pub fn forward_constant_substitution<F: Field, const N: usize>(
mds: &[[F; N]; N],
partial_rc: &[[F; N]],
) -> (Vec<F>, [F; N])Expand description
Forward constant substitution for the textbook partial round path.
In a partial round, only state[0] goes through the S-box. The constants for
state[1..WIDTH] can be folded forward through the MDS matrix, reducing each
partial round to a single scalar addition to state[0] plus one MDS multiply.
§Algorithm
Starting from round 0, for each partial round:
- The scalar constant for that round is
rc[0] + acc[0](original constant plus accumulated offset from previous rounds). - The remaining offsets
[0, rc[1]+acc[1], ..., rc[W-1]+acc[W-1]]are propagated through the MDS matrix to produce the accumulator for the next round.
After all rounds, the final accumulator is a residual vector that must be added to the state.
§Returns
A tuple of (scalar_constants, residual) where:
scalar_constantshas RP entries, one per partial round (added tostate[0]before the S-box).residualis a WIDTH-vector added to the state after all partial rounds complete.