Acknowledgments

Special thanks to FaresMezenner for reviewing the blog and providing valuable feedback. Your comment helped improve its clarity and accuracy.

<aside> 🧭

In this blog, you will learn:

How IOPs model proofs using oracle tables, verifier randomness, and selective queries.
How completeness, soundness, knowledge soundness, and succinctness define IOP security.
How Merkle commitments and Fiat-Shamir compile IOPs into SNARK.
Why round-by-round soundness matters for Fiat-Shamir security.
How IOPPs extend IOPs with proximity checks over large oracle objects.
How Reed-Solomon IOPPs like FRI check that a table is close to a low-degree polynomial.
How Poly-IOPs use low-degree polynomial oracles instead of table oracles.
How Poly-IOP ⇒ IOP works by encoding polynomials as Reed-Solomon evaluation tables.
Why proximity testing is needed when the prover may send a fake table.
Why Reed-Solomon tables are not yet full polynomial commitments.
How quotienting proves evaluation openings like $f(a)=b$ .
How batching and vanishing polynomials handle multiple openings efficiently.
Why a random out-of-domain anchor $(r,s)$ binds all openings to the same polynomial.
How the division by zero issue is handled when a query point lies inside $L$ .
How the full path works: Poly-IOP → RS-IOPP / FRI → IOP → Merkle commitments → Interactive Proof → Fiat-Shamir → SNARK. </aside>

Interactive Oracle Proofs (IOP)

An Interactive Oracle Proof (IOP) is a proof system where the prover sends large proof objects called oracles:

$$ \pi_0, \pi_1, \ldots, \pi_k $$

The verifier does not read the full oracles. Instead, it queries a few random positions and checks local consistency.

In short: IOP = large proof tables + few verifier queries + random checks

$R$ is the rule that defines what counts as a valid statement/witness pair.

$$ R = \{(x, w)\} \quad \text{ in a poly-time relation} $$

Example:

$$ x = \mathrm{hash}(w) $$

Meaning:

So the prover wants to prove:

$$ \exists w \text{ such that } x = \mathrm{hash}(w) $$

without directly revealing $w$ .