Chunky: Weighted PVSS for field elements via batched range proofs

$$
\def\F{\mathbb{F}}
\def\Gr{\mathbb{G}}
\newcommand{\vect}[1]{\mathbf{#1}}
\newcommand{\pvss}{\mathsf{PVSS}}
\newcommand{\dekart}{\mathsf{DeKART}}
\def\secret#1{\textcolor{##b58900}{#1}}
\def\bydef{\stackrel{\mathsf{def}}{=}}
\def\randget{\stackrel{\\$}{\leftarrow}}
\def\ek{\textcolor{#d33682}{\mathsf{ek}}}
\def\dk{\secret{\mathsf{dk}}}
\def\pk{\mathsf{pk}}
\def\G{\widetilde{G}}
\def\V{\widetilde{V}}
\def\H{\mathbb{H}}
\def\L{\mathcal{L}}
\def\s{\secret{s}}
\def\trx{\textcolor{#268bd2}{\mathsf{trx}}}
\def\piRange{\pi_\mathsf{range}}
\def\piPoK{\pi_\mathsf{PoK}}
\def\ck{\mathsf{ck}}
\def\vk{\mathsf{vk}}
\def\prk{\mathsf{prk}}
\def\term#1{\bbox[border:2.5px solid yellowgreen; padding: 2px; background-color: transparent]{#1}}
$$

/* Tighten paragraph spacing on `.tiny` slides (e.g., References) — reveal's default
       paragraph margin stacks up into large gaps once you have 10+ items. */
    .reveal .tiny p { margin: 0.25em 0; }

/* Per-slide opt-out of the `white` theme's ALL-CAPS headings.
 Tag a slide with `` to render its heading normally. */
 .reveal .no-caps h1, .reveal .no-caps h2, .reveal .no-caps h3 { text-transform: none; }

/* In-slide citation keys, e.g. [BDF+25e].
 Purple to stand out from body text without being loud. */
 .reveal .cite { color: #8e44ad; }

/* Hyperlinked citation keys should keep the purple color, not the theme's default blue
       link color (reveal's theme sets `a { color: ... }` which would override the span). */
    .reveal .cite a { color: inherit; }

/* Prose-level "good/improvement" highlight — green, no bold. Used in tl;dr bullets
       and on the Moral of the story slide to mark where a competing scheme beats Chunky. */
    .reveal .good { color: #2e7d32; }

/* Prose-level "bad/deterioration vs Chunky" highlight — red, no bold. Mirror of `.good`.
       Used on the Moral slide to mark where a competing scheme loses to Chunky. */
    .reveal .bad { color: #c62828; }

/* Table-cell "best in column" marker — green. */
    .reveal .best { color: #2e7d32; }

/* Middle-of-pack benchmark-cell highlight: a value that is neither the fastest/smallest
       (`.best`) nor the slowest/biggest (`.worst`) in its column. Dark yellow matches the
       `\secret` macro's color. */
    .reveal .mid { color: #b58900; }

/* Worst-of-pack benchmark-cell highlight: the slowest/biggest value in its column. */
    .reveal .worst { color: #c62828; }

/* Muted speedup/slowdown ratio text, e.g., "(1.04x)" next to a benchmark value.
       Light gray + 75% size of the surrounding cell so ratios sit visually beneath
       the primary value without competing for attention. `display: block` puts the
       ratio on its own line; tight `line-height` keeps the gap above minimal. */
    .reveal .ratio { color: #9e9e9e; font-size: 0.75em; display: block; line-height: 1.1; }

/* Term/name highlight for introducing new names in prose (e.g., Chunky).
 Note: this is an HTML/text styling class; the `\term{}` MathJax macro (bbox border)
 is independent and only applies inside math mode. */
 .reveal .term { color: #1565c0; }

/* "Me" highlight — used to mark Alin Tomescu (this author) in multi-author citations.
       Distinct slightly-bolder green vs. `.good` so co-authorship reads differently. */
    .reveal .me { color: #2e7d32; font-weight: 700; }

/* Per-slide opt-out of reveal's default center-alignment — useful for definition and
 reference slides that read better flush-left. Tag with ``.
 The `h1/h2/h3` selectors are needed because reveal themes center headings independently. */
 .reveal .left, .reveal .left h1, .reveal .left h2, .reveal .left h3 { text-align: left; }

/* Tighten the default vertical margin around every `$$ ... $$` display-math block.
 MathJax wraps each in a centered container with ~1em top+bottom margin; stacking
 two consecutive display blocks (e.g., the two fragments on Deal (3/3)) leaves a
 visibly large gap. 0.25em keeps equations visually grouped while still breathable. */
 .reveal .MathJax_SVG_Display { margin: 0.25em 0 !important; }
</style>

### _Chunky:_ Weighted PVSS for field elements via batched range proofs

Alin Tomescu ([@alinush](https://x.com/alinush))   
Head of Cryptography at **Aptos Labs**  
_Friday, April 22nd, 2026_

---

## tl;dr

<ul>
 <li>why weighted PVSS?
 <ul>
 <li class="fragment">
 want: prevent front-running (MEV)
 $\Rightarrow$ need batch threshold decryption scheme [<a href="https://eprint.iacr.org/2025/2032">FPTX25e</a>]
 $\Rightarrow$ need weighted DKG over $\F$
 $\Rightarrow$ need weighted PVSS over $\F$
 </li>
 </ul>
 </li>
 
 <li class="fragment">why Chunky? the fastest production-grade PVSS!
 <ul>
 <li class="fragment">hundreds of miliseconds to deal ($n = 256$ players)</li>
 <li class="fragment">~250 KiB transcript</li>
 <li class="fragment">tens of miliseconds to verify a transcript</li>
 <li class="fragment">tens of miliseconds to decrypt a share</li>
 <li class="fragment">~1.5 months on Aptos devnet</li>
 
 </ul>
 </li>
 <li class="fragment">key ingredient:
 DeKART, new batched ZK range proof [<a href="https://eprint.iacr.org/2025/1159">BDF+25e</a>]
 </li>
</ul>

---

## Batched ZK range proofs definition

$\mathsf{ZKRP.\underline{Commit}}\_\ck((z_i)_{i\in[N]}; \term{\rho}) \rightarrow C$

$\mathsf{ZKRP.\underline{Prove}}\_\prk(C, \term{\ell}; (z_i)_{i\in[N]}, \rho) \rightarrow \piRange$

$\mathsf{ZKRP.\underline{Verify}}\_\vk(C, \ell; \piRange) \rightarrow \lbrace 0,1 \rbrace$

For simplicity of exposition, we'll ignore the $\ck,\prk,\vk$.

---

## Range proof benchmarks: $\ell = 32$

<table>
 <thead>
 <tr><th>Scheme</th><th>$n$</th><th>Prove</th><th>Verify</th><th>Size</th></tr>
 </thead>
 <tbody>
 <tr class="fragment">
 <td>Univariate DeKART</td>
 <td>2047</td>
 <td>113.2 ms</td>
 <td>2.33 ms</td>
 <td>2.88 KiB</td>
 </tr>
 <tr class="fragment">
 <td>Bulletproofs [<a href="https://eprint.iacr.org/2017/1066">BBB+18e</a>]</td>
 <td>2048</td>
 <td>8.91 s(78.77x)</td>
 <td>664 ms(284.83x)</td>
 <td>1.28 KiB(2.24x)</td>
 </tr>
 <tr class="fragment">
 <td>MissileProof [<a href="https://doi.org/10.1145/3658644.3670324">GWHW24</a>]</td>
 <td>2047</td>
 <td>1.71 s(15.14x)</td>
 <td>2.48 ms(1.06x)</td>
 <td>688 B(4.28x)</td>
 </tr>
 </tbody>
</table>

$\Rightarrow$ we'll leverage our faster range proof for PVSS!

---

## PVSS definition

$\mathsf{PVSS.KeyGen}(1^\lambda) \rightarrow (\ek, \dk)$

$\mathsf{PVSS.\underline{Deal}}(\s, \term{t}, \lbrace \term{w_1}, \ek_1, \ldots, \term{w_n}, \ek_n\rbrace) \rightarrow \trx$

$\mathsf{PVSS.\underline{DecryptShare}}(\trx, i, \dk_i) \rightarrow \left(\s_{i,j}\right)\_{j\in[w_i]}$

$\mathsf{PVSS.\underline{Verify}}(\trx, t, \lbrace w_1, \ek_1, \ldots, w_n, \ek_n\rbrace) \rightarrow \lbrace 0,1 \rbrace$

<!--$\mathsf{PVSS.GetPubKey(\trx)}\rightarrow \s \cdot \term{\G}$

$\mathsf{PVSS.GetPubKeyShare}(\trx, i)\rightarrow \left(\s_{i,j}\cdot \G\right)\_{j\in[w_i]}$ -->

_Restriction for Aptos:_ Player $i$'s EK must be a BLS12-381 point:

$$\ek_i \bydef \dk_i \cdot \term{H}$$

---

## PVSS benchmarks: $t=22, n = 32$

BLS12-381 via <code>blstrs</code>.
Single-threaded
(8 threads for Golden [<a href="https://eprint.iacr.org/2025/1924">BCK25e</a>]).
Lower ⬇️ is better 👍.

green = best in column, red = worst, yellow = in between.

<table>
 <thead>
 <tr><th>Scheme</th><th>Transcript</th><th>Deal</th><th>Verify</th><th>Decrypt</th><th>$\Sigma$</th></tr>
 </thead>
 <tbody>
 <tr class="fragment"><td>Chunky ($\ell{=}32$)</td><td>39.3 KiB</td><td>63 ms</td><td>10.6 ms</td><td>58.89 ms</td><td>133 ms</td></tr>
 <tr class="fragment"><td>[<a href="https://eprint.iacr.org/2021/339">Groth21</a>] ($\ell{=}32$)</td><td>25.4 KiB(1.55x)</td><td>48.2 ms(1.31x)</td><td>29.1 ms(2.75x)</td><td>2.66 s(45.17x)</td><td>2.74 s(20.66x)</td></tr>
 <tr class="fragment"><td>[<a href="https://eprint.iacr.org/2021/339">Groth21</a>] ($\ell{=}16$)</td><td>37.8 KiB(1.04x)</td><td>72.6 ms(1.15x)</td><td>48.2 ms(4.56x)</td><td>14.72 ms(4.00x)</td><td>136 ms(1.02x)</td></tr>
 <tr class="fragment"><td>Golden+PLONK [<a href="https://eprint.iacr.org/2025/1924">BCK25e</a>]</td><td>21.0 KiB(1.87x)</td><td>59.6 s(945.16x)</td><td>45.7 ms(4.32x)</td><td>0.30 ms(196.30x)</td><td>59.66 s(450.18x)</td></tr>
 <tr class="fragment"><td>cgVSS [<a href="https://eprint.iacr.org/2023/451">KMM+23e</a>]</td><td>18.2 KiB(2.16x)</td><td>76.1 ms(1.21x)</td><td>89.3 ms(8.45x)</td><td>10 ms(5.89x)</td><td>175 ms(1.32x)</td></tr>
 <tr class="fragment"><td>[<a href="https://eprint.iacr.org/2021/1397">GHL21e</a>]</td><td>183 KiB(4.66x)</td><td>5.7 s(90.95x)</td><td>486 ms(45.98x)</td><td>0.50 ms(117.78x)</td><td>6.22 s(46.95x)</td></tr>
 </tbody>
</table>

---

## PVSS benchmarks: $t = 171, n = 256$

green = best in column, red = worst, yellow = in between.

<table>
 <thead>
 <tr><th>Scheme</th><th>Transcript</th><th>Deal</th><th>Verify</th><th>Decrypt</th><th>$\Sigma$</th></tr>
 </thead>
 <tbody>
 <tr class="fragment"><td>Chunky ($\ell{=}32$)</td><td>286 KiB</td><td>472 ms</td><td>51.4 ms</td><td>58.89 ms</td><td>582 ms</td></tr>
 <tr class="fragment"><td>[<a href="https://eprint.iacr.org/2021/339">Groth21</a>] ($\ell{=}32$)</td><td>169 KiB(1.69x)</td><td>333 ms(1.42x)</td><td>179 ms(3.49x)</td><td>7.54 s(128.03x)</td><td>8.05 s(13.83x)</td></tr>
 <tr class="fragment"><td>[<a href="https://eprint.iacr.org/2021/339">Groth21</a>] ($\ell{=}16$)</td><td>265 KiB(1.08x)</td><td>516 ms(1.09x)</td><td>320 ms(6.24x)</td><td>41.64 ms(1.41x)</td><td>878 ms(1.51x)</td></tr>
 <tr class="fragment"><td>Golden+PLONK [<a href="https://eprint.iacr.org/2025/1924">BCK25e</a>]</td><td>167 KiB(1.71x)</td><td>448 s(949.14x)</td><td>344 ms(6.69x)</td><td>0.30 ms(196.30x)</td><td>448.2 s(769.91x)</td></tr>
 <tr class="fragment"><td>cgVSS [<a href="https://eprint.iacr.org/2023/451">KMM+23e</a>]</td><td>140 KiB(2.04x)</td><td>313 ms(1.51x)</td><td>390 ms(7.59x)</td><td>10 ms(5.89x)</td><td>713 ms(1.22x)</td></tr>
 <tr class="fragment"><td>[<a href="https://eprint.iacr.org/2021/1397">GHL21e</a>]</td><td>202 KiB(1.42x)</td><td>6.57 s(13.92x)</td><td>512 ms(9.96x)</td><td>0.50 ms(117.78x)</td><td>7.08 s(12.17x)</td></tr>
 </tbody>
</table>

---

## PVSS benchmarks: $t = 683, n = 1024$

<table>
 <thead>
 <tr><th>Scheme</th><th>Transcript</th><th>Deal</th><th>Verify</th><th>Decrypt</th><th>$\Sigma$</th></tr>
 </thead>
 <tbody>
 <tr class="fragment"><td>Chunky ($\ell{=}32$)</td><td>1.13 MiB</td><td>1.83 s</td><td>170 ms</td><td>58.89 ms</td><td>2.05 s</td></tr>
 <tr class="fragment"><td>[<a href="https://eprint.iacr.org/2021/339">Groth21</a>] ($\ell{=}32$)</td><td>661 KiB(1.71x)</td><td>1.29 s(1.41x)</td><td>680 ms(3.99x)</td><td>15.07 s(255.90x)</td><td>17.04 s(8.29x)</td></tr>
 <tr class="fragment"><td>[<a href="https://eprint.iacr.org/2021/339">Groth21</a>] ($\ell{=}16$)</td><td>1.05 MiB(1.08x)</td><td>2.04 s(1.12x)</td><td>1.23 s(7.21x)</td><td>83.28 ms(1.41x)</td><td>3.36 s(1.63x)</td></tr>
 <tr class="fragment"><td>Golden+PLONK [<a href="https://eprint.iacr.org/2025/1924">BCK25e</a>]</td><td>669 KiB(1.69x)</td><td>1673 s(916.49x)</td><td>1.35 s(7.91x)</td><td>0.30 ms(196.30x)</td><td>1674.4 s(814.95x)</td></tr>
 <tr class="fragment"><td>cgVSS [<a href="https://eprint.iacr.org/2023/451">KMM+23e</a>]</td><td>559 KiB(2.02x)</td><td>1.17 s(1.56x)</td><td>1.42 s(8.33x)</td><td>10 ms(5.89x)</td><td>2.60 s(1.26x)</td></tr>
 <tr class="fragment"><td>[<a href="https://eprint.iacr.org/2021/1397">GHL21e</a>]</td><td>253 KiB(4.46x)</td><td>7.88 s(4.32x)</td><td>562 ms(3.30x)</td><td>0.50 ms(117.78x)</td><td>8.44 s(4.11x)</td></tr>
 </tbody>
</table>

---

## Moral of the story

<ul>
 <li class="fragment">In PVSS-based DKGs, $\trx$ verification time trumps dealing time</li>
 <li class="fragment">Previous PVSS schemes verify 6-8x slower than Chunky.</li>
 <li class="fragment">For DKGs, Chunky should be your fastest choice.</li>
</ul>

---

## Chunky.Deal (1/3): shares

Step 1. Sample a random polynomial of degree $t$:

$$
\term{f(X)} \bydef \underbrace{a_0}\_{\secret{s}} + a_1 X + a_2 X^2 + \cdots + a_t X^t
$$

</div>

Compute the $j$-th share of player $i$:

$$
\secret{s_{i,j}} \bydef f(\omega_{i,j}), \qquad i \in [n],\ j \in [w_i]
$$

</div>

Step 2. Commit to the shares over $\Gr_2$ (Feldman-style):

$$
\term{\V\_{i,j}} \bydef \secret{s_{i,j}} \cdot \G, \qquad \term{\V_0} \bydef \secret{s} \cdot \G
$$

</div>

---

## Chunky.Deal (2/3): chunks + ElGamal

Step 3. Split each share into $\term{m}$ chunks in base $\term{B} = 2^\term{\ell}$:

$$
\secret{s_{i,j}} \bydef \sum_{k \in [m]} B^{k-1} \cdot \secret{s_{i,j,k}}, \qquad \secret{s_{i,j,k}} \in [0, B)
$$

</div>

Step 4. Batched ElGamal encryption (share randomness across different players $i$):

$$
\term{R\_{j,k}} \gets \term{r\_{j,k}} \cdot H,\quad \text{where}\ r\_{j,k} \randget\F,\ \forall j\in[\max\_i{w\_i}], k \in[m]
$$

</div>

$$
\term{C\_{i,j,k}} \gets \secret{s\_{i,j,k}} \cdot \term{G} + r\_{j,k} \cdot \ek\_i,\quad \forall i\in[n],j,k
$$

</div>

If $\forall j$ we correlate $\sum_{k\in[m]} B^{k-1} r_{j,k} = 0$
 , then $\sum_{k\in[m]} B^{k-1} \cdot C_{i,j,k} = \secret{s_{i,j}} \cdot G$ 
 $\Rightarrow$ can check against $\V_{i,j} \bydef \s_{i,j}\cdot \G$ with pairings.

---

## Chunky.Deal (3/3): range proof + ZKPoK

Step 5. Prove all chunks are $\ell$-bit via DeKART:

$$
\term{C} \bydef \dekart.\mathsf{Commit}\bigl((\secret{s_{i,j,k}})\_{i,j,k}; \term{\rho}\bigr), \quad \rho \randget \F
$$

</div>

$$
\term{\piRange} \bydef \dekart.\mathsf{Prove}\bigl(C, \ell; (\secret{s_{i,j,k}})\_{i,j,k}, \rho\bigr)
$$

</div>

Step 6. Prove ElGamal plaintexts are KZG-committed in $C$ (see <a href="https://alinush.org/chunky#the-mathcalr_mathsfe2k-elgamal-to-kzg-np-relation">relation</a>):

$$
\piPoK \bydef \Sigma.\mathsf{Prove}\left(\begin{array}{l}
    \overbrace{G, H, \\{\ek_i\\}\_i, \\{C_{i,j,k}\\}\_{i,j,k}, \\{R_{j,k}\\}\_{j,k}, C}^{\text{statement}}\textbf{;}\\\\\
    \underbrace{\secret{s_{i,j,k}}, r_{j,k}, \rho}\_{\text{witness}}
\end{array}\right)
$$

</div>

Return the transcript:

$$
\trx \bydef \bigl(\V_0, \underbrace{\\{\V_{i,j}\\}\_{i,j}}\_{\text{share commitments}}, \underbrace{\\{C_{i,j,k}\\}\_{i,j,k},\ \\{R_{j,k}\\}\_{j,k}}\_{\text{ciphertexts}},\ \underbrace{C,\piRange,\piPoK}\_{\text{proof}\ \term{\pi}}\bigr)
$$

</div>

---

## Chunky.Verify

(1) SCRAPE low-degree test [<a href="https://eprint.iacr.org/2017/216">CD17</a>] on the $\V_{i,j}$'s $\Rightarrow$ shares lie on degree-$t$ polynomial

(2) Batch $e\left(\sum_k B^{k-1}\cdot C_{i,j,k}, \G\right) \overset{?}{=} e\left(G, \V_{i,j}\right)$ pairing checks:

$$
\term{\beta\_{i,j}}\randget\\{0,1\\}^\lambda,\quad \forall i\in[n],j\in[w\_i]
$$

</div>

$$
e\left(\sum\_{i,j,k} \left(\beta\_{i,j} \cdot B^{k-1}\right)\cdot C\_{i,j,k},\ \G\right) \overset{?}{=} e\left(G,\ \sum\_{i,j} \beta\_{i,j}\cdot \V\_{i,j}\right)
$$

</div>

(3) Verify DeKART range proof $\piRange$ and $\Sigma$-protocol proof $\piPoK$.

---

## DeKART PIOP (non-ZK core)

$$
\mathcal{R} \bydef \left\\{
    \bigl(\underbrace{f(X)}\_{\text{stmt.}}\ ;\ \underbrace{(\term{z\_i}, \term{z\_{i,j}})\_{i,j}}\_{\text{witness}}\bigr)\ :\ \begin{array}{l}
        \forall i\in[n], f(\omega^i) = z\_i = \sum\_{j\in[\ell)} 2^j z\_{i,j}, \\\\
        \forall i\in[n], j\in[\ell), z\_{i,j}\in\\{0,1\\}
    \end{array}
\right\\}
$$

</div>

Round 1 (P$\to$V). Send bit oracles, each of degree $\lt n$:

$$\term{f_j(X)} \bydef \sum_{i\in[n]} z_{i,j} \cdot \term{\L_i(X)} \Rightarrow f_j(\omega^i)=z_{i,j}$$

Key observation: $\mathcal{R}$ holds $\Leftrightarrow$ Two checks on $f$ and the $f_j$'s over all $X \in \{\omega^0, \ldots,\omega^{n-1}\}\bydef \term{\H}$.

$$f(X) - \sum_{j\in[\ell)} 2^j f_j(X) = 0,\forall X \in \H$$

$$f_j(X)\bigl(f_j(X)-1\bigr) = 0,\forall X \in \H,\forall j\in[\ell)$$

Round 2 (V$\to$P). V samples $\term{\beta},\term{\beta_0},\ldots,\term{\beta_{\ell-1}}\randget\mathbb{F}$. P sends quotient oracle $\term{h(X)}$ s.t.

$$h(X) \cdot (X^n - 1) = \beta\left(f(X) - \sum\_{j} 2^j f\_j(X)\right) + \sum\_{j} \beta\_j f\_j(X)\bigl(f\_j(X)-1\bigr)$$

</div>

Query. V samples $\term{\gamma}\randget \F$, queries $f(\gamma),f_j(\gamma),h(\gamma)$, checks the batched identity above at $\gamma$.

ZK = hiding KZG with ZK openings [<a href="https://eprint.iacr.org/2023/917">KT23e</a>] + blind each $f_j$ + blind $f$; see <a href="https://alinush.org/dekart">alinush.org/dekart</a>.

---

## Fragment test: `\htmlClass{fragment}` inside `\begin{align}`

**Variant A** — existing `\class{fragment}` (works inline):

$$
\begin{aligned}
s &= s_0 + s_1 \cdot 2^\ell \class{fragment}{{} + s_2 \cdot 2^{2\ell}} \class{fragment}{{} + \cdots}
\end{aligned}
$$

**Variant B** — `\htmlClass{fragment}` wrapping whole lines of `\begin{align}` (unnumbered via `\nonumber`):

\begin{align}
x &\htmlClass{fragment}{{} = a + b}\nonumber\\\\\
y &\htmlClass{fragment}{{} = c + d}\nonumber
\end{align}

**Variant C** — `\htmlClass{fragment}` inline mid-equation:

$$
z \htmlClass{fragment}{{} = 1} \htmlClass{fragment}{{} + 2} \htmlClass{fragment}{{} + 3}
$$

If Variant B/C renders the <code>\htmlClass</code> literal as text (or as plain "htmlClass…"), then MathJax 2 does not support it and we should stick with <code>\class</code>. If it renders the math correctly and the lines animate one by one, <code>\htmlClass</code> is supported.

---

## Conclusion

<ul>
 <li class="fragment">good ol' "chunk your shares and ElGamal-encrypt them" works great
 <ul>
 <li class="fragment">...if you have fast batched range proofs!</li>
 </ul>
 </li>
 <li class="fragment">Chunky: fastest PVSS for $\F$ you can use today</li>
 <li class="fragment">more details, benchmarks and nuance at <a href="https://alinush.org/chunky">alinush.org/chunky</a></li>
</ul>

Future work:
<ul>
 <li class="fragment">further optimize all benchmarked PVSS schemes</li>
 <li class="fragment">multivariate DeKART from sumcheck and a multilinear PCS (e.g., Zeromorph [<a href="https://eprint.iacr.org/2023/917">KT23e</a>])</li>
 <li class="fragment">eVRF-based PVSS like Golden [<a href="https://eprint.iacr.org/2025/1924">BCK25e</a>]: a very exciting direction</li>
 <ul>
 <li class="fragment">inspires me to revisit SNARK-based PVSS [<a href="https://research.protocol.ai/blog/2022/a-deep-dive-into-dkg-chain-of-snarks-and-arkworks/#benchmarks">Gai22</a>]</li>
 </ul>
 <li class="fragment">lattice-based PVSS [<a href="https://eprint.iacr.org/2021/1397">GHL21e</a>]: very exciting as well</li>
</ul>

---

## References

**[<a href="https://eprint.iacr.org/2017/1066">BBB+18e</a>]** Benedikt Bünz, Jonathan Bootle, Dan Boneh, Andrew Poelstra, Pieter Wuille, Greg Maxwell. *Bulletproofs: Short Proofs for Confidential Transactions and More*.

**[<a href="https://eprint.iacr.org/2025/1924">BCK25e</a>]** Benedikt Bünz, Kevin Choi, Chelsea Komlo. *Golden: Lightweight Non-Interactive Distributed Key Generation*.

**[<a href="https://eprint.iacr.org/2025/1159">BDF+25e</a>]** Dan Boneh, Trisha Datta, Rex Fernando, Kamilla Nazirkhanova, Alin Tomescu. *DekartProof: Efficient Vector Range Proofs and Their Applications*.

**[<a href="https://cr.yp.to/dlog/cuberoot-20120919.pdf">BL12</a>]** Daniel J. Bernstein, Tanja Lange. *Computing small discrete logarithms faster*. 2012.

**[<a href="https://eprint.iacr.org/2017/216">CD17</a>]** Ignacio Cascudo, Bernardo David. *SCRAPE: Scalable Randomness Attested by Public Entities*. ACNS 2017.

**[<a href="https://eprint.iacr.org/2015/047">CL15</a>]** Guilhem Castagnos, Fabien Laguillaumie. *Linearly Homomorphic Encryption from DDH*.

**[<a href="https://eprint.iacr.org/2025/2032">FPTX25e</a>]** Rex Fernando, Guru-Vamsi Policharla, Andrei Tonkikh, Zhuolun Xiang. *TrX: Encrypted Mempools in High Performance BFT Protocols*.

**[<a href="https://research.protocol.ai/blog/2022/a-deep-dive-into-dkg-chain-of-snarks-and-arkworks/#benchmarks">Gai22</a>]** Nicolas Gailly. *A deep dive into DKG, chain of SNARKs and arkworks*. 2022.

**[<a href="https://eprint.iacr.org/2021/1397">GHL21e</a>]** Craig Gentry, Shai Halevi, Vadim Lyubashevsky. *Practical Non-interactive Publicly Verifiable Secret Sharing with Thousands of Parties*.

**[<a href="https://eprint.iacr.org/2021/339">Groth21</a>]** Jens Groth. *Non-interactive distributed key generation and key resharing*.

**[<a href="https://doi.org/10.1145/3658644.3670324">GWHW24</a>]** Rui Gao, Zhiguo Wan, Yuncong Hu, Huaqun Wang. *A Succinct Range Proof for Polynomial-based Vector Commitment*. CCS 2024.

**[<a href="https://eprint.iacr.org/2023/451">KMM+23e</a>]** Aniket Kate, Easwar Vivek Mangipudi, Pratyay Mukherjee, Hamza Saleem, Sri Aravinda Krishnan Thyagarajan. *Non-interactive VSS using Class Groups and Application to DKG*.

**[<a href="https://eprint.iacr.org/2023/917">KT23e</a>]** Tohru Kohrita, Patrick Towa. *Zeromorph: Zero-Knowledge Multilinear-Evaluation Proofs from Homomorphic Univariate Commitments*.

---

## Appendix: Summary of benchmarks

- [<a href="https://eprint.iacr.org/2021/339">Groth21</a>] is ~as succint, but slower to deal & verify (holding decryption time ~same)
 + faster DL algorithms [<a href="https://cr.yp.to/dlog/cuberoot-20120919.pdf">BL12</a>] would help [<a href="https://eprint.iacr.org/2021/339">Groth21</a>], but would also help Chunky
 - Golden [<a href="https://eprint.iacr.org/2025/1924">BCK25e</a>] has smaller $\trx$, but much slower to deal & verify
 + with better choice of zkSNARK, Golden could become faster to verify
 + Golden decryption will always be fastest
 - cgVSS [<a href="https://eprint.iacr.org/2023/451">KMM+23e</a>] has 2x smaller $\trx$, and faster dealing, but slower verification
 + relies on class groups and [<a href="https://eprint.iacr.org/2015/047">CL15</a>]
 + end-to-end ($\Sigma$), Chunky is faster
 - lattices [<a href="https://eprint.iacr.org/2021/1397">GHL21e</a>] for large enough $n$, has smaller $\trx$, but always much slower to deal & verify
 + is PQ sound, unlike Chunky