Research · Papers · Adders, counters and the heap law · ML-068
Impossibility of Constant Absorption by Memoryless Scalar Carry Codes
No block with boundary state encoding scalar carry 0..4 beats 4 ANDs/col once carry 4 is reachable.
Published 2026-09-04
For everyone
Plain summary
When designing hardware for cryptography, engineers try to minimize multiplication operations (AND gates). A common approach to adding fixed numbers (round constants) is absorbing them directly into the adder circuit. Designers often split the addition into smaller blocks that only pass a basic running carry number between them.
This entry proves that strategy cannot break through the standard cost barrier. Once an addition constant allows a carry of 4, no block of any size can run on fewer than four AND gates per column if the boundary only sends the scalar carry (0 through 4). Changing how wires encode the carry at the input and output boundaries does not bypass this limit.
Result
Let an adder block operate over GF(2) in the XOR-free XAG cost model, computing modular addition with a fixed nonzero round constant. If the constant makes scalar carry value 4 reachable, no block of arbitrary width achieves fewer than 4 AND gates (products) per column under the constraint that its inter-block boundary state is a memoryless, fixed encoding of the scalar carry set {0, 1, 2, 3, 4}. The bound holds for arbitrary wire counts and holds when input and output boundary encodings differ.
Two related structural variants are dead:
- Treating the constant as a fifth summand, which yields Kummer carry count kappa = 32 at every width-32 split.
- The 92-gate nonstationary factor-toggle class, where an exhaustive one-hot SAT query across all 62 SHA constants returned UNSAT.
Setting and definitions
- Cost model: GF(2) XOR-and-inverter graph (XAG); multiplicative complexity counts AND gates (products), while XOR gates are free.
- Scalar carry boundary: An interface between consecutive bit blocks encoding strictly the integer carry value c ∈ {0, 1, 2, 3, 4}.
- Memoryless boundary: An interface where the state encoding depends solely on the current scalar carry value, passing no auxiliary state or history across the split.
- Kummer carry count kappa: The number of carries generated across digit additions.
Method
Structural analysis and exact solver verification established the bound and closed the candidate variants:
- Boundary encoding analysis proved that no wire configuration transmitting solely scalar state c ∈ {0, 1, 2, 3, 4} achieves amortized cost below 4 AND gates per column once carry value 4 is reachable.
- Kummer evaluation established kappa = 32 across all width-32 partition boundaries when modeling the constant as a fifth summand.
- SAT-based exact synthesis via a one-hot query over all 62 SHA round constants proved the 92-gate nonstationary factor-toggle architecture unsatisfiable (UNSAT).
Search logs and certificates are recorded in RECORD-CONSTADD92.md and RECORD-CONSTFREE.md.
Discussion
The lower bound applies strictly to slice boundaries that transmit only the scalar carry value. It does not constrain architectures with multi-column lookahead, non-scalar carry encodings, or state retained across block boundaries.
The result closes:
- Memoryless scalar carry boundary designs attempting constant absorption at < 4 ANDs/column.
- 5-to-1 constant-absorption reduction via fifth-summand splits.
- The 92-gate nonstationary factor-toggle class across SHA round constants.
The register records no prior-art claims or index corrections.
For everyone — the takeaway
What this means
Engineers cannot drop constant addition below four multiplications per bit if adder blocks only pass a basic carry number back and forth. To beat four multiplications per column, circuit designs must share richer structural state between blocks instead of reducing everything to a simple carry value.
Register references
- Entry:
ML-068 - Receipts:
RECORD-CONSTADD92.md,RECORD-CONSTFREE.md
Every artifact named above is bundled in, or hashed by, this paper's evidence pack below.
Evidence pack
Everything needed to check this entry against its receipts: the register text, a manifest with a SHA-256 hash for every named receipt, and 0 of 2 receipt files bundled (1 KB). Anything not bundled is still hashed in the manifest and lives in the compute-box working trees.
Changelog
Last reviewed 2026-09-04
- 2026-09-04Published on this site.