Slothful reduction

[burdges]

Is there anything to be gained from applying ideas from https://eprint.iacr.org/2017/437 here? I noticed amcl claims constant time operations based on that. All this is irrelevant for zcash perhaps? Right now, I donno anyone who would care about pairings being constant time, for example.

[daira]

Pairings are only used in proof validation, which need not be constant-time. However the constant-time techniques in section 7 of that paper apply to extension field arithmetic in general, and we do use that for the G₂ operations used in proving.