4a0b48588c
Aere Network public source. Everything here can be checked against the live chain (chain id 2800, https://rpc.aere.network). Scope note, stated up front rather than buried: consensus on chain 2800 is classical secp256k1 ECDSA QBFT. The post-quantum work in this repository is at the signature, precompile, account and transport layers. Nothing here makes the consensus post-quantum, and no document in it should be read as claiming so.
60 lines
5.1 KiB
JSON
60 lines
5.1 KiB
JSON
{
|
|
"component": "FRI low-degree test / query verification over BabyBear (port spec component (d))",
|
|
"precompile": "0x0000000000000000000000000000000000000ae8",
|
|
"scope": "port spec section 5; the FRI verifier's FOLD + OPENING relations (verify_query / verify_challenges): arity-2 folding in F_{p^4}, per-layer MMCS openings against the commit-phase roots, down to a single constant equal to the committed final polynomial.",
|
|
"validates": "CONFORMANCE: real FRI proofs emitted by the pinned Plonky3 p3-fri 0.4.3-succinct PROVER (and accepted by its own verifier) are re-verified byte-for-byte by this reference (accept), and four tamper variants are rejected (corrupted opened value, corrupted MMCS sibling digest, wrong fold challenge beta, non-matching final poly); Python/Node/Java produce byte-identical per-query folded values.",
|
|
"does_not_validate": "the SP1 recursion-AIR constraint evaluation (component (e)), which supplies the reduced openings and is UN-PORTED. Within THIS FRI KAT the betas / query indices are supplied as inputs; deriving them in-circuit is component (f) (the duplex-sponge challenger), now CONFIRMED separately (test_challenger.py), whose derived betas/indices close the loop into this verify_query.",
|
|
"top_level_verifier": "unchanged, still FAIL-CLOSED (returns EMPTY for every input). Even with the FRI fold+opening (d) and the challenger (f) confirmed, StarkConstraints.evaluateAtZeta=UNAVAILABLE (component (e)), so verify() never reaches ACCEPT and computePrecompile returns EMPTY. ACCEPT is unreachable. DO NOT ACTIVATE.",
|
|
"confirmed_config": {
|
|
"folding_arity": 2,
|
|
"sibling_rule": "index_sibling = index ^ 1, index_pair = index >> 1 (p3-fri verifier.rs)",
|
|
"num_fold_rounds": "log_max_height - log_blowup (final poly is a single F_{p^4} CONSTANT)",
|
|
"log_max_height": "commit_phase_commits.len() + log_blowup",
|
|
"commit_phase_mmcs": "ExtensionMmcs<Val,Challenge,ValMmcs> over the CONFIRMED FieldMerkleTreeMmcs (component (c)); a commit-phase leaf is a pair of F_{p^4} evals flattened to 8 BabyBear coords, hashed by the PaddingFreeSponge",
|
|
"coset_point": "x = two_adic_generator(log_max_height)^reverse_bits_len(index, log_max_height), in F_{p^4}; the sibling point is -x (two_adic_generator(1))",
|
|
"fold_relation": "folded = e0 + (beta - x0) * (e1 - e0) / (x1 - x0) (linear interpolation through beta), plus reduced_openings[log_folded_height+1] injected before each fold",
|
|
"final_poly_check": "every query's folded constant must equal proof.final_poly"
|
|
},
|
|
"confirmed_by_kat": [
|
|
"CONFIRMED arity-2 fold (sibling=index^1, index_pair=index>>1) vs p3-fri verifier.rs",
|
|
"CONFIRMED num_fold_rounds = log_max_height - log_blowup; final poly is a single F_{p^4} constant",
|
|
"CONFIRMED reverse_bits_len index-to-coset-point mapping (x = g^rev(index))",
|
|
"CONFIRMED two_adic_generator(bits) matches Plonky3 (the fold coset points are correct)",
|
|
"CONFIRMED the F_{p^4} non-residue W = 11 is Plonky3's (the EF fold arithmetic reproduces the fold)",
|
|
"CONFIRMED the ExtensionMmcs flatten (each F_{p^4} eval -> 4 base coords, pair -> 8) + base MMCS open"
|
|
],
|
|
"cross_language": [
|
|
"java",
|
|
"node",
|
|
"python"
|
|
],
|
|
"conformance": {
|
|
"status": "CONFIRMED (real known-answer test PASSED: accept genuine + reject tampered)",
|
|
"method": "pq-stark/fri-extractor (a Rust binary depending on the pinned crates; lockfile checksums matched) ran p3_fri::prover::prove over known low-degree codewords with the seed_from_u64(1) Poseidon2, then p3_fri::verifier::{verify_shape_and_sample_challenges,verify_challenges} to confirm the library accepts; its output is fri_ground_truth.json",
|
|
"cases": [
|
|
"blowup1_h6_q4",
|
|
"blowup2_h7_q5",
|
|
"blowup1_h8_q6"
|
|
]
|
|
},
|
|
"pinned_conformance_target": {
|
|
"revision": "Succinct Plonky3 fork, crates.io version 0.4.3-succinct",
|
|
"p3_fri_checksum": "5cbc4965ee488f3247867b7ec4bb005b8afa72cb0d461a4dcb1387ecab6426d5",
|
|
"p3_challenger_checksum": "b6a908924d43e4cfb93fb41c8346cac211b70314385a9037e9241f5b7f3eaf77",
|
|
"p3_dft_checksum": "be6408b10a2c27eb13a7d5580c546c2179a8dc7dbc10a990657311891f9b41c0",
|
|
"p3_commit_checksum": "50acacc7219fce6c01db938f82c1b21b5e7133990b7fff861f91534aeb569419",
|
|
"found_in": "aerenew/zk-circuits/*/Cargo.lock and aerenew/rollup-evm-validity/*/Cargo.lock"
|
|
},
|
|
"flags": [
|
|
"[VERIFY]->CONFIRMED here: arity-2 fold, num_fold_rounds, reverse-bits mapping, two_adic_generator, W=11 (all exercised by the accept-KAT over the pinned p3-fri proof)",
|
|
"[MEASURE] conformance against a REAL exported SP1 v6.1.0 inner proof's FRI section (needs the exported proof + the AIR reduced-openings, component (e))",
|
|
"component (f) transcript binding is now CONFIRMED (Challenger.spongePorted=true; the derived betas/indices close the loop into this verify_query, see test_challenger.py). The top level stays fail-closed on the AIR (component (e), StarkConstraints=UNAVAILABLE)"
|
|
],
|
|
"notes": [
|
|
"CONFORMANCE: 3 FRI proofs from the pinned p3-fri 0.4.3-succinct prover accepted; 4 tamper variants each rejected (opening, MMCS proof, beta, final poly)",
|
|
"cross-language implementations compared: java, node, python"
|
|
],
|
|
"passed": 55,
|
|
"failed": 0,
|
|
"total": 55
|
|
} |