Evaluate the linear combination given a variable assignment

Add a term to the linear combination

Creates a random Ajtai commitment matrix. Generates a kappa × n matrix with random ring elements for use in lattice-based commitment schemes. # Argu

check that a R1CS structure is satisfied by a z vector.

Creates a modified identity matrix for protocol testing. Generates an n×n identity matrix with the first diagonal entry set to 2 instead of 1, creati

Generates a witness vector of the specified size following this pattern. # Arguments `size` - Number of ring elements to generate `rng` - Random numb

Monomial set check Proves sets rings are all unit monomials. Currently requires k >= 1 monomial matrices sets. TODO support other scenarios. If k > 1

Πmlin protocol Folds L `LinB` instances.

This function build the eq(x, r) polynomial for any given r. Evaluate eq(x,y) = \prod_i=1^num_var (x_i * y_i + (1-x_i)*(1-y_i)) over r, which is eq(x

Add a constraint to the system

Evaluate eq polynomial.

Get the total number of variables

Decomposes and squares a R1CS n x m -> n x n, where m * k = n

Range checks Support for `L` [`RgInstance`]s mapped to the corresponding [`DcomEvals`].

Computes and validates decomposition parameters for the given configuration. Combines parameter validation with decomposition parameter computation,

Builds an R1CS instance with decomposed square transformation. Creates identity matrices for A, B, C, applies `r1cs_decomposed_square` transformation

Creates multilinear fold input for prover benchmarks. Generates L committed R1CS instances, linearizes each to produce LinB instances, and packages t

t(z) = tensor(c(z)) ⊗ s' ⊗ (1, d', ..., d'^(ℓ-1)) ⊗ (1, X, ..., X^(d-1))

Commit to a witness in the NTT form. The most basic one just multiplies by the matrix.

Creates range check input for prover benchmarks. Generates a single `RgInstance` with a random witness satisfying the decomposition parameter constra

Computes the tensor product of two flat vectors. If `a` has length `m` and `b` has length `n`, the result is a new vector of length `m * n` containin

Returns a vector of ring elements given a vector of unsigned ints

Adds two ring vectors

Computes the evaluation of the MLEs of $\\{ M_j \mathbf{z} \mid j = 1, 2, \dots, t \\}$ at the sumcheck challenge point. # Parameters `Mz_mles` (`&[

Computes `v0`, `u0`, `x0`, and `cm_0` as folding subprotocol. # Type Parameters - `NTT`: A ring suitable to be used in the LatticeFold protocol. #

Configures a criterion benchmark group with standard settings. Applies consistent parameters across all protocol benchmarks: - Sample size: 10 iterat

Πlin protocol Runs the Πmlin protocol with only L=1 instance

Creates end-to-end protocol input for prover benchmarks. Generates a complete setup including decomposed R1CS constraints, L identical committed R1CS

Creates split function input for prover benchmarks. Generates a random κ × (k_first·d) commitment matrix where d is the ring dimension. This matrix r

Creates set check input for prover benchmarks. Generates identity matrices to guarantee monomial properties (exactly one non-zero per row/column). Us

Creates commitment transformation input for prover benchmarks. Generates L range check instances with random witnesses and commitment matrices. Uses

Computes the tensor operation on a vector `r`. This corresponds to the `tensor(r)` function, defined as the sequential tensor product of `(1 - r_i, r

Builds a basic R1CS instance without decomposed square transformation. Creates identity matrices for A, B, C with optional first element modification

Get the MLEs needed for $k$ g1 and g3 components of the sumcheck polynomial

Prove

Computes the sum $\sum\_{i=1}^{2k} \mathrm{RotSum}(\rho\_i, \mathrm{NTT}(\theta\_i))$. The function takes two slices: one of coefficient representati

Creates double commitment input for prover benchmarks. Generates a ComR1CS instance with decomposed square R1CS constraints, then extracts the witnes

Creates single instance fold input for prover benchmarks. Generates a committed R1CS instance, linearizes it to produce a LinB instance, then prepare

Creates decomposition input for prover benchmarks. Generates a LinB2 instance by first creating a committed R1CS, linearizing it, and then preparing

Generates a valid commitment transformation proof for verifier benchmarks. Creates input with L instances, executes the prover to generate a `CmProof

Verify

A helper function to build eq(x, r) recursively. This function takes `r.len()` steps, and for each step it requires a maximum `r.len()-1` multiplicati

This function build the eq(x, r) polynomial for any given r, and output the evaluation of eq(x, r) in its vector form. Evaluate eq(x,y) = \prod_i=1^n

check that a CCS structure is satisfied by a z vector. Only for testing.

Commit to a witness

Takes a vector and returns a matrix that will square the vector

Takes a vector and returns a matrix that will square the vector