31 const auto sha256_OUT_D = in.get(C::sha256_d) + in.get(C::sha256_init_d);
32 const auto sha256_OUT_E = in.get(C::sha256_e) + in.get(C::sha256_init_e);
33 const auto sha256_OUT_F = in.get(C::sha256_f) + in.get(C::sha256_init_f);
34 const auto sha256_OUT_G = in.get(C::sha256_g) + in.get(C::sha256_init_g);
35 const auto sha256_OUT_H = in.get(C::sha256_h) + in.get(C::sha256_init_h);
36 const auto sha256_LATCH_CONDITION = in.get(C::sha256_latch) + in.get(C::precomputed_first_row);
40 auto tmp = in.get(C::sha256_perform_round) * (in.get(C::sha256_xor_sel) -
FF(2));
41 tmp *= scaling_factor;
42 std::get<0>(evals) +=
typename Accumulator::View(tmp);
46 auto tmp = in.get(C::sha256_and_sel);
47 tmp *= scaling_factor;
48 std::get<1>(evals) +=
typename Accumulator::View(tmp);
52 auto tmp = (in.get(C::sha256_perform_round) - (
FF(1) - sha256_LATCH_CONDITION) * sha256_SEL_NO_ERR);
53 tmp *= scaling_factor;
54 std::get<2>(evals) +=
typename Accumulator::View(tmp);
58 auto tmp = (in.get(C::sha256_start) * (in.get(C::sha256_rounds_remaining) - sha256_NUM_ROUNDS) +
59 in.get(C::sha256_perform_round) *
60 ((in.get(C::sha256_rounds_remaining) - in.get(C::sha256_rounds_remaining_shift)) -
FF(1)));
61 tmp *= scaling_factor;
62 std::get<3>(evals) +=
typename Accumulator::View(tmp);
66 auto tmp = sha256_SEL_NO_ERR *
67 (in.get(C::sha256_round_count) - (sha256_NUM_ROUNDS - in.get(C::sha256_rounds_remaining)));
68 tmp *= scaling_factor;
69 std::get<4>(evals) +=
typename Accumulator::View(tmp);
74 sha256_SEL_NO_ERR * ((in.get(C::sha256_rounds_remaining) *
75 (in.get(C::sha256_latch) * (
FF(1) - in.get(C::sha256_rounds_remaining_inv)) +
76 in.get(C::sha256_rounds_remaining_inv)) -
78 in.get(C::sha256_latch));
79 tmp *= scaling_factor;
80 std::get<5>(evals) +=
typename Accumulator::View(tmp);
84 auto tmp = sha256_SEL_NO_ERR * (in.get(C::sha256_two_pow_32) -
FF(4294967296UL));
85 tmp *= scaling_factor;
86 std::get<6>(evals) +=
typename Accumulator::View(tmp);
90 auto tmp = in.get(C::sha256_start) * (
FF(1) - in.get(C::sha256_err)) *
91 (in.get(C::sha256_a) - in.get(C::sha256_init_a));
92 tmp *= scaling_factor;
93 std::get<7>(evals) +=
typename Accumulator::View(tmp);
97 auto tmp = in.get(C::sha256_start) * (
FF(1) - in.get(C::sha256_err)) *
98 (in.get(C::sha256_b) - in.get(C::sha256_init_b));
99 tmp *= scaling_factor;
100 std::get<8>(evals) +=
typename Accumulator::View(tmp);
104 auto tmp = in.get(C::sha256_start) * (
FF(1) - in.get(C::sha256_err)) *
105 (in.get(C::sha256_c) - in.get(C::sha256_init_c));
106 tmp *= scaling_factor;
107 std::get<9>(evals) +=
typename Accumulator::View(tmp);
111 auto tmp = in.get(C::sha256_start) * (
FF(1) - in.get(C::sha256_err)) *
112 (in.get(C::sha256_d) - in.get(C::sha256_init_d));
113 tmp *= scaling_factor;
118 auto tmp = in.get(C::sha256_start) * (
FF(1) - in.get(C::sha256_err)) *
119 (in.get(C::sha256_e) - in.get(C::sha256_init_e));
120 tmp *= scaling_factor;
125 auto tmp = in.get(C::sha256_start) * (
FF(1) - in.get(C::sha256_err)) *
126 (in.get(C::sha256_f) - in.get(C::sha256_init_f));
127 tmp *= scaling_factor;
132 auto tmp = in.get(C::sha256_start) * (
FF(1) - in.get(C::sha256_err)) *
133 (in.get(C::sha256_g) - in.get(C::sha256_init_g));
134 tmp *= scaling_factor;
139 auto tmp = in.get(C::sha256_start) * (
FF(1) - in.get(C::sha256_err)) *
140 (in.get(C::sha256_h) - in.get(C::sha256_init_h));
141 tmp *= scaling_factor;
146 auto tmp = in.get(C::sha256_perform_round) * (in.get(C::sha256_helper_w0_shift) - in.get(C::sha256_helper_w1));
147 tmp *= scaling_factor;
152 auto tmp = in.get(C::sha256_perform_round) * (in.get(C::sha256_helper_w1_shift) - in.get(C::sha256_helper_w2));
153 tmp *= scaling_factor;
158 auto tmp = in.get(C::sha256_perform_round) * (in.get(C::sha256_helper_w2_shift) - in.get(C::sha256_helper_w3));
159 tmp *= scaling_factor;
164 auto tmp = in.get(C::sha256_perform_round) * (in.get(C::sha256_helper_w3_shift) - in.get(C::sha256_helper_w4));
165 tmp *= scaling_factor;
170 auto tmp = in.get(C::sha256_perform_round) * (in.get(C::sha256_helper_w4_shift) - in.get(C::sha256_helper_w5));
171 tmp *= scaling_factor;
176 auto tmp = in.get(C::sha256_perform_round) * (in.get(C::sha256_helper_w5_shift) - in.get(C::sha256_helper_w6));
177 tmp *= scaling_factor;
182 auto tmp = in.get(C::sha256_perform_round) * (in.get(C::sha256_helper_w6_shift) - in.get(C::sha256_helper_w7));
183 tmp *= scaling_factor;
188 auto tmp = in.get(C::sha256_perform_round) * (in.get(C::sha256_helper_w7_shift) - in.get(C::sha256_helper_w8));
189 tmp *= scaling_factor;
194 auto tmp = in.get(C::sha256_perform_round) * (in.get(C::sha256_helper_w8_shift) - in.get(C::sha256_helper_w9));
195 tmp *= scaling_factor;
200 auto tmp = in.get(C::sha256_perform_round) * (in.get(C::sha256_helper_w9_shift) - in.get(C::sha256_helper_w10));
201 tmp *= scaling_factor;
207 in.get(C::sha256_perform_round) * (in.get(C::sha256_helper_w10_shift) - in.get(C::sha256_helper_w11));
208 tmp *= scaling_factor;
214 in.get(C::sha256_perform_round) * (in.get(C::sha256_helper_w11_shift) - in.get(C::sha256_helper_w12));
215 tmp *= scaling_factor;
221 in.get(C::sha256_perform_round) * (in.get(C::sha256_helper_w12_shift) - in.get(C::sha256_helper_w13));
222 tmp *= scaling_factor;
228 in.get(C::sha256_perform_round) * (in.get(C::sha256_helper_w13_shift) - in.get(C::sha256_helper_w14));
229 tmp *= scaling_factor;
235 in.get(C::sha256_perform_round) * (in.get(C::sha256_helper_w14_shift) - in.get(C::sha256_helper_w15));
236 tmp *= scaling_factor;
241 auto tmp = in.get(C::sha256_perform_round) * (in.get(C::sha256_helper_w15_shift) - in.get(C::sha256_w));
242 tmp *= scaling_factor;
247 auto tmp = (in.get(C::sha256_sel_compute_w) -
248 in.get(C::sha256_perform_round) * (
FF(1) - in.get(C::sha256_sel_is_input_round)));
249 tmp *= scaling_factor;
254 auto tmp = in.get(C::sha256_sel_compute_w) *
255 ((in.get(C::sha256_computed_w_lhs) *
FF(4294967296UL) + in.get(C::sha256_computed_w_rhs)) -
257 tmp *= scaling_factor;
262 auto tmp = in.get(C::sha256_sel_compute_w) * (in.get(C::sha256_w) - in.get(C::sha256_computed_w_rhs));
263 tmp *= scaling_factor;
268 auto tmp = in.get(C::sha256_sel_compute_w) *
269 (in.get(C::sha256_helper_w1) - (in.get(C::sha256_lhs_w_7) *
FF(128) + in.get(C::sha256_rhs_w_7)));
270 tmp *= scaling_factor;
276 in.get(C::sha256_sel_compute_w) *
277 (in.get(C::sha256_w_15_rotr_7) - (in.get(C::sha256_rhs_w_7) *
FF(33554432) + in.get(C::sha256_lhs_w_7)));
278 tmp *= scaling_factor;
283 auto tmp = in.get(C::sha256_sel_compute_w) * (in.get(C::sha256_two_pow_7) -
FF(128));
284 tmp *= scaling_factor;
290 in.get(C::sha256_sel_compute_w) *
291 (in.get(C::sha256_helper_w1) - (in.get(C::sha256_lhs_w_18) *
FF(262144) + in.get(C::sha256_rhs_w_18)));
292 tmp *= scaling_factor;
298 in.get(C::sha256_sel_compute_w) *
299 (in.get(C::sha256_w_15_rotr_18) - (in.get(C::sha256_rhs_w_18) *
FF(16384) + in.get(C::sha256_lhs_w_18)));
300 tmp *= scaling_factor;
305 auto tmp = in.get(C::sha256_sel_compute_w) * (in.get(C::sha256_two_pow_18) -
FF(262144));
306 tmp *= scaling_factor;
311 auto tmp = in.get(C::sha256_sel_compute_w) *
312 (in.get(C::sha256_helper_w1) - (in.get(C::sha256_lhs_w_3) *
FF(8) + in.get(C::sha256_rhs_w_3)));
313 tmp *= scaling_factor;
318 auto tmp = in.get(C::sha256_sel_compute_w) * (in.get(C::sha256_w_15_rshift_3) - in.get(C::sha256_lhs_w_3));
319 tmp *= scaling_factor;
324 auto tmp = in.get(C::sha256_sel_compute_w) * (in.get(C::sha256_two_pow_3) -
FF(8));
325 tmp *= scaling_factor;
331 in.get(C::sha256_sel_compute_w) *
332 (in.get(C::sha256_helper_w14) - (in.get(C::sha256_lhs_w_17) *
FF(131072) + in.get(C::sha256_rhs_w_17)));
333 tmp *= scaling_factor;
339 in.get(C::sha256_sel_compute_w) *
340 (in.get(C::sha256_w_2_rotr_17) - (in.get(C::sha256_rhs_w_17) *
FF(32768) + in.get(C::sha256_lhs_w_17)));
341 tmp *= scaling_factor;
346 auto tmp = in.get(C::sha256_sel_compute_w) * (in.get(C::sha256_two_pow_17) -
FF(131072));
347 tmp *= scaling_factor;
353 in.get(C::sha256_sel_compute_w) *
354 (in.get(C::sha256_helper_w14) - (in.get(C::sha256_lhs_w_19) *
FF(524288) + in.get(C::sha256_rhs_w_19)));
355 tmp *= scaling_factor;
361 in.get(C::sha256_sel_compute_w) *
362 (in.get(C::sha256_w_2_rotr_19) - (in.get(C::sha256_rhs_w_19) *
FF(8192) + in.get(C::sha256_lhs_w_19)));
363 tmp *= scaling_factor;
368 auto tmp = in.get(C::sha256_sel_compute_w) * (in.get(C::sha256_two_pow_19) -
FF(524288));
369 tmp *= scaling_factor;
375 in.get(C::sha256_sel_compute_w) *
376 (in.get(C::sha256_helper_w14) - (in.get(C::sha256_lhs_w_10) *
FF(1024) + in.get(C::sha256_rhs_w_10)));
377 tmp *= scaling_factor;
382 auto tmp = in.get(C::sha256_sel_compute_w) * (in.get(C::sha256_w_2_rshift_10) - in.get(C::sha256_lhs_w_10));
383 tmp *= scaling_factor;
388 auto tmp = in.get(C::sha256_sel_compute_w) * (in.get(C::sha256_two_pow_10) -
FF(1024));
389 tmp *= scaling_factor;
394 auto tmp = in.get(C::sha256_perform_round) *
395 (in.get(C::sha256_e) - (in.get(C::sha256_lhs_e_6) *
FF(64) + in.get(C::sha256_rhs_e_6)));
396 tmp *= scaling_factor;
402 in.get(C::sha256_perform_round) *
403 (in.get(C::sha256_e_rotr_6) - (in.get(C::sha256_rhs_e_6) *
FF(67108864) + in.get(C::sha256_lhs_e_6)));
404 tmp *= scaling_factor;
409 auto tmp = in.get(C::sha256_perform_round) * (in.get(C::sha256_two_pow_6) -
FF(64));
410 tmp *= scaling_factor;
415 auto tmp = in.get(C::sha256_perform_round) *
416 (in.get(C::sha256_e) - (in.get(C::sha256_lhs_e_11) *
FF(2048) + in.get(C::sha256_rhs_e_11)));
417 tmp *= scaling_factor;
423 in.get(C::sha256_perform_round) *
424 (in.get(C::sha256_e_rotr_11) - (in.get(C::sha256_rhs_e_11) *
FF(2097152) + in.get(C::sha256_lhs_e_11)));
425 tmp *= scaling_factor;
430 auto tmp = in.get(C::sha256_perform_round) * (in.get(C::sha256_two_pow_11) -
FF(2048));
431 tmp *= scaling_factor;
436 auto tmp = in.get(C::sha256_perform_round) *
437 (in.get(C::sha256_e) - (in.get(C::sha256_lhs_e_25) *
FF(33554432) + in.get(C::sha256_rhs_e_25)));
438 tmp *= scaling_factor;
443 auto tmp = in.get(C::sha256_perform_round) *
444 (in.get(C::sha256_e_rotr_25) - (in.get(C::sha256_rhs_e_25) *
FF(128) + in.get(C::sha256_lhs_e_25)));
445 tmp *= scaling_factor;
450 auto tmp = in.get(C::sha256_perform_round) * (in.get(C::sha256_two_pow_25) -
FF(33554432));
451 tmp *= scaling_factor;
457 in.get(C::sha256_perform_round) * ((in.get(C::sha256_e) + in.get(C::sha256_not_e)) -
FF(4294967295UL));
458 tmp *= scaling_factor;
463 auto tmp = in.get(C::sha256_perform_round) *
464 (in.get(C::sha256_a) - (in.get(C::sha256_lhs_a_2) *
FF(4) + in.get(C::sha256_rhs_a_2)));
465 tmp *= scaling_factor;
471 in.get(C::sha256_perform_round) *
472 (in.get(C::sha256_a_rotr_2) - (in.get(C::sha256_rhs_a_2) *
FF(1073741824) + in.get(C::sha256_lhs_a_2)));
473 tmp *= scaling_factor;
478 auto tmp = in.get(C::sha256_perform_round) * (in.get(C::sha256_two_pow_2) -
FF(4));
479 tmp *= scaling_factor;
484 auto tmp = in.get(C::sha256_perform_round) *
485 (in.get(C::sha256_a) - (in.get(C::sha256_lhs_a_13) *
FF(8192) + in.get(C::sha256_rhs_a_13)));
486 tmp *= scaling_factor;
492 in.get(C::sha256_perform_round) *
493 (in.get(C::sha256_a_rotr_13) - (in.get(C::sha256_rhs_a_13) *
FF(524288) + in.get(C::sha256_lhs_a_13)));
494 tmp *= scaling_factor;
499 auto tmp = in.get(C::sha256_perform_round) * (in.get(C::sha256_two_pow_13) -
FF(8192));
500 tmp *= scaling_factor;
505 auto tmp = in.get(C::sha256_perform_round) *
506 (in.get(C::sha256_a) - (in.get(C::sha256_lhs_a_22) *
FF(4194304) + in.get(C::sha256_rhs_a_22)));
507 tmp *= scaling_factor;
512 auto tmp = in.get(C::sha256_perform_round) *
513 (in.get(C::sha256_a_rotr_22) - (in.get(C::sha256_rhs_a_22) *
FF(1024) + in.get(C::sha256_lhs_a_22)));
514 tmp *= scaling_factor;
519 auto tmp = in.get(C::sha256_perform_round) * (in.get(C::sha256_two_pow_22) -
FF(4194304));
520 tmp *= scaling_factor;
525 auto tmp = in.get(C::sha256_perform_round) *
526 ((in.get(C::sha256_next_a_lhs) *
FF(4294967296UL) + in.get(C::sha256_next_a_rhs)) - sha256_NEXT_A);
527 tmp *= scaling_factor;
532 auto tmp = in.get(C::sha256_perform_round) *
533 ((in.get(C::sha256_next_e_lhs) *
FF(4294967296UL) + in.get(C::sha256_next_e_rhs)) - sha256_NEXT_E);
534 tmp *= scaling_factor;
539 auto tmp = in.get(C::sha256_perform_round) * (in.get(C::sha256_a_shift) - in.get(C::sha256_next_a_rhs));
540 tmp *= scaling_factor;
545 auto tmp = in.get(C::sha256_perform_round) * (in.get(C::sha256_b_shift) - in.get(C::sha256_a));
546 tmp *= scaling_factor;
551 auto tmp = in.get(C::sha256_perform_round) * (in.get(C::sha256_c_shift) - in.get(C::sha256_b));
552 tmp *= scaling_factor;
557 auto tmp = in.get(C::sha256_perform_round) * (in.get(C::sha256_d_shift) - in.get(C::sha256_c));
558 tmp *= scaling_factor;
563 auto tmp = in.get(C::sha256_perform_round) * (in.get(C::sha256_e_shift) - in.get(C::sha256_next_e_rhs));
564 tmp *= scaling_factor;
569 auto tmp = in.get(C::sha256_perform_round) * (in.get(C::sha256_f_shift) - in.get(C::sha256_e));
570 tmp *= scaling_factor;
575 auto tmp = in.get(C::sha256_perform_round) * (in.get(C::sha256_g_shift) - in.get(C::sha256_f));
576 tmp *= scaling_factor;
581 auto tmp = in.get(C::sha256_perform_round) * (in.get(C::sha256_h_shift) - in.get(C::sha256_g));
582 tmp *= scaling_factor;
587 auto tmp = sha256_LAST * (sha256_OUT_A -
588 (in.get(C::sha256_output_a_lhs) *
FF(4294967296UL) + in.get(C::sha256_output_a_rhs)));
589 tmp *= scaling_factor;
594 auto tmp = sha256_LAST * (sha256_OUT_B -
595 (in.get(C::sha256_output_b_lhs) *
FF(4294967296UL) + in.get(C::sha256_output_b_rhs)));
596 tmp *= scaling_factor;
601 auto tmp = sha256_LAST * (sha256_OUT_C -
602 (in.get(C::sha256_output_c_lhs) *
FF(4294967296UL) + in.get(C::sha256_output_c_rhs)));
603 tmp *= scaling_factor;
608 auto tmp = sha256_LAST * (sha256_OUT_D -
609 (in.get(C::sha256_output_d_lhs) *
FF(4294967296UL) + in.get(C::sha256_output_d_rhs)));
610 tmp *= scaling_factor;
615 auto tmp = sha256_LAST * (sha256_OUT_E -
616 (in.get(C::sha256_output_e_lhs) *
FF(4294967296UL) + in.get(C::sha256_output_e_rhs)));
617 tmp *= scaling_factor;
622 auto tmp = sha256_LAST * (sha256_OUT_F -
623 (in.get(C::sha256_output_f_lhs) *
FF(4294967296UL) + in.get(C::sha256_output_f_rhs)));
624 tmp *= scaling_factor;
629 auto tmp = sha256_LAST * (sha256_OUT_G -
630 (in.get(C::sha256_output_g_lhs) *
FF(4294967296UL) + in.get(C::sha256_output_g_rhs)));
631 tmp *= scaling_factor;
636 auto tmp = sha256_LAST * (sha256_OUT_H -
637 (in.get(C::sha256_output_h_lhs) *
FF(4294967296UL) + in.get(C::sha256_output_h_rhs)));
638 tmp *= scaling_factor;