l-bfv

[0xjei]

L-BFV chunking roadmap

This issue tracks the work required to make the L-BFV parameter set compatible with chunked proving and the target proving environments.

Current roadblocks

• C3a and C3b share encryption is approximately 10M constraints. Chunking or a ct0 and ct1 split may reduce the size.
• C4a and C4b share decryption currently verifies all H proofs in one circuit. The split-by-H approach produces 17,600,899 constraints because it verifies the H proofs inside the circuit.
• user_data_encryption_ct0 and user_data_encryption_ct1 are each approximately 4M constraints, about twice the maximum target size for browser proving.
• C6 threshold share decryption is approximately 8M constraints and may also require chunking.

Related branches

• https://github.com/theinterfold/interfold/tree/chunk-lbfv-params
• https://github.com/theinterfold/interfold/tree/chunk-lbfv-c4

Linked child issues

• [L-BFV I7] Update fhe-params search tool to the current smudging formula #1857 — Update fhe-params search tool to the current smudging formula (2^(lambda+1) * d * B_C)