@atlasauth/pca-mpc 0.0.0-stage → 0.1.0

package/README.md

@@ -1,3 +1,31 @@
-# Temporary Holding Version
+# @atlasauth/pca-mpc
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+PCA evolution B5 reference prototype: a multi-stakeholder Policy VM composed under secure multi-party computation (semi-honest additive secret sharing over a prime field), so user+org+regulator jointly decide allow/threshold without any party revealing its own policy.
+
+## Install
+
+```sh
+npm i @atlasauth/pca-mpc
+```
+
+Depends on the core `@atlasauth/pca` (installed transitively).
+
+## Usage
+
+```ts
+import { evaluateParty, composeSecure } from '@atlasauth/pca-mpc';
+
+// Each stakeholder evaluates its OWN private policy to a tiny decision vector { allow, t, rQuant }.
+const user = evaluateParty({ id: 'user', decideInput: userInput });
+const org = evaluateParty({ id: 'org', decideInput: orgInput });
+const regulator = evaluateParty({ id: 'regulator', decideInput: regulatorInput });
+
+// Compose under MPC: only the joint decision is revealed, no party's own policy or vector.
+const result = composeSecure([user, org, regulator]);
+result.composed;         // { allow, t, rQuant } — composed allow + MAX threshold + MAX risk
+result.opened;           // the Beaver openings (the only online messages)
+```
+
+`spdz` / `spdz-runner` provide the malicious-with-abort (dishonest-majority) layer. This computes a joint policy verdict; it does not authorize on its own — the resource server's verifier decides. See `docs/specs/pca-mpc-policy-vm.md` for the security model.
+
+Part of Proof-Carrying Authority — see `@atlasauth/pca`.

package/dist/beaver.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Secure MULTIPLICATION of two additively-shared values via Beaver triples.
+ *
+ * Additive sharing gives addition and public-scalar ops for free, but NOT multiplication (the
+ * product of two secrets is quadratic in the shares and has no local form). Beaver's trick turns one
+ * multiplication into two PUBLIC openings plus local arithmetic, using a pre-shared random triple
+ * (a, b, c=a*b):
+ *
+ *   x*y = (d+a)(e+b) = d*e + d*b + e*a + a*b     where d = x-a, e = y-b
+ *
+ * The parties open d and e (reconstruct them in the clear). Because a and b are uniform and secret,
+ * d = x-a and e = y-b are uniform masks that reveal NOTHING about x or y. Given public d, e each
+ * party then forms its share of the product locally:
+ *
+ *   z_i = c_i + d*b_i + e*a_i     (and party 0 additionally adds the public term d*e)
+ *
+ * so Σ z_i = c + d*b + e*a + d*e = a*b + d*b + e*a + d*e = x*y.
+ *
+ * PREPROCESSING MODEL (prototype): a TRUSTED DEALER generates the triples and shares them. This is a
+ * standard and legitimate semi-honest preprocessing choice; the correctness/privacy of the ONLINE
+ * phase (what the parties exchange) does not depend on the dealer beyond "the triples are correct and
+ * the a,b stay secret." A production system removes the trusted dealer with an offline triple
+ * generation protocol (OT-based or homomorphic-encryption-based), and adds MACs (SPDZ) for malicious
+ * security. See the design doc.
+ */
+import { FieldRng } from './field';
+import { type SharedValue } from './sharing';
+/** A Beaver multiplication triple, each component additively shared across the N parties. */
+export interface Triple {
+    a: SharedValue;
+    b: SharedValue;
+    c: SharedValue;
+}
+/** One opened (reconstructed, public) protocol message. `shares` are the per-party broadcasts. */
+export interface OpenedMsg {
+    label: 'd' | 'e';
+    value: bigint;
+    shares: bigint[];
+}
+/** Trusted-dealer preprocessing: generate `count` correct multiplication triples for `n` parties. */
+export declare function genTriples(count: number, n: number, rng: FieldRng): Triple[];
+/** Trusted-dealer preprocessing: one correct triple (a, b, c=a*b), each component shared. */
+export declare function genTriple(n: number, rng: FieldRng): Triple;
+/**
+ * Secure multiply: returns a sharing of x*y, consuming `triple`. Every opened value (d, e) is pushed
+ * to `transcript` when provided — that transcript IS the adversary's view of the online messages, and
+ * the privacy tests assert it reveals nothing about the inputs.
+ */
+export declare function beaverMul(x: SharedValue, y: SharedValue, triple: Triple, transcript?: OpenedMsg[]): SharedValue;

package/dist/beaver.js

@@ -0,0 +1,72 @@
+"use strict";
+/**
+ * Secure MULTIPLICATION of two additively-shared values via Beaver triples.
+ *
+ * Additive sharing gives addition and public-scalar ops for free, but NOT multiplication (the
+ * product of two secrets is quadratic in the shares and has no local form). Beaver's trick turns one
+ * multiplication into two PUBLIC openings plus local arithmetic, using a pre-shared random triple
+ * (a, b, c=a*b):
+ *
+ *   x*y = (d+a)(e+b) = d*e + d*b + e*a + a*b     where d = x-a, e = y-b
+ *
+ * The parties open d and e (reconstruct them in the clear). Because a and b are uniform and secret,
+ * d = x-a and e = y-b are uniform masks that reveal NOTHING about x or y. Given public d, e each
+ * party then forms its share of the product locally:
+ *
+ *   z_i = c_i + d*b_i + e*a_i     (and party 0 additionally adds the public term d*e)
+ *
+ * so Σ z_i = c + d*b + e*a + d*e = a*b + d*b + e*a + d*e = x*y.
+ *
+ * PREPROCESSING MODEL (prototype): a TRUSTED DEALER generates the triples and shares them. This is a
+ * standard and legitimate semi-honest preprocessing choice; the correctness/privacy of the ONLINE
+ * phase (what the parties exchange) does not depend on the dealer beyond "the triples are correct and
+ * the a,b stay secret." A production system removes the trusted dealer with an offline triple
+ * generation protocol (OT-based or homomorphic-encryption-based), and adds MACs (SPDZ) for malicious
+ * security. See the design doc.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.genTriples = genTriples;
+exports.genTriple = genTriple;
+exports.beaverMul = beaverMul;
+const field_1 = require("./field");
+const sharing_1 = require("./sharing");
+const sharing_2 = require("./sharing");
+/** Trusted-dealer preprocessing: generate `count` correct multiplication triples for `n` parties. */
+function genTriples(count, n, rng) {
+    const triples = [];
+    for (let i = 0; i < count; i++)
+        triples.push(genTriple(n, rng));
+    return triples;
+}
+/** Trusted-dealer preprocessing: one correct triple (a, b, c=a*b), each component shared. */
+function genTriple(n, rng) {
+    const a = rng.next();
+    const b = rng.next();
+    const c = (0, field_1.fmul)(a, b);
+    return { a: (0, sharing_2.share)(a, n, rng), b: (0, sharing_2.share)(b, n, rng), c: (0, sharing_2.share)(c, n, rng) };
+}
+/**
+ * Secure multiply: returns a sharing of x*y, consuming `triple`. Every opened value (d, e) is pushed
+ * to `transcript` when provided — that transcript IS the adversary's view of the online messages, and
+ * the privacy tests assert it reveals nothing about the inputs.
+ */
+function beaverMul(x, y, triple, transcript) {
+    if (x.length !== y.length)
+        throw new Error('beaverMul: operand party counts differ');
+    const dShares = (0, sharing_1.subSV)(x, triple.a);
+    const eShares = (0, sharing_1.subSV)(y, triple.b);
+    const d = (0, sharing_1.reconstruct)(dShares);
+    const e = (0, sharing_1.reconstruct)(eShares);
+    if (transcript) {
+        transcript.push({ label: 'd', value: d, shares: dShares });
+        transcript.push({ label: 'e', value: e, shares: eShares });
+    }
+    const de = (0, field_1.fmul)(d, e);
+    return triple.c.map((ci, i) => {
+        let zi = (0, field_1.fadd)(ci, (0, field_1.fadd)((0, field_1.fmul)(d, triple.b[i]), (0, field_1.fmul)(e, triple.a[i])));
+        if (i === 0)
+            zi = (0, field_1.fadd)(zi, de); // the public d*e term lives on exactly one party
+        return zi;
+    });
+}
+//# sourceMappingURL=beaver.js.map

package/dist/beaver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"beaver.js","sourceRoot":"","sources":["../src/beaver.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;;AAqBH,gCAIC;AAGD,8BAKC;AAOD,8BAqBC;AA3DD,mCAA+C;AAC/C,uCAAiE;AACjE,uCAAkC;AAgBlC,qGAAqG;AACrG,SAAgB,UAAU,CAAC,KAAa,EAAE,CAAS,EAAE,GAAa;IAChE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE;QAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAChE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,6FAA6F;AAC7F,SAAgB,SAAS,CAAC,CAAS,EAAE,GAAa;IAChD,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACrB,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACrB,MAAM,CAAC,GAAG,IAAA,YAAI,EAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrB,OAAO,EAAE,CAAC,EAAE,IAAA,eAAK,EAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,IAAA,eAAK,EAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,IAAA,eAAK,EAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED;;;;GAIG;AACH,SAAgB,SAAS,CACvB,CAAc,EACd,CAAc,EACd,MAAc,EACd,UAAwB;IAExB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACrF,MAAM,OAAO,GAAG,IAAA,eAAK,EAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,IAAA,eAAK,EAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,CAAC,GAAG,IAAA,qBAAW,EAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,CAAC,GAAG,IAAA,qBAAW,EAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,UAAU,EAAE,CAAC;QACf,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3D,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,EAAE,GAAG,IAAA,YAAI,EAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACtB,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE;QAC5B,IAAI,EAAE,GAAG,IAAA,YAAI,EAAC,EAAE,EAAE,IAAA,YAAI,EAAC,IAAA,YAAI,EAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,EAAE,IAAA,YAAI,EAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,KAAK,CAAC;YAAE,EAAE,GAAG,IAAA,YAAI,EAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,iDAAiD;QACjF,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/compose.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Composition semantics (the "meet" of stakeholder authorities) and the CLEARTEXT reference.
+ *
+ * Composition is deliberately conservative — it can only ever TIGHTEN, never loosen, matching PCA's
+ * fail-closed philosophy:
+ *   - allow  = AND over parties  (every stakeholder must admit; one deny => composed deny)
+ *   - t      = MAX over parties  (the strictest required proof strength wins)
+ *   - rQuant = MAX over parties  (the highest assessed risk wins)
+ *
+ * The secure runner (`runner.ts`) computes EXACTLY this function under MPC; `composeClear` is the
+ * ground truth the correctness tests check it against.
+ */
+import type { DecisionVector } from './party';
+/** The composed, revealed decision. */
+export interface ComposedDecision {
+    allow: 0 | 1;
+    t: 1 | 2 | 3;
+    rQuant: number;
+}
+/** Cleartext composition over the parties' decision vectors. Requires at least one party. */
+export declare function composeClear(vectors: ReadonlyArray<DecisionVector>): ComposedDecision;

package/dist/compose.js

@@ -0,0 +1,33 @@
+"use strict";
+/**
+ * Composition semantics (the "meet" of stakeholder authorities) and the CLEARTEXT reference.
+ *
+ * Composition is deliberately conservative — it can only ever TIGHTEN, never loosen, matching PCA's
+ * fail-closed philosophy:
+ *   - allow  = AND over parties  (every stakeholder must admit; one deny => composed deny)
+ *   - t      = MAX over parties  (the strictest required proof strength wins)
+ *   - rQuant = MAX over parties  (the highest assessed risk wins)
+ *
+ * The secure runner (`runner.ts`) computes EXACTLY this function under MPC; `composeClear` is the
+ * ground truth the correctness tests check it against.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.composeClear = composeClear;
+/** Cleartext composition over the parties' decision vectors. Requires at least one party. */
+function composeClear(vectors) {
+    if (vectors.length === 0)
+        throw new Error('composeClear: no parties (fail closed)');
+    let allow = 1;
+    let t = 1;
+    let rQuant = 0;
+    for (const v of vectors) {
+        if (v.allow === 0)
+            allow = 0;
+        if (v.t > t)
+            t = v.t;
+        if (v.rQuant > rQuant)
+            rQuant = v.rQuant;
+    }
+    return { allow, t, rQuant };
+}
+//# sourceMappingURL=compose.js.map

package/dist/compose.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compose.js","sourceRoot":"","sources":["../src/compose.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;AAYH,oCAWC;AAZD,6FAA6F;AAC7F,SAAgB,YAAY,CAAC,OAAsC;IACjE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACpF,IAAI,KAAK,GAAU,CAAC,CAAC;IACrB,IAAI,CAAC,GAAc,CAAC,CAAC;IACrB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC;YAAE,KAAK,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;YAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,CAAC,MAAM,GAAG,MAAM;YAAE,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC"}

package/dist/csprng.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Cryptographically-secure randomness — the default source for ALL protocol randomness (docs §7.1
+ * item c). Every secret the protocol samples — base-OT scalars `x`/`y`, the Schnorr nonce, IKNP seeds,
+ * Gilboa masks `ρ`, the MAC key shares `α_i`, triple shares `a_i`/`b_i`, and the sacrifice / input /
+ * MAC-check coefficients — is drawn here from `node:crypto.randomBytes` unless a test explicitly asks
+ * for a reproducible seeded stream.
+ *
+ * The deterministic SplitMix64 path (`field.ts` / `ot.ts`) is retained ONLY behind an explicit
+ * `testSeed`, so tests stay bit-reproducible while production never silently runs on a deterministic
+ * PRNG. The one deliberately-NON-secret source is the KOS challenge `χ` (`ot.ts`), which is a
+ * public-coin Fiat–Shamir value derived from the committed transcript — it must be reproducible by
+ * both parties and is therefore a transcript hash by design, not a secret the CSPRNG governs.
+ *
+ * NOTE on the remaining boundary (honest, docs §7.1): a real deployment also needs a *secure coin-flip*
+ * among the parties for the public MAC-check / sacrifice coefficients (here a CSPRNG stands in for that
+ * interactive sub-protocol), and a secret per-session seed management story. Using `randomBytes` closes
+ * the "deterministic PRNG" caveat; it does not itself provide the multiparty coin-flip, which is a
+ * network/protocol layer (§7.1 item: real async network).
+ */
+import { FieldRng } from './field';
+import type { OtRandom } from './ot';
+/** A minimal field-random source: `next()` yields a uniform element of F_p. `FieldRng` satisfies it. */
+export interface FieldSource {
+    next(): bigint;
+}
+/**
+ * A CSPRNG-backed field RNG. Drop-in for `FieldRng` everywhere (it extends it and overrides `next()`),
+ * so `share` / `setupMac` / `macCheck` / the no-dealer offline all accept it with no signature change.
+ * Draws unbiased elements of F_p by rejection sampling over fresh `randomBytes`.
+ */
+export declare class SecureFieldRng extends FieldRng {
+    constructor();
+    next(): bigint;
+}
+/**
+ * A CSPRNG-backed `OtRandom` (scalars in `[1, L)` by rejection, raw bytes from `randomBytes`). This is
+ * the default randomness for every base OT / OT-extension / Schnorr nonce when no test seed is set.
+ */
+export declare function secureOtRandom(): OtRandom;
+/**
+ * The field-randomness policy for the whole package: a CSPRNG by default, or a reproducible seeded
+ * `FieldRng` ONLY when an explicit `testSeed` is given. Production calls this with no argument.
+ */
+export declare function fieldRandom(opts?: {
+    testSeed?: bigint;
+}): FieldSource;

package/dist/csprng.js

@@ -0,0 +1,86 @@
+"use strict";
+/**
+ * Cryptographically-secure randomness — the default source for ALL protocol randomness (docs §7.1
+ * item c). Every secret the protocol samples — base-OT scalars `x`/`y`, the Schnorr nonce, IKNP seeds,
+ * Gilboa masks `ρ`, the MAC key shares `α_i`, triple shares `a_i`/`b_i`, and the sacrifice / input /
+ * MAC-check coefficients — is drawn here from `node:crypto.randomBytes` unless a test explicitly asks
+ * for a reproducible seeded stream.
+ *
+ * The deterministic SplitMix64 path (`field.ts` / `ot.ts`) is retained ONLY behind an explicit
+ * `testSeed`, so tests stay bit-reproducible while production never silently runs on a deterministic
+ * PRNG. The one deliberately-NON-secret source is the KOS challenge `χ` (`ot.ts`), which is a
+ * public-coin Fiat–Shamir value derived from the committed transcript — it must be reproducible by
+ * both parties and is therefore a transcript hash by design, not a secret the CSPRNG governs.
+ *
+ * NOTE on the remaining boundary (honest, docs §7.1): a real deployment also needs a *secure coin-flip*
+ * among the parties for the public MAC-check / sacrifice coefficients (here a CSPRNG stands in for that
+ * interactive sub-protocol), and a secret per-session seed management story. Using `randomBytes` closes
+ * the "deterministic PRNG" caveat; it does not itself provide the multiparty coin-flip, which is a
+ * network/protocol layer (§7.1 item: real async network).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecureFieldRng = void 0;
+exports.secureOtRandom = secureOtRandom;
+exports.fieldRandom = fieldRandom;
+const node_crypto_1 = require("node:crypto");
+const field_1 = require("./field");
+const ec_1 = require("./ec");
+const MASK64 = (1n << 64n) - 1n;
+/**
+ * A CSPRNG-backed field RNG. Drop-in for `FieldRng` everywhere (it extends it and overrides `next()`),
+ * so `share` / `setupMac` / `macCheck` / the no-dealer offline all accept it with no signature change.
+ * Draws unbiased elements of F_p by rejection sampling over fresh `randomBytes`.
+ */
+class SecureFieldRng extends field_1.FieldRng {
+    constructor() {
+        // The super ctor seeds the (now-unused) SplitMix64 state; `next()` below ignores it entirely.
+        super(0n);
+    }
+    next() {
+        // Largest multiple of p that fits in 64 bits; reject anything at/above it so `% p` is exactly uniform.
+        const limit = ((MASK64 + 1n) / field_1.PRIME) * field_1.PRIME;
+        for (;;) {
+            const buf = (0, node_crypto_1.randomBytes)(8);
+            let u = 0n;
+            for (let i = 0; i < 8; i++)
+                u = (u << 8n) | BigInt(buf[i]);
+            if (u < limit)
+                return u % field_1.PRIME;
+        }
+    }
+}
+exports.SecureFieldRng = SecureFieldRng;
+/**
+ * A CSPRNG-backed `OtRandom` (scalars in `[1, L)` by rejection, raw bytes from `randomBytes`). This is
+ * the default randomness for every base OT / OT-extension / Schnorr nonce when no test seed is set.
+ */
+function secureOtRandom() {
+    return {
+        scalar() {
+            // 32 bytes → reject the top `2^256 mod L` residues so reduction mod L is exactly uniform; reject 0.
+            const bound = (1n << 256n) - ((1n << 256n) % ec_1.L);
+            for (;;) {
+                const buf = (0, node_crypto_1.randomBytes)(32);
+                let acc = 0n;
+                for (let i = 0; i < 32; i++)
+                    acc = (acc << 8n) | BigInt(buf[i]);
+                if (acc >= bound)
+                    continue;
+                const s = acc % ec_1.L;
+                if (s !== 0n)
+                    return s;
+            }
+        },
+        bytes(n) {
+            return new Uint8Array((0, node_crypto_1.randomBytes)(n));
+        },
+    };
+}
+/**
+ * The field-randomness policy for the whole package: a CSPRNG by default, or a reproducible seeded
+ * `FieldRng` ONLY when an explicit `testSeed` is given. Production calls this with no argument.
+ */
+function fieldRandom(opts) {
+    return opts?.testSeed === undefined ? new SecureFieldRng() : new field_1.FieldRng(opts.testSeed);
+}
+//# sourceMappingURL=csprng.js.map

package/dist/csprng.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csprng.js","sourceRoot":"","sources":["../src/csprng.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;;;AAyCH,wCAkBC;AAMD,kCAEC;AAjED,6CAA0C;AAC1C,mCAA0C;AAC1C,6BAAyB;AAGzB,MAAM,MAAM,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;AAOhC;;;;GAIG;AACH,MAAa,cAAe,SAAQ,gBAAQ;IAC1C;QACE,8FAA8F;QAC9F,KAAK,CAAC,EAAE,CAAC,CAAC;IACZ,CAAC;IAEQ,IAAI;QACX,uGAAuG;QACvG,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,GAAG,aAAK,CAAC,GAAG,aAAK,CAAC;QAC9C,SAAS,CAAC;YACR,MAAM,GAAG,GAAG,IAAA,yBAAW,EAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,CAAC,GAAG,EAAE,CAAC;YACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;gBAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,CAAC;YAC5D,IAAI,CAAC,GAAG,KAAK;gBAAE,OAAO,CAAC,GAAG,aAAK,CAAC;QAClC,CAAC;IACH,CAAC;CACF;AAhBD,wCAgBC;AAED;;;GAGG;AACH,SAAgB,cAAc;IAC5B,OAAO;QACL,MAAM;YACJ,oGAAoG;YACpG,MAAM,KAAK,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,MAAC,CAAC,CAAC;YAChD,SAAS,CAAC;gBACR,MAAM,GAAG,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC;gBAC5B,IAAI,GAAG,GAAG,EAAE,CAAC;gBACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE;oBAAE,GAAG,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,CAAC;gBACjE,IAAI,GAAG,IAAI,KAAK;oBAAE,SAAS;gBAC3B,MAAM,CAAC,GAAG,GAAG,GAAG,MAAC,CAAC;gBAClB,IAAI,CAAC,KAAK,EAAE;oBAAE,OAAO,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QACD,KAAK,CAAC,CAAS;YACb,OAAO,IAAI,UAAU,CAAC,IAAA,yBAAW,EAAC,CAAC,CAAC,CAAC,CAAC;QACxC,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,WAAW,CAAC,IAA4B;IACtD,OAAO,IAAI,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,cAAc,EAAE,CAAC,CAAC,CAAC,IAAI,gBAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC3F,CAAC"}

package/dist/ec.d.ts

@@ -0,0 +1,110 @@
+/**
+ * A small, self-contained prime-order elliptic-curve group, used by the base oblivious transfer in
+ * `ot.ts`. The no-dealer offline phase (MASCOT-style triple generation) rests on real OT, and real OT
+ * rests on a real group with a hard discrete log — this module provides that group with nothing but
+ * BigInt arithmetic, so the whole stack stays dependency-free and testable in-process.
+ *
+ * Curve: **Ed25519** (twisted Edwards `−x² + y² = 1 + d·x²·y²` over `F_q`, `q = 2^255 − 19`). We work
+ * exclusively in the prime-order subgroup of order `L = 2^252 + 27742317777372353535851937790883648493`
+ * generated by the standard base point `B`, keeping every scalar in `[0, L)`; all group elements we
+ * ever form are scalar multiples of subgroup points, so they stay in the subgroup. Points are held in
+ * **extended coordinates** `(X, Y, Z, T)` with `x = X/Z`, `y = Y/Z`, `T = XY/Z`, and combined with the
+ * unified ("hwcd-3") addition law, which is *complete* on the subgroup — there are no special cases to
+ * branch on, which is exactly what keeps the implementation free of the subtle point-at-infinity bugs
+ * that plague short-Weierstrass code.
+ *
+ * SECURITY NOTES (prototype honesty, mirrored in docs §7.1):
+ *  - **Point validation IS implemented** (`isOnCurve` / `hasPrimeOrder` / `assertInSubgroup`): every
+ *    point a party RECEIVES across the OT trust boundary is validated to be on the curve and in the
+ *    prime-order subgroup (cofactor check `[L]·P = O`), and non-identity, so a malicious party cannot
+ *    inject an off-curve / small-order / mixed-order point to mount a small-subgroup attack. A
+ *    `schnorrProve`/`schnorrVerify` NIZK of knowledge of the sender's discrete log `y` (`S = y·B`)
+ *    binds `S` to a known exponent, which — with validation — is what makes the base OT malicious-secure.
+ *  - **Constant-time is NOT achieved and cannot be, in pure JS.** BigInt modular arithmetic branches on
+ *    operand size and is not constant-time; this is a genuine language/runtime boundary (see docs §7.1),
+ *    not a shortcut — full constant-time needs a native/WASM constant-time field, exactly as the TEE
+ *    seam needs real hardware. We add what is cheap and honest (constant-time byte comparison for
+ *    commitments lives in `ot.ts`), and do not pretend the field layer is constant-time.
+ *  - Discrete log in the order-`L` subgroup is the hardness the OT's receiver-choice privacy relies on.
+ */
+/** Field prime q = 2^255 − 19. */
+export declare const Q: bigint;
+/** Prime order of the base-point subgroup. Scalars live in [0, L). */
+export declare const L: bigint;
+/** A curve point in extended twisted-Edwards coordinates (X:Y:Z:T), x=X/Z, y=Y/Z, T=XY/Z. */
+export interface Point {
+    X: bigint;
+    Y: bigint;
+    Z: bigint;
+    T: bigint;
+}
+/** The identity (neutral) element, affine (0, 1). */
+export declare const IDENTITY: Point;
+/** The standard Ed25519 base point B (a generator of the order-L subgroup). */
+export declare const BASE: Point;
+/** Canonical representative in [0, q). */
+export declare function modFq(x: bigint): bigint;
+/**
+ * Unified complete addition (twisted Edwards a=−1, "add-2008-hwcd-3"). Works for P=Q too (so doubling
+ * is just `add(P, P)`), and is complete on the prime-order subgroup — no exceptional cases.
+ */
+export declare function add(p1: Point, p2: Point): Point;
+/**
+ * Dedicated doubling (twisted Edwards a=−1, "dbl-2008-hwcd") — cheaper than the unified add, used to
+ * speed up the scalar ladder. Complete on the subgroup.
+ */
+export declare function dbl(p: Point): Point;
+/** Scalar multiplication [k]P (double-and-add). k is reduced mod L; k=0 ⇒ identity. */
+export declare function mul(k: bigint, p: Point): Point;
+/** [k]·BASE. */
+export declare function mulBase(k: bigint): Point;
+/** P − Q. */
+export declare function sub(p1: Point, p2: Point): Point;
+/** −P = (−X : Y : Z : −T). */
+export declare function neg(p: Point): Point;
+/** Affine (x, y) of a point (one inversion). Identity ⇒ (0, 1). */
+export declare function toAffine(p: Point): {
+    x: bigint;
+    y: bigint;
+};
+/** Whether two points are equal as group elements (compare in affine). */
+export declare function equal(p1: Point, p2: Point): boolean;
+/** Canonical 64-byte encoding of a point (affine x‖y), the input to the OT key-derivation hash. */
+export declare function encodePoint(p: Point): Uint8Array;
+/** Raised when a received point fails on-curve / subgroup / identity validation. */
+export declare class PointValidationError extends Error {
+    constructor(message: string);
+}
+/**
+ * Whether `p`'s extended coordinates lie on the Ed25519 curve. Checks projectively (no inversion):
+ *   - `Z ≠ 0` (a valid projective point),
+ *   - the T-invariant `T·Z ≡ X·Y`,
+ *   - the twisted-Edwards equation (`a = −1`) cleared of denominators: `(Y² − X²)·Z² ≡ Z⁴ + d·X²·Y²`.
+ * An off-curve / malformed point fails here before any scalar work.
+ */
+export declare function isOnCurve(p: Point): boolean;
+/** Whether `p` is the identity (neutral) element (affine `(0, 1)`). */
+export declare function isIdentity(p: Point): boolean;
+/**
+ * The cofactor check: whether `[L]·P = O`, i.e. `p` lies in the prime-order-`L` subgroup. For an
+ * on-curve point this is true iff `p` has order dividing `L`; since `L` is prime this means order `1`
+ * (identity) or order `L`. So on-curve ∧ `hasPrimeOrder` ∧ ¬identity ⟺ a genuine prime-order point.
+ * Rejects every small-order point (order | 8) and every mixed-order point (order `h·L`, `h | 8`, `h>1`).
+ */
+export declare function hasPrimeOrder(p: Point): boolean;
+/** Whether `p` is a valid non-identity point of the prime-order subgroup (the OT point contract). */
+export declare function isInSubgroup(p: Point): boolean;
+/** Assert `p` is a valid non-identity prime-order-subgroup point, else throw `PointValidationError`. */
+export declare function assertInSubgroup(p: Point, label?: string): void;
+/** A Fiat–Shamir Schnorr proof of knowledge of `y` s.t. `S = y·B`: commitment `U = r·B` and `z = r + e·y`. */
+export interface SchnorrProof {
+    U: Point;
+    z: bigint;
+}
+/** Prove knowledge of `y` with `S = y·B`. `rnd` draws the (secret) nonce `r ∈ [1, L)`. */
+export declare function schnorrProve(y: bigint, S: Point, rnd: () => bigint): SchnorrProof;
+/**
+ * Verify a Schnorr proof for `S`: `z` is in range, `U` is a valid subgroup point, and `z·B = U + e·S`
+ * for the recomputed challenge `e`. Returns false on any failure (the OT layer turns that into an abort).
+ */
+export declare function schnorrVerify(S: Point, proof: SchnorrProof): boolean;