# Cryptographic algebra and ZK components

[All sections](../README.md)

## Modules

| Module | Verified result |
|---|---|
| [CryptoSPNInvariants](CryptoSPNInvariants.en.md) | Invertibility of rational diffusion, a weight-sum lower bound of five, and round bijectivity under invertible substitution. |
| [CryptoZKAir](CryptoZKAir.en.md) | Generation and checking of finite deterministic traces, checker correctness, and trace uniqueness. |
| [CryptoZKFRILowDegree](CryptoZKFRILowDegree.en.md) | Length of pairwise coefficient folding, arithmetic of d/2^k, and a folding identity for cubic polynomials. |
| [CryptoKZGCommitment](CryptoKZGCommitment.en.md) | Division identities for P(x)−P(z) in degrees 2 and 3, linearity of evaluation, and cancellation in a scalar verification equation. |
| [CryptoPedersenCommitment](../06_cryptography_and_zk/CryptoPedersenCommitment.en.md) | For C(m,r)=mG+rH over real scalars, additivity, scalar linearity, an explicit change of opening, and a ratio identity extracted from a collision. H ≠ 0 is required; the collision result also assumes distinct messages. |

## Scope

These components do not prove end-to-end cryptographic security. Finite cryptographic groups, adversaries, probability distributions, and hardness reductions require separate models.

[Contributing](../CONTRIBUTING.en.md) · [Validation](../VERIFICATION.en.md)

- [CryptoR1CSToQAP](../06_cryptography_and_zk/CryptoR1CSToQAP.en.md): two-node interpolation and scalar constraint factorization.

- [CryptoFiatShamirTransform](../06_cryptography_and_zk/CryptoFiatShamirTransform.en.md): scalar Schnorr completeness and conditional witness extraction.

- [CryptoShamirSecretSharing](../06_cryptography_and_zk/CryptoShamirSecretSharing.en.md)

- [CryptoMerkleTree](../06_cryptography_and_zk/CryptoMerkleTree.en.md)

- [CryptoBLSSignatureAggregation](../06_cryptography_and_zk/CryptoBLSSignatureAggregation.en.md)

- [CryptoSchnorrSignature](../06_cryptography_and_zk/CryptoSchnorrSignature.en.md)

- [CryptoElGamalEncryption](../06_cryptography_and_zk/CryptoElGamalEncryption.en.md)

- [CryptoKZGPolynomialCommitment](../06_cryptography_and_zk/CryptoKZGPolynomialCommitment.en.md)

- [CryptoSumcheckProtocol](../06_cryptography_and_zk/CryptoSumcheckProtocol.en.md)

- [CryptoR1CSConstraintSystem](../06_cryptography_and_zk/CryptoR1CSConstraintSystem.en.md)

- [CryptoGroth16SNARK](../06_cryptography_and_zk/CryptoGroth16SNARK.en.md)

- [CryptoFeldmanVSS](../07_cryptography/CryptoFeldmanVSS.md): scalar share consistency and reconstruction against fixed coefficient commitments.

- [CryptoMuSig2Aggregation](../07_cryptography/CryptoMuSig2Aggregation.md): two-signer, two-nonce scalar completeness and a restricted naive-key cancellation barrier; no MuSig2 security claim.

- [CryptoSchnorrBatchVerification](../07_cryptography/CryptoSchnorrBatchVerification.md): exact prime-field batch acceptance counts and independent-round fractions for fixed residuals.

- [CryptoTranscriptForkingLemma](../07_cryptography/CryptoTranscriptForkingLemma.md): Finite uniform matrix forking bound and scalar witness extraction; no adaptive random-oracle reduction.

- [CryptoPedersenHomomorphicSum](../04_cryptography_and_protocols/CryptoPedersenHomomorphicSum.md) — Finite-group homomorphism, exact hiding distributions and collision extraction.

- [CryptoSchnorrIdentification](../04_cryptography_and_protocols/CryptoSchnorrIdentification.md) — Finite-group identification, algebraic extraction and exact HVZK transcript distributions.

- [CryptoSchnorrMultiSignaturesMuSigGroup](../04_cryptography/CryptoSchnorrMultiSignaturesMuSigGroup.md) — Finite-group Schnorr aggregation completeness and naive rogue-key witness.

- [CryptoBLSSignatureAggregationGroup](../04_cryptography/CryptoBLSSignatureAggregationGroup.md) — Bilinear BLS aggregation, rogue-key and error-cancellation counterexamples.

- [CryptoElGamalHomomorphismGroup](../04_cryptography/CryptoElGamalHomomorphismGroup.md) — Group ElGamal correctness, weighted homomorphism, rerandomization and malleability.

- [CryptoCommitmentVectorPedersenGroup](../04_cryptography/CryptoCommitmentVectorPedersenGroup.md) — Vector Pedersen commitments, uniform-PMF hiding and collision relations.

- [CryptoShamirSecretSharingGroup](../04_cryptography/CryptoShamirSecretSharingGroup.md) — Shamir threshold sharing, joint PMF secrecy and group recovery.

- [CryptoThresholdSchnorrFrostGroup](../04_cryptography/CryptoThresholdSchnorrFrostGroup.md) — FROST threshold completeness, canonical sessions and error cancellation.

- [CryptoPedersenRangeProofLinear](../04_cryptography/CryptoPedersenRangeProofLinear.md): interactive range proofs, two-transcript extraction and full joint special HVZK.

- [CryptoBulletproofsInnerProduct](../04_cryptography/CryptoBulletproofsInnerProduct.md) — Recursive IPA completeness, expanded verification and exact payload counts.

- [Bulletproofs algebraic range reduction](../04_cryptography/CryptoBulletproofsRangeReduction.md)

- [Bulletproofs batch verification](../04_cryptography/CryptoBulletproofsBatchVerification.md)

- [Bulletproofs range aggregation](../04_cryptography/CryptoBulletproofsAggregation.md)

- [Local Bulletproofs witness extraction](../04_cryptography/CryptoBulletproofsWitnessExtraction.md)

- [Recursive IPA tree extraction](../04_cryptography/CryptoBulletproofsTreeExtraction.md)

- [Bulletproofs finite-grid range interpolation](../04_cryptography/CryptoBulletproofsRangeInterpolation.md) — fixed-witness formal identity and range constraints.

- [Conditional Bulletproofs range extraction](../04_cryptography/CryptoBulletproofsRangeWitnessExtraction.md) — certified openings, IPA trees and explicit generator relations.

- [Two-branch Pedersen opening extraction](../04_cryptography/CryptoPedersenCommitmentOpeningExtractionContract.md) — scalar/vector special soundness, checked extraction and conditional range composition.

- [Finite shared-prefix IPA fork acquisition](../04_cryptography/CryptoBulletproofsIPAForkingExtractionContract.md) — seven distinct nonzero accepting calls, recursive coverage, and witness-or-relation extraction.

- [Finite IPA forking probability](../04_cryptography/CryptoBulletproofsIPAFiniteForkingProbabilityContract.md) — four uniform draws, heavy prefixes, and conditional extractor composition.

- [Complete IPA tree probability](../04_cryptography/CryptoBulletproofsIPATreeProbabilityContract.md).

- [Bounded IPA retries and expected attempt count](../04_cryptography/CryptoBulletproofsIPABoundedRetryContract.md).

- [IPA candidate generation on independent product tapes](../04_cryptography/CryptoBulletproofsIPAProductTapeCandidateGeneratorContract.md).

- [Recursive finite IPA tree generation](../04_cryptography/CryptoBulletproofsIPARecursiveTreeGeneratorContract.md).

- [Node-local multi-level IPA retries](../04_cryptography/CryptoBulletproofsIPAMultiLevelNodeRetryGeneratorContract.md).

- [Partial IPA branch cache and resource comparison](../04_cryptography/CryptoBulletproofsIPAPartialBranchCacheResourceContract.md).

- [IPA binding to a public scalar](../04_cryptography/CryptoBulletproofsIPAPublicScalarBindingContract.md).

- [Pedersen opening consistency with IPA](../04_cryptography/CryptoBulletproofsIPAPedersenOpeningConsistencyContract.md).

- [Hidden inner-product protocol and exact HVZK](../04_cryptography/CryptoHiddenScalarInnerProductProtocolContract.md).

- [Hidden inner-product compression and supplied-fork extraction](../04_cryptography/CryptoHiddenScalarInnerProductCompressionContract.md).

- [Snapshot-indexed nested fork acquisition](../04_cryptography/CryptoHiddenScalarForkAcquisitionContract.md).

- [Retained-branch quota probability](../04_cryptography/CryptoHiddenScalarForkProgressProbabilityContract.md).

- [Independent full-probe schedule progress](../04_cryptography/CryptoHiddenScalarForkScheduleProgressContract.md).

- [fork local density](../04_cryptography/CryptoHiddenScalarForkLocalDensityContract.md).

- [fork recursive quota](../04_cryptography/CryptoHiddenScalarForkRecursiveQuotaContract.md).

- [single path](../04_cryptography/CryptoHiddenScalarSinglePathContract.md).

- [threshold quota](../04_cryptography/CryptoHiddenScalarThresholdQuotaContract.md).

- [tape average](../04_cryptography/CryptoHiddenScalarTapeAverageContract.md).

- [heavy tape](../04_cryptography/CryptoHiddenScalarHeavyTapeContract.md).

- [Decidable quota margins and a finite positive minimum](../04_cryptography/CryptoHiddenScalarQuotaMarginContract.md).

- [Explicit factorized quota bounds](../04_cryptography/CryptoHiddenScalarQuotaProductContract.md).

- [Geometric quota deficit bounds](../04_cryptography/CryptoHiddenScalarQuotaDeficitContract.md).

- [Constructive quota budgets](../04_cryptography/CryptoHiddenScalarQuotaBudgetContract.md).

- [Exact reference quota budgets](../04_cryptography/CryptoHiddenScalarQuotaMinimumContract.md).

- [Exact reference quota budgets](../04_cryptography/CryptoHiddenScalarQuotaTabularContract.md).

- [Streaming quota budget search](../04_cryptography/CryptoHiddenScalarQuotaStreamingContract.md).

- [Structural accounting for quota search](../04_cryptography/CryptoHiddenScalarQuotaCostContract.md).

- [Structural accounting for quota search](../04_cryptography/CryptoHiddenScalarQuotaComparisonContract.md).

- [Fast boundary branches for quota search](../04_cryptography/CryptoHiddenScalarQuotaFastContract.md).

- [Certified resumable quota search](../04_cryptography/CryptoHiddenScalarQuotaResumableContract.md).

- [Exact structural costs of quota resumption](../04_cryptography/CryptoHiddenScalarQuotaResumeCostContract.md).

- [Full state and cost equality of quota chains](../04_cryptography/CryptoHiddenScalarQuotaChainContract.md).

- [Fast successful start of resumable quota search](../04_cryptography/CryptoHiddenScalarQuotaFastStartContract.md).

- [Resume chains with one fast start](../04_cryptography/CryptoHiddenScalarQuotaFastChainContract.md).

- [Checked quota cursor snapshots](../04_cryptography/CryptoHiddenScalarQuotaSnapshotContract.md).

- [CryptoHiddenScalarQuotaCodecContract](../04_cryptography/CryptoHiddenScalarQuotaCodecContract.md).
- [CryptoHiddenScalarQuotaCanonicalWireContract](../04_cryptography/CryptoHiddenScalarQuotaCanonicalWireContract.md).
- [CryptoHiddenScalarQuotaProfileContract](../04_cryptography/CryptoHiddenScalarQuotaProfileContract.md).
- [Bounded snapshot reader and CLI](../../docs/quota-snapshot-reader.en.md).

- [CryptoHiddenScalarQuotaProfileCodecContract](../04_cryptography/CryptoHiddenScalarQuotaProfileCodecContract.md).
- [DigitalProvenanceManifestContract](../04_cryptography/DigitalProvenanceManifestContract.md).
- [Bounded profile reader and CLI](../../docs/quota-profile-reader.en.md).

- [DigitalProvenanceVerificationContract](../04_cryptography/DigitalProvenanceVerificationContract.md).
- [DigitalProvenanceReplayContract](../04_cryptography/DigitalProvenanceReplayContract.md).

- [DigitalProvenanceReportContract](../04_cryptography/DigitalProvenanceReportContract.md).
- [DigitalProvenanceRecoveryContract](../04_cryptography/DigitalProvenanceRecoveryContract.md).

- [DataAvailabilitySamplingContract](../01_cryptography_and_protocols/DataAvailabilitySamplingContract.md) — explicitly scoped contract; see its assumptions and limitations.

- [DigitalProvenanceChallengeRegistryContract](../04_cryptography/DigitalProvenanceChallengeRegistryContract.md)

- [DigitalProvenanceReadyPreparedContract](../04_cryptography/DigitalProvenanceReadyPreparedContract.md)

- [CryptoFeldmanVSSGroup](CryptoFeldmanVSSGroup.en.md) — Arbitrary-degree finite-field group share consistency and verified reconstruction.

- [CryptoPedersenVSSGroup](CryptoPedersenVSSGroup.en.md) — Joint hiding and verified polynomial Pedersen shares.

- [CryptoShamirShareRepair](CryptoShamirShareRepair.en.md) — Repair at arbitrary participant coordinates.

- [CryptoShamirRefresh](CryptoShamirRefresh.en.md) — Uniform zero-constant polynomial refresh.

- [CryptoThresholdBLSGroup](CryptoThresholdBLSGroup.en.md) — Threshold BLS reconstruction from checked partials.

- [CryptoQualifiedDealerSharing](CryptoQualifiedDealerSharing.en.md) — Aggregation after agreement on qualified dealers.

- [CryptoKZGOpeningEquation](CryptoKZGOpeningEquation.en.md) — Typed pairing equation for polynomial openings.

- [CryptoGroth16PairingEquation](CryptoGroth16PairingEquation.en.md) — Groth16 verification equation in distinct pairing groups.