leanDA — PQ proofs of RS codes with leanVM

leanDA

Post Quantum Proofs of RS codes with leanVM

Tau Lepton

Tau Lepton · 2026
leanDA — PQ proofs of RS codes with leanVM

Construction 1 — RLC + FRI Fold In Circuit

RLC + FRI fold diagram

1. Commit rows and sample the RLC challenge. The transcript binds every row root before sampling .

2. Build one extension-field aggregate codeword. Every column is combined with powers of .

3. Fold the aggregate in the leanVM trace. Each round halves the domain.

4. Assert exact RS membership. The final folded vector must be constant.

benchmark parameters prove message throughput proof
leanDAS headline , half-rate 5.28 s 364 KB/s 356 KiB
Implementation: circuit.py
Run: cargo run --release --bin leandas -- -m 240 -n 4096 --zkvm
Tau Lepton · 2026
leanDA — PQ proofs of RS codes with leanVM

Construction 2 — Barycentric Check Per Row

Barycentric row check diagram

1. Commit rows and sample the barycentric point. The same challenge is used for all row checks.

2. Build the evens/odds barycentric slices. For row domain roots :

3. Check every row independently. For :

blobs bytecode cycles Poseidon16 ExtOp proof throughput
8 59,560 131,254 81,920 180,236 316.09 KiB 836.91 KiB/s
16 59,656 213,286 163,840 311,308 334.89 KiB 930.65 KiB/s
32 59,848 377,350 327,680 573,452 351.21 KiB 949.17 KiB/s
Implementation: lean_da.py, barycentric.py
Run: cargo run --release -p lean-da -- --n-blobs 32
Tau Lepton · 2026
leanDA — PQ proofs of RS codes with leanVM

Construction 3 — Systematic Row Digests + Column Merkle Commitments + Row Barycentric Checks + Cell-Level Sampling

Column Merkle commitment diagram

1. Hash each cell. Split every row into aligned cells of extension-field elements. Cell starts at offset , then its base-field limbs are chunked and chain-hashed into one 8-FE digest.

2. Chain only systematic cell digests into one digest per row. The row digest ignores parity cells.

3. Merkle-commit each column, then bind row and column commitments together. Non-power-of-two row counts are zero-padded inside each column tree.

4. Run the standard row barycentric LDT. The same evens/odds identity is checked for every row.

blobs bytecode cycles Poseidon16 ExtOp proof throughput
12 228,887 261,655 133,135 245,772 319.83 KiB 770.04 KiB/s
24 382,927 448,463 266,271 442,380 338.14 KiB 711.70 KiB/s
44 688,871 819,943 493,631 770,060 361.56 KiB 1,102.26 KiB/s
46 689,939 821,011 513,087 802,828 363.20 KiB 1,150.06 KiB/s
Implementation: lean_da_column_commit.py
Run: cargo run --release -p lean-da -- --construction column-commit --n-blobs 46 --tracing
Tau Lepton · 2026