Integrate with sponge & Add multivariate challenge strategy

Cargo.toml

@@ -25,6 +25,7 @@ ark-serialize = { version = "^0.3.0", default-features = false, features = [ "de
 ark-ff = { version = "^0.3.0", default-features = false }
 ark-ec = { version = "^0.3.0", default-features = false }
 ark-poly = {version = "^0.3.0", default-features = false }
+ark-sponge = {version = "^0.3.0", default-feautres = false}
 
 ark-std = { version = "^0.3.0", default-features = false }
 ark-relations = { version = "^0.3.0", default-features = false, optional = true }
@@ -58,7 +59,7 @@ debug = true
 
 [features]
 default = [ "std", "parallel" ]
-std = [ "ark-ff/std", "ark-ec/std", "ark-nonnative-field/std", "ark-poly/std", "ark-std/std", "ark-relations/std", "ark-serialize/std" ]
-r1cs = [ "ark-relations", "ark-r1cs-std", "ark-nonnative-field", "hashbrown" ]
+std = [ "ark-ff/std", "ark-ec/std", "ark-nonnative-field/std", "ark-poly/std", "ark-std/std", "ark-relations/std", "ark-serialize/std", "ark-sponge/std"]
+r1cs = [ "ark-relations", "ark-r1cs-std", "ark-nonnative-field", "hashbrown", "ark-sponge/r1cs"]
 print-trace = [ "ark-std/print-trace" ]
 parallel = [ "std", "ark-ff/parallel", "ark-ec/parallel", "ark-poly/parallel", "ark-std/parallel", "rayon" ]

src/challenge.rs

@@ -0,0 +1,58 @@
+use ark_ff::PrimeField;
+use ark_sponge::FieldBasedCryptographicSponge;
+
+/// State stored for univariate generator
+#[derive(Copy, Clone)]
+pub struct UnivariateGeneratorState<F: PrimeField> {
+    gen: F,
+    next: F,
+}
+
+impl<F: PrimeField> UnivariateGeneratorState<F> {
+    fn new(gen: F) -> Self {
+        Self { gen, next: gen }
+    }
+
+    fn get_next(&mut self) -> F {
+        let result = self.next;
+        self.next *= self.gen;
+        result
+    }
+}
+
+/// Challenge Generator (todo doc)
+#[derive(Copy, Clone)]
+pub enum ChallengeGenerator<'a, F: PrimeField, S: 'a + FieldBasedCryptographicSponge<F>> {
+    /// Each challenge is freshly squeezed from a sponge.
+    Multivariate(&'a mut S),
+    /// ach challenge is a power of one squeezed element from sponge.
+    Univariate(UnivariateGeneratorState<F>),
+}
+
+impl<'a, F: PrimeField, S: 'a + FieldBasedCryptographicSponge<F>> ChallengeGenerator<'a, F, S> {
+    /// Returns a challenge generator with multivariate strategy. Each challenge is freshly squeezed
+    /// from a sponge.
+    pub fn new_multivariate(sponge: &'a mut S) -> Self {
+        Self::Multivariate(sponge)
+    }
+
+    /// Returns a challenge generator with univariate strategy. Each challenge is a power of one
+    /// squeezed element from sponge.
+    pub fn new_univariate(sponge: &mut S) -> Self {
+        let gen = sponge.squeeze_native_field_elements(1)[0];
+        let univariate_state = UnivariateGeneratorState::new(gen);
+        Self::Univariate(univariate_state)
+    }
+
+    /// Returns the next challenge generated.
+    pub fn next_challenge(&mut self) -> F {
+        if let Self::Multivariate(s) = self {
+            s.squeeze_native_field_elements(1)[0]
+        } else if let Self::Univariate(s) = self {
+            s.get_next()
+        } else {
+            // should not happen
+            panic!()
+        }
+    }
+}

src/data_structures.rs

@@ -8,6 +8,7 @@ use ark_std::{
     marker::PhantomData,
     ops::{AddAssign, MulAssign, SubAssign},
 };
+use ark_sponge::FieldBasedCryptographicSponge;
 
 /// Labels a `LabeledPolynomial` or a `LabeledCommitment`.
 pub type PolynomialLabel = String;
@@ -104,11 +105,12 @@ pub trait PCProof: Clone + ark_ff::ToBytes + CanonicalSerialize + CanonicalDeser
 
 /// A proof of satisfaction of linear combinations.
 #[derive(Clone, CanonicalSerialize, CanonicalDeserialize)]
-pub struct BatchLCProof<F: Field, P: Polynomial<F>, PC: PolynomialCommitment<F, P>> {
+pub struct BatchLCProof<F: Field, P: Polynomial<F>, PC: PolynomialCommitment<F, P, S>, S: FieldBasedCryptographicSponge<F>> {
     /// Evaluation proof.
     pub proof: PC::BatchProof,
     /// Evaluations required to verify the proof.
     pub evals: Option<Vec<F>>,
+    _sponge: PhantomData<S>
 }
 
 /// A polynomial along with information about its degree bound (if any), and the