crypto/sha2: publish hash and block lengths in bytes - #1606

Implements fjs/crypto/sha2/todo/byte-length-fields.md (deleted here).

Why

Sha2 published only bit counts, so every consumer needing bytes re-did the conversion — in two different spellings:

// hmac
const p = repeat(blockLength >> 3n)
// sign
const rep = repeat(divUp8(hf.hashLength))

Whether the two roundings agree was left for the reader to work out per site.

What

sha2(...) computes both once and the type publishes them:

readonly hashBytes: bigint
readonly blockBytes: bigint

hmac reads blockBytes, sign reads hashBytes, and divUp8 drops out of sign's imports entirely.

divUp8 is the spelling kept for both: it agrees with >> 3n on every SHA-2 variant, and it is the rounding RFC 6979 actually specifies (ceil(hlen/8)), so a hypothetical non-byte-multiple hashLength — sha2 takes it as a parameter — stays correct rather than silently truncating.

Verification

I checked the "the two roundings agree" premise rather than assuming it, across every variant:

All equal >> 3n. (The TODO said "all four variants" — there are six.)

• npx tsc clean; fjs test 2910 pass, 0 fail; npm run cov 100% aggregate, which Fail npm run cov if aggregate coverage falls under 100% #1605 now gates on.
• New byteLengths proof covers all six, asserting each byte count against both its expected value and the bit length it derives from, so the identity is pinned rather than the numbers alone.
• Differential on hmac, the consumer whose changed value feeds a branch (length(k) > blockLength): 6 variants × 10 key lengths straddling both block sizes (0, 1, 32, 63, 64, 65, 127, 128, 129, 200 bytes) × 5 message lengths = 300 digests, identical.
• Differential on sign/computeK: 4 curves × 6 hashes × 4 messages = 96 signatures, identical.
• Declaration emit shows exactly the two added fields and nothing else.

One note on method: my first hmac differential script was wrong — it passed a list where a Vec was expected and crashed on both sides, so cmp reported "identical" on two equal stack traces. I caught it, fixed the call, and added a row-count and non-empty-digest guard to both scripts so a silent failure cannot masquerade as a match again. The numbers above are from the corrected runs.

Changelog:

• crypto/sha2: Sha2 publishes hashBytes and blockBytes, so consumers sizing byte buffers read them instead of converting bit lengths themselves

🤖 Generated with Claude Code

https://claude.ai/code/session_016HvbYkBMYWwQECL7myLhqs

Generated by Claude Code