MPC-in-the-Head Zero-Knowledge Proof for Rank Syndrome Decoding via Mixed-Field Secret Sharing

Abstract

Quantum computing poses significant challenges to traditional zero-knowledge proof schemes based on number-theoretic assumptions. As a result, code-based cryptography has attracted increasing attention for its resistance against quantum computing. In this paper, we study the Rank Syndrome Decoding problem (RSD) and investigate its ZK proof formulation within the MPC-in-the-Head framework. To prove the possession of a secret witness, we reformulate the secret witness as a mixed-field matrix multiplication preserving the rank constraint, and then obtain a representation that aligns naturally with the local-view paradigm of MPC-in-the-Head. Utilizing this value-to-calculation technique, we introduce the RSD relation into a ZKBoo-style (2, 3)-secret-sharing MPC-in-the-Head framework and obtain an RSD-based zero-knowledge proof scheme via mixed-field secret sharing. The resulting scheme reduces the proof size relative to generic formulations while preserving completeness, soundness, and zero-knowledge for the interactive protocol. The Fiat–Shamir non-interactive extension is analyzed only in the classical random oracle model; we do not claim QROM security for this variant.

1. Introduction

Zero-knowledge (ZK) proofs are a fundamental cryptographic tool that allow a prover to convince a verifier of the validity of a statement without revealing the underlying witness. They are widely used in privacy-preserving computation, anonymous authentication, and blockchain systems [1]. As quantum computing continues to advance, the long-term security guarantees of many public-key constructions relying on number-theoretic hardness assumptions are being called into question. This shift has brought post-quantum zero-knowledge to the forefront of contemporary cryptographic research. Among the leading candidates for post-quantum cryptography, code-based cryptography remains especially appealing because of its conservative security foundation, efficient finite-field operations, extensive history of cryptanalytic evaluation [2], and inherent resistance to quantum attacks [3,4]. The development of coding-based ZK proof schemes also constitutes a significant research direction.

The seminal work on code-based zero-knowledge proofs is due to Stern [5], based on the Syndrome Decoding (SD) problem. Stern’s protocol has a soundness error of $2/3$, which can be made arbitrarily small through parallel or sequential repetition. Since then, several works have proposed optimizations and practical implementations of Stern’s approach [6,7,8]. However, for these random linear codes at standard security levels, the resulting communication cost is still relatively large. Advanced SD-based ZK constructions include Threshold-in-the-Head (TCitH) approaches, such as SDitH [9]. Within code-based cryptography, the rank metric provides an appealing alternative to the classical Hamming metric, since it can achieve comparable security with smaller parameter sizes [10]. This makes the Rank Syndrome Decoding (RSD) problem a promising foundation for compact post-quantum proof systems. Recent application-oriented developments also support the practical relevance of this direction. The digital signature can be viewed as a non-interactive zero-knowledge proof that additionally incorporates the message to be signed. In particular, RYDE [11] demonstrates that RSD assumptions can be used in concrete VOLE-in-the-Head (VOLEitH) style signature constructions, and NIST’s additional post-quantum signature process advanced both RYDE and SDitH to the second round in October 2024 [12]. These developments motivate a closer study of zero-knowledge formulations for rank-metric relations and of proof systems that preserve their native algebraic structure. This paper focuses on ZK proof constructions based on the RSD problem in the MPC-in-the-Head paradigm.

The MPC-in-the-Head (MPCitH) paradigm, originating from the work of Ishai et al. [13], provides a general approach for transforming secure multiparty computation (MPC) into zero-knowledge proofs. In recent years, this paradigm has increasingly been used in the construction of practical zero-knowledge and signature schemes. ZKBoo [2] demonstrated that this paradigm can yield practically efficient proofs for generic Boolean circuits, while ZKB++ [14] further improved proof compactness through more efficient view generation and compression techniques in the underlying MPC. These works establish MPC-in-the-Head as a flexible proof framework for general circuit statements. MPCitH-based constructions have been extended beyond generic circuit statements to post-quantum settings and code-based assumptions. In particular, prior work SDitH [9] studied MPCitH-based signatures from the classical Syndrome Decoding (SD) problem. In the rank-metric setting, RYDE [11] instantiated RSD-based signature constructions within the VOLE-in-the-Head paradigm. This line of research shows that MPCitH is not limited to generic Boolean encodings, but can also be instantiated over more structured algebraic relations.

Related Work and Positioning. To clarify the technical contribution of this work, we summarise how it differs from the closest existing MPC-in-the-Head and rank-metric proof systems along three axes: the underlying framework, the target relation, and the design goal. Generic-circuit MPCitH schemes such as ZKBoo [2] and ZKB++ [14] encode the statement as a Boolean circuit and incur a communication cost proportional to the gate count of that circuit; in contrast, our scheme exploits the algebraic structure of the rank-metric relation directly, replacing the rank constraint by a mixed-field matrix factorisation $e=X·y$ and never materialising a rank-check sub-circuit. Concerning the target relation, MPCitH constructions based on Hamming-metric Syndrome Decoding (e.g., SDitH [9]) rely on permutation-based or weight-based encodings of the error vector; our scheme works natively in the rank metric and reduces the rank predicate to a dimension-controlled product over the base field and its extension. Finally, with respect to the design goal, signature constructions such as RYDE [11] and SDitH [9] target the shortest possible non-interactive signature by composing MPCitH with aggressive transcript-compression techniques (VOLE-in-the-Head, Threshold-in-the-Head, hypercube sharing); our goal is complementary, namely a stand-alone zero-knowledge proof of knowledge for the RSD relation within the classical $(2, 3)$-secret-sharing MPCitH paradigm, preserving the native algebraic structure of RSD and remaining amenable to further composition.

Our contribution. Building on the positioning above, the technical contributions of this paper are as follows.

• We arithmetise the rank constraint of the RSD relation as a mixed-field matrix product $e=X·y$ with $X\in {\mathbb{F}}_q^{n\times r}$ and $y\in {\mathbb{F}}_{q^m}^r$. This algebraic identity turns a rank-metric statement into a relation suitable for a $(2, 3)$-secret-sharing MPC protocol without an explicit rank-check sub-circuit.
• We design a $(2, 3)$-secret-sharing MPC protocol for the mixed-field product, operating simultaneously over ${\mathbb{F}}_q$ and ${\mathbb{F}}_{q^m}$, and apply the MPC-in-the-Head transformation to obtain a single-round interactive zero-knowledge $\mathrm{\Sigma }$-protocol with soundness error $2/3$. The local view of each virtual party is formally defined in Section 3.3, where every value used by the verifier is shown to be either recomputable from the response or cryptographically bound by a commitment.
• We give a Fiat–Shamir compilation of the protocol into a non-interactive zero-knowledge proof (Section 5), with the security analysis explicitly restricted to the classical random oracle model. We do not claim security of the Fiat–Shamir variant in the Quantum Random Oracle Model, and we identify QROM security as future work. We instantiate the scheme at NIST Security Level 1 with parameters $(q,m,n,k,r)=(2,41,38,19,7)$ and validate the parameter choice using the Rank-Metric Estimator of Bardet et al. [15], whose detailed attack-cost breakdown is reported in Section 6.1. We additionally provide a reference implementation and the proposed scheme produces a 65.7 KB proof in approximately 22 ms and verifies it in approximately 14 ms.

Organization. The remainder of this paper is organized as follows. In Section 2, we review the necessary preliminaries, including the notation, the RSD problem, and the MPC-in-the-Head paradigm. Section 3 presents our proposed single-round interactive protocol, with details on the arithmetization of the rank constraint and the protocol design. In Section 4, we discuss the security of the proposed protocol. Section 5 presents a non-interactive extension together with its security discussion. Section 6 provides a performance evaluation of the proposed scheme. Finally, Section 7 concludes the paper.

2. Preliminaries

2.1. Notation

In this paper, all linear algebra operations are performed over the corresponding fields by default. Unless otherwise specified, lowercase letters represent scalars or column vectors, uppercase letters represent matrices, and ${(•)}^T$ denotes the transpose. Throughout this paper, all party indices are taken modulo 3, such that $i\in \{1,2,3\}$ and $i+1$ wraps around to 1 when $i=3$. The detailed descriptions of the parameters used in this paper are listed in

Table 1. Notation and definitions.

Notation	Definition
q	A prime power
${\mathbb{F}}_q$	The finite field of size q
${\mathbb{F}}_{q^m}$	The extension field of degree m
${(•)}^T$	Transpose
$A_{i,j}$	The element in the i-th row and j-th column for a matrix A
$x_i$	The i-th component for a vector x
$\mathbf{0}$	The zero vector or matrix
${\mathbf{I}}_{\mathbf{t}}$	The $t\times t$ identity matrix
⌀	The empty set
${\dim }_{{\mathbb{F}}_q}\left(V\right)$	The dimension of a vector space V defined over ${\mathbb{F}}_q$
$rank\left(e\right)$	The rank weight of a vector e
N	The number of virtual parties in the MPC-in-the-Head framework (default $N=3$)
$P_i$	The i-th virtual party
$Vie{w}_i$	The local view of the i-th party
$C_i$	The commitment of the i-th party
$ch$	The verifier’s challenge
$\lambda$	The security parameter
$\kappa$	The number of repetitions
X	The coefficient matrix over the base field ${\mathbb{F}}_q^{n\times r}$
y	The basis vector over the extension field ${\mathbb{F}}_{q^m}^r$
$Hash(•)$	The hash function

.

2.2. Rank Syndrome Decoding

The Rank Syndrome Decoding (RSD) problem [16] is a core computational hard problem in rank-metric cryptography, employing different metrics compared to the commonly used Syndrome Decoding (SD) problem under the Hamming metric. Definition 1 below gives the definition of RSD.

Definition 1

(Rank Syndrome Decoding Problem). Given an extension field ${\mathbb{F}}_{q^m}$, which can be viewed as an m-dimensional vector space over the base field ${\mathbb{F}}_q$. For a given random matrix $H\in {\mathbb{F}}_{q^m}^{(n-k)\times n}$, a target syndrome $s\in {\mathbb{F}}_{q^m}^{n-k}$, and an integer parameter r, the RSD problem requires finding a vector $e\in {\mathbb{F}}_{q^m}^n$ such that

$$He=s,rank\left(e\right)\le r.$$

Here, the $rank\left(e\right)$ is defined as the dimension of the vector space spanned by its components $e_1,e_2,\dots ,e_n\in {\mathbb{F}}_{q^m}$ over the base field ${\mathbb{F}}_q$.

The SD problem under the classic Hamming metric has been proven to be NP-hard. The RSD problem has been proven to be NP-hard [17] through a probabilistic reduction to the SD problem. Compared to the Hamming metric, decoding problems under the rank metric often provide smaller parameter sizes for the same security level [16].

2.3. MPC-in-the-Head

Multi-party computation (MPC) is an interactive protocol involving multiple parties $\left(P_1,\dots ,P_N\right).$ To compute a function f over a secret input w, the input is first divided into N shares $(w_1,\dots ,w_N)$, and each party $P_i$ holds a specific share $w_i$. They collaboratively compute $f\left(w\right)$ without revealing their individual shares. Each party outputs its respective computation result. MPC-in-the-Head framework is proposed by Ishai et al. in 2007 [13], which is a general framework for transforming secure MPC protocols into zero-knowledge proof (ZKP) systems.

As illustrated in Figure 1, the MPC-in-the-Head paradigm transforms a secure multiparty computation protocol into a zero-knowledge proof through a standard three-phase interaction:

• Commit Phase: The prover locally simulates an N-party ($N=3$) MPC protocol in their local. The secret witness w is divided into corresponding shares $(w_1,w_2,w_3)$ and distributed to virtual parties $(P_1,P_2,P_3)$. After the internal simulation, the prover generates a local view $Vie{w}_i$ for each party and sends their hash commitments $C_i=Hash\left(Vie{w}_i\right)$ to the verifier.
• Challenge Phase: The verifier uniformly samples a random challenge $ch\in \{1,2,3\}$ and sends it to the prover, specifying which subset of views should be opened.
• Response and Verification Phase: The prover reveals a specific subset of views according to the challenge. The verifier then independently performs three strict checks: (1) Whether the opened views match the initial commitments ($Hash\left(Vie{w}_i\right)==C_i$), (2) Whether the intermediate computation messages are logically consistent between the opened views, and (3) Whether the simulated MPC circuit ultimately outputs a valid result.

The security of this mechanism relies strictly on the underlying MPC protocol. The zero-knowledge property is guaranteed because the verifier only observes a subset of views, which can be perfectly simulated due to the MPC’s privacy threshold. Meanwhile, the soundness is derived from the correctness of the MPC protocol, as any cheating attempt by the prover will introduce inconsistencies that the verifier catches with a certain probability. By repeating this process, the scheme achieves high security with very low communication overhead [2,13].

3. The Single-Round Interactive Protocol

3.1. Arithmetization of the Rank Constraint

The primary objective of the scheme is for the prover to prove, in a zero-knowledge manner, the possession of a secret error vector $e\in {\mathbb{F}}_{q^m}^n$ that satisfies $He=s$ and $ran{k}_{{\mathbb{F}}_q}\left(e\right)\le r$. To efficiently handle the rank constraint within the MPC-in-the-Head framework, this scheme leverages the algebraic properties of the rank metric to perform a basis decomposition of the vector e. Let $X\in {\mathbb{F}}_q^{n\times r}$ be the coefficient matrix defined over the base field, and $y\in {\mathbb{F}}_{q^m}^r$ be the basis vector defined over the extension field. We equivalently decompose the rank constraint of e into the product of two smaller matrices

$$e=X·y$$

(1)

according to Lemma 1.

Lemma 1

(Rank Constraint Preserved by Basis Decomposition). Let $e\in {\mathbb{F}}_{q^m}^n$ be an error vector. If there exist a coefficient matrix $X\in {\mathbb{F}}_q^{n\times r}$ and a basis vector $y\in {\mathbb{F}}_{q^m}^r$ such that $e=X·y$, then the rank weight of e over the base field ${\mathbb{F}}_q$ satisfies rank constraint $ran{k}_{{\mathbb{F}}_q}\left(e\right)\le r$. Equivalently, if $ran{k}_{{\mathbb{F}}_q}\left(e\right)>r$, then e cannot be decomposed into the product $X·y$ with dimensions $n\times r$ and $r\times 1$, respectively.

Proof. 

Necessity. We proceed by contradiction. Assume there exists an error vector $e={\left(e_1,e_2,\dots ,e_n\right)}^T\in {\mathbb{F}}_{q^m}^n$ with $ran{k}_{{\mathbb{F}}_q}\left(e\right)>r$, which can be successfully decomposed as $e=X·y$, where $X\in {\mathbb{F}}_q^{n\times r}$ and $y={\left(y_1,y_2,\dots ,y_r\right)}^T\in {\mathbb{F}}_{q^m}^r$. By the definition of matrix multiplication, the i-th component of $e(1\le i\le n)$ can be explicitly written as the inner product of the i-th row of X and the vector y

$$e_i={\displaystyle \sum _{j=1}^r}{X}_{i,j}{y}_j.$$

(2)

In this equation, each $y_j\in {\mathbb{F}}_{q^m}$, and all matrix entries $X_{i,j}$ strictly belong to the base field ${\mathbb{F}}_q$. This indicates that every component $e_i$ is a linear combination of the elements $\{y_1,y_2,\dots ,y_r\}$ with coefficients drawn exclusively from ${\mathbb{F}}_q$. Let $V_e=spa{n}_{{\mathbb{F}}_q}\{e_1,e_2,\dots ,e_n\}$ be the ${\mathbb{F}}_q$-linear subspace spanned by the components of e, and let $V_y=spa{n}_{{\mathbb{F}}_q}\{y_1,y_2,\dots ,y_r\}$ be the subspace spanned by the components of y. The aforementioned linear combination implies that $V_e\subseteq V_y$. Since $V_y$ is generated by at most r elements, its dimension over ${\mathbb{F}}_q$ is bounded by r

$${dim}_{{\mathbb{F}}_q}\left(V_y\right)\le r.$$

Because $V_e$ is a subspace of $V_y$, its dimension must not exceed the dimension of $V_y$. By the definition of the rank metric, the rank of e is exactly the dimension of $V_e$. Thus, we have

$$ran{k}_{{\mathbb{F}}_q}\left(e\right)={dim}_{{\mathbb{F}}_q}\left(V_e\right)\le {dim}_{{\mathbb{F}}_q}\left(V_y\right)\le r.$$

This yields $ran{k}_{{\mathbb{F}}_q}\left(e\right)\le r$, which strictly contradicts our initial assumption that $ran{k}_{{\mathbb{F}}_q}\left(e\right)>r$. Therefore, the initial assumption must be false. This completes the proof.

Sufficiency. Conversely, assume that ${\mathrm{rank}}_{{\mathbb{F}}_q}\left(e\right)\le r$. We construct $X\in {\mathbb{F}}_q^{n\times r}$ and $y\in {\mathbb{F}}_{q^m}^r$ such that $e=X·y$. Let $r^{\prime }={\mathrm{rank}}_{{\mathbb{F}}_q}\left(e\right)\le r$, and let $V_e={\mathrm{span}}_{{\mathbb{F}}_q}\{e_1,e_2,\dots ,e_n\}$ denote the ${\mathbb{F}}_q$-linear subspace spanned by the components of e. By definition, ${dim}_{{\mathbb{F}}_q}\left(V_e\right)=r^{\prime }$, so we can fix an ${\mathbb{F}}_q$-basis $\{b_1,b_2,\dots ,b_{r^{\prime }}\}\subseteq {\mathbb{F}}_{q^m}$ of $V_e$. Since each component $e_i$ lies in $V_e$, it admits a unique expansion in this basis with coefficients in the base field ${\mathbb{F}}_q$:

$$e_i={\displaystyle \sum _{j=1}^{r^{\prime }}}{a}_{i,j}{b}_j,a_{i,j}\in {\mathbb{F}}_q.$$

If $r^{\prime }<r$, we extend the basis to an r-tuple $\{b_1,\dots ,b_{r^{\prime }},b_{r^{\prime }+1},\dots ,b_r\}\subseteq {\mathbb{F}}_{q^m}$ by appending arbitrary elements (for example, $b_{r^{\prime }+1}=\cdots =b_r=0$ suffices, since the corresponding coefficients can be taken as zero). Now define

$$X={\left(a_{i,j}\right)}_{1\le i\le n,1\le j\le r}\in {\mathbb{F}}_q^{n\times r},y={(b_1,b_2,\dots ,b_r)}^T\in {\mathbb{F}}_{q^m}^r,$$

where $a_{i,j}=0$ for $j>r^{\prime }$. By construction, for every $1\le i\le n$,

$${(X·y)}_i={\displaystyle \sum _{j=1}^r}{X}_{i,j}{y}_j={\displaystyle \sum _{j=1}^{r^{\prime }}}{a}_{i,j}{b}_j+{\displaystyle \sum _{j=r^{\prime }+1}^r}0·b_j={\displaystyle \sum _{j=1}^{r^{\prime }}}{a}_{i,j}{b}_j=e_i.$$

Therefore $X·y=e$, as required. Combining the two directions, the rank constraint ${\mathrm{rank}}_{{\mathbb{F}}_q}\left(e\right)\le r$ is equivalent to the existence of the matrix factorisation $e=X·y$ with the prescribed dimensions.    □

Thus the rank constraint of the error vector e is implicitly confirmed by the decomposition with matrices in the corresponding dimensions. This yields the equation constraint $He=H·(X·y)=s$. By reducing the original rank evaluation problem into a simple matrix multiplication between ${\mathbb{F}}_q$ and ${\mathbb{F}}_{q^m}$, we align the RSD problem with the structural strengths of the MPC-in-the-Head paradigm. Consequently, the prover’s secret input is transformed from the complex vector e to the pair $(X,y)$, elegantly eliminating the need for convoluted combinatorial proofs and paving the way for our compact mixed-field secret sharing protocol.

3.2. (2, 3)-Secret Sharing Mechanism for Mixed Fields

Our ideas were inspired by ZKB++ [14]. We model the prover as three parties $(P_1,P_2,P_3)$. The prover decomposes the secret inputs X and y into three shares: $X=X_1+X_2+X_3$ and $y=y_1+y_2+y_3$. The prover computes the secret sharing $e_i$ and the syndrome sharing $s_i=H{e}_i$ to compute execution view $Vie{w}_i$ for each party $P_i$ and submits the commitment $C_i=Hash\left(Vie{w}_i\right)$. Then, the prover computes the global round commitment $C=Hash(s_1,s_2,s_3,C_1,C_2,C_3)$. In the challenge phase, the verifier randomly selects a challenge $ch\in \{1,2,3\}$, and the prover opens the views of parties $P_{ch}$ and $P_{ch+1}$. During the verification phase, because the views of $P_i$ and $P_{i+1}$ are revealed, to prevent the verifier from deducing the secret from the exposed shares, a random blinding factor $R_i$ is introduced. The verifier first checks whether the two opened views match their corresponding commitments $C_i$. If they match, the verifier then verifies whether the execution processes between the two opened views are logically consistent. Instead of directly checking the output, the verifier utilizes the public syndrome s to algebraically reconstruct the unrevealed third syndrome share, which is then used to verify the global hash commitment.

By substituting the shared secrets into the multiplication, the total vector is expanded as follows.

$$\begin{array}{c}e=\left(X_1+X_2+X_3\right)·\left(y_1+y_2+y_3\right)\\ =X_1{y}_1+X_1{y}_2+X_2{y}_1\\ +X_2{y}_2+X_2{y}_3+X_3{y}_2\\ +X_3{y}_3+X_3{y}_1+X_1{y}_3.\end{array}$$

(3)

According to the (2, 3)-Secret Sharing Mechanism, each party $P_i$ first locally evaluates its cross-terms

$$X_i{y}_i+X_i{y}_{i+1}+X_{i+1}{y}_i.$$

To securely mask these cross-terms using the previously defined blinding factors, each party $P_i$ cyclically adds its own generated blinding factor and that of the next party. Thus, the final formula for $e^{\left(i\right)}$ is given by

$$e_i=X_i{y}_i+X_i{y}_{i+1}+X_{i+1}{y}_i+R_i-R_{i+1}.$$

(4)

It can be verified that these random values cancel out cyclically when the shares from all three parties are summed together

$$R_1-R_2+R_2-R_3+R_3-R_1=\mathbf{0}.$$

(5)

Therefore, the completeness of the computation holds

$$\begin{array}{c}e=\left(X_1+X_2+X_3\right)·\left(y_1+y_2+y_3\right)\\ =X_1{y}_1+X_1{y}_2+X_2{y}_1+R_1-R_2\\ +X_2{y}_2+X_2{y}_3+X_3{y}_2+R_2-R_3\\ +X_3{y}_3+X_3{y}_1+X_1{y}_3+R_3-R_1\\ =X·y.\end{array}$$

(6)

In the process described above, since both X and y are the prover’s secrets, multiplying secret variables in MPC typically requires substantial communication between parties. This would result in a significant increase in the final ZKP size. To eliminate the communication overhead associated with multiplication, we adopt the (2, 3)-distributed computation structure from ZKBoo [2] and specifically optimize it for mixed-field multiplication between ${\mathbb{F}}_q$ and ${\mathbb{F}}_{q^m}$.

3.3. Formal Definition of the Local View

In this section, we formalize what constitutes the local view of each virtual party in the head of the prover. This is the object that is later committed to in the Commit phase, partially opened in the Response phase, and recomputed in the Verify phase. Definition 2 below specifies the components of each local view, and Proposition 1 establishes that every value used by the verifier is either recomputable from the response or cryptographically bound by a commitment.

Definition 2

(Local View of a Virtual Party). For each virtual party $P_i$ with $i\in \{1,2,3\}$, the local view of $P_i$ is the triple

$$Vie{w}_i=(see{d}_i,au{x}_i,e_i),$$

whose three components are defined as follows.

• The seed ${\mathrm{seed}}_i\in {\{0,1\}}^{\lambda }$ is a uniformly random bit-string sampled by the prover at the beginning of the Commit phase. A pseudorandom generator $\mathrm{PRG}$ with domain-separated tags expands ${\mathrm{seed}}_i$ deterministically into the party’s local randomness: for $i\in \{1,2\}$, ${\mathrm{seed}}_i$ expands to the triple $(X_i,y_i,R_i)\in {\mathbb{F}}_q^{n\times r}\times {\mathbb{F}}_{q^m}^r\times {\mathbb{F}}_{q^m}^n$; for $i=3$, ${\mathrm{seed}}_3$ expands only to the blinding factor $R_3\in {\mathbb{F}}_{q^m}^n$.
• The auxiliary input ${\mathrm{aux}}_i$ carries the part of the party’s local randomness that is not derivable from any seed. It is defined as

  $${\mathrm{aux}}_i=\varnothing \mathit{for}i\in \{1,2\},{\mathrm{aux}}_3=(X_3,y_3),$$
  where $X_3=X-X_1-X_2$ and $y_3=y-y_1-y_2$ are determined by the prover’s secret witness and the seed-expanded shares of the other two parties.
• The local output share $e_i\in {\mathbb{F}}_{q^m}^n$ is the error-vector share computed by $P_i$ according to the cross-multiplication formula

  $$e_i=X_i{y}_i+X_i{y}_{i+1}+X_{i+1}{y}_i+R_i-R_{i+1}.$$

Each party additionally computes the syndrome share $s_i=H{e}_i\in {\mathbb{F}}_{q^m}^{n-k}$. The share $s_i$ is not a stored component of ${\mathrm{View}}_i$, since it is deterministically derivable from $e_i$ and the public matrix H; however, it participates in the round commitment $C=\mathrm{Hash}(s_1,s_2,s_3,C_1,C_2,C_3)$ defined in the protocol. By Equation (6), the three error shares satisfy $e_1+e_2+e_3=X·y=e$, and the three syndrome shares satisfy $s_1+s_2+s_3=s$.

Proposition 1

(Recomputability and Binding). Let $\mathrm{ch}\in \{1,2,3\}$ be a challenge, and let $\mathrm{Rsp}=({\mathrm{seed}}_{\mathrm{ch}},{\mathrm{seed}}_{\mathrm{ch}+1},{\mathrm{aux}}_{\mathrm{ch}},{\mathrm{aux}}_{\mathrm{ch}+1},e_{\mathrm{ch}+1},C_{\mathrm{ch}+2})$ be the corresponding response, where indices are taken modulo 3. Then the verifier can carry out all consistency checks of the protocol using only the values transmitted in $\mathrm{Rsp}$, the public statement $(H,s)$, the first message C, and the public algorithms $\mathrm{PRG}$ and $\mathrm{Hash}$. More precisely, every value involved in the verifier’s check belongs to exactly one of the following three categories.

• (C1) Explicitly transmitted: ${\mathrm{seed}}_{\mathrm{ch}}$, ${\mathrm{seed}}_{\mathrm{ch}+1}$, ${\mathrm{aux}}_{\mathrm{ch}}$, ${\mathrm{aux}}_{\mathrm{ch}+1}$, $e_{\mathrm{ch}+1}$, ${\mathrm{C}}_{\mathrm{ch}+2}$.
• (C2) Deterministically recomputable from (C1): the input-and-randomness triples $(X_{\mathrm{ch}},y_{\mathrm{ch}},R_{\mathrm{ch}})$ and $(X_{\mathrm{ch}+1},y_{\mathrm{ch}+1},R_{\mathrm{ch}+1})$ obtained by PRG expansion of the transmitted seeds (or read from ${\mathrm{aux}}_3$ when $P_3$ is opened); the error share $e_{\mathrm{ch}}$ obtained by applying the cross-multiplication formula to these triples; the syndrome shares $s_{\mathrm{ch}}=H{e}_{\mathrm{ch}}$ and $s_{\mathrm{ch}+1}=H{e}_{\mathrm{ch}+1}$; and the view commitments $C_{\mathrm{ch}}=\mathrm{Hash}\left({\mathrm{View}}_{\mathrm{ch}}\right)$ and $C_{\mathrm{ch}+1}=\mathrm{Hash}\left({\mathrm{View}}_{\mathrm{ch}+1}\right)$.
• (C3) Algebraically forced by the public statement: the unopened syndrome share $s_{\mathrm{ch}+2}=s-s_{\mathrm{ch}}-s_{\mathrm{ch}+1}$, derived from the public syndrome relation $s_1+s_2+s_3=s$. Furthermore, the values that do not fall into (C1)–(C3), namely the components of the unopened view ${\mathrm{View}}_{\mathrm{ch}+2}$, are cryptographically bound: the prover transmits $C_{\mathrm{ch}+2}=\mathrm{Hash}\left({\mathrm{View}}_{\mathrm{ch}+2}\right)$ as part of the response, and the first message $C=\mathrm{Hash}(s_1,s_2,s_3,C_1,C_2,C_3)$ binds the three per-party commitments together with the three syndrome shares. Under the collision-resistance of $\mathrm{Hash}$, the prover is therefore committed, before the challenge is issued, to a unique tuple (${\mathrm{View}}_1,{\mathrm{View}}_2,{\mathrm{View}}_3$) consistent with C.

Proof. 

We verify (C1)–(C3) in order. Category (C1) follows by inspection of the response defined in the protocol description (Section 3.4). For (C2), the seed expansions $(X_i,y_i,R_i)\leftarrow \mathrm{PRG}\left({\mathrm{seed}}_i\right)$ for $i\in \{1,2\}$ and $R_3\leftarrow \mathrm{PRG}\left({\mathrm{seed}}_3\right)$ are by Definition 2; when $\mathrm{ch}=3$, the shares $(X_3,y_3)$ are read directly from ${\mathrm{aux}}_3$. The error share $e_{\mathrm{ch}}$ is then obtained from the cross-multiplication formula of Definition 2 (iii), which depends only on the triples $(X_{\mathrm{ch}}, y_{\mathrm{ch}}, R_{\mathrm{ch}})$ and $(X_{\mathrm{ch}+1}, y_{\mathrm{ch}+1}, R_{\mathrm{ch}+1})$; the syndrome shares $s_{\mathrm{ch}}, s_{\mathrm{ch}+1}$ follow by multiplication with the public matrix H; and $C_{\mathrm{ch}}, C_{\mathrm{ch}+1}$ are obtained by hashing the reconstructed views. For (C3), Equation (6) and its image under H imply $s_1+s_2+s_3=H(X·y)=s$, which the verifier uses to solve for the unopened $s_{\mathrm{ch}+2}$. Finally, for the binding statement: a successful adversarial prover producing two distinct openings of the same first message C with different ${\mathrm{View}}_{\mathrm{ch}+2}$ would, by the structure of $C=\mathrm{Hash}(s_1, s_2, s_3, C_1, C_2, C_3)$ and $C_i=\mathrm{Hash}\left({\mathrm{View}}_i\right)$, yield a collision for $\mathrm{Hash}$. This proves the proposition.    □

3.4. Protocol

This section details the foundational single-round interactive protocol of our proposed scheme. This standard 3-move protocol comprises a commitment phase by the prover, a challenge phase where an online verifier supplies a uniformly random challenge $ch\in \{1, 2, 3\}$, and a subsequent response phase.

• Setup: Generate the parity-check matrix $H\in {\mathbb{F}}_{q^m}^{(n-k)\times n}$, the syndrome $s\in {\mathbb{F}}_{q^m}^{n-k}$, the rank $r\in {\mathbb{Z}}^{+}$ and the prover’s secret input $X\in {\mathbb{F}}_q^{n\times r}$, $y\in {\mathbb{F}}_{q^m}^r$.
• Commit: (1) Sample three seeds $(see{d}_1, see{d}_2, see{d}_3)$ from a true random source, and use a pseudorandom generator (PRG) to generate the blinding factors $R_i=PRG\left(see{d}_i\right)\in {\mathbb{F}}_{q^m}^n$ for each party; (2) The prover uses $see{d}_1$ and $see{d}_2$ to pseudorandomly generate the initial shares $\left(X_1,y_1\right)$, $\left(X_2,y_2\right)$ of the views using a PRG, $X_3=X-X_1-X_2$, $y_3=y-y_1-y_2$. Since the input shares of the third virtual party cannot be pseudorandomly derived from a seed, we define auxiliary data $au{x}_i=⌀$ if $i=1,2$ and $au{x}_i=\left(X_3,y_3\right)$ if $i=3$ to explicitly transmit $\left(X_3,y_3\right)$; (3) Each virtual party $P_i$ performs local computations $e_i=X_i{y}_i+X_i{y}_{i+1}+X_{i+1}{y}_i+R_i-R_{i+1}$ and determine its respective syndrome share $s_i=H·e_i$; (4). The prover defines the serialized local view of each virtual party as $Vie{w}_i=(see{d}_i,au{x}_i,e_i)$. It then computes the commitment $C_i=Hash\left(Vie{w}_i\right)$ for $i\in \{1, 2, 3\}$, and sends the round commitment $C=Hash\left(s_1, s_2, s_3, C_1, C_2, C_3\right)$ to the verifier.
• Challenge: The verifier uniformly samples a challenge value $ch\in \left\{1, 2, 3\right\}$ and sends it to the prover.
• Response: The prover sends the tuple $Rsp=(see{d}_{ch}, see{d}_{ch+1}, au{x}_{ch}, au{x}_{ch+1}, e_{ch+1}, C_{ch+2})$ to the verifier, where $au{x}_1=au{x}_2=⌀$ and $au{x}_3=\left(X_3, y_3\right)$.
• Verify: (1) The verifier locally uses the $see{d}_{ch}, see{d}_{ch+1}, au{x}_{ch}, au{x}_{ch+1}$ to compute $\left(X_{ch}, y_{ch}\right), \left(X_{ch+1}, y_{ch+1}\right), R_{ch}, R_{ch+1}$, and then re-executes the mixed-field cross-multiplication circuit to compute $e_{ch}$ and read $e_{ch+1}$ from the response. It then reconstructs the views $Vie{w}_{ch}=(see{d}_{ch}, au{x}_{ch}, e_{ch})$ and $Vie{w}_{ch+1}=(see{d}_{ch+1}, au{x}_{ch+1}, e_{ch+1})$; (2) Calculates the syndrome share $H{e}_{ch}=s_{ch}$ and $H{e}_{ch+1}=s_{ch+1}$; (3) The verifier derives the missing syndrome share utilizing the public syndrome $s_{ch+2}=s-s_{ch}-s_{ch+1}$; (4) Re-computes the commitments $C_{ch}$ and $C_{ch+1}$ using the reconstructed views and read $C_{ch+2}$ from the response; (5) The verifier accepts the proof if the re-computed commitment $C^{\prime }=Hash(s_1^{\prime }, s_2^{\prime }, s_3^{\prime }, C_1^{\prime }, C_2^{\prime }, C_3^{\prime })$ matches the C received in Step Commit, and execution steps are logically consistent; otherwise, the verifier rejects the proof.

4. Security Discussion of the Single-Round Protocol

To formalize the security goals of the proposed protocol, we follow the formulation style adopted in the $\mathrm{\Sigma }$-protocol. These definitions capture three main security objectives of the protocol. Firstly, a valid proof generated by an honest prover should always be accepted by an honest verifier. Secondly, that any prover convincing the verifier must possess a valid witness for the public statement. And thirdly, that the interaction should not leak additional information about that witness to an honest verifier. This viewpoint is particularly suitable for our protocol, since the underlying interaction has the standard three-move structure of commitment, challenge, and response, and its proof-of-knowledge property is established through witness extraction from accepting transcripts under distinct challenges.

Definition 3

($\mathrm{\Sigma }$-protocol). A Σ-protocol is a three-move protocol between a prover $\mathcal{P}$ and a verifier $\mathcal{V}$, where the prover sends a commitment, the verifier responds with a random challenge, and the prover replies with a response. A Σ-protocol satisfies completeness, special soundness, and special honest-verifier zero-knowledge properties:

(1) 

three-move:

• Commit: $\mathcal{P}$ sends a first message a to $\mathcal{V}$;
• Challenge: $\mathcal{V}$ sends a random challenge h to $\mathcal{P}$;
• Response: $\mathcal{P}$ replies a response z to $\mathcal{V}$.

(2) 

Completeness: If both players $\mathcal{P}$ and $\mathcal{V}$ are honest and $x\in L$, then $Pr\left[\right(\mathcal{P},\mathcal{V}\left)\right(x)=accept]=1$;

(3) 

s-Special Soundness: For any x and any set of s accepting conversations ${\left\{(a,h_i,z_i)\right\}}_{i\in \left[s\right]}$ with $h_i\ne h_j$ if $i\ne j$, a witness w for x can be efficiently computed;

(4) 

Special Honest-Verifier Zero-Knowledge: There exists a PPT simulator $\mathcal{S}$ such that on input $x\in L$ and h outputs a triple $(a^{\prime },h,z^{\prime })$ with the same probability distribution as real conversations $(a, h, z)$ of the protocol.

Based on the Definition 3, we now analyze the security of the proposed protocol in the standard $\mathrm{\Sigma }$-protocol [2] setting. In particular, we show that the single-round interactive protocol satisfies completeness, proof of knowledge through special soundness, and honest-verifier zero-knowledge. These properties together establish that the protocol is a valid zero-knowledge proof of knowledge for the target RSD relation, and they also provide the basis for the security discussion of the non-interactive variant obtained later via the Fiat–Shamir transform.

The proposed single-round interactive protocol of Section 3.4 is a $\mathrm{\Sigma }$-protocol that satisfies completeness, 3-special soundness, and special honest-verifier zero-knowledge (SHVZK) under the standard MPC-in-the-Head framework [2,13,17] according to Theorems 1–3.

Theorem 1

(Completeness). If the prover is honest and holds a valid secret witness $(X,y)$ that satisfies $He=H(X·y)=s$ and the rank constraint, then an honest verifier will accept the proof with probability 1.

Proof. 

During the protocol interaction, an honest prover strictly follows the rules to generate the views of the three virtual parties. According to the mixed-field cross-secret sharing algorithm proposed in Section 3.2, the error vector share computed locally by each party is $e_i=X_i{y}_i+X_i{y}_{i+1}+X_{i+1}{y}_i+R_i-R_{i+1}$. Section 3.2 has shown that this local cross-multiplication satisfies linear additive property, meaning ${\sum }_{i=1}^3{e}_i=X·y=e$. Since matrix multiplication is a linear operation, the sum of the syndrome shares computed by the parties satisfies

$$s_1+s_2+s_3=H{e}_1+H{e}_2+H{e}_3=H(e_1+e_2+e_3)=He=s.$$

In the challenge phase, regardless of which challenge value $ch\in \{1,2,3\}$ the verifier selects, the missing share $s_{ch+2}$ calculated using the two reconstructed views will always match the original data contained in the hash commitment $C_{ch+2}$ from the first step. Therefore, the proof generated by an honest prover always passes the verifier’s hash consistency check.    □

Theorem 2

(3-Special Soundness). The proposed single-round protocol satisfies 3-special soundness. More precisely, given three accepting transcripts

$$(C,c{h}_1,{\mathsf{resp}}_1),(C,c{h}_2,{\mathsf{resp}}_2),(C,c{h}_3,{\mathsf{resp}}_3)$$

with the same initial commitment C and three pairwise distinct challenges $c{h}_1,c{h}_2,c{h}_3\in \{1,2,3\}$, there exists a polynomial-time extractor $\mathcal{E}$ that outputs a valid witness $(X,y)$ such that

$$H(X·y)=s.$$

Consequently, the soundness error of one round is at most $2/3$.

Proof. 

We give the extractor algorithm $\mathcal{E}$ explicitly, then argue its correctness in three steps. Throughout the proof, indices $i\in \{1,2,3\}$ are read modulo 3, and we refer to Definition 2 and Proposition 1 of Section 3.3 for the structure of the local view ${\mathrm{View}}_i=({\mathrm{seed}}_i, {\mathrm{aux}}_i, e_i)$ and the form of the response ${\mathrm{resp}}_j$.

Step 1 (Extractor algorithm). On input three accepting transcripts $(C, {\mathrm{ch}}_j, {\mathrm{resp}}_j)$ with ${\mathrm{ch}}_j\in \{1, 2, 3\}$ pairwise distinct, $\mathcal{E}$ proceeds as follows. First, $\mathcal{E}$ collects the seeds of every party from the openings. Across the three challenges, each party $P_i$ is opened by exactly two of the three transcripts (namely those with challenges $\mathrm{ch}=i$ and $\mathrm{ch}=i-1$). Therefore, $\mathcal{E}$ reads ${\mathrm{seed}}_1$ from the transcripts with $\mathrm{ch}\in \{1,3\}$, ${\mathrm{seed}}_2$ from those with $\mathrm{ch}\in \{1,2\}$, and ${\mathrm{seed}}_3$ from those with $\mathrm{ch}\in \{2,3\}$. Similarly, ${\mathrm{aux}}_3=(X_3,y_3)$ is read from any transcript that opens $P_3$, of which at least two exist. If the two copies of any of these values disagree, $\mathcal{E}$ outputs ⊥. Second, $\mathcal{E}$ uses the pseudorandom generator PRG to expand the seeds: by Definition 2 (i), ${\mathrm{seed}}_1$ and ${\mathrm{seed}}_2$ expand to $(X_1,y_1,R_1)$ and $(X_2,y_2,R_2)$, respectively, while ${\mathrm{seed}}_3$ expands to $R_3$, and the pair $(X_3,y_3)$ is taken from ${\mathrm{aux}}_3$. Third, $\mathcal{E}$ outputs the candidate witness

$$X=X_1+X_2+X_3\in {\mathbb{F}}_q^{n\times r},y=y_1+y_2+y_3\in {\mathbb{F}}_{q^m}^r.$$

The procedure performs three PRG expansions and a constant number of finite-field additions and subtractions on vectors and matrices of total size $O(nr+rm+nm)$ bits, and therefore runs in time linear in the size of the input transcripts.

Step 2 (Consistency of seeds across transcripts). We claim that the only way $\mathcal{E}$ can output ⊥ in Step 1 is by exhibiting a hash collision. Suppose two transcripts both open party $P_i$ but the corresponding seeds (or, more generally, the corresponding views) disagree: ${\mathrm{View}}_i\ne {\mathrm{View}}_i^{\prime }$. By the acceptance condition of each transcript and the protocol description, both openings must satisfy $C_i=\mathrm{Hash}\left({\mathrm{View}}_i\right)$ and $C_i=\mathrm{Hash}\left({\mathrm{View}}_i^{\prime }\right)$, where $C_i$ is the per-party commitment determined by the common first message C (cf. Proposition 1). Hence $\mathrm{Hash}\left({\mathrm{View}}_i\right)=\mathrm{Hash}\left({\mathrm{View}}_i^{\prime }\right)$ with ${\mathrm{View}}_i\ne {\mathrm{View}}_i^{\prime }$, which is a hash collision. The probability that this event occurs is therefore bounded by the collision-finding advantage ${\mathrm{Adv}}_{\mathrm{Hash}}^{\mathrm{coll}}\left(\mathcal{B}\right)$ of a polynomial-time adversary $\mathcal{B}$ constructed from $\mathcal{E}$ and the cheating prover. In the remainder of the proof we assume that the seeds (and hence the views) are consistent across all three transcripts.

Step 3 (Witness satisfies the syndrome equation). Since each transcript is accepting, the verifier’s local consistency check of Section 3.4 succeeds: for each opened party $P_i$, the reconstructed share $e_i$ obeys the cross-multiplication formula

$$\begin{array}{c}\hfill e_i=X_i{y}_i+X_i{y}_{i+1}+X_{i+1}{y}_i+R_i-R_{i+1},i=1,2,3,\end{array}$$

(7)

and the syndrome shares satisfy $s_i=H{e}_i$ and $s_1+s_2+s_3=s$. Because seeds are consistent across transcripts (Step 2), the three instances of (7) hold simultaneously for $i=1,2,3$. Summing (7) over $i=1,2,3$, each blinding factor $R_i$ appears in exactly two of the three equations and therefore cancels, and the cross-terms collectively span all off-diagonal products $X_i{y}_j$ with $i\ne j$. Combined with the diagonal terms, the right-hand side reduces to

$${\displaystyle \sum _{i=1}^3}{\displaystyle \sum _{j=1}^3}{X}_i{y}_j=\left({\displaystyle \sum _{i=1}^3}{X}_i\right)·\left({\displaystyle \sum _{j=1}^3}{y}_j\right)=X·y.$$

Therefore $e_1+e_2+e_3=X·y$. Multiplying by the public matrix H on the left and using $s_i=H{e}_i$ together with $s_1+s_2+s_3=s$, we obtain

$$H(X·y)=H{e}_1+H{e}_2+H{e}_3=s_1+s_2+s_3=s.$$

Step 4 (Witness satisfies the rank constraint). By construction, $X=X_1+X_2+X_3\in {\mathbb{F}}_q^{n\times r}$ is a matrix with r columns and entries in the base field ${\mathbb{F}}_q$, and $y\in {\mathbb{F}}_{q^m}^r$ is a vector of length r. The hypothesis of Lemma 1 is therefore satisfied with these dimensions, and Lemma 1 implies

$${\mathrm{rank}}_{{\mathbb{F}}_q}(X·y)\le r.$$

Combining Steps 3 and 4, the pair $(X,y)$ output by $\mathcal{E}$ is a valid RSD witness, except with probability bounded by the collision-finding advantage against $\mathrm{Hash}$.

Soundness error. Finally, fix any first message C produced by an adversarial prover. If a valid witness $(X,y)$ does not exist for the statement $(H,s)$, then by the contrapositive of Steps 1–4 the prover cannot produce accepting responses for all three challenges; otherwise, $\mathcal{E}$ would extract a valid witness from those three responses, contradicting the assumption. Hence for any fixed C, at most two of the three possible challenges admit an accepting response. Since the verifier chooses $ch$ uniformly from $\{1,2,3\}$, the cheating probability in one round is at most $2/3$. This proves the 3-special soundness of the protocol.    □

Theorem 3

(Special Honest-Verifier Zero-Knowledge, SHVZK). The proposed scheme satisfies computational SHVZK. That is, there exists a polynomial-time simulator $\mathcal{S}$ that, given the public statement $(H,s)$ and a challenge $ch\in \{1,2,3\}$, outputs an accepting transcript computationally indistinguishable from a real interaction without knowing the witness.

Proof. 

We give the simulator algorithm $\mathcal{S}$ explicitly for the case $\mathrm{ch}=1$, then prove computational indistinguishability between the simulated and real transcript distributions via a sequence of three hybrids. The cases $ch=2$ and $ch=3$ require an additional treatment of the auxiliary value of $P_3$, and are discussed at the end of the proof. We refer to Definition 2 and Proposition 1 of Section 3.3 for the structure of the local view and the response.

Step 1 (Simulator algorithm for $\mathrm{ch}=1$). Given the public statement $(H,s)$, the simulator $\mathcal{S}$ proceeds as follows. First, $\mathcal{S}$ samples two fresh seeds ${\mathrm{seed}}_1, {\mathrm{seed}}_2\in {\{0,1\}}^{\lambda }$ uniformly and expands them via the pseudorandom generator $\mathrm{PRG}$, exactly as the real prover would, to obtain $(X_1, y_1, R_1)$ and $(X_2, y_2, R_2)$. Second, $\mathcal{S}$ samples a uniformly random error share $e_2\in {\mathbb{F}}_{q^m}^n$. This vector replaces the unopened share $e_2$ that the verifier reads from the response; sampling it uniformly is the key step that allows simulation without the witness. Third, $\mathcal{S}$ computes the share $e_1$ honestly using the cross-multiplication formula and the values sampled in the first step:

$$e_1=X_1{y}_1+X_1{y}_2+X_2{y}_1+R_1-R_2.$$

Note that $e_1$ is determined entirely by the seeds and does not involve party $P_3$ or the witness. Fourth, $\mathcal{S}$ sets the three syndrome shares: $s_1=H{e}_1$ and $s_2=H{e}_2$ are computed by direct multiplication with the public matrix H, and the third share is completed via the public syndrome relation

$$s_3=s-s_1-s_2.$$

Fifth, $\mathcal{S}$ constructs the per-party commitments. For the two opened parties it computes

$$C_1=\mathrm{Hash}\left({\mathrm{View}}_1\right)=\mathrm{Hash}({\mathrm{seed}}_1,\varnothing ,e_1),C_2=\mathrm{Hash}({\mathrm{seed}}_2,\varnothing ,e_2).$$

For the unopened party $P_3$, $\mathcal{S}$ does not attempt to construct a view; instead, it samples a uniformly random commitment $C_3\in {\{0,1\}}^{2\lambda }$ as a placeholder. Sixth, $\mathcal{S}$ assembles the first message $C=\mathrm{Hash}(s_1, s_2, s_3, C_1, C_2, C_3)$ and outputs the transcript

$$(C,{\mathrm{ch}}^{★}=1,({\mathrm{seed}}_1,{\mathrm{seed}}_2,\varnothing ,\varnothing ,e_2,C_3)).$$

By construction, the verifier’s consistency check accepts the simulated transcript: $e_1$ is recomputed from the seeds by exactly the same formula used in the real protocol, $s_1, s_2$ match $H{e}_1, H{e}_2$, respectively, and $s_3$ satisfies $s_1+s_2+s_3=s$. The simulator runs in time linear in the transcript size.

Step 2 (Hybrid argument). We now show that the distribution of the simulated transcript is computationally indistinguishable from the real transcript distribution. Define the following hybrids, all conditioned on $\mathrm{ch}=1$. Hybrid ${\mathrm{H}}_0$ is the real transcript distribution: an honest prover holds a valid witness $(X,y)$, samples all three seeds, ${\mathrm{seed}}_1, {\mathrm{seed}}_2, {\mathrm{seed}}_3$, uniformly, derives all local randomness via PRG $\mathrm{PRG}$, computes the views and commitments honestly, and answers challenge $\mathrm{ch}=1$. Hybrid ${\mathrm{H}}_1$ is identical to ${\mathrm{H}}_0$, except that after ${\mathrm{seed}}_3$ is used to derive $R_3$ via PRG $\mathrm{PRG}$, the value $R_3$ is replaced by a uniformly random vector ${\tilde{R}}_3\in {\mathbb{F}}_{q^m}^n$ in all downstream computations. Hybrid ${\mathrm{H}}_2$ is identical to ${\mathrm{H}}_1$, except that the unopened commitment $C_3=\mathrm{Hash}\left({\mathrm{View}}_3\right)$ is replaced by a uniformly random string ${\tilde{C}}_3\in {\{0,1\}}^{2\lambda }$. Hybrid ${\mathrm{H}}_3$ is identical to ${\mathrm{H}}_2$, except that the unopened share $e_2$ is replaced by a uniformly random vector ${\tilde{e}}_2\in {\mathbb{F}}_{q^m}^n$, and $s_3$ is recomputed as $s-s_1-H{\tilde{e}}_2$.

The output of $\mathcal{S}$ matches the distribution ${\mathrm{H}}_3$ after identification of the simulator’s freshly sampled values ${\tilde{R}}_3$, ${\tilde{C}}_3$, and ${\tilde{e}}_2$ with the corresponding placeholders. We argue indistinguishability of each consecutive pair of hybrids.

${\mathrm{H}}_0{\approx }_c{\mathrm{H}}_1$ (PRG security).* In the real transcript, the seed ${\mathrm{seed}}_3$ is not transmitted to the verifier (since $\mathrm{ch}=1$ opens parties $P_1$ and $P_2$ but not $P_3$). The only places where ${\mathrm{seed}}_3$ influences the transcript are (i) the blinding factor $R_3=\mathrm{PRG}({\mathrm{seed}}_3,"\mathtt{R}")$, which appears inside the unopened view ${\mathrm{View}}_3$, and (ii) the components of ${\mathrm{View}}_3$ hashed into the commitment $C_3$. A distinguisher between ${\mathrm{H}}_0$ and ${\mathrm{H}}_1$ therefore yields a distinguisher against $\mathrm{PRG}$.

${\mathrm{H}}_1{\approx }_c{\mathrm{H}}_2$ (commitment hiding).* In ${\mathrm{H}}_1$, the unopened commitment is $C_3=\mathrm{Hash}\left({\mathrm{View}}_3\right)$, where the contribution from ${\mathrm{seed}}_3$ is only through the blinding factor $R_3$. In ${\mathrm{H}}_2$, this commitment is replaced by a uniformly random string ${\tilde{C}}_3$. A distinguisher between ${\mathrm{H}}_1$ and ${\mathrm{H}}_2$ therefore yields a distinguisher against the commitment scheme.

${\mathrm{H}}_2\equiv {\mathrm{H}}_3$(statistical, perfect).* We claim that the two distributions are identical. In ${\mathrm{H}}_2$, the share $e_2$ is computed honestly by

$$e_2=X_2{y}_2+X_2{y}_3+X_3{y}_2+R_2-{\tilde{R}}_3,$$

where ${\tilde{R}}_3$ is a uniformly random vector in ${\mathbb{F}}_{q^m}^n$ independent of all other quantities appearing in the transcript (the value ${\tilde{R}}_3$ enters the transcript only through this expression and through $C_3$, which has already been replaced by a uniformly random string in ${\mathrm{H}}_2$). The computation of any vector with an independent uniform vector is uniform; therefore $e_2$ in ${\mathrm{H}}_2$ is uniformly distributed in ${\mathbb{F}}_{q^m}^n$, which is exactly the distribution of ${\tilde{e}}_2$ in ${\mathrm{H}}_3$. Moreover, in both hybrids the syndrome share $s_3$ is determined by the relation $s_3=s-s_1-s_2$. Hence ${\mathrm{H}}_2$ and ${\mathrm{H}}_3$ are statistically identical.

Composing the three steps,

$${\mathrm{H}}_0{\approx }_c{\mathrm{H}}_1{\approx }_c{\mathrm{H}}_2\equiv {\mathrm{H}}_3=\mathcal{S}(H,s,{\mathrm{ch}}^{★}=1),$$

and the advantage of any polynomial-time distinguisher against $\mathcal{S}$ is bounded by

$${\mathrm{Adv}}_{\mathrm{PRG}}^{\mathrm{prg}}\left({\mathcal{A}}_1\right)+{\mathrm{Adv}}_{\mathrm{Com}}^{\mathrm{hide}}\left({\mathcal{A}}_2\right),$$

which is negligible in the security parameter $\lambda$.

The cases $ch=2$ and $ch=3$ are handled in the same manner, with one additional point caused by the auxiliary value of $P_3$. When $P_3$ is opened, namely for $ch=2$ or $ch=3$, the simulator explicitly samples $au{x}_3=(X_3,y_3)$ uniformly from $F_q^{n\times r}\times F_{q^m}^r$. This has the same distribution as in a real execution: although $X_3=X-X_1-X_2$ and $y_3=y-y_1-y_2$ depend on the witness, at least one of the two shares used to define them remains unopened and is uniformly distributed. Hence the resulting $X_3$ and $y_3$ are also uniformly distributed from the verifier’s point of view. More concretely, for $ch=2$, the simulator opens $P_2$ and $P_3$, samples $au{x}_3$ uniformly, computes the share of $P_2$ honestly from the opened data, samples the response share of $P_3$ uniformly, and derives the remaining syndrome share from s. For $ch=3$, it opens $P_3$ and $P_1$ and proceeds analogously. In both cases, the unopened party commitment is replaced by a random string, and the same hybrid argument as in the case $ch=1$ applies. Therefore, the simulated transcripts are computationally indistinguishable from real transcripts. This proves the SHVZK property.    □

5. Non-Interactive Extension

5.1. Non-Interactive Protocol

The above protocol is interactive and therefore requires communication between the prover and the verifier. For practical use, we apply the Fiat–Shamir heuristic to obtain a non-interactive zero-knowledge proof. The verifier’s challenge is replaced with a hash value derived from the public input and all commitments. The following Algorithms 1 and 2 describe the corresponding proof generation and verification procedures.

Algorithm 1: Non-interactive Proof Generation (Prove)

Input: Public parameters ($H\in {\mathbb{F}}_{q^m}^{(n-k)\times n}$, $s\in {\mathbb{F}}_{q^m}^{n-k}$, $r\in {\mathbb{Z}}^{+}$); Secret input $X\in {\mathbb{F}}_q^{n\times r}$, $y\in {\mathbb{F}}_{q^m}^{r\times 1}$. Output: Zero-knowledge proof $\Pi$.

5.2. Security Discussion

The non-interactive protocol is obtained from the interactive protocol by applying the Fiat–Shamir transform. In Algorithms 1 and 2, the value included in the proof is the Fiat–Shamir digest $CH$, while the actual challenge vector is deterministically derived from $CH$ by a KDF. Therefore, in the security proof we model the hash function used to compute $CH$ as a domain-separated random oracle

$$H_{\mathrm{FS}}:{\{0,1\}}^{*}\to {\{0,1\}}^{2\lambda }.$$

For a vector of round commitments $(C^{\left(1\right)},\dots ,C^{\left(\kappa \right)})$, the Fiat–Shamir digest is

$$CH=H_{\mathrm{FS}}(H,s,C^{\left(1\right)},\dots ,C^{\left(\kappa \right)}),$$

and the challenge vector is obtained as

$$\mathbf{ch}=(c{h}^{\left(1\right)},\dots ,c{h}^{\left(\kappa \right)})\leftarrow \mathrm{KDF}\left(CH\right),c{h}^{\left(j\right)}\in \{1,2,3\}.$$

Thus, $CH$, rather than $\mathbf{ch}$, is stored in the non-interactive proof. We assume that the KDF, instantiated for example with rejection sampling, maps a uniformly random digest $CH$ to a uniformly distributed challenge vector in ${\{1,2,3\}}^{\kappa }$. The analysis below is carried out in the classical Random Oracle Model (ROM).

Algorithm 2: Non-interactive Proof Verification (Verify)

Input: Public parameters ($H\in {\mathbb{F}}_{q^m}^{(n-k)\times n}$, $s\in {\mathbb{F}}_{q^m}^{n-k}$); Non-interactive proof $\mathrm{\Pi }=(CH,{\left\{Rs{p}^{\left(j\right)}\right\}}_{j=1}^{\kappa })$. Output: Accept or Reject.

We first recall the security properties established for the underlying interactive protocol. By Theorems 1–3, one execution of the interactive protocol is complete, 3-special sound, and computational special honest-verifier zero-knowledge. The non-interactive protocol consists of $\kappa$ independent repetitions of this base protocol. The verifier’s challenge vector is derived in two steps: first the Fiat–Shamir digest $CH$ is computed by $H_{\mathrm{FS}}$, and then $CH$ is expanded by the KDF into $\mathbf{ch}\in {\{1,2,3\}}^{\kappa }$.

Theorem 4

(Security of the Fiat–Shamir Transform in the ROM). Assume that the underlying single-round protocol satisfies completeness, 3-special soundness, and computational special honest-verifier zero-knowledge. Assume further that the hash-based view commitment is binding and that the PRG is secure. Let

$$H_{\mathrm{FS}}:{\{0,1\}}^{*}\to {\{0,1\}}^{2\lambda }$$

be modeled as a classical random oracle. We assume that, when $CH$ is uniformly distributed in ${\{0,1\}}^{2\lambda }$, the procedure $\mathrm{KDF}\left(CH\right)$ outputs a uniformly distributed challenge vector in ${\{1, 2, 3\}}^{\kappa }$, for example by using rejection sampling. Then the Fiat–Shamir transformed protocol is complete. Moreover, for any classical adversary making at most $Q_H$ queries to $H_{\mathrm{FS}}$, the soundness error is bounded by

$$Q_H{\left({\displaystyle \frac{2}{3}}\right)}^{\kappa }+2^{-2\lambda }+{\mathrm{Adv}}_{\mathrm{Hash}}^{\mathrm{coll}},$$

where ${\mathrm{Adv}}_{\mathrm{Hash}}^{\mathrm{coll}}$ denotes the probability of breaking the binding property of the hash-based commitments. In particular, for polynomially bounded $Q_H$, the soundness error is negligible whenever κ is chosen such that

$$Q_H{\left({\displaystyle \frac{2}{3}}\right)}^{\kappa }$$

is negligible. The protocol is also computational zero-knowledge in the programmable classical ROM.

Proof. 

We prove completeness, soundness, proof of knowledge, and zero-knowledge in turn.

Completeness.

Assume that the prover holds a valid witness $(X,y)$ such that

$$H(X·y)=s$$

and ${rank}_{{\mathbb{F}}_q}(X·y)\le r$. In each repetition j, the prover generates the local views, syndrome shares, and round commitment $C^{\left(j\right)}$ exactly as in the interactive protocol. The prover first computes the Fiat–Shamir digest

$$CH=H_{\mathrm{FS}}\left(H,s,C^{\left(1\right)},\dots ,C^{\left(\kappa \right)}\right),$$

and then derives the challenge vector

$$\mathbf{ch}=(c{h}^{\left(1\right)},\dots ,c{h}^{\left(\kappa \right)})\leftarrow \mathrm{KDF}\left(CH\right).$$

This challenge vector determines which two adjacent views are opened in every repetition. For each round, the verification procedure is identical to the verification step of the underlying interactive protocol with challenge $c{h}^{\left(j\right)}$. By the completeness of the interactive protocol, every round accepts. Therefore, the non-interactive verifier accepts with probability 1.

Soundness. Fix a public statement $(H, s, r)$ for which no valid witness exists. Consider any fixed vector of round commitments

$$\mathbf{C}=(C^{\left(1\right)},\dots ,C^{\left(\kappa \right)}).$$

For this fixed $\mathbf{C}$, define the accepting challenge set

$${\mathcal{A}}_{\mathbf{C}}=\left\{\mathbf{ch}\in {\{1,2,3\}}^{\kappa }:\mathrm{there}\mathrm{exists}\mathrm{an}\mathrm{accepting}\mathrm{response}\mathrm{to}\mathbf{C}\mathrm{under}\mathrm{challenge}\mathbf{ch}\right\}.$$

We first show that

$$|{\mathcal{A}}_{\mathbf{C}}| \le 2^{\kappa },$$

except with probability bounded by the commitment collision probability.

Suppose, toward a contradiction, that

$$|{\mathcal{A}}_{\mathbf{C}}| >2^{\kappa }.$$

Then there exists a repetition index $j^{*}\in \{1,\dots ,\kappa \}$ such that the projection of ${\mathcal{A}}_{\mathbf{C}}$ on the $j^{*}$-th coordinate contains all three possible challenges $1,2,3$. Indeed, if every coordinate used at most two challenge values, then ${\mathcal{A}}_{\mathbf{C}}$ would be contained in a product set of size at most $2^{\kappa }$, contradicting $|{\mathcal{A}}_{\mathbf{C}}| >2^{\kappa }$.

Therefore, there exist three accepting challenge vectors

$${\mathbf{ch}}_1,{\mathbf{ch}}_2,{\mathbf{ch}}_3\in {\mathcal{A}}_{\mathbf{C}}$$

whose $j^{*}$-th components are pairwise distinct:

$$c{h}_1^{\left(j^{*}\right)},c{h}_2^{\left(j^{*}\right)},c{h}_3^{\left(j^{*}\right)}\in \{1,2,3\}.$$

Since the corresponding full non-interactive proofs are accepting, the $j^{*}$-th round responses are accepting responses for the same round commitment $C^{\left(j^{*}\right)}$ and for three distinct challenges. By the 3-special soundness of the underlying interactive protocol, the extractor of Theorem 2 can be applied to these three accepting transcripts to recover a valid witness $(X,y)$ satisfying

$$H(X·y)=s\mathrm{and}{rank}_{{\mathbb{F}}_q}(X·y)\le r.$$

This contradicts the assumption that the statement has no valid witness. Hence, for any fixed commitment vector $\mathbf{C}$, at most $2^{\kappa }$ challenge vectors can be answered successfully, except in the event of a commitment collision.

Now consider the Fiat–Shamir challenge generation. Since $H_{\mathrm{FS}}$ is modeled as a random oracle, for any fixed query input

$$(H,s,C^{\left(1\right)},\dots ,C^{\left(\kappa \right)}),$$

the digest

$$CH=H_{\mathrm{FS}}\left(H,s,C^{\left(1\right)},\dots ,C^{\left(\kappa \right)}\right)$$

is uniformly distributed in ${\{0,1\}}^{2\lambda }$. By the assumed uniformity of the KDF expansion, the derived challenge vector

$$\mathbf{ch}\leftarrow \mathrm{KDF}\left(CH\right)$$

is uniformly distributed over ${\{1,2,3\}}^{\kappa }$. Therefore, for any fixed random-oracle query, the probability that the derived challenge vector belongs to ${\mathcal{A}}_{\mathbf{C}}$ is at most

$${\displaystyle \frac{|{\mathcal{A}}_{\mathbf{C}}|}{3^{\kappa }}}\le {\displaystyle \frac{2^{\kappa }}{3^{\kappa }}}={\left({\displaystyle \frac{2}{3}}\right)}^{\kappa }.$$

If an adversary makes at most $Q_H$ random-oracle queries, a union bound gives a total success probability at most

$$Q_H{\left({\displaystyle \frac{2}{3}}\right)}^{\kappa }.$$

It remains to consider the case where the adversary outputs an accepting proof without having queried $H_{\mathrm{FS}}$ on the corresponding input

$$(H,s,C^{\left(1\right)},\dots ,C^{\left(\kappa \right)}).$$

In this case, the proof contains a digest $CH$ that must equal the random-oracle value on this input, because the verifier recomputes

$$C{H}^{\prime }=H_{\mathrm{FS}}\left(H,s,C^{\prime \left(1\right)},\dots ,C^{\prime \left(\kappa \right)}\right)$$

and accepts only if $C{H}^{\prime }=CH$. Since the adversary has not queried this point, the value of the random oracle at this point is uniform and unknown to the adversary. Thus the probability of guessing it is at most

$$2^{-2\lambda }.$$

Finally, inconsistent openings of the same committed view or the same round commitment can only occur if the adversary finds a collision in the hash-based commitment structure. This adds the term ${\mathrm{Adv}}_{\mathrm{Hash}}^{\mathrm{coll}}$. Combining the above cases yields the stated soundness bound.

Proof of knowledge. The above soundness argument also yields a knowledge extractor. Let an adversarial prover produce accepting non-interactive proofs with probability non-negligibly larger than

$$Q_H{\left({\displaystyle \frac{2}{3}}\right)}^{\kappa }+2^{-2\lambda }+{\mathrm{Adv}}_{\mathrm{Hash}}^{\mathrm{coll}}.$$

The extractor runs the adversary and records its random-oracle queries. Except with probability at most $2^{-2\lambda }$, any accepting proof must correspond to a previously asked query

$$(H,s,C^{\left(1\right)},\dots ,C^{\left(\kappa \right)}).$$

The extractor rewinds the adversary to the point immediately before this query. In each rewound execution, the extractor answers the same random-oracle query with an independently sampled digest

$$C{H}^{\prime }\leftarrow {\{0,1\}}^{2\lambda },$$

and the corresponding challenge vector is then derived as

$${\mathbf{ch}}^{\prime }\leftarrow \mathrm{KDF}\left(C{H}^{\prime }\right).$$

Thus, the extractor resamples the Fiat–Shamir digest $C{H}^{\prime }$, not the challenge vector directly. Whenever a rewound execution produces an accepting proof for the same commitment vector

$$\mathbf{C}=(C^{\left(1\right)},\dots ,C^{\left(\kappa \right)}),$$

the extractor records the derived challenge vector ${\mathbf{ch}}^{\prime }$ together with the corresponding responses.

If, for some repetition $j^{*}$, the collected accepting transcripts contain all three challenge values $1,2,3$ in the $j^{*}$-th coordinate, then the extractor takes the $j^{*}$-th round components of these three accepting proofs. These components form three accepting transcripts of the underlying interactive protocol with the same first message $C^{\left(j^{*}\right)}$ and three pairwise distinct challenges. The extractor of Theorem 2 is then invoked to recover a valid witness $(X,y)$.

If no such coordinate exists, then the set of accepting challenge vectors for the fixed commitment vector has a size of at most $2^{\kappa }$, and the adversary’s success probability is bounded by the soundness bound proved above. Therefore, any adversary succeeding with probability non-negligibly larger than the stated bound can be converted into an extractor that outputs a valid RSD witness with non-negligible probability.

Zero-knowledge. We finally show computational zero-knowledge in the programmable classical ROM. Let $S_{\mathrm{\Sigma }}$ be the special honest-verifier zero-knowledge simulator for the underlying interactive protocol from Theorem 3. The simulator for the Fiat–Shamir protocol proceeds as follows.

First, it samples a uniformly random digest

$$CH\leftarrow {\{0,1\}}^{2\lambda }$$

and derives the challenge vector

$$\mathbf{ch}=(c{h}^{\left(1\right)},\dots ,c{h}^{\left(\kappa \right)})\leftarrow \mathrm{KDF}\left(CH\right).$$

For each repetition j, it invokes the interactive simulator $S_{\mathrm{\Sigma }}$ on input the public statement $(H,s,r)$ and challenge $c{h}^{\left(j\right)}$. This produces a simulated accepting transcript

$$(C^{\left(j\right)},c{h}^{\left(j\right)},Rs{p}^{\left(j\right)}),$$

whose distribution is computationally indistinguishable from that of a real accepting interactive transcript with challenge $c{h}^{\left(j\right)}$.

The simulator then programs the random oracle at the point

$$(H,s,C^{\left(1\right)},\dots ,C^{\left(\kappa \right)})$$

so that

$$H_{\mathrm{FS}}\left(H,s,C^{\left(1\right)},\dots ,C^{\left(\kappa \right)}\right)=CH.$$

It outputs the non-interactive proof

$$\mathrm{\Pi }=(CH,Rs{p}^{\left(1\right)},\dots ,Rs{p}^{\left(\kappa \right)}).$$

By construction, the verifier first derives the same challenge vector

$$\mathbf{ch}\leftarrow \mathrm{KDF}\left(CH\right),$$

then recomputes the same round commitments from the simulated responses, and finally recomputes the programmed Fiat–Shamir digest $CH$. Hence the simulated proof is accepting. The distribution of each simulated round is computationally indistinguishable from the corresponding real round by Theorem 3, and the programmed digest $CH$ is uniformly distributed exactly as in a real Fiat–Shamir proof. Therefore, the simulated non-interactive proof is computationally indistinguishable from a real proof in the classical programmable ROM. This completes the proof.    □

6. Performance Evaluation

6.1. Security Parameter

To meet the 128-bit security level required by post-quantum cryptography standards (NIST Security Level 1), the parameter selection must address two independent requirements: the hardness of the underlying RSD instance against the best known attacks, and the number of Fiat–Shamir repetitions required to amplify the per-round soundness error of the $\mathrm{\Sigma }$-protocol to the target $2^{-\lambda }$ level.

Table 2. Parameter set of the proposed scheme at NIST Security Level 1. The attack-cost evaluation for this RSD instance is given in Table 3.

Quantity	Value
Base field ${\mathbb{F}}_q$	${\mathbb{F}}_2$
Extension degree m	41
Code length n	38
Information dimension k	19
Rank weight r	7
Security parameter $\lambda$	128
Repetition count $\kappa$	219
Hash/PRG	SHA3-256/SHAKE-256
Best classical attack	MaxMinors [18]

collects all parameters of the scheme together with the underlying complexity assumptions, the attack-cost estimator used for parameter validation, and the implementation primitives, in a form intended to make the entire choice independently reproducible.

The classical attack complexity of $2^{130.7}$ bit operations cited in Table 2 is the time of the best-known attack against our RSD instance, which we summarise in

Table 3. Best known attacks against the Rank Syndrome Decoding instance $(q, m, n, k, r)=(2, 41, 38, 19, 7)$, classified by family. Time complexity is reported in ${log}_2$ of bit operations; memory in ${log}_2$ of bits. All values are obtained from the RSD Estimator of Bardet et al. [15] in its latest open-source version (2026).

Family	Attack	Time (log2)	Memory (log2)
Combinatorial	Basis Enumeration [19]	228.8	17.9
	Ourivski–Johansson (OJ1) [20]	150.3	16.3
	Ourivski–Johansson (OJ2) [20]	249.4	15.1
	GRS [21]	160.8	19.2
	Improved GRS [22]	141.8	19.0
	Guessing-Enhanced GRS [23]	141.8	19.0
	Annulator Polynomial [24]	157.9	13.6
Algebraic	MaxMinors [18]	130.7	40.5
	Support Minors [25]	145.1	53.0
Security level achieved		$2^{130.7}$	—

. The RSD Estimator of Bardet et al. [15] evaluates the cost of nine attacks across two families: combinatorial attacks, which enumerate or guess the ${\mathbb{F}}_2$-support of the error vector e, and algebraic attacks, which model the RSD relation as a system of multivariate polynomial equations and solve it via Gröbner-basis-style techniques. For the parameter set $(q, m, n, k, r)=(2, 41, 38, 19, 7)$, the algebraic MaxMinors attack of Bardet et al. [18] dominates with a time complexity of $2^{130.7}$ bit operations; all combinatorial attacks evaluated by the estimator are above $2^{141.8}$, and the next best algebraic attack (Support Minors) is at $2^{145.1}$. The parameter set therefore satisfies the $2^{128}$ NIST Level 1 target against the strongest known classical attack.

The Fiat–Shamir repetition count $\kappa$ is determined by the per-round soundness error of the $\mathrm{\Sigma }$-protocol established in Theorem 2 of Section 4. Since one round of the $(2, 3)$-secret-sharing protocol has a cheating probability of at most $2/3$, repeating the protocol $\kappa$ times independently in parallel reduces the soundness error to ${(2/3)}^{\kappa }$. Requiring this error to be at most $2^{-\lambda }$ gives

$$\kappa =⌈{\displaystyle \frac{\lambda }{{log}_2(3/2)}}⌉=219.$$

This choice corresponds to the standard ROM bound for $\lambda =128$ bit security; extending the analysis to the Quantum Random Oracle Model is identified as a direction for future work in Section 7.

6.2. Communication Overhead and Proof Size

Based on the selected parameters, we now formulate the theoretical proof size of our non-interactive scheme. The total proof size is determined by the global challenge and the aggregate responses across all $\kappa =219$ parallel rounds. According to the non-interactive protocol detailed in Section 5.1, the final proof is constructed as $\mathrm{\Pi }=(CH,{\left\{Rs{p}^{\left(j\right)}\right\}}_{j=1}^{\kappa })$. The bit-length of the global challenge $CH$ is $\left|CH\right|=2\lambda$. For each round $j\in \{1,\dots ,\kappa \}$, the response $Rs{p}^{\left(j\right)}$ varies depending on the generated challenge $c{h}^{\left(j\right)}\in \{1,2,3\}$. The components of $Rs{p}^{\left(j\right)}$ include:

• Two seeds corresponding to the opened views are revealed, contributing $2\lambda$ bits.
• The hash commitment of the unopened view $C_{c{h}^{\left(j\right)}+2}$ is provided, contributing $2\lambda$ bits.
• The error vector share $e_{c{h}^{\left(j\right)}+1}^{\left(j\right)}$ required for cross-term reconstruction is provided, contributing $n·m·{log}_{2}q$ bits.
• The third share $X_3$ and $y_3$ are algebraically computed rather than pseudo-randomly generated. Therefore, if the challenge $c{h}^{\left(j\right)}\in \{2,3\}$, the prover must explicitly transmit $(X_3,y_3)$ as auxiliary plaintext. ($\left|X_3\right|=n·r·{log}_{2}q$ bits, $\left|y_3\right|=r·m·{log}_{2}q$ bits).

Since the global challenge $CH$ is generated by a random oracle, the sequence of challenge values is uniformly distributed. The expected number of rounds requiring the auxiliary input is ${\displaystyle \frac{2}{3}}\kappa$. Therefore, the expected average proof size of our scheme is formulated as

$$|\mathrm{\Pi }|=2\lambda +\kappa ·(4\lambda +n·m·{log}_{2}q+{\displaystyle \frac{2}{3}}·r(n+m){log}_{2}q).$$

(8)

6.3. Comparison with Existing Schemes

Table 4. Comparison of representative stand-alone MPC-in-the-Head zero-knowledge proofs and a same-relation generic baseline.

Cat.	Scheme	Framework	Target	Size (KB)	Prov. (ms)	Verif. (ms)
(I)	ZKBoo [2]	MPCitH	SHA-1	441	19	11
	ZKB++ [14]	MPCitH	SHA-1	226	26	10
(II)	Generic MPCitH	ZKB++-style	RSD	≈8300	≈1200	≈600
	Ours	MPCitH	RSD	$65.7$	21	14

compares the proposed scheme with representative MPC-in-the-Head proof systems and with a generic baseline for the same RSD relation. Since the listed schemes do not all prove the same statement, the comparison should be interpreted with care. In particular, ZKBoo and ZKB++ are included as generic Boolean-circuit MPCitH reference points: their reported benchmarks are for the SHA-1 preimage relation and therefore serve only to illustrate the typical proof-size and running-time range of generic circuit-based MPCitH proofs. They are not used as a direct same-relation benchmark for the RSD relation considered in this paper.

To provide a more meaningful comparison for our target statement, we additionally include a generic MPCitH baseline for the same RSD relation. This baseline is obtained by encoding the relation

$$He=s\wedge {rank}_{{\mathbb{F}}_q}\left(e\right)\le r$$

as a Boolean circuit, where the syndrome equation is implemented by finite-field arithmetic over ${\mathbb{F}}_{q^m}$, and the rank constraint is checked by an in-circuit Gaussian elimination on the $n\times m$ base-field representation of e. We then estimate the proof size and running time by applying the standard ZKB++-style MPCitH accounting to this Boolean representation. This baseline is not intended as an optimized implementation, but as a conservative analytic reference that isolates the cost of treating the RSD relation as a generic Boolean circuit.

We use the standard ZKB++ per-round accounting of $G+4\lambda$ bits, where G is the AND-gate count of the circuit [14]. Encoding the RSD relation as a Boolean circuit gives: a syndrome check requiring $(n-k)n=722$ multiplications in ${\mathbb{F}}_{2^{41}}$ at $\approx 350$ AND gates each, i.e., $\approx 2.5\times {10}^5$ gates; and an in-circuit Gaussian-elimination rank check on the $38\times 41$ bit-matrix of $\mathbf{e}$, $\approx 5.7\times {10}^4$ gates. The total is $G\approx 3.1\times {10}^5$ AND gates per round, giving

$$|{\mathrm{\Pi }}_{\mathrm{generic}}|=2\lambda +\kappa (G+4\lambda )=256+219(310,000+512)\mathrm{bits}\approx 8300\mathrm{KB}.$$

(9)

The most meaningful same-relation comparison in Table 4 is between the generic MPCitH baseline and our proposed mixed-field construction, since both target the RSD relation. Under this comparison, the proposed scheme reduces the proof size from approximately $8.3$ MB to $65.7$ KB, giving a reduction of about two orders of magnitude. This improvement comes from preserving the native algebraic structure of the RSD witness through the mixed-field factorisation $e=X·y$, rather than materialising both the syndrome equation and the rank constraint as a Boolean circuit.

The ZKBoo and ZKB++ entries should be viewed only as framework-level reference points for generic circuit-based MPCitH proofs. Because their target relation is SHA-1 preimage rather than RSD, their proof sizes cannot be used to claim a direct relation-level advantage. They nevertheless show that the proposed construction remains in a comparable time range to classical MPCitH implementations while proving an algebraically structured rank-metric statement.

6.4. Computational Complexity and Implementation

We analyse the cost of one $\mathrm{\Sigma }$-protocol round in terms of the six primitive operations relevant to the scheme: arithmetic operations over ${\mathbb{F}}_{q^m}$ (for our parameter set ${\mathbb{F}}_{2^{41}}$), hash function calls, pseudorandom generator calls, commitment computations, the prover’s overall round cost, and the verifier’s overall round cost. Let n, k, r, m denote the RSD parameters and $\lambda$ the security parameter; the asymptotic counts are summarised below.

• Field operations. The only ${\mathbb{F}}_{2^m}$ multiplications in one round occur in the three syndrome evaluations $\mathbf{H}{\mathbf{e}}_i$, yielding $3(n-k)n$ multiplications per round; the three mixed-field matrix-vector products ${\mathbf{X}}_i{\mathbf{y}}_j$ contribute $O\left(nr\right)$ additions in ${\mathbb{F}}_{2^m}$ but no multiplications, since entries of ${\mathbf{X}}_i$ lie in ${\mathbb{F}}_2\subset {\mathbb{F}}_{2^m}$. Total per-round field cost: $\mathcal{O}\left(\right(n-k\left)n\right)$ field multiplications and $\mathcal{O}(nr+nm)$ field additions.
• Hash calls. Four calls per round: three per-party view commitments $C_i=\mathsf{Hash}\left({\mathrm{View}}_i\right)$ and one round commitment $C=\mathsf{Hash}(s_1, s_2, s_3, C_1, C_2, C_3)$. Total asymptotic cost: $\mathcal{O}\left(1\right)$ hash calls per round on inputs of size $\mathcal{O}(nm+nr+\lambda )$ bits.
• PRG calls. Three calls per round, one per virtual party, each expanding a $\lambda$-bit seed to $\mathcal{O}(nr+rm+nm)$ pseudorandom bits via domain-separated SHAKE-256.
• Commitment. The commitment scheme is realised as $\mathsf{Com}\left(v\right)=\mathsf{Hash}\left(v\right)$, so its cost is counted under hash calls; per round, three view commitments and one round commitment, totalling $\mathcal{O}\left(1\right)$ commitment operations on $\mathcal{O}(nm+nr+\lambda )$ bits of input.
• Prover (per round). $\mathcal{O}\left(\right(n-k\left)n\right)$${\mathbb{F}}_{2^m}$ multiplications, $\mathcal{O}(nm+nr)$ additions, $\mathcal{O}\left(1\right)$ PRG and hash calls.
• Verifier (per round). Approximately two thirds of the prover’s work, since only two of the three views are reconstructed.

Over all $\kappa =\lceil \lambda /{log}_2(3/2)\rceil$ Fiat–Shamir rounds, every count scales linearly in $\kappa$; the asymptotic complexity of generating a full non-interactive proof is therefore $\mathcal{O}\left(\kappa \right(n-k\left)n\right)$ field multiplications and $\mathcal{O}\left(\kappa \right)$ hash/PRG/commitment calls.

For the parameter set $(q, m, n, k, r)=(2, 41, 38, 19, 7)$ and $\kappa =219$, the concrete counts of each primitive operation are given in

Table 5. Concrete per-round and total operation counts of the proposed scheme at $(q, m, n, k, r)=(2, 41, 38, 19, 7)$, $\kappa =219$. Verifier counts are approximate (the verifier reconstructs two of the three views per round).

Operation	Per Round	Total ($\mathit{\kappa }=219$)
${\mathbb{F}}_{2^{41}}$ multiplications (prover)	$3(n-k)n=2166$	≈$4.7\times {10}^5$
${\mathbb{F}}_{2^{41}}$ multiplications (verifier)	≈$2(n-k)n=1444$	≈$3.2\times {10}^5$
${\mathbb{F}}_{2^{41}}$ additions (prover)	≈$3(nm+nr)=5472$	≈$1.2\times {10}^6$
Hash calls (SHA3-256), prover	4	877
Hash calls (SHA3-256), verifier	3	658
PRG calls (SHAKE-256), prover	3	657
PRG calls (SHAKE-256), verifier	2	438
Commitment operations (=hash calls)	4	876

.

We implemented the proposed scheme in C++17 (gcc 13.3 release build, -O3 -march=native), using SHA3-256/SHAKE-256 with domain-separated tags and the PCLMULQDQ instruction for ${\mathbb{F}}_{2^{41}}$ multiplication via the irreducible trinomial $f\left(x\right)=x^{41}+x^3+1$.

Table 6. Wall-clock benchmark of the proposed scheme at NIST Security Level 1 on an Intel Xeon processor at @ $2.80$ GHz, using a gcc 13.3 release build, single thread, averaged over 10 runs.

Quantity	Value
Proof generation (prover)	21 ms
Proof verification	14 ms
Proof size	$65.7$ KB

reports single-threaded wall-clock times for proof generation and verification on an Intel Xeon at $2.80$ GHz, averaged over 10 independent runs. The measured proof size of $65.68$ KB matches the theoretical value predicted by Equation (8). This empirically confirms the proof-size analysis of Section 6.2.

The complete source code, including independent gcc 13.3 and Python 3.14 implementations used for cross-validation, is available in the artifact accompanying this paper.

7. Conclusions

In this paper, we proposed an MPC-in-the-Head zero-knowledge proof scheme for the RSD problem. To support the mixed-field computations required by the protocol, we introduced a secret-sharing method for multiplication between the base field and the extension field. This construction enables the MPC-in-the-Head framework to be applied to the RSD setting in a natural and structured way, and provides a concrete method for handling cross-field operations within the proof system.

We further analyzed the security and efficiency of the proposed scheme. The results show that the scheme satisfies completeness, soundness, and zero-knowledge, while achieving a smaller proof size than more generic constructions. These properties indicate that the proposed construction is a feasible and meaningful approach for building rank-metric-based zero-knowledge proofs.

In contrast to prior work focusing primarily on obtaining the shortest possible Fiat–Shamir signature, we study how to construct a zero-knowledge proof directly for the RSD problem under the rank metric and how to support the mixed-field computations that naturally arise in this setting. From this perspective, the proposed scheme provides a problem-oriented design with clear algebraic structure and a dedicated treatment of base-field/extension-field interaction. This work enriches the study of zero-knowledge proofs under rank-metric assumptions and suggests that mixed-field secret-sharing techniques may be useful beyond the specific protocol considered here. In particular, the method developed in this paper may be of independent interest for other cryptographic constructions involving interactions between the base field and the extension field. One natural direction for future research is to further optimize the protocol so as to reduce proof size, communication cost, and prover complexity. We emphasize that the security proof of the Fiat–Shamir non-interactive variant is given only in the classical ROM. Therefore, while the underlying RSD assumption and the interactive protocol are motivated by post-quantum cryptography, the present non-interactive construction should not be interpreted as fully QROM-secure. A second direction is to establish security in the QROM, for instance via the generic Fiat–Shamir-in-QROM frameworks of Don, Fehr, Majenz, and Schaffner [26] or Liu and Zhandry [27], or via the more recent online-extractable Fiat–Shamir compilers, which would extend the post-quantum security claim of the proposed scheme to quantum adversaries with superposition access to the random oracle.