Switch to Sponge2‑Style Zero‑Padding with Capacity Length Encoding for AO‑Friendly AEAD

Summary
- This issue proposes replacing the current pad10*‑based instantiation in ePrint 2023/1668 with a Sponge2‑style variant that uses:
- zero‑padding for associated data and plaintext, and
- capacity initialization with full message lengths at setup (`|(A)|`, `|(P)|` on encryption; `|(A)|`, `|(C)|` on decryption),
while preserving the Duplex/MonkeySpongeWrap (MSW) security guarantees. The change materially improves efficiency in arithmetization‑oriented (AO) settings without weakening the bounds and simplifies the implementation.

Motivation
- `pad10*` forces at least one extra delimiter field element and, for rate‑aligned inputs, often an entire extra block needs to be permuted.
- The Sponge2 framework (ePrint 2024/911) shows that zero‑padding plus capacity‑based domain separation achieves strong indifferentiability guarantees. Adapting MSW to this style seems like a natural question to investigate.

Proposed Change
- Replace the pad10*‑based MSW instantiation with a Sponge2‑style variant:
1) Zero‑pad `A` and `P` to multiples of `r`.
2) Capacity initialization at setup (before any absorption):
- Enc: set two fixed capacity words to `(|A|, |P|)`; zero the rest.
- Dec: set `(|A|, |C|)`; zero the rest.
3) Preserve input‑before‑output duplex phasing (permute precedes every squeeze/overwrite).
4) Keep nonce‑respecting requirement and reject‑on‑fail decryption unchanged.

Algorithms (pseudocode)

Encryption (K, N, A, P) → (C, T):
```
S ← 0^b
S[rate][0:κ) ← K; S[rate][κ:κ+ν) ← N
S[cap][jA] ← |A|; S[cap][jP] ← |P|; S[cap][others] ← 0
S ← π(S)

// Associated data (overwrite; no release)
for each r‑sized block A_i of ZeroPad(A):
S ← π(S)
S[rate] ← A_i

// Plaintext (encrypt; release)
C ← ε
for each r‑sized block P_i of ZeroPad(P):
S ← π(S)
Z_i ← S[rate]
C_i ← P_i + Z_i
C ← C || C_i
S[rate] ← S[rate] + P_i

// Tag
S ← π(S)
T ← extract_digest(S[rate])
return (C[0:|P|), T)
```

Decryption (K, N, A, C, T) → P or ⊥:
```
S ← 0^b
S[rate][0:κ) ← K; S[rate][κ:κ+ν) ← N
S[cap][jA] ← |A|; S[cap][jC] ← |C|; S[cap][others] ← 0
S ← π(S)

// Associated data (overwrite; no release)
for each r‑sized block A_i of ZeroPad(A):
S ← π(S)
S[rate] ← A_i

// Ciphertext (decrypt; no early release)
P ← ε
for each r‑sized block C_i of ZeroPad(C):
S ← π(S)
Z_i ← S[rate]
P_i ← C_i + Z_i
S[rate] ← C_i
P ← P || P_i

// Verify tag
S ← π(S)
T* ← extract_digest(S[rate])
if T ≠ T* then return ⊥
return P[0:|C|)
```

Open Questions

- Investigate the security of this new construction.