impl test for ghash, polyval

[thor314]

implement tests for ghash and polyval; see ref test vector in ietf spec. Tests should be both in terms of raw inputs to ghash/polyval, and testing implementations of polyval/ghash in terms of one another (relying on impl of mulx in #48)

that is, given code:

f ghash()
f polyval()

write tests:

# see spec for assertions
test ghash(input) -> output ...
test polyval(input) -> output ...

# see spec for how to impl ghash from polyval
test ghash_from_polyval {
  poly_out := polyval
  compute_ghash_from_polyval_using_mulx(...)
}
# repeat above for polyval_from_ghash

Closes #42
Closes #43

this pr does not implement ghash or polyval

[thor314]

pausing for tonight. Status:

tasks: implement ghash

• do: impl ghash using mulx
  • test bytereverse
  • impl bytereverse
  • tests for ghash
  • impl ghash
  • clean
• do: polyval
  • tests for polyval
  • impl polyval
  • clean
• comms
• back
  • reduce repo unused codepaths - test/{gfmulint,ghash}
  • bug: ghash 256 bits returned

[devloper]

🤯

[0xJepsen]

When working with @KaiGeffen we found that we can use circuit.expectPass({ in: TheInputVar }, { out: TheoutputVar });

to assert that the output is what we expect using the tools in curcomkit. This is nice because then you don't have to map the bits to the bigint like you do here

[thor314]

Updating the remaining scope of this PR:

• incorporate kai comments from 48 into 49
• merge main
• impl tests for polyval
• impl tests for ghash/polyval in terms of one another, as spceified in ietf spec

next:

• how should we impl galois field mul in circom <- the biggest focus for thor right now