 Hi, I'm Charlotte and I'm going to tell you about our paper Practical Statistically Sound Proofs of Exponentiation in Any Group. This is joint work with Pavel, Chetan, Karin and Ksistof. Now, in a proof of explanation, we have a prover and a verifier. And they both get as input the table x, q, t, y. Now, the prover claims that the result of the explanation x to the q to the t equals y in some group g. But the verifier doesn't trust the prover. So how can the verifier be sure that this is the correct result? In groups of hidden order, recomputing the result takes t sequential explanations. We don't know of a significantly faster algorithm to compute it. But we want the verifier to be much more efficient. And to this end, we let the prover send a proof of explanation or PoE to the verifier to prove correctness of the result. Here, the cost of computing and verifying the PoE is much less than t. Applications of PoEs include verifiable delay functions and time and space efficient arguments for NP. Now, let's look at the existing PoEs. Again, this is our instance, x to the q to the t equals y. So there's Fizolowski's protocol, which is quite short. The proof consists of only one group element. However, the soundness is only computational and it relies on the adaptive root assumption, which is a quite novel assumption and not well understood. Then there's Pitchx protocol. Here, the proofs are a bit longer. The proof size is log t. However, this PoE is statistically sound in some groups. And in other groups, it's computationally sound if the low order assumption holds. Finally, we have the PoE of block at I, which can be seen as a clever parallel repetition of Pitchx protocol. Due to this repetition, however, the proof size blows up. And the proof consists of lambda log t group elements where lambda is a statistical security parameter. But this PoE has the advantage that it's statistically sound in any group. Now, our contribution is the following. We construct a statistically sound PoE that reduces the proof size of block at I by almost one order of magnitude for q of a special form. We will later see that in all of the applications we consider, choosing q of this form is not a restriction. And if you want to see how we achieve this result, please come to the live talk.