Fp128, the 128 bit prime order field, only gets used in test vectors, and was used in the paper to compare against another proof system that works in a 128 bit field. But in practice, we expect Longfellow to be used only with Fp256 (for ECDSA P-256 signatures) and GF(2^128) (for SHA-256). We should remove mention of Fp128 and instead provide test vectors in Fp256 so that implementations don't have to deal with an extra, test-only field.
Fp128, the 128 bit prime order field, only gets used in test vectors, and was used in the paper to compare against another proof system that works in a 128 bit field. But in practice, we expect Longfellow to be used only withFp256(for ECDSA P-256 signatures) andGF(2^128)(for SHA-256). We should remove mention ofFp128and instead provide test vectors inFp256so that implementations don't have to deal with an extra, test-only field.