General Aliascheck template

[clararod9]

This PR introduces an improved version of the Aliascheck() template. This implementation overcomes two major limitations of the current circomlib implementation:

1. Flexibility: the current version of the Aliascheck template only works for the bn128 finite field and produces incorrect results if it is applied to other finite fields. While there are other implementations of the Aliascheck template for other finite fields, this PR introduces the first generalized implementation that can be applied to any finite field.

2. Performance: the new template significantly reduces the number of non-linear R1CS constraints required, lowering circuit compilation and proving costs.

The reductions obtained for the goldilocks and bn128 primes are the following:

Non-linear constraints

Prime / Field	Previous	Now
goldilocks	65	5
bn128	262	169

Intuition:

To verify that an input $x$ is valid and cannot be used in an alias attack, we must ensure that $x \le p - 1$. Instead of performing this check bit-by-bit, we decompose $C = p - 1$ into its Run-Length Encoding (RLE) of contiguous identical bits. Then, let $n$ be the number of blocks $C$, we split the bits of the input in the same $n$ blocks, and we get $C_0,...,C_{n-1}$ from $C$ and $B_0,...,B_{n-1}$ from the input. We then perform comparisons on these blocks:

Block comparison

• If $C_i$ is a block of 1's: We compute the sum of the bits of the input block $B_i$. We check if all bits are 1 by comparing whether the sum equals the block length. If so, the block $B_i$ matches the corresponding block $C_i$. Otherwise, it is smaller.

• If $C_i$ is a block of 0's in $C$: We compute the sum of the bits of the input in that block. We check if all bits are 0 by comparing whether the sum is zero. If so, the block $B_i$ matches the corresponding block $C_i$. If not, it is greater.

• Optimization: If a block is only 1 bit long, we evaluate the bit directly.

Chain comparison

We aggregate the comparison results of the blocks backwards from the LSB to the MSB. Let n be the number of blocks of $C$. Then for all i in {0..m-1} the signal accum[i] is 0 if and only if $B_0,...,B_i$ is smaller than or equal to $C_0,...,C_i$.
We encode this as follows:

• If C_i is a block of 0's : We add the negation of the block-match result to accum[i-1] (if i>0). The output is 0 if and only if the $B_i$ matches $C_i$ and $B_0,...,B_i$ is smaller than or equal to $C_0,...,C_i$ (which fulfils the specification).
• If C_i is a block of $1$'s : We multiply the block-match result and accum[i-1] (if i>0). The output is 0 if and only if either $B_i$ is smaller than $C_i$ or they are equal and $B_0,...,B_i$ is smaller than or equal to $C_0,...,C_i$ (which fulfils the specification).

Number of non-linear constraints

The number of non-linear constraints in the template depends on the number of blocks in the decomposition of $p - 1$. We can compute it as follows:

$$ C_{\text{NL}} = 2 \cdot B_{\text{size}>1} + \frac{B}{2} $$

where $C_{\text{NL}}$ is the number of non-linear constraints in the R1CS system, $B_{\text{size}>1}$ is the number of blocks in the decomposition of $p - 1$ with a size greater than 1, and $B$ is the total number of blocks in the decomposition.