1970-01-01

(2026-03) S-two Whitepaper

• [[Dan Carmon]]
• [[Lior Goldberg]]
• [[Ulrich Haböck]]
• [[Leonardo Lerer]]
• [[Ilya Lesokhin]]

2026-03-16

• #cryptography
• #paper

Abstract

This whitepaper describes S-two, a circle STARK (Haböck, Levit, Papini 2024) over the Mersenne prime field with modulus $p =2^{31} -1$. We formalize the "flat AIR" circuit model, a modern arithmetization paradigm used by several contemporary zero-knowledge virtual machines, and we provide an in-depth security analysis of our proof of proximity for flat AIRs. For the latter, we highlight the importance of "cross-domain correlated agreement", a notion which is crucial for taming the soundness error of multi-table proofs. We show that multi-table circle FRI satisfies this notion up to the Johnson bound of the code, and we discuss two plausible conjectures on the list-decodability and line-decodability of Reed-Solomon codes, which are in alignment with the recent progress on proximity gaps.