Remove Trapdoor From Circuit

[bhgomes]

Changes

• Replace trapdoor with secret key check on the Sender side
  • Trapdoor was the shared secret between the prover and the sender but it allowed the prover to impersonate the sender in the circuit
  • Now that the trapdoor is gone, we remove a scalar multiplication (3944 constraints & 3821 variables) from each Sender and Receiver
• Remove unnecessary ephemeral public key check on the Receiver side
  • The ephemeral public key check was leftover from previous design choices made on the encrypted note.
  • NB: We don't check the encrypted note in-circuit on purpose since we don't care about enforcing in-band secret distribution, it does not change the security/privacy guarantees on honest users.
  • Now that this check is gone we remove a (constant-base) scalar multiplication (1902 constraints & 1779 variables) from each Receiver
• Generalize some cryptographic primitives and add more encoding/decode methods

Circuit Sizes

This upgrade reduces the circuit sizes considerably:

CIRCUIT	CONSTRAINTS	Δ	SECRET VARIABLES	Δ	PUBLIC VARIABLES	Δ
Mint	450	-5857	448	-5607	4	-2
PrivateTransfer	18148	-15840	17936	-15340	7	-4
Reclaim	17706	-9983	17492	-9733	8	-2