nx_blake2b_long.nx

nx_blake2b_long.nx -- RFC 9106 sec 3.4 variable-length BLAKE2b H'. Argon2 needs hash outputs LONGER than BLAKE2b's 64-byte max (each memory block is 1024 bytes). H' chains BLAKE2b calls to extend the output to any T in [1, 2^32 - 1] bytes. Per cardinal feedback-bits-up-exceed-never-match: substrate's own H' chained on substrate's own BLAKE2b; nothing imported from argon2_ref / argon2_optimized. ===== Algorithm (RFC 9106 sec 3.4) ============================== H'(T, A) where T is output length in bytes, A is the input message of arbitrary length. Phase 1: prepend the 4-byte little-endian length T to A: input_prime = le32(T) || A Phase 2: if T <= 64: return BLAKE2b(input_prime, out_len = T) else: V_1 = BLAKE2b(input_prime, out_len = 64) (64 bytes) r = ceil(T / 32) - 2 (number of 32-byte full chunks beyond V_1) output[0..31] = V_1[0..31] for i = 2 .. r + 1: V_i = BLAKE2b(V_{i-1}, out_len = 64) (64 bytes) output[(i-1)*32 .. i*32 - 1] = V_i[0..31] V_last = BLAKE2b(V_{r+1}, out_len = T - 32*r) output[(r+1)*32 .. T - 1] = V_last Note: r counts the number of full V_2..V_{r+1} contributions of 32 bytes; V_1 contributes the FIRST 32 bytes; V_last (variable length T - 32*r) contributes the tail (which is ALSO 32 bytes when T is a multiple of 32, or whatever remainder otherwise). The H' construction is what gives Argon2 its 1024-byte memory