International Association
for Cryptologic Research

We present Mova, a folding scheme for R1CS instances that does not require committing to error or cross terms, nor makes use of the sumcheck protocol. For reasonable parameter choices, Mova's Prover is about $5$ to $10$ times faster than Nova's Prover, and about $1.5$ times faster than Hypernova's Prover (applied to R1CS instances), not counting the cost of committing to the R1CS witness. Mova's Verifier has a similar cost as Hypernova's Verifier, but Mova has the advantage of having only $4$ rounds of communication, while Hypernova has a logarithmic number of rounds.

Mova, which is based on the Nova folding scheme, manages to avoid committing to Nova's so-called error term $\mathbf{EE}$ and cross term $\mathbf{TT}$ by replacing said commitments with evaluations of the Multilinear Extension (MLE) of $\mathbf{EE}$ and $\mathbf{TT}$ at a random point sampled by the Verifier. A key observation used in Mova's soundness proofs is that $\mathbf{EE}$ is implicitly committed by a commitment to the input-witness vector $\mathbf{ZZ}$, since $\mathbf{EE}=(A\cdot\mathbf{ZZ})\circ (B\cdot\mathbf{ZZ}) -u (C\cdot \mathbf{ZZ})$.