sha256 circuit

[Brechtpd]

Adds a sha256 circuit with the same lookup interface as the keccak circuit.

• Requires 72 rows/sha256 permutation (64 bytes absorbed per permutation)
• Uses ~130 columns
• Would be a bit faster when making the circuit x4 wider (and then of course also using x4 fewer rows)
• Current expression degree is 4, should be possible to lower this to 3 after the no-zk halo2 is usable
• Is around 4x faster than keccak for same length inputs (keccak absorbs ~2x the amount of data per permutation so sha256 needs ~2x the number of permutations to process a similar amount of data)

[str4d]

Ooh, nice! I would love to see this adapted to implement the Sha256Instructions trait from halo2_gadgets, as then circuit developers would have a very easy time switching between our 10-column chip and this ~130-column one.

[CPerezz]

Hey @Brechtpd I'm adding the challenge API to all three keccak implementations we currently have in #925. I hope this does not collide with that (Otherwise, I'll code it with features or an option or whatever).

Please, ping me to review it! Since reviewed the last 3 I guess I'd be a bit faster!

Thanks for working on this!!!! 😄

[Brechtpd]

I don't think there will be any conflict with the keccak implementations, and will update the code confirming to #925 if it's decided this implementation will be used for the sha256 precompile (or if useful regardless of that to e.g. compare between different implementations). :)

[CPerezz]

this implementation will be used for the sha256 precompile (or if useful regardless of that to e.g. compare between different implementations). :)

That's nice!! Thanks a lot!! I'd also consider the 4 options and stick to only 1 or 2. Otherwise we need to mantain a lot more code. WDYT?

[Brechtpd]

What do you mean 4 options? I think for sha256 there's only like 2 I guess (this one or the halo2 one). Or are you talking about keccak?

[CPerezz]

What do you mean 4 options? I think for sha256 there's only like 2 I guess (this one or the halo2 one). Or are you talking about keccak?

Indeed mate.. My brain classified SHA256 and keccak as the same thing xD

Apologies, we already discussed the 3 different keccak implementations privately. 🙏