Signals, constraints, and the arithmetic field

Why this matters

In Circom, everything is a signal and every signal lives in a prime field (default: BN254's scalar field, a ~254-bit prime). You cannot use negative numbers, floating points, or strings — only integers mod p. You cannot use != directly; you must express 'not equal' via an inverse existing. You cannot use modular arithmetic other than mod p; 'x mod 2' is a dozen constraints. This is the single largest source of beginner frustration, and internalising 'everything is a field element' early saves weeks of confusion.

Demo

Three idioms every Circom programmer needs: IsZero (1 if input is 0, 0 otherwise), IsEqual (1 if a == b, 0 otherwise), and Num2Bits (decompose a field element into its bit representation). These are in circomlib; rewriting them yourself is how you learn the field-arithmetic mindset.

pragma circom 2.1.6;
 
template IsZero() {
    signal input in;
    signal output out;
    signal inv;
 
    // If in != 0, we must show an inverse exists.
    // If in == 0, out = 1 and the constraint degenerates to 1 === 0 + 1 ✓
    inv <-- in != 0 ? 1 / in : 0;      // witness-only hint
    out <== -in * inv + 1;             // the actual constraint
    in * out === 0;                    // forces out = 0 when in != 0
}
 
template IsEqual() {
    signal input a, b;
    signal output out;
    component iz = IsZero();
    iz.in <== a - b;
    out <== iz.out;
}
 
component main = IsEqual();
// Witness: a=5, b=5 → out=1. Witness: a=5, b=7 → out=0.

Try it yourself

1. Run IsZero with in=0: confirm out=1. Run with in=5: confirm out=0. The two-constraint trick (multiply by inv, then force to zero) is one of the most used patterns in circomlib.
2. Count the constraints of IsZero by snarkjs info. Should be 2. IsEqual wraps IsZero and adds a subtraction — 2 constraints total. These numbers matter when you're building bigger circuits.
3. Try writing IsZero WITHOUT the <-- line — compile fails, because inv has no witness-gen rule. This is why <-- and <== are separate operators.
4. Write a LessThan template (for small inputs). Hint: first convert inputs to their bit decomposition (use circomlib's Num2Bits), then compare bit-by-bit.
5. Read circomlib/circuits/comparators.circom end-to-end. Count how many templates are built from IsZero as primitives.

Prompt your AI

Use these three in order. Each builds on the one before.

1. Basics & terminology

In one paragraph, explain why in Circom everything is a field element over BN254's scalar field, what operations are free versus expensive in constraints, and why comparisons are not natively available.

2. Why it works (the mechanism)

Walk me through IsZero step by step: why the witness-hint inv uses `<--` not `<==`, what constraint `in * out === 0` enforces, and why this pattern is zero-knowledge.

3. Advanced — application & what's next

I'm implementing a circuit that needs to check a SHA-256 hash against a value. Walk me through why SHA-256 is expensive in Circom (bit decompositions, XOR as (a+b-2ab)) and whether I should switch to Poseidon for ~30× cheaper hashing.

References

• Circom 2 Documentation — Getting Started
• iden3 — snarkjs README
• 0xPARC — Circom Workshop (Ya-Wen Jeng)
• Vitalik — QAPs from Zero to Hero