zkStudyClub - cqlin: Efficient linear operations on KZG commits [Liam Eagen, Blockstream Research]

Transcript

this meeting is being recorded hello everyone welcome back very excited to welcome Liam Eagan from blockstream research he's going to be presenting some new work some joint work that he's done with Ariel gabazam on cqm so with that uh over to you Liam hi um yeah so cqlin uh this is a new protocol um for uh Lin check in linear time in the uh size of the witness Vector so I guess I'll just get right into it motivation so wind check um many people are probably familiar you

want to check that a vector satisfies a system of linear constraints very common um sort of sub problem in snarks um yeah and so many approaches to this for example like Marlin um take time linear in the sparsity of the Matrix right so the linear constraints that you want to satisfy prove your time depends on how many entries of the Matrix are not zero um we would like uh you know to have um prove your time depend only on the dimension of the vector uh rather than the number of non-zero entries um because uh if the Matrix is dense

then the number of non-zero entries will be quadratic in the dimension of the vector an example of where this is useful would be in zkml where you have a lot of dense matrices that you want to multiply by vectors um so yeah um this uh problem sort of implicit in earlier work the GK mmm paper um which is uh protocol for rank one constraint system but if you just sort of consider the The Matrix part the linear part rather uh you get an O of n Lin check

protocol in the dimension of the vector um but it has a trusted setup that depends on the size of the Matrix and it has a cubic setup time so our our my work um does not depend on the size of the Matrix for The Trusted setup and has a quadratic set of time so just some background on the techniques um that we used for this uh Ariel went on the Zero knowledge podcast and gave a talk at the ZK Summit about this Trilogy of snark protocols um and so this works cqlin would be kind

of in the the third part of his Trilogy so the first uh phase is um like uh terminated with say growth 16 where you can use pairings to get a very efficient verifiers and approvers without using the PCP theorem but you need a trusted setup per circuit um then the there was a second kind of wave of snark protocols like Planck and Marlin and these use polynomial commitment schemes and the advantage of this is that you kind of abstract the pairing away and sort of put it inside of the polynomial commitment scheme

and as a result of only using polynomial commitment schemes you only need a single trusted setup for um any Circuit of a at most a certain size um Liam real quick uh there's a question in the chat uh Dara which is are we generally assuming Square matrices I'm assuming referring to the prior slide are we assuming Square matrices without loss of generality uh yeah yeah um yes throughout the slides and in the paper we assume Square matrices but that's mostly just like a simplifying assumption um like it it is true that you could put a rectangular Matrix inside of a square Matrix but you could

also modify the protocol to handle rectangular matrices uh directly but yes um yeah so uh polynomial commitment schemes yep and then the Third Kind of chapter of the snark Trilogy um re-uh or breaks the abstraction right so we abstracted the pairing into the polynomial commitment scheme and then you break the abstraction and and revisit pairings directly so the sort of classic example uh beginning this chapter would be where you can use the pairing to do really efficient lookup arguments and then there was a

sequence of lookup argument papers that I think terminated in CQ which was kind of the predecessor work for CQ Lin which I guess makes sense with the name um yeah so uh what other applications benefit from breaking this abstraction and and using pairings for more than just polynomial commitment schemes with pre-processing uh cqlin so preliminaries I'll go through this kind of fast I wasn't sure how much background to include in the slides but you know so we commit we see human as well as CQ use kcg commitments um they're they

don't work with other kinds of polynomial commitments so we use the bracket notation to commit to the polynomial f um and so kzg commitments allow you to prove that F evaluated at a equals B by um proving knowledge of this Q which if F of a equals B is a polynomial otherwise it would be a rational function um and so you can generalize this to proving f and g agree at multiple points if this Q is also a polynomial more preliminaries Omega root of unity

LaGrange polynomials um there's zero everywhere except for when I and J are the same so they're kind of like uh you know the unit vectors or identity Matrix columns we can encode a vector as a polynomial Point Wise by constructing a polynomial so that each root of unity to an ith power maps to the ith component of the vector and this is equivalent to writing the polynomial as a linear combination of LaGrange polynomials um and then this is just also a useful uh technique that we will use

um for for uh univariate some check so if you have your polynomial um and you want to sum its values at the roots of unity then it's sufficient to evaluate it at zero if its degree is less than n so so sparse commitments so the uh our goal remember is to get a linear time prover in the dimension of the vector but the Matrix itself will have in general N squared entries and so uh we're interested in sort of working with commitments to larger numbers of values

then the proverb has time to sort of consider um on their own and so in general we'll talk about the sparse commitment right so you have a polynomial which has degree D and in general if you want to commit to the polynomial you have to do D scalar multiplications say right you have to commit to uh its coefficients or something like this but sometimes we can have a polynomial of degree D that can be written as a linear combination of a smaller number of polynomials b i you know so there's NBI and that's less than D and so P can be a linear combination of these B polynomials and

uh yeah the values F of i f sub I are uh only non-zero uh very infrequently relative to the degree of the polynomial and the point of of this is that we can commit to uh P we can construct a commitment to p in of K time given pre-computed commitments to the basis polynomials um so K much smaller than D and we can construct a commitment to P much faster than if we were to say compute the coefficients of p as a degree D polynomial and commit to those let's assume that you're representing

the polynomials in LaGrange basis um so we we will uh later um but it actually works for any any bi um bi could be Powers they they will typically be uh LaGrange but yeah they could they could be anything um that bullet point is missing a the F's multiplying the B bracket but yeah that okay got it um one other question uh Liam is from protucian asking is the model basically uh piops so um a polynomial interactive Oracle groups is that right I think it's sort

of poiop stand for uh with the ability to query a degree to product uh of the Oracle polynomial it's in the chat too if you if I the way I read it was confusing okay hold on I'll try and answer yeah I can I can also just ask it um directly so basically the um so you said you know you're able to I guess uh you're using the pairings to take I guess a product of the polynomials right so is the model that you're I sort of querying um like if I have two articles sent by the proverb p and Q like if I want to query the product I can you know get the evaluations of both and you know get the product but I can also if I have a commitment to p and G1 and a commitment to q and G2 then I can try to

you know check an identity for example um by Computing the pairing between the commitment to P1 to p and Q um does that make sense yes yes um that will be a key right because evaluating P um would take uh D time because it's degree D so the pairing allows us to like you say take the product of two polynomials without um querying them directly yeah that was that was actually what I was trying to get at with my previous question because I was wondering what the the efficiency of operating on these polynomials was not balances as well okay uh I'll say there's a little plug that I

tried to formalize this and the lookup paper so there there's this model that protouche relates to your question and the point is in like the compilation from the abstract piop to a real protocol if you've only done degree two checks on certain polynomials then for those polynomials you don't need to pay for yeah for the time to to compute them like only the time to compute their their commitments okay okay yeah so on that note there is also I think um in the lunar paper the Explorer there I believe in the context maybe in a similar context where they also use G1 and G2 commit kgd

commitments to be able to check um yeah degree 2 relations without having to actually compute the product um so that might not be something you might want to see if there's any similarities there or ideas there that could be ported over yeah I mean I remember taking a look and uh yeah I don't actually I don't remember what my conclusion was but though I I remember still feeling like I need to to write down this model uh uh yeah like they didn't extract like an information theoretic component out of it um as far as I remember um uh so so again which paper that was is this a lunar paper okay I don't know the full name

lunar a toolbox for more efficient Universal and updatable snacks I'll put the link in the chat thank you awesome uh any other just uh questions on this topic or uh Leah are we good to let Liam continue yeah yeah sorry yeah no no it's all good uh I guess yeah Liam go ahead yep so um can commit to uh P um in omk time uh and then uh the important property for sparsity for our purposes is that it's linear

right so um P times F uh if F or if p is bi sparse then P times f is bi times F sparse um just by you know Distributing the F multiplication and you can kind of imagine that this is where the pairing might end up uh yeah so some simple examples of of what we can use sparse commitments to do is like degree checks so we want to show p is degree D but the um trusted setup has degree n uh we can compute for our basis these x times Big N minus D

um times the Bix which are of Maximum degree and then we can compute this this D value and check that P is no more than degree D um I guess that should probably be a less than or equal to d uh in the first bullet point but yeah so this is this is a way to check that P is of a degree no more than D in okay time um right because p is uh B sparse um then the next thing is opening say to fix value so we want to open p at zero um for example as part of some check say we can pre-compute the openings of all

of the the b i at zero and so for example in the case of LaGrange polynomials these can be computed very efficiently um and then similarly we can take Z as the F linear combination of the z i and check that P equals c just like that so these are some simple examples that are sort of useful later um so uh yeah and then a more complicated example is how we can use these sparse commitments in CQ so we have a table uh that in you know Point wise encodes a vector um TI should be and then we want to

prove that some value is in the table and um if we have then uh a right is LaGrange sparse so imagine a has mostly zeros everywhere except for the places of the table that we're interested in sort of reading so when we multiply a by the table it'll sort of pick out those parts of the table and the zero will cause the B on the right hand side to also be zero at the parts of the table that we're not interested in so a is LaGrange sparse by construction but we also know that b is LaGrange sparse because a is mostly zero

on the left hand side here um and then the interesting part for CQ is that Q is also in sparse um there's a set of Qi values which are defined there so that you can write Q as a linear combination um of these values by the the values of a so yeah so so if you were to take like the values of a at the points where it's not zero and you add up the right hand side or the left hand side and then the B will be those values times ti times the middle term and then Q will be the same values times the Q I added up

uh now for the CQ we can compute these Qi values using um the FK technique uh basically some DFT fft stuff over curve points uh in N log n time which is pretty cool and that lets us work with very large tables and we can compute a of x b of x and q of X all in little end time so that's independent of the size of the table and uh you know doesn't make sense to get deep into CQ but basically you can use this trick to encode uh the log derivative lookup

in um I guess it would be the polynomial a or yeah a and then ultimately you end up just summing over the values and since a is mostly zero there's only little n values to sum over and so we can use the same sort of some check sparse stuff that I talked about on the previous slide to do that efficiently um so yeah as far as commitment's very useful now we'll move on to the Lynn check problem so we fix an N by n Square Matrix m and uh given commitments to two vectors we want to show that M times a equals B

so goal is to do this in oven group and scalar operations and so since m is n by N A and B are both Dimension little n how so uh first we'll encode it as polynomials natural First Step then we're going to perform this m times a as a product of polynomials using uh the pairing and then we'll take advantage of the fact that m is fixed uh independent of A and B to pre-compute quotients for this product uh find sparse spaces for all the commitments so the quotients for example

would be part of that and then uh commit to everything using that basis and uh finally which I won't talk about too much I think it's sort of clearer maybe to write it using bivariate polynomials but everything can be done using univariate polynomials um so recall definition of matrix multiplication M times a is just a linear combination of columns of M so we can encode B and the columns as polynomials and then the Matrix equation holds only if this linear combination of

polynomials on the left equals B um and so now a matrix is sort of like a vector of vectors right it's a two-dimensional object and we can introduce a new variable and use the same sort of technique to encode The Matrix as this bivariate m and have its evaluations at y are the roots of unity at y be the columns and so simple code Vector a is a polynomial now the Matrix equation holds if this sum over the values of the polynomial a times the values of m

equals B uh now we can introduce this variable or this polynomial R which will just be the products so it's all the terms in this sum basically and uh this it turns out is equivalent to um R being M times a mod Y to the N minus 1 because uh you know that holds if and only if both sides are the same at all the roots of unity uh and then that is of course just equivalent to having the quotient okay so now our Matrix equation holds uh if this R is well formed as the product of M times

a mod Q or Moda y to the N minus one and um then if the sum of R over all the roots of unity gives B and the degree of R and Y is less than n and that final point is so that we can use the sum check to just evaluate r at y equals zero and then we'll check that it equals B so this is you know fairly straightforward I think you just sort of converting into polynomials um we would like to construct all these polynomials in a little end time um so we need to find a basis for each polynomial that is little n sparse and

it's worth noting here that um the the A and the B aren't super I mean they're not they're not super surprising that they would be sorry little and sparse um because they're just encoding vectors of Dimension n the interesting polynomials are R and Q because they're bivariate polynomials and so even if X and Y both only have degree n then there's a potential for N squared terms um so degree checks pretty straightforward um so this is how we can kind of compute R using

um a basis of little n polynomials so remember that R when you evaluate it at y being a root of unity should give a sub I times C sub I of x and uh here that's sort of exactly what we have on the right hand side because when we evaluate the LaGrange polynomial at different roots of unity it's zero except for when the root of unity uh is raised to the ith power and so evaluating at a particular y you would get the correct thing on the right hand side and notice that there's only little n of these commitments that we need in order to commit to R and sorry one thing uh CI here

I I think are there rows of M right um committing the roles of M I I think they're they're supposed to be columns I do sometimes mess up the indexing with rows and columns but uh yeah here so the CI come from these CI and so okay and then they go here and so yes the CI would be The Columns of M I believe uh yeah and so the CI can all be pre-computed um because we know m in advance and

since the CI can all be pre-computed you can pre-compute all of this and then during proving you only have to take these little n uh scalar multiplications then the sum check over the values of Y like we said can be done by having the openings of this value at zero um in the univariate case that's a little bit more complicated but not too much I think it makes sense to think of it more like this like sort of having an independent variable and opening it at zero but you know each of these openings at zero is just pretty computable like

we talked about uh in the much earlier slide and so once again Computing the PCG opening at zero can be done in little n scalar multiplications and so that just leaves the quotient and so how will we do the quotient um uh quick question uh from the chat do we only need or do we only actually need the CI not the original M and the context as it might be useful if the Matrix is private question from Dara um do we only need to see so we are

using Amex M of X y's uh so yeah uh the way this will ultimately will go is is the the verifier will have a commitment to um M and uh this well I guess this would end up being um actually more like uh this expression be pairing of uh the commitment a and then a commitment to M so I think in principle it should work for private matrices M yes private to the verifier um that sounds useful yeah yeah uh come on uh

okay so quotient I'm just looking at this I'm I'm trying to make sure that it's uh correct I think it's yeah I think it's fine okay so um this is very similar to the original CQ technique uh and so in in CQ you'd have your table here and you'd be multiplying it by LaGrange things LaGrange polynomials and then you'd have the values of the the table here and they would also be multiplied by LaGrange polynomials and then you have your quotient but in this case instead of having scalar values they're polynomials so the evaluation of M at Omega to the I will be CI and so this

expression holds mod Y to the N minus one and then there's some Q value that uh exists only um for this expression for each eye and if we have these Qi then uh we can take the sum over the AI values of this Qi to get a commitment to the the quotient polynomial and so yeah this is M times a so if you were to sum up all of these over the values of I this would this equation would be like multiplied by a times I and then we'd sum it so then a times I times L sub I

of a y will be a of Y and then we have M of X and then over here uh we we end up with the AI times c i x times l i y and that will give us exactly r and so yeah summing all of these equations over the AI will make this br will make this be M times a and then this become Q um basically by a definition right because this is how we Define q as R equals m times a of this times Q so that's how we compute the quotient in a little M little n time we just need commitments to these Qi now these Qi

don't depend on um A or B they depend only on The Matrix m so we can pre-compute them and uh yeah that's that's what we want it's our sparse basis it's it sort of sparse in the set of polynomials of degree n and X and Y so there's N squared terms like I said before um so to clean this up a little bit and make it into the paper version uh we prefer to use a univariate trusted setup rather than a bivariate trusted setup that's not a problem we can just substitute x to the N for y and uh everything pretty much works I mean it's you know worth

checking but it's it's a sort of makes sense right because the Y only ranges over uh n powers and so replacing it with X to the N means that so this say being a polynomial in X and Y becomes a polynomial in X and X to the N so it's a polynomial of degree sort of N squared and then we prefer to accept our input via a polynomial in X so after we make this substitution for y equals x to the N this polynomial a which is a polynomial in y will uh be like a polynomial in x to the

n and so if you for example wanted to chain this protocol to like multiply matrices in sequence or something like this you you'd need the input and output to be sort of have the same structure and so this is very straightforward we just can check that a of some random value equals F of that random value raised to the N because y equals x to the N uh I think that's right yeah and uh foreign yeah and so at a random point and these are both just polynomials of degree n so this can be checked in a little end time and uh

that's it that's that's all we need to do yes uh so why is X then should so it should it not be a of a to the N equals a of alpha to the N is f of alpha oh have I got I was just wondering the same thing I think this is right because uh so like a will be uh after we make this substitution it will only have terms of degree divisible by n oh sorry yeah yeah yeah uh

yep and so uh I guess any questions or that's that's mostly the protocol um from here I just had like future work stuff potential improvements that I'm interested in working on okay also I guess Ariel if you have any commentary you know since I know you're a co-author I mean feel free and share if you have any any commentary as well otherwise we can let Liam proceed with the rest uh yeah no no comments nailed it Liam all right absolutely all right um so

stuff I would like to improve upon or see improved upon um uh one natural generalization is uh moving beyond um just uh using the roots of unity um I mean obviously roots of unity are super convenient to work with but they don't always exist and um yeah being able to not depend on them would be great and I'm fairly confident this is uh doable um the only significant dependency on the roots of unity is the Aurora some check um you know evaluating at zero uh and

there are ways to get around that and then the uh of n log n and so if say you used co-sets of roots of unity you'd have something like of n times M Times log n plus log M squared or something like that but that would be good I think more practical um over a larger class of Curves and larger you know sets of matrices now that's also because you because you don't necessarily have a a set of route to Unity is the right size right right okay and also this in the context of CQ so for lookup arguments if you want say a lookup table size 2 to the 32 and you

don't have 2 to the 32 roots of unity or some product of values that's acceptably close to that using larger Vanishing sets uh would be cool and also yeah sorry you say that the only thing where you need roots of your it is for the sound check um the subject and the uh o of n log n um like fft algorithms um just like for setup and stuff uh I I believe so yeah um most everything else what's that like the the sound check you can do it without the roots of unity set

yeah yeah um so they interproved so that should be easy yeah I I think I think so um I haven't like worked it all out but it seems like it should work I continue a reference but where so for the ffts yet the regular yeah I I am interested in using um uh EC fft uh potentially for using um the set of whatever like x coordinates of the two Power Group um and that uh I believe has uh well I know it has n log n for certain

algorithms and I think those are sufficient for doing um uh generalizing these CQ cqln protocols to that set of Vanishing polynomials um yeah I think I think the question there is um does the the asymptotic um Improvement for EC fft um outweigh the um the constant Factor slider yeah I don't know I think it'd be cool to experiment though yeah yeah and so then uh just generally reduce work prover size trade-offs um as I've described it here it's all

sort of more abstract algebraic um equations of degree two and so there's lots of ways one can kind of play around with trying to put them into pairings and commitments to trade off proof size prover work etc that kind of stuff so that's maybe worth exploring um and uh then the big interesting one is improving the setup time or trusted setup size for sparse matrices so right now The Trusted setup has to be N squared right um and the setup time is also N squared but if we wanted to use this for like an r1cs Matrix that was very sparse that

would be undesirable we would prefer if it only required a trust that is linear in the sparsity and the setup time that only depends on the sparsity so uh interested to see if some of the techniques here or other stuff or just future work in general is able to improve on that while still retaining uh linear approver time only in the dimension of the vector um yeah and then just other applications of pre-computations and pairings I didn't have anything in particular in mind but yeah interested to work on that more

yep and that's it cool awesome thanks Liam um I know we've been kind of this has been more a free-form discussion but I guess at this point uh as at the end here do we have any does anyone have any lingering questions or comments on the protocol that Liam just presented oh uh yeah so I knew you had comments RL yeah yeah I I had actually I did right I lied I had a comment but I I wanted to say it well so I I did it a few minutes to so Liam if you if you could go back to the the slide where you uh you check that f is like an N or a is an nth power

was towards the end just oh yeah the final touches so yeah so just a cute little uh technical point so here we we have this polynomial capital A that is a polynomial of nth Powers but of degree roughly N squared and just in that a simple you know nice uh technical point that you can see in the paper is that you if you have a polynomial that's of f powers of degree N squared and you want to open it at a point that is uh uh wait actually now I'm seeing that even though I thought of it I'm saying it wrong uh

okay so so yeah you can open a polynomial of nth powers of degree N squared at a random Point Alpha in time of n so that's just a little Q technical point right because if you did it totally straightforward the kzg proof for a would would you you'd pay the prover would pay N squared at this point or is a different one stated where in Claymore Claymore uh uh I I don't know I mean uh yeah we did it in cql in but it that's uh you're saying maybe they they

do something similar uh yeah I mean I'm gonna ask this mainly for the benefit of anyone who views the video can you provide like a little context on that question no I'm just asking if the technique to open this uh kcg uh polynomial has uh so yeah I think if it is the same technique you introduce a new one uh it's it's it's a new one it's claimed for 4.3 in in the cql in paper okay it's it's a simple observation cool and I'll post the links to these

papers in the uh in the video uh description um did you was there more you wanted to add there Aria or um uh no that was it cool I didn't have um one question so is there a way to sort of extend this to work for lin eval instead of just Lynn check um [Music] for context uh so I guess Ariel knows about Lenovo um maybe the only other person in the chat who knows about an email uh but linear value basic so Lynn check says okay I have um this Vector uh this polynomial B which encodes the

product of M times a right um and I'm going to check that M times a equals B and the idea then sort of you can go ahead and use B wherever you would want like say to perform your Hardware check or whatever right um another way to do it is that instead of materializing B sort of directly answer queries to B by uh making queries to um sort of M times a and lineival is a protocol for sort of evaluating this this linear combination at the points of your choice so linear like you can construct it like in a similar way to to uh in sort of the sparse polynomial or uh and with complexity that grows with the number of non-zero entries um in a

similar way like how we do it from marlin so I was wondering if sort of um these techniques would also you know similarly extend to to line eval instead of Lynn check um I don't I don't know um maybe uh evaluating with the sparser polynomials can sometimes be tricky because um uh well like you can't um you know evaluate the polynomial directly uh like for example M would be too large but I I think it's it's plausible I don't know Ariel what do you think uh I don't know I it's a good question I

I have to think about it right the it's sort of like the question can we run the protocol without a commitment to B uh yeah I don't know good good question to think about um okay I have a question um suppose you're trying to use this in a um a snack or or some larger protocol that you want to be zero knowledge um would you just use um uh uh blinded kcg commitments or would you pads The Matrix with random values or how would you go about that

I'm not sure the paper doesn't do zero knowledge yeah yeah I mean it's it's focused on the components um rather than a full snack so that that's quite reasonable um yeah I think I think it should be possible to to do it similarly to how we do it in Marlin way sort of you your b and a polynomials you sort of randomize um then by adding in an appropriate multiple like a random multiple of the vanishing polynomial though I don't know if that'll like screw up any of the sparsity techniques or not and you can also do it by by sort of making the M like adding a dummy row at the end of M or something along those

lines that's a different way right okay by the way a separate question so if the Matrix has some structure says like you know um let's say a sumerical tree Matrix right so there's like the same hash function copied over and over again do you think in that case um there's ways to cut down on the pre-processing time um because it's not only is the Matrix sparse but it's very highly structured

so like in the I guess you know this problem is already solved by succinct Aurora that's about basically there's this paper um it's like a follow-up to the Aurora paper which has um a succinct line check for these succinct matrices but it has this unfortunate um dependence on these sort of um like your your field needs to have two different smooth subgroups um so like say three to the m and 2 to the N or something like that wondering if you know using these techniques maybe you can get rid of um that dependence um I don't know interesting yeah I don't know that sounds interesting uh I'll have to look at that

do you know why they need the two different smooth subgroups essentially sort of the decomposed the the structured Matrix into like um so let's say if you had a local tree Matrix right it's like a staircase Matrix of the same hash function sub Matrix repeat it again and again um so this sort of decomposed this into like a small um dense Matrix which is the hash function Matrix and like one very structured Matrix basically close to like the identity uh Matrix or something like that and then um to do this decomposition efficiently they basically apply like the Chinese remainder theorem to um so they encode The Matrix

um in the the full subgroups so three to the m times 2 to the n and then to go down to like the uh the subgroups corresponding to the two decomposed matrices you need to apply the Chinese remainder theorem it's a bit technical uh we probably didn't do a great job of explaining um why they need that requirement but yeah maybe if um you can take advantage of some structure in this in this setting this essentially like saying you have like a structured table in some sense yeah I think that would be interesting to look into I wonder if that kind of needing the two independent subgroups if you could use

like the the um what is it like the full torsion of an elliptic curve like if with EC fft if you had an elliptic curve with two independent subgroups of order two to the N or if they need to be co-prime maybe that wouldn't work I think the problem there is sort of usually the new arithmetic circuit would be over a ring as opposed to a field and then you run into some other issues maybe and did I get the right paper um that said guest based on the authors and uh yeah yeah that's right well yeah okay thanks thanks for pasting it yeah it's a bit of a opaque people to go through it's very written very

abstractly but uh the sort of when you drill down and make everything concrete the core technique is this Chinese remainder theorem decomposition hmm awesome any last questions for Liam or uh or Ariel I guess okay awesome uh I I have another question um have you tried to plug this into any existing sort of larger protocols no I have not uh implemented anything simple answer

well hopefully that leaves a lot of room for uh potentially other exciting work so um thank you very much Liam for presenting thank you uh Liam and Arielle for uh writing this putting this together and thank you everyone for being here and contributing to what I think was a great conversation foreign