FRI offers shortest proof size among all plausibly post-quantum PC schemes known today
FRI ensures that a committed vector contains exactly the evaluations of a degree-d polynomial
The FRI verifier time is inversely proportional to the logarithm of the blowup factor
The FRI prover time grows sub-linearly with the blowup factor
FRI has a linear prover time
Verifier challenges in the folding phase of FRI are sampled from Omega, where Omega is the set of n-th roots of unity
In the query phase of FRI, the verifier checks O(lambda/log(blowup factor)) entries in each committed vector
The known attack on FRI also works if |T| = 2*\rho*n
Each verifier query in the FRI (standard not list) polynomial commitment scheme offers less than 1 bit of security
In FRI polynomial commitment scheme, the prover commits to evaluations of (q(X) - v) * (X - r)^-1
The oracle for the quotient polynomial q(X) in ZeroTest from lecture 5 can be instantiated using a list polynomial commitment scheme
When applying the Fiat-Shamir transformation, the verifier challenge for round j only depends on the prover message for round j-1
When transforming a multi-round interactive protocol using Fiat-Shamir, there may in general be a r/log(r) factor decrease in "bits of security" where r=\lambda is the number of rounds
A round-by-round sound interactive protocol can be made non-interactive using Fiat-Shamir without a big loss in security in the random oracle model
