UNPKG

opnet

Version:

The perfect library for building Bitcoin-based applications.

1,226 lines (1,211 loc) 250 kB
import { r as requireUtils$2, a as requireHmac, b as requireSha2, c as bytesToHex, i as isBytes, h as hexToBytes, d as abytes, e as concatBytes, f as anumber, g as ahash, j as randomBytes, k as hmac, s as sha256 } from './noble-hashes.js'; function getDefaultExportFromCjs(x) { return x && x.__esModule && Object.prototype.hasOwnProperty.call(x, "default") ? x["default"] : x; } function getAugmentedNamespace(n) { if (Object.prototype.hasOwnProperty.call(n, "__esModule")) return n; var f = n.default; if (typeof f == "function") { var a = function a2() { var isInstance = false; try { isInstance = this instanceof a2; } catch { } if (isInstance) { return Reflect.construct(f, arguments, this.constructor); } return f.apply(this, arguments); }; a.prototype = f.prototype; } else a = {}; Object.defineProperty(a, "__esModule", { value: true }); Object.keys(n).forEach(function(k) { var d = Object.getOwnPropertyDescriptor(n, k); Object.defineProperty(a, k, d.get ? d : { enumerable: true, get: function() { return n[k]; } }); }); return a; } var secp256k1$1 = {}; var _shortw_utils = {}; var weierstrass$1 = {}; var utils$1 = {}; var hasRequiredUtils$1; function requireUtils$1 () { if (hasRequiredUtils$1) return utils$1; hasRequiredUtils$1 = 1; (function (exports$1) { Object.defineProperty(exports$1, "__esModule", { value: true }); exports$1.notImplemented = exports$1.bitMask = exports$1.utf8ToBytes = exports$1.randomBytes = exports$1.isBytes = exports$1.hexToBytes = exports$1.concatBytes = exports$1.bytesToUtf8 = exports$1.bytesToHex = exports$1.anumber = exports$1.abytes = void 0; exports$1.abool = abool; exports$1._abool2 = _abool2; exports$1._abytes2 = _abytes2; exports$1.numberToHexUnpadded = numberToHexUnpadded; exports$1.hexToNumber = hexToNumber; exports$1.bytesToNumberBE = bytesToNumberBE; exports$1.bytesToNumberLE = bytesToNumberLE; exports$1.numberToBytesBE = numberToBytesBE; exports$1.numberToBytesLE = numberToBytesLE; exports$1.numberToVarBytesBE = numberToVarBytesBE; exports$1.ensureBytes = ensureBytes; exports$1.equalBytes = equalBytes; exports$1.copyBytes = copyBytes; exports$1.asciiToBytes = asciiToBytes; exports$1.inRange = inRange; exports$1.aInRange = aInRange; exports$1.bitLen = bitLen; exports$1.bitGet = bitGet; exports$1.bitSet = bitSet; exports$1.createHmacDrbg = createHmacDrbg; exports$1.validateObject = validateObject; exports$1.isHash = isHash; exports$1._validateObject = _validateObject; exports$1.memoized = memoized; /** * Hex, bytes and number utilities. * @module */ /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */ const utils_js_1 = /*@__PURE__*/ requireUtils$2(); var utils_js_2 = /*@__PURE__*/ requireUtils$2(); Object.defineProperty(exports$1, "abytes", { enumerable: true, get: function () { return utils_js_2.abytes; } }); Object.defineProperty(exports$1, "anumber", { enumerable: true, get: function () { return utils_js_2.anumber; } }); Object.defineProperty(exports$1, "bytesToHex", { enumerable: true, get: function () { return utils_js_2.bytesToHex; } }); Object.defineProperty(exports$1, "bytesToUtf8", { enumerable: true, get: function () { return utils_js_2.bytesToUtf8; } }); Object.defineProperty(exports$1, "concatBytes", { enumerable: true, get: function () { return utils_js_2.concatBytes; } }); Object.defineProperty(exports$1, "hexToBytes", { enumerable: true, get: function () { return utils_js_2.hexToBytes; } }); Object.defineProperty(exports$1, "isBytes", { enumerable: true, get: function () { return utils_js_2.isBytes; } }); Object.defineProperty(exports$1, "randomBytes", { enumerable: true, get: function () { return utils_js_2.randomBytes; } }); Object.defineProperty(exports$1, "utf8ToBytes", { enumerable: true, get: function () { return utils_js_2.utf8ToBytes; } }); const _0n = /* @__PURE__ */ BigInt(0); const _1n = /* @__PURE__ */ BigInt(1); function abool(title, value) { if (typeof value !== 'boolean') throw new Error(title + ' boolean expected, got ' + value); } // tmp name until v2 function _abool2(value, title = '') { if (typeof value !== 'boolean') { const prefix = title && `"${title}"`; throw new Error(prefix + 'expected boolean, got type=' + typeof value); } return value; } // tmp name until v2 /** Asserts something is Uint8Array. */ function _abytes2(value, length, title = '') { const bytes = (0, utils_js_1.isBytes)(value); const len = value?.length; const needsLen = length !== undefined; if (!bytes || (needsLen && len !== length)) { const prefix = title && `"${title}" `; const ofLen = needsLen ? ` of length ${length}` : ''; const got = bytes ? `length=${len}` : `type=${typeof value}`; throw new Error(prefix + 'expected Uint8Array' + ofLen + ', got ' + got); } return value; } // Used in weierstrass, der function numberToHexUnpadded(num) { const hex = num.toString(16); return hex.length & 1 ? '0' + hex : hex; } function hexToNumber(hex) { if (typeof hex !== 'string') throw new Error('hex string expected, got ' + typeof hex); return hex === '' ? _0n : BigInt('0x' + hex); // Big Endian } // BE: Big Endian, LE: Little Endian function bytesToNumberBE(bytes) { return hexToNumber((0, utils_js_1.bytesToHex)(bytes)); } function bytesToNumberLE(bytes) { (0, utils_js_1.abytes)(bytes); return hexToNumber((0, utils_js_1.bytesToHex)(Uint8Array.from(bytes).reverse())); } function numberToBytesBE(n, len) { return (0, utils_js_1.hexToBytes)(n.toString(16).padStart(len * 2, '0')); } function numberToBytesLE(n, len) { return numberToBytesBE(n, len).reverse(); } // Unpadded, rarely used function numberToVarBytesBE(n) { return (0, utils_js_1.hexToBytes)(numberToHexUnpadded(n)); } /** * Takes hex string or Uint8Array, converts to Uint8Array. * Validates output length. * Will throw error for other types. * @param title descriptive title for an error e.g. 'secret key' * @param hex hex string or Uint8Array * @param expectedLength optional, will compare to result array's length * @returns */ function ensureBytes(title, hex, expectedLength) { let res; if (typeof hex === 'string') { try { res = (0, utils_js_1.hexToBytes)(hex); } catch (e) { throw new Error(title + ' must be hex string or Uint8Array, cause: ' + e); } } else if ((0, utils_js_1.isBytes)(hex)) { // Uint8Array.from() instead of hash.slice() because node.js Buffer // is instance of Uint8Array, and its slice() creates **mutable** copy res = Uint8Array.from(hex); } else { throw new Error(title + ' must be hex string or Uint8Array'); } const len = res.length; if (typeof expectedLength === 'number' && len !== expectedLength) throw new Error(title + ' of length ' + expectedLength + ' expected, got ' + len); return res; } // Compares 2 u8a-s in kinda constant time function equalBytes(a, b) { if (a.length !== b.length) return false; let diff = 0; for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i]; return diff === 0; } /** * Copies Uint8Array. We can't use u8a.slice(), because u8a can be Buffer, * and Buffer#slice creates mutable copy. Never use Buffers! */ function copyBytes(bytes) { return Uint8Array.from(bytes); } /** * Decodes 7-bit ASCII string to Uint8Array, throws on non-ascii symbols * Should be safe to use for things expected to be ASCII. * Returns exact same result as utf8ToBytes for ASCII or throws. */ function asciiToBytes(ascii) { return Uint8Array.from(ascii, (c, i) => { const charCode = c.charCodeAt(0); if (c.length !== 1 || charCode > 127) { throw new Error(`string contains non-ASCII character "${ascii[i]}" with code ${charCode} at position ${i}`); } return charCode; }); } /** * @example utf8ToBytes('abc') // new Uint8Array([97, 98, 99]) */ // export const utf8ToBytes: typeof utf8ToBytes_ = utf8ToBytes_; /** * Converts bytes to string using UTF8 encoding. * @example bytesToUtf8(Uint8Array.from([97, 98, 99])) // 'abc' */ // export const bytesToUtf8: typeof bytesToUtf8_ = bytesToUtf8_; // Is positive bigint const isPosBig = (n) => typeof n === 'bigint' && _0n <= n; function inRange(n, min, max) { return isPosBig(n) && isPosBig(min) && isPosBig(max) && min <= n && n < max; } /** * Asserts min <= n < max. NOTE: It's < max and not <= max. * @example * aInRange('x', x, 1n, 256n); // would assume x is in (1n..255n) */ function aInRange(title, n, min, max) { // Why min <= n < max and not a (min < n < max) OR b (min <= n <= max)? // consider P=256n, min=0n, max=P // - a for min=0 would require -1: `inRange('x', x, -1n, P)` // - b would commonly require subtraction: `inRange('x', x, 0n, P - 1n)` // - our way is the cleanest: `inRange('x', x, 0n, P) if (!inRange(n, min, max)) throw new Error('expected valid ' + title + ': ' + min + ' <= n < ' + max + ', got ' + n); } // Bit operations /** * Calculates amount of bits in a bigint. * Same as `n.toString(2).length` * TODO: merge with nLength in modular */ function bitLen(n) { let len; for (len = 0; n > _0n; n >>= _1n, len += 1) ; return len; } /** * Gets single bit at position. * NOTE: first bit position is 0 (same as arrays) * Same as `!!+Array.from(n.toString(2)).reverse()[pos]` */ function bitGet(n, pos) { return (n >> BigInt(pos)) & _1n; } /** * Sets single bit at position. */ function bitSet(n, pos, value) { return n | ((value ? _1n : _0n) << BigInt(pos)); } /** * Calculate mask for N bits. Not using ** operator with bigints because of old engines. * Same as BigInt(`0b${Array(i).fill('1').join('')}`) */ const bitMask = (n) => (_1n << BigInt(n)) - _1n; exports$1.bitMask = bitMask; /** * Minimal HMAC-DRBG from NIST 800-90 for RFC6979 sigs. * @returns function that will call DRBG until 2nd arg returns something meaningful * @example * const drbg = createHmacDRBG<Key>(32, 32, hmac); * drbg(seed, bytesToKey); // bytesToKey must return Key or undefined */ function createHmacDrbg(hashLen, qByteLen, hmacFn) { if (typeof hashLen !== 'number' || hashLen < 2) throw new Error('hashLen must be a number'); if (typeof qByteLen !== 'number' || qByteLen < 2) throw new Error('qByteLen must be a number'); if (typeof hmacFn !== 'function') throw new Error('hmacFn must be a function'); // Step B, Step C: set hashLen to 8*ceil(hlen/8) const u8n = (len) => new Uint8Array(len); // creates Uint8Array const u8of = (byte) => Uint8Array.of(byte); // another shortcut let v = u8n(hashLen); // Minimal non-full-spec HMAC-DRBG from NIST 800-90 for RFC6979 sigs. let k = u8n(hashLen); // Steps B and C of RFC6979 3.2: set hashLen, in our case always same let i = 0; // Iterations counter, will throw when over 1000 const reset = () => { v.fill(1); k.fill(0); i = 0; }; const h = (...b) => hmacFn(k, v, ...b); // hmac(k)(v, ...values) const reseed = (seed = u8n(0)) => { // HMAC-DRBG reseed() function. Steps D-G k = h(u8of(0x00), seed); // k = hmac(k || v || 0x00 || seed) v = h(); // v = hmac(k || v) if (seed.length === 0) return; k = h(u8of(0x01), seed); // k = hmac(k || v || 0x01 || seed) v = h(); // v = hmac(k || v) }; const gen = () => { // HMAC-DRBG generate() function if (i++ >= 1000) throw new Error('drbg: tried 1000 values'); let len = 0; const out = []; while (len < qByteLen) { v = h(); const sl = v.slice(); out.push(sl); len += v.length; } return (0, utils_js_1.concatBytes)(...out); }; const genUntil = (seed, pred) => { reset(); reseed(seed); // Steps D-G let res = undefined; // Step H: grind until k is in [1..n-1] while (!(res = pred(gen()))) reseed(); reset(); return res; }; return genUntil; } // Validating curves and fields const validatorFns = { bigint: (val) => typeof val === 'bigint', function: (val) => typeof val === 'function', boolean: (val) => typeof val === 'boolean', string: (val) => typeof val === 'string', stringOrUint8Array: (val) => typeof val === 'string' || (0, utils_js_1.isBytes)(val), isSafeInteger: (val) => Number.isSafeInteger(val), array: (val) => Array.isArray(val), field: (val, object) => object.Fp.isValid(val), hash: (val) => typeof val === 'function' && Number.isSafeInteger(val.outputLen), }; // type Record<K extends string | number | symbol, T> = { [P in K]: T; } function validateObject(object, validators, optValidators = {}) { const checkField = (fieldName, type, isOptional) => { const checkVal = validatorFns[type]; if (typeof checkVal !== 'function') throw new Error('invalid validator function'); const val = object[fieldName]; if (isOptional && val === undefined) return; if (!checkVal(val, object)) { throw new Error('param ' + String(fieldName) + ' is invalid. Expected ' + type + ', got ' + val); } }; for (const [fieldName, type] of Object.entries(validators)) checkField(fieldName, type, false); for (const [fieldName, type] of Object.entries(optValidators)) checkField(fieldName, type, true); return object; } // validate type tests // const o: { a: number; b: number; c: number } = { a: 1, b: 5, c: 6 }; // const z0 = validateObject(o, { a: 'isSafeInteger' }, { c: 'bigint' }); // Ok! // // Should fail type-check // const z1 = validateObject(o, { a: 'tmp' }, { c: 'zz' }); // const z2 = validateObject(o, { a: 'isSafeInteger' }, { c: 'zz' }); // const z3 = validateObject(o, { test: 'boolean', z: 'bug' }); // const z4 = validateObject(o, { a: 'boolean', z: 'bug' }); function isHash(val) { return typeof val === 'function' && Number.isSafeInteger(val.outputLen); } function _validateObject(object, fields, optFields = {}) { if (!object || typeof object !== 'object') throw new Error('expected valid options object'); function checkField(fieldName, expectedType, isOpt) { const val = object[fieldName]; if (isOpt && val === undefined) return; const current = typeof val; if (current !== expectedType || val === null) throw new Error(`param "${fieldName}" is invalid: expected ${expectedType}, got ${current}`); } Object.entries(fields).forEach(([k, v]) => checkField(k, v, false)); Object.entries(optFields).forEach(([k, v]) => checkField(k, v, true)); } /** * throws not implemented error */ const notImplemented = () => { throw new Error('not implemented'); }; exports$1.notImplemented = notImplemented; /** * Memoizes (caches) computation result. * Uses WeakMap: the value is going auto-cleaned by GC after last reference is removed. */ function memoized(fn) { const map = new WeakMap(); return (arg, ...args) => { const val = map.get(arg); if (val !== undefined) return val; const computed = fn(arg, ...args); map.set(arg, computed); return computed; }; } } (utils$1)); return utils$1; } var curve = {}; var modular = {}; var hasRequiredModular; function requireModular () { if (hasRequiredModular) return modular; hasRequiredModular = 1; Object.defineProperty(modular, "__esModule", { value: true }); modular.isNegativeLE = void 0; modular.mod = mod; modular.pow = pow; modular.pow2 = pow2; modular.invert = invert; modular.tonelliShanks = tonelliShanks; modular.FpSqrt = FpSqrt; modular.validateField = validateField; modular.FpPow = FpPow; modular.FpInvertBatch = FpInvertBatch; modular.FpDiv = FpDiv; modular.FpLegendre = FpLegendre; modular.FpIsSquare = FpIsSquare; modular.nLength = nLength; modular.Field = Field; modular.FpSqrtOdd = FpSqrtOdd; modular.FpSqrtEven = FpSqrtEven; modular.hashToPrivateScalar = hashToPrivateScalar; modular.getFieldBytesLength = getFieldBytesLength; modular.getMinHashLength = getMinHashLength; modular.mapHashToField = mapHashToField; /** * Utils for modular division and fields. * Field over 11 is a finite (Galois) field is integer number operations `mod 11`. * There is no division: it is replaced by modular multiplicative inverse. * @module */ /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */ const utils_ts_1 = /*@__PURE__*/ requireUtils$1(); // prettier-ignore const _0n = BigInt(0), _1n = BigInt(1), _2n = /* @__PURE__ */ BigInt(2), _3n = /* @__PURE__ */ BigInt(3); // prettier-ignore const _4n = /* @__PURE__ */ BigInt(4), _5n = /* @__PURE__ */ BigInt(5), _7n = /* @__PURE__ */ BigInt(7); // prettier-ignore const _8n = /* @__PURE__ */ BigInt(8), _9n = /* @__PURE__ */ BigInt(9), _16n = /* @__PURE__ */ BigInt(16); // Calculates a modulo b function mod(a, b) { const result = a % b; return result >= _0n ? result : b + result; } /** * Efficiently raise num to power and do modular division. * Unsafe in some contexts: uses ladder, so can expose bigint bits. * @example * pow(2n, 6n, 11n) // 64n % 11n == 9n */ function pow(num, power, modulo) { return FpPow(Field(modulo), num, power); } /** Does `x^(2^power)` mod p. `pow2(30, 4)` == `30^(2^4)` */ function pow2(x, power, modulo) { let res = x; while (power-- > _0n) { res *= res; res %= modulo; } return res; } /** * Inverses number over modulo. * Implemented using [Euclidean GCD](https://brilliant.org/wiki/extended-euclidean-algorithm/). */ function invert(number, modulo) { if (number === _0n) throw new Error('invert: expected non-zero number'); if (modulo <= _0n) throw new Error('invert: expected positive modulus, got ' + modulo); // Fermat's little theorem "CT-like" version inv(n) = n^(m-2) mod m is 30x slower. let a = mod(number, modulo); let b = modulo; // prettier-ignore let x = _0n, u = _1n; while (a !== _0n) { // JIT applies optimization if those two lines follow each other const q = b / a; const r = b % a; const m = x - u * q; // prettier-ignore b = a, a = r, x = u, u = m; } const gcd = b; if (gcd !== _1n) throw new Error('invert: does not exist'); return mod(x, modulo); } function assertIsSquare(Fp, root, n) { if (!Fp.eql(Fp.sqr(root), n)) throw new Error('Cannot find square root'); } // Not all roots are possible! Example which will throw: // const NUM = // n = 72057594037927816n; // Fp = Field(BigInt('0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab')); function sqrt3mod4(Fp, n) { const p1div4 = (Fp.ORDER + _1n) / _4n; const root = Fp.pow(n, p1div4); assertIsSquare(Fp, root, n); return root; } function sqrt5mod8(Fp, n) { const p5div8 = (Fp.ORDER - _5n) / _8n; const n2 = Fp.mul(n, _2n); const v = Fp.pow(n2, p5div8); const nv = Fp.mul(n, v); const i = Fp.mul(Fp.mul(nv, _2n), v); const root = Fp.mul(nv, Fp.sub(i, Fp.ONE)); assertIsSquare(Fp, root, n); return root; } // Based on RFC9380, Kong algorithm // prettier-ignore function sqrt9mod16(P) { const Fp_ = Field(P); const tn = tonelliShanks(P); const c1 = tn(Fp_, Fp_.neg(Fp_.ONE)); // 1. c1 = sqrt(-1) in F, i.e., (c1^2) == -1 in F const c2 = tn(Fp_, c1); // 2. c2 = sqrt(c1) in F, i.e., (c2^2) == c1 in F const c3 = tn(Fp_, Fp_.neg(c1)); // 3. c3 = sqrt(-c1) in F, i.e., (c3^2) == -c1 in F const c4 = (P + _7n) / _16n; // 4. c4 = (q + 7) / 16 # Integer arithmetic return (Fp, n) => { let tv1 = Fp.pow(n, c4); // 1. tv1 = x^c4 let tv2 = Fp.mul(tv1, c1); // 2. tv2 = c1 * tv1 const tv3 = Fp.mul(tv1, c2); // 3. tv3 = c2 * tv1 const tv4 = Fp.mul(tv1, c3); // 4. tv4 = c3 * tv1 const e1 = Fp.eql(Fp.sqr(tv2), n); // 5. e1 = (tv2^2) == x const e2 = Fp.eql(Fp.sqr(tv3), n); // 6. e2 = (tv3^2) == x tv1 = Fp.cmov(tv1, tv2, e1); // 7. tv1 = CMOV(tv1, tv2, e1) # Select tv2 if (tv2^2) == x tv2 = Fp.cmov(tv4, tv3, e2); // 8. tv2 = CMOV(tv4, tv3, e2) # Select tv3 if (tv3^2) == x const e3 = Fp.eql(Fp.sqr(tv2), n); // 9. e3 = (tv2^2) == x const root = Fp.cmov(tv1, tv2, e3); // 10. z = CMOV(tv1, tv2, e3) # Select sqrt from tv1 & tv2 assertIsSquare(Fp, root, n); return root; }; } /** * Tonelli-Shanks square root search algorithm. * 1. https://eprint.iacr.org/2012/685.pdf (page 12) * 2. Square Roots from 1; 24, 51, 10 to Dan Shanks * @param P field order * @returns function that takes field Fp (created from P) and number n */ function tonelliShanks(P) { // Initialization (precomputation). // Caching initialization could boost perf by 7%. if (P < _3n) throw new Error('sqrt is not defined for small field'); // Factor P - 1 = Q * 2^S, where Q is odd let Q = P - _1n; let S = 0; while (Q % _2n === _0n) { Q /= _2n; S++; } // Find the first quadratic non-residue Z >= 2 let Z = _2n; const _Fp = Field(P); while (FpLegendre(_Fp, Z) === 1) { // Basic primality test for P. After x iterations, chance of // not finding quadratic non-residue is 2^x, so 2^1000. if (Z++ > 1000) throw new Error('Cannot find square root: probably non-prime P'); } // Fast-path; usually done before Z, but we do "primality test". if (S === 1) return sqrt3mod4; // Slow-path // TODO: test on Fp2 and others let cc = _Fp.pow(Z, Q); // c = z^Q const Q1div2 = (Q + _1n) / _2n; return function tonelliSlow(Fp, n) { if (Fp.is0(n)) return n; // Check if n is a quadratic residue using Legendre symbol if (FpLegendre(Fp, n) !== 1) throw new Error('Cannot find square root'); // Initialize variables for the main loop let M = S; let c = Fp.mul(Fp.ONE, cc); // c = z^Q, move cc from field _Fp into field Fp let t = Fp.pow(n, Q); // t = n^Q, first guess at the fudge factor let R = Fp.pow(n, Q1div2); // R = n^((Q+1)/2), first guess at the square root // Main loop // while t != 1 while (!Fp.eql(t, Fp.ONE)) { if (Fp.is0(t)) return Fp.ZERO; // if t=0 return R=0 let i = 1; // Find the smallest i >= 1 such that t^(2^i) ≡ 1 (mod P) let t_tmp = Fp.sqr(t); // t^(2^1) while (!Fp.eql(t_tmp, Fp.ONE)) { i++; t_tmp = Fp.sqr(t_tmp); // t^(2^2)... if (i === M) throw new Error('Cannot find square root'); } // Calculate the exponent for b: 2^(M - i - 1) const exponent = _1n << BigInt(M - i - 1); // bigint is important const b = Fp.pow(c, exponent); // b = 2^(M - i - 1) // Update variables M = i; c = Fp.sqr(b); // c = b^2 t = Fp.mul(t, c); // t = (t * b^2) R = Fp.mul(R, b); // R = R*b } return R; }; } /** * Square root for a finite field. Will try optimized versions first: * * 1. P ≡ 3 (mod 4) * 2. P ≡ 5 (mod 8) * 3. P ≡ 9 (mod 16) * 4. Tonelli-Shanks algorithm * * Different algorithms can give different roots, it is up to user to decide which one they want. * For example there is FpSqrtOdd/FpSqrtEven to choice root based on oddness (used for hash-to-curve). */ function FpSqrt(P) { // P ≡ 3 (mod 4) => √n = n^((P+1)/4) if (P % _4n === _3n) return sqrt3mod4; // P ≡ 5 (mod 8) => Atkin algorithm, page 10 of https://eprint.iacr.org/2012/685.pdf if (P % _8n === _5n) return sqrt5mod8; // P ≡ 9 (mod 16) => Kong algorithm, page 11 of https://eprint.iacr.org/2012/685.pdf (algorithm 4) if (P % _16n === _9n) return sqrt9mod16(P); // Tonelli-Shanks algorithm return tonelliShanks(P); } // Little-endian check for first LE bit (last BE bit); const isNegativeLE = (num, modulo) => (mod(num, modulo) & _1n) === _1n; modular.isNegativeLE = isNegativeLE; // prettier-ignore const FIELD_FIELDS = [ 'create', 'isValid', 'is0', 'neg', 'inv', 'sqrt', 'sqr', 'eql', 'add', 'sub', 'mul', 'pow', 'div', 'addN', 'subN', 'mulN', 'sqrN' ]; function validateField(field) { const initial = { ORDER: 'bigint', MASK: 'bigint', BYTES: 'number', BITS: 'number', }; const opts = FIELD_FIELDS.reduce((map, val) => { map[val] = 'function'; return map; }, initial); (0, utils_ts_1._validateObject)(field, opts); // const max = 16384; // if (field.BYTES < 1 || field.BYTES > max) throw new Error('invalid field'); // if (field.BITS < 1 || field.BITS > 8 * max) throw new Error('invalid field'); return field; } // Generic field functions /** * Same as `pow` but for Fp: non-constant-time. * Unsafe in some contexts: uses ladder, so can expose bigint bits. */ function FpPow(Fp, num, power) { if (power < _0n) throw new Error('invalid exponent, negatives unsupported'); if (power === _0n) return Fp.ONE; if (power === _1n) return num; let p = Fp.ONE; let d = num; while (power > _0n) { if (power & _1n) p = Fp.mul(p, d); d = Fp.sqr(d); power >>= _1n; } return p; } /** * Efficiently invert an array of Field elements. * Exception-free. Will return `undefined` for 0 elements. * @param passZero map 0 to 0 (instead of undefined) */ function FpInvertBatch(Fp, nums, passZero = false) { const inverted = new Array(nums.length).fill(passZero ? Fp.ZERO : undefined); // Walk from first to last, multiply them by each other MOD p const multipliedAcc = nums.reduce((acc, num, i) => { if (Fp.is0(num)) return acc; inverted[i] = acc; return Fp.mul(acc, num); }, Fp.ONE); // Invert last element const invertedAcc = Fp.inv(multipliedAcc); // Walk from last to first, multiply them by inverted each other MOD p nums.reduceRight((acc, num, i) => { if (Fp.is0(num)) return acc; inverted[i] = Fp.mul(acc, inverted[i]); return Fp.mul(acc, num); }, invertedAcc); return inverted; } // TODO: remove function FpDiv(Fp, lhs, rhs) { return Fp.mul(lhs, typeof rhs === 'bigint' ? invert(rhs, Fp.ORDER) : Fp.inv(rhs)); } /** * Legendre symbol. * Legendre constant is used to calculate Legendre symbol (a | p) * which denotes the value of a^((p-1)/2) (mod p). * * * (a | p) ≡ 1 if a is a square (mod p), quadratic residue * * (a | p) ≡ -1 if a is not a square (mod p), quadratic non residue * * (a | p) ≡ 0 if a ≡ 0 (mod p) */ function FpLegendre(Fp, n) { // We can use 3rd argument as optional cache of this value // but seems unneeded for now. The operation is very fast. const p1mod2 = (Fp.ORDER - _1n) / _2n; const powered = Fp.pow(n, p1mod2); const yes = Fp.eql(powered, Fp.ONE); const zero = Fp.eql(powered, Fp.ZERO); const no = Fp.eql(powered, Fp.neg(Fp.ONE)); if (!yes && !zero && !no) throw new Error('invalid Legendre symbol result'); return yes ? 1 : zero ? 0 : -1; } // This function returns True whenever the value x is a square in the field F. function FpIsSquare(Fp, n) { const l = FpLegendre(Fp, n); return l === 1; } // CURVE.n lengths function nLength(n, nBitLength) { // Bit size, byte size of CURVE.n if (nBitLength !== undefined) (0, utils_ts_1.anumber)(nBitLength); const _nBitLength = nBitLength !== undefined ? nBitLength : n.toString(2).length; const nByteLength = Math.ceil(_nBitLength / 8); return { nBitLength: _nBitLength, nByteLength }; } /** * Creates a finite field. Major performance optimizations: * * 1. Denormalized operations like mulN instead of mul. * * 2. Identical object shape: never add or remove keys. * * 3. `Object.freeze`. * Fragile: always run a benchmark on a change. * Security note: operations don't check 'isValid' for all elements for performance reasons, * it is caller responsibility to check this. * This is low-level code, please make sure you know what you're doing. * * Note about field properties: * * CHARACTERISTIC p = prime number, number of elements in main subgroup. * * ORDER q = similar to cofactor in curves, may be composite `q = p^m`. * * @param ORDER field order, probably prime, or could be composite * @param bitLen how many bits the field consumes * @param isLE (default: false) if encoding / decoding should be in little-endian * @param redef optional faster redefinitions of sqrt and other methods */ function Field(ORDER, bitLenOrOpts, // TODO: use opts only in v2? isLE = false, opts = {}) { if (ORDER <= _0n) throw new Error('invalid field: expected ORDER > 0, got ' + ORDER); let _nbitLength = undefined; let _sqrt = undefined; let modFromBytes = false; let allowedLengths = undefined; if (typeof bitLenOrOpts === 'object' && bitLenOrOpts != null) { if (opts.sqrt || isLE) throw new Error('cannot specify opts in two arguments'); const _opts = bitLenOrOpts; if (_opts.BITS) _nbitLength = _opts.BITS; if (_opts.sqrt) _sqrt = _opts.sqrt; if (typeof _opts.isLE === 'boolean') isLE = _opts.isLE; if (typeof _opts.modFromBytes === 'boolean') modFromBytes = _opts.modFromBytes; allowedLengths = _opts.allowedLengths; } else { if (typeof bitLenOrOpts === 'number') _nbitLength = bitLenOrOpts; if (opts.sqrt) _sqrt = opts.sqrt; } const { nBitLength: BITS, nByteLength: BYTES } = nLength(ORDER, _nbitLength); if (BYTES > 2048) throw new Error('invalid field: expected ORDER of <= 2048 bytes'); let sqrtP; // cached sqrtP const f = Object.freeze({ ORDER, isLE, BITS, BYTES, MASK: (0, utils_ts_1.bitMask)(BITS), ZERO: _0n, ONE: _1n, allowedLengths: allowedLengths, create: (num) => mod(num, ORDER), isValid: (num) => { if (typeof num !== 'bigint') throw new Error('invalid field element: expected bigint, got ' + typeof num); return _0n <= num && num < ORDER; // 0 is valid element, but it's not invertible }, is0: (num) => num === _0n, // is valid and invertible isValidNot0: (num) => !f.is0(num) && f.isValid(num), isOdd: (num) => (num & _1n) === _1n, neg: (num) => mod(-num, ORDER), eql: (lhs, rhs) => lhs === rhs, sqr: (num) => mod(num * num, ORDER), add: (lhs, rhs) => mod(lhs + rhs, ORDER), sub: (lhs, rhs) => mod(lhs - rhs, ORDER), mul: (lhs, rhs) => mod(lhs * rhs, ORDER), pow: (num, power) => FpPow(f, num, power), div: (lhs, rhs) => mod(lhs * invert(rhs, ORDER), ORDER), // Same as above, but doesn't normalize sqrN: (num) => num * num, addN: (lhs, rhs) => lhs + rhs, subN: (lhs, rhs) => lhs - rhs, mulN: (lhs, rhs) => lhs * rhs, inv: (num) => invert(num, ORDER), sqrt: _sqrt || ((n) => { if (!sqrtP) sqrtP = FpSqrt(ORDER); return sqrtP(f, n); }), toBytes: (num) => (isLE ? (0, utils_ts_1.numberToBytesLE)(num, BYTES) : (0, utils_ts_1.numberToBytesBE)(num, BYTES)), fromBytes: (bytes, skipValidation = true) => { if (allowedLengths) { if (!allowedLengths.includes(bytes.length) || bytes.length > BYTES) { throw new Error('Field.fromBytes: expected ' + allowedLengths + ' bytes, got ' + bytes.length); } const padded = new Uint8Array(BYTES); // isLE add 0 to right, !isLE to the left. padded.set(bytes, isLE ? 0 : padded.length - bytes.length); bytes = padded; } if (bytes.length !== BYTES) throw new Error('Field.fromBytes: expected ' + BYTES + ' bytes, got ' + bytes.length); let scalar = isLE ? (0, utils_ts_1.bytesToNumberLE)(bytes) : (0, utils_ts_1.bytesToNumberBE)(bytes); if (modFromBytes) scalar = mod(scalar, ORDER); if (!skipValidation) if (!f.isValid(scalar)) throw new Error('invalid field element: outside of range 0..ORDER'); // NOTE: we don't validate scalar here, please use isValid. This done such way because some // protocol may allow non-reduced scalar that reduced later or changed some other way. return scalar; }, // TODO: we don't need it here, move out to separate fn invertBatch: (lst) => FpInvertBatch(f, lst), // We can't move this out because Fp6, Fp12 implement it // and it's unclear what to return in there. cmov: (a, b, c) => (c ? b : a), }); return Object.freeze(f); } // Generic random scalar, we can do same for other fields if via Fp2.mul(Fp2.ONE, Fp2.random)? // This allows unsafe methods like ignore bias or zero. These unsafe, but often used in different protocols (if deterministic RNG). // which mean we cannot force this via opts. // Not sure what to do with randomBytes, we can accept it inside opts if wanted. // Probably need to export getMinHashLength somewhere? // random(bytes?: Uint8Array, unsafeAllowZero = false, unsafeAllowBias = false) { // const LEN = !unsafeAllowBias ? getMinHashLength(ORDER) : BYTES; // if (bytes === undefined) bytes = randomBytes(LEN); // _opts.randomBytes? // const num = isLE ? bytesToNumberLE(bytes) : bytesToNumberBE(bytes); // // `mod(x, 11)` can sometimes produce 0. `mod(x, 10) + 1` is the same, but no 0 // const reduced = unsafeAllowZero ? mod(num, ORDER) : mod(num, ORDER - _1n) + _1n; // return reduced; // }, function FpSqrtOdd(Fp, elm) { if (!Fp.isOdd) throw new Error("Field doesn't have isOdd"); const root = Fp.sqrt(elm); return Fp.isOdd(root) ? root : Fp.neg(root); } function FpSqrtEven(Fp, elm) { if (!Fp.isOdd) throw new Error("Field doesn't have isOdd"); const root = Fp.sqrt(elm); return Fp.isOdd(root) ? Fp.neg(root) : root; } /** * "Constant-time" private key generation utility. * Same as mapKeyToField, but accepts less bytes (40 instead of 48 for 32-byte field). * Which makes it slightly more biased, less secure. * @deprecated use `mapKeyToField` instead */ function hashToPrivateScalar(hash, groupOrder, isLE = false) { hash = (0, utils_ts_1.ensureBytes)('privateHash', hash); const hashLen = hash.length; const minLen = nLength(groupOrder).nByteLength + 8; if (minLen < 24 || hashLen < minLen || hashLen > 1024) throw new Error('hashToPrivateScalar: expected ' + minLen + '-1024 bytes of input, got ' + hashLen); const num = isLE ? (0, utils_ts_1.bytesToNumberLE)(hash) : (0, utils_ts_1.bytesToNumberBE)(hash); return mod(num, groupOrder - _1n) + _1n; } /** * Returns total number of bytes consumed by the field element. * For example, 32 bytes for usual 256-bit weierstrass curve. * @param fieldOrder number of field elements, usually CURVE.n * @returns byte length of field */ function getFieldBytesLength(fieldOrder) { if (typeof fieldOrder !== 'bigint') throw new Error('field order must be bigint'); const bitLength = fieldOrder.toString(2).length; return Math.ceil(bitLength / 8); } /** * Returns minimal amount of bytes that can be safely reduced * by field order. * Should be 2^-128 for 128-bit curve such as P256. * @param fieldOrder number of field elements, usually CURVE.n * @returns byte length of target hash */ function getMinHashLength(fieldOrder) { const length = getFieldBytesLength(fieldOrder); return length + Math.ceil(length / 2); } /** * "Constant-time" private key generation utility. * Can take (n + n/2) or more bytes of uniform input e.g. from CSPRNG or KDF * and convert them into private scalar, with the modulo bias being negligible. * Needs at least 48 bytes of input for 32-byte private key. * https://research.kudelskisecurity.com/2020/07/28/the-definitive-guide-to-modulo-bias-and-how-to-avoid-it/ * FIPS 186-5, A.2 https://csrc.nist.gov/publications/detail/fips/186/5/final * RFC 9380, https://www.rfc-editor.org/rfc/rfc9380#section-5 * @param hash hash output from SHA3 or a similar function * @param groupOrder size of subgroup - (e.g. secp256k1.CURVE.n) * @param isLE interpret hash bytes as LE num * @returns valid private scalar */ function mapHashToField(key, fieldOrder, isLE = false) { const len = key.length; const fieldLen = getFieldBytesLength(fieldOrder); const minLen = getMinHashLength(fieldOrder); // No small numbers: need to understand bias story. No huge numbers: easier to detect JS timings. if (len < 16 || len < minLen || len > 1024) throw new Error('expected ' + minLen + '-1024 bytes of input, got ' + len); const num = isLE ? (0, utils_ts_1.bytesToNumberLE)(key) : (0, utils_ts_1.bytesToNumberBE)(key); // `mod(x, 11)` can sometimes produce 0. `mod(x, 10) + 1` is the same, but no 0 const reduced = mod(num, fieldOrder - _1n) + _1n; return isLE ? (0, utils_ts_1.numberToBytesLE)(reduced, fieldLen) : (0, utils_ts_1.numberToBytesBE)(reduced, fieldLen); } return modular; } var hasRequiredCurve; function requireCurve () { if (hasRequiredCurve) return curve; hasRequiredCurve = 1; Object.defineProperty(curve, "__esModule", { value: true }); curve.wNAF = void 0; curve.negateCt = negateCt; curve.normalizeZ = normalizeZ; curve.mulEndoUnsafe = mulEndoUnsafe; curve.pippenger = pippenger; curve.precomputeMSMUnsafe = precomputeMSMUnsafe; curve.validateBasic = validateBasic; curve._createCurveFields = _createCurveFields; /** * Methods for elliptic curve multiplication by scalars. * Contains wNAF, pippenger. * @module */ /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */ const utils_ts_1 = /*@__PURE__*/ requireUtils$1(); const modular_ts_1 = /*@__PURE__*/ requireModular(); const _0n = BigInt(0); const _1n = BigInt(1); function negateCt(condition, item) { const neg = item.negate(); return condition ? neg : item; } /** * Takes a bunch of Projective Points but executes only one * inversion on all of them. Inversion is very slow operation, * so this improves performance massively. * Optimization: converts a list of projective points to a list of identical points with Z=1. */ function normalizeZ(c, points) { const invertedZs = (0, modular_ts_1.FpInvertBatch)(c.Fp, points.map((p) => p.Z)); return points.map((p, i) => c.fromAffine(p.toAffine(invertedZs[i]))); } function validateW(W, bits) { if (!Number.isSafeInteger(W) || W <= 0 || W > bits) throw new Error('invalid window size, expected [1..' + bits + '], got W=' + W); } function calcWOpts(W, scalarBits) { validateW(W, scalarBits); const windows = Math.ceil(scalarBits / W) + 1; // W=8 33. Not 32, because we skip zero const windowSize = 2 ** (W - 1); // W=8 128. Not 256, because we skip zero const maxNumber = 2 ** W; // W=8 256 const mask = (0, utils_ts_1.bitMask)(W); // W=8 255 == mask 0b11111111 const shiftBy = BigInt(W); // W=8 8 return { windows, windowSize, mask, maxNumber, shiftBy }; } function calcOffsets(n, window, wOpts) { const { windowSize, mask, maxNumber, shiftBy } = wOpts; let wbits = Number(n & mask); // extract W bits. let nextN = n >> shiftBy; // shift number by W bits. // What actually happens here: // const highestBit = Number(mask ^ (mask >> 1n)); // let wbits2 = wbits - 1; // skip zero // if (wbits2 & highestBit) { wbits2 ^= Number(mask); // (~); // split if bits > max: +224 => 256-32 if (wbits > windowSize) { // we skip zero, which means instead of `>= size-1`, we do `> size` wbits -= maxNumber; // -32, can be maxNumber - wbits, but then we need to set isNeg here. nextN += _1n; // +256 (carry) } const offsetStart = window * windowSize; const offset = offsetStart + Math.abs(wbits) - 1; // -1 because we skip zero const isZero = wbits === 0; // is current window slice a 0? const isNeg = wbits < 0; // is current window slice negative? const isNegF = window % 2 !== 0; // fake random statement for noise const offsetF = offsetStart; // fake offset for noise return { nextN, offset, isZero, isNeg, isNegF, offsetF }; } function validateMSMPoints(points, c) { if (!Array.isArray(points)) throw new Error('array expected'); points.forEach((p, i) => { if (!(p instanceof c)) throw new Error('invalid point at index ' + i); }); } function validateMSMScalars(scalars, field) { if (!Array.isArray(scalars)) throw new Error('array of scalars expected'); scalars.forEach((s, i) => { if (!field.isValid(s)) throw new Error('invalid scalar at index ' + i); }); } // Since points in different groups cannot be equal (different object constructor), // we can have single place to store precomputes. // Allows to make points frozen / immutable. const pointPrecomputes = new WeakMap(); const pointWindowSizes = new WeakMap(); function getW(P) { // To disable precomputes: // return 1; return pointWindowSizes.get(P) || 1; } function assert0(n) { if (n !== _0n) throw new Error('invalid wNAF'); } /** * Elliptic curve multiplication of Point by scalar. Fragile. * Table generation takes **30MB of ram and 10ms on high-end CPU**, * but may take much longer on slow devices. Actual generation will happen on * first call of `multiply()`. By default, `BASE` point is precomputed. * * Scalars should always be less than curve order: this should be checked inside of a curve itself. * Creates precomputation tables for fast multiplication: * - private scalar is split by fixed size windows of W bits * - every window point is collected from window's table & added to accumulator * - since windows are different, same point inside tables won't be accessed more than once per calc * - each multiplication is 'Math.ceil(CURVE_ORDER / 𝑊) + 1' point additions (fixed for any scalar) * - +1 window is neccessary for wNAF * - wNAF reduces table size: 2x less memory + 2x faster generation, but 10% slower multiplication * * @todo Research returning 2d JS array of windows, instead of a single window. * This would allow windows to be in different memory locations */ class wNAF { // Parametrized with a given Point class (not individual point) constructor(Point, bits) { this.BASE = Point.BASE; this.ZERO = Point.ZERO; this.Fn = Point.Fn; this.bits = bits; } // non-const time multiplication ladder _unsafeLadder(elm, n, p = this.ZERO) { let d = elm; while (n > _0n) { if (n & _1n) p = p.add(d); d = d.double(); n >>= _1n; } return p; } /** * Creates a wNAF precomputation window. Used for caching. * Default window size is set by `utils.precompute()` and is equal to 8. * Number of precomputed points depends on the curve size: * 2^(𝑊−1) * (Math.ceil(𝑛 / 𝑊) + 1), where: * - 𝑊 is the window size * - 𝑛 is the bitlength of the curve order. * For a 256-bit curve and window size 8, the number of precomputed points is 128 * 33 = 4224. * @param point Point instance * @param W window size * @returns precomputed point tables flattened to a single array */ precomputeWindow(point, W) { const { windows, windowSize } = calcWOpts(W, this.bits); const points = []; let p = point; let base = p; for (let window = 0; window < windows; window++) { base = p; points.push(base); // i=1, bc we skip 0 for (let i = 1; i < windowSize; i++) { base = base.add(p); points.push(base); } p = base.double(); } return points; } /** * Implements ec multiplication using precomputed tables and w-ary non-adjacent form. * More compact implementation: * https://github.com/paulmillr/noble-secp256k1/blob/47cb1669b6e506ad66b35fe7d76132ae97465da2/index.ts#L502-L541 * @returns real and fake (for const-time) points */ wNAF(W, precomputes, n) { // Scalar should be smaller than field order if (!this.Fn.isValid(n)) throw new Error('invalid scalar'); // Accumulators let p = this.ZERO; let f = this.BASE; // This code was first written with assumption that 'f' and 'p' will never be infinity point: // since each addition is multiplied by 2 ** W, it cannot cancel each other. However, // there is negate now: it is possible that negated element from low value // would be the same as high element, which will create carry into next window. // It's not obvious how this can fail, but still worth investigating later. const wo = calcWOpts(W, this.bits); for (let window = 0; window < wo.windows; window++) { // (n === _0n) is handled and not early-exited. isEven and offsetF are used for noise const { nextN, offset, isZero, isNeg, isNegF, offsetF } = calcOffsets(n, window, wo); n = nextN; if (isZero) { // bits are 0: add garbage to fake point // Important part for const-time getPublicKey: add random "noise" point to f. f = f.add(negateCt(isNegF, precomputes[offsetF])); } else { // bits are 1: add to result point p = p.add(negateCt(isNeg, precomputes[offset])); } } assert0(n); // Return both real and fake points: JIT won't eliminate f. // At this point there is a way to F be infinity-point even if p is not, // which makes it less const-time: around 1 bigint multiply. return { p, f }; } /** * Implements ec unsafe (non const-time) multiplication using precomputed tables and w-ary non-adjacent form. * @param acc accumulator point to add result of multiplication * @returns point */ wNAFUnsafe(W, precomputes, n, acc = this.ZERO) { const wo = calcWOpts(W, this.bits); for (let window = 0; window < wo.windows; window++) { if (n === _0n) break; // Early-exit, skip 0 value const { nextN, offset, isZero, isNeg } = calcOffsets(n, window, wo); n = nextN; if (isZero) { // Window bits are 0: skip processing. // Move to next window. continue; } else { const item = precomputes[offset]; acc = acc.add(isNeg ? item.negate() : item); // Re-using acc allows to save adds in MSM } } assert0(n); return acc; } getPrecomputes(W, point, transform) { // Calculate precomputes on a first run, reuse them after let comp = pointPrecomputes.get(point); if (!comp) { comp = this.precomputeWindow(point, W); if (W !== 1) { // Doing transform outside of if brings 15% perf hit if (typeof transform === 'function') comp = transform(comp); pointPrecomputes.set(point, comp); } } return comp; } cached(point, scalar, transform) { const W = getW(point); return this.wNAF(W, this.getPrecomputes(W, point, transform), scalar)