Use of mod N instead of mod N^2 in proofs

[mortendahl]

The use of mod N in the proofs of correct decryption key might be a non-standard assumption that we should make sure is okay to use. Hardness of DCR implies hardness of RSA inversion but may not imply RSA indistinguishability, which might be needed for the simulation proofs to go through (alternatively the simulator may be adaptable).

In any case, this should be addressed before making the next release, defaulting to the conservative case if not resolution is found.

[mortendahl]

The fact that (x mod nn) mod n = x mod n settles the issue, making it safe to reveal x mod n instead of x mod nn