WIP Square gadget

Saves 17% on prove time for the squared norm equality circuit and 50%
query time. This amounts to 4% savings for sharding and prep
initialization.

crates/daphne/benches/pine.rs

@@ -10,7 +10,7 @@ use prio::{
 };
 
 fn pine(c: &mut Criterion) {
-    for (dimension, chunk_len, chunk_len_sq_norm_equal) in [(200_000, 150 * 2, 447 * 8)] {
+    for (dimension, chunk_len, chunk_len_sq_norm_equal) in [(200_000, 150 * 2, 447 * 18)] {
         let pine =
             Pine::new_64(1 << 15, dimension, 15, chunk_len, chunk_len_sq_norm_equal).unwrap();
         let measurement = vec![0.0; dimension];

crates/daphne/src/pine/flp.rs

@@ -34,7 +34,7 @@
 use prio::{
     field::FftFriendlyFieldElement,
     flp::{
-        gadgets::{Mul, ParallelSum, ParallelSumGadget},
+        gadgets::{Mul, ParallelSum, ParallelSumGadget, PolyEval},
         FlpError, Gadget, Type,
     },
     vdaf::{
@@ -530,7 +530,10 @@ impl<F: FftFriendlyFieldElement> Type for PineTypeSquaredNormEqual<F> {
 
     fn gadget(&self) -> Vec<Box<dyn Gadget<F>>> {
         vec![Box::new(ParallelSum::new(
-            Mul::new(self.cfg.gadget_calls_sq_norm_equal),
+            PolyEval::new(
+                vec![F::zero(), F::zero(), F::one()],
+                self.cfg.gadget_calls_sq_norm_equal,
+            ),
             self.cfg.chunk_len_sq_norm_equal,
         ))]
     }
@@ -542,7 +545,7 @@ impl<F: FftFriendlyFieldElement> Type for PineTypeSquaredNormEqual<F> {
         _joint_rand: &[F],
         _num_shares: usize,
     ) -> Result<F, FlpError> {
-        let mut buf = Vec::with_capacity(self.cfg.chunk_len_sq_norm_equal * 2);
+        let mut buf = Vec::with_capacity(self.cfg.chunk_len_sq_norm_equal);
         let (encoded_gradient, rest) = meas.split_at(self.cfg.dimension);
         let (sq_norm_v_bits, _rest) = rest.split_at(self.cfg.sq_norm_bits);
 
@@ -553,10 +556,7 @@ impl<F: FftFriendlyFieldElement> Type for PineTypeSquaredNormEqual<F> {
         let sq_norm = encoded_gradient
             .chunks(self.cfg.chunk_len_sq_norm_equal)
             .map(|chunk| {
-                for x in chunk {
-                    buf.push(*x);
-                    buf.push(*x);
-                }
+                buf.extend(chunk);
                 for _ in buf.len()..buf.capacity() {
                     buf.push(F::zero());
                 }
@@ -576,21 +576,21 @@ impl<F: FftFriendlyFieldElement> Type for PineTypeSquaredNormEqual<F> {
     }
 
     fn proof_len(&self) -> usize {
-        2 * self.cfg.chunk_len_sq_norm_equal
+        self.cfg.chunk_len_sq_norm_equal
             + 2 * ((1 + self.cfg.gadget_calls_sq_norm_equal).next_power_of_two() - 1)
             + 1
     }
 
     fn verifier_len(&self) -> usize {
-        2 * self.cfg.chunk_len_sq_norm_equal + 2
+        self.cfg.chunk_len_sq_norm_equal + 2
     }
 
     fn joint_rand_len(&self) -> usize {
         0
     }
 
     fn prove_rand_len(&self) -> usize {
-        self.cfg.chunk_len_sq_norm_equal * 2
+        self.cfg.chunk_len_sq_norm_equal
     }
 
     fn query_rand_len(&self) -> usize {