Anonymous usage tokens from curve trees or autct

[kayabaNerve]

@AdamISZ

Indeed, your numbers match up more closely with the benchmarking results quoted in the paper.

It should do significantly better with proper arithmetic. It’s a fraction of the size.

@AdamISZ

And for batch verify, yes, I did note that in the OP,

Just wanted to provide a literal number

@AdamISZ

Are your proving times also similar to what’s claimed in the paper?

I haven’t looked. They haven’t been an issue and it isn’t a priority of mine.

@AdamISZ

proof size is 219 bytes

Oh, no, 219 billion for the set size. The proof size is as expected.

@AdamISZ

SPARTAN doesn’t use a cycle of curves does it?

Neither does Bulletproofs. The premise of Curve Trees is two proofs, one on each curve, each towering a child curve, as you’ve noted. Curve Trees with Spartan would require doing the Pedersen hash on the towering curve and lose a lot of the performance (though it’d still beat out Poseidon by a significant margin if I recall my estimates correctly). To be clear, secp256k1 towers secq256k1, secq256k1 towers secp256k1. They accordingly form a cycle, yet if secq256k1 didn’t tower secp256k1, secp256k1 would still tower secq256k1.

@AdamISZ

as long as the linking tag is defined as x-coord only

Correct re: leafs. Re: branches, see initialization generator commentary.