Christian Knabenhans @cknabs.bsky.social · 09/12/2024One thing I’m proud of in this paper is the notation: while lattice crypto papers are typically heavy notationally, we use matrix notation throughout which leads to a very concise (and imho elegant) notation. Here’s the entire protocol for our core folding step! (3/8) 120
Christian Knabenhans @cknabs.bsky.social · 09/12/2024Is Lova concretely efficient? Lova has some nice features: it is very algebraic (great for prover parallelism!) and only requires a single challenge matrix, which makes it recursion-friendly. We also use the modulus q=2^64 and get rid of modular reduction. (4/8) 110
Christian Knabenhans @cknabs.bsky.social · 09/12/2024However, since Lova uses the unstructured SIS assumption, and because we’re constrained to a small challenge set, we need to amplify soundness quite a bit, leading to large-ish proofs (dozens of MB) and proving times >10 minutes. (5/8) 110