Adds to the circuit description the conditional negation of a point: bit == 1 => -value, bit == 0 => value, # Note The `bit` used as input which is a

Adds to the circuit description the conditional selection of the a point between two of them: ```text bit == 1 => point_1, bit == 0 => point_0, ```

Assumes matrix is partially reduced to upper triangular. `column` is the column to eliminate from all rows. Returns `None` if either: - no non-zero pi

A gate which outputs a variable whose value is 1 if the two input variables have equal values and whose value is 0 otherwise.

Keys the [`Transcript`] with additional seed information Wrapper around [`Transcript::append_message`]. [`Transcript`]: merlin::Transcript [`Transcri

Performs a logical AND or XOR op between the inputs provided for the specified number of bits. Each logic gate adds `(num_bits / 2) + 1` gates to the

The number of S-boxes (also called the "cost") given by equation (14) in the Poseidon paper: `cost = t * R_F + R_P`.

Output the hash

Pads the circuit to the next power of two. # Note `diff` is the difference between circuit size and next power of two.

These are the parts of preprocessing that the prover must compute Although the prover does not need the verification key, he must compute the commitme

FIXME: Add struct for prover side (last two tuple items).

Pushes a row to the `LookupTable` vector.

Perform row operations to reduce `self` to the identity matrix. `self` must be upper triangular. All operations are performed also on `shadow` to tra

Treats each element in the multiset as evaluation points Computes IFFT of the set of evaluation points and returns the coefficients as a Polynomial da

Performs the verification of a [`Proof`] returning a boolean result.

This function is used to add a blinding factors to the witness and permutation polynomials. All gate selectors are turned off to guarantee the constra

This function adds two dummy gates to the circuit description which are guaranteed to always satisfy the gate equation. This function is only used in

Adds 3 dummy rows to the lookup table The first rows match the witness values used for `add_dummy_constraint` This function is only used for benchmark

Adds a logical AND gate that performs the bitwise AND between two values for the specified first `num_bits` returning a [`Variable`] holding the resul

Ensures that the bit is either `+1`, `-1`, or `0`.

Checks that all of the wires of the composer have the same length.

Adds two curve points together using the classical point addition algorithm. This method is slower than WNAF and is just meant to be the source of tru

- Compress constants by pushing them back through linear layers and through the identity components of partial layers. - As a result, constants need o

Computes the lineariser check.

Computes the following: ```text -(a_eval + beta * sigma_1 + gamma)(b_eval + beta * sigma_2 + gamma) (c_eval + beta * sigma_3 + gamma) * beta *z_eval

Computes the following: ```text (a_eval + beta * z_challenge + gamma)(b_eval + beta * K1 * z_challenge + gamma)(c_eval + beta * K2 * z_challenge + ga

Compute lookup portion of quotient polynomial

Computes the following: ```text (a(x) + beta* Sigma1(X) + gamma) (b(X) + beta * Sigma2(X) + gamma) (c(X) + beta * Sigma3(X) + gamma)(d(X) + beta * Si

Compute evals of lookup portion of quotient polynomial

Computes the following: ```text (a(x) + beta * X + gamma) (b(X) + beta * k1 * X + gamma) (c(X) + beta k2 * X + gamma)(d(X) + beta * k3 * X + gamma)z(

Given that the domain size is `D` This function computes the `D` evaluation points for the vanishing polynomial of degree `n` over a coset

Adds to the circuit description the conditional selection of the identity point: ```text bit == 1 => point, bit == 0 => 1, ``` # Note The `bit` use

Adds the polynomial f(x) = 1 - x + xa to the circuit description where `x = bit`. If: bit == 1 => value, bit == 0 => 1, # Note The `bit` used as inpu

Adds the polynomial f(x) = x * a to the circuit description where `x = bit`. If: bit == 1 => value, bit == 0 => 0, # Note The `bit` used as input whi

Checks if an element is in the MultiSet

Extracts the bit value from the accumulated bit.

Fixed group addition of a point.

This allows the witness table to be filled directly without taking any values, or the results, from the lookup table. If the values do no exist in the

From the paper THe parameter describes the initial state of constant generation (80-bits) `field`: description of field. b0, b1 `sbox`: description of

Insert a new row for an addition operation. This function needs to know the upper bound of the amount of addition operations that will be done in the

Insert a new row for an AND operation. This function needs to know the upper bound of the amount of AND operations that will be done in the plookup t

Insert a new row for a multiplication operation. This function needs to know the upper bound of the amount of multiplication operations that will be

Function builds a table from mutiple operations. If, for example, we are using lookup tables for both XOR and mul operataions, we can create a table w

Returns the public inputs as a vector of `n` evaluations. The provided `n` must be a power of 2.

Attempts to find an output value, given two input values, by querying the lookup table. The final wire holds the index of the table. The element must

return `self @ vec`, treating `vec` as a column vector.

return `vec @ self`, treating `vec` as a row vector.

Extends the length of the multiset to n elements The `n` will be the size of the arithmetic circuit. This will extend the vectors to the size

Returns the position of the element in the Multiset. Returns None if the element is not found.

The verifier only requires the commitments in order to verify a [`Proof`](super::Proof) We can therefore speed up preprocessing for the verifier by sk

Creates a [`Proof]` that demonstrates that a circuit is satisfied. # Note If you intend to construct multiple [`Proof`]s with different witnesses, aft

Returns `true` if the provided round numbers satisfy the security inequalities specified in the Poseidon paper.

Adds the circuit description to the transcript.

shifts the polynomials by one root of unity

NOTE: This is an ok type for internal use.

Returns the length of the circuit that can accommodate the lookup table.

Adds a variable-base scalar multiplication to the circuit description. # Note If you're planning to multiply always by the generator of the scalar f

Takes in a table, which is a vector of slices containing 4 elements, and turns them into 4 distinct multisets for a, b, c and d.

TODO Delete if not used

Add evaluation of poly at point if the label is not already in the set of evaluations

Add the provided affine point as a circuit description and return its constrained witness value

Converts an embeded curve point into a constraint system Point without constraining the values

Creates an addition table for addends from the lower bound up to the upper bound 2^n

Aggregate polynomials