译自 halo2 book:https://zcash.github.io/halo2/design/gadgets/sha256/table16.html

用于 SHA-256 的 16 比特表芯片(table chip)

这个芯片(chip)实现围绕单张 16 比特查表表(lookup table)构建。它至少需要 $2^{16}$ 个电路行(circuit rows),因此适合用在较大的电路中。

我们的目标是最大约束次数(constraint degree)为 $9$ 。这将允许我们在一行内处理对进位(carries)以及"小片(small pieces)"约束到 ${0..7}$ 范围内的约束。

轮压缩(Compression round)

共有 $64$ 轮压缩(compression rounds)。每一轮以 32 比特值 $A, B, C, D, E, F, G, H$ 作为输入,并执行以下运算:

$C h (E, F, G) M aj (A, B, C) Σ_{0} (A) Σ_{1} (E) H^{'} E_{n e w} A_{n e w} = = = = = = = = (E \land F) \oplus (\neg E \land G) (A \land B) \oplus (A \land C) \oplus (B \land C) co u n t (A, B, C) \geq 2 (A ⋙ 2) \oplus (A ⋙ 13) \oplus (A ⋙ 22) (E ⋙ 6) \oplus (E ⋙ 11) \oplus (E ⋙ 25) H + C h (E, F, G) + Σ_{1} (E) + K_{t} + W_{t} re d u c e_{6} (H^{'} + D) re d u c e_{7} (H^{'} + M aj (A, B, C) + Σ_{0} (A))$

其中 $re d u c e_{i}$ 必须处理一个满足 $0 \leq carry < i$ 的进位(carry)。

The SHA-256 compression function

把 $spread$ 定义为一张表,它把一个 $16$ 比特的输入映射到一个用零比特交错(interleaved)的输出。我们不需要为范围检查(range checks)单独建表,因为可以使用 $spread$ 。

模加法(Modular addition)

为实现模 $2^{32}$ 加法,我们注意到这等价于用域加法(field addition)把操作数相加,然后把结果除最低 32 比特之外的全部比特都掩掉(mask away)。例如,若我们有两个操作数 $a$ 和 $b$ :

$a ⊞ b = c,$

我们把每个操作数(连同结果)分解(decompose)成 16 比特的小块(chunks):

$(a_{L} : Z_{2^{16}}, a_{H} : Z_{2^{16}}) ⊞ (b_{L} : Z_{2^{16}}, b_{H} : Z_{2^{16}}) = (c_{L} : Z_{2^{16}}, c_{H} : Z_{2^{16}}),$

然后用域加法重新表述该约束:

$carry \cdot 2^{32} + c_{H} \cdot 2^{16} + c_{L} = (a_{H} + b_{H}) \cdot 2^{16} + a_{L} + b_{L} .$

更一般地,输出的任意比特分解(bit-decomposition)都可以使用,而不仅限于分解成 16 比特小块。注意这正确地处理了来自 $a_{L} + b_{L}$ 的进位。

这个约束要求每个小块都被正确地范围检查(否则一次赋值可能溢出该域(overflow the field))。

操作数小块和结果小块可以用 $spread$ 来约束,办法是在表的某个子集中,在"密集(dense)"列里对每个小块查表。这样我们还能免费得到输出的"展开(spread)"形式;特别地,对于右下角那个 $⊞$ 的输出(它会成为 $A_{n e w}$ ),以及最左边那个 $⊞$ 的输出(它会成为 $E_{n e w}$ ),都是如此。我们将在下文用这一点来优化 $M aj$ 和 $C h$ 。
$carry$ 必须被约束到与操作数个数相对应的、允许的进位值的精确范围内。我们用一个小范围约束(small range constraint)来做这件事。

Maj 函数

$M aj$ 可以用 $4$ 次查表完成: $2 spread * 2$ 个小块

如上所述,第一轮之后我们已经拥有展开形式的 $A$ ,即 $A^{'}$ 。类似地, $B$ 和 $C$ 分别等于上一轮的 $A$ 和 $B$ , 因此在稳态(steady state)下,我们已经拥有它们的展开形式 $B^{'}$ 和 $C^{'}$ 。事实上我们也可以假定在第一轮就拥有它们的展开形式,要么来自固定的 IV,要么来自用 $spread$ 去归约(reduce)上一块前馈(feedforward)的输出。
把这些展开形式在域中相加: $M^{'} = A^{'} + B^{'} + C^{'}$ ;
- 我们可以把它们当作 $32$ 比特字相加,也可以分片相加;两者等价。
见证(witness)压缩偶数比特 $M_{i}^{e v e n}$ 和压缩奇数比特 $M_{i}^{o dd}$ , $i = {0..1}$ ;
约束 $M^{'} = spread (M_{0}^{e v e n}) + 2 \cdot spread (M_{0}^{o dd}) + 2^{32} \cdot spread (M_{1}^{e v e n}) + 2^{33} \cdot spread (M_{1}^{o dd})$ ,其中 $M_{i}^{o dd}$ 是 $M aj$ 函数的输出。

注:我们所说的"偶数(even)"比特指的是权重为 $2$ 的偶数次幂的比特,即权重为 $2^{0}, 2^{2}, \dots$ 的比特。类似地,"奇数(odd)"比特指的是权重为 $2$ 的奇数次幂的比特。

Ch 函数

TODO:借助一张额外的表,可能可以优化到 $4$ 或 $5$ 次查表。

$C h$ 可以用 $8$ 次查表完成: $4 spread * 2$ 个小块

如上所述,第一轮之后我们已经拥有展开形式的 $E$ ,即 $E^{'}$ 。类似地, $F$ 和 $G$ 分别等于上一轮的 $E$ 和 $F$ , 因此在稳态下,我们已经拥有它们的展开形式 $F^{'}$ 和 $G^{'}$ 。事实上我们也可以假定在第一轮就拥有它们的展开形式,要么来自固定的 IV,要么来自用 $spread$ 去归约上一块前馈的输出。
计算 $P^{'} = E^{'} + F^{'}$ 和 $Q^{'} = (e v e n s - E^{'}) + G^{'}$ ,其中 $e v e n s = spread (2^{32} - 1)$ 。
- 我们可以把它们当作 $32$ 比特字相加,也可以分片相加;两者等价。
- $e v e n s - E^{'}$ 之所以能算出 $\neg E$ 的展开形式,尽管取反(negation)与 $spread$ 一般并不交换(commute)。它之所以有效,是因为 $E^{'}$ 中的每个展开比特都从 $1$ 中减去,所以不会发生借位(borrows)。
见证 $P_{i}^{e v e n}, P_{i}^{o dd}, Q_{i}^{e v e n}, Q_{i}^{o dd}$ ,使得 $P^{'} = spread (P_{0}^{e v e n}) + 2 \cdot spread (P_{0}^{o dd}) + 2^{32} \cdot spread (P_{1}^{e v e n}) + 2^{33} \cdot spread (P_{1}^{o dd})$ ,对 $Q^{'}$ 同理。
${P_{i}^{o dd} + Q_{i}^{o dd}}_{i = 0..1}$ 就是 $C h$ 函数的输出。

Σ_0 函数

$Σ_{0} (A)$ 可以用 $6$ 次查表完成。

为此,我们首先把 $A$ 切分成片 $(a, b, c, d)$ ,长度分别为 $(2, 11, 9, 10)$ 比特,从低端(little end)开始计数。同时我们得到这些片的展开形式。这一切都可以在两个 PLONK 行内完成,因为 $10$ 比特和 $11$ 比特的片可以用 $spread$ 查表来处理,而 $9$ 比特的片可以切分成 $3 * 3$ 比特的子片(subpieces)。后者和剩下的 $2$ 比特片可以与这两次查表并行地用多项式约束(polynomial constraints)做范围检查,每行做两个小片。这些小片的展开形式通过插值(interpolation)求得。

注意,把它切分成片这件事可以与 $A_{n e w}$ 的归约(reduction)合并,即后者不需要额外的查表。在最后一轮中,我们在加上前馈之后再归约 $A_{n e w}$ (需要处理一个至多为 $7$ 的进位,这没问题)。

$(A ⋙ 2) \oplus (A ⋙ 13) \oplus (A ⋙ 22)$ 等价于 $(A ⋙ 2) \oplus (A ⋙ 13) \oplus (A ⋘ 10)$ :

然后,再用 $4$ 次 $spread$ 查表,我们把结果作为这些片的某个线性组合(linear combination)的偶数比特而得到:

$R^{'} = (a (b (c 4^{30} a 4^{21} b 4^{23} c ∣∣ ∣∣ ∣∣ + + + d a b 4^{20} d 4^{19} a 4^{12} b ∣∣ ∣∣ ∣∣ ⇓ + + + c d a 4^{11} c 4^{9} d 4^{10} a ∣∣ ∣∣ ∣∣ + + + b) c) d) b c d \oplus \oplus + +$

也就是说,我们见证压缩偶数比特 $R_{i}^{e v e n}$ 和压缩奇数比特 $R_{i}^{o dd}$ ,并约束 $R^{'} = spread (R_{0}^{e v e n}) + 2 \cdot spread (R_{0}^{o dd}) + 2^{32} \cdot spread (R_{1}^{e v e n}) + 2^{33} \cdot spread (R_{1}^{o dd})$ 其中 ${R_{i}^{e v e n}}_{i = 0..1}$ 是 $Σ_{0}$ 函数的输出。

Σ_1 函数

$Σ_{1} (E)$ 可以用 $6$ 次查表完成。

为此,我们首先把 $E$ 切分成片 $(a, b, c, d)$ ,长度分别为 $(6, 5, 14, 7)$ 比特,从低端开始计数。同时我们得到这些片的展开形式。这一切都可以在两个 PLONK 行内完成,因为 $7$ 比特和 $14$ 比特的片可以用 $spread$ 查表来处理, $5$ 比特的片可以切分成 $3$ 比特和 $2$ 比特的子片,而 $6$ 比特的片可以切分成 $2 * 3$ 比特的子片。这四个小片可以与这两次查表并行地用多项式约束做范围检查,每行做两个小片。这些小片的展开形式通过插值求得。

注意,把它切分成片这件事可以与 $E_{n e w}$ 的归约合并,即后者不需要额外的查表。在最后一轮中,我们在加上前馈之后再归约 $E_{n e w}$ (需要处理一个至多为 $6$ 的进位,这没问题)。

$(E ⋙ 6) \oplus (E ⋙ 11) \oplus (E ⋙ 25)$ 等价于 $(E ⋙ 6) \oplus (E ⋙ 11) \oplus (E ⋘ 7)$ 。

然后,再用 $4$ 次 $spread$ 查表,我们以与 $Σ_{0}$ 相同的方式,把结果作为这些片的某个线性组合的偶数比特而得到:

$R^{'} = (a (b (c 4^{26} a 4^{27} b 4^{18} c ∣∣ ∣∣ ∣∣ + + + d a b 4^{19} d 4^{21} a 4^{13} b ∣∣ ∣∣ ∣∣ ⇓ + + + c d a 4^{5} c 4^{14} d 4^{7} a ∣∣ ∣∣ ∣∣ + + + b) c) d) b c d \oplus \oplus + +$

块分解(Block decomposition)

对于已填充消息(padded message)的每一个块 $M \in {0, 1}^{512}$ ,要构造 $64$ 个各 $32$ 比特的字 ,方法如下:

前 $16$ 个通过把 $M$ 切分成 $32$ 比特的块来得到 $M = W_{0} ∣∣ W_{1} ∣∣ \dots ∣∣ W_{14} ∣∣ W_{15};$
其余 $48$ 个字用以下公式构造: $W_{i} = σ_{1} (W_{i - 2}) ⊞ W_{i - 7} ⊞ σ_{0} (W_{i - 15}) ⊞ W_{i - 16},$ 对 $16 \leq i < 64$ 。

注: $W$ 字的下标采用从 $0$ 开始的编号。

$σ_{0} (X) σ_{1} (X) = = (X ⋙ 7) \oplus (X ⋙ 18) \oplus (X ≫ 3) (X ⋙ 17) \oplus (X ⋙ 19) \oplus (X ≫ 10)$

注: $≫$ 是右移位(shift),不是旋转(rotation)。

σ_0 函数

$(X ⋙ 7) \oplus (X ⋙ 18) \oplus (X ≫ 3)$ 等价于 $(X ⋙ 7) \oplus (X ⋘ 14) \oplus (X ≫ 3)$ 。

与上面类似,但片 $(a, b, c, d)$ 的长度为 $(3, 4, 11, 14)$ ,从低端开始计数。把 $b$ 切分成两个 $2$ 比特子片。

$R^{'} = (0^{[3]} (b (c 4^{28} b 4^{21} c ∣∣ ∣∣ ∣∣ + + d a b 4^{15} d 4^{25} a 4^{17} b ∣∣ ∣∣ ∣∣ ⇓ + + + c d a 4^{4} c 4^{11} d 4^{14} a ∣∣ ∣∣ ∣∣ + + + b) c) d) b c d \oplus \oplus + +$

σ_1 函数

$(X ⋙ 17) \oplus (X ⋙ 19) \oplus (X ≫ 10)$ 等价于 $(X ⋘ 15) \oplus (X ⋘ 13) \oplus (X ≫ 10)$ 。

TODO:这张图与右侧的表达式不符。这里只是为了与其他图保持一致。

与上面类似,但片 $(a, b, c, d)$ 的长度为 $(10, 7, 2, 13)$ ,从低端开始计数。把 $b$ 切分成 $(3, 2, 2)$ 比特子片。

$R^{'} = (0^{[10]} (b (c 4^{25} b 4^{30} c ∣∣ ∣∣ ∣∣ + + d a b 4^{9} d 4^{15} a 4^{23} b ∣∣ ∣∣ ∣∣ ⇓ + + + c d a 4^{7} c 4^{2} d 4^{13} a ∣∣ ∣∣ ∣∣ + + + b) c) d) b c d \oplus \oplus + +$

消息调度(Message scheduling)

我们对 $W_{1..48}$ 应用 $σ_{0}$ ,对 $W_{14..61}$ 应用 $σ_{1}$ 。为了避免对 $spread$ 的冗余应用,在 $W_{14..48}$ 的情形下,我们可以把 $σ_{0}$ 和 $σ_{1}$ 的切片合并。把片长度 $(3, 4, 11, 14)$ 和 $(10, 7, 2, 13)$ 合并后,得到长度为 $(3, 4, 3, 7, 1, 1, 13)$ 的片。

如果我们能用 $3$ 行完成这个合并的切分(而不是分别为 $σ_{0}$ 和 $σ_{1}$ 切分时总共需要的 $4$ 行),我们就节省了 $35$ 行。

这些甚至或许能用 $2$ 行做到;不确定。 ——Daira

当 $W_{16..61}$ 被用于计算后续的字时,我们可以把它们的模 $2^{32}$ 归约合并进它们的切分中,类似于我们对轮函数中的 $A$ 和 $E$ 所做的。

我们仍然需要归约 $W_{62..63}$ ,因为它们没有被切分。(从技术上讲我们可以让它们保持未归约,因为稍后用它们来计算 $A_{n e w}$ 和 $E_{n e w}$ 时它们会被归约——但那会需要处理一个至多为 $10$ 而不是 $6$ 的进位,所以不值得为此增加复杂度。)

由此得到的消息调度代价为:

$2$ 行用于把 $W_{0}$ 约束为 $32$ 比特
- 这从技术上讲是可选的,但为了健壮性我们还是这么做,因为输入的其余部分是免费被约束的。
$13 * 2$ 行用于把 $W_{1..13}$ 切分成 $(3, 4, 11, 14)$ 比特的片
$35 * 3$ 行用于把 $W_{14..48}$ 切分成 $(3, 4, 3, 7, 1, 1, 13)$ 比特的片(对 $W_{16..48}$ 合并了一次归约)
$13 * 2$ 行用于把 $W_{49..61}$ 切分成 $(10, 7, 2, 13)$ 比特的片(合并了一次归约)
$4 * 48$ 行用于提取 $W_{1..48}$ 的 $σ_{0}$ 结果
$4 * 48$ 行用于提取 $W_{14..61}$ 的 $σ_{1}$ 结果
$2 * 2$ 行用于归约 $W_{62..63}$
$= 547$ 行。

总体代价(Overall cost)

对每一轮:

$8$ 行用于 $C h$
$4$ 行用于 $M aj$
$6$ 行用于 $Σ_{0}$
$6$ 行用于 $Σ_{1}$
$re d u c e_{6}$ 和 $re d u c e_{7}$ 始终是免费的
$=$ 每轮 $24$

这给整个"步骤 3"带来 $24 * 64 = 1792$ 行,在此之上我们还需加上:

$547$ 行用于消息调度
$2 * 8$ 行用于"步骤 4"中 $8$ 次模 $2^{32}$ 归约

总计 $2099$ 行。

表(Tables)

我们只需要一张表 $spread$ ,它有 $2^{16}$ 行和 $3$ 列。我们需要一个标签(tag)列,以便为 $Σ_{0..1}$ 和 $σ_{0..1}$ 选取表的 $(7, 10, 11, 13, 14)$ 比特子集。

`spread` 表

row	tag	table (16b)	spread (32b)
$0$	0	0000000000000000	00000000000000000000000000000000
$1$	0	0000000000000001	00000000000000000000000000000001
$2$	0	0000000000000010	00000000000000000000000000000100
$3$	0	0000000000000011	00000000000000000000000000000101
...	0	...	...
$2^{7} - 1$	0	0000000001111111	00000000000000000001010101010101
$2^{7}$	1	0000000010000000	00000000000000000100000000000000
...	1	...	...
$2^{10} - 1$	1	0000001111111111	00000000000001010101010101010101
...	2	...	...
$2^{11} - 1$	2	0000011111111111	00000000010101010101010101010101
...	3	...	...
$2^{13} - 1$	3	0001111111111111	00000001010101010101010101010101
...	4	...	...
$2^{14} - 1$	4	0011111111111111	00000101010101010101010101010101
...	5	...	...
$2^{16} - 1$	5	1111111111111111	01010101010101010101010101010101

例如,要做一次 $11$ 比特的 $spread$ 查表,我们用多项式约束把标签约束到 ${0, 1, 2}$ 内。对于最常见的 $16$ 比特查表的情形,我们不需要约束标签。注意我们可以用一个重复条目(例如全零)来填充超出 $2^{16}$ 的任何未用行。

门(Gates)

选择门(Choice gate)

来自先前运算的输入:

$E^{'}, F^{'}, G^{'},$ 即 32 比特字 $E, F, G$ 的 64 比特展开形式,假定已被先前运算所约束
- 在实践中,把 $E^{'}, F^{'}, G^{'}$ 分解成 16 比特子片之后,我们才会有它们的展开形式
$e v e n s$ 定义为 $spread (2^{32} - 1)$
- $e v e n s_{0} = e v e n s_{1} = spread (2^{16} - 1)$

E ∧ F

s_ch	$a_{0}$	$a_{1}$	$a_{2}$	$a_{3}$	$a_{4}$
0	{0,1,2,3,4,5}	$P_{0}^{e v e n}$	$spread (P_{0}^{e v e n})$	$spread (E^{l o})$	$spread (E^{hi})$
1	{0,1,2,3,4,5}	$P_{0}^{o dd}$	$spread (P_{0}^{o dd})$	$spread (P_{1}^{o dd})$
0	{0,1,2,3,4,5}	$P_{1}^{e v e n}$	$spread (P_{1}^{e v e n})$	$spread (F^{l o})$	$spread (F^{hi})$
0	{0,1,2,3,4,5}	$P_{1}^{o dd}$	$spread (P_{1}^{o dd})$

¬E ∧ G

s_ch_neg	$a_{0}$	$a_{1}$	$a_{2}$	$a_{3}$	$a_{4}$	$a_{5}$
0	{0,1,2,3,4,5}	$Q_{0}^{e v e n}$	$spread (Q_{0}^{e v e n})$	$spread (E_{n e g}^{l o})$	$spread (E_{n e g}^{hi})$	$spread (E^{l o})$
1	{0,1,2,3,4,5}	$Q_{0}^{o dd}$	$spread (Q_{0}^{o dd})$	$spread (Q_{1}^{o dd})$		$spread (E^{hi})$
0	{0,1,2,3,4,5}	$Q_{1}^{e v e n}$	$spread (Q_{1}^{e v e n})$	$spread (G^{l o})$	$spread (G^{hi})$
0	{0,1,2,3,4,5}	$Q_{1}^{o dd}$	$spread (Q_{1}^{o dd})$

约束:

s_ch(选择,choice): $L H S - R H S = 0$
- $L H S = a_{3} ω^{- 1} + a_{3} ω + 2^{32} (a_{4} ω^{- 1} + a_{4} ω)$
- $R H S = a_{2} ω^{- 1} + 2 * a_{2} + 2^{32} (a_{2} ω + 2 * a_{3})$
s_ch_neg(取反,negation):带一个额外取反检查的 s_ch
对 $(a_{0}, a_{1}, a_{2})$ 做 $spread$ 查表
$(a_{2}, a_{3})$ 之间的置换(permutation)

输出: $C h (E, F, G) = P^{o dd} + Q^{o dd} = (P_{0}^{o dd} + Q_{0}^{o dd}) + 2^{16} (P_{1}^{o dd} + Q_{1}^{o dd})$

多数门(Majority gate)

来自先前运算的输入:

$A^{'}, B^{'}, C^{'},$ 即 32 比特字 $A, B, C$ 的 64 比特展开形式,假定已被先前运算所约束
- 在实践中,把 $A^{'}, B^{'}, C^{'}$ 分解成 $16$ 比特子片之后,我们才会有它们的展开形式

s_maj	$a_{0}$	$a_{1}$	$a_{2}$	$a_{3}$	$a_{4}$	$a_{5}$
0	{0,1,2,3,4,5}	$M_{0}^{e v e n}$	$spread (M_{0}^{e v e n})$		$spread (A^{l o})$	$spread (A^{hi})$
1	{0,1,2,3,4,5}	$M_{0}^{o dd}$	$spread (M_{0}^{o dd})$	$spread (M_{1}^{o dd})$	$spread (B^{l o})$	$spread (B^{hi})$
0	{0,1,2,3,4,5}	$M_{1}^{e v e n}$	$spread (M_{1}^{e v e n})$		$spread (C^{l o})$	$spread (C^{hi})$
0	{0,1,2,3,4,5}	$M_{1}^{o dd}$	$spread (M_{1}^{o dd})$

约束:

s_maj(多数,majority): $L H S - R H S = 0$
- $L H S = spread (M_{0}^{e v e n}) + 2 \cdot spread (M_{0}^{o dd}) + 2^{32} \cdot spread (M_{1}^{e v e n}) + 2^{33} \cdot spread (M_{1}^{o dd})$
- $R H S = A^{'} + B^{'} + C^{'}$
对 $(a_{0}, a_{1}, a_{2})$ 做 $spread$ 查表
$(a_{2}, a_{3})$ 之间的置换

输出: $M aj (A, B, C) = M^{o dd} = M_{0}^{o dd} + 2^{16} M_{1}^{o dd}$

Σ_0 门

$A$ 是一个 32 比特字,被切分成 $(2, 11, 9, 10)$ 比特的小块,从低端开始。我们分别把这些小块称为 $(a (2), b (11), c (9), d (10))$ ,并进一步把 $c (9)$ 切分成三个 3 比特小块 $c (9)^{l o}, c (9)^{mi d}, c (9)^{hi}$ 。我们见证这些小块的展开版本。

$Σ_{0} (A) = = (A ⋙ 2) \oplus (A ⋙ 13) \oplus (A ⋙ 22) (A ⋙ 2) \oplus (A ⋙ 13) \oplus (A ⋘ 10)$

s_upp_sigma_0	$a_{0}$	$a_{1}$	$a_{2}$	$a_{3}$	$a_{4}$	$a_{5}$	$a_{6}$
0	{0,1,2,3,4,5}	$R_{0}^{e v e n}$	$spread (R_{0}^{e v e n})$	$c (9)^{l o}$	$spread (c (9)^{l o})$	$c (9)^{mi d}$	$spread (c (9)^{mi d})$
1	{0,1,2,3,4,5}	$R_{0}^{o dd}$	$spread (R_{0}^{o dd})$	$spread (R_{1}^{o dd})$	$spread (d (10))$	$spread (b (11))$	$c (9)$
0	{0,1,2,3,4,5}	$R_{1}^{e v e n}$	$spread (R_{1}^{e v e n})$	$a (2)$	$spread (a (2))$	$c (9)^{hi}$	$spread (c (9)^{hi})$
0	{0,1,2,3,4,5}	$R_{1}^{o dd}$	$spread (R_{1}^{o dd})$

约束:

s_upp_sigma_0( $Σ_{0}$ 约束): $L H S - R H S + t a g + d eco m p ose = 0$

$t a g d eco m p ose L H S = = = co n s t r ai n_{1} (a_{0} ω^{- 1}) + co n s t r ai n_{2} (a_{0} ω) a (2) + 2^{2} b (11) + 2^{13} c (9)^{l o} + 2^{16} c (9)^{mi d} + 2^{19} c (9)^{hi} + 2^{22} d (10) - A spread (R_{0}^{e v e n}) + 2 \cdot spread (R_{0}^{o dd}) + 2^{32} \cdot spread (R_{1}^{e v e n}) + 2^{33} \cdot spread (R_{1}^{o dd})$ $R H S = 4^{30} spread (a (2)) 4^{21} spread (b (11)) 4^{29} spread (c (9)^{hi}) + + + 4^{20} spread (d (10)) 4^{19} spread (a (2)) 4^{26} spread (c (9)^{mi d}) + + + 4^{17} spread (c (9)^{hi}) 4^{9} spread (d (10)) 4^{23} spread (c (9)^{l o}) + + + 4^{14} spread (c (9)^{mi d}) 4^{6} spread (c (9)^{hi}) 4^{12} spread (b (11)) + + + 4^{11} spread (c (9)^{l o}) 4^{3} spread (c (9)^{mi d}) 4^{10} spread (a (2)) + + + spread (b (11)) spread (c (9)^{l o}) spread (d (10)) + +$

对 $a_{0}, a_{1}, a_{2}$ 做 $spread$ 查表
对 $a (2)$ 做 2 比特范围检查和 2 比特展开检查
对 $c (9)^{l o}, c (9)^{mi d}, c (9)^{hi}$ 做 3 比特范围检查和 3 比特展开检查

(参见辅助门(Helper gates)一节)

输出: $Σ_{0} (A) = R^{e v e n} = R_{0}^{e v e n} + 2^{16} R_{1}^{e v e n}$

Σ_1 门

$E$ 是一个 32 比特字,被切分成 $(6, 5, 14, 7)$ 比特的小块,从低端开始。我们分别把这些小块称为 $(a (6), b (5), c (14), d (7))$ ,并进一步把 $a (6)$ 切分成两个 3 比特小块 $a (6)^{l o}, a (6)^{hi}$ ,把 $b$ 切分成 (2,3) 比特小块 $b (5)^{l o}, b (5)^{hi}$ 。我们见证这些小块的展开版本。

$Σ_{1} (E) = = (E ⋙ 6) \oplus (E ⋙ 11) \oplus (E ⋙ 25) (E ⋙ 6) \oplus (E ⋙ 11) \oplus (E ⋘ 7)$

s_upp_sigma_1	$a_{0}$	$a_{1}$	$a_{2}$	$a_{3}$	$a_{4}$	$a_{5}$	$a_{6}$	$a_{7}$
0	{0,1,2,3,4,5}	$R_{0}^{e v e n}$	$spread (R_{0}^{e v e n})$	$b (5)^{l o}$	$spread (b (5)^{l o})$	$b (5)^{hi}$	$spread (b (5)^{hi})$	$b (5)$
1	{0,1,2,3,4,5}	$R_{0}^{o dd}$	$spread (R_{0}^{o dd})$	$spread (R_{1}^{o dd})$	$spread (d (7))$	$spread (c (14))$
0	{0,1,2,3,4,5}	$R_{1}^{e v e n}$	$spread (R_{1}^{e v e n})$	$a (6)^{l o}$	$spread (a (6)^{l o})$	$a (6)^{hi}$	$spread (a (6)^{hi})$	$a (6)$
0	{0,1,2,3,4,5}	$R_{1}^{o dd}$	$spread (R_{1}^{o dd})$

约束:

s_upp_sigma_1( $Σ_{1}$ 约束): $L H S - R H S + t a g + d eco m p ose = 0$

$t a g d eco m p ose L H S = = = a_{0} ω^{- 1} + co n s t r ai n_{4} (a_{0} ω) a (6)^{l o} + 2^{3} a (6)^{hi} + 2^{6} b (5)^{l o} + 2^{8} b (5)^{hi} + 2^{11} c (14) + 2^{25} d (7) - E spread (R_{0}^{e v e n}) + 2 \cdot spread (R_{0}^{o dd}) + 2^{32} \cdot spread (R_{1}^{e v e n}) + 2^{33} \cdot spread (R_{1}^{o dd})$ $R H S = 4^{29} spread (a (6)^{hi}) 4^{29} spread (b (5)^{hi}) 4^{18} spread (c (14)) + + + 4^{26} spread (a (6)^{l o}) 4^{27} spread (b (5)^{l o}) 4^{15} spread (b (5)^{hi}) + + + 4^{19} spread (d (7)) 4^{24} spread (a (6)^{hi}) 4^{13} spread (b (5)^{l o}) + + + 4^{5} spread (c (14)) 4^{21} spread (a (6)^{l o}) 4^{10} spread (a (6)^{hi}) + + + 4^{2} spread (b (5)^{hi}) 4^{14} spread (d (7)) 4^{7} spread (a (6)^{l o}) + + + spread (b (5)^{l o}) spread (c (14)) spread (d (7)) + +$

对 $a_{0}, a_{1}, a_{2}$ 做 $spread$ 查表
对 $b (5)^{l o}$ 做 2 比特范围检查和 2 比特展开检查
对 $a (6)^{l o}, a (6)^{hi}, b (4)^{hi}$ 做 3 比特范围检查和 3 比特展开检查

(参见辅助门(Helper gates)一节)

输出: $Σ_{1} (E) = R^{e v e n} = R_{0}^{e v e n} + 2^{16} R_{1}^{e v e n}$

σ_0 门

v1

$σ_{0}$ 门的 v1 版本接收一个被切分成 $(3, 4, 11, 14)$ 比特小块的字(已由消息调度约束)。我们分别把这些小块称为 $(a (3), b (4), c (11), d (14)) .$ $b (4)$ 被进一步切分成两个 2 比特小块 $b (4)^{l o}, b (4)^{hi} .$ 我们见证这些小块的展开版本。我们已经从消息调度得到了 $spread (c (11))$ 和 $spread (d (14))$ 。

$(X ⋙ 7) \oplus (X ⋙ 18) \oplus (X ≫ 3)$ 等价于 $(X ⋙ 7) \oplus (X ⋘ 14) \oplus (X ≫ 3)$ 。

s_low_sigma_0	$a_{0}$	$a_{1}$	$a_{2}$	$a_{3}$	$a_{4}$	$a_{5}$	$a_{6}$
0	{0,1,2,3,4,5}	$R_{0}^{e v e n}$	$spread (R_{0}^{e v e n})$	$b (4)^{l o}$	$spread (b (4)^{l o})$	$b (4)^{hi}$	$spread (b (4)^{hi})$
1	{0,1,2,3,4,5}	$R_{0}^{o dd}$	$spread (R_{0}^{o dd})$	$spread (R_{1}^{o dd})$	$spread (c)$	$spread (d)$	$b (4)$
0	{0,1,2,3,4,5}	$R_{1}^{e v e n}$	$spread (R_{1}^{e v e n})$	$0$	$0$	$a$	$spread (a)$
0	{0,1,2,3,4,5}	$R_{1}^{o dd}$	$spread (R_{1}^{o dd})$

约束:

s_low_sigma_0( $σ_{0}$ v1 约束): $L H S - R H S = 0$

$L H S = spread (R_{0}^{e v e n}) + 2 \cdot spread (R_{0}^{o dd}) + 2^{32} \cdot spread (R_{1}^{e v e n}) + 2^{33} \cdot spread (R_{1}^{o dd})$ $R H S = 4^{30} b (4)^{hi} 4^{21} c (11) + + 4^{15} d (14) 4^{28} b (4)^{l o} 4^{19} b (4)^{hi} + + + 4^{4} c (11) 4^{25} a (3) 4^{17} b (4)^{l o} + + + 4^{2} b (4)^{hi} 4^{11} d (14) 4^{14} a (3) + + + b (4)^{l o} c (11) d (14) + +$

检查 b 是否被正确地切分成 4 比特片的各子段。
- $W^{b (4) l o} + 2^{2} W^{b (4) hi} - W = 0$
对 $b (4)^{l o}, b (4)^{hi}$ 做 2 比特范围检查和 2 比特展开检查
对 $a (3)$ 做 3 比特范围检查和 3 比特展开检查

v2

$σ_{0}$ 门的 v2 版本接收一个被切分成 $(3, 4, 3, 7, 1, 1, 13)$ 比特小块的字(已由消息调度约束)。我们分别把这些小块称为 $(a (3), b (4), c (3), d (7), e (1), f (1), g (13)) .$ 我们已经从消息调度得到了 $spread (d (7)), spread (g (13))$ 。1 比特的 $e (1), f (1)$ 经展开运算后保持不变,可以直接使用。我们进一步把 $b (4)$ 切分成两个 2 比特小块 $b (4)^{l o}, b (4)^{hi} .$ 我们见证这些小块的展开版本。

$(X ⋙ 7) \oplus (X ⋙ 18) \oplus (X ≫ 3)$ 等价于 $(X ⋙ 7) \oplus (X ⋘ 14) \oplus (X ≫ 3)$ 。

s_low_sigma_0_v2	$a_{0}$	$a_{1}$	$a_{2}$	$a_{3}$	$a_{4}$	$a_{5}$	$a_{6}$	$a_{7}$
0	{0,1,2,3,4,5}	$R_{0}^{e v e n}$	$spread (R_{0}^{e v e n})$	$b (4)^{l o}$	$spread (b (4)^{l o})$	$b (4)^{hi}$	$spread (b (4)^{hi})$
1	{0,1,2,3,4,5}	$R_{0}^{o dd}$	$spread (R_{0}^{o dd})$	$spread (R_{1}^{o dd})$	$spread (d (7))$	$spread (g (13))$	$b (4)$	$e (1)$
0	{0,1,2,3,4,5}	$R_{1}^{e v e n}$	$spread (R_{1}^{e v e n})$	$a (3)$	$spread (a (3))$	$c (3)$	$spread (c (3))$	$f (1)$
0	{0,1,2,3,4,5}	$R_{1}^{o dd}$	$spread (R_{1}^{o dd})$

约束:

s_low_sigma_0_v2( $σ_{0}$ v2 约束): $L H S - R H S = 0$

$L H S = spread (R_{0}^{e v e n}) + 2 \cdot spread (R_{0}^{o dd}) + 2^{32} \cdot spread (R_{1}^{e v e n}) + 2^{33} \cdot spread (R_{1}^{o dd})$ $R H S = 4^{30} b (4)^{hi} 4^{31} e (1) + + 4^{16} g (13) 4^{28} b (4)^{l o} 4^{24} d (7) + + + 4^{15} f (1) 4^{25} a (3) 4^{21} c (3) + + + 4^{14} e (1) 4^{12} g (13) 4^{19} b (4)^{hi} + + + 4^{7} d (7) 4^{11} f (1) 4^{17} b (4)^{l o} + + + 4^{4} c (3) 4^{10} e (1) 4^{14} a (3) + + + 4^{2} b (4)^{hi} 4^{3} d (7) 4^{1} g (13) + + + b (4)^{l o} c (3) f (1) + +$

检查 b 是否被正确地切分成 4 比特片的各子段。
- $W^{b (4) l o} + 2^{2} W^{b (4) hi} - W = 0$
对 $b (4)^{l o}, b (4)^{hi}$ 做 2 比特范围检查和 2 比特展开检查
对 $a (3), c (3)$ 做 3 比特范围检查和 3 比特展开检查

σ_1 门

v1

$σ_{1}$ 门的 v1 版本接收一个被切分成 $(10, 7, 2, 13)$ 比特小块的字(已由消息调度约束)。我们分别把这些小块称为 $(a (10), b (7), c (2), d (13)) .$ $b (7)$ 被进一步切分成 $(2, 2, 3)$ 比特小块 $b (7)^{l o}, b (7)^{mi d}, b (7)^{hi} .$ 我们见证这些小块的展开版本。我们已经从消息调度得到了 $spread (a (10))$ 和 $spread (d (13))$ 。

$(X ⋙ 17) \oplus (X ⋙ 19) \oplus (X ≫ 10)$ 等价于 $(X ⋘ 15) \oplus (X ⋘ 13) \oplus (X ≫ 10)$ 。

s_low_sigma_1	$a_{0}$	$a_{1}$	$a_{2}$	$a_{3}$	$a_{4}$	$a_{5}$	$a_{6}$
0	{0,1,2,3,4,5}	$R_{0}^{e v e n}$	$spread (R_{0}^{e v e n})$	$b (7)^{l o}$	$spread (b (7)^{l o})$	$b (7)^{mi d}$	$spread (b (7)^{mi d})$
1	{0,1,2,3,4,5}	$R_{0}^{o dd}$	$spread (R_{0}^{o dd})$	$spread (R_{1}^{o dd})$	$spread (a (10))$	$spread (d (13))$	$b (7)$
0	{0,1,2,3,4,5}	$R_{1}^{e v e n}$	$spread (R_{1}^{e v e n})$	$c (2)$	$spread (c (2))$	$b (7)^{hi}$	$spread (b (7)^{hi})$
0	{0,1,2,3,4,5}	$R_{1}^{o dd}$	$spread (R_{1}^{o dd})$

约束:

s_low_sigma_1( $σ_{1}$ v1 约束): $L H S - R H S = 0$ $L H S = spread (R_{0}^{e v e n}) + 2 \cdot spread (R_{0}^{o dd}) + 2^{32} \cdot spread (R_{1}^{e v e n}) + 2^{33} \cdot spread (R_{1}^{o dd})$ $R H S = 4^{29} b (7)^{hi} 4^{30} c (2) + + 4^{9} d (13) 4^{27} b (7)^{mi d} 4^{27} b (7)^{hi} + + + 4^{7} c (2) 4^{25} b (7)^{l o} 4^{25} b (7)^{mi d} + + + 4^{4} b (7)^{hi} 4^{15} a (10) 4^{23} b (7)^{l o} + + + 4^{2} b (7)^{mi d} 4^{2} d (13) 4^{13} a (10) + + + b (7)^{l o} c (2) d (13) + +$
检查 b 是否被正确地切分成 7 比特片的各子段。
- $W^{b (7) l o} + 2^{2} W^{b (7) mi d} + 2^{4} W^{b (7) hi} - W = 0$
对 $b (7)^{l o}, b (7)^{mi d}, c (2)$ 做 2 比特范围检查和 2 比特展开检查
对 $b (7)^{hi}$ 做 3 比特范围检查和 3 比特展开检查

v2

$σ_{1}$ 门的 v2 版本接收一个被切分成 $(3, 4, 3, 7, 1, 1, 13)$ 比特小块的字(已由消息调度约束)。我们分别把这些小块称为 $(a (3), b (4), c (3), d (7), e (1), f (1), g (13)) .$ 我们已经从消息调度得到了 $spread (d (7)), spread (g (13))$ 。1 比特的 $e (1), f (1)$ 经展开运算后保持不变,可以直接使用。我们进一步把 $b (4)$ 切分成两个 2 比特小块 $b (4)^{l o}, b (4)^{hi} .$ 我们见证这些小块的展开版本。

$(X ⋙ 17) \oplus (X ⋙ 19) \oplus (X ≫ 10)$ 等价于 $(X ⋘ 15) \oplus (X ⋘ 13) \oplus (X ≫ 10)$ 。

s_low_sigma_1_v2	$a_{0}$	$a_{1}$	$a_{2}$	$a_{3}$	$a_{4}$	$a_{5}$	$a_{6}$	$a_{7}$
0	{0,1,2,3,4,5}	$R_{0}^{e v e n}$	$spread (R_{0}^{e v e n})$	$b (4)^{l o}$	$spread (b (4)^{l o})$	$b (4)^{hi}$	$spread (b (4)^{hi})$
1	{0,1,2,3,4,5}	$R_{0}^{o dd}$	$spread (R_{0}^{o dd})$	$spread (R_{1}^{o dd})$	$spread (d (7))$	$spread (g (13))$	$b (4)$	$e (1)$
0	{0,1,2,3,4,5}	$R_{1}^{e v e n}$	$spread (R_{1}^{e v e n})$	$a (3)$	$spread (a (3))$	$c (3)$	$spread (c (3))$	$f (1)$
0	{0,1,2,3,4,5}	$R_{1}^{o dd}$	$spread (R_{1}^{o dd})$

约束:

s_low_sigma_1_v2( $σ_{1}$ v2 约束): $L H S - R H S = 0$

$L H S = spread (R_{0}^{e v e n}) + 2 \cdot spread (R_{0}^{o dd}) + 2^{32} \cdot spread (R_{1}^{e v e n}) + 2^{33} \cdot spread (R_{1}^{o dd})$ $R H S = 4^{25} d (7) 4^{31} f (1) + + 4^{22} c (3) 4^{30} e (1) + + 4^{20} b (4)^{hi} 4^{23} d (7) + + 4^{9} g (13) 4^{18} b (4)^{l o} 4^{20} c (3) + + + 4^{8} f (1) 4^{15} a 4^{18} b (4)^{hi} + + + 4^{7} e (1) 4^{2} g (13) 4^{16} b (4)^{l o} + + + d (7) 4^{1} f (1) 4^{13} a + + + e (1) g (13) +$

检查 b 是否被正确地切分成 4 比特片的各子段。
- $W^{b (4) l o} + 2^{2} W^{b (4) hi} - W = 0$
对 $b (4)^{l o}, b (4)^{hi}$ 做 2 比特范围检查和 2 比特展开检查
对 $a (3), c (3)$ 做 3 比特范围检查和 3 比特展开检查

sr2	$a_{0}$
1	a

2 比特展开

$l_{1} (a) + 4 * l_{2} (a) + 5 * l_{3} (a) - a^{'} = 0$

ss2	$a_{0}$	$a_{1}$
1	a	a'

插值多项式(interpolation polynomials)为:

$l_{0} (a) = \frac{( a - 3 ) ( a - 2 ) ( a - 1 )}{( - 3 ) ( - 2 ) ( - 1 )}$ ( $spread (00) = 0000$ )
$l_{1} (a) = \frac{( a - 3 ) ( a - 2 ) ( a )}{( - 2 ) ( - 1 ) ( 1 )}$ ( $spread (01) = 0001$ )
$l_{2} (a) = \frac{( a - 3 ) ( a - 1 ) ( a )}{( - 1 ) ( 1 ) ( 2 )}$ ( $spread (10) = 0100$ )
$l_{3} (a) = \frac{( a - 2 ) ( a - 1 ) ( a )}{( 1 ) ( 2 ) ( 3 )}$ ( $spread (11) = 0101$ )

3 比特范围检查

$(a - 7) (a - 6) (a - 5) (a - 4) (a - 3) (a - 2) (a - 1) (a) = 0$

sr3	$a_{0}$
1	a

3 比特展开

$l_{1} (a) + 4 * l_{2} (a) + 5 * l_{3} (a) + 16 * l_{4} (a) + 17 * l_{5} (a) + 20 * l_{6} (a) + 21 * l_{7} (a) - a^{'} = 0$

ss3	$a_{0}$	$a_{1}$
1	a	a'

插值多项式为:

$l_{0} (a) = \frac{( a - 7 ) ( a - 6 ) ( a - 5 ) ( a - 4 ) ( a - 3 ) ( a - 2 ) ( a - 1 )}{( - 7 ) ( - 6 ) ( - 5 ) ( - 4 ) ( - 3 ) ( - 2 ) ( - 1 )}$ ( $spread (000) = 000000$ )
$l_{1} (a) = \frac{( a - 7 ) ( a - 6 ) ( a - 5 ) ( a - 4 ) ( a - 3 ) ( a - 2 ) ( a )}{( - 6 ) ( - 5 ) ( - 4 ) ( - 3 ) ( - 2 ) ( - 1 ) ( 1 )}$ ( $spread (001) = 000001$ )
$l_{2} (a) = \frac{( a - 7 ) ( a - 6 ) ( a - 5 ) ( a - 4 ) ( a - 3 ) ( a - 1 ) ( a )}{( - 5 ) ( - 4 ) ( - 3 ) ( - 2 ) ( - 1 ) ( 1 ) ( 2 )}$ ( $spread (010) = 000100$ )
$l_{3} (a) = \frac{( a - 7 ) ( a - 6 ) ( a - 5 ) ( a - 4 ) ( a - 2 ) ( a - 1 ) ( a )}{( - 4 ) ( - 3 ) ( - 2 ) ( - 1 ) ( 1 ) ( 2 ) ( 3 )}$ ( $spread (011) = 000101$ )
$l_{4} (a) = \frac{( a - 7 ) ( a - 6 ) ( a - 5 ) ( a - 3 ) ( a - 2 ) ( a - 1 ) ( a )}{( - 3 ) ( - 2 ) ( - 1 ) ( 1 ) ( 2 ) ( 3 ) ( 4 )}$ ( $spread (100) = 010000$ )
$l_{5} (a) = \frac{( a - 7 ) ( a - 6 ) ( a - 4 ) ( a - 3 ) ( a - 2 ) ( a - 1 ) ( a )}{( - 2 ) ( - 1 ) ( 1 ) ( 2 ) ( 3 ) ( 4 ) ( 5 )}$ ( $spread (101) = 010001$ )
$l_{6} (a) = \frac{( a - 7 ) ( a - 5 ) ( a - 4 ) ( a - 3 ) ( a - 2 ) ( a - 1 ) ( a )}{( - 1 ) ( 1 ) ( 2 ) ( 3 ) ( 4 ) ( 5 ) ( 6 )}$ ( $spread (110) = 010100$ )
$l_{7} (a) = \frac{( a - 6 ) ( a - 5 ) ( a - 4 ) ( a - 3 ) ( a - 2 ) ( a - 1 ) ( a )}{( 1 ) ( 2 ) ( 3 ) ( 4 ) ( 5 ) ( 6 ) ( 7 )}$ ( $spread (111) = 010101$ )

reduce_6 门

6 个元素的模 $2^{32}$ 加法

输入:

$E$
${e_{i}^{l o}, e_{i}^{hi}}_{i = 0}^{5}$
$c a rry$

检查: $E = e_{0} + e_{1} + e_{2} + e_{3} + e_{4} + e_{5} (mod 32)$

假定输入已被约束为 16 比特。

加法门(sa):
- $a_{0} + a_{1} + a_{2} + a_{3} + a_{4} + a_{5} + a_{6} - a_{7} = 0$
进位门(sc):
- $2^{16} a_{6} ω^{- 1} + a_{6} + [(a_{6} - 5) (a_{6} - 4) (a_{6} - 3) (a_{6} - 2) (a_{6} - 1) (a_{6})] = 0$

sa	sc	$a_{0}$	$a_{1}$	$a_{2}$	$a_{3}$	$a_{4}$	$a_{5}$	$a_{6}$	$a_{7}$
1	0	$e_{0}^{l o}$	$e_{1}^{l o}$	$e_{2}^{l o}$	$e_{3}^{l o}$	$e_{4}^{l o}$	$e_{5}^{l o}$	$- c a rry * 2^{16}$	$E^{l o}$
1	1	$e_{0}^{hi}$	$e_{1}^{hi}$	$e_{2}^{hi}$	$e_{3}^{hi}$	$e_{4}^{hi}$	$e_{5}^{hi}$	$c a rry$	$E^{hi}$

假定输入已被约束为 16 比特。

加法门(sa):
- $a_{0} ω^{- 1} + a_{1} ω^{- 1} + a_{2} ω^{- 1} + a_{0} + a_{1} + a_{2} + a_{3} ω^{- 1} - a_{3} = 0$
进位门(sc):
- $2^{16} a_{3} ω + a_{3} ω^{- 1} = 0$

sa	sc	$a_{0}$	$a_{1}$	$a_{2}$	$a_{3}$
0	0	$e_{0}^{l o}$	$e_{1}^{l o}$	$e_{2}^{l o}$	$- c a rry * 2^{16}$
1	1	$e_{3}^{l o}$	$e_{4}^{l o}$	$e_{5}^{l o}$	$E^{l o}$
0	0	$e_{0}^{hi}$	$e_{1}^{hi}$	$e_{2}^{hi}$	$c a rry$
1	0	$e_{3}^{hi}$	$e_{4}^{hi}$	$e_{5}^{hi}$	$E^{hi}$

reduce_7 门

7 个元素的模 $2^{32}$ 加法

输入:

$E$
${e_{i}^{l o}, e_{i}^{hi}}_{i = 0}^{6}$
$c a rry$

检查: $E = e_{0} + e_{1} + e_{2} + e_{3} + e_{4} + e_{5} + e_{6} (mod 32)$

假定输入已被约束为 16 比特。

加法门(sa):
- $a_{0} + a_{1} + a_{2} + a_{3} + a_{4} + a_{5} + a_{6} + a_{7} - a_{8} = 0$
进位门(sc):
- $2^{16} a_{7} ω^{- 1} + a_{7} + [(a_{7} - 6) (a_{7} - 5) (a_{7} - 4) (a_{7} - 3) (a_{7} - 2) (a_{7} - 1) (a_{7})] = 0$

sa	sc	$a_{0}$	$a_{1}$	$a_{2}$	$a_{3}$	$a_{4}$	$a_{5}$	$a_{6}$	$a_{7}$	$a_{8}$
1	0	$e_{0}^{l o}$	$e_{1}^{l o}$	$e_{2}^{l o}$	$e_{3}^{l o}$	$e_{4}^{l o}$	$e_{5}^{l o}$	$e_{6}^{l o}$	$- c a rry * 2^{16}$	$E^{l o}$
1	1	$e_{0}^{hi}$	$e_{1}^{hi}$	$e_{2}^{hi}$	$e_{3}^{hi}$	$e_{4}^{hi}$	$e_{5}^{hi}$	$e_{6}^{hi}$	$c a rry$	$E^{hi}$

消息调度区域(Message scheduling region)

对于已填充消息的每一个块 $M \in {0, 1}^{512}$ ,要构造 $64$ 个各 $32$ 比特的字,方法如下:

前 $16$ 个通过把 $M$ 切分成 $32$ 比特的块来得到 $M = W_{0} ∣∣ W_{1} ∣∣ \dots ∣∣ W_{14} ∣∣ W_{15};$
其余 $48$ 个字用以下公式构造: $W_{i} = σ_{1} (W_{i - 2}) ⊞ W_{i - 7} ⊞ σ_{0} (W_{i - 15}) ⊞ W_{i - 16},$ 对 $16 \leq i < 64$ 。

sw	sd0	sd1	sd2	sd3	ss0	ss0_v2	ss1	ss1_v2	$a_{0}$	$a_{1}$	$a_{2}$	$a_{3}$	$a_{4}$	$a_{5}$	$a_{6}$	$a_{7}$	$a_{8}$	$a_{9}$
0	1	0	0	0	0	0	0	0	{0,1,2,3,4,5}	$W_{0}^{l o}$	$spread (W_{0}^{l o})$	$W_{0}^{l o}$	$W_{0}^{hi}$	$W_{0}$	$σ_{0} (W_{1})^{l o}$	$σ_{1} (W_{14})^{l o}$	$W_{9}^{l o}$
1	0	0	0	0	0	0	0	0	{0,1,2,3,4,5}	$W_{0}^{hi}$	$spread (W_{0}^{hi})$			$W_{16}$	$σ_{0} (W_{1})^{hi}$	$σ_{1} (W_{14})^{hi}$	$W_{9}^{hi}$	$c a rr y_{16}$
0	1	1	0	0	0	0	0	0	{0,1,2,3,4}	$W_{1}^{d (14)}$	$spread (W_{1}^{d (14)})$	$W_{1}^{l o}$	$W_{1}^{hi}$	$W_{1}$	$σ_{0} (W_{2})^{l o}$	$σ_{1} (W_{15})^{l o}$	$W_{10}^{l o}$
1	0	0	0	0	0	0	0	0	{0,1,2}	$W_{1}^{c (11)}$	$spread (W_{1}^{c (11)})$	$W_{1}^{a (3)}$	$W_{1}^{b (4)}$	$W_{17}$	$σ_{0} (W_{2})^{hi}$	$σ_{1} (W_{15})^{hi}$	$W_{10}^{hi}$	$c a rr y_{17}$
0	0	0	0	0	0	0	0	0	{0,1,2,3,4,5}	$R_{0}^{e v e n}$	$spread (R_{0}^{e v e n})$	$W_{1}^{b (4) l o}$	$spread (W_{1}^{b (4) l o})$	$W_{1}^{b (4) hi}$	$spread (W_{1}^{b (4) hi})$
0	0	0	0	0	1	0	0	0	{0,1,2,3,4,5}	$R_{1}^{o dd}$	$spread (R_{0}^{o dd})$	$spread (R_{1}^{o dd})$	$spread (W_{1}^{c (11)})$	$spread (W_{1}^{d (14)})$	$W_{1}^{b (4)}$
0	0	0	0	0	0	0	0	0	{0,1,2,3,4,5}	$R_{0}^{o dd}$	$spread (R_{1}^{e v e n})$	$0$	$0$	$W_{1}^{a (3)}$	$spread (W_{1}^{a (3)})$
0	0	0	0	0	0	0	0	0	{0,1,2,3,4,5}	$R_{1}^{e v e n}$	$spread (R_{1}^{o dd})$	$σ_{0} v 1 R_{0}$	$σ_{0} v 1 R_{1}$	$σ_{0} v 1 R_{0}^{e v e n}$	$σ_{0} v 1 R_{0}^{o dd}$
..	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...
0	0	0	0	0	0	0	0	0	{0,1,2,3}	$W_{14}^{g (13)}$	$spread (W_{14}^{g (13)})$	$W_{14}^{a (3)}$	$W_{14}^{c (3)}$
0	1	0	1	0	0	0	0	0	0	$W_{14}^{d (7)}$	$spread (W_{14}^{d (7)})$	$W_{14}^{l o}$	$W_{14}^{hi}$	$W_{14}$	$σ_{0} (W_{15})^{l o}$	$σ_{1} (W_{28})^{l o}$	$W_{23}^{l o}$
1	0	0	0	0	0	0	0	0	0	$W_{14}^{b (4)}$	$spread (W_{14}^{b (4)})$	$W_{14}^{e (1)}$	$W_{14}^{f (1)}$	$W_{30}$	$σ_{0} (W_{15})^{hi}$	$σ_{1} (W_{28})^{hi}$	$W_{23}^{hi}$	$c a rr y_{30}$
0	0	0	0	0	0	0	0	0	{0,1,2,3,4,5}	$R_{0}^{e v e n}$	$spread (R_{0}^{e v e n})$	$W_{14}^{b (4) l o}$	$spread (W_{14}^{b (4) l o})$	$W_{14}^{b (4) hi}$	$spread (W_{14}^{b (4) hi})$
0	0	0	0	0	0	1	0	0	{0,1,2,3,4,5}	$R_{0}^{o dd}$	$spread (R_{0}^{o dd})$	$spread (R_{1}^{o dd})$	$spread (W_{14}^{d (7)})$	$spread (W_{14}^{g (13)})$	$W_{1}^{b (14)}$	$W_{14}^{e (1)}$
0	0	0	0	0	0	0	0	0	{0,1,2,3,4,5}	$R_{1}^{e v e n}$	$spread (R_{1}^{e v e n})$	$W_{14}^{a (3)}$	$spread (W_{14}^{a (3)})$	$W_{14}^{c (3)}$	$spread (W_{14}^{c (3)})$	$W_{14}^{f (1)}$
0	0	0	0	0	0	0	0	0	{0,1,2,3,4,5}	$R_{1}^{o dd}$	$spread (R_{1}^{o dd})$	$σ_{0} v 2 R_{0}$	$σ_{0} v 2 R_{1}$	$σ_{0} v 2 R_{0}^{e v e n}$	$σ_{0} v 2 R_{0}^{o dd}$
0	0	0	0	0	0	0	0	0	{0,1,2,3,4,5}	$R_{0}^{e v e n}$	$spread (R_{0}^{e v e n})$	$W_{14}^{b (4) l o}$	$spread (W_{14}^{b (4) l o})$	$W_{14}^{b (4) hi}$	$spread (W_{14}^{b (4) hi})$
0	0	0	0	0	0	0	0	1	{0,1,2,3,4,5}	$R_{0}^{o dd}$	$spread (R_{0}^{o dd})$	$spread (R_{1}^{o dd})$	$spread (d)$	$spread (g)$		$W_{14}^{e (1)}$
0	0	0	0	0	0	0	0	0	{0,1,2,3,4,5}	$R_{1}^{e v e n}$	$spread (R_{1}^{e v e n})$	$W_{14}^{a (3)}$	$spread (W_{14}^{a (3)})$	$W_{14}^{c (3)}$	$spread (W_{14}^{c (3)})$	$W_{14}^{f (1)}$
0	0	0	0	0	0	0	0	0	{0,1,2,3,4,5}	$R_{1}^{o dd}$	$spread (R_{1}^{o dd})$	$σ_{1} v 2 R_{0}$	$σ_{1} v 2 R_{1}$	$σ_{1} v 2 R_{0}^{e v e n}$	$σ_{1} v 2 R_{0}^{o dd}$
..	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...
0	1	0	0	1	0	0	0	0	{0,1,2,3}	$W_{49}^{d (13)}$	$spread (W_{49}^{d (13)})$	$W_{49}^{l o}$	$W_{49}^{hi}$	$W_{49}$
0	0	0	0	0	0	0	0	0	{0,1}	$W_{49}^{a (10)}$	$spread (W_{49}^{a (10)})$	$W_{49}^{c (2)}$	$W_{49}^{b (7)}$
0	0	0	0	0	0	0	0	0	{0,1,2,3,4,5}	$R_{0}^{e v e n}$	$spread (R_{0}^{e v e n})$	$W_{49}^{b (7) l o}$	$spread (W_{49}^{b (7) l o})$	$W_{49}^{b (7) mi d}$	$spread (W_{49}^{b (7) mi d})$
0	0	0	0	0	0	0	0	1	{0,1,2,3,4,5}	$R_{0}^{o dd}$	$spread (R_{0}^{o dd})$	$spread (R_{1}^{o dd})$	$spread (a)$	$spread (d)$	$W_{1}^{b (49)}$
0	0	0	0	0	0	0	0	0	{0,1,2,3,4,5}	$R_{1}^{e v e n}$	$spread (R_{1}^{e v e n})$	$W_{49}^{c (2)}$	$spread (W_{49}^{c (2)})$	$W_{49}^{b (7) hi}$	$spread (W_{49}^{b (7) hi})$
0	0	0	0	0	0	0	0	0	{0,1,2,3,4,5}	$R_{1}^{o dd}$	$spread (R_{1}^{o dd})$	$σ_{1} v 1 R_{0}$	$σ_{1} v 1 R_{1}$	$σ_{1} v 1 R_{0}^{e v e n}$	$σ_{1} v 1 R_{0}^{o dd}$
..	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...	...
0	1	0	0	0	0	0	0	0	{0,1,2,3,4,5}	$W_{62}^{l o}$	$spread (W_{62}^{l o})$	$W_{62}^{l o}$	$W_{62}^{hi}$	$W_{62}$
0	0	0	0	0	0	0	0	0	{0,1,2,3,4,5}	$W_{62}^{hi}$	$spread (W_{62}^{hi})$
0	1	0	0	0	0	0	0	0	{0,1,2,3,4,5}	$W_{63}^{l o}$	$spread (W_{63}^{l o})$	$W_{63}^{l o}$	$W_{63}^{hi}$	$W_{63}$
0	0	0	0	0	0	0	0	0	{0,1,2,3,4,5}	$W_{63}^{hi}$	$spread (W_{63}^{hi})$

约束:

sw:用 $re d u c e_{4}$ 构造字
sd0: $W_{0}, W_{62}, W_{63}$ 的分解门
- $W^{l o} + 2^{16} W^{hi} - W = 0$
sd1: $W_{1..13}$ 的分解门(切分成 $(3, 4, 11, 14)$ 比特的片)
- $W^{a (3)} + 2^{3} W^{b (4) l o} + 2^{5} W^{b (4) hi} + 2^{7} W^{c (11)} + 2^{18} W^{d (14)} - W = 0$
sd2: $W_{14..48}$ 的分解门(切分成 $(3, 4, 3, 7, 1, 1, 13)$ 比特的片)
- $W^{a (3)} + 2^{3} W^{b (4) l o} + 2^{5} W^{b (4) hi} + 2^{7} W^{c (11)} + 2^{10} W^{d (14)} + 2^{17} W^{e (1)} + 2^{18} W^{f (1)} + 2^{19} W^{g (13)} - W = 0$
sd3: $W_{49..61}$ 的分解门(切分成 $(10, 7, 2, 13)$ 比特的片)
- $W^{a (10)} + 2^{10} W^{b (7) l o} + 2^{12} W^{b (7) mi d} + 2^{15} W^{b (7) hi} + 2^{17} W^{c (2)} + 2^{19} W^{d (13)} - W = 0$

压缩区域(Compression region)

+----------------------------------------------------------+
|                                                          |
|          decompose E,                                    |
|          Σ_1(E)                                          |
|                                                          |
|                  +---------------------------------------+
|                  |                                       |
|                  |        reduce_5() to get H'           |
|                  |                                       |
+----------------------------------------------------------+
|          decompose F, decompose G                        |
|                                                          |
|                        Ch(E,F,G)                         |
|                                                          |
+----------------------------------------------------------+
|                                                          |
|          decompose A,                                    |
|          Σ_0(A)                                          |
|                                                          |
|                                                          |
|                  +---------------------------------------+
|                  |                                       |
|                  |        reduce_7() to get A_new,       |
|                  |              using H'                 |
|                  |                                       |
+------------------+---------------------------------------+
|          decompose B, decompose C                        |
|                                                          |
|          Maj(A,B,C)                                      |
|                                                          |
|                  +---------------------------------------+
|                  |        reduce_6() to get E_new,       |
|                  |              using H'                 |
+------------------+---------------------------------------+

初始轮(Initial round):

sd_abcd	sd_efgh	ss0	ss1	s_maj	s_ch_neg	s_ch	s_a_new	s_e_new	s_h_prime	$a_{0}$	$a_{1}$	$a_{2}$	$a_{3}$	$a_{4}$	$a_{5}$	$a_{6}$	$a_{7}$	$a_{8}$	$a_{9}$
0	1	0	0	0	0	0	0	0	0	{0,1,2}	$F_{0} d (7)$	$spread (E_{0} d (7))$	$E_{0} b (5)^{l o}$	$spread (E_{0} b (5)^{l o})$	$E_{0} b (5)^{hi}$	$spread (E_{0} b (5)^{hi})$	$E_{0}^{l o}$	$spread (E_{0}^{l o})$
0	0	0	0	0	0	0	0	0	0	{0,1}	$E_{0} c (14)$	$spread (E_{0} c (14))$	$E_{0} a (6)^{l o}$	$spread (E_{0} a (6)^{l o})$	$E_{0} a (6)^{hi}$	$spread (E_{0} a (6)^{hi})$	$E_{0}^{hi}$	$spread (E_{0}^{hi})$
0	0	0	0	0	0	0	0	0	0	{0,1,2,3,4,5}	$R_{0}^{e v e n}$	$spread (R_{0}^{e v e n})$	$spread (E_{0} b (5)^{l o})$	$spread (E_{0} b (5)^{hi})$
0	0	0	1	0	0	0	0	0	0	{0,1,2,3,4,5}	$R_{0}^{o dd}$	$spread (R_{0}^{o dd})$	$spread (R_{1}^{o dd})$	$spread (E_{0} d (7))$	$spread (E_{0} c (14))$
0	0	0	0	0	0	0	0	0	0	{0,1,2,3,4,5}	$R_{1}^{e v e n}$	$spread (R_{1}^{e v e n})$	$spread (E_{0} a (6)^{l o})$	$spread (E_{0} a (6)^{hi})$
0	0	0	0	0	0	0	0	0	0	{0,1,2,3,4,5}	$R_{1}^{o dd}$	$spread (R_{1}^{o dd})$
0	1	0	0	0	0	0	0	0	0	{0,1,2}	$F_{0} d (7)$	$spread (F_{0} d (7))$	$F_{0} b (5)^{l o}$	$spread (F_{0} b (5)^{l o})$	$F_{0} b (5)^{hi}$	$spread (F_{0} b (5)^{hi})$	$F_{0}^{l o}$	$spread (F_{0}^{l o})$
0	0	0	0	0	0	0	0	0	0	{0,1}	$F_{0} c (14)$	$spread (F_{0} c (14))$	$F_{0} a (6)^{l o}$	$spread (F_{0} a (6)^{l o})$	$F_{0} a (6)^{hi}$	$spread (F_{0} a (6)^{hi})$	$F_{0}^{hi}$	$spread (F_{0}^{hi})$
0	1	0	0	0	0	0	0	0	0	{0,1,2}	$G_{0} d (7)$	$spread (G_{0} d (7))$	$G_{0} b (5)^{l o}$	$spread (G_{0} b (5)^{l o})$	$G_{0} b (5)^{hi}$	$spread (G_{0} b (5)^{hi})$	$G_{0}^{l o}$	$spread (G_{0}^{l o})$
0	0	0	0	0	0	0	0	0	0	{0,1}	$G_{0} c (14)$	$spread (G_{0} c (14))$	$G_{0} a (6)^{l o}$	$spread (G_{0} a (6)^{l o})$	$G_{0} a (6)^{hi}$	$spread (G_{0} a (6)^{hi})$	$G_{0}^{hi}$	$spread (G_{0}^{hi})$
0	0	0	0	0	0	0	0	0	0	{0,1,2,3,4,5}	$P_{0}^{e v e n}$	$spread (P_{0}^{e v e n})$	$spread (E^{l o})$	$spread (E^{hi})$	$Q_{0}^{o dd}$	$K_{0}^{l o}$	$H_{0}^{l o}$	$W_{0}^{l o}$
0	0	0	0	0	0	1	0	0	1	{0,1,2,3,4,5}	$P_{0}^{o dd}$	$spread (P_{0}^{o dd})$	$spread (P_{1}^{o dd})$	$Σ_{1} (E_{0})^{l o}$	$Σ_{1} (E_{0})^{hi}$	$K_{0}^{hi}$	$H_{0}^{hi}$	$W_{0}^{hi}$
0	0	0	0	0	0	0	0	0	0	{0,1,2,3,4,5}	$P_{1}^{e v e n}$	$spread (P_{1}^{e v e n})$	$spread (F^{l o})$	$spread (F^{hi})$	$Q_{1}^{o dd}$	$P_{1}^{o dd}$	$H p r im e_{0}^{l o}$	$H p r im e_{0}^{hi}$	$H p r im e_{0} c a rry$
0	0	0	0	0	0	0	0	0	0	{0,1,2,3,4,5}	$P_{1}^{o dd}$	$spread (P_{1}^{o dd})$					$D_{0}^{l o}$	$E_{1}^{l o}$
0	0	0	0	0	0	0	0	1	0	{0,1,2,3,4,5}	$Q_{0}^{e v e n}$	$spread (Q_{0}^{e v e n})$	$spread (E_{n e g}^{l o})$	$spread (E_{n e g}^{hi})$	$spread (E^{l o})$		$D_{0}^{hi}$	$E_{1}^{hi}$	$E_{1} c a rry$
0	0	0	0	0	1	0	0	0	0	{0,1,2,3,4,5}	$Q_{0}^{o dd}$	$spread (Q_{0}^{o dd})$	$spread (Q_{1}^{o dd})$		$spread (E^{hi})$
0	0	0	0	0	0	0	0	0	0	{0,1,2,3,4,5}	$Q_{1}^{e v e n}$	$spread (Q_{1}^{e v e n})$	$spread (G^{l o})$	$spread (G^{hi})$
0	0	0	0	0	0	0	0	0	0	{0,1,2,3,4,5}	$Q_{1}^{o dd}$	$spread (Q_{1}^{o dd})$
1	0	0	0	0	0	0	0	0	0	{0,1,2}	$A_{0} b (11)$	$spread (A_{0} b (11))$	$A_{0} c (9)^{l o}$	$spread (A_{0} c (9)^{l o})$	$A_{0} c (9)^{mi d}$	$spread (A_{0} c (9)^{mi d})$	$A_{0}^{l o}$	$spread (A_{0}^{l o})$
0	0	0	0	0	0	0	0	0	0	{0,1}	$A_{0} d (10)$	$spread (A_{0} d (10))$	$A_{0} a (2)$	$spread (A_{0} a (2))$	$A_{0} c (9)^{hi}$	$spread (A_{0} c (9)^{hi})$	$A_{0}^{hi}$	$spread (A_{0}^{hi})$
0	0	0	0	0	0	0	0	0	0	{0,1,2,3,4,5}	$R_{0}^{e v e n}$	$spread (R_{0}^{e v e n})$	$spread (c (9)^{l o})$	$spread (c (9)^{mi d})$
0	0	1	0	0	0	0	0	0	0	{0,1,2,3,4,5}	$R_{0}^{o dd}$	$spread (R_{0}^{o dd})$	$spread (R_{1}^{o dd})$	$spread (d (10))$	$spread (b (11))$
0	0	0	0	0	0	0	0	0	0	{0,1,2,3,4,5}	$R_{1}^{e v e n}$	$spread (R_{1}^{e v e n})$	$spread (a (2))$	$spread (c (9)^{hi})$
0	0	0	0	0	0	0	0	0	0	{0,1,2,3,4,5}	$R_{1}^{o dd}$	$spread (R_{1}^{o dd})$
1	0	0	0	0	0	0	0	0	0	{0,1,2}	$B_{0} b (11)$	$spread (B_{0} b (11))$	$B_{0} c (9)^{l o}$	$spread (B_{0} c (9)^{l o})$	$B_{0} c (9)^{mi d}$	$spread (B_{0} c (9)^{mi d})$	$B_{0}^{l o}$	$spread (B_{0}^{l o})$
0	0	0	0	0	0	0	0	0	0	{0,1}	$B_{0} d (10)$	$spread (B_{0} d (10))$	$B_{0} a (2)$	$spread (B_{0} a (2))$	$B_{0} c (9)^{hi}$	$spread (B_{0} c (9)^{hi})$	$B_{0}^{hi}$	$spread (B_{0}^{hi})$
1	0	0	0	0	0	0	0	0	0	{0,1,2}	$C_{0} b (11)$	$spread (C_{0} b (11))$	$C_{0} c (9)^{l o}$	$spread (C_{0} c (9)^{l o})$	$C_{0} c (9)^{mi d}$	$spread (C_{0} c (9)^{mi d})$	$C_{0}^{l o}$	$spread (C_{0}^{l o})$
0	0	0	0	0	0	0	0	0	0	{0,1}	$C_{0} d (10)$	$spread (C_{0} d (10))$	$C_{0} a (2)$	$spread (C_{0} a (2))$	$C_{0} c (9)^{hi}$	$spread (C_{0} c (9)^{hi})$	$C_{0}^{hi}$	$spread (C_{0}^{hi})$
0	0	0	0	0	0	0	0	0	0	{0,1,2,3,4,5}	$M_{0}^{e v e n}$	$spread (M_{0}^{e v e n})$	$M_{1}^{o dd}$	$spread (A_{0}^{l o})$	$spread (A_{0}^{hi})$		$H p r im e_{0}^{l o}$	$H p r im e_{0}^{hi}$
0	0	0	0	1	0	0	1	0	0	{0,1,2,3,4,5}	$M_{0}^{o dd}$	$spread (M_{0}^{o dd})$	$spread (M_{1}^{o dd})$	$spread (B_{0}^{l o})$	$spread (B_{0}^{hi})$	$Σ_{0} (A_{0})^{l o}$		$A_{1}^{l o}$	$A_{1} c a rry$
0	0	0	0	0	0	0	0	0	0	{0,1,2,3,4,5}	$M_{1}^{e v e n}$	$spread (M_{1}^{e v e n})$		$spread (C_{0}^{l o})$	$spread (C_{0}^{hi})$	$Σ_{0} (A_{0})^{hi}$		$A_{1}^{hi}$
0	0	0	0	0	0	0	0	0	0	{0,1,2,3,4,5}	$M_{1}^{o dd}$	$spread (M_{1}^{o dd})$

稳态(Steady-state):

sd_abcd	sd_efgh	ss0	ss1	s_maj	s_ch_neg	s_ch	s_a_new	s_e_new	s_h_prime	$a_{0}$	$a_{1}$	$a_{2}$	$a_{3}$	$a_{4}$	$a_{5}$	$a_{6}$	$a_{7}$	$a_{8}$	$a_{9}$
0	1	0	0	0	0	0	0	0	0	{0,1,2}	$F_{0} d (7)$	$spread (E_{0} d (7))$	$E_{0} b (5)^{l o}$	$spread (E_{0} b (5)^{l o})$	$E_{0} b (5)^{hi}$	$spread (E_{0} b (5)^{hi})$	$E_{0}^{l o}$	$spread (E_{0}^{l o})$
0	0	0	0	0	0	0	0	0	0	{0,1}	$E_{0} c (14)$	$spread (E_{0} c (14))$	$E_{0} a (6)^{l o}$	$spread (E_{0} a (6)^{l o})$	$E_{0} a (6)^{hi}$	$spread (E_{0} a (6)^{hi})$	$E_{0}^{hi}$	$spread (E_{0}^{hi})$
0	0	0	0	0	0	0	0	0	0	{0,1,2,3,4,5}	$R_{0}^{e v e n}$	$spread (R_{0}^{e v e n})$	$spread (E_{0} b (5)^{l o})$	$spread (E_{0} b (5)^{hi})$
0	0	0	1	0	0	0	0	0	0	{0,1,2,3,4,5}	$R_{0}^{o dd}$	$spread (R_{0}^{o dd})$	$spread (R_{1}^{o dd})$	$spread (E_{0} d (7))$	$spread (E_{0} c (14))$
0	0	0	0	0	0	0	0	0	0	{0,1,2,3,4,5}	$R_{1}^{e v e n}$	$spread (R_{1}^{e v e n})$	$spread (E_{0} a (6)^{l o})$	$spread (E_{0} a (6)^{hi})$
0	0	0	0	0	0	0	0	0	0	{0,1,2,3,4,5}	$R_{1}^{o dd}$	$spread (R_{1}^{o dd})$
0	0	0	0	0	0	0	0	0	0	{0,1,2,3,4,5}	$P_{0}^{e v e n}$	$spread (P_{0}^{e v e n})$	$spread (E^{l o})$	$spread (E^{hi})$	$Q_{0}^{o dd}$	$K_{0}^{l o}$	$H_{0}^{l o}$	$W_{0}^{l o}$
0	0	0	0	0	0	1	0	0	1	{0,1,2,3,4,5}	$P_{0}^{o dd}$	$spread (P_{0}^{o dd})$	$spread (P_{1}^{o dd})$	$Σ_{1} (E_{0})^{l o}$	$Σ_{1} (E_{0})^{hi}$	$K_{0}^{hi}$	$H_{0}^{hi}$	$W_{0}^{hi}$
0	0	0	0	0	0	0	0	0	0	{0,1,2,3,4,5}	$P_{1}^{e v e n}$	$spread (P_{1}^{e v e n})$	$spread (F^{l o})$	$spread (F^{hi})$	$Q_{1}^{o dd}$	$P_{1}^{o dd}$	$H p r im e_{0}^{l o}$	$H p r im e_{0}^{hi}$	$H p r im e_{0} c a rry$
0	0	0	0	0	0	0	0	0	0	{0,1,2,3,4,5}	$P_{1}^{o dd}$	$spread (P_{1}^{o dd})$					$D_{0}^{l o}$	$E_{1}^{l o}$
0	0	0	0	0	0	0	0	1	0	{0,1,2,3,4,5}	$Q_{0}^{e v e n}$	$spread (Q_{0}^{e v e n})$	$spread (E_{n e g}^{l o})$	$spread (E_{n e g}^{hi})$	$spread (E^{l o})$		$D_{0}^{hi}$	$E_{1}^{hi}$	$E_{1} c a rry$
0	0	0	0	0	1	0	0	0	0	{0,1,2,3,4,5}	$Q_{0}^{o dd}$	$spread (Q_{0}^{o dd})$	$spread (Q_{1}^{o dd})$		$spread (E^{hi})$
0	0	0	0	0	0	0	0	0	0	{0,1,2,3,4,5}	$Q_{1}^{e v e n}$	$spread (Q_{1}^{e v e n})$	$spread (G^{l o})$	$spread (G^{hi})$
0	0	0	0	0	0	0	0	0	0	{0,1,2,3,4,5}	$Q_{1}^{o dd}$	$spread (Q_{1}^{o dd})$
1	0	0	0	0	0	0	0	0	0	{0,1,2}	$A_{0} b (11)$	$spread (A_{0} b (11))$	$A_{0} c (9)^{l o}$	$spread (A_{0} c (9)^{l o})$	$A_{0} c (9)^{mi d}$	$spread (A_{0} c (9)^{mi d})$	$A_{0}^{l o}$	$spread (A_{0}^{l o})$
0	0	0	0	0	0	0	0	0	0	{0,1}	$A_{0} d (10)$	$spread (A_{0} d (10))$	$A_{0} a (2)$	$spread (A_{0} a (2))$	$A_{0} c (9)^{hi}$	$spread (A_{0} c (9)^{hi})$	$A_{0}^{hi}$	$spread (A_{0}^{hi})$
0	0	0	0	0	0	0	0	0	0	{0,1,2,3,4,5}	$R_{0}^{e v e n}$	$spread (R_{0}^{e v e n})$	$spread (c (9)^{l o})$	$spread (c (9)^{mi d})$
0	0	1	0	0	0	0	0	0	0	{0,1,2,3,4,5}	$R_{0}^{o dd}$	$spread (R_{0}^{o dd})$	$spread (R_{1}^{o dd})$	$spread (d (10))$	$spread (b (11))$
0	0	0	0	0	0	0	0	0	0	{0,1,2,3,4,5}	$R_{1}^{e v e n}$	$spread (R_{1}^{e v e n})$	$spread (a (2))$	$spread (c (9)^{hi})$
0	0	0	0	0	0	0	0	0	0	{0,1,2,3,4,5}	$R_{1}^{o dd}$	$spread (R_{1}^{o dd})$
0	0	0	0	0	0	0	0	0	0	{0,1,2,3,4,5}	$M_{0}^{e v e n}$	$spread (M_{0}^{e v e n})$	$M_{1}^{o dd}$	$spread (A_{0}^{l o})$	$spread (A_{0}^{hi})$		$H p r im e_{0}^{l o}$	$H p r im e_{0}^{hi}$
0	0	0	0	1	0	0	1	0	0	{0,1,2,3,4,5}	$M_{0}^{o dd}$	$spread (M_{0}^{o dd})$	$spread (M_{1}^{o dd})$	$spread (B_{0}^{l o})$	$spread (B_{0}^{hi})$	$Σ_{0} (A_{0})^{l o}$		$A_{1}^{l o}$	$A_{1} c a rry$
0	0	0	0	0	0	0	0	0	0	{0,1,2,3,4,5}	$M_{1}^{e v e n}$	$spread (M_{1}^{e v e n})$		$spread (C_{0}^{l o})$	$spread (C_{0}^{hi})$	$Σ_{0} (A_{0})^{hi}$		$A_{1}^{hi}$
0	0	0	0	0	0	0	0	0	0	{0,1,2,3,4,5}	$M_{1}^{o dd}$	$spread (M_{1}^{o dd})$

最终摘要(Final digest):

s_digest	$a_{3}$	$a_{4}$	$a_{5}$	$a_{6}$	$a_{7}$	$a_{8}$
1	$A_{63}^{l o}$	$A_{63}^{hi}$	$A_{63}$	$B_{63}^{l o}$	$B_{63}^{hi}$	$B_{63}$
0	$C_{63}^{l o}$	$C_{63}^{hi}$	$C_{63}$	$C_{63}^{l o}$	$C_{63}^{hi}$	$C_{63}$
1	$E_{63}^{l o}$	$E_{63}^{hi}$	$E_{63}$	$G_{63}^{l o}$	$G_{63}^{hi}$	$G_{63}$
0	$F_{63}^{l o}$	$F_{63}^{hi}$	$F_{63}$	$H_{63}^{l o}$	$H_{63}^{hi}$	$H_{63}$

Keyboard shortcuts

halo2 中文手册 (The halo2 Book · 简体中文版)