SHA-256 and HMAC specs and lemmas (from VST)