Poseidon2 half output

[lvella]

Of all uses we have for Poseidon2 (Merkle Tree, Sponge absorption, Sponge squeeze), none use the full 8 field elements of the output. Sponge absorption uses only the final 4, and Merkle Tree and Sponge squeeze uses only the initial 4.

This change introduces a switch for the user to select what parts of the final state to output (first half, second half, all of it or none of it).

[georgwiese]

Was there a reason for this change?

[lvella]

If there was, I forgot. It feels like it had something to do with the removal of the 0x0000000100000002 case below.

[georgwiese]

Suggested change

	pub enum Poseidon2OutputHalf {
	//None = 0,
	FirstHalf = 1,
	SecondHalf = 2,
	//Full = 3,
	}
	pub enum Poseidon2OutputHalf {
	FirstHalf = 1,
	SecondHalf = 2,
	}

[lvella]

These comments act as a sort of documentation... do you really want them gone?

[georgwiese]

Do we need support for both and none? I think it's only used in the test?

If we only supported exactly one half, we could:

• Receive output_second_half directly as input (saves a column)
• Define let output_first_half = 1 - output_second_half (saves another column)
• Remove 4 links to memory

[lvella]

I tried doing this way, but I couldn't because the index of output[index] must be constant, so all 8 links are needed regardless...

Now thinking better, I could create a new array[4], and assign the values depending on the output_first_half, but then the column balance would be +3.

Would it be worth?

As for the need of the full state, I know of a theoretical one: the original form of sponge construction (not the one used in plonky3) requires the full state. But yeah, we currently don't implement that, and the only reason I can think of for ever needing it is for compatibility with some existing system.

[georgwiese]

I think this would work:

let output_first_half = 1 - output_second_half;
let output_0 = output_first_half * output[0] + output_second_half * output[4];
link if is_used ~> mem.mstore(output_addr + 0, output_time_step, output_0);

which would not introduce any extra columns, right?

[georgwiese]

Regarding whether we'll need the full state, I don't know :)