Carryless polynomial multiplication in polynomial time #
The single evaluator BitPolynomial.mulEval reads both operand coefficient
lists from the standard pairing codec and computes their product over
ZMod 2. Its FP certificate uses the library's deterministic machine model
uniformly over all input lengths. The coefficient lists are runtime inputs;
there is no field modulus or hardwired polynomial in this construction.
On malformed pairings, the total projections give a possibly nonempty padding
of zero coefficients.
Carryless multiplication of two runtime coefficient lists is uniformly polynomial-time.