00:29:57 <kayabanerve[m]> > Our arguments achieve 6.6× and 11.4×
00:29:57 <kayabanerve[m]> improvement in proving and verification efficiency for 𝑁 = 64, respectively, while
00:29:57 <kayabanerve[m]> incurring only 50% additional communication cost
00:30:18 <kayabanerve[m]> https://eprint.iacr.org/2022/1251
00:30:22 <kayabanerve[m]> UkoeHB: 
00:47:45 <selsta> kayabanerve[m]: are these a bulletproofs replacement?
00:48:20 <selsta> ok, yes, should have looked at the paper :P
00:51:48 <kayabanerve[m]> Yes
00:52:46 <selsta> so basically we would have to check how it comapres to Bulletproofs++
00:53:17 <kayabanerve[m]> + and ++ were size savings on original IIRC
00:53:27 <kayabanerve[m]> I don't believe they changed perf
00:53:38 <selsta> not only size, see https://github.com/monero-project/research-lab/issues/101
00:54:05 <kayabanerve[m]> So sure, its not only 50℅ but will be 60℅ or whatever
00:57:57 <kayabanerve[m]> Interesting
01:03:30 <kayabanerve[m]> I get roughly the same results for 2 outputs 
01:04:39 <UkoeHB> hmm
01:04:53 <kayabanerve[m]> Ah. I used a dumb mode. Base 16 shared has a massive fixed cost
01:06:52 <kayabanerve[m]> 51 for BP++
01:06:52 <kayabanerve[m]> 279 for BP+ base 16 inline
01:06:52 <kayabanerve[m]> 277 for BP+ binary
01:06:52 <kayabanerve[m]> Looks to be 5x for 2 outputs?
01:07:22 <kayabanerve[m]> This is claiming 11.4x BUT that may be for just one output 
01:07:52 <UkoeHB> I find it hard to believe the verifier can use fewer than N exponentiations
01:08:50 <UkoeHB> although it's true with BP batching you can amortize to fewer than N per range proof..
01:09:05 <UkoeHB> I think?
01:11:42 <kayabanerve[m]> UkoeHB: While I won't say this is reviewed, I will say Eagen is potentially revolutionary at this topic
01:12:49 <kayabanerve[m]> they have a lot of extremely performant ideas
01:13:00 <UkoeHB> this isn't an eagen paper
01:13:22 <kayabanerve[m]> I also didn't cite its performance here other than a multiplier
01:13:52 <kayabanerve[m]> > <@kayabanerve:matrix.org> 51 for BP++... (full message at <https://libera.ems.host/_matrix/media/r0/download/libera.chat/6cd6a4e0f651d3448c70861391d46bb36b06b31b>)
01:14:20 <kayabanerve[m]> I'm not sure flash proofs can be batched 
01:15:06 <kayabanerve[m]> *though yes, this claims just 30 ops for a range proof of 64 bits
01:15:23 <kayabanerve[m]> So this also claims <N
01:16:00 <kayabanerve[m]> kayabanerve[m]: I'm sure we could have it technically do a 128 bit proof, which may still be <51? But we'd be limited to just 3 outputs in an extremely weird system
01:18:41 <kayabanerve[m]> Page 19 discusses aggregation 
01:19:42 <kayabanerve[m]> It's written as 16 outputs taking ~320 operations. I'd have to check how well BP++ does there
01:35:17 <kayabanerve[m]> BP++ wins at 16 with 295. It's also only slightly slower at the one output level
01:35:31 <kayabanerve[m]> So looks like BP++ remains the path, but this is definitely interesting
01:52:48 <UkoeHB> kayabanerve[m]: back in 2019/2020 monero had 94% of txs as 1/2-in 2-out txs
01:54:22 <UkoeHB> would be nice to see some concrete benchmarks, nothing much I personally can do with the paper