Succinct Arguments over Towers of Binary Fields (Binius)

Benjamin E. Diamond and Jim Posen, both at Irreducible. IACR ePrint 2023/1784, 52 pages. The paper behind Binius, named in it as "an open-source production-grade Rust implementation of our protocol." The version read on 2026-08-15 cites 2024 work and benchmarks against Plonky3, so it is a later revision of the 2023 posting — ePrint papers change under their URL. Read from the PDF with pypdf.

The argument: keep shrinking the field

The paper reads recent SNARK performance as one trend. Elliptic-curve systems need groups of about 256 bits for standard security. ethSTARK and Plonky2 moved to 64-bit primes — Plonky2's Goldilocks, p = 2⁶⁴ − 2³² + 1, is a Solinas prime with an especially cheap modular reduction. Smaller fields mean cheaper arithmetic, smaller storage and better cache behaviour, and with fast hash functions in place of elliptic-curve primitives the FRI scheme commits 1 MiB roughly 7× faster than KZG over BN254. Polynomial commitment is most of a prover's cost, so that is most of the story.

Binius takes the trend "to its logical conclusion": F₂, the smallest field there is (binary-fields).

The obstacle it removes is embedding overhead. Earlier schemes had to lift a one-bit value into a large field element and pay for the space it did not use. Their adaptation of Brakedown commits small-field polynomials with none. Two candidate commitment schemes are given: one instantiating Brakedown with a concatenated code (Reed–Solomon outer, ad-hoc inner), and — preferred for prover efficiency and simplicity — a second using block-level encoding, which packs message elements into extension-field elements, encodes with plain Reed–Solomon, and tests contiguous blocks of columns rather than individual ones. On top of the commitment they port HyperPlonk's product and permutation checks and Lasso's lookup argument to binary fields.

Why binary fields make bit-heavy work cheap

Elements of F₂ᵏ are exactly k-bit strings, addition is XOR, and squaring is far cheaper than general multiplication because (x + y)² = x² + y² in characteristic 2 (the "freshman's dream"). Computations dominated by bitwise operations — SHA-256, Keccak-256 — are precisely what prime-field systems prove badly, and precisely what Ethereum rollups need proven in volume. The paper's stated target is generating "precisely those Keccak-256-proofs which critically underlie modern efforts to scale Ethereum."

The numbers, and the trade

Proving 8,192 Keccak-f permutations against Plonky3:

(single-threaded / multithreaded). Faster to prove, faster to verify, and larger proofs — 5.574 MiB against 4.010 MiB. The commitment benchmarks show the same shape. Recursive composition is the named route to buying the size back: prove with a fast large-proof system, wrap in a slow small-proof one.

That trade is the cleanest instance of the pattern in concrete-efficiency — a result here is almost never a free improvement, it is a swap between prover time, proof size and verifier time.

Its place in the lineage

Binius is the first of the two proof-system sources in this spoke's founding corpus, and it is the baseline the second one beats. flock (2026) measures itself against Binius64, a later Irreducible system, and reports being ~9× faster on SHA-256, 7× on Keccak and 14× on BLAKE3. It also rejects a specific choice made here: Flock's new zerocheck challenge points work without tower fields, which it calls less efficient than direct extensions of F₂. Towers are in this paper's title. See synthesis.

Tiering

T1 — primary research, the authors reporting their own construction. Tier and trust are separate axes (the convention ../programming-languages-wiki made explicit on 2026-08-05): the benchmarks are self-run on the authors' own implementation against systems they did not write, which is normal for the field and still not independent measurement.

Related

succinct-argument · binary-fields · concrete-efficiency · flock · irreducible · synthesis