h2c 0.2.1 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3de2455d74c152fea54a81e553295ba16f3122e1af6e3d2196e52055eb179180
-  data.tar.gz: 6bc78d7cbfa6110f5cee57aff3d099e1a86a25f3a511b7ea13ad4b366aa38bab
+  metadata.gz: 9dcc054ebdb4c4b8e5526bc34cbc81c4fc19b1f20a703e410b580abcbc79bc87
+  data.tar.gz: 7564fca3ea320b66f3c6404a08d03dfda8e01b40a09cb56746aeabe6f9188f46
 SHA512:
-  metadata.gz: 7654446bc65c08a1eb073f4f4de149809e9b44c58d19f9eb420ff2a6c9f9277c5e2b7e7827cde92514e3807fa1ea7544e344be9441c9ac636d256dbdff522af6
-  data.tar.gz: 8e4f8ee2aed37e8639869ea488a276f597dc0264cacd50bd8dc1a22ff2316da3ee2adc879af92a922f54e2f6cd7307d57368ec53be8a4d95a6e551fe38465239
+  metadata.gz: 45e3d5f5b868bd7ca68da8831a3f3f1ef76315145374ee494ec255ec8b47098151fb4766c6b6e9180018b462cd61f80ca598b57179692c37b7d460df863862a3
+  data.tar.gz: 596e7f33544c8a48b337cd4867d4af5377911452a56426edc6c81616635658cca7e36b031ce1a15d44514b5532fad0000815eac1df84ecdbaaeccbe866ef4029

data/.rubocop.yml

@@ -1,10 +1,14 @@
-require:
+plugins:
   - rubocop-rake
   - rubocop-rspec
 inherit_gem:
-  prettier: rubocop.yml
+  syntax_tree: config/rubocop.yml
 AllCops:
-  TargetRubyVersion: 2.7
+  TargetRubyVersion: 3.3
+  NewCops: enable
+# Requiring MFA on rubygems.org is a release-policy decision, not a lint one.
+Gemspec/RequireMFA:
+  Enabled: false
 RSpec/ExampleLength:
   Enabled: false
 Metrics:
@@ -17,5 +21,7 @@ Style/WhileUntilModifier:
   Enabled: false
 Naming/MethodParameterName:
   Enabled: false
-RSpec/FilePath:
+RSpec/SpecFilePathFormat:
+  Enabled: false
+RSpec/SpecFilePathSuffix:
   Enabled: false

data/.ruby-version

@@ -1 +1 @@
-ruby-3.2.0
+ruby-3.4.8

data/CHANGELOG.md

@@ -1,5 +1,49 @@
 ## [Unreleased]
 
-## [0.1.0] - 2022-12-26
+## [0.4.0] - 2026-11-01
 
-- Initial release
+### Breaking changes
+
+- Move the curve definitions from `ECDSA::Group::Secp256k1_3ISO`, `BLS::Group::BLS12381G1` and `BLS::Group::BLS12381G1_11ISO` to `H2C::Curve::Secp256k1_3ISO`, `H2C::Curve::BLS12381G1` and `H2C::Curve::BLS12381G1_11ISO`, so that h2c no longer defines constants in the ecdsa gem's namespace or a top-level `BLS` module.
+- Require Ruby 3.3 or later, matching the versions tested in CI.
+- Rename `H2C::M2C::ISOGeny` to `H2C::M2C::Isogeny`.
+- Remove the unused third argument (`k`) of `H2C::Expander.get`.
+- `H2C::Expander::XMD#digest` now returns the `Digest` class rather than a shared instance, and `#dst` returns a binary (ASCII-8BIT) copy of the tag.
+
+### Fixed
+
+- `expand_message_xmd` raised `Encoding::CompatibilityError` for a UTF-8 DST containing non-ASCII characters whose length byte is 0x80 or above.
+- `expand_message_xmd` rejected valid inputs: `ell == 255`, `len_in_bytes == 65535` and DSTs of 254 or 255 bytes. The abort conditions now follow RFC 9380 Section 5.3.1 exactly.
+- `H2C::M2C::SSWU#map` reduces `u` modulo p before computing `sgn0`, so an unreduced `u` maps to the same point as `u mod p`.
+- `H2C::M2C::SSWU#map` raises `H2C::Error` instead of `NoMethodError` when no square root is found.
+
+### Changed
+
+- `H2C::Expander::XMD` holds no mutable digest state, so an expander (and `H2C::HashToPoint`) can be shared across threads.
+- Skip the cofactor multiplication when the cofactor is 1.
+- Documentation now references RFC 9380 instead of draft-irtf-cfrg-hash-to-curve-16.
+- Replace the unmaintained prettier gem with syntax_tree for formatting checks, since prettier 4.0.3 fails on Ruby 4.0 (`JSON.fast_generate` was removed).
+
+## [0.3.0] - 2026-08-09
+
+- Fix the SSWU exceptional case (`u == 0` or `Z * u^2 == -1`) by using `inv0` semantics instead of raising.
+- Fix the byte range used by `hash_to_field` when splitting the expanded message, which was wrong for extension degree `m > 1`.
+- Reject an empty domain separation tag, as required by RFC 9380 Section 3.1.
+- Document that the library is not constant-time and must not be used with secret inputs.
+- Test against Ruby 3.3, 3.4 and 4.0.
+
+## [0.2.1] - 2024-02-06
+
+- Add a `modulo` argument to `H2C::HashToPoint#hash_to_field` so that protocols such as FROST can reduce by the group order.
+- Move the BLS12-381 group definitions from `ECDSA::Group` to `BLS::Group`.
+
+## [0.2.0] - 2023-01-13
+
+- Support `BLS12381G1_XMD:SHA-256_SSWU_NU_` and `BLS12381G1_XMD:SHA-256_SSWU_RO_`.
+- Support `P256_XMD:SHA-256_SSWU_NU_` and `P256_XMD:SHA-256_SSWU_RO_`.
+- Support `P384_XMD:SHA-384_SSWU_NU_` and `P384_XMD:SHA-384_SSWU_RO_`.
+- Support `P521_XMD:SHA-512_SSWU_NU_` and `P521_XMD:SHA-512_SSWU_RO_`.
+
+## [0.1.0] - 2023-01-12
+
+- Initial release with `secp256k1_XMD:SHA-256_SSWU_NU_` and `secp256k1_XMD:SHA-256_SSWU_RO_`.

data/Gemfile

@@ -9,7 +9,7 @@ gem "rake", "~> 13.0"
 
 gem "rspec", "~> 3.0"
 
-gem 'prettier', '4.0.3'
+gem "syntax_tree"
 
-gem 'rubocop-rake'
-gem 'rubocop-rspec'
+gem "rubocop-rake"
+gem "rubocop-rspec"

data/README.md

@@ -1,9 +1,23 @@
 # Hashing to Elliptic Curves for Ruby
 
-This is a Ruby implementation of the [Hash to Curves](https://github.com/cfrg/draft-irtf-cfrg-hash-to-curve) proposed by the [IETF](https://datatracker.ietf.org/doc/draft-irtf-cfrg-hash-to-curve/).
+This is a Ruby implementation of [RFC 9380: Hashing to Elliptic Curves](https://www.rfc-editor.org/rfc/rfc9380.html).
 
 It has been tested using the Test Vector provided, but the code has not been audited to ensure functional specification and safety. Also It is under development and is subject to change without backward compatibility.
 
+## Security considerations
+
+**This library is not constant-time and must not be used with secret input messages.**
+
+[RFC 9380 Section 4](https://www.rfc-editor.org/rfc/rfc9380.html#section-4) requires a constant-time implementation when the message being hashed is secret. This library does not meet that requirement:
+
+* Field arithmetic is performed with Ruby's arbitrary-precision `Integer`, whose execution time depends on the operand values.
+* The mapping in `H2C::M2C::SSWU#map` selects between candidates with ordinary `if`/ternary branches rather than constant-time conditional moves.
+* Byte-string handling in `H2C::Expander` allocates and copies in ways that depend on the requested length.
+
+An attacker able to measure timing or cache behaviour may therefore be able to recover information about the input. Hashing a **public** message to a curve point (the primary use case of RFC 9380) is unaffected.
+
+In particular, do not use this library to derive nonces or key material directly from secret values — for example, FROST's `nonce_generate`, which hashes a secret share. Such protocols require a constant-time implementation.
+
 The following cipher suites are currently supported:
 
 * secp256k1_XMD:SHA-256_SSWU_NU_

data/h2c.gemspec

@@ -12,19 +12,24 @@ Gem::Specification.new do |spec|
   spec.description = "Ruby implementation of hash to curve."
   spec.homepage = "https://github.com/azuchi/h2c"
   spec.license = "MIT"
-  spec.required_ruby_version = ">= 2.7.0"
+  spec.required_ruby_version = ">= 3.3.0"
 
   spec.metadata["homepage_uri"] = spec.homepage
-  spec.metadata["source_code_uri"] = spec.homepage 
-  spec.metadata["changelog_uri"] = spec.homepage
+  spec.metadata["source_code_uri"] = spec.homepage
+  spec.metadata["changelog_uri"] = "#{spec.homepage}/blob/master/CHANGELOG.md"
 
   # Specify which files should be added to the gem when it is released.
   # The `git ls-files -z` loads the files in the RubyGem that have been added into git.
-  spec.files = Dir.chdir(File.expand_path(__dir__)) do
-    `git ls-files -z`.split("\x0").reject do |f|
-      (f == __FILE__) || f.match(%r{\A(?:(?:test|spec|features)/|\.(?:git|travis|circleci)|appveyor)})
+  spec.files =
+    Dir.chdir(File.expand_path(__dir__)) do
+      `git ls-files -z`.split("\x0")
+        .reject do |f|
+          (f == __FILE__) ||
+            f.match(
+              %r{\A(?:(?:test|spec|features)/|\.(?:git|travis|circleci)|appveyor)}
+            )
+        end
     end
-  end
   spec.bindir = "exe"
   spec.executables = spec.files.grep(%r{\Aexe/}) { |f| File.basename(f) }
   spec.require_paths = ["lib"]

data/lib/{ext → h2c}/curve/bls12381_g1.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
-module BLS
-  class Group
+module H2C
+  module Curve
+    # BLS12-381 G1.
+    # https://www.rfc-editor.org/rfc/rfc9380.html#section-8.8.1
     BLS12381G1 =
       ECDSA::Group.new(
         name: "bls12381_g1",

data/lib/{ext → h2c}/curve/bls12381_g1_11iso.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
-module BLS
-  class Group
+module H2C
+  module Curve
+    # 11-isogenous curve to BLS12-381 G1.
+    # https://www.rfc-editor.org/rfc/rfc9380.html#section-8.8.1
     BLS12381G1_11ISO =
       ECDSA::Group.new(
         name: "bls12381_g1_11iso",

data/lib/{ext → h2c}/curve/secp256k1_3iso.rb

@@ -1,8 +1,10 @@
 # frozen_string_literal: true
-module ECDSA
-  class Group
+module H2C
+  module Curve
+    # 3-isogenous curve to secp256k1.
+    # https://www.rfc-editor.org/rfc/rfc9380.html#section-8.7
     Secp256k1_3ISO =
-      new(
+      ECDSA::Group.new(
         name: "secp256k1_3ISO",
         p:
           0xFFFFFFFF_FFFFFFFF_FFFFFFFF_FFFFFFFF_FFFFFFFF_FFFFFFFF_FFFFFFFE_FFFFFC2F,

data/lib/h2c/curve.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+module H2C
+  # Curve definitions used by the suites that are not provided by the ecdsa gem,
+  # including the isogenous curves required by the SSWU map for AB == 0 curves.
+  module Curve
+  end
+end
+
+require_relative "curve/secp256k1_3iso"
+require_relative "curve/bls12381_g1"
+require_relative "curve/bls12381_g1_11iso"

data/lib/h2c/expander/xmd.rb

@@ -6,58 +6,55 @@ module H2C
     # Expander::XMD produces a uniformly random byte string using a cryptographic hash function H that outputs b bits.
     class XMD
       attr_reader :dst, :digest
+
       # Constructor
-      # @param [String] func Hash function name. Currently supported by 'SHA256' and 'SHA512'
+      # @param [String] func Hash function name. Currently supported by 'SHA256', 'SHA384' and 'SHA512'
       # @param [String] dst Domain separation tag with binary format.
       def initialize(func, dst)
-        @dst = dst
-        @digest = Digest(func).new
+        # Concatenating with the length byte (and the hashed prefix for long
+        # tags) requires a binary string. A UTF-8 tag with non-ASCII characters
+        # would otherwise raise Encoding::CompatibilityError once the length
+        # byte is 0x80 or above.
+        @dst = dst.b
+        # Keep the Digest class rather than an instance so that expand holds no
+        # mutable state and a single expander can be shared across threads.
+        @digest = Digest(func)
       end
 
       # Expand message.
-      # https://www.ietf.org/archive/id/draft-irtf-cfrg-hash-to-curve-16.html#name-expand_message_xmd
+      # https://www.rfc-editor.org/rfc/rfc9380.html#section-5.3.1
       # @param [String] msg The message to be expanded with binary format.
       # @param [Integer] len The length of the requested output in bytes.
       # @return [String] Expanded message.
       # @raise [H2C::Error]
       def expand(msg, len)
-        b_len = digest.digest_length
+        b_len = digest.new.digest_length
         ell = (len + b_len - 1) / b_len
-        dst_prime = construct_dst_prime
-
-        if ell >= 0xff || len >= 0xffff || dst_prime.bytesize >= 0xff
-          raise H2C::Error, "requested too many bytes"
+        # RFC 9380 5.3.1 step 2. A dst longer than 255 bytes has already been
+        # hashed down by construct_dst_prime, so only the output length needs
+        # checking here.
+        if ell > 255 || len > 65_535
+          raise H2C::Error,
+                "requested too many bytes: len must be at most 65535 and " \
+                  "ceil(len / #{b_len}) at most 255."
         end
-        lib_str = [(len >> 8) & 0xFF, (len & 0xff)].pack("CC")
-        z_pad = Array.new(digest.block_length, 0)
-
-        digest.reset
-        digest.update(z_pad.pack("C*"))
-        digest.update(msg)
-        digest.update(lib_str)
-        digest.update([0].pack("C"))
-        digest.update(dst_prime)
-
-        b0 = digest.digest
-        digest.reset
-        digest.update(b0)
-        digest.update([1].pack("C"))
-        digest.update(dst_prime)
+        dst_prime = construct_dst_prime
+        lib_str = [len].pack("n")
+        z_pad = "\x00".b * digest.new.block_length
 
-        bi = digest.digest
-        pseudo = bi
-        (2..(ell + 1)).each do |i|
-          digest.reset
-          digest.update(Expander.xor(b0, bi))
-          digest.update([i].pack("C"))
-          digest.update(dst_prime)
-          bi = digest.digest
-          pseudo += bi
+        b0 = digest.digest(z_pad + msg.b + lib_str + "\x00".b + dst_prime)
+        bi = digest.digest(b0 + "\x01".b + dst_prime)
+        pseudo = bi.dup
+        # b_1 is already computed above, so this yields b_1, ..., b_ell in total.
+        (2..ell).each do |i|
+          bi = digest.digest(Expander.xor(b0, bi) + [i].pack("C") + dst_prime)
+          pseudo << bi
         end
-        pseudo[0...len]
+        pseudo[0, len]
       end
 
       # Construct DST prime.
+      # https://www.rfc-editor.org/rfc/rfc9380.html#section-5.3.3
       # @return [String] DST prime
       def construct_dst_prime
         dst_prime =

data/lib/h2c/expander.rb

@@ -31,15 +31,19 @@ module H2C
     module_function
 
     # Get expander implementation
-    # @param [String] func Hash function name. Currently supported by 'SHA-256' and 'SHA-512'.
-    # @raise [H2C::Error] If invalid func specified.
+    # @param [String] func Hash function name. One of H2C::HashFunc::XMD_FUNCS
+    # ("SHA256", "SHA384" or "SHA512").
+    # @param [String] dst Domain separation tag with binary format. Must not be empty.
+    # @raise [H2C::Error] If invalid func or empty dst specified.
     # @return [XMD] expander implementation, currently only XMD is supported.
-    def get(func, dst, _k)
+    def get(func, dst)
       unless HashFunc::XMD_FUNCS.include?(func)
         raise H2C::Error, "func #{func} is unsupported."
       end
+      # RFC 9380 3.1 requires domain separation tags to have nonzero length.
+      raise H2C::Error, "dst must not be empty." if dst.nil? || dst.empty?
       XMD.new(func, dst)
-      # TODO: XOR
+      # TODO: expand_message_xof for HashFunc::XOF_FUNCS is not implemented yet.
     end
 
     # XOR two byte(+x+ and +y+) string.

data/lib/h2c/hash_to_point.rb

@@ -24,11 +24,22 @@ module H2C
           u = hash_to_field(msg, 1)
           suite.map.map(u[0])
         end
-      suite.curve.cofactor ? p.multiply_by_scalar(suite.curve.cofactor) : p
+      clear_cofactor(p)
+    end
+
+    # Clear the cofactor of the point.
+    # https://www.rfc-editor.org/rfc/rfc9380.html#section-7
+    # The ecdsa gem leaves the cofactor nil for the NIST curves and set to 1 for
+    # secp256k1, both of which are prime-order groups with nothing to clear.
+    # @param [ECDSA::Point] p point
+    # @return [ECDSA::Point] point in the prime-order subgroup
+    def clear_cofactor(p)
+      h = suite.curve.cofactor
+      h && h > 1 ? p.multiply_by_scalar(h) : p
     end
 
     # Hashes a msg of any length into an element of a finite field.
-    # https://www.ietf.org/archive/id/draft-irtf-cfrg-hash-to-curve-16.html#name-hash_to_field-implementatio
+    # https://www.rfc-editor.org/rfc/rfc9380.html#section-5.2
     # @param [String] msg A byte string containing the message to hash.
     # @param [Integer] count The number of elements of Field to output.
     # @param [Integer] modulo (Optional) This value is a finite field of characteristic p in the
@@ -41,8 +52,8 @@ module H2C
       count.times do |i|
         v = []
         suite.m.times do |j|
-          offset = suite.l * (j + i * suite.m)
-          t = pseudo[offset, (offset + suite.l)]
+          offset = suite.l * (j + (i * suite.m))
+          t = pseudo[offset, suite.l]
           vj = t.unpack1("H*").to_i(16)
           v[j] = vj % modulo
         end

data/lib/h2c/m2c/isogeny/bls12381_g1.rb

@@ -2,9 +2,9 @@
 
 module H2C
   module M2C
-    module ISOGeny
+    module Isogeny
       # 11-isogeny map for BLS12381
-      # https://www.ietf.org/archive/id/draft-irtf-cfrg-hash-to-curve-16.html#appendix-E.2
+      # https://www.rfc-editor.org/rfc/rfc9380.html#appendix-E.2
       class BLS12381G1
         attr_reader :e0, :e1
 
@@ -76,8 +76,8 @@ module H2C
           1
         ].freeze
         def initialize
-          @e0 = BLS::Group::BLS12381G1_11ISO
-          @e1 = BLS::Group::BLS12381G1
+          @e0 = Curve::BLS12381G1_11ISO
+          @e1 = Curve::BLS12381G1
         end
 
         def map(x, y)
@@ -87,12 +87,12 @@ module H2C
           y_num = 0
           y_den = 0
           (X_NUM.length - 1).step(0, -1) do |i|
-            x_num = f.mod(x_num * x + X_NUM[i])
-            x_den = f.mod(x_den * x + X_DEN[i])
+            x_num = f.mod((x_num * x) + X_NUM[i])
+            x_den = f.mod((x_den * x) + X_DEN[i])
           end
           (Y_NUM.length - 1).step(0, -1) do |i|
-            y_num = f.mod(y_num * x + Y_NUM[i])
-            y_den = f.mod(y_den * x + Y_DEN[i])
+            y_num = f.mod((y_num * x) + Y_NUM[i])
+            y_den = f.mod((y_den * x) + Y_DEN[i])
           end
           xx = f.mod(x_num * f.inverse(x_den))
           yy = f.mod(y * (y_num * f.inverse(y_den)))

data/lib/h2c/m2c/isogeny/secp256k1.rb

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
 module H2C
   module M2C
-    module ISOGeny
+    module Isogeny
       # 3-isogeny map for secp256k1
-      # https://www.ietf.org/archive/id/draft-irtf-cfrg-hash-to-curve-16.html#appendix-E.1
+      # https://www.rfc-editor.org/rfc/rfc9380.html#appendix-E.1
       class Secp256k1
         attr_reader :e0, :e1
 
@@ -33,7 +33,7 @@ module H2C
         ].freeze
 
         def initialize
-          @e0 = ECDSA::Group::Secp256k1_3ISO
+          @e0 = Curve::Secp256k1_3ISO
           @e1 = ECDSA::Group::Secp256k1
         end
 
@@ -45,10 +45,10 @@ module H2C
           y_num = 0
           y_den = 0
           3.step(0, -1) do |i|
-            x_num = f.mod(x_num * x + X_NUM[i])
-            x_den = f.mod(x_den * x + X_DEN[i])
-            y_num = f.mod(y_num * x + Y_NUM[i])
-            y_den = f.mod(y_den * x + Y_DEN[i])
+            x_num = f.mod((x_num * x) + X_NUM[i])
+            x_den = f.mod((x_den * x) + X_DEN[i])
+            y_num = f.mod((y_num * x) + Y_NUM[i])
+            y_den = f.mod((y_den * x) + Y_DEN[i])
           end
           xx = f.mod(x_num * f.inverse(x_den))
           yy = f.mod(y * (y_num * f.inverse(y_den)))

data/lib/h2c/m2c/isogeny.rb

@@ -1,8 +1,8 @@
 # frozen_string_literal: true
 module H2C
   module M2C
-    # https://www.ietf.org/archive/id/draft-irtf-cfrg-hash-to-curve-16.html#name-isogeny-maps-for-suites
-    module ISOGeny
+    # https://www.rfc-editor.org/rfc/rfc9380.html#appendix-E
+    module Isogeny
       autoload :Secp256k1, "h2c/m2c/isogeny/secp256k1"
       autoload :BLS12381G1, "h2c/m2c/isogeny/bls12381_g1"
     end

data/lib/h2c/m2c/sswu.rb

@@ -2,7 +2,7 @@
 
 module H2C
   module M2C
-    # https://www.ietf.org/archive/id/draft-irtf-cfrg-hash-to-curve-16.html#section-6.6.2
+    # https://www.rfc-editor.org/rfc/rfc9380.html#section-6.6.2
     class SSWU
       attr_reader :curve, :c1, :c2, :z
 
@@ -14,21 +14,26 @@ module H2C
         @z = z
         f = curve.field
         @c1 = f.mod(-curve.param_b * f.inverse(curve.param_a))
-        @c2 = f.mod(-f.inverse(z))
+        @c2 = f.mod(-f.inverse(f.mod(z)))
       end
 
       # Outputs x and y are elements of the field F.
       # @param [Integer] u
-      # @return [Array(Integer, Integer)] x and y
+      # @return [ECDSA::Point] point on the curve
+      # @raise [H2C::Error] if no square root is found, which cannot happen for
+      # a correct Z but guards against a misconfigured curve.
       def map(u)
         f = curve.field
+        # sgn0 below inspects the parity of u, so u must be reduced first.
+        u = f.mod(u)
         t1 = f.mod(f.power(u, 2) * f.mod(z))
         t2 = f.power(t1, 2)
         x1 = f.mod(t1 + t2)
-        x1 = f.inverse(x1)
         e1 = x1.zero?
+        # inv0(x) is the multiplicative inverse of x, with inv0(0) = 0.
+        x1 = e1 ? 0 : f.inverse(x1)
         x1 = f.mod(x1 + 1)
-        x1 = e1 ? c2 : x1
+        x1 = c2 if e1
         x1 = f.mod(x1 * c1)
         gx1 = f.power(x1, 2)
         gx1 = f.mod(gx1 + curve.param_a)
@@ -40,20 +45,23 @@ module H2C
         e2 = square?(gx1)
         x = e2 ? x1 : x2
         y2 = e2 ? gx1 : gx2
-        y = f.square_roots(y2)[0]
+        y = f.square_roots(y2).first
+        if y.nil?
+          raise H2C::Error, "no square root found for #{y2} on #{curve.name}."
+        end
         e3 = sgn0(u) == sgn0(y)
         y = f.mod(e3 ? y : -y)
         curve.new_point([x, y])
       end
 
       def square?(x)
-        test = curve.field.power(x, ((curve.field.prime - 1) / 2))
+        test = curve.field.power(x, (curve.field.prime - 1) / 2)
         [0, 1].include?(test)
       end
 
       def sgn0(x)
         res = x % 2
-        curve.field.mod(1 - 2 * res)
+        curve.field.mod(1 - (2 * res))
       end
     end
   end

data/lib/h2c/m2c/sswuab0.rb

@@ -1,19 +1,19 @@
 # frozen_string_literal: true
 module H2C
   module M2C
-    # https://www.ietf.org/archive/id/draft-irtf-cfrg-hash-to-curve-16.html#section-6.6.3
+    # https://www.rfc-editor.org/rfc/rfc9380.html#section-6.6.3
     class SSWUAB0
       attr_reader :sswu, :iso
 
       # Constructor
-      # @param [H2C::M2C::ISOGeny] iso
+      # @param [H2C::M2C::Isogeny] iso
       # @param [Integer] z
       def initialize(iso, z)
         @sswu = SSWU.new(iso.e0, z)
         @iso = iso
       end
 
-      # https://www.ietf.org/archive/id/draft-irtf-cfrg-hash-to-curve-16.html#section-6.6.3
+      # https://www.rfc-editor.org/rfc/rfc9380.html#section-6.6.3
       # @param [Integer] u
       # @return [ECDSA::Point]
       def map(u)

data/lib/h2c/m2c.rb

@@ -2,9 +2,9 @@
 
 module H2C
   # Map to Curve functions.
-  # https://www.ietf.org/archive/id/draft-irtf-cfrg-hash-to-curve-16.html#section-6
+  # https://www.rfc-editor.org/rfc/rfc9380.html#section-6
   module M2C
-    autoload :ISOGeny, "h2c/m2c/isogeny"
+    autoload :Isogeny, "h2c/m2c/isogeny"
     autoload :SSWU, "h2c/m2c/sswu"
     autoload :SSWUAB0, "h2c/m2c/sswuab0"
   end

data/lib/h2c/suite.rb

@@ -25,38 +25,38 @@ module H2C
       case id
       when SECP256K1_XMDSHA256_SSWU_NU_, SECP256K1_XMDSHA256_SSWU_RO_
         @curve = ECDSA::Group::Secp256k1
-        @exp = Expander.get(HashFunc::SHA256, dst, @k)
+        @exp = Expander.get(HashFunc::SHA256, dst)
         @l = 48
-        @map = M2C::SSWUAB0.new(H2C::M2C::ISOGeny::Secp256k1.new, -11)
+        @map = M2C::SSWUAB0.new(H2C::M2C::Isogeny::Secp256k1.new, -11)
         @ro = (id == SECP256K1_XMDSHA256_SSWU_RO_)
       when BLS12381G1_XMDSHA256_SSWU_NU_, BLS12381G1_XMDSHA256_SSWU_RO_
-        @curve = BLS::Group::BLS12381G1
-        @exp = Expander.get(HashFunc::SHA256, dst, @k)
+        @curve = Curve::BLS12381G1
+        @exp = Expander.get(HashFunc::SHA256, dst)
         @l = 64
-        @map = M2C::SSWUAB0.new(H2C::M2C::ISOGeny::BLS12381G1.new, 11)
+        @map = M2C::SSWUAB0.new(H2C::M2C::Isogeny::BLS12381G1.new, 11)
         @ro = (id == BLS12381G1_XMDSHA256_SSWU_RO_)
       when P256_XMDSHA256_SSWU_NU_, P256_XMDSHA256_SSWU_RO_
         @curve = ECDSA::Group::Nistp256
-        @exp = Expander.get(HashFunc::SHA256, dst, @k)
+        @exp = Expander.get(HashFunc::SHA256, dst)
         @l = 48
         @map = M2C::SSWU.new(ECDSA::Group::Nistp256, -10)
         @ro = (id == P256_XMDSHA256_SSWU_RO_)
       when P384_XMDSHA384_SSWU_NU_, P384_XMDSHA384_SSWU_RO_
         @k = 192
         @curve = ECDSA::Group::Nistp384
-        @exp = Expander.get(HashFunc::SHA384, dst, @k)
+        @exp = Expander.get(HashFunc::SHA384, dst)
         @l = 72
         @map = M2C::SSWU.new(ECDSA::Group::Nistp384, -12)
         @ro = (id == P384_XMDSHA384_SSWU_RO_)
       when P521_XMDSHA512_SSWU_NU_, P521_XMDSHA512_SSWU_RO_
         @k = 256
         @curve = ECDSA::Group::Nistp521
-        @exp = Expander.get(HashFunc::SHA512, dst, @k)
+        @exp = Expander.get(HashFunc::SHA512, dst)
         @l = 98
         @map = M2C::SSWU.new(ECDSA::Group::Nistp521, -4)
         @ro = (id == P521_XMDSHA512_SSWU_RO_)
       else
-        raise H2C::Error, "suite #{curve} unsupported."
+        raise H2C::Error, "suite #{id} unsupported."
       end
     end
   end

data/lib/h2c/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module H2C
-  VERSION = "0.2.1"
+  VERSION = "0.4.0"
 end

data/lib/h2c.rb

@@ -2,10 +2,10 @@
 
 require_relative "h2c/version"
 require "ecdsa"
-require_relative "ext/curve"
+require_relative "h2c/curve"
 
 # Hash to Curves library.
-# https://www.ietf.org/archive/id/draft-irtf-cfrg-hash-to-curve-16.html
+# https://www.rfc-editor.org/rfc/rfc9380.html
 module H2C
   class Error < StandardError
   end
@@ -31,9 +31,10 @@ module H2C
 
   # Get hash to curve corresponding to +suite+.
   #
-  # @param [String] suite Suite name for hashing.
-  # Currently supported are "secp256k1_XMD:SHA-256_SSWU_NU_" and "secp256k1_XMD:SHA-256_SSWU_RO_".
-  # @param [String] dst Domain separation tag.
+  # @param [String] suite Suite id for hashing. See the constants in H2C::Suite
+  # for the supported suites.
+  # @param [String] dst Domain separation tag. Must not be empty.
+  # @raise [H2C::Error] If the suite is unsupported or dst is empty.
   # @return [H2C::HashToPoint]
   def get(suite, dst)
     suite = Suite.new(suite, dst)

data/sig/h2c.rbs

@@ -1,4 +1,127 @@
+# The ecdsa gem ships no type signatures, so its classes (ECDSA::Group,
+# ECDSA::Point and ECDSA::PrimeField) appear here as untyped.
 module H2C
   VERSION: String
-  # See the writing guide of rbs: https://github.com/ruby/rbs#guides
+
+  class Error < StandardError
+  end
+
+  module HashFunc
+    SHA256: String
+    SHA384: String
+    SHA512: String
+    SHAKE128: String
+    SHAKE256: String
+    XMD_FUNCS: Array[String]
+    XOF_FUNCS: Array[String]
+  end
+
+  # Returns a hash-to-curve function for +suite+ and +dst+.
+  def self.get: (String suite, String dst) -> HashToPoint
+
+  module Curve
+    Secp256k1_3ISO: untyped
+    BLS12381G1: untyped
+    BLS12381G1_11ISO: untyped
+  end
+
+  class Suite
+    SECP256K1_XMDSHA256_SSWU_NU_: String
+    SECP256K1_XMDSHA256_SSWU_RO_: String
+    BLS12381G1_XMDSHA256_SSWU_NU_: String
+    BLS12381G1_XMDSHA256_SSWU_RO_: String
+    P256_XMDSHA256_SSWU_NU_: String
+    P256_XMDSHA256_SSWU_RO_: String
+    P384_XMDSHA384_SSWU_NU_: String
+    P384_XMDSHA384_SSWU_RO_: String
+    P521_XMDSHA512_SSWU_NU_: String
+    P521_XMDSHA512_SSWU_RO_: String
+
+    attr_reader id: String
+    attr_reader curve: untyped
+    attr_reader k: Integer
+    attr_reader exp: Expander::XMD
+    attr_reader m: Integer
+    attr_reader l: Integer
+    attr_reader ro: bool
+    attr_reader map: M2C::SSWU | M2C::SSWUAB0
+
+    def initialize: (String id, String dst) -> void
+  end
+
+  class HashToPoint
+    attr_reader suite: Suite
+
+    def initialize: (Suite suite) -> void
+    def digest: (String msg) -> untyped
+    def clear_cofactor: (untyped p) -> untyped
+    def hash_to_field: (String msg, Integer count, ?Integer modulo) -> Array[Integer]
+  end
+
+  module Expander
+    MAX_DST_LENGTH: Integer
+    LONG_DST_PREFIX: String
+
+    def self.get: (String func, String? dst) -> XMD
+    def self.xor: (String x, String y) -> String
+
+    class XMD
+      attr_reader dst: String
+      attr_reader digest: singleton(Digest::Base)
+
+      def initialize: (String func, String dst) -> void
+      def expand: (String msg, Integer len) -> String
+      def construct_dst_prime: () -> String
+    end
+  end
+
+  module M2C
+    class SSWU
+      attr_reader curve: untyped
+      attr_reader c1: Integer
+      attr_reader c2: Integer
+      attr_reader z: Integer
+
+      def initialize: (untyped curve, Integer z) -> void
+      def map: (Integer u) -> untyped
+      def square?: (Integer x) -> bool
+      def sgn0: (Integer x) -> Integer
+    end
+
+    class SSWUAB0
+      attr_reader sswu: SSWU
+      attr_reader iso: Isogeny::Secp256k1 | Isogeny::BLS12381G1
+
+      def initialize: (Isogeny::Secp256k1 | Isogeny::BLS12381G1 iso, Integer z) -> void
+      def map: (Integer u) -> untyped
+    end
+
+    module Isogeny
+      class Secp256k1
+        X_NUM: Array[Integer]
+        X_DEN: Array[Integer]
+        Y_NUM: Array[Integer]
+        Y_DEN: Array[Integer]
+
+        attr_reader e0: untyped
+        attr_reader e1: untyped
+
+        def initialize: () -> void
+        def map: (Integer x, Integer y) -> [Integer, Integer]
+      end
+
+      class BLS12381G1
+        X_NUM: Array[Integer]
+        X_DEN: Array[Integer]
+        Y_NUM: Array[Integer]
+        Y_DEN: Array[Integer]
+
+        attr_reader e0: untyped
+        attr_reader e1: untyped
+
+        def initialize: () -> void
+        def map: (Integer x, Integer y) -> [Integer, Integer]
+      end
+    end
+  end
 end

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: h2c
 version: !ruby/object:Gem::Version
-  version: 0.2.1
+  version: 0.4.0
 platform: ruby
 authors:
 - azuchi
-autorequire: 
 bindir: exe
 cert_chain: []
-date: 2024-02-06 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ecdsa
@@ -31,7 +30,6 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- ".prettierignore"
 - ".rspec"
 - ".rubocop.yml"
 - ".ruby-gemset"
@@ -45,11 +43,11 @@ files:
 - bin/console
 - bin/setup
 - h2c.gemspec
-- lib/ext/curve.rb
-- lib/ext/curve/bls12381_g1.rb
-- lib/ext/curve/bls12381_g1_11iso.rb
-- lib/ext/curve/secp256k1_3iso.rb
 - lib/h2c.rb
+- lib/h2c/curve.rb
+- lib/h2c/curve/bls12381_g1.rb
+- lib/h2c/curve/bls12381_g1_11iso.rb
+- lib/h2c/curve/secp256k1_3iso.rb
 - lib/h2c/expander.rb
 - lib/h2c/expander/xmd.rb
 - lib/h2c/hash_to_point.rb
@@ -68,8 +66,7 @@ licenses:
 metadata:
   homepage_uri: https://github.com/azuchi/h2c
   source_code_uri: https://github.com/azuchi/h2c
-  changelog_uri: https://github.com/azuchi/h2c
-post_install_message: 
+  changelog_uri: https://github.com/azuchi/h2c/blob/master/CHANGELOG.md
 rdoc_options: []
 require_paths:
 - lib
@@ -77,15 +74,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.7.0
+      version: 3.3.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.1
-signing_key: 
+rubygems_version: 3.6.9
 specification_version: 4
 summary: Ruby implementation of hash to curve.
 test_files: []

data/.prettierignore

@@ -1,2 +0,0 @@
-/bin
-/vendor

data/lib/ext/curve.rb

@@ -1,5 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "curve/secp256k1_3iso"
-require_relative "curve/bls12381_g1"
-require_relative "curve/bls12381_g1_11iso"