UNPKG

@keplr-ewallet/ewallet-sdk-eth

Version:
1,333 lines (1,325 loc) 151 kB
import { pad, toHex, toBytes, hashMessage, keccak256, serializeTransaction, hashTypedData, isAddressEqual, hexToString, serializeTypedData, isAddress, defineChain } from 'viem'; import { v4 } from 'uuid'; import { publicKeyToAddress } from 'viem/accounts'; import { EventEmitter } from 'eventemitter3'; import { KeplrEWallet } from '@keplr-ewallet/ewallet-sdk-core'; import { mainnet, base, optimism, arbitrum, blast, avalanche, unichain, polygon, forma, berachain, story, sepolia, citreaTestnet } from 'viem/chains'; const PUBLIC_RPC_METHODS = new Set([ "web3_clientVersion", "eth_blobBaseFee", "eth_blockNumber", "eth_chainId", "eth_call", "eth_coinbase", "eth_feeHistory", "eth_estimateGas", "eth_gasPrice", "eth_getBalance", "eth_getBlockByHash", "eth_getBlockByNumber", "eth_getBlockTransactionCountByHash", "eth_getBlockTransactionCountByNumber", "eth_getCode", "eth_getProof", "eth_getFilterChanges", "eth_getFilterLogs", "eth_getLogs", "eth_newBlockFilter", "eth_newFilter", "eth_newPendingTransactionFilter", "eth_uninstallFilter", "eth_getStorageAt", "eth_getTransactionByBlockHashAndIndex", "eth_getTransactionByBlockNumberAndIndex", "eth_getTransactionByHash", "eth_getTransactionCount", "eth_getTransactionReceipt", "eth_getUncleByBlockHashAndIndex", "eth_getUncleByBlockNumberAndIndex", "eth_getUncleCountByBlockHash", "eth_getUncleCountByBlockNumber", "eth_maxPriorityFeePerGas", "eth_protocolVersion", "eth_sendRawTransaction", "eth_syncing", ]); const WALLET_RPC_METHODS = new Set([ "eth_accounts", "eth_requestAccounts", "eth_sendTransaction", "eth_signTransaction", "eth_signTypedData_v4", "personal_sign", "wallet_addEthereumChain", "wallet_switchEthereumChain", ]); /** * Utilities for hex, bytes, CSPRNG. * @module */ /*! noble-hashes - MIT License (c) 2022 Paul Miller (paulmillr.com) */ /** Checks if something is Uint8Array. Be careful: nodejs Buffer will return true. */ function isBytes(a) { return a instanceof Uint8Array || (ArrayBuffer.isView(a) && a.constructor.name === 'Uint8Array'); } /** Asserts something is positive integer. */ function anumber(n, title = '') { if (!Number.isSafeInteger(n) || n < 0) { const prefix = title && `"${title}" `; throw new Error(`${prefix}expected integer >0, got ${n}`); } } /** Asserts something is Uint8Array. */ function abytes(value, length, title = '') { const bytes = isBytes(value); const len = value?.length; const needsLen = length !== undefined; if (!bytes || (needsLen && len !== length)) { const prefix = title && `"${title}" `; const ofLen = needsLen ? ` of length ${length}` : ''; const got = bytes ? `length=${len}` : `type=${typeof value}`; throw new Error(prefix + 'expected Uint8Array' + ofLen + ', got ' + got); } return value; } /** Asserts something is hash */ function ahash(h) { if (typeof h !== 'function' || typeof h.create !== 'function') throw new Error('Hash must wrapped by utils.createHasher'); anumber(h.outputLen); anumber(h.blockLen); } /** Asserts a hash instance has not been destroyed / finished */ function aexists(instance, checkFinished = true) { if (instance.destroyed) throw new Error('Hash instance has been destroyed'); if (checkFinished && instance.finished) throw new Error('Hash#digest() has already been called'); } /** Asserts output is properly-sized byte array */ function aoutput(out, instance) { abytes(out, undefined, 'digestInto() output'); const min = instance.outputLen; if (out.length < min) { throw new Error('"digestInto() output" expected to be of length >=' + min); } } /** Zeroize a byte array. Warning: JS provides no guarantees. */ function clean(...arrays) { for (let i = 0; i < arrays.length; i++) { arrays[i].fill(0); } } /** Create DataView of an array for easy byte-level manipulation. */ function createView(arr) { return new DataView(arr.buffer, arr.byteOffset, arr.byteLength); } /** The rotate right (circular right shift) operation for uint32 */ function rotr(word, shift) { return (word << (32 - shift)) | (word >>> shift); } // Built-in hex conversion https://caniuse.com/mdn-javascript_builtins_uint8array_fromhex const hasHexBuiltin = /* @__PURE__ */ (() => // @ts-ignore typeof Uint8Array.from([]).toHex === 'function' && typeof Uint8Array.fromHex === 'function')(); // Array where index 0xf0 (240) is mapped to string 'f0' const hexes = /* @__PURE__ */ Array.from({ length: 256 }, (_, i) => i.toString(16).padStart(2, '0')); /** * Convert byte array to hex string. Uses built-in function, when available. * @example bytesToHex(Uint8Array.from([0xca, 0xfe, 0x01, 0x23])) // 'cafe0123' */ function bytesToHex(bytes) { abytes(bytes); // @ts-ignore if (hasHexBuiltin) return bytes.toHex(); // pre-caching improves the speed 6x let hex = ''; for (let i = 0; i < bytes.length; i++) { hex += hexes[bytes[i]]; } return hex; } // We use optimized technique to convert hex string to byte array const asciis = { _0: 48, _9: 57, A: 65, F: 70, a: 97, f: 102 }; function asciiToBase16(ch) { if (ch >= asciis._0 && ch <= asciis._9) return ch - asciis._0; // '2' => 50-48 if (ch >= asciis.A && ch <= asciis.F) return ch - (asciis.A - 10); // 'B' => 66-(65-10) if (ch >= asciis.a && ch <= asciis.f) return ch - (asciis.a - 10); // 'b' => 98-(97-10) return; } /** * Convert hex string to byte array. Uses built-in function, when available. * @example hexToBytes('cafe0123') // Uint8Array.from([0xca, 0xfe, 0x01, 0x23]) */ function hexToBytes(hex) { if (typeof hex !== 'string') throw new Error('hex string expected, got ' + typeof hex); // @ts-ignore if (hasHexBuiltin) return Uint8Array.fromHex(hex); const hl = hex.length; const al = hl / 2; if (hl % 2) throw new Error('hex string expected, got unpadded hex of length ' + hl); const array = new Uint8Array(al); for (let ai = 0, hi = 0; ai < al; ai++, hi += 2) { const n1 = asciiToBase16(hex.charCodeAt(hi)); const n2 = asciiToBase16(hex.charCodeAt(hi + 1)); if (n1 === undefined || n2 === undefined) { const char = hex[hi] + hex[hi + 1]; throw new Error('hex string expected, got non-hex character "' + char + '" at index ' + hi); } array[ai] = n1 * 16 + n2; // multiply first octet, e.g. 'a3' => 10*16+3 => 160 + 3 => 163 } return array; } /** Copies several Uint8Arrays into one. */ function concatBytes(...arrays) { let sum = 0; for (let i = 0; i < arrays.length; i++) { const a = arrays[i]; abytes(a); sum += a.length; } const res = new Uint8Array(sum); for (let i = 0, pad = 0; i < arrays.length; i++) { const a = arrays[i]; res.set(a, pad); pad += a.length; } return res; } /** Creates function with outputLen, blockLen, create properties from a class constructor. */ function createHasher(hashCons, info = {}) { const hashC = (msg, opts) => hashCons(opts).update(msg).digest(); const tmp = hashCons(undefined); hashC.outputLen = tmp.outputLen; hashC.blockLen = tmp.blockLen; hashC.create = (opts) => hashCons(opts); Object.assign(hashC, info); return Object.freeze(hashC); } /** Cryptographically secure PRNG. Uses internal OS-level `crypto.getRandomValues`. */ function randomBytes(bytesLength = 32) { const cr = typeof globalThis === 'object' ? globalThis.crypto : null; if (typeof cr?.getRandomValues !== 'function') throw new Error('crypto.getRandomValues must be defined'); return cr.getRandomValues(new Uint8Array(bytesLength)); } /** Creates OID opts for NIST hashes, with prefix 06 09 60 86 48 01 65 03 04 02. */ const oidNist = (suffix) => ({ oid: Uint8Array.from([0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, suffix]), }); /** * Internal Merkle-Damgard hash utils. * @module */ /** Choice: a ? b : c */ function Chi(a, b, c) { return (a & b) ^ (~a & c); } /** Majority function, true if any two inputs is true. */ function Maj(a, b, c) { return (a & b) ^ (a & c) ^ (b & c); } /** * Merkle-Damgard hash construction base class. * Could be used to create MD5, RIPEMD, SHA1, SHA2. */ class HashMD { blockLen; outputLen; padOffset; isLE; // For partial updates less than block size buffer; view; finished = false; length = 0; pos = 0; destroyed = false; constructor(blockLen, outputLen, padOffset, isLE) { this.blockLen = blockLen; this.outputLen = outputLen; this.padOffset = padOffset; this.isLE = isLE; this.buffer = new Uint8Array(blockLen); this.view = createView(this.buffer); } update(data) { aexists(this); abytes(data); const { view, buffer, blockLen } = this; const len = data.length; for (let pos = 0; pos < len;) { const take = Math.min(blockLen - this.pos, len - pos); // Fast path: we have at least one block in input, cast it to view and process if (take === blockLen) { const dataView = createView(data); for (; blockLen <= len - pos; pos += blockLen) this.process(dataView, pos); continue; } buffer.set(data.subarray(pos, pos + take), this.pos); this.pos += take; pos += take; if (this.pos === blockLen) { this.process(view, 0); this.pos = 0; } } this.length += data.length; this.roundClean(); return this; } digestInto(out) { aexists(this); aoutput(out, this); this.finished = true; // Padding // We can avoid allocation of buffer for padding completely if it // was previously not allocated here. But it won't change performance. const { buffer, view, blockLen, isLE } = this; let { pos } = this; // append the bit '1' to the message buffer[pos++] = 0b10000000; clean(this.buffer.subarray(pos)); // we have less than padOffset left in buffer, so we cannot put length in // current block, need process it and pad again if (this.padOffset > blockLen - pos) { this.process(view, 0); pos = 0; } // Pad until full block byte with zeros for (let i = pos; i < blockLen; i++) buffer[i] = 0; // Note: sha512 requires length to be 128bit integer, but length in JS will overflow before that // You need to write around 2 exabytes (u64_max / 8 / (1024**6)) for this to happen. // So we just write lowest 64 bits of that value. view.setBigUint64(blockLen - 8, BigInt(this.length * 8), isLE); this.process(view, 0); const oview = createView(out); const len = this.outputLen; // NOTE: we do division by 4 later, which must be fused in single op with modulo by JIT if (len % 4) throw new Error('_sha2: outputLen must be aligned to 32bit'); const outLen = len / 4; const state = this.get(); if (outLen > state.length) throw new Error('_sha2: outputLen bigger than state'); for (let i = 0; i < outLen; i++) oview.setUint32(4 * i, state[i], isLE); } digest() { const { buffer, outputLen } = this; this.digestInto(buffer); const res = buffer.slice(0, outputLen); this.destroy(); return res; } _cloneInto(to) { to ||= new this.constructor(); to.set(...this.get()); const { blockLen, buffer, length, finished, destroyed, pos } = this; to.destroyed = destroyed; to.finished = finished; to.length = length; to.pos = pos; if (length % blockLen) to.buffer.set(buffer); return to; } clone() { return this._cloneInto(); } } /** * Initial SHA-2 state: fractional parts of square roots of first 16 primes 2..53. * Check out `test/misc/sha2-gen-iv.js` for recomputation guide. */ /** Initial SHA256 state. Bits 0..32 of frac part of sqrt of primes 2..19 */ const SHA256_IV = /* @__PURE__ */ Uint32Array.from([ 0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19, ]); /** * SHA2 hash function. A.k.a. sha256, sha384, sha512, sha512_224, sha512_256. * SHA256 is the fastest hash implementable in JS, even faster than Blake3. * Check out [RFC 4634](https://www.rfc-editor.org/rfc/rfc4634) and * [FIPS 180-4](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf). * @module */ /** * Round constants: * First 32 bits of fractional parts of the cube roots of the first 64 primes 2..311) */ // prettier-ignore const SHA256_K = /* @__PURE__ */ Uint32Array.from([ 0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, 0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da, 0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070, 0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2 ]); /** Reusable temporary buffer. "W" comes straight from spec. */ const SHA256_W = /* @__PURE__ */ new Uint32Array(64); /** Internal 32-byte base SHA2 hash class. */ class SHA2_32B extends HashMD { constructor(outputLen) { super(64, outputLen, 8, false); } get() { const { A, B, C, D, E, F, G, H } = this; return [A, B, C, D, E, F, G, H]; } // prettier-ignore set(A, B, C, D, E, F, G, H) { this.A = A | 0; this.B = B | 0; this.C = C | 0; this.D = D | 0; this.E = E | 0; this.F = F | 0; this.G = G | 0; this.H = H | 0; } process(view, offset) { // Extend the first 16 words into the remaining 48 words w[16..63] of the message schedule array for (let i = 0; i < 16; i++, offset += 4) SHA256_W[i] = view.getUint32(offset, false); for (let i = 16; i < 64; i++) { const W15 = SHA256_W[i - 15]; const W2 = SHA256_W[i - 2]; const s0 = rotr(W15, 7) ^ rotr(W15, 18) ^ (W15 >>> 3); const s1 = rotr(W2, 17) ^ rotr(W2, 19) ^ (W2 >>> 10); SHA256_W[i] = (s1 + SHA256_W[i - 7] + s0 + SHA256_W[i - 16]) | 0; } // Compression function main loop, 64 rounds let { A, B, C, D, E, F, G, H } = this; for (let i = 0; i < 64; i++) { const sigma1 = rotr(E, 6) ^ rotr(E, 11) ^ rotr(E, 25); const T1 = (H + sigma1 + Chi(E, F, G) + SHA256_K[i] + SHA256_W[i]) | 0; const sigma0 = rotr(A, 2) ^ rotr(A, 13) ^ rotr(A, 22); const T2 = (sigma0 + Maj(A, B, C)) | 0; H = G; G = F; F = E; E = (D + T1) | 0; D = C; C = B; B = A; A = (T1 + T2) | 0; } // Add the compressed chunk to the current hash value A = (A + this.A) | 0; B = (B + this.B) | 0; C = (C + this.C) | 0; D = (D + this.D) | 0; E = (E + this.E) | 0; F = (F + this.F) | 0; G = (G + this.G) | 0; H = (H + this.H) | 0; this.set(A, B, C, D, E, F, G, H); } roundClean() { clean(SHA256_W); } destroy() { this.set(0, 0, 0, 0, 0, 0, 0, 0); clean(this.buffer); } } /** Internal SHA2-256 hash class. */ class _SHA256 extends SHA2_32B { // We cannot use array here since array allows indexing by variable // which means optimizer/compiler cannot use registers. A = SHA256_IV[0] | 0; B = SHA256_IV[1] | 0; C = SHA256_IV[2] | 0; D = SHA256_IV[3] | 0; E = SHA256_IV[4] | 0; F = SHA256_IV[5] | 0; G = SHA256_IV[6] | 0; H = SHA256_IV[7] | 0; constructor() { super(32); } } /** * SHA2-256 hash function from RFC 4634. In JS it's the fastest: even faster than Blake3. Some info: * * - Trying 2^128 hashes would get 50% chance of collision, using birthday attack. * - BTC network is doing 2^70 hashes/sec (2^95 hashes/year) as per 2025. * - Each sha256 hash is executing 2^18 bit operations. * - Good 2024 ASICs can do 200Th/sec with 3500 watts of power, corresponding to 2^36 hashes/joule. */ const sha256 = /* @__PURE__ */ createHasher(() => new _SHA256(), /* @__PURE__ */ oidNist(0x01)); /** * Hex, bytes and number utilities. * @module */ /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */ const _0n$3 = /* @__PURE__ */ BigInt(0); const _1n$3 = /* @__PURE__ */ BigInt(1); function abool(value, title = '') { if (typeof value !== 'boolean') { const prefix = title && `"${title}" `; throw new Error(prefix + 'expected boolean, got type=' + typeof value); } return value; } // Used in weierstrass, der function abignumber(n) { if (typeof n === 'bigint') { if (!isPosBig(n)) throw new Error('positive bigint expected, got ' + n); } else anumber(n); return n; } function numberToHexUnpadded(num) { const hex = abignumber(num).toString(16); return hex.length & 1 ? '0' + hex : hex; } function hexToNumber(hex) { if (typeof hex !== 'string') throw new Error('hex string expected, got ' + typeof hex); return hex === '' ? _0n$3 : BigInt('0x' + hex); // Big Endian } // BE: Big Endian, LE: Little Endian function bytesToNumberBE(bytes) { return hexToNumber(bytesToHex(bytes)); } function bytesToNumberLE(bytes) { return hexToNumber(bytesToHex(copyBytes(abytes(bytes)).reverse())); } function numberToBytesBE(n, len) { anumber(len); n = abignumber(n); const res = hexToBytes(n.toString(16).padStart(len * 2, '0')); if (res.length !== len) throw new Error('number too large'); return res; } function numberToBytesLE(n, len) { return numberToBytesBE(n, len).reverse(); } /** * Copies Uint8Array. We can't use u8a.slice(), because u8a can be Buffer, * and Buffer#slice creates mutable copy. Never use Buffers! */ function copyBytes(bytes) { return Uint8Array.from(bytes); } // Is positive bigint const isPosBig = (n) => typeof n === 'bigint' && _0n$3 <= n; function inRange(n, min, max) { return isPosBig(n) && isPosBig(min) && isPosBig(max) && min <= n && n < max; } /** * Asserts min <= n < max. NOTE: It's < max and not <= max. * @example * aInRange('x', x, 1n, 256n); // would assume x is in (1n..255n) */ function aInRange(title, n, min, max) { // Why min <= n < max and not a (min < n < max) OR b (min <= n <= max)? // consider P=256n, min=0n, max=P // - a for min=0 would require -1: `inRange('x', x, -1n, P)` // - b would commonly require subtraction: `inRange('x', x, 0n, P - 1n)` // - our way is the cleanest: `inRange('x', x, 0n, P) if (!inRange(n, min, max)) throw new Error('expected valid ' + title + ': ' + min + ' <= n < ' + max + ', got ' + n); } // Bit operations /** * Calculates amount of bits in a bigint. * Same as `n.toString(2).length` * TODO: merge with nLength in modular */ function bitLen(n) { let len; for (len = 0; n > _0n$3; n >>= _1n$3, len += 1) ; return len; } /** * Calculate mask for N bits. Not using ** operator with bigints because of old engines. * Same as BigInt(`0b${Array(i).fill('1').join('')}`) */ const bitMask = (n) => (_1n$3 << BigInt(n)) - _1n$3; /** * Minimal HMAC-DRBG from NIST 800-90 for RFC6979 sigs. * @returns function that will call DRBG until 2nd arg returns something meaningful * @example * const drbg = createHmacDRBG<Key>(32, 32, hmac); * drbg(seed, bytesToKey); // bytesToKey must return Key or undefined */ function createHmacDrbg(hashLen, qByteLen, hmacFn) { anumber(hashLen, 'hashLen'); anumber(qByteLen, 'qByteLen'); if (typeof hmacFn !== 'function') throw new Error('hmacFn must be a function'); const u8n = (len) => new Uint8Array(len); // creates Uint8Array const NULL = Uint8Array.of(); const byte0 = Uint8Array.of(0x00); const byte1 = Uint8Array.of(0x01); const _maxDrbgIters = 1000; // Step B, Step C: set hashLen to 8*ceil(hlen/8) let v = u8n(hashLen); // Minimal non-full-spec HMAC-DRBG from NIST 800-90 for RFC6979 sigs. let k = u8n(hashLen); // Steps B and C of RFC6979 3.2: set hashLen, in our case always same let i = 0; // Iterations counter, will throw when over 1000 const reset = () => { v.fill(1); k.fill(0); i = 0; }; const h = (...msgs) => hmacFn(k, concatBytes(v, ...msgs)); // hmac(k)(v, ...values) const reseed = (seed = NULL) => { // HMAC-DRBG reseed() function. Steps D-G k = h(byte0, seed); // k = hmac(k || v || 0x00 || seed) v = h(); // v = hmac(k || v) if (seed.length === 0) return; k = h(byte1, seed); // k = hmac(k || v || 0x01 || seed) v = h(); // v = hmac(k || v) }; const gen = () => { // HMAC-DRBG generate() function if (i++ >= _maxDrbgIters) throw new Error('drbg: tried max amount of iterations'); let len = 0; const out = []; while (len < qByteLen) { v = h(); const sl = v.slice(); out.push(sl); len += v.length; } return concatBytes(...out); }; const genUntil = (seed, pred) => { reset(); reseed(seed); // Steps D-G let res = undefined; // Step H: grind until k is in [1..n-1] while (!(res = pred(gen()))) reseed(); reset(); return res; }; return genUntil; } function validateObject(object, fields = {}, optFields = {}) { if (!object || typeof object !== 'object') throw new Error('expected valid options object'); function checkField(fieldName, expectedType, isOpt) { const val = object[fieldName]; if (isOpt && val === undefined) return; const current = typeof val; if (current !== expectedType || val === null) throw new Error(`param "${fieldName}" is invalid: expected ${expectedType}, got ${current}`); } const iter = (f, isOpt) => Object.entries(f).forEach(([k, v]) => checkField(k, v, isOpt)); iter(fields, false); iter(optFields, true); } /** * Memoizes (caches) computation result. * Uses WeakMap: the value is going auto-cleaned by GC after last reference is removed. */ function memoized(fn) { const map = new WeakMap(); return (arg, ...args) => { const val = map.get(arg); if (val !== undefined) return val; const computed = fn(arg, ...args); map.set(arg, computed); return computed; }; } /** * Utils for modular division and fields. * Field over 11 is a finite (Galois) field is integer number operations `mod 11`. * There is no division: it is replaced by modular multiplicative inverse. * @module */ /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */ // Numbers aren't used in x25519 / x448 builds // prettier-ignore const _0n$2 = /* @__PURE__ */ BigInt(0), _1n$2 = /* @__PURE__ */ BigInt(1), _2n$2 = /* @__PURE__ */ BigInt(2); // prettier-ignore const _3n$1 = /* @__PURE__ */ BigInt(3), _4n$1 = /* @__PURE__ */ BigInt(4), _5n = /* @__PURE__ */ BigInt(5); // prettier-ignore const _7n = /* @__PURE__ */ BigInt(7), _8n = /* @__PURE__ */ BigInt(8), _9n = /* @__PURE__ */ BigInt(9); const _16n = /* @__PURE__ */ BigInt(16); // Calculates a modulo b function mod(a, b) { const result = a % b; return result >= _0n$2 ? result : b + result; } /** Does `x^(2^power)` mod p. `pow2(30, 4)` == `30^(2^4)` */ function pow2(x, power, modulo) { let res = x; while (power-- > _0n$2) { res *= res; res %= modulo; } return res; } /** * Inverses number over modulo. * Implemented using [Euclidean GCD](https://brilliant.org/wiki/extended-euclidean-algorithm/). */ function invert(number, modulo) { if (number === _0n$2) throw new Error('invert: expected non-zero number'); if (modulo <= _0n$2) throw new Error('invert: expected positive modulus, got ' + modulo); // Fermat's little theorem "CT-like" version inv(n) = n^(m-2) mod m is 30x slower. let a = mod(number, modulo); let b = modulo; // prettier-ignore let x = _0n$2, u = _1n$2; while (a !== _0n$2) { // JIT applies optimization if those two lines follow each other const q = b / a; const r = b % a; const m = x - u * q; // prettier-ignore b = a, a = r, x = u, u = m; } const gcd = b; if (gcd !== _1n$2) throw new Error('invert: does not exist'); return mod(x, modulo); } function assertIsSquare(Fp, root, n) { if (!Fp.eql(Fp.sqr(root), n)) throw new Error('Cannot find square root'); } // Not all roots are possible! Example which will throw: // const NUM = // n = 72057594037927816n; // Fp = Field(BigInt('0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab')); function sqrt3mod4(Fp, n) { const p1div4 = (Fp.ORDER + _1n$2) / _4n$1; const root = Fp.pow(n, p1div4); assertIsSquare(Fp, root, n); return root; } function sqrt5mod8(Fp, n) { const p5div8 = (Fp.ORDER - _5n) / _8n; const n2 = Fp.mul(n, _2n$2); const v = Fp.pow(n2, p5div8); const nv = Fp.mul(n, v); const i = Fp.mul(Fp.mul(nv, _2n$2), v); const root = Fp.mul(nv, Fp.sub(i, Fp.ONE)); assertIsSquare(Fp, root, n); return root; } // Based on RFC9380, Kong algorithm // prettier-ignore function sqrt9mod16(P) { const Fp_ = Field(P); const tn = tonelliShanks(P); const c1 = tn(Fp_, Fp_.neg(Fp_.ONE)); // 1. c1 = sqrt(-1) in F, i.e., (c1^2) == -1 in F const c2 = tn(Fp_, c1); // 2. c2 = sqrt(c1) in F, i.e., (c2^2) == c1 in F const c3 = tn(Fp_, Fp_.neg(c1)); // 3. c3 = sqrt(-c1) in F, i.e., (c3^2) == -c1 in F const c4 = (P + _7n) / _16n; // 4. c4 = (q + 7) / 16 # Integer arithmetic return (Fp, n) => { let tv1 = Fp.pow(n, c4); // 1. tv1 = x^c4 let tv2 = Fp.mul(tv1, c1); // 2. tv2 = c1 * tv1 const tv3 = Fp.mul(tv1, c2); // 3. tv3 = c2 * tv1 const tv4 = Fp.mul(tv1, c3); // 4. tv4 = c3 * tv1 const e1 = Fp.eql(Fp.sqr(tv2), n); // 5. e1 = (tv2^2) == x const e2 = Fp.eql(Fp.sqr(tv3), n); // 6. e2 = (tv3^2) == x tv1 = Fp.cmov(tv1, tv2, e1); // 7. tv1 = CMOV(tv1, tv2, e1) # Select tv2 if (tv2^2) == x tv2 = Fp.cmov(tv4, tv3, e2); // 8. tv2 = CMOV(tv4, tv3, e2) # Select tv3 if (tv3^2) == x const e3 = Fp.eql(Fp.sqr(tv2), n); // 9. e3 = (tv2^2) == x const root = Fp.cmov(tv1, tv2, e3); // 10. z = CMOV(tv1, tv2, e3) # Select sqrt from tv1 & tv2 assertIsSquare(Fp, root, n); return root; }; } /** * Tonelli-Shanks square root search algorithm. * 1. https://eprint.iacr.org/2012/685.pdf (page 12) * 2. Square Roots from 1; 24, 51, 10 to Dan Shanks * @param P field order * @returns function that takes field Fp (created from P) and number n */ function tonelliShanks(P) { // Initialization (precomputation). // Caching initialization could boost perf by 7%. if (P < _3n$1) throw new Error('sqrt is not defined for small field'); // Factor P - 1 = Q * 2^S, where Q is odd let Q = P - _1n$2; let S = 0; while (Q % _2n$2 === _0n$2) { Q /= _2n$2; S++; } // Find the first quadratic non-residue Z >= 2 let Z = _2n$2; const _Fp = Field(P); while (FpLegendre(_Fp, Z) === 1) { // Basic primality test for P. After x iterations, chance of // not finding quadratic non-residue is 2^x, so 2^1000. if (Z++ > 1000) throw new Error('Cannot find square root: probably non-prime P'); } // Fast-path; usually done before Z, but we do "primality test". if (S === 1) return sqrt3mod4; // Slow-path // TODO: test on Fp2 and others let cc = _Fp.pow(Z, Q); // c = z^Q const Q1div2 = (Q + _1n$2) / _2n$2; return function tonelliSlow(Fp, n) { if (Fp.is0(n)) return n; // Check if n is a quadratic residue using Legendre symbol if (FpLegendre(Fp, n) !== 1) throw new Error('Cannot find square root'); // Initialize variables for the main loop let M = S; let c = Fp.mul(Fp.ONE, cc); // c = z^Q, move cc from field _Fp into field Fp let t = Fp.pow(n, Q); // t = n^Q, first guess at the fudge factor let R = Fp.pow(n, Q1div2); // R = n^((Q+1)/2), first guess at the square root // Main loop // while t != 1 while (!Fp.eql(t, Fp.ONE)) { if (Fp.is0(t)) return Fp.ZERO; // if t=0 return R=0 let i = 1; // Find the smallest i >= 1 such that t^(2^i) ≡ 1 (mod P) let t_tmp = Fp.sqr(t); // t^(2^1) while (!Fp.eql(t_tmp, Fp.ONE)) { i++; t_tmp = Fp.sqr(t_tmp); // t^(2^2)... if (i === M) throw new Error('Cannot find square root'); } // Calculate the exponent for b: 2^(M - i - 1) const exponent = _1n$2 << BigInt(M - i - 1); // bigint is important const b = Fp.pow(c, exponent); // b = 2^(M - i - 1) // Update variables M = i; c = Fp.sqr(b); // c = b^2 t = Fp.mul(t, c); // t = (t * b^2) R = Fp.mul(R, b); // R = R*b } return R; }; } /** * Square root for a finite field. Will try optimized versions first: * * 1. P ≡ 3 (mod 4) * 2. P ≡ 5 (mod 8) * 3. P ≡ 9 (mod 16) * 4. Tonelli-Shanks algorithm * * Different algorithms can give different roots, it is up to user to decide which one they want. * For example there is FpSqrtOdd/FpSqrtEven to choice root based on oddness (used for hash-to-curve). */ function FpSqrt(P) { // P ≡ 3 (mod 4) => √n = n^((P+1)/4) if (P % _4n$1 === _3n$1) return sqrt3mod4; // P ≡ 5 (mod 8) => Atkin algorithm, page 10 of https://eprint.iacr.org/2012/685.pdf if (P % _8n === _5n) return sqrt5mod8; // P ≡ 9 (mod 16) => Kong algorithm, page 11 of https://eprint.iacr.org/2012/685.pdf (algorithm 4) if (P % _16n === _9n) return sqrt9mod16(P); // Tonelli-Shanks algorithm return tonelliShanks(P); } // prettier-ignore const FIELD_FIELDS = [ 'create', 'isValid', 'is0', 'neg', 'inv', 'sqrt', 'sqr', 'eql', 'add', 'sub', 'mul', 'pow', 'div', 'addN', 'subN', 'mulN', 'sqrN' ]; function validateField(field) { const initial = { ORDER: 'bigint', BYTES: 'number', BITS: 'number', }; const opts = FIELD_FIELDS.reduce((map, val) => { map[val] = 'function'; return map; }, initial); validateObject(field, opts); // const max = 16384; // if (field.BYTES < 1 || field.BYTES > max) throw new Error('invalid field'); // if (field.BITS < 1 || field.BITS > 8 * max) throw new Error('invalid field'); return field; } // Generic field functions /** * Same as `pow` but for Fp: non-constant-time. * Unsafe in some contexts: uses ladder, so can expose bigint bits. */ function FpPow(Fp, num, power) { if (power < _0n$2) throw new Error('invalid exponent, negatives unsupported'); if (power === _0n$2) return Fp.ONE; if (power === _1n$2) return num; let p = Fp.ONE; let d = num; while (power > _0n$2) { if (power & _1n$2) p = Fp.mul(p, d); d = Fp.sqr(d); power >>= _1n$2; } return p; } /** * Efficiently invert an array of Field elements. * Exception-free. Will return `undefined` for 0 elements. * @param passZero map 0 to 0 (instead of undefined) */ function FpInvertBatch(Fp, nums, passZero = false) { const inverted = new Array(nums.length).fill(passZero ? Fp.ZERO : undefined); // Walk from first to last, multiply them by each other MOD p const multipliedAcc = nums.reduce((acc, num, i) => { if (Fp.is0(num)) return acc; inverted[i] = acc; return Fp.mul(acc, num); }, Fp.ONE); // Invert last element const invertedAcc = Fp.inv(multipliedAcc); // Walk from last to first, multiply them by inverted each other MOD p nums.reduceRight((acc, num, i) => { if (Fp.is0(num)) return acc; inverted[i] = Fp.mul(acc, inverted[i]); return Fp.mul(acc, num); }, invertedAcc); return inverted; } /** * Legendre symbol. * Legendre constant is used to calculate Legendre symbol (a | p) * which denotes the value of a^((p-1)/2) (mod p). * * * (a | p) ≡ 1 if a is a square (mod p), quadratic residue * * (a | p) ≡ -1 if a is not a square (mod p), quadratic non residue * * (a | p) ≡ 0 if a ≡ 0 (mod p) */ function FpLegendre(Fp, n) { // We can use 3rd argument as optional cache of this value // but seems unneeded for now. The operation is very fast. const p1mod2 = (Fp.ORDER - _1n$2) / _2n$2; const powered = Fp.pow(n, p1mod2); const yes = Fp.eql(powered, Fp.ONE); const zero = Fp.eql(powered, Fp.ZERO); const no = Fp.eql(powered, Fp.neg(Fp.ONE)); if (!yes && !zero && !no) throw new Error('invalid Legendre symbol result'); return yes ? 1 : zero ? 0 : -1; } // CURVE.n lengths function nLength(n, nBitLength) { // Bit size, byte size of CURVE.n if (nBitLength !== undefined) anumber(nBitLength); const _nBitLength = nBitLength !== undefined ? nBitLength : n.toString(2).length; const nByteLength = Math.ceil(_nBitLength / 8); return { nBitLength: _nBitLength, nByteLength }; } class _Field { ORDER; BITS; BYTES; isLE; ZERO = _0n$2; ONE = _1n$2; _lengths; _sqrt; // cached sqrt _mod; constructor(ORDER, opts = {}) { if (ORDER <= _0n$2) throw new Error('invalid field: expected ORDER > 0, got ' + ORDER); let _nbitLength = undefined; this.isLE = false; if (opts != null && typeof opts === 'object') { if (typeof opts.BITS === 'number') _nbitLength = opts.BITS; if (typeof opts.sqrt === 'function') this.sqrt = opts.sqrt; if (typeof opts.isLE === 'boolean') this.isLE = opts.isLE; if (opts.allowedLengths) this._lengths = opts.allowedLengths?.slice(); if (typeof opts.modFromBytes === 'boolean') this._mod = opts.modFromBytes; } const { nBitLength, nByteLength } = nLength(ORDER, _nbitLength); if (nByteLength > 2048) throw new Error('invalid field: expected ORDER of <= 2048 bytes'); this.ORDER = ORDER; this.BITS = nBitLength; this.BYTES = nByteLength; this._sqrt = undefined; Object.preventExtensions(this); } create(num) { return mod(num, this.ORDER); } isValid(num) { if (typeof num !== 'bigint') throw new Error('invalid field element: expected bigint, got ' + typeof num); return _0n$2 <= num && num < this.ORDER; // 0 is valid element, but it's not invertible } is0(num) { return num === _0n$2; } // is valid and invertible isValidNot0(num) { return !this.is0(num) && this.isValid(num); } isOdd(num) { return (num & _1n$2) === _1n$2; } neg(num) { return mod(-num, this.ORDER); } eql(lhs, rhs) { return lhs === rhs; } sqr(num) { return mod(num * num, this.ORDER); } add(lhs, rhs) { return mod(lhs + rhs, this.ORDER); } sub(lhs, rhs) { return mod(lhs - rhs, this.ORDER); } mul(lhs, rhs) { return mod(lhs * rhs, this.ORDER); } pow(num, power) { return FpPow(this, num, power); } div(lhs, rhs) { return mod(lhs * invert(rhs, this.ORDER), this.ORDER); } // Same as above, but doesn't normalize sqrN(num) { return num * num; } addN(lhs, rhs) { return lhs + rhs; } subN(lhs, rhs) { return lhs - rhs; } mulN(lhs, rhs) { return lhs * rhs; } inv(num) { return invert(num, this.ORDER); } sqrt(num) { // Caching _sqrt speeds up sqrt9mod16 by 5x and tonneli-shanks by 10% if (!this._sqrt) this._sqrt = FpSqrt(this.ORDER); return this._sqrt(this, num); } toBytes(num) { return this.isLE ? numberToBytesLE(num, this.BYTES) : numberToBytesBE(num, this.BYTES); } fromBytes(bytes, skipValidation = false) { abytes(bytes); const { _lengths: allowedLengths, BYTES, isLE, ORDER, _mod: modFromBytes } = this; if (allowedLengths) { if (!allowedLengths.includes(bytes.length) || bytes.length > BYTES) { throw new Error('Field.fromBytes: expected ' + allowedLengths + ' bytes, got ' + bytes.length); } const padded = new Uint8Array(BYTES); // isLE add 0 to right, !isLE to the left. padded.set(bytes, isLE ? 0 : padded.length - bytes.length); bytes = padded; } if (bytes.length !== BYTES) throw new Error('Field.fromBytes: expected ' + BYTES + ' bytes, got ' + bytes.length); let scalar = isLE ? bytesToNumberLE(bytes) : bytesToNumberBE(bytes); if (modFromBytes) scalar = mod(scalar, ORDER); if (!skipValidation) if (!this.isValid(scalar)) throw new Error('invalid field element: outside of range 0..ORDER'); // NOTE: we don't validate scalar here, please use isValid. This done such way because some // protocol may allow non-reduced scalar that reduced later or changed some other way. return scalar; } // TODO: we don't need it here, move out to separate fn invertBatch(lst) { return FpInvertBatch(this, lst); } // We can't move this out because Fp6, Fp12 implement it // and it's unclear what to return in there. cmov(a, b, condition) { return condition ? b : a; } } /** * Creates a finite field. Major performance optimizations: * * 1. Denormalized operations like mulN instead of mul. * * 2. Identical object shape: never add or remove keys. * * 3. `Object.freeze`. * Fragile: always run a benchmark on a change. * Security note: operations don't check 'isValid' for all elements for performance reasons, * it is caller responsibility to check this. * This is low-level code, please make sure you know what you're doing. * * Note about field properties: * * CHARACTERISTIC p = prime number, number of elements in main subgroup. * * ORDER q = similar to cofactor in curves, may be composite `q = p^m`. * * @param ORDER field order, probably prime, or could be composite * @param bitLen how many bits the field consumes * @param isLE (default: false) if encoding / decoding should be in little-endian * @param redef optional faster redefinitions of sqrt and other methods */ function Field(ORDER, opts = {}) { return new _Field(ORDER, opts); } /** * Returns total number of bytes consumed by the field element. * For example, 32 bytes for usual 256-bit weierstrass curve. * @param fieldOrder number of field elements, usually CURVE.n * @returns byte length of field */ function getFieldBytesLength(fieldOrder) { if (typeof fieldOrder !== 'bigint') throw new Error('field order must be bigint'); const bitLength = fieldOrder.toString(2).length; return Math.ceil(bitLength / 8); } /** * Returns minimal amount of bytes that can be safely reduced * by field order. * Should be 2^-128 for 128-bit curve such as P256. * @param fieldOrder number of field elements, usually CURVE.n * @returns byte length of target hash */ function getMinHashLength(fieldOrder) { const length = getFieldBytesLength(fieldOrder); return length + Math.ceil(length / 2); } /** * "Constant-time" private key generation utility. * Can take (n + n/2) or more bytes of uniform input e.g. from CSPRNG or KDF * and convert them into private scalar, with the modulo bias being negligible. * Needs at least 48 bytes of input for 32-byte private key. * https://research.kudelskisecurity.com/2020/07/28/the-definitive-guide-to-modulo-bias-and-how-to-avoid-it/ * FIPS 186-5, A.2 https://csrc.nist.gov/publications/detail/fips/186/5/final * RFC 9380, https://www.rfc-editor.org/rfc/rfc9380#section-5 * @param hash hash output from SHA3 or a similar function * @param groupOrder size of subgroup - (e.g. secp256k1.Point.Fn.ORDER) * @param isLE interpret hash bytes as LE num * @returns valid private scalar */ function mapHashToField(key, fieldOrder, isLE = false) { abytes(key); const len = key.length; const fieldLen = getFieldBytesLength(fieldOrder); const minLen = getMinHashLength(fieldOrder); // No small numbers: need to understand bias story. No huge numbers: easier to detect JS timings. if (len < 16 || len < minLen || len > 1024) throw new Error('expected ' + minLen + '-1024 bytes of input, got ' + len); const num = isLE ? bytesToNumberLE(key) : bytesToNumberBE(key); // `mod(x, 11)` can sometimes produce 0. `mod(x, 10) + 1` is the same, but no 0 const reduced = mod(num, fieldOrder - _1n$2) + _1n$2; return isLE ? numberToBytesLE(reduced, fieldLen) : numberToBytesBE(reduced, fieldLen); } /** * Methods for elliptic curve multiplication by scalars. * Contains wNAF, pippenger. * @module */ /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */ const _0n$1 = /* @__PURE__ */ BigInt(0); const _1n$1 = /* @__PURE__ */ BigInt(1); function negateCt(condition, item) { const neg = item.negate(); return condition ? neg : item; } /** * Takes a bunch of Projective Points but executes only one * inversion on all of them. Inversion is very slow operation, * so this improves performance massively. * Optimization: converts a list of projective points to a list of identical points with Z=1. */ function normalizeZ(c, points) { const invertedZs = FpInvertBatch(c.Fp, points.map((p) => p.Z)); return points.map((p, i) => c.fromAffine(p.toAffine(invertedZs[i]))); } function validateW(W, bits) { if (!Number.isSafeInteger(W) || W <= 0 || W > bits) throw new Error('invalid window size, expected [1..' + bits + '], got W=' + W); } function calcWOpts(W, scalarBits) { validateW(W, scalarBits); const windows = Math.ceil(scalarBits / W) + 1; // W=8 33. Not 32, because we skip zero const windowSize = 2 ** (W - 1); // W=8 128. Not 256, because we skip zero const maxNumber = 2 ** W; // W=8 256 const mask = bitMask(W); // W=8 255 == mask 0b11111111 const shiftBy = BigInt(W); // W=8 8 return { windows, windowSize, mask, maxNumber, shiftBy }; } function calcOffsets(n, window, wOpts) { const { windowSize, mask, maxNumber, shiftBy } = wOpts; let wbits = Number(n & mask); // extract W bits. let nextN = n >> shiftBy; // shift number by W bits. // What actually happens here: // const highestBit = Number(mask ^ (mask >> 1n)); // let wbits2 = wbits - 1; // skip zero // if (wbits2 & highestBit) { wbits2 ^= Number(mask); // (~); // split if bits > max: +224 => 256-32 if (wbits > windowSize) { // we skip zero, which means instead of `>= size-1`, we do `> size` wbits -= maxNumber; // -32, can be maxNumber - wbits, but then we need to set isNeg here. nextN += _1n$1; // +256 (carry) } const offsetStart = window * windowSize; const offset = offsetStart + Math.abs(wbits) - 1; // -1 because we skip zero const isZero = wbits === 0; // is current window slice a 0? const isNeg = wbits < 0; // is current window slice negative? const isNegF = window % 2 !== 0; // fake random statement for noise const offsetF = offsetStart; // fake offset for noise return { nextN, offset, isZero, isNeg, isNegF, offsetF }; } // Since points in different groups cannot be equal (different object constructor), // we can have single place to store precomputes. // Allows to make points frozen / immutable. const pointPrecomputes = new WeakMap(); const pointWindowSizes = new WeakMap(); function getW(P) { // To disable precomputes: // return 1; return pointWindowSizes.get(P) || 1; } function assert0(n) { if (n !== _0n$1) throw new Error('invalid wNAF'); } /** * Elliptic curve multiplication of Point by scalar. Fragile. * Table generation takes **30MB of ram and 10ms on high-end CPU**, * but may take much longer on slow devices. Actual generation will happen on * first call of `multiply()`. By default, `BASE` point is precomputed. * * Scalars should always be less than curve order: this should be checked inside of a curve itself. * Creates precomputation tables for fast multiplication: * - private scalar is split by fixed size windows of W bits * - every window point is collected from window's table & added to accumulator * - since windows are different, same point inside tables won't be accessed more than once per calc * - each multiplication is 'Math.ceil(CURVE_ORDER / 𝑊) + 1' point additions (fixed for any scalar) * - +1 window is neccessary for wNAF * - wNAF reduces table size: 2x less memory + 2x faster generation, but 10% slower multiplication * * @todo Research returning 2d JS array of windows, instead of a single window. * This would allow windows to be in different memory locations */ class wNAF { BASE; ZERO; Fn; bits; // Parametrized with a given Point class (not individual point) constructor(Point, bits) { this.BASE = Point.BASE; this.ZERO = Point.ZERO; this.Fn = Point.Fn; this.bits = bits; } // non-const time multiplication ladder _unsafeLadder(elm, n, p = this.ZERO) { let d = elm; while (n > _0n$1) { if (n & _1n$1) p = p.add(d); d = d.double(); n >>= _1n$1; } return p; } /** * Creates a wNAF precomputation window. Used for caching. * Default window size is set by `utils.precompute()` and is equal to 8. * Number of precomputed points depends on the curve size: * 2^(𝑊−1) * (Math.ceil(𝑛 / 𝑊) + 1), where: * - 𝑊 is the window size * - 𝑛 is the bitlength of the curve order. * For a 256-bit curve and window size 8, the number of precomputed points is 128 * 33 = 4224. * @param point Point instance * @param W window size * @returns precomputed point tables flattened to a single array */ precomputeWindow(point, W) { const { windows, windowSize } = calcWOpts(W, this.bits); const points = []; let p = point; let base = p; for (let window = 0; window < windows; window++) { base = p; points.push(base); // i=1, bc we skip 0 for (let i = 1; i < windowSize; i++) { base = base.add(p); points.push(base); } p = base.double(); } return points; } /** * Implements ec multiplication using precomputed tables and w-ary non-adjacent form. * More compact implementation: * https://github.com/paulmillr/noble-secp256k1/blob/47cb1669b6e506ad66b35fe7d76132ae97465da2/index.ts#L502-L541 * @returns real and fake (for const-time) points */ wNAF(W, precomputes, n) { // Scalar should be smaller than field order if (!this.Fn.isValid(n)) throw new Error('invalid scalar'); // Accumulators let p = this.ZERO; let f = this.BASE; // This code was first written with assumption that 'f' and 'p' will never be infinity point: // since each addition is multiplied by 2 ** W, it cannot cancel each other. However, // there is negate now: it is possible that negated element from low value // would be the same as high element, which will create carry into next window. // It's not obvious how this can fail, but still worth investigating later. const wo = calcWOpts(W, this.bits); for (let window = 0; window < wo.windows; window++) { // (n === _0n) is handled and not early-exited. isEven and offsetF are used for noise const { nextN, offset, isZero, isNeg, isNegF, offsetF } = calcOffsets(n, window, wo); n = nextN; if (isZero) { // bits are 0: add garbage to fake point // Important part for const-time getPublicKey: add random "noise" point to f. f = f.add(negateCt(isNegF, precomputes[offsetF])); } else {