Expand description
Multi-point evaluation subprotocol.
Reduces MLE evaluation claims at a shared point r’ - the “up” evaluations
v_j(r'), the “down” (shifted) evaluations v_j^{down}(r'), and optional
bit-op virtual evaluations - to a single set of standard MLE evaluation
claims at a new random point r_0 via one sumcheck.
The trace column MLEs are precombined into a single MLE
precombined(b) = \sum_j \gamma_j * v_j(b) + \sum_l \gamma_l^bit * bit_op_l(b)
before entering the sumcheck, so the prover works with only 3 MLE groups
(eq, next, precombined) regardless of the number of columns. The
sumcheck proves:
\sum_b [eq(b, r') * (\sum_j \gamma_j * v_j(b)
+ \sum_l \gamma_l^bit * bit_op_l(b))
+ \sum_k \alpha_k * next_{c_k}(r', b) * v_{src_k}(b)]
= \sum_j \gamma_j * up_eval_j
+ \sum_l \gamma_l^bit * bit_op_eval_l
+ \sum_k \alpha_k * down_eval_kwhere \alpha_k batch the per-shift evaluation kernels and \gamma_j
batch across columns. After the sumcheck reduces to point r_0, the
verifier calls MultipointEval::verify_subclaim with the committed-column
open_evals and the verifier-derived bit_op_open_evals to check the
final consistency equation. For bit-op virtuals, those open evaluations are
derived from source lifted openings via Lemma 2.3 rather than trusted as
independent witness openings.
This corresponds to the T=2 case of Pi_{BMLE} in the paper. Following the paper, the prover sends only the polynomial-valued lifted evaluations (alpha’_j in F_q[X]); the scalar open_evals are derived by the verifier via \psi_a rather than being sent as a separate proof element.
Structs§
- Multipoint
Eval - Multipoint
Eval Family Inputs - Per-family inputs to the lockstep multi-point evaluation protocol, those that aren’t shared between families.
- Proof
- Proof for the multi-point evaluation protocol.
- Prover
State - Prover state after the multi-point evaluation protocol for one constraint family.
- Subclaim
- Verifier subclaim after the multi-point evaluation sumcheck for one constraint family.