docs: publish generalized ring-switching .tex source

Author: TomWambsgans

.github/workflows/ring-switching.yml

@@ -0,0 +1,36 @@
+name: Ring Switching Note PDF
+
+on:
+  push:
+    branches: [ "main" ]
+    paths:
+      - 'misc/ring-switching.tex'
+      - '.github/workflows/ring-switching.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+concurrency:
+  group: ring-switching-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build-pdf:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Compile LaTeX
+        uses: xu-cheng/latex-action@v3
+        with:
+          working_directory: misc
+          root_file: ring-switching.tex
+      - name: Publish PDF as release asset
+        if: github.event_name != 'pull_request'
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ring-switching-latest
+          name: Latest ring switching note PDF
+          body: Auto-built from `misc/ring-switching.tex` on every push to `main`.
+          make_latest: false
+          files: misc/ring-switching.pdf

misc/ring-switching-generalized.pdf

@@ -0,0 +1,124 @@
+\documentclass[11pt]{article}
+\usepackage[margin=1in]{geometry}
+\usepackage{amsmath,amssymb}
+\usepackage{xcolor}
+\usepackage[colorlinks=true,linkcolor=blue!50!black,citecolor=blue!50!black,urlcolor=blue!50!black]{hyperref}
+
+\newcommand{\F}{\mathbb{F}}
+\newcommand{\eq}{\mathrm{eq}}
+\newcommand{\pkd}{\mathrm{packed}}
+
+\title{\textbf{Ring switching, generalized}}
+
+\author{}
+\date{}
+
+\begin{document}
+\maketitle
+\vspace{-3em}
+\begin{center}
+How to transform a PCS for $\F_{2^f}$ into a PCS for $\F_{2^e}$, for arbitrary $e$ and $f$.
+\end{center}
+
+\paragraph{Goal.} We want $f$ \emph{bit}-valued multilinears $P_1,\dots,P_f:\{0,1\}^m\to\{0,1\}$ over the same $m$ variables, to be committed through a dense PCS over the \emph{packing} field $\F_{2^f}$ (if we can commit to bits, we can trivially commit in any extension). The evaluation claims, however, arrive over a \emph{different} field: at an opening point $r\in\F_{2^e}^m$ we are given $P_i(r)=\alpha_i\in\F_{2^e}$. Ring switching~\cite{DP26} packs the $f$ polynomials into one $\F_{2^f}$-dense polynomial and reduces the $f$ claims to a single claim on it. The two extension degrees, $f$ (packing) and $e$ (opening), are unrelated (not necessarily a sub-field / extension-field).
+
+\paragraph{Packing.} Fix an $\F_2$-basis $\{b^{F}_i\}_{i=1}^f$ of $\F_{2^f}$. Consider the multilinear polynomial:
+\[
+P_\pkd(y)=\sum_{i=1}^f P_i(y)\,b^{F}_i,\qquad y\in\{0,1\}^m,
+\]
+dense over $\F_{2^f}$, which we commit to.
+
+\paragraph{Reduction.} The claims share a \emph{common} point $r\in\F_{2^e}^m$; each is
+\[
+\alpha_i=P_i(r)=\sum_{y\in\{0,1\}^m}\eq(r,y)\,P_i(y),
+\]
+with bits $P_i(y)$ and weights $\eq(r,y)\in\F_{2^e}$. Fix an $\F_2$-basis $\{b^{E}_w\}_{w=1}^e$ of the \emph{opening} field $\F_{2^e}$ and expand the weights, $\eq(r,y)=\sum_{w=1}^e A(y,w)\,b^{E}_w$, with $A:\{0,1\}^m\times[e]\to\F_2$ public, multilinear in $y$ for each fixed $w$, with efficiently computable MLE (see \nameref{section:eval_B} below). Substituting and pulling out the basis,
+\[
+\alpha_i=\sum_{w=1}^eb^{E}_w\underbrace{\sum_{y\in\{0,1\}^m}A(y,w)\,P_i(y)}_{\in\,\F_2},
+\]
+so the $w$-th $\F_2$-coordinate of $\alpha_i$ is $\alpha_{w,i}=\sum_{y\in\{0,1\}^m}A(y,w)\,P_i(y)$. Now recombine \emph{across $i$} with the \emph{packing} basis $\{b^{F}_i\}$: define, for each $w \in \{1,\dots,e\}$,
+\[
+t_w:=\sum_{i=1}^f\alpha_{w,i}\,b^{F}_i=\sum_{y\in\{0,1\}^m}A(y,w)\underbrace{\sum_{i=1}^fP_i(y)\,b^{F}_i}_{=\,P_\pkd(y)}=\sum_{y\in\{0,1\}^m}A(y,w)\,P_\pkd(y)\ \in\ \F_{2^f}
+\]
+one claim per $w$, now purely about the packed polynomial $P_\pkd$ over $\F_{2^f}$ and public $A$. Batch these $e$ claims with powers of a random $\gamma\leftarrow\F_{2^f}$ into a single sumcheck on $\sum_{y\in\{0,1\}^m}B(y)\,P_\pkd(y)=\sum_{w=1}^e\gamma^w t_w$, with $B(y)=\sum_{w=1}^e\gamma^w A(y,w)$. Its output is the packed claim $P_\pkd(r')=\alpha'$ at a point $r'\in\F_{2^f}^m$ (plus a $B(r')$ the verifier computes itself). Done.
+
+\paragraph{Soundness.} Suppose the input is wrong: $\alpha_i\neq P_i(r)$ for some $i$, against the committed $P_\pkd$. Then the reduction outputs a correct packed claim $P_\pkd(r')=\alpha'$ with probability at most
+\[
+\underbrace{\frac{e}{2^f}}_{\text{batching}}\;+\;\underbrace{\frac{2m}{2^f}}_{\text{sumcheck}}\;=\;\frac{2m+e}{2^f},
+\]
+
+Proof:
+
+\begin{enumerate}
+\item The map $(\alpha_i)_{i=1}^f\mapsto(t_w)_{w=1}^e$ is a \emph{bijection} $\F_{2^e}^f\to\F_{2^f}^e$. So a wrong input forces, with certainty, $t_w\neq\sum_{y\in\{0,1\}^m}A(y,w)\,P_\pkd(y)$ for some $w$.
+\item By Schwartz--Zippel, $\sum_{w=1}^e\gamma^w t_w$ then differs from $\sum_{y\in\{0,1\}^m}B(y)\,P_\pkd(y)$ except with probability $\le e/2^f$ over $\gamma\leftarrow\F_{2^f}$.
+\item Sumcheck started from this false value (summand of degree $2$, over $m$ variables) ends at a correct claim $P_\pkd(r')=\alpha'$ with probability $\le 2m/2^f$.
+\end{enumerate}
+
+\phantomsection
+\section*{Evaluating $B$}
+\label{section:eval_B}
+
+It remains to compute $B(r')$, where $B(y)=\sum_{w=1}^e\gamma^w A(y,w)$ and $A(y,w)\in\F_2$ is the $w$-th coordinate of $\eq(r,y)$, i.e.\ $\eq(r,y)=\sum_{w=1}^e A(y,w)\,b^E_w$. Following~\cite{Flock}, this gives $B$ a closed form on the hypercube. Let $\Phi:\F_{2^e}\to\F_{2^f}$ be the $\F_2$-linear map with $\Phi(b^E_w)=\gamma^w$. For every $y\in\{0,1\}^m$:
+\[
+\Phi\big(\eq(r,y)\big)=\Phi\Big(\sum_{w=1}^e A(y,w)\,b^E_w\Big)=\sum_{w=1}^e A(y,w)\,\Phi(b^E_w)=\sum_{w=1}^e A(y,w)\,\gamma^w=B(y).
+\]
+So on the hypercube $B$ is ``compute $\eq(r,y)\in\F_{2^e}$, then apply $\Phi$''.
+
+\paragraph{Closed form.} Two elementary facts do all the work.
+
+\emph{Fact 1 ($\eq$ in characteristic $2$).} In each factor of $\eq$ the two $x_jy_j$ terms cancel:
+\[
+\eq(x,y)=\prod_{j=1}^m\bigl(x_jy_j+(1+x_j)(1+y_j)\bigr)=\prod_{j=1}^m(1+x_j+y_j).
+\]
+
+\emph{Fact 2 (linear maps are sums of squarings).} View $\Phi$ as mapping into $L=\F_{2^{\mathrm{lcm}(e,f)}}$, the smallest field containing both $\F_{2^e}$ and $\F_{2^f}$ (for $e=f$: $L=\F_{2^e}$, nothing to embed). Squaring is additive in characteristic $2$, so any \emph{linearized polynomial}~\cite{WikiLinPoly}
+\[
+a\;\mapsto\;c_0\,a+c_1\,a^2+c_2\,a^4+\dots+c_{e-1}\,a^{2^{e-1}},\qquad c_k\in L,
+\]
+is an $\F_2$-linear map $\F_{2^e}\to L$. We claim $\Phi$ is of this form, and find the $c_k$ by writing out what $\Phi$ must do on the basis, $\Phi(b^E_w)=\gamma^w$:
+\[
+\sum_{k=0}^{e-1}\bigl(b^E_w\bigr)^{2^k}c_k=\gamma^w,\qquad w=1,\dots,e:
+\]
+$e$ linear equations in the $e$ unknowns $c_k$. The coefficient matrix $\bigl((b^E_w)^{2^k}\bigr)_{w,k}$ is a \emph{Moore matrix}, invertible exactly because the $b^E_w$ are $\F_2$-linearly independent~\cite{WikiMoore}, so the $c_k$ exist and are unique; the resulting linearized polynomial agrees with $\Phi$ on an $\F_2$-basis, hence (both being $\F_2$-linear) everywhere. The matrix depends only on the basis, not on $\gamma$: invert it once and for all; each reduction then reads off its $(c_k)_{k<e}$ by one matrix-vector product, $O(e^2)$ multiplications.
+
+Now compute. Squaring respects sums and products and fixes bits ($y_j^2=y_j$), so on the hypercube, by Fact~1,
+\[
+\eq(r,y)^{2^k}=\prod_{j=1}^m(1+r_j+y_j)^{2^k}=\prod_{j=1}^m\bigl(1+r_j^{2^k}+y_j\bigr)=\eq\bigl(r^{2^k},y\bigr),
+\qquad r^{2^k}:=\bigl(r_1^{2^k},\dots,r_m^{2^k}\bigr).
+\]
+Since $B$ is multilinear, evaluating it at $r'$ and expanding with Fact~2:
+\[
+B(r')=\sum_{y\in\{0,1\}^m}B(y)\,\eq(r',y)
+=\sum_{y\in\{0,1\}^m}\Phi\bigl(\eq(r,y)\bigr)\,\eq(r',y)
+=\sum_{k<e}c_k\sum_{y\in\{0,1\}^m}\eq\bigl(r^{2^k},y\bigr)\,\eq(r',y).
+\]
+The inner sum evaluates, at $r'$, the multilinear extension of $y\mapsto\eq(r^{2^k},y)$, which is $\eq(r^{2^k},\cdot\,)$ itself. So it collapses to $\eq(r^{2^k},r')$, and by Fact~1 again:
+\[
+\boxed{\ \
+B(r') \;=\; \sum_{k<e}\, c_k \prod_{j=1}^m
+\bigl( 1 + r_j^{2^k} + r'_j \bigr).
+\ \ }
+\]
+
+\paragraph{Cost.} Level $k$ needs one squaring per coordinate (to get $r_j^{2^k}$ from $r_j^{2^{k-1}}$) and one $m$-factor product: $O(em)$ multiplications in $L$, on top of the $O(e^2)$ for the $c_k$: plain field arithmetic throughout, no bit decompositions.
+
+\section*{Remarks}
+
+\begin{enumerate}
+\item \emph{Small $\F_{2^f}$.} If $2^f$ is too small for the error $(2m+e)/2^f$, sample $\gamma$ (and run the sumcheck) in an extension $L\supseteq\F_{2^f}$: the error becomes $(2m+e)/|L|$, and $P_\pkd$ is just opened at $r'\in L^m$.
+\item \emph{Any field.} Nothing uses characteristic $2$: replace $\F_2$ by any field $K$ and $\F_{2^f},\F_{2^e}$ by degree-$f$ and degree-$e$ extensions of $K$; the reduction still works, and efficient algorithms for evaluating $B$ exist in general too.
+\end{enumerate}
+
+\section*{Credits}
+
+The idea of generalizing Ring-Switching, originally described in \cite{DP26}, to arbitrary extension degrees (non necessarily powers of two), comes from Lev Soukhanov, \textit{[[alloc]init]}.
+
+\begin{thebibliography}{9}
+\bibitem{DP26} Benjamin E. Diamond and Jim Posen. Polylogarithmic proofs for multilinears over binary towers. In \emph{Advances in Cryptology -- EUROCRYPT 2026}, pages 3--32. Springer, 2026.
+\bibitem{Flock} Benedikt B\"unz, Ron Rothblum, and William Wang. Flock: Fast proving for batch Boolean computations. Cryptology ePrint Archive, Paper 2026/1329, 2026. \url{https://eprint.iacr.org/2026/1329}.
+\bibitem{WikiLinPoly} Wikipedia. Linearised polynomial. \url{https://en.wikipedia.org/wiki/Linearised_polynomial}.
+\bibitem{WikiMoore} Wikipedia. Moore matrix. \url{https://en.wikipedia.org/wiki/Moore_matrix}.
+\end{thebibliography}
+
+\end{document}