Ashlar

An arithmetization-oriented hash function over large prime fields. Its degree engine is a Feistel chain of field squarings, surrounded by x^alpha rounds in a HADES frame.

The design question it answers is bits of CICO ideal degree per R1CS constraint. Squaring buys one bit per constraint, and one bit per constraint is a ceiling: a rank-1 constraint has total degree at most two, so a zero-dimensional CICO ideal presented by C of them has quotient dimension at most 2^C by the affine Bézout bound. Attaining the ceiling is a property to be checked per design, not a given — we measure the engine attaining it at six points, and two configurations we measured falling short of their own Bézout products.

This repository is the artifact for the paper. Paper: paper/main.pdf.

Headline numbers

metric	Ashlar	baseline	provenance
R1CS constraints, BN254 t=3, 2-to-1	191	Poseidon 243, Poseidon2 240	Ashlar measured in ark-relations; baselines derived from published schedules
EVM gas, 2-to-1, saturated optimizer	14,232	Poseidon 18,229	measured, forge --gas-report
native permutation, BN254 t=3	6.488 µs	Poseidon2 5.855 µs	measured, criterion medians with 95% intervals
native permutation, Goldilocks t=12	3.956 µs	Poseidon2 0.968 µs, RPO 4.789 µs	measured; the Goldilocks gap is conceded explicitly
Plonkish rows, fold-3 gate	58	Poseidon 66	measured from keygen_vk, not assumed

Every one of these is mapped to a driver command, a raw output file, a byte length and a SHA-256 prefix in artifact/MANIFEST.csv, including the runs that were abandoned at a stated budget. The paper's R1CS table carries a per-row provenance column separating measured from derived; so does the manifest.

Status

The artifact is assembled and self-auditing, but not yet deposited: there is no persistent identifier and no pinned public revision. Hashes make the manifest tamper-evident within this repository; they do not make it independently retrievable, and nothing here has been checked by anyone outside the project. Claims sourced to measurement should be read as unaudited submission claims. Appendix E of the paper says the same thing in the same terms.

Two things are open by the paper's own account: the 0 ∈ I branch of the multi-output degree formula was never run, and the general multi-output ideal degree of the normative permutation is unresolved.

Layout

path	contents
paper/	LaTeX sources and the built PDF
artifact/	the row-level manifest, its self-audit, and the deposit builder
validation/ashlar-final/	reference implementation, Rust crates, Solidity contracts, acceptance gates, constants, vectors, and the R1CS / native / EVM / Plonkish results
validation/ashlar-gb/	the Gröbner campaign (394 configurations) and the Anemoi calibration gate
validation/ashlar-bracket/	multi-output bracket measurements (42 configurations)
validation/truss-core/	shared field and linear-algebra backend (named for the design's first iteration; see the naming note in Appendix A.1)
checks/	the standalone checks the paper's proofs cite, with their recorded outputs

Reproducing

git clone https://github.com/aryaethn/ashlar
cd ashlar

python3 artifact/check_manifest.py       # audit the manifest itself; must exit 0

validation/ashlar-final/run_all.sh       # gates, constants, R1CS, native, EVM, Plonkish
validation/ashlar-gb/run_all.sh          # Gröbner campaign (calibration gate runs first)
validation/ashlar-bracket/run_all.sh     # multi-output bracket

Order matters inside run_all.sh: no timing or algebraic number is reported from an implementation that has not first passed its correctness gate, and the Gröbner harness reproduces a published Anemoi result before it computes any Ashlar number.

Individual proof checks:

python3 checks/35-floor-structure-verify.py    # Prop. 2(i) chain degrees
python3 checks/36-spec-conformance-check.py    # Appendix A alone reproduces the vectors
python3 checks/38-chunked-system-check.py      # chunked-engine boundary form
python3 checks/39-multivariable-cico-analysis.py
python3 checks/40-coefficient-hypotheses.py    # Lemma 4
python3 checks/48-mi-subspace-and-poseidon2-reconciliation.py

Rebuilding the paper

bash paper/build.sh

main.pdf is committed and is inside the deposit archive, so the build is pinned with SOURCE_DATE_EPOCH — an ordinary latexmk run would stamp a fresh timestamp into the PDF and change the archive digest without changing a source byte. Two clean builds produce byte-identical output.

Environment

Apple M2 (4P+4E), 8 GB, macOS 26.5.1. Rust 1.88.0 pinned via validation/rust-toolchain.toml with Cargo.lock committed; criterion 0.5, single-threaded, 3 s warm-up / 8 s measurement. msolve 0.10.1, SageMath 10.7 (libSingular). Foundry forge 1.7.1, solc 0.8.24, Cancun. Competitor crates: zkhash 0.2, Plonky3 p3-poseidon2 0.2, miden-crypto 0.10.3, tiny-keccak 2, sha2 0.10, poseidon-solidity 0.0.5, zemse/poseidon2-evm (commit 35c0707).

EVM gas is opcode-priced and therefore machine-independent. Everything else is same-machine, same-session, so ratios within a table are internally consistent and absolute microseconds are not portable.

No competitor was hand-rolled to fill a cell. Every competitor implementation is a maintained third-party package gated against a published or frozen test vector before any number from it is reported. artifact/README.md records the dated search protocol behind that coverage, including the four families that ship in a harness we examined and were nonetheless not measured.

History

The design's internal lineage runs Truss → Gusset → Gusset2 → Ashlar, and the reference implementation's seed strings still read Ashlar2; the seeds are reproduced verbatim in Appendix A.1 so the artifact matches bit for bit. The superseded crates are not published here. Development history lived in a separate repository under validation/ and was not carried over; this repository begins at the frozen manuscript.

Licence

Code MIT, manuscript CC BY 4.0. See LICENSE.