Ticket to keep track of Daira's review

[daira]

No description provided.

[daira]

Reviewed https://github.com/zcash-hackworks/sapling-crypto/blob/master/src/circuit/blake2s.rs and its dependency https://github.com/zcash-hackworks/sapling-crypto/blob/master/src/circuit/multieq.rs . Prompted @ebfull to find the issue with MultiEq (not a consensus bug, just cleanup) that is fixed in #83. Spec updated to take account of the MultiEq batching in 2018.0-beta-29. Also checked against the BLAKE2s paper and RFC.

Partially reviewed https://github.com/zcash-hackworks/sapling-crypto/blob/master/src/circuit/num.rs , in particular the range check in into_bits_le_strict (and its dependency AllocatedBit::alloc_conditionally). Updated the spec to include a full correctness proof (which is quite subtle!) for that constraint system in 2018.0-beta-29.