@atlasauth/pca-mpc 0.0.0-stage → 0.1.0

package/dist/ec.js

@@ -0,0 +1,306 @@
+"use strict";
+/**
+ * A small, self-contained prime-order elliptic-curve group, used by the base oblivious transfer in
+ * `ot.ts`. The no-dealer offline phase (MASCOT-style triple generation) rests on real OT, and real OT
+ * rests on a real group with a hard discrete log — this module provides that group with nothing but
+ * BigInt arithmetic, so the whole stack stays dependency-free and testable in-process.
+ *
+ * Curve: **Ed25519** (twisted Edwards `−x² + y² = 1 + d·x²·y²` over `F_q`, `q = 2^255 − 19`). We work
+ * exclusively in the prime-order subgroup of order `L = 2^252 + 27742317777372353535851937790883648493`
+ * generated by the standard base point `B`, keeping every scalar in `[0, L)`; all group elements we
+ * ever form are scalar multiples of subgroup points, so they stay in the subgroup. Points are held in
+ * **extended coordinates** `(X, Y, Z, T)` with `x = X/Z`, `y = Y/Z`, `T = XY/Z`, and combined with the
+ * unified ("hwcd-3") addition law, which is *complete* on the subgroup — there are no special cases to
+ * branch on, which is exactly what keeps the implementation free of the subtle point-at-infinity bugs
+ * that plague short-Weierstrass code.
+ *
+ * SECURITY NOTES (prototype honesty, mirrored in docs §7.1):
+ *  - **Point validation IS implemented** (`isOnCurve` / `hasPrimeOrder` / `assertInSubgroup`): every
+ *    point a party RECEIVES across the OT trust boundary is validated to be on the curve and in the
+ *    prime-order subgroup (cofactor check `[L]·P = O`), and non-identity, so a malicious party cannot
+ *    inject an off-curve / small-order / mixed-order point to mount a small-subgroup attack. A
+ *    `schnorrProve`/`schnorrVerify` NIZK of knowledge of the sender's discrete log `y` (`S = y·B`)
+ *    binds `S` to a known exponent, which — with validation — is what makes the base OT malicious-secure.
+ *  - **Constant-time is NOT achieved and cannot be, in pure JS.** BigInt modular arithmetic branches on
+ *    operand size and is not constant-time; this is a genuine language/runtime boundary (see docs §7.1),
+ *    not a shortcut — full constant-time needs a native/WASM constant-time field, exactly as the TEE
+ *    seam needs real hardware. We add what is cheap and honest (constant-time byte comparison for
+ *    commitments lives in `ot.ts`), and do not pretend the field layer is constant-time.
+ *  - Discrete log in the order-`L` subgroup is the hardness the OT's receiver-choice privacy relies on.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PointValidationError = exports.BASE = exports.IDENTITY = exports.L = exports.Q = void 0;
+exports.modFq = modFq;
+exports.add = add;
+exports.dbl = dbl;
+exports.mul = mul;
+exports.mulBase = mulBase;
+exports.sub = sub;
+exports.neg = neg;
+exports.toAffine = toAffine;
+exports.equal = equal;
+exports.encodePoint = encodePoint;
+exports.isOnCurve = isOnCurve;
+exports.isIdentity = isIdentity;
+exports.hasPrimeOrder = hasPrimeOrder;
+exports.isInSubgroup = isInSubgroup;
+exports.assertInSubgroup = assertInSubgroup;
+exports.schnorrProve = schnorrProve;
+exports.schnorrVerify = schnorrVerify;
+const node_crypto_1 = require("node:crypto");
+/** Field prime q = 2^255 − 19. */
+exports.Q = 2n ** 255n - 19n;
+/** Prime order of the base-point subgroup. Scalars live in [0, L). */
+exports.L = 2n ** 252n + 27742317777372353535851937790883648493n;
+// d = −121665 / 121666 (mod q).
+const D = modFq(-121665n * invFq(121666n));
+/** The identity (neutral) element, affine (0, 1). */
+exports.IDENTITY = { X: 0n, Y: 1n, Z: 1n, T: 0n };
+/** The standard Ed25519 base point B (a generator of the order-L subgroup). */
+exports.BASE = fromAffine(15112221349535400772501151409588531511454012693041857206046113283949847762202n, 46316835694926478169428394003475163141307993866256225615783033603165251855960n);
+/** Canonical representative in [0, q). */
+function modFq(x) {
+    const r = x % exports.Q;
+    return r >= 0n ? r : r + exports.Q;
+}
+/** Modular inverse in F_q via Fermat (q prime): a^(q−2). */
+function invFq(a) {
+    return powFq(modFq(a), exports.Q - 2n);
+}
+function powFq(base, exp) {
+    let b = modFq(base);
+    let e = exp;
+    let acc = 1n;
+    while (e > 0n) {
+        if (e & 1n)
+            acc = (acc * b) % exports.Q;
+        b = (b * b) % exports.Q;
+        e >>= 1n;
+    }
+    return acc;
+}
+function fromAffine(x, y) {
+    const X = modFq(x);
+    const Y = modFq(y);
+    return { X, Y, Z: 1n, T: modFq(X * Y) };
+}
+/**
+ * Unified complete addition (twisted Edwards a=−1, "add-2008-hwcd-3"). Works for P=Q too (so doubling
+ * is just `add(P, P)`), and is complete on the prime-order subgroup — no exceptional cases.
+ */
+function add(p1, p2) {
+    const A = (modFq(p1.Y - p1.X) * modFq(p2.Y - p2.X)) % exports.Q;
+    const B = (modFq(p1.Y + p1.X) * modFq(p2.Y + p2.X)) % exports.Q;
+    const C = (((p1.T * 2n) % exports.Q) * D % exports.Q) * p2.T % exports.Q;
+    const Dd = (((p1.Z * 2n) % exports.Q) * p2.Z) % exports.Q;
+    const E = modFq(B - A);
+    const F = modFq(Dd - C);
+    const G = modFq(Dd + C);
+    const H = modFq(B + A);
+    return {
+        X: (E * F) % exports.Q,
+        Y: (G * H) % exports.Q,
+        T: (E * H) % exports.Q,
+        Z: (F * G) % exports.Q,
+    };
+}
+/**
+ * Dedicated doubling (twisted Edwards a=−1, "dbl-2008-hwcd") — cheaper than the unified add, used to
+ * speed up the scalar ladder. Complete on the subgroup.
+ */
+function dbl(p) {
+    const A = (p.X * p.X) % exports.Q;
+    const B = (p.Y * p.Y) % exports.Q;
+    const C = (2n * ((p.Z * p.Z) % exports.Q)) % exports.Q;
+    const Dd = modFq(-A); // a·A with a = −1
+    const s = modFq(p.X + p.Y);
+    const E = modFq((s * s) % exports.Q - A - B);
+    const G = modFq(Dd + B);
+    const F = modFq(G - C);
+    const H = modFq(Dd - B);
+    return {
+        X: (E * F) % exports.Q,
+        Y: (G * H) % exports.Q,
+        T: (E * H) % exports.Q,
+        Z: (F * G) % exports.Q,
+    };
+}
+/** Scalar multiplication [k]P (double-and-add). k is reduced mod L; k=0 ⇒ identity. */
+function mul(k, p) {
+    let e = k % exports.L;
+    if (e < 0n)
+        e += exports.L;
+    let acc = exports.IDENTITY;
+    let base = p;
+    while (e > 0n) {
+        if (e & 1n)
+            acc = add(acc, base);
+        base = dbl(base);
+        e >>= 1n;
+    }
+    return acc;
+}
+/** [k]·BASE. */
+function mulBase(k) {
+    return mul(k, exports.BASE);
+}
+/** P − Q. */
+function sub(p1, p2) {
+    return add(p1, neg(p2));
+}
+/** −P = (−X : Y : Z : −T). */
+function neg(p) {
+    return { X: modFq(-p.X), Y: p.Y, Z: p.Z, T: modFq(-p.T) };
+}
+/** Affine (x, y) of a point (one inversion). Identity ⇒ (0, 1). */
+function toAffine(p) {
+    const zinv = invFq(p.Z);
+    return { x: modFq(p.X * zinv), y: modFq(p.Y * zinv) };
+}
+/** Whether two points are equal as group elements (compare in affine). */
+function equal(p1, p2) {
+    // X1*Z2 == X2*Z1 and Y1*Z2 == Y2*Z1 (projective equality, no inversion).
+    return (modFq(p1.X * p2.Z) === modFq(p2.X * p1.Z) && modFq(p1.Y * p2.Z) === modFq(p2.Y * p1.Z));
+}
+/** 32-byte little-endian encoding of a field element (for hashing points deterministically). */
+function feBytes(a) {
+    const out = new Uint8Array(32);
+    let v = modFq(a);
+    for (let i = 0; i < 32; i++) {
+        out[i] = Number(v & 0xffn);
+        v >>= 8n;
+    }
+    return out;
+}
+/** Canonical 64-byte encoding of a point (affine x‖y), the input to the OT key-derivation hash. */
+function encodePoint(p) {
+    const { x, y } = toAffine(p);
+    const out = new Uint8Array(64);
+    out.set(feBytes(x), 0);
+    out.set(feBytes(y), 32);
+    return out;
+}
+// ==================================================================================================
+// POINT VALIDATION (malicious-security hardening, docs §7.1 item b).
+//
+// A party must never trust a group element received from a (possibly malicious) peer. Three checks
+// together reject every point that could enable a small-subgroup / invalid-curve attack:
+//   (1) on-curve:   the extended coordinates satisfy the twisted-Edwards equation (and the T-invariant),
+//   (2) subgroup:   [L]·P = O, the cofactor check — rejects small-order (order | 8) AND mixed-order
+//                   points, so only genuine order-L (prime-order subgroup) points survive,
+//   (3) non-identity where the protocol forbids it (S = y·B with y = 0, or a degenerate R).
+// These are wired into every OT point decode in `ot.ts`.
+// ==================================================================================================
+/** Raised when a received point fails on-curve / subgroup / identity validation. */
+class PointValidationError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'PointValidationError';
+    }
+}
+exports.PointValidationError = PointValidationError;
+/**
+ * Scalar multiplication `[k]·P` WITHOUT the mod-L reduction that `mul` applies. `mul` reduces `k mod L`
+ * (correct for subgroup scalars, but it would turn `[L]·P` into `[0]·P = O` for every P and so cannot
+ * test subgroup membership). This raw ladder is used only by `hasPrimeOrder`.
+ */
+function scalarMulRaw(k, p) {
+    let e = k < 0n ? -k : k;
+    let acc = exports.IDENTITY;
+    let base = p;
+    while (e > 0n) {
+        if (e & 1n)
+            acc = add(acc, base);
+        base = dbl(base);
+        e >>= 1n;
+    }
+    return acc;
+}
+/**
+ * Whether `p`'s extended coordinates lie on the Ed25519 curve. Checks projectively (no inversion):
+ *   - `Z ≠ 0` (a valid projective point),
+ *   - the T-invariant `T·Z ≡ X·Y`,
+ *   - the twisted-Edwards equation (`a = −1`) cleared of denominators: `(Y² − X²)·Z² ≡ Z⁴ + d·X²·Y²`.
+ * An off-curve / malformed point fails here before any scalar work.
+ */
+function isOnCurve(p) {
+    if (modFq(p.Z) === 0n)
+        return false;
+    if (modFq(p.T * p.Z) !== modFq(p.X * p.Y))
+        return false;
+    const X2 = modFq(p.X * p.X);
+    const Y2 = modFq(p.Y * p.Y);
+    const Z2 = modFq(p.Z * p.Z);
+    const lhs = modFq((Y2 - X2) * Z2);
+    const Z4 = modFq(Z2 * Z2);
+    const dxy = modFq(modFq(D * X2) * Y2);
+    const rhs = modFq(Z4 + dxy);
+    return lhs === rhs;
+}
+/** Whether `p` is the identity (neutral) element (affine `(0, 1)`). */
+function isIdentity(p) {
+    return equal(p, exports.IDENTITY);
+}
+/**
+ * The cofactor check: whether `[L]·P = O`, i.e. `p` lies in the prime-order-`L` subgroup. For an
+ * on-curve point this is true iff `p` has order dividing `L`; since `L` is prime this means order `1`
+ * (identity) or order `L`. So on-curve ∧ `hasPrimeOrder` ∧ ¬identity ⟺ a genuine prime-order point.
+ * Rejects every small-order point (order | 8) and every mixed-order point (order `h·L`, `h | 8`, `h>1`).
+ */
+function hasPrimeOrder(p) {
+    return equal(scalarMulRaw(exports.L, p), exports.IDENTITY);
+}
+/** Whether `p` is a valid non-identity point of the prime-order subgroup (the OT point contract). */
+function isInSubgroup(p) {
+    return isOnCurve(p) && !isIdentity(p) && hasPrimeOrder(p);
+}
+/** Assert `p` is a valid non-identity prime-order-subgroup point, else throw `PointValidationError`. */
+function assertInSubgroup(p, label = 'point') {
+    if (!isOnCurve(p))
+        throw new PointValidationError(`${label}: not on curve`);
+    if (isIdentity(p))
+        throw new PointValidationError(`${label}: identity element (forbidden here)`);
+    if (!hasPrimeOrder(p)) {
+        throw new PointValidationError(`${label}: not in the prime-order subgroup (small-order/cofactor)`);
+    }
+}
+const TAG_SCHNORR = new TextEncoder().encode('atlas-pca-mpc/schnorr-dlog');
+/** Fiat–Shamir challenge `e = H(tag ‖ B ‖ S ‖ U) mod L` (64 hash bytes ⇒ negligible modular bias). */
+function schnorrChallenge(S, U) {
+    const d = (0, node_crypto_1.createHash)('sha512')
+        .update(TAG_SCHNORR)
+        .update(encodePoint(exports.BASE))
+        .update(encodePoint(S))
+        .update(encodePoint(U))
+        .digest();
+    let acc = 0n;
+    for (const b of d)
+        acc = (acc << 8n) | BigInt(b);
+    return acc % exports.L;
+}
+/** Prove knowledge of `y` with `S = y·B`. `rnd` draws the (secret) nonce `r ∈ [1, L)`. */
+function schnorrProve(y, S, rnd) {
+    // The nonce must be a non-zero subgroup scalar; `rnd` already draws from [1, L), the guard is belt-and-braces.
+    let r = ((rnd() % exports.L) + exports.L) % exports.L;
+    if (r === 0n)
+        r = 1n;
+    const U = mulBase(r);
+    const e = schnorrChallenge(S, U);
+    let z = (r + e * (((y % exports.L) + exports.L) % exports.L)) % exports.L;
+    if (z < 0n)
+        z += exports.L;
+    return { U, z };
+}
+/**
+ * Verify a Schnorr proof for `S`: `z` is in range, `U` is a valid subgroup point, and `z·B = U + e·S`
+ * for the recomputed challenge `e`. Returns false on any failure (the OT layer turns that into an abort).
+ */
+function schnorrVerify(S, proof) {
+    if (proof.z < 0n || proof.z >= exports.L)
+        return false;
+    if (!isInSubgroup(proof.U))
+        return false;
+    const e = schnorrChallenge(S, proof.U);
+    return equal(mulBase(proof.z), add(proof.U, mul(e, S)));
+}
+//# sourceMappingURL=ec.js.map

package/dist/ec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ec.js","sourceRoot":"","sources":["../src/ec.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;;;AA+BH,sBAGC;AA6BD,kBAeC;AAMD,kBAgBC;AAGD,kBAWC;AAGD,0BAEC;AAGD,kBAEC;AAGD,kBAEC;AAGD,4BAGC;AAGD,sBAKC;AAcD,kCAMC;AA8CD,8BAWC;AAGD,gCAEC;AAQD,sCAEC;AAGD,oCAEC;AAGD,4CAMC;AAiCD,oCASC;AAMD,sCAKC;AA5SD,6CAAyC;AAEzC,kCAAkC;AACrB,QAAA,CAAC,GAAG,EAAE,IAAI,IAAI,GAAG,GAAG,CAAC;AAElC,sEAAsE;AACzD,QAAA,CAAC,GAAG,EAAE,IAAI,IAAI,GAAG,uCAAuC,CAAC;AAEtE,gCAAgC;AAChC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;AAU3C,qDAAqD;AACxC,QAAA,QAAQ,GAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC;AAE9D,+EAA+E;AAClE,QAAA,IAAI,GAAU,UAAU,CACnC,8EAA8E,EAC9E,8EAA8E,CAC/E,CAAC;AAEF,0CAA0C;AAC1C,SAAgB,KAAK,CAAC,CAAS;IAC7B,MAAM,CAAC,GAAG,CAAC,GAAG,SAAC,CAAC;IAChB,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,SAAC,CAAC;AAC7B,CAAC;AAED,4DAA4D;AAC5D,SAAS,KAAK,CAAC,CAAS;IACtB,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,SAAC,GAAG,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,KAAK,CAAC,IAAY,EAAE,GAAW;IACtC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IACpB,IAAI,CAAC,GAAG,GAAG,CAAC;IACZ,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC;QACd,IAAI,CAAC,GAAG,EAAE;YAAE,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,SAAC,CAAC;QAChC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,SAAC,CAAC;QAChB,CAAC,KAAK,EAAE,CAAC;IACX,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,CAAS,EAAE,CAAS;IACtC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACnB,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACnB,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;AAC1C,CAAC;AAED;;;GAGG;AACH,SAAgB,GAAG,CAAC,EAAS,EAAE,EAAS;IACtC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,SAAC,CAAC;IACxD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,SAAC,CAAC;IACxD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,SAAC,CAAC,GAAG,CAAC,GAAG,SAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,SAAC,CAAC;IACjD,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,SAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,SAAC,CAAC;IAC1C,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,MAAM,CAAC,GAAG,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACxB,MAAM,CAAC,GAAG,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACxB,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,OAAO;QACL,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,SAAC;QACd,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,SAAC;QACd,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,SAAC;QACd,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,SAAC;KACf,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,GAAG,CAAC,CAAQ;IAC1B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,SAAC,CAAC;IAC1B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,SAAC,CAAC;IAC1B,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,SAAC,CAAC,CAAC,GAAG,SAAC,CAAC;IACvC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB;IACxC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,SAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,GAAG,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACxB,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,MAAM,CAAC,GAAG,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACxB,OAAO;QACL,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,SAAC;QACd,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,SAAC;QACd,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,SAAC;QACd,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,SAAC;KACf,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,SAAgB,GAAG,CAAC,CAAS,EAAE,CAAQ;IACrC,IAAI,CAAC,GAAG,CAAC,GAAG,SAAC,CAAC;IACd,IAAI,CAAC,GAAG,EAAE;QAAE,CAAC,IAAI,SAAC,CAAC;IACnB,IAAI,GAAG,GAAG,gBAAQ,CAAC;IACnB,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC;QACd,IAAI,CAAC,GAAG,EAAE;YAAE,GAAG,GAAG,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACjC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC,KAAK,EAAE,CAAC;IACX,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gBAAgB;AAChB,SAAgB,OAAO,CAAC,CAAS;IAC/B,OAAO,GAAG,CAAC,CAAC,EAAE,YAAI,CAAC,CAAC;AACtB,CAAC;AAED,aAAa;AACb,SAAgB,GAAG,CAAC,EAAS,EAAE,EAAS;IACtC,OAAO,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AAC1B,CAAC;AAED,8BAA8B;AAC9B,SAAgB,GAAG,CAAC,CAAQ;IAC1B,OAAO,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED,mEAAmE;AACnE,SAAgB,QAAQ,CAAC,CAAQ;IAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;AACxD,CAAC;AAED,0EAA0E;AAC1E,SAAgB,KAAK,CAAC,EAAS,EAAE,EAAS;IACxC,yEAAyE;IACzE,OAAO,CACL,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CACvF,CAAC;AACJ,CAAC;AAED,gGAAgG;AAChG,SAAS,OAAO,CAAC,CAAS;IACxB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;QAC3B,CAAC,KAAK,EAAE,CAAC;IACX,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mGAAmG;AACnG,SAAgB,WAAW,CAAC,CAAQ;IAClC,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACvB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACxB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,qGAAqG;AACrG,qEAAqE;AACrE,EAAE;AACF,mGAAmG;AACnG,yFAAyF;AACzF,yGAAyG;AACzG,oGAAoG;AACpG,2FAA2F;AAC3F,4FAA4F;AAC5F,yDAAyD;AACzD,qGAAqG;AAErG,oFAAoF;AACpF,MAAa,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AALD,oDAKC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,CAAS,EAAE,CAAQ;IACvC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,GAAG,GAAG,gBAAQ,CAAC;IACnB,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC;QACd,IAAI,CAAC,GAAG,EAAE;YAAE,GAAG,GAAG,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACjC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC,KAAK,EAAE,CAAC;IACX,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,SAAS,CAAC,CAAQ;IAChC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;IAClC,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1B,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,KAAK,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC;IAC5B,OAAO,GAAG,KAAK,GAAG,CAAC;AACrB,CAAC;AAED,uEAAuE;AACvE,SAAgB,UAAU,CAAC,CAAQ;IACjC,OAAO,KAAK,CAAC,CAAC,EAAE,gBAAQ,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;GAKG;AACH,SAAgB,aAAa,CAAC,CAAQ;IACpC,OAAO,KAAK,CAAC,YAAY,CAAC,SAAC,EAAE,CAAC,CAAC,EAAE,gBAAQ,CAAC,CAAC;AAC7C,CAAC;AAED,qGAAqG;AACrG,SAAgB,YAAY,CAAC,CAAQ;IACnC,OAAO,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,wGAAwG;AACxG,SAAgB,gBAAgB,CAAC,CAAQ,EAAE,KAAK,GAAG,OAAO;IACxD,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,oBAAoB,CAAC,GAAG,KAAK,gBAAgB,CAAC,CAAC;IAC5E,IAAI,UAAU,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,oBAAoB,CAAC,GAAG,KAAK,qCAAqC,CAAC,CAAC;IACjG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,oBAAoB,CAAC,GAAG,KAAK,0DAA0D,CAAC,CAAC;IACrG,CAAC;AACH,CAAC;AAiBD,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC;AAE3E,sGAAsG;AACtG,SAAS,gBAAgB,CAAC,CAAQ,EAAE,CAAQ;IAC1C,MAAM,CAAC,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC;SAC3B,MAAM,CAAC,WAAW,CAAC;SACnB,MAAM,CAAC,WAAW,CAAC,YAAI,CAAC,CAAC;SACzB,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;SACtB,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;SACtB,MAAM,EAAE,CAAC;IACZ,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,CAAC;QAAE,GAAG,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACjD,OAAO,GAAG,GAAG,SAAC,CAAC;AACjB,CAAC;AAED,0FAA0F;AAC1F,SAAgB,YAAY,CAAC,CAAS,EAAE,CAAQ,EAAE,GAAiB;IACjE,+GAA+G;IAC/G,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,SAAC,CAAC,GAAG,SAAC,CAAC,GAAG,SAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,EAAE;QAAE,CAAC,GAAG,EAAE,CAAC;IACrB,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACrB,MAAM,CAAC,GAAG,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,SAAC,CAAC,GAAG,SAAC,CAAC,GAAG,SAAC,CAAC,CAAC,GAAG,SAAC,CAAC;IAC1C,IAAI,CAAC,GAAG,EAAE;QAAE,CAAC,IAAI,SAAC,CAAC;IACnB,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,SAAgB,aAAa,CAAC,CAAQ,EAAE,KAAmB;IACzD,IAAI,KAAK,CAAC,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,CAAC,IAAI,SAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,CAAC,GAAG,gBAAgB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACvC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC"}

package/dist/field.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Arithmetic in the prime field F_p used for additive secret sharing.
+ *
+ * p = 2^61 - 1 (the Mersenne prime M61). It is wider than any value the composition ever shares
+ * (bits, thermometer bits, small sums), so no secret ever wraps; sharing randomness lives in the
+ * full field so that any single share is (information-theoretically) uniform and independent of the
+ * secret. All arithmetic is BigInt and exact — never floating point — so the protocol is
+ * bit-deterministic and verifier-reproducible.
+ *
+ * RANDOMNESS (docs §7.1 item "CSPRNG — done"): the `FieldRng` below is a deterministic SplitMix64, kept
+ * ONLY for bit-reproducible tests behind an explicit seed. It is NOT the default: the protocol draws
+ * all sharing/triple/MAC randomness from the CSPRNG `SecureFieldRng` / `secureOtRandom` in `csprng.ts`
+ * (`node:crypto.randomBytes`) unless a test explicitly asks for the seeded stream. `SecureFieldRng`
+ * extends this class and overrides `next()`, so it is a drop-in wherever a `FieldRng` is accepted.
+ */
+export declare const PRIME: bigint;
+/** Canonical representative in [0, p). */
+export declare function mod(x: bigint): bigint;
+export declare const fadd: (a: bigint, b: bigint) => bigint;
+export declare const fsub: (a: bigint, b: bigint) => bigint;
+export declare const fmul: (a: bigint, b: bigint) => bigint;
+export declare const fneg: (a: bigint) => bigint;
+/**
+ * Deterministic SplitMix64, drawing UNBIASED field elements by rejection sampling (reject the top
+ * 2^64 mod p = 8 residues so the modulo is exactly uniform). Deterministic for reproducible tests;
+ * see the security note above for production.
+ */
+export declare class FieldRng {
+    private s;
+    constructor(seed?: bigint);
+    private nextU64;
+    /** Uniform element of F_p (unbiased). */
+    next(): bigint;
+}

package/dist/field.js

@@ -0,0 +1,65 @@
+"use strict";
+/**
+ * Arithmetic in the prime field F_p used for additive secret sharing.
+ *
+ * p = 2^61 - 1 (the Mersenne prime M61). It is wider than any value the composition ever shares
+ * (bits, thermometer bits, small sums), so no secret ever wraps; sharing randomness lives in the
+ * full field so that any single share is (information-theoretically) uniform and independent of the
+ * secret. All arithmetic is BigInt and exact — never floating point — so the protocol is
+ * bit-deterministic and verifier-reproducible.
+ *
+ * RANDOMNESS (docs §7.1 item "CSPRNG — done"): the `FieldRng` below is a deterministic SplitMix64, kept
+ * ONLY for bit-reproducible tests behind an explicit seed. It is NOT the default: the protocol draws
+ * all sharing/triple/MAC randomness from the CSPRNG `SecureFieldRng` / `secureOtRandom` in `csprng.ts`
+ * (`node:crypto.randomBytes`) unless a test explicitly asks for the seeded stream. `SecureFieldRng`
+ * extends this class and overrides `next()`, so it is a drop-in wherever a `FieldRng` is accepted.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FieldRng = exports.fneg = exports.fmul = exports.fsub = exports.fadd = exports.PRIME = void 0;
+exports.mod = mod;
+exports.PRIME = 2n ** 61n - 1n;
+const MASK64 = (1n << 64n) - 1n;
+/** Canonical representative in [0, p). */
+function mod(x) {
+    const r = x % exports.PRIME;
+    return r >= 0n ? r : r + exports.PRIME;
+}
+const fadd = (a, b) => mod(a + b);
+exports.fadd = fadd;
+const fsub = (a, b) => mod(a - b);
+exports.fsub = fsub;
+const fmul = (a, b) => mod(a * b);
+exports.fmul = fmul;
+const fneg = (a) => mod(-a);
+exports.fneg = fneg;
+/**
+ * Deterministic SplitMix64, drawing UNBIASED field elements by rejection sampling (reject the top
+ * 2^64 mod p = 8 residues so the modulo is exactly uniform). Deterministic for reproducible tests;
+ * see the security note above for production.
+ */
+class FieldRng {
+    s;
+    constructor(seed = 0x243f6a8885a308d3n) {
+        this.s = seed & MASK64;
+    }
+    nextU64() {
+        this.s = (this.s + 0x9e3779b97f4a7c15n) & MASK64;
+        let z = this.s;
+        z = ((z ^ (z >> 30n)) * 0xbf58476d1ce4e5b9n) & MASK64;
+        z = ((z ^ (z >> 27n)) * 0x94d049bb133111ebn) & MASK64;
+        z = (z ^ (z >> 31n)) & MASK64;
+        return z;
+    }
+    /** Uniform element of F_p (unbiased). */
+    next() {
+        // Largest multiple of p that fits in 64 bits; drop anything at or above it so `% PRIME` is uniform.
+        const limit = ((MASK64 + 1n) / exports.PRIME) * exports.PRIME;
+        for (;;) {
+            const u = this.nextU64();
+            if (u < limit)
+                return u % exports.PRIME;
+        }
+    }
+}
+exports.FieldRng = FieldRng;
+//# sourceMappingURL=field.js.map

package/dist/field.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"field.js","sourceRoot":"","sources":["../src/field.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;;AAOH,kBAGC;AARY,QAAA,KAAK,GAAG,EAAE,IAAI,GAAG,GAAG,EAAE,CAAC;AAEpC,MAAM,MAAM,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;AAEhC,0CAA0C;AAC1C,SAAgB,GAAG,CAAC,CAAS;IAC3B,MAAM,CAAC,GAAG,CAAC,GAAG,aAAK,CAAC;IACpB,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,aAAK,CAAC;AACjC,CAAC;AAEM,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,CAAS,EAAU,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AAApD,QAAA,IAAI,QAAgD;AAC1D,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,CAAS,EAAU,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AAApD,QAAA,IAAI,QAAgD;AAC1D,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,CAAS,EAAU,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AAApD,QAAA,IAAI,QAAgD;AAC1D,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAAtC,QAAA,IAAI,QAAkC;AAEnD;;;;GAIG;AACH,MAAa,QAAQ;IACX,CAAC,CAAS;IAElB,YAAY,OAAe,mBAAmB;QAC5C,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,MAAM,CAAC;IACzB,CAAC;IAEO,OAAO;QACb,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,mBAAmB,CAAC,GAAG,MAAM,CAAC;QACjD,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;QACf,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,mBAAmB,CAAC,GAAG,MAAM,CAAC;QACtD,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,mBAAmB,CAAC,GAAG,MAAM,CAAC;QACtD,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC;QAC9B,OAAO,CAAC,CAAC;IACX,CAAC;IAED,yCAAyC;IACzC,IAAI;QACF,oGAAoG;QACpG,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,GAAG,aAAK,CAAC,GAAG,aAAK,CAAC;QAC9C,SAAS,CAAC;YACR,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YACzB,IAAI,CAAC,GAAG,KAAK;gBAAE,OAAO,CAAC,GAAG,aAAK,CAAC;QAClC,CAAC;IACH,CAAC;CACF;AAzBD,4BAyBC"}

package/dist/gf128.d.ts

@@ -0,0 +1,23 @@
+/**
+ * GF(2^128) arithmetic — the field the KOS correlation check lives in (`ot.ts`).
+ *
+ * The malicious-secure OT-extension consistency check (KOS) folds every row of the extension matrix
+ * into a single random linear combination over GF(2^κ) with κ = 128, and verifies one field equation.
+ * A cheating receiver who deviates in the extension matrix passes that equation with probability at
+ * most `2^{-128}` (the field size), which is what upgrades IKNP from semi-honest to malicious-secure.
+ *
+ * We use the standard GF(2^128) with reduction polynomial `x^128 + x^7 + x^2 + x + 1` (the GCM /
+ * "0x87" polynomial). Elements are 128-bit `bigint`s, bit `i` = coefficient of `x^i`. Addition is XOR.
+ * Multiplication is schoolbook carryless multiply with reduction; `mulByXi` (multiply by `x^i`) is the
+ * repeated-shift form used by the column-domain check so the hot path pays no full 128×128 multiply
+ * per row. This is a textbook field (BigInt, not constant-time) — sound for the in-process prototype;
+ * see docs §7.1 for the constant-time boundary.
+ */
+/** Field addition in GF(2^128): XOR (masked to 128 bits). */
+export declare function gf128Add(a: bigint, b: bigint): bigint;
+/** Multiply by `x` (one step of the LFSR): shift left 1, reduce if it overflowed bit 127. */
+export declare function gf128MulX(v: bigint): bigint;
+/** Multiply by `x^i` (i ≥ 0): i LFSR steps. Used by the column-domain KOS fold. */
+export declare function gf128MulByXi(v: bigint, i: number): bigint;
+/** Full GF(2^128) multiplication (carryless multiply + reduction), right-to-left over the bits of `b`. */
+export declare function gf128Mul(a: bigint, b: bigint): bigint;

package/dist/gf128.js

@@ -0,0 +1,59 @@
+"use strict";
+/**
+ * GF(2^128) arithmetic — the field the KOS correlation check lives in (`ot.ts`).
+ *
+ * The malicious-secure OT-extension consistency check (KOS) folds every row of the extension matrix
+ * into a single random linear combination over GF(2^κ) with κ = 128, and verifies one field equation.
+ * A cheating receiver who deviates in the extension matrix passes that equation with probability at
+ * most `2^{-128}` (the field size), which is what upgrades IKNP from semi-honest to malicious-secure.
+ *
+ * We use the standard GF(2^128) with reduction polynomial `x^128 + x^7 + x^2 + x + 1` (the GCM /
+ * "0x87" polynomial). Elements are 128-bit `bigint`s, bit `i` = coefficient of `x^i`. Addition is XOR.
+ * Multiplication is schoolbook carryless multiply with reduction; `mulByXi` (multiply by `x^i`) is the
+ * repeated-shift form used by the column-domain check so the hot path pays no full 128×128 multiply
+ * per row. This is a textbook field (BigInt, not constant-time) — sound for the in-process prototype;
+ * see docs §7.1 for the constant-time boundary.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.gf128Add = gf128Add;
+exports.gf128MulX = gf128MulX;
+exports.gf128MulByXi = gf128MulByXi;
+exports.gf128Mul = gf128Mul;
+/** 128-bit mask. */
+const MASK128 = (1n << 128n) - 1n;
+/**
+ * The reduction tail for `x^128 + x^7 + x^2 + x + 1`: when a shift pushes a 1 past bit 127, we have
+ * `x^128 ≡ x^7 + x^2 + x + 1 = 0x87`, so we XOR `0x87` back in.
+ */
+const GF128_RED = (1n << 7n) | (1n << 2n) | (1n << 1n) | 1n; // 0x87
+/** Field addition in GF(2^128): XOR (masked to 128 bits). */
+function gf128Add(a, b) {
+    return (a ^ b) & MASK128;
+}
+/** Multiply by `x` (one step of the LFSR): shift left 1, reduce if it overflowed bit 127. */
+function gf128MulX(v) {
+    const carry = (v >> 127n) & 1n;
+    let r = (v << 1n) & MASK128;
+    if (carry)
+        r ^= GF128_RED;
+    return r;
+}
+/** Multiply by `x^i` (i ≥ 0): i LFSR steps. Used by the column-domain KOS fold. */
+function gf128MulByXi(v, i) {
+    let r = v & MASK128;
+    for (let k = 0; k < i; k++)
+        r = gf128MulX(r);
+    return r;
+}
+/** Full GF(2^128) multiplication (carryless multiply + reduction), right-to-left over the bits of `b`. */
+function gf128Mul(a, b) {
+    let res = 0n;
+    let v = a & MASK128;
+    for (let i = 0; i < 128; i++) {
+        if ((b >> BigInt(i)) & 1n)
+            res ^= v;
+        v = gf128MulX(v);
+    }
+    return res & MASK128;
+}
+//# sourceMappingURL=gf128.js.map

package/dist/gf128.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gf128.js","sourceRoot":"","sources":["../src/gf128.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;AAYH,4BAEC;AAGD,8BAKC;AAGD,oCAIC;AAGD,4BAQC;AAtCD,oBAAoB;AACpB,MAAM,OAAO,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;AAElC;;;GAGG;AACH,MAAM,SAAS,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO;AAEpE,6DAA6D;AAC7D,SAAgB,QAAQ,CAAC,CAAS,EAAE,CAAS;IAC3C,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC;AAC3B,CAAC;AAED,6FAA6F;AAC7F,SAAgB,SAAS,CAAC,CAAS;IACjC,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/B,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC;IAC5B,IAAI,KAAK;QAAE,CAAC,IAAI,SAAS,CAAC;IAC1B,OAAO,CAAC,CAAC;AACX,CAAC;AAED,mFAAmF;AACnF,SAAgB,YAAY,CAAC,CAAS,EAAE,CAAS;IAC/C,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC;IACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;QAAE,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IAC7C,OAAO,CAAC,CAAC;AACX,CAAC;AAED,0GAA0G;AAC1G,SAAgB,QAAQ,CAAC,CAAS,EAAE,CAAS;IAC3C,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC;IACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE;YAAE,GAAG,IAAI,CAAC,CAAC;QACpC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,GAAG,OAAO,CAAC;AACvB,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,27 @@
+/**
+ * @atlasauth/pca-mpc — PCA evolution B5 reference prototype.
+ *
+ * A multi-stakeholder Policy VM composed under secure multi-party computation, so user + org +
+ * regulator decide allow / threshold jointly WITHOUT any party revealing its own policy. Two layers:
+ *   - SEMI-HONEST: additive secret sharing over a prime field + Beaver-triple multiplication
+ *     (`sharing.ts`, `beaver.ts`, `runner.ts`).
+ *   - MALICIOUS-WITH-ABORT (dishonest-majority): SPDZ-style authenticated sharing with
+ *     information-theoretic MACs + a commit-then-open MAC-check that ABORTS on any deviation
+ *     (`spdz.ts`, `spdz-runner.ts`). Result is correct, or an abort — never a silent wrong answer.
+ * See docs/specs/pca-mpc-policy-vm.md for the security model and the trusted-dealer / no-dealer boundary.
+ */
+export * from './field';
+export * from './sharing';
+export * from './beaver';
+export * from './thermometer';
+export * from './party';
+export * from './compose';
+export * from './runner';
+export * from './spdz';
+export * from './spdz-runner';
+export * from './ec';
+export * from './gf128';
+export * from './csprng';
+export * from './ot';
+export * from './kem-ot';
+export * from './mascot';

package/dist/index.js

@@ -0,0 +1,44 @@
+"use strict";
+/**
+ * @atlasauth/pca-mpc — PCA evolution B5 reference prototype.
+ *
+ * A multi-stakeholder Policy VM composed under secure multi-party computation, so user + org +
+ * regulator decide allow / threshold jointly WITHOUT any party revealing its own policy. Two layers:
+ *   - SEMI-HONEST: additive secret sharing over a prime field + Beaver-triple multiplication
+ *     (`sharing.ts`, `beaver.ts`, `runner.ts`).
+ *   - MALICIOUS-WITH-ABORT (dishonest-majority): SPDZ-style authenticated sharing with
+ *     information-theoretic MACs + a commit-then-open MAC-check that ABORTS on any deviation
+ *     (`spdz.ts`, `spdz-runner.ts`). Result is correct, or an abort — never a silent wrong answer.
+ * See docs/specs/pca-mpc-policy-vm.md for the security model and the trusted-dealer / no-dealer boundary.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./field"), exports);
+__exportStar(require("./sharing"), exports);
+__exportStar(require("./beaver"), exports);
+__exportStar(require("./thermometer"), exports);
+__exportStar(require("./party"), exports);
+__exportStar(require("./compose"), exports);
+__exportStar(require("./runner"), exports);
+__exportStar(require("./spdz"), exports);
+__exportStar(require("./spdz-runner"), exports);
+__exportStar(require("./ec"), exports);
+__exportStar(require("./gf128"), exports);
+__exportStar(require("./csprng"), exports);
+__exportStar(require("./ot"), exports);
+__exportStar(require("./kem-ot"), exports);
+__exportStar(require("./mascot"), exports);
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;;;;;;;;;;;;;;AAEH,0CAAwB;AACxB,4CAA0B;AAC1B,2CAAyB;AACzB,gDAA8B;AAC9B,0CAAwB;AACxB,4CAA0B;AAC1B,2CAAyB;AACzB,yCAAuB;AACvB,gDAA8B;AAC9B,uCAAqB;AACrB,0CAAwB;AACxB,2CAAyB;AACzB,uCAAqB;AACrB,2CAAyB;AACzB,2CAAyB"}