1/*
  2    Copyright 2018 0KIMS association.
  3
  4    This file is part of circom (Zero Knowledge Circuit Compiler).
  5
  6    circom is a free software: you can redistribute it and/or modify it
  7    under the terms of the GNU General Public License as published by
  8    the Free Software Foundation, either version 3 of the License, or
  9    (at your option) any later version.
 10
 11    circom is distributed in the hope that it will be useful, but WITHOUT
 12    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 13    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
 14    License for more details.
 15
 16    You should have received a copy of the GNU General Public License
 17    along with circom. If not, see <https://www.gnu.org/licenses/>.
 18*/
 19pragma circom 2.0.0;
 20
 21include "constants.circom";
 22include "t1.circom";
 23include "t2.circom";
 24include "../binsum.circom";
 25include "sigmaplus.circom";
 26include "sha256compression_function.circom";
 27
 28
 29template Sha256compression() {
 30    signal input hin[256];
 31    signal input inp[512];
 32    signal output out[256];
 33    signal a[65][32];
 34    signal b[65][32];
 35    signal c[65][32];
 36    signal d[65][32];
 37    signal e[65][32];
 38    signal f[65][32];
 39    signal g[65][32];
 40    signal h[65][32];
 41    signal w[64][32];
 42
 43
 44    var outCalc[256] = sha256compression(hin, inp);
 45
 46    var i;
 47    for (i=0; i<256; i++) out[i] <-- outCalc[i];
 48
 49    component sigmaPlus[48];
 50    for (i=0; i<48; i++) sigmaPlus[i] = SigmaPlus();
 51
 52    component ct_k[64];
 53    for (i=0; i<64; i++) ct_k[i] = K(i);
 54
 55    component t1[64];
 56    for (i=0; i<64; i++) t1[i] = T1();
 57
 58    component t2[64];
 59    for (i=0; i<64; i++) t2[i] = T2();
 60
 61    component suma[64];
 62    for (i=0; i<64; i++) suma[i] = BinSum(32, 2);
 63
 64    component sume[64];
 65    for (i=0; i<64; i++) sume[i] = BinSum(32, 2);
 66
 67    component fsum[8];
 68    for (i=0; i<8; i++) fsum[i] = BinSum(32, 2);
 69
 70    var k;
 71    var t;
 72
 73    for (t=0; t<64; t++) {
 74        if (t<16) {
 75            for (k=0; k<32; k++) {
 76                w[t][k] <== inp[t*32+31-k];
 77            }
 78        } else {
 79            for (k=0; k<32; k++) {
 80                sigmaPlus[t-16].in2[k] <== w[t-2][k];
 81                sigmaPlus[t-16].in7[k] <== w[t-7][k];
 82                sigmaPlus[t-16].in15[k] <== w[t-15][k];
 83                sigmaPlus[t-16].in16[k] <== w[t-16][k];
 84            }
 85
 86            for (k=0; k<32; k++) {
 87                w[t][k] <== sigmaPlus[t-16].out[k];
 88            }
 89        }
 90    }
 91
 92    for (k=0; k<32; k++ ) {
 93        a[0][k] <== hin[k];
 94        b[0][k] <== hin[32*1 + k];
 95        c[0][k] <== hin[32*2 + k];
 96        d[0][k] <== hin[32*3 + k];
 97        e[0][k] <== hin[32*4 + k];
 98        f[0][k] <== hin[32*5 + k];
 99        g[0][k] <== hin[32*6 + k];
100        h[0][k] <== hin[32*7 + k];
101    }
102
103    for (t = 0; t<64; t++) {
104        for (k=0; k<32; k++) {
105            t1[t].h[k] <== h[t][k];
106            t1[t].e[k] <== e[t][k];
107            t1[t].f[k] <== f[t][k];
108            t1[t].g[k] <== g[t][k];
109            t1[t].k[k] <== ct_k[t].out[k];
110            t1[t].w[k] <== w[t][k];
111
112            t2[t].a[k] <== a[t][k];
113            t2[t].b[k] <== b[t][k];
114            t2[t].c[k] <== c[t][k];
115        }
116
117        for (k=0; k<32; k++) {
118            sume[t].in[0][k] <== d[t][k];
119            sume[t].in[1][k] <== t1[t].out[k];
120
121            suma[t].in[0][k] <== t1[t].out[k];
122            suma[t].in[1][k] <== t2[t].out[k];
123        }
124
125        for (k=0; k<32; k++) {
126            h[t+1][k] <== g[t][k];
127            g[t+1][k] <== f[t][k];
128            f[t+1][k] <== e[t][k];
129            e[t+1][k] <== sume[t].out[k];
130            d[t+1][k] <== c[t][k];
131            c[t+1][k] <== b[t][k];
132            b[t+1][k] <== a[t][k];
133            a[t+1][k] <== suma[t].out[k];
134        }
135    }
136
137    for (k=0; k<32; k++) {
138        fsum[0].in[0][k] <==  hin[32*0+k];
139        fsum[0].in[1][k] <==  a[64][k];
140        fsum[1].in[0][k] <==  hin[32*1+k];
141        fsum[1].in[1][k] <==  b[64][k];
142        fsum[2].in[0][k] <==  hin[32*2+k];
143        fsum[2].in[1][k] <==  c[64][k];
144        fsum[3].in[0][k] <==  hin[32*3+k];
145        fsum[3].in[1][k] <==  d[64][k];
146        fsum[4].in[0][k] <==  hin[32*4+k];
147        fsum[4].in[1][k] <==  e[64][k];
148        fsum[5].in[0][k] <==  hin[32*5+k];
149        fsum[5].in[1][k] <==  f[64][k];
150        fsum[6].in[0][k] <==  hin[32*6+k];
151        fsum[6].in[1][k] <==  g[64][k];
152        fsum[7].in[0][k] <==  hin[32*7+k];
153        fsum[7].in[1][k] <==  h[64][k];
154    }
155
156    for (k=0; k<32; k++) {
157        out[31-k]     === fsum[0].out[k];
158        out[32+31-k]  === fsum[1].out[k];
159        out[64+31-k]  === fsum[2].out[k];
160        out[96+31-k]  === fsum[3].out[k];
161        out[128+31-k] === fsum[4].out[k];
162        out[160+31-k] === fsum[5].out[k];
163        out[192+31-k] === fsum[6].out[k];
164        out[224+31-k] === fsum[7].out[k];
165    }
166}