A quick note that after some discussion with the BP+ proposers, there's agreement that the verification benefits they listed would not be present to the same degree in a Monero implementation

So still a size improvement, but no tangible verification time improvement?

Their original BP implementation did not use weighting across verification equations to combine common generators, which is likely why they saw the results they did when comparing to BP+

Yeah, the size benefits would be present (noting that we require >= 2 outputs and a single proof per transaction)

There would be a marginal verification improvement, but not to the extent in the table they presented

I'd rather have had it the other way around :/

yeah

but this is still good

An improvement to either is still great

What is it, 64 bytes per tx ?

96 bytes

nice

Still good if small changes.

The verification is no worse :)

Slightly better, but still better

That will get us down to almost 1200b/TX after CLSAG, IIRC

For a 1-2 txn you mean?

yes

I might be off by 100b

Aye, and 2-2 would drop to about 1.8 kB

Nice

Right now 2-2 is 2.54 kB

That's a great improvement between the two changes

exciting stuff :)

At any rate, it's good to know why they saw so much better improvement

I do wonder whether it is worth touching sensitive code for mere size gains

This is the tradeoff

have we reached the boundary of the 80/20 rule already? diminishing returns from here on out?

Well, saving 96 bytes is nontrivial

In terms of verification, we've likely hit a limit on trust-free range proofs unless there are underlying library changes/optimizations

might be worth running a benchmark under valgrind/cachegrind and look for any obvious hot spots

BP+ does appear to save a lot in terms of scalar-only computations, but those are orders of magnitude faster than the bulky Pippenger operation

I'd be very surprised if the savings there would be noticeable

One idea I had a while back was combining generators between next-gen signature constructions and range proofs

It wouldn't be game-changing by any means (and would add a lot of complexity)

<sarang> There would be a marginal verification improvement, <= Can we quantify marginal here?

Maybe a percent or two

The benefits decrease as the number of aggregated outputs increase (due to the way generators work)