Skip to main content

forward_constant_substitution

Function forward_constant_substitution 

Source
pub fn forward_constant_substitution<F: Field, const N: usize>(
    mds: &[[F; N]; N],
    partial_rc: &[[F; N]],
) -> (Vec<F>, [F; N])
Expand description

Forward constant substitution for the textbook partial round path.

In a partial round, only state[0] goes through the S-box. The constants for state[1..WIDTH] can be folded forward through the MDS matrix, reducing each partial round to a single scalar addition to state[0] plus one MDS multiply.

§Algorithm

Starting from round 0, for each partial round:

  1. The scalar constant for that round is rc[0] + acc[0] (original constant plus accumulated offset from previous rounds).
  2. The remaining offsets [0, rc[1]+acc[1], ..., rc[W-1]+acc[W-1]] are propagated through the MDS matrix to produce the accumulator for the next round.

After all rounds, the final accumulator is a residual vector that must be added to the state.

§Returns

A tuple of (scalar_constants, residual) where:

  • scalar_constants has RP entries, one per partial round (added to state[0] before the S-box).
  • residual is a WIDTH-vector added to the state after all partial rounds complete.