The MAYA Verifier Specification is a complete, language-agnostic verification procedure. Together with the election record, it enables an independent developer to write a working verifier from scratch, in any programming language, without access to the MAYA source code or the research paper.
Specification Documents
| Version | Specification | Date |
|---|---|---|
| 1.0 | Download | September 2026 |
What the Specification Covers
- Group and scalar arithmetic for Ristretto255 (Section 3)
- Data formats and serialization (Section 4)
- Deterministic generator derivation / CRS (Section 5)
- Hash computation and Fiat–Shamir transcript (Section 6)
- Challenge vector derivation (Section 7)
- Complete verification algorithm in 6 steps (Section 8)
- IPA and eCP sub-protocols (Sections 9–10)
- Test vectors for every intermediate computation (Section 11)
Test Vectors
Section 11 of the specification provides reference values for every intermediate computation a verifier performs, so that each stage can be validated independently before moving to the next. A mismatch at any stage pinpoints the module that needs fixing.
The reference test case is a shuffle of n = 4 ciphertexts with folding factor k = 2, recursion depth d = 2, and base-case parameter m = 1, under the permutation π = (1, 3, 0, 2). Every value is printed as 64 hexadecimal characters encoding 32 bytes in byte order. Both the transcript and the prover’s random-number generator were initialized with fixed seeds, so the values are reproducible on every run.
| Stage | What to compare | Section |
|---|---|---|
| CRS generators | B_blinding, F, first 4 of g and h | 11.5–11.6 |
| Challenge vector e | First 4 entries | 11.7 |
| Transcript challenges | y, z, x, x', x_ipp, w_agg | 11.8 |
| Flattened weights | w_L, w_R, w_O, w_V, w_c for n = 4 | 11.9 |
| Proof parsing | Proof header, IPA and eCP sub-proofs | 11.10–11.12 |
| IPA scalar expansion | s_g, s_h vectors | 11.13 |
| eCP scalar expansion | Corresponding vectors | 11.14 |
| Mega-MSM result | 32 zero bytes (the group identity) | 11.17 |
The binary test election record is not yet published. Until it is, the hexadecimal values in Section 11 are sufficient to construct the input by hand and to check every stage of an implementation.
Byte-Level Reproducibility
Two conforming implementations in different languages must produce identical accept/reject decisions on identical input bytes. Every array length is stated and must be verified; every scalar and group element is checked for canonicality. This is what makes the specification, rather than any particular codebase, the reference for what a valid MAYA proof is.