Justin Thaler

Doing anything on-chain will mean working over BN254. Turning Jolt verifier into RISC-V gives one baseline way to do recursion/composition to decrease proof size. Another would be to directly turn...

I'm not sure the benefit of looking at MNT4 or BLS12-381 given that our main goal is on-chain verification on Ethereum, so we need to run Groth16 over BN254? We...

Alas, our plans to get cheap on-chain verification (and folding) no longer involve implementing the HyperKZG verifier non-natively in constraints.

> Also, to clarify, what's implemented here doesn't involve non-native arithmetic: MSM and pairing definitions are simply appended to public input to be checked by the verifier. The circuit only...