Hi! Regarding issue #342.

The conjecture 8.4 in this paper seems to refer to the security guarantees of applying theorems 1.2, 1.4 and 1.6 with some margin defined by parameter η > 0. But the error referred in the conjecture doesn't seem to be applicable to FRI for estimating the number of queries as stated in the issue description

Still, I have found something insightful that might be worth to consider, the paper states that you can calculate the number of queries like:

s = 2λ / log(1/ρ)

when

q >> n^2

(which seems to be the case in most configurations)

See teorem 8.3 discussion (https://eprint.iacr.org/2020/654.pdf)

Which brings a reduction of around 33% in the number of queries! So I went ahead and implemented the fri_conjecture flag (this name maybe doesn't make sense anymore though)

I have created a couple of tests to verify that this implementation has reasonable results, and seems to be the case :)

• test_calculate_n_test_queries_fri_conjecture: this test is essentially the same as the existing one but applying the formula

  • security_bits: 96
  • log_dimension: 28
  • log_inv_rate: 1 & 2
  • Previous result: 232 & 143 queries
  • Result after applying formula: 193 & 97 queries 🔥

• test_n_test_queries_fri_conjecture_66_security_bits: this one is based on this paper, I wanted to replicate the cases they have tested to compare against this:

  • security_bits: 66
  • log_dimension: 12
  • log_inv_rate 5 -> ρ = 2^(-5)
  • Paper results: 49, 37 & 30 queries - with Jhonson proximities - m=6,4,3 respectively
  • Result after applying formula: 27 - still below proximity m=3!

• test_n_test_queries_fri_conjecture_128_security_bits: also based on this paper:

  • security_bits: 128
  • log_dimension: 12
  • log_inv_rate 5 -> ρ = 2^(-5)
  • Paper results: 92, 70 & 57 queries - with Jhonson proximities - m=8,5,3 respectively
  • Result after applying formula: 52 - still below proximity m=3!

Note: q >> n^2 is an ambiguous criteria to implement. So I defined FRI_CONJECTURE_SAFETY_FACTOR = 10 constant, which gives you the factor of difference between the field size q and the blocklength n, I arbitrarily defined q >= 10*q^2 as the limit of applicability (up to discussion)

I haven't implemented the Params struct putting all the parameters together just to make it easier to review, though the only critical file to review is crates/core/src/protocols/fri/common.rs.

I might be wrong in some of the points I have made here, I studied the paper for a few days but still some parts are tricky to understand to me, anyways I'm open to discussion if you need any clarification :)