Method open

poly-commit/src/hyrax/mod.rs:273–406

Opens a list of polynomial commitments at a desired point. This requires the list of original polynomials (`labeled_polynomials`) as well as the random values using by the Pedersen multi-commits during the commitment phase (`randomness`). Cf. sections "Square-root commitment scheme" and appendix A.2 from the reference article. # Panics Panics if - `rng` is None, since Hyrax requires randomness i

(
        ck: &Self::CommitterKey,
        labeled_polynomials: impl IntoIterator<Item = &'a LabeledPolynomial<G::ScalarField, P>>,
        commitments: impl IntoIterator<Item = &'a LabeledCommitment<

    /// - The number of variables of a polynomial doesn't match that of the
    /// point.
    fn open<'a>(
        ck: &Self::CommitterKey,
        labeled_polynomials: impl IntoIterator<Item = &'a LabeledPolynomial<G::ScalarField, P>>,
        commitments: impl IntoIterator<Item = &'a LabeledCommitment<Self::Commitment>>,
        point: &'a P::Point,
        sponge: &mut impl CryptographicSponge,
        states: impl IntoIterator<Item = &'a Self::CommitmentState>,
        rng: Option<&mut dyn RngCore>,
    ) -> Result<Self::Proof, Self::Error>
    where
        Self::Commitment: 'a,
        Self::CommitmentState: 'a,
        P: 'a,
    {
        let n = point.len();

        if n % 2 == 1 {
            // Only polynomials with an even number of variables are
            // supported in this implementation
            return Err(Error::InvalidNumberOfVariables);
        }

        let dim = 1 << n / 2;

        // Reversing the point is necessary because the MLE interface returns
        // evaluations in little-endian order
        let point_rev: Vec<G::ScalarField> = point.iter().rev().cloned().collect();

        let point_lower = &point_rev[n / 2..];
        let point_upper = &point_rev[..n / 2];

        // Deriving the tensors which result in the evaluation of the polynomial
        // when they are multiplied by the coefficient matrix.
        let l = tensor_prime(point_lower);
        let r = tensor_prime(point_upper);

        let mut proofs = Vec::new();

        let rng_inner = rng.expect("Opening polynomials requires randomness");

        for (l_poly, (l_com, state)) in labeled_polynomials
            .into_iter()
            .zip(commitments.into_iter().zip(states.into_iter()))
        {
            let label = l_poly.label();
            if label != l_com.label() {
                return Err(Error::MismatchedLabels {
                    commitment_label: l_com.label().to_string(),
                    polynomial_label: label.to_string(),
                });
            }

            let poly = l_poly.polynomial();
            let com = l_com.commitment();

            if poly.num_vars() != n {
                return Err(Error::MismatchedNumVars {
                    poly_nv: poly.num_vars(),