Henry de Valence

Cool! As noted, the vector backends are all rearranged by #215, which hasn't landed yet, so there's no rush. A good first step might be measuring how much time of...

I'll try to land #215 so that this can start.

Instead of starting with the vectorized field ops, this could start by defining the iterator adapters, and internally just making them do four (serial) field operations at a time, so...

I could be mistaken, but no, I don't think so.

For doing ECC inside of Ristretto, there is a nice way to build "Doppio" (Ristretto in Ristretto) that gives a prime-order group inside the circuit. Probably there will be an...

All I meant was that there are decisions to be made about how the constraint systems are actually held internally when doing aggregated proofs -- right now, the constraint system...

Unfortunately, I think that this is mostly infeasible, and to the extent that it is, it would not provide a benefit over the existing implementation. First, it is already possible...

Hmm, how does this interact with the naming scheme we have for the rangeproofs? Is there a difference between the `Verifier` type (which is probably used only in an R1CS...

What I was thinking of was to try collapsing the `L, R` computations into a single multiscalar multiplication for each, in the same way that the verifier collapses them when...

There's no milestone attached, so we can leave this open and have it be a point of accumulation for ideas about the inner-product proof.