Optimising proving by avoiding recomputing final Pi polynomial in MLKZG

[storojs72]

Fixes #228

The obvious solution could be just reducing the number of iteration in following loop to ell-1 with subsequent pushing eval to polys. But, as @adr1anh noted in some of discussions we don't need to compute the commitment to this constant polynomial at prover side, since verifier has all necessary information to do that on its side, so in this PR, the EvaluationArgument created by prover contains comms without commitment to eval. It is recomputed at verifier's side and added to com vector before executing kzg_verify_batch.

Important detail

The following check:

if i == ell - 1 && *eval != Pi[0] {
    return Err(NovaError::UnSat);
}

from initial implementation is no longer needed, because we don't compute final Pi but add eval to polys instead, so it is removed. The wrong eval is now detected during proof verification and unit-test added to enforce this.

Question to reviewers

We don't actually use the C parameter while proving. In original implementation it was used only inside kzg_open_batch just to validate the input size and nowhere else at sensible computations. Is that expected?

[adr1anh]

This looks correct to me! However, we can be slightly more optimal by avoiding the opening of the constant polynomial entirely.

The prover only needs to open the ell polynomials, where the first one is the initial input one, and the last one is of size 2. In the first phase of the verification, the verifier uses the fact that ypos[ell] = yneg[ell] = Y[ell] = *y (the evaluation of the constant polynomial).

• Change the size to ell rather than ell+1 in L395
• Append *y to Y in L400.