@aztec/foundation 0.0.0-test.0 → 0.0.1-commit.0208eb9

package/src/crypto/secp256k1-signer/utils.ts

@@ -7,6 +7,27 @@ import { keccak256 } from '../keccak/index.js';
 
 const ETH_SIGN_PREFIX = '\x19Ethereum Signed Message:\n32';
 
+/** Signature recovery options */
+type RecoveryOpts = {
+  /**
+   * Whether to allow s-values in the high half of the curve (s >= CURVE.n/2).
+   * These are discouraged by EIP2 to prevent signature malleability, and outright
+   * rejected in OpenZeppelin's ECDSA recover, which we use in our Rollup contract.
+   */
+  allowMalleable?: boolean;
+  /**
+   * Whether to allow an y-parity 0-1 bit instead of the standard v value 27-28.
+   */
+  allowYParityAsV?: boolean;
+};
+
+export class Secp256k1Error extends Error {
+  constructor(message: string, opts?: { cause: unknown }) {
+    super(message, opts);
+    this.name = 'Secp256k1Error';
+  }
+}
+
 // We just hash the message to make it easier to work with in the smart contract.
 export function makeEthSignDigest(message: Buffer32): Buffer32 {
   const prefix = Buffer.from(ETH_SIGN_PREFIX);
@@ -46,11 +67,36 @@ export function addressFromPrivateKey(privateKey: Buffer): EthAddress {
  * Recovers an address from a hash and a signature.
  * @param hash - The hash to recover the address from.
  * @param signature - The signature to recover the address from.
+ * @param opts - Recovery options.
  * @returns The address.
+ * @throws Error if signature recovery fails or if signature is malleable and allowMalleable is false.
  */
-export function recoverAddress(hash: Buffer32, signature: Signature): EthAddress {
-  const publicKey = recoverPublicKey(hash, signature);
-  return publicKeyToAddress(publicKey);
+export function recoverAddress(hash: Buffer32, signature: Signature, opts?: RecoveryOpts): EthAddress {
+  try {
+    const publicKey = recoverPublicKey(hash, signature, opts);
+    return publicKeyToAddress(publicKey);
+  } catch (err: unknown) {
+    throw new Secp256k1Error(
+      `Error recovering Ethereum address from hash ${hash.toString()} and signature ${signature.toString()}`,
+      { cause: err },
+    );
+  }
+}
+
+/**
+ * Safely attempts to recover an address from a hash and a signature.
+ * @param hash - The hash to recover the address from.
+ * @param signature - The signature to recover the address from.
+ * @param opts - Recovery options.
+ * @returns The address if recovery succeeds, undefined otherwise.
+ */
+export function tryRecoverAddress(hash: Buffer32, signature: Signature, opts?: RecoveryOpts): EthAddress | undefined {
+  try {
+    const publicKey = recoverPublicKey(hash, signature, opts);
+    return publicKeyToAddress(publicKey);
+  } catch {
+    return undefined;
+  }
 }
 
 /**
@@ -59,7 +105,7 @@ export function recoverAddress(hash: Buffer32, signature: Signature): EthAddress
  * @param yParityOrV - The yParityOrV value to convert.
  * @returns The recovery bit.
  */
-function toRecoveryBit(yParityOrV: number) {
+export function toRecoveryBit(yParityOrV: number) {
   if (yParityOrV === 0 || yParityOrV === 1) {
     return yParityOrV;
   }
@@ -69,7 +115,7 @@ function toRecoveryBit(yParityOrV: number) {
   if (yParityOrV === 28) {
     return 1;
   }
-  throw new Error('Invalid yParityOrV value');
+  throw new Secp256k1Error(`Invalid yParityOrV value ${yParityOrV}`);
 }
 
 /**
@@ -83,17 +129,84 @@ export function signMessage(message: Buffer32, privateKey: Buffer) {
   return new Signature(Buffer32.fromBigInt(r), Buffer32.fromBigInt(s), recovery ? 28 : 27);
 }
 
+/**
+ * Flips an ECDSA signature.
+ * If the signature has a low s-value (s < CURVE.n/2), it flips it to high s-value (CURVE.n - s) and vice versa.
+ * Also flips the v value accordingly (27 <-> 28, or 0 <-> 1).
+ * This is useful for testing signature malleability handling.
+ * @param signature - The signature to flip.
+ * @returns A new signature with flipped s-value and v-value.
+ */
+export function flipSignature(signature: Signature): Signature {
+  const { r, s, v } = signature;
+  const sig = new secp256k1.Signature(r.toBigInt(), s.toBigInt());
+  const flippedS = secp256k1.CURVE.n - sig.s;
+
+  return new Signature(r, Buffer32.fromBigInt(flippedS), flipV(v));
+}
+
+/**
+ * Normalizes an ECDSA signature.
+ * If the signature has a high s-value (s >= CURVE.n/2), it flips it to low s-value (CURVE.n - s), and flips v accordingly.
+ * If the signature uses a recovery bit of 0/1, it is converted to a v-value 27/28 for ecrecover.
+ * @remarks This does not handle post EIP155 tx signatures which embed the chain id in v. Use it only for feeding into ECRECOVER precompiles.
+ * @param signature - The signature to normalize.
+ */
+export function normalizeSignature(signature: Signature): Signature {
+  const { r, s, v } = signature;
+  const sig = new secp256k1.Signature(r.toBigInt(), s.toBigInt());
+  if (sig.hasHighS()) {
+    const newV = flipV(v);
+    const newS = sig.normalizeS().s;
+    return new Signature(r, Buffer32.fromBigInt(newS), toVFromYParityOrV(newV));
+  }
+
+  return new Signature(r, s, toVFromYParityOrV(v));
+}
+
+/** Converts a yParityOrV value to a pre-EIP155 v-value 27-28. */
+function toVFromYParityOrV(yParityOrV: number): number {
+  if (yParityOrV === 0 || yParityOrV === 1) {
+    return yParityOrV + 27;
+  } else if (yParityOrV === 27 || yParityOrV === 28) {
+    return yParityOrV;
+  } else {
+    throw new Secp256k1Error(`Invalid yParityOrV value ${yParityOrV}`);
+  }
+}
+
+/** Flips the recovery bit or v-value */
+function flipV(v: number): number {
+  switch (v) {
+    case 27:
+      return 28;
+    case 28:
+      return 27;
+    case 0:
+      return 1;
+    case 1:
+      return 0;
+    default:
+      throw new Secp256k1Error(`Invalid v value ${v}`);
+  }
+}
+
 /**
  * Recovers a public key from a hash and a signature.
  * @param hash - The hash to recover the public key from.
  * @param signature - The signature to recover the public key from.
  * @returns The public key.
  */
-export function recoverPublicKey(hash: Buffer32, signature: Signature): Buffer {
+export function recoverPublicKey(hash: Buffer32, signature: Signature, opts: RecoveryOpts = {}): Buffer {
   const { r, s, v } = signature;
+  if (!opts.allowYParityAsV && v !== 27 && v !== 28) {
+    throw new Secp256k1Error(`Invalid v value ${v} (expected 27 or 28)`);
+  }
   const recoveryBit = toRecoveryBit(v);
   const sig = new secp256k1.Signature(r.toBigInt(), s.toBigInt()).addRecoveryBit(recoveryBit);
-
+  if (!opts.allowMalleable && sig.hasHighS()) {
+    throw new Secp256k1Error('Signature has high s-value (malleable signature)');
+  }
   const publicKey = sig.recoverPublicKey(hash.buffer).toHex(false);
   return Buffer.from(publicKey, 'hex');
 }

package/src/crypto/sha256/index.ts

@@ -1,9 +1,10 @@
 /* eslint-disable camelcase */
 import { default as hash } from 'hash.js';
 
-import { Fr } from '../../fields/fields.js';
+import { Fr } from '../../curves/bn254/field.js';
 import { truncateAndPad } from '../../serialize/free_funcs.js';
 import { type Bufferable, serializeToBuffer } from '../../serialize/serialize.js';
+import type { Hasher } from '../../trees/hasher.js';
 
 export function sha256(data: Buffer) {
   return Buffer.from(hash.sha256().update(data).digest());
@@ -145,3 +146,49 @@ function g0_256(x: number) {
 function g1_256(x: number) {
   return rotr32(x, 17) ^ rotr32(x, 19) ^ (x >>> 10);
 }
+
+/**
+ * A helper class encapsulating SHA256 hash functionality.
+ * @deprecated Don't call SHA256 directly in production code. Instead, create suitably-named functions for specific
+ * purposes.
+ */
+export class SHA256 implements Hasher {
+  /*
+   * @deprecated Don't call SHA256 directly in production code. Instead, create suitably-named functions for specific
+   * purposes.
+   */
+  public hash(lhs: Uint8Array, rhs: Uint8Array) {
+    return sha256(Buffer.concat([Buffer.from(lhs), Buffer.from(rhs)])) as Buffer<ArrayBuffer>;
+  }
+
+  /*
+   * @deprecated Don't call SHA256 directly in production code. Instead, create suitably-named functions for specific
+   * purposes.
+   */
+  public hashInputs(inputs: Buffer[]) {
+    return sha256(Buffer.concat(inputs)) as Buffer<ArrayBuffer>;
+  }
+}
+
+/**
+ * A helper class encapsulating truncated SHA256 hash functionality.
+ * @deprecated Don't call SHA256 directly in production code. Instead, create suitably-named functions for specific
+ * purposes.
+ */
+export class SHA256Trunc implements Hasher {
+  /*
+   * @deprecated Don't call SHA256 directly in production code. Instead, create suitably-named functions for specific
+   * purposes.
+   */
+  public hash(lhs: Uint8Array, rhs: Uint8Array) {
+    return truncateAndPad(sha256(Buffer.concat([Buffer.from(lhs), Buffer.from(rhs)]))) as Buffer<ArrayBuffer>;
+  }
+
+  /*
+   * @deprecated Don't call SHA256 directly in production code. Instead, create suitably-named functions for specific
+   * purposes.
+   */
+  public hashInputs(inputs: Buffer[]) {
+    return truncateAndPad(sha256(Buffer.concat(inputs))) as Buffer<ArrayBuffer>;
+  }
+}

package/src/crypto/sha512/index.ts

@@ -1,6 +1,6 @@
 import { default as hash } from 'hash.js';
 
-import { GrumpkinScalar } from '../../fields/fields.js';
+import { GrumpkinScalar } from '../../curves/grumpkin/index.js';
 import { type Bufferable, serializeToBuffer } from '../../serialize/serialize.js';
 
 export const sha512 = (data: Buffer) => Buffer.from(hash.sha512().update(data).digest());

package/src/crypto/signature/index.ts

@@ -1,4 +1,4 @@
-import type { Fr } from '@aztec/foundation/fields';
+import type { Fr } from '@aztec/foundation/curves/bn254';
 
 /**
  * Interface to represent a signature.

package/src/crypto/sync/index.ts

@@ -3,4 +3,4 @@ import { BarretenbergSync } from '@aztec/bb.js';
 export * from './poseidon/index.js';
 export * from './pedersen/index.js';
 
-await BarretenbergSync.initSingleton(process.env.BB_WASM_PATH);
+await BarretenbergSync.initSingleton();

package/src/crypto/sync/pedersen/index.ts

@@ -1,6 +1,6 @@
-import { BarretenbergSync, Fr as FrBarretenberg } from '@aztec/bb.js';
+import { BarretenbergSync } from '@aztec/bb.js';
 
-import { Fr } from '../../../fields/fields.js';
+import { Fr } from '../../../curves/bn254/field.js';
 import { type Fieldable, serializeToFields } from '../../../serialize/serialize.js';
 
 /**
@@ -12,13 +12,11 @@ export function pedersenCommit(input: Buffer[], offset = 0) {
     throw new Error('All Pedersen Commit input buffers must be <= 32 bytes.');
   }
   input = input.map(i => (i.length < 32 ? Buffer.concat([Buffer.alloc(32 - i.length, 0), i]) : i));
-  const point = BarretenbergSync.getSingleton().pedersenCommit(
-    input.map(i => new FrBarretenberg(i)),
-    offset,
-  );
-  // toBuffer returns Uint8Arrays (browser/worker-boundary friendly).
-  // TODO: rename toTypedArray()?
-  return [Buffer.from(point.x.toBuffer()), Buffer.from(point.y.toBuffer())];
+  const response = BarretenbergSync.getSingleton().pedersenCommit({
+    inputs: input,
+    hashIndex: offset,
+  });
+  return [Buffer.from(response.point.x), Buffer.from(response.point.y)];
 }
 
 /**
@@ -29,17 +27,20 @@ export function pedersenCommit(input: Buffer[], offset = 0) {
  */
 export function pedersenHash(input: Fieldable[], index = 0): Fr {
   const inputFields = serializeToFields(input);
-  const hash = BarretenbergSync.getSingleton().pedersenHash(
-    inputFields.map(i => new FrBarretenberg(i.toBuffer())), // TODO(#4189): remove this stupid conversion
-    index,
-  );
-  return Fr.fromBuffer(Buffer.from(hash.toBuffer()));
+  const response = BarretenbergSync.getSingleton().pedersenHash({
+    inputs: inputFields.map(i => i.toBuffer()),
+    hashIndex: index,
+  });
+  return Fr.fromBuffer(Buffer.from(response.hash));
 }
 
 /**
  * Create a pedersen hash from an arbitrary length buffer.
  */
 export function pedersenHashBuffer(input: Buffer, index = 0) {
-  const result = BarretenbergSync.getSingleton().pedersenHashBuffer(input, index);
-  return Buffer.from(result.toBuffer());
+  const response = BarretenbergSync.getSingleton().pedersenHashBuffer({
+    input,
+    hashIndex: index,
+  });
+  return Buffer.from(response.hash);
 }

package/src/crypto/sync/poseidon/index.ts

@@ -1,6 +1,6 @@
-import { BarretenbergSync, Fr as FrBarretenberg } from '@aztec/bb.js';
+import { BarretenbergSync } from '@aztec/bb.js';
 
-import { Fr } from '../../../fields/fields.js';
+import { Fr } from '../../../curves/bn254/field.js';
 import { type Fieldable, serializeToFields } from '../../../serialize/serialize.js';
 
 /**
@@ -10,10 +10,11 @@ import { type Fieldable, serializeToFields } from '../../../serialize/serialize.
  */
 export function poseidon2Hash(input: Fieldable[]): Fr {
   const inputFields = serializeToFields(input);
-  const hash = BarretenbergSync.getSingleton().poseidon2Hash(
-    inputFields.map(i => new FrBarretenberg(i.toBuffer())), // TODO(#4189): remove this stupid conversion
-  );
-  return Fr.fromBuffer(Buffer.from(hash.toBuffer()));
+  const api = BarretenbergSync.getSingleton();
+  const response = api.poseidon2Hash({
+    inputs: inputFields.map(i => i.toBuffer()),
+  });
+  return Fr.fromBuffer(Buffer.from(response.hash));
 }
 
 /**
@@ -26,18 +27,11 @@ export function poseidon2HashWithSeparator(input: Fieldable[], separator: number
   const inputFields = serializeToFields(input);
   inputFields.unshift(new Fr(separator));
 
-  const hash = BarretenbergSync.getSingleton().poseidon2Hash(
-    inputFields.map(i => new FrBarretenberg(i.toBuffer())), // TODO(#4189): remove this stupid conversion
-  );
-  return Fr.fromBuffer(Buffer.from(hash.toBuffer()));
-}
-
-export function poseidon2HashAccumulate(input: Fieldable[]): Fr {
-  const inputFields = serializeToFields(input);
-  const result = BarretenbergSync.getSingleton().poseidon2HashAccumulate(
-    inputFields.map(i => new FrBarretenberg(i.toBuffer())),
-  );
-  return Fr.fromBuffer(Buffer.from(result.toBuffer()));
+  const api = BarretenbergSync.getSingleton();
+  const response = api.poseidon2Hash({
+    inputs: inputFields.map(i => i.toBuffer()),
+  });
+  return Fr.fromBuffer(Buffer.from(response.hash));
 }
 
 /**
@@ -49,12 +43,13 @@ export function poseidon2Permutation(input: Fieldable[]): Fr[] {
   const inputFields = serializeToFields(input);
   // We'd like this assertion but it's not possible to use it in the browser.
   // assert(input.length === 4, 'Input state must be of size 4');
-  const res = BarretenbergSync.getSingleton().poseidon2Permutation(
-    inputFields.map(i => new FrBarretenberg(i.toBuffer())),
-  );
+  const api = BarretenbergSync.getSingleton();
+  const response = api.poseidon2Permutation({
+    inputs: inputFields.map(i => i.toBuffer()),
+  });
   // We'd like this assertion but it's not possible to use it in the browser.
-  // assert(res.length === 4, 'Output state must be of size 4');
-  return res.map(o => Fr.fromBuffer(Buffer.from(o.toBuffer())));
+  // assert(response.outputs.length === 4, 'Output state must be of size 4');
+  return response.outputs.map(o => Fr.fromBuffer(Buffer.from(o)));
 }
 
 export function poseidon2HashBytes(input: Buffer): Fr {
@@ -68,9 +63,10 @@ export function poseidon2HashBytes(input: Buffer): Fr {
     inputFields.push(Fr.fromBuffer(fieldBytes));
   }
 
-  const res = BarretenbergSync.getSingleton().poseidon2Hash(
-    inputFields.map(i => new FrBarretenberg(i.toBuffer())), // TODO(#4189): remove this stupid conversion
-  );
+  const api = BarretenbergSync.getSingleton();
+  const response = api.poseidon2Hash({
+    inputs: inputFields.map(i => i.toBuffer()),
+  });
 
-  return Fr.fromBuffer(Buffer.from(res.toBuffer()));
+  return Fr.fromBuffer(Buffer.from(response.hash));
 }