[ananas-block]

Single-commitment gnark Groth16 proofs currently require separate four-term and two-term pairing calls. Add verify_opt() to combine the two equations with a nonzero Fiat–Shamir coefficient derived from the full key, public inputs, and proof. It verifies one proof at a time using the existing gnark proof and verifying key.

Optional verify_opt_with_options() accelerators validate a 49-byte quotient/remainder hint for the commitment hash and reuse a key digest pinned at build time. The hash hint is untrusted and checked with exact integer arithmetic and a canonical remainder bound. The key digest is a trusted verifier parameter and must never come from prover-controlled instruction data. verify() keeps its existing separate checks and error diagnostics.

Measured with the same profiled SBF program and deterministic gnark fixtures:

Public inputs	verify	verify_opt	With hint and pinned digest
1	134,795	119,286	117,600
2	139,201	123,739	122,022
4	147,939	132,574	130,795
8	165,258	150,085	148,176

verify_opt() adds no instruction data. The optional hash hint adds 49 bytes; the pinned digest adds none. The full benchmark matrix includes all combinations. The fully accelerated path saves 17,082–17,195 CU per proof, or 10.3–12.8%.

The method documentation derives the prime-order cancellation bound and cites Bellare–Garay–Rabin, section 3.3 / Theorem 3.3 and BSB22, sections 5.1.2, 5.5 and 6.1. It states the classical random-oracle and trusted-setup assumptions. This concrete transcript adaptation has not received an independent cryptographic audit.

Validation:

• cargo test --workspace, including gnark FFI, hash-to-field differential, Circom integration, and SBF rejection tests.
• Unit and codegen tests with bsb22 gnark-vk circom-vk.
• go test ./... for the gnark fixtures and deterministic generation.
• just lint, just check-nostd, and Rustdoc with broken-link warnings denied.
• All 24 SBF benchmark variants and 18 SBF rejection tests.
• Regression showing unweighted pairing residuals can cancel, while verify_opt rejects.
• Differential integer-division tests, mutated hint bytes, oversized quotient rejection, and noncanonical remainder rejection.