Research · Papers · Cipher S-boxes, χ, and quantum gate counts · MF-135
Three sound whole-function multiplicative complexity lower-bound floors
MC(F) >= ceil(-log2 delta(F)/log2(8/5)), MC(F) >= max(ceil Lambda, ceil Sigma), MC(F) >= ceil(E_H MC(F|H) + alpha_{N,d})
Published 2026-09-04
For everyone
Plain summary
In zero-knowledge proofs and specialized cryptography, linear steps like XOR (exclusive OR) cost almost nothing, but non-linear steps like AND (multiplication) are expensive. Multiplicative complexity counts the minimum number of multiplication gates needed to evaluate a function.
This work proves three lower bounds that set hard floors on this cost for entire functions. The first floor uses additive energy, a measure of geometric structure in a function's graph, showing that each AND gate can preserve at most 5/8 of those patterns. The second tracks how a function's spectral spread grows through logic gates. The third averages costs across smaller affine slices and adds a circuit-independent bonus term.
To remain sound, the third floor requires a non-affine rescope condition flagged by the test map chi_3^2.
Result
Let F: GF(2)^N -> GF(2)^M be a Boolean map. In the GF(2) XOR-AND graph (XAG) model where linear operations over GF(2) are free, the multiplicative complexity MC(F) obeys three invariant lower bounds:
(i) Graph additive energy floor: MC(F) >= ceil(-log2 delta(F) / log2(8/5)) where delta(F) is the normalized additive energy of the function graph of F.
(ii) Walsh butterfly floor: MC(F) >= max(ceil Lambda, ceil Sigma) where Lambda and Sigma derive from l1-norm growth (bounded by a factor of 2 per AND gate) and spectral support growth (bounded by a factor of 4 per AND gate) under triangular shear embedding.
(iii) Isotropic switching floor: MC(F) >= ceil(E_H MC(F|H) + alpha_{N,d}) where E_H is the expectation over uniformly random affine d-flats H, and alpha_{N,d} is a circuit-independent fractional bonus.
All three floors are invariant under free linear operations.
Setting and definitions
MC(F) is the multiplicative complexity of F: GF(2)^N -> GF(2)^M, defined as the minimum number of non-linear AND gates needed in an XAG to compute F.
Floor (i): delta(F) is the normalized additive energy of the transcript graph of F, counting additive quadruples across the graph.
Floor (ii): Lambda and Sigma track Walsh transform expansion under triangular shear embeddings:
- The Walsh l1-norm grows by at most a factor of 2 per AND gate.
- Support size grows by at most a factor of 4 per AND gate.
- Zero-ancilla merging operations do not increase either quantity.
Floor (iii): H is an affine subspace of dimension d in GF(2)^N, F|H is the restriction of F to H, and alpha_{N,d} is a fractional correction term depending only on input dimension N and flat dimension d.
Method
Analytic proofs (evidence tier P) establish the gate-by-gate invariants:
- Floor (i): a single AND gate retains at least 5/8 of a transcript graph's additive quadruples, setting the log2(8/5) denominator.
- Floor (ii): bounds spectral l1-norm and support expansion under triangular shear embedding, proving stability under zero-ancilla merging.
- Floor (iii): applies isotropic switching over affine d-flats to derive alpha_{N,d}.
A clean-room sweep evaluated all three bounds across all 72 atlas cells with zero exceedances (evidence tier FC). Verification artifacts and replay logs reside in: zkgolf-decomp/COUNCIL3-VERIFY-FLOORS.md.
Discussion
The three bounds provide invariant whole-function lower-bound instruments:
- Floor (i) holds even when erasing every component boundary within F. On a 1,600-bit map, the universal cap derived from this energy floor is approximately 2,360.
- Floor (ii) jointly constrains l1-norm growth and spectral support expansion.
- Floor (iii) requires the non-affine rescope identified through chi_3^2.
The 72-cell atlas sweep produced zero exceedances. These bounds apply strictly to whole-function complexity in XOR-free GF(2) models; they do not predict synthesis layouts or circuit upper bounds.
For everyone — the takeaway
What this means
These three formulas prove the absolute minimum number of multiplication gates needed to compute a given logic function. By connecting gate counts directly to geometric structure, frequency spread, and slice averages, they show why certain cryptographic functions cannot be compressed past a specific circuit size.
Register references
- Register entry: MF-135
- Receipt artifact:
zkgolf-decomp/COUNCIL3-VERIFY-FLOORS.md
Every artifact named above is bundled in, or hashed by, this paper's evidence pack below.
Evidence pack
Everything needed to check this entry against its receipts: the register text, a manifest with a SHA-256 hash for every named receipt, and 0 of 1 receipt files bundled (1 KB). Anything not bundled is still hashed in the manifest and lives in the compute-box working trees.
Changelog
Last reviewed 2026-09-04
- 2026-09-04Published on this site.