Crypto part of the Groth's NIDKG

[jstuczyn]

Alright, this [draft] pull request includes the first batch of work required for distributed key generation so that we could have our coconut credentials. This part focuses on the crypto-part of the problem. The implementation is based on Non-interactive distributed key generation and key resharing by Jens Groth paper. It is also further supported by the extremely helpful description provided by Ania and Alfredo available on our overleaf: https://www.overleaf.com/project/61fc031513021c2738dee13c.

Unfortunately in order to create this implementation, the bls12-381 curve library had to be forked and we will need to operate on the fork until zkcrypto/bls12_381#10 is resolved as we require being able to serialize curve elements inside Gt so that we could create the lookup table required for the baby-step giant-step algorithm used during chunk decryption. This also means that once DKG is incorporated into the coconut, the underlying curve library used there will need to be switched to the same fork.

The PR also includes couple of benchmarks and those regarding dealing verification and share recovery should be of interest. I've run them on my local machine with ryzen 5900X and the relevant results are as follows:

• it takes 3.43s to verify a single dealing (and recover associated share) that has been created for 20 party setup. This means that every single party in the system will need to dedicate ~4.35 minutes of compute time for key creation. (each party has to recover shares from 19 other parties and it has to be performed 4 times since we intend to have 4 attributes in each credential and 3.43s * 19 * 4 = 260.7s ~ 4.35 minutes)
• it takes 16.83s to verify a single dealing (and recover associated share) that has been created for 100 party setup. This implies that every single party in the system will need to dedicate ~2 hours of compute time for key creation (16.83 * 99 * 4 = 111 minutes)

The remaining work before this PR can be moved out of the draft includes:
- serialization implementation of the remaining data structures that are required for end-to-end operation (such as DecryptionKey or Dealing),
- implementation of VKCombine and VKVfy algorithms

However, in its current state, I think all the existing crypto primitives are ready to get reviewed.

[aniampio]

The crypto looks good! Left a few minor comments.