1
 2
 3include "constants.circom";
 4include "sha256compression.circom";
 5
 6template Sha256(nBits) {
 7    signal input in[nBits];
 8    signal output out[256];
 9
10    var i;
11    var k;
12    var nBlocks;
13    var bitsLastBlock;
14
15
16    nBlocks = ((nBits + 64)\512)+1;
17
18    signal paddedIn[nBlocks*512];
19
20    for (k=0; k<nBits; k++) {
21        paddedIn[k] <== in[k];
22    }
23    paddedIn[nBits] <== 1;
24
25    for (k=nBits+1; k<nBlocks*512-64; k++) {
26        paddedIn[k] <== 0;
27    }
28
29    for (k = 0; k< 64; k++) {
30        paddedIn[nBlocks*512 - k -1] <== (nBits >> k)&1;
31    }
32
33    component ha0 = H(0);
34    component hb0 = H(1);
35    component hc0 = H(2);
36    component hd0 = H(3);
37    component he0 = H(4);
38    component hf0 = H(5);
39    component hg0 = H(6);
40    component hh0 = H(7);
41
42    component sha256compression[nBlocks];
43
44    for (i=0; i<nBlocks; i++) {
45
46        sha256compression[i] = Sha256compression() ;
47
48        if (i==0) {
49            for (k=0; k<32; k++ ) {
50                sha256compression[i].hin[0*32+k] <== ha0.out[k];
51                sha256compression[i].hin[1*32+k] <== hb0.out[k];
52                sha256compression[i].hin[2*32+k] <== hc0.out[k];
53                sha256compression[i].hin[3*32+k] <== hd0.out[k];
54                sha256compression[i].hin[4*32+k] <== he0.out[k];
55                sha256compression[i].hin[5*32+k] <== hf0.out[k];
56                sha256compression[i].hin[6*32+k] <== hg0.out[k];
57                sha256compression[i].hin[7*32+k] <== hh0.out[k];
58            }
59        } else {
60            for (k=0; k<32; k++ ) {
61                sha256compression[i].hin[32*0+k] <== sha256compression[i-1].out[32*0+31-k];
62                sha256compression[i].hin[32*1+k] <== sha256compression[i-1].out[32*1+31-k];
63                sha256compression[i].hin[32*2+k] <== sha256compression[i-1].out[32*2+31-k];
64                sha256compression[i].hin[32*3+k] <== sha256compression[i-1].out[32*3+31-k];
65                sha256compression[i].hin[32*4+k] <== sha256compression[i-1].out[32*4+31-k];
66                sha256compression[i].hin[32*5+k] <== sha256compression[i-1].out[32*5+31-k];
67                sha256compression[i].hin[32*6+k] <== sha256compression[i-1].out[32*6+31-k];
68                sha256compression[i].hin[32*7+k] <== sha256compression[i-1].out[32*7+31-k];
69            }
70        }
71
72        for (k=0; k<512; k++) {
73            sha256compression[i].inp[k] <== paddedIn[i*512+k];
74        }
75    }
76
77    for (k=0; k<256; k++) {
78        out[k] <== sha256compression[nBlocks-1].out[k];
79    }
80
81}