Owner: @Mehmet

Reviewers: 🟢@Álvaro Castro-Castilla 🟢@Thomas Lavaur 🟢@Daniel Kashepava 🟢@Marcin Pawlowski 🟢@Daniel Sanchez Quiros

Introduction

This document describes the cryptographic protocol underlying NomosDA, the data availability (DA) layer for the Nomos blockchain. NomosDA ensures that all data submitted by Nomos Zones, called blobs, is made available and verifiable by all network participants, including sampling clients and validators.

To achieve this, the blob data is first encoded using Reed–Solomon erasure coding and arranged in a matrix format. Each row of the matrix is interpreted as a polynomial and committed to using a KZG polynomial commitment. The columns of this matrix are then distributed across a set of decentralized DA nodes.

Rather than requiring individual proofs for each chunk, NomosDA uses a random linear combination of all row polynomials to construct a single combined polynomial. This allows for generating one proof per column, which enables efficient and scalable verification without sacrificing soundness. Sampling clients verify availability by selecting random columns and checking that the data and proof they receive are consistent with the committed structure. Because each column intersects all rows, even a small number of sampled columns provides strong confidence that the entire blob is available.

This document details the cryptographic mechanisms that support NomosDA, structured around the protocol’s three key stages: encoding, dispersal, and sampling. For readers less familiar with polynomial commitments, interpolation, or erasure coding, we include a background summary in the Annex at the end of this document.

Notations

• $fᵢ(x)$ : Polynomial interpolated from the chunks in row $i$.
• $comᵢ$ : KZG commitment of the row polynomial $fᵢ(x)$.
• $f_C(x)$ : Combined polynomial formed as a random linear combination of all row polynomials.
• $com_C$ : KZG commitment of the combined polynomial $f_C(x)$.
• $w$ : Primitive $n$-th root of unity in the finite field.
• $h$ : Random scalar generated using the Fiat–Shamir heuristic from row commitments.
• $πⱼ$ : KZG evaluation proof for column j of the combined polynomial.
• $vⱼ$ : Combined evaluation of column j (i.e., $f_C(w^{j-1})$).

Overview

The NomosDA encoding protocol transforms blob data into a form that supports efficient verification of data availability using erasure coding and polynomial commitments.

At a high level, the encoding process follows these steps:

1. Data Matrix Formation

   The blob is divided into $\ell$ rows of $k$ field elements each. These elements are treated as evaluations of univariate polynomials of degree $<k$, with evaluation points taken from a multiplicative subgroup of a finite field.