  Zero-knowledge circuits are sets of equality constraints over arithmetic
expressions interpreted in a prime field; they are used to encode computations
in cryptographic zero-knowledge proofs. We make the following contributions to
the problem of ensuring that a circuit correctly encodes a computation: a
formal framework for circuit correctness; an ACL2 library for prime fields; an
ACL2 model of the existing R1CS (Rank-1 Constraint Systems) formalism to
represent circuits, along with ACL2 and Axe tools to verify circuits of this
form; a novel PFCS (Prime Field Constraint Systems) formalism to represent
hierarchically structured circuits, along with an ACL2 model of it and ACL2
tools to verify circuits of this form in a compositional and scalable way;
verification of circuits, ranging from simple to complex; and discovery of bugs
and optimizations in existing zero-knowledge systems.
