shared_types/

transcript.rs

//! Types for modeling and interacting with a transcript sponge when applying the
//! Fiat-Shamir transformation on a an interactive protocol.

use std::fmt::Display;

use serde::{Deserialize, Serialize};
use thiserror::Error;
use tracing::warn;
use utils::sha256_hash_chain_on_field_elems;

use crate::Field;
use std::fmt::Debug;

pub mod counting_transcript;
pub mod ec_transcript;
pub mod keccak_transcript;
pub mod poseidon_sponge;
pub mod test_transcript;
mod utils;

use anyhow::{anyhow, Result};

/// A `TranscriptSponge` provides the basic interface for a cryptographic sponge
/// operating on field elements. It is typically used for representing the
/// transcript of an interactive protocol turned non-interactive view
/// Fiat-Shamir.
pub trait TranscriptSponge<F>: Clone + Send + Sync + Default + Debug {
    /// Absorb the initialization label.
    fn absorb_initialization_label(&mut self, label: &str);

    /// Absorb a single field element `elem`.
    fn absorb(&mut self, elem: F);

    /// Absorb a list of field elements sequentially.
    fn absorb_elements(&mut self, elements: &[F]);

    /// Generate a field element by squeezing the sponge. Internal state is
    /// modified.
    fn squeeze(&mut self) -> F;

    /// Generate a sequence of field elements by squeezing the sponge
    /// `num_elements` times. Internal state is modified.
    fn squeeze_elements(&mut self, num_elements: usize) -> Vec<F>;
}

/// Describes an elementary operation on a transcript.
#[derive(PartialEq, Clone, Debug, Serialize, Deserialize)]
enum Operation<F> {
    /// An append operation consists of a label (used for debugging purposes)
    /// and a vector of field elements to be appended in order to the
    /// transcript.
    Append(String, Vec<F>),

    /// An `AppendInput` operation consists of the same things as an `Append`
    /// operation, alongside the circuit-expensive hash (typically instantiated
    /// with e.g. SHA-256) of the elements which are to be appended.
    ///
    /// Note that this is to defend against attacks of the form written about
    /// within <https://eprint.iacr.org/2025/118>.
    AppendInput(String, Vec<F>, Vec<F>),

    /// A squeeze operation consists of a label (used for debugging purposes)
    /// and a counter of how many elements are to be squeezed from the sponge.
    Squeeze(String, usize),
}

/// A type used for storing an immutable version of the transcript.
/// A `Transcript` is typically generated by the prover using a
/// `TranscriptWriter`, and is then serialized and saved on disk as part of the
/// generated proof. The verifier de-serializes the transcript and can access it
/// through the `TranscriptReader` interface.
#[derive(PartialEq, Clone, Serialize, Deserialize, Debug)]
pub struct Transcript<T> {
    /// A label used to identify this transcript. Used for debugging purposes.
    label: String,

    /// The content of the transcript represented as a sequence of operations
    /// used to generate it.
    operations: Vec<Operation<T>>,
}

impl<F: Clone> Transcript<F> {
    /// Create an empty transcript with identifier `label`.
    pub fn new(label: &str) -> Self {
        Self {
            label: String::from(label),
            operations: vec![],
        }
    }

    /// Record the operation of appending `elements` in the sponge.
    /// `label` is an identifier for this operation that can be used for sanity
    /// checking by the verifier.
    pub fn append_elements(&mut self, label: &str, elements: &[F]) {
        self.operations
            .push(Operation::Append(String::from(label), elements.to_vec()));
    }

    /// Record the operation of appending circuit input `elements` into the
    /// sponge. `label` is the same as that within [Transcript::append_elements()],
    /// and `elements_hash` is the hash chain of `elements`, computed in such
    /// a way that the GKR circuit cannot emulate such a hash chain.
    pub fn append_input_elements(
        &mut self,
        label: &str,
        elements: &[F],
        elements_hash_chain_digest: &[F],
    ) {
        self.operations.push(Operation::AppendInput(
            String::from(label),
            elements.to_vec(),
            elements_hash_chain_digest.to_vec(),
        ));
    }

    /// Record the operation of squeezing `num_elements` from the sponge.
    /// `label` is an identifier for this operation that can be used for sanity
    /// checking by the verifier.
    pub fn squeeze_elements(&mut self, label: &str, num_elements: usize) {
        self.operations
            .push(Operation::Squeeze(String::from(label), num_elements));
    }
}

impl<F: Debug> Display for Transcript<F> {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        self.operations.iter().try_for_each(|op| match op {
            Operation::Append(label, elements) => {
                writeln!(f, "Append: \"{}\" with {} elements", label, elements.len())
            }
            Operation::Squeeze(label, num_elements) => {
                writeln!(f, "Squeeze: \"{label}\" with {num_elements} elements")
            }
            Operation::AppendInput(label, elements, elements_hash_chain_digest) => {
                writeln!(
                    f,
                    "Append input: \"{}\" with {} elements and digest {:?}",
                    label,
                    elements.len(),
                    elements_hash_chain_digest
                )
            }
        })
    }
}

pub trait ProverTranscript<F> {
    fn append(&mut self, label: &str, elem: F);

    fn append_elements(&mut self, label: &str, elements: &[F]);

    fn append_input_elements(&mut self, label: &str, elements: &[F]);

    fn get_challenge(&mut self, label: &str) -> F;

    fn get_challenges(&mut self, label: &str, num_elements: usize) -> Vec<F>;
}

/// The prover-side interface for interacting with a transcript sponge. A
/// `TranscriptWriter` acts as a wrapper around a `TranscriptSponge` and
/// additionally keeps track of all the append/squeeze operations to be able to
/// generate a serializable `Transcript`.
pub struct TranscriptWriter<F, T> {
    /// The sponge that this writer is using to append/squeeze elements.
    sponge: T,

    /// A mutable transcript which keeps a record of all the append/squeeze
    /// operations.
    transcript: Transcript<F>,
}

impl<F: Field, Tr: TranscriptSponge<F>> ProverTranscript<F> for TranscriptWriter<F, Tr> {
    /// Append an element to the sponge and record the operation to the
    /// transcript. `label` is an identifier for this operation and is used for
    /// sanity checking by the `TranscriptReader`.
    fn append(&mut self, label: &str, elem: F) {
        self.sponge.absorb(elem);
        self.transcript.append_elements(label, &[elem]);
    }

    /// Append a slice of elements to the sponge sequentially and record the
    /// operation on the transcript. If `elements` is the empty slice, the
    /// operation is *not* recorded.
    /// `label` is an identifier for this operation
    /// and is used for sanity checking by the `TranscriptReader`.
    fn append_elements(&mut self, label: &str, elements: &[F]) {
        if !elements.is_empty() {
            self.sponge.absorb_elements(elements);
            self.transcript.append_elements(label, elements);
        }
    }

    /// Squeezes the sponge once to get an element and records the squeeze
    /// operation on the transcript.
    /// `label` serves as sanity-check identifier by the `TranscriptReader`.
    fn get_challenge(&mut self, label: &str) -> F {
        let challenge = self.sponge.squeeze();
        self.transcript.squeeze_elements(label, 1);
        challenge
    }

    /// Squeezes the sponge `num_elements` times to get a sequence of elements
    /// and records the operation on the transcript. If `num_elements == 0`, the
    /// empty vector is returned and the operation is *not* recorded on the
    /// transcript.
    /// `label` serves as sanity-check identifier by the `TranscriptReader`.
    fn get_challenges(&mut self, label: &str, num_elements: usize) -> Vec<F> {
        if num_elements == 0 {
            vec![]
        } else {
            let challenges = self.sponge.squeeze_elements(num_elements);
            self.transcript.squeeze_elements(label, num_elements);
            challenges
        }
    }

    /// A function which MUST be used on circuit inputs as an additional
    /// deterrant against the attack specified in <https://eprint.iacr.org/2025/118>,
    /// by absorbing H(H(H(...H(x)...))) into the `Transcript`, where `x` is
    /// a circuit input and `H` is the hash function defined in the below field.
    fn append_input_elements(&mut self, label: &str, elements: &[F]) {
        if !elements.is_empty() {
            // First, compute the hash chain digest of `elements`.
            let elements_hash_chain_digest = sha256_hash_chain_on_field_elems(elements);

            // Append the operation to the internal `Transcript` object.
            self.transcript
                .append_input_elements(label, elements, &elements_hash_chain_digest);

            // Absorb a series of elements as an input commitment, i.e. FIRST absorb a
            // the elements normally, and NEXT the hash chain of the sequence of elements.
            self.sponge.absorb_elements(elements);
            self.sponge.absorb_elements(&elements_hash_chain_digest);
        }
    }
}

impl<F: Field, Tr: TranscriptSponge<F>> TranscriptWriter<F, Tr> {
    /// Destructively extract the transcript produced by this writer.
    /// This should be the last operation performed on a `TranscriptWriter`.
    pub fn get_transcript(self) -> Transcript<F> {
        self.transcript
    }

    /// Creates an empty sponge.
    /// `label` is an identifier and will be absorbed into the
    /// transcript upon intialization.
    pub fn new(label: &str) -> Self {
        let mut new_sponge = Self {
            sponge: Tr::default(),
            transcript: Transcript::new(label),
        };
        new_sponge.sponge.absorb_initialization_label(label);
        new_sponge
    }
}

pub trait VerifierTranscript<F> {
    /// Circuit input elements are treated differently in order to mitigate
    /// the Rothblum et. al. attack in <https://eprint.iacr.org/2025/118>.
    ///
    /// In particular, a hash chain of the elements is computed and absorbed
    /// by the transcript sponge alongside each of the given elements.
    fn consume_input_elements(
        &mut self,
        label: &'static str,
        num_elements: usize,
    ) -> Result<(Vec<F>, Vec<F>)>;

    fn consume_element(&mut self, label: &'static str) -> Result<F>;

    fn consume_elements(&mut self, label: &'static str, num_elements: usize) -> Result<Vec<F>>;

    fn get_challenge(&mut self, label: &'static str) -> Result<F>;

    fn get_challenges(&mut self, label: &'static str, num_elements: usize) -> Result<Vec<F>>;
}

/// Errors that a `TranscriptReader` may produce.
#[derive(Error, Debug, Clone, PartialEq)]
pub enum TranscriptReaderError {
    #[error("An unexpected consume input operation was requested")]
    ConsumeInputError,
    #[error("An unexpected consume operation was requested")]
    ConsumeError,
    #[error("An unexpected squeeze operation was requested")]
    SqueezeError,
}

/// A `TranscriptReader` is typically created using a `Transcript` produced by a
/// `TranscriptWriter`.
///
/// Its operation is similar to that of the writer, except that instead of an
/// "append" operation, it provides a "consume" operation which returns the next
/// field element that was appended to the circuit by the prover. The user of a
/// `TranscriptReader` (typically that is the verifier) is responsible for
/// running any checks (if necessary) to verify the validity of the consumed
/// elements. The "squeeze" operation behaves similarly to that of a
/// `TranscriptWriter`.
///
/// Consume/Squeeze operations on a `TranscriptReader` may return errors when an
/// unexpected operation is requested. An operation can be unexpected if it
/// doesn't match the sequence of operations performed by the `TranscriptWriter`
/// that produced the `Transcript` used in the initialization of the reader.
pub struct TranscriptReader<F, T> {
    /// The sponge that this reader is wrapping around.
    sponge: T,

    /// The transcript that this reader is using to consume elements from and
    /// verify the order of operations is valid.
    transcript: Transcript<F>,

    /// An internal state representing the position of the next operation on the
    /// transcript.
    next_element: (usize, usize),
}

impl<F: Field, T: TranscriptSponge<F>> TranscriptReader<F, T> {
    /// Reads off a single input element from the transcript and returns it
    /// if it exists. Note that this is identical to [TranscriptReader::consume_element()],
    /// but using [Operation::AppendInput] rather than [Operation::Append]. Note
    /// that this function should *not* be called externally!
    ///
    /// The operation can fail with:
    /// * `TranscriptReaderError::ConsumeInputError`: if there are no more elements
    ///   to consume or if a squeeze or non-input consume was expected.
    ///
    /// `label` is as described in the other [TranscriptReader] functions.
    fn consume_input_element(&mut self, label: &'static str) -> Result<F> {
        let (operation_idx, element_idx) = self.next_element;

        match self.transcript.operations.get(operation_idx) {
            Some(Operation::AppendInput(expected_label, elements, _elements_hash_chain_digest)) => {
                if label != expected_label {
                    dbg!("MISMATCH");
                    warn!("Label mismatch on TranscriptReader `consume_input_elements`. Expected \"{}\" but instead got \"{}\".", expected_label, label);
                }
                match elements.get(element_idx) {
                    None => {
                        // This should never happen if `self.advance_indices()` maintains its
                        // invariants. Panicking because we reached an inconsistent state.
                        panic!("Internal TranscriptReader Error: indices are in an inconsistent state (Operation::AppendInput)!");
                    }
                    Some(&element) => {
                        self.advance_indices()?;
                        self.sponge.absorb(element);
                        Ok(element)
                    }
                }
            }
            _ => Err(anyhow!(TranscriptReaderError::ConsumeInputError)),
        }
    }

    /// Reads off a single element from the hash chain digest elements in an
    /// input commitment and returns it if it exists. Note that this function
    /// should *not* be called externally!
    fn consume_input_hash_chain_digest_element(&mut self, label: &'static str) -> Result<F> {
        let (operation_idx, element_idx) = self.next_element;

        match self.transcript.operations.get(operation_idx) {
            Some(Operation::AppendInput(expected_label, elements, elements_hash_chain_digest)) => {
                let hash_chain_digest_idx = element_idx - elements.len();
                if label != expected_label {
                    dbg!("MISMATCH");
                    warn!("Label mismatch on TranscriptReader `consume_input_elements`. Expected \"{}\" but instead got \"{}\".", expected_label, label);
                }
                match elements_hash_chain_digest.get(hash_chain_digest_idx) {
                    None => {
                        // This should never happen if `self.advance_indices()` maintains its
                        // invariants. Panicking because we reached an inconsistent state.
                        panic!("Internal TranscriptReader Error: indices are in an inconsistent state (Operation::AppendInput)!");
                    }
                    Some(&hash_chain_digest_elem) => {
                        self.advance_indices()?;
                        self.sponge.absorb(hash_chain_digest_elem);
                        Ok(hash_chain_digest_elem)
                    }
                }
            }
            _ => Err(anyhow!(TranscriptReaderError::ConsumeInputError)),
        }
    }
}

impl<F: Field, T: TranscriptSponge<F>> VerifierTranscript<F> for TranscriptReader<F, T> {
    /// Reads off a single element from the transcript and returns it if
    /// successful.
    /// The operation can fail with:
    /// * `TranscriptReaderError::ConsumeError`: if there are no more elements
    ///   to consume or if a squeeze was expected.
    ///
    /// The `label` is used for sanity checking against the label that was used
    /// by the `TranscriptWriter` for the corresponding operation. If the labels
    /// don't match, a trace warning message is produced, but the caller is not
    /// otherwise notified of this discrepancy.
    fn consume_element(&mut self, label: &'static str) -> Result<F> {
        let (operation_idx, element_idx) = self.next_element;

        match self.transcript.operations.get(operation_idx) {
            Some(Operation::Append(expected_label, v)) => {
                if label != expected_label {
                    dbg!("MISMATCH");
                    warn!("Label mismatch on TranscriptReader consume_element. Expected \"{}\" but instead got \"{}\".", expected_label, label);
                }
                match v.get(element_idx) {
                    None => {
                        // This should never happen if `self.advance_indices()` maintains its
                        // invariants. Panicking because we reached an inconsistent state.
                        panic!("Internal TranscriptReader Error: indices are in an inconsistent state!");
                    }
                    Some(&element) => {
                        self.advance_indices()?;
                        self.sponge.absorb(element);
                        Ok(element)
                    }
                }
            }
            _ => Err(anyhow!(TranscriptReaderError::ConsumeError)),
        }
    }

    /// A multi-element version of the `consume_element` method. Reads off a
    /// sequence of `num_elements` elements from the transcript and returns a
    /// vector of them if successful.
    /// The operation can fail with:
    /// * `TranscriptReaderError::ConsumeError`: if less than `num_elements`
    ///   elements remain in the transcript or if a squeeze operation was
    ///   expected to occur at any point before the consumption of
    ///   `num_elements` elements.
    ///
    /// The `label` is used for sanity checking against the label that was used
    /// by the `TranscriptWriter` for the corresponding operations. In
    /// particular, the `TranscriptWriter` may have appended either a sequence
    /// of elements using `TranscriptWritter::append_elements` or may have
    /// called `TranscriptWritter::append` multiple times. Both scenarios are
    /// valid and in both cases, `label` should match with the corresponding
    /// labels used on the writer side. If there is a label mismatch for any of
    /// the `num_elements` elements, a trace warning message is produced, but
    /// the caller is not otherwise notified of this discrepancy.
    fn consume_elements(&mut self, label: &'static str, num_elements: usize) -> Result<Vec<F>> {
        (0..num_elements)
            .map(|_| self.consume_element(label))
            .collect()
    }

    /// Reads off input elements from the transcript and returns them, alongside
    /// their hash chain digest, if successful.
    /// The operation can fail with:
    /// * `TranscriptReaderError::ConsumeInputError`: if there are no more elements
    ///   to consume or if a squeeze or non-input consume was expected.
    ///
    /// `label` is as described in the other [TranscriptReader] functions.
    fn consume_input_elements(
        &mut self,
        label: &'static str,
        num_elements: usize,
    ) -> Result<(Vec<F>, Vec<F>)> {
        // First, retrieve the input elements which were appended to the transcript
        // by the prover.
        let maybe_input_elems: Result<Vec<F>> = (0..num_elements)
            .map(|_| self.consume_input_element(label))
            .collect();
        let input_elems = maybe_input_elems?;
        // Next, independently compute the hash chain of these elements.
        let input_elems_hash_chain = sha256_hash_chain_on_field_elems(&input_elems);
        let maybe_claimed_input_elems_hash_chain: Result<Vec<F>> = (0..input_elems_hash_chain
            .len())
            .map(|_| self.consume_input_hash_chain_digest_element(label))
            .collect();
        // Read off the hash chain elements proposed by the prover and check
        // that they are the same as what the verifier independently computed.
        // (Note that this step is not strictly necessary as the sponge takes
        // care of any discrepancies between the two)
        let claimed_input_elems_hash_chain = maybe_claimed_input_elems_hash_chain?;
        assert_eq!(input_elems_hash_chain, claimed_input_elems_hash_chain);
        Ok((input_elems, input_elems_hash_chain))
    }

    /// Squeezes the sponge once and returns a single element if successful.
    /// The operation can fail with:
    /// * `TranscriptReaderError::SqueezeError`: if a squeeze is requested at a
    ///   time when either a consume operation was expected or no more
    ///   operations were expected.
    ///
    /// The `label` is used for sanity checking against the label that was used
    /// by the `TranscriptWriter` for the corresponding operation. If the labels
    /// don't match, a trace warning message is produced, but the caller is not
    /// otherwise notified of this discrepancy.
    fn get_challenge(&mut self, label: &'static str) -> Result<F> {
        let (operation_idx, element_idx) = self.next_element;

        match self.transcript.operations.get(operation_idx) {
            Some(Operation::Squeeze(expected_label, num_elements)) => {
                if label != expected_label {
                    dbg!("MISMATCH");
                    warn!("Label mismatch on TranscriptReader get_challenge. Expected \"{}\" but instead got \"{}\".", expected_label, label);
                }
                if element_idx >= *num_elements {
                    Err(anyhow!(TranscriptReaderError::SqueezeError))
                } else {
                    self.advance_indices()?;
                    Ok(self.sponge.squeeze())
                }
            }
            _ => Err(anyhow!(TranscriptReaderError::SqueezeError)),
        }
    }

    /// Squeezes the sponge `num_elements` times and returns a vector of the
    /// resulting elements if successful.
    /// The operation can fail with:
    /// * `TranscriptReaderError::SqueezeError`: if any of the squeeze
    ///   operations requested does not correspond to a squeeze operation
    ///   performed by the `TranscriptWriter` that produced the transcript.
    ///
    /// The `label` is used for sanity checking against the label that was used
    /// by the `TranscriptWriter` for the corresponding operations. In
    /// particular, the `TranscriptWriter` may have squeezed either a sequence
    /// of elements using `TranscriptWriter::get_challenges` or may have called
    /// `TranscriptWriter::get_challenge` multiple times. Both scenarios are
    /// valid and in both cases, `label` should match with the corresponding
    /// labels used on the writer side. If there is a label mismatch for any of
    /// the `num_elements` elements, a trace warning message is produced, but
    /// the caller is not otherwise notified of this discrepancy.
    fn get_challenges(&mut self, label: &'static str, num_elements: usize) -> Result<Vec<F>> {
        (0..num_elements)
            .map(|_| self.get_challenge(label))
            .collect()
    }
}

impl<F: std::fmt::Debug, Tr: TranscriptSponge<F>> TranscriptReader<F, Tr> {
    /// Generate a new `TranscriptReader` to operate on a given `transcript`.
    pub fn new(transcript: Transcript<F>) -> Self {
        let label = &transcript.label.clone();
        let mut new_sponge = Self {
            sponge: Tr::default(),
            transcript,
            next_element: (0, 0),
        };
        new_sponge.sponge.absorb_initialization_label(label);
        new_sponge
    }

    /// Internal method used to advance the internal state to the next
    /// operation.
    fn advance_indices(&mut self) -> Result<()> {
        let (operation_idx, element_idx) = self.next_element;

        match self.transcript.operations.get(operation_idx) {
            None => {
                // `advance_indices` should never be called in an already inconsistent state.
                panic!("Internal TranscriptReader Error: attempt to advance indices in an already inconsistent state!");
            }
            Some(Operation::Append(_, v)) => {
                if element_idx + 1 >= v.len() {
                    self.next_element = (operation_idx + 1, 0);
                } else {
                    self.next_element = (operation_idx, element_idx + 1);
                }
                Ok(())
            }
            Some(Operation::Squeeze(_, num_elements)) => {
                if element_idx + 1 >= *num_elements {
                    self.next_element = (operation_idx + 1, 0);
                } else {
                    self.next_element = (operation_idx, element_idx + 1);
                }
                Ok(())
            }
            Some(Operation::AppendInput(_, elements, elements_hash_chain_digest)) => {
                // The `element_idx` for an `Operation::AppendInput` is simply
                // the index into the concatenation of the elements themselves
                // and their hash chain digest.
                if element_idx + 1 >= elements.len() + elements_hash_chain_digest.len() {
                    self.next_element = (operation_idx + 1, 0);
                } else {
                    self.next_element = (operation_idx, element_idx + 1);
                }
                Ok(())
            }
        }
    }
}

#[cfg(test)]
mod tests {
    use self::poseidon_sponge::PoseidonSponge;

    use super::*;
    use crate::Fr;

    fn generate_test_transcript() -> Transcript<Fr> {
        let mut transcript_writer = TranscriptWriter::<Fr, PoseidonSponge<Fr>>::new("New tw");

        transcript_writer.append("A1", Fr::from(1));
        transcript_writer.append("A2", Fr::from(2));
        let _ = transcript_writer.get_challenge("C1");
        transcript_writer.append_elements("A3", &[Fr::from(3), Fr::from(4)]);
        // The following operation should be ignored.
        transcript_writer.append_elements("A3*", &[]);
        transcript_writer.append("A4", Fr::from(5));
        let _ = transcript_writer.get_challenge("C2");
        let _ = transcript_writer.get_challenges("C3", 5);
        // The following operation should be ignored.
        let _ = transcript_writer.get_challenges("C3*", 0);
        transcript_writer.append_elements("A5", &[Fr::from(6), Fr::from(7), Fr::from(8)]);
        let _ = transcript_writer.get_challenge("C4");

        transcript_writer.get_transcript()
    }

    #[test]
    fn test_transcript_writer_internal_state() {
        let transcript = generate_test_transcript();

        let appended_elements = vec![
            Operation::Append(String::from("A1"), vec![Fr::from(1)]),
            Operation::Append(String::from("A2"), vec![Fr::from(2)]),
            Operation::Squeeze(String::from("C1"), 1),
            Operation::Append(String::from("A3"), vec![Fr::from(3), Fr::from(4)]),
            Operation::Append(String::from("A4"), vec![Fr::from(5)]),
            Operation::Squeeze(String::from("C2"), 1),
            Operation::Squeeze(String::from("C3"), 5),
            Operation::Append(
                String::from("A5"),
                vec![Fr::from(6), Fr::from(7), Fr::from(8)],
            ),
            Operation::Squeeze(String::from("C4"), 1),
        ];

        let expected_transcript = Transcript::<Fr> {
            label: String::from("New tw"),
            operations: appended_elements,
        };

        assert_eq!(transcript, expected_transcript);
    }

    #[test]
    fn test_transcript_reader() {
        let transcript = generate_test_transcript();
        let mut transcript_reader = TranscriptReader::<Fr, PoseidonSponge<Fr>>::new(transcript);

        assert_eq!(
            transcript_reader.consume_element("A1").unwrap(),
            Fr::from(1)
        );
        assert_eq!(
            transcript_reader.consume_element("A2").unwrap(),
            Fr::from(2)
        );
        assert!(transcript_reader.get_challenge("C1").is_ok());
        assert_eq!(
            transcript_reader.consume_element("A3").unwrap(),
            Fr::from(3)
        );
        assert_eq!(
            transcript_reader.consume_element("A3").unwrap(),
            Fr::from(4)
        );
        assert_eq!(
            transcript_reader.consume_element("A4").unwrap(),
            Fr::from(5)
        );
        assert!(transcript_reader.get_challenge("C2").is_ok());
        assert!(transcript_reader.get_challenges("C3", 5).is_ok());
        assert_eq!(
            transcript_reader.consume_element("A5").unwrap(),
            Fr::from(6)
        );
        assert_eq!(
            transcript_reader.consume_element("A5").unwrap(),
            Fr::from(7)
        );
        assert_eq!(
            transcript_reader.consume_element("A5").unwrap(),
            Fr::from(8)
        );
        assert!(transcript_reader.get_challenge("C4").is_ok());

        assert!(transcript_reader.get_challenge("C5").is_err());
        assert!(transcript_reader.consume_element("A6").is_err());
    }
}