14:34:53 <sarang> A quick note that after some discussion with the BP+ proposers, there's agreement that the verification benefits they listed would not be present to the same degree in a Monero implementation
14:35:25 <sethsimmons> So still a size improvement, but no tangible verification time improvement?
14:35:57 <sarang> Their original BP implementation did not use weighting across verification equations to combine common generators, which is likely why they saw the results they did when comparing to BP+
14:36:25 <sarang> Yeah, the size benefits would be present (noting that we require >= 2 outputs and a single proof per transaction)
14:36:42 <sarang> There would be a marginal verification improvement, but not to the extent in the table they presented
14:36:48 <moneromooo> I'd rather have had it the other way around :/
14:36:53 <sarang> yeah
14:37:01 <sarang> but this is still good
14:37:10 <sethsimmons> An improvement to either is still great
14:37:16 <moneromooo> What is it, 64 bytes per tx ?
14:37:31 <sarang> 96 bytes
14:37:42 <sethsimmons> nice
14:37:49 <moneromooo> Still good if small changes.
14:38:18 <sarang> The verification is no worse :)
14:38:26 <sarang> Slightly better, but still better
14:38:32 <sethsimmons> That will get us down to almost 1200b/TX after CLSAG, IIRC
14:38:52 <sarang> For a 1-2 txn you mean?
14:39:04 <sethsimmons> yes
14:39:13 <sethsimmons> I might be off by 100b
14:39:15 <sarang> Aye, and 2-2 would drop to about 1.8 kB
14:39:21 <sethsimmons> Nice
14:39:31 <sarang> Right now 2-2 is 2.54 kB
14:40:06 <sethsimmons> That's a great improvement between the two changes
14:40:07 <sethsimmons> exciting stuff :)
14:41:33 <sarang> At any rate, it's good to know why they saw so much better improvement
14:52:16 <dEBRUYNE> I do wonder whether it is worth touching sensitive code for mere size gains
14:55:33 <sarang> This is the tradeoff
15:04:02 <hyc> have we reached the boundary of the 80/20 rule already? diminishing returns from here on out?
15:05:06 <sarang> Well, saving 96 bytes is nontrivial
15:05:41 <sarang> In terms of verification, we've likely hit a limit on trust-free range proofs unless there are underlying library changes/optimizations
15:13:14 <hyc> might be worth running a benchmark under valgrind/cachegrind and look for any obvious hot spots
15:14:28 <sarang> BP+ does appear to save a lot in terms of scalar-only computations, but those are orders of magnitude faster than the bulky Pippenger operation
15:14:54 <sarang> I'd be very surprised if the savings there would be noticeable
15:16:55 <sarang> One idea I had a while back was combining generators between next-gen signature constructions and range proofs
15:17:14 <sarang> It wouldn't be game-changing by any means (and would add a lot of complexity)
15:20:35 <dEBRUYNE> <sarang> There would be a marginal verification improvement, <= Can we quantify marginal here?
15:22:12 <sarang> Maybe a percent or two
15:22:38 <sarang> The benefits decrease as the number of aggregated outputs increase (due to the way generators work)