Add decider circuit RelaxedR1CS

[arnaucube]

This PR implements the approach that @nalinbhardwaj proposed (#19), in order to avoid needing to modify an existing SNARK prover to work with Relaxed R1CS. The main idea is to have a R1CS circuit that checks the Relaxed R1CS relation (Az∘Bz - uCz-E=0), and is this circuit the one which is then proved with the SNARK prover.

As an example, for an original circuit of 1k constraints, it takes ~3k constraints for the RelaxedR1CS checker circuit.

The following table provides some approximate results to have a bit of intuition on the numbers:

original circuit description	num constr original circuit	num constr RelaxedR1CS checker circuit with R1CS matrices as witness	num constr RelaxedR1CS checker circuit with R1CS matrices as constraints
y=x^3+x+5	3	19	8
sha256	40k	304k	109k
2x sha256	79.7k	605.6k	217k
CustomTestCircuit	40k	240k	120k
CustomTestCircuit	79k	474k	237k
CustomTestCircuit	1k	6k	3k
CustomTestCircuit	10k	60k	30k
CustomTestCircuit	1M	6M	3M

(CustomTestCircuit logic is just a loop of multiplications in order to generate the number of constraints desired, it's logic can be found here)

Note that the CustomTestCircuit is very sparse, that's why although original circuits with similar number of constraints for sha256 & CustomTestCircuit, they will have a bit different number of constraints for the RelaxedR1CS checker circuit.

For the circuit implementation I'm using sparse matrices shape, which I'm not 100% sure that is the proper way to handle the circuit matrices in terms of constraints. If needed I could update it implementing it with dense matrices.

Commit msg:
Add decider circuit RelaxedR1CS

• Add naive decider circuit RelaxedR1CSGadget, which in-circuit checks that the given z satisfies the given RelaxedR1CS instance
• Add method to relax the R1CS instance
• Add check_relation (for testing only) to R1CS & RelaxedR1CS
• Migrate from own SparseMatrix to use ark_relations::r1cs::Matrix
• Add frontend helper to use arkworks circuits

resolves #19

Edit1: I've requested also review from @nalinbhardwaj (through chat as I can not put him as reviewer through the GitHub interface), since this approach was originally proposed by him.
Edit2: updated the table with the most-right column.

[han0110]

LGTM. Only have a question on the decider usecase.

[arnaucube]

Update: @han0110 made a great point here: #21 (comment) 🙌
I've updated the code to use the R1CS matrices as constants instead of witnesses (here the small diff) as @han0110 suggested, and the blowup factor of number of constraints for the circuit got from 6x to 3x!
Updated also the table from the PR message adding another column with the new numbers of constraints.

[CPerezz]

LGTM!

Left some nits to be addressed optionally.

[pnyda]

May I ask how we're gonna use Sha256Gadget?

[arnaucube]

May I ask how we're gonna use Sha256Gadget?

The Sha256Gadget only was used only for the test to have some numbers about the constraints of a 'real circuit' passed through the relaxed-r1cs verifier circuit. No plans (at least for now) to use it in the library itself (other than in the mentioned test).