fix(sha256): Add extra checks against message size when constructing msg blocks

[vezenovm]

Description

Problem*

Resolves

Issue found in zk passport https://github.com/ocelots-app/passport-verifier/blob/47e9464e7e782b07b6d791bf1d13257fce2f486b/crates/lib/data-check/integrity/src/lib.nr#L118 when performing sha on a message with a large padding.

Summary*

The current sha algorithm accounts for message padding, but only where ithe padding is still contained in the block we are compressing. For the case where we have a padding that extends multiple blocks past the message size we end up with a correctness error. We need to add more checks against the message size to make sure we are comrpessing the correct msg block.

An increase in gate count is expected from these changes.

Additional Context

Documentation*

Check one:

• No documentation needed.
• Documentation included in this PR.
• [For Experimental Features] Documentation to be submitted in a separate PR.

PR Checklist*

• I have tested the changes locally.
• I have formatted the changes with Prettier and/or cargo fmt on default settings.

[github-actions]

Changes to Brillig bytecode sizes

Generated at commit: 566151986e49e002b33765eebaf327fe42771c7d, compared to commit: cfd68d4c1bd1a2319698fca99d200a5d86ffa771

🧾 Summary (10% most significant diffs)

Program	Brillig opcodes (+/-)	%
sha256_regression	+4,118 ❌	+62.98%
sha256_var_size_regression	+60 ❌	+1.83%

---

Full diff report 👇

Program	Brillig opcodes (+/-)	%
sha256_regression	10,657 (+4,118)	+62.98%
sha256_var_size_regression	3,341 (+60)	+1.83%
sha256	3,421 (+16)	+0.47%

[github-actions]

Changes to circuit sizes

Generated at commit: 566151986e49e002b33765eebaf327fe42771c7d, compared to commit: cfd68d4c1bd1a2319698fca99d200a5d86ffa771

🧾 Summary (10% most significant diffs)

Program	ACIR opcodes (+/-)	%	Circuit size (+/-)	%
sha256_regression	+32,838 ❌	+444.78%	+114,735 ❌	+121.86%
regression_4449	+3,850 ❌	+18.39%	+5,793 ❌	+1.96%

---

Full diff report 👇

Program	ACIR opcodes (+/-)	%	Circuit size (+/-)	%
sha256_regression	40,221 (+32,838)	+444.78%	208,891 (+114,735)	+121.86%
regression_4449	24,788 (+3,850)	+18.39%	300,859 (+5,793)	+1.96%
sha2_byte	20,267 (+62)	+0.31%	94,011 (+93)	+0.10%
sha256	2,936 (-877)	-23.00%	47,628 (0)	0.00%
sha256_var_size_regression	20,058 (-697)	-3.36%	77,523 (-657)	-0.84%

[vezenovm]

Program ACIR opcodes (+/-) % Circuit size (+/-) %
sha256_regression +32,838 ❌ +444.78% +114,735 ❌ +121.86%
regression_4449 +3,850 ❌ +18.39% +5,793 ❌ +1.96%

Two big new additional regressions were included under sha256_regression in this PR. If you look at the full report sha256, sha2_byte, and sha256_var_size_regression are largely untouched in circuit size by these changes.

[michaeljklein]

Small typo in comment, otherwise LGTM