Research · Papers · Further results · MF-143

Refutation of three proposed multiplicative complexity laws

MC(11 x mod 128) = 6 ≠ 5, kappa_sq(7) ∈ {2,3} ≠ 1, and MC(I_9) = 6 ≠ 5, refuting three conjectured complexity laws.

MF-143REFUTEDRECEIPTEDNEGATIVE RESULTFurther results

Published 2026-09-04

For everyone

Plain summary

In circuit design and cryptography, multiplicative complexity counts the minimum number of AND gates needed to compute a function when XOR gates are free. Previous work proposed three simple formulas to predict this exact cost for three modular operations: multiplying by an odd constant, modular squaring with helper values (a square catalyst), and calculating modular reciprocals (inverses).

All three formulas are incorrect. Exhaustive computer searches and replayed circuits found counterexamples where the true cost exceeds the formula's prediction:

  • Multiplying by 11 modulo 128 requires 6 AND gates, not 5.
  • The 7-bit square catalyst overhead is 2 or 3, not 1.
  • The 9-bit modular reciprocal requires 6 AND gates, not 5.

A narrower formula for shear multipliers was already proven separately and remains valid.

Result

Three candidate multiplicative complexity laws in the GF(2) XAG cost model are disproved:

  1. The general odd-multiplier valuation law MC(a x mod 2^n) = max(0, N - s - 1) is false. The lexicographically minimal counterexample is MC(11 x mod 128) = 6, refuting the predicted complexity of 5. The proven shear subfamily MC((1+2^s) x mod 2^n) = max(0, n-s-1) is unaffected and stands.
  2. The square catalyst law kappa_sq(n) = 1 for n >= 5 is false at n = 7. Both complexity 5 (rank-tight) and the conjectured complexity 6 are impossible; a verified eight-gate circuit gives MC(S_7) in [7,8], proving kappa_sq(7) in {2,3} ≠ 1.
  3. The odd reciprocal law MC(I_n) = max(0, n-4) is false: MC(I_9) = 6 ≠ 5.

Setting and definitions

Let MC(f) denote the multiplicative complexity of a Boolean or bit-vector function f over GF(2), defined as the minimum number of two-input AND gates in an XOR-AND graph (XAG) computing f.

  • MC(a x mod 2^n) denotes the multiplicative complexity of modular constant multiplication by an odd integer a.
  • S_n denotes the modular squaring operator over n-bit inputs, and kappa_sq(n) denotes the associated square catalyst overhead.
  • I_n denotes the n-bit odd modular reciprocal operation.

Method

Each refutation is established at evidence tier FC+FR (full certification and full replay):

  • For MC(11 x mod 128), complete truth-space ordered-flag exhaustion establishes MC ≥ 6. An exact six-gate circuit replayed on all 128 input states establishes MC ≤ 6.
  • For S_7, lower-bound certification proves that 5-gate and 6-gate circuits are impossible. An eight-gate circuit replayed on all inputs bounds MC(S_7) to [7,8], yielding kappa_sq(7) in {2,3}.
  • For I_9, exact evaluation demonstrates MC(I_9) = 6, refuting the conjectured value of 5.

Verification receipts and circuit artifacts are recorded in CONST-MULT-LAW.md and SQUARE-CATALYST.md.

Discussion

These refutations eliminate three candidate general laws so downstream lower bounds and circuit synthesis routines do not build on false assumptions.

The scope of the results is specific:

  • The failure of the general odd-multiplier law does not affect the proven shear subfamily formula MC((1+2^s) x mod 2^n) = max(0, n-s-1).
  • The failure of kappa_sq(7) = 1 bounds the true catalyst overhead at n = 7 to {2,3}.
  • No prior-art claims are recognized for these candidate laws beyond the refuted formulations.

For everyone — the takeaway

What this means

Formulas that match small test cases can break down at larger bit-widths. Certifying minimal counterexamples prevents these flawed scaling laws from being used as foundations for modular arithmetic circuits or cryptographic cost estimators. Multiplicative complexity for these modular operations is higher and less uniform than the proposed formulas assumed.

Register references

  • MF-143
  • CONST-MULT-LAW.md
  • SQUARE-CATALYST.md

Every artifact named above is bundled in, or hashed by, this paper's evidence pack below.

Evidence pack

Everything needed to check this entry against its receipts: the register text, a manifest with a SHA-256 hash for every named receipt, and 0 of 2 receipt files bundled (1 KB). Anything not bundled is still hashed in the manifest and lives in the compute-box working trees.

Download evidence.zip

Changelog

Last reviewed 2026-09-04

  • 2026-09-04Published on this site.

Related in this programme