[CFRG] Performance improvements for Prio3

[Christopher Patton <[e-mail]>]

Hi PPM + CFRG,

The VDAF draft (draft-irtf-cfrg-vdaf) is just about ready for RGLC. We
have completed panel review and addressed nearly all feedback. The two
remaining issues are non-trivial:

https://github.com/cfrg/draft-irtf-cfrg-vdaf/issues/549 points out an
improved range check that would reduce the cost of the Sum circuit and make
the SumVec circuit a lot more useful. This would be a breaking change
because we're changing the circuits for the corresponding Prio3 instances.

https://github.com/cfrg/draft-irtf-cfrg-vdaf/issues/574 points out an
algorithmic improvement due to Armando Faz that siginifiantly reduces the
runtime cost of proving and querying the FLP. This would also be a breaking
change because it changes the representation of polynomials on the wire.
(Armando will discuss that in more detail at CFRG next week.)

The editors feel these improvements are significant enough that we should
take them, even if that means RGLC. However, we would like to hear from
implementers as well as CFRG participants at large before we do:

1. As an implementer, are you willing to make a breaking change at this
point?
2. Is it appropriate to make these changes given that we've already
completed panel review for this document?

Thanks in advance,
Chris P. on behalf of the editors