In a group that supports efficient pairings, we can compute g^{xy} given g^x and g^y, hence breaking the Computation Diffie-Hellman (CDH) assumption

In the GGM model, the adversary can only output new group elements that are a linear combination of the group elements it has already seen

q-SBDH is a weaker assumption than CDH

Pairings enable verification of quadratic relations in the exponent (using notation from lecture 6)

In the modified KZG scheme that provides knowledge soundness with KoE assumption, the randomness alpha is known to the prover

The KZG scheme supports batched openings where verifier complexity is sublinear in the number of queries

In powers-of-tau ceremony, each contributor provides a proof showing that s is not equal to 0 to prevent tau from becoming 0

The multivariate KZG scheme only works over multilinear polynomials

The prover and verifier complexity in Bulletproofs PC is the same asymptotically

Hyrax has the following relation between proof size |pi| and verifier time |V|: |pi| * |V| = O(d)