[Tabaie]

This PR finishes the implementation of GKR for Koalabear.
The input and output columns are over Koalabear. The outgoing claims are over E6.
Internally, the first round of each sum-check is mixed. All other rounds are entirely over the extensions.

---

Note

High Risk
Changes the Fiat–Shamir transcript and Prove/Verify hasher API across all curves; incorrect caller seeding or challenge ordering would break soundness, and the rename is a breaking public API change.

Overview
Refactors GKR Fiat–Shamir across the generated curve packages: Prove/Verify now take hash.FieldHasher, transcripts use Absorb/Squeeze via NewNativeTranscript (replacing byte hash.Hash and Bind/Challenge), and BindGkrFinalEvalProof is renamed to AbsorbGkrFinalEvalProof. Each curve moves from package gkr to its own package (e.g. gkrbn254), with shared gkr.EvaluationClaim and gkr.PrimeField used from constraint gate registration.

Adds DeserializeProof as the inverse of Proof.Flatten, tightens Claims.Check (wire 0, instance count, missing wires, evaluation-point length), and documents that verifiers must seed the hasher like the prover. Sumcheck proving splits eq/input evaluation buffers in roundPolynomial; tests add Poseidon2 end-to-end flatten/deserialize flows and stronger claim checks, with test helpers moved to gkrtesting.

^{Reviewed by Cursor Bugbot for commit d81db55. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

There are 3 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 4f6c711. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/​github.com/​consensys/​gnark-crypto@​v0.22.1-0.20261009142911-8911ee45d22b ⏵ v0.22.1-0.20261103155519-1a9aede5b1c3	+1

View full report

[Tabaie]

Thanks for the feedback @ivokub. I think I addressed it all. Though it now pins an unmerged gnark-crypto commit from Consensys-Incorporated/gnark-crypto#920

[ivokub]

All comments from the previous round are addressed. Claims.Check now ties each claim's evaluation-point length to the assignment's column size, which closes the soundness gap where a proof covering a subset of instances verified against a larger assignment — the main finding of last round. The new regression test covers exactly that attack.

The switch to hash.FieldHasher is a strict improvement: it removes the SetBytesCanonical panic path for non-field-native hashes and makes the transcript field-aware. The PadBlock fix in 81c88ac is important and correct — without it a Squeeze is not committed into the running state, so "squeeze, then absorb" would be transcript-indistinguishable from absorbing alone. Renames (Absorb/Squeeze, roundPolynomialBaseInputs/roundPolynomialExt) match behavior now.

Non-blocking notes: (1) consider exporting a default hasher constructor from gkr/koalabear (e.g. NewPoseidon2Hasher) so external callers don't need to discover extensionsHash.NewBaseFieldHashAdapterE6(poseidon2.NewMerkleDamgardHasher()) themselves — the prime-field backends have mimc.NewFieldHasher(), KoalaBear has no equivalent; (2) the gnark-crypto pin needs updating once the upstream PR lands. The API breaks vs master (gkrapi.Field removal, BindGkrFinalEvalProof rename) are acceptable here since external use goes through the concrete backend constructors.

Though perhaps we should wait for a bit for the FieldHasher PR feedback? I also recommended some changes there, particularly for the extension adapter (which perhaps makes sense o remove there and we just do the slicing of the array here).

[ivokub]

@Tabaie - is it ready to merge? Should we update gnark-crypto to its master?

[Tabaie]

@Tabaie - is it ready to merge? Should we update gnark-crypto to its master?

@ivokub Should be good now!

[ivokub]

Thanks! Looks good and corresponds to gnark-crypto changes. Good to merge!