Aux point used for incomplete EC formulas

[davidnevadoc]

Some EC operations such as multiplication and batch multiplication make use an extra aux point in order to utilize incomplete (and more convenient) addition and doubling formulas. This approach is detailed here.

At the moment this aux point is generated at random and passed to the circuit. The purpose of this issue is to discuss whether this point could be fixed and hardcoded into the circuit or not, and what are the security implications and requirements regarding the choice of this point.

[han0110]

After confirmed with @kilic, we should be able to bake a constant into aux, we only need to make sure [aux, 2*aux, 4*aux, 8*aux, ...] are all different for multiexp algorithm (so perhaps choose a random point that's not identity).

[CPerezz]

@davidnevadoc will elaborate on that and come up with a HackMD writeup to start the discussion over this.

[CPerezz]

This approach was taken from Aztec so we could contribute back with our solution.

[davidnevadoc]

I wrote a small note about this topic, see note. The summary is that the aux point cannot be fixed or, more generally, known by the prover before the witness generation, otherwise he can break soundness.

[CPerezz]

Las item to be able to close this would be to export an alias for a Fixed Random Point.