On Proving Pairings - Andrija Novakovic

Transcript

hello everyone today we have Andrea who will be talking about H improving B and welcome everyone H you can ask questions in the chat and also at the end of the presentation so yeah the floor is yours so feel free to start when you want yeah um so welcome everyone uh this is uh my joint work with Cam Igan uh from zeta function Technologies and blockstream so uh the paper is called on proving pairings and I think uh it's quite clear what we're trying to do so

uh we are de we kind of uh consider uh if it's possible to more efficiently prove the equality of some pairings um instead of just uh Computing the full pairing so uh just let me try to fix my slid okay so why in general do we care about this and what is the motivation so we see that there are more and more applications which are doing this kind of recursive setting so uh that are like verifying proofs of proofs and the most

very far efficient and like proof size pairings are uh proof size uh proofs are still pairing based so uh they are quite common uh a lot of projects are using them and uh we have this task to uh verify the pairing inside the snark in order to do the at least one step recursion uh there are other works to cons consider which are like um uh split accumulation and stuff like that to like postpone the pairing until the end but here we uh are like dealing with use cases where uh

literally we have to verify the proof the pairing proof in the snark and um this is uh what we are trying to to optimize and as a consequence of the result um there is also more efficient way to verify pairings on uh let's say lock chains uh which are like accepting uh STK proofs for something so a quite common technique and I think all the people who are here are very familiar with this that uh instead of

carrying whole computation inside the circuits we're kind of uh having this technique of like witnessing or hinting and I think that everybody uh at some moment saw this so instead of computing the whole inverse in the circuit um the prover can actually uh hint the inverse and then inside the circuit prove that it is indeed inverse by one multip application or instead of carrying like the whole uh uh Computing of the squared root let's say like uh he can also hint the result and then prove that uh X2 is equal Y and this is like more fundamental I think

and um uh if you look into like um p and NP complexity classes uh given like uh an instance it's always easier to check if it's satisfiable than like checking if some problem has solution in like uh full language so um the core idea of our paper was also to exploit this hint and make the verification of pairing um substantially uh faster and and uh uh smaller so uh again I guess a lot of

people here are familiar with what are the pairings so uh pairings are this very nice bilinear structure this bilinear mapping uh that we use a lot in snarks so intuitively we cannot multiply points on the curves we can only add them and pairings are this like magic function that allows us to multiply once and um for example we see usage of pairings in BLS signatures uh verification of kcg so all kind of um uh plish kind of systems which are using kcg Etc also gr 16

so a very like important um detail is that that when we are dealing with snarks and when we are verifying some pairing equations it always comes down into verifying if some products of pairings are equal so maybe like all of these examples are uh uh clear Showcase of that so uh just verifying that in the end result will be this multiplicative ident entity in the Target Group which is like one so um when we are verifying snarks we're

are very um like curious to see if some products of parings are equal um so yeah if you have any questions please type but I think this is uh quite common knowledge for our people uh from our industry so on High level how one compute pairing is or uh let's say Tate or eight pairing which are the most the most efficient pairings to compute and that we use uh in all these algorithms so given uh two points one from G2 one from G1 and some

specific curve parameter U uh the pairing computation is consistent of uh let's say two big parts so one part is called a Miller Loop and another part is called final exponentiation so uh the Miller Loop is this uh incremental algorithm which uh is doing a few operations so uh it evaluates uh lines through some accumulator points as we go because otherwise evaluating this devisor and curves uh with parameters that are safe for the discrete log to be

hard is just practically impossible so this is something very similar to Double and add algorithm so as you can see you're always squaring something you're evaluating the line and you're updating this accumulator as you go and whenever you find uh something that is one uh you kind of increment so this really is very similar to how double and that algorithm Works um the more efficient uh way to write this uh parameter uh of the curve viu is kind of in this I I not sure how people call it today like WF or uh let's

say this like kind of a ternary uh uh base where you have like minus one zero and one and if you can see the number of operations here depends uh on whenever the bit uh is one or uh minus one so we kind of want to have the parameter which gives us as lowest hemming weight as possible so when writing in this uh tary notation uh we in general achieve uh the smaller Hamming uh weight but it's kind of uh out of scope for what I'm trying to

present here so I'm keeping this algorithms very simple it works for for both versions but uh for the sake of Simplicity we have this uh easier versions of Miller loops and once the loop is done we have uh this uh exponentiation which happens on in the end which is called final exponentiation as you would guess and this is kind of a very um expensive to do and there are like a lot of papers that uh exploit the structure of the groups uh do a lot of very nice tricks to make this very

practical on the computers today and very fast to compute but still it requires a lot of uh uh a lot of uh steps to compute this and and we can speak about this for a very long time how to efficiently compute final exponentiation and all the tricks that there exist but again um we are not going to go there uh the main result of our paper is that we actually showed that if you want to prove that some pairings are equal you actually don't need final exponentiation um so you can fully omit

it it will be replaced with some small amount of multiplications we will see but general idea is that we are able to almost fully remove the computation of final exponentiation so uh let's see when are two uh T pairings equal okay so the main thing thing about Tate or eight pairings is that results are not unique and that they lie in uh this equivalence class which has uh like a

bit ugly notation maybe but we'll see in a second what does it mean so Computing uh pairing between two points let's call this result a z it gives us some art root of unity in the Target group call it Omega to di so some art root of unity and some element as you see from this equivalence class of this quotient which is some element raised to the r and r is the torsion group we use so uh we can say that this C is some art residue so as you can see as we know the pairings are like

bilinear operation so um if you can like uh if you move the the discrete logs of this uh of these points uh Etc you will always end up with same art root of unity here but you might get different C here okay so uh I think the example is the best to see so if you have another pair of points and if these two pairings are equal it actually does not mean that they're equal in the Target group it just means that their art roots of unity are equal but they have this different

art residue and you can see why they lie in the equivalence class so they have the same art root of unity and then I don't know call this a shift or something like that this uh different art root of um that they're multiplied with so conceptually what the final exponentiation will do so it will make this result unique so here if we divide these two the r roots of unity will cancel we will end up something uh some number C1 over C2 to d r and if we uh raise it to this number where due to the

case I embedding degree we will end up with one by little format here because U this number will be something to the r and then R and R cancel and you raise it to the qk minus one so again just by little fat it goes to one and final exponentiation like allows us to obtain unique results okay con actually what we prove or what our paper is about is that we show that if you want to prove the two pairings are equal you don't need to obtain this

unique result to do that before we go into very details uh probably again something that people are familiar with but um you don't want to compute this pairing and then final exponentiation and then disappearing and then final exponentiation and compare them because you will have to do two final exponentiations then or if you have more complex products uh of pairings let's say something as inro 16 you will have to do even more final exponentiations so it's quite inefficient so what we General do so let's say that we move this on the left

side so this equation goes on the left side we negate one of the points and then we compute the Miller loop on that and then in the end we compute the final exponentiation of this one result it's it since the pairing is like bilinear this does not affect our result at all so again this works for any like product of pairings I'm just for the sake of Simplicity keeping uh just two pairs of points so what we do as we go in the loop we just uh like run both accumulators for both pairs at the same time and there is

something also very important to note why multimer Loop is very powerful it is uh powerful because what we can do is by doing the same accumul the both accumulators in the same time instead of running one Loop and then another loop is very important because we kind of get these squarings for free so what do I mean by that and this will be very important as another optimizations or of our paper is that uh imagine that we run the Miller Loop first for uh first pair of points and then we obtain another

loop which we run for the second pair of points we multiply those results and we do final exponentiation in the end so we achieved something we removed one final exponentiation but during these two Loops at each step we had to do this F squared so by merging all Loops together we're actually squaring just once so you really start seeing the benefit of this as you accumulate more and more um pairs of points into a single Loop further there are other optimizations how to obtain uh the more efficient computation

of Miller Loop and it is by first accumulating all products of uh evaluated lines because there is a very nice uh structure of the element when you evaluate um this line in the P point it's always sparse element in Target group and it's more efficient to multiply sparse elements than sparse Time full element but again for the sake of Simplicity and conceptual overview of how the things work I'm leaving the the most simple algorithm uh to see uh where the main optimizations are obtained so as I said by moving everything on one

side side we achieve Computing only one final exponentiation in the end and by merging all Loops together we get all the we have to square just once instead of squaring for each pair of point and this is how uh things like how the state-ofthe-art things are working today okay so the most important like punchline of our paper is replace final exponentiation with the residue track okay so instead of so when we want to prove that two pairings or some product

of pairings are equal instead of proving that after we compute this multimill L and we do final exponentiation it gives us one we actually prove knowledge of some C such that product of Miller Loops or the result of computing multim Miller Loop is equal C Tod R and I'm not going to go into the all dilemas and uh small proofs that we have uh I'm you can look into the paper for details on or reach me and Liam but what we proved is that this is enough so if you can find this C that

means means that uh and I think it's clear from here that if you just raise this to the qk minus one over R this will indeed be one so here is the in the sense you don't actually need to carry the whole final exponentiation because if you know that it is some C Tod R then uh it's enough you can stop there and on the other side if the product if the result of multimill loop is actually not some art residue so if it has some uh art root of unity inside as I showed

here right like if it has some contribution from some root of unity um you cannot find such a c uh so you get you get this soundness so you cannot make a a wrong proof um with some C If the product of your pairings is not one and this is like the most important um thing to remember about this work so we are again hinting this c as we would hint the squar root or uh inverse uh in the previous examples so we are

hinting AR residue and we are proving that the result of multimill loop is this art residue instead of carrying the full final exponentiation to obtain one okay so just doing this is not completely enough to obtain uh some like uh crazy efficiency and the reason is that today like how you like the state-ofthe-art of computational full final exponentiation is very fast and there are is like a lot of tricks to obtain very fast and efficient computation of it so if we

would just witness or hint the C compute C todr it would work it would gain some benefits but like nothing substantial nothing worth mentioning so we have to go a step further and show how this can be optim a bit more in order to actually achieve some uh Improvement in the number of constraints okay so we said that R is our torsion group right and the modern pairings are also not Computing the multimar loop in the

number uh of bits of the torsion group there is this paper called op optimal pairing uh that proved actually that eight pairings what we have today are optimal and the idea is that instead of doing something with r you try to write r as a sum short linear combinations of Q where uh Q is the characteristic of the field we are working so we write r as a some linear combination of Q Powers why is this important because uh I'm not going to go there but raising elements to the Que in the field let's say which is called like

fenus operator uh where Q is the field or the characteristic of the field we are working with is extremely cheap so let's say uh without going into too many details that if we work over some field Q then a to the Q for any a is just a by the little fat theorem it's very easy to see so in general even in the extensions raising stuff to the like doing this fenus operator raising stuff to the Q or any Q Power is like way more efficient than any other uh exponentiation by some other number so the idea is to try to write

r as some linear combination of Q powers and then the exponentiation you have to do would be doing something smaller and then multiplying something times something that is raised to power of Q which is cheap I'll show the example in a minute and then uh we had to carry some other optimizations that I'll show you and then the final result that we were able to obtain is that full final exponentiation is replaced with just m fqk multiplications where m is the Hamming weight of the eight Loop count so M uh

like once we obtain this optimal Vector for optimal pairings if we look into the Hamming weight of it roughly that's how many multiplications we have to pay um and we fully removed the the the full the final exponentiation there are a few other multiplications but in general uh the thing is dominated by uh Computing this um M multiplications where m is the humming weight of the eight Loop G I'll show this in a second so let's see what do we gain by writing r as a linear combination of Q Powers

okay so from hassem U I think I might have a small mistake here maybe because I didn't build my slides again sorry so from the hasset theorem we know that uh let's where R is like the torsion subgroup or the number of points the order of the elliptic curve that we are working let's say in our case um is bounded this number the order of the curve and the the the characteristic of the field we're working is bounded by U this two time square root of Q okay so what can we

achieve we can you from here you can see that R can be computed as something depending on T and Q so instead of computing C to the r okay you can actually compute C to the T times C to the Q as I said c to the Q is very efficient to compute and we have to compute C to the T and we know that now T is something that is like Big O of s Square Q square root of Q so previous R was like uh let's say o of Q and now we

compute stuff in O of s² Cu so we get like 2x here um and this is kind of the general intuition what we want to achieve so the best is if we can write r as some linear combination of some AI * Qi and we try to minimize coefficients AI so then we would have to actually carry this square and multiply exponentiation algorithm for all AIS which we hope are very short as short as possible and then we again have to like

combine them with raising to the Q Powers which is very cheap that's the best what we can get so for the uh like just to show an example of how it looks for the BN family of curves so BN curves are parameterized by this let's say parameter x and q is G given by this polinomial order is given by this polinomial and the T which is called trace of herbus is this and here you can see that actually from the h bound that uh t plus r is like Q minus one because the only difference is in this uh

coefficient here 24 18 and then 18 + 6 so what I tried to say is that instead of raising to this polinomial when you put X and you obtain prime numbers Etc what you can actually do is raise to the T compute some inverse and then raise to the Q and it would be much faster to work raising with this than actually doing square and add for the whole this polinomial and I think it's clear that this polinomial is like much smaller than this polinomial from looking into it okay

so what this optimal pairings paper showed us and what do we do in practice today is the Miller Loop that we do is also not working with r but it's working with this optimal Vector that we can find that is uh given by solving some ltis which minimizes this coefficients AI okay for BN there are a few of these vectors one that is commonly used is this Vector so it's 6 x + 2 1 - 1 1 okay so if we look uh into this linear

combination we obtain this value Lambda which is 6X + 2 + Q - Q ^2 + plus Q cubed and the only like problem or I would say not the problem but the only difference is that actually this is not r as you can see this is some Lambda and you can prove that R always divides this Lambda okay so we wanted to write r as a linear combination of these but it's quite hard as you can already see R is smaller than Q so if we allow ourselves to write um to take some linear

combination and obtain result that divides are we're still good so in the sake of pairing you can still prove that um your pairing will be well defined non non degenerate and all the things you have to provide for pairings which I'm not going to go now for us for like the the paper that we are analyzing and what we are concerned of is that raising C to the Lambda will be much faster than raising C to the r okay so why is that as I said all these things here are very efficient to

compute like you can say almost nothing so in order to do c to the Lambda it will be dominated by Computing this uh C to the 6X + 2 or we can say it will depend on the number of bits that your X needs okay just for the sake of comparison if we do the trick from the h bound you would actually uh have to compute uh C to the T which would depend on x² so I think it's clear that from this uh computing something that depends on number of bits in X is again even more efficient than Computing something in

bits of x² okay um so here we obtain this optimal exponentiation ideally what we would like to have is that product of M like the result of our multimill Loop that we're Computing is equal to C to the Lambda and then we would be done like uh C to the Lambda would be very efficient to compute sadly for the uh example we gave which is like BM curve uh or in general it's not going to be always true so we said that it's you can prove that

R always divides Lambda so Lambda over R is like very is um uh well-defined uh integer and by the definition of embedding embedding degree which is K you you have that R divides Q to the K minus one so this is also well divin integer if we compute gcd of these two numbers we can show that product of multimar Loops will always be almost Lambda res so it will be Lambda over D residue or however we can call it and this is fine but still

not ideal because as we said the most benefit we would have if we compute C to the Lambda somehow okay in actually to do in order to do this uh now I don't know how people are familiar with like legender symbols and stuff like that but if you have let's say two non-s squared residues and you multiply them you will obtain Square residue and you can generalize this to other residues so what we show is that if you have something that is non de

residue and if you multiply this number with that non-de residue where this is also not de residue you will obtain something that is De residue if the final thing is inde De residue you can actually compute C to the Lambda okay so we showed that there always exist such number let's call it a that is not the residue such that if you scale the multimill loop then it will make it a Lambda residue then you can find this C Hint it and in

the circuit compute this optimal exponentiation okay so there are like a a few things that you might be concerned of and one maybe the most obvious is is this sound so yes you can also look into the paper or we can discuss that if you uh scale something with non deit residue in this setting it can still it still cannot like uh make your result of the pairing mailable in a sense that after the scaling if your pairings was not were not one how somehow to make them one so this is still completely fine to do and

when you look into how your curves how your like pairing friendly curves are defined you can always find uh like non de residue so it's complete it will always work in the case for the very famous b254 curve which everybody uses uh this D is equal three and it's easy to see that when you write all the numbers down that 27th roots of unity are not uh third residues so if you take some 27 root of unity and if you have uh some multimill Loop output that is not Lambda residue then multiplying it

with this 27 root ofinity or it Square will make it a LDA TR okay and then as a like a final optimization and um this has to do with the the trick I showed how in general we compute multimill Loop uh what you can do instead of proving that a times the multimar loop is equal C to the Lambda you can actually prove that 8 time a * multimer Loop time C to the minus Lambda is equal 1 and then what you can actually do so instead of initializing F to be one you

can initialize F to be C inverse and then as you you can see while Computing this you will also get squarings of C for free so in general you will multiply F by C only when this bit is not zero and this has to like this is connected to what I said that instead of doing full final exponentiation you have to do M multiplications where M was the humming weight of the curve

parameter so as you see whenever this bit is not zero which is one which adds one to its hming weight we have to do another multiplication otherwise in the like generic step of the loop we square and this C is squared together with it okay so when we finish everything we actually like accumulated computation of C to the minus Lambda together with the multimar loop and the end what we have to assert in the circuit or prove is just that a * f is equal 1 in the end so do not mix this with proving that

result of the multimar loop after full final exponentiation is one just for the Clarity we were doing this operation and then we were claiming that the result of that will be one by little FMA if our pairings are equal here as you can see there is no mention of the final exponentiation you never have to raise to this Q to the K minus one / R okay this was just some algebra to move stuff from the left to the right side and this all together uh like achieves uh what we claim that

in order to prove that some pairings are equal you actually don't have to carry the full final exponentiation until the end and I think from here it's clear that if you want to uh verify snark or sing on blockchain again instead of expecting the chain to execute the full final exponentiation whoever submit the proof can also hint the C this number and then actually um the the chain can use the C to check if this relation holds and then we don't

need to do full Final exponentiation on chain anymore uh we have to like pay for sending another extension field element and storing it on chain but we don't have to pay the computation of of full final exponentiation and um we might not need to store it always it will just exist while the function is executed so I think it's completely fine um another thing that we noted but this is kind of not fully new technique uh we know that some people that it's around for a while and uh libraries as arcworks are exploiting

it so if you pay like if you looked into the how the Miller Loop looks for example uh this lines that you have to compute they actually never depend on the point point the point from G1 so you have to compute these lines and then evaluate them in P but they never depend on the p which gives us even more structure to exploit so first thing we do is instead of computing lines in circuit we again allow prover to hint line coefficients let's call them Lambda and mu and then

in the circuit we just Pro that these coefficients indeed Define the correct line through two points or that it's correct tangent and the the the like biggest optimization comes when you have predefined G2 points and if you look closely to some of the formulas I had uh at the beginning uh if you have like a constant public key both G and G2 DX are predefined points in the case of uh kcg uh you again have just generator here and here you have G2 which exists once we do trusted setup and sorry I

mixed the notation I just um wanted to have notations how you in general see it in the papers for kcg BLS and Rod and also the points GMA and Delta will already be in the very fair key for GR that you obtain from running trusted setup and this Alpha uh this pairing is fully computable so you can just cach this point this GT element in the Target group so by looking into equations that we verified today we have almost all points that are like predefined so instead of computing them

every time we can build our circuit after We Run The Trusted setup right and we can hardcode this coefficients Lambda and mu in inside our circuit it's like we hardcode the verifying key okay and then we don't need to check that these lines are uh uh correct because everybody can compute them and check if circuit is correct we can say it's like the indexing phase of our uh of our scheme so uh we can just hardcode them and for example if you look into kcg where both points are predefined and we

know them uh you can fully remove all the arithmetic on the Twisted curve which is super cool right and yeah when you have all these techniques when you use uh the stuff we we presented in the paper uh we have some amazing people already uh working on it uh onor from EF killage he already implemented the technique in Halo 2 and for now we see like a two week speed up um Gaga guys also did the implementation depending on is it like

BLS full gr 16 or kcg for now they see like four or 5x speed up and all these um like all these uh Frameworks all the implementations that they Benchmark uh are using non-native field arithmetic so I think if we have a proof system that works over cycles of curvs and if we don't need to represent elements with like uh uh in the non-native uh in the non-native field which uh also adds like a lot of cost in uh very simple computations as additions um we can

benefit even more more from some techniques that are already uh already known uh which we also gave an overview of which we called randomized polinomial arithmetic so if you actually build a proof system which works over the cycles of Curves and has no um uh non- ative arithmetic we really think that uh the whole pairing can be computed in proved in like a couple of thousand of contraints and as I said as a consequence we also show that uh whenever you have like this computationally restricted environment

as blockchain you can also additionally hint stuff as we can see and um also remove full final exponentiation from Computing pairings and blockchains which I think happens a lot of time with all the BLS signatures and gr 6 improves and finally what Liam is working uh in alpen and we see some amazing progress there is that if you actually want to verify snars uh on bitcoin um you should definitely use these techniques and they have some amazing progress on the on the how much it will take to verify uh FF long or

graic improve uh on bitcoin so yeah um whenever you have the need to prove the pairing inside your circuit this method is like plug and play it does not require anything more any other assumptions wherever you proved the pairings inside the snark you can just use this and you will remove the most expensive part of computing um of computing pairings which is full exponentiation so yeah this uh this is um what we did with our paper and uh I'm happy to hear

all the questions now let me back okay yeah yeah thank you so much for the great presentation and yeah I will open my for people to ask questions there is a question in the in the chat H we can start with that too uh when you say minimize coefficient does this means minimal hemming weight um in general yes so your like square and multiply algorithm will uh depend on the humming weight but alog together it depends on how many bits you

need to write the exponent so it's not just uh about uh minimizing just summing weight you want as small as possible coefficients uh in this short linear combination Vector yeah and then they ask the something else I'm trying to count the number of hints needed so far looks like a and how many for the line in in the loop how many hints you have to send oh wait I how many for the lines so far

looks like a c and how many for the lines in the Miller Loop yeah so for uh how to say okay for a per step of multimill loop you have to evaluate two lines for pair of points so whenever you have a GJ point that is not predefined let's say the pair a * B in gr 16 you have to send uh line so sorry you have to send like a coefficients of tangent line per bit which for BN is like around 60 64 I forgot now and plus you have to send line for each you have to compute

line for each uh nonzero uh bit so so you have to hint two coefficients per uh number of bits that your eight Loop count has plus two coefficients per uh each one so it's like two coefficients times Hamming weight Hamming weight for BN I if I remember correctly was 27 and um the whole thing was the whole 8 slope count was 60 something bits so I don't know let's take upper bound of 100

and then um you will have uh 100 * two uh tanks and Hamming weight of what again okay the hemming weight of this Lambda Vector right so if you remember we computed this Lambda as a a short uh as a linear combination of Q powers so everything that had Q you could shift and do later so the first coefficient that didn't depend on Q okay in our case uh because everything else was one which was depending on 6X + 2 so you take the hemming weight of

that and you take the number of bits of that if you had like some other coefficient in front of some of the q's you would also have to account for that and I don't recall now but you have like three different versions of um the short vectors that you can obtain for BN and yeah I think the first one is maybe the most intuitive but like you have a few of them so yeah it's like Hamming weights and the number of bits of these AI coefficient that you use to obtain the short vector um some AI to the

QI um yeah I hope that this clarifies what you ask thanks maybe I'll I'll just unmute if that's okay to to continue the question to be a lot of uh thanks thanks that's helpful but okay so um it's a in other words it's a parameter that depends on the on the curve or the the the curves not on the particular pairing that I need to compute right yeah on the family of Curves you have yes okay so I just have to look up what it is for for my particular curve and yes for BN family of Curves we uh we got like uh this parameter is X which is your parameter of the curve uh that makes

sense thanks uh it's like a big O of X right uh the exact number was 6X + 2 thanks yeah I I hope this made sense like um it's a very like a lot of numbers are here and I can open the slides and show you again if you if you actually need something very specific oh that's okay I I'll get it from the paper when I when I do it actually I'll I'll do this for the sake of clarity um so let's look into the most basic Miller Loop here okay so the parameter U you have here will

be uh this 6X + 2 okay so if you oh yeah yeah I'm not sure are you sharing your screen moment I cannot see your screen either you cannot no I can't um let me try to reshare again can you see it now no h i see that I'm sharing the screen yeah I see this that you're sharing the screen but I cannot see the screen okay that's interesting um should you

restart or yeah now I can see it perfect so uh this optimal Vector for BN was this okay so this 6X + 2 okay when you look into the Miller Loop this is the parameter that you have that you plug in here so let me take this algorithm just for one pair you can see that for every bit minus one but let's say for every bit you have to do one line here and then for every nonzero bit you have

to do another line right and so whether that bid is zero or non zero is a constant per curve right yes yes yeah okay okay thanks once you have the the curve you compute this and then you know so it's depending on like number of bits and the humming weight so those are like two Dimensions that you have to account thanks that's helpful and uh really nice presentation thank you yeah yeah thank thank you very much um I'll I'll leave this the screen if somebody else has any other questions yeah thank you and yeah we it looks like there is another

question yes so at our repository uh geometry research you can find the rust code that will uh compute the hint so C and A mainly the the line hints are like very easy and both garaga and Halo to implementations should like are open source so uh if anybody has them handy uh feel free to drop uh otherwise we can link them later yeah yeah you're still sharing the screen so yeah yes yeah maybe I to Google a bit and I don't have them so

yeah we can find later and yeah and there is a link oh yeah honor uh awesome thank you uh my chat is not scrolling automatically oh yes yes yes yes yes and and yeah okay so yeah I'll I'll link you my implementation for the the witnessing for the hint computation ler yeah more questions yeah can wait one more

minute but thank you very much for the great presentation and the paper and all the word you do thank you very much um yeah if no other questions um you can always us on X or wherever and we will have we will yeah it looks like there are not more questions so thank you again and thank you everyone for joining thank you yeah here and um yeah see you around thank you and have a nice day yeah nice day everyone yeah byebye Everyone by