WHIR

 

tl;dr: Notes on WHIR1.

$ \def\L{\mathcal{L}} \def\RS{\mathsf{RS}} \def\CRS{\mathsf{CRS}} $

Unstructured notes

A Reed-Solomon (RS) code is defined as a set of functions such that, for each function $f$ in the set, there exists a degree $< 2^\term{m}$ univariate polynomial $\hat{f}(X)$ such that $f(x) = \hat{f}(x),\forall x\in\term{\L}$ (a.k.a., $f$ and $\hat{f}$ “agree” over $\L$). $\emph{\L}$ here is the evaluation domain of size $\term{n}$.

More formally: \begin{align} \term{\RS[\F,\L,m]} &\bydef \left\{ f : \L\rightarrow F\ \middle|\ \exists \hat{f} \in \F^{<2^m}[X]\ \text{s.t.}\ f(x) = \hat{f}(x),\forall x\in\L\right\} \end{align}

Alternatively, the definition can require that the polynomial $\hat{f}$ be multilinear: \begin{align} \emph{\RS[\F,\L,m]} &\bydef \left\{ f : \L\rightarrow F\ \middle|\ \exists \hat{f} \in \F^{\le 1}[X_1,\ldots,X_m]\ \text{s.t.}\ f(x) = \hat{f}\left(x^{2^0},x^{2^1},\ldots,x^{2^{m-1}}\right),\forall x\in\L\right\} \end{align}

I find both these definition annoying. I think of the “code” as the encoding function with an input message space (i.e., $\F^{<2^m}[X]$) and an output codeword space (i.e., $\F^n$). They seem to be defining the “code” as the set of codewords, by viewing the functions $f$ as size-$n$ vectors $f(x_1),\ldots,f(x_n)$ where $\L \bydef (x_i)_{i\in[n]}$.

References

For cited works, see below 👇👇

  1. WHIR: Reed–Solomon Proximity Testing with Super-Fast Verification, by Gal Arnon and Alessandro Chiesa and Giacomo Fenzi and Eylon Yogev, in Cryptology {ePrint} Archive, Paper 2024/1586, 2024, [URL]