P3Q-SHA3 Hash Family Binding
SHA-3 / cSHAKE256 binding for the P3Q STARK substrate — defines hash-to-field, domain separation, Merkle commitment, and Fiat-Shamir transcript.
Abstract
P3Q-SHA3 binds the P3Q STARK substrate (LP-4800) to the NIST SP 800-185 cSHAKE256 hash family, replacing Plonky3's Poseidon-MDS upstream commitment hash with a pure SHA-3 construction. This LP defines (a) the hash-to-field primitive over the P3Q Goldilocks field, (b) the domain-separation tags for each P3Q transcript context (Merkle commitment, trace-quotient, FRI folding, Fiat-Shamir challenge), (c) the Merkle hash function used for the mixed-LDE trace commitment, and (d) the canonical encoding of field elements as Keccak input bytes. SHA-3 is the only hash family in P3Q; Poseidon and friends are not present (their security reduces to algebraic-attack arguments that don't compose cleanly with FRI's soundness proof, and they add precompile surface area that the strict-PQ profile rejects). Verifier-side SHA-3 lives in LP-3655 (precompile).
Reference implementation
- Primitive:
luxfi/p3q/hash(planned) - Hash backend: SHA-3 / cSHAKE256 (LP-3655 precompile)
- Domain separation:
lp4810-{merkle,trace,fri,fs}
Copyright
Copyright and related rights waived via CC0.