@aztec/foundation 0.0.0-test.0

package/src/crypto/random/index.ts

@@ -0,0 +1,85 @@
+import nodeCrypto from 'crypto';
+import isNode from 'detect-node';
+
+import { RandomnessSingleton } from './randomness_singleton.js';
+
+// limit of Crypto.getRandomValues()
+// https://developer.mozilla.org/en-US/docs/Web/API/Crypto/getRandomValues
+const MAX_BYTES = 65536;
+
+const getWebCrypto = () => {
+  if (typeof window !== 'undefined' && window.crypto) {
+    return window.crypto;
+  }
+  if (typeof self !== 'undefined' && self.crypto) {
+    return self.crypto;
+  }
+  return undefined;
+};
+
+export const randomBytes = (len: number) => {
+  const singleton = RandomnessSingleton.getInstance();
+
+  if (singleton.isDeterministic()) {
+    return singleton.getBytes(len);
+  }
+
+  if (isNode) {
+    return nodeCrypto.randomBytes(len) as Buffer;
+  }
+
+  const crypto = getWebCrypto();
+  if (!crypto) {
+    throw new Error('randomBytes UnsupportedEnvironment');
+  }
+
+  const buf = Buffer.allocUnsafe(len);
+  if (len > MAX_BYTES) {
+    // this is the max bytes crypto.getRandomValues
+    // can do at once see https://developer.mozilla.org/en-US/docs/Web/API/window.crypto.getRandomValues
+    for (let generated = 0; generated < len; generated += MAX_BYTES) {
+      // buffer.slice automatically checks if the end is past the end of
+      // the buffer so we don't have to here
+      crypto.getRandomValues(buf.slice(generated, generated + MAX_BYTES));
+    }
+  } else {
+    crypto.getRandomValues(buf);
+  }
+
+  return buf;
+};
+
+/**
+ * Generate a random integer less than max.
+ * @param max - The maximum value.
+ * @returns A random integer.
+ *
+ * TODO(#3949): This is insecure as it's modulo biased. Nuke or safeguard before mainnet.
+ */
+export const randomInt = (max: number) => {
+  const randomBuffer = randomBytes(6); // Generate a buffer of 6 random bytes.
+  const randomInt = parseInt(randomBuffer.toString('hex'), 16); // Convert buffer to a large integer.
+  return randomInt % max; // Use modulo to ensure the result is less than max.
+};
+
+/**
+ * Generate a random bigint less than max.
+ * @param max - The maximum value.
+ * @returns A random bigint.
+ *
+ * TODO(#3949): This is insecure as it's modulo biased. Nuke or safeguard before mainnet.
+ */
+export const randomBigInt = (max: bigint) => {
+  const randomBuffer = randomBytes(8); // Generate a buffer of 8 random bytes.
+  const randomBigInt = BigInt(`0x${randomBuffer.toString('hex')}`); // Convert buffer to a large integer.
+  return randomBigInt % max; // Use modulo to ensure the result is less than max.
+};
+
+/**
+ * Generate a random boolean value.
+ * @returns A random boolean value.
+ */
+export const randomBoolean = () => {
+  const randomByte = randomBytes(1)[0]; // Generate a single random byte.
+  return randomByte % 2 === 0; // Use modulo to determine if the byte is even or odd.
+};

package/src/crypto/random/randomness_singleton.ts

@@ -0,0 +1,62 @@
+import { createLogger } from '../../log/pino-logger.js';
+
+/**
+ * A number generator which is used as a source of randomness in the system. If the SEED env variable is set, the
+ * generator will be deterministic and will always produce the same sequence of numbers. Otherwise a true randomness
+ * sourced by crypto library will be used.
+ * @remarks This class was implemented so that tests can be run deterministically.
+ *
+ * TODO(#3949): This is not safe enough for production and should be made safer or removed before mainnet.
+ */
+export class RandomnessSingleton {
+  private static instance: RandomnessSingleton;
+
+  private counter = 0;
+
+  private constructor(
+    private readonly seed?: number,
+    private readonly log = createLogger('foundation:randomness_singleton'),
+  ) {
+    if (seed !== undefined) {
+      this.log.debug(`Using pseudo-randomness with seed: ${seed}`);
+      this.counter = seed;
+    } else {
+      this.log.debug('Using true randomness');
+    }
+  }
+
+  public static getInstance(): RandomnessSingleton {
+    if (!RandomnessSingleton.instance) {
+      const seed = process.env.SEED ? Number(process.env.SEED) : undefined;
+      RandomnessSingleton.instance = new RandomnessSingleton(seed);
+    }
+
+    return RandomnessSingleton.instance;
+  }
+
+  /**
+   * Indicates whether the generator is deterministic (was seeded) or not.
+   * @returns Whether the generator is deterministic.
+   */
+  public isDeterministic(): boolean {
+    return this.seed !== undefined;
+  }
+
+  public getBytes(length: number): Buffer {
+    if (this.seed === undefined) {
+      // Note: It would be more natural to just have the contents of randomBytes(...) function from
+      // yarn-project/foundation/src/crypto/random/index.ts here but that would result in a larger
+      // refactor so I think prohibiting use of this func when the seed is undefined is and handling
+      // the singleton within randomBytes func is fine.
+      throw new Error('RandomnessSingleton is not implemented for non-deterministic mode');
+    }
+    const result = Buffer.alloc(length);
+    for (let i = 0; i < length; i++) {
+      // Each byte of the buffer is set to a 1 byte of this.counter's value. 0xff is 255 in decimal and it's used as
+      // a mask to get the last 8 bits of the shifted counter.
+      result[i] = (this.counter >> (i * 8)) & 0xff;
+    }
+    this.counter++;
+    return result;
+  }
+}

package/src/crypto/schnorr/index.ts

@@ -0,0 +1,55 @@
+import { BarretenbergSync } from '@aztec/bb.js';
+import { type GrumpkinScalar, Point } from '@aztec/foundation/fields';
+import { numToInt32BE } from '@aztec/foundation/serialize';
+
+import { concatenateUint8Arrays } from '../serialize.js';
+import { SchnorrSignature } from './signature.js';
+
+export * from './signature.js';
+
+/**
+ * Schnorr signature construction and helper operations.
+ */
+export class Schnorr {
+  /**
+   * Computes a grumpkin public key from a private key.
+   * @param privateKey - The private key.
+   * @returns A grumpkin public key.
+   */
+  public async computePublicKey(privateKey: GrumpkinScalar): Promise<Point> {
+    const api = await BarretenbergSync.initSingleton(process.env.BB_WASM_PATH);
+    const [result] = api.getWasm().callWasmExport('schnorr_compute_public_key', [privateKey.toBuffer()], [64]);
+    return Point.fromBuffer(Buffer.from(result));
+  }
+
+  /**
+   * Constructs a Schnorr signature given a msg and a private key.
+   * @param msg - Message over which the signature is constructed.
+   * @param privateKey - The private key of the signer.
+   * @returns A Schnorr signature of the form (s, e).
+   */
+  public async constructSignature(msg: Uint8Array, privateKey: GrumpkinScalar) {
+    const api = await BarretenbergSync.initSingleton(process.env.BB_WASM_PATH);
+    const messageArray = concatenateUint8Arrays([numToInt32BE(msg.length), msg]);
+    const [s, e] = api
+      .getWasm()
+      .callWasmExport('schnorr_construct_signature', [messageArray, privateKey.toBuffer()], [32, 32]);
+    return new SchnorrSignature(Buffer.from([...s, ...e]));
+  }
+
+  /**
+   * Verifies a Schnorr signature given a Grumpkin public key.
+   * @param msg - Message over which the signature was constructed.
+   * @param pubKey - The Grumpkin public key of the signer.
+   * @param sig - The Schnorr signature.
+   * @returns True or false.
+   */
+  public async verifySignature(msg: Uint8Array, pubKey: Point, sig: SchnorrSignature) {
+    const api = await BarretenbergSync.initSingleton(process.env.BB_WASM_PATH);
+    const messageArray = concatenateUint8Arrays([numToInt32BE(msg.length), msg]);
+    const [result] = api
+      .getWasm()
+      .callWasmExport('schnorr_verify_signature', [messageArray, pubKey.toBuffer(), sig.s, sig.e], [1]);
+    return result[0] === 1;
+  }
+}

package/src/crypto/schnorr/signature.ts

@@ -0,0 +1,116 @@
+import { randomBytes } from '@aztec/foundation/crypto';
+import { Fr } from '@aztec/foundation/fields';
+import { BufferReader, mapTuple } from '@aztec/foundation/serialize';
+
+import type { Signature } from '../signature/index.js';
+
+/**
+ * Schnorr signature used for transactions.
+ * @see cpp/barretenberg/cpp/src/barretenberg/crypto/schnorr/schnorr.hpp
+ */
+export class SchnorrSignature implements Signature {
+  /**
+   * The size of the signature in bytes.
+   */
+  public static SIZE = 64;
+
+  /**
+   * An empty signature.
+   */
+  public static EMPTY = new SchnorrSignature(Buffer.alloc(64));
+
+  constructor(private buffer: Buffer) {
+    if (buffer.length !== SchnorrSignature.SIZE) {
+      throw new Error(`Invalid signature buffer of length ${buffer.length}.`);
+    }
+  }
+
+  /**
+   * Determines if the provided signature is valid or not.
+   * @param signature - The data to be checked.
+   * @returns Boolean indicating if the provided data is a valid schnorr signature.
+   */
+  public static isSignature(signature: string) {
+    return /^(0x)?[0-9a-f]{128}$/i.test(signature);
+  }
+
+  /**
+   * Constructs a SchnorrSignature from the provided string.
+   * @param signature - The string to be converted to a schnorr signature.
+   * @returns The constructed schnorr signature.
+   */
+  public static fromString(signature: string) {
+    if (!SchnorrSignature.isSignature(signature)) {
+      throw new Error(`Invalid signature string: ${signature}`);
+    }
+    return new SchnorrSignature(Buffer.from(signature.replace(/^0x/i, ''), 'hex'));
+  }
+
+  /**
+   * Generates a random schnorr signature.
+   * @returns The randomly constructed signature.
+   */
+  public static random() {
+    return new SchnorrSignature(randomBytes(64));
+  }
+
+  /**
+   * Returns the 's' component of the signature.
+   * @returns A buffer containing the signature's 's' component.
+   */
+  get s() {
+    return this.buffer.subarray(0, 32);
+  }
+
+  /**
+   * Returns the 'e' component of the signature.
+   * @returns A buffer containing the signature's 'e' component.
+   */
+  get e() {
+    return this.buffer.subarray(32);
+  }
+
+  /**
+   * Returns the full signature as a buffer.
+   * @returns A buffer containing the signature.
+   */
+  toBuffer() {
+    return this.buffer;
+  }
+
+  /**
+   * Deserializes from a buffer.
+   * @param buffer - The buffer representation of the object.
+   * @returns The new object.
+   */
+  static fromBuffer(buffer: Buffer | BufferReader): SchnorrSignature {
+    const reader = BufferReader.asReader(buffer);
+    return new SchnorrSignature(reader.readBytes(SchnorrSignature.SIZE));
+  }
+
+  /**
+   * Returns the full signature as a hex string.
+   * @returns A string containing the signature in hex format.
+   */
+  toString() {
+    return `0x${this.buffer.toString('hex')}`;
+  }
+
+  /**
+   * Converts the signature to an array of three fields.
+   * @returns The signature components as an array of three fields
+   */
+  toFields(): Fr[] {
+    const sig = this.toBuffer();
+
+    const buf1 = Buffer.alloc(32);
+    const buf2 = Buffer.alloc(32);
+    const buf3 = Buffer.alloc(32);
+
+    sig.copy(buf1, 1, 0, 31);
+    sig.copy(buf2, 1, 31, 62);
+    sig.copy(buf3, 1, 62, 64);
+
+    return mapTuple([buf1, buf2, buf3], Fr.fromBuffer);
+  }
+}

package/src/crypto/secp256k1/index.ts

@@ -0,0 +1,57 @@
+import { BarretenbergSync } from '@aztec/bb.js';
+
+/**
+ * Secp256k1 elliptic curve operations.
+ */
+export class Secp256k1 {
+  // prettier-ignore
+  static generator = Buffer.from([
+    0x79, 0xbe, 0x66, 0x7e, 0xf9, 0xdc, 0xbb, 0xac, 0x55, 0xa0, 0x62, 0x95, 0xce, 0x87, 0x0b, 0x07,
+    0x02, 0x9b, 0xfc, 0xdb, 0x2d, 0xce, 0x28, 0xd9, 0x59, 0xf2, 0x81, 0x5b, 0x16, 0xf8, 0x17, 0x98,
+    0x48, 0x3a, 0xda, 0x77, 0x26, 0xa3, 0xc4, 0x65, 0x5d, 0xa4, 0xfb, 0xfc, 0x0e, 0x11, 0x08, 0xa8,
+    0xfd, 0x17, 0xb4, 0x48, 0xa6, 0x85, 0x54, 0x19, 0x9c, 0x47, 0xd0, 0x8f, 0xfb, 0x10, 0xd4, 0xb8,
+  ]);
+
+  /**
+   * Point generator
+   * @returns The generator for the curve.
+   */
+  public generator(): Buffer {
+    return Secp256k1.generator;
+  }
+
+  /**
+   * Multiplies a point by a scalar (adds the point `scalar` amount of time).
+   * @param point - Point to multiply.
+   * @param scalar - Scalar to multiply by.
+   * @returns Result of the multiplication.
+   */
+  public async mul(point: Uint8Array, scalar: Uint8Array) {
+    const api = await BarretenbergSync.initSingleton(process.env.BB_WASM_PATH);
+    const [result] = api.getWasm().callWasmExport('ecc_secp256k1__mul', [point, scalar], [64]);
+    return Buffer.from(result);
+  }
+
+  /**
+   * Gets a random field element.
+   * @returns Random field element.
+   */
+  public async getRandomFr() {
+    const api = await BarretenbergSync.initSingleton(process.env.BB_WASM_PATH);
+    const [result] = api.getWasm().callWasmExport('ecc_secp256k1__get_random_scalar_mod_circuit_modulus', [], [32]);
+    return Buffer.from(result);
+  }
+
+  /**
+   * Converts a 512 bits long buffer to a field.
+   * @param uint512Buf - The buffer to convert.
+   * @returns Buffer representation of the field element.
+   */
+  public async reduce512BufferToFr(uint512Buf: Buffer) {
+    const api = await BarretenbergSync.initSingleton(process.env.BB_WASM_PATH);
+    const [result] = api
+      .getWasm()
+      .callWasmExport('ecc_secp256k1__reduce512_buffer_mod_circuit_modulus', [uint512Buf], [32]);
+    return Buffer.from(result);
+  }
+}

package/src/crypto/secp256k1-signer/index.ts

@@ -0,0 +1,2 @@
+export * from './secp256k1_signer.js';
+export * from './utils.js';

package/src/crypto/secp256k1-signer/secp256k1_signer.ts

@@ -0,0 +1,38 @@
+import { Buffer32 } from '@aztec/foundation/buffer';
+import type { EthAddress } from '@aztec/foundation/eth-address';
+import type { Signature } from '@aztec/foundation/eth-signature';
+
+import { addressFromPrivateKey, makeEthSignDigest, signMessage } from './utils.js';
+
+/**
+ * Secp256k1Signer
+ *
+ * A class for signing messages using a secp256k1 private key.
+ * - This is a slim drop in replacement for an Ethereum signer, so it can be used in the same way.
+ * - See `utils.ts` for functions that enable recovering addresses and public keys from signatures.
+ */
+export class Secp256k1Signer {
+  public readonly address: EthAddress;
+
+  constructor(private privateKey: Buffer32) {
+    this.address = addressFromPrivateKey(privateKey.buffer);
+  }
+
+  sign(message: Buffer32): Signature {
+    return signMessage(message, this.privateKey.buffer);
+  }
+
+  /**
+   * Sign a message using the same method as eth_sign
+   * @param message - The message to sign.
+   * @returns The signature.
+   */
+  signMessage(message: Buffer32): Signature {
+    const digest = makeEthSignDigest(message);
+    return this.sign(digest);
+  }
+
+  static random(): Secp256k1Signer {
+    return new Secp256k1Signer(Buffer32.random());
+  }
+}

package/src/crypto/secp256k1-signer/utils.ts

@@ -0,0 +1,99 @@
+import { secp256k1 } from '@noble/curves/secp256k1';
+
+import { Buffer32 } from '../../buffer/buffer32.js';
+import { EthAddress } from '../../eth-address/index.js';
+import { Signature } from '../../eth-signature/eth_signature.js';
+import { keccak256 } from '../keccak/index.js';
+
+const ETH_SIGN_PREFIX = '\x19Ethereum Signed Message:\n32';
+
+// We just hash the message to make it easier to work with in the smart contract.
+export function makeEthSignDigest(message: Buffer32): Buffer32 {
+  const prefix = Buffer.from(ETH_SIGN_PREFIX);
+  return Buffer32.fromBuffer(keccak256(Buffer.concat([prefix, message.buffer])));
+}
+
+/**
+ * Converts a public key to an address.
+ * @param publicKey - The public key to convert.
+ * @returns The address.
+ */
+function publicKeyToAddress(publicKey: Buffer): EthAddress {
+  const hash = keccak256(publicKey.subarray(1));
+  return new EthAddress(hash.subarray(12));
+}
+
+/**
+ * Converts a private key to a public key.
+ * @param privateKey - The private key to convert.
+ * @returns The public key.
+ */
+export function publicKeyFromPrivateKey(privateKey: Buffer): Buffer {
+  return Buffer.from(secp256k1.getPublicKey(privateKey, false));
+}
+
+/**
+ * Converts a private key to an address.
+ * @param privateKey - The private key to convert.
+ * @returns The address.
+ */
+export function addressFromPrivateKey(privateKey: Buffer): EthAddress {
+  const publicKey = publicKeyFromPrivateKey(privateKey);
+  return publicKeyToAddress(publicKey);
+}
+
+/**
+ * Recovers an address from a hash and a signature.
+ * @param hash - The hash to recover the address from.
+ * @param signature - The signature to recover the address from.
+ * @returns The address.
+ */
+export function recoverAddress(hash: Buffer32, signature: Signature): EthAddress {
+  const publicKey = recoverPublicKey(hash, signature);
+  return publicKeyToAddress(publicKey);
+}
+
+/**
+ * @attribution - viem
+ * Converts a yParityOrV value to a recovery bit.
+ * @param yParityOrV - The yParityOrV value to convert.
+ * @returns The recovery bit.
+ */
+function toRecoveryBit(yParityOrV: number) {
+  if (yParityOrV === 0 || yParityOrV === 1) {
+    return yParityOrV;
+  }
+  if (yParityOrV === 27) {
+    return 0;
+  }
+  if (yParityOrV === 28) {
+    return 1;
+  }
+  throw new Error('Invalid yParityOrV value');
+}
+
+/**
+ * Signs a message using ecdsa over the secp256k1 curve.
+ * @param message - The message to sign.
+ * @param privateKey - The private key to sign the message with.
+ * @returns The signature.
+ */
+export function signMessage(message: Buffer32, privateKey: Buffer) {
+  const { r, s, recovery } = secp256k1.sign(message.buffer, privateKey);
+  return new Signature(Buffer32.fromBigInt(r), Buffer32.fromBigInt(s), recovery ? 28 : 27);
+}
+
+/**
+ * Recovers a public key from a hash and a signature.
+ * @param hash - The hash to recover the public key from.
+ * @param signature - The signature to recover the public key from.
+ * @returns The public key.
+ */
+export function recoverPublicKey(hash: Buffer32, signature: Signature): Buffer {
+  const { r, s, v } = signature;
+  const recoveryBit = toRecoveryBit(v);
+  const sig = new secp256k1.Signature(r.toBigInt(), s.toBigInt()).addRecoveryBit(recoveryBit);
+
+  const publicKey = sig.recoverPublicKey(hash.buffer).toHex(false);
+  return Buffer.from(publicKey, 'hex');
+}

package/src/crypto/serialize.ts

@@ -0,0 +1,85 @@
+// TODO find a new home for this as we move to external bb.js
+// See https://github.com/AztecProtocol/aztec-packages/issues/782
+import { Buffer } from 'buffer';
+
+/**
+ * For serializing an array of fixed length buffers.
+ * TODO move to foundation pkg.
+ * @param arr - Array of bufffers.
+ * @returns The serialized buffers.
+ */
+export function serializeBufferArrayToVector(arr: Buffer[]) {
+  const lengthBuf = Buffer.alloc(4);
+  lengthBuf.writeUInt32BE(arr.length, 0);
+  return Buffer.concat([lengthBuf, ...arr]);
+}
+
+/**
+ * Helper function for deserializeArrayFromVector.
+ */
+type DeserializeFn<T> = (
+  buf: Buffer,
+  offset: number,
+) => {
+  /**
+   * The deserialized type.
+   */
+  elem: T;
+  /**
+   * How many bytes to advance by.
+   */
+  adv: number;
+};
+
+/**
+ * For deserializing numbers to 32-bit little-endian form.
+ * TODO move to foundation pkg.
+ * @param n - The number.
+ * @returns The endian-corrected number.
+ */
+export function deserializeArrayFromVector<T>(deserialize: DeserializeFn<T>, vector: Buffer, offset = 0) {
+  let pos = offset;
+  const size = vector.readUInt32BE(pos);
+  pos += 4;
+  const arr = new Array<T>(size);
+  for (let i = 0; i < size; ++i) {
+    const { elem, adv } = deserialize(vector, pos);
+    pos += adv;
+    arr[i] = elem;
+  }
+  return { elem: arr, adv: pos - offset };
+}
+
+/**
+ * For serializing numbers to 32 bit little-endian form.
+ * TODO move to foundation pkg.
+ * @param n - The number.
+ * @returns The endian-corrected number.
+ */
+export function numToUInt32LE(n: number, bufferSize = 4) {
+  const buf = Buffer.alloc(bufferSize);
+  buf.writeUInt32LE(n, bufferSize - 4);
+  return buf;
+}
+
+/**
+ * Deserialize the 256-bit number at address `offset`.
+ * @param buf - The buffer.
+ * @param offset - The address.
+ * @returns The derserialized 256-bit field.
+ */
+export function deserializeField(buf: Buffer, offset = 0) {
+  const adv = 32;
+  return { elem: buf.slice(offset, offset + adv), adv };
+}
+
+export function concatenateUint8Arrays(arrayOfUint8Arrays: Uint8Array[]) {
+  const totalLength = arrayOfUint8Arrays.reduce((prev, curr) => prev + curr.length, 0);
+  const result = new Uint8Array(totalLength);
+  let length = 0;
+  for (const array of arrayOfUint8Arrays) {
+    result.set(array, length);
+    length += array.length;
+  }
+  return result;
+}