Module digest 

SHA-512 round functions and Ed25519 digest helpers used by the rings and the controllers. All are RHDL kernels, so they become plain combinational logic wherever they are called.

The SHA-512 functions follow FIPS 180-4 section 4.1.3 on 64-bit words. The digest helpers convert between the two byte orders in play: SHA-512 reads and writes big-endian words, while the cores’ ports and Ed25519’s scalars and points are little-endian (word 0 holds bytes 0..8, and the least significant byte of each word comes first).

Functions

big_sigma0

SHA-512 round function Σ0(a) = ROTR^28 ^ ROTR^34 ^ ROTR^39.

big_sigma1

SHA-512 round function Σ1(e) = ROTR^14 ^ ROTR^18 ^ ROTR^41.

digest_words

SHA-512 state words as the little-endian 512-bit digest.

prefix_from_digest

Nonce prefix (upper half of SHA-512(seed), bytes 32..64), which RFC 8032 hashes with the message to derive the per-signature nonce r.

reverse_bytes

Byte-reverse a 64-bit word (SHA-512 is big-endian, the ports little-endian).

rotr

Rotate the 64-bit value right by amount bits.

round_constant

SHA-512 round constant K_t for round t in 0..80 (FIPS 180-4 section 4.2.3).

secret_from_digest

Clamped secret scalar a from SHA-512(seed) (RFC 8032 section 5.1.5).

small_sigma0

SHA-512 message-schedule function σ0(x) = ROTR^1 ^ ROTR^8 ^ SHR^7.

small_sigma1

SHA-512 message-schedule function σ1(x) = ROTR^19 ^ ROTR^61 ^ SHR^6.

words256

A 256-bit little-endian value as four big-endian SHA-512 message words.