Compute CCS-linearization evaluation claims.

Compute f-hat evaluation claims.

Takes the concatenation `x_w || h`, performs gadget decomposition of it, decomposes the resulting `P::B`-short vector into `P::K` `P::B_SMALL`-vectors

Fetch the i'th constraint, returning the respective (A, B, C) i'th row

Step 2 of Fig 5: Construct polynomial $g$ and generate $\beta$ challenges.

Decompose a vector of norm B in its coefficient form into DP::K small vectors.

Takes a coefficient form witness, decomposes it vertically in radix-B, i.e. computes a preimage G_B^{-1}(w), and Ajtai commits to the result.

Takes an NTT form witness, transforms it into the coefficient form, decomposes it vertically in radix-B, i.e. computes a preimage G_B^{-1}(w), and Ajt

Decompose a vector of arbitrary norm in its NTT form into DP::K vectors and applies the gadget-B matrix again.

Decomposes a witness `wit` into `P::K` vectors norm `< P::B_SMALL` such that $$ \text{wit} = \sum\limits_{i=0}^{\text{P::K} - 1} \text{P::B\\_SMALL}^i

extract sum from the proof

Create an R1CS from a constraint system

Reconstruct the original CCS witness from the Ajtai witness Assume that Ajtai witness has bound B. We can multiply by the base B gadget matrix to rec

Constructs a [`CCS`] instance from a [`R1CS`].

Constructs a [`CCS`] instance from a [`R1CS`]. The CCS instance matrices rows are then padded to max { `(n - l - 1) * L`, `m` } next power of 2.

Create a [`Witness`] from a ccs witness. The main operations that need to be done are decomposing the ccs witness. We can then construct [`f_hat`](cr

Step 2: Run linearization sum-check protocol.

Given a gadget-decomposed witness slice `f` returns the f-hat matrix from the Latticefold paper, i.e. a matrix of dimension `tau x f.len()`, where `ta

Generates `rho` values based on the provided transcript and decomposition parameters. This function is used within the module to extract or compute v

Given a witness, provides a satisfying degree three CCS of arbitrary size

Return a R1CS instance of arbitrary size, useful for benching. Only works when z vector consists of multiplicative identities.

Return a R1CS instance of arbitrary size, useful for benching. Works for arbitrary z vector.

Return z vector consisting only of multiplicative identities, split into statement, constant, and witness.

Return z vector consisting of non scalar ring elements, split into statement, constant, and witness.

Return non-scalar z vector for Vitalik's [R1CS example](https://medium.com/@VitalikButerin/quadratic-arithmetic-programs-from-zero-to-hero-f6d558cea64

Return scalar z vector for Vitalik's [R1CS example](https://medium.com/@VitalikButerin/quadratic-arithmetic-programs-from-zero-to-hero-f6d558cea649#81

Initialize

Check if the linear combination is valid given the number of variables

Creates a new R1CS builder with the given parameters. # Arguments `n` - Witness size (total number of variables) `k` - Decomposition width `b` - Norm

Create a new scheme using the provided Ajtai matrix

Create a new empty linear combination

This function does the same thing as `prove`, but it uses cryptographic sponge as the transcript/to generate the verifier challenges. Additionally, it

receive message from verifier, generate prover message, and proceed to next round Adapted Jolt's sumcheck implementation

initialize the prover to argue for the sum of polynomial over {0,1}^`num_vars`

Generates a random witness by firstly generating a random vector of arbitrary norm and then computing the rest of the data needed for a witness. # Ar

Returns a random Ajtai commitment matrix

Recomposes `s`, calculating the linear combination `b[0] * s[0][j] + b[1] * s[1][j] + ... + b[s.len() - 1] * s[s.len() - 1][j]` for each element index