'On the Amortized Complexity of Zero-knowledge Protocols' by Ronald Cramer, Ivan Damgård & Marcel Keller.

https://eprint.iacr.org/2015/446.pdf nostr:note1pz30h2jcwdz5yafeva705wj2n8w7tlt3uqgv3smnu9uvwsq8vlxq0ut463