$$$$

CC-Sector Update Circuit

General Notation

${\mathbb{F}}_q$
A prime field element (i.e. an integer

$\text{mod }q$). Filecoin uses the BLS12-381 scalar field as its prime field.

${\mathbb{F}}_q{|}_{\{0,1\}}$
A field element whose value is constrained to either

$0$ or

$1$.

${{\mathbb{F}}_q}^{[n]}$
An array containing

$n$ field elements.

$x:{\mathbb{F}}_q$
A variable

$x$ which has type

${\mathbb{F}}_q$.

$(x_1,x_2)$
An array containing two values.

$0\text{..}n$
The range of values

$(0,1,\dots ,n-1)$.

$\text{arr}[m\text{..}n]$
A slice (subarray) of an array

$\text{arr}$ containing the values

$(\text{arr}[m],\text{arr}[m+1],\dots ,\text{arr}[n-1])$.

$y\stackrel{\diamond }{=}\mathsf{\text{some\_gadget}}(\dots )$
Denotes

$y$ as a being a value allocated in a constraint system by a gadget

$\mathsf{\text{some\_gadget}}$.

Circuit Notation and Constants

$N=\{\begin{array}{ll}{2}^{30}& \text{if sector-size}=32\text{GiB}\\ 2^{31}& \text{otherwise if sector-size}=64\text{GiB}\end{array}$
The number of nodes per sector.

$C=2200$
The number of challenges per sector (one proof is generated for per update CC-sector).

$c\in 0\text{..}N$
A Merkle challenge (i.e. the index of a node in a sector of size

$N$). There are

$C$ number of challenges

$c_i$ generated per proof.

$\rho :{\mathbb{F}}_q$
A random value generated for each challenge

$c$.

$\mathbf{\text{bitlen}}(\text{digest})=\mathbf{\text{bitlen}}({\mathbb{F}}_q)=\lceil {\log }_2(q)\rceil =255$
The bit-length of a Poseidon digest. Our Poseidon hash function is instantiated over a

$\approx$ 256-bit field (BLS12-381's scalar field

${\mathbb{F}}_q$), thus targets a security level of 128 bits.

$q$ is the Poseidon field modulus.

$\mathbf{\text{bitlen}}(c)={\log }_2(N)=\{\begin{array}{ll}30& \text{if sector-size is 32GiB}\\ 31& \text{otherwise if sector-size is 64GiB}\end{array}$
The bit-length of a challenge

$c$. Each challenge

$c$ is the index of a node in a sector

$c\in 0\text{..}N$.

$\lfloor \frac{\mathbf{\text{bitlen}}(\text{digest})}{\mathbf{\text{bitlen}}(c)}\rfloor =\lfloor \frac{255}{{\log }_2(N)}\rfloor =8$
The number of challenges generated using a single Poseidon digest, i.e. the

$j^{th}$ digest is used to generate the challenges

$(c_{j8},c_{j8+1},\dots ,c_{j8+7})$.

$C/8=275$
The number of Poseidon digests required to generate

$C$ number of challenges, i.e. a single Poseidon digest generates

$8$ of the required

$C=2200$ challenges.

$\text{boldsymbol}H=(2^7,2^8,2^9,2^{10},2^{11},2^{12})$
An array containing the possible values of

$H$.

$H\in \text{boldsymbol}H$
Specifies the number of bits extracted from a challenge

$c$'s binary representation

$\text{c\_bits}$ and appended onto

$\text{CommDNew}$ to generate the preimage for

$c$'s random value

$\rho$.

$H$ is chosen from

$\text{boldsymbol}H$ using the

$\text{HSelect}$ public-input.

$\text{HSelect}:{\mathbb{F}}_q\in \{2^0,2^1,2^2,2^3,2^4,2^5\}$
Selects

$H\in \text{boldsymbol}H$ via

$H=\text{boldsymbol}H[{\log }_2(\text{HSelect})]$. Note that each possible value of

$\text{HSelect}$ has either no bits set or exactly one bit set, thus

${\log }_2(\text{HSelect})$ is a unique integer in

$0\text{..}6$. Within the circuit we allocate

$\mathsf{\text{HSelect}}$ as 6 bits

$\text{h\_select\_bits}$ and extract the

${\log }_2(H)$ high bits from each challenge

$c$ using the linear combination

$c\ast \sum _{k\in 0\text{..}6}\text{h\_select\_bits}[k]\ast 2^{{\log }_2(N)-{\log }_2(\text{boldsymbol}H[k])}$.

$\text{CommDNew}:{\mathbb{F}}_q$
Commitment to the sector's plaintext data after updating; the root of

$\text{TreeDNew}$.

$\text{CommROld},\text{CommRNew}:{\mathbb{F}}_q$
Commitments to the replicated sector before and after updating;

$\text{CommR}={\mathsf{\text{poseidon}}}_2((\text{CommC},\text{CommRLast}))$.

$\text{CommRLastOld},\text{CommRLastNew}:{\mathbb{F}}_q$
Roots of the sector's

$\text{TreeR}$ trees before and after updating.

$\text{CommC}:{\mathbb{F}}_q$
The original/unupdated sector's

$\text{CommC}$. Note that

$\text{CommC}$ is not changed when updating a CC-sector.

${\text{TreeDNewProof}}_c:\mathsf{\text{struct }}\{\text{leaf}:{\mathbb{F}}_q,\text{path}:{{{\mathbb{F}}_q}^{[1]}}^{[{\log }_2(N)]}\}$

${\text{TreeROldProof}}_c,{\text{TreeRNewProof}}_c:\mathsf{\text{struct }}\{\text{leaf}:{\mathbb{F}}_q,\text{path}:{{{\mathbb{F}}_q}^{[7]}}^{[{\log }_8(N)]}\}$
Three Merkle proofs (1 bintree, 2 octtree) are generated for each challenge

$c$: one in

$\text{TreeDNew}$, one in

$\text{TreeROld}$, and one in

$\text{TreeRNew}$. The

$\text{leaf}$ field is the Merkel challenge

$c$'s (leaf) label. The field

$\text{path}$ is the Merkle path generated for

$c$.

Summary

Generate

$C$ number of challenges using

$C/8$ Poseidon digests, i.e. one digest generates

$8$ challenges.

$$\mathrm{\forall }j\in 0\text{..}C/8:{\text{digest}}_j=\text{poseidon}((\text{CommDNew},j))$$

Each challenge is a

${\log }_2(N)$-bit unsigned integer, thus split each digest into

$8$,

${\log }_2(N)$-bit, partitions interpreting each as the little-endian bits of a challenge

$c$.

$$\mathrm{\forall }i\in 0\text{..}8:c_{8j+i}={\text{digest}}_j[{\log }_2(N)i\text{..}{\log }_2(N)(i+1)]\mathsf{\text{ as }}{\mathbb{F}}_q$$

Isolate the most-significant

$H$ bits of

$c$ denoted

$\text{c\_high}$ where

$H$ is chosen from

$\text{boldsymbol}H$ using the public input bit-array

$\text{HSelect}$. Calculate each challenge's random value

$\rho$ using

$\text{c\_high}$.

$${\rho }_c=\text{poseidon}((\text{poseideon}(\text{CommDNew},\text{CommROld}),\text{c\_high}))$$

Verify each challenge

$c$'s Merkle proofs in

$\text{TreeDNew}$,

$\text{TreeROld}$, and

$\text{TreeRNew}$ (i.e. the trees built over the new plaintext data, old replica, and new replica).

Verify each

$c$'s new replica label

$R_c^{\ast }$ using

$c$'s old replica label

$R_c$, new plaintext label

$D_c^{\ast }$, and

${\rho }_c$.

$$R_c^{\ast }=R_c+D_c^{\ast }{\rho }_c$$

Circuit

Public Inputs:

$\text{CommDNew},\text{CommROld},\text{CommRNew},\text{HSelect}$

Private Inputs:

$\text{CommC},\text{CommRLastOld},\text{CommRLastNew},\mathrm{\forall }c\in (c_1,\dots ,c_{2200}):{\text{TreeDNewProof}}_c,{\text{TreeROldProof}}_c,{\text{TreeRNewProof}}_c$

$\stackrel{―}{\underset{―}{\mathbf{\text{Circuit:}}\text{SDR CC-Sector Update}}}$

$1.\phantom{10.}\text{comm\_d\_new}\stackrel{\diamond }{=}\mathsf{\text{alloc\_pub}}({\text{CommDNew}}_{\text{pub}})$

$2.\phantom{10.}\text{comm\_r\_old}\stackrel{\diamond }{=}\mathsf{\text{alloc\_pub}}({\text{CommROld}}_{\text{pub}})$

$3.\phantom{10.}\text{comm\_r\_new}\stackrel{\diamond }{=}\mathsf{\text{alloc\_pub}}({\text{CommRNew}}_{\text{pub}})$

$4.\phantom{10.}\varphi :{\mathbb{F}}_q\stackrel{\diamond }{=}{\mathsf{\text{poseidon\_gadget}}}_2((\text{comm\_d\_new},\text{comm\_r\_old}))$

$5.\phantom{10.}\text{h\_select}\stackrel{\diamond }{=}\mathsf{\text{alloc\_pub}}({\text{HSelect}}_{\text{pub}})$

$6.\phantom{10.}\text{h\_select\_bits}:{{\mathbb{F}}_q{|}_{\{0,1\}}}^{[6]}\stackrel{\diamond }{=}\mathsf{\text{le\_bits\_gadget}}(\text{h\_select},6)$

$7.\phantom{10.}\text{comm\_c}\stackrel{\diamond }{=}\mathsf{\text{alloc}}({\text{CommC}}_{\text{priv}})$

$8.\phantom{10.}\text{comm\_r\_last\_old}\stackrel{\diamond }{=}\mathsf{\text{alloc}}({\text{CommRLastOld}}_{\text{priv}})$

$9.\phantom{10.}\text{comm\_r\_last\_new}\stackrel{\diamond }{=}\mathsf{\text{alloc}}({\text{CommRLastNew}}_{\text{priv}})$

TODO: do we need to prove

$\text{CommRLastOld}$ using

$\text{CommROld}$?

$10.\phantom{10.}\text{comm\_r\_old\_calc}:{\mathbb{F}}_q\stackrel{\diamond }{=}{\mathsf{\text{poseidon\_gadget}}}_2((\text{comm\_c},\text{comm\_r\_last\_old}))$

$11.\phantom{10.}\mathsf{\text{assert\_eq}}(\text{comm\_r\_old\_calc},\text{comm\_r\_old})$

$10.\phantom{10.}\text{comm\_r\_new\_calc}:{\mathbb{F}}_q\stackrel{\diamond }{=}{\mathsf{\text{poseidon\_gadget}}}_2((\text{comm\_c},\text{comm\_r\_last\_new}))$

$11.\phantom{10.}\mathsf{\text{assert\_eq}}(\text{comm\_r\_new\_calc},\text{comm\_r\_new})$

$12.\phantom{10.}\mathbf{\text{for }}j\in 0\text{..}C/8:$

$13.\phantom{10.}j\stackrel{\diamond }{=}\mathsf{\text{alloc}}(j)$

$14.\phantom{10.}\text{digest}:{\mathbb{F}}_q\stackrel{\diamond }{=}{\mathsf{\text{poseidon\_gadget}}}_2((\text{comm\_r\_new},j))$

$15.\phantom{10.}\text{digest\_bits}:{{\mathbb{F}}_q{|}_{\{0,1\}}}^{[8{\log }_2(N)]}\stackrel{\diamond }{=}\mathsf{\text{le\_bits\_gadget}}(\text{digest},8{\log }_2(N))$

$16.\phantom{10.}\mathbf{\text{for }}i\in 0\text{..}8:$

$17.\phantom{10.}\text{c\_bits}:{{\mathbb{F}}_q{|}_{\{0,1\}}}^{[{\log }_2(N)]}=\text{digest\_bits}[{\log }_2(N)i\text{..}{\log }_2(N)(i+1)]$

$18.\phantom{10.}\text{c\_high}\stackrel{\diamond }{=}\mathsf{\text{lc\_gadget}}(\sum _{k\in 0\text{..}6}\text{h\_select\_bits}[k]\ast (\text{c\_bits}\gg ({\log }_2(N)-{\log }_2(\text{boldsymbol}H[k]))))$

$19.\phantom{10.}\rho :{\mathbb{F}}_q\stackrel{\diamond }{=}{\mathsf{\text{poseidon\_gadget}}}_2((\varphi ,\text{c\_high}))$

$20.\phantom{10.}(\text{label\_d\_new},\text{path\_d\_new})\stackrel{\diamond }{=}\mathsf{\text{alloc\_bintree\_proof}}({\text{TreeDNewProof}}_{c,\text{priv}})$

$21.\phantom{10.}(\text{label\_r\_old},\text{path\_r\_old})\stackrel{\diamond }{=}\mathsf{\text{alloc\_octtree\_proof}}({\text{TreeROldProof}}_{c,\text{priv}})$

$22.\phantom{10.}(\text{label\_r\_new},\text{path\_r\_new})\stackrel{\diamond }{=}\mathsf{\text{alloc\_octtree\_proof}}({\text{TreeRNewProof}}_{c,\text{priv}})$

$23.\phantom{10.}\text{comm\_d\_new\_calc}\stackrel{\diamond }{=}\mathsf{\text{bintree\_root\_gadget}}(\text{c\_bits},\text{label\_d\_new},\text{path\_d\_new})$

$24.\phantom{10.}\text{comm\_r\_last\_old\_calc}\stackrel{\diamond }{=}\mathsf{\text{octtree\_root\_gadget}}(\text{c\_bits},\text{label\_r\_old},\text{path\_r\_old})$

$25.\phantom{10.}\text{comm\_r\_last\_new\_calc}\stackrel{\diamond }{=}\mathsf{\text{octtree\_root\_gadget}}(\text{c\_bits},\text{label\_r\_new},\text{path\_r\_new})$

$26.\phantom{10.}\mathsf{\text{assert\_eq}}(\text{comm\_d\_new\_calc},\text{comm\_d\_new})$

$27.\phantom{10.}\mathsf{\text{assert\_eq}}(\text{comm\_r\_last\_old\_calc},\text{comm\_r\_last\_old})$

$28.\phantom{10.}\mathsf{\text{assert\_eq}}(\text{comm\_r\_last\_new\_calc},\text{comm\_r\_last\_new})$

$29.\phantom{10.}\text{rho\_label\_d\_new}\stackrel{\diamond }{=}\mathsf{\text{mul\_gadget}}(\rho ,\text{label\_d\_new})$

$30.\phantom{10.}\text{label\_r\_new\_calc}\stackrel{\diamond }{=}\mathsf{\text{add\_gadget}}(\text{label\_r\_old},\text{rho\_label\_d\_new})$

$31.\phantom{10.}\mathsf{\text{assert\_eq}}(\text{label\_r\_new\_calc},\text{label\_r\_new})$

Gadgets

$\mathsf{\text{alloc}}(x)$ allocates

$x$ in the constraint-system and does not add constraints.

$\mathsf{\text{alloc\_pub}}(x)$ makes one public and one private allocation in the constraint-system and adds one constraint asserting equality between the two.

$\mathsf{\text{alloc\_bintree\_proof/alloc\_octtree\_proof}}(\text{leaf},\text{path})$ allocate a challenge

$c$'s Merkle leaf label and its Merkle path elements and doe not add constraints to the constraint system.

$\mathsf{\text{assert\_eq}}(x,y)$ adds one constraint asserting the equality

$x==y$.

$\mathsf{\text{add\_gadget}}(x,y)$ allocates the sum

$x+y$ and adds one constraint asserting the correctness of the allocated value.

$\mathsf{\text{mul\_gadget}}(x,y)$ allocates the product

$x\ast y$ and adds one constraint asserting the correctness of the allocated value.

$\mathsf{\text{lc\_gadget}}(\sum _i{\text{const}}_i\ast {\text{prev\_alloc\_value}}_i)$ makes one allocation for the output of the linear combination ("lc") and adds one constraint asserting that the allocated value is consistent with the sum of (scaled) previously allocated values. Note that each constant

${\text{const}}_i$ is unallocated.

${\mathsf{\text{poseidon\_gadget}}}_2((x,y))$ calculates the arity-2 Poseidon digest of the preimage array

$(x,y)$.

$\mathsf{\text{le\_bits\_gadget}}(x,n)$ allocates

$x$ as

$n$ bits in the constraint system, i.e. makes

$n$ allocations, add a boolean constraint for each allocated bit, and adds

$1$ constraint asserting that the allocated bits are the correct binary representation for

$x$:

$\mathsf{\text{assert\_eq}}(\sum _{i\in 0\text{..}n}{2}^i\ast \text{bits}[i],x)$.

$\mathsf{\text{bintree\_root\_gadget/octtree\_root\_gadget}}(\text{c\_bits},\text{leaf},\text{path})$ calculates the root of a Merkle bintree/octtree given a challenge

$c$'s Merkle leaf label and Merkle path. Bintrees use arity-2 SHA256 and octtrees use arity-8 Poseidon.

Circuit (Updated)

$\mathbf{\text{const }}\text{P}=16$

$\mathbf{\text{const }}\text{A}=128$

$\mathbf{\text{const }}\text{C}=86$

$\mathbf{\text{const }}\mathbf{\text{Hs}}=(7,8,9,10,11,12)$

$\mathbf{\text{const }}\text{PartitionTreeHeight}={\log }_2(\text{P})=4$

$\mathbf{\text{const }}\text{ApexTreeHeight}={\log }_2(\text{A})=7$

$\mathbf{\text{config }}\text{SectorSize}\in \{32\text{GiB},64\text{GiB}\}$

$\mathbf{\text{config }}k\in 0\text{..}\text{P}$

$\mathbf{\text{config }}\text{HsIndex}\in \{0,1,2,3,4,5\}$

$\mathbf{\text{type }}\text{TreeD}=\text{BinTree}$

$\mathbf{\text{type }}\text{TreeR}=\{\begin{array}{ll}\text{OctTree}& \text{if }\text{SectorSize}=32\text{GiB}\\ \text{OctBinTree}& \text{if }\text{SectorSize}=64\text{GiB}\end{array}$

$\text{Nodes}=\{\begin{array}{ll}{2}^{30}& \text{if }\text{SectorSize}=32\text{Gib}\\ 2^{31}& \text{if }\text{SectorSize}=64\text{Gib}\end{array}$

$\mathbf{\text{input }}{\text{R}}_{\text{old}}\in {{\mathbb{F}}_q}^{[\text{Nodes}]}$

$\mathbf{\text{input }}{\text{D}}_{\text{new}}\in {{\mathbb{F}}_q}^{[\text{Nodes}]}$

$\mathbf{\text{input }}{\text{R}}_{\text{new}}\in {{\mathbb{F}}_q}^{[\text{Nodes}]}$

$\text{ChallengeBits}={\log }_2(\text{Nodes})$

$\text{PartitionBits}={\log }_2(\text{P})$

$\text{RandChallengeBits}=\text{ChallengeBits}-\text{PartitionBits}$

$\text{HSelect}=2^{\text{HsIndex}}$

$\text{H}=\mathbf{\text{Hs}}[\text{HsIndex}]=\mathbf{\text{Hs}}[{\log }_2(\text{HSelect})]$

$\text{TreeROld}=\text{TreeR}({\text{R}}_{\text{old}})$

$\text{TreeDNew}=\text{TreeD}({\text{D}}_{\text{new}})$

$\text{TreeRNew}=\text{TreeR}({\text{R}}_{\text{new}})$

$\text{CommROld}=\text{TreeROld}\text{.root}$

$\text{CommDNew}=\text{TreeDNew}\text{.root}$

$\text{CommRNew}=\text{TreeRNew}\text{.root}$

$\text{TreeDHeight}={\log }_2(\text{Nodes})$

$\text{TreeRHeight}=\{\begin{array}{ll}{\log }_8(\text{Nodes})& \text{if }\text{SectorSize}=32\text{GiB}\\ {\log }_8(\text{Nodes}/2)+1& \text{if }\text{SectorSize}=64\text{GiB}\end{array}$

$\text{ApexRootsRow}=\text{TreeDHeight}-\text{PartitionTreeHeight}$

$\text{ApexLeafsRow}=\text{ApexRootsRow}-\text{ApexTreeHeight}$

$\text{ApexLeafs}=\text{TreeD}[\text{ApexLeafsRow}][k\ast \text{A}\text{..}(k+1)\ast \text{A}]$

$\text{ApexTree}=\text{TreeD}(\text{ApexLeafs})$

$\text{ApexRoots}=\text{TreeD}[\text{ApexRootsRow}]$

$\text{ApexRoot}=\text{ApexRoots}[k]=\text{ApexTree}\text{.root}$

$\text{PartitionBits}=((k\gg i)\wedge 1\mid i\in {\log }_2(\text{P}))=\mathbf{\text{le\_bits}}(k)$

$\text{PartitionPath}=({\text{TreeD}}_{\text{new}}[\text{ApexRootsRow}+i][(k\gg i)+j]\mid i\in 0\text{..}\text{ApexTreeHeight},j=\{\begin{array}{ll}1& \text{if }\mathbf{\text{is\_even}}(k\gg i)\\ -1& \text{if }\mathbf{\text{is\_odd}}(k\gg i)\end{array})={\text{TreeDNewProof}}_c[\text{TreeDHeight}-\text{PartitionTreeHeight}\text{..}]$

$\text{PubInputs}=(k,\text{CommROld},\text{CommDNew},\text{CommRNew},\text{HSelect})$

$\text{PrivInputs}=(\text{CommC},\text{RootROld},\text{RootRNew},\mathbf{\text{ApexLeafs}},\mathbf{\text{ChallengeProofs}})$

$\stackrel{―}{\underset{―}{\mathbf{\text{Circuit:}}\text{SDR Empty Sector Update}}}$

$1.\phantom{10.}\text{k}\stackrel{\diamond }{=}\mathsf{\text{alloc\_pub}}(k_{\text{pub}})$

$2.\phantom{10.}\text{comm\_r\_old}\stackrel{\diamond }{=}\mathsf{\text{alloc\_pub}}({\text{CommROld}}_{\text{pub}})$

$3.\phantom{10.}\text{comm\_d\_new}\stackrel{\diamond }{=}\mathsf{\text{alloc\_pub}}({\text{CommDNew}}_{\text{pub}})$

$4.\phantom{10.}\text{comm\_r\_new}\stackrel{\diamond }{=}\mathsf{\text{alloc\_pub}}({\text{CommRNew}}_{\text{pub}})$

$5.\phantom{10.}\text{h\_select}\stackrel{\diamond }{=}\mathsf{\text{alloc\_pub}}({\text{HSelect}}_{\text{pub}})$

$6.\phantom{10.}\text{k\_bits}\stackrel{\diamond }{=}\mathsf{\text{le\_bits\_gadget}}(\text{k},255)[\text{..}{\log }_2(P)]$

$7.\phantom{10.}\text{h\_select\_bits}\stackrel{\diamond }{=}\mathsf{\text{le\_bits\_gadget}}(\text{h\_select},255)[\text{..}6]$

$8.\phantom{10.}\text{phi}\stackrel{\diamond }{=}\mathsf{\text{poseidon\_gadget}}((\text{comm\_d\_new},\text{comm\_r\_old}))$

$9.\phantom{10.}\text{comm\_c}\stackrel{\diamond }{=}\mathsf{\text{alloc}}({\text{CommC}}_{\text{priv}})$

$10.\phantom{10.}\text{root\_r\_old}\stackrel{\diamond }{=}\mathsf{\text{alloc}}({\text{RootROld}}_{\text{priv}})$

$11.\phantom{10.}\text{root\_r\_new}\stackrel{\diamond }{=}\mathsf{\text{alloc}}({\text{RootRNew}}_{\text{priv}})$

$12.\phantom{10.}\text{apex\_leafs}:{{\mathbb{F}}_q}^{[\text{A}]}\stackrel{\diamond }{=}(\mathsf{\text{alloc}}(\text{apex\_leaf})\mid \text{apex\_leaf}\in {\text{ApexLeafs}}_{\text{priv}})$

$13.\phantom{10.}\text{partition\_path}:{{{\mathbb{F}}_q}^{[1]}}^{[\text{PartitionTreeHeight}]}\stackrel{\diamond }{=}((\mathsf{\text{alloc}}(\text{el}))\mid \text{el}\in {\text{PartitionPath}}_{\text{priv}})$

$14.\phantom{10.}\text{comm\_r\_old\_calc}\stackrel{\diamond }{=}\mathsf{\text{poseidon\_gadget}}((\text{comm\_c},\text{root\_r\_old}))$

$15.\phantom{10.}\mathsf{\text{assert\_eq}}(\text{comm\_r\_old\_calc},\text{comm\_r\_old})$

$16.\phantom{10.}\text{comm\_r\_new\_calc}\stackrel{\diamond }{=}\mathsf{\text{poseidon\_gadget}}((\text{comm\_c},\text{root\_r\_new}))$

$17.\phantom{10.}\mathsf{\text{assert\_eq}}(\text{comm\_r\_new\_calc},\text{comm\_r\_new})$

$18.\phantom{10.}\text{apex\_tree}:({{\mathbb{F}}_q}^{[\text{A}]},{{\mathbb{F}}_q}^{[A/2]},\dots ,{{\mathbb{F}}_q}^{[1]})\stackrel{\diamond }{=}\mathsf{\text{bin\_tree\_gadget}}(\text{apex\_leafs})$

$19.\phantom{10.}\text{apex\_root}=\text{apex\_tree}[\text{ApexTreeHeight}][0]$

$20.\phantom{10.}\text{comm\_d\_new\_calc}\stackrel{\diamond }{=}\mathsf{\text{bintree\_root\_gadget}}(\text{k\_bits},\text{apex\_root},\text{partition\_path})$

$21.\phantom{10.}\mathsf{\text{assert\_eq}}(\text{comm\_d\_new\_calc},\text{comm\_d\_new})$

$22.\phantom{10.}\text{rand\_bits}:{{{\mathbb{F}}_q{|}_{\{0,1\}}}^{[\text{RandChallengeBits}]}}^{[\text{C}]}\stackrel{\diamond }{=}\mathsf{\text{gen\_challenge\_bits\_gadget}}(\text{comm\_r\_new},\text{k})$

$23.\phantom{10.}\mathbf{\text{for }}\text{c\_rand\_bits}\in \text{rand\_bits}:$

$24.\phantom{10.}\text{c\_high\_and\_zeros}:{{\mathbb{F}}_q}^{[6]}=()$

$25.\phantom{10.}\mathbf{\text{for }}h,\text{h\_select\_bit}\in \mathbf{\text{zip}}(\mathbf{\text{Hs}},\text{h\_select\_bits}):$

$26.\phantom{10.}\text{c\_high\_bits}=\text{c\_rand\_bits}[\text{RandChallengeBits}-h\text{..}]$

$27.\phantom{10.}\text{c\_high}\stackrel{\diamond }{=}\mathsf{\text{lc\_gadget}}(\sum _{i\in 0\text{..}h}{2}^i\ast \text{c\_high\_bits}[i])$

$28.\phantom{10.}\text{c\_high\_or\_zero}\stackrel{\diamond }{=}\mathsf{\text{mul\_gadget}}(\text{h\_select\_bit},\text{c\_high})$

$29.\phantom{10.}\text{c\_high\_and\_zeros}\text{.}\mathbf{\text{push}}(\text{c\_high\_or\_zero})$

$30.\phantom{10.}\text{c\_high\_selected}\stackrel{\diamond }{=}\mathsf{\text{lc\_gadget}}(\sum _{i\in 0\text{..}6}\text{c\_high\_and\_zeros}[i])$

$31.\phantom{10.}\text{rho}\stackrel{\diamond }{=}\mathsf{\text{poseidon\_gadget}}((\text{phi},\text{c\_high\_selected}))$