blake3: slot-align the message and domain witness regions#16
Open
gopikannappan wants to merge 1 commit into
Open
blake3: slot-align the message and domain witness regions#16gopikannappan wants to merge 1 commit into
gopikannappan wants to merge 1 commit into
Conversation
Re-order the block layout so every externally meaningful region sits on a 256-bit slot boundary: cv (slot 0), out_lo (slot 1), the two message halves (slots 2-3), and one domain slot holding t, blen, flags and the z-constant, all protocol constants. GS region moves to the next slot boundary. Costs 127 padding bits per block (0.78 percent of the 2^14 block), changes no circuit semantics: all 22 blake3 tests pass, including the compress-vs-blake3-crate cross-checks and proof round-trips. Motivation: aligned regions are addressable by structured MLE claim points (tau_pos, slot selector, instance), which lets downstream users attach wiring claims to cv/out/m without a bit-offset fold. Needed for sound BLAKE3 signature aggregation in flock-xmss; the domain slot also becomes pinnable, closing the t/blen/flags binding gap. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
gopikannappan
added a commit
to gopikannappan/flock-xmss
that referenced
this pull request
Jul 6, 2026
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Re-orders the BLAKE3 compression witness layout so every externally meaningful
region starts on a 256-bit slot boundary:
CV_BASE(input)OUT_LO_BASE(output)M_BASE(message, 2 slots)T_LO/T_HI/BLEN/FLAGS/z-const)GS_BASE(g-function work)This is purely a change of base offsets. All bit placement still goes through
the existing
*_bitaccessors, so the R1CS and the compression semantics areunchanged.
USEFUL_BITSgrows from 15,409 to 15,536, still well underK = 2^14.Why
The current layout puts the message region at bit 513, one bit past a slot
boundary (it shares slot 2 with the single z-constant wire). That off-by-one
means the message region cannot be addressed by a structured MLE claim point of
the form
(tau_pos, slot selector, instance)— the same shape SHA-256 alreadysupports, where cv/out/message all sit on 256-bit boundaries.
Aligning the message region (and collecting the domain fields into one aligned,
all-constant slot) lets a downstream protocol open the BLAKE3 witness with the
same slot-addressed claims it already uses for SHA-256. Concretely this is what
let me add a sound cross-instance wiring layer (XMSS chain links, Merkle path,
domain pinning) on top of the batch prover for BLAKE3, matching the SHA-256
path, at ~7% prover overhead. Repo: https://github.com/gopikannappan/flock-xmss
The domain slot
[T_LO_BASE, GS_BASE)now holds only protocol constants(counter, block length, flags, z-const, zero padding), so it can be pinned to a
constant as a whole — useful for enforcing BLAKE3 domain separation.
Test
layout_constantsis updated to assert the new offsets and that everyclaim-addressable region is 256-bit aligned. Full
flock-proverBLAKE3 suitepasses (22 tests). No change to any non-BLAKE3 path.