Paper 2025/2249

Revisiting Sum-check-based Polynomial Commitment Schemes

Abstract

The sum-check protocol serves as a fundamental building block in succinct arguments, yet its security guarantees are typically formalized in a manner intimately tied to the encompassing protocol, impeding modular analysis and design. We address this limitation by introducing a functional perspective that characterizes sum-check via the \emph{repulsive verifier property}: the verifier's output function is repelled from any polynomial whose hypercube sum differs from the claimed value. This property is intrinsic to sum-check and holds independently of any external binding mechanism or commitment scheme. Dually, we identify an \emph{attractive verifier property} inherent to the FRI protocol: provided the input word is sufficiently close to a codeword (i.e., a Reed-Solomon encoding of a polynomial), the verifier either outputs the evaluation of that polynomial at the random challenge point or aborts. These dual properties---repulsiveness and attractiveness---yield a clean, modular methodology for analyzing protocols that interleave sum-check with other components. We demonstrate the efficacy of this methodology through three applications. First, we provide a modular analysis of BaseFold that directly exploits these functional properties, circumventing the need for monolithic security arguments. Second, we show that BulletProofs can be decomposed into a repulsive sum-check and a computationally attractive component, leading to a simpler security proof. Third, we construct $\MyWork$, a new polynomial commitment scheme that simultaneously achieves transparency, homomorphic commitments, and double efficiency by composing these functional building blocks, thereby illustrating that our approach facilitates the systematic design of novel cryptographic protocols.