1469 (not a good candidate)

A non-interactive, extractable polynomial commitment with poly-logarithmic proof size and verifier time under Module-SIS assumptions, built via a Merkle-ized PRISIS commitment and an FRI-style split-and-fold evaluation protocol with negligible knowledge soundness (via batching).

Core idea

Commitment layer: Build a Merkle tree whose nodes are small PRISIS commitments; this yields quasi-linear commit time and a polylog(size) CRS instead of quadratic. Binding reduces to a multi-instance PRISIS that the paper re-randomizes back to single-instance and then to Module-SIS.
Evaluation layer: An FRI-inspired split-and-fold sigma-protocol repeated log steps; batching multiple claims gives negligible knowledge soundness without parallel repetition (suitable for Fiat–Shamir).

Asymptotic costs (from their comparison table and efficiency lemma)

Prover time: $O(d)$.
Verifier time: $O(\log^2 d)$.
Proof size: $O(\log d)$ elements over $R_q$.
CRS size: $O(\log^2 d)$ elements over $R_q$.

They report indicative proof sizes (not runtime timings):

$d = 2^{20}, k=1, \ell=1$ (no batching across many claims): |$\pi$| ≈ 36.5 MB.
$d = 2^{30}, k=1, \ell=8:$ |$\pi$| ≈ 767 MB.

(Here, $\ell$ is the number of recursive rounds shown and they discuss security targeting)

Note: These are proof sizes only; the paper does not provide concrete wall-clock proof generation or verification times.

CMKW24: https://eprint.iacr.org/2024/281

A lattice-based polynomial commitment with transparent setup (CRS is just public randomness), post-quantum security, and a Fiat–Shamir (FS) transform to the non-interactive setting; they also prove knowledge soundness against quantum adversaries using LMS22/BBK22-style techniques. It needs no pre-processing yet still attains sublinear (polylog) verification, and it naturally supports multilinear polynomials.

They give an optimized instantiation (using LNS21/LNP22-style tweaks) with $O(\sqrt[3]{L})$ proof size and verifier complexity, and show concrete sizes that beat prior work at practical degrees: for $L\!=\!2^{20}$ the proof is ~501 KB, which is 2× smaller than hash-based FRI, 6×smaller than FMN’23, and 70× smaller than SLAP; the reported sizes are 120 KB (2¹⁵), 501 KB (2²⁰), 1.51 MB (2²⁵), 5.17 MB (2³⁰).

HSS24: https://eprint.iacr.org/2024/306

A lattice-based polynomial commitment with transparent setup and public verification, targeting concrete efficiency (not just asymptotic). It’s built on a modified Ajtai commitment and introduces two key techniques:

Big-prime encoding: maps large field elements (e.g., 255-bit) into small-norm ring polynomials while preserving homomorphisms—avoiding parameter blow-ups when committing large coefficients.