Limber: Low Overhead SNARKs for Integers from Any PCS

What it is

Limber is an "integer mod-PCS" construction from Jessica Chen, Lucas Xia, Wilson Nguyen, and Benedikt Bünz (NYU), published as IACR ePrint 2026/1635. It realizes the fingerprinting recipe from Zaratan (PKC 26) in practice, letting a SNARK prove integer relations (e.g., a·b = c + u·m) by reducing them to the same relation over a randomly sampled prime field.

How it works

Standard SNARKs are built over a fixed field, so computation involving integers or non-native fields (RSA moduli, foreign elliptic curves, etc.) must be emulated in-circuit, which is expensive and error-prone. Zaratan's fingerprinting approach instead proves the integer relation by checking it modulo a randomly chosen prime. Limber's contribution is an "integer mod-PCS" — a polynomial commitment scheme that commits to integer polynomials and opens their evaluations modulo a prime chosen after the underlying PCS's setup and commitment phases (the random prime can't be known in advance). Limber can be built generically on top of any standard field-based PCS, including ones defined over small fields, and achieves o(1) multiplicative commitment overhead asymptotically. A PIOP for integer R1CS over the random prime is then layered on top to yield the full SNARK.

Preconditions / Affected

Applies to SNARK system designers/implementers who need to handle non-native arithmetic — e.g., RSA accumulators, foreign-field elliptic curve operations, or hashing with non-SNARK-friendly functions like Poseidon2 over a different field. Relevant to anyone currently working around this with elliptic curve cycles or SNARK-friendly hash substitutions, or who has hit non-native arithmetization bugs (the paper cites 9 of 27 critical bugs in the 0xPARC/zkbugtracker as stemming from this class).

What to do

No code, library, or artifact link is given in the fetched content — this is a cryptographic construction described in a preprint, not a drop-in tool. Action here is evaluative: engineers building SNARK circuits with non-native arithmetic (RSA, non-native hashing, foreign-curve ops) should read the full construction to assess whether swapping in a Limber-based SNARK (on top of their existing PCS) could replace in-circuit emulation, given the claimed 15-30x speedup on RSA accumulator proofs and 24x on non-native Poseidon2 hashing versus circuit-based approaches.

Caveats

The page itself provides no implementation link, benchmark hardware/parameters, or security proof details — only headline speedup multipliers. The paper notes it was revised (2026-10-03) to update benchmark comparisons and add the Poseidon2 benchmark, meaning the numbers have already changed once and should be checked against the latest revision before citing.