Quadratic Residues and the Failure of Zero Knowledge Positivity Proofs over BN254

Nagaraj (arXiv:2608.09087v1) proposes a zero-knowledge circuit over a prime field that attests the positivity certificate α_self·I + γ·A_sym ≻ 0 through a Cholesky witness, and states that the proof system is complete and sound. We show it is neither when instantiated over the BN254 scalar field, a standard field for Groth16. We prove an exact acceptance criterion: the circuit accepts a symmetric S if and only if each ratio of consecutive leading principal minors, reduced mod p, is a nonzero quadratic residue with a positive signed representative. That condition is unrelated to the true signs of the minors. For the paper's three-agent star topology with α_self = 1/10, we give two counterexamples. At γ ≈ 0.10997, above the exact threshold of 0.1, an indefinite encoded S (smallest eigenvalue ≈ −16640.92) has an accepting witness. Conversely, every diagonal entry equals α_self, and both natural encodings of 1/10 are quadratic non-residues mod p. The circuit therefore rejects every configuration, including γ = 0. The flaw lies in the arithmetization, not in Groth16. We suggest a repair based on range-checked integer arithmetic and Sylvester's criterion, and release code that reproduces every number.

Note: A follow-up paper implementing and proving the repaired construction (range-checked integer arithmetic with Sylvester's criterion) is in preparation. Source code reproducing every number in this paper is included in this version (Askey-2026-BN254-reproduction.zip; run instructions in README.txt). Contact: 0rei@tuta.io