Dynamic SHA2

[mitschabaude]

closes #27

adds an implementation of sha2 for a dynamic-length byte string. this primitive will be necessary for a variety of credential signatures.

overhead compared to sha2 on static-sized inputs is about 8% (in case the max number of blocks is not bigger than the actual number). This seems pretty good and hard to improve, most of it comes from a single pass over the input message asserting that the out-of-bounds elements are all 0.

also adds general-purpose types for:

• dynamic-length arrays
• static-length arrays

Todo

• currently depends on a local version of o1js synced to Expose some types and gadgets o1-labs/o1js#1860, need to merge that and switch back to published o1js

Results

> node --experimental-strip-types src/attestations/dynamic-sha256.test.ts

dynamic {
  'Total rows': 40840,
  Generic: 14318,
  EndoMulScalar: 11762,
  Xor16: 9840,
  Zero: 4920
}
static {
  'Total rows': 37779,
  Generic: 11529,
  EndoMulScalar: 11562,
  Xor16: 9792,
  Zero: 4896
}

static # of bytes: 407
max dynamic # of bytes: 430
static # of blocks: 7
max dynamic # of blocks: 7
constraint overhead for dynamic: 8.10%