partial-round-collapse.md

partial-round collapse states [1..15] evolve linearly during all 16 partial rounds. precompute the composed linear map. break the sequential dependency for 15 of 16 state elements. ~4× prover wall-clock speedup. the observation in partial rounds, only state[0] gets the nonlinear x⁻¹ S-box. states…