**R to @adam3us: the hashring idea from AOS paper is about 50% more compact as you only need to send one c value c0, plus n r values. c_{i+1}=h(r_i*G+c_i*Q_i) where i is modulo n the number of ORs. so it looks like c_1=H(r_0+c_0*Q_i) c_2=H(r_1+c_1*Q{i+1}) ... c_0=H(r_{n-1}+c_{n-1}*Q_{n-1})** the hashring idea from AOS paper is about 50% more compact as you only need to send one c value c0, plus n r values. c_{i+1}=h(r_i*G+c_i*Q_i) where i is modulo n the number of ORs. so it looks like c_1=H(r_0+c_0*Q_i) c_2=H(r_1+c_1*Q{i+1}) ... c_0=H(r_{n-1}+c_{n-1}*Q_{n-1})**R to @adam3us: the hashring idea from AOS paper is about 50% more compact as you only need to send one c value c0, plus n r values. c_{i+1}=h(r_i*G+c_i*Q_i) where i is modulo n the number of ORs. so it looks like c_1=H(r_0+c_0*Q_i) c_2=H(r_1+c_1… https://nitter.net/adam3us/status/1605996276859826176#m