@0xpolygonid/js-sdk 1.19.0 → 1.20.0

package/dist/browser/esm/index.js

@@ -2031,10 +2031,16 @@ function randomBytes$1(bytesLength = 32) {
     if (crypto$3 && typeof crypto$3.getRandomValues === 'function') {
         return crypto$3.getRandomValues(new Uint8Array(bytesLength));
     }
+    // Legacy Node.js compatibility
+    if (crypto$3 && typeof crypto$3.randomBytes === 'function') {
+        return crypto$3.randomBytes(bytesLength);
+    }
     throw new Error('crypto.getRandomValues must be defined');
 }
 
-// Polyfill for Safari 14
+/**
+ * Polyfill for Safari 14
+ */
 function setBigUint64$1(view, byteOffset, value, isLE) {
     if (typeof view.setBigUint64 === 'function')
         return view.setBigUint64(byteOffset, value, isLE);
@@ -2047,9 +2053,13 @@ function setBigUint64$1(view, byteOffset, value, isLE) {
     view.setUint32(byteOffset + h, wh, isLE);
     view.setUint32(byteOffset + l, wl, isLE);
 }
-// Choice: a ? b : c
+/**
+ * Choice: a ? b : c
+ */
 const Chi$1 = (a, b, c) => (a & b) ^ (~a & c);
-// Majority function, true if any two inpust is true
+/**
+ * Majority function, true if any two inputs is true
+ */
 const Maj$1 = (a, b, c) => (a & b) ^ (a & c) ^ (b & c);
 /**
  * Merkle-Damgard hash construction base class.
@@ -3239,6 +3249,60 @@ function wNAF$1(c, bits) {
         },
     };
 }
+/**
+ * Pippenger algorithm for multi-scalar multiplication (MSM).
+ * MSM is basically (Pa + Qb + Rc + ...).
+ * 30x faster vs naive addition on L=4096, 10x faster with precomputes.
+ * For N=254bit, L=1, it does: 1024 ADD + 254 DBL. For L=5: 1536 ADD + 254 DBL.
+ * Algorithmically constant-time (for same L), even when 1 point + scalar, or when scalar = 0.
+ * @param c Curve Point constructor
+ * @param field field over CURVE.N - important that it's not over CURVE.P
+ * @param points array of L curve points
+ * @param scalars array of L scalars (aka private keys / bigints)
+ */
+function pippenger(c, field, points, scalars) {
+    // If we split scalars by some window (let's say 8 bits), every chunk will only
+    // take 256 buckets even if there are 4096 scalars, also re-uses double.
+    // TODO:
+    // - https://eprint.iacr.org/2024/750.pdf
+    // - https://tches.iacr.org/index.php/TCHES/article/view/10287
+    // 0 is accepted in scalars
+    if (!Array.isArray(points) || !Array.isArray(scalars) || scalars.length !== points.length)
+        throw new Error('arrays of points and scalars must have equal length');
+    scalars.forEach((s, i) => {
+        if (!field.isValid(s))
+            throw new Error(`wrong scalar at index ${i}`);
+    });
+    points.forEach((p, i) => {
+        if (!(p instanceof c))
+            throw new Error(`wrong point at index ${i}`);
+    });
+    const wbits = bitLen$1(BigInt(points.length));
+    const windowSize = wbits > 12 ? wbits - 3 : wbits > 4 ? wbits - 2 : wbits ? 2 : 1; // in bits
+    const MASK = (1 << windowSize) - 1;
+    const buckets = new Array(MASK + 1).fill(c.ZERO); // +1 for zero array
+    const lastBits = Math.floor((field.BITS - 1) / windowSize) * windowSize;
+    let sum = c.ZERO;
+    for (let i = lastBits; i >= 0; i -= windowSize) {
+        buckets.fill(c.ZERO);
+        for (let j = 0; j < scalars.length; j++) {
+            const scalar = scalars[j];
+            const wbits = Number((scalar >> BigInt(i)) & BigInt(MASK));
+            buckets[wbits] = buckets[wbits].add(points[j]);
+        }
+        let resI = c.ZERO; // not using this will do small speed-up, but will lose ct
+        // Skip first bucket, because it is zero
+        for (let j = buckets.length - 1, sumI = c.ZERO; j > 0; j--) {
+            sumI = sumI.add(buckets[j]);
+            resI = resI.add(sumI);
+        }
+        sum = sum.add(resI);
+        if (i !== 0)
+            for (let j = 0; j < windowSize; j++)
+                sum = sum.double();
+    }
+    return sum;
+}
 function validateBasic$1(curve) {
     validateField$1(curve.Fp);
     validateObject$1(curve, {
@@ -3293,6 +3357,7 @@ function twistedEdwards(curveDef) {
     const { Fp, n: CURVE_ORDER, prehash: prehash, hash: cHash, randomBytes, nByteLength, h: cofactor, } = CURVE;
     const MASK = _2n$7 << (BigInt(nByteLength * 8) - _1n$a);
     const modP = Fp.create; // Function overrides
+    const Fn = Field$1(CURVE.n, CURVE.nBitLength);
     // sqrt(u/v)
     const uvRatio = CURVE.uvRatio ||
         ((u, v) => {
@@ -3391,6 +3456,10 @@ function twistedEdwards(curveDef) {
             const toInv = Fp.invertBatch(points.map((p) => p.ez));
             return points.map((p, i) => p.toAffine(toInv[i])).map(Point.fromAffine);
         }
+        // Multiscalar Multiplication
+        static msm(points, scalars) {
+            return pippenger(Point, Fn, points, scalars);
+        }
         // "Private method", don't use it directly
         _setWindowSize(windowSize) {
             wnaf.setWindowSize(this, windowSize);
@@ -4040,6 +4109,10 @@ let HMAC$1 = class HMAC extends Hash$1 {
  * @param hash - function that would be used e.g. sha256
  * @param key - message key
  * @param message - message data
+ * @example
+ * import { hmac } from '@noble/hashes/hmac';
+ * import { sha256 } from '@noble/hashes/sha2';
+ * const mac1 = hmac(sha256, 'key', 'message');
  */
 const hmac$1 = (hash, key, message) => new HMAC$1(hash, key).update(message).digest();
 hmac$1.create = (hash, key) => new HMAC$1(hash, key);
@@ -4079,8 +4152,14 @@ function validatePointOpts$1(curve) {
     }
     return Object.freeze({ ...opts });
 }
-// ASN.1 DER encoding utilities
 const { bytesToNumberBE: b2n$1, hexToBytes: h2b$1 } = ut$1;
+/**
+ * ASN.1 DER encoding utilities. ASN is very complex & fragile. Format:
+ *
+ *     [0x30 (SEQUENCE), bytelength, 0x02 (INTEGER), intLength, R, 0x02 (INTEGER), intLength, S]
+ *
+ * Docs: https://letsencrypt.org/docs/a-warm-welcome-to-asn1-and-der/, https://luca.ntop.org/Teaching/Appunti/asn1.html
+ */
 const DER$1 = {
     // asn.1 DER encoding utils
     Err: class DERErr extends Error {
@@ -4088,54 +4167,103 @@ const DER$1 = {
             super(m);
         }
     },
-    _parseInt(data) {
-        const { Err: E } = DER$1;
-        if (data.length < 2 || data[0] !== 0x02)
-            throw new E('Invalid signature integer tag');
-        const len = data[1];
-        const res = data.subarray(2, len + 2);
-        if (!len || res.length !== len)
-            throw new E('Invalid signature integer: wrong length');
-        // https://crypto.stackexchange.com/a/57734 Leftmost bit of first byte is 'negative' flag,
-        // since we always use positive integers here. It must always be empty:
-        // - add zero byte if exists
-        // - if next byte doesn't have a flag, leading zero is not allowed (minimal encoding)
-        if (res[0] & 0b10000000)
-            throw new E('Invalid signature integer: negative');
-        if (res[0] === 0x00 && !(res[1] & 0b10000000))
-            throw new E('Invalid signature integer: unnecessary leading zero');
-        return { d: b2n$1(res), l: data.subarray(len + 2) }; // d is data, l is left
+    // Basic building block is TLV (Tag-Length-Value)
+    _tlv: {
+        encode: (tag, data) => {
+            const { Err: E } = DER$1;
+            if (tag < 0 || tag > 256)
+                throw new E('tlv.encode: wrong tag');
+            if (data.length & 1)
+                throw new E('tlv.encode: unpadded data');
+            const dataLen = data.length / 2;
+            const len = numberToHexUnpadded$1(dataLen);
+            if ((len.length / 2) & 128)
+                throw new E('tlv.encode: long form length too big');
+            // length of length with long form flag
+            const lenLen = dataLen > 127 ? numberToHexUnpadded$1((len.length / 2) | 128) : '';
+            return `${numberToHexUnpadded$1(tag)}${lenLen}${len}${data}`;
+        },
+        // v - value, l - left bytes (unparsed)
+        decode(tag, data) {
+            const { Err: E } = DER$1;
+            let pos = 0;
+            if (tag < 0 || tag > 256)
+                throw new E('tlv.encode: wrong tag');
+            if (data.length < 2 || data[pos++] !== tag)
+                throw new E('tlv.decode: wrong tlv');
+            const first = data[pos++];
+            const isLong = !!(first & 128); // First bit of first length byte is flag for short/long form
+            let length = 0;
+            if (!isLong)
+                length = first;
+            else {
+                // Long form: [longFlag(1bit), lengthLength(7bit), length (BE)]
+                const lenLen = first & 127;
+                if (!lenLen)
+                    throw new E('tlv.decode(long): indefinite length not supported');
+                if (lenLen > 4)
+                    throw new E('tlv.decode(long): byte length is too big'); // this will overflow u32 in js
+                const lengthBytes = data.subarray(pos, pos + lenLen);
+                if (lengthBytes.length !== lenLen)
+                    throw new E('tlv.decode: length bytes not complete');
+                if (lengthBytes[0] === 0)
+                    throw new E('tlv.decode(long): zero leftmost byte');
+                for (const b of lengthBytes)
+                    length = (length << 8) | b;
+                pos += lenLen;
+                if (length < 128)
+                    throw new E('tlv.decode(long): not minimal encoding');
+            }
+            const v = data.subarray(pos, pos + length);
+            if (v.length !== length)
+                throw new E('tlv.decode: wrong value length');
+            return { v, l: data.subarray(pos + length) };
+        },
+    },
+    // https://crypto.stackexchange.com/a/57734 Leftmost bit of first byte is 'negative' flag,
+    // since we always use positive integers here. It must always be empty:
+    // - add zero byte if exists
+    // - if next byte doesn't have a flag, leading zero is not allowed (minimal encoding)
+    _int: {
+        encode(num) {
+            const { Err: E } = DER$1;
+            if (num < _0n$6)
+                throw new E('integer: negative integers are not allowed');
+            let hex = numberToHexUnpadded$1(num);
+            // Pad with zero byte if negative flag is present
+            if (Number.parseInt(hex[0], 16) & 0b1000)
+                hex = '00' + hex;
+            if (hex.length & 1)
+                throw new E('unexpected assertion');
+            return hex;
+        },
+        decode(data) {
+            const { Err: E } = DER$1;
+            if (data[0] & 128)
+                throw new E('Invalid signature integer: negative');
+            if (data[0] === 0x00 && !(data[1] & 128))
+                throw new E('Invalid signature integer: unnecessary leading zero');
+            return b2n$1(data);
+        },
     },
     toSig(hex) {
         // parse DER signature
-        const { Err: E } = DER$1;
+        const { Err: E, _int: int, _tlv: tlv } = DER$1;
         const data = typeof hex === 'string' ? h2b$1(hex) : hex;
         abytes(data);
-        let l = data.length;
-        if (l < 2 || data[0] != 0x30)
-            throw new E('Invalid signature tag');
-        if (data[1] !== l - 2)
-            throw new E('Invalid signature: incorrect length');
-        const { d: r, l: sBytes } = DER$1._parseInt(data.subarray(2));
-        const { d: s, l: rBytesLeft } = DER$1._parseInt(sBytes);
-        if (rBytesLeft.length)
+        const { v: seqBytes, l: seqLeftBytes } = tlv.decode(0x30, data);
+        if (seqLeftBytes.length)
             throw new E('Invalid signature: left bytes after parsing');
-        return { r, s };
+        const { v: rBytes, l: rLeftBytes } = tlv.decode(0x02, seqBytes);
+        const { v: sBytes, l: sLeftBytes } = tlv.decode(0x02, rLeftBytes);
+        if (sLeftBytes.length)
+            throw new E('Invalid signature: left bytes after parsing');
+        return { r: int.decode(rBytes), s: int.decode(sBytes) };
     },
     hexFromSig(sig) {
-        // Add leading zero if first byte has negative bit enabled. More details in '_parseInt'
-        const slice = (s) => (Number.parseInt(s[0], 16) & 0b1000 ? '00' + s : s);
-        const h = (num) => {
-            const hex = num.toString(16);
-            return hex.length & 1 ? `0${hex}` : hex;
-        };
-        const s = slice(h(sig.s));
-        const r = slice(h(sig.r));
-        const shl = s.length / 2;
-        const rhl = r.length / 2;
-        const sl = h(shl);
-        const rl = h(rhl);
-        return `30${h(rhl + shl + 4)}02${rl}${r}02${sl}${s}`;
+        const { _tlv: tlv, _int: int } = DER$1;
+        const seq = `${tlv.encode(0x02, int.encode(sig.r))}${tlv.encode(0x02, int.encode(sig.s))}`;
+        return tlv.encode(0x30, seq);
     },
 };
 // Be friendly to bad ECMAScript parsers by not using bigint literals
@@ -4144,6 +4272,7 @@ const _0n$6 = BigInt(0), _1n$8 = BigInt(1); BigInt(2); const _3n$2 = BigInt(3);
 function weierstrassPoints$1(opts) {
     const CURVE = validatePointOpts$1(opts);
     const { Fp } = CURVE; // All curves has same field / group length as for now, but they can differ
+    const Fn = Field$1(CURVE.n, CURVE.nBitLength);
     const toBytes = CURVE.toBytes ||
         ((_c, point, _isCompressed) => {
             const a = point.toAffine();
@@ -4317,6 +4446,10 @@ function weierstrassPoints$1(opts) {
         static fromPrivateKey(privateKey) {
             return Point.BASE.multiply(normPrivateKeyToScalar(privateKey));
         }
+        // Multiscalar Multiplication
+        static msm(points, scalars) {
+            return pippenger(Point, Fn, points, scalars);
+        }
         // "Private method", don't use it directly
         _setWindowSize(windowSize) {
             wnaf.setWindowSize(this, windowSize);
@@ -7557,7 +7690,7 @@ const VerifiableConstants = Object.freeze({
         PUSH_NOTIFICATION: 'push-notification'
     },
     AUTH: {
-        AUTH_BJJ_CREDENTAIL_HASH: '013fd3f623559d850fb5b02ff012d0e2',
+        AUTH_BJJ_CREDENTIAL_HASH: '013fd3f623559d850fb5b02ff012d0e2',
         AUTH_BJJ_CREDENTIAL_SCHEMA_JSON_URL: 'https://schema.iden3.io/core/json/auth.json',
         AUTH_BJJ_CREDENTIAL_SCHEMA_JSONLD_URL: 'https://schema.iden3.io/core/jsonld/auth.jsonld',
         AUTH_BJJ_CREDENTIAL_TYPE: 'AuthBJJCredential',
@@ -7589,7 +7722,7 @@ var CredentialStatusType;
     CredentialStatusType["Iden3ReverseSparseMerkleTreeProof"] = "Iden3ReverseSparseMerkleTreeProof";
     // Iden3commRevocationStatusV1 is CredentialStatusType for iden3comm revocation status
     CredentialStatusType["Iden3commRevocationStatusV1"] = "Iden3commRevocationStatusV1.0";
-    // Iden3OnсhainSparseMerkleTreeProof2023 is a proof type for MTP proofs with iden3 metadata from blockchain
+    // Iden3OnchainSparseMerkleTreeProof2023 is a proof type for MTP proofs with iden3 metadata from blockchain
     CredentialStatusType["Iden3OnchainSparseMerkleTreeProof2023"] = "Iden3OnchainSparseMerkleTreeProof2023";
 })(CredentialStatusType || (CredentialStatusType = {}));
 /**
@@ -20007,7 +20140,7 @@ class W3CCredential {
     }
     async verifyIden3SparseMerkleTreeProof(proof, coreClaim, resolverURL) {
         await validateDIDDocumentAuth(proof.issuerData.id, resolverURL, proof.issuerData.state.value);
-        // root from proof == issuerData.state.сlaimsTreeRoot
+        // root from proof == issuerData.state.claimsTreeRoot
         const { hi, hv } = coreClaim.hiHv();
         const rootFromProofValue = await rootFromProof(proof.mtp, hi, hv);
         if (!rootFromProofValue.equals(proof.issuerData.state.claimsTreeRoot)) {
@@ -53858,7 +53991,7 @@ class OnChainRevocationStorage {
      *
      * Creates an instance of OnChainIssuer.
      * @public
-     * @param {string} - onhcain contract address
+     * @param {string} - onchain contract address
      * @param {string} - rpc url to connect to the blockchain
      */
     constructor(_config, contractAddress, _signer) {
@@ -54989,7 +55122,7 @@ class OnChainResolver {
         }
         return network;
     }
-    // TODO (illia-korotia): is dirty hack for mock in tests.
+    // TODO: is dirty hack for mock in tests.
     // need to pass to constructor list of state stores not list of network configs
     _getStateStorageForIssuer(issuerId) {
         const issuerChainId = getChainId(DID.blockchainFromId(issuerId), DID.networkIdFromId(issuerId));
@@ -56383,10 +56516,10 @@ function fnvHash(str) {
         hash *= BigInt(0x100000001b3);
         hash %= uint64_max;
     }
-    let shash = hash.toString(16);
-    const n = 16 - shash.length;
-    shash = '0'.repeat(n).concat(shash);
-    return shash;
+    let hashHex = hash.toString(16);
+    const n = 16 - hashHex.length;
+    hashHex = '0'.repeat(n).concat(hashHex);
+    return hashHex;
 }
 
 /**