WEBVTT Kind: captions Language: en 00:00:00.000 --> 00:00:04.350 align:start position:0% foreign 00:00:04.350 --> 00:00:04.360 align:start position:0% 00:00:04.360 --> 00:00:18.370 align:start position:0% [Music] 00:00:18.370 --> 00:00:18.380 align:start position:0% 00:00:18.380 --> 00:00:20.689 align:start position:0% actually<00:00:19.380> I'm<00:00:19.619> gonna<00:00:19.740> talk<00:00:20.039> about<00:00:20.160> some<00:00:20.580> of 00:00:20.689 --> 00:00:20.699 align:start position:0% actually I'm gonna talk about some of 00:00:20.699 --> 00:00:23.630 align:start position:0% actually I'm gonna talk about some of the<00:00:21.199> algorithmic<00:00:22.199> optimizations<00:00:22.859> we<00:00:23.220> have<00:00:23.340> in 00:00:23.630 --> 00:00:23.640 align:start position:0% the algorithmic optimizations we have in 00:00:23.640 --> 00:00:25.670 align:start position:0% the algorithmic optimizations we have in Canal<00:00:24.359> that<00:00:24.539> makes<00:00:24.720> it<00:00:24.900> fast 00:00:25.670 --> 00:00:25.680 align:start position:0% Canal that makes it fast 00:00:25.680 --> 00:00:29.150 align:start position:0% Canal that makes it fast so<00:00:26.160> we<00:00:26.460> are<00:00:26.640> a<00:00:26.760> team<00:00:27.000> of<00:00:27.300> five<00:00:27.840> so<00:00:28.199> far 00:00:29.150 --> 00:00:29.160 align:start position:0% so we are a team of five so far 00:00:29.160 --> 00:00:31.490 align:start position:0% so we are a team of five so far and<00:00:29.460> we<00:00:29.640> are<00:00:29.820> building<00:00:30.000> two<00:00:30.599> libraries<00:00:31.019> in<00:00:31.199> go 00:00:31.490 --> 00:00:31.500 align:start position:0% and we are building two libraries in go 00:00:31.500 --> 00:00:34.610 align:start position:0% and we are building two libraries in go so<00:00:31.920> one<00:00:32.040> is<00:00:32.220> called<00:00:32.340> gunak<00:00:32.759> which<00:00:33.000> is<00:00:33.120> a<00:00:33.620> easy 00:00:34.610 --> 00:00:34.620 align:start position:0% so one is called gunak which is a easy 00:00:34.620 --> 00:00:36.470 align:start position:0% so one is called gunak which is a easy to<00:00:34.800> use<00:00:34.920> open<00:00:35.100> source<00:00:35.520> library<00:00:35.700> for<00:00:36.000> snacks 00:00:36.470 --> 00:00:36.480 align:start position:0% to use open source library for snacks 00:00:36.480 --> 00:00:38.569 align:start position:0% to use open source library for snacks and<00:00:37.020> the<00:00:37.200> other<00:00:37.320> one<00:00:37.500> is<00:00:37.680> Gnar<00:00:38.100> crypto<00:00:38.399> which 00:00:38.569 --> 00:00:38.579 align:start position:0% and the other one is Gnar crypto which 00:00:38.579 --> 00:00:41.810 align:start position:0% and the other one is Gnar crypto which is<00:00:38.700> a<00:00:38.940> cryptographic<00:00:39.660> library<00:00:39.899> in<00:00:40.620> Glo 00:00:41.810 --> 00:00:41.820 align:start position:0% is a cryptographic library in Glo 00:00:41.820 --> 00:00:45.110 align:start position:0% is a cryptographic library in Glo so<00:00:42.480> uh<00:00:42.780> Glock<00:00:43.200> under<00:00:43.320> the<00:00:43.620> hood<00:00:43.800> is<00:00:44.120> basically 00:00:45.110 --> 00:00:45.120 align:start position:0% so uh Glock under the hood is basically 00:00:45.120 --> 00:00:47.090 align:start position:0% so uh Glock under the hood is basically composed<00:00:45.780> of<00:00:45.840> these<00:00:46.260> components<00:00:46.680> so<00:00:46.920> you<00:00:47.040> have 00:00:47.090 --> 00:00:47.100 align:start position:0% composed of these components so you have 00:00:47.100 --> 00:00:48.770 align:start position:0% composed of these components so you have a<00:00:47.219> front<00:00:47.399> end<00:00:47.640> when<00:00:47.879> you<00:00:48.000> write<00:00:48.120> your<00:00:48.360> circuit 00:00:48.770 --> 00:00:48.780 align:start position:0% a front end when you write your circuit 00:00:48.780 --> 00:00:50.810 align:start position:0% a front end when you write your circuit a<00:00:49.260> back<00:00:49.440> end<00:00:49.620> for<00:00:49.920> per<00:00:50.160> generation<00:00:50.460> for 00:00:50.810 --> 00:00:50.820 align:start position:0% a back end for per generation for 00:00:50.820 --> 00:00:52.850 align:start position:0% a back end for per generation for verification<00:00:51.180> and<00:00:51.960> then<00:00:52.079> underneath<00:00:52.559> you 00:00:52.850 --> 00:00:52.860 align:start position:0% verification and then underneath you 00:00:52.860 --> 00:00:54.650 align:start position:0% verification and then underneath you have<00:00:53.039> this<00:00:53.399> you<00:00:53.879> can<00:00:54.000> architecture<00:00:54.539> Library 00:00:54.650 --> 00:00:54.660 align:start position:0% have this you can architecture Library 00:00:54.660 --> 00:00:57.650 align:start position:0% have this you can architecture Library which<00:00:55.500> is<00:00:55.680> bearing<00:00:56.280> based<00:00:56.699> cryptography<00:00:57.360> on 00:00:57.650 --> 00:00:57.660 align:start position:0% which is bearing based cryptography on 00:00:57.660 --> 00:00:59.869 align:start position:0% which is bearing based cryptography on the<00:00:57.780> elliptic<00:00:58.219> curve-based<00:00:59.219> cryptography 00:00:59.869 --> 00:00:59.879 align:start position:0% the elliptic curve-based cryptography 00:00:59.879 --> 00:01:03.650 align:start position:0% the elliptic curve-based cryptography and<00:01:00.539> uh<00:01:01.140> finite<00:01:01.559> field<00:01:01.800> uh<00:01:02.699> arithmetic 00:01:03.650 --> 00:01:03.660 align:start position:0% and uh finite field uh arithmetic 00:01:03.660 --> 00:01:05.210 align:start position:0% and uh finite field uh arithmetic Library<00:01:03.780> so<00:01:04.019> we<00:01:04.140> have<00:01:04.260> all<00:01:04.440> the<00:01:04.559> stock<00:01:04.739> written 00:01:05.210 --> 00:01:05.220 align:start position:0% Library so we have all the stock written 00:01:05.220 --> 00:01:08.149 align:start position:0% Library so we have all the stock written in<00:01:05.339> go<00:01:05.519> no<00:01:05.939> dependencies<00:01:06.479> so<00:01:07.320> in<00:01:07.799> the<00:01:07.920> back<00:01:08.040> end 00:01:08.149 --> 00:01:08.159 align:start position:0% in go no dependencies so in the back end 00:01:08.159 --> 00:01:10.969 align:start position:0% in go no dependencies so in the back end we<00:01:08.400> have<00:01:08.580> so<00:01:08.880> far<00:01:09.060> got<00:01:09.299> 16<00:01:09.600> and<00:01:10.140> Planck<00:01:10.799> with 00:01:10.969 --> 00:01:10.979 align:start position:0% we have so far got 16 and Planck with 00:01:10.979 --> 00:01:14.330 align:start position:0% we have so far got 16 and Planck with two<00:01:11.100> polynomial<00:01:11.580> commitments<00:01:12.180> so<00:01:12.600> kcg<00:01:13.340> and 00:01:14.330 --> 00:01:14.340 align:start position:0% two polynomial commitments so kcg and 00:01:14.340 --> 00:01:18.050 align:start position:0% two polynomial commitments so kcg and Phi<00:01:14.960> we<00:01:15.960> have<00:01:16.080> in<00:01:16.200> the<00:01:16.320> front<00:01:16.500> side<00:01:16.799> a<00:01:17.640> standard 00:01:18.050 --> 00:01:18.060 align:start position:0% Phi we have in the front side a standard 00:01:18.060 --> 00:01:22.010 align:start position:0% Phi we have in the front side a standard library<00:01:18.360> with<00:01:18.840> the<00:01:19.020> mimc<00:01:19.680> ecdsa<00:01:20.460> eddsa<00:01:21.240> banks 00:01:22.010 --> 00:01:22.020 align:start position:0% library with the mimc ecdsa eddsa banks 00:01:22.020 --> 00:01:24.649 align:start position:0% library with the mimc ecdsa eddsa banks in<00:01:22.140> circuit<00:01:22.500> builders<00:01:23.040> in<00:01:23.159> circuits<00:01:23.700> and<00:01:24.420> we 00:01:24.649 --> 00:01:24.659 align:start position:0% in circuit builders in circuits and we 00:01:24.659 --> 00:01:26.990 align:start position:0% in circuit builders in circuits and we have<00:01:24.840> both<00:01:25.320> apis<00:01:25.799> for<00:01:26.100> not<00:01:26.400> a<00:01:26.640> native<00:01:26.820> field 00:01:26.990 --> 00:01:27.000 align:start position:0% have both apis for not a native field 00:01:27.000 --> 00:01:29.570 align:start position:0% have both apis for not a native field and<00:01:27.299> non-native<00:01:27.659> field<00:01:27.840> arithmetric<00:01:28.500> and<00:01:29.340> in 00:01:29.570 --> 00:01:29.580 align:start position:0% and non-native field arithmetric and in 00:01:29.580 --> 00:01:31.190 align:start position:0% and non-native field arithmetric and in Glock<00:01:30.360> rate<00:01:30.540> so<00:01:30.659> we<00:01:30.840> have<00:01:30.900> a<00:01:31.020> bunch<00:01:31.140> of 00:01:31.190 --> 00:01:31.200 align:start position:0% Glock rate so we have a bunch of 00:01:31.200 --> 00:01:35.210 align:start position:0% Glock rate so we have a bunch of ellipticals<00:01:31.860> ba<00:01:32.220> and<00:01:32.340> BLS<00:01:32.700> 12<00:01:32.939> BLS<00:01:33.479> 24<00:01:34.220> Two 00:01:35.210 --> 00:01:35.220 align:start position:0% ellipticals ba and BLS 12 BLS 24 Two 00:01:35.220 --> 00:01:38.109 align:start position:0% ellipticals ba and BLS 12 BLS 24 Two Chains<00:01:35.640> with<00:01:35.700> BNS<00:01:36.119> 12<00:01:36.299> or<00:01:36.479> 24<00:01:36.659> Twisted<00:01:37.320> Watts 00:01:38.109 --> 00:01:38.119 align:start position:0% Chains with BNS 12 or 24 Twisted Watts 00:01:38.119 --> 00:01:40.190 align:start position:0% Chains with BNS 12 or 24 Twisted Watts we<00:01:39.119> have<00:01:39.240> fast<00:01:39.420> multi-scanner 00:01:40.190 --> 00:01:40.200 align:start position:0% we have fast multi-scanner 00:01:40.200 --> 00:01:44.030 align:start position:0% we have fast multi-scanner multiplication<00:01:40.680> fast<00:01:41.340> pairing<00:01:42.180> kcg<00:01:43.140> 5<00:01:43.500> pillow 00:01:44.030 --> 00:01:44.040 align:start position:0% multiplication fast pairing kcg 5 pillow 00:01:44.040 --> 00:01:46.670 align:start position:0% multiplication fast pairing kcg 5 pillow caps<00:01:44.400> and<00:01:44.700> we<00:01:44.880> have<00:01:45.060> already<00:01:45.680> recently 00:01:46.670 --> 00:01:46.680 align:start position:0% caps and we have already recently 00:01:46.680 --> 00:01:49.550 align:start position:0% caps and we have already recently implemented<00:01:47.159> some<00:01:47.400> check<00:01:47.640> protocol<00:01:48.000> gkl 00:01:49.550 --> 00:01:49.560 align:start position:0% implemented some check protocol gkl 00:01:49.560 --> 00:01:52.190 align:start position:0% implemented some check protocol gkl and<00:01:50.100> in<00:01:50.280> the<00:01:50.460> finite<00:01:50.759> field<00:01:51.020> arithmetic<00:01:52.020> we 00:01:52.190 --> 00:01:52.200 align:start position:0% and in the finite field arithmetic we 00:01:52.200 --> 00:01:54.969 align:start position:0% and in the finite field arithmetic we have<00:01:52.439> different<00:01:52.740> sizes<00:01:53.220> ranging<00:01:53.640> from<00:01:53.820> 768<00:01:54.600> to 00:01:54.969 --> 00:01:54.979 align:start position:0% have different sizes ranging from 768 to 00:01:54.979 --> 00:01:58.370 align:start position:0% have different sizes ranging from 768 to 256<00:01:55.979> to<00:01:56.579> cold<00:01:56.880> Deluxe<00:01:57.360> as<00:01:57.479> well<00:01:57.659> and<00:01:58.259> it 00:01:58.370 --> 00:01:58.380 align:start position:0% 256 to cold Deluxe as well and it 00:01:58.380 --> 00:02:00.230 align:start position:0% 256 to cold Deluxe as well and it performs<00:01:58.920> very<00:01:59.100> very<00:01:59.520> well<00:01:59.700> on<00:01:59.939> different 00:02:00.230 --> 00:02:00.240 align:start position:0% performs very very well on different 00:02:00.240 --> 00:02:02.350 align:start position:0% performs very very well on different targets 00:02:02.350 --> 00:02:02.360 align:start position:0% targets 00:02:02.360 --> 00:02:06.830 align:start position:0% targets so<00:02:03.360> the<00:02:03.659> usual<00:02:04.640> workflow<00:02:05.640> of<00:02:05.880> snacks<00:02:06.299> so<00:02:06.540> same 00:02:06.830 --> 00:02:06.840 align:start position:0% so the usual workflow of snacks so same 00:02:06.840 --> 00:02:09.410 align:start position:0% so the usual workflow of snacks so same in<00:02:07.020> Glock<00:02:07.380> so<00:02:07.860> we<00:02:08.039> have<00:02:08.160> a<00:02:08.459> circuit<00:02:08.940> that<00:02:09.239> we 00:02:09.410 --> 00:02:09.420 align:start position:0% in Glock so we have a circuit that we 00:02:09.420 --> 00:02:12.770 align:start position:0% in Glock so we have a circuit that we write<00:02:09.660> in<00:02:09.959> Blingo<00:02:10.860> so<00:02:11.099> it's<00:02:11.220> not<00:02:11.400> in<00:02:11.580> a<00:02:11.760> DSL<00:02:12.300> and 00:02:12.770 --> 00:02:12.780 align:start position:0% write in Blingo so it's not in a DSL and 00:02:12.780 --> 00:02:15.890 align:start position:0% write in Blingo so it's not in a DSL and then<00:02:12.900> we<00:02:13.080> compile<00:02:13.440> it<00:02:13.680> to<00:02:14.520> some<00:02:15.480> constraint 00:02:15.890 --> 00:02:15.900 align:start position:0% then we compile it to some constraint 00:02:15.900 --> 00:02:18.650 align:start position:0% then we compile it to some constraint system<00:02:16.200> and<00:02:17.040> then<00:02:17.160> you<00:02:17.340> call<00:02:17.520> setup<00:02:18.060> move<00:02:18.360> and 00:02:18.650 --> 00:02:18.660 align:start position:0% system and then you call setup move and 00:02:18.660 --> 00:02:21.589 align:start position:0% system and then you call setup move and verify<00:02:19.080> API<00:02:19.620> so<00:02:20.340> it<00:02:20.640> is<00:02:20.760> fairly<00:02:21.120> easy<00:02:21.300> to 00:02:21.589 --> 00:02:21.599 align:start position:0% verify API so it is fairly easy to 00:02:21.599 --> 00:02:23.570 align:start position:0% verify API so it is fairly easy to change<00:02:21.780> the<00:02:22.440> elliptical<00:02:22.860> you<00:02:23.160> want<00:02:23.280> to<00:02:23.400> use 00:02:23.570 --> 00:02:23.580 align:start position:0% change the elliptical you want to use 00:02:23.580 --> 00:02:25.190 align:start position:0% change the elliptical you want to use and<00:02:23.940> the<00:02:24.120> constraint<00:02:24.420> system<00:02:24.660> you<00:02:24.900> want<00:02:25.020> so 00:02:25.190 --> 00:02:25.200 align:start position:0% and the constraint system you want so 00:02:25.200 --> 00:02:28.250 align:start position:0% and the constraint system you want so you<00:02:25.379> just<00:02:25.620> change<00:02:25.920> for<00:02:26.160> example<00:02:26.400> here<00:02:26.700> BN<00:02:27.260> 254 00:02:28.250 --> 00:02:28.260 align:start position:0% you just change for example here BN 254 00:02:28.260 --> 00:02:31.690 align:start position:0% you just change for example here BN 254 by<00:02:28.560> bns12<00:02:29.459> and 00:02:31.690 --> 00:02:31.700 align:start position:0% by bns12 and 00:02:31.700 --> 00:02:34.729 align:start position:0% by bns12 and l1cs<00:02:32.700> which<00:02:32.940> is<00:02:33.000> class<00:02:33.180> 16<00:02:33.420> by<00:02:33.780> SCS<00:02:34.560> which 00:02:34.729 --> 00:02:34.739 align:start position:0% l1cs which is class 16 by SCS which 00:02:34.739 --> 00:02:37.010 align:start position:0% l1cs which is class 16 by SCS which stands<00:02:35.040> for<00:02:35.099> sparse<00:02:35.700> gastrated<00:02:36.480> and<00:02:36.780> which<00:02:36.900> is 00:02:37.010 --> 00:02:37.020 align:start position:0% stands for sparse gastrated and which is 00:02:37.020 --> 00:02:38.570 align:start position:0% stands for sparse gastrated and which is blocked 00:02:38.570 --> 00:02:38.580 align:start position:0% blocked 00:02:38.580 --> 00:02:42.290 align:start position:0% blocked uh<00:02:39.239> so<00:02:39.480> we<00:02:39.599> have<00:02:39.720> a<00:02:39.840> playground<00:02:40.700> uh<00:02:41.700> where<00:02:41.940> you 00:02:42.290 --> 00:02:42.300 align:start position:0% uh so we have a playground uh where you 00:02:42.300 --> 00:02:44.630 align:start position:0% uh so we have a playground uh where you can<00:02:42.840> play<00:02:43.080> with<00:02:43.319> it<00:02:43.440> in<00:02:43.620> the<00:02:43.739> browser<00:02:44.099> we<00:02:44.280> go<00:02:44.400> 16 00:02:44.630 --> 00:02:44.640 align:start position:0% can play with it in the browser we go 16 00:02:44.640 --> 00:02:47.449 align:start position:0% can play with it in the browser we go 16 and<00:02:44.940> Planck<00:02:45.420> to<00:02:46.260> see<00:02:46.440> how<00:02:46.680> you<00:02:46.860> can<00:02:46.980> write<00:02:47.220> your 00:02:47.449 --> 00:02:47.459 align:start position:0% and Planck to see how you can write your 00:02:47.459 --> 00:02:49.729 align:start position:0% and Planck to see how you can write your circuits<00:02:47.940> in<00:02:48.060> go 00:02:49.729 --> 00:02:49.739 align:start position:0% circuits in go 00:02:49.739 --> 00:02:51.650 align:start position:0% circuits in go um<00:02:49.920> and<00:02:50.220> then<00:02:50.400> you<00:02:50.580> can<00:02:50.819> download<00:02:51.060> the 00:02:51.650 --> 00:02:51.660 align:start position:0% um and then you can download the 00:02:51.660 --> 00:02:54.350 align:start position:0% um and then you can download the constraints<00:02:52.500> and<00:02:52.680> look<00:02:52.860> like<00:02:53.040> look<00:02:53.700> at<00:02:54.000> what 00:02:54.350 --> 00:02:54.360 align:start position:0% constraints and look like look at what 00:02:54.360 --> 00:02:58.190 align:start position:0% constraints and look like look at what they<00:02:54.599> look<00:02:54.780> like<00:02:54.959> both<00:02:55.440> in<00:02:55.620> row<00:02:55.980> 16<00:02:56.099> and<00:02:56.340> snack 00:02:58.190 --> 00:02:58.200 align:start position:0% they look like both in row 16 and snack 00:02:58.200 --> 00:03:02.509 align:start position:0% they look like both in row 16 and snack um<00:02:58.319> so<00:02:59.160> why<00:02:59.819> Glock<00:03:00.360> so<00:03:00.599> we<00:03:00.780> have<00:03:00.840> no<00:03:01.019> DSL<00:03:01.560> plain 00:03:02.509 --> 00:03:02.519 align:start position:0% um so why Glock so we have no DSL plain 00:03:02.519 --> 00:03:04.970 align:start position:0% um so why Glock so we have no DSL plain go<00:03:02.640> so<00:03:02.879> no<00:03:03.000> dependencies<00:03:03.540> at<00:03:03.840> all<00:03:04.019> we<00:03:04.680> compile 00:03:04.970 --> 00:03:04.980 align:start position:0% go so no dependencies at all we compile 00:03:04.980 --> 00:03:07.750 align:start position:0% go so no dependencies at all we compile large<00:03:05.280> sockets<00:03:05.700> in<00:03:06.000> a<00:03:06.720> few<00:03:06.959> seconds 00:03:07.750 --> 00:03:07.760 align:start position:0% large sockets in a few seconds 00:03:07.760 --> 00:03:09.830 align:start position:0% large sockets in a few seconds so<00:03:08.760> when<00:03:08.879> you<00:03:09.000> write<00:03:09.180> your<00:03:09.360> circuits<00:03:09.780> in 00:03:09.830 --> 00:03:09.840 align:start position:0% so when you write your circuits in 00:03:09.840 --> 00:03:12.290 align:start position:0% so when you write your circuits in playing<00:03:10.080> go<00:03:10.319> you<00:03:10.560> can<00:03:10.680> use<00:03:10.860> go<00:03:11.400> to<00:03:11.580> Links<00:03:12.120> stand 00:03:12.290 --> 00:03:12.300 align:start position:0% playing go you can use go to Links stand 00:03:12.300 --> 00:03:13.729 align:start position:0% playing go you can use go to Links stand out<00:03:12.480> go<00:03:12.659> to<00:03:12.780> links<00:03:13.140> to<00:03:13.260> the<00:03:13.379> back<00:03:13.500> test 00:03:13.729 --> 00:03:13.739 align:start position:0% out go to links to the back test 00:03:13.739 --> 00:03:15.770 align:start position:0% out go to links to the back test Benchmark<00:03:14.220> your<00:03:14.459> circuit<00:03:14.879> but<00:03:15.239> also<00:03:15.540> we've 00:03:15.770 --> 00:03:15.780 align:start position:0% Benchmark your circuit but also we've 00:03:15.780 --> 00:03:17.570 align:start position:0% Benchmark your circuit but also we've developed<00:03:16.080> a<00:03:16.260> cool<00:03:16.379> cool<00:03:16.920> thing<00:03:17.159> which<00:03:17.340> we 00:03:17.570 --> 00:03:17.580 align:start position:0% developed a cool cool thing which we 00:03:17.580 --> 00:03:20.210 align:start position:0% developed a cool cool thing which we call<00:03:17.760> constraints<00:03:18.239> profiler<00:03:18.840> so<00:03:19.500> by<00:03:19.980> just 00:03:20.210 --> 00:03:20.220 align:start position:0% call constraints profiler so by just 00:03:20.220 --> 00:03:22.009 align:start position:0% call constraints profiler so by just adding<00:03:20.519> two<00:03:20.640> lines<00:03:20.819> of<00:03:21.060> code<00:03:21.180> you<00:03:21.780> can<00:03:21.840> have 00:03:22.009 --> 00:03:22.019 align:start position:0% adding two lines of code you can have 00:03:22.019 --> 00:03:24.649 align:start position:0% adding two lines of code you can have this<00:03:22.440> key<00:03:22.739> this<00:03:23.159> this<00:03:23.400> video<00:03:23.580> here<00:03:24.000> where<00:03:24.420> you 00:03:24.649 --> 00:03:24.659 align:start position:0% this key this this video here where you 00:03:24.659 --> 00:03:25.970 align:start position:0% this key this this video here where you see<00:03:24.840> in<00:03:25.140> each<00:03:25.260> function<00:03:25.620> how<00:03:25.860> many 00:03:25.970 --> 00:03:25.980 align:start position:0% see in each function how many 00:03:25.980 --> 00:03:28.790 align:start position:0% see in each function how many constraints<00:03:26.519> does<00:03:26.760> it<00:03:26.879> consume 00:03:28.790 --> 00:03:28.800 align:start position:0% constraints does it consume 00:03:28.800 --> 00:03:31.190 align:start position:0% constraints does it consume um<00:03:29.280> yeah<00:03:29.879> and<00:03:30.060> the<00:03:30.239> several<00:03:30.599> packages<00:03:30.900> are 00:03:31.190 --> 00:03:31.200 align:start position:0% um yeah and the several packages are 00:03:31.200 --> 00:03:33.949 align:start position:0% um yeah and the several packages are already<00:03:31.980> audited<00:03:32.580> by<00:03:32.879> algon<00:03:33.360> and<00:03:33.659> fastest 00:03:33.949 --> 00:03:33.959 align:start position:0% already audited by algon and fastest 00:03:33.959 --> 00:03:37.070 align:start position:0% already audited by algon and fastest bike<00:03:34.379> get<00:03:34.620> for<00:03:35.040> one<00:03:35.519> year<00:03:35.700> I<00:03:35.879> guess<00:03:36.000> now<00:03:36.180> and 00:03:37.070 --> 00:03:37.080 align:start position:0% bike get for one year I guess now and 00:03:37.080 --> 00:03:39.649 align:start position:0% bike get for one year I guess now and there<00:03:37.739> is<00:03:37.920> one<00:03:37.980> code<00:03:38.159> base<00:03:38.400> that<00:03:39.060> performs 00:03:39.649 --> 00:03:39.659 align:start position:0% there is one code base that performs 00:03:39.659 --> 00:03:42.170 align:start position:0% there is one code base that performs well<00:03:39.780> in<00:03:40.019> different<00:03:40.340> architectures<00:03:41.340> CPU 00:03:42.170 --> 00:03:42.180 align:start position:0% well in different architectures CPU 00:03:42.180 --> 00:03:44.750 align:start position:0% well in different architectures CPU mobile<00:03:42.420> wasn't<00:03:42.840> so<00:03:43.560> in<00:03:43.799> the<00:03:44.040> mobile<00:03:44.280> we<00:03:44.580> have 00:03:44.750 --> 00:03:44.760 align:start position:0% mobile wasn't so in the mobile we have 00:03:44.760 --> 00:03:47.330 align:start position:0% mobile wasn't so in the mobile we have 70<00:03:45.060> faster<00:03:45.840> than<00:03:46.080> the<00:03:46.500> Baseline<00:03:46.980> in<00:03:47.099> the<00:03:47.159> Z 00:03:47.330 --> 00:03:47.340 align:start position:0% 70 faster than the Baseline in the Z 00:03:47.340 --> 00:03:49.070 align:start position:0% 70 faster than the Baseline in the Z price 00:03:49.070 --> 00:03:49.080 align:start position:0% price 00:03:49.080 --> 00:03:51.289 align:start position:0% price um<00:03:49.200> so<00:03:49.440> the<00:03:49.620> question<00:03:49.739> is<00:03:49.980> why<00:03:50.340> Clark<00:03:50.760> is<00:03:51.120> that 00:03:51.289 --> 00:03:51.299 align:start position:0% um so the question is why Clark is that 00:03:51.299 --> 00:03:53.869 align:start position:0% um so the question is why Clark is that fast<00:03:51.480> so<00:03:52.440> here<00:03:52.620> I<00:03:52.860> give<00:03:53.040> an<00:03:53.220> example<00:03:53.519> of<00:03:53.700> course 00:03:53.869 --> 00:03:53.879 align:start position:0% fast so here I give an example of course 00:03:53.879 --> 00:03:57.589 align:start position:0% fast so here I give an example of course 16<00:03:54.120> snack<00:03:54.599> over<00:03:54.840> on<00:03:55.200> bn254<00:03:56.099> okay<00:03:56.819> so<00:03:57.420> this 00:03:57.589 --> 00:03:57.599 align:start position:0% 16 snack over on bn254 okay so this 00:03:57.599 --> 00:03:59.869 align:start position:0% 16 snack over on bn254 okay so this means<00:03:58.040> msm's<00:03:59.040> computations<00:03:59.400> fft 00:03:59.869 --> 00:03:59.879 align:start position:0% means msm's computations fft 00:03:59.879 --> 00:04:02.330 align:start position:0% means msm's computations fft computations<00:04:00.540> and<00:04:00.900> parallelism<00:04:01.560> so<00:04:01.920> I<00:04:02.099> took 00:04:02.330 --> 00:04:02.340 align:start position:0% computations and parallelism so I took 00:04:02.340 --> 00:04:04.250 align:start position:0% computations and parallelism so I took the<00:04:02.400> examples<00:04:02.760> of<00:04:03.060> two<00:04:03.659> of<00:04:03.840> the<00:04:03.959> most<00:04:04.080> used 00:04:04.250 --> 00:04:04.260 align:start position:0% the examples of two of the most used 00:04:04.260 --> 00:04:07.789 align:start position:0% the examples of two of the most used libraries<00:04:04.860> so<00:04:05.340> Arc<00:04:06.060> Works<00:04:06.420> in<00:04:07.019> our<00:04:07.200> stands 00:04:07.789 --> 00:04:07.799 align:start position:0% libraries so Arc Works in our stands 00:04:07.799 --> 00:04:10.309 align:start position:0% libraries so Arc Works in our stands silicon<00:04:08.280> with<00:04:08.760> a<00:04:09.299> rapid<00:04:09.480> snark<00:04:09.900> back<00:04:10.080> and<00:04:10.200> then 00:04:10.309 --> 00:04:10.319 align:start position:0% silicon with a rapid snark back and then 00:04:10.319 --> 00:04:14.089 align:start position:0% silicon with a rapid snark back and then C<00:04:10.500> plus<00:04:10.680> plus<00:04:10.680> so<00:04:11.640> two<00:04:12.060> kind<00:04:12.360> of<00:04:12.599> uh<00:04:13.099> circuit 00:04:14.089 --> 00:04:14.099 align:start position:0% C plus plus so two kind of uh circuit 00:04:14.099 --> 00:04:17.930 align:start position:0% C plus plus so two kind of uh circuit sizes<00:04:14.400> so<00:04:15.000> one<00:04:15.239> is<00:04:15.560> 65k<00:04:16.560> the<00:04:17.100> other<00:04:17.280> one<00:04:17.519> is<00:04:17.699> 8 00:04:17.930 --> 00:04:17.940 align:start position:0% sizes so one is 65k the other one is 8 00:04:17.940 --> 00:04:19.210 align:start position:0% sizes so one is 65k the other one is 8 million<00:04:18.239> constraints 00:04:19.210 --> 00:04:19.220 align:start position:0% million constraints 00:04:19.220 --> 00:04:22.850 align:start position:0% million constraints so<00:04:20.220> this<00:04:20.400> is<00:04:20.519> a<00:04:20.760> AWS<00:04:21.359> AMD<00:04:22.019> machine<00:04:22.260> and<00:04:22.500> we<00:04:22.740> see 00:04:22.850 --> 00:04:22.860 align:start position:0% so this is a AWS AMD machine and we see 00:04:22.860 --> 00:04:24.950 align:start position:0% so this is a AWS AMD machine and we see that<00:04:23.040> gnat<00:04:23.460> performs<00:04:23.940> very<00:04:24.060> well<00:04:24.300> for<00:04:24.780> both 00:04:24.950 --> 00:04:24.960 align:start position:0% that gnat performs very well for both 00:04:24.960 --> 00:04:27.110 align:start position:0% that gnat performs very well for both kind<00:04:25.259> of<00:04:25.500> circuits<00:04:26.460> so<00:04:26.699> there<00:04:26.880> are<00:04:27.000> some 00:04:27.110 --> 00:04:27.120 align:start position:0% kind of circuits so there are some 00:04:27.120 --> 00:04:28.850 align:start position:0% kind of circuits so there are some libraries<00:04:27.419> that<00:04:27.660> are<00:04:27.780> heavy<00:04:28.139> optimized<00:04:28.740> or 00:04:28.850 --> 00:04:28.860 align:start position:0% libraries that are heavy optimized or 00:04:28.860 --> 00:04:31.249 align:start position:0% libraries that are heavy optimized or large<00:04:29.100> circuits<00:04:29.520> for<00:04:29.759> instance<00:04:30.139> Glock<00:04:31.139> is 00:04:31.249 --> 00:04:31.259 align:start position:0% large circuits for instance Glock is 00:04:31.259 --> 00:04:33.650 align:start position:0% large circuits for instance Glock is optimized<00:04:31.680> for<00:04:31.800> most<00:04:32.460> so<00:04:33.060> this<00:04:33.240> is<00:04:33.360> for<00:04:33.540> the 00:04:33.650 --> 00:04:33.660 align:start position:0% optimized for most so this is for the 00:04:33.660 --> 00:04:34.969 align:start position:0% optimized for most so this is for the previous<00:04:33.780> site 00:04:34.969 --> 00:04:34.979 align:start position:0% previous site 00:04:34.979 --> 00:04:37.010 align:start position:0% previous site for<00:04:35.699> the<00:04:35.820> verify<00:04:36.120> your<00:04:36.300> site<00:04:36.540> which<00:04:36.720> is<00:04:36.780> Ghost 00:04:37.010 --> 00:04:37.020 align:start position:0% for the verify your site which is Ghost 00:04:37.020 --> 00:04:40.550 align:start position:0% for the verify your site which is Ghost 16<00:04:37.259> snack<00:04:37.800> verifier<00:04:38.580> so<00:04:39.479> which<00:04:39.840> is<00:04:40.020> mainly 00:04:40.550 --> 00:04:40.560 align:start position:0% 16 snack verifier so which is mainly 00:04:40.560 --> 00:04:44.330 align:start position:0% 16 snack verifier so which is mainly pairing<00:04:40.979> computation<00:04:41.460> of<00:04:42.120> lbn<00:04:42.660> 254.<00:04:43.620> so<00:04:44.160> again 00:04:44.330 --> 00:04:44.340 align:start position:0% pairing computation of lbn 254. so again 00:04:44.340 --> 00:04:47.210 align:start position:0% pairing computation of lbn 254. so again we<00:04:44.880> see<00:04:45.000> that<00:04:45.180> on<00:04:45.419> same<00:04:45.660> machine 00:04:47.210 --> 00:04:47.220 align:start position:0% we see that on same machine 00:04:47.220 --> 00:04:48.010 align:start position:0% we see that on same machine um 00:04:48.010 --> 00:04:48.020 align:start position:0% um 00:04:48.020 --> 00:04:52.189 align:start position:0% um Glock<00:04:49.020> is<00:04:49.199> very<00:04:49.380> fast<00:04:49.560> so<00:04:49.919> it's<00:04:50.160> uh<00:04:51.300> a<00:04:51.780> bit<00:04:52.080> more 00:04:52.189 --> 00:04:52.199 align:start position:0% Glock is very fast so it's uh a bit more 00:04:52.199 --> 00:04:53.930 align:start position:0% Glock is very fast so it's uh a bit more than<00:04:52.380> one<00:04:52.560> milliseconds<00:04:53.160> on<00:04:53.280> this<00:04:53.460> machine<00:04:53.639> to 00:04:53.930 --> 00:04:53.940 align:start position:0% than one milliseconds on this machine to 00:04:53.940 --> 00:04:56.510 align:start position:0% than one milliseconds on this machine to verify<00:04:54.360> to<00:04:54.720> computer<00:04:55.259> to<00:04:55.740> verifiable<00:04:56.220> which 00:04:56.510 --> 00:04:56.520 align:start position:0% verify to computer to verifiable which 00:04:56.520 --> 00:04:59.330 align:start position:0% verify to computer to verifiable which is<00:04:56.580> mainly<00:04:56.940> a<00:04:57.660> multi-explanator<00:04:58.560> appearing 00:04:59.330 --> 00:04:59.340 align:start position:0% is mainly a multi-explanator appearing 00:04:59.340 --> 00:05:01.610 align:start position:0% is mainly a multi-explanator appearing computation 00:05:01.610 --> 00:05:01.620 align:start position:0% computation 00:05:01.620 --> 00:05:02.629 align:start position:0% computation um 00:05:02.629 --> 00:05:02.639 align:start position:0% um 00:05:02.639 --> 00:05:05.210 align:start position:0% um yeah<00:05:03.000> so<00:05:03.240> it's<00:05:03.360> a<00:05:03.479> PDF<00:05:04.199> it<00:05:04.620> was<00:05:04.740> interactive 00:05:05.210 --> 00:05:05.220 align:start position:0% yeah so it's a PDF it was interactive 00:05:05.220 --> 00:05:08.810 align:start position:0% yeah so it's a PDF it was interactive but<00:05:05.460> anyway<00:05:06.020> so<00:05:07.020> the<00:05:07.740> question<00:05:07.979> is<00:05:08.220> why<00:05:08.400> gnarok 00:05:08.810 --> 00:05:08.820 align:start position:0% but anyway so the question is why gnarok 00:05:08.820 --> 00:05:11.030 align:start position:0% but anyway so the question is why gnarok is<00:05:08.940> that<00:05:09.060> fast<00:05:09.300> so<00:05:10.199> remember<00:05:10.380> this<00:05:10.740> diagram 00:05:11.030 --> 00:05:11.040 align:start position:0% is that fast so remember this diagram 00:05:11.040 --> 00:05:12.409 align:start position:0% is that fast so remember this diagram from<00:05:11.280> the<00:05:11.460> very<00:05:11.580> beginning<00:05:11.759> so<00:05:12.120> we<00:05:12.240> have<00:05:12.360> a 00:05:12.409 --> 00:05:12.419 align:start position:0% from the very beginning so we have a 00:05:12.419 --> 00:05:14.390 align:start position:0% from the very beginning so we have a front-end<00:05:12.780> backend<00:05:13.259> I'm<00:05:13.680> gonna<00:05:13.800> click<00:05:14.100> tool 00:05:14.390 --> 00:05:14.400 align:start position:0% front-end backend I'm gonna click tool 00:05:14.400 --> 00:05:17.150 align:start position:0% front-end backend I'm gonna click tool underneath<00:05:14.759> and<00:05:15.419> the<00:05:15.600> question<00:05:15.720> is<00:05:15.960> so<00:05:16.620> I<00:05:16.979> will 00:05:17.150 --> 00:05:17.160 align:start position:0% underneath and the question is so I will 00:05:17.160 --> 00:05:19.070 align:start position:0% underneath and the question is so I will go<00:05:17.340> through<00:05:17.460> some<00:05:17.759> of<00:05:18.000> the<00:05:18.300> algorithms<00:05:18.900> that 00:05:19.070 --> 00:05:19.080 align:start position:0% go through some of the algorithms that 00:05:19.080 --> 00:05:21.050 align:start position:0% go through some of the algorithms that are<00:05:19.199> highly<00:05:19.500> optimized<00:05:19.979> in<00:05:20.040> knock<00:05:20.340> so<00:05:20.820> we 00:05:21.050 --> 00:05:21.060 align:start position:0% are highly optimized in knock so we 00:05:21.060 --> 00:05:22.909 align:start position:0% are highly optimized in knock so we start<00:05:21.240> by<00:05:21.419> writing<00:05:21.840> a<00:05:21.960> circuit 00:05:22.909 --> 00:05:22.919 align:start position:0% start by writing a circuit 00:05:22.919 --> 00:05:26.150 align:start position:0% start by writing a circuit see<00:05:23.759> we<00:05:24.120> generate<00:05:24.419> the<00:05:24.539> proof<00:05:24.840> Pi<00:05:25.199> of<00:05:25.380> C 00:05:26.150 --> 00:05:26.160 align:start position:0% see we generate the proof Pi of C 00:05:26.160 --> 00:05:28.430 align:start position:0% see we generate the proof Pi of C which<00:05:26.759> means<00:05:27.060> that<00:05:27.240> we<00:05:27.419> will<00:05:27.539> call<00:05:27.720> ganache2 00:05:28.430 --> 00:05:28.440 align:start position:0% which means that we will call ganache2 00:05:28.440 --> 00:05:31.850 align:start position:0% which means that we will call ganache2 to<00:05:28.560> compute<00:05:28.800> ffts<00:05:29.460> and<00:05:29.880> mostly<00:05:30.419> msms<00:05:31.259> over<00:05:31.380> so 00:05:31.850 --> 00:05:31.860 align:start position:0% to compute ffts and mostly msms over so 00:05:31.860 --> 00:05:33.469 align:start position:0% to compute ffts and mostly msms over so yeah<00:05:31.979> so<00:05:32.460> I'm<00:05:32.580> giving<00:05:32.759> the<00:05:32.940> example<00:05:33.240> of<00:05:33.360> a 00:05:33.469 --> 00:05:33.479 align:start position:0% yeah so I'm giving the example of a 00:05:33.479 --> 00:05:35.090 align:start position:0% yeah so I'm giving the example of a cursive<00:05:33.780> course<00:05:34.020> 60<00:05:34.199> Improvement<00:05:34.680> just<00:05:34.919> to 00:05:35.090 --> 00:05:35.100 align:start position:0% cursive course 60 Improvement just to 00:05:35.100 --> 00:05:36.950 align:start position:0% cursive course 60 Improvement just to concentrate<00:05:35.580> over<00:05:35.880> the<00:05:36.240> algorithmic 00:05:36.950 --> 00:05:36.960 align:start position:0% concentrate over the algorithmic 00:05:36.960 --> 00:05:38.930 align:start position:0% concentrate over the algorithmic optimizations<00:05:37.440> I'm<00:05:37.680> using<00:05:37.979> a<00:05:38.039> 2J<00:05:38.340> so<00:05:38.639> there<00:05:38.820> is 00:05:38.930 --> 00:05:38.940 align:start position:0% optimizations I'm using a 2J so there is 00:05:38.940 --> 00:05:41.330 align:start position:0% optimizations I'm using a 2J so there is no<00:05:39.120> long<00:05:39.419> field<00:05:39.720> arithmetic<00:05:40.259> but<00:05:40.919> it<00:05:41.039> works 00:05:41.330 --> 00:05:41.340 align:start position:0% no long field arithmetic but it works 00:05:41.340 --> 00:05:44.510 align:start position:0% no long field arithmetic but it works also<00:05:41.520> with<00:05:41.699> long<00:05:42.060> field<00:05:42.240> arithmetic<00:05:43.340> so<00:05:44.340> it 00:05:44.510 --> 00:05:44.520 align:start position:0% also with long field arithmetic so it 00:05:44.520 --> 00:05:50.570 align:start position:0% also with long field arithmetic so it has<00:05:44.820> an<00:05:45.479> amazing<00:05:46.220> 377<00:05:47.419> and<00:05:48.419> then<00:05:48.660> we<00:05:49.380> write<00:05:50.340> a 00:05:50.570 --> 00:05:50.580 align:start position:0% has an amazing 377 and then we write a 00:05:50.580 --> 00:05:53.390 align:start position:0% has an amazing 377 and then we write a circuit<00:05:50.940> C<00:05:51.120> Prime<00:05:51.360> of<00:05:51.840> the<00:05:51.960> both<00:05:52.139> pi<00:05:52.919> we 00:05:53.390 --> 00:05:53.400 align:start position:0% circuit C Prime of the both pi we 00:05:53.400 --> 00:05:55.909 align:start position:0% circuit C Prime of the both pi we generate<00:05:53.820> the<00:05:54.120> poof<00:05:54.539> Pi<00:05:55.259> Prime<00:05:55.500> of<00:05:55.800> this 00:05:55.909 --> 00:05:55.919 align:start position:0% generate the poof Pi Prime of this 00:05:55.919 --> 00:05:58.550 align:start position:0% generate the poof Pi Prime of this circuit<00:05:56.280> C<00:05:56.460> Prime<00:05:56.699> so<00:05:56.940> the<00:05:57.120> aggregation<00:05:57.560> which 00:05:58.550 --> 00:05:58.560 align:start position:0% circuit C Prime so the aggregation which 00:05:58.560 --> 00:06:01.029 align:start position:0% circuit C Prime so the aggregation which means<00:05:58.800> that<00:05:58.919> we<00:05:59.100> will<00:05:59.280> call<00:05:59.460> a<00:06:00.000> galactic 00:06:01.029 --> 00:06:01.039 align:start position:0% means that we will call a galactic 00:06:01.039 --> 00:06:04.010 align:start position:0% means that we will call a galactic to<00:06:02.039> compute<00:06:02.580> a<00:06:02.940> multi-scalar<00:06:03.600> multiplication 00:06:04.010 --> 00:06:04.020 align:start position:0% to compute a multi-scalar multiplication 00:06:04.020 --> 00:06:06.350 align:start position:0% to compute a multi-scalar multiplication over<00:06:04.259> the<00:06:04.639> bw6761<00:06:05.639> curve<00:06:05.940> which<00:06:06.060> is<00:06:06.180> the 00:06:06.350 --> 00:06:06.360 align:start position:0% over the bw6761 curve which is the 00:06:06.360 --> 00:06:07.790 align:start position:0% over the bw6761 curve which is the outside<00:06:06.479> curve 00:06:07.790 --> 00:06:07.800 align:start position:0% outside curve 00:06:07.800 --> 00:06:09.650 align:start position:0% outside curve and 00:06:09.650 --> 00:06:09.660 align:start position:0% and 00:06:09.660 --> 00:06:12.290 align:start position:0% and um<00:06:09.720> we<00:06:10.380> verify<00:06:10.800> the<00:06:10.919> proof<00:06:11.220> step<00:06:11.639> five<00:06:11.880> which 00:06:12.290 --> 00:06:12.300 align:start position:0% um we verify the proof step five which 00:06:12.300 --> 00:06:14.210 align:start position:0% um we verify the proof step five which means<00:06:12.539> that<00:06:12.660> we<00:06:12.840> will<00:06:12.960> calculate<00:06:13.500> to<00:06:13.800> compute 00:06:14.210 --> 00:06:14.220 align:start position:0% means that we will calculate to compute 00:06:14.220 --> 00:06:15.770 align:start position:0% means that we will calculate to compute the<00:06:14.340> pain<00:06:14.520> so<00:06:14.759> I<00:06:14.820> will<00:06:15.060> be<00:06:15.240> talking<00:06:15.419> about<00:06:15.660> the 00:06:15.770 --> 00:06:15.780 align:start position:0% the pain so I will be talking about the 00:06:15.780 --> 00:06:18.469 align:start position:0% the pain so I will be talking about the optimizations<00:06:16.380> in<00:06:16.979> those<00:06:17.880> points<00:06:18.180> that<00:06:18.300> are 00:06:18.469 --> 00:06:18.479 align:start position:0% optimizations in those points that are 00:06:18.479 --> 00:06:21.830 align:start position:0% optimizations in those points that are in<00:06:18.660> that<00:06:19.259> are<00:06:19.380> in<00:06:19.500> boxes<00:06:19.800> so<00:06:20.280> mainly<00:06:20.759> msms<00:06:21.479> and 00:06:21.830 --> 00:06:21.840 align:start position:0% in that are in boxes so mainly msms and 00:06:21.840 --> 00:06:25.430 align:start position:0% in that are in boxes so mainly msms and pairings<00:06:22.259> and<00:06:22.560> writing<00:06:23.220> circuits 00:06:25.430 --> 00:06:25.440 align:start position:0% pairings and writing circuits 00:06:25.440 --> 00:06:28.249 align:start position:0% pairings and writing circuits um so<00:06:25.680> images<00:06:25.979> of<00:06:26.340> a<00:06:26.460> BNS<00:06:26.759> 12<00:06:26.940> 377 00:06:28.249 --> 00:06:28.259 align:start position:0% um so images of a BNS 12 377 00:06:28.259 --> 00:06:31.850 align:start position:0% um so images of a BNS 12 377 so<00:06:28.800> I<00:06:28.979> this<00:06:29.400> is<00:06:29.520> a<00:06:29.699> graph<00:06:29.940> from<00:06:30.180> the<00:06:30.539> Z<00:06:31.080> price<00:06:31.440> uh 00:06:31.850 --> 00:06:31.860 align:start position:0% so I this is a graph from the Z price uh 00:06:31.860 --> 00:06:33.050 align:start position:0% so I this is a graph from the Z price uh submission 00:06:33.050 --> 00:06:33.060 align:start position:0% submission 00:06:33.060 --> 00:06:35.330 align:start position:0% submission uh<00:06:33.960> some<00:06:34.139> comparing<00:06:34.680> to<00:06:34.740> Arc<00:06:34.979> works<00:06:35.220> because 00:06:35.330 --> 00:06:35.340 align:start position:0% uh some comparing to Arc works because 00:06:35.340 --> 00:06:39.110 align:start position:0% uh some comparing to Arc works because it<00:06:35.520> implements<00:06:35.880> VLS<00:06:36.300> work<00:06:36.479> 377<00:06:37.400> so<00:06:38.400> we<00:06:38.580> are<00:06:38.759> 40 00:06:39.110 --> 00:06:39.120 align:start position:0% it implements VLS work 377 so we are 40 00:06:39.120 --> 00:06:42.409 align:start position:0% it implements VLS work 377 so we are 40 up<00:06:39.600> to<00:06:39.840> 47<00:06:40.620> faster 00:06:42.409 --> 00:06:42.419 align:start position:0% up to 47 faster 00:06:42.419 --> 00:06:46.010 align:start position:0% up to 47 faster for<00:06:43.259> 100<00:06:44.220> points<00:06:45.120> surrounding<00:06:45.419> from<00:06:45.660> two<00:06:45.840> to 00:06:46.010 --> 00:06:46.020 align:start position:0% for 100 points surrounding from two to 00:06:46.020 --> 00:06:49.370 align:start position:0% for 100 points surrounding from two to the<00:06:46.139> eight<00:06:46.259> to<00:06:46.560> two<00:06:46.740> to<00:06:46.979> the<00:06:47.160> 18.<00:06:48.419> so<00:06:49.139> this<00:06:49.259> is 00:06:49.370 --> 00:06:49.380 align:start position:0% the eight to two to the 18. so this is 00:06:49.380 --> 00:06:52.129 align:start position:0% the eight to two to the 18. so this is tested<00:06:49.860> on<00:06:49.979> mobile<00:06:50.160> so<00:06:50.580> on<00:06:50.759> a<00:06:50.880> Samsung<00:06:51.000> Galaxy 00:06:52.129 --> 00:06:52.139 align:start position:0% tested on mobile so on a Samsung Galaxy 00:06:52.139 --> 00:06:54.350 align:start position:0% tested on mobile so on a Samsung Galaxy and<00:06:53.039> we<00:06:53.220> have<00:06:53.340> two<00:06:53.520> so<00:06:53.759> here<00:06:53.940> I<00:06:54.120> have<00:06:54.180> two 00:06:54.350 --> 00:06:54.360 align:start position:0% and we have two so here I have two 00:06:54.360 --> 00:06:56.029 align:start position:0% and we have two so here I have two versions<00:06:54.600> of<00:06:54.780> Glock<00:06:55.139> one<00:06:55.380> using<00:06:55.740> Twisted 00:06:56.029 --> 00:06:56.039 align:start position:0% versions of Glock one using Twisted 00:06:56.039 --> 00:06:57.350 align:start position:0% versions of Glock one using Twisted Advanced<00:06:56.520> curves<00:06:56.759> and<00:06:56.880> the<00:06:57.000> other<00:06:57.120> one<00:06:57.240> is 00:06:57.350 --> 00:06:57.360 align:start position:0% Advanced curves and the other one is 00:06:57.360 --> 00:07:00.469 align:start position:0% Advanced curves and the other one is using<00:06:57.960> shop<00:06:58.380> twice<00:06:58.680> curve<00:06:59.220> so<00:06:59.819> the<00:06:59.940> one<00:07:00.060> is<00:07:00.240> 40 00:07:00.469 --> 00:07:00.479 align:start position:0% using shop twice curve so the one is 40 00:07:00.479 --> 00:07:02.890 align:start position:0% using shop twice curve so the one is 40 to<00:07:00.720> 47<00:07:01.139> and<00:07:01.319> the<00:07:01.440> other<00:07:01.560> one<00:07:01.740> is<00:07:01.919> 20<00:07:02.340> to<00:07:02.580> 35 00:07:02.890 --> 00:07:02.900 align:start position:0% to 47 and the other one is 20 to 35 00:07:02.900 --> 00:07:07.010 align:start position:0% to 47 and the other one is 20 to 35 faster<00:07:03.900> and<00:07:04.080> the<00:07:04.199> question<00:07:04.380> is<00:07:04.560> why<00:07:04.740> so 00:07:07.010 --> 00:07:07.020 align:start position:0% faster and the question is why so 00:07:07.020 --> 00:07:09.770 align:start position:0% faster and the question is why so um so<00:07:07.440> both<00:07:07.860> implementations<00:07:08.759> do<00:07:09.300> not<00:07:09.479> use<00:07:09.600> by 00:07:09.770 --> 00:07:09.780 align:start position:0% um so both implementations do not use by 00:07:09.780 --> 00:07:12.230 align:start position:0% um so both implementations do not use by computations<00:07:10.259> but<00:07:10.560> use<00:07:10.740> parallelisms<00:07:11.580> but<00:07:12.060> in 00:07:12.230 --> 00:07:12.240 align:start position:0% computations but use parallelisms but in 00:07:12.240 --> 00:07:13.430 align:start position:0% computations but use parallelisms but in a<00:07:12.419> different<00:07:12.600> way 00:07:13.430 --> 00:07:13.440 align:start position:0% a different way 00:07:13.440 --> 00:07:15.590 align:start position:0% a different way I'm<00:07:13.860> not<00:07:13.979> going<00:07:14.100> to<00:07:14.220> talk<00:07:14.340> about<00:07:14.460> this<00:07:14.759> so<00:07:15.419> we 00:07:15.590 --> 00:07:15.600 align:start position:0% I'm not going to talk about this so we 00:07:15.600 --> 00:07:18.290 align:start position:0% I'm not going to talk about this so we use<00:07:15.720> two<00:07:15.840> enough<00:07:16.020> buckets<00:07:16.560> which<00:07:17.520> reduces<00:07:18.180> the 00:07:18.290 --> 00:07:18.300 align:start position:0% use two enough buckets which reduces the 00:07:18.300 --> 00:07:20.270 align:start position:0% use two enough buckets which reduces the size<00:07:18.419> of<00:07:18.539> the<00:07:18.660> buckets<00:07:18.900> by<00:07:19.139> twice<00:07:19.620> this<00:07:20.039> is<00:07:20.160> not 00:07:20.270 --> 00:07:20.280 align:start position:0% size of the buckets by twice this is not 00:07:20.280 --> 00:07:22.610 align:start position:0% size of the buckets by twice this is not using<00:07:20.520> networks<00:07:21.060> but<00:07:21.599> most<00:07:21.840> importantly<00:07:22.259> here 00:07:22.610 --> 00:07:22.620 align:start position:0% using networks but most importantly here 00:07:22.620 --> 00:07:24.469 align:start position:0% using networks but most importantly here is<00:07:23.160> the<00:07:23.400> curve<00:07:23.699> form<00:07:23.759> and<00:07:24.000> the<00:07:24.120> coordinate 00:07:24.469 --> 00:07:24.479 align:start position:0% is the curve form and the coordinate 00:07:24.479 --> 00:07:27.050 align:start position:0% is the curve form and the coordinate system<00:07:24.720> so<00:07:25.139> we<00:07:25.319> proved<00:07:25.800> that<00:07:25.979> any<00:07:26.400> inner<00:07:26.819> curve 00:07:27.050 --> 00:07:27.060 align:start position:0% system so we proved that any inner curve 00:07:27.060 --> 00:07:28.610 align:start position:0% system so we proved that any inner curve can<00:07:27.240> be<00:07:27.360> written<00:07:27.599> in<00:07:27.720> a<00:07:27.840> Twisted<00:07:28.199> Edwards 00:07:28.610 --> 00:07:28.620 align:start position:0% can be written in a Twisted Edwards 00:07:28.620 --> 00:07:30.770 align:start position:0% can be written in a Twisted Edwards curve<00:07:28.919> with<00:07:29.340> a<00:07:29.460> equal<00:07:29.639> to<00:07:30.060> -1 00:07:30.770 --> 00:07:30.780 align:start position:0% curve with a equal to -1 00:07:30.780 --> 00:07:34.790 align:start position:0% curve with a equal to -1 and<00:07:31.680> we<00:07:32.340> extended<00:07:33.300> a<00:07:33.479> coordinate<00:07:33.840> system<00:07:34.199> so 00:07:34.790 --> 00:07:34.800 align:start position:0% and we extended a coordinate system so 00:07:34.800 --> 00:07:38.029 align:start position:0% and we extended a coordinate system so so<00:07:35.580> we<00:07:35.759> call<00:07:35.880> it<00:07:36.000> custom<00:07:36.180> xyt<00:07:36.960> in<00:07:37.620> order<00:07:37.800> to 00:07:38.029 --> 00:07:38.039 align:start position:0% so we call it custom xyt in order to 00:07:38.039 --> 00:07:40.189 align:start position:0% so we call it custom xyt in order to make<00:07:38.160> computations<00:07:38.699> faster<00:07:39.060> so<00:07:39.300> why<00:07:39.479> is<00:07:39.599> that 00:07:40.189 --> 00:07:40.199 align:start position:0% make computations faster so why is that 00:07:40.199 --> 00:07:41.990 align:start position:0% make computations faster so why is that so<00:07:41.340> um 00:07:41.990 --> 00:07:42.000 align:start position:0% so um 00:07:42.000 --> 00:07:44.870 align:start position:0% so um so<00:07:42.479> I<00:07:42.599> call<00:07:42.840> a<00:07:42.960> b<00:07:43.020> bit<00:07:43.199> MSM<00:07:43.740> is<00:07:43.979> an<00:07:44.160> MSM<00:07:44.580> of<00:07:44.699> size 00:07:44.870 --> 00:07:44.880 align:start position:0% so I call a b bit MSM is an MSM of size 00:07:44.880 --> 00:07:48.129 align:start position:0% so I call a b bit MSM is an MSM of size n<00:07:45.180> with<00:07:46.139> scalars<00:07:46.800> of<00:07:46.860> B<00:07:47.099> bit 00:07:48.129 --> 00:07:48.139 align:start position:0% n with scalars of B bit 00:07:48.139 --> 00:07:50.629 align:start position:0% n with scalars of B bit so<00:07:49.139> generally<00:07:49.740> so<00:07:49.979> all<00:07:50.160> the<00:07:50.340> libraries 00:07:50.629 --> 00:07:50.639 align:start position:0% so generally so all the libraries 00:07:50.639 --> 00:07:52.070 align:start position:0% so generally so all the libraries implement<00:07:51.000> this<00:07:51.180> variant<00:07:51.599> of<00:07:51.660> piplanger 00:07:52.070 --> 00:07:52.080 align:start position:0% implement this variant of piplanger 00:07:52.080 --> 00:07:55.189 align:start position:0% implement this variant of piplanger which<00:07:52.440> is<00:07:52.620> bucket<00:07:53.340> list<00:07:53.460> method<00:07:53.940> so<00:07:54.539> it<00:07:54.840> goes 00:07:55.189 --> 00:07:55.199 align:start position:0% which is bucket list method so it goes 00:07:55.199 --> 00:07:57.230 align:start position:0% which is bucket list method so it goes in<00:07:55.259> three<00:07:55.440> steps<00:07:55.800> so<00:07:55.919> it<00:07:56.160> uses<00:07:56.340> the<00:07:56.460> B<00:07:56.520> bit<00:07:56.699> MSM 00:07:57.230 --> 00:07:57.240 align:start position:0% in three steps so it uses the B bit MSM 00:07:57.240 --> 00:07:59.930 align:start position:0% in three steps so it uses the B bit MSM into<00:07:57.780> CBS<00:07:58.259> MSN<00:07:58.680> for<00:07:58.860> some<00:07:58.979> success<00:07:59.220> for<00:07:59.819> some 00:07:59.930 --> 00:07:59.940 align:start position:0% into CBS MSN for some success for some 00:07:59.940 --> 00:08:02.990 align:start position:0% into CBS MSN for some success for some fixed<00:08:00.360> C<00:08:00.680> we<00:08:01.680> solve<00:08:01.919> each<00:08:02.099> C<00:08:02.280> bit<00:08:02.520> MSM 00:08:02.990 --> 00:08:03.000 align:start position:0% fixed C we solve each C bit MSM 00:08:03.000 --> 00:08:04.490 align:start position:0% fixed C we solve each C bit MSM efficiently<00:08:03.479> and<00:08:03.720> then<00:08:03.840> we<00:08:04.020> combine<00:08:04.259> the<00:08:04.380> C 00:08:04.490 --> 00:08:04.500 align:start position:0% efficiently and then we combine the C 00:08:04.500 --> 00:08:07.189 align:start position:0% efficiently and then we combine the C bits<00:08:04.860> MSM<00:08:05.280> into<00:08:05.759> the<00:08:05.940> final<00:08:06.060> bibet<00:08:06.539> MSM<00:08:06.900> so<00:08:07.080> the 00:08:07.189 --> 00:08:07.199 align:start position:0% bits MSM into the final bibet MSM so the 00:08:07.199 --> 00:08:09.650 align:start position:0% bits MSM into the final bibet MSM so the overall<00:08:07.500> cost<00:08:07.680> is<00:08:07.919> this<00:08:08.099> one<00:08:08.280> so<00:08:08.940> -1<00:08:09.000> is<00:08:09.419> in 00:08:09.650 --> 00:08:09.660 align:start position:0% overall cost is this one so -1 is in 00:08:09.660 --> 00:08:12.290 align:start position:0% overall cost is this one so -1 is in blue<00:08:09.840> is<00:08:10.080> when<00:08:10.259> you<00:08:10.380> use<00:08:10.620> this<00:08:10.979> uh<00:08:11.759> in<00:08:12.060> enough 00:08:12.290 --> 00:08:12.300 align:start position:0% blue is when you use this uh in enough 00:08:12.300 --> 00:08:14.870 align:start position:0% blue is when you use this uh in enough encoding<00:08:12.960> of<00:08:13.139> the<00:08:13.380> scholars<00:08:13.979> otherwise<00:08:14.280> so 00:08:14.870 --> 00:08:14.880 align:start position:0% encoding of the scholars otherwise so 00:08:14.880 --> 00:08:17.689 align:start position:0% encoding of the scholars otherwise so you<00:08:15.120> have<00:08:15.240> two<00:08:15.360> to<00:08:15.599> the<00:08:15.720> scene<00:08:16.400> but<00:08:17.400> this 00:08:17.689 --> 00:08:17.699 align:start position:0% you have two to the scene but this 00:08:17.699 --> 00:08:22.629 align:start position:0% you have two to the scene but this overall<00:08:18.120> cost<00:08:18.360> can<00:08:18.720> be<00:08:19.400> uh<00:08:20.400> explicitly 00:08:22.629 --> 00:08:22.639 align:start position:0% overall cost can be uh explicitly 00:08:22.639 --> 00:08:26.270 align:start position:0% overall cost can be uh explicitly broken<00:08:23.639> into<00:08:23.940> what<00:08:24.720> I<00:08:24.900> call<00:08:25.020> mixed<00:08:25.440> additions 00:08:26.270 --> 00:08:26.280 align:start position:0% broken into what I call mixed additions 00:08:26.280 --> 00:08:30.650 align:start position:0% broken into what I call mixed additions additions<00:08:27.240> and<00:08:27.660> additions<00:08:28.440> and<00:08:28.620> doublings<00:08:29.039> so 00:08:30.650 --> 00:08:30.660 align:start position:0% additions and additions and doublings so 00:08:30.660 --> 00:08:31.189 align:start position:0% additions and additions and doublings so um 00:08:31.189 --> 00:08:31.199 align:start position:0% um 00:08:31.199 --> 00:08:34.190 align:start position:0% um so<00:08:31.740> for<00:08:31.979> large<00:08:32.159> msms<00:08:32.940> so<00:08:33.360> what<00:08:33.659> sees<00:08:34.020> most 00:08:34.190 --> 00:08:34.200 align:start position:0% so for large msms so what sees most 00:08:34.200 --> 00:08:36.050 align:start position:0% so for large msms so what sees most important<00:08:34.560> is<00:08:34.740> the<00:08:34.860> mixed<00:08:35.159> the<00:08:35.700> additions 00:08:36.050 --> 00:08:36.060 align:start position:0% important is the mixed the additions 00:08:36.060 --> 00:08:38.029 align:start position:0% important is the mixed the additions because<00:08:36.240> they<00:08:36.479> scale<00:08:36.839> with<00:08:37.440> the<00:08:37.620> number<00:08:37.800> of 00:08:38.029 --> 00:08:38.039 align:start position:0% because they scale with the number of 00:08:38.039 --> 00:08:40.909 align:start position:0% because they scale with the number of points<00:08:38.760> and<00:08:38.940> the<00:08:39.240> others<00:08:39.539> are<00:08:39.719> constants<00:08:40.620> so 00:08:40.909 --> 00:08:40.919 align:start position:0% points and the others are constants so 00:08:40.919 --> 00:08:42.709 align:start position:0% points and the others are constants so if<00:08:41.099> you<00:08:41.219> look<00:08:41.339> at<00:08:41.580> all<00:08:41.940> the<00:08:42.120> shapes<00:08:42.419> of<00:08:42.599> the 00:08:42.709 --> 00:08:42.719 align:start position:0% if you look at all the shapes of the 00:08:42.719 --> 00:08:44.389 align:start position:0% if you look at all the shapes of the elliptic<00:08:43.140> curves<00:08:43.440> and<00:08:43.800> all<00:08:43.979> the<00:08:44.099> coordinate 00:08:44.389 --> 00:08:44.399 align:start position:0% elliptic curves and all the coordinate 00:08:44.399 --> 00:08:46.070 align:start position:0% elliptic curves and all the coordinate systems<00:08:44.820> that<00:08:44.940> are<00:08:45.120> over<00:08:45.360> there<00:08:45.660> so<00:08:45.839> you<00:08:45.959> can 00:08:46.070 --> 00:08:46.080 align:start position:0% systems that are over there so you can 00:08:46.080 --> 00:08:48.550 align:start position:0% systems that are over there so you can look<00:08:46.200> at<00:08:46.320> efd<00:08:46.880> webpage 00:08:48.550 --> 00:08:48.560 align:start position:0% look at efd webpage 00:08:48.560 --> 00:08:51.350 align:start position:0% look at efd webpage so<00:08:49.560> Twisted<00:08:49.920> Edwards<00:08:50.339> with<00:08:50.519> a<00:08:50.640> equal<00:08:50.760> to<00:08:51.000> minus 00:08:51.350 --> 00:08:51.360 align:start position:0% so Twisted Edwards with a equal to minus 00:08:51.360 --> 00:08:53.509 align:start position:0% so Twisted Edwards with a equal to minus one<00:08:51.480> with<00:08:51.899> extended<00:08:52.380> coordinate<00:08:52.800> system<00:08:53.040> have 00:08:53.509 --> 00:08:53.519 align:start position:0% one with extended coordinate system have 00:08:53.519 --> 00:08:55.850 align:start position:0% one with extended coordinate system have seven<00:08:53.940> multiplication<00:08:54.660> for<00:08:55.380> dedicated 00:08:55.850 --> 00:08:55.860 align:start position:0% seven multiplication for dedicated 00:08:55.860 --> 00:08:59.030 align:start position:0% seven multiplication for dedicated addition<00:08:56.360> uh<00:08:57.360> compared<00:08:57.779> to<00:08:57.839> for<00:08:58.260> example<00:08:58.500> 11 00:08:59.030 --> 00:08:59.040 align:start position:0% addition uh compared to for example 11 00:08:59.040 --> 00:09:02.570 align:start position:0% addition uh compared to for example 11 in<00:08:59.700> artworks<00:09:00.240> with<00:09:00.360> Jacobian<00:09:00.720> coordinates 00:09:02.570 --> 00:09:02.580 align:start position:0% in artworks with Jacobian coordinates 00:09:02.580 --> 00:09:05.570 align:start position:0% in artworks with Jacobian coordinates um so<00:09:03.360> what<00:09:03.660> we<00:09:03.839> did<00:09:04.080> is<00:09:04.260> basically<00:09:04.680> when<00:09:05.279> I 00:09:05.570 --> 00:09:05.580 align:start position:0% um so what we did is basically when I 00:09:05.580 --> 00:09:08.810 align:start position:0% um so what we did is basically when I say<00:09:05.640> addition<00:09:06.300> is<00:09:06.800> so<00:09:07.800> those<00:09:08.040> points<00:09:08.459> are 00:09:08.810 --> 00:09:08.820 align:start position:0% say addition is so those points are 00:09:08.820 --> 00:09:11.389 align:start position:0% say addition is so those points are re-added<00:09:09.480> in<00:09:10.260> the<00:09:10.380> package<00:09:10.680> so<00:09:10.860> they<00:09:11.160> are<00:09:11.279> the 00:09:11.389 --> 00:09:11.399 align:start position:0% re-added in the package so they are the 00:09:11.399 --> 00:09:13.130 align:start position:0% re-added in the package so they are the same<00:09:11.580> so<00:09:11.880> when<00:09:12.240> you<00:09:12.360> look<00:09:12.480> at<00:09:12.660> this<00:09:12.839> unified 00:09:13.130 --> 00:09:13.140 align:start position:0% same so when you look at this unified 00:09:13.140 --> 00:09:15.170 align:start position:0% same so when you look at this unified addition<00:09:13.680> so<00:09:14.100> which<00:09:14.279> means<00:09:14.519> that<00:09:14.640> we<00:09:14.880> will<00:09:15.060> not 00:09:15.170 --> 00:09:15.180 align:start position:0% addition so which means that we will not 00:09:15.180 --> 00:09:17.930 align:start position:0% addition so which means that we will not have<00:09:15.420> any<00:09:15.720> band<00:09:15.959> any<00:09:16.320> F<00:09:16.560> else<00:09:16.800> branches<00:09:17.279> to<00:09:17.700> to 00:09:17.930 --> 00:09:17.940 align:start position:0% have any band any F else branches to to 00:09:17.940 --> 00:09:21.230 align:start position:0% have any band any F else branches to to handle<00:09:18.779> exception<00:09:19.440> case<00:09:19.760> so<00:09:20.760> it<00:09:20.940> is<00:09:21.060> one 00:09:21.230 --> 00:09:21.240 align:start position:0% handle exception case so it is one 00:09:21.240 --> 00:09:22.850 align:start position:0% handle exception case so it is one multiplication<00:09:21.839> plus<00:09:22.080> but<00:09:22.380> the 00:09:22.850 --> 00:09:22.860 align:start position:0% multiplication plus but the 00:09:22.860 --> 00:09:24.590 align:start position:0% multiplication plus but the multiplication<00:09:23.339> is<00:09:23.700> a<00:09:23.820> multiplication<00:09:24.240> by<00:09:24.480> a 00:09:24.590 --> 00:09:24.600 align:start position:0% multiplication is a multiplication by a 00:09:24.600 --> 00:09:26.570 align:start position:0% multiplication is a multiplication by a constant<00:09:24.959> which<00:09:25.140> is<00:09:25.200> 2<00:09:25.320> to<00:09:25.500> the<00:09:25.680> D<00:09:25.800> so<00:09:26.220> we<00:09:26.459> come 00:09:26.570 --> 00:09:26.580 align:start position:0% constant which is 2 to the D so we come 00:09:26.580 --> 00:09:28.370 align:start position:0% constant which is 2 to the D so we come up<00:09:26.700> with<00:09:26.880> a<00:09:27.000> custom<00:09:27.180> coordinate<00:09:27.720> system<00:09:28.019> which 00:09:28.370 --> 00:09:28.380 align:start position:0% up with a custom coordinate system which 00:09:28.380 --> 00:09:30.889 align:start position:0% up with a custom coordinate system which is<00:09:28.500> instead<00:09:29.339> of<00:09:29.459> having<00:09:29.760> the<00:09:30.000> Tuple<00:09:30.360> X<00:09:30.480> and<00:09:30.720> Y 00:09:30.889 --> 00:09:30.899 align:start position:0% is instead of having the Tuple X and Y 00:09:30.899 --> 00:09:33.769 align:start position:0% is instead of having the Tuple X and Y you<00:09:31.200> have<00:09:31.380> y<00:09:31.800> minus<00:09:32.160> X<00:09:32.399> Y<00:09:32.640> plus<00:09:32.880> X<00:09:33.180> and<00:09:33.420> 2<00:09:33.540> times 00:09:33.769 --> 00:09:33.779 align:start position:0% you have y minus X Y plus X and 2 times 00:09:33.779 --> 00:09:38.210 align:start position:0% you have y minus X Y plus X and 2 times D<00:09:34.019> times<00:09:34.320> x<00:09:34.680> times<00:09:34.920> y<00:09:35.519> so<00:09:36.360> you<00:09:37.260> can<00:09:37.380> do<00:09:37.560> unified 00:09:38.210 --> 00:09:38.220 align:start position:0% D times x times y so you can do unified 00:09:38.220 --> 00:09:39.710 align:start position:0% D times x times y so you can do unified additions<00:09:38.760> without<00:09:38.880> branching<00:09:39.420> at<00:09:39.540> the<00:09:39.660> same 00:09:39.710 --> 00:09:39.720 align:start position:0% additions without branching at the same 00:09:39.720 --> 00:09:42.110 align:start position:0% additions without branching at the same cost<00:09:39.899> of<00:09:40.080> the<00:09:40.200> the<00:09:40.560> dedicated<00:09:41.279> addition<00:09:41.640> to 00:09:42.110 --> 00:09:42.120 align:start position:0% cost of the the dedicated addition to 00:09:42.120 --> 00:09:44.949 align:start position:0% cost of the the dedicated addition to seven<00:09:42.540> multiplication 00:09:44.949 --> 00:09:44.959 align:start position:0% seven multiplication 00:09:44.959 --> 00:09:47.329 align:start position:0% seven multiplication yeah<00:09:45.959> and<00:09:46.260> this<00:09:46.440> is<00:09:46.500> basically<00:09:46.800> one<00:09:47.100> of<00:09:47.160> the 00:09:47.329 --> 00:09:47.339 align:start position:0% yeah and this is basically one of the 00:09:47.339 --> 00:09:49.970 align:start position:0% yeah and this is basically one of the the<00:09:47.580> optimizations<00:09:48.360> that<00:09:48.720> makes<00:09:48.959> MSM<00:09:49.740> faster 00:09:49.970 --> 00:09:49.980 align:start position:0% the optimizations that makes MSM faster 00:09:49.980 --> 00:09:51.070 align:start position:0% the optimizations that makes MSM faster in<00:09:50.220> crack 00:09:51.070 --> 00:09:51.080 align:start position:0% in crack 00:09:51.080 --> 00:09:54.110 align:start position:0% in crack this<00:09:52.440> inbox<00:09:52.920> was<00:09:53.160> right<00:09:53.399> in<00:09:53.640> the<00:09:53.760> circuit<00:09:54.000> C 00:09:54.110 --> 00:09:54.120 align:start position:0% this inbox was right in the circuit C 00:09:54.120 --> 00:09:56.150 align:start position:0% this inbox was right in the circuit C Prime<00:09:54.360> of<00:09:54.600> the<00:09:54.660> verification<00:09:55.080> of<00:09:55.260> Pi<00:09:55.500> so<00:09:55.980> in 00:09:56.150 --> 00:09:56.160 align:start position:0% Prime of the verification of Pi so in 00:09:56.160 --> 00:09:57.829 align:start position:0% Prime of the verification of Pi so in the<00:09:56.279> previous<00:09:56.339> presentations<00:09:57.060> we've<00:09:57.600> talked 00:09:57.829 --> 00:09:57.839 align:start position:0% the previous presentations we've talked 00:09:57.839 --> 00:10:00.110 align:start position:0% the previous presentations we've talked about<00:09:57.959> parent<00:09:58.740> check<00:09:59.040> inside<00:09:59.279> a<00:09:59.580> circuit<00:09:59.880> and 00:10:00.110 --> 00:10:00.120 align:start position:0% about parent check inside a circuit and 00:10:00.120 --> 00:10:03.949 align:start position:0% about parent check inside a circuit and how<00:10:00.240> much<00:10:00.360> it<00:10:00.540> is<00:10:00.660> expensive<00:10:01.080> right<00:10:01.519> so<00:10:02.959> there 00:10:03.949 --> 00:10:03.959 align:start position:0% how much it is expensive right so there 00:10:03.959 --> 00:10:06.410 align:start position:0% how much it is expensive right so there is<00:10:04.140> a<00:10:04.260> long<00:10:04.320> line<00:10:04.560> of<00:10:04.740> research<00:10:05.220> of<00:10:05.880> pairing 00:10:06.410 --> 00:10:06.420 align:start position:0% is a long line of research of pairing 00:10:06.420 --> 00:10:08.509 align:start position:0% is a long line of research of pairing computation<00:10:06.839> outside<00:10:07.080> of<00:10:07.380> the<00:10:07.500> circuit<00:10:07.800> and 00:10:08.509 --> 00:10:08.519 align:start position:0% computation outside of the circuit and 00:10:08.519 --> 00:10:11.870 align:start position:0% computation outside of the circuit and we<00:10:08.700> can<00:10:08.820> do<00:10:09.260> computations<00:10:10.260> of<00:10:10.560> BLS<00:10:11.160> appearing 00:10:11.870 --> 00:10:11.880 align:start position:0% we can do computations of BLS appearing 00:10:11.880 --> 00:10:14.150 align:start position:0% we can do computations of BLS appearing of<00:10:12.000> BLS<00:10:12.300> 12377<00:10:13.019> outside<00:10:13.260> of<00:10:13.560> circuit<00:10:13.860> in<00:10:13.980> less 00:10:14.150 --> 00:10:14.160 align:start position:0% of BLS 12377 outside of circuit in less 00:10:14.160 --> 00:10:16.070 align:start position:0% of BLS 12377 outside of circuit in less than<00:10:14.279> one<00:10:14.519> millisecond<00:10:15.060> but<00:10:15.540> if<00:10:15.720> you<00:10:15.899> put 00:10:16.070 --> 00:10:16.080 align:start position:0% than one millisecond but if you put 00:10:16.080 --> 00:10:19.070 align:start position:0% than one millisecond but if you put mutations<00:10:16.620> those<00:10:17.459> optimizations<00:10:18.060> inside<00:10:18.779> of 00:10:19.070 --> 00:10:19.080 align:start position:0% mutations those optimizations inside of 00:10:19.080 --> 00:10:20.930 align:start position:0% mutations those optimizations inside of a<00:10:19.260> circuit<00:10:19.620> the<00:10:20.040> number<00:10:20.160> of<00:10:20.279> constraints<00:10:20.760> is 00:10:20.930 --> 00:10:20.940 align:start position:0% a circuit the number of constraints is 00:10:20.940 --> 00:10:24.110 align:start position:0% a circuit the number of constraints is roughly<00:10:21.300> 80<00:10:21.959> 000<00:10:22.019> in<00:10:22.440> LS<00:10:22.860> so<00:10:23.580> we<00:10:23.700> were<00:10:23.880> able<00:10:24.060> to 00:10:24.110 --> 00:10:24.120 align:start position:0% roughly 80 000 in LS so we were able to 00:10:24.120 --> 00:10:27.769 align:start position:0% roughly 80 000 in LS so we were able to reduce<00:10:24.360> it<00:10:24.660> to<00:10:24.839> eight<00:10:25.140> so<00:10:25.800> 11.5<00:10:26.779> constraints 00:10:27.769 --> 00:10:27.779 align:start position:0% reduce it to eight so 11.5 constraints 00:10:27.779 --> 00:10:30.230 align:start position:0% reduce it to eight so 11.5 constraints so<00:10:28.200> there<00:10:28.440> are<00:10:28.620> a<00:10:28.680> few<00:10:28.940> implementations<00:10:29.940> so 00:10:30.230 --> 00:10:30.240 align:start position:0% so there are a few implementations so 00:10:30.240 --> 00:10:31.730 align:start position:0% so there are a few implementations so far<00:10:30.420> so<00:10:30.600> there<00:10:30.720> is<00:10:30.839> one<00:10:30.959> in<00:10:31.080> our<00:10:31.200> quarks<00:10:31.560> one<00:10:31.620> in 00:10:31.730 --> 00:10:31.740 align:start position:0% far so there is one in our quarks one in 00:10:31.740 --> 00:10:34.130 align:start position:0% far so there is one in our quarks one in lips<00:10:31.980> knocks<00:10:32.279> and<00:10:32.459> I<00:10:32.640> believe<00:10:32.760> one<00:10:33.120> a<00:10:33.720> new<00:10:33.959> one 00:10:34.130 --> 00:10:34.140 align:start position:0% lips knocks and I believe one a new one 00:10:34.140 --> 00:10:38.449 align:start position:0% lips knocks and I believe one a new one in<00:10:34.440> the<00:10:34.560> ZK<00:10:34.980> Peg<00:10:35.279> by<00:10:35.519> zero<00:10:36.060> EXP 00:10:38.449 --> 00:10:38.459 align:start position:0% 00:10:38.459 --> 00:10:40.430 align:start position:0% in<00:10:38.940> Arc<00:10:39.300> Works<00:10:39.600> which<00:10:39.720> was<00:10:39.899> the<00:10:40.080> state<00:10:40.200> of<00:10:40.320> the 00:10:40.430 --> 00:10:40.440 align:start position:0% in Arc Works which was the state of the 00:10:40.440 --> 00:10:42.710 align:start position:0% in Arc Works which was the state of the art<00:10:40.500> for<00:10:40.680> this<00:10:40.860> computation<00:10:41.220> it<00:10:41.459> was<00:10:41.640> 19 00:10:42.710 --> 00:10:42.720 align:start position:0% art for this computation it was 19 00:10:42.720 --> 00:10:44.150 align:start position:0% art for this computation it was 19 000<00:10:42.839> constraints 00:10:44.150 --> 00:10:44.160 align:start position:0% 000 constraints 00:10:44.160 --> 00:10:47.389 align:start position:0% 000 constraints but<00:10:44.760> we<00:10:45.060> were<00:10:45.360> able<00:10:45.600> to<00:10:45.660> reduce<00:10:45.839> it<00:10:46.140> to<00:10:46.260> 11.5<00:10:46.740> so 00:10:47.389 --> 00:10:47.399 align:start position:0% but we were able to reduce it to 11.5 so 00:10:47.399 --> 00:10:49.610 align:start position:0% but we were able to reduce it to 11.5 so the<00:10:47.700> the<00:10:47.940> paper<00:10:48.180> is<00:10:48.480> here 00:10:49.610 --> 00:10:49.620 align:start position:0% the the paper is here 00:10:49.620 --> 00:10:52.370 align:start position:0% the the paper is here uh<00:10:50.100> you<00:10:50.220> can<00:10:50.339> check<00:10:50.459> it<00:10:50.720> uh<00:10:51.720> but<00:10:52.019> the<00:10:52.260> main 00:10:52.370 --> 00:10:52.380 align:start position:0% uh you can check it uh but the main 00:10:52.380 --> 00:10:54.530 align:start position:0% uh you can check it uh but the main ideas<00:10:52.560> are<00:10:53.040> basically 00:10:54.530 --> 00:10:54.540 align:start position:0% ideas are basically 00:10:54.540 --> 00:10:56.630 align:start position:0% ideas are basically um<00:10:54.600> so<00:10:55.079> the<00:10:55.200> inverse<00:10:55.620> is<00:10:55.740> not<00:10:55.860> costly<00:10:56.220> and<00:10:56.519> I 00:10:56.630 --> 00:10:56.640 align:start position:0% um so the inverse is not costly and I 00:10:56.640 --> 00:10:58.910 align:start position:0% um so the inverse is not costly and I almost<00:10:56.760> here<00:10:57.000> so<00:10:57.180> you<00:10:57.300> can<00:10:57.420> do<00:10:57.600> double<00:10:58.320> and<00:10:58.620> add 00:10:58.910 --> 00:10:58.920 align:start position:0% almost here so you can do double and add 00:10:58.920 --> 00:11:02.350 align:start position:0% almost here so you can do double and add in<00:10:59.279> a<00:10:59.339> fine<00:10:59.519> so<00:10:59.820> not<00:11:00.060> double<00:11:00.240> and<00:11:00.540> double<00:11:01.079> and 00:11:02.350 --> 00:11:02.360 align:start position:0% in a fine so not double and double and 00:11:02.360 --> 00:11:05.630 align:start position:0% in a fine so not double and double and uh<00:11:03.360> we<00:11:03.779> have<00:11:04.140> a<00:11:04.500> different<00:11:04.680> representation<00:11:05.399> of 00:11:05.630 --> 00:11:05.640 align:start position:0% uh we have a different representation of 00:11:05.640 --> 00:11:07.550 align:start position:0% uh we have a different representation of the<00:11:05.820> line<00:11:06.000> so<00:11:06.660> that<00:11:06.839> we<00:11:07.019> have<00:11:07.140> sparse 00:11:07.550 --> 00:11:07.560 align:start position:0% the line so that we have sparse 00:11:07.560 --> 00:11:09.470 align:start position:0% the line so that we have sparse multiplications<00:11:08.040> by<00:11:08.279> the<00:11:08.459> line<00:11:08.579> in<00:11:08.820> our<00:11:09.060> CS 00:11:09.470 --> 00:11:09.480 align:start position:0% multiplications by the line in our CS 00:11:09.480 --> 00:11:10.569 align:start position:0% multiplications by the line in our CS wise 00:11:10.569 --> 00:11:10.579 align:start position:0% wise 00:11:10.579 --> 00:11:13.490 align:start position:0% wise we<00:11:11.579> use<00:11:11.700> Choice<00:11:11.940> based<00:11:12.420> arithmetic<00:11:13.019> inside<00:11:13.200> of 00:11:13.490 --> 00:11:13.500 align:start position:0% we use Choice based arithmetic inside of 00:11:13.500 --> 00:11:15.590 align:start position:0% we use Choice based arithmetic inside of the<00:11:13.620> circuit<00:11:13.980> so<00:11:14.519> it<00:11:14.700> uses<00:11:14.940> inverses<00:11:15.420> that's 00:11:15.590 --> 00:11:15.600 align:start position:0% the circuit so it uses inverses that's 00:11:15.600 --> 00:11:17.389 align:start position:0% the circuit so it uses inverses that's why<00:11:15.779> it<00:11:15.899> wasn't<00:11:16.019> used<00:11:16.380> outside<00:11:17.040> of<00:11:17.279> the 00:11:17.389 --> 00:11:17.399 align:start position:0% why it wasn't used outside of the 00:11:17.399 --> 00:11:19.009 align:start position:0% why it wasn't used outside of the circuit<00:11:17.700> but<00:11:17.880> inside<00:11:18.180> of<00:11:18.480> the<00:11:18.600> circuits<00:11:18.959> it 00:11:19.009 --> 00:11:19.019 align:start position:0% circuit but inside of the circuits it 00:11:19.019 --> 00:11:20.630 align:start position:0% circuit but inside of the circuits it makes<00:11:19.260> sense<00:11:19.740> and<00:11:20.220> the<00:11:20.339> finance 00:11:20.630 --> 00:11:20.640 align:start position:0% makes sense and the finance 00:11:20.640 --> 00:11:23.030 align:start position:0% makes sense and the finance pronunciation<00:11:21.120> is<00:11:21.300> also<00:11:21.540> using<00:11:21.839> calabino<00:11:22.740> SQL 00:11:23.030 --> 00:11:23.040 align:start position:0% pronunciation is also using calabino SQL 00:11:23.040 --> 00:11:24.290 align:start position:0% pronunciation is also using calabino SQL Atomic<00:11:23.339> squaring<00:11:23.640> instead<00:11:23.880> instead<00:11:24.240> of 00:11:24.290 --> 00:11:24.300 align:start position:0% Atomic squaring instead instead of 00:11:24.300 --> 00:11:26.269 align:start position:0% Atomic squaring instead instead of conjure<00:11:24.779> Scots<00:11:25.079> which<00:11:25.560> is<00:11:25.680> not<00:11:25.860> used<00:11:26.040> outside 00:11:26.269 --> 00:11:26.279 align:start position:0% conjure Scots which is not used outside 00:11:26.279 --> 00:11:29.150 align:start position:0% conjure Scots which is not used outside of<00:11:26.579> the<00:11:26.760> circuit<00:11:27.060> and<00:11:27.779> for<00:11:28.260> both<00:11:28.500> the<00:11:28.800> media 00:11:29.150 --> 00:11:29.160 align:start position:0% of the circuit and for both the media 00:11:29.160 --> 00:11:31.130 align:start position:0% of the circuit and for both the media Loop<00:11:29.459> and<00:11:29.640> the<00:11:29.820> final<00:11:29.940> exponentiation<00:11:30.600> we<00:11:30.959> use 00:11:31.130 --> 00:11:31.140 align:start position:0% Loop and the final exponentiation we use 00:11:31.140 --> 00:11:33.410 align:start position:0% Loop and the final exponentiation we use short<00:11:31.620> addition<00:11:32.040> chains<00:11:32.459> but<00:11:32.940> the<00:11:33.060> trick<00:11:33.300> here 00:11:33.410 --> 00:11:33.420 align:start position:0% short addition chains but the trick here 00:11:33.420 --> 00:11:34.790 align:start position:0% short addition chains but the trick here is<00:11:33.600> that<00:11:33.779> normally<00:11:34.140> in<00:11:34.260> a<00:11:34.440> short<00:11:34.500> addition 00:11:34.790 --> 00:11:34.800 align:start position:0% is that normally in a short addition 00:11:34.800 --> 00:11:37.730 align:start position:0% is that normally in a short addition chain<00:11:35.100> of<00:11:35.820> Dublin<00:11:36.180> ad<00:11:36.540> you<00:11:37.260> would<00:11:37.380> like<00:11:37.560> to 00:11:37.730 --> 00:11:37.740 align:start position:0% chain of Dublin ad you would like to 00:11:37.740 --> 00:11:40.910 align:start position:0% chain of Dublin ad you would like to have<00:11:37.920> to<00:11:38.160> optimize<00:11:38.579> the<00:11:38.760> the<00:11:39.000> the<00:11:39.120> doublings 00:11:40.910 --> 00:11:40.920 align:start position:0% have to optimize the the the doublings 00:11:40.920 --> 00:11:42.590 align:start position:0% have to optimize the the the doublings because<00:11:41.399> doublings<00:11:41.940> are<00:11:42.180> faster<00:11:42.420> than 00:11:42.590 --> 00:11:42.600 align:start position:0% because doublings are faster than 00:11:42.600 --> 00:11:44.990 align:start position:0% because doublings are faster than additions<00:11:43.079> but<00:11:43.380> constraints<00:11:43.980> wise<00:11:44.279> it's<00:11:44.700> the 00:11:44.990 --> 00:11:45.000 align:start position:0% additions but constraints wise it's the 00:11:45.000 --> 00:11:47.329 align:start position:0% additions but constraints wise it's the opposite<00:11:45.620> are<00:11:46.620> doubling<00:11:46.860> costs<00:11:47.279> more 00:11:47.329 --> 00:11:47.339 align:start position:0% opposite are doubling costs more 00:11:47.339 --> 00:11:49.490 align:start position:0% opposite are doubling costs more constraint<00:11:47.700> annulation<00:11:48.180> because<00:11:48.540> the<00:11:49.320> line 00:11:49.490 --> 00:11:49.500 align:start position:0% constraint annulation because the line 00:11:49.500 --> 00:11:51.530 align:start position:0% constraint annulation because the line slope<00:11:49.980> is<00:11:50.160> has<00:11:50.459> a<00:11:50.640> square<00:11:50.760> so<00:11:51.000> it<00:11:51.120> scores<00:11:51.300> two 00:11:51.530 --> 00:11:51.540 align:start position:0% slope is has a square so it scores two 00:11:51.540 --> 00:11:53.630 align:start position:0% slope is has a square so it scores two constraints<00:11:51.959> instead<00:11:52.500> of<00:11:52.560> one<00:11:52.920> just<00:11:53.160> switched 00:11:53.630 --> 00:11:53.640 align:start position:0% constraints instead of one just switched 00:11:53.640 --> 00:11:56.090 align:start position:0% constraints instead of one just switched division<00:11:54.060> so<00:11:54.660> the<00:11:54.839> idea<00:11:55.019> is<00:11:55.200> cross<00:11:55.500> section<00:11:55.860> is 00:11:56.090 --> 00:11:56.100 align:start position:0% division so the idea is cross section is 00:11:56.100 --> 00:11:59.269 align:start position:0% division so the idea is cross section is only<00:11:56.220> in<00:11:56.579> 19<00:11:57.540> K<00:11:58.200> constraint<00:11:58.680> bearded 00:11:59.269 --> 00:11:59.279 align:start position:0% only in 19 K constraint bearded 00:11:59.279 --> 00:12:01.730 align:start position:0% only in 19 K constraint bearded signature<00:11:59.579> is<00:11:59.760> 14.8<00:12:00.540> constraint<00:12:01.019> case 00:12:01.730 --> 00:12:01.740 align:start position:0% signature is 14.8 constraint case 00:12:01.740 --> 00:12:04.550 align:start position:0% signature is 14.8 constraint case constraint<00:12:02.160> and<00:12:02.339> kcg<00:12:02.760> verifier<00:12:03.240> is<00:12:03.540> just<00:12:03.779> uh 00:12:04.550 --> 00:12:04.560 align:start position:0% constraint and kcg verifier is just uh 00:12:04.560 --> 00:12:08.630 align:start position:0% constraint and kcg verifier is just uh 20<00:12:05.519> 000<00:12:05.579> constraints 00:12:08.630 --> 00:12:08.640 align:start position:0% 00:12:08.640 --> 00:12:14.329 align:start position:0% um<00:12:08.760> the<00:12:08.940> last<00:12:09.180> box<00:12:09.420> so<00:12:10.140> pairings<00:12:10.620> over<00:12:10.800> bw6761 00:12:14.329 --> 00:12:14.339 align:start position:0% 00:12:14.339 --> 00:12:15.829 align:start position:0% um<00:12:14.399> so 00:12:15.829 --> 00:12:15.839 align:start position:0% um so 00:12:15.839 --> 00:12:18.170 align:start position:0% um so we<00:12:16.500> can<00:12:16.680> compute<00:12:17.040> this<00:12:17.220> on<00:12:17.459> a<00:12:17.640> inside<00:12:17.820> machine 00:12:18.170 --> 00:12:18.180 align:start position:0% we can compute this on a inside machine 00:12:18.180 --> 00:12:22.150 align:start position:0% we can compute this on a inside machine here<00:12:18.480> in<00:12:19.260> 1.22<00:12:20.100> milliseconds<00:12:20.700> compared<00:12:21.540> to 00:12:22.150 --> 00:12:22.160 align:start position:0% here in 1.22 milliseconds compared to 00:12:22.160 --> 00:12:26.449 align:start position:0% here in 1.22 milliseconds compared to 1.76<00:12:23.600> 71<00:12:24.680> milliseconds<00:12:25.680> and<00:12:25.920> the<00:12:26.100> question<00:12:26.220> is 00:12:26.449 --> 00:12:26.459 align:start position:0% 1.76 71 milliseconds and the question is 00:12:26.459 --> 00:12:29.210 align:start position:0% 1.76 71 milliseconds and the question is why<00:12:26.700> so<00:12:27.600> actually<00:12:27.959> we<00:12:28.200> do<00:12:28.380> not<00:12:28.500> implement<00:12:28.920> the 00:12:29.210 --> 00:12:29.220 align:start position:0% why so actually we do not implement the 00:12:29.220 --> 00:12:31.069 align:start position:0% why so actually we do not implement the same<00:12:29.459> formula 00:12:31.069 --> 00:12:31.079 align:start position:0% same formula 00:12:31.079 --> 00:12:32.210 align:start position:0% same formula so 00:12:32.210 --> 00:12:32.220 align:start position:0% so 00:12:32.220 --> 00:12:35.630 align:start position:0% so um appearing<00:12:32.940> is<00:12:33.120> so<00:12:33.720> of<00:12:34.079> p<00:12:34.260> and<00:12:34.440> Q<00:12:34.620> is<00:12:34.920> this<00:12:35.220> m 00:12:35.630 --> 00:12:35.640 align:start position:0% um appearing is so of p and Q is this m 00:12:35.640 --> 00:12:37.490 align:start position:0% um appearing is so of p and Q is this m of<00:12:35.820> p<00:12:36.000> and<00:12:36.180> Q<00:12:36.360> which<00:12:36.720> is<00:12:36.839> what<00:12:37.140> we<00:12:37.260> call<00:12:37.380> the 00:12:37.490 --> 00:12:37.500 align:start position:0% of p and Q which is what we call the 00:12:37.500 --> 00:12:40.550 align:start position:0% of p and Q which is what we call the middle<00:12:37.680> Loop<00:12:38.100> so<00:12:38.339> it<00:12:38.459> is<00:12:38.519> a<00:12:38.640> loop<00:12:39.240> and<00:12:40.019> a<00:12:40.260> final 00:12:40.550 --> 00:12:40.560 align:start position:0% middle Loop so it is a loop and a final 00:12:40.560 --> 00:12:41.690 align:start position:0% middle Loop so it is a loop and a final exponentiation<00:12:41.279> which<00:12:41.459> is<00:12:41.579> the 00:12:41.690 --> 00:12:41.700 align:start position:0% exponentiation which is the 00:12:41.700 --> 00:12:43.610 align:start position:0% exponentiation which is the exponentiation<00:12:42.300> by<00:12:42.540> Q<00:12:42.720> to<00:12:42.959> this<00:12:43.079> x<00:12:43.260> minus<00:12:43.500> 1 00:12:43.610 --> 00:12:43.620 align:start position:0% exponentiation by Q to this x minus 1 00:12:43.620 --> 00:12:46.190 align:start position:0% exponentiation by Q to this x minus 1 out<00:12:43.740> of<00:12:43.920> R<00:12:44.100> so<00:12:44.880> the<00:12:45.300> optimization<00:12:45.779> comes<00:12:46.079> from 00:12:46.190 --> 00:12:46.200 align:start position:0% out of R so the optimization comes from 00:12:46.200 --> 00:12:49.150 align:start position:0% out of R so the optimization comes from the<00:12:46.320> middle<00:12:46.440> Loop<00:12:47.100> so<00:12:47.760> the<00:12:48.000> original<00:12:48.180> paper<00:12:48.660> of 00:12:49.150 --> 00:12:49.160 align:start position:0% the middle Loop so the original paper of 00:12:49.160 --> 00:12:51.590 align:start position:0% the middle Loop so the original paper of bw6761<00:12:50.160> has<00:12:50.519> this<00:12:50.700> formula<00:12:51.120> for<00:12:51.240> computing 00:12:51.590 --> 00:12:51.600 align:start position:0% bw6761 has this formula for computing 00:12:51.600 --> 00:12:54.470 align:start position:0% bw6761 has this formula for computing the<00:12:51.720> plane<00:12:51.839> which<00:12:52.139> is<00:12:52.260> f<00:12:52.500> of<00:12:53.220> U<00:12:53.459> plus<00:12:53.760> plus<00:12:54.240> one 00:12:54.470 --> 00:12:54.480 align:start position:0% the plane which is f of U plus plus one 00:12:54.480 --> 00:12:58.430 align:start position:0% the plane which is f of U plus plus one and<00:12:54.720> F<00:12:54.899> of<00:12:55.079> u<00:12:55.320> q<00:12:55.620> minus<00:12:56.120> uh<00:12:57.120> Square<00:12:57.360> minus<00:12:57.779> U<00:12:57.899> so 00:12:58.430 --> 00:12:58.440 align:start position:0% and F of u q minus uh Square minus U so 00:12:58.440 --> 00:13:00.470 align:start position:0% and F of u q minus uh Square minus U so which<00:12:58.740> are<00:12:58.980> two<00:12:59.220> Miller<00:12:59.459> Loops<00:12:59.880> of<00:13:00.060> size<00:13:00.240> U 00:13:00.470 --> 00:13:00.480 align:start position:0% which are two Miller Loops of size U 00:13:00.480 --> 00:13:03.710 align:start position:0% which are two Miller Loops of size U plus<00:13:00.660> one<00:13:00.839> and<00:13:01.320> uq<00:13:01.680> minus<00:13:02.040> U<00:13:02.220> Square<00:13:02.459> minus<00:13:02.880> U 00:13:03.710 --> 00:13:03.720 align:start position:0% plus one and uq minus U Square minus U 00:13:03.720 --> 00:13:06.470 align:start position:0% plus one and uq minus U Square minus U so<00:13:04.019> when<00:13:04.260> you<00:13:04.500> see<00:13:04.860> those<00:13:05.459> uh<00:13:06.000> so<00:13:06.240> they<00:13:06.360> have 00:13:06.470 --> 00:13:06.480 align:start position:0% so when you see those uh so they have 00:13:06.480 --> 00:13:10.610 align:start position:0% so when you see those uh so they have bit<00:13:06.720> size<00:13:06.959> 64<00:13:07.860> and<00:13:08.399> 190<00:13:09.120> and<00:13:09.720> they<00:13:10.200> humming 00:13:10.610 --> 00:13:10.620 align:start position:0% bit size 64 and 190 and they humming 00:13:10.620 --> 00:13:13.550 align:start position:0% bit size 64 and 190 and they humming weight<00:13:10.800> in<00:13:11.040> two<00:13:11.160> and<00:13:11.279> a<00:13:11.399> half<00:13:11.399> is<00:13:11.639> 7<00:13:12.000> and<00:13:12.360> 31.<00:13:13.079> so 00:13:13.550 --> 00:13:13.560 align:start position:0% weight in two and a half is 7 and 31. so 00:13:13.560 --> 00:13:15.650 align:start position:0% weight in two and a half is 7 and 31. so what<00:13:13.740> we<00:13:13.860> did<00:13:14.040> in<00:13:14.160> gnoc<00:13:14.519> is<00:13:14.700> that<00:13:14.880> we<00:13:15.000> observed 00:13:15.650 --> 00:13:15.660 align:start position:0% what we did in gnoc is that we observed 00:13:15.660 --> 00:13:17.870 align:start position:0% what we did in gnoc is that we observed that<00:13:15.959> U<00:13:16.260> minus<00:13:16.680> 1<00:13:16.800> square<00:13:17.160> the<00:13:17.519> Hamming 00:13:17.870 --> 00:13:17.880 align:start position:0% that U minus 1 square the Hamming 00:13:17.880 --> 00:13:19.850 align:start position:0% that U minus 1 square the Hamming weights<00:13:18.180> of<00:13:18.300> it<00:13:18.360> in<00:13:18.540> two<00:13:18.720> half<00:13:18.959> is<00:13:19.200> just<00:13:19.440> 12 00:13:19.850 --> 00:13:19.860 align:start position:0% weights of it in two half is just 12 00:13:19.860 --> 00:13:22.250 align:start position:0% weights of it in two half is just 12 compared<00:13:20.399> to<00:13:20.519> 31<00:13:20.940> and<00:13:21.360> we<00:13:21.600> already<00:13:21.779> arranged 00:13:22.250 --> 00:13:22.260 align:start position:0% compared to 31 and we already arranged 00:13:22.260 --> 00:13:25.129 align:start position:0% compared to 31 and we already arranged the<00:13:22.380> equation<00:13:22.680> so<00:13:23.040> that<00:13:23.279> we<00:13:24.120> uh<00:13:24.600> have<00:13:24.899> this 00:13:25.129 --> 00:13:25.139 align:start position:0% the equation so that we uh have this 00:13:25.139 --> 00:13:27.769 align:start position:0% the equation so that we uh have this second<00:13:25.380> equation<00:13:25.860> and<00:13:26.700> basically<00:13:27.060> you<00:13:27.660> have 00:13:27.769 --> 00:13:27.779 align:start position:0% second equation and basically you have 00:13:27.779 --> 00:13:29.690 align:start position:0% second equation and basically you have two<00:13:27.959> Miller<00:13:28.139> Loops<00:13:28.620> still<00:13:28.800> but<00:13:29.339> the<00:13:29.579> second 00:13:29.690 --> 00:13:29.700 align:start position:0% two Miller Loops still but the second 00:13:29.700 --> 00:13:32.930 align:start position:0% two Miller Loops still but the second middle<00:13:30.000> Loop<00:13:30.779> uh<00:13:31.620> this<00:13:31.980> one<00:13:32.100> is<00:13:32.459> using<00:13:32.820> the 00:13:32.930 --> 00:13:32.940 align:start position:0% middle Loop uh this one is using the 00:13:32.940 --> 00:13:34.550 align:start position:0% middle Loop uh this one is using the results<00:13:33.120> of<00:13:33.420> this<00:13:33.600> one<00:13:33.779> and<00:13:34.200> it's<00:13:34.320> not 00:13:34.550 --> 00:13:34.560 align:start position:0% results of this one and it's not 00:13:34.560 --> 00:13:37.250 align:start position:0% results of this one and it's not starting<00:13:34.800> at<00:13:35.100> one<00:13:35.279> as<00:13:35.579> as<00:13:35.940> in<00:13:36.120> these<00:13:36.360> two<00:13:36.480> and 00:13:37.250 --> 00:13:37.260 align:start position:0% starting at one as as in these two and 00:13:37.260 --> 00:13:39.410 align:start position:0% starting at one as as in these two and this<00:13:37.560> is<00:13:37.680> just<00:13:37.800> a<00:13:37.980> line<00:13:38.160> computation<00:13:38.700> and<00:13:39.240> this 00:13:39.410 --> 00:13:39.420 align:start position:0% this is just a line computation and this 00:13:39.420 --> 00:13:40.910 align:start position:0% this is just a line computation and this point<00:13:39.600> is<00:13:39.779> already<00:13:39.899> computed<00:13:40.500> in<00:13:40.680> this<00:13:40.740> middle 00:13:40.910 --> 00:13:40.920 align:start position:0% point is already computed in this middle 00:13:40.920 --> 00:13:42.470 align:start position:0% point is already computed in this middle Loop<00:13:41.279> so<00:13:41.399> you<00:13:41.519> have<00:13:41.700> really<00:13:41.880> just<00:13:42.120> two<00:13:42.300> Miller 00:13:42.470 --> 00:13:42.480 align:start position:0% Loop so you have really just two Miller 00:13:42.480 --> 00:13:47.329 align:start position:0% Loop so you have really just two Miller Loops<00:13:42.899> as<00:13:43.260> in<00:13:43.500> here<00:13:43.620> but<00:13:44.339> with<00:13:45.180> uh<00:13:45.959> size<00:13:46.339> with 00:13:47.329 --> 00:13:47.339 align:start position:0% Loops as in here but with uh size with 00:13:47.339 --> 00:13:51.350 align:start position:0% Loops as in here but with uh size with the<00:13:47.459> loop<00:13:47.700> size<00:13:47.880> way<00:13:48.540> smaller<00:13:49.380> uh<00:13:50.279> the<00:13:50.760> X 00:13:51.350 --> 00:13:51.360 align:start position:0% the loop size way smaller uh the X 00:13:51.360 --> 00:13:54.110 align:start position:0% the loop size way smaller uh the X pronunciation<00:13:51.839> by<00:13:52.079> by<00:13:52.680> Q<00:13:52.980> are<00:13:53.459> are<00:13:53.760> cheap 00:13:54.110 --> 00:13:54.120 align:start position:0% pronunciation by by Q are are cheap 00:13:54.120 --> 00:13:56.329 align:start position:0% pronunciation by by Q are are cheap because<00:13:54.360> these<00:13:54.660> are<00:13:54.779> just<00:13:54.959> four<00:13:55.139> videos<00:13:55.440> so<00:13:56.160> we 00:13:56.329 --> 00:13:56.339 align:start position:0% because these are just four videos so we 00:13:56.339 --> 00:13:58.069 align:start position:0% because these are just four videos so we have<00:13:56.459> also<00:13:56.700> a<00:13:56.820> paper<00:13:56.940> about<00:13:57.180> this<00:13:57.480> it<00:13:57.779> is<00:13:57.899> only 00:13:58.069 --> 00:13:58.079 align:start position:0% have also a paper about this it is only 00:13:58.079 --> 00:13:59.990 align:start position:0% have also a paper about this it is only punch<00:13:58.440> you<00:13:58.620> can<00:13:58.680> check<00:13:58.800> it<00:13:58.980> out<00:13:59.100> and<00:13:59.579> we<00:13:59.700> have<00:13:59.880> a 00:13:59.990 --> 00:14:00.000 align:start position:0% punch you can check it out and we have a 00:14:00.000 --> 00:14:03.650 align:start position:0% punch you can check it out and we have a hack<00:14:00.120> MD<00:14:00.480> here<00:14:00.720> blog<00:14:01.260> where<00:14:01.920> it<00:14:02.220> explains<00:14:02.820> uh 00:14:03.650 --> 00:14:03.660 align:start position:0% hack MD here blog where it explains uh 00:14:03.660 --> 00:14:05.329 align:start position:0% hack MD here blog where it explains uh the<00:14:03.839> changes<00:14:04.200> between<00:14:04.440> these<00:14:04.800> two<00:14:04.920> and<00:14:05.160> other 00:14:05.329 --> 00:14:05.339 align:start position:0% the changes between these two and other 00:14:05.339 --> 00:14:06.829 align:start position:0% the changes between these two and other algorithms<00:14:05.940> because<00:14:06.120> this<00:14:06.300> one<00:14:06.420> is<00:14:06.540> just<00:14:06.660> for 00:14:06.829 --> 00:14:06.839 align:start position:0% algorithms because this one is just for 00:14:06.839 --> 00:14:08.810 align:start position:0% algorithms because this one is just for one<00:14:07.079> pairing<00:14:07.500> and<00:14:07.800> for<00:14:07.980> multi-pairings<00:14:08.579> we 00:14:08.810 --> 00:14:08.820 align:start position:0% one pairing and for multi-pairings we 00:14:08.820 --> 00:14:10.790 align:start position:0% one pairing and for multi-pairings we have<00:14:09.000> other<00:14:09.600> algorithms<00:14:10.260> so<00:14:10.380> a<00:14:10.560> novel 00:14:10.790 --> 00:14:10.800 align:start position:0% have other algorithms so a novel 00:14:10.800 --> 00:14:13.069 align:start position:0% have other algorithms so a novel algorithm<00:14:11.160> that<00:14:11.399> we<00:14:11.519> call<00:14:11.700> Twisted<00:14:12.180> States<00:14:12.420> it 00:14:13.069 --> 00:14:13.079 align:start position:0% algorithm that we call Twisted States it 00:14:13.079 --> 00:14:15.590 align:start position:0% algorithm that we call Twisted States it was<00:14:13.260> because<00:14:13.500> in<00:14:13.920> this<00:14:14.279> kind<00:14:14.459> of<00:14:14.639> ellipticals 00:14:15.590 --> 00:14:15.600 align:start position:0% was because in this kind of ellipticals 00:14:15.600 --> 00:14:18.290 align:start position:0% was because in this kind of ellipticals bw6<00:14:16.139> G1<00:14:16.740> and<00:14:16.920> G2<00:14:17.220> are<00:14:17.399> on<00:14:17.459> the<00:14:17.639> same<00:14:17.760> field<00:14:17.940> so 00:14:18.290 --> 00:14:18.300 align:start position:0% bw6 G1 and G2 are on the same field so 00:14:18.300 --> 00:14:20.930 align:start position:0% bw6 G1 and G2 are on the same field so you<00:14:18.480> can<00:14:18.600> use<00:14:18.899> State<00:14:19.139> instead<00:14:19.560> of<00:14:19.680> eight<00:14:19.940> and 00:14:20.930 --> 00:14:20.940 align:start position:0% you can use State instead of eight and 00:14:20.940 --> 00:14:22.790 align:start position:0% you can use State instead of eight and you<00:14:21.360> can<00:14:21.480> use<00:14:21.540> the<00:14:21.720> endomorphism<00:14:22.200> then<00:14:22.560> for 00:14:22.790 --> 00:14:22.800 align:start position:0% you can use the endomorphism then for 00:14:22.800 --> 00:14:25.490 align:start position:0% you can use the endomorphism then for multipacks<00:14:23.519> it<00:14:24.060> was<00:14:24.240> way<00:14:24.540> faster<00:14:24.839> than<00:14:25.079> than 00:14:25.490 --> 00:14:25.500 align:start position:0% multipacks it was way faster than than 00:14:25.500 --> 00:14:28.430 align:start position:0% multipacks it was way faster than than what<00:14:25.860> we<00:14:25.980> had<00:14:26.160> previously<00:14:26.700> so<00:14:27.899> um<00:14:27.959> this<00:14:28.320> is 00:14:28.430 --> 00:14:28.440 align:start position:0% what we had previously so um this is 00:14:28.440 --> 00:14:30.410 align:start position:0% what we had previously so um this is just<00:14:28.680> a<00:14:28.860> couple<00:14:28.980> of<00:14:29.160> optimizations<00:14:29.820> that<00:14:30.300> I 00:14:30.410 --> 00:14:30.420 align:start position:0% just a couple of optimizations that I 00:14:30.420 --> 00:14:33.530 align:start position:0% just a couple of optimizations that I talked<00:14:30.839> about<00:14:30.899> in<00:14:31.320> in<00:14:31.800> Glock<00:14:32.279> so<00:14:32.700> it<00:14:32.880> is<00:14:33.060> really 00:14:33.530 --> 00:14:33.540 align:start position:0% talked about in in Glock so it is really 00:14:33.540 --> 00:14:35.750 align:start position:0% talked about in in Glock so it is really optimized<00:14:34.079> in<00:14:34.260> all<00:14:34.440> the<00:14:34.560> stack 00:14:35.750 --> 00:14:35.760 align:start position:0% optimized in all the stack 00:14:35.760 --> 00:14:37.790 align:start position:0% optimized in all the stack um<00:14:35.839> if<00:14:36.839> you<00:14:36.899> have<00:14:37.019> any<00:14:37.139> questions<00:14:37.320> with<00:14:37.620> face 00:14:37.790 --> 00:14:37.800 align:start position:0% um if you have any questions with face 00:14:37.800 --> 00:14:40.430 align:start position:0% um if you have any questions with face to<00:14:37.920> contact<00:14:38.100> us<00:14:38.399> on<00:14:38.639> by<00:14:39.000> email<00:14:39.240> or<00:14:39.600> on<00:14:39.899> Twitter 00:14:40.430 --> 00:14:40.440 align:start position:0% to contact us on by email or on Twitter 00:14:40.440 --> 00:14:43.250 align:start position:0% to contact us on by email or on Twitter there<00:14:41.100> are<00:14:41.279> some<00:14:41.459> useful<00:14:41.880> links<00:14:42.240> here<00:14:42.420> and<00:14:43.079> I'm 00:14:43.250 --> 00:14:43.260 align:start position:0% there are some useful links here and I'm 00:14:43.260 --> 00:14:44.990 align:start position:0% there are some useful links here and I'm happy<00:14:43.380> to<00:14:43.500> take<00:14:43.680> any<00:14:43.860> questions 00:14:44.990 --> 00:14:45.000 align:start position:0% happy to take any questions 00:14:45.000 --> 00:14:46.300 align:start position:0% happy to take any questions thank<00:14:45.600> you 00:14:46.300 --> 00:14:46.310 align:start position:0% thank you 00:14:46.310 --> 00:14:52.970 align:start position:0% thank you [Applause] 00:14:52.970 --> 00:14:52.980 align:start position:0% [Applause] 00:14:52.980 --> 00:14:58.550 align:start position:0% [Applause] any<00:14:53.339> questions 00:14:58.550 --> 00:14:58.560 align:start position:0% 00:14:58.560 --> 00:15:02.509 align:start position:0% hi<00:14:59.459> good<00:14:59.880> talk<00:15:00.120> thank<00:15:00.540> you<00:15:00.660> I<00:15:01.320> want<00:15:01.440> to<00:15:01.560> know 00:15:02.509 --> 00:15:02.519 align:start position:0% hi good talk thank you I want to know 00:15:02.519 --> 00:15:05.750 align:start position:0% hi good talk thank you I want to know why<00:15:03.180> did<00:15:03.420> you<00:15:03.600> choose<00:15:03.839> go<00:15:04.620> instead<00:15:05.220> of<00:15:05.339> rust 00:15:05.750 --> 00:15:05.760 align:start position:0% why did you choose go instead of rust 00:15:05.760 --> 00:15:09.410 align:start position:0% why did you choose go instead of rust for<00:15:06.120> example<00:15:06.380> uh<00:15:07.380> good<00:15:07.560> question<00:15:07.800> so<00:15:08.880> um<00:15:08.940> this 00:15:09.410 --> 00:15:09.420 align:start position:0% for example uh good question so um this 00:15:09.420 --> 00:15:12.290 align:start position:0% for example uh good question so um this work<00:15:10.079> was<00:15:10.440> started<00:15:10.920> before<00:15:11.100> I<00:15:11.339> joined<00:15:11.699> sectors 00:15:12.290 --> 00:15:12.300 align:start position:0% work was started before I joined sectors 00:15:12.300 --> 00:15:17.090 align:start position:0% work was started before I joined sectors already<00:15:12.600> didn't<00:15:12.839> go<00:15:13.019> but<00:15:13.980> uh<00:15:14.279> yeah<00:15:14.579> so<00:15:15.420> um 00:15:17.090 --> 00:15:17.100 align:start position:0% already didn't go but uh yeah so um 00:15:17.100 --> 00:15:19.250 align:start position:0% already didn't go but uh yeah so um um so<00:15:17.459> we<00:15:17.820> think<00:15:17.940> that<00:15:18.060> goes<00:15:18.480> still<00:15:18.720> are<00:15:19.019> so 00:15:19.250 --> 00:15:19.260 align:start position:0% um so we think that goes still are so 00:15:19.260 --> 00:15:21.610 align:start position:0% um so we think that goes still are so fast<00:15:19.440> but<00:15:20.040> also<00:15:20.339> because<00:15:20.639> there<00:15:21.120> are<00:15:21.300> many 00:15:21.610 --> 00:15:21.620 align:start position:0% fast but also because there are many 00:15:21.620 --> 00:15:24.110 align:start position:0% fast but also because there are many libraries<00:15:22.620> and<00:15:22.800> projects<00:15:23.220> out<00:15:23.399> over<00:15:23.880> there 00:15:24.110 --> 00:15:24.120 align:start position:0% libraries and projects out over there 00:15:24.120 --> 00:15:26.329 align:start position:0% libraries and projects out over there that<00:15:24.300> are<00:15:24.480> using<00:15:24.720> last<00:15:24.959> and<00:15:25.860> there<00:15:26.100> are<00:15:26.279> many 00:15:26.329 --> 00:15:26.339 align:start position:0% that are using last and there are many 00:15:26.339 --> 00:15:28.069 align:start position:0% that are using last and there are many blockchains<00:15:26.880> that<00:15:26.940> are<00:15:27.060> using<00:15:27.300> go<00:15:27.480> so<00:15:27.839> it<00:15:27.959> was 00:15:28.069 --> 00:15:28.079 align:start position:0% blockchains that are using go so it was 00:15:28.079 --> 00:15:30.170 align:start position:0% blockchains that are using go so it was nice<00:15:28.320> to<00:15:28.500> have<00:15:28.740> the<00:15:29.100> snack<00:15:29.579> Library<00:15:29.760> written 00:15:30.170 --> 00:15:30.180 align:start position:0% nice to have the snack Library written 00:15:30.180 --> 00:15:32.569 align:start position:0% nice to have the snack Library written in<00:15:30.240> Ingo<00:15:30.540> so<00:15:30.720> that<00:15:30.839> we<00:15:31.199> can<00:15:31.320> have<00:15:31.440> native<00:15:31.860> uh 00:15:32.569 --> 00:15:32.579 align:start position:0% in Ingo so that we can have native uh 00:15:32.579 --> 00:15:42.769 align:start position:0% in Ingo so that we can have native uh integration<00:15:32.940> with<00:15:33.120> them 00:15:42.769 --> 00:15:42.779 align:start position:0% 00:15:42.779 --> 00:15:44.290 align:start position:0% you<00:15:43.079> mentioned<00:15:43.380> you<00:15:43.500> guys<00:15:43.620> had<00:15:43.740> support<00:15:43.980> for 00:15:44.290 --> 00:15:44.300 align:start position:0% you mentioned you guys had support for 00:15:44.300 --> 00:15:46.370 align:start position:0% you mentioned you guys had support for lookups<00:15:45.300> and<00:15:45.480> garc<00:15:45.779> is<00:15:46.079> that<00:15:46.199> already 00:15:46.370 --> 00:15:46.380 align:start position:0% lookups and garc is that already 00:15:46.380 --> 00:15:48.730 align:start position:0% lookups and garc is that already released<00:15:46.920> or<00:15:47.279> yeah<00:15:47.639> so<00:15:47.940> it<00:15:48.060> is 00:15:48.730 --> 00:15:48.740 align:start position:0% released or yeah so it is 00:15:48.740 --> 00:15:51.470 align:start position:0% released or yeah so it is but<00:15:49.740> we<00:15:49.860> do<00:15:50.040> not<00:15:50.160> have<00:15:50.279> plonk<00:15:50.760> with<00:15:50.820> P<00:15:51.000> Lucas<00:15:51.300> we 00:15:51.470 --> 00:15:51.480 align:start position:0% but we do not have plonk with P Lucas we 00:15:51.480 --> 00:15:52.430 align:start position:0% but we do not have plonk with P Lucas we have<00:15:51.600> we<00:15:51.660> have<00:15:51.779> just<00:15:51.899> the<00:15:52.019> pill<00:15:52.139> lookup 00:15:52.430 --> 00:15:52.440 align:start position:0% have we have just the pill lookup 00:15:52.440 --> 00:15:54.710 align:start position:0% have we have just the pill lookup argument<00:15:52.680> in<00:15:52.940> Calcutta<00:15:53.940> that<00:15:54.300> will<00:15:54.420> be<00:15:54.600> used 00:15:54.710 --> 00:15:54.720 align:start position:0% argument in Calcutta that will be used 00:15:54.720 --> 00:15:57.710 align:start position:0% argument in Calcutta that will be used for<00:15:54.899> the<00:15:55.019> zika<00:15:55.380> evm 00:15:57.710 --> 00:15:57.720 align:start position:0% for the zika evm 00:15:57.720 --> 00:16:00.290 align:start position:0% for the zika evm uh<00:15:58.260> sorry<00:15:58.500> I<00:15:59.100> guess<00:15:59.279> so<00:15:59.760> you're<00:15:59.940> saying<00:16:00.180> you 00:16:00.290 --> 00:16:00.300 align:start position:0% uh sorry I guess so you're saying you 00:16:00.300 --> 00:16:03.110 align:start position:0% uh sorry I guess so you're saying you can<00:16:00.420> use<00:16:00.720> plookup<00:16:01.440> but<00:16:01.860> how<00:16:02.760> to<00:16:02.880> use<00:16:03.000> it 00:16:03.110 --> 00:16:03.120 align:start position:0% can use plookup but how to use it 00:16:03.120 --> 00:16:04.910 align:start position:0% can use plookup but how to use it without<00:16:03.300> the<00:16:03.660> Planck<00:16:03.959> integration<00:16:04.260> so<00:16:04.680> we<00:16:04.800> do 00:16:04.910 --> 00:16:04.920 align:start position:0% without the Planck integration so we do 00:16:04.920 --> 00:16:06.410 align:start position:0% without the Planck integration so we do not<00:16:05.040> have<00:16:05.160> the<00:16:05.279> integration<00:16:05.639> so<00:16:06.000> far<00:16:06.120> but<00:16:06.300> we 00:16:06.410 --> 00:16:06.420 align:start position:0% not have the integration so far but we 00:16:06.420 --> 00:16:08.269 align:start position:0% not have the integration so far but we have<00:16:06.540> just<00:16:06.660> the<00:16:06.779> pillowcup<00:16:07.260> arguments 00:16:08.269 --> 00:16:08.279 align:start position:0% have just the pillowcup arguments 00:16:08.279 --> 00:16:11.000 align:start position:0% have just the pillowcup arguments okay<00:16:08.579> got<00:16:08.760> it