Zook : Protocol Wiring

[ocdbytes]

Summary

Adds the Zook zero-knowledge protocol (Construction 9.7) end-to-end, along with the supporting protocol and parameter-selection changes it needs. Added adaptive rate planning for optimised proving schedule.

Changes

• Zook protocol (protocols/zook/) : new module implementing the Construction 9.7 ZK flow: commit → per-round (sumcheck → code-switch → mask discharge) → basecase, closed out via FinalClaim.
• Code-switch : threads a mutable Claim { covector, sum } keeping μ == ⟨vector, covector⟩ across rounds; adds verify_for_implicit/CovectorUpdateParams for implicit covector accumulation.
• Mask proximity : per-mask discharge (mask_contribution_covectors) running the Construction 7.2 target check, with claims bound before γ.
• NTT : masks moved out of the engine: interleaved_encode is now a pure encoder over message ‖ mask slices (&[&[F]] → Buffer<F>); drops the Messages/masks API.
• Adaptive rate scheduling (params/) : new RateSchedule (Stepping/Capped/Adaptive) and a Pareto-knee planner (adaptive.rs) choosing per-round inverse rates under the security target.
• Buffer : adds wipe() (zeroize secret buffers) and into_vec() (zero-copy readback for in-place sumcheck/basecase folds).
• Mask Machinery : adds a proper mask discharge and generate machinery.

Zook protocol flow

flowchart TD
    A["commit(witness)<br/>→ CommittedWitness"] --> B["γ ← verifier<br/>(RLC challenge)"]
    B --> C["covector = Σ γ·formⱼ<br/>sum = Σ γ·evalⱼ"]
    C --> D{"CommittedState?"}

    D -->|Basecase-only| BC
    D -->|Round| L

    subgraph L["per round: reduce (message, covector, sum)"]
        direction TB
        R0["RoundMaskOracle::begin<br/>sample + commit sumcheck-mask tree"]
        R1["sumcheck.prove(message, covector, sum, blinding)<br/>→ opening (round challenges)"]
        R2["bind_code_switch_mask<br/>build cs_mask, commit, send mask_eval_sum<br/>reconcile sum → unmasked dot"]
        R3["extend covector for ZK mask region"]
        R4["code_switch.prove(message, irs_witness,<br/>Claim{covector, sum}, challenges, cs_mask)<br/>→ cs_witness"]
        R5["masker.finish<br/>prove both mask trees<br/>subtract cs_mask contribution from sum"]
        R6["message ← cs_witness.message<br/>irs_witness ← cs_witness.target_witness<br/>truncate covector"]
        R0 --> R1 --> R2 --> R3 --> R4 --> R5 --> R6
    end

    L -->|"loops over self.rounds()<br/>invariant: sum == ⟨message, covector⟩"| BC

    BC["basecase.prove(message, witness, covector, sum)"] --> F["FinalClaim<br/>verifier checks:<br/>scale · Σ rlcⱼ · formⱼ(eval_pt) == contribution"]

Loading

[codspeed-hq]

Merging this PR will not alter performance

✅ 10 untouched benchmarks
⏩ 22 skipped benchmarks¹

---

_{Comparing ocdbytes:aj/zk-whir-3-4 (271b11c) with main (6251d42)}

Footnotes

1. 22 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩