Skip to content

zorch.pcs.stage

The polynomial-commitment seam as a committer plus a terminal stage.

A PCS is two things wearing one name: commit runs before any claim exists, so it reduces nothing, while opening is a claim reduction in everything but name.

Keep the halves apart. Merging them would put a KZG prover key — O(degree), against an O(1) verifier key — within reach of a deployed verifier.

Committer

Bases: Protocol[C_co, D_co]

Bind to a batch of polynomials, creating the object later claims are about. Holds the proving material, so a verifier never constructs one.

Source code in zorch/pcs/stage.py 
28
29
30
31
32
33
34
35
class Committer(Protocol[C_co, D_co]):
    """Bind to a batch of polynomials, creating the object later claims are
    about. Holds the proving material, so a verifier never constructs one."""

    def commit(self, polys: Sequence[Array]) -> tuple[C_co, D_co]:
        """Return the commitment sent to the verifier and the prover data
        retained for the opening."""
        ...

commit 

commit(polys: Sequence[Array]) -> tuple[C_co, D_co]

Return the commitment sent to the verifier and the prover data retained for the opening.

Source code in zorch/pcs/stage.py 
32
33
34
35
def commit(self, polys: Sequence[Array]) -> tuple[C_co, D_co]:
    """Return the commitment sent to the verifier and the prover data
    retained for the opening."""
    ...

OpeningClaim dataclass

Bases: Generic[Commitment]

The committed polynomials evaluate at points.

No values: the prover computes them while opening, so a claim naming them would be one neither role could construct before the fact.

Source code in zorch/pcs/stage.py 
38
39
40
41
42
43
44
45
46
47
@dataclass(frozen=True)
class OpeningClaim(Generic[Commitment]):
    """The committed polynomials evaluate at `points`.

    No values: the prover computes them while opening, so a claim naming them
    would be one neither role could construct before the fact.
    """

    commitment: Commitment
    points: Sequence[Array]

OpeningWitness dataclass

Bases: Generic[ProverData]

The prover data commit retained; prover-only, hence not in the claim.

Source code in zorch/pcs/stage.py 
50
51
52
53
54
@dataclass(frozen=True)
class OpeningWitness(Generic[ProverData]):
    """The prover data `commit` retained; prover-only, hence not in the claim."""

    prover_data: ProverData

CommittingOpener

Bases: Protocol[Commitment, ProverData, P_co]

A committer that also opens — what a consumer holding both halves needs.

Structural, because "commits and opens" is a conjunction of two independent contracts and Python cannot spell their intersection nominally. A scheme still subclasses ProverStage for the opening itself; this only names the pair for call sites like Spartan that commit and later open.

Source code in zorch/pcs/stage.py 
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
class CommittingOpener(Protocol[Commitment, ProverData, P_co]):
    """A committer that also opens — what a consumer holding both halves needs.

    Structural, because "commits and opens" is a conjunction of two independent
    contracts and Python cannot spell their intersection nominally. A scheme
    still subclasses `ProverStage` for the opening itself; this only names the
    pair for call sites like Spartan that commit and later open.
    """

    def commit(self, polys: Sequence[Array]) -> tuple[Commitment, ProverData]: ...

    def prove(
        self,
        claim: OpeningClaim[Commitment],
        witness: OpeningWitness[ProverData],
        transcript: Any,
    ) -> Any: ...

OpeningProof dataclass

Bases: Generic[Proof]

The claimed evaluations and the scheme's opening proof for them.

Source code in zorch/pcs/stage.py 
76
77
78
79
80
81
@dataclass(frozen=True)
class OpeningProof(Generic[Proof]):
    """The claimed evaluations and the scheme's opening proof for them."""

    values: Array
    proof: Proof