3for

`r(X,1)` has exponents of `X` that span from `X^{-2N}` to `X^{N}`， why we choose to multiply `3N-1` in the paper？ Is it proper to multiply `2N` instead？

Well, I'm a new learner not quailified to be the maintianer right now. Maybe it's possible with your help? Seemed that the Ristretto abstraction can be used for pedersen commitment...

Both in func `test_poe_small_exp` and `test_poke2`, the proof ` Q: Rsa2048::elem(1)` will not always hold, for the quotient `q` val will not always be zero.  ``` // sage: w...

@burdges I'm also curious. It seemed that the co-prime product in this repo is always bigger than the max scalar val in Curve25519. @whaatt Could you help us for more...

@Fiono11 I think it's possible, just treat the polynomial commitment as an inner product. See this paper [Doubly-efficient zkSNARKs without trusted setup](https://eprint.iacr.org/2017/1132.pdf), the dot-product proof protocol maybe suitable。

Glad to help~

Maybe I misunderstood the relation between t4 and t6？ ``` sage: hex(689871209842287392837045615510547309923794944) '1eef5546609756bec2a33f0dc9a1b671660000' sage: hex(689871209842287392837045615510547309923794943) '1eef5546609756bec2a33f0dc9a1b67165ffff' ```