Prio3: Improve domain separation for multi-proof mode

[cjpatton]

Partially addresses #177.

The query randomness is correlated for different values of Prio3.PROOFS. To provide defense in depth in case the same verification key is used for different versions, prepend the binder with bytes(Prio3.PROOFS).

For consistency, do the same for the prove randomness and each Helper's share of the proofs. Also, do the same for joint randomness in case Prio3.PROOFS == 1.

[cjpatton]

@divergentdave please let me know if you'd be happy implementing multi-proof mode in libprio-rs. (Previously it was optional, but this PR would make this feature wire breaking.)

@albertpl please review as well and make sure you're happy.

[albertpl]

Good catch!

So this change would break some of the Prio3 related test vectors , right? If we generate test vectors with PROOFS=1, it wouldn't be the same again. Is that a problem? Shall we document this?

Wait. So wire change is for this purpose?

[cjpatton]

Good catch!

So this change would break some of the Prio3 related test vectors , right? If we generate test vectors with PROOFS=1, it wouldn't be the same again. Is that a problem? Shall we document this?

Yes, we'll break the test vectors, but we will break the test vectors anyway in the next version (when we bump VERSION). All we need to do is re-generate them, so this is not a problem. The break will be documented in the Change Log section of the draft.

Wait. So wire change is for this purpose?

Yes.

[albertpl]

Thank you for catching this.

[divergentdave]

LGTM. We can implement it in libprio-rs too. I figure the main thing we'll have to watch out for is performance regressions if bound checks stop being elided, but we can address that with appropriate use of iterators.