Paper 2025/1912 Original: eprint.iacr.org/2025/1912 ↗

Quasar: Sublinear Multi-Cast Commitment Mixing in Recursive Accumulation

Abstract

Sitting at the core of folding-based recursion, multi-instance accumulation still forces the recursive verifier to combine $\ell$ committed objects, incurring $\Theta(\ell)$ circuit-expensive commitment random linear combinations (CRCs). Here $\ell$ denotes the number of instances accumulated per step, and a CRC is an in-circuit random linear combination of commitments. Eliminating the linear-in-$\ell$ CRC overhead is the central challenge, and we address it with Quasar, reducing in-circuit CRCs from $\Theta(\ell)$ to $O(1)$ per step, while the unavoidable cost of reading and processing public inputs remains linear as usual. Realizing constant-commitment accumulation, Quasar's multi-cast reduction commits to a union polynomial and verifies a random partial evaluation, yielding a reduced instance with $O(1)$ commitments. Moreover, composing multi-cast with a standard $2$-to-$1$ folding reduction yields a multi-instance accumulation scheme whose verifier uses $O(\log \ell)$ field work and $O(1)$ CRCs per step. Across instantiations with suitable polynomial commitments, our instantiation supports linear-time accumulation provers, plausible post-quantum security, and parallelizable proving at each step. Not only does Quasar keep CRCs constant in $\ell$, it also yields a multi-instance incrementally verifiable computation with lower recursion overhead.