Crypto Bikeshedding

[nothingmuch]

A list of items to revisit before by testnet release

• Transcript
  • labels, domain separators
  • statement commitments (just dimensions? not even?)
  • review ordering
  • review need for TLV
• Proof of Work
  • For denial of service protection, a preimage of the the t scalar satisfying some proof of work requirement can be provided instead of having the coordinator generate it. This is desirable because null credential registration is permissionless but appends to the nullifier set. estimate cost of DoS in this way, both per round and long term fee credentials (previously i've always assumed the long term pool would not have them, but maybe that is not a big deal actually)
• Generators
  • Generators.Gh := Generators.G, Generators.Gg := H(Generators.Gh) - make Pedersen commitments compatible with Confidential Transaction ones no point because randomized commitments to 0 still require two generators, so a signature can't be used as a proof that the comitted value is 0
• Sigma protocol compression (far future, possibly after mainnet)
  • bulletproofs?
  • bulletproofs+?
  • https://eprint.iacr.org/2020/152 (current favorite)