fix: make Hash duplex sponge portable across pointer widths

`Hash<D>::squeeze` and `squeeze_end` fold the squeeze block-counter and the
read-length into the hash state via `usize::to_be_bytes()`. `usize` is 8 bytes
on 64-bit targets and 4 bytes on 32-bit (e.g. wasm32), so the absorbed bytes —
and therefore the squeezed output — differ by target. A 64-bit prover and a
32-bit verifier then derive different Fiat-Shamir challenges, breaking
verification (this surfaced verifying a 64-bit-produced transcript inside a
wasm32 verifier).

Encode both counters as fixed-width `u64`. On 64-bit this is byte-identical to
the previous output (`i as u64 == i`), so existing transcripts/vectors are
unchanged; only 32-bit output changes, now matching 64-bit. The permutation
`DuplexSponge` is unaffected — its `usize` fields are buffer indices, never
absorbed.

Add a multi-block squeeze known-answer test (counter increments past 0, plus a
squeeze_end) that pins the output; running it on both a 64-bit and a 32-bit
target guards the portability property.

Author: shreyas-londhe

spongefish/src/instantiations/hash.rs

@@ -86,9 +86,12 @@ impl<D: BlockSizeUser + Digest + Clone + FixedOutputReset> DuplexSpongeInterface
             self.squeeze(&mut output[len..])
         // Squeeze another digest
         } else if let Mode::Squeeze(i) = self.mode {
-            // Add the squeeze mask, current digest, and index
+            // Add the squeeze mask, current digest, and index.
+            // Encode the index as a fixed-width `u64` (not `usize`) so the absorbed
+            // bytes are identical on 32- and 64-bit targets; otherwise a 64-bit
+            // prover and a 32-bit verifier (e.g. wasm32) derive different outputs.
             let mut output_hasher_prefix = self.hasher.clone();
-            Digest::update(&mut output_hasher_prefix, i.to_be_bytes());
+            Digest::update(&mut output_hasher_prefix, (i as u64).to_be_bytes());
             let digest = output_hasher_prefix.finalize();
             // Copy the digest into the output, and store the rest for later
             let chunk_len = usize::min(output.len(), Self::DIGEST_SIZE);
@@ -147,7 +150,9 @@ impl<D: BlockSizeUser + Digest + Clone + Reset> Hash<D> {
             let mut squeeze_hasher = D::new();
             Digest::update(&mut squeeze_hasher, Self::mask_squeeze_end());
             Digest::update(&mut squeeze_hasher, &self.cv);
-            Digest::update(&mut squeeze_hasher, byte_count.to_be_bytes());
+            // Fixed-width `u64` encoding for cross-architecture portability — see the
+            // matching note in `squeeze`.
+            Digest::update(&mut squeeze_hasher, (byte_count as u64).to_be_bytes());
             self.cv = Digest::finalize(squeeze_hasher);
 
             // set the sponge state in absorb mode
@@ -259,3 +264,39 @@ fn test_shosha() {
     sho.squeeze(&mut got[..63]);
     assert_eq!(&got[..63], expected);
 }
+
+/// Cross-architecture known-answer test for the squeeze path.
+///
+/// `squeeze` and `squeeze_end` absorb the squeeze block-counter / read-length
+/// into the hash state. These must be encoded at a fixed width (`u64`), not the
+/// native `usize`, or a 64-bit prover and a 32-bit verifier (e.g. `wasm32`)
+/// produce different output. This pins a multi-block squeeze (the counter
+/// increments past 0) plus a `squeeze_end`; the value MUST be identical on every
+/// target — run this under a 32-bit target (e.g. `wasm32-unknown-unknown`) as
+/// well as 64-bit to guard the property.
+#[cfg(all(test, feature = "sha2"))]
+#[test]
+fn squeeze_is_pointer_width_independent() {
+    let mut sho = Hash::<sha2::Sha256>::default();
+    sho.absorb(b"portability");
+    sho.ratchet();
+    sho.absorb(b"check");
+    // 200 bytes spans multiple 32-byte SHA-256 squeeze blocks, exercising the
+    // `Mode::Squeeze(i)` counter (i = 0..6) folded into the hash.
+    let mut got = [0u8; 200];
+    sho.squeeze(&mut got);
+    sho.squeeze_end();
+    let mut tail = [0u8; 40];
+    sho.squeeze(&mut tail);
+
+    assert_eq!(
+        hex::encode(got),
+        "694d33cf42aed220f5cbbc49bf16d4f2494dbfa6d42cb50d23ec50d398fca6286cb54bd8989f97db6da16f1a0395e0c79d6eb3624e5dff81da81b75d1380d2b0c029419d5dde093607c5a910a9da16778ca145776ba961dcdb4b3581b5d0d237329b94b85ac05a1b1cf51394fbcf5a742a2c1d5447f6b823ad044ebd85356418e3ea6e6c67be32e209d832968101fbebbf24e352c6f1fda5f3142e6dbff79479f09948c96d663f21ebf3cf4c4739d2587213e698101e13c07d8e1ec2e13241f5580703770da745e0",
+        "200-byte squeeze KAT changed (or is pointer-width dependent)"
+    );
+    assert_eq!(
+        hex::encode(tail),
+        "871f6366393e4fef9d77b0289953f1ec85d54b5ec95eb1d26397cdc5ae21139cfdc77ab9919726f8",
+        "post-squeeze_end KAT changed (or is pointer-width dependent)"
+    );
+}