ProgCrypto (ZK) Study Group 2025 — The Moonmath Manual to ZK-Snarks: Chapter 5 Elliptic Curves Part2

Yep. Okay. Great. Uh yeah, thanks for coming. So um again we'll go through the standard um way we go through this.

We'll go through each section um and I'll ask any questions and afterwards we can revisit it um if um we gone through the entire place entire thing and um there's no question. So um I guess first of all uh 5.4 four elliptic curve pairings. Any questions on this? Uh sorry 5.

4 sorry embedding degrees. Um any questions on this? Anything we want to talk about on this particular section? Just slowly scroll down. Okay.

Um curve over extension fields. Um last week we talked a little bit about extension fields. Um so here um essentially um what we've been talking about extension field actually not actually not last week last last week on um on fields um chapter 4 I believe um yeah here extension field refers to the primary extension fields um yeah extension fields oh actually before I continue. Um I does anyone here um tried to imp uh implement uh elitic curves? Um if you've did uh do open the PR to the repo I've shared.

Um I I'll share it again. Um later in the in the in the telegram group. By the way, if you're not in the telegram group, um give me let me know in the chat. I'll just speak up. I'll I'll share the link.

uh to you. Yeah. In the chat and um yeah, so you can join. So yeah, um for those that did try to implement um litic curves um so so yeah, so that's our last week um homework um self motivated homework. Um for those that did uh you are free to open a PR um to our repo and I'll be looking at those and giving you some feedback.

Um as well I'll also be working on it um working on an implementation myself in Python. Um so yeah if you're interested uh do it you know it helps us learn help some of us right and for me at least it helps me learn a little bit more into the details of what we're going through here. Um implemented with cursor but great learning receiver. Yeah, yeah, yeah, yeah. It's it's okay if you use V coding tools.

Um, you know, as long as you feel you learn. I I do recommend not doing that if you try to learn like the nitty-gritty details. Uh, I do personally use uh AI assistant to to help me plan out like um the pseudo code. Those those helps a little bit. Yeah, some Yeah, some equations are hard to do.

Yeah. Um okay so um before I okay so let's let's get back here um yeah do implement so this week as well our homework will be just trying to implement pairings um as well so last week homework I think next week we'll we'll go through all all of the things we try to implement um yeah but anyways okay so let's see I think there's a question for ZK what high and low embedding degree means and how to pick the best um uh okay so what does it Well, um, embedding degrees here. Okay. Um, let me let me find my words. Um, so what's a what's a good way of let me check my notes.

Oh, what's a good way of explaining it? Um, so a moment. Okay. So um embedding degree here um well essentially it's to do with well to a certain extent at least um and from my understanding it's very much to do with um the what's that called Um so it's very much to do with well how well the definition is it's the smallest integer and such that you know r is divisible by q2 k minus one um and and embedded degrees K, right? Um, so well it's it's well so to say it's to do with what you want your curve like what what property you want your curve to have or what structure curve you want your curves to have as as is with a few of the things here like torsion the toion group as well.

Um well I I don't think it's like tolerant group it's necessary that it's it's also like a thing we we want u for snarks um embedding degree um in this case you well you want it to well you choose the not the best I mean you usually want to choose the smallest so um you want the smallest one um which is calculated through this um in a way it's kind of brute force I don't I'm not quite sure if there's a non brute force way or brute force way of calculating this. This is the essentially the method you you basically increment until you find some k that satisfied that's divisible by uh that's divisible by r sorry r is yeah r such that is yeah I think how do I say that correctly um yeah I think yeah such that r is divisible yeah so yeah this is how you find so like for example um they give the example for this so um in this case Yeah, the order of E11 F5 is nine and you know since the B prime they will take the factor of three and then from that you they will find essentially what's um divisible by R such that find yeah find a K that is divisible by R sorry yeah I think that's the correct okay so uh such that q k minus one is divisible by r and in this case um they just go through so 5 to the^ of 1 - 1 = to 4 and this is not divisible but this is divisible, right? Um so that's how they find it. They want to find the smallest um number um in this case. Um uh I'm not sure if there is a so to say best um I I think yes the smallest is essentially what we want to find.

Um yeah, but from what I've learned and understand, um well, you usually want a I think depending on um what properties you want your curve to have, you want to choose a curve uh with different embedding degrees. Um, I think in the case for pairings, if you want a smaller embedding degree, I might be wrong on this. I I I forgot. I've gone through I I've done some reading on this. Um but um if you are using or if you are working with non-pairing curves um you might want to choose a different like a curve that has maybe higher emitting degree.

I'm not quite sure on this but there is something to do like um it emitting degree determines some that there is some property that that comes with this um yeah and to choose a curve that has slower or higher embedding degrees um essentially well it depends on what you want to do for SN I believe you do want a smaller one um yeah that's I don't think that fully answers your question but yeah that's from what I've understood from uh going through this and some external material um let me check if I noted it down somewhere um book I don't think I have unfortunately. Yep. Um okay. Smallest and degree. But why pick curves with specific number of K like Y 12 in BLS?

Um specific of specific number of embedding degrees you mean? Um, wait. Where's the BS one? Is it in the book? The BLS 12 embedding degrees.

Check. No, the example. Okay. Um, I Oh, I see. I see.

Ah, okay. I get what you mean. Um, I don't think it's specifically choosing an embedding degree of like the magic number 12, but I might be wrong. Um, I might very much be wrong. Um, I think it's choosing a small embedding degree in this case.

Um but yeah, I may be wrong. It might be also be related to some um security concerns or like security factor. Um so I'm I'm not quite sure why it specifically chooses 12 for BS but I believe generally speaking when it comes to pairings we want small embedding degrees. Yeah. Yeah.

Probably something related to that cuz for example if you like here they actually talk about it as well. um if you do choose like a big embedding degree right you can't like it's going to be hard to calculate later um I think they talk about it in torsion group probably um yeah so if you choose something that has like a huge embedding degree there are some calculation that is harder to do when you want to do pairing um yeah that's why Yeah, you you might be very much correct on that. Um, usually these parameters are chosen because of that. Oh, fun fact. Um, I think so there is a Dan Bonet talk out there that talks about pairings and, uh, fun fact, um, this specific curve, the parameter for this is, um, is chosen based on like the given reason for this like choose like the parent reason for this is it's not really chosen VR um I think I think you should check out like a video talks a little bit more about more how how like this the parameters for this the seat for this is chosen and uh it's pretty funny that there's not too much reason given for how the uh yeah how the seat is chosen I'll share the link later but yeah that is a pretty interesting video.

Anyways, um okay, where were we? Yeah, so uh embedding degree um ideally small for pairing uh pairing purposes. Um and if you are not using it for pairing, this matters slightly less. Um yeah, so you usually that's why yeah that's what embedding degrees are. Um as for why we chose a certain embedding degree that I'm not quite sure but generally pairings we do want some smaller embedding degree um in this case it helps with calculation.

So I think we were in in the global extension field. Yeah. Again stop me for any questions um and all that. Actually I'll I'll just share the video link now. Um moment there cryptography.

And wait, the video is called parents in cryptography. I'll share it here. Yeah. Okay. Anyways, okay.

Um, stop me for any questions again. Um, I shared the link in the group. So, as we are going through, okay, electric extension field. So, um, any questions on this? Remember what's prime extension fields?

hopefully um yep we'll talk about a lot about tiny general curve um which is um a very specific curve uh that it's used as example here so um that's also mentioned quite a lot um I think in previous sections as well okay let's continue to groups Any questions? I think in torion groups we do talk about why um specifically uh embeddings is quite important here if I'm not wrong. Um I recall seeing that. Um but yeah, any questions with to group? So ah yeah, here.

Um oh sorry. Um where is it? Okay, there we go. Um let's go up a little bit. So the five to group over this is equals to the five to group of tiny j over five.

So this is actually talking about um so what here it's happening um I think I'll go above it a bit. So um they were actually calculating a torsion group for um baby tiny job. Sorry not baby jump tiny jop. Um and here um what's happening is they are calculating time over this prime extension field. Um and the property that we see here is essentially the subgroup.

So um the 5,000 group for this extension field is equal to 5 group of the base field. And essentially this just means that you no matter like the arrogion group of your extension is will always be equals to the um arto group of the base base field. Um yeah that's that's essentially what what it's trying to say here. Um and here we see actually uh in regards to embedding curves uh sorry embedding curves uh sorry in regards to embedding degrees um to find R toen you need to compute embedding degree and you can't compute the R toion of this uh for sec 2516K1 because the embed is way too huge and yeah um And that's that essentially means that when you want to use like when you do calculate the autoion group which is um required in parenting groups um it's going to be very huge um and thus not efficient. That's why I think um pairings we will usually use um curves with small embedding degrees because it allows to calculate um more efficiently.

Uh yeah this means that embedding is very large which implies the field extension is very large and in the case of this such representation k entries each of them 256 bit without any optimization representing such an element we need k * 256 which is insane. So it follows that it is not in only inasible to calculate but yeah to write down the single elements of the group in general. Yeah. Okay. Yeah, that's um essentially artoen or ftoen groups.

Ftoen groups refer to the entire thing. Artogen group. Um well okay. Yeah. And autoen group refers to um the subset essentially.

The full art group is is everything but uh there's also like a lot of subgroup. We still call them torsion group. Okay. Anyways, um that's all about torsion groups, pairing groups. Any questions on this here is essentially what where we where it's actually talked about um where G1 G2 is talked about for pairings.

So recall pairings um in here. Let me just click back to pairings. I believe it's here. Yeah, recall pairings. We have this, right?

This is what pairings is. Um some tree group community group um G1 maps like G1 um par is function G1 X G2 mapping to G3 right uh function takes element from G1 and G2 and maps them to G3 such that by linearity property holds so yeah parent groups yeah essentially talks about how we get G1 and G2 any questions on No, then we'll go down. Okay. Oh clear for full toion toion group I think I think uh it's more okay um so for this it's more correct to say full art toion groups and art to groups um yeah I think that's a little bit more accurate um full art to group well Okay, full autoion group it's um like every full auto group essentially it's the R toion of the curve every every single um okay let's go a little bit into other I can't I can't really just go. Yeah.

So again our toion group essentially we define it as um given some points we um we take we essentially compute um some set of points RP sorry such that RP is equals to infinity. This is infinity. Okay. So we we have an infinite point and this essentially well um how do I put this? Yeah.

So okay let's let's just remember we define Ration group as like um EFR so elliptic curve over some field R will result in a set that the points is in this elliptic curve and um R times the points each of the points in this set will oop sorry will be let me just click here will be equals to infinity right um that means that Um because r is a factor of n. This what this also means is essentially u when you have this r like when when when it meets it has this factor of r the this this these points will will essentially disappear. um it disappear when given some R um that you choose here like tree origin it disappears when when R is three right the points that that appear here so for example uh okay so this tree origin right so these disappear when R is three like when R is four it will be another set of um it'll be another set of uh points and those will disappear when when r is four but in this case everything here will disappear when r is three um yeah so fool here what f here means um essentially so okay we will so let me let me find an example uh it okay Um, is it this? No. Uh, let me see if I can find another example to give me a moment.

I don't have an example here. Okay. So, what exactly is full? Well, when you calculate some um some e uh some toen uh e some r toen group, right? Um so this okay when you calculate some r toen group um you can calculate over well the sub so the elliptic curve over some prime field um you can calculate the artoen of that and its extension.

um usually when you calculate over that prime fields extension I mean it's still going to be the same sub um subset of the base field itself over the extension um when we talk about full here it just means I think um so the R version full version is essentially when you do some calculation on um the field the electrical o extended field of the degree K um yeah I think I think that's what we call the full hen group here full hen group here because you can also calculate the hogen group on any other thing for example the non like the base if the curve over some field um not the blood over the base field not the extend uh extension field um that's an arto group but we specifically call the calculation on this the full arrogion group um I believe it contains all the points not quite sure all the possible are the points in the possible possible points in the specific uh toion group um like yeah if I'm not wrong so f just well f just mean I being full it's called full because it contains um the poss all the possible points in in this ring group specifically if you calculate it on other um extension it might result in something different extension goes to er oh oh actually it's explaining it here yeah does it Help that contains a full subgroup like uh not full subgroup. Um all the possible points all all the points in in this. Okay, for example um okay let's let's look at this. Okay. So this the diabeting degree um yeah the largest like the abetting degrees two right.

So E this so this toion the toion calculated here contains all the possible points for anything based upon this elliptic curve over the base field. I don't think that's a very good way of explaining it but it contains all possible points um if you were to calculate okay if you were to if you have this right if this calculating the toion field to R torsion on this um will give you all the points that is possible if you calculate the R toen for well in this case there's only one other um a curve um in this case or any other extension to be fair um yeah so if you calculate let's say E11 F5 the base field um the RO for that it doesn't contain all the possible points but if you calculate this you you basically get everything so That's why this it's called a full full Henfield. I think it's not sub full subgroup but just all the points all the points in all the subgroups. I I I suppose that that's the correct way of saying it. Yeah.

Oh yeah. All the all the points in in the subgroup. All the possible points in your subgroup. Yeah. Okay.

Great. Uh, I I did not script this, so maybe next time I should script this a little bit so I can answer with a little bit more clarity on first. But anyways, okay, let's continue. Okay, I think I was at pairing groups. So pairing groups, any questions on on this part?

So in pairing groups we we use our torsion to calculate um our G1 and G2 um with the only difference being so both of them come from the torsion group um the R toen group of the elliptic curve um specifically the full art to group. So you need to calculate the embedding here. Um and the only difference is that the forinius map um the the result of this um we define it as P * the points itself. Um yeah so G1 the difference between G1 and G2 is is this essentially um yeah any questions? So this is actually um so E11.

So using this example right this is actually um E11 the to okay this is to are the three torsion of a curve 11 one this is the parameters for your so this is specifically the parameters for short wise source curve here let me just point so a and b for this formula okay um let me just go back to parenting groups specifically that so let's okay so when we say E1 the three group of E11 right E elliptic curve this elliptic curve we are actually so we are actually calculating based on this elliptic curve over the extension field of f5 um to the^ of two um f5 squ yeah yeah um in this particular case that's why you'll see um extra extra um points here um which is yeah from from the extension field. Um originally I believe um the elliptic curve only have these fields. Yeah, maybe a little bit more. But yeah, um originally only has these few fields um and not I guess these few fields and not um these fields with the um additional variable t. Yeah.

So this is actually um calculating based on the curve of the extended field. Um yeah the that's why it's a full R3 to look in this case. Anyways, let's continue. Any questions? Yeah.

See, also this is Yeah, this is just choosing G1 and G2 using frobinous endomorphism. Uh yeah, if you if you can try to implement this um we will talk about it next week. Let me just scroll down slowly. Stop me if you have any questions. So okay that's all about pairing groups are well pairings any questions here algorithm uh there's a pseudo code here so you can also try to implement this and yeah play with So the well pairing questions here.

Okay, so let's get to the next part. Hashing to curves um specific I mean I think it's just going into try and increment hash functions. Yeah, this this goes into how you might um hash your values into a curve and yeah, essentially it just increments um the value and if the value fits into the curve. If it doesn't fit, we we increment and if it fits um we accept it. How to know if a curve is pairing friendly?

That is a very good question. Um, I want to know if it's penguin. Well, um, from what's here, you want to curve. Okay. From what's here, um, I there is also things that probably well is not really talked about here.

Um, but, um, how to know? One of them is um you have a small embedding degree hopefully. Um you well you have some yeah you have a small degree. You also have a you have some co-actor usually um because that allows you to do well the calculation for pairings um easier, cheaper, more efficiently. Um that that's one of it.

What else? I think I think embedding this is one of the factors that that decides that um one of the things is also um well it's usually so this is the one of the factors I believe but I think generally you essentially want something that allows you to calculate pairings um cheaper um that that's done one of the big things in in um choosing the curves that are good for pairing, right? Choosing a curve pairing friendly curves, right? What will happen if I use a point from the wrong subgroup group? Um so um I am assuming you are talking about um when we do like when we when you want to calculate I guess uh full toion or like parenting groups um if you use a point from the wrong subgroup in in this scenario I think what will happen uh is essentially when you want to do the well pairing when you want when you want to like do this function when you want to calculate this it will just give you a incorrect value um if your G2 let's say you have like a bad point in your G2 um like it will just not work right this this um I do not know um the exact derivation how this comes from but I'll assume um so this this relies on a property from pairing pairing groups and fooding groups um so if you have the incorrect set here this will just not it will just not give you the correct result that you want in this case um yeah so um back to how to know if a curve is pairing friendly Um, pairing friendly usually just refers to curves that are well it's it's a curve that you can do pairing calculations on relatively efficiently.

So in that case you like uh to know if it's pairing friendly you have to essentially see that um one of the things is yeah the emitting degrees one um probably a lot more than that because there's a lot of things affecting um the pairing calculation the pairing calculation efficiency um one of them is the embedding degree um so you don't if you want to know you probably have to just do the calculation see um if that curve curve is suitable in this is um yeah uh I don't have a list for that I think in this case. Yeah. Let's see. So if you choose a curve that okay so that that remember remember SH wise Montgomery and Twisted Edwards so we talked about how Princess Edwards it's very easy to do a calculation for like um addition um because of um because of the fact that um sorry because of the fact that where is it? Yeah, the group law it's it's very easy to do group law for the twist outwards curve, right?

Um if you choose a curve that is a twisted networks curve um you reduce the cost um when you want to apply group law and that helps um in a sense it helps you make your well if you're using it for for ZK or for snarks um it will make it so that it's cheaper to do um group addition, right? Group operation, group law. Um short wire source curve is a lot more expensive to do because you know you need it's very hard to represent that um in this case um because you need to do branching. Same same goes for Montary, right? You need to do branching.

when you specifically handle branching u for the group law um I think for wire straws it's it's even harder because um it's very hard to define the it's hard to define it's it's also expensive to calculate the group law in short um curve case it's a fine group law right this co and tangent rule so I I guess yeah that that's that's one of the things to make sure your curves are pairing friendly How to know? Um yeah, one of ways is yeah see if it you can you can make it a twist outwards curve or monsary curves. Um yeah and also yeah embedding degree of course and probably a lot more. I will take a note on this and I will give you a little bit more context on this probably next week. Um, let me just record this.

Okay, any more questions? I hope I help answer ZK's and Xiaom's question. Okay. Try an increment again. Um so if you if you can read Python code this this helps you understand a little bit more.

Uh yeah. So, so this essentially it's trying to hash. Um I wouldn't say this is brute force but essentially it's trying to like this method try increment essentially it's trying to hash some value into you know the g we are just checking like hey you know if this points work uh if this works so this is the I believe this is the wire stra the the the short wire st formula curve formula is it uh no I'm not I think I'm wrong yeah um yeah I think I'm slightly Uh I think I'm wrong. Yeah. Is it?

No, it is. It is. Okay. Yeah, it is the shortest uh curve formula. Um but yeah, this is essentially trying to hash into a specific curve and um see if it this this point works by essentially checking yeah if it's correct.

Um in this case, yep, it tries to hash into it the first time gets 15. Doesn't work because it's not in three 13. tries a second time after you increment by one. So the binary counter is used um where is it C right there. Yeah, it's so you you concatenate your basically concatenate your firing counter.

This will be increased and retry again. Um, and yeah, this will constantly so this try and increment because you try to hash it in and then if it doesn't work, increment this specific bit and then try again with that additional bit for your uh for the target or your string or the word or the plain plain text that you want to hash into the curve. Um, yeah. So in this case you'll just keep doing it and then checking this against um the short wires equation and um yeah yeah it just keeps implement uh in uh in incrementing it until um it gets a correct point. That's why I try and increment it.

Um yeah, you can also try and implement this not increment implement this and uh yeah and see you know tell in some right okay so 5.6 ICS constructing elliptic curves. Um this is a lot of math. this specific section um we talked so there will be like trace of for yeah where you use this to calculate um well you use this to check if your curve have more points than um the underlying field um Yeah. Um we need this to do the complex multiplication method which is talked about.

Yeah. There's also J invariant which the books mentioned. Um yeah both of this is used later in the complex multiplication method. Um, I haven't really gone through this myself. Um, but this is essentially a way for you to create uh a elliptic curve.

So, you might want to do this when you want certain properties for your curve. Um there are okay so I'm not exactly sure which of the curve currently up used in production is calculated via this. I don't know exactly which of them are done via this. Um, but for example, sometimes you might want a curve that uh that allows you to do recursive operations a little bit cheaper or just allows you to do like recursive stuff, right? Um, and yeah, or like aggregated stuff.

Um, in those cases, you might want to have your own curve with some property and yeah, this might be helpful to do that. Um a very interesting curve is the pasta curve. Uh which is used by I believe um Mina. Yeah, I believe it's Mina. Um no it's not Mina is it?

No it's not. Is it? Yeah but I don't quite remember. But essentially um yeah pasta vesta curve the pasta. So the yeah pasta curves something vesta.

I don't think it's pasta list something but yeah it's essentially um curves that are used um to enable recursive um snarks. Yeah, quite interesting. You can take a look. Um yeah, not sure if they like you actually they are constructed via this method complexion method. Yeah, any questions or anyone that want want to like talk about this?

they have gone through this and want to talk about it. Welcome. Um so ZK um asks uh so the hash is just keep trying until it lands on the valid point. um for this specific method. Yes.

Um you are essentially so you still try to okay if you look here right um you have your string or like your your plain text you try to hash it in and see after you hash it in and you want convert to binary does it hit does it uh land on a point within the within the curve if it doesn't we increment the counter and try again. Um, this specific counter is also concatenated to the to the uh to the to the plain text or like the the string itself like the the thing that you're hashing, right? The the value the the the word. Um, so yeah, it's deterministic in the sense that the same value hashing the same will always result in the same um hash because the counter will always be the same, right? you are trying and incrementing.

So yeah, yes, it is just keep trying until it increments until it finds a point valid point. Pretty sure there maybe maybe there is a better way of doing it, but it doesn't really talk about it here. Um yeah, this is a little bit different from uh if you're just doing on a field. So for the field you can use um you don't need to try increment uh I believe there is um something called let me check no it's not here com rings hashing to module yeah there's also try increment in in rings as well which does similar things Um yeah, this this is actually does the same thing, but this is for rings and and fields. It it works for that.

Um if it's in groups. So yeah, this is the third method, right? They talk about third method here. Um but essentially when you hash into uh mod armatic you can you can do multi ways of like doing it. Um there there's a few explanation here.

So yeah, this this is one of the things right they talk about um hashing into a ring fields are essentially just um rings two rings I believe is it yeah no it's it's just ring this is just a ring yeah fields it's just a ring with um the extra points the extra infinity points extra no point identity points I believe. Yeah. Um yeah. So they they do talk about here but for elliptic curves you use the same method but you are trying to hash into the points of a curve right instead of uh the possible um coordinates of a ring. You are hashing into the possible coordinates of a curve which is slightly different because um yeah because of the selection of your generator in this case.

Yeah. So yes, the try increment yeah it's essentially just keep trying until you find a valid point. Um it can be very efficient because if your field is pretty large or if the your curve the points in your curve is pretty large um there shouldn't be too much um collision I suppose or it should land something it might just very easily land within that um field itself or like the the curve itself. Um yeah, intuitively for me at least if you're just hashing into um groups it's slightly easier groups is a little bit more straightforward. Okay, any more questions?

So there's also this BRS 666 pen and paper curve where you can try to calculate um so they actually walk you through the entire calculation using um complex multiplication method um to basically create a curve right um I haven't gone through this yet um so if you have and you want to share please pick up or else we We'll talk about this next week. We'll try to go through this together next week. Um yeah. So without further ado, um let's go back again. Uh any more questions within like for for four 5.

4 uh 5.5 and 5.6 probably not 5.6. I'll go through 5.

6 next week again alongside with um your possible implementation on uh curve and curve pairings. Um, yeah. Any more questions before we potentially end today's session? Okay, I think I'll assume that everyone don't as of now have much questions. Um I'm okay.

So, so it's been a few weeks I've been conducting uh lessons by basically going through each section and then uh answering to questions. Yeah. To tell me if this works for you or you might prefer some other way of going through the sessions itself because it's a study group. Um so yeah, just just give me any feedback you have. You can PM me on uh Telegram or whatnot as well.

Um yeah, do tell me that. Yep. So without further ado, if there's no questions regarding this, um please do try to implement what you've learned in chapter 5 um in the language you choose. If you are familiar with Python, use Python. If you're familiar with Go, use Go.

If you're familiar with Ras, you ras um it's a homework um there's no pressure of course. But um if you are someone who learns by example or by by implementation, this will help you a lot. Um yeah. Um so let's talk a little bit about what we'll cover next week. So next week we'll cover 5.

6 and the entire chapter 6. So the entire chapter six here um it's chapter six is considered a shorter chapters but it talks about um statements which we will talk about um it's it's a little bit it's slightly related to um compilers in a way um but also how you can represent your program I think in this case um a snark circuit right um Yeah. So, we'll cover 5.6 and chapter 6 next week. Um, same time um 8 to 9:30.

And if you have any questions or things that you want to know or learn about uh or like revisit um from chapter 3 to chapter 5, bring it up next week as well. Um yeah, we'll also so next will be a slightly longer session. I might run it to 1000 p.m. next week.

I I'm not sure yet. Uh we will decide based on uh how fast we go through it. But um we'll also additionally cover things that you have implemented for chapter four and five and I I'll go through an implementation um as well. So before then you can submit your PRs to the repo. I will try to go through them within the week and give some feedback or like you know just have some discussion over there as well.

So yeah, I think that's that's essentially it for today. So next week we'll cover 5.6. Uh we'll go through specifically BRS66 the pen and paper curve. We'll go through this.

Um, we'll probably go in a little bit more detail um as well on on on what's covered here. I I'll answer some of the questions you guys asked this week um as well and then we'll also cover chapter 6. So, please go back, take a look, go through um 5.6 and chapter 6 and we can yeah have more discussion next week. Um yeah, try to implement it in in the language you choose.

Submit the PR to the repo. Uh if you don't know what repo it is, I I will share it again later in the group. Um thank you very much for today. Thank you. Pleasure for coming.

Bye-bye. Okay. Bye. Bye.