Fix shift malleability attack.

[SoraSuegami]

As pointed out in zkp2p/zk-p2p#113, the current VarShiftLeft template does not check that the given shift is at the first position of the non-masked string.
It allows an adversary to extract an arbitrary substring of the non-masked string.

I added VarShiftMaskedStr and ShiftAndPackMaskedStr in packages/circuits/helpers/extract.circom to fix that issue in the following approach.

1. The circuit takes as input the starting index shift.
2. The shift template constrains the following conditions.

• in[shift] is not zero.
• shift is zero or in[shift-1] is zero.

[socket-security]

Updated dependencies detected. Learn more about Socket for GitHub ↗︎

Packages	Version	New capabilities	Transitives	Size	Publisher
@zk-email/zk-regex-circom	1.1.0...1.1.1	None	+0/-0	197 kB	sora_suegami