Welcome to the resource topic for
**2024/1220**

**Title:**

Mova: folding without committing to error terms and without sumcheck

**Authors:**
Nikolaos Dimitriou, Albert Garreta, Ignacio Manzur, Ilia Vlasov

**Abstract:**

We present Mova, a folding scheme for R1CS instances that does not require committing to error or cross terms, nor makes use of the sumcheck protocol. For reasonable parameter choices, Mova’s Prover is about 5 to 10 times faster than Nova’s Prover, and about 1.5 times faster than Hypernova’s Prover (applied to R1CS instances), not counting the cost of committing to the R1CS witness. Mova’s Verifier has a similar cost as Hypernova’s Verifier, but Mova has the advantage of having only 4 rounds of communication, while Hypernova has a logarithmic number of rounds.

Mova, which is based on the Nova folding scheme, manages to avoid committing to Nova’s so-called error term \mathbf{EE} and cross term \mathbf{TT} by replacing said commitments with evaluations of the Multilinear Extension (MLE) of \mathbf{EE} and \mathbf{TT} at a random point sampled by the Verifier. A key observation used in Mova’s soundness proofs is that \mathbf{EE} is implicitly committed by a commitment to the input-witness vector \mathbf{ZZ}, since \mathbf{EE}=(A\cdot\mathbf{ZZ})\circ (B\cdot\mathbf{ZZ}) -u (C\cdot \mathbf{ZZ}).

**ePrint:**
https://eprint.iacr.org/2024/1220

See all topics related to this paper.

Feel free to post resources that are related to this paper below.

**Example resources include:**
implementations, explanation materials, talks, slides, links to previous discussions on other websites.

For more information, see the rules for Resource Topics .