Research · Papers · The SHA-256 record and exact synthesis · MF-108
The verified 22,215-row SHA-256 bill remains unchanged
verified rows = 22,215; authorized row change = 0; no row improvement is claimed
Published 2026-08-29
For everyone
Plain summary
This entry confirms the exact cost of the verified benchmark circuit for the SHA-256 cryptographic hash function. Translating computations into zero-knowledge circuits consumes a specific row count or budget in a proof system. Theoretical shortcuts suggest smaller budgets—such as 20,531 rows or conditional estimates of 21,738 and 22,074 rows—but an uncompiled shortcut is not a finished circuit.
This formal audit reconciles every component, constraint, and allocation against machine-checked source files. The verified canonical leader remains exactly 22,215 ordered identity-C rows, with zero authorized row reductions. Speculative estimates do not count as verified records, because plain-adder simplifications do not carry over automatically when accounting for fixed constants, carry-ins, and compiler rules.
Result
Let the cost metric be the count of ordered identity-C rows in the verified canonical SHA-256 circuit under the GF(2) XAG (XOR-free) cost model.
The verified bill of materials is: verified rows = 22,215 authorized row change = 0
All circuit allocations, system constraints, and component costs sum to 22,215 rows. No row reduction is claimed. Lower counterfactual estimates—including the hypothetical 20,531-row metric and the p14 synthesis counts of 21,738 and 22,074 rows—remain conditional and do not alter the verified record.
Setting and definitions
The target artifact is the compiled canonical implementation of the SHA-256 compression function and message schedule. The evaluation metric counts ordered identity-C rows for fully instantiated, end-to-end proved constraints.
The cost model is GF(2) XAG (XOR-free). Component breakdowns cover message expansion, state round updates (including merged schedules), constant injections, carry-in handling, and residual accumulations. A row count is verified if and only if backed by an explicit proof receipt and fully mechanized source reconciliation.
Method
The result is established by source reconciliation and deterministic recomputation of the compiled leader artifact:
- Verification scripts
record-22215/Main.lean,record-22215/Cost.lean, andrecord-22215/Rounds16CanonMerged.leancheck constraint assignments and component cost metrics across all SHA-256 rounds. - The generator
zkgolf-decomp/synth-n-scratch/recompute_capstone.py(SHA-256 hashdaa50ff0dbba3f7a4b1be31d87360b53da4b7b23e1a5252706d81252765e3360) executes the recomputation. - The run outputs receipt
zkgolf-decomp/synth-n-scratch/recompute_capstone.receipt.json(SHA-256 hash3c23b130a6dbe5dc0f22226d653870d4a204e4c28e1b2af18192e5688efd9843), establishing evidence tier P + FR for the compiled 22,215-row artifact.
Discussion
This entry fixes the boundary conditions for the canonical SHA-256 benchmark:
- The verified leader is not 20,531 rows.
- The alternative counts of 21,738 and 22,074 rows from p14 synthesis remain conditional.
- Plain-adder optimizations do not transfer to circuits with fixed constants, carry-ins, residues, or identity-C compilation without a verified build.
- No claim of priority or algorithmic novelty is asserted beyond confirming the current program leader.
The authorized row delta for this cycle is zero. Speculative counts and unintegrated synthesis estimates do not replace verified bills of materials.
For everyone — the takeaway
What this means
In formal verification, an optimization counts only when every constraint and edge case has a complete machine-checked proof. Early designs and paper calculations often promise lower numbers, but they often fail when integrated with carry bits and fixed constants. The verified SHA-256 record remains 22,215 rows.
Register references
- Entry: MF-108
- Reports:
zkgolf-decomp/reports/RECORD-BOM.md,zkgolf-decomp/reports/STATE-OF-PROGRAM.md,zkgolf-decomp/SD-RESEARCH-UPDATE-REPORT.md,SYNTH-L-TRUNCADD.md,SYNTH-M-P14.md - Formal proof sources:
record-22215/Main.lean,record-22215/Cost.lean,record-22215/Rounds16CanonMerged.lean - Receipt artifact:
zkgolf-decomp/synth-n-scratch/recompute_capstone.receipt.json(SHA-2563c23b130a6dbe5dc0f22226d653870d4a204e4c28e1b2af18192e5688efd9843) - Generator artifact:
zkgolf-decomp/synth-n-scratch/recompute_capstone.py(SHA-256daa50ff0dbba3f7a4b1be31d87360b53da4b7b23e1a5252706d81252765e3360)
Every artifact named above is bundled in, or hashed by, this paper's evidence pack below.
Evidence pack
Everything needed to check this entry against its receipts: the register text, a manifest with a SHA-256 hash for every named receipt, and 3 of 5 receipt files bundled (27 KB). Anything not bundled is still hashed in the manifest and lives in the compute-box working trees.
Changelog
Last reviewed 2026-08-29
- 2026-08-29Published on this site.