Mercury opens a multilinear polynomial with a proof that does not grow with the polynomial: five commitments, three opening elements, six field numbers — whether the witness has thirty-two entries or a billion. This page runs one whole opening on a five-variable instance over a 27 481-element field and prints every number it touches, from the 4 × 8 table to the two pairing equations at the end. Thirty-nine steps, forward and back.
Scope. One opening of one commitment: only the commitment scheme and the opening protocol of Section 6, with no proving system, sumcheck or batching around it. Everything on screen is computed in the browser in exact modular arithmetic, including the commitments, which are real points on a real curve, and both verifier checks, which are real pairings in Fp12.
Sumcheck-based systems end by needing one multilinear polynomial opened at one random point. gemini and zeromorph keep the prover linear but send a commitment per variable, so the proof grows as O(log n); the univariate route keeps the proof constant but pays an FFT. Mercury takes neither trade: a constant-size proof, O(n) field operations for the prover, and an ordinary KZG commitment to the same coefficient vector.
Reshape the n values into a table and split the evaluation point to match. The ordinary fold-to-one procedure becomes a single matrix expression, v = Ψu₁T F Ψu₂, and the vector reached halfway is h = Ψu₁T F, which the prover commits to. To test it, the table is folded a second time, along the other axis, by powers of a random α drawn after h is fixed: g = F A. Evaluating h at α, or g as a multilinear at u₁, both give Ψu₁T F A, so a prover who altered h must match a value computed along a path that never touched it.
Modulo Xb₁ − α, the indeterminate Xb₁ is α, so Xi+jb₁ reduces to αjXi and the remainder of f is the folded vector, coefficient for coefficient. The fold is therefore proved by a division identity, f = (X4 − α)q + g, which a KZG verifier tests at one point, with the quotient computed by Horner's rule once per row. The reversal D(X) = X3g(1/X), a polynomial exactly when deg g < 4, is the witness that keeps the remainder unique.
Two inner-product claims survive to the end, ⟨Pu₁, g⟩ = ĝ(u₁) and ⟨Pu₂, h⟩ = v, and a committed witness S reduces both to one equation under one challenge γ. The verifier never receives h(α): it reconstructs it from that identity and requires the committed h to open to it at α. That is why h is opened at three points, and it is where a tampered halfway vector is caught.
The table stays on screen throughout, with the axis being folded lit, above a trust chain that fills in as each link is established. Reseed draws a fresh instance; Cheat hands the protocol to a prover that has moved one coefficient of h, so the only thing that changes on screen is what breaks.
- Real. The field arithmetic, the folds, the division, the commitments as points on an actual pairing-friendly curve, and both verifier checks as pairings. Every polynomial identity is also compared coefficient by coefficient, including those a verifier only tests at a point.
- Small on purpose. A Barreto–Naehrig curve at
x = 5, sop = 27 631andr = 27 481. Statistical soundness is about seven bits and cryptographic security is zero. - Rectangular, not square. Five variables split 2 and 3, so
b₁ = 4governs the division andb₂ = 8counts columns.
- The shipped script is the tested script: the Node harness requires the same modules the page inlines.
- Twelve thousand assertions across 301 instances, and forty thousand openings, honest and tampering, across twenty thousand seeds: every verdict correct.
- A 29-check self-test runs in the browser on every load and reseed.
Source: Liam Eagen and Ariel Gabizon, MERCURY: A multilinear Polynomial Commitment Scheme with constant proof size and linear field work, IACR ePrint 2025/385. The batched multi-point opening is Section 4 of Boneh, Drake, Fisch and Gabizon, ePrint 2020/081.