Opt : smaller proof size by using alternate randomness sampling approach

[ocdbytes]

Summary

• Implements zkWHIR 2.0 using the "Alternative Randomness Sampling" approach, replacing the previous per-round blinding strategy. Proof size drops from (μ+1)·q(δ) to (ν+1)·q(δ) field
  elements, where ν = ⌊μ/ℓ⌋ + 1 ≪ μ.
• Extracts shared WHIR round logic into whir/rounds.rs, deduplicating the fold-commit-sumcheck loop between base WHIR and zkWHIR.
• Adds open_at_indices / verify_at_indices to irs_commit for the Γ consistency check (opening at caller-provided codeword positions instead of transcript-sampled ones).

Design

Two WHIR instances run as sub-protocols:

1. Blinded polynomial (f̂ = f + msk(Φ₀)): standard WHIR rounds on f_zk = ρ·f + g, with a Γ consistency check verifying [[f̂]] openings match [[H]].
2. Blinding polynomial (M, ĝ₁..ĝ_ν): batched proof over ν + n committed vectors using weight covectors derived from beq tables.

Protocol steps:

1. Commitment — sample masking/blinding polynomials, commit both instances
2. Blinding claims — verifier sends β, prover sends G claims
3. Combination — verifier sends ρ ≠ 0, prover forms f_zk = ρ·f + g
4. Initial sumcheck on f_zk
5. OOD/STIR queries + remaining WHIR rounds (shared via rounds.rs)
6. Γ consistency check — verify [[f̂]] openings match [[H]] at FRI query indices
7. Batched blinding proof via second WHIR instance

Reference Issue : #230

Reference Doc : [ ZK WHIR updated params doc by @yswami-tfh ]

Metric	Previous Implementation	New Implementation	Change
Proof Size	3.2 MB	740 KB	-77%
Verifier Time	243 ms	136 ms	-44%

[codspeed-hq]

Merging this PR will not alter performance

✅ 10 untouched benchmarks
⏩ 22 skipped benchmarks¹

---

_{Comparing ocdbytes:aj/opt/proof-size (77340f3) with main (716b457)}

Footnotes

1. 22 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[Bisht13]

leak() regresses from the old code's saturating_mul/saturating_add to plain */+, which wrap silently in release mode. If any intermediate product wraps, q_ub becomes tiny, ℓ becomes too small, and ZK is compromised.

Both saturating_mul and saturating_add are const fn since Rust 1.47, so the fix is drop-in:

const fn leak(&self) -> usize {
    self.k.saturating_mul(self.q_delta.saturating_add(self.stir_delta))
        .saturating_add(self.t_delta)
        .saturating_add(self.ood_delta)
        .saturating_add((self.d + 1).saturating_mul(self.mu))
}

[Bisht13]

Same issue as leak(), use witness.leak().saturating_add(blinding.leak()).

[Bisht13]

This is debug_assert_ne!, which is stripped in release builds. The verifier uses verify!(rho != F::ZERO) which returns a proper error. If the astronomically unlikely rho == 0 happens in a release build, the prover would silently produce a broken proof. Consider assert_ne! for consistency.

[Bisht13]

All integration tests use num_variables = 12. Depending on derived ell, this may or may not produce rem = mu % ell != 0. Consider adding a test with parameters that force a non-zero rem (where Φ₀ and Φ₁ extract different bit windows) to exercise the uneven-tiling path end-to-end. The phi_i_bits unit tests cover the indexing, but no round-trip test confirms the full protocol when windows don't tile evenly.

[Bisht13]

discrete_log_pow2 computes gen.inverse() on every call. Since gen_h is the same for all gamma points, the inverse could be precomputed once and passed in (or discrete_log_pow2 could accept a precomputed inverse). Not a bottleneck at current query counts, but a free win.

[Bisht13]

The doc comment says "ν = ⌊μ/ℓ⌋ + 1 blinding polynomials" but the code variable nu = ⌊μ/ℓ⌋ (line 140). The code's nu is actually ν − 1 in this convention, and num_g_polys() = nu + 1 is the real count. The line 139 comment also calls nu the "number of blinding polynomials" which is off by one.

Suggest: change comment to // nu = ⌊mu/ell⌋ — highest blinding polynomial index (ν+1 = nu+1 total g-polynomials) and update the top doc to match.

[Bisht13]

Same naming issue as above, nu is used both as ⌊μ/ℓ⌋ here and as a subscript in ĝ₁..ĝ_ν in other comments, creating ambiguity about whether ν means nu or nu+1. Consider renaming to something unambiguous or adding a one-line clarification.

[Bisht13]

Comment says Mᵢ(ȳ,t) = ĝ₀(ȳ) + t·mskᵢ(ȳ) but the interleaving [g₀[k], mskᵢ[k]] gives MLE (1−t)·ĝ₀(ȳ) + t·mskᵢ(ȳ). No correctness impact (code works on raw vectors, not MLEs), but this will mislead anyone reasoning about the polynomial algebra.

[Bisht13]

The blinding instance InstanceLeak uses num_variables_main (μ) for the (d+1)·μ sumcheck term and borrows ood_delta from the blinded instance's IRS config. Both overestimate since the blinding polynomial actually has ℓ+1 variables and a smaller vector size. This is necessary (ℓ isn't known yet), but an iterative tightening pass could reduce ℓ/ν and shave proof size.

[Bisht13]

When rem = 0 (μ divisible by ℓ), Φ₀ and Φ₁ extract the same bit window (start = 0 for both). This wastes one blinding polynomial, g₁ adds no new bit coverage beyond g₀. ZK still holds (all μ bits covered by Φ₂..Φ_ν), but you could save one committed vector by special-casing rem = 0 to skip the duplicate projection.

[Bisht13]

Replaced with #239 and meant to lie in v1