fix: enforce GT subgroup membership in ArkGT deserialization

[moodlezoup]

Summary

Fixes FJ-ACT-H-08: Dory proof GT elements deserialized as raw Fq12 without subgroup validation, allowing a malicious prover to supply arbitrary Fq12 elements outside the GT subgroup.

• ArkGT now wraps PairingOutput<Bn254> instead of raw Fq12 — PairingOutput's Valid::check() verifies GT subgroup membership by computing x^r == 1 (where r is the scalar field characteristic), whereas Fq12::check() only validates field encoding
• Wire format is unchanged — PairingOutput serializes the same bytes as Fq12, with an additional subgroup check on deserialization
• random() now generates valid GT elements via pairing instead of random Fq12 (which is almost certainly not in GT)
• Removed clippy::suspicious_arithmetic_impl allows — PairingOutput uses additive notation for GT group ops, so + inside add() is no longer suspicious

Changed files

• ark_group.rs — ArkGT wraps PairingOutput<Bn254>; manual Default returning group identity; operators use PairingOutput's group ops
• ark_pairing.rs — Stop unwrapping PairingOutput at all 5 construction sites (ArkGT(result.0) → ArkGT(result))
• ark_serde.rs — DoryDeserialize deserializes as PairingOutput<Bn254> (subgroup check on validation); Valid::check() now delegates to PairingOutput::check()
• tests/ — Wrap test Fq12::rand(...) in PairingOutput(...) to match new inner type

Test plan

• cargo build --all-features — clean
• cargo clippy --features "arkworks,parallel,zk" — clean
• cargo test --features "arkworks,parallel,zk" — 90/90 pass
• Pre-existing cache-feature test flake (21 failures) confirmed on original code — unrelated

🤖 Generated with Claude Code

[moodlezoup]

@markosg04 is there a reason why ArkGT wraps Fq12 and not the PairingOutput(Fq12)? The Valid impl for PairingOutput does perform the subgroup check

[Copilot]

Pull request overview

This PR hardens the arkworks backend’s GT (ArkGT) validation during deserialization by adding an explicit prime-order subgroup membership check, addressing a soundness issue where non-GT Fq12 elements could previously pass validation.

Changes:

• Enforce GT subgroup membership for ArkGT by checking x^r == 1 (with r = Fr::characteristic()).
• Route DoryDeserialize::deserialize_with_mode(..., Validate::Yes) for ArkGT through the new subgroup check (fully qualified to avoid the encoding-only ark_serialize::Valid).
• Add unit tests covering rejection/acceptance and Validate::{Yes,No} behavior for ArkGT deserialization.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[markosg04]

Thank you!