Add SHA according to FIPS 180-4

[kleinreact]

This PR adds

• a specification of the FIPS PUB 180-4: Secure Hash Standard (SHS) that has been formalized using a purely functional description in Haskell,
• streaming based hardware implementations for all of the hash algorithms of FIPS 180-4 utilizing a request-response interface, and
• some sanity checks for testing the functional correctness of the specification and the implementations, where cryptohash is used as an independent reference implementation.

Synthesis of the design requires some fixes and workarounds that are not available upstream yet.

• zipEqual: left list is longer clash-compiler#2812

  • worked around by using GHC 9.10

• The power of Index clash-compiler#2813

  • fixed by Fix literal rendering of Index values clash-compiler#2816

• "Other error: divide by zero" on input file clash-compiler#2815

  • fixed by Catch "divide by zero" in more places in the primitive evaluator clash-compiler#2817

• Prelude.!!: index to large clash-compiler#2831

  • worked around by 2e8263f

• clash-spec-limit needs to grow exponentially clash-compiler#2832

  • worked around by 2e8263f

• Verilog generation runs indefinitely clash-compiler#2834

  • worked around by 8519fd9

where we use this dedicated branch to utilize the available fixes at the moment. Nevertheless, further errors still might to be expected for synthesizing the design.

I propose to already merge this PR, as clash-crypto still is in a preliminary development state anyway and to keep track of the missing compiler support via issues separately.

[diegodiv]

Very nice work! I made some suggestions, most of them we already talked about. The last fix seems to make it synthesizable, which is super nice. I think that's very good for a first revision, and we'll improve on the design later anyway.

[diegodiv]

I don't find this signature particularly readable: maybe we could have a type embodying the function type returned here, like

type Distributer a b d =  ∀ (dom ∷ Domain) (k ∷ Nat).
  (KnownDomain dom, HiddenClockResetEnable dom) ⇒
  DSignal dom k b →
  DSignal dom k a →
  DSignal dom (k + d) a

and then use it as the return type of the functions (both the inside one and the top-level one).

[kleinreact]

I don't like the idea of introducing an additional type alias here, as it does not work well with haddock in terms of documentation and it wouldn't have any particular meaning, except that it reduces redundancy.

The Haskell compiler also will take care that both signatures are kept in sync.

[diegodiv]

True, but that's mostly about readability - I'd be inclined to think that knowing at first sight what it does by looking at the signature is quite important, and I find it a bit difficult to read. Maybe just having a layout-based solution would be enough.

[diegodiv]

LGTM, very nice job. I didn't opt for very thorough testing as the goal is to test it by other means and find issues, so the current state it's in is fine by me!

For the other remarks, we can discuss them later if needed, but we can move them out of the scope of this PR.

[diegodiv]

Nice!