and the claimed values, then compare to the FRI proof's level leaves at that query.

Any of the checks failing yields a non-nil error explaining the failure mode.

type Params 

type Params struct {
	N          int // 2^n: size of the evaluation domain
	D          int // 2^m: degree of the purported polynomial
	NumQueries int // number of independent queries (controls soundness error ≈ (1-δ)^Q)
	LeafHasher LeafHasher
	NodeHasher NodeHasher
	// contains filtered or unexported fields
}

Params holds the FRI configuration and precomputed per-level data. Build once with NewParams; reuse across many Prove/Verify calls.

func NewParams 

func NewParams(N, D, numQueries int, lh LeafHasher, nh NodeHasher, opts ...Option) (Params, error)

NewParams constructs and validates a Params, precomputing r+1 domains and inv(2).

func (Params) BuildLevelTree 

func (p Params) BuildLevelTree(layer []koalabear.Element) (*merkle.Tree, error)

BuildLevelTree builds the pair-leaf Merkle tree expected by FRI for a base level polynomial: tree leaf k = LeafHasher(layer[2*k], layer[2*k+1]).

func (Params) BuildLevelTreeExt 

func (p Params) BuildLevelTreeExt(layer []ext.E6) (*merkle.Tree, error)

BuildLevelTreeExt builds the pair-leaf Merkle tree expected by FRI for an extension-field level polynomial.

func (Params) Encode 

func (p Params) Encode(poly []koalabear.Element) ([]koalabear.Element, error)

Encode converts a polynomial from Lagrange form (size D) to its evaluation on the full domain of size N. The result is a₀, ready to pass to Prove.

func (Params) EncodeExt 

func (p Params) EncodeExt(poly []ext.E6) ([]ext.E6, error)

EncodeExt is the extension-field counterpart of Encode.

func (Params) FullDomainGenerator 

func (p Params) FullDomainGenerator() koalabear.Element

FullDomainGenerator returns the generator of the full evaluation domain (layer 0, size N).

type Poseidon2LeafHasher 

type Poseidon2LeafHasher struct{}

--------------- poseidon2 -----------------

func (Poseidon2LeafHasher) BatchSize 

func (Poseidon2LeafHasher) BatchSize() int

func (Poseidon2LeafHasher) HashLeafPair 

func (Poseidon2LeafHasher) HashLeafPair(lo, hi RawRow) hash.Digest

func (Poseidon2LeafHasher) HashLeafPairs 

func (lh Poseidon2LeafHasher) HashLeafPairs(dst []hash.Digest, src LeafSource, startPair int)

type Poseidon2NodeHasher 

type Poseidon2NodeHasher struct{}

func (Poseidon2NodeHasher) BatchSize 

func (Poseidon2NodeHasher) BatchSize() int

BatchSize is the lane width of the SIMD-batched Poseidon2 permutation.

func (Poseidon2NodeHasher) HashNode 

func (Poseidon2NodeHasher) HashNode(left, right hash.Digest) hash.Digest

func (Poseidon2NodeHasher) HashNodes 

func (Poseidon2NodeHasher) HashNodes(dst, left, right []hash.Digest)

HashNodes compresses BatchSize() (left, right) pairs in one batched permutation. dst, left, right must all have length BatchSize().

type Proof 

type Proof struct {
	// LevelQueries[l-1][k] is the adjacent row opening for levels[l].Evals at
	// outer query k. The stored Row is the full query row shifted to the round
	// where that level is introduced.
	LevelQueries [][]QueryLayer

	// Running-polynomial FRI path.
	FRIRoots      []hash.Digest // Merkle roots for running poly T_1..T_{r-1}
	FinalField    field.Kind
	FinalPolyBase []koalabear.Element               // populated when FinalField == field.Base
	FinalPolyExt  []ext.E6                          // populated when FinalField == field.Ext
	FRIQueries    []Query                           // one full-row query path per FRI query
	PoW           map[string]fiatshamir.ProofOfWork // proof of work in case grinding has nbBits > 0
}

Proof is the complete multi-degree FRI proof. Level polynomial Merkle roots are NOT stored here — they are passed externally to Verify (the caller commits to those polynomials before invoking FRI).

func Prove 

func Prove(p Params, levels []Level, ts *fiatshamir.Transcript) (Proof, []int, error)

Prove runs multi-degree FRI (commit + query phase) and returns a Proof together with the query positions. levels[0].D must equal p.D and every Level must contain one evaluation vector on exactly one rail. levels is sorted in-place in decreasing order of D. ts must already have been initialised with any prior-round context.

type Query 

type Query struct {
	Layers []QueryLayer // len = numRounds
}

Query holds the opening data for one full query path across all folding levels of the running FRI polynomial.

type QueryLayer 

type QueryLayer struct {
	Field     field.Kind
	Row       int
	LeafPBase koalabear.Element // populated when Field == field.Base
	LeafQBase koalabear.Element
	LeafPExt  ext.E6 // populated when Field == field.Ext
	LeafQExt  ext.E6
	Path      merkle.Proof // authenticates the adjacent pair containing LeafP and LeafQ
}

Bit-reversed row convention: every RS-encoded vector committed by FRI is stored in bit-reversed evaluation order. If a layer has N rows, row r stores the evaluation at omega_N^bitrev_log2(N)(r). The FRI companion row is r^1, the oriented pair is lo = r&^1 and hi = lo+1, and the next folded-layer row is r>>1.

QueryLayer holds the adjacent row openings for one FRI level. Exactly one rail is populated, selected by Field. Row is the sampled full-domain row projected to this level; LeafP is the value at row Row&^1 and LeafQ is the value at row (Row&^1)+1. Path authenticates the adjacent pair leaf containing both values, with Path.LeafIdx == (Row&^1)/2.

type RSCommit 

type RSCommit struct {
	// Encoder is the Reed-Solomon encoder built for the size N passed to
	// NewRSCommit / NewRSCommitWithDomainCache. It is reused inside Commit
	// whenever a group's size matches it; groups of any other size build a
	// fresh encoder on the fly (using rate). Kept exported for back-compat
	// with code that reads Encoder.Domain.Cardinality.
	Encoder    reedsolomon.Encoder
	LeafHasher LeafHasher
	NodeHasher NodeHasher
	// contains filtered or unexported fields
}

func NewRSCommit 

func NewRSCommit(N uint64, rate uint64, leafHasher LeafHasher, nodehasher NodeHasher) RSCommit

func NewRSCommitWithDomainCache 

func NewRSCommitWithDomainCache(N uint64, rate uint64, leafHasher LeafHasher, nodehasher NodeHasher, cache *poly.DomainCache) RSCommit

NewRSCommitWithDomainCache constructs an RSCommit using cache for the Reed-Solomon encoder domain. N is the natural size used to seed the reusable Encoder; Commit can still accept groups of other sizes by building fresh encoders from rate on the fly.

func (*RSCommit) Commit 

func (rs *RSCommit) Commit(batch Batch, opts ...CommitOption) (WMerkleTree, []LeafSource, error)

Commit commits to one or more Groups of polynomials into a single Merkle tree. Each Group in batch must hold polynomials sharing a single power-of-two length; group sizes must be pairwise distinct. The largest group's encoded row-pair hashes form the actual tree leaves; each smaller group is folded in as a merkle.LevelInjection at the level whose width matches its number of encoded row pairs.

Within a group, pair leaf i absorbs rows 2*i and 2*i+1: first all base polynomial values from the two rows, then all extension polynomial values from the two rows. Multi-group calls add injection levels above the top group.

In addition to the committed tree, Commit returns the per-group LeafSource in the same decreasing-size order used internally to build the tree (i.e. sources[0] is the top group whose RS-encoded row pairs form the Merkle leaves; sources[k>0] corresponds to a smaller group folded in as a LevelInjection at the level whose width matches that group's number of encoded row pairs). Callers needing to reopen committed values at FRI query positions can read RS-encoded evaluations directly from the LeafSource.

type RawRow 

type RawRow struct {
	RawRowBase []koalabear.Element
	RawRowExt  []ext.E6
}

RawRow holds one encoded row for one Group of the committed tree: one base value per base-rail polynomial and one extension value per extension-rail polynomial, in declaration order.

type RawRowPair 

type RawRowPair struct {
	Lo RawRow
	Hi RawRow
}

RawRowPair holds the two adjacent rows needed by the DEEP bridge.

type SHA256LeafHasher 

type SHA256LeafHasher struct{}

func (SHA256LeafHasher) BatchSize 

func (SHA256LeafHasher) BatchSize() int

func (SHA256LeafHasher) HashLeafPair 

func (SHA256LeafHasher) HashLeafPair(lo, hi RawRow) hash.Digest

type SHA256NodeHasher 

type SHA256NodeHasher struct{}

func (SHA256NodeHasher) HashNode 

func (SHA256NodeHasher) HashNode(left, right hash.Digest) hash.Digest

type WMerkleInjectionOpening 

type WMerkleInjectionOpening struct {
	Rows RawRowPair
}

WMerkleInjectionOpening is the compact opening payload for one injected smaller group. Rows is the canonical lo/hi row pair at that group's row domain and is authenticated as a pair leaf on the top Merkle path.

type WMerkleProof 

type WMerkleProof struct {
	TopRows    RawRowPair
	Path       merkle.Proof
	Injections []WMerkleInjectionOpening
}

WMerkleProof is an opening proof for a WMerkleTree at one query position.

One top Merkle path authenticates the top row pair and every injected raw row pair crossed by that path. TopRows is the canonical lo/hi row pair for the top group. Path authenticates hash(TopRows.Lo || TopRows.Hi). Injections carries one compact opening per injected smaller group, in the same decreasing-size order as WMerkleTree.InjectionWidths().

type WMerkleTree 

type WMerkleTree struct {
	Tree *merkle.Tree
	// contains filtered or unexported fields
}

func (WMerkleTree) BaseWidth 

func (wt WMerkleTree) BaseWidth() int

BaseWidth returns the number of base-field values in the top group row.

func (WMerkleTree) ExtWidth 

func (wt WMerkleTree) ExtWidth() int

ExtWidth returns the number of extension-field values in the top group row.

func (WMerkleTree) Groups 

func (wt WMerkleTree) Groups() BatchShapes

Groups returns the per-group shape descriptors in decreasing-size order (groups[0] is the top / largest group). The returned slice is owned by the tree; callers must not mutate it.

func (WMerkleTree) InjectionWidths 

func (wt WMerkleTree) InjectionWidths() []int

InjectionWidths returns the pair-leaf LevelWidth of each merkle injection in the same order as the tree's injection schedule (decreasing widths). It is nil for single-group trees. Suitable for passing to merkle.VerifyWithInjections.

func (WMerkleTree) NumLeaves 

func (wt WMerkleTree) NumLeaves() int

NumLeaves returns the number of actual Merkle leaves in the top group. Each leaf hashes one adjacent encoded row pair, so NumLeaves() == NumRows()/2 for valid committed trees.

func (WMerkleTree) NumRows 

func (wt WMerkleTree) NumRows() int

NumRows returns the number of encoded rows of the top (largest) group.

func (WMerkleTree) OpenProof 

func (wt WMerkleTree) OpenProof(i int) (merkle.Proof, error)

OpenProof returns the Merkle proof for pair leaf i. Raw row-pair values are reconstructed by the prover from the committed polynomials when needed. For multi-group trees the returned proof carries InjectionLeaves matching InjectionWidths.

func (WMerkleTree) Root 

func (wt WMerkleTree) Root() hash.Digest

Source Files

View all Source files

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.