Back implementations of SHA2, HMAC-SHA1, HMAC-SHA2 and HKDF-SHA2 by hacl-rs

[keks]

This PR replaces some use of hacl-c by hacl-rs.

The Rust files in the directories libcrux-hacl-rs and libcrux-hacl-rs-xxx are autogenerated, with two caveats:

• some have been rustfmt'd
• I added some use items to modules inside the same crate in some cases
• Some modules paths changed when copying them into this crate, so I had to adapt that sometimes.

The reason for the last two items is that upstream they define several crates, and here I wanted to keep the number crates low. So when e.g. they use crate::bignum_base in their bignum crate, and I move that crate into a module bignum inside our libcrux-hacl-rs crate, this becomes crate::bignum::bignum_base.

Maybe we should ask if they can put everything in a single crate (except the proc-macro of course), or maybe we can split these into separate crates. Not sure what is better.

In some places it also changed the API a little:

Everywhere

Pass in &mut [u8; N] instead of returning [u8; N]

Seems like it’s the more general thing, even though the API is a bit more clunky. We can implement the returning API on top of the borrowing API, as well.

HKDF

Trait and Structs

Use structs and traits for the implementations rather than modules. Somehow doing it this way seemed cleaner to me, but I can understand if that is not how it should be. More of a conversation starter, the old structure is still around. Happy to hear feedback around this.

Renamed “tag length” (in comments, $tag_len, …) to “hash length”

That’s what the RFC calls it.

fixed some comments on panics

removed one of the two errors

Until now, we had (a) libcrux_hkdf::Error and (b) libcrux_hkdf::hacl_hkdf::Error. However, (a) did not contain all error conditions, but was the only that was exposed, so we returned “too long okm” when in fact the input buffer was too large. Now we just have a single error, with both error conditions, and that’s just used everywhere.

HMAC

Nothing besides the change from “return array” to “take &mut”.

SHA2

Removed the additional layering between the public facing types and the state types

Previously, it looked like the inner type would only hide the unsafe-ness of the hacl-c implementation, and then we would just forward most of the API to the used in a wrapper around that. Now that this is safe, the utility became even more questionable, so I got rid of it. The digest module now uses hacl-rs directly.

ed25519

Nothing besides the change from “return array” to “take &mut”.