Paper 2026/532

S-two Whitepaper

Lior Goldberg, StarkWare Industries LTD

Ulrich Haböck, StarkWare Industries LTD

Leonardo Lerer, StarkWare Instustries LTD

Ilya Lesokhin, StarkWare Industries LTD

Shahar Papini, Attestable LTD

Shahar Samocha, Attestable LTD

Abstract

This whitepaper describes S-two, a circle STARK (Haböck, Levit, Papini 2024) over the Mersenne prime field with modulus $p =2^{31} -1$. We formalize the "flat AIR" circuit model, a modern arithmetization paradigm used by several contemporary zero-knowledge virtual machines, and we provide an in-depth security analysis of our proof of proximity for flat AIRs. For the latter, we highlight the importance of "cross-domain correlated agreement", a notion which is crucial for taming the soundness error of multi-table proofs. We show that multi-table circle FRI satisfies this notion up to the Johnson bound of the code, and we discuss two plausible conjectures on the list-decodability and line-decodability of Reed-Solomon codes, which are in alignment with the recent progress on proximity gaps.

Note: Updated author list

@misc{cryptoeprint:2026/532,
      author = {Dan Carmon and Lior Goldberg and Ulrich Haböck and Leonardo Lerer and Ilya Lesokhin and Shahar Papini and Shahar Samocha},
      title = {S-two Whitepaper},
      howpublished = {Cryptology {ePrint} Archive, Paper 2026/532},
      year = {2026},
      url = {https://eprint.iacr.org/2026/532}
}