circom/doc/r1cs_bin_format.md
doc/r1cs_bin_format.mdRaw
1# Binary format for R1CS
2
3---
4eip:
5title: r1cs binary format
6author: Jordi Baylina <jordi@baylina.cat>
7discussions-to:
8status: draft
9type: Standards Track
10category: ERC
11created: 2019-09-24
12requires:
13---
14
15## Simple Summary
16
17This standard defines a standard format for a binery representation of a r1cs constraint system.
18
19## Abstract
20
21
22## Motivation
23
24The zero knowledge primitives, requires the definition of a statment that wants to be proved. This statment can be expressed as a deterministric program or an algebraic circuit. Lots of primitives like zkSnarks, bulletProofs or aurora, requires to convert this statment to a rank-one constraint system.
25
26This standard specifies a format for a r1cs and allows the to connect a set of tools that compiles a program or a circuit to r1cs that can be used for the zksnarks or bulletproofs primitives.
27
28## Specification
29
30### General considerations
31
32The standard extension is `.r1cs`
33
34
35A deterministic program (or circuit) is a program that generates a set of deterministic values given an input. All those values are labeled from l_{0} to l_{n_labels}
36
37This file defines a map beween l_{i} -> w_{j} and defines a series a R1CS of the form
38
39$$
40\left\{ \begin{array}{rclclcl}
41(a_{0,0}w_0 + a_{0,1}w_1 + ... + a_{0,n}w_{n}) &\cdot& (b_{0,0} w_0 + b_{0,1} w_1 + ... + b_{0,n} w_{n}) &-& (c_{0,0} w_0 + c_{0,1} w_1 + ... + c_{0,n}w_{n}) &=& 0 \\
42(a_{1,0}w_0 + a_{1,1}w_1 + ... + a_{1,n}w_{n}) &\cdot& (b_{1,0} w_0 + b_{1,1} w_1 + ... + b_{1,n} w_{n}) &-& (c_{1,0} w_0 + c_{1,1}w_1 + ... + c_{1,n}w_{n}) &=& 0 \\
43...\\
44(a_{m-1,0}w_0 + a_{m-1,1}w_1 + ... + a_{m-1,n}w_{n}) &\cdot& (b_{m-1,0} w_0 + b_{m-1,1} w_1 + ... + b_{m-1,n} w_{n}) &-& (c_{m-1,0} w_0 + c_{m-1,1}w_1 + ... + c_{m-1,n}w_{n}) &=& 0
45 \end{array} \right.
46$$
47
48Wire 0 must be always mapped to label 0 and it's an input forced to value "1" implicitly
49
50
51### Format of the file
52
53````
54
55 ┏━━━━┳━━━━━━━━━━━━━━━━━┓
56 ┃ 4 │ 72 31 63 73 ┃ Magic "r1cs"
57 ┗━━━━┻━━━━━━━━━━━━━━━━━┛
58 ┏━━━━┳━━━━━━━━━━━━━━━━━┓
59 ┃ 4 │ 01 00 00 00 ┃ Version 1
60 ┗━━━━┻━━━━━━━━━━━━━━━━━┛
61 ┏━━━━┳━━━━━━━━━━━━━━━━━┓
62 ┃ 4 │ 03 00 00 00 ┃ Number of Sections
63 ┗━━━━┻━━━━━━━━━━━━━━━━━┛
64 ┏━━━━┳━━━━━━━━━━━━━━━━━┳━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━┓
65 ┃ 4 │ sectionType ┃ 8 │ SectionSize ┃
66 ┗━━━━┻━━━━━━━━━━━━━━━━━┻━━━━━┻━━━━━━━━━━━━━━━━━━━━━━━━┛
67 ┏━━━━━━━━━━━━━━━━━━━━━┓
68 ┃ ┃
69 ┃ ┃
70 ┃ ┃
71 ┃ Section Content ┃
72 ┃ ┃
73 ┃ ┃
74 ┃ ┃
75 ┗━━━━━━━━━━━━━━━━━━━━━┛
76
77 ┏━━━━┳━━━━━━━━━━━━━━━━━┳━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━┓
78 ┃ 4 │ sectionType ┃ 8 │ SectionSize ┃
79 ┗━━━━┻━━━━━━━━━━━━━━━━━┻━━━━━┻━━━━━━━━━━━━━━━━━━━━━━━━┛
80 ┏━━━━━━━━━━━━━━━━━━━━━┓
81 ┃ ┃
82 ┃ ┃
83 ┃ ┃
84 ┃ Section Content ┃
85 ┃ ┃
86 ┃ ┃
87 ┃ ┃
88 ┗━━━━━━━━━━━━━━━━━━━━━┛
89
90 ...
91 ...
92 ...
93````
94
95#### Magic Number
96
97Size: 4 bytes
98The file start with a constant 4 bytes (magic number) "r1cs"
99
100```
1010x72 0x31 0x63 0x73
102```
103
104#### Version
105
106Size: 4 bytes
107Format: Little-Endian
108
109For this standard it's fixed to
110
111```
1120x01 0x00 0x00 0x00
113```
114
115#### Number of Sections
116
117Size: 4 bytes
118Format: Little-Endian
119
120Number of sections contained in the file
121
122#### SectionType
123
124Size: 4 bytes
125Format: Little-Endian
126
127Type of the section.
128
129Currently there are 3 types of sections defined:
130
131* 0x00000001 : Header Section
132* 0x00000002 : Constraint Section
133* 0x00000003 : Wire2LabelId Map Section
134
135If the file contain other types, the format is valid, but they MUST be ignored.
136
137Any order of the section must be accepted.
138
139Example:
140```
1410x01 0x00 0x00 0x00
142```
143
144#### SectionSize
145
146Size: `ws` bytes
147Format: Little-Endian
148
149Size in bytes of the section
150
151### Header Section
152
153Section Type: 0x01
154````
155 ┏━━━━┳━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
156 ┃ 4 │ FieldDefSize ┃ FieldDef ┃ field Id
157 ┗━━━━┻━━━━━━━━━━━━━━━━━┻━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛
158 ┏━━━━┳━━━━━━━━━━━━━━━━━┓
159 ┃ 4 │ 00 00 00 00 ┃ bigInt Format
160 ┗━━━━┻━━━━━━━━━━━━━━━━━┛
161 ┏━━━━┳━━━━━━━━━━━━━━━━━┓
162 ┃ 4 │ is ┃ Id size ( Normally 4 (32bits))
163 ┗━━━━┻━━━━━━━━━━━━━━━━━┛
164 ┏━━━━┳━━━━━━━━━━━━━━━━━┓
165 ┃ is │ 01 00 00 00 ┃ nWires
166 ┗━━━━┻━━━━━━━━━━━━━━━━━┛
167 ┏━━━━┳━━━━━━━━━━━━━━━━━┓
168 ┃ is │ 01 00 00 00 ┃ nPubOut
169 ┗━━━━┻━━━━━━━━━━━━━━━━━┛
170 ┏━━━━┳━━━━━━━━━━━━━━━━━┓
171 ┃ is │ 01 00 00 00 ┃ nPubIn
172 ┗━━━━┻━━━━━━━━━━━━━━━━━┛
173 ┏━━━━┳━━━━━━━━━━━━━━━━━┓
174 ┃ is │ 01 00 00 00 ┃ nPrvIn
175 ┗━━━━┻━━━━━━━━━━━━━━━━━┛
176 ┏━━━━┳━━━━━━━━━━━━━━━━━┓
177 ┃ is │ 01 00 00 00 ┃ nLabels
178 ┗━━━━┻━━━━━━━━━━━━━━━━━┛
179 ┏━━━━┳━━━━━━━━━━━━━━━━━┓
180 ┃ is │ 01 00 00 00 ┃ mConstraints
181 ┗━━━━┻━━━━━━━━━━━━━━━━━┛
182
183
184````
185
186#### fieldDefSize
187
188Size: 4 bytes
189Format: Little-Endian
190
191Size of the field Definition
192
193Example:
194```
1950x00 0x0 0x00 0x00
196```
197
198#### fieldDef
199
200Field dfinition the first 4 bytes are the type in LE. 0x0000001 Ar prime fields.
201
202For the prime fields, the next bytes are the prime in variable length LE base 256 format.
203
204NOTE: This number is independent of the bigInt Format defined next
205
206#### bigInt Format
207
208Size: 4 bytes
209Format: Little-Endian
210
2110 Means that the Big Int are variable size LE.
212That is the First byte indicates the size and the remaining bytes are the number in little enfian (LSB first) base 256.
213
214Numbers from 1 to 16383 are fixed size Litle endian format base 256.
215
216Example:
217```
2180x00 0x00 0x00 0x00
219```
220
221#### Id Size (is)
222
223Size: 4 bytes
224Format: Little-Endian
225
226Size of the identifiers for wires, labels and constraints. In small circuits this is going to be 4 (32 bits)
227but can be increaset to 8 for bigger circiuits.
228
229The only possible numbers are 4 or 8
230
231
232#### Number of wires
233
234Size: `is` bytes
235Format: Little-Endian
236
237Total Number of wires including ONE signal (Index 0).
238
239#### Number of public outputs
240
241Size: `is` bytes
242Format: Little-Endian
243
244Total Number of wires public output wires. They should be starting at idx 1
245
246#### Number of public inputs
247
248Size: `is` bytes
249Format: Little-Endian
250
251Total Number of wires public input wires. They should be starting just after the public output
252
253#### Number of private inputs
254
255Size: `is` bytes
256Format: Little-Endian
257
258Total Number of wires private input wires. They should be starting just after the public inputs
259
260#### Number of constraints (m)
261
262Size: `ìs` bytes
263Format: Little-Endian
264
265Total Number of constraints
266
267### Constraints section
268
269Section Type: 0x02
270
271````
272 ┏━━━━┳━━━━━━━━━━━━━━━━━┓ ╲
273 ┃ is │ nA ┃ ╲
274 ┣━━━━╋━━━━━━━━━━━━━━━━━╋━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━┓ ╲
275 ┃ is │ wireId_1 ┃ V │ a_{0,wireId_1} ┃ │
276 ┣━━━━╋━━━━━━━━━━━━━━━━━╋━━━━━╋━━━━━━━━━━━━━━━━━━━━━━━━┫ │
277 ┃ is │ wireId_2 ┃ V │ a_{0,wireId_2} ┃ │
278 ┗━━━━┻━━━━━━━━━━━━━━━━━┻━━━━━┻━━━━━━━━━━━━━━━━━━━━━━━━┛ │
279 ... ... │
280 ┏━━━━┳━━━━━━━━━━━━━━━━━┳━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━┓ │
281 ┃ is │ wireId_nA ┃ V │ a_{0,wireId_nA} ┃ │
282 ┗━━━━┻━━━━━━━━━━━━━━━━━┻━━━━━┻━━━━━━━━━━━━━━━━━━━━━━━━┛ │
283 ┏━━━━┳━━━━━━━━━━━━━━━━━┓ │
284 ┃ is │ nB ┃ │
285 ┣━━━━╋━━━━━━━━━━━━━━━━━╋━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━┓ │
286 ┃ is │ wireId_1 ┃ V │ b_{0,wireId_1} ┃ │
287 ┣━━━━╋━━━━━━━━━━━━━━━━━╋━━━━━╋━━━━━━━━━━━━━━━━━━━━━━━━┫ ╲
288 ┃ is │ wireId_2 ┃ V │ b_{0,wireId_2} ┃ ╲
289 ┗━━━━┻━━━━━━━━━━━━━━━━━┻━━━━━┻━━━━━━━━━━━━━━━━━━━━━━━━┛ ╱ Constraint_0
290 ... ... ╱
291 ┏━━━━┳━━━━━━━━━━━━━━━━━┳━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━┓ │
292 ┃ is │ wireId_nB ┃ V │ b_{0,wireId_nB} ┃ │
293 ┗━━━━┻━━━━━━━━━━━━━━━━━┻━━━━━┻━━━━━━━━━━━━━━━━━━━━━━━━┛ │
294 ┏━━━━┳━━━━━━━━━━━━━━━━━┓ │
295 ┃ is │ nC ┃ │
296 ┣━━━━╋━━━━━━━━━━━━━━━━━╋━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━┓ │
297 ┃ is │ wireId_1 ┃ V │ c_{0,wireId_1} ┃ │
298 ┣━━━━╋━━━━━━━━━━━━━━━━━╋━━━━━╋━━━━━━━━━━━━━━━━━━━━━━━━┫ │
299 ┃ is │ wireId_2 ┃ V │ c_{0,wireId_2} ┃ │
300 ┗━━━━┻━━━━━━━━━━━━━━━━━┻━━━━━┻━━━━━━━━━━━━━━━━━━━━━━━━┛ │
301 ... ... │
302 ┏━━━━┳━━━━━━━━━━━━━━━━━┳━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━┓ │
303 ┃ is │ wireId_nC ┃ V │ c_{0,wireId_nC} ┃ ╱
304 ┗━━━━┻━━━━━━━━━━━━━━━━━┻━━━━━┻━━━━━━━━━━━━━━━━━━━━━━━━┛ ╱
305 ╱
306
307
308 ┏━━━━┳━━━━━━━━━━━━━━━━━┓ ╲
309 ┃ is │ nA ┃ ╲
310 ┣━━━━╋━━━━━━━━━━━━━━━━━╋━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━┓ ╲
311 ┃ is │ wireId_1 ┃ V │ a_{1,wireId_1} ┃ │
312 ┣━━━━╋━━━━━━━━━━━━━━━━━╋━━━━━╋━━━━━━━━━━━━━━━━━━━━━━━━┫ │
313 ┃ is │ wireId_2 ┃ V │ a_{1,wireId_2} ┃ │
314 ┗━━━━┻━━━━━━━━━━━━━━━━━┻━━━━━┻━━━━━━━━━━━━━━━━━━━━━━━━┛ │
315 ... ... │
316 ┏━━━━┳━━━━━━━━━━━━━━━━━┳━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━┓ │
317 ┃ is │ wireId_nA ┃ V │ a_{1,wireId_nA} ┃ │
318 ┗━━━━┻━━━━━━━━━━━━━━━━━┻━━━━━┻━━━━━━━━━━━━━━━━━━━━━━━━┛ │
319 ┏━━━━┳━━━━━━━━━━━━━━━━━┓ │
320 ┃ is │ nB ┃ │
321 ┣━━━━╋━━━━━━━━━━━━━━━━━╋━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━┓ │
322 ┃ is │ wireId_1 ┃ V │ b_{1,wireId_1} ┃ │
323 ┣━━━━╋━━━━━━━━━━━━━━━━━╋━━━━━╋━━━━━━━━━━━━━━━━━━━━━━━━┫ ╲
324 ┃ is │ wireId_2 ┃ V │ b_{1,wireId_2} ┃ ╲
325 ┗━━━━┻━━━━━━━━━━━━━━━━━┻━━━━━┻━━━━━━━━━━━━━━━━━━━━━━━━┛ ╱ Constraint_1
326 ... ... ╱
327 ┏━━━━┳━━━━━━━━━━━━━━━━━┳━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━┓ │
328 ┃ is │ wireId_nB ┃ V │ b_{1,wireId_nB} ┃ │
329 ┗━━━━┻━━━━━━━━━━━━━━━━━┻━━━━━┻━━━━━━━━━━━━━━━━━━━━━━━━┛ │
330 ┏━━━━┳━━━━━━━━━━━━━━━━━┓ │
331 ┃ is │ nC ┃ │
332 ┣━━━━╋━━━━━━━━━━━━━━━━━╋━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━┓ │
333 ┃ is │ wireId_1 ┃ V │ c_{1,wireId_1} ┃ │
334 ┣━━━━╋━━━━━━━━━━━━━━━━━╋━━━━━╋━━━━━━━━━━━━━━━━━━━━━━━━┫ │
335 ┃ is │ wireId_2 ┃ V │ c_{1,wireId_2} ┃ │
336 ┗━━━━┻━━━━━━━━━━━━━━━━━┻━━━━━┻━━━━━━━━━━━━━━━━━━━━━━━━┛ │
337 ... ... │
338 ┏━━━━┳━━━━━━━━━━━━━━━━━┳━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━┓ │
339 ┃ is │ wireId_nC ┃ V │ c_{1,wireId_nC} ┃ ╱
340 ┗━━━━┻━━━━━━━━━━━━━━━━━┻━━━━━┻━━━━━━━━━━━━━━━━━━━━━━━━┛ ╱
341 ╱
342
343 ...
344 ...
345 ...
346
347 ┏━━━━┳━━━━━━━━━━━━━━━━━┓ ╲
348 ┃ is │ nA ┃ ╲
349 ┣━━━━╋━━━━━━━━━━━━━━━━━╋━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━┓ ╲
350 ┃ is │ wireId_1 ┃ V │ a_{m-1,wireId_1} ┃ │
351 ┣━━━━╋━━━━━━━━━━━━━━━━━╋━━━━━╋━━━━━━━━━━━━━━━━━━━━━━━━┫ │
352 ┃ is │ wireId_2 ┃ V │ a_{m-1,wireId_2} ┃ │
353 ┗━━━━┻━━━━━━━━━━━━━━━━━┻━━━━━┻━━━━━━━━━━━━━━━━━━━━━━━━┛ │
354 ... ... │
355 ┏━━━━┳━━━━━━━━━━━━━━━━━┳━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━┓ │
356 ┃ is │ wireId_nA ┃ V │ a_{m-1,wireId_nA} ┃ │
357 ┗━━━━┻━━━━━━━━━━━━━━━━━┻━━━━━┻━━━━━━━━━━━━━━━━━━━━━━━━┛ │
358 ┏━━━━┳━━━━━━━━━━━━━━━━━┓ │
359 ┃ is │ nB ┃ │
360 ┣━━━━╋━━━━━━━━━━━━━━━━━╋━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━┓ │
361 ┃ is │ wireId_1 ┃ V │ b_{m-1,wireId_1} ┃ │
362 ┣━━━━╋━━━━━━━━━━━━━━━━━╋━━━━━╋━━━━━━━━━━━━━━━━━━━━━━━━┫ ╲
363 ┃ is │ wireId_2 ┃ V │ b_{m-1,wireId_2} ┃ ╲
364 ┗━━━━┻━━━━━━━━━━━━━━━━━┻━━━━━┻━━━━━━━━━━━━━━━━━━━━━━━━┛ ╱ Constraint_{m-1}
365 ... ... ╱
366 ┏━━━━┳━━━━━━━━━━━━━━━━━┳━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━┓ │
367 ┃ is │ wireId_nB ┃ V │ b_{m-1,wireId_nB} ┃ │
368 ┗━━━━┻━━━━━━━━━━━━━━━━━┻━━━━━┻━━━━━━━━━━━━━━━━━━━━━━━━┛ │
369 ┏━━━━┳━━━━━━━━━━━━━━━━━┓ │
370 ┃ is │ nC ┃ │
371 ┣━━━━╋━━━━━━━━━━━━━━━━━╋━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━┓ │
372 ┃ is │ wireId_1 ┃ V │ c_{m-1,wireId_1} ┃ │
373 ┣━━━━╋━━━━━━━━━━━━━━━━━╋━━━━━╋━━━━━━━━━━━━━━━━━━━━━━━━┫ │
374 ┃ is │ wireId_2 ┃ V │ c_{m-1,wireId_2} ┃ │
375 ┗━━━━┻━━━━━━━━━━━━━━━━━┻━━━━━┻━━━━━━━━━━━━━━━━━━━━━━━━┛ │
376 ... ... │
377 ┏━━━━┳━━━━━━━━━━━━━━━━━┳━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━┓ │
378 ┃ is │ wireId_nC ┃ V │ c_{m-1,wireId_nC} ┃ ╱
379 ┗━━━━┻━━━━━━━━━━━━━━━━━┻━━━━━┻━━━━━━━━━━━━━━━━━━━━━━━━┛ ╱
380 ╱ ╱
381````
382
383
384
385#### Constraints
386
387Each constraint contains 3 linear combinations A, B, C.
388
389The constraint is such that:
390```
391A*B-C = 0
392```
393
394#### Linear combination
395
396Each linear combination is of the form:
397
398$$
399a_{j,0}w_0 + a_{j,1}w_1 + ... + a_{j,n}w_{n}
400$$
401
402#### Number of nonZero Factors
403
404Size: `ìs` bytes
405Format: Little-Endian
406
407Total number of non Zero factors in the linear compination.
408
409The factors MUST be sorted in ascending order.
410
411#### Factor
412
413For each factor we have the index of the factor and the value of the factor.
414
415#### WireId of the factor
416
417Size: `is` bytes
418Format: Little-Endian
419
420WireId of the nonZero Factor
421
422#### Value of the factor
423
424The first byte indicate the length N in bytes of the number in the upcoming bytes.
425
426The next N bytes represent the value in Little Endian format.
427
428For example, to represent the linear combination:
429
430$$
4315w_4 +8w_5 + 260w_{886}
432$$
433
434The linear combination would be represented as:
435
436````
437 ┏━━━━━━━━━━━━━━━━━┓
438 ┃ 03 00 00 00 ┃
439 ┣━━━━━━━━━━━━━━━━━╋━━━━━━━━━━━━━━━━━┓
440 ┃ 04 00 00 00 ┃ 01 05 ┃
441 ┣━━━━━━━━━━━━━━━━━╋━━━━━━━━━━━━━━━━━┫
442 ┃ 05 00 00 00 ┃ 01 08 ┃
443 ┣━━━━━━━━━━━━━━━━━╋━━━━━━━━━━━━━━━━━┫
444 ┃ 76 03 00 00 ┃ 02 04 01 ┃
445 ┗━━━━━━━━━━━━━━━━━┻━━━━━━━━━━━━━━━━━┛
446````
447
448
449### WireId2LabelId Map Section
450
451Section Type: 0x03
452
453````
454┏━━┳━━━━━━━━━━━━━━━━━━━┳━━┳━━━━━━━━━━━━━━━━━━━┓ ┏━━┳━━━━━━━━━━━━━━━━━━━┓
455┃is│ labelId of Wire_0 ┃is│ labelId of Wire_1 ┃ ... ┃is│ labelId of Wire_n ┃
456┗━━┻━━━━━━━━━━━━━━━━━━━┻━━┻━━━━━━━━━━━━━━━━━━━┛ ┗━━┻━━━━━━━━━━━━━━━━━━━┛
457````
458
459## Rationale
460
461Variable size for field elements allows to shrink the size of the file and allows to work with any field.
462
463Version allows to update the format.
464
465Have a very good comprasion ratio for sparse r1cs as it's the normal case.
466
467The motivation of having a map between l and w is that this allows optimizers to calculate equivalent r1cs systems but keeping the original values geneated by the circuit.
468
469
470## Backward Compatibility
471
472N.A.
473
474## Test Cases
475### Example
476
477Given this r1cs in a 256 bit Field:
478
479
480$$
481\left\{ \begin{array}{rclclcl}
482(3w_5 + 8w_6) &\cdot& (2w_0 + 20w_2 + 12w_3) &-& (5w_0 + 7w_2) &=& 0 \\
483(4w_1 + 8w_4 + 3w_5) &\cdot& (6w_6 + 44w_3) && &=& 0 \\
484(4w_6) &\cdot& (6w_0 + 5w_3 + 11s_2) &-& (600w_6) &=& 0
485\end{array} \right.
486$$
487
488And a Wire to label map.
489
490$$
491w_0 := l_0 \\
492w_1 := l_3 \\
493w_2 := l_{10} \\
494w_3 := l_{11} \\
495w_4 := l_{12} \\
496w_5 := l_{15} \\
497w_6 := l_{324} \\
498$$
499
500The format will be:
501
502````
503 ┏━━━━━━━━━━━━━━┓
504 ┃ 72 31 63 77 ┃ Magic
505 ┣━━━━━━━━━━━━━━┫
506 ┃ 01 00 00 00 ┃ Version
507 ┣━━━━━━━━━━━━━━┫
508 ┃ 03 00 00 00 ┃ nSections
509 ┗━━━━━━━━━━━━━━┛
510 ┏━━━━━━━━━━━━━━┳━━━━━━━━━━━━━┓
511 ┃ 01 00 00 00 ┃ 49 00 00 00 ┃ SectionType: Header
512 ┗━━━━━━━━━━━━━━┻━━━━━━━━━━━━━┛
513 ┏━━━━━━━━━━━━━━┳━━━━━━━━━━━━━┓
514 ┃ 25 00 00 00 ┃ 10 00 00 00 ┃ FieldDefSize FieldDef
515 ┣━━━━━━━━━━━━━━┻━━━━━━━━━━━━━┻━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
516 ┃ 20 010000f0 93f5e143 9170b979 48e83328 5d588181 b64550b8 29a031e1 724e6430┃
517 ┣━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛
518 ┃ 00 00 00 00 ┃ Big Int format
519 ┣━━━━━━━━━━━━━━┫
520 ┃ 04 00 00 00 ┃ Id Size
521 ┣━━━━━━━━━━━━━━┫
522 ┃ 07 00 00 00 ┃ # of wires
523 ┣━━━━━━━━━━━━━━┫
524 ┃ 01 00 00 00 ┃ # Public Outs
525 ┣━━━━━━━━━━━━━━┫
526 ┃ 02 00 00 00 ┃ # Public Ins
527 ┣━━━━━━━━━━━━━━┫
528 ┃ 03 00 00 00 ┃ # Private Ins
529 ┣━━━━━━━━━━━━━━┫
530 ┃ e8 03 00 00 ┃ # Labels
531 ┣━━━━━━━━━━━━━━┫
532 ┃ 03 00 00 00 ┃ # Constraints
533 ┗━━━━━━━━━━━━━━┛
534 ┏━━━━━━━━━━━━━━┳━━━━━━━━━━━━━┓
535 ┃ 02 00 00 00 ┃ 8b 00 00 00 ┃ SectionType: Constraints
536 ┗━━━━━━━━━━━━━━┻━━━━━━━━━━━━━┛
537 ┏━━━━━━━━━━━━━━┓ Constraint 0: (3w_5 + 8w_6) * (2w_0 + 20w_2 + 12w_3) - (5w_0 + 7w_2) = 0
538 ┃ 02 00 00 00 ┃
539 ┣━━━━━━━━━━━━━━╋━━━━━━━━┓
540 ┃ 05 00 00 00 ┃ 01 03 ┃
541 ┣━━━━━━━━━━━━━━╋━━━━━━━━┫
542 ┃ 06 00 00 00 ┃ 01 08 ┃
543 ┗━━━━━━━━━━━━━━┻━━━━━━━━┛
544 ┏━━━━━━━━━━━━━━┓
545 ┃ 03 00 00 00 ┃
546 ┣━━━━━━━━━━━━━━╋━━━━━━━━┓
547 ┃ 00 00 00 00 ┃ 01 02 ┃
548 ┣━━━━━━━━━━━━━━╋━━━━━━━━┫
549 ┃ 02 00 00 00 ┃ 01 14 ┃
550 ┣━━━━━━━━━━━━━━╋━━━━━━━━┫
551 ┃ 03 00 00 00 ┃ 01 0C ┃
552 ┗━━━━━━━━━━━━━━┻━━━━━━━━┛
553 ┏━━━━━━━━━━━━━━┓
554 ┃ 02 00 00 00 ┃
555 ┣━━━━━━━━━━━━━━╋━━━━━━━━┓
556 ┃ 00 00 00 00 ┃ 01 05 ┃
557 ┣━━━━━━━━━━━━━━╋━━━━━━━━┫
558 ┃ 02 00 00 00 ┃ 01 07 ┃
559 ┗━━━━━━━━━━━━━━┻━━━━━━━━┛
560
561 ┏━━━━━━━━━━━━━━┓ Constraint 1: (4w_1 + 8w_4 + 3w_5) * (6w_6 + 44w_3) = 0
562 ┃ 03 00 00 00 ┃
563 ┣━━━━━━━━━━━━━━╋━━━━━━━━━┓
564 ┃ 01 00 00 00 ┃ 01 04 ┃
565 ┣━━━━━━━━━━━━━━╋━━━━━━━━━┫
566 ┃ 04 00 00 00 ┃ 01 08 ┃
567 ┣━━━━━━━━━━━━━━╋━━━━━━━━━┫
568 ┃ 05 00 00 00 ┃ 01 03 ┃
569 ┗━━━━━━━━━━━━━━┻━━━━━━━━━┛
570 ┏━━━━━━━━━━━━━━┓
571 ┃ 02 00 00 00 ┃
572 ┣━━━━━━━━━━━━━━╋━━━━━━━━━┓
573 ┃ 03 00 00 00 ┃ 01 2C ┃
574 ┣━━━━━━━━━━━━━━╋━━━━━━━━━┫
575 ┃ 06 00 00 00 ┃ 01 06 ┃
576 ┗━━━━━━━━━━━━━━┻━━━━━━━━━┛
577 ┏━━━━━━━━━━━━━━┓
578 ┃ 00 00 00 00 ┃
579 ┗━━━━━━━━━━━━━━┛
580
581 ┏━━━━━━━━━━━━━━┓ Constraint 2: (4w_6) * (6w_0 + 5w_3 + 11w_2) - (600w_6) = 0
582 ┃ 01 00 00 00 ┃
583 ┣━━━━━━━━━━━━━━╋━━━━━━━━━┓
584 ┃ 06 00 00 00 ┃ 01 04 ┃
585 ┗━━━━━━━━━━━━━━┻━━━━━━━━━┛
586 ┏━━━━━━━━━━━━━━┓
587 ┃ 03 00 00 00 ┃
588 ┣━━━━━━━━━━━━━━╋━━━━━━━━━┓
589 ┃ 00 00 00 00 ┃ 01 06 ┃
590 ┣━━━━━━━━━━━━━━╋━━━━━━━━━┫
591 ┃ 02 00 00 00 ┃ 01 0B ┃
592 ┣━━━━━━━━━━━━━━╋━━━━━━━━━┫
593 ┃ 03 00 00 00 ┃ 01 05 ┃
594 ┗━━━━━━━━━━━━━━┻━━━━━━━━━┛
595 ┏━━━━━━━━━━━━━━┓
596 ┃ 01 00 00 00 ┃
597 ┣━━━━━━━━━━━━━━╋━━━━━━━━━━━━━┓
598 ┃ 06 00 00 00 ┃ 02 58 02 ┃
599 ┗━━━━━━━━━━━━━━┻━━━━━━━━━━━━━┛
600
601 ┏━━━━━━━━━━━━━━┳━━━━━━━━━━━━━┓
602 ┃ 03 00 00 00 ┃ 1c 00 00 00 ┃ Wire to Label Map
603 ┗━━━━━━━━━━━━━━┻━━━━━━━━━━━━━┛
604 ┏━━━━━━━━━━━━━━┓
605 ┃ 00 00 00 00 ┃
606 ┣━━━━━━━━━━━━━━┫
607 ┃ 03 00 00 00 ┃
608 ┣━━━━━━━━━━━━━━┫
609 ┃ 0a 00 00 00 ┃
610 ┣━━━━━━━━━━━━━━┫
611 ┃ 0b 00 00 00 ┃
612 ┣━━━━━━━━━━━━━━┫
613 ┃ 0c 00 00 00 ┃
614 ┣━━━━━━━━━━━━━━┫
615 ┃ 0f 00 00 00 ┃
616 ┣━━━━━━━━━━━━━━┫
617 ┃ 44 01 00 00 ┃
618 ┗━━━━━━━━━━━━━━┛
619````
620
621And the binary representation in Hex:
622
623````
62472 31 63 77
62501 00 00 00
62603 00 00 00
62701 00 00 00 49 00 00 00
62825 00 00 00 10 00 00 00
62920 010000f0 93f5e143 9170b979 48e83328 5d588181 b64550b8 29a031e1 724e6430
63000 00 00 00
63104 00 00 00
63207 00 00 00
63301 00 00 00
63402 00 00 00
63503 00 00 00
636e8 03 00 00
63703 00 00 00
63802 00 00 00 8b 00 00 00
63902 00 00 00
64005 00 00 00 01 03
64106 00 00 00 01 08
64203 00 00 00
64300 00 00 00 01 02
64402 00 00 00 01 14
64503 00 00 00 01 0C
64602 00 00 00
64700 00 00 00 01 05
64802 00 00 00 01 07
64903 00 00 00
65001 00 00 00 01 04
65104 00 00 00 01 08
65205 00 00 00 01 03
65302 00 00 00
65403 00 00 00 01 2C
65506 00 00 00 01 06
65600 00 00 00
65701 00 00 00
65806 00 00 00 01 04
65903 00 00 00
66000 00 00 00 01 06
66102 00 00 00 01 0B
66203 00 00 00 01 05
66301 00 00 00
66406 00 00 00 02 58 02
66503 00 00 00 1c 00 00 00
66600 00 00 00
66703 00 00 00
6680a 00 00 00
6690b 00 00 00
6700c 00 00 00
6710f 00 00 00
67244 01 00 00
673
674````
675
676## Implementation
677
678circom will output this format.
679
680## Copyright
681
682Copyright and related rights waived via [CC0](https://creativecommons.org/publicdomain/zero/1.0/).
683