Add base-field witness randomization for full polynomial-IOP ZK
Nobody has claimed this yet.
- Dominant language
- Noir
- Stars
- 138
- Forks
- 47
- Avg merge
- 1d 34m
- Merged PRs (30d)
- 6
Description
Title
Add base-field witness randomization for full polynomial-IOP ZK
Summary
The polynomial IOP currently masks the Spartan sumcheck, but the witness-derived values opened after the zero-check still need a zero-knowledge treatment. Once #493 provides the joint witness polynomial w, implement the base-field randomization from whitepaper Section 5.1.2 for the w_A(α) and w_B(α) openings.
This also concerns the compiler, which must support the additional random gates introduced by the zero-knowledge randomization.
This is related to #476, which tracks the broader goal of making the witness commitment hiding. The commitment masks for w_1 and w_2 must be coordinated with the joint mask-commitment flow in worldfnd/whir#276.
Dependencies: #493, worldfnd/whir#276.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Read whitepaper Section 5.1.2 first, then review dependency #493 for the joint witness polynomial and worldfnd/whir#276 for coordinated mask commitments. Trace the existing Spartan sumcheck masking and compiler handling of random gates. Done means the w_A(α) and w_B(α) openings receive base-field randomization and the compiler supports the added gates.
Written by the indexing model from the issue text.
Assessment
- Domain
- compilers, cryptography
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100