Witnessing points

We represent elliptic curve points in the circuit in their affine representation . The identity is represented as the pseudo-coordinate , which we assume is not a valid point on the curve.

Non-identity points

To constrain a coordinate pair as representing a valid point on the curve, we directly check the curve equation. For Pallas and Vesta, this is:

Points including the identity

To allow to represent either a valid point on the curve, or the pseudo-coordinate , we define a separate gate that enforces the curve equation check unless both and are zero.