Weikeng Chen

I think we can merge. I probably will fix the downstream in a few days.

Thanks a lot. Much appreciated!

I think we will be following on this recently. I looked at the existing MSM algorithm and had the feeling that it only implements part of the Pippenger, and there...

Yes, as you observed, the current implementation of `get_root_of_unity`, which takes `usize` as input, implicitly makes a bound of the `TWO_ADICITY`. It is slightly more complicated to support larger two...

The problem seems to be, if the application never uses the subgroup as large as 2^64, but unfortunately this curve is just way too nice and have a high two...

Dev is right. Starting from Libra, using an extension field of Mersenne prime field has become a known technique for efficiently implementing RS Code/Merkle Tree-based proofs. I think the question...

I am thinking about which direction to go---since changing the encoding is breaking, not just on the code level, but probably on the data level. I am worrying if there...

One thing about the alternative encoding is that it assumes three available most significant bits. If we change all the curves' encodings into this new one, we need to assure...

Note that the alternative encoding has the benefit that it will be always smaller by about one byte.

I think the only reason is simplicity. As Pratyush mentioned, I think we do need to specialize in the encoding for BLS12-381 to be compatible with the mainstream format.