Slothful reduction
burdges opened this issue · comments
Is there anything to be gained from applying ideas from https://eprint.iacr.org/2017/437 here? I noticed amcl claims constant time operations based on that. All this is irrelevant for zcash perhaps? Right now, I donno anyone who would care about pairings being constant time, for example.
Pairings are only used in proof validation, which need not be constant-time. However the constant-time techniques in section 7 of that paper apply to extension field arithmetic in general, and we do use that for the G2 operations used in proving.