Fig. 2From: Shorter ZK-SNARKs from square span programs over ideal latticesProof length varying from circuit sizeBack to article page