Struct SsaPartCommitment 

pub struct SsaPartCommitment<S: PixSpec, P = <S as PixSpec>::Pseudonym> {
    pub(crate) spi: SsaPolynomialId<P>,
    pub(crate) constant_term: PixGroup<S>,
}

Commitment to the constant term of the polynomial with the given SsaPolynomialId.

Why only the constant term

This used to be a full Feldman verifier — a commitment to every coefficient — so that each individual share could be checked the moment it arrived. Classic VSS needs that, because its shares sit with mutually distrusting parties that reconstruct later. PIX has exactly one shareholder: the Exit holds every share, reconstructs locally, is the whole quorum, and consumes only the recovered constant term. Checking a₀·G == C₀ once, on the reconstructed part, is therefore deterministic and exact for the property actually relied upon — and costs one scalar multiplication per polynomial instead of threshold per share.

What the per-coefficient commitments did buy was fault isolation: one bad share could be rejected on arrival and its slot refilled from the surplus. That is given up. A share that fails to reconstruct implies a dishonest or broken Entry — it travels inside a Sphinx-authenticated SURB, and its decryption key is fixed by the very acknowledgement challenge it is filed under, so there is no benign path to a corrupt one — and such an Entry has already funded the deposit it thereby forfeits. The price paid is detection latency: a dishonest Entry is caught on the threshold-th share of a polynomial rather than the first.

surplus_shares still absorbs lost shares, since reconstruction starts at the first threshold distinct shares that arrive.

Fields

spi: SsaPolynomialId<P>

constant_term: PixGroup<S>

Implementations

impl<S: PixSpec> SsaPartCommitment<S, S::Pseudonym>

pub fn from_decoded_commitment( spi: SsaPolynomialId<S::Pseudonym>, constant_term: PixGroup<S>, ) -> Self

Creates a commitment from an already decoded and subgroup-checked group element.

The only decode is decode_commitment, performed once when the commitment arrives on the wire. Decompression requires a modular square root and is the dominant per-commitment cost, so nothing here decodes a second time.

pub fn spi(&self) -> &SsaPolynomialId<S::Pseudonym>

Returns the SsaPolynomialId of the polynomial this commitment belongs to.

pub fn constant_term(&self) -> &PixGroup<S>

Returns the commitment to the constant term of the polynomial.

pub fn verify_reconstructed(&self, secret: &PixScalar<S>) -> bool

Checks a reconstructed constant term against this commitment.

This is the entire verification the Exit performs on a polynomial, and it happens once, after threshold shares have been interpolated. A mismatch means at least one of those shares did not come from the committed polynomial; it does not say which.

pub fn decode_commitment( commitment: &PixGroupRepr<S>, ) -> Result<PixGroup<S>, S::Pseudonym>

Decodes a single serialized coefficient commitment into a group element.

Rejects bytes that do not decode, and points outside the prime-order subgroup: Baby JubJub has cofactor 8, so small-order points can pass the plain on-curve check.

No value-based filtering is applied — a coefficient commitment equal to the generator validly represents scalar coefficient 1 and must be preserved.

Trait Implementations

impl<S: Clone + PixSpec, P: Clone> Clone for SsaPartCommitment<S, P>

fn clone(&self) -> SsaPartCommitment<S, P>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<S: Debug + PixSpec, P: Debug> Debug for SsaPartCommitment<S, P>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de, S: PixSpec, P> Deserialize<'de> for SsaPartCommitment<S, P>

where P: Deserialize<'de>,

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl<S: Eq + PixSpec, P: Eq> Eq for SsaPartCommitment<S, P>

impl<S: PartialEq + PixSpec, P: PartialEq> PartialEq for SsaPartCommitment<S, P>

fn eq(&self, other: &SsaPartCommitment<S, P>) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl<S: PixSpec, P> Serialize for SsaPartCommitment<S, P>

where P: Serialize,

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl<S: PartialEq + PixSpec, P: PartialEq> StructuralPartialEq for SsaPartCommitment<S, P>