Feat: store codeword with max height before FRI fold

[kunxian-xia]

Summary

Issue

The protocol previously implemented works like this.

1. Each matrix is mixed with random challenges to produce a codeword f(g^i) = dot_product(m.row[i], rand_coeffs).
2. The ith row and i+n/2th row are packed (stored) in one row (or in one leaf in the merkle tree commitment scheme).
3. The the codeword with max height is the first to be folded using the well known FRI fold formula. But this codeword is not committed.
4. In order to let the verifier to be able to recover the 1st evaluation in the commit phase, the verifier opens the base/input mmcs to get m.row[i] and m.row[i+n/2], mixed them with random challenges, get f(g^i) = dot_product(m.row[i], rand_coeffs) and f(-g^i) = dot_product(m.row[i+n/2], rand_coeffs). Then the verifier will fold them into a new evaluation.

When the matrix to be opened is super wide (like 1000 columns), then the above implementation will be very costly especially in the recursion verifier.

Solution

We add a new ext mmcs ext to store f(g^i) in addition to the original base/input mmcs to store m.rows().

The verifier proceeds like this.

1. open base/input mmcs to get m.row(i).
2. mix that row with random challenges to get f(g^i).
3. open extension mmcs ext to get f(-g^i) (aka. sibling value).
4. fold f(g^i) and f(-g^i).

[hero78119]

Awesome work and clean up bunch of complex condition with less code 👍👍👍 💯 💯 💯