longfellow 0.1.0

data/vendor/longfellow-zk/lib/circuits/sha/flatsha256_witness.cc

@@ -0,0 +1,163 @@
+// Copyright 2026 Google LLC.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "circuits/sha/flatsha256_witness.h"
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include "circuits/sha/sha256_constants.h"
+#include "util/ceildiv.h"
+#include "util/panic.h"
+
+namespace proofs {
+
+static inline uint32_t shr(uint32_t x, size_t b) { return (x >> b); }
+
+static inline uint32_t rotr(uint32_t x, size_t b) {
+  return (x >> b) | (x << (32 - b));
+}
+
+static inline uint32_t Ch(uint32_t x, uint32_t y, uint32_t z) {
+  return (x & y) ^ (~x & z);
+}
+
+static inline uint32_t Maj(uint32_t x, uint32_t y, uint32_t z) {
+  return (x & y) ^ (x & z) ^ (y & z);
+}
+
+// See FIPS 180-4, section 4.1.2.  Use the confusing Sigma/sigma terminology
+// from that document.
+static inline uint32_t Sigma0(uint32_t x) {
+  return rotr(x, 2) ^ rotr(x, 13) ^ rotr(x, 22);
+}
+
+static inline uint32_t Sigma1(uint32_t x) {
+  return rotr(x, 6) ^ rotr(x, 11) ^ rotr(x, 25);
+}
+
+static inline uint32_t sigma0(uint32_t x) {
+  return rotr(x, 7) ^ rotr(x, 18) ^ shr(x, 3);
+}
+
+static inline uint32_t sigma1(uint32_t x) {
+  return rotr(x, 17) ^ rotr(x, 19) ^ shr(x, 10);
+}
+
+uint32_t SHA256_ru32be(const uint8_t *d) {
+  uint32_t r = 0;
+  for (size_t i = 0; i < 4; ++i) {
+    r = (r << 8) + (d[i] & 0xffu);
+  }
+  return r;
+}
+
+void SHA256_wu64be(uint8_t *d, uint64_t n) {
+  for (size_t i = 0; i < 8; ++i) {
+    d[7 - i] = (n >> (8 * i)) & 0xffu;
+  }
+}
+
+void FlatSHA256Witness::transform_and_witness_block(
+    const uint32_t in[16], const uint32_t H0[8], uint32_t outw[48],
+    uint32_t oute[64], uint32_t outa[64], uint32_t H1[8]) {
+  uint32_t w[64];
+  for (size_t i = 0; i < 16; ++i) {
+    w[i] = in[i];
+  }
+
+  for (size_t i = 16; i < 64; ++i) {
+    outw[i - 16] = w[i] =
+        sigma1(w[i - 2]) + w[i - 7] + sigma0(w[i - 15]) + w[i - 16];
+  }
+
+  uint32_t a = H0[0];
+  uint32_t b = H0[1];
+  uint32_t c = H0[2];
+  uint32_t d = H0[3];
+  uint32_t e = H0[4];
+  uint32_t f = H0[5];
+  uint32_t g = H0[6];
+  uint32_t h = H0[7];
+
+  for (size_t t = 0; t < 64; ++t) {
+    uint32_t t1 = h + Sigma1(e) + Ch(e, f, g) + kSha256Round[t] + w[t];
+    uint32_t t2 = Sigma0(a) + Maj(a, b, c);
+    h = g;
+    g = f;
+    f = e;
+    oute[t] = e = d + t1;
+    d = c;
+    c = b;
+    b = a;
+    outa[t] = a = t1 + t2;
+  }
+
+  H1[0] = H0[0] + a;
+  H1[1] = H0[1] + b;
+  H1[2] = H0[2] + c;
+  H1[3] = H0[3] + d;
+  H1[4] = H0[4] + e;
+  H1[5] = H0[5] + f;
+  H1[6] = H0[6] + g;
+  H1[7] = H0[7] + h;
+}
+
+static const uint32_t initial_h0[8] = {0x6a09e667u, 0xbb67ae85u, 0x3c6ef372u,
+                                       0xa54ff53au, 0x510e527fu, 0x9b05688cu,
+                                       0x1f83d9abu, 0x5be0cd19u};
+
+void FlatSHA256Witness::transform_and_witness_message(
+    size_t n, const uint8_t msg[/*n*/], size_t max, uint8_t &numb,
+    uint8_t in[/* 64*max */], BlockWitness bw[/*max*/]) {
+  // Compute the exact number of blocks needed for hashing.
+  numb = ceildiv<size_t>(n + 9, 64);
+
+  size_t ii = 0;
+  for (size_t i = 0; i < n; ++i, ++ii) {
+    in[ii] = msg[i];
+  }
+  in[ii++] = 0x80;
+  if ((ii % 64) == 0 || (ii % 64) > 56) {
+    while (ii % 64) {
+      in[ii++] = 0;
+    }
+  }
+  while ((ii % 64) < 56) {
+    in[ii++] = 0;
+  }
+  SHA256_wu64be(&in[ii], n * 8);
+  ii += 8;
+  check(ii % 64 == 0, "Invalid padding");
+
+  // Pad to end.
+  while (ii < 64 * max) {
+    in[ii++] = 0;
+  }
+
+  // Compute all of the intermediate hashes and witnesses.
+  uint32_t data[16];
+  const uint32_t *H = initial_h0;
+  for (size_t bl = 0; bl < max; bl++) {
+    for (size_t i = 0; i < 16; ++i) {
+      data[i] = SHA256_ru32be(&in[bl * 64 + i * 4]);
+    }
+
+    transform_and_witness_block(data, H, bw[bl].outw, bw[bl].oute, bw[bl].outa,
+                                bw[bl].h1);
+    H = bw[bl].h1;
+  }
+}
+
+}  // namespace proofs

data/vendor/longfellow-zk/lib/circuits/sha/flatsha256_witness.h

@@ -0,0 +1,47 @@
+// Copyright 2026 Google LLC.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef PRIVACY_PROOFS_ZK_LIB_CIRCUITS_SHA_FLATSHA256_WITNESS_H_
+#define PRIVACY_PROOFS_ZK_LIB_CIRCUITS_SHA_FLATSHA256_WITNESS_H_
+
+#include <stddef.h>
+#include <stdint.h>
+
+namespace proofs {
+
+uint32_t SHA256_ru32be(const uint8_t *d);
+
+class FlatSHA256Witness {
+ public:
+  struct BlockWitness {
+    uint32_t outw[48];
+    uint32_t oute[64];
+    uint32_t outa[64];
+    uint32_t h1[8];
+  };
+
+  static void transform_and_witness_block(const uint32_t in[16],
+                                          const uint32_t H0[8],
+                                          uint32_t outw[48], uint32_t oute[64],
+                                          uint32_t outa[64], uint32_t H1[8]);
+
+  static void transform_and_witness_message(size_t n, const uint8_t msg[/*n*/],
+                                            size_t max, uint8_t &numb,
+                                            uint8_t in[/* 64*max */],
+                                            BlockWitness bw[/*max*/]);
+};
+
+}  // namespace proofs
+
+#endif  // PRIVACY_PROOFS_ZK_LIB_CIRCUITS_SHA_FLATSHA256_WITNESS_H_

data/vendor/longfellow-zk/lib/circuits/sha/sha256_constants.cc

@@ -0,0 +1,34 @@
+// Copyright 2026 Google LLC.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "circuits/sha/sha256_constants.h"
+
+namespace proofs {
+
+#include <cstdint>
+
+const uint32_t kSha256Round[64] = {
+    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1,
+    0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
+    0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, 0xe49b69c1, 0xefbe4786,
+    0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147,
+    0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
+    0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b,
+    0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a,
+    0x5b9cca4f, 0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
+    0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2};
+
+}  // namespace proofs

data/vendor/longfellow-zk/lib/circuits/sha/sha256_constants.h

@@ -0,0 +1,27 @@
+// Copyright 2026 Google LLC.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef PRIVACY_PROOFS_ZK_LIB_CIRCUITS_SHA_SHA256_CONSTANTS_H_
+#define PRIVACY_PROOFS_ZK_LIB_CIRCUITS_SHA_SHA256_CONSTANTS_H_
+
+#include <cstdint>
+
+namespace proofs {
+
+// Array of round constants used to define SHA256.
+// See FIPS 180-4, section 4.2.2.
+extern const uint32_t kSha256Round[64];
+
+}  // namespace proofs
+#endif  // PRIVACY_PROOFS_ZK_LIB_CIRCUITS_SHA_SHA256_CONSTANTS_H_

data/vendor/longfellow-zk/lib/circuits/sha/sha256_test_values.h

@@ -0,0 +1,389 @@
+// Copyright 2026 Google LLC.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef PRIVACY_PROOFS_ZK_LIB_CIRCUITS_SHA_SHA256_TEST_VALUES_H_
+#define PRIVACY_PROOFS_ZK_LIB_CIRCUITS_SHA_SHA256_TEST_VALUES_H_
+
+#include <stdint.h>
+#include <stdlib.h>
+#include <sys/types.h>
+
+namespace proofs {
+
+struct sha256_testvec {
+  const char* str;
+  size_t len;
+  uint8_t hash[32];
+};
+
+// A set of SHA256 test vectors used to verify the circuit implementation.
+static const struct sha256_testvec SHA256_TV[] = {
+    {"", 0, {0xe3, 0xb0, 0xc4, 0x42, 0x98, 0xfc, 0x1c, 0x14, 0x9a, 0xfb, 0xf4,
+             0xc8, 0x99, 0x6f, 0xb9, 0x24, 0x27, 0xae, 0x41, 0xe4, 0x64, 0x9b,
+             0x93, 0x4c, 0xa4, 0x95, 0x99, 0x1b, 0x78, 0x52, 0xb8, 0x55}},
+    {"abc", 3, {0xba, 0x78, 0x16, 0xbf, 0x8f, 0x01, 0xcf, 0xea,
+                0x41, 0x41, 0x40, 0xde, 0x5d, 0xae, 0x22, 0x23,
+                0xb0, 0x03, 0x61, 0xa3, 0x96, 0x17, 0x7a, 0x9c,
+                0xb4, 0x10, 0xff, 0x61, 0xf2, 0x00, 0x15, 0xad}},
+    {"abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq",
+     56,
+     {0x24, 0x8d, 0x6a, 0x61, 0xd2, 0x06, 0x38, 0xb8, 0xe5, 0xc0, 0x26,
+      0x93, 0x0c, 0x3e, 0x60, 0x39, 0xa3, 0x3c, 0xe4, 0x59, 0x64, 0xff,
+      0x21, 0x67, 0xf6, 0xec, 0xed, 0xd4, 0x19, 0xdb, 0x06, 0xc1}},
+    {"abcdefghbcdefghicdefghijdefghijkefghijklfghijklmghijklmnhijklmnoijklmno"
+     "pjklmnopqklmnopqrlmnopqrsmnopqrstnopqrstu",
+     112,
+     {0xcf, 0x5b, 0x16, 0xa7, 0x78, 0xaf, 0x83, 0x80, 0x03, 0x6c, 0xe5,
+      0x9e, 0x7b, 0x04, 0x92, 0x37, 0x0b, 0x24, 0x9b, 0x11, 0xe8, 0xf0,
+      0x7a, 0x51, 0xaf, 0xac, 0x45, 0x03, 0x7a, 0xfe, 0xe9, 0xd1}},
+    {"D818590293A66776657273696F6E63312E306F646967657374416C676F726974686D67534"
+     "8412D32353667646F6354797065756F72672E69736F2E31383031332E352E312E6D444C6C"
+     "76616C756544696765737473A2716F72672E69736F2E31383031332E352E31A3005820CF9"
+     "C1CB89584BF8C4176A37C2C954A8DC56077D3BA65EE44011E62AB7C63CE2D0158202F00C7"
+     "0D5FA9867D7BD2207E0D0B87E35A9AC962A8DE36EE1BE3944B63B39141025820EA9C0339A"
+     "AF9BAE8",
+     372,
+     {0xc7, 0xce, 0x90, 0x99, 0xbd, 0xb6, 0x41, 0x75, 0x02, 0xb7, 0x3e,
+      0x44, 0xc9, 0x82, 0x7c, 0xd2, 0x95, 0x6c, 0x54, 0x11, 0x0a, 0x39,
+      0xb2, 0x60, 0x67, 0xfb, 0xf7, 0x9f, 0xf8, 0x9b, 0x20, 0xee}},
+
+    // test boundary conditions for padding
+    // 55 a's
+    {"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+     55,
+     {0x9f, 0x43, 0x90, 0xf8, 0xd3, 0x0c, 0x2d, 0xd9, 0x2e, 0xc9, 0xf0,
+      0x95, 0xb6, 0x5e, 0x2b, 0x9a, 0xe9, 0xb0, 0xa9, 0x25, 0xa5, 0x25,
+      0x8e, 0x24, 0x1c, 0x9f, 0x1e, 0x91, 0x0f, 0x73, 0x43, 0x18}},
+    // 56 a's
+    {"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+     56,
+     {0xb3, 0x54, 0x39, 0xa4, 0xac, 0x6f, 0x09, 0x48, 0xb6, 0xd6, 0xf9,
+      0xe3, 0xc6, 0xaf, 0x0f, 0x5f, 0x59, 0x0c, 0xe2, 0x0f, 0x1b, 0xde,
+      0x70, 0x90, 0xef, 0x79, 0x70, 0x68, 0x6e, 0xc6, 0x73, 0x8a}},
+    // 57 a's
+    {"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+     57,
+     {0xf1, 0x3b, 0x2d, 0x72, 0x46, 0x59, 0xeb, 0x3b, 0xf4, 0x7f, 0x2d,
+      0xd6, 0xaf, 0x1a, 0xcc, 0xc8, 0x7b, 0x81, 0xf0, 0x9f, 0x59, 0xf2,
+      0xb7, 0x5e, 0x5c, 0x0b, 0xed, 0x65, 0x89, 0xdf, 0xe8, 0xc6}},
+    {"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+     63,
+     {0x7d, 0x3e, 0x74, 0xa0, 0x5d, 0x7d, 0xb1, 0x5b, 0xce, 0x4a, 0xd9,
+      0xec, 0x06, 0x58, 0xea, 0x98, 0xe3, 0xf0, 0x6e, 0xee, 0xcf, 0x16,
+      0xb4, 0xc6, 0xff, 0xf2, 0xda, 0x45, 0x7d, 0xdc, 0x2f, 0x34}},
+    {"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+     64,
+     {0xff, 0xe0, 0x54, 0xfe, 0x7a, 0xe0, 0xcb, 0x6d, 0xc6, 0x5c, 0x3a,
+      0xf9, 0xb6, 0x1d, 0x52, 0x09, 0xf4, 0x39, 0x85, 0x1d, 0xb4, 0x3d,
+      0x0b, 0xa5, 0x99, 0x73, 0x37, 0xdf, 0x15, 0x46, 0x68, 0xeb}},
+    {"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+     65,
+     {0x63, 0x53, 0x61, 0xc4, 0x8b, 0xb9, 0xea, 0xb1, 0x41, 0x98, 0xe7,
+      0x6e, 0xa8, 0xab, 0x7f, 0x1a, 0x41, 0x68, 0x5d, 0x6a, 0xd6, 0x2a,
+      0xa9, 0x14, 0x6d, 0x30, 0x1d, 0x4f, 0x17, 0xeb, 0x0a, 0xe0}},
+    {"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+     66,
+     {0xac, 0x13, 0x7f, 0xce, 0x49, 0x83, 0x7c, 0x7c, 0x29, 0x45, 0xf6,
+      0x16, 0x0d, 0x3c, 0x0e, 0x67, 0x9e, 0x6f, 0x40, 0x07, 0x08, 0x50,
+      0x42, 0x0a, 0x22, 0xbc, 0x10, 0xe0, 0x69, 0x2c, 0xbd, 0xc7}},
+    // 2 block boundary conditions
+    {"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabbbbbbb"
+     "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+     118,
+     {0x16, 0x1f, 0x88, 0x3d, 0xfb, 0x71, 0x6c, 0x8a, 0xcf, 0x49, 0x6c,
+      0x04, 0x78, 0x8d, 0x42, 0xf8, 0x0c, 0xe2, 0x21, 0x50, 0x4a, 0xfa,
+      0x81, 0x63, 0xc0, 0xe7, 0x3b, 0x11, 0xb5, 0xd2, 0x5f, 0xd0}},
+    {"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabbbbbbb"
+     "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbc",
+     119,
+     {0x6c, 0x17, 0x1b, 0xd6, 0x6a, 0x89, 0x03, 0x44, 0xee, 0x32, 0xde,
+      0x77, 0xe9, 0xdb, 0x13, 0xc0, 0x18, 0x23, 0xac, 0x16, 0xc6, 0xf4,
+      0x76, 0x67, 0x69, 0xd8, 0xa3, 0xf4, 0x91, 0x27, 0xda, 0x98}},
+    {"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabbbbbbb"
+     "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbcccccccc",
+     126,
+     {0x8c, 0xfb, 0x31, 0xd1, 0x1d, 0xd7, 0x6e, 0xfb, 0x8c, 0x70, 0x38,
+      0xa5, 0x09, 0xb9, 0x80, 0x69, 0xbb, 0xb7, 0xa6, 0x04, 0x67, 0x55,
+      0xc5, 0x5b, 0x10, 0x83, 0x9e, 0xd8, 0x72, 0x39, 0x9b, 0x9c}},
+    {"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabbbbbbb"
+     "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbccccccccd",
+     127,
+     {0xf4, 0xaf, 0x59, 0x2b, 0xd9, 0x85, 0xc2, 0x48, 0x66, 0x64, 0x61,
+      0x9a, 0xff, 0xd7, 0xf6, 0xe1, 0x97, 0x8d, 0x9b, 0x24, 0x01, 0x7c,
+      0xe8, 0x63, 0x82, 0x83, 0x62, 0xa1, 0xcd, 0xcd, 0x33, 0xfc}},
+    {"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabbbbbbb"
+     "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbccccccccdd",
+     128,
+     {0xdb, 0x2c, 0x2b, 0xe4, 0xf8, 0x50, 0xcf, 0xd4, 0x2d, 0xce, 0x67,
+      0x8b, 0xe2, 0x63, 0xa9, 0xbb, 0x74, 0x26, 0xf6, 0xbf, 0x39, 0x12,
+      0x8e, 0x9e, 0x75, 0xd3, 0xa3, 0xbd, 0x02, 0x31, 0x64, 0x9a}},
+    {"\x00", 1, {0x6e, 0x34, 0x0b, 0x9c, 0xff, 0xb3, 0x7a, 0x98,
+                 0x9c, 0xa5, 0x44, 0xe6, 0xbb, 0x78, 0x0a, 0x2c,
+                 0x78, 0x90, 0x1d, 0x3f, 0xb3, 0x37, 0x38, 0x76,
+                 0x85, 0x11, 0xa3, 0x06, 0x17, 0xaf, 0xa0, 0x1d}},
+    {"\x00\x01", 2, {0xb4, 0x13, 0xf4, 0x7d, 0x13, 0xee, 0x2f, 0xe6,
+                     0xc8, 0x45, 0xb2, 0xee, 0x14, 0x1a, 0xf8, 0x1d,
+                     0xe8, 0x58, 0xdf, 0x4e, 0xc5, 0x49, 0xa5, 0x8b,
+                     0x79, 0x70, 0xbb, 0x96, 0x64, 0x5b, 0xc8, 0xd2}},
+    {"\x00\x01\x02", 3, {0xae, 0x4b, 0x32, 0x80, 0xe5, 0x6e, 0x2f, 0xaf,
+                         0x83, 0xf4, 0x14, 0xa6, 0xe3, 0xda, 0xbe, 0x9d,
+                         0x5f, 0xbe, 0x18, 0x97, 0x65, 0x44, 0xc0, 0x5f,
+                         0xed, 0x12, 0x1a, 0xcc, 0xb8, 0x5b, 0x53, 0xfc}},
+    {"\x00\x01\x02\x03", 4, {0x05, 0x4e, 0xde, 0xc1, 0xd0, 0x21, 0x1f, 0x62,
+                             0x4f, 0xed, 0x0c, 0xbc, 0xa9, 0xd4, 0xf9, 0x40,
+                             0x0b, 0x0e, 0x49, 0x1c, 0x43, 0x74, 0x2a, 0xf2,
+                             0xc5, 0xb0, 0xab, 0xeb, 0xf0, 0xc9, 0x90, 0xd8}},
+};
+
+// Sample input-output pairs for the block transform.
+struct SHA256BlockTests {
+  uint32_t input[16];
+  uint32_t h[8];
+  uint32_t want[8];
+};
+
+static const struct SHA256BlockTests kSha_bt_[] = {
+    {
+        {
+            0,
+            0xdeadbeef,
+            0xbd5b7dde,
+            0x9c093ccd,
+            0x7ab6fbbc,
+            0x5964baab,
+            0x3812799a,
+            0x16c03889,
+            0xf56df778,
+            0xd41bb667,
+            0xb2c97556,
+            0x91773445,
+            0x7024f334,
+            0x4ed2b223,
+            0x2d807112,
+            0xc2e3001,
+        },
+        {0, 0xabadcafe, 0x575b95fc, 0x30960fa, 0xaeb72bf8, 0x5a64f6f6,
+         0x612c1f4, 0xb1c08cf2},
+        {
+            0x656f967b,
+            0x508cb605,
+            0x109902c5,
+            0xbe9909c,
+            0x30ed1bc6,
+            0x8d3bb28c,
+            0x836c99a8,
+            0x30731a12,
+        },
+    },
+    {
+        {
+            0x7,
+            0xe,
+            0x15,
+            0x1c,
+            0x23,
+            0x2a,
+            0x31,
+            0x38,
+            0x3f,
+            0x46,
+            0x4d,
+            0x54,
+            0x5b,
+            0x62,
+            0x69,
+            0x70,
+        },
+        {0x0, 0x13, 0x26, 0x39, 0x4c, 0x5f, 0x72, 0x85},
+        {
+            0x95ddd507,
+            0x1a7a4b1f,
+            0xf5951676,
+            0x105a25a3,
+            0x511cee03,
+            0xd0972a96,
+            0xb1cb76d7,
+            0xf9f46d72,
+        },
+    },
+    {
+        {
+            0xf0cee5d1,
+            0x615dfa6a,
+            0xbda82adf,
+            0xcb66fb25,
+            0x30d60637,
+            0xb1018af9,
+            0x2c5c0e06,
+            0xb0556e74,
+            0xf8e2da1f,
+            0xf05b699b,
+            0xabbf6d16,
+            0x3377e5ad,
+            0x46d8cd9e,
+            0xcc01d8dd,
+            0x5532a535,
+            0x34e928ea,
+        },
+        {
+            0x515f007c,
+            0x5bd062c2,
+            0x12200854,
+            0x4db127f8,
+            0x216231b,
+            0x1f16e9e8,
+            0x1190cde7,
+            0x66ef438d,
+        },
+        {
+            0x3a3995a,
+            0xb55e568e,
+            0x5fb4b933,
+            0x97c9e9c0,
+            0xaea7d67c,
+            0xaee17ae4,
+            0xcfffacb8,
+            0x91d6ab5e,
+        },
+    }};
+
+// Output values for SHA256(a^k) for various values of k used in the
+// benchmarking results.
+struct sha256_bench {
+  size_t len;
+  uint8_t hash[32];
+};
+
+static const struct sha256_bench kSha_benchmark_[] = {
+    {50, {0x16, 0x0b, 0x4e, 0x43, 0x3e, 0x38, 0x4e, 0x05, 0xe5, 0x37, 0xdc,
+          0x59, 0xb4, 0x67, 0xf7, 0xcb, 0x24, 0x03, 0xf0, 0x21, 0x4d, 0xb1,
+          0x5c, 0x5d, 0xb5, 0x88, 0x62, 0xa3, 0xf1, 0x15, 0x6d, 0x2e}},
+    {114, {0x6c, 0xb7, 0x50, 0xb2, 0x18, 0x16, 0x06, 0x51, 0x1f, 0x4a, 0x7e,
+           0x47, 0x86, 0xb5, 0x36, 0x92, 0xf5, 0x1a, 0x9c, 0xdc, 0x4d, 0x31,
+           0x72, 0xfd, 0xcf, 0xb9, 0x26, 0x7a, 0xec, 0xa7, 0xe4, 0xe4}},
+    {178, {0xca, 0xad, 0x4b, 0x2f, 0xbb, 0x83, 0x0f, 0xa5, 0x40, 0x02, 0xa1,
+           0x67, 0x5f, 0x15, 0x99, 0xd9, 0xb0, 0x92, 0xcd, 0x39, 0x8a, 0xd6,
+           0xfb, 0xb8, 0x16, 0xbf, 0xe8, 0xf9, 0x48, 0xcd, 0xd6, 0x20}},
+    {242, {0x8f, 0xde, 0xd5, 0x9c, 0x42, 0x7b, 0x2e, 0x68, 0x09, 0xc8, 0x10,
+           0x91, 0x5a, 0xac, 0xa9, 0x63, 0x57, 0x32, 0xa1, 0xde, 0xcc, 0x4b,
+           0xa2, 0xac, 0x8e, 0x0a, 0x1d, 0x90, 0xfc, 0x10, 0x92, 0xc9}},
+    {306, {0x4c, 0xef, 0xdb, 0xa1, 0xba, 0x8d, 0x39, 0x75, 0xf3, 0x2c, 0xba,
+           0xc9, 0xf2, 0x27, 0xc7, 0xe6, 0xb6, 0xe6, 0x63, 0x43, 0x9e, 0x79,
+           0x85, 0x61, 0x6b, 0xbb, 0x5c, 0x61, 0x82, 0x4d, 0xbb, 0x0c}},
+    {370, {0x27, 0xdd, 0xc5, 0x8e, 0xcc, 0x58, 0xfd, 0x86, 0x93, 0x37, 0x48,
+           0x1a, 0xf7, 0x73, 0x02, 0xd5, 0x4d, 0xd5, 0xba, 0x91, 0x84, 0x21,
+           0x44, 0xf8, 0x7d, 0xeb, 0x83, 0x24, 0x09, 0x06, 0x9d, 0x0b}},
+    {434, {0xd9, 0x67, 0xcc, 0x55, 0x05, 0x9d, 0x00, 0x82, 0xb6, 0xb2, 0x47,
+           0xd2, 0xa7, 0xd7, 0xfb, 0x79, 0xb7, 0xdd, 0xed, 0xa9, 0x7b, 0xe5,
+           0x92, 0x7d, 0xf4, 0x0c, 0xf9, 0x64, 0x2c, 0xee, 0xc6, 0xd3}},
+    {498, {0x40, 0x47, 0x02, 0x9c, 0x99, 0xeb, 0x4e, 0xf6, 0x39, 0x25, 0x9b,
+           0x2e, 0xe3, 0xc8, 0xde, 0xb4, 0x40, 0x90, 0x86, 0xc8, 0x1d, 0xe1,
+           0xcd, 0xab, 0x00, 0x53, 0xbb, 0xcc, 0x08, 0x84, 0xe4, 0x1e}},
+    {562, {0x3e, 0x47, 0xed, 0x99, 0x0d, 0x31, 0xf0, 0xfe, 0xb0, 0xa7, 0x77,
+           0x1c, 0x72, 0xd1, 0x32, 0x0f, 0xad, 0x55, 0x58, 0x14, 0xf7, 0x81,
+           0x95, 0x6e, 0xfc, 0x89, 0xda, 0x88, 0x4f, 0xf6, 0x3d, 0x40}},
+    {626, {0xc6, 0x20, 0x91, 0x3d, 0xad, 0x86, 0x0a, 0x2a, 0x77, 0x3d, 0x9d,
+           0x56, 0x0c, 0x2c, 0xed, 0x25, 0x03, 0xf6, 0xf9, 0xe2, 0xc5, 0x5c,
+           0xcd, 0x65, 0x08, 0x3b, 0xf0, 0x53, 0x2d, 0x60, 0x62, 0x61}},
+    {690, {0x21, 0x8d, 0xb2, 0x31, 0x17, 0xd4, 0x98, 0x63, 0x1b, 0xfc, 0x22,
+           0x96, 0x49, 0x9a, 0xb2, 0x7e, 0x07, 0x2c, 0xce, 0xf4, 0xfa, 0xea,
+           0xca, 0x63, 0xe5, 0xa2, 0xec, 0xcc, 0x7e, 0x22, 0xf4, 0xac}},
+    {754, {0x29, 0x2c, 0x65, 0x83, 0xeb, 0xe8, 0x2f, 0xee, 0xec, 0xed, 0x13,
+           0xa8, 0x6b, 0xdb, 0x83, 0x8a, 0x15, 0xaf, 0xcc, 0x5b, 0xf4, 0x7f,
+           0x2a, 0xcf, 0x51, 0x51, 0x50, 0x7e, 0xae, 0x03, 0xd7, 0x7c}},
+    {818, {0x5f, 0x99, 0x78, 0x83, 0x81, 0x11, 0x36, 0x98, 0x23, 0x16, 0x54,
+           0xd9, 0x80, 0xfc, 0x73, 0x8d, 0x8e, 0x19, 0x11, 0xc6, 0xa3, 0x0d,
+           0xe8, 0xcb, 0x33, 0xa2, 0x9e, 0xf7, 0xc1, 0xed, 0xc3, 0x19}},
+    {882, {0x5f, 0x2e, 0xb1, 0xec, 0x0f, 0xd7, 0x93, 0x76, 0xc4, 0x8a, 0xfc,
+           0x9c, 0x15, 0xd1, 0x98, 0x64, 0x94, 0x20, 0x5f, 0x69, 0x08, 0x36,
+           0x43, 0xb9, 0xd6, 0x9a, 0x05, 0x85, 0xf4, 0xfb, 0xdc, 0x5f}},
+    {946, {0xe8, 0x06, 0x78, 0xdf, 0xad, 0xb0, 0x70, 0x4e, 0x5e, 0x68, 0x4a,
+           0xda, 0x0b, 0x0b, 0xe7, 0xac, 0x2f, 0x22, 0x54, 0x7f, 0x13, 0x04,
+           0xfe, 0x9a, 0xb4, 0xaa, 0xa7, 0x30, 0xd9, 0x90, 0x9a, 0x3a}},
+    {1010, {0x69, 0x4d, 0x24, 0xc6, 0x82, 0x83, 0xb9, 0x9a, 0xd5, 0xee, 0x5c,
+            0xea, 0xa3, 0x5d, 0x9d, 0xe4, 0xdd, 0x55, 0x45, 0xdd, 0x7a, 0x38,
+            0x5f, 0x4b, 0x18, 0xfa, 0x85, 0xb2, 0xdc, 0x6d, 0xe2, 0xba}},
+    {1074, {0x55, 0xd2, 0xfe, 0x88, 0x80, 0x0f, 0x6b, 0xcb, 0xe7, 0xce, 0xa2,
+            0x98, 0xf4, 0x88, 0xa7, 0xc8, 0x41, 0xd4, 0x03, 0x9f, 0x3f, 0xf3,
+            0xf0, 0xc6, 0xea, 0x2f, 0xa5, 0x40, 0x84, 0xf4, 0xa0, 0xdf}},
+    {1138, {0xa3, 0x38, 0x31, 0x67, 0x79, 0x4a, 0x75, 0x6d, 0x88, 0x9a, 0x7a,
+            0x99, 0xf4, 0x15, 0x79, 0x4d, 0xe9, 0xdf, 0xeb, 0x21, 0x67, 0x2c,
+            0xd1, 0x04, 0x41, 0xcf, 0xfd, 0x93, 0xdb, 0xd8, 0x20, 0x5a}},
+    {1202, {0xdb, 0xb3, 0x3f, 0x50, 0xf1, 0xc7, 0xb1, 0xd9, 0x28, 0x63, 0x2f,
+            0x81, 0x35, 0x08, 0x6a, 0x58, 0xc2, 0x6a, 0x66, 0x55, 0x3b, 0xd2,
+            0x27, 0x7e, 0x4f, 0x9a, 0x5f, 0x00, 0x61, 0xc6, 0xcc, 0x25}},
+    {1266, {0xeb, 0xdd, 0x77, 0xc4, 0x04, 0x96, 0xa9, 0xeb, 0x3f, 0xf9, 0x24,
+            0xf4, 0xcf, 0xb5, 0x4e, 0xee, 0xb2, 0xc6, 0xf5, 0x04, 0x26, 0xb1,
+            0xca, 0x2f, 0xd4, 0xd9, 0x72, 0x83, 0xd8, 0x49, 0x72, 0xce}},
+    {1330, {0x05, 0x3b, 0xbf, 0x41, 0xf3, 0x3d, 0xad, 0x63, 0x5a, 0x69, 0x03,
+            0xca, 0x32, 0x8f, 0x2e, 0xfd, 0x98, 0x87, 0x70, 0x2a, 0x3e, 0x02,
+            0x1e, 0x6a, 0xac, 0x55, 0x9c, 0x53, 0x53, 0xec, 0x43, 0x41}},
+    {1394, {0xf2, 0xda, 0xba, 0x28, 0x4a, 0x48, 0xf7, 0xc6, 0x8f, 0x72, 0x9a,
+            0x17, 0x2b, 0x26, 0x3a, 0xaf, 0x97, 0xd8, 0x0c, 0x57, 0xab, 0xba,
+            0x9b, 0xec, 0xa6, 0x75, 0xb9, 0x4c, 0xcb, 0x6e, 0x9d, 0xa7}},
+    {1458, {0x20, 0x2f, 0x4f, 0x63, 0xe9, 0x31, 0x90, 0x1a, 0xe1, 0xcb, 0x8d,
+            0x42, 0x1d, 0x16, 0x9b, 0x12, 0x78, 0x2a, 0x58, 0x51, 0xca, 0x49,
+            0x73, 0x72, 0xf4, 0xf4, 0x7c, 0x6f, 0xea, 0xc7, 0x61, 0x1d}},
+    {1522, {0xee, 0x97, 0x06, 0xa8, 0xbd, 0x8b, 0x8f, 0xbe, 0x96, 0xa9, 0xff,
+            0x52, 0xb7, 0xc6, 0x36, 0x02, 0x80, 0x70, 0x5f, 0x74, 0xbe, 0x73,
+            0xb8, 0x65, 0x5b, 0xdb, 0x8d, 0x56, 0x07, 0x61, 0xa7, 0xad}},
+    {1586, {0x60, 0xd6, 0x6a, 0xa2, 0x83, 0xbf, 0x1c, 0xed, 0x60, 0x6f, 0xa6,
+            0x40, 0x73, 0xf4, 0x36, 0x3d, 0xed, 0x46, 0x92, 0x4e, 0x93, 0xbe,
+            0x67, 0xb8, 0x19, 0x0b, 0x04, 0xa5, 0x70, 0xab, 0x4a, 0xb5}},
+    {1650, {0x93, 0x32, 0xff, 0xe0, 0x58, 0x84, 0xbf, 0x8f, 0xdd, 0x09, 0x2f,
+            0x94, 0x43, 0x22, 0x57, 0x28, 0x4f, 0x9c, 0x23, 0x2a, 0x72, 0xe5,
+            0xaa, 0x3b, 0x9b, 0x11, 0xda, 0xc4, 0x57, 0xe3, 0x46, 0x34}},
+    {1714, {0xd3, 0x47, 0xa1, 0xbe, 0xf9, 0xea, 0x05, 0x0d, 0xe5, 0x06, 0x2e,
+            0x27, 0x86, 0x72, 0x7d, 0x2b, 0x4c, 0xcb, 0x60, 0x77, 0x7c, 0x82,
+            0xf9, 0x7c, 0xd7, 0x58, 0xfa, 0x44, 0x27, 0x35, 0x51, 0x42}},
+    {1778, {0xdd, 0xf6, 0x34, 0x5e, 0x0e, 0xd2, 0x19, 0x75, 0x06, 0xac, 0x22,
+            0x9f, 0x3b, 0x5f, 0x53, 0xe8, 0xc0, 0x44, 0x24, 0x1d, 0xf6, 0x52,
+            0x72, 0x79, 0xdd, 0x08, 0xa1, 0x2c, 0xbf, 0x75, 0x9f, 0x5e}},
+    {1842, {0xd3, 0xc1, 0x90, 0xe9, 0x4b, 0x65, 0xd4, 0xd6, 0x87, 0xf4, 0xa0,
+            0x14, 0xc6, 0x9a, 0x21, 0x93, 0x87, 0x64, 0x19, 0xcc, 0xa9, 0xa4,
+            0x11, 0xf5, 0xdb, 0x10, 0x03, 0x29, 0xb2, 0x44, 0xe7, 0x98}},
+    {1906, {0x5a, 0x13, 0x1d, 0xa8, 0x27, 0xb8, 0x8a, 0x0e, 0x43, 0x40, 0x7b,
+            0x2b, 0x61, 0x5a, 0x9b, 0x39, 0x1f, 0x80, 0xee, 0x45, 0xab, 0x70,
+            0x55, 0x6c, 0x13, 0xa4, 0x72, 0xe2, 0xa6, 0xf5, 0x79, 0xb3}},
+    {1970, {0x36, 0xaf, 0x67, 0x22, 0xf2, 0xf8, 0x6f, 0x99, 0x3d, 0x5f, 0x36,
+            0x02, 0xc3, 0x1f, 0x3d, 0xea, 0xbd, 0x34, 0xdc, 0xf1, 0xe4, 0xe4,
+            0x78, 0x73, 0x05, 0x20, 0xea, 0xec, 0xf8, 0x71, 0x76, 0xac}},
+    {2034, {0xad, 0x21, 0x5f, 0x13, 0xa8, 0xf7, 0x7d, 0xa1, 0xd0, 0x15, 0xc3,
+            0x5a, 0xdd, 0xee, 0xf8, 0x08, 0x54, 0x79, 0x51, 0xa0, 0x1b, 0x06,
+            0x58, 0x0d, 0x06, 0x31, 0x29, 0x3a, 0xab, 0x6b, 0x24, 0x31}},
+    {2098, {0x5b, 0xff, 0x21, 0x09, 0x0b, 0x8c, 0x80, 0xcf, 0xaf, 0x9c, 0xae,
+            0x93, 0x11, 0x75, 0x05, 0x3e, 0xb2, 0x37, 0x9b, 0xa4, 0xe5, 0xd5,
+            0xa1, 0x2a, 0x60, 0x7c, 0x55, 0x57, 0x72, 0x10, 0xf0, 0xb3}},
+    {2162, {0xad, 0x56, 0x0c, 0xd1, 0x7d, 0x76, 0x14, 0x5f, 0x19, 0x34, 0x14,
+            0x78, 0x31, 0x88, 0x89, 0xdc, 0x35, 0x58, 0xb1, 0x83, 0xed, 0xd4,
+            0x6a, 0x80, 0x07, 0x82, 0x93, 0xdf, 0x94, 0xd9, 0x35, 0x43}},
+    {2226, {0x49, 0x2d, 0x5a, 0x85, 0xfc, 0x33, 0x49, 0xc1, 0x01, 0x83, 0xb0,
+            0x54, 0x80, 0x3c, 0x6d, 0x97, 0x52, 0x8d, 0xcf, 0x61, 0x5b, 0x7a,
+            0x6f, 0xfa, 0x12, 0x97, 0xee, 0x46, 0x3b, 0x48, 0x0b, 0x08}},
+    {2290, {0x9b, 0xfc, 0x47, 0x6b, 0xc9, 0x7e, 0x17, 0x78, 0xd9, 0x20, 0x9f,
+            0x8e, 0x1f, 0x5b, 0xa5, 0x79, 0x1d, 0xad, 0x62, 0xb0, 0x9d, 0xf2,
+            0x45, 0x33, 0x17, 0x4e, 0xf6, 0x8f, 0x3a, 0x04, 0xfb, 0x11}},
+    {2354, {0x7a, 0xbb, 0x72, 0xe9, 0x1a, 0xb0, 0x42, 0x7d, 0xf0, 0x33, 0xaa,
+            0xb7, 0x21, 0xaa, 0x8c, 0x0a, 0xd0, 0x73, 0xe7, 0xd0, 0xea, 0x03,
+            0x40, 0x15, 0xda, 0x17, 0x9c, 0xe7, 0x85, 0xf1, 0x0e, 0x1e}},
+    {2418, {0x21, 0xc6, 0xcc, 0xdb, 0x95, 0x84, 0x53, 0x12, 0xe3, 0xc9, 0x35,
+            0xff, 0xb8, 0xff, 0x69, 0xc2, 0x6e, 0x00, 0x4e, 0x9c, 0x10, 0x80,
+            0xb0, 0x0d, 0x82, 0xfb, 0x17, 0x77, 0x98, 0x23, 0x52, 0x66}},
+    {2482, {0xda, 0x0f, 0x57, 0x79, 0x4d, 0x99, 0x1e, 0x88, 0xd7, 0x4e, 0x03,
+            0x86, 0x63, 0x2a, 0xeb, 0x24, 0xc8, 0x60, 0xe8, 0xc7, 0xff, 0x62,
+            0x5d, 0x5a, 0xd1, 0x20, 0x03, 0x0c, 0x78, 0xb5, 0xba, 0x62}}};
+
+}  // namespace proofs
+
+#endif  // PRIVACY_PROOFS_ZK_LIB_CIRCUITS_SHA_SHA256_TEST_VALUES_H_