R1CS

Acronym: Rank-1 Constraint System. A circuit arithmetization based on matrix equalities: each matrix row enforces a constraint over linear combinations of the circuit’s wires.


⚠️ Prerequisites: Arithmetization, Circuit.

Rank-1 Constraint Systems (R1CS) are one way (amongst many others) to encode an arithmetic circuit. An R1CS circuit is defined by the following equation: where , and are square matrices of identical sizes, is a vector and ‘’ denotes the element-wise product.

The matrices , and are fixed and define the circuit. To satisfy the R1CS circuit, a prover must find a vector for which the equality above is true. We can also include public inputs by changing the game slightly: we choose a vector of public inputs and require that the prover finds a vector such that the vector satisfies the R1CS equality1. We call the instance vector and the witness vector.

R1CS in Action. You can see R1CS in action in Module 6 of the ZK Whiteboard Sessions from 7:56 to 12:00. There, Mary Maller shows how to populate R1CS matrices to enforce that a value decomposes into three bits by enforcing the following equalities: Note that she is working with a different yet equivalent matrix equation:

1 Here ‘’ denotes the concatenation operation.