Struct TranscriptReader 

pub struct TranscriptReader<F, T> {
    sponge: T,
    transcript: Transcript<F>,
    next_element: (usize, usize),
}

A TranscriptReader is typically created using a Transcript produced by a TranscriptWriter.

Its operation is similar to that of the writer, except that instead of an “append” operation, it provides a “consume” operation which returns the next field element that was appended to the circuit by the prover. The user of a TranscriptReader (typically that is the verifier) is responsible for running any checks (if necessary) to verify the validity of the consumed elements. The “squeeze” operation behaves similarly to that of a TranscriptWriter.

Consume/Squeeze operations on a TranscriptReader may return errors when an unexpected operation is requested. An operation can be unexpected if it doesn’t match the sequence of operations performed by the TranscriptWriter that produced the Transcript used in the initialization of the reader.

Fields

sponge: T

The sponge that this reader is wrapping around.

transcript: Transcript<F>

The transcript that this reader is using to consume elements from and verify the order of operations is valid.

next_element: (usize, usize)

An internal state representing the position of the next operation on the transcript.

Implementations

impl<F: Field, T: TranscriptSponge<F>> TranscriptReader<F, T>

fn consume_input_element(&mut self, label: &'static str) -> Result<F>

Reads off a single input element from the transcript and returns it if it exists. Note that this is identical to TranscriptReader::consume_element(), but using Operation::AppendInput rather than Operation::Append. Note that this function should not be called externally!

The operation can fail with:

• TranscriptReaderError::ConsumeInputError: if there are no more elements to consume or if a squeeze or non-input consume was expected.

label is as described in the other TranscriptReader functions.

fn consume_input_hash_chain_digest_element( &mut self, label: &'static str, ) -> Result<F>

Reads off a single element from the hash chain digest elements in an input commitment and returns it if it exists. Note that this function should not be called externally!

impl<F: Debug, Tr: TranscriptSponge<F>> TranscriptReader<F, Tr>

pub fn new(transcript: Transcript<F>) -> Self

Generate a new TranscriptReader to operate on a given transcript.

fn advance_indices(&mut self) -> Result<()>

Internal method used to advance the internal state to the next operation.

Trait Implementations

impl<F: Field, T: TranscriptSponge<F>> VerifierTranscript<F> for TranscriptReader<F, T>

fn consume_element(&mut self, label: &'static str) -> Result<F>

Reads off a single element from the transcript and returns it if successful. The operation can fail with:

• TranscriptReaderError::ConsumeError: if there are no more elements to consume or if a squeeze was expected.

The label is used for sanity checking against the label that was used by the TranscriptWriter for the corresponding operation. If the labels don’t match, a trace warning message is produced, but the caller is not otherwise notified of this discrepancy.

fn consume_elements( &mut self, label: &'static str, num_elements: usize, ) -> Result<Vec<F>>

A multi-element version of the consume_element method. Reads off a sequence of num_elements elements from the transcript and returns a vector of them if successful. The operation can fail with:

• TranscriptReaderError::ConsumeError: if less than num_elements elements remain in the transcript or if a squeeze operation was expected to occur at any point before the consumption of num_elements elements.

The label is used for sanity checking against the label that was used by the TranscriptWriter for the corresponding operations. In particular, the TranscriptWriter may have appended either a sequence of elements using TranscriptWritter::append_elements or may have called TranscriptWritter::append multiple times. Both scenarios are valid and in both cases, label should match with the corresponding labels used on the writer side. If there is a label mismatch for any of the num_elements elements, a trace warning message is produced, but the caller is not otherwise notified of this discrepancy.

fn consume_input_elements( &mut self, label: &'static str, num_elements: usize, ) -> Result<(Vec<F>, Vec<F>)>

Reads off input elements from the transcript and returns them, alongside their hash chain digest, if successful. The operation can fail with:

• TranscriptReaderError::ConsumeInputError: if there are no more elements to consume or if a squeeze or non-input consume was expected.

label is as described in the other TranscriptReader functions.

fn get_challenge(&mut self, label: &'static str) -> Result<F>

Squeezes the sponge once and returns a single element if successful. The operation can fail with:

• TranscriptReaderError::SqueezeError: if a squeeze is requested at a time when either a consume operation was expected or no more operations were expected.

The label is used for sanity checking against the label that was used by the TranscriptWriter for the corresponding operation. If the labels don’t match, a trace warning message is produced, but the caller is not otherwise notified of this discrepancy.

fn get_challenges( &mut self, label: &'static str, num_elements: usize, ) -> Result<Vec<F>>

Squeezes the sponge num_elements times and returns a vector of the resulting elements if successful. The operation can fail with:

• TranscriptReaderError::SqueezeError: if any of the squeeze operations requested does not correspond to a squeeze operation performed by the TranscriptWriter that produced the transcript.

The label is used for sanity checking against the label that was used by the TranscriptWriter for the corresponding operations. In particular, the TranscriptWriter may have squeezed either a sequence of elements using TranscriptWriter::get_challenges or may have called TranscriptWriter::get_challenge multiple times. Both scenarios are valid and in both cases, label should match with the corresponding labels used on the writer side. If there is a label mismatch for any of the num_elements elements, a trace warning message is produced, but the caller is not otherwise notified of this discrepancy.