Lecture 8: FRI-based Polynomial Commitments and Fiat-Shamir

What this lecture covers

This lecture opens with a survey of how the polynomial IOPs and polynomial commitment schemes covered so far combine into real SNARK systems (Halo 2, Marlin, Plonk, Groth16), comparing their transparency, post-quantum security, proof size, and prover/verifier costs. It then builds FRI, the hashing-based polynomial commitment behind most transparent, post-quantum SNARKs deployed today, and closes with a detailed treatment of the Fiat-Shamir transformation, including concrete attacks that can silently destroy security if applied carelessly.

After watching, you can place a given SNARK (Halo 2, Plonk, Groth16, STARKs) into the right category by its polynomial commitment scheme, explain how FRI folds a committed vector to test low-degreeness without reading it in full, and recognize why Fiat-Shamir needs round-by-round soundness to be applied safely to many-round protocols like FRI.

Key ideas

• Polynomial IOP + polynomial commitment: nearly any polynomial IOP can be paired with nearly any polynomial commitment scheme to build a succinct interactive argument, then made non-interactive with Fiat-Shamir; the resulting SNARK's transparency and post-quantum security come entirely from the commitment scheme.
• Three commitment categories: pairing-based with trusted setup (KZG, constant-size proofs, fastest verifier), discrete-log-based and transparent (Bulletproofs, Hyrax, Dory), and hashing-based, transparent and post-quantum (FRI, Ligero, Brakedown, Orion).
• Homomorphism: group-based commitments (KZG, discrete-log schemes) support adding commitments together, which enables cheap batching; hash-based commitments like FRI do not.
• FRI blowup factor: the prover commits to a polynomial's evaluations over a domain larger than its degree by a constant factor rho^-1; a bigger blowup factor means more prover time but shorter proofs and faster verification.
• Roots of unity domain: FRI evaluates over the nth roots of unity because squaring is exactly two-to-one on that set, which is what lets each folding round halve the domain size cleanly.
• Folding: FRI repeatedly splits a polynomial into even and odd parts and combines them with a random verifier challenge, halving the degree each round until a constant (degree-zero) polynomial remains.
• Query phase: after folding, the verifier spot-checks a handful of entries across the folded vectors to catch any round where the prover folded dishonestly, with security controlled by the number of queries.
• List polynomial commitment: because FRI's proven soundness bound is weaker than its conjectured bound, deployed systems treat FRI as binding the prover to a small list of low-degree polynomials rather than a single one, which still suffices for SNARK security.
• Round-by-round soundness: a property an interactive protocol needs before Fiat-Shamir can safely make it non-interactive; without it, a cheating prover can "grind" one round at a time and defeat even a protocol with negligible interactive soundness error.

Walkthrough

Comparing polynomial IOPs, commitments, and SNARKs (0:00)

The lecture recaps what a polynomial IOP and polynomial commitment scheme are, then reviews known polynomial IOPs (interactive proofs, multi-prover interactive proofs, constant-round IOPs like Marlin and Plonk) and the three commitment categories by their verification cost, transparency, and post-quantum status.

Snark Zoo Overview (13:01)

Working through popular deployed SNARKs, the lecture contrasts Halo 2 (Plonk plus Bulletproofs, short but slowly-verified proofs), FRI-based systems like STARKs and Aurora (shortest post-quantum proofs but still hundreds of kilobytes, with field-size flexibility that matters less when proving statements about elliptic curves), and sum-check-based systems like Spartan, Brakedown, and Orion (fastest provers, larger proofs, though Orion+ gets under 10 kilobytes by using a KZG variant).

Non-Transparent Snarks (21:45)

Groth16 gets the smallest proofs and fastest verification but needs a circuit-specific trusted setup and only handles restricted circuit types; Marlin and Plonk trade some proof size and prover speed for a circuit-independent setup and more general circuits.

FRI blowup factor and roots of unity (26:26)

Revisiting an earlier flawed attempt at a polynomial commitment (committing to every field element), FRI fixes the prover-time problem by committing only to evaluations over the nth roots of unity, a domain of size rho^-1 times the degree bound. The lecture works through the algebraic properties of roots of unity, including why squaring an nth root of unity gives an n/2th root of unity, which is the mechanism FRI's folding relies on.

FRI Folding Procedure (46:54)

To address the second flaw (the verifier not knowing the committed vector is truly low-degree), FRI runs an interactive "folding phase": splitting the polynomial into even and odd parts, combining them with a verifier-chosen random field element, and repeating for log(degree) rounds until a constant polynomial remains, which the prover sends directly. The lecture proves this algebraic folding is equivalent to the geometric picture of pairing up each root of unity with its negative.

Query phase, security, and the known attack (53:44)

The query phase spot-checks entries across the folded vectors for consistency, with cost controlled by the security parameter divided by the log of the blowup factor. The lecture sketches the soundness proof (bounding the chance of a "lucky" fold plus the chance queries miss all inconsistencies) and presents a known attack showing the conjectured security bound is tight, which is why FRI is used in practice as a weaker "list polynomial commitment" rather than a strict polynomial commitment.

Building a polynomial commitment from FRI (1:29:11)

Using the same quotient-polynomial identity as KZG (Q(x) = f(x) - v divisible by x - r), the verifier applies FRI's low-degree test to a derived function to confirm a claimed evaluation, without ever reading the full committed vector.

Fiat-Shamir Transformation (1:37:41)

The lecture explains how Fiat-Shamir replaces verifier challenges with hashes of the prover's prior messages (including the public input, to preserve adaptive security), then describes the "grinding attack," where a cheating prover retries first messages until one hashes to a favorable challenge, and compares its cost-to-success tradeoff against attacking a collision-resistant hash function.

Security Loss in Fiat-Shamir (1:55:14)

Using a deliberately silly example (a sequential repetition of a coin-flip protocol for the empty language), the lecture shows that applying Fiat-Shamir to a many-round protocol can be catastrophic: a prover can grind one round at a time instead of all rounds at once, defeating even negligible interactive soundness error with only a linear number of hash evaluations. Protocols need "round-by-round soundness" to rule this out; sum-check and Bulletproofs have it, but the lecture notes FRI's round-by-round soundness has not yet been formally published, despite being deployed non-interactively everywhere.

Before you watch

• Watch lecture 4 (interactive proofs and sum-check), lecture 5 (Plonk), and lecture 6 (KZG and discrete-log commitments), since this lecture compares and builds on all of them.
• Review lecture 7's error-correcting-code-based commitments (Ligero, Brakedown, Orion), which this lecture directly contrasts FRI against.

Check your understanding

1. Why does the choice of polynomial commitment scheme alone determine whether a resulting SNARK is transparent and post-quantum secure?
2. Why does FRI evaluate the committed polynomial over the nth roots of unity rather than over the whole field?
3. What does one FRI folding round accomplish, and why does the prover eventually send a single field element?
4. Why is FRI used in practice as a "list polynomial commitment" rather than a strict polynomial commitment?
5. What makes the sequential repetition of the empty-language protocol insecure once Fiat-Shamir is applied, and what property would rule that out?