rank-1 constraint system (R1CS)

A Rank-1 Constraint System (R1CS) is the standard intermediate format that turns an arithmetic circuit into a list of simple equations a SNARK can digest. Every constraint has exactly one multiplication, written in the form (A · s) × (B · s) = (C · s), where s is the solution vector containing the constant 1, the public inputs, and all the private witness values, and A, B, C are coefficient vectors selecting linear combinations of s. The name "rank-1" refers to that single product per constraint: each row multiplies two linear combinations and equates the result to a third.

Encoding a computation in R1CS means breaking it into one multiplication at a time. To prove you know x such that x^3 + x + 5 = 35, you introduce intermediate wires — let v1 = x·x, then v2 = v1·x — and write each as its own rank-1 constraint, plus a final linear constraint forcing v2 + x + 5 = 35. The full circuit becomes a set of such rows; a witness satisfies the system if and only if every row's product equation holds. Additions and constant multiples are absorbed for free into the A/B/C linear combinations, which is why R1CS counts cost in multiplication constraints.

R1CS is the input that Groth16 and other QAP-based SNARKs consume: the three coefficient matrices are interpolated into polynomials, and satisfying all constraints simultaneously becomes a single polynomial divisibility check. Newer systems like PLONK use a more flexible "PLONKish" arithmetization with custom gates and lookups instead of pure R1CS, but R1CS remains the canonical teaching model and the native format of widely used toolchains like Circom and snarkjs.