1pragma circom 2.0.0;
  2
  3include "./utils.circom";
  4
  5template step(shl, shr) {
  6    // out = a<<shl|a>>shr
  7    signal input a[64];
  8    signal output out[64];
  9    var i;
 10
 11    component aux0 = ShR(64, shr);
 12    for (i=0; i<64; i++) {
 13        aux0.in[i] <== a[i];
 14    }
 15    component aux1 = ShL(64, shl);
 16    for (i=0; i<64; i++) {
 17        aux1.in[i] <== a[i];
 18    }
 19    component aux2 = OrArray(64);
 20    for (i=0; i<64; i++) {
 21        aux2.a[i] <== aux0.out[i];
 22        aux2.b[i] <== aux1.out[i];
 23    }
 24    for (i=0; i<64; i++) {
 25        out[i] <== aux2.out[i];
 26    }
 27}
 28template RhoPi() {
 29    signal input in[25*64];
 30    signal output out[25*64];
 31
 32    var i;
 33
 34    for (i=0; i<64; i++) {
 35        out[i] <== in[i];
 36    }
 37
 38    // r[10] = a[1]<<1|a[1]>>(64-1)
 39    component s10 = step(1, 64-1);
 40    for (i=0; i<64; i++) {
 41        s10.a[i] <== in[1*64+i];
 42    }
 43    // r[7] = a[10]<<3|a[10]>>(64-3)
 44    component s7 = step(3, 64-3);
 45    for (i=0; i<64; i++) {
 46        s7.a[i] <== in[10*64+i];
 47    }
 48    // r[11] = a[7]<<6|a[7]>>(64-6)
 49    component s11 = step(6, 64-6);
 50    for (i=0; i<64; i++) {
 51        s11.a[i] <== in[7*64+i];
 52    }
 53    // r[17] = a[11]<<10|a[11]>>(64-10)
 54    component s17 = step(10, 64-10);
 55    for (i=0; i<64; i++) {
 56        s17.a[i] <== in[11*64+i];
 57    }
 58    // r[18] = a[17]<<15|a[17]>>(64-15)
 59    component s18 = step(15, 64-15);
 60    for (i=0; i<64; i++) {
 61        s18.a[i] <== in[17*64+i];
 62    }
 63    // r[3] = a[18]<<21|a[18]>>(64-21)
 64    component s3 = step(21, 64-21);
 65    for (i=0; i<64; i++) {
 66        s3.a[i] <== in[18*64+i];
 67    }
 68    // r[5] = a[3]<<28|a[3]>>(64-28)
 69    component s5 = step(28, 64-28);
 70    for (i=0; i<64; i++) {
 71        s5.a[i] <== in[3*64+i];
 72    }
 73    // r[16] = a[5]<<36|a[5]>>(64-36)
 74    component s16 = step(36, 64-36);
 75    for (i=0; i<64; i++) {
 76        s16.a[i] <== in[5*64+i];
 77    }
 78    // r[8] = a[16]<<45|a[16]>>(64-45)
 79    component s8 = step(45, 64-45);
 80    for (i=0; i<64; i++) {
 81        s8.a[i] <== in[16*64+i];
 82    }
 83    // r[21] = a[8]<<55|a[8]>>(64-55)
 84    component s21 = step(55, 64-55);
 85    for (i=0; i<64; i++) {
 86        s21.a[i] <== in[8*64+i];
 87    }
 88    // r[24] = a[21]<<2|a[21]>>(64-2)
 89    component s24 = step(2, 64-2);
 90    for (i=0; i<64; i++) {
 91        s24.a[i] <== in[21*64+i];
 92    }
 93    // r[4] = a[24]<<14|a[24]>>(64-14)
 94    component s4 = step(14, 64-14);
 95    for (i=0; i<64; i++) {
 96        s4.a[i] <== in[24*64+i];
 97    }
 98    // r[15] = a[4]<<27|a[4]>>(64-27)
 99    component s15 = step(27, 64-27);
100    for (i=0; i<64; i++) {
101        s15.a[i] <== in[4*64+i];
102    }
103    // r[23] = a[15]<<41|a[15]>>(64-41)
104    component s23 = step(41, 64-41);
105    for (i=0; i<64; i++) {
106        s23.a[i] <== in[15*64+i];
107    }
108    // r[19] = a[23]<<56|a[23]>>(64-56)
109    component s19 = step(56, 64-56);
110    for (i=0; i<64; i++) {
111        s19.a[i] <== in[23*64+i];
112    }
113    // r[13] = a[19]<<8|a[19]>>(64-8)
114    component s13 = step(8, 64-8);
115    for (i=0; i<64; i++) {
116        s13.a[i] <== in[19*64+i];
117    }
118    // r[12] = a[13]<<25|a[13]>>(64-25)
119    component s12 = step(25, 64-25);
120    for (i=0; i<64; i++) {
121        s12.a[i] <== in[13*64+i];
122    }
123    // r[2] = a[12]<<43|a[12]>>(64-43)
124    component s2 = step(43, 64-43);
125    for (i=0; i<64; i++) {
126        s2.a[i] <== in[12*64+i];
127    }
128    // r[20] = a[2]<<62|a[2]>>(64-62)
129    component s20 = step(62, 64-62);
130    for (i=0; i<64; i++) {
131        s20.a[i] <== in[2*64+i];
132    }
133    // r[14] = a[20]<<18|a[20]>>(64-18)
134    component s14 = step(18, 64-18);
135    for (i=0; i<64; i++) {
136        s14.a[i] <== in[20*64+i];
137    }
138    // r[22] = a[14]<<39|a[14]>>(64-39)
139    component s22 = step(39, 64-39);
140    for (i=0; i<64; i++) {
141        s22.a[i] <== in[14*64+i];
142    }
143    // r[9] = a[22]<<61|a[22]>>(64-61)
144    component s9 = step(61, 64-61);
145    for (i=0; i<64; i++) {
146        s9.a[i] <== in[22*64+i];
147    }
148    // r[6] = a[9]<<20|a[9]>>(64-20)
149    component s6 = step(20, 64-20);
150    for (i=0; i<64; i++) {
151        s6.a[i] <== in[9*64+i];
152    }
153    // r[1] = a[6]<<44|a[6]>>(64-44)
154    component s1 = step(44, 64-44);
155    for (i=0; i<64; i++) {
156        s1.a[i] <== in[6*64+i];
157    }
158
159    for (i=0; i<64; i++) {
160        out[10*64+i] <== s10.out[i];
161        out[7*64+i] <== s7.out[i];
162        out[11*64+i] <== s11.out[i];
163        out[17*64+i] <== s17.out[i];
164        out[18*64+i] <== s18.out[i];
165        out[3*64+i] <== s3.out[i];
166        out[5*64+i] <== s5.out[i];
167        out[16*64+i] <== s16.out[i];
168        out[8*64+i] <== s8.out[i];
169        out[21*64+i] <== s21.out[i];
170        out[24*64+i] <== s24.out[i];
171        out[4*64+i] <== s4.out[i];
172        out[15*64+i] <== s15.out[i];
173        out[23*64+i] <== s23.out[i];
174        out[19*64+i] <== s19.out[i];
175        out[13*64+i] <== s13.out[i];
176        out[12*64+i] <== s12.out[i];
177        out[2*64+i] <== s2.out[i];
178        out[20*64+i] <== s20.out[i];
179        out[14*64+i] <== s14.out[i];
180        out[22*64+i] <== s22.out[i];
181        out[9*64+i] <== s9.out[i];
182        out[6*64+i] <== s6.out[i];
183        out[1*64+i] <== s1.out[i];
184    }
185}