In the zero-knowledge cryptography nomenclature, we have multiple representations of arbitrary computation suitable for submission to various proof backends (e.g. Groth16). Two specific examples spring to mind: rank-1 constraint systems (R1CS) and Algebraic Intermediate Representations (AIR).

What are these called?


1 Answer 1


I'd say, R1CS, PLONK and AIR are 3 different arithmetic circuit / constraints systems ("backends").

All of these characterize NP and work using arithmetic over finite prime fields.

Other languages that characterize NP are for example 3-SAT. So it should be possible to define ZK with a 3-SAT backend:


An interesting side question would be: why are arithmetic circuits seemingly preferred to SAT based ones? One possible answer: using arithmetic circuits allows to use advanced math available, eg compressing polynomials

Also compare to the verifier-based definition of NP:

"Given any instance I of problem Π \Pi and witness W, if there exists a verifier V so that given the ordered pair (I, W) as input, V returns "yes" in polynomial time if the witness proves that the answer is "yes" or "no" in polynomial time otherwise, then Π \Pi is in NP." (wikipedia)


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.