BCHKS integration and RBR grinding

[hecmas]

BCHKS

The new results from BCHKS are not yet correctly integrated.

In particular, their new theorem states that:

which implies that we must include the new linear terms as well.

They also show that:

meaning that there are no restrictions on the weights, which simplifies things significantly for the commit phases soundness.

Therefore, at a minimum, both the batch and commit formulas should be updated to incorporate these changes.

New FRI soundness bounds:

$$ \epsilon_{\text{FRI}} = \max\left\{\underbrace{2^{-z_{\text{B}}} \cdot \left(\ell - 1\right) \cdot \overbrace{\frac{2\left(m + \frac{1}{2}\right)^5 + 3\left(m + \frac{1}{2}\right) \rho}{3\rho^{3/2}} \cdot \frac{|D|}{|\mathbb{K}|}}^{\epsilon}}_{\epsilon_{\text{Batch}}}, \left\{\underbrace{2^{-z_{\text{C}_i}} \cdot (t_i - 1) \prod_{j=1}^i t_j^{-1} \cdot \epsilon}_{\epsilon_{\text{Commit}_i}}\right\}_{i=1}^r,\underbrace{2^{-z_{\text{Q}}} \cdot \left(1 - \gamma \right)^s}_{\epsilon_{\text{Query}}}\right\} $$

where:

• $\mathbb{F}$ is a finite field.
• $\mathbb{K}$ is an extension over $\mathbb{F}$.
• $D$ is a subgroup of $\mathbb{F}$.
• $H$ is a subgroup of $D$.
• $\rho = \frac{|H|}{|D|}$ is the rate of the code.
• $\gamma \in (0, 1 - \sqrt{\rho})$ is the proximity parameter.
• $m$ is the multiplicity parameter (a positive integer) of the Guruswami–Sudan list decoder.
• $\ell$ is the number of polynomials subject to the batching.
• $r$ is the number of foldings in the commit phase of FRI.
• $t_i$ is the $i$-th FRI folding factor, for $i=1,\dots,r$.
• $s$ is the number of queries in the query phase of FRI.
• $z_X$ is the number of grinding bits at phase "X" of FRI.

Remark 1: Note that we can rewrite the paper's bound as:

$$ M \cdot \left(\frac{2\left(m + \frac{1}{2}\right)^5 + 3\left(m + \frac{1}{2}\right) \gamma \rho}{3\rho^{3/2}} \cdot n + \frac{m + \frac{1}{2}}{\sqrt{\rho}} \right) = M \cdot \left(\frac{2\left(m + \frac{1}{2}\right)^5}{3\rho^{3/2}} \cdot n + \frac{\left(m + \frac{1}{2}\right)}{\sqrt{\rho}} \cdot (\gamma \cdot n + 1) \right) $$

and replace $\gamma \cdot n + 1$ by simply $n$, implying a slightly smaller bound (the bound is dominated by $n$). I've discussed this with the paper's author Ulrich and we both agree that proofs also hold for this modified bound.

Remark 2: For the commit phase bounds, notice that the domain $|D_i|$ for the $i$-th commit phase can be obtained as:

$$ |D_i| = \frac{|D|}{\prod_{j=1}^{i}t_i} $$

RBR Grinding

On a different topic, I think we should also consider supporting grinding in all phases, which I like to call round-by-round grinding, not only in the query phase. This becomes very important if we want to achieve tight bounds on the number of bits of security. Restricting grinding to the query phase alone may leave unnecessary slack, especially now that the updated bounds from BCHKS make the other phases more dominant in some parameter regimes.

[asn-d6]

This PR is in a bit of a pickle, due to the major refactoring that happened in #20 and #22.

So at this point, many changes of this PR seem no longer applicable:

• We now have better handling of per-round commit phase error
• We have integrated all the circuits of ZisK

However, we should still integrate the more precise BCHKS bounds: https://github.com/ethereum/soundcalc/pull/23/files#diff-3406d4a5489bddf237a94a2bd8a134b6b48ff0a9c7c77818e7b6348d9e2da5adR84

I will do this in a separate ticket, and close this one.

Hope that's OK! Thanks!