Is this available on iOS too?

Don't think this was the case for everyone but for me it was about keeping my phone number private (before Signal introduced usernames)

I'm kind of conflicted over this.

Up to now my Signal has been almost exclusively for personal use and Telegram exclusively for connecting at conferences. And I've come to value this clean separation

To the point where I have said no to connecting over Signal

2/ As such, I wrote a research note to help cryptography engineers fully understand both techniques: baincapitalcrypto.com/a-deep-dive-...

Video or it didn't happen 👀

But this might not work in your case depending on how strict you want to be on the caveat you mentioned

The usual pattern is:
1. arrange the keys into a Merkle tree and give each signer their authentication path in that tree
2. signer produces a signature on the data
3. signer produces a ZKP that signature verifies against some public key, and that this public key is included in the Merkle tree

Part 2 starts with important terminology (pre-quantum vs post-quantum vs quantum). Or then explains how to make Bitcoin and Ethereum post-quantum secure via signature lifting and then talks about using quantum computers to make digital money

zeroknowledge.fm/podcast/297/

2/2

Correct!

Bit of a tradeoff. We have O(1) proofs and verifiers using univariate polynomials, whereas sumcheck gives at best O(log(circuit))

It replaces the "quotient polynomial". This was the method used to succinctly check that all the Plonk contraints or AIR rows are satisfied.

The advantage is that with sumcheck the prover no longer needs to perform polynomial division and therefore can run in linear time

The original description has it as an IP (no oracles). And the messages are actually super short: for a MV polynomial with degree at most d in each variable, the prover only needs to send d field elements in each round