Paper 2026/1489 Original: eprint.iacr.org/2026/1489 ↗

SwitchFold: Code-Agnostic Succinct Polynomial Commitments via Recursive Code Switching

Abstract

We study hash-based polynomial commitment schemes (PCSs) over large prime fields that scale to witnesses containing billions of scalars. Such PCSs are important for emerging data-science-related applications of zero-knowledge succinct non-interactive arguments of knowledge (zkSNARKs). Our goal is to reduce prover time while preserving polylogarithmic proof size and verifier time. To this end, we seek code agnostic, succinct PCS constructions that can be instantiated with any linear code over any target field, allowing the most efficient code for the chosen field to be selected. Our SwitchFold construction achieves polylogarithmic verification by recursively applying the code-switching technique between codes of decreasing block lengths. Prior code-switching PCSs switch from an unstructured code to a foldable code; in contrast, SwitchFold requires no code foldability and thus decouples PCS design from code design. For a polynomial of size N and security parameter λ, instantiating SwitchFold with linear-time encodable codes yields O(N) prover time and O(λ log^2 N) proof size and verifier time. We instantiate SwitchFold with the Brakedown codes (Golovnev et al., CRYPTO ’23) and the recently proposed quasi-Abelian (QA) codes (Li et al., IACR ePrint ’26), yielding BrakeFold and QAFold, respectively. At N = 2^30, QAFold achieves the fastest prover time among all evaluated PCSs with succinct verification. Compared with TensorSwitch (Bünz et al., IACR ePrint ’25), the other code-agnostic PCS, QAFold reduces total and marginal prover time by factors of 2.2× and 2.7× under the same QA-code instantiation. With Brakedown codes, BrakeFold reduces the marginal prover time per additional opening by a factor of 2.9× relative to TensorSwitch.