Lecture 7: Polynomial Commitments from Error-Correcting Codes

What this lecture covers

The previous lecture built polynomial commitments from bilinear pairings (KZG) and discrete logarithm (Bulletproofs, Hyrax, Dory, Dark). This lecture introduces a third family, built from error-correcting codes and Merkle trees instead of group exponentiations. These schemes are plausibly post-quantum, need no trusted setup, and have very fast provers, at the cost of much larger proofs.

You'll see how arranging a polynomial's coefficients into a matrix, encoding each row with a linear code, and committing to the result with a Merkle tree lets a verifier check an evaluation using only a proximity test and a consistency test. The lecture also covers how a linear-time encodable code can be built from expander graphs, which is what makes the prover in these schemes linear-time in practice.

Key ideas

• Error-correcting code: an encoding of a length-k message into a length-n codeword, characterized by its rate k/n and relative distance (minimum fraction of differing symbols between any two codewords).
• Linear code: a code where any linear combination of codewords is a codeword, so distance equals the minimum weight (non-zero count) of any non-zero codeword; Reed-Solomon codes are the classic example, encoding a polynomial's evaluations.
• Matrix view of a polynomial: arranging a degree-D polynomial's coefficients as a square-root-of-D by square-root-of-D matrix lets evaluation be computed as two vector-matrix products.
• Merkle-tree commitment: the prover encodes the coefficient matrix row-wise with a linear code, then commits to the encoded matrix column-wise with a Merkle tree, so any column can later be opened and checked.
• Proximity test: a random linear combination of rows plus spot-checking opened columns lets the verifier confirm, with high probability, that the committed matrix is close to a properly encoded matrix.
• Consistency test: reusing the same opened columns, the verifier checks that the vector-matrix product with the evaluation point matches the claimed message, without needing a separate decoding step.
• Linear-time encodable codes via expander graphs: a recursive construction using "lossless expanders" achieves constant relative distance with linear encoding time, which is what gives these schemes a linear-time prover.
• Trade-off: no trusted setup, small constant-size global parameters, and fast (linear-time, exponentiation-free) proving, but proof sizes of tens of megabytes in the basic version, reducible to a few megabytes with proof composition.

Walkthrough

Motivation and background on error-correcting codes (1:01)

The lecture recaps KZG and discrete-log-based commitments, then motivates code-based schemes: no known quantum attacks, fast provers using only hashes and field arithmetic instead of group exponentiations, and tiny global parameters, offset by large proof sizes and a lack of the homomorphic structure needed for easy aggregation. It then covers the basic vocabulary of coding theory: rate, minimum (Hamming) distance, relative distance, the rate-distance trade-off, linear codes, and the Reed-Solomon code, which encodes a polynomial's evaluations at fixed points and has near-optimal rate and distance.

Reducing polynomial evaluation to a vector-matrix product (13:07)

Arranging the polynomial's coefficients as a square matrix, evaluation at a point u decomposes into two vector-matrix products: first multiplying a vector derived from u by the coefficient matrix to get an intermediate vector, then taking an inner product with another vector derived from u. This reduces the polynomial commitment problem to proving the first step correctly, which the prover can do by sending only a square-root-size vector.

Committing with linear codes and Merkle trees (18:13)

Key generation just samples a hash function, with no trusted setup. To commit, the prover encodes each row of the coefficient matrix with a linear code, then builds a Merkle tree over the columns of the resulting encoded matrix, sending only the root as the commitment.

Proximity test (21:14)

Because a malicious prover could commit to arbitrary vectors that aren't valid codewords, the verifier sends a random challenge vector, and the prover returns the resulting linear combination of rows. The verifier then opens several random columns (using Merkle proofs) and checks that this returned vector is itself a codeword, matches the committed columns, and is consistent with the columns' values. The lecture sketches why a cheating prover fails these checks with overwhelming probability, tied to the code's relative distance, and notes an optimization where the prover sends the shorter pre-encoding message instead of the full codeword.

Consistency test and full protocol (37:37)

Reusing the columns opened during the proximity test, the prover sends the message corresponding to the vector-matrix product with the evaluation-point vector, and the verifier checks it against the same opened columns. Combined with the proximity test, this lets an extractor recover the coefficient matrix, completing the polynomial commitment. The lecture emphasizes why both tests are needed: the consistency test alone would let a prover cheat if it knew the evaluation point in advance.

Performance and the tensor-IOP lineage (46:47)

The scheme has constant-size global parameters, linear commitment and evaluation time, but square-root proof size and verifier time. Concrete numbers from the "Brakedown" paper show a degree-2^25 polynomial committing in 36 seconds with a 3.2-second evaluation proof, but a roughly 49-megabyte proof. The lecture traces the lineage from Ligero and Bootle et al.'s original proximity-test ideas, through a tensor-IOP generalization, to Brakedown's polynomial commitment and Orion's proof-size reduction to around 5.7 megabytes via proof composition and code switching.

Linear-time codes from expander graphs (55:56)

To get a genuinely linear-time prover, the lecture introduces expander graphs: bipartite graphs where small subsets on one side connect to disproportionately many nodes on the other. A naive encoding (summing neighbors) doesn't achieve good distance, so the lecture builds a recursive encoding that copies the message, passes it through a "lossless expander" to shrink it, recursively encodes the smaller piece, and expands it again, concatenating the pieces into the final codeword. A case-based argument shows this recursive construction achieves constant relative distance, and the lecture notes that finding good expanders in practice relies on randomized sampling with a testing step, refined in the Brakedown and Orion papers.

Before you watch

• Watch lecture 6 first, since this lecture assumes familiarity with the KZG and discrete-log polynomial commitment schemes it's being contrasted against.
• Review lecture 4's coverage of the sum-check protocol and multilinear polynomials, and be comfortable with basic linear algebra (vectors, matrices, inner products).

Check your understanding

1. Why do code-based polynomial commitments avoid group exponentiations entirely, and what operations replace them?
2. What does the proximity test guarantee about the committed matrix, and why is it not enough on its own to prove a correct evaluation?
3. Why is the consistency test alone insufficient without first running the proximity test?
4. What is a lossless expander, and why is it needed to get a linear-time encodable code with constant relative distance?
5. What is the fundamental trade-off between this family of schemes and the pairing- or discrete-log-based schemes from the previous lecture?