Plonky3 MultiField32Challenger: transcript malleability and challenge entropy loss
Key: challenger/src/multi_field_challenger.rs | MultiField32Challenger::duplexing | transcript_malleability Affected files: challenger/src/multi_field_challenger.rs, field/src/helpers.rs Violated invariant: The Fiat-Shamir sponge must bind challenges to the exact sequence of observed field elements. Specifically: (1) absorption must be injective — distinct observation streams must produce distinct sponge states, (2) squeezing must be injective — distinct PF rate cells must yield distinct F challenge sequences, and (3) all bits of each absorbed PF element must influence the sponge …