ECCVM: Explore length/width tradeoff

[ledwards2225]

Basic question: is there a low-complexity way to trade length for width in the ECCVM with the goal of reducing the final IPA MSM size at the expense of some prover work / proof size?

[ledwards2225]

@notnotraju Can you summarize your conclusions on this for posterity then close as appropriate?

[notnotraju]

Summary

I attempted to do this in 21721. We followed the idea of trying to increase the number of digits per row. However, the problem is that we can't do this for doublings, as each wnaf digit is 4 bits.

We should keep this in our back pocket in case we want to do it later, but it is a nontrivial change and doesn't cause that much of a win.

Capacity analysis

Each app circuit adds ~1104 ECCVM rows with a base overhead of ~1494 rows.

CONST_ECCVM_LOG_N	ECCVM rows	Max apps	vs. old 4-wide at LOG_N=15
15	32768	28	+65% capacity (was 17)
14	16384	13	-24% capacity (was 17)

LOG_N=14 does NOT maintain capacity parity: only 13 apps fit (down from 17).