edwinhere / nazgul Goto Github PK

Hi~

We notice from our experiment on CLSAG that the sign/verify time is quadratic to ring size. We have tested ring size up to 2500. However, by looking at page 22 of https://eprint.iacr.org/2019/654.pdf, we suspect it shouldn't be that high (the previous MLSAG scheme is of linear signing cost).

We run some test and realize the quadratic cost comes from the following lines of codes:
Sign:
line 146-158

Verify:
line 273-280

It is quite strange as each iteration of the outer loop runs the exact same codes and we wonder whether it could be optimized.