ff 0.13 (#269)

* Partial move to ff 0.13

It turns out the newly released k256 0.12 isn't on ff 0.13, preventing further
work at this time.

* Update all crates to work on ff 0.13

The provided curves still need to be expanded to fit the new API.

* Finish adding dalek-ff-group ff 0.13 constants

* Correct FieldElement::product definition

Also stops exporting macros.

* Test most new parts of ff 0.13

* Additionally test ff-group-tests with BLS12-381 and the pasta curves

We only tested curves from RustCrypto. Now we test a curve offered by zk-crypto,
the group behind ff/group, and the pasta curves, which is by Zcash (though
Zcash developers are also behind zk-crypto).

* Finish Ed448

Fully specifies all constants, passes all tests in ff-group-tests, and finishes moving to ff-0.13.

* Add RustCrypto/elliptic-curves to allowed git repos

Needed due to k256/p256 incorrectly defining product.

* Finish writing ff 0.13 tests

* Add additional comments to dalek

* Further comments

* Update ethereum-serai to ff 0.13

crypto/frost/src/curve/mod.rs

@@ -92,7 +92,7 @@ pub trait Curve: Ciphersuite {
     while {
       seed.extend(repr.as_ref());
       res = Zeroizing::new(<Self as Curve>::hash_to_F(b"nonce", seed.deref()));
-      res.ct_eq(&Self::F::zero()).into()
+      res.ct_eq(&Self::F::ZERO).into()
     } {
       seed = Zeroizing::new(vec![0; 32]);
       rng.fill_bytes(&mut seed);

crypto/frost/src/sign.rs

@@ -200,7 +200,7 @@ impl<C: Curve> SignatureShare<C> {
   pub(crate) fn invalidate(&mut self) {
     use ciphersuite::group::ff::Field;
 
-    self.0 += C::F::one();
+    self.0 += C::F::ONE;
   }
 }
 
@@ -252,6 +252,7 @@ pub struct AlgorithmSignMachine<C: Curve, A: Algorithm<C>> {
   params: Params<C, A>,
   seed: CachedPreprocess,
 
+  #[zeroize(skip)]
   commitments_challenge: <A::Transcript as Transcript>::Challenge,
   pub(crate) nonces: Vec<Nonce<C>>,
   // Skips the preprocess due to being too large a bound to feasibly enforce on users

crypto/frost/src/tests/nonces.rs

@@ -106,7 +106,7 @@ impl<C: Curve> Algorithm<C> for MultiNonce<C> {
     self.nonces = Some(nonce_sums.to_vec());
 
     // Sum the nonces so we can later check they actually have a relationship to nonce_sums
-    let mut res = C::F::zero();
+    let mut res = C::F::ZERO;
 
     // Weight each nonce
     // This is probably overkill, since their unweighted forms would practically still require