Log — Cryptography Wiki

Append-only history. Entries start ## [YYYY-MM-DD] <op> | <title>, where <op> is ingest, query, quality or split.

[2026-08-15] split | cryptography-wiki created from _inbox (3 sources)

Spun out by the hub router when flock arrived and completed a cluster that diamond-io (parked 2026-07-28) and binius (parked earlier the same day) had held at 2. All three had been declined by every existing spoke with the same finding: no spoke owned cryptography. A grep across all 35 spokes before the split returned zero pages mentioning SNARKs, zero-knowledge, Keccak or Reed–Solomon — a missing subject, not a missing link.

Domain chosen as cryptography as a constructive discipline, with succinct proof systems as the founding corner and concrete-efficiency as the through-line, rather than the narrower proof-systems framing: that would have fitted two of the three sources and orphaned the third, and the axis the three actually share is what a construction costs to run.

Boundaries recorded in CLAUDE.md are the reasons the records were declined elsewhere, kept so they are not re-derived: mathematics-wiki (theory taught from first principles there, constructions with benchmarks here), research-wiki (homonym — theorem proving is deductive machine-checked proof; a SNARK is a probabilistic argument about an execution), bit-manipulation-wiki (instruction-level integer technique), defensive-security-wiki (blue-team practice, not construction).

Founding pages: concrete-efficiency, succinct-argument, binary-fields, indistinguishability-obfuscation; sources flock, binius, diamond-io; entities irreducible, vitalik-buterin.

[2026-08-15] ingest | Flock: Fast Proving for Batch Boolean Computations

https://arxiv.org/pdf/2607.27491 arrived via Telegram (sent twice); the trigger source for the split. Bünz (NYU, Espresso), Rothblum (Succinct), Wang (NYU), arXiv 2607.27491v1, 2026-07-29, 45 pp. Extracted locally with pypdf. T1 — primary research; tier and trust are separate axes and the benchmarks are author-run. Headline: ≈250× overhead over native execution, 82k BLAKE3 / 42.1k SHA-256 / 30.7k Keccak-f per second on one M4 Max core (witness generation included), 661k BLAKE3/s on ten cores. ~9× Binius64 on SHA-256, 7× on Keccak multithreaded, 14× on BLAKE3, 1.8× Hashcaster, >500× NeutronNova. Proofs <450 KB at 2³⁰ AND gates; 100-bit soundness unconditionally at the IOP level, resting on SHA-256 for Merkle commitments and Fiat–Shamir. Method: Spartan-like PIOP for batch-R1CS over F₂; batching removes the permutation and memory-checking arguments general systems need, which makes the zerocheck the bottleneck and the target of the optimization work. New challenge points process log|F| bit claims in ~2 bit-shifts and XORs per input without tower fields. Limitations recorded in full: research prototype, batched Boolean R1CS only, glue circuit supported for hash chains and Merkle trees but not generally, tuned for Apple ARM, succinctness without zero-knowledge. Application claim: ~160 hashes per post-quantum signature ⇒ hashing for ~4,000 tps at ten-core BLAKE3 throughput, against Buterin's 200k-hashes/s estimate; a full Bitcoin block of 5,000 SHA-256 signatures in under 2.5 s. The paper itself bounds the claim — hashing only, no execution or state access. Noted for ../agentic-tooling-wiki: the implementation was "co-designed by coding agents" and "heavily AI-assisted," with no detail and no hand-written baseline. Recorded as a claim, cross-linked, not paged here. Pages: flock; succinct-argument, binary-fields, concrete-efficiency created alongside.

[2026-08-15] ingest | Succinct Arguments over Towers of Binary Fields (Binius)

https://eprint.iacr.org/2023/1784.pdf parked in the hub _inbox earlier today, migrated here by the split. Diamond & Posen (Irreducible), IACR ePrint 2023/1784, 52 pp. Extracted locally with pypdf. T1. The version read cites 2024 work and benchmarks Plonky3, so it is a later revision under the 2023 URL — dated on the page. Construction: Brakedown adapted into a multilinear polynomial commitment for tiny fields with no embedding overhead, via block-level encoding that keeps plain Reed–Solomon instead of a concatenated code; binary-field ports of HyperPlonk's product and permutation checks and Lasso's lookup. Numbers: 8,192 Keccak-f, multithreaded, 5.90 s vs Plonky3's 13.8 s (Keccak) and 17.4 s (Poseidon); verify 0.100 s vs 0.525 / 0.644; single-threaded 65.3 s vs 71.2 / 120. Paid for with a larger proof, 5.574 MiB vs 4.010 MiB — the corpus's cleanest instance of the standing trade. Gap-relevance: supplies the baseline flock beats, and the field-size trend argument (256-bit groups → 64-bit Goldilocks → F₂) that binary-fields is built on. Pages: binius; irreducible paged as the recurring organization.

[2026-08-15] ingest | Obfuscation, part II: diamond iO (Buterin)

https://vitalik.eth.limo/general/2026/07/28/obfuscation_part_ii_diamond_io.html parked in the hub _inbox on 2026-07-28, migrated here by the split. T2 — an expert secondary source explaining someone else's construction; the diamond iO paper itself is not held, which is growth edge 2. Substance: iO encrypts a program so it runs on plaintext without exposing its logic. The conservative tech tree is blocked by "literally galactic runtime." Diamond iO reaches "planetary, rather than galactic runtime — still infeasible today" by modifying BGG+14 ABE and changing both the conditional-FHE-decryption mechanism and the input-encoding generation, at the price of evasive LWE and all-product LWE — assumptions Buterin himself calls "at the same time plausible… but also novel and risky," with evasive LWE non-falsifiable in Naor's sense. Its argued advantage is analyzability. Gap-relevance: it is the far end of concrete-efficiency and the reason the spoke's domain is cryptography rather than proof systems. Also opens the tension recorded in synthesis: analyzability as a security property pulls against the direction of the proof-system work, which stacks optimizations. Pages: diamond-io, indistinguishability-obfuscation, vitalik-buterin.

[2026-08-16] quality | First scorecard — healthy, skipped deliberately

Scored in the hub's daily cycle, one day after the split. Nothing was changed here.

9 pages · T1 2 / T2 1 · 0 orphans · 0 stale · 0 thin. The split left the spoke in the state ../QUALITY.md asks for: ranked ## Growth edges, standing caveats in CLAUDE.md (self-reported benchmarks, ePrint revised in place, security as a moving argument), and a scope boundary that was exercised the next day when the MacKay coding-theory build-out went to ../mathematics-wiki and not here.

The floor looks perfect and that is an artifact of size — no T3 or T4 because there are only three sources and all three are research papers. The real weakness is growth edge 1: every number in the spoke was produced by the people being measured. Promoted to the hub's ## Most wanted (#22) so it competes for research-pass budget rather than waiting for a source to arrive.

[2026-08-20] ingest | zk-Bench — the first number here that no competitor produced (via research pass)

Source: Ernstberger, Chaliasos, Kadianakis, Jovanovic, Orrù, Livshits, Gervais & Steinhorst, zk-Bench: A Toolset for Comparative Evaluation and Performance Benchmarking of SNARKs, ePrint 2023/1503, SCN 2024. T1: peer-reviewed, and the authors sit at TU Munich, Imperial, UCL, the Ethereum Foundation and CNRS rather than at a company shipping a prover. Read from the full PDF (UCL Discovery copy, 26 pages, extracted locally with pypdf) rather than the abstract.

Growth edge 1 half closed. The edge asked for a third-party evaluation or a standardized proving benchmark run by someone with nothing in the race, and this is one: 13 elliptic curves across 9 arithmetic libraries, 5 SNARK development tools, 5 named AWS instance types. The paper's own motivating sentence is the spoke's standing tension in the authors' words — "claimed results are generated in isolation, and omissions in details render them irreproducible."

What it changes. The finding is not that any published number is wrong; it is that a prover timing does not identify a system. The arithmetic library underneath is worth 14.02× on SHA-256 proving (gnark against snarkjs, same circuit, same curve), traced to a 9.44×/13.06× MSM gap in G1/G2 between gnark-crypto and ffjavascript. A tool's ranking reverses between two test vectors (halo2 8.64× slower than gnark on one, 1.09× faster on the other) through circuit optimizations alone. Hardware alone moves proving up to 50% compute-optimized or 40% memory-optimized. binius's headline margin over Plonky3 is 2.3×, so the confounders are larger than the effects this corpus has been comparing. Two arithmetic results also cut against received assumptions: BN254 scalar-field arithmetic is not consistently faster than BLS12-381's, and gnark-crypto beats blstrs on BLS12-381 by 1.83×.

Not closed, and why. The paper is 2023 work: Bellman, halo2, gnark, Circom and Starky over Groth16/Plonk/STARK, a generation before binius and flock, with no binary-field system in it. Its estimator is Plonk-only at 6–32% accuracy. Independence is established for the field and not for the systems this spoke holds, so the edge is re-specified — a third party running Binius against Flock, or either against Plonky3, on stated hardware — rather than struck. Half-close rule in ../QUALITY.md.

Integrated into concrete-efficiency (a headline number now has to state its arithmetic backend and instance type, not only what it traded) and into the synthesis tension on whose claims these are.

[2026-09-03] ingest | Contract-validated ZK benchmarking (ePrint 2026/1729)

Research pass, quality cycle, hunting hub most-wanted #22 on the day its cooldown expired.

contract-validated-zk-bench (T1) is the second independent benchmark this spoke holds and the first covering zkVMs: eight systems — Groth16, ICICLE, Halo2, Plonky3, Winterfell, Nova, RISC Zero with CUDA and Groth16 wrapping, SP1 with and without AVX — on 8 CPU cores plus CUDA. All three authors are at Brno University of Technology and none ships a prover.

Its contribution is conceptual before it is numerical. zk-bench showed that a prover timing does not identify a system, which raises the question of whether two systems expressing a workload differently are solving the same problem at all. This paper answers with workload-specific semantic contracts: the declared public claim is a structured object, and the host checks it plus the agent's verification flag before a result counts. Systems are compared on the claim, not on the circuit.

Findings recorded: Plonky3 and Winterfell smallest across-case proving time and RAM; Groth16 and ICICLE sub-kilobyte proofs; Winterfell lowest host verification time; zkVMs trading proof size and memory for programmability; GPU acceleration paying off only after fixed setup costs amortize.

Edge #22 half closed for the third time — no Binius, no Flock. Recorded as a pattern rather than a miss: independent harnesses in this field land one generation behind. A residue worth naming is that Plonky3 now leads the one independent harness that measures it while binius's own material claims 2.3× over Plonky3, and zk-bench measured a 14× confounder underneath both.

Not recorded: search summaries attribute throughput ratios over Plonky3 and Binius64 to BinarySpartan (Setty, ePrint 2026/1656); the abstract as read carries no such ratios, so they were left out. What the abstract does carry — BLAKE3 547,000 hashes/s, SHA-256 255,000 hashes/s, one SHA-256 of a 2 KiB message in 6.2 ms, and its borrowing of Binius64's byte lookup tables — is on the page. avoid-ai-writing run. Verify at the cycle's end-of-run gate.

[2026-09-28] ingest | PolyXOR128 (orlp/polyxor)

Via Telegram from Lucsw. T1 — GitHub repository, single commit, zlib license. This spoke's first source that is neither a proof system nor obfuscation: a keyed 128-bit universal hash, in the Carter–Wegman / NH / CLHASH lineage, aimed at fast integrity checking rather than proving anything or hiding anything. Runner-up spoke logged at the hub: ../bit-manipulation-wiki (the SIMD carryless-multiply dispatch is its territory; the scheme and the proven bound are this spoke's — see polyxor128 → Cross-spoke context, and ../bit-manipulation-wiki gets no page from this ingest).

Construction. 128-byte blocks, key material mixed in, split into four parts plus a parity-check fifth; each part hashed with a carryless-multiplication NH/CLHASH variant and XOR-accumulated in SIMD; after a 4 KiB key buffer is exhausted, the running hashes fold into a polynomial hash. Ten 64×64→128-bit carryless multiplies per 128 bytes — the same primitive operation (binary-fields, multiplication over GF(2)[x]) this spoke's proof-system corpus uses for polynomial commitment, now doing symmetric-key hashing instead.

The proof, and what checking it meant. A collision bound, (n/4096+3)/2¹²⁸ for n-byte inputs under a random independent key, formalized in Lean. LLMs wrote the Lean proofs; the author confirmed the Lean definitions match the Rust code and checked the final security-claim statements, but states plainly they have not checked the proof steps connecting the two — only that Lean's kernel accepts the proof with no hidden axioms. Recorded on the page precisely rather than rounded up to "formally verified."

Benchmarks are self-reported (130 GB/s Ryzen 9950X, 60 GB/s Apple M2 Pro) — flagged per this spoke's standing caveat, same as every number in the founding corpus. No third-party cryptanalysis exists; the README says not to use it where security is paramount.

Entity discovery. orson-peters (GitHub orlp) paged as a Person — better known for pdqsort (now the default unstable sort in Rust's and Go's standard libraries) than for this repository; entity-index found no existing node for him or for "PolyXOR"/"polymur-hash" before creating. His Polars affiliation is recorded in prose only, not paged (not domain-relevant). Budget used: 1 of 8.

New concept page: universal-hash — the spoke's first source in this primitive family, distinct from both SNARKs and indistinguishability-obfuscation; ties finalize_mac into the standard hash-to-MAC pattern (also how UMAC works).

Integration. binary-fields gets a new paragraph: the field-size argument now has an instance outside proof systems. synthesis gets a new thesis paragraph (this source's place in concrete-efficiency's trade pattern — a proven bound traded against zero third-party cryptanalysis), a new open question (does a machine-checked proof substitute for independent cryptanalysis, when the checking was this partial), and the ../bit-manipulation-wiki adjacency bullet now names this ingest as the worked boundary case.

avoid-ai-writing run in detect mode over the three new pages, then hand-edited (em dashes and bold brought down to match this spoke's established page conventions). npm run check:wikilinks clean.

[2026-10-04] research | edge 1 (#36) hunted, nothing at the bar

Quality-cycle research pass. Searched for a third-party run that holds a binary-field prover. The only candidate is still BinarySpartan (ePrint 2026/1656), and its PDF now returns HTTP 403 behind a Cloudflare challenge. An unsigned HackMD summary says the baselines were configured by Flock's own harness on an M4 Max. That summary is below the bar, so it is recorded in the synthesis as a lead and on no page. No page work.