Research · Papers · What rank-one constraints can express · ML-085
R1CS lower bound for modular addition via quadratic degree bound
In auxiliary-free R1CS over F_p, enforcing b_{n-1} + 2c ∈ {0,1,2,3} for modular addition requires ≥ 2 quadratic constraint rows
Published 2026-09-04
For everyone
Plain summary
Zero-knowledge systems use systems of quadratic equations called R1CS to check computations over prime number fields. Modular addition wraps around when numbers exceed a power of two. When a circuit cannot use helper variables (auxiliary witness variables) for the top bits, the combined high bit and carry can take four valid values: 0, 1, 2, or 3. Because a quadratic equation has at most two roots, a single quadratic constraint cannot isolate four distinct solutions. This forces the system to use at least two constraint rows. This claim is an unproven conjecture with unstated assumptions, and it only covers designs that forbid helper variables.
Result
In an auxiliary-free R1CS over F_p, enforcing the high-order bit and carry relation b_{n-1} + 2c ∈ {0, 1, 2, 3} for modular addition r = (a + b) mod 2^n requires ≥ 2 quadratic constraint rows.
Setting and definitions
The cost metric is the number of R1CS constraint rows over a prime field F_p, distinct from GF(2) multiplicative complexity.
The arithmetic target is n-bit modular addition r = (a + b) mod 2^n. Individual booleanity rows b_i * (1 - b_i) = 0 constrain the low-order bits b_0..b_{n-2}. The affine term b_{n-1} + 2c combines the most significant bit b_{n-1} and the carry bit c. The auxiliary-free condition forbids allocating intermediate witness variables for high-order bits or carry relations.
Method
The algebraic degree-bound argument in wave2-zk-gadgets/zk_gadgets_sha256.py cuts out the target set S = b_{n-1} + 2c ∈ {0, 1, 2, 3}. A univariate quadratic polynomial over F_p has at most 2 roots and cannot define a 4-element set in one step. Isolating the four valid assignments without auxiliary variables therefore requires at least 2 quadratic constraint rows.
Discussion
This entry addresses sub-item ML-080 ii as a conjecture. The audit assigned an UNSTATED ASSUMPTION flag because the lower bound assumes standard bit representations and forbids auxiliary witness variables.
The bound is not unconditional. It does not rule out encodings that introduce auxiliary field witnesses or non-bit output representations. A formal specification of the auxiliary-free model remains pending. The register lists no prior-art position and no external value.
For everyone — the takeaway
What this means
Optimizing zero-knowledge circuits requires knowing the absolute lower limits on constraint counts. Without helper variables, modular addition needs at least two quadratic constraint rows for its top bit and carry because quadratic polynomials have only two roots. Since practical circuits often use helper variables, whether this lower bound applies to general circuits remains open.
Register references
- ML-085
- ML-080 ii
- wave2-zk-gadgets/zk_gadgets_sha256.py
Every artifact named above is bundled in, or hashed by, this paper's evidence pack below.
Evidence pack
Everything needed to check this entry against its receipts: the register text, a manifest with a SHA-256 hash for every named receipt, and 1 of 1 receipt files bundled (3 KB). Anything not bundled is still hashed in the manifest and lives in the compute-box working trees.
Changelog
Last reviewed 2026-09-04
- 2026-09-04Published on this site.