Chris Peikert

A first step would be to implement a ring-based variant of the GSW FHE, e.g., something like Ducas-Micciancio. That's not too high on the current list of priorities, though. We'd...

More thoughts following comments from Eric: - Compile time of the examples is huge and will cause Travis to time out. - With `stack build --fast` we are getting them...

Thanks for writing this up. I'm going to let this one simmer until we have a better idea of how the updated Lol will look, and how/whether that will change...

During a cryptographic review, I noticed the following point that has major implications for the needed collision-resistance of MiMC for these curves/parameters. (I also have other serious concerns about input...

A couple more assorted comments on gnark's instantiation of MiMC for these curves: - In contrast to MiMC's recommended sponge or Feistel "modes of operation" (around the MiMC "block cipher"),...

Coming back to this... I think that “option 1” from [this comment](https://github.com/algorand/go-algorand/pull/5978#issuecomment-2143856099) can be reasonable, with caveats. The main things I would like to see are: 1. better naming/options for...