To fflonk or not to fflonk?

[drskalman]

I made this issue to gather pro and cons of using fflonk as opposed to vanila KZG in this repo to make the final decision on this dilemma.

[drskalman]

@AlistairStewart believs it results in some modest but not spectacular speed up given that we have to open in two different points due to linearization.

@swasilyev thinks it would be very useful if we have to commit to verkle-tree, but suspicious of any speed up in current algorithm, be ring proof or SNARKed verification of ring VRF.

[davxy]

As a general approach I prefer to not depend on something that is not used/necessary.

That said, don't we actually open two different polynomials at different points?

• aggregated poly $agg$ at $\zeta$
• aggregated linearization poly $l$ at $\zeta \omega$

Honestly, I don't know how fflonk works, but I was thinking that it allows to open the same poly at multiple points. But maybe I'm wrong.