[INFO] cloning repository https://github.com/ronin207/vc-pqc [INFO] running `Command { std: "git" "-c" "credential.helper=" "-c" "credential.helper=/workspace/cargo-home/bin/git-credential-null" "clone" "--bare" "https://github.com/ronin207/vc-pqc" "/workspace/cache/git-repos/https%3A%2F%2Fgithub.com%2Fronin207%2Fvc-pqc", kill_on_drop: false }` [INFO] [stderr] Cloning into bare repository '/workspace/cache/git-repos/https%3A%2F%2Fgithub.com%2Fronin207%2Fvc-pqc'... [INFO] running `Command { std: "git" "rev-parse" "HEAD", kill_on_drop: false }` [INFO] [stdout] 468edb09f0ba1aacacb69eb0a7b4e5a800503499 [INFO] testing ronin207/vc-pqc against beta-2025-10-28 for beta-1.92-2 [INFO] running `Command { std: "git" "clone" "/workspace/cache/git-repos/https%3A%2F%2Fgithub.com%2Fronin207%2Fvc-pqc" "/workspace/builds/worker-0-tc2/source", kill_on_drop: false }` [INFO] [stderr] Cloning into '/workspace/builds/worker-0-tc2/source'... [INFO] [stderr] done. [INFO] started tweaking git repo https://github.com/ronin207/vc-pqc [INFO] finished tweaking git repo https://github.com/ronin207/vc-pqc [INFO] tweaked toml for git repo https://github.com/ronin207/vc-pqc written to /workspace/builds/worker-0-tc2/source/Cargo.toml [INFO] validating manifest of git repo https://github.com/ronin207/vc-pqc on toolchain beta-2025-10-28 [INFO] running `Command { std: CARGO_HOME="/workspace/cargo-home" RUSTUP_HOME="/workspace/rustup-home" "/workspace/cargo-home/bin/cargo" "+beta-2025-10-28" "metadata" "--manifest-path" "Cargo.toml" "--no-deps", kill_on_drop: false }` [INFO] crate git repo https://github.com/ronin207/vc-pqc already has a lockfile, it will not be regenerated [INFO] running `Command { std: CARGO_HOME="/workspace/cargo-home" RUSTUP_HOME="/workspace/rustup-home" "/workspace/cargo-home/bin/cargo" "+beta-2025-10-28" "fetch" "--manifest-path" "Cargo.toml", kill_on_drop: false }` [INFO] running `Command { std: "docker" "create" "-v" "/var/lib/crater-agent-workspace/builds/worker-0-tc2/target:/opt/rustwide/target:rw,Z" "-v" "/var/lib/crater-agent-workspace/builds/worker-0-tc2/source:/opt/rustwide/workdir:ro,Z" "-v" "/var/lib/crater-agent-workspace/cargo-home:/opt/rustwide/cargo-home:ro,Z" "-v" "/var/lib/crater-agent-workspace/rustup-home:/opt/rustwide/rustup-home:ro,Z" "-e" "SOURCE_DIR=/opt/rustwide/workdir" "-e" "CARGO_TARGET_DIR=/opt/rustwide/target" "-e" "CARGO_HOME=/opt/rustwide/cargo-home" "-e" "RUSTUP_HOME=/opt/rustwide/rustup-home" "-w" "/opt/rustwide/workdir" "-m" "1610612736" "--user" "0:0" "--network" "none" "ghcr.io/rust-lang/crates-build-env/linux@sha256:4848fb76d95f26979359cc7e45710b1dbc8f3acb7aeedee7c460d7702230f228" "/opt/rustwide/cargo-home/bin/cargo" "+beta-2025-10-28" "metadata" "--no-deps" "--format-version=1", kill_on_drop: false }` [INFO] [stdout] 36eb1d8892466544458122d2c0f16353d896c45f177fb30a2de8546aa8871ca7 [INFO] running `Command { std: "docker" "start" "-a" "36eb1d8892466544458122d2c0f16353d896c45f177fb30a2de8546aa8871ca7", kill_on_drop: false }` [INFO] running `Command { std: "docker" "inspect" "36eb1d8892466544458122d2c0f16353d896c45f177fb30a2de8546aa8871ca7", kill_on_drop: false }` [INFO] running `Command { std: "docker" "rm" "-f" "36eb1d8892466544458122d2c0f16353d896c45f177fb30a2de8546aa8871ca7", kill_on_drop: false }` [INFO] [stdout] 36eb1d8892466544458122d2c0f16353d896c45f177fb30a2de8546aa8871ca7 [INFO] running `Command { std: "docker" "create" "-v" "/var/lib/crater-agent-workspace/builds/worker-0-tc2/target:/opt/rustwide/target:rw,Z" "-v" "/var/lib/crater-agent-workspace/builds/worker-0-tc2/source:/opt/rustwide/workdir:ro,Z" "-v" "/var/lib/crater-agent-workspace/cargo-home:/opt/rustwide/cargo-home:ro,Z" "-v" "/var/lib/crater-agent-workspace/rustup-home:/opt/rustwide/rustup-home:ro,Z" "-e" "SOURCE_DIR=/opt/rustwide/workdir" "-e" "CARGO_TARGET_DIR=/opt/rustwide/target" "-e" "CARGO_INCREMENTAL=0" "-e" "RUST_BACKTRACE=full" "-e" "RUSTFLAGS=--cap-lints=warn" "-e" "RUSTDOCFLAGS=--cap-lints=warn" "-e" "CARGO_HOME=/opt/rustwide/cargo-home" "-e" "RUSTUP_HOME=/opt/rustwide/rustup-home" "-w" "/opt/rustwide/workdir" "-m" "1610612736" "--user" "0:0" "--network" "none" "ghcr.io/rust-lang/crates-build-env/linux@sha256:4848fb76d95f26979359cc7e45710b1dbc8f3acb7aeedee7c460d7702230f228" "/opt/rustwide/cargo-home/bin/cargo" "+beta-2025-10-28" "build" "--frozen" "--message-format=json", kill_on_drop: false }` [INFO] [stdout] 1848016cd54e319d25d61de808f16d1193c75271c05b2ebafe969974b8bb9889 [INFO] running `Command { std: "docker" "start" "-a" "1848016cd54e319d25d61de808f16d1193c75271c05b2ebafe969974b8bb9889", kill_on_drop: false }` [INFO] [stderr] Compiling libc v0.2.172 [INFO] [stderr] Compiling zerocopy v0.8.25 [INFO] [stderr] Compiling serde v1.0.219 [INFO] [stderr] Compiling syn v2.0.101 [INFO] [stderr] Compiling digest v0.10.7 [INFO] [stderr] Compiling sha2 v0.10.9 [INFO] [stderr] Compiling getrandom v0.2.16 [INFO] [stderr] Compiling rand_core v0.6.4 [INFO] [stderr] Compiling ppv-lite86 v0.2.21 [INFO] [stderr] Compiling rand_chacha v0.3.1 [INFO] [stderr] Compiling rand v0.8.5 [INFO] [stderr] Compiling serde_derive v1.0.219 [INFO] [stderr] Compiling zeroize_derive v1.4.2 [INFO] [stderr] Compiling thiserror-impl v1.0.69 [INFO] [stderr] Compiling zeroize v1.8.1 [INFO] [stderr] Compiling merlin v3.0.0 [INFO] [stderr] Compiling thiserror v1.0.69 [INFO] [stderr] Compiling bincode v1.3.3 [INFO] [stderr] Compiling vc-pqc v0.1.0 (/opt/rustwide/workdir) [INFO] [stderr] Finished `dev` profile [unoptimized + debuginfo] target(s) in 19.34s [INFO] running `Command { std: "docker" "inspect" "1848016cd54e319d25d61de808f16d1193c75271c05b2ebafe969974b8bb9889", kill_on_drop: false }` [INFO] running `Command { std: "docker" "rm" "-f" "1848016cd54e319d25d61de808f16d1193c75271c05b2ebafe969974b8bb9889", kill_on_drop: false }` [INFO] [stdout] 1848016cd54e319d25d61de808f16d1193c75271c05b2ebafe969974b8bb9889 [INFO] running `Command { std: "docker" "create" "-v" "/var/lib/crater-agent-workspace/builds/worker-0-tc2/target:/opt/rustwide/target:rw,Z" "-v" "/var/lib/crater-agent-workspace/builds/worker-0-tc2/source:/opt/rustwide/workdir:ro,Z" "-v" "/var/lib/crater-agent-workspace/cargo-home:/opt/rustwide/cargo-home:ro,Z" "-v" "/var/lib/crater-agent-workspace/rustup-home:/opt/rustwide/rustup-home:ro,Z" "-e" "SOURCE_DIR=/opt/rustwide/workdir" "-e" "CARGO_TARGET_DIR=/opt/rustwide/target" "-e" "CARGO_INCREMENTAL=0" "-e" "RUST_BACKTRACE=full" "-e" "RUSTFLAGS=--cap-lints=warn" "-e" "RUSTDOCFLAGS=--cap-lints=warn" "-e" "CARGO_HOME=/opt/rustwide/cargo-home" "-e" "RUSTUP_HOME=/opt/rustwide/rustup-home" "-w" "/opt/rustwide/workdir" "-m" "1610612736" "--user" "0:0" "--network" "none" "ghcr.io/rust-lang/crates-build-env/linux@sha256:4848fb76d95f26979359cc7e45710b1dbc8f3acb7aeedee7c460d7702230f228" "/opt/rustwide/cargo-home/bin/cargo" "+beta-2025-10-28" "test" "--frozen" "--no-run" "--message-format=json", kill_on_drop: false }` [INFO] [stdout] eb7a6ee1c78152877c84ffad2bc4be1cb0da1f2bb5974722a7eab9859209f040 [INFO] running `Command { std: "docker" "start" "-a" "eb7a6ee1c78152877c84ffad2bc4be1cb0da1f2bb5974722a7eab9859209f040", kill_on_drop: false }` [INFO] [stderr] Compiling libc v0.2.172 [INFO] [stderr] Compiling either v1.15.0 [INFO] [stderr] Compiling num-traits v0.2.19 [INFO] [stderr] Compiling half v2.6.0 [INFO] [stderr] Compiling regex-syntax v0.8.5 [INFO] [stderr] Compiling memchr v2.7.5 [INFO] [stderr] Compiling clap_builder v4.5.41 [INFO] [stderr] Compiling serde v1.0.219 [INFO] [stderr] Compiling itertools v0.10.5 [INFO] [stderr] Compiling rayon v1.10.0 [INFO] [stderr] Compiling ciborium-ll v0.2.2 [INFO] [stderr] Compiling getrandom v0.2.16 [INFO] [stderr] Compiling is-terminal v0.4.16 [INFO] [stderr] Compiling plotters v0.3.7 [INFO] [stderr] Compiling rand_core v0.6.4 [INFO] [stderr] Compiling rand_chacha v0.3.1 [INFO] [stderr] Compiling merlin v3.0.0 [INFO] [stderr] Compiling regex-automata v0.4.9 [INFO] [stderr] Compiling rand v0.8.5 [INFO] [stderr] Compiling criterion-plot v0.5.0 [INFO] [stderr] Compiling clap v4.5.41 [INFO] [stderr] Compiling regex v1.11.1 [INFO] [stderr] Compiling serde_json v1.0.140 [INFO] [stderr] Compiling ciborium v0.2.2 [INFO] [stderr] Compiling bincode v1.3.3 [INFO] [stderr] Compiling vc-pqc v0.1.0 (/opt/rustwide/workdir) [INFO] [stderr] Compiling tinytemplate v1.2.1 [INFO] [stderr] Compiling criterion v0.5.1 [INFO] [stderr] Finished `test` profile [unoptimized + debuginfo] target(s) in 28.30s [INFO] running `Command { std: "docker" "inspect" "eb7a6ee1c78152877c84ffad2bc4be1cb0da1f2bb5974722a7eab9859209f040", kill_on_drop: false }` [INFO] running `Command { std: "docker" "rm" "-f" "eb7a6ee1c78152877c84ffad2bc4be1cb0da1f2bb5974722a7eab9859209f040", kill_on_drop: false }` [INFO] [stdout] eb7a6ee1c78152877c84ffad2bc4be1cb0da1f2bb5974722a7eab9859209f040 [INFO] running `Command { std: "docker" "create" "-v" "/var/lib/crater-agent-workspace/builds/worker-0-tc2/target:/opt/rustwide/target:rw,Z" "-v" "/var/lib/crater-agent-workspace/builds/worker-0-tc2/source:/opt/rustwide/workdir:ro,Z" "-v" "/var/lib/crater-agent-workspace/cargo-home:/opt/rustwide/cargo-home:ro,Z" "-v" "/var/lib/crater-agent-workspace/rustup-home:/opt/rustwide/rustup-home:ro,Z" "-e" "SOURCE_DIR=/opt/rustwide/workdir" "-e" "CARGO_TARGET_DIR=/opt/rustwide/target" "-e" "CARGO_INCREMENTAL=0" "-e" "RUST_BACKTRACE=full" "-e" "RUSTFLAGS=--cap-lints=warn" "-e" "RUSTDOCFLAGS=--cap-lints=warn" "-e" "CARGO_HOME=/opt/rustwide/cargo-home" "-e" "RUSTUP_HOME=/opt/rustwide/rustup-home" "-w" "/opt/rustwide/workdir" "-m" "1610612736" "--user" "0:0" "--network" "none" "ghcr.io/rust-lang/crates-build-env/linux@sha256:4848fb76d95f26979359cc7e45710b1dbc8f3acb7aeedee7c460d7702230f228" "/opt/rustwide/cargo-home/bin/cargo" "+beta-2025-10-28" "test" "--frozen", kill_on_drop: false }` [INFO] [stdout] 801ec578160d58d88e384b66c72cea45630dca2c1fc8ccc16b5ee05a5aae9a9f [INFO] running `Command { std: "docker" "start" "-a" "801ec578160d58d88e384b66c72cea45630dca2c1fc8ccc16b5ee05a5aae9a9f", kill_on_drop: false }` [INFO] [stderr] Finished `test` profile [unoptimized + debuginfo] target(s) in 0.17s [INFO] [stderr] Running unittests src/lib.rs (/opt/rustwide/target/debug/deps/vc_pqc-7a2cb6410c531a98) [INFO] [stdout] [INFO] [stdout] running 33 tests [INFO] [stdout] test loquat::field_p127::tests::test_fp127_rand_nonzero ... ok [INFO] [stdout] test loquat::field_utils::tests::test_field_operations ... ok [INFO] [stdout] test loquat::field_utils::tests::test_legendre_prf_deterministic ... ok [INFO] [stdout] test loquat::field_utils::tests::test_u128_field_conversion ... ok [INFO] [stdout] test loquat::fft::tests::test_fft_constant_polynomial ... ok [INFO] [stdout] test loquat::fft::tests::test_fft_ifft_roundtrip ... ok [INFO] [stdout] test loquat::fft::tests::test_fft_matches_naive_evaluations ... ok [INFO] [stdout] test loquat::field_p127::tests::test_fp2_pow_two_matches_squaring ... ok [INFO] [stdout] test loquat::field_utils::tests::test_constant_time_legendre ... ok [INFO] [stdout] test loquat::setup::tests::test_hash_functions_generation ... ok [INFO] [stdout] test loquat::setup::tests::test_invalid_security_level ... ok [INFO] [stdout] test loquat::setup::tests::test_coset_generator_power ... ok [INFO] [stdout] test loquat::sumcheck::tests::test_sumcheck_protocol ... ok [INFO] [stdout] test loquat::tests::integration_tests::test_invalid_setup_parameters ... ok [INFO] [stdout] test loquat::iop_key_id::tests::test_iop_key_identification ... ok [INFO] [stdout] test loquat::tests::integration_tests::test_field_arithmetic_edge_cases ... ok [INFO] [stdout] test loquat::setup::tests::test_loquat_setup_parameters ... ok [INFO] [stdout] test loquat::iop_key_id::tests::test_challenge_determinism ... ok [INFO] [stdout] test loquat::iop_key_id::tests::test_iop_verification ... ok [INFO] [stdout] test loquat::iop_key_id::tests::test_invalid_witness_rejection ... ok [INFO] [stdout] test loquat::keygen::tests::test_forbidden_value_avoidance_with_setup ... ok [INFO] [stdout] test loquat::keygen::tests::test_keygen_with_params ... ok [INFO] [stdout] test loquat::verify::tests::test_invalid_signature_tampered_message ... ok [INFO] [stdout] test loquat::tests::integration_tests::test_malformed_signature_rejection ... ok [INFO] [stdout] test loquat::tests::integration_tests::test_message_binding ... ok [INFO] [stdout] test loquat::tests::integration_tests::test_public_key_mismatch ... ok [INFO] [stdout] test loquat::tests::integration_tests::test_signature_unforgeability ... ok [INFO] [stdout] test loquat::tests::integration_tests::test_empty_message_signature ... ok [INFO] [stdout] test loquat::tests::integration_tests::test_large_message_signature ... ok [INFO] [stdout] test loquat::verify::tests::test_valid_signature_verification ... ok [INFO] [stdout] test loquat::tests::integration_tests::test_complete_signature_flow ... ok [INFO] [stdout] test loquat::tests::integration_tests::test_tampered_signature_components ... FAILED [INFO] [stdout] test loquat::tests::integration_tests::test_different_security_levels ... ok [INFO] [stdout] [INFO] [stdout] failures: [INFO] [stdout] [INFO] [stdout] ---- loquat::tests::integration_tests::test_tampered_signature_components stdout ---- [INFO] [stdout] [INFO] [stdout] ================== ALGORITHM 2: LOQUAT SETUP ================== [INFO] [stdout] INPUT: Security Parameter λ = 128 [INFO] [stdout] [INFO] [stdout] --- STEP 2: Public Parameters for Legendre PRF --- [INFO] [stdout] ✓ L (public key bits): 256 (derived from λ=128) [INFO] [stdout] ✓ B (challenged residuosity symbols): 64 (B ≤ L constraint satisfied) [INFO] [stdout] ✓ I = {I₁, ..., I_L}: Generated 256 random field elements from F_p [INFO] [stdout] ✓ m (degree bound): 16 (power of 2 requirement satisfied) [INFO] [stdout] ✓ n (parallel executions): 4 (where m * n = 64 ≥ B = 64) [INFO] [stdout] [INFO] [stdout] --- STEP 3: Public Parameters for Univariate Sumcheck and LDT --- [INFO] [stdout] ✓ η (localization parameter): 2 [INFO] [stdout] ✓ κ (query repetition parameter): 80 [INFO] [stdout] ✓ Minimum rate denominator: 4m + κ*2^η = 384 [INFO] [stdout] ✓ |H| = 32 [INFO] [stdout] ✓ |U| = 512 (next power of 2 ≥ 384) [INFO] [stdout] ✓ ρ* = 1 (power of two bound) [INFO] [stdout] ✓ r (LDT round complexity): 4 [INFO] [stdout] • U(1) size: 128 [INFO] [stdout] • U(2) size: 32 [INFO] [stdout] • U(3) size: 8 [INFO] [stdout] • U(4) size: 2 [INFO] [stdout] [INFO] [stdout] --- STEP 5: Parameter Validation --- [INFO] [stdout] ✓ All parameter constraints satisfied [INFO] [stdout] [INFO] [stdout] --- OUTPUT: L-pp Generated Successfully --- [INFO] [stdout] [INFO] [stdout] ================== ALGORITHM 3: LOQUAT KEY GENERATION ================== [INFO] [stdout] INPUT: Public parameters L-pp [INFO] [stdout] Following Algorithm 3 specification from rules.mdc [INFO] [stdout] [INFO] [stdout] --- STEP 2: L-KeyGen Process --- [INFO] [stdout] Parameters received: [INFO] [stdout] L = 256 (public key bit length) [INFO] [stdout] |I| = 256 (number of public indices) [INFO] [stdout] [INFO] [stdout] --- STEP 3: Generate Secret Key --- [INFO] [stdout] Requirement: Randomly pick K from F_p* excluding {-I₁, ..., -I_L} [INFO] [stdout] ✓ Excluded set {-I₁, ..., -I_L} created with 256 elements [INFO] [stdout] ✓ Secret key sampled after 1 attempt(s) [INFO] [stdout] Constraint K ∈ F_p* \ {-I₁, ..., -I_L} satisfied [INFO] [stdout] [INFO] [stdout] --- STEP 4: Generate Public Key --- [INFO] [stdout] Computing pk = L_K(I) = (L_K(I₁), ..., L_K(I_L)) [INFO] [stdout] L_K(I_1) = L_K(Fp127(0x63770ad6ca5f8e5b22d0a2f551152a6f)) = Fp127(0x0) [INFO] [stdout] L_K(I_2) = L_K(Fp127(0x2d1680f9abec80d98689fe048c755451)) = Fp127(0x1) [INFO] [stdout] L_K(I_3) = L_K(Fp127(0x275357def163445b38c0322e0c4d926a)) = Fp127(0x0) [INFO] [stdout] L_K(I_4) = L_K(Fp127(0xf09023e03d172d25fa8fef39979c66a)) = Fp127(0x0) [INFO] [stdout] L_K(I_5) = L_K(Fp127(0x3dd6609ccb142c821ed545ba0f876e44)) = Fp127(0x0) [INFO] [stdout] ... (computing remaining 251 values) [INFO] [stdout] ✓ Public key computed: L = 256 bits [INFO] [stdout] Legendre PRF output distribution: [INFO] [stdout] Value Fp127(0x1): 128 occurrences (50.0%) [INFO] [stdout] Value Fp127(0x0): 128 occurrences (50.0%) [INFO] [stdout] [INFO] [stdout] --- VERIFICATION: Legendre PRF Constraints --- [INFO] [stdout] ✓ All Legendre PRF computations verified correctly [INFO] [stdout] ✓ pk[i] = L_K(I_i) constraint satisfied for all i ∈ [L] [INFO] [stdout] [INFO] [stdout] --- STEP 5: Output Key Pair --- [INFO] [stdout] ✓ Key pair (sk, pk) generated successfully [INFO] [stdout] Secret key size: 1 field elements [INFO] [stdout] Public key size: 256 field elements (256 bits) [INFO] [stdout] [INFO] [stdout] --- SECURITY VERIFICATION --- [INFO] [stdout] ✓ sk ∉ {-I₁, ..., -I_L} (collision avoidance) [INFO] [stdout] ✓ sk ≠ 0 (non-zero requirement) [INFO] [stdout] ✓ pk = L_K(I) where L_K is the Legendre PRF with key K [INFO] [stdout] ================== ALGORITHM 3 COMPLETE ================== [INFO] [stdout] [INFO] [stdout] [INFO] [stdout] ================== ALGORITHMS 4-6: LOQUAT SIGN ================== [INFO] [stdout] INPUT: Public parameter L-pp, secret key sk, message M [INFO] [stdout] Following Algorithms 4, 5, 6 specification from rules.mdc [INFO] [stdout] Message length: 14 bytes [INFO] [stdout] Public key length: 256 field elements [INFO] [stdout] Parameters: m=16, n=4, L=256, B=64, κ=80 [INFO] [stdout] ✓ Message commitment computed: 32 bytes [INFO] [stdout] [INFO] [stdout] ================== ALGORITHM 4: LOQUAT SIGN PART I ================== [INFO] [stdout] [INFO] [stdout] --- PHASE 1: Commit to secret key and randomness --- [INFO] [stdout] Following Algorithm 4, Phase 1 specification [INFO] [stdout] [INFO] [stdout] --- Step 1.1: Computing T values (Legendre PRF outputs) --- [INFO] [stdout] ✓ Generated vanishing polynomial values Z_H(x) over U [INFO] [stdout] ✓ Sampling randomness matrix r_{j,i} and constructing masked polynomials [INFO] [stdout] ✓ Generated randomness matrix r_{j,i} for j ∈ [4], i ∈ [16] [INFO] [stdout] ✓ Masked commitments prepared for Merkle binding over U [INFO] [stdout] ✓ Computed masked evaluations ĉ'_j|_U for all j ∈ [n] [INFO] [stdout] [INFO] [stdout] --- Step 1.4: Merkle commitment to c'_j evaluations over U --- [INFO] [stdout] ✓ Merkle tree created with 512 leaves for |U| = 512 [INFO] [stdout] ✓ root_c committed to transcript [INFO] [stdout] ✓ σ₁ = (root_c, {T_{i,j}}) added to transcript [INFO] [stdout] [INFO] [stdout] --- PHASE 2: Compute residuosity symbols --- [INFO] [stdout] Following Algorithm 4, Phase 2 specification [INFO] [stdout] ✓ h₁ = H₁(σ₁, M) computed [INFO] [stdout] ✓ Expanded h₁ to get I_{i,j} indices: 64 total [INFO] [stdout] [INFO] [stdout] --- Step 2.1: Computing o_{i,j} values --- [INFO] [stdout] ✓ σ₂ = {o_{i,j}} added to transcript [INFO] [stdout] [INFO] [stdout] --- PHASE 3: Compute witness vector for univariate sumcheck --- [INFO] [stdout] Following Algorithm 4, Phase 3 specification [INFO] [stdout] ✓ h₂ = H₂(σ₂, h₁) computed [INFO] [stdout] ✓ Expanded h₂ to get λ_{i,j} and ε_j values [INFO] [stdout] [INFO] [stdout] --- Step 3.3: Building witness polynomial data --- [INFO] [stdout] ✓ Polynomial evaluations over H sum to μ [INFO] [stdout] ✓ μ = Σ_{j=1}^n ε_j * (Σ_{i=1}^m λ_{i,j} * o_{i,j}) = Fp2(Fp127(0xd1d6964309743ecc28c4a1a90dc6942), Fp127(0x0)) [INFO] [stdout] [INFO] [stdout] --- Step 3.4: Executing univariate sumcheck protocol --- [INFO] [stdout] [INFO] [stdout] --- SUMCHECK PROOF GENERATION --- [INFO] [stdout] Polynomial evaluations length: 32 [INFO] [stdout] Expected length (2^5): 32 [INFO] [stdout] Claimed sum: Fp2(Fp127(0xd1d6964309743ecc28c4a1a90dc6942), Fp127(0x0)) [INFO] [stdout] First few evaluations: [Fp2(Fp127(0x4c453aaa279c24288c5f85e57e2178c0), Fp127(0x0)), Fp2(Fp127(0x1b8c17b99766fea0583a61d84144ae06), Fp127(0x0)), Fp2(Fp127(0x7341d4ee0fb0d45975d6a1a49ddd3299), Fp127(0x0)), Fp2(Fp127(0x5f7b060274ebdf8afc1e84d19a81e076), Fp127(0x0)), Fp2(Fp127(0x7da8cb69fc9a69511cba4baf11b412f4), Fp127(0x0)), Fp2(Fp127(0x77d31f5061dbac1326ca5286bf82a4c7), Fp127(0x0)), Fp2(Fp127(0x13ec8af3299c594c5859347e7cbe883c), Fp127(0x0)), Fp2(Fp127(0x2630460f0bf69167c69ca2a7e189f31d), Fp127(0x0))] [INFO] [stdout] Computed sum from polynomial_evals: Fp2(Fp127(0xd1d6964309743ecc28c4a1a90dc6942), Fp127(0x0)) [INFO] [stdout] [INFO] [stdout] Prover Round 0: [INFO] [stdout] Current evaluations length: 32 [INFO] [stdout] g_0(0): Fp2(Fp127(0x30545ca952c02fb1ed138c6582d7b2ee), Fp127(0x0)) [INFO] [stdout] g_0(1): Fp2(Fp127(0x5cc90cbaddd7143ad578bdb50e04b653), Fp127(0x0)) [INFO] [stdout] g_0(0) + g_0(1): Fp2(Fp127(0xd1d6964309743ecc28c4a1a90dc6942), Fp127(0x0)) [INFO] [stdout] Challenge: Fp2(Fp127(0x7e57f86942f52e70288910693371deac), Fp127(0x3eda320da829c34a0f6785e467f0c961)) [INFO] [stdout] Next evaluations length: 16 [INFO] [stdout] [INFO] [stdout] Prover Round 1: [INFO] [stdout] Current evaluations length: 16 [INFO] [stdout] g_1(0): Fp2(Fp127(0x248b13558dd56247d03b7017b7fe19f7), Fp127(0x4f57f4f20f5ecd610b7ea3917299c6be)) [INFO] [stdout] g_1(1): Fp2(Fp127(0x45ab8afe8805f9369b4b15e87a1cca4a), Fp127(0x2b031c91088d076ad62bd4a194cfa7fc)) [INFO] [stdout] g_1(0) + g_1(1): Fp2(Fp127(0x6a369e5415db5b7e6b868600321ae441), Fp127(0x7a5b118317ebd4cbe1aa783307696eba)) [INFO] [stdout] Challenge: Fp2(Fp127(0x8b6019c70e9b4dc6670cd15f6f9c19b), Fp127(0x1b92d4111d3d30a026b42f81c65c235a)) [INFO] [stdout] Next evaluations length: 8 [INFO] [stdout] [INFO] [stdout] Prover Round 2: [INFO] [stdout] Current evaluations length: 8 [INFO] [stdout] g_2(0): Fp2(Fp127(0x77fae3af43042cb28f4e3a7e36365f1c), Fp127(0x596584564d73e2b667115de5cc9f35c1)) [INFO] [stdout] g_2(1): Fp2(Fp127(0x2e8ebba54f0ea677b03ef553097d4fc1), Fp127(0x54818f674dd1be8b6239889880202458)) [INFO] [stdout] g_2(0) + g_2(1): Fp2(Fp127(0x26899f549212d32a3f8d2fd13fb3aede), Fp127(0x2de713bd9b45a141c94ae67e4cbf5a1a)) [INFO] [stdout] Challenge: Fp2(Fp127(0x2ab27bc34349d377f23712d6e90626be), Fp127(0x54bed009a62b5f306f2fc215bd3c7dc2)) [INFO] [stdout] Next evaluations length: 4 [INFO] [stdout] [INFO] [stdout] Prover Round 3: [INFO] [stdout] Current evaluations length: 4 [INFO] [stdout] g_3(0): Fp2(Fp127(0x4754ff6f54746883fd0e89886ac2e2ad), Fp127(0x32bfda05c47581c690080c99173b9c8)) [INFO] [stdout] g_3(1): Fp2(Fp127(0x255f78f0a04124123f6eb9399b5081bf), Fp127(0x4d41da72de4a49f921994233fba1793d)) [INFO] [stdout] g_3(0) + g_3(1): Fp2(Fp127(0x6cb4785ff4b58c963c7d42c20613646c), Fp127(0x506dd8133a91a2158a99c2fd8d153305)) [INFO] [stdout] Challenge: Fp2(Fp127(0x17949254c7f301e424d5385fe66ec61c), Fp127(0x520afb8ddc5b6a3583385255f7a13ce6)) [INFO] [stdout] Next evaluations length: 2 [INFO] [stdout] [INFO] [stdout] Prover Round 4: [INFO] [stdout] Current evaluations length: 2 [INFO] [stdout] g_4(0): Fp2(Fp127(0x715d0fe81b6c0434ae9d3d433f8e61ee), Fp127(0x4ac67aa0ef14a36d126078535ad20fd5)) [INFO] [stdout] g_4(1): Fp2(Fp127(0x2b1c3bc8ffc22b16d2f54e3c49159d36), Fp127(0x610a1c77bbd170d0b8459d24bf02b3c1)) [INFO] [stdout] g_4(0) + g_4(1): Fp2(Fp127(0x1c794bb11b2e2f4b81928b7f88a3ff25), Fp127(0x2bd09718aae6143dcaa6157819d4c397)) [INFO] [stdout] Challenge: Fp2(Fp127(0x390fa92006b21ded78a01814fd9ed5ee), Fp127(0x43c1b946b4ab0da9570bfd00aae36d2)) [INFO] [stdout] Next evaluations length: 1 [INFO] [stdout] [INFO] [stdout] Final evaluation: Fp2(Fp127(0x37b7468e7b3691f19d5bbd75fa77e3ec), Fp127(0x162117b69954f2e29be178180409baa3)) [INFO] [stdout] Generated 5 round polynomials [INFO] [stdout] ✓ Generated πUS with claimed_sum: Fp2(Fp127(0xd1d6964309743ecc28c4a1a90dc6942), Fp127(0x0)) [INFO] [stdout] [INFO] [stdout] ================== ALGORITHM 5: LOQUAT SIGN PART II ================== [INFO] [stdout] ✓ σ₃ = (root_s, S) added to transcript [INFO] [stdout] ✓ h₃ = H₃(σ₃, h₂) computed [INFO] [stdout] ✓ σ₄ = (root_h) added to transcript [INFO] [stdout] ✓ h₄ = H₄(σ₄, h₃) computed [INFO] [stdout] ✓ f^(0) evaluations computed over U [INFO] [stdout] [INFO] [stdout] ================== ALGORITHM 6: LOQUAT SIGN PART III (LDT) ================== [INFO] [stdout] ✓ LDT codeword length: 512 (evaluations of f^(0) over U) [INFO] [stdout] [INFO] [stdout] --- FINAL SIGNATURE ASSEMBLY --- [INFO] [stdout] ✓ σ = {root_c, root_s, root_h, T_{i,j}, o_{i,j}, πUS, πLDT} assembled [INFO] [stdout] ================== ALGORITHMS 4-6 COMPLETE ================== [INFO] [stdout] [INFO] [stdout] [INFO] [stdout] ================== ALGORITHM 7: LOQUAT VERIFY ================== [INFO] [stdout] INPUT: Signature σ, public key pk, message M [INFO] [stdout] ✓ Message commitment verified [INFO] [stdout] ✓ σ₁ = (root_c, {T_{i,j}}) added to transcript [INFO] [stdout] ✓ h₁ = H₁(σ₁, M) recomputed [INFO] [stdout] ✓ Expanded h₁ to regenerate I_{i,j} indices [INFO] [stdout] ✓ σ₂ = {o_{i,j}} added to transcript [INFO] [stdout] ✓ h₂ = H₂(σ₂, h₁) recomputed [INFO] [stdout] ✓ Expanded h₂ to regenerate λ_{i,j} and ε_j values [INFO] [stdout] [INFO] [stdout] ================== ALGORITHM 7: STEP 3 - CHECKING PROOFS ================== [INFO] [stdout] [INFO] [stdout] --- Step 3.1: Legendre PRF Constraint Verification --- [INFO] [stdout] ✗ FAILED: Legendre PRF check failed at [0][0] [INFO] [stdout] [INFO] [stdout] ================== ALGORITHM 7: LOQUAT VERIFY ================== [INFO] [stdout] INPUT: Signature σ, public key pk, message M [INFO] [stdout] ✓ Message commitment verified [INFO] [stdout] ✓ σ₁ = (root_c, {T_{i,j}}) added to transcript [INFO] [stdout] ✓ h₁ = H₁(σ₁, M) recomputed [INFO] [stdout] ✓ Expanded h₁ to regenerate I_{i,j} indices [INFO] [stdout] ✓ σ₂ = {o_{i,j}} added to transcript [INFO] [stdout] ✓ h₂ = H₂(σ₂, h₁) recomputed [INFO] [stdout] ✓ Expanded h₂ to regenerate λ_{i,j} and ε_j values [INFO] [stdout] [INFO] [stdout] ================== ALGORITHM 7: STEP 3 - CHECKING PROOFS ================== [INFO] [stdout] [INFO] [stdout] --- Step 3.1: Legendre PRF Constraint Verification --- [INFO] [stdout] ✓ All Legendre PRF checks passed [INFO] [stdout] ✓ μ value verified [INFO] [stdout] ✓ Π rows verified [INFO] [stdout] ✓ f^(0) evaluations verified [INFO] [stdout] [INFO] [stdout] --- Step 3.2: Univariate Sumcheck Verification --- [INFO] [stdout] [INFO] [stdout] --- SUMCHECK VERIFICATION DETAILS --- [INFO] [stdout] Number of variables: 5 [INFO] [stdout] Proof round polynomials: 5 [INFO] [stdout] Proof claimed sum: Fp2(Fp127(0xd1d6964309743ecc28c4a1a90dc6943), Fp127(0x0)) [INFO] [stdout] Proof final evaluation: Fp2(Fp127(0x37b7468e7b3691f19d5bbd75fa77e3ec), Fp127(0x162117b69954f2e29be178180409baa3)) [INFO] [stdout] Following Univariate Sumcheck protocol from rules.mdc [INFO] [stdout] ✓ Claimed sum added to transcript [INFO] [stdout] Starting verification with claimed sum: Fp2(Fp127(0xd1d6964309743ecc28c4a1a90dc6943), Fp127(0x0)) [INFO] [stdout] [INFO] [stdout] Round 0: [INFO] [stdout] p(0): Fp2(Fp127(0x30545ca952c02fb1ed138c6582d7b2ee), Fp127(0x0)) [INFO] [stdout] p(1): Fp2(Fp127(0x5cc90cbaddd7143ad578bdb50e04b653), Fp127(0x0)) [INFO] [stdout] p(0) + p(1): Fp2(Fp127(0xd1d6964309743ecc28c4a1a90dc6942), Fp127(0x0)) [INFO] [stdout] Expected sum (last_sum): Fp2(Fp127(0xd1d6964309743ecc28c4a1a90dc6943), Fp127(0x0)) [INFO] [stdout] ✗ SUMCHECK FAILED at round 0: Sum constraint violation [INFO] [stdout] p(0) + p(1) = Fp2(Fp127(0xd1d6964309743ecc28c4a1a90dc6942), Fp127(0x0)) [INFO] [stdout] Expected: Fp2(Fp127(0xd1d6964309743ecc28c4a1a90dc6943), Fp127(0x0)) [INFO] [stdout] ✗ SUMCHECK FAILED [INFO] [stdout] [INFO] [stdout] ================== ALGORITHMS 4-6: LOQUAT SIGN ================== [INFO] [stdout] INPUT: Public parameter L-pp, secret key sk, message M [INFO] [stdout] Following Algorithms 4, 5, 6 specification from rules.mdc [INFO] [stdout] Message length: 14 bytes [INFO] [stdout] Public key length: 256 field elements [INFO] [stdout] Parameters: m=16, n=4, L=256, B=64, κ=80 [INFO] [stdout] ✓ Message commitment computed: 32 bytes [INFO] [stdout] [INFO] [stdout] ================== ALGORITHM 4: LOQUAT SIGN PART I ================== [INFO] [stdout] [INFO] [stdout] --- PHASE 1: Commit to secret key and randomness --- [INFO] [stdout] Following Algorithm 4, Phase 1 specification [INFO] [stdout] [INFO] [stdout] --- Step 1.1: Computing T values (Legendre PRF outputs) --- [INFO] [stdout] ✓ Generated vanishing polynomial values Z_H(x) over U [INFO] [stdout] ✓ Sampling randomness matrix r_{j,i} and constructing masked polynomials [INFO] [stdout] ✓ Generated randomness matrix r_{j,i} for j ∈ [4], i ∈ [16] [INFO] [stdout] ✓ Masked commitments prepared for Merkle binding over U [INFO] [stdout] ✓ Computed masked evaluations ĉ'_j|_U for all j ∈ [n] [INFO] [stdout] [INFO] [stdout] --- Step 1.4: Merkle commitment to c'_j evaluations over U --- [INFO] [stdout] ✓ Merkle tree created with 512 leaves for |U| = 512 [INFO] [stdout] ✓ root_c committed to transcript [INFO] [stdout] ✓ σ₁ = (root_c, {T_{i,j}}) added to transcript [INFO] [stdout] [INFO] [stdout] --- PHASE 2: Compute residuosity symbols --- [INFO] [stdout] Following Algorithm 4, Phase 2 specification [INFO] [stdout] ✓ h₁ = H₁(σ₁, M) computed [INFO] [stdout] ✓ Expanded h₁ to get I_{i,j} indices: 64 total [INFO] [stdout] [INFO] [stdout] --- Step 2.1: Computing o_{i,j} values --- [INFO] [stdout] ✓ σ₂ = {o_{i,j}} added to transcript [INFO] [stdout] [INFO] [stdout] --- PHASE 3: Compute witness vector for univariate sumcheck --- [INFO] [stdout] Following Algorithm 4, Phase 3 specification [INFO] [stdout] ✓ h₂ = H₂(σ₂, h₁) computed [INFO] [stdout] ✓ Expanded h₂ to get λ_{i,j} and ε_j values [INFO] [stdout] [INFO] [stdout] --- Step 3.3: Building witness polynomial data --- [INFO] [stdout] ✓ Polynomial evaluations over H sum to μ [INFO] [stdout] ✓ μ = Σ_{j=1}^n ε_j * (Σ_{i=1}^m λ_{i,j} * o_{i,j}) = Fp2(Fp127(0x790b1ef8552e188fb296260840f58b89), Fp127(0x0)) [INFO] [stdout] [INFO] [stdout] --- Step 3.4: Executing univariate sumcheck protocol --- [INFO] [stdout] [INFO] [stdout] --- SUMCHECK PROOF GENERATION --- [INFO] [stdout] Polynomial evaluations length: 32 [INFO] [stdout] Expected length (2^5): 32 [INFO] [stdout] Claimed sum: Fp2(Fp127(0x790b1ef8552e188fb296260840f58b89), Fp127(0x0)) [INFO] [stdout] First few evaluations: [Fp2(Fp127(0x5854e97794be4de3833e4d11af37cb4d), Fp127(0x0)), Fp2(Fp127(0x1dbe3818343542b46cae4e4095e1d1ea), Fp127(0x0)), Fp2(Fp127(0x1702fb8aca101496911d80e59094be6c), Fp127(0x0)), Fp2(Fp127(0x320a11f840836bae5d39b1c062b745cd), Fp127(0x0)), Fp2(Fp127(0xaec21602505e450a8779c1e1be5465f), Fp127(0x0)), Fp2(Fp127(0x49496761473e3e1a3771f05730f3a416), Fp127(0x0)), Fp2(Fp127(0x5435fdfd4a6d9639b6c40d08029a444f), Fp127(0x0)), Fp2(Fp127(0x8c558c10169c06dd5b02aed06b84d2e), Fp127(0x0))] [INFO] [stdout] Computed sum from polynomial_evals: Fp2(Fp127(0x790b1ef8552e188fb296260840f58b89), Fp127(0x0)) [INFO] [stdout] [INFO] [stdout] Prover Round 0: [INFO] [stdout] Current evaluations length: 32 [INFO] [stdout] g_0(0): Fp2(Fp127(0x2d86ee3a1536bb8664202dce4d30d843), Fp127(0x0)) [INFO] [stdout] g_0(1): Fp2(Fp127(0x4b8430be3ff75d094e75f839f3c4b346), Fp127(0x0)) [INFO] [stdout] g_0(0) + g_0(1): Fp2(Fp127(0x790b1ef8552e188fb296260840f58b89), Fp127(0x0)) [INFO] [stdout] Challenge: Fp2(Fp127(0x34ff55098be704a574ced364e10f8242), Fp127(0x604e3144a34337abff367216b1033b1d)) [INFO] [stdout] Next evaluations length: 16 [INFO] [stdout] [INFO] [stdout] Prover Round 1: [INFO] [stdout] Current evaluations length: 16 [INFO] [stdout] g_1(0): Fp2(Fp127(0x4dcacbecf778cf67223ffe364e62f6f6), Fp127(0x343b5c28fff12449f042ea481f56c577)) [INFO] [stdout] g_1(1): Fp2(Fp127(0x4662c946f25c3dbc5bd8f25ca6aee3bf), Fp127(0x1f1c7a51df44cab2d470da99435eb609)) [INFO] [stdout] g_1(0) + g_1(1): Fp2(Fp127(0x142d9533e9d50d237e18f092f511dab6), Fp127(0x5357d67adf35eefcc4b3c4e162b57b80)) [INFO] [stdout] Challenge: Fp2(Fp127(0x23de30d07ff3aefa4a88cf756f3f8836), Fp127(0x3c4fdc49481aa51cf4686c7c1310a8be)) [INFO] [stdout] Next evaluations length: 8 [INFO] [stdout] [INFO] [stdout] Prover Round 2: [INFO] [stdout] Current evaluations length: 8 [INFO] [stdout] g_2(0): Fp2(Fp127(0x17bc2d8e7567ce92bc31e990c082ec5e), Fp127(0x51aad2ccff6a6676332a82a2efc9f799)) [INFO] [stdout] g_2(1): Fp2(Fp127(0x5333ebb6f913ca2d7fe5878e298847ac), Fp127(0x2ed0c257f309d0ebbf053c101254151f)) [INFO] [stdout] g_2(0) + g_2(1): Fp2(Fp127(0x6af019456e7b98c03c17711eea0b340a), Fp127(0x7b9524f2743761f22fbeb3021e0cb9)) [INFO] [stdout] Challenge: Fp2(Fp127(0x42a0acd5779d7c8d6caf97e1f8b38918), Fp127(0x5b5cc7bc92483f3990c9bfd9eff3101a)) [INFO] [stdout] Next evaluations length: 4 [INFO] [stdout] [INFO] [stdout] Prover Round 3: [INFO] [stdout] Current evaluations length: 4 [INFO] [stdout] g_3(0): Fp2(Fp127(0x69eec16989e6a5aa861cea2329178ee3), Fp127(0x601beaa0891a99a1a93620e792079e9d)) [INFO] [stdout] g_3(1): Fp2(Fp127(0x37fe2dce015f654b74747f552a324d36), Fp127(0x1752f21ff1c433aae3547c8ca2ccdf1f)) [INFO] [stdout] g_3(0) + g_3(1): Fp2(Fp127(0x21ecef378b460af5fa9169785349dc1a), Fp127(0x776edcc07adecd4c8c8a9d7434d47dbc)) [INFO] [stdout] Challenge: Fp2(Fp127(0x7944ea2d96f284842046a7918d740a5), Fp127(0x1cb97c5854d3ea2ce19d3d9c42fee2c6)) [INFO] [stdout] Next evaluations length: 2 [INFO] [stdout] [INFO] [stdout] Prover Round 4: [INFO] [stdout] Current evaluations length: 2 [INFO] [stdout] g_4(0): Fp2(Fp127(0x530be9ca046510b7d91b5c2cf816599a), Fp127(0x7fb8c64d958c9e127f8c4dd2aa937831)) [INFO] [stdout] g_4(1): Fp2(Fp127(0x2a1bfd78c73c8364f3da60bc664862e7), Fp127(0x444450f606247ceaf191d6765734682)) [INFO] [stdout] g_4(0) + g_4(1): Fp2(Fp127(0x7d27e742cba1941cccf5bce95e5ebc81), Fp127(0x3fd0b5cf5eee5e12ea56b3a1006beb4)) [INFO] [stdout] Challenge: Fp2(Fp127(0x289a7a7b4519e21729519c781c759b70), Fp127(0x52008c28d2ffd72834fd35156a679f04)) [INFO] [stdout] Next evaluations length: 1 [INFO] [stdout] [INFO] [stdout] Final evaluation: Fp2(Fp127(0x5dcb5c6937a543d1e9da0f976ff86ded), Fp127(0x5b39ecba20aebdd9b436d7ba7ba6a312)) [INFO] [stdout] Generated 5 round polynomials [INFO] [stdout] ✓ Generated πUS with claimed_sum: Fp2(Fp127(0x790b1ef8552e188fb296260840f58b89), Fp127(0x0)) [INFO] [stdout] [INFO] [stdout] ================== ALGORITHM 5: LOQUAT SIGN PART II ================== [INFO] [stdout] ✓ σ₃ = (root_s, S) added to transcript [INFO] [stdout] ✓ h₃ = H₃(σ₃, h₂) computed [INFO] [stdout] ✓ σ₄ = (root_h) added to transcript [INFO] [stdout] ✓ h₄ = H₄(σ₄, h₃) computed [INFO] [stdout] ✓ f^(0) evaluations computed over U [INFO] [stdout] [INFO] [stdout] ================== ALGORITHM 6: LOQUAT SIGN PART III (LDT) ================== [INFO] [stdout] ✓ LDT codeword length: 512 (evaluations of f^(0) over U) [INFO] [stdout] [INFO] [stdout] --- FINAL SIGNATURE ASSEMBLY --- [INFO] [stdout] ✓ σ = {root_c, root_s, root_h, T_{i,j}, o_{i,j}, πUS, πLDT} assembled [INFO] [stdout] ================== ALGORITHMS 4-6 COMPLETE ================== [INFO] [stdout] [INFO] [stdout] [INFO] [stdout] ================== ALGORITHM 7: LOQUAT VERIFY ================== [INFO] [stdout] INPUT: Signature σ, public key pk, message M [INFO] [stdout] ✓ Message commitment verified [INFO] [stdout] ✓ σ₁ = (root_c, {T_{i,j}}) added to transcript [INFO] [stdout] ✓ h₁ = H₁(σ₁, M) recomputed [INFO] [stdout] ✓ Expanded h₁ to regenerate I_{i,j} indices [INFO] [stdout] ✓ σ₂ = {o_{i,j}} added to transcript [INFO] [stdout] ✓ h₂ = H₂(σ₂, h₁) recomputed [INFO] [stdout] ✓ Expanded h₂ to regenerate λ_{i,j} and ε_j values [INFO] [stdout] [INFO] [stdout] ================== ALGORITHM 7: STEP 3 - CHECKING PROOFS ================== [INFO] [stdout] [INFO] [stdout] --- Step 3.1: Legendre PRF Constraint Verification --- [INFO] [stdout] ✓ All Legendre PRF checks passed [INFO] [stdout] ✓ μ value verified [INFO] [stdout] ✓ Π rows verified [INFO] [stdout] ✓ f^(0) evaluations verified [INFO] [stdout] [INFO] [stdout] --- Step 3.2: Univariate Sumcheck Verification --- [INFO] [stdout] [INFO] [stdout] --- SUMCHECK VERIFICATION DETAILS --- [INFO] [stdout] Number of variables: 5 [INFO] [stdout] Proof round polynomials: 5 [INFO] [stdout] Proof claimed sum: Fp2(Fp127(0x790b1ef8552e188fb296260840f58b89), Fp127(0x0)) [INFO] [stdout] Proof final evaluation: Fp2(Fp127(0x5dcb5c6937a543d1e9da0f976ff86ded), Fp127(0x5b39ecba20aebdd9b436d7ba7ba6a312)) [INFO] [stdout] Following Univariate Sumcheck protocol from rules.mdc [INFO] [stdout] ✓ Claimed sum added to transcript [INFO] [stdout] Starting verification with claimed sum: Fp2(Fp127(0x790b1ef8552e188fb296260840f58b89), Fp127(0x0)) [INFO] [stdout] [INFO] [stdout] Round 0: [INFO] [stdout] p(0): Fp2(Fp127(0x2d86ee3a1536bb8664202dce4d30d843), Fp127(0x0)) [INFO] [stdout] p(1): Fp2(Fp127(0x4b8430be3ff75d094e75f839f3c4b346), Fp127(0x0)) [INFO] [stdout] p(0) + p(1): Fp2(Fp127(0x790b1ef8552e188fb296260840f58b89), Fp127(0x0)) [INFO] [stdout] Expected sum (last_sum): Fp2(Fp127(0x790b1ef8552e188fb296260840f58b89), Fp127(0x0)) [INFO] [stdout] ✓ Sum constraint satisfied: p(0) + p(1) = last_sum [INFO] [stdout] Challenge: Fp2(Fp127(0x34ff55098be704a574ced364e10f8242), Fp127(0x604e3144a34337abff367216b1033b1d)) [INFO] [stdout] p(challenge): Fp2(Fp127(0x142d9533e9d50d237e18f092f511dab6), Fp127(0x5357d67adf35eefcc4b3c4e162b57b80)) [INFO] [stdout] Next evaluations length: 16 [INFO] [stdout] [INFO] [stdout] Round 1: [INFO] [stdout] p(0): Fp2(Fp127(0x4dcacbecf778cf67223ffe364e62f6f6), Fp127(0x343b5c28fff12449f042ea481f56c577)) [INFO] [stdout] p(1): Fp2(Fp127(0x4662c946f25c3dbc5bd8f25ca6aee3bf), Fp127(0x1f1c7a51df44cab2d470da99435eb609)) [INFO] [stdout] p(0) + p(1): Fp2(Fp127(0x142d9533e9d50d237e18f092f511dab6), Fp127(0x5357d67adf35eefcc4b3c4e162b57b80)) [INFO] [stdout] Expected sum (last_sum): Fp2(Fp127(0x142d9533e9d50d237e18f092f511dab6), Fp127(0x5357d67adf35eefcc4b3c4e162b57b80)) [INFO] [stdout] ✓ Sum constraint satisfied: p(0) + p(1) = last_sum [INFO] [stdout] Challenge: Fp2(Fp127(0x23de30d07ff3aefa4a88cf756f3f8836), Fp127(0x3c4fdc49481aa51cf4686c7c1310a8be)) [INFO] [stdout] p(challenge): Fp2(Fp127(0x6af019456e7b98c03c17711eea0b340a), Fp127(0x7b9524f2743761f22fbeb3021e0cb9)) [INFO] [stdout] Next evaluations length: 8 [INFO] [stdout] [INFO] [stdout] Round 2: [INFO] [stdout] p(0): Fp2(Fp127(0x17bc2d8e7567ce92bc31e990c082ec5e), Fp127(0x51aad2ccff6a6676332a82a2efc9f799)) [INFO] [stdout] p(1): Fp2(Fp127(0x5333ebb6f913ca2d7fe5878e298847ac), Fp127(0x2ed0c257f309d0ebbf053c101254151f)) [INFO] [stdout] p(0) + p(1): Fp2(Fp127(0x6af019456e7b98c03c17711eea0b340a), Fp127(0x7b9524f2743761f22fbeb3021e0cb9)) [INFO] [stdout] Expected sum (last_sum): Fp2(Fp127(0x6af019456e7b98c03c17711eea0b340a), Fp127(0x7b9524f2743761f22fbeb3021e0cb9)) [INFO] [stdout] ✓ Sum constraint satisfied: p(0) + p(1) = last_sum [INFO] [stdout] Challenge: Fp2(Fp127(0x42a0acd5779d7c8d6caf97e1f8b38918), Fp127(0x5b5cc7bc92483f3990c9bfd9eff3101a)) [INFO] [stdout] p(challenge): Fp2(Fp127(0x21ecef378b460af5fa9169785349dc1a), Fp127(0x776edcc07adecd4c8c8a9d7434d47dbc)) [INFO] [stdout] Next evaluations length: 4 [INFO] [stdout] [INFO] [stdout] Round 3: [INFO] [stdout] p(0): Fp2(Fp127(0x69eec16989e6a5aa861cea2329178ee3), Fp127(0x601beaa0891a99a1a93620e792079e9d)) [INFO] [stdout] p(1): Fp2(Fp127(0x37fe2dce015f654b74747f552a324d36), Fp127(0x1752f21ff1c433aae3547c8ca2ccdf1f)) [INFO] [stdout] p(0) + p(1): Fp2(Fp127(0x21ecef378b460af5fa9169785349dc1a), Fp127(0x776edcc07adecd4c8c8a9d7434d47dbc)) [INFO] [stdout] Expected sum (last_sum): Fp2(Fp127(0x21ecef378b460af5fa9169785349dc1a), Fp127(0x776edcc07adecd4c8c8a9d7434d47dbc)) [INFO] [stdout] ✓ Sum constraint satisfied: p(0) + p(1) = last_sum [INFO] [stdout] Challenge: Fp2(Fp127(0x7944ea2d96f284842046a7918d740a5), Fp127(0x1cb97c5854d3ea2ce19d3d9c42fee2c6)) [INFO] [stdout] p(challenge): Fp2(Fp127(0x7d27e742cba1941cccf5bce95e5ebc81), Fp127(0x3fd0b5cf5eee5e12ea56b3a1006beb4)) [INFO] [stdout] Next evaluations length: 2 [INFO] [stdout] [INFO] [stdout] Round 4: [INFO] [stdout] p(0): Fp2(Fp127(0x530be9ca046510b7d91b5c2cf816599a), Fp127(0x7fb8c64d958c9e127f8c4dd2aa937831)) [INFO] [stdout] p(1): Fp2(Fp127(0x2a1bfd78c73c8364f3da60bc664862e7), Fp127(0x444450f606247ceaf191d6765734682)) [INFO] [stdout] p(0) + p(1): Fp2(Fp127(0x7d27e742cba1941cccf5bce95e5ebc81), Fp127(0x3fd0b5cf5eee5e12ea56b3a1006beb4)) [INFO] [stdout] Expected sum (last_sum): Fp2(Fp127(0x7d27e742cba1941cccf5bce95e5ebc81), Fp127(0x3fd0b5cf5eee5e12ea56b3a1006beb4)) [INFO] [stdout] ✓ Sum constraint satisfied: p(0) + p(1) = last_sum [INFO] [stdout] Challenge: Fp2(Fp127(0x289a7a7b4519e21729519c781c759b70), Fp127(0x52008c28d2ffd72834fd35156a679f04)) [INFO] [stdout] p(challenge): Fp2(Fp127(0x5dcb5c6937a543d1e9da0f976ff86ded), Fp127(0x5b39ecba20aebdd9b436d7ba7ba6a312)) [INFO] [stdout] Next evaluations length: 1 [INFO] [stdout] [INFO] [stdout] Final evaluation check: [INFO] [stdout] Computed final value: Fp2(Fp127(0x5dcb5c6937a543d1e9da0f976ff86ded), Fp127(0x5b39ecba20aebdd9b436d7ba7ba6a312)) [INFO] [stdout] Proof final evaluation: Fp2(Fp127(0x5dcb5c6937a543d1e9da0f976ff86ded), Fp127(0x5b39ecba20aebdd9b436d7ba7ba6a312)) [INFO] [stdout] Match: true [INFO] [stdout] ✓ SUMCHECK VERIFICATION COMPLETE: All rounds passed [INFO] [stdout] ✓ SUMCHECK PASSED [INFO] [stdout] ✓ σ₃ = (root_s, S) added to transcript [INFO] [stdout] ✓ h₃ challenge verified [INFO] [stdout] ✓ σ₄ = (root_h) added to transcript [INFO] [stdout] ✓ h₄ challenge verified [INFO] [stdout] [INFO] [stdout] --- Step 3.3: Low-Degree Test Verification --- [INFO] [stdout] --- ALGORITHM 7: LDT VERIFICATION (Steps 4-6) --- [INFO] [stdout] Following rules.mdc: 'Verify LDT and Sumcheck Consistency at Query Points' [INFO] [stdout] ✓ LDT structure verification: 5 commitments, 80 openings [INFO] [stdout] ✓ Re-derived 4 FRI folding challenges [INFO] [stdout] ✗ FRI commitment mismatch at layer 1 [INFO] [stdout] ✗ LDT FAILED [INFO] [stdout] [INFO] [stdout] ================== ALGORITHMS 4-6: LOQUAT SIGN ================== [INFO] [stdout] INPUT: Public parameter L-pp, secret key sk, message M [INFO] [stdout] Following Algorithms 4, 5, 6 specification from rules.mdc [INFO] [stdout] Message length: 14 bytes [INFO] [stdout] Public key length: 256 field elements [INFO] [stdout] Parameters: m=16, n=4, L=256, B=64, κ=80 [INFO] [stdout] ✓ Message commitment computed: 32 bytes [INFO] [stdout] [INFO] [stdout] ================== ALGORITHM 4: LOQUAT SIGN PART I ================== [INFO] [stdout] [INFO] [stdout] --- PHASE 1: Commit to secret key and randomness --- [INFO] [stdout] Following Algorithm 4, Phase 1 specification [INFO] [stdout] [INFO] [stdout] --- Step 1.1: Computing T values (Legendre PRF outputs) --- [INFO] [stdout] ✓ Generated vanishing polynomial values Z_H(x) over U [INFO] [stdout] ✓ Sampling randomness matrix r_{j,i} and constructing masked polynomials [INFO] [stdout] ✓ Generated randomness matrix r_{j,i} for j ∈ [4], i ∈ [16] [INFO] [stdout] ✓ Masked commitments prepared for Merkle binding over U [INFO] [stdout] ✓ Computed masked evaluations ĉ'_j|_U for all j ∈ [n] [INFO] [stdout] [INFO] [stdout] --- Step 1.4: Merkle commitment to c'_j evaluations over U --- [INFO] [stdout] ✓ Merkle tree created with 512 leaves for |U| = 512 [INFO] [stdout] ✓ root_c committed to transcript [INFO] [stdout] ✓ σ₁ = (root_c, {T_{i,j}}) added to transcript [INFO] [stdout] [INFO] [stdout] --- PHASE 2: Compute residuosity symbols --- [INFO] [stdout] Following Algorithm 4, Phase 2 specification [INFO] [stdout] ✓ h₁ = H₁(σ₁, M) computed [INFO] [stdout] ✓ Expanded h₁ to get I_{i,j} indices: 64 total [INFO] [stdout] [INFO] [stdout] --- Step 2.1: Computing o_{i,j} values --- [INFO] [stdout] ✓ σ₂ = {o_{i,j}} added to transcript [INFO] [stdout] [INFO] [stdout] --- PHASE 3: Compute witness vector for univariate sumcheck --- [INFO] [stdout] Following Algorithm 4, Phase 3 specification [INFO] [stdout] ✓ h₂ = H₂(σ₂, h₁) computed [INFO] [stdout] ✓ Expanded h₂ to get λ_{i,j} and ε_j values [INFO] [stdout] [INFO] [stdout] --- Step 3.3: Building witness polynomial data --- [INFO] [stdout] ✓ Polynomial evaluations over H sum to μ [INFO] [stdout] ✓ μ = Σ_{j=1}^n ε_j * (Σ_{i=1}^m λ_{i,j} * o_{i,j}) = Fp2(Fp127(0x3850197c3daed87f35d7027195c53426), Fp127(0x0)) [INFO] [stdout] [INFO] [stdout] --- Step 3.4: Executing univariate sumcheck protocol --- [INFO] [stdout] [INFO] [stdout] --- SUMCHECK PROOF GENERATION --- [INFO] [stdout] Polynomial evaluations length: 32 [INFO] [stdout] Expected length (2^5): 32 [INFO] [stdout] Claimed sum: Fp2(Fp127(0x3850197c3daed87f35d7027195c53426), Fp127(0x0)) [INFO] [stdout] First few evaluations: [Fp2(Fp127(0x64d734816ccd91502b86cdfbec712741), Fp127(0x0)), Fp2(Fp127(0x61c73c602d9ea15e57c5e8c154a657f2), Fp127(0x0)), Fp2(Fp127(0x72b18c262353f24b2530f1da7a4d297), Fp127(0x0)), Fp2(Fp127(0x2575209d1eb3ce15c9d42f95c5d832a4), Fp127(0x0)), Fp2(Fp127(0x79d653881116435e0646a35f691bb638), Fp127(0x0)), Fp2(Fp127(0x771df312674f129f15969d9640e8ee81), Fp127(0x0)), Fp2(Fp127(0x11dbe2a4e8c99f104b6995a169ceb29e), Fp127(0x0)), Fp2(Fp127(0x3078e3b378c64bc925fd30c755bd9f7a), Fp127(0x0))] [INFO] [stdout] Computed sum from polynomial_evals: Fp2(Fp127(0x3850197c3daed87f35d7027195c53426), Fp127(0x0)) [INFO] [stdout] [INFO] [stdout] Prover Round 0: [INFO] [stdout] Current evaluations length: 32 [INFO] [stdout] g_0(0): Fp2(Fp127(0x55b56a6f0f72ed74a9cde7e898fc02da), Fp127(0x0)) [INFO] [stdout] g_0(1): Fp2(Fp127(0x629aaf0d2e3beb0a8c091a88fcc9314b), Fp127(0x0)) [INFO] [stdout] g_0(0) + g_0(1): Fp2(Fp127(0x3850197c3daed87f35d7027195c53426), Fp127(0x0)) [INFO] [stdout] Challenge: Fp2(Fp127(0x2641dd63e5d77f913443a7b58559677c), Fp127(0x55c26547fa1c081951a03f4e454d69c2)) [INFO] [stdout] Next evaluations length: 16 [INFO] [stdout] [INFO] [stdout] Prover Round 1: [INFO] [stdout] Current evaluations length: 16 [INFO] [stdout] g_1(0): Fp2(Fp127(0x5d84990e12c7524cb905d7e65cf071c1), Fp127(0xd918dcc28caa9d9371b08c366fa681e)) [INFO] [stdout] g_1(1): Fp2(Fp127(0x7622e9534b5efed023ab338d71e4688e), Fp127(0x41f28bfcea5cd061e83852cf990afe12)) [INFO] [stdout] g_1(0) + g_1(1): Fp2(Fp127(0x53a782615e26511cdcb10b73ced4da50), Fp127(0x4f8419c913277a3b1f535b9300056630)) [INFO] [stdout] Challenge: Fp2(Fp127(0x2b39c9e485e1636b939e21795cb10e76), Fp127(0xe0adb0863e49b899d59b7d3679cc665)) [INFO] [stdout] Next evaluations length: 8 [INFO] [stdout] [INFO] [stdout] Prover Round 2: [INFO] [stdout] Current evaluations length: 8 [INFO] [stdout] g_2(0): Fp2(Fp127(0x3394d51d16cbf1948dec6f6361629cf8), Fp127(0x764492a840f1370d342514521de13e00)) [INFO] [stdout] g_2(1): Fp2(Fp127(0x195357aa37640548be1607170a09d2fb), Fp127(0x74b4d341c89686720387ae8df7d6bffa)) [INFO] [stdout] g_2(0) + g_2(1): Fp2(Fp127(0x4ce82cc74e2ff6dd4c02767a6b6c6ff3), Fp127(0x6af965ea0987bd7f37acc2e015b7fdfb)) [INFO] [stdout] Challenge: Fp2(Fp127(0x31a636c69f7c5920ea3c9ca62a157eb0), Fp127(0x2d40b6695a9c44db65106c9645fe7c4c)) [INFO] [stdout] Next evaluations length: 4 [INFO] [stdout] [INFO] [stdout] Prover Round 3: [INFO] [stdout] Current evaluations length: 4 [INFO] [stdout] g_3(0): Fp2(Fp127(0x72ec49156ec53df170fd75f1ae3a2e3), Fp127(0x32d86e1bd9ae8e39d84f507535d39f2d)) [INFO] [stdout] g_3(1): Fp2(Fp127(0x3bf8dd24c9c8d6431b646c7d62cb5a36), Fp127(0x7b80d6c13690bde0f1a99aac4dc59947)) [INFO] [stdout] g_3(0) + g_3(1): Fp2(Fp127(0x4327a1b620b52a22327443dc7daefd19), Fp127(0x2e5944dd103f4c1ac9f8eb2183993875)) [INFO] [stdout] Challenge: Fp2(Fp127(0x5f1cd8c930828349faa9f4342166eb00), Fp127(0x4851f302ce9d6909dd5e050a7cd042a2)) [INFO] [stdout] Next evaluations length: 2 [INFO] [stdout] [INFO] [stdout] Prover Round 4: [INFO] [stdout] Current evaluations length: 2 [INFO] [stdout] g_4(0): Fp2(Fp127(0x6083e9714b4700c18478b9769b116c1f), Fp127(0x6c5a144b550540dbe7fdfb1a8b660fb3)) [INFO] [stdout] g_4(1): Fp2(Fp127(0x53c0c1af232d2a5f57ed1f102fd7cefb), Fp127(0x27a6ff07f811e2de46f30fa08417b097)) [INFO] [stdout] g_4(0) + g_4(1): Fp2(Fp127(0x3444ab206e742b20dc65d886cae93b1b), Fp127(0x140113534d1723ba2ef10abb0f7dc04b)) [INFO] [stdout] Challenge: Fp2(Fp127(0x32094c918d6ce4c4a9c406d4a81a8965), Fp127(0x36e80c9ffd74ae6c8185e8b2734fb12a)) [INFO] [stdout] Next evaluations length: 1 [INFO] [stdout] [INFO] [stdout] Final evaluation: Fp2(Fp127(0x56bf06053d061602d71ee36c5a8b9b6a), Fp127(0x4c958f4b5aced6cd03ddbf12a3a0bf79)) [INFO] [stdout] Generated 5 round polynomials [INFO] [stdout] ✓ Generated πUS with claimed_sum: Fp2(Fp127(0x3850197c3daed87f35d7027195c53426), Fp127(0x0)) [INFO] [stdout] [INFO] [stdout] ================== ALGORITHM 5: LOQUAT SIGN PART II ================== [INFO] [stdout] ✓ σ₃ = (root_s, S) added to transcript [INFO] [stdout] ✓ h₃ = H₃(σ₃, h₂) computed [INFO] [stdout] ✓ σ₄ = (root_h) added to transcript [INFO] [stdout] ✓ h₄ = H₄(σ₄, h₃) computed [INFO] [stdout] ✓ f^(0) evaluations computed over U [INFO] [stdout] [INFO] [stdout] ================== ALGORITHM 6: LOQUAT SIGN PART III (LDT) ================== [INFO] [stdout] ✓ LDT codeword length: 512 (evaluations of f^(0) over U) [INFO] [stdout] [INFO] [stdout] --- FINAL SIGNATURE ASSEMBLY --- [INFO] [stdout] ✓ σ = {root_c, root_s, root_h, T_{i,j}, o_{i,j}, πUS, πLDT} assembled [INFO] [stdout] ================== ALGORITHMS 4-6 COMPLETE ================== [INFO] [stdout] [INFO] [stdout] [INFO] [stdout] ================== ALGORITHM 7: LOQUAT VERIFY ================== [INFO] [stdout] INPUT: Signature σ, public key pk, message M [INFO] [stdout] ✓ Message commitment verified [INFO] [stdout] ✓ σ₁ = (root_c, {T_{i,j}}) added to transcript [INFO] [stdout] ✓ h₁ = H₁(σ₁, M) recomputed [INFO] [stdout] ✓ Expanded h₁ to regenerate I_{i,j} indices [INFO] [stdout] ✓ σ₂ = {o_{i,j}} added to transcript [INFO] [stdout] ✓ h₂ = H₂(σ₂, h₁) recomputed [INFO] [stdout] ✓ Expanded h₂ to regenerate λ_{i,j} and ε_j values [INFO] [stdout] [INFO] [stdout] ================== ALGORITHM 7: STEP 3 - CHECKING PROOFS ================== [INFO] [stdout] [INFO] [stdout] --- Step 3.1: Legendre PRF Constraint Verification --- [INFO] [stdout] ✓ All Legendre PRF checks passed [INFO] [stdout] ✓ μ value verified [INFO] [stdout] ✓ Π rows verified [INFO] [stdout] ✓ f^(0) evaluations verified [INFO] [stdout] [INFO] [stdout] --- Step 3.2: Univariate Sumcheck Verification --- [INFO] [stdout] [INFO] [stdout] --- SUMCHECK VERIFICATION DETAILS --- [INFO] [stdout] Number of variables: 5 [INFO] [stdout] Proof round polynomials: 5 [INFO] [stdout] Proof claimed sum: Fp2(Fp127(0x3850197c3daed87f35d7027195c53426), Fp127(0x0)) [INFO] [stdout] Proof final evaluation: Fp2(Fp127(0x56bf06053d061602d71ee36c5a8b9b6a), Fp127(0x4c958f4b5aced6cd03ddbf12a3a0bf79)) [INFO] [stdout] Following Univariate Sumcheck protocol from rules.mdc [INFO] [stdout] ✓ Claimed sum added to transcript [INFO] [stdout] Starting verification with claimed sum: Fp2(Fp127(0x3850197c3daed87f35d7027195c53426), Fp127(0x0)) [INFO] [stdout] [INFO] [stdout] Round 0: [INFO] [stdout] p(0): Fp2(Fp127(0x55b56a6f0f72ed74a9cde7e898fc02da), Fp127(0x0)) [INFO] [stdout] p(1): Fp2(Fp127(0x629aaf0d2e3beb0a8c091a88fcc9314b), Fp127(0x0)) [INFO] [stdout] p(0) + p(1): Fp2(Fp127(0x3850197c3daed87f35d7027195c53426), Fp127(0x0)) [INFO] [stdout] Expected sum (last_sum): Fp2(Fp127(0x3850197c3daed87f35d7027195c53426), Fp127(0x0)) [INFO] [stdout] ✓ Sum constraint satisfied: p(0) + p(1) = last_sum [INFO] [stdout] Challenge: Fp2(Fp127(0x2641dd63e5d77f913443a7b58559677c), Fp127(0x55c26547fa1c081951a03f4e454d69c2)) [INFO] [stdout] p(challenge): Fp2(Fp127(0x53a782615e26511cdcb10b73ced4da50), Fp127(0x4f8419c913277a3b1f535b9300056630)) [INFO] [stdout] Next evaluations length: 16 [INFO] [stdout] [INFO] [stdout] Round 1: [INFO] [stdout] p(0): Fp2(Fp127(0x5d84990e12c7524cb905d7e65cf071c1), Fp127(0xd918dcc28caa9d9371b08c366fa681e)) [INFO] [stdout] p(1): Fp2(Fp127(0x7622e9534b5efed023ab338d71e4688e), Fp127(0x41f28bfcea5cd061e83852cf990afe12)) [INFO] [stdout] p(0) + p(1): Fp2(Fp127(0x53a782615e26511cdcb10b73ced4da50), Fp127(0x4f8419c913277a3b1f535b9300056630)) [INFO] [stdout] Expected sum (last_sum): Fp2(Fp127(0x53a782615e26511cdcb10b73ced4da50), Fp127(0x4f8419c913277a3b1f535b9300056630)) [INFO] [stdout] ✓ Sum constraint satisfied: p(0) + p(1) = last_sum [INFO] [stdout] Challenge: Fp2(Fp127(0x2b39c9e485e1636b939e21795cb10e76), Fp127(0xe0adb0863e49b899d59b7d3679cc665)) [INFO] [stdout] p(challenge): Fp2(Fp127(0x4ce82cc74e2ff6dd4c02767a6b6c6ff3), Fp127(0x6af965ea0987bd7f37acc2e015b7fdfb)) [INFO] [stdout] Next evaluations length: 8 [INFO] [stdout] [INFO] [stdout] Round 2: [INFO] [stdout] p(0): Fp2(Fp127(0x3394d51d16cbf1948dec6f6361629cf8), Fp127(0x764492a840f1370d342514521de13e00)) [INFO] [stdout] p(1): Fp2(Fp127(0x195357aa37640548be1607170a09d2fb), Fp127(0x74b4d341c89686720387ae8df7d6bffa)) [INFO] [stdout] p(0) + p(1): Fp2(Fp127(0x4ce82cc74e2ff6dd4c02767a6b6c6ff3), Fp127(0x6af965ea0987bd7f37acc2e015b7fdfb)) [INFO] [stdout] Expected sum (last_sum): Fp2(Fp127(0x4ce82cc74e2ff6dd4c02767a6b6c6ff3), Fp127(0x6af965ea0987bd7f37acc2e015b7fdfb)) [INFO] [stdout] ✓ Sum constraint satisfied: p(0) + p(1) = last_sum [INFO] [stdout] Challenge: Fp2(Fp127(0x31a636c69f7c5920ea3c9ca62a157eb0), Fp127(0x2d40b6695a9c44db65106c9645fe7c4c)) [INFO] [stdout] p(challenge): Fp2(Fp127(0x4327a1b620b52a22327443dc7daefd19), Fp127(0x2e5944dd103f4c1ac9f8eb2183993875)) [INFO] [stdout] Next evaluations length: 4 [INFO] [stdout] [INFO] [stdout] Round 3: [INFO] [stdout] p(0): Fp2(Fp127(0x72ec49156ec53df170fd75f1ae3a2e3), Fp127(0x32d86e1bd9ae8e39d84f507535d39f2d)) [INFO] [stdout] p(1): Fp2(Fp127(0x3bf8dd24c9c8d6431b646c7d62cb5a36), Fp127(0x7b80d6c13690bde0f1a99aac4dc59947)) [INFO] [stdout] p(0) + p(1): Fp2(Fp127(0x4327a1b620b52a22327443dc7daefd19), Fp127(0x2e5944dd103f4c1ac9f8eb2183993875)) [INFO] [stdout] Expected sum (last_sum): Fp2(Fp127(0x4327a1b620b52a22327443dc7daefd19), Fp127(0x2e5944dd103f4c1ac9f8eb2183993875)) [INFO] [stdout] ✓ Sum constraint satisfied: p(0) + p(1) = last_sum [INFO] [stdout] Challenge: Fp2(Fp127(0x5f1cd8c930828349faa9f4342166eb00), Fp127(0x4851f302ce9d6909dd5e050a7cd042a2)) [INFO] [stdout] p(challenge): Fp2(Fp127(0x3444ab206e742b20dc65d886cae93b1b), Fp127(0x140113534d1723ba2ef10abb0f7dc04b)) [INFO] [stdout] Next evaluations length: 2 [INFO] [stdout] [INFO] [stdout] Round 4: [INFO] [stdout] p(0): Fp2(Fp127(0x6083e9714b4700c18478b9769b116c1f), Fp127(0x6c5a144b550540dbe7fdfb1a8b660fb3)) [INFO] [stdout] p(1): Fp2(Fp127(0x53c0c1af232d2a5f57ed1f102fd7cefb), Fp127(0x27a6ff07f811e2de46f30fa08417b097)) [INFO] [stdout] p(0) + p(1): Fp2(Fp127(0x3444ab206e742b20dc65d886cae93b1b), Fp127(0x140113534d1723ba2ef10abb0f7dc04b)) [INFO] [stdout] Expected sum (last_sum): Fp2(Fp127(0x3444ab206e742b20dc65d886cae93b1b), Fp127(0x140113534d1723ba2ef10abb0f7dc04b)) [INFO] [stdout] ✓ Sum constraint satisfied: p(0) + p(1) = last_sum [INFO] [stdout] Challenge: Fp2(Fp127(0x32094c918d6ce4c4a9c406d4a81a8965), Fp127(0x36e80c9ffd74ae6c8185e8b2734fb12a)) [INFO] [stdout] p(challenge): Fp2(Fp127(0x56bf06053d061602d71ee36c5a8b9b6a), Fp127(0x4c958f4b5aced6cd03ddbf12a3a0bf79)) [INFO] [stdout] Next evaluations length: 1 [INFO] [stdout] [INFO] [stdout] Final evaluation check: [INFO] [stdout] Computed final value: Fp2(Fp127(0x56bf06053d061602d71ee36c5a8b9b6a), Fp127(0x4c958f4b5aced6cd03ddbf12a3a0bf79)) [INFO] [stdout] Proof final evaluation: Fp2(Fp127(0x56bf06053d061602d71ee36c5a8b9b6a), Fp127(0x4c958f4b5aced6cd03ddbf12a3a0bf79)) [INFO] [stdout] Match: true [INFO] [stdout] ✓ SUMCHECK VERIFICATION COMPLETE: All rounds passed [INFO] [stdout] ✓ SUMCHECK PASSED [INFO] [stdout] ✓ σ₃ = (root_s, S) added to transcript [INFO] [stdout] ✓ h₃ challenge verified [INFO] [stdout] ✓ σ₄ = (root_h) added to transcript [INFO] [stdout] ✓ h₄ challenge verified [INFO] [stdout] [INFO] [stdout] --- Step 3.3: Low-Degree Test Verification --- [INFO] [stdout] --- ALGORITHM 7: LDT VERIFICATION (Steps 4-6) --- [INFO] [stdout] Following rules.mdc: 'Verify LDT and Sumcheck Consistency at Query Points' [INFO] [stdout] ✓ LDT structure verification: 5 commitments, 80 openings [INFO] [stdout] ✓ Re-derived 4 FRI folding challenges [INFO] [stdout] ✗ FRI commitment mismatch at layer 0 [INFO] [stdout] ✗ LDT FAILED [INFO] [stdout] [INFO] [stdout] ================== ALGORITHMS 4-6: LOQUAT SIGN ================== [INFO] [stdout] INPUT: Public parameter L-pp, secret key sk, message M [INFO] [stdout] Following Algorithms 4, 5, 6 specification from rules.mdc [INFO] [stdout] Message length: 14 bytes [INFO] [stdout] Public key length: 256 field elements [INFO] [stdout] Parameters: m=16, n=4, L=256, B=64, κ=80 [INFO] [stdout] ✓ Message commitment computed: 32 bytes [INFO] [stdout] [INFO] [stdout] ================== ALGORITHM 4: LOQUAT SIGN PART I ================== [INFO] [stdout] [INFO] [stdout] --- PHASE 1: Commit to secret key and randomness --- [INFO] [stdout] Following Algorithm 4, Phase 1 specification [INFO] [stdout] [INFO] [stdout] --- Step 1.1: Computing T values (Legendre PRF outputs) --- [INFO] [stdout] ✓ Generated vanishing polynomial values Z_H(x) over U [INFO] [stdout] ✓ Sampling randomness matrix r_{j,i} and constructing masked polynomials [INFO] [stdout] ✓ Generated randomness matrix r_{j,i} for j ∈ [4], i ∈ [16] [INFO] [stdout] ✓ Masked commitments prepared for Merkle binding over U [INFO] [stdout] ✓ Computed masked evaluations ĉ'_j|_U for all j ∈ [n] [INFO] [stdout] [INFO] [stdout] --- Step 1.4: Merkle commitment to c'_j evaluations over U --- [INFO] [stdout] ✓ Merkle tree created with 512 leaves for |U| = 512 [INFO] [stdout] ✓ root_c committed to transcript [INFO] [stdout] ✓ σ₁ = (root_c, {T_{i,j}}) added to transcript [INFO] [stdout] [INFO] [stdout] --- PHASE 2: Compute residuosity symbols --- [INFO] [stdout] Following Algorithm 4, Phase 2 specification [INFO] [stdout] ✓ h₁ = H₁(σ₁, M) computed [INFO] [stdout] ✓ Expanded h₁ to get I_{i,j} indices: 64 total [INFO] [stdout] [INFO] [stdout] --- Step 2.1: Computing o_{i,j} values --- [INFO] [stdout] ✓ σ₂ = {o_{i,j}} added to transcript [INFO] [stdout] [INFO] [stdout] --- PHASE 3: Compute witness vector for univariate sumcheck --- [INFO] [stdout] Following Algorithm 4, Phase 3 specification [INFO] [stdout] ✓ h₂ = H₂(σ₂, h₁) computed [INFO] [stdout] ✓ Expanded h₂ to get λ_{i,j} and ε_j values [INFO] [stdout] [INFO] [stdout] --- Step 3.3: Building witness polynomial data --- [INFO] [stdout] ✓ Polynomial evaluations over H sum to μ [INFO] [stdout] ✓ μ = Σ_{j=1}^n ε_j * (Σ_{i=1}^m λ_{i,j} * o_{i,j}) = Fp2(Fp127(0x1ce53b06426dedba4b71ceeaf43b57be), Fp127(0x0)) [INFO] [stdout] [INFO] [stdout] --- Step 3.4: Executing univariate sumcheck protocol --- [INFO] [stdout] [INFO] [stdout] --- SUMCHECK PROOF GENERATION --- [INFO] [stdout] Polynomial evaluations length: 32 [INFO] [stdout] Expected length (2^5): 32 [INFO] [stdout] Claimed sum: Fp2(Fp127(0x1ce53b06426dedba4b71ceeaf43b57be), Fp127(0x0)) [INFO] [stdout] First few evaluations: [Fp2(Fp127(0x184bd8c9187f939f5b93c890d794118f), Fp127(0x0)), Fp2(Fp127(0x18a242b4cde8db73d96cc1a8c90a8d1e), Fp127(0x0)), Fp2(Fp127(0x388e852ea6c38a872202c827b5f4778e), Fp127(0x0)), Fp2(Fp127(0x62372ff81ccf54a79ba899bd061cb576), Fp127(0x0)), Fp2(Fp127(0x514018b70890d23814351e8701d9f7c0), Fp127(0x0)), Fp2(Fp127(0x1124bfde65b8297967184a0520f80339), Fp127(0x0)), Fp2(Fp127(0x536031de828b945b20e374394606a5f8), Fp127(0x0)), Fp2(Fp127(0x36cbb72067fb664ee9d6f6f822932c35), Fp127(0x0))] [INFO] [stdout] Computed sum from polynomial_evals: Fp2(Fp127(0x1ce53b06426dedba4b71ceeaf43b57be), Fp127(0x0)) [INFO] [stdout] [INFO] [stdout] Prover Round 0: [INFO] [stdout] Current evaluations length: 32 [INFO] [stdout] g_0(0): Fp2(Fp127(0x7da905d851d52b8d82896de48a151dbb), Fp127(0x0)) [INFO] [stdout] g_0(1): Fp2(Fp127(0x1f3c352df098c22cc8e861066a263a02), Fp127(0x0)) [INFO] [stdout] g_0(0) + g_0(1): Fp2(Fp127(0x1ce53b06426dedba4b71ceeaf43b57be), Fp127(0x0)) [INFO] [stdout] Challenge: Fp2(Fp127(0x1e4ffc76bfcbabf01978b745fd08d9c6), Fp127(0x7d057b70ce1833d356398e0829ddfbd9)) [INFO] [stdout] Next evaluations length: 16 [INFO] [stdout] [INFO] [stdout] Prover Round 1: [INFO] [stdout] Current evaluations length: 16 [INFO] [stdout] g_1(0): Fp2(Fp127(0x55c7aff2a76941db82a5d31ea822ab60), Fp127(0x5c7e799faa89bc35a88b26832f60a94e)) [INFO] [stdout] g_1(1): Fp2(Fp127(0x4c11eaa9d2b9402adbc73e18f62d79e1), Fp127(0xf30b14f275d75a2bfbf0896c82ae013)) [INFO] [stdout] g_1(0) + g_1(1): Fp2(Fp127(0x21d99a9c7a2282065e6d11379e502542), Fp127(0x6baf2aeed1e731d8684a2f19f78b8961)) [INFO] [stdout] Challenge: Fp2(Fp127(0x3980f8c1d847f1b60644d07b9a1e7669), Fp127(0x342d42be5c86c91d6481db54368cc584)) [INFO] [stdout] Next evaluations length: 8 [INFO] [stdout] [INFO] [stdout] Prover Round 2: [INFO] [stdout] Current evaluations length: 8 [INFO] [stdout] g_2(0): Fp2(Fp127(0x3d31960701df010b065051e925635cca), Fp127(0x142199d720c82321844c70e83affe80)) [INFO] [stdout] g_2(1): Fp2(Fp127(0x1e0e2c051cff0d0fc4aa13f85ab8a006), Fp127(0x1a19afcc8585060424b24e70b9ffb82a)) [INFO] [stdout] g_2(0) + g_2(1): Fp2(Fp127(0x5b3fc20c1ede0e1acafa65e1801bfcd0), Fp127(0x1b5bc969f79188363cf7157f3dafb6aa)) [INFO] [stdout] Challenge: Fp2(Fp127(0x78775d0bc478f71d868172dae00fb5f1), Fp127(0x15115c00b9ea29a58db0e0ad0cce82d8)) [INFO] [stdout] Next evaluations length: 4 [INFO] [stdout] [INFO] [stdout] Prover Round 3: [INFO] [stdout] Current evaluations length: 4 [INFO] [stdout] g_3(0): Fp2(Fp127(0x7155462dc63a3d04330da666c118cf3f), Fp127(0x319a594a49ab0292078ab89fe833ba0e)) [INFO] [stdout] g_3(1): Fp2(Fp127(0x3418bb63166cc01a8b22869f7519faa2), Fp127(0x65e6e92efbdcf036efb7afbec3fc3be8)) [INFO] [stdout] g_3(0) + g_3(1): Fp2(Fp127(0x256e0190dca6fd1ebe302d063632c9e2), Fp127(0x178142794587f2c8f742685eac2ff5f7)) [INFO] [stdout] Challenge: Fp2(Fp127(0x3a794369e1595422b1ed836cfcae0c42), Fp127(0x2bf6c7b4b722a013f12c1a8a361f68fa)) [INFO] [stdout] Next evaluations length: 2 [INFO] [stdout] [INFO] [stdout] Prover Round 4: [INFO] [stdout] Current evaluations length: 2 [INFO] [stdout] g_4(0): Fp2(Fp127(0x37b87c97a49e451018ba9b747d535a02), Fp127(0x783e32c2247d502d4ca51a3838d6bb88)) [INFO] [stdout] g_4(1): Fp2(Fp127(0x7414f95415b4b192e037fc9602b03c4c), Fp127(0x286224353a42331bc31a33bab39d9d30)) [INFO] [stdout] g_4(0) + g_4(1): Fp2(Fp127(0x2bcd75ebba52f6a2f8f2980a8003964f), Fp127(0x20a056f75ebf83490fbf4df2ec7458b9)) [INFO] [stdout] Challenge: Fp2(Fp127(0x4cbcfd08f88820763476b17681bd9895), Fp127(0xa9ec90010abde68237ed908c1998949)) [INFO] [stdout] Next evaluations length: 1 [INFO] [stdout] [INFO] [stdout] Final evaluation: Fp2(Fp127(0x265ebafe28417fff72af56e62d236170), Fp127(0x2acfc96ccb5c01438be3b95cd82d62fc)) [INFO] [stdout] Generated 5 round polynomials [INFO] [stdout] ✓ Generated πUS with claimed_sum: Fp2(Fp127(0x1ce53b06426dedba4b71ceeaf43b57be), Fp127(0x0)) [INFO] [stdout] [INFO] [stdout] ================== ALGORITHM 5: LOQUAT SIGN PART II ================== [INFO] [stdout] ✓ σ₃ = (root_s, S) added to transcript [INFO] [stdout] ✓ h₃ = H₃(σ₃, h₂) computed [INFO] [stdout] ✓ σ₄ = (root_h) added to transcript [INFO] [stdout] ✓ h₄ = H₄(σ₄, h₃) computed [INFO] [stdout] ✓ f^(0) evaluations computed over U [INFO] [stdout] [INFO] [stdout] ================== ALGORITHM 6: LOQUAT SIGN PART III (LDT) ================== [INFO] [stdout] ✓ LDT codeword length: 512 (evaluations of f^(0) over U) [INFO] [stdout] [INFO] [stdout] --- FINAL SIGNATURE ASSEMBLY --- [INFO] [stdout] ✓ σ = {root_c, root_s, root_h, T_{i,j}, o_{i,j}, πUS, πLDT} assembled [INFO] [stdout] ================== ALGORITHMS 4-6 COMPLETE ================== [INFO] [stdout] [INFO] [stdout] [INFO] [stdout] ================== ALGORITHM 7: LOQUAT VERIFY ================== [INFO] [stdout] INPUT: Signature σ, public key pk, message M [INFO] [stdout] ✓ Message commitment verified [INFO] [stdout] ✓ σ₁ = (root_c, {T_{i,j}}) added to transcript [INFO] [stdout] ✓ h₁ = H₁(σ₁, M) recomputed [INFO] [stdout] ✓ Expanded h₁ to regenerate I_{i,j} indices [INFO] [stdout] ✓ σ₂ = {o_{i,j}} added to transcript [INFO] [stdout] ✓ h₂ = H₂(σ₂, h₁) recomputed [INFO] [stdout] ✓ Expanded h₂ to regenerate λ_{i,j} and ε_j values [INFO] [stdout] [INFO] [stdout] ================== ALGORITHM 7: STEP 3 - CHECKING PROOFS ================== [INFO] [stdout] [INFO] [stdout] --- Step 3.1: Legendre PRF Constraint Verification --- [INFO] [stdout] ✓ All Legendre PRF checks passed [INFO] [stdout] ✓ μ value verified [INFO] [stdout] ✓ Π rows verified [INFO] [stdout] ✓ f^(0) evaluations verified [INFO] [stdout] [INFO] [stdout] --- Step 3.2: Univariate Sumcheck Verification --- [INFO] [stdout] [INFO] [stdout] --- SUMCHECK VERIFICATION DETAILS --- [INFO] [stdout] Number of variables: 5 [INFO] [stdout] Proof round polynomials: 5 [INFO] [stdout] Proof claimed sum: Fp2(Fp127(0x1ce53b06426dedba4b71ceeaf43b57be), Fp127(0x0)) [INFO] [stdout] Proof final evaluation: Fp2(Fp127(0x265ebafe28417fff72af56e62d236170), Fp127(0x2acfc96ccb5c01438be3b95cd82d62fc)) [INFO] [stdout] Following Univariate Sumcheck protocol from rules.mdc [INFO] [stdout] ✓ Claimed sum added to transcript [INFO] [stdout] Starting verification with claimed sum: Fp2(Fp127(0x1ce53b06426dedba4b71ceeaf43b57be), Fp127(0x0)) [INFO] [stdout] [INFO] [stdout] Round 0: [INFO] [stdout] p(0): Fp2(Fp127(0x7da905d851d52b8d82896de48a151dbb), Fp127(0x0)) [INFO] [stdout] p(1): Fp2(Fp127(0x1f3c352df098c22cc8e861066a263a02), Fp127(0x0)) [INFO] [stdout] p(0) + p(1): Fp2(Fp127(0x1ce53b06426dedba4b71ceeaf43b57be), Fp127(0x0)) [INFO] [stdout] Expected sum (last_sum): Fp2(Fp127(0x1ce53b06426dedba4b71ceeaf43b57be), Fp127(0x0)) [INFO] [stdout] ✓ Sum constraint satisfied: p(0) + p(1) = last_sum [INFO] [stdout] Challenge: Fp2(Fp127(0x1e4ffc76bfcbabf01978b745fd08d9c6), Fp127(0x7d057b70ce1833d356398e0829ddfbd9)) [INFO] [stdout] p(challenge): Fp2(Fp127(0x21d99a9c7a2282065e6d11379e502542), Fp127(0x6baf2aeed1e731d8684a2f19f78b8961)) [INFO] [stdout] Next evaluations length: 16 [INFO] [stdout] [INFO] [stdout] Round 1: [INFO] [stdout] p(0): Fp2(Fp127(0x55c7aff2a76941db82a5d31ea822ab60), Fp127(0x5c7e799faa89bc35a88b26832f60a94e)) [INFO] [stdout] p(1): Fp2(Fp127(0x4c11eaa9d2b9402adbc73e18f62d79e1), Fp127(0xf30b14f275d75a2bfbf0896c82ae013)) [INFO] [stdout] p(0) + p(1): Fp2(Fp127(0x21d99a9c7a2282065e6d11379e502542), Fp127(0x6baf2aeed1e731d8684a2f19f78b8961)) [INFO] [stdout] Expected sum (last_sum): Fp2(Fp127(0x21d99a9c7a2282065e6d11379e502542), Fp127(0x6baf2aeed1e731d8684a2f19f78b8961)) [INFO] [stdout] ✓ Sum constraint satisfied: p(0) + p(1) = last_sum [INFO] [stdout] Challenge: Fp2(Fp127(0x3980f8c1d847f1b60644d07b9a1e7669), Fp127(0x342d42be5c86c91d6481db54368cc584)) [INFO] [stdout] p(challenge): Fp2(Fp127(0x5b3fc20c1ede0e1acafa65e1801bfcd0), Fp127(0x1b5bc969f79188363cf7157f3dafb6aa)) [INFO] [stdout] Next evaluations length: 8 [INFO] [stdout] [INFO] [stdout] Round 2: [INFO] [stdout] p(0): Fp2(Fp127(0x3d31960701df010b065051e925635cca), Fp127(0x142199d720c82321844c70e83affe80)) [INFO] [stdout] p(1): Fp2(Fp127(0x1e0e2c051cff0d0fc4aa13f85ab8a006), Fp127(0x1a19afcc8585060424b24e70b9ffb82a)) [INFO] [stdout] p(0) + p(1): Fp2(Fp127(0x5b3fc20c1ede0e1acafa65e1801bfcd0), Fp127(0x1b5bc969f79188363cf7157f3dafb6aa)) [INFO] [stdout] Expected sum (last_sum): Fp2(Fp127(0x5b3fc20c1ede0e1acafa65e1801bfcd0), Fp127(0x1b5bc969f79188363cf7157f3dafb6aa)) [INFO] [stdout] ✓ Sum constraint satisfied: p(0) + p(1) = last_sum [INFO] [stdout] Challenge: Fp2(Fp127(0x78775d0bc478f71d868172dae00fb5f1), Fp127(0x15115c00b9ea29a58db0e0ad0cce82d8)) [INFO] [stdout] p(challenge): Fp2(Fp127(0x256e0190dca6fd1ebe302d063632c9e2), Fp127(0x178142794587f2c8f742685eac2ff5f7)) [INFO] [stdout] Next evaluations length: 4 [INFO] [stdout] [INFO] [stdout] Round 3: [INFO] [stdout] p(0): Fp2(Fp127(0x7155462dc63a3d04330da666c118cf3f), Fp127(0x319a594a49ab0292078ab89fe833ba0e)) [INFO] [stdout] p(1): Fp2(Fp127(0x3418bb63166cc01a8b22869f7519faa2), Fp127(0x65e6e92efbdcf036efb7afbec3fc3be8)) [INFO] [stdout] p(0) + p(1): Fp2(Fp127(0x256e0190dca6fd1ebe302d063632c9e2), Fp127(0x178142794587f2c8f742685eac2ff5f7)) [INFO] [stdout] Expected sum (last_sum): Fp2(Fp127(0x256e0190dca6fd1ebe302d063632c9e2), Fp127(0x178142794587f2c8f742685eac2ff5f7)) [INFO] [stdout] ✓ Sum constraint satisfied: p(0) + p(1) = last_sum [INFO] [stdout] Challenge: Fp2(Fp127(0x3a794369e1595422b1ed836cfcae0c42), Fp127(0x2bf6c7b4b722a013f12c1a8a361f68fa)) [INFO] [stdout] p(challenge): Fp2(Fp127(0x2bcd75ebba52f6a2f8f2980a8003964f), Fp127(0x20a056f75ebf83490fbf4df2ec7458b9)) [INFO] [stdout] Next evaluations length: 2 [INFO] [stdout] [INFO] [stdout] Round 4: [INFO] [stdout] p(0): Fp2(Fp127(0x37b87c97a49e451018ba9b747d535a02), Fp127(0x783e32c2247d502d4ca51a3838d6bb88)) [INFO] [stdout] p(1): Fp2(Fp127(0x7414f95415b4b192e037fc9602b03c4c), Fp127(0x286224353a42331bc31a33bab39d9d30)) [INFO] [stdout] p(0) + p(1): Fp2(Fp127(0x2bcd75ebba52f6a2f8f2980a8003964f), Fp127(0x20a056f75ebf83490fbf4df2ec7458b9)) [INFO] [stdout] Expected sum (last_sum): Fp2(Fp127(0x2bcd75ebba52f6a2f8f2980a8003964f), Fp127(0x20a056f75ebf83490fbf4df2ec7458b9)) [INFO] [stdout] ✓ Sum constraint satisfied: p(0) + p(1) = last_sum [INFO] [stdout] Challenge: Fp2(Fp127(0x4cbcfd08f88820763476b17681bd9895), Fp127(0xa9ec90010abde68237ed908c1998949)) [INFO] [stdout] p(challenge): Fp2(Fp127(0x265ebafe28417fff72af56e62d236170), Fp127(0x2acfc96ccb5c01438be3b95cd82d62fc)) [INFO] [stdout] Next evaluations length: 1 [INFO] [stdout] [INFO] [stdout] Final evaluation check: [INFO] [stdout] Computed final value: Fp2(Fp127(0x265ebafe28417fff72af56e62d236170), Fp127(0x2acfc96ccb5c01438be3b95cd82d62fc)) [INFO] [stdout] Proof final evaluation: Fp2(Fp127(0x265ebafe28417fff72af56e62d236170), Fp127(0x2acfc96ccb5c01438be3b95cd82d62fc)) [INFO] [stdout] Match: true [INFO] [stdout] ✓ SUMCHECK VERIFICATION COMPLETE: All rounds passed [INFO] [stdout] ✓ SUMCHECK PASSED [INFO] [stdout] ✓ σ₃ = (root_s, S) added to transcript [INFO] [stdout] ✓ h₃ challenge verified [INFO] [stdout] ✓ σ₄ = (root_h) added to transcript [INFO] [stdout] ✓ h₄ challenge verified [INFO] [stdout] [INFO] [stdout] --- Step 3.3: Low-Degree Test Verification --- [INFO] [stdout] --- ALGORITHM 7: LDT VERIFICATION (Steps 4-6) --- [INFO] [stdout] Following rules.mdc: 'Verify LDT and Sumcheck Consistency at Query Points' [INFO] [stdout] ✓ LDT structure verification: 5 commitments, 80 openings [INFO] [stdout] ✓ Re-derived 4 FRI folding challenges [INFO] [stdout] [INFO] [stdout] --- Step 4: Verifying κ=80 LDT Query Proofs --- [INFO] [stdout] ✓ LDT Query Verification: 80 queries passed [INFO] [stdout] ✓ LDT VERIFICATION SUCCESSFUL [INFO] [stdout] ✓ LDT PASSED [INFO] [stdout] [INFO] [stdout] --- ALGORITHM 7: FINAL DECISION --- [INFO] [stdout] ✓ VERIFICATION SUCCESSFUL: Signature is valid [INFO] [stdout] [INFO] [stdout] thread 'loquat::tests::integration_tests::test_tampered_signature_components' (55) panicked at src/loquat/tests.rs:170:9: [INFO] [stdout] Signature with tampered Π row folding data should be invalid [INFO] [stdout] stack backtrace: [INFO] [stdout] 0: 0x5e98f9eaa272 - std::backtrace_rs::backtrace::libunwind::trace::h16acf28769fcd909 [INFO] [stdout] at /rustc/3b4dd9bf1410f8da6329baa36ce5e37673cbbd1f/library/std/src/../../backtrace/src/backtrace/libunwind.rs:117:9 [INFO] [stdout] 1: 0x5e98f9eaa272 - std::backtrace_rs::backtrace::trace_unsynchronized::hb5541aa5d4f92513 [INFO] [stdout] at /rustc/3b4dd9bf1410f8da6329baa36ce5e37673cbbd1f/library/std/src/../../backtrace/src/backtrace/mod.rs:66:14 [INFO] [stdout] 2: 0x5e98f9eaa272 - std::sys::backtrace::_print_fmt::h8ac8268cb667a306 [INFO] [stdout] at /rustc/3b4dd9bf1410f8da6329baa36ce5e37673cbbd1f/library/std/src/sys/backtrace.rs:66:9 [INFO] [stdout] 3: 0x5e98f9eaa272 - ::fmt::h47627beda0767f4c [INFO] [stdout] at /rustc/3b4dd9bf1410f8da6329baa36ce5e37673cbbd1f/library/std/src/sys/backtrace.rs:39:26 [INFO] [stdout] 4: 0x5e98f9ebb35f - core::fmt::rt::Argument::fmt::h686a01ad57c1c92a [INFO] [stdout] at /rustc/3b4dd9bf1410f8da6329baa36ce5e37673cbbd1f/library/core/src/fmt/rt.rs:173:76 [INFO] [stdout] 5: 0x5e98f9ebb35f - core::fmt::write::h8a63064c67176fd8 [INFO] [stdout] at /rustc/3b4dd9bf1410f8da6329baa36ce5e37673cbbd1f/library/core/src/fmt/mod.rs:1469:25 [INFO] [stdout] 6: 0x5e98f9e77c53 - std::io::default_write_fmt::hd4797e693c0ec256 [INFO] [stdout] at /rustc/3b4dd9bf1410f8da6329baa36ce5e37673cbbd1f/library/std/src/io/mod.rs:639:11 [INFO] [stdout] 7: 0x5e98f9e77c53 - std::io::Write::write_fmt::h791e240ad2720c99 [INFO] [stdout] at /rustc/3b4dd9bf1410f8da6329baa36ce5e37673cbbd1f/library/std/src/io/mod.rs:1954:13 [INFO] [stdout] 8: 0x5e98f9e83be2 - std::sys::backtrace::BacktraceLock::print::h4634d27c0afbaebb [INFO] [stdout] at /rustc/3b4dd9bf1410f8da6329baa36ce5e37673cbbd1f/library/std/src/sys/backtrace.rs:42:9 [INFO] [stdout] 9: 0x5e98f9e8867f - std::panicking::default_hook::{{closure}}::h23e0299d4738b766 [INFO] [stdout] at /rustc/3b4dd9bf1410f8da6329baa36ce5e37673cbbd1f/library/std/src/panicking.rs:301:27 [INFO] [stdout] 10: 0x5e98f9e88511 - std::panicking::default_hook::hfeec6294e8751b62 [INFO] [stdout] at /rustc/3b4dd9bf1410f8da6329baa36ce5e37673cbbd1f/library/std/src/panicking.rs:325:9 [INFO] [stdout] 11: 0x5e98f9dffb2e - as core::ops::function::Fn>::call::h3f5a16438cee2b4e [INFO] [stdout] at /rustc/3b4dd9bf1410f8da6329baa36ce5e37673cbbd1f/library/alloc/src/boxed.rs:2019:9 [INFO] [stdout] 12: 0x5e98f9dffb2e - test::test_main_with_exit_callback::{{closure}}::h9214498cef9aafc5 [INFO] [stdout] at /rustc/3b4dd9bf1410f8da6329baa36ce5e37673cbbd1f/library/test/src/lib.rs:145:21 [INFO] [stdout] 13: 0x5e98f9e88c8f - as core::ops::function::Fn>::call::hdb18da3e68df7464 [INFO] [stdout] at /rustc/3b4dd9bf1410f8da6329baa36ce5e37673cbbd1f/library/alloc/src/boxed.rs:2019:9 [INFO] [stdout] 14: 0x5e98f9e88c8f - std::panicking::panic_with_hook::hd57cd463d793ed79 [INFO] [stdout] at /rustc/3b4dd9bf1410f8da6329baa36ce5e37673cbbd1f/library/std/src/panicking.rs:842:13 [INFO] [stdout] 15: 0x5e98f9e88ab6 - std::panicking::panic_handler::{{closure}}::hddd6216c3fddee3b [INFO] [stdout] at /rustc/3b4dd9bf1410f8da6329baa36ce5e37673cbbd1f/library/std/src/panicking.rs:700:13 [INFO] [stdout] 16: 0x5e98f9e83d19 - std::sys::backtrace::__rust_end_short_backtrace::h5e7a56f283378525 [INFO] [stdout] at /rustc/3b4dd9bf1410f8da6329baa36ce5e37673cbbd1f/library/std/src/sys/backtrace.rs:174:18 [INFO] [stdout] 17: 0x5e98f9e6c3fd - __rustc[256c90bb7e548b45]::rust_begin_unwind [INFO] [stdout] at /rustc/3b4dd9bf1410f8da6329baa36ce5e37673cbbd1f/library/std/src/panicking.rs:698:5 [INFO] [stdout] 18: 0x5e98f9ec2de0 - core::panicking::panic_fmt::hf19c198748ef6a95 [INFO] [stdout] at /rustc/3b4dd9bf1410f8da6329baa36ce5e37673cbbd1f/library/core/src/panicking.rs:80:14 [INFO] [stdout] 19: 0x5e98f9db3d02 - vc_pqc::loquat::tests::integration_tests::test_tampered_signature_components::hb90e83ab5db1a101 [INFO] [stdout] at /opt/rustwide/workdir/src/loquat/tests.rs:170:9 [INFO] [stdout] 20: 0x5e98f9db3da7 - vc_pqc::loquat::tests::integration_tests::test_tampered_signature_components::{{closure}}::h8d660036dfb8afea [INFO] [stdout] at /opt/rustwide/workdir/src/loquat/tests.rs:137:44 [INFO] [stdout] 21: 0x5e98f9d936f6 - core::ops::function::FnOnce::call_once::h10d8252ffd40f798 [INFO] [stdout] at /rustc/3b4dd9bf1410f8da6329baa36ce5e37673cbbd1f/library/core/src/ops/function.rs:250:5 [INFO] [stdout] 22: 0x5e98f9dff97b - core::ops::function::FnOnce::call_once::h43f43c5185cf39c2 [INFO] [stdout] at /rustc/3b4dd9bf1410f8da6329baa36ce5e37673cbbd1f/library/core/src/ops/function.rs:250:5 [INFO] [stdout] 23: 0x5e98f9dff97b - test::__rust_begin_short_backtrace::hc4fa634eb2764bdc [INFO] [stdout] at /rustc/3b4dd9bf1410f8da6329baa36ce5e37673cbbd1f/library/test/src/lib.rs:663:18 [INFO] [stdout] 24: 0x5e98f9e13f98 - test::run_test_in_process::{{closure}}::h9f4b799a5211b72a [INFO] [stdout] at /rustc/3b4dd9bf1410f8da6329baa36ce5e37673cbbd1f/library/test/src/lib.rs:686:74 [INFO] [stdout] 25: 0x5e98f9e13f98 - as core::ops::function::FnOnce<()>>::call_once::ha572bf7dc5230a8f [INFO] [stdout] at /rustc/3b4dd9bf1410f8da6329baa36ce5e37673cbbd1f/library/core/src/panic/unwind_safe.rs:274:9 [INFO] [stdout] 26: 0x5e98f9e13f98 - std::panicking::catch_unwind::do_call::hfd6ff51f25dd177b [INFO] [stdout] at /rustc/3b4dd9bf1410f8da6329baa36ce5e37673cbbd1f/library/std/src/panicking.rs:590:40 [INFO] [stdout] 27: 0x5e98f9e13f98 - std::panicking::catch_unwind::h8609b446221def5f [INFO] [stdout] at /rustc/3b4dd9bf1410f8da6329baa36ce5e37673cbbd1f/library/std/src/panicking.rs:553:19 [INFO] [stdout] 28: 0x5e98f9e13f98 - std::panic::catch_unwind::h362f73cc48531e26 [INFO] [stdout] at /rustc/3b4dd9bf1410f8da6329baa36ce5e37673cbbd1f/library/std/src/panic.rs:359:14 [INFO] [stdout] 29: 0x5e98f9e13f98 - test::run_test_in_process::hf52fd21d696aae67 [INFO] [stdout] at /rustc/3b4dd9bf1410f8da6329baa36ce5e37673cbbd1f/library/test/src/lib.rs:686:27 [INFO] [stdout] 30: 0x5e98f9e13f98 - test::run_test::{{closure}}::h7e780b8354e6d007 [INFO] [stdout] at /rustc/3b4dd9bf1410f8da6329baa36ce5e37673cbbd1f/library/test/src/lib.rs:607:43 [INFO] [stdout] 31: 0x5e98f9decd64 - test::run_test::{{closure}}::hdc2695f2276aad3e [INFO] [stdout] at /rustc/3b4dd9bf1410f8da6329baa36ce5e37673cbbd1f/library/test/src/lib.rs:637:41 [INFO] [stdout] 32: 0x5e98f9decd64 - std::sys::backtrace::__rust_begin_short_backtrace::h2555b2113ed90fc9 [INFO] [stdout] at /rustc/3b4dd9bf1410f8da6329baa36ce5e37673cbbd1f/library/std/src/sys/backtrace.rs:158:18 [INFO] [stdout] 33: 0x5e98f9df069a - std::thread::Builder::spawn_unchecked_::{{closure}}::{{closure}}::h99800d480987dfb6 [INFO] [stdout] at /rustc/3b4dd9bf1410f8da6329baa36ce5e37673cbbd1f/library/std/src/thread/mod.rs:562:17 [INFO] [stdout] 34: 0x5e98f9df069a - as core::ops::function::FnOnce<()>>::call_once::hbbb69b5294b2221b [INFO] [stdout] at /rustc/3b4dd9bf1410f8da6329baa36ce5e37673cbbd1f/library/core/src/panic/unwind_safe.rs:274:9 [INFO] [stdout] 35: 0x5e98f9df069a - std::panicking::catch_unwind::do_call::h495689350c27df20 [INFO] [stdout] at /rustc/3b4dd9bf1410f8da6329baa36ce5e37673cbbd1f/library/std/src/panicking.rs:590:40 [INFO] [stdout] 36: 0x5e98f9df069a - std::panicking::catch_unwind::hf22437c51d1b3740 [INFO] [stdout] at /rustc/3b4dd9bf1410f8da6329baa36ce5e37673cbbd1f/library/std/src/panicking.rs:553:19 [INFO] [stdout] 37: 0x5e98f9df069a - std::panic::catch_unwind::habda1a57de8231f8 [INFO] [stdout] at /rustc/3b4dd9bf1410f8da6329baa36ce5e37673cbbd1f/library/std/src/panic.rs:359:14 [INFO] [stdout] 38: 0x5e98f9df069a - std::thread::Builder::spawn_unchecked_::{{closure}}::h5833d8dda8c7e80b [INFO] [stdout] at /rustc/3b4dd9bf1410f8da6329baa36ce5e37673cbbd1f/library/std/src/thread/mod.rs:560:30 [INFO] [stdout] 39: 0x5e98f9df069a - core::ops::function::FnOnce::call_once{{vtable.shim}}::ha2910283a5058402 [INFO] [stdout] at /rustc/3b4dd9bf1410f8da6329baa36ce5e37673cbbd1f/library/core/src/ops/function.rs:250:5 [INFO] [stdout] 40: 0x5e98f9e7f00f - as core::ops::function::FnOnce>::call_once::he4d85cb537521972 [INFO] [stdout] at /rustc/3b4dd9bf1410f8da6329baa36ce5e37673cbbd1f/library/alloc/src/boxed.rs:2005:9 [INFO] [stdout] 41: 0x5e98f9e7f00f - std::sys::thread::unix::Thread::new::thread_start::hbaf586a9e50a98cd [INFO] [stdout] at /rustc/3b4dd9bf1410f8da6329baa36ce5e37673cbbd1f/library/std/src/sys/thread/unix.rs:126:17 [INFO] [stdout] 42: 0x7ee5c5b36aa4 - [INFO] [stdout] 43: 0x7ee5c5bc3a64 - clone [INFO] [stdout] 44: 0x0 - [INFO] [stdout] [INFO] [stdout] [INFO] [stdout] failures: [INFO] [stdout] loquat::tests::integration_tests::test_tampered_signature_components [INFO] [stdout] [INFO] [stdout] test result: FAILED. 32 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.13s [INFO] [stdout] [INFO] [stderr] error: test failed, to rerun pass `--lib` [INFO] running `Command { std: "docker" "inspect" "801ec578160d58d88e384b66c72cea45630dca2c1fc8ccc16b5ee05a5aae9a9f", kill_on_drop: false }` [INFO] running `Command { std: "docker" "rm" "-f" "801ec578160d58d88e384b66c72cea45630dca2c1fc8ccc16b5ee05a5aae9a9f", kill_on_drop: false }` [INFO] [stdout] 801ec578160d58d88e384b66c72cea45630dca2c1fc8ccc16b5ee05a5aae9a9f