Add a batch verified DLEq

The batch verified one offers ~23% faster verification. While this 
massively refactors for modularity, I'm still not happy with the DLEq 
proofs at the top level, nor am I happy with the AOS signatures. I'll 
work on cleaning them up more later.

crypto/dleq/src/tests/cross_group/linear/concise.rs

@@ -0,0 +1,98 @@
+use rand_core::{RngCore, OsRng};
+
+use ff::{Field, PrimeField};
+
+use k256::Scalar;
+#[cfg(feature = "serialize")]
+use k256::ProjectivePoint;
+#[cfg(feature = "serialize")]
+use dalek_ff_group::EdwardsPoint;
+
+use blake2::{Digest, Blake2b512};
+
+use crate::{
+  cross_group::{scalar::mutual_scalar_from_bytes, linear::ConciseDLEq},
+  tests::cross_group::{transcript, generators}
+};
+
+#[test]
+fn test_linear_concise_cross_group_dleq() {
+  let generators = generators();
+
+  for i in 0 .. 1 {
+    let (proof, keys) = if i == 0 {
+      let mut seed = [0; 32];
+      OsRng.fill_bytes(&mut seed);
+
+      ConciseDLEq::prove(
+        &mut OsRng,
+        &mut transcript(),
+        generators,
+        Blake2b512::new().chain_update(seed)
+      )
+    } else {
+      let mut key;
+      let mut res;
+      while {
+        key = Scalar::random(&mut OsRng);
+        res = ConciseDLEq::prove_without_bias(
+          &mut OsRng,
+          &mut transcript(),
+          generators,
+          key
+        );
+        res.is_none()
+      } {}
+      let res = res.unwrap();
+      assert_eq!(key, res.1.0);
+      res
+    };
+
+    let public_keys = proof.verify(&mut OsRng, &mut transcript(), generators).unwrap();
+    assert_eq!(generators.0.primary * keys.0, public_keys.0);
+    assert_eq!(generators.1.primary * keys.1, public_keys.1);
+
+    #[cfg(feature = "serialize")]
+    {
+      let mut buf = vec![];
+      proof.serialize(&mut buf).unwrap();
+      let deserialized = ConciseDLEq::<ProjectivePoint, EdwardsPoint>::deserialize(
+        &mut std::io::Cursor::new(&buf)
+      ).unwrap();
+      assert_eq!(proof, deserialized);
+      deserialized.verify(&mut OsRng, &mut transcript(), generators).unwrap();
+    }
+  }
+}
+
+#[test]
+fn test_remainder() {
+  // Uses Secp256k1 for both to achieve an odd capacity of 255
+  assert_eq!(Scalar::CAPACITY, 255);
+  let generators = (generators().0, generators().0);
+  let keys = mutual_scalar_from_bytes(&[0xFF; 32]);
+  assert_eq!(keys.0, keys.1);
+
+  let (proof, res) = ConciseDLEq::prove_without_bias(
+    &mut OsRng,
+    &mut transcript(),
+    generators,
+    keys.0
+  ).unwrap();
+  assert_eq!(keys, res);
+
+  let public_keys = proof.verify(&mut OsRng, &mut transcript(), generators).unwrap();
+  assert_eq!(generators.0.primary * keys.0, public_keys.0);
+  assert_eq!(generators.1.primary * keys.1, public_keys.1);
+
+  #[cfg(feature = "serialize")]
+  {
+    let mut buf = vec![];
+    proof.serialize(&mut buf).unwrap();
+    let deserialized = ConciseDLEq::<ProjectivePoint, ProjectivePoint>::deserialize(
+      &mut std::io::Cursor::new(&buf)
+    ).unwrap();
+    assert_eq!(proof, deserialized);
+    deserialized.verify(&mut OsRng, &mut transcript(), generators).unwrap();
+  }
+}

crypto/dleq/src/tests/cross_group/linear/efficient.rs

@@ -0,0 +1,66 @@
+use rand_core::{RngCore, OsRng};
+
+use ff::Field;
+
+use k256::Scalar;
+#[cfg(feature = "serialize")]
+use k256::ProjectivePoint;
+#[cfg(feature = "serialize")]
+use dalek_ff_group::EdwardsPoint;
+
+use blake2::{Digest, Blake2b512};
+
+use crate::{
+  cross_group::linear::EfficientDLEq,
+  tests::cross_group::{transcript, generators}
+};
+
+#[test]
+fn test_linear_efficient_cross_group_dleq() {
+  let generators = generators();
+
+  for i in 0 .. 1 {
+    let (proof, keys) = if i == 0 {
+      let mut seed = [0; 32];
+      OsRng.fill_bytes(&mut seed);
+
+      EfficientDLEq::prove(
+        &mut OsRng,
+        &mut transcript(),
+        generators,
+        Blake2b512::new().chain_update(seed)
+      )
+    } else {
+      let mut key;
+      let mut res;
+      while {
+        key = Scalar::random(&mut OsRng);
+        res = EfficientDLEq::prove_without_bias(
+          &mut OsRng,
+          &mut transcript(),
+          generators,
+          key
+        );
+        res.is_none()
+      } {}
+      let res = res.unwrap();
+      assert_eq!(key, res.1.0);
+      res
+    };
+
+    let public_keys = proof.verify(&mut OsRng, &mut transcript(), generators).unwrap();
+    assert_eq!(generators.0.primary * keys.0, public_keys.0);
+    assert_eq!(generators.1.primary * keys.1, public_keys.1);
+
+    #[cfg(feature = "serialize")]
+    {
+      let mut buf = vec![];
+      proof.serialize(&mut buf).unwrap();
+      let deserialized = EfficientDLEq::<ProjectivePoint, EdwardsPoint>::deserialize(
+        &mut std::io::Cursor::new(&buf)
+      ).unwrap();
+      assert_eq!(proof, deserialized);
+      deserialized.verify(&mut OsRng, &mut transcript(), generators).unwrap();
+    }
+  }
+}

crypto/dleq/src/tests/cross_group/linear/mod.rs

@@ -0,0 +1,2 @@
+mod concise;
+mod efficient;

crypto/dleq/src/tests/cross_group/mod.rs

@@ -2,7 +2,7 @@ mod scalar;
 mod schnorr;
 
 use hex_literal::hex;
-use rand_core::{RngCore, OsRng};
+use rand_core::OsRng;
 
 use ff::{Field, PrimeField};
 use group::{Group, GroupEncoding};
@@ -10,17 +10,17 @@ use group::{Group, GroupEncoding};
 use k256::{Scalar, ProjectivePoint};
 use dalek_ff_group::{self as dfg, EdwardsPoint, CompressedEdwardsY};
 
-use blake2::{Digest, Blake2b512};
-
 use transcript::RecommendedTranscript;
 
-use crate::{Generators, cross_group::{DLEqProof, scalar::mutual_scalar_from_bytes}};
+use crate::{Generators, cross_group::linear::EfficientDLEq};
 
-fn transcript() -> RecommendedTranscript {
+mod linear;
+
+pub(crate) fn transcript() -> RecommendedTranscript {
   RecommendedTranscript::new(b"Cross-Group DLEq Proof Test")
 }
 
-fn generators() -> (Generators<ProjectivePoint>, Generators<EdwardsPoint>) {
+pub(crate) fn generators() -> (Generators<ProjectivePoint>, Generators<EdwardsPoint>) {
   (
     Generators::new(
       ProjectivePoint::GENERATOR,
@@ -46,7 +46,7 @@ fn test_rejection_sampling() {
   }
 
   assert!(
-    DLEqProof::prove_without_bias(
+    EfficientDLEq::prove_without_bias(
       &mut OsRng,
       &mut RecommendedTranscript::new(b""),
       generators(),
@@ -54,85 +54,3 @@ fn test_rejection_sampling() {
     ).is_none()
   );
 }
-
-#[test]
-fn test_cross_group_dleq() {
-  let generators = generators();
-
-  for i in 0 .. 2 {
-    let (proof, keys) = if i == 0 {
-      let mut seed = [0; 32];
-      OsRng.fill_bytes(&mut seed);
-
-      DLEqProof::prove(
-        &mut OsRng,
-        &mut transcript(),
-        generators,
-        Blake2b512::new().chain_update(seed)
-      )
-    } else {
-      let mut key;
-      let mut res;
-      while {
-        key = Scalar::random(&mut OsRng);
-        res = DLEqProof::prove_without_bias(
-          &mut OsRng,
-          &mut transcript(),
-          generators,
-          key
-        );
-        res.is_none()
-      } {}
-      let res = res.unwrap();
-      assert_eq!(key, res.1.0);
-      res
-    };
-
-    let public_keys = proof.verify(&mut transcript(), generators).unwrap();
-    assert_eq!(generators.0.primary * keys.0, public_keys.0);
-    assert_eq!(generators.1.primary * keys.1, public_keys.1);
-
-    #[cfg(feature = "serialize")]
-    {
-      let mut buf = vec![];
-      proof.serialize(&mut buf).unwrap();
-      let deserialized = DLEqProof::<ProjectivePoint, EdwardsPoint>::deserialize(
-        &mut std::io::Cursor::new(&buf)
-      ).unwrap();
-      assert_eq!(proof, deserialized);
-      deserialized.verify(&mut transcript(), generators).unwrap();
-    }
-  }
-}
-
-#[test]
-fn test_remainder() {
-  // Uses Secp256k1 for both to achieve an odd capacity of 255
-  assert_eq!(Scalar::CAPACITY, 255);
-  let generators = (generators().0, generators().0);
-  let keys = mutual_scalar_from_bytes(&[0xFF; 32]);
-  assert_eq!(keys.0, keys.1);
-
-  let (proof, res) = DLEqProof::prove_without_bias(
-    &mut OsRng,
-    &mut transcript(),
-    generators,
-    keys.0
-  ).unwrap();
-  assert_eq!(keys, res);
-
-  let public_keys = proof.verify(&mut transcript(), generators).unwrap();
-  assert_eq!(generators.0.primary * keys.0, public_keys.0);
-  assert_eq!(generators.1.primary * keys.1, public_keys.1);
-
-  #[cfg(feature = "serialize")]
-  {
-    let mut buf = vec![];
-    proof.serialize(&mut buf).unwrap();
-    let deserialized = DLEqProof::<ProjectivePoint, ProjectivePoint>::deserialize(
-      &mut std::io::Cursor::new(&buf)
-    ).unwrap();
-    assert_eq!(proof, deserialized);
-    deserialized.verify(&mut transcript(), generators).unwrap();
-  }
-}