#R1CS
LightNews LightNews
hipstersasquatch.bsky.social
The worst part is, the perfect song and video already exists. He should have had his media team/nephew photoshop his face on the singer, and the towers into the background.

www.youtube.com/watch?v=R1cS...
America Fuck Yeah We Stand As One
YouTube video by jarts
www.youtube.com
November 5, 2025 at 7:54 PM
erwan.bsky.social
me looking at any r1cs circuit
fullslack.bsky.social full slack @fullslack.bsky.social · Jun 12
this picture of Biden looking at a quantum computer is fucking hilarious lmao
June 12, 2023 at 10:23 PM
fegge.bsky.social
The Moon Math Manual from Least Authority is a pretty good intro to R1CS and KZG.

leastauthority.com/static/publi...
leastauthority.com
March 27, 2025 at 9:00 AM
giacomofenzi.bsky.social
New work out! We (royally) show that Fiat-Shamir transformation is insecure for a class of proof systems for *generated* relations (including variants of commonly deployed protocols for R1CS).
A thread to explain where this applies

ia.cr/2026/1838
September 2, 2026 at 5:19 AM
xiyadie.bsky.social
₽4 r£v ○$t remake is....kind of awful. We alr know the lyrics were nonsense but the new vocal dir. making the words be enunciated better made the flow grating 2 the ears. If they were gonna do that, idk why they didn't bother 2 at least tweak the l¥r1cs.
September 16, 2026 at 12:46 AM
eprint.ing.bot
Bulletproofs for R1CS: Bridging the Completeness-Soundness Gap and a ZK Extension (Gil Segev) ia.cr/2025/327
Abstract. Bulletproofs, introduced by Bünz, Bootle, Boneh, Poelstra, Wuille and Maxwell (IEEE S&P, 2018), is a highly efficient non-interactive argument system that does not require a trusted setup. Recently, Bünz (PhD Thesis, 2023) extended Bulletproofs to support arguments for rank-1 constraint satisfaction (R1CS) systems, a widely-used representation for arithmetic satisfiability problems. Although the argument system constructed by Bünz preserves the attractive properties of Bulletproofs, it presents a gap between its completeness and soundness guarantees: The system is complete for a restricted set of instances, but sound only for a significantly broader set. Although argument systems for such gap relations nevertheless provide clear and concrete guarantees, the gaps they introduce may lead to various inconsistencies or undesirable gaps within proofs of security, especially when used as building blocks within larger systems. In this work we show that the argument system presented by Bünz can be extended to bridge the gap between its completeness and soundness, and to additionally provide honest-verifier zero-knowledge. For the extended argument system, we introduce a refined R1CS relation that captures the precise set of instances for which both completeness and soundness hold without resorting to a gap formulation. The extended argument system preserves the performance guarantees of the argument system presented by Bünz, and yields a non-interactive argument system using the Fiat-Shamir transform. Image showing part 2 of abstract.
February 25, 2025 at 2:55 PM
bsky.gay
LAttice-Based Recursively Amortized Demonstrations Of R1CS 🐶
LAttice-Based Recursively Amortized Demonstrations Of R1CS
August 23, 2023 at 9:35 PM
darrylflood.bsky.social
www.youtube.com/watch?v=R1cS...
Yugi's Grandpa ranting about kids these days
YouTube video by neotaito
www.youtube.com
September 18, 2026 at 5:42 AM
ferlainogroup.bsky.social
👉 For more details and how to apply, please visit: www.oeaw.ac.at/jobs?jh=r1cs...
June 23, 2025 at 7:44 AM
bsky.gay
gregor seiler’s got that dawg in him
gregor swiping giving a presentation on his paper labrador: compact proofs for r1cs from module-sis
August 23, 2023 at 9:31 PM
eprint.ing.bot
Plonkify: R1CS-to-Plonk transpiler (Pengfei Zhu) ia.cr/2025/534
Abstract. Rank-1 Constraint Systems (R1CS) and Plonk constraint systems are two commonly used circuit formats for zero-knowledge succinct non-interactive arguments of knowledge (zkSNARKs). We present Plonkify, a tool that converts a circuit in an R1CS arithmetization to Plonk, with support for both vanilla gates and custom gates. Our tool is able to convert an R1CS circuit with 229,847 constraints to a vanilla Plonk circuit with 855,296 constraints, or a jellyfish turbo Plonk circuit with 429,166 constraints, representing a 2.59× and 1.9× reduction in the number of constraints over the respective naïve conversions.
March 23, 2025 at 3:59 PM
pirapira.bsky.social
I was comparing formal verification frameworks for arithmetic circuits: blog.zksecurity.xyz/posts/formal...
Comparison of formal verification frameworks for arithmetic circuits
A hands-on comparison of formal verification frameworks for arithmetic circuits, evaluating those in the ACL2 Book (r1cs, PFCS), acl2-jolt, Garden (Rocq), zk-lean, sp1-lean, and Clean. Each framework ...
blog.zksecurity.xyz
November 23, 2025 at 9:02 PM
rivalsofaether.eu
The LAST community R1CS event of the year is happening this Sunday! Bracket starts at 18:00 CET, don't forget to sign in!

https://roaeurope.challonge.com/r1cs2025december
December 19, 2025 at 3:28 PM
zkhack.dev
SuperSpartan leverages the sum-check algorithm to efficiently prove that a CCS relation holds, offering flexibility (R1CS, Plonkish, AIR), and serving as a foundational component for more complex recursive proof systems.
May 21, 2025 at 12:04 PM
eprint.ing.bot
Mova: folding without committing to error terms and without sumcheck (Nikolaos Dimitriou, Albert Garreta, Ignacio Manzur, Ilia Vlasov) ia.cr/2024/1220
Abstract. We present Mova, a folding scheme for R1CS instances that does not require committing to error or cross terms, nor makes use of the sumcheck protocol. For reasonable parameter choices, Mova’s Prover is about 5 to 10 times faster than Nova’s Prover, and about 1.5 times faster than Hypernova’s Prover (applied to R1CS instances), not counting the cost of committing to the R1CS witness. Mova’s Verifier has a similar cost as Hypernova’s Verifier, but Mova has the advantage of having only 4 rounds of communication, while Hypernova has a logarithmic number of rounds. Mova, which is based on the Nova folding scheme, manages to avoid committing to Nova’s so-called error term EE and cross term TT by replacing said commitments with evaluations of the Multilinear Extension (MLE) of EE and TT at a random point sampled by the Verifier. A key observation used in Mova’s soundness proofs is that EE is implicitly committed by a commitment to the input-witness vector ZZ, since EE = (A⋅ZZ) ∘ (B⋅ZZ) − u(C⋅ZZ).
July 31, 2024 at 12:09 PM
eprint.ing.bot
Polymath: Groth16 Is Not The Limit (Helger Lipmaa) ia.cr/2024/916
Abstract. Shortening the argument (three group elements or 1536 / 3072 bits over the BLS12-381/BLS24-509 curves) of the Groth16 zk-SNARK for R1CS is a long-standing open problem. We propose a zk-SNARK Polymath for the Square Arithmetic Programming constraint system using the KZG polynomial commitment scheme. Polymath has a shorter argument (1408 / 1792 bits over the same curves) than Groth16. At 192-bit security, Polymath’s argument is nearly half the size, making it highly competitive for high-security future applications. Notably, we handle public inputs in a simple way. We optimized Polymath’s prover through an exhaustive parameter search. Polymath’s prover does not output 𝔾₂ elements, aiding in batch verification, SNARK aggregation, and recursion. Polymath’s properties make it highly suitable to be the final SNARK in SNARK compositions.
June 10, 2024 at 3:13 AM
eprint.ing.bot
Blind zkSNARKs for Private Proof Delegation and Verifiable Computation over Encrypted Data (Mariana Gama, Emad Heydari Beni, Jiayi Kang, Jannik Spiessens, Frederik Vercauteren) ia.cr/2024/1684
Abstract. In this paper, we show for the first time it is practical to privately delegate proof generation of zkSNARKs proving up to 2²⁰ R1CS constraints to a single server. We achieve this by homomorphically computing zkSNARK proof generation, an approach we call blind zkSNARKs. We formalize the concept of blind proofs, analyze their cryptographic properties and show that the resulting blind zkSNARKs remain sound when compiled using BCS compilation. Garg et al. gave a similar framework at CRYPTO 2024, but no practical instantiation for proving non-trivial computations was known. By delegating proof generation, we are able to reduce client computation time from 10 minutes to mere seconds, while server computation time remains limited to 20 minutes. We also propose a practical construction for vCOED supporting constraint sizes four orders of magnitude larger than the current state-of-the-art verifiable FHE-based approaches. These results are achieved by optimizing Fractal for the GBFV homomorphic encryption scheme, e.g. by designing specialized homomorphic circuits with two dimensional NTTs. Furthermore, we make the proofs publicly-verifiable by appending a zero-knowledge Proof of Decryption (PoD). We propose a new construction for PoDs, optimized for low proof generation time, exploiting modulus and ring switching in GBFV; these techniques might be of independent interest. Finally, we implement the latter protocol in C and report on execution time and proof sizes. Image showing part 2 of abstract.
October 18, 2024 at 2:40 AM
bsky.gay
sneak peek from my CRYPTO 2023 slides
Results • First plausibly post-quantum arguments with quasilinear prover complexity, O(log n) size proofs, and an O(log n log log n) complexity verifier. . Previous best result: O(log^2 n) verifier hash-based constructions . Constructions for both cyclotomic rings R and integers Zq of: • Linear map functional commitments/ inner product argument • Polynomial commitments • SNARK for R1CS • All extractable, preprocessing, non-interactive, structure-preserving, and recursively composable
August 16, 2023 at 1:13 AM
eprint.ing.bot
Compositional Formal Verification of Zero-Knowledge Circuits
(Alessandro Coglio, Eric McCarthy, Eric Smith, Collin Chin, Pranav Gaddamadugu, Michel Dellepere) ia.cr/2023/1278
Abstract. We provide a preliminary report of our ongoing work in formally defining and verifying, in a compositional way, the R1CS gadgets generated by Aleo’s snarkVM. The approach is applicable to other systems that generate gadgets in a similar manner, and that may use non-R1CS representations.
September 28, 2023 at 1:58 AM
jazsoundwav.bsky.social
6 time NA R2CS/R1CS champ.

@cakeassault.bsky.social is on a 4 season streak of being #1. Will he extend his streak to 5 seasons, or will he be dethroned? Only time will tell.

This is poster 2 of 2 of Cake using brutalism style. Making this more colorful was tricky, but the end result came out well
July 29, 2026 at 4:35 PM
eprint.ing.bot
How to prove more false statements: Fiat–Shamir limitations on (generated) R1CS (Giacomo Fenzi) ia.cr/2026/1838
Abstract. The Fiat–Shamir (FS) transformation is a technique that converts interactive protocols into non-interactive ones. FS is secure in idealized models such as the random oracle model (ROM) (if the interactive protocol satisfies a condition known as state-restoration soundness). It is known that there are protocols whose FS transformation is secure in the ROM, yet insecure when instantiated with any concrete hash function. Historically, these protocols were contrived (as in, they were designed so their FS transformation would be unsound). Khovratovich, Rothblum and Soukhanov (CRYPTO 2025) showed that a class of natural (and practically deployed) protocols based on a protocol of Goldwasser, Kalai and Rothblum (JACM 2015) was also unsound when compiled with FS and any concrete hash function. We extend the attack to a different class of protocols: those whose instances are generated by running a program. This setting covers concrete trends in modern proof systems, in which the computation to be proven is described by a program (often adversarialy generated) which is then either compiled or autonomously converted into an instance of target relation such as rank-1 constraint satisfaction (R1CS). We show that, when the conversion process is “expressive enough”, an adversary controlling the program code can break soundness of the non-interactive proof system. The attacks generalize to a wide class of protocols: any protocol in which a cheating prover can prepare an accepting transcript before the statement is bound. We show that variants of the Spartan (CRYPTO 2020) and Aurora (EUROCRYPT 2019) proof systems for R1CS fall in this class. Complementing the attacks, we formalize a mitigation: deriving the first Fiat–Shamir challenge from the generated statement, rather than from the program that generates it, provably reduces the soundness of the compiled protocol to that of the underlying protocol for the non-generated relation. Image showing part 2 of abstract. Image showing part 3 of abstract.
September 1, 2026 at 8:17 PM
msakai.bsky.social
Satisfiability Modulo Finite Fields: Unlocking SMT for ZK Verification eprint.iacr.org/2023/091.pdf

ゼロ知識証明のR1CSへのコンパイルの検証を対象に、有限体の理論と理論ソルバーを提案しcvc5に実装。有限体上の+,×,=,≠を扱い、≠も=に帰着できるので多項式環のイデアルのバラエティの非空判定に。

グレブナー基底でイデアルがtrivial(1を含む)であることを判定することで高速なunsat判定を行い、その後のモデル構築では高速に処理できる条件もあるものの最悪ケースでは網羅的な探索に。
eprint.iacr.org
November 12, 2024 at 12:31 AM
zkhack.dev
@srinathtv.bsky.social introduced NEO, a new folding-based proof system built on HyperNova and LatticeFold.

Paper: t.co/cm4hmX3Bdf
Neo: Lattice-based folding scheme for CCS over small fields and pay-per-bit commitments
This paper introduces Neo, a new lattice-based folding scheme for CCS, an NP-complete relation that generalizes R1CS, Plonkish, and AIR. Neo's folding scheme can be viewed as adapting the folding…
t.co
February 28, 2025 at 4:46 PM
eprint.ing.bot
Flock: Fast Proving for Batch Boolean Computations (Benedikt Bünz, Ron Rothblum, William Wang) ia.cr/2026/1329
Abstract. For many applications of SNARKs, a key bottleneck is proving large batches of standard cryptographic hash evaluations, such as SHA-256, Keccak, or BLAKE3. We introduce Flock, a hash-based SNARK for extremely fast proving of such batched Boolean computations. Flock proves batches of the same R1CS circuit (plus input/output relations between them), can prove hash-chains and Merkle path openings, and in principle can be extended to full-fledged hash-based signature verification. At its core, Flock combines new optimizations for the lincheck and zerocheck protocols with an aggressively optimized proof-of-concept implementation co-designed by coding agents. On a single core of an M4 Max processor, Flock proves 82k evaluations of the BLAKE3 compression function, 42k SHA-256 compressions, and 30k Keccak permutations per second — less than a 250× overhead over native execution. On ten cores, throughput exceeds 660k BLAKE3 compressions per second; in proving SHA-256, Flock is more than 9× faster than Binius64, the prior state of the art, and more than 500× faster than the fastest elliptic curve-based SNARK we measured against. Image showing part 2 of abstract.
June 29, 2026 at 2:32 PM
eprint.ing.bot
Lumora: A Family of Permutation-Based Wide-Block Ciphers for Post-Quantum zkSNARK Applications (Susanta Samanta, Martin Grenouilloux, Guang Gong, Chunlei Li) ia.cr/2026/1653
Abstract. The deployment of advanced cryptographic protocols such as zero-knowledge proofs (ZKPs) requires symmetric primitives optimized for fast verification inside proof systems. In frameworks based on Rank-1 Constraint Systems (R1CS), prover performance and proof size are dominated by the cost of arithmetization, specifically, by the number of nonlinear multiplication constraints. Traditional bit-oriented designs are typically inefficient under this metric. In this paper, we introduce Lumora, a family of arithmetization-oriented, permutation-based wide-block ciphers designed for efficient use inside zkSNARK circuits and for applications in post-quantum digital signatures. Each instance of Lumora follows a unified AES-like SPN structure defined over the binary extension field 𝔽_(2^(n)) for n ∈ {16, 32, 64}. The underlying permutation is instantiated as a block cipher via the Even-Mansour paradigm, which eliminates the R1CS constraint overhead of a separate key schedule, ensuring the prover’s workload remains strictly focused on evaluating the public permutation. Finally, we provide a detailed security analysis of the Lumora family, together with implementation results and a comparison within the FAEST-EM-256 framework. Image showing part 2 of abstract.
August 18, 2026 at 6:28 PM