Title
Add base-field witness randomization for full polynomial-IOP ZK
Summary
The polynomial IOP currently masks the Spartan sumcheck, but the witness-derived values opened after the zero-check still need a zero-knowledge treatment. Once #493 provides the joint witness polynomial w, implement the base-field randomization from whitepaper Section 5.1.2 for the w_A(α) and w_B(α) openings.
This also concerns the compiler, which must support the additional random gates introduced by the zero-knowledge randomization.
This is related to #476, which tracks the broader goal of making the witness commitment hiding. The commitment masks for w_1 and w_2 must be coordinated with the joint mask-commitment flow in worldfnd/whir#276.
Dependencies: #493, worldfnd/whir#276.
Title
Add base-field witness randomization for full polynomial-IOP ZK
Summary
The polynomial IOP currently masks the Spartan sumcheck, but the witness-derived values opened after the zero-check still need a zero-knowledge treatment. Once #493 provides the joint witness polynomial
w, implement the base-field randomization from whitepaper Section 5.1.2 for thew_A(α)andw_B(α)openings.This also concerns the compiler, which must support the additional random gates introduced by the zero-knowledge randomization.
This is related to #476, which tracks the broader goal of making the witness commitment hiding. The commitment masks for
w_1andw_2must be coordinated with the joint mask-commitment flow in worldfnd/whir#276.Dependencies: #493, worldfnd/whir#276.