@aztec/foundation 0.0.1-commit.3fd054f6 → 0.0.1-commit.431c48d

package/src/config/network_name.ts

@@ -1,7 +1,6 @@
 export type NetworkNames =
   | 'local'
-  | 'staging-ignition'
-  | 'staging-public'
+  | 'staging'
   | 'testnet'
   | 'mainnet'
   | 'next-net'
@@ -12,9 +11,7 @@ export function getActiveNetworkName(name?: string): NetworkNames {
   const network = name || process.env.NETWORK;
   if (!network || network === '' || network === 'local') {
     return 'local';
-  } else if (network === 'staging-ignition') {
-    return network;
-  } else if (network === 'staging-public') {
+  } else if (network === 'staging') {
     return network;
   } else if (network === 'testnet' || network === 'alpha-testnet') {
     return 'testnet';

package/src/config/secret_value.ts

@@ -43,7 +43,7 @@ export class SecretValue<T> {
   /**
    * Returns a Zod schema
    */
-  static schema<O>(valueSchema: ZodType<O, any, any>): ZodType<SecretValue<O>, any, any> {
+  static schema<O>(valueSchema: ZodType<O, any>): ZodType<SecretValue<O>, any> {
     return valueSchema.transform(value => new SecretValue<O>(value));
   }
 }

package/src/crypto/aes128/index.ts

@@ -59,10 +59,19 @@ export class Aes128 {
    * @param iv - AES initialization vector.
    * @param key - Key to decrypt with.
    * @returns Decrypted data.
+   * @throws If the decrypted buffer has invalid PKCS#7 padding.
    */
   public async decryptBufferCBC(data: Uint8Array, iv: Uint8Array, key: Uint8Array) {
     const paddedBuffer = await this.decryptBufferCBCKeepPadding(data, iv, key);
-    const paddingToRemove = paddedBuffer[paddedBuffer.length - 1];
-    return paddedBuffer.subarray(0, paddedBuffer.length - paddingToRemove);
+    const paddingLen = paddedBuffer[paddedBuffer.length - 1];
+    if (paddingLen === 0 || paddingLen > 16) {
+      throw new Error(`Invalid PKCS#7 padding length: ${paddingLen}`);
+    }
+    for (let i = paddedBuffer.length - paddingLen; i < paddedBuffer.length; i++) {
+      if (paddedBuffer[i] !== paddingLen) {
+        throw new Error('Invalid PKCS#7 padding');
+      }
+    }
+    return paddedBuffer.subarray(0, paddedBuffer.length - paddingLen);
   }
 }

package/src/crypto/bls/bn254_keystore.ts

@@ -1,7 +1,8 @@
 import { randomBytes } from '@aztec/foundation/crypto/random';
 
-import { createCipheriv, createDecipheriv, createHash, pbkdf2Sync, randomUUID } from 'crypto';
+import { createCipheriv, createDecipheriv, createHash, pbkdf2, pbkdf2Sync, randomUUID } from 'crypto';
 import { readFileSync } from 'fs';
+import { promisify } from 'util';
 import { z } from 'zod';
 
 /**
@@ -100,24 +101,15 @@ export interface Bn254KeystoreInterface {
   version: number;
 }
 
-/**
- * Creates a BN254 keystore object for a BN254 BLS private key.
- *
- * Uses PBKDF2 with SHA-256 for key derivation and AES-128-CTR for encryption,
- * following the EIP-2335 specification format.
- *
- * @param password - Password for encrypting the private key
- * @param privateKeyHex - Private key as 0x-prefixed hex string (32 bytes)
- * @param pubkeyHex - Public key as hex string (compressed or uncompressed)
- * @param derivationPath - BIP-44 style derivation path (e.g., "m/12381/3600/0/0/0")
- * @returns BN254 keystore object ready to be serialized to JSON
- * @throws Error if private key is not 32-byte hex
- */
-export function createBn254Keystore(
-  password: string,
+const pbkdf2Async = promisify(pbkdf2);
+
+function createBn254KeystoreFromDerivedKey(
   privateKeyHex: string,
   pubkeyHex: string,
   derivationPath: string,
+  salt: Buffer,
+  iv: Buffer,
+  dk: Buffer,
 ): Bn254Keystore {
   const ensureHex = (hex: string) => hex.replace(/^0x/i, '');
   const privHex = ensureHex(privateKeyHex);
@@ -125,11 +117,7 @@ export function createBn254Keystore(
     throw new Error('BLS private key must be 32-byte hex');
   }
 
-  const salt = randomBytes(32);
-  const iv = randomBytes(16);
-  const dk = pbkdf2Sync(Buffer.from(password.normalize('NFKD'), 'utf8'), salt, 262144, 32, 'sha256');
   const cipherKey = dk.subarray(0, 16);
-
   const cipher = createCipheriv('aes-128-ctr', cipherKey, iv);
   const plaintext = Buffer.from(privHex, 'hex');
   const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
@@ -166,6 +154,31 @@ export function createBn254Keystore(
   };
 }
 
+/**
+ * Creates a BN254 keystore object for a BN254 BLS private key.
+ *
+ * Uses PBKDF2 with SHA-256 for key derivation and AES-128-CTR for encryption,
+ * following the EIP-2335 specification format.
+ *
+ * @param password - Password for encrypting the private key
+ * @param privateKeyHex - Private key as 0x-prefixed hex string (32 bytes)
+ * @param pubkeyHex - Public key as hex string (compressed or uncompressed)
+ * @param derivationPath - BIP-44 style derivation path (e.g., "m/12381/3600/0/0/0")
+ * @returns BN254 keystore object ready to be serialized to JSON
+ * @throws Error if private key is not 32-byte hex
+ */
+export async function createBn254Keystore(
+  password: string,
+  privateKeyHex: string,
+  pubkeyHex: string,
+  derivationPath: string,
+): Promise<Bn254Keystore> {
+  const salt = randomBytes(32);
+  const iv = randomBytes(16);
+  const dk = await pbkdf2Async(Buffer.from(password.normalize('NFKD'), 'utf8'), salt, 262144, 32, 'sha256');
+  return createBn254KeystoreFromDerivedKey(privateKeyHex, pubkeyHex, derivationPath, salt, iv, dk);
+}
+
 /**
  * Loads and validates a BN254 keystore file.
  *
@@ -262,26 +275,3 @@ export function decryptBn254KeystoreFromObject(keystore: Bn254Keystore, password
     throw new Bn254KeystoreError(`Failed to decrypt keystore: ${String(error)}`, error as Error);
   }
 }
-
-/**
- * Validates that a decrypted private key matches the public key in the keystore.
- *
- * @param privateKeyHex - Decrypted private key (0x-prefixed)
- * @param expectedPubkey - Expected public key from keystore
- * @param computePublicKey - Function to compute public key from private key
- * @returns true if keys match, false otherwise
- */
-export function verifyBn254Keypair(
-  privateKeyHex: string,
-  expectedPubkey: string,
-  computePublicKey: (privateKey: string) => string,
-): boolean {
-  try {
-    const computedPubkey = computePublicKey(privateKeyHex);
-    const normalizedExpected = expectedPubkey.toLowerCase().replace(/^0x/i, '');
-    const normalizedComputed = computedPubkey.toLowerCase().replace(/^0x/i, '');
-    return normalizedExpected === normalizedComputed;
-  } catch {
-    return false;
-  }
-}

package/src/crypto/poseidon/index.ts

@@ -1,21 +1,35 @@
-import { Barretenberg } from '@aztec/bb.js';
+import { Barretenberg, BarretenbergSync } from '@aztec/bb.js';
 
 import { Fr } from '../../curves/bn254/field.js';
 import { type Fieldable, serializeToFields } from '../../serialize/serialize.js';
 
+const IS_BROWSER = typeof self !== 'undefined';
+
+async function poseidon2HashFields(inputFields: Fr[]): Promise<Fr> {
+  if (IS_BROWSER) {
+    await BarretenbergSync.initSingleton();
+    const api = BarretenbergSync.getSingleton();
+    const response = api.poseidon2Hash({
+      inputs: inputFields.map(i => i.toBuffer()),
+    });
+    return Fr.fromBuffer(Buffer.from(response.hash));
+  } else {
+    await Barretenberg.initSingleton();
+    const api = Barretenberg.getSingleton();
+    const response = await api.poseidon2Hash({
+      inputs: inputFields.map(i => i.toBuffer()),
+    });
+    return Fr.fromBuffer(Buffer.from(response.hash));
+  }
+}
+
 /**
  * Create a poseidon hash (field) from an array of input fields.
  * @param input - The input fields to hash.
  * @returns The poseidon hash.
  */
-export async function poseidon2Hash(input: Fieldable[]): Promise<Fr> {
-  const inputFields = serializeToFields(input);
-  await Barretenberg.initSingleton();
-  const api = Barretenberg.getSingleton();
-  const response = await api.poseidon2Hash({
-    inputs: inputFields.map(i => i.toBuffer()),
-  });
-  return Fr.fromBuffer(Buffer.from(response.hash));
+export function poseidon2Hash(input: Fieldable[]): Promise<Fr> {
+  return poseidon2HashFields(serializeToFields(input));
 }
 
 /**
@@ -24,15 +38,10 @@ export async function poseidon2Hash(input: Fieldable[]): Promise<Fr> {
  * @param separator - The domain separator.
  * @returns The poseidon hash.
  */
-export async function poseidon2HashWithSeparator(input: Fieldable[], separator: number): Promise<Fr> {
+export function poseidon2HashWithSeparator(input: Fieldable[], separator: number): Promise<Fr> {
   const inputFields = serializeToFields(input);
   inputFields.unshift(new Fr(separator));
-  await Barretenberg.initSingleton();
-  const api = Barretenberg.getSingleton();
-  const response = await api.poseidon2Hash({
-    inputs: inputFields.map(i => i.toBuffer()),
-  });
-  return Fr.fromBuffer(Buffer.from(response.hash));
+  return poseidon2HashFields(inputFields);
 }
 
 /**
@@ -42,19 +51,24 @@ export async function poseidon2HashWithSeparator(input: Fieldable[], separator:
  */
 export async function poseidon2Permutation(input: Fieldable[]): Promise<Fr[]> {
   const inputFields = serializeToFields(input);
-  // We'd like this assertion but it's not possible to use it in the browser.
-  // assert(input.length === 4, 'Input state must be of size 4');
-  await Barretenberg.initSingleton();
-  const api = Barretenberg.getSingleton();
-  const response = await api.poseidon2Permutation({
-    inputs: inputFields.map(i => i.toBuffer()),
-  });
-  // We'd like this assertion but it's not possible to use it in the browser.
-  // assert(response.outputs.length === 4, 'Output state must be of size 4');
-  return response.outputs.map(o => Fr.fromBuffer(Buffer.from(o)));
+  if (IS_BROWSER) {
+    await BarretenbergSync.initSingleton();
+    const api = BarretenbergSync.getSingleton();
+    const response = api.poseidon2Permutation({
+      inputs: inputFields.map(i => i.toBuffer()),
+    });
+    return response.outputs.map(o => Fr.fromBuffer(Buffer.from(o)));
+  } else {
+    await Barretenberg.initSingleton();
+    const api = Barretenberg.getSingleton();
+    const response = await api.poseidon2Permutation({
+      inputs: inputFields.map(i => i.toBuffer()),
+    });
+    return response.outputs.map(o => Fr.fromBuffer(Buffer.from(o)));
+  }
 }
 
-export async function poseidon2HashBytes(input: Buffer): Promise<Fr> {
+export function poseidon2HashBytes(input: Buffer): Promise<Fr> {
   const inputFields = [];
   for (let i = 0; i < input.length; i += 31) {
     const fieldBytes = Buffer.alloc(32, 0);
@@ -65,11 +79,5 @@ export async function poseidon2HashBytes(input: Buffer): Promise<Fr> {
     inputFields.push(Fr.fromBuffer(fieldBytes));
   }
 
-  await Barretenberg.initSingleton();
-  const api = Barretenberg.getSingleton();
-  const response = await api.poseidon2Hash({
-    inputs: inputFields.map(i => i.toBuffer()),
-  });
-
-  return Fr.fromBuffer(Buffer.from(response.hash));
+  return poseidon2HashFields(inputFields);
 }

package/src/crypto/schnorr/index.ts

@@ -1,4 +1,5 @@
 import { BarretenbergSync } from '@aztec/bb.js';
+import type { Fr } from '@aztec/foundation/curves/bn254';
 import type { GrumpkinScalar } from '@aztec/foundation/curves/grumpkin';
 import { Point } from '@aztec/foundation/curves/grumpkin';
 
@@ -23,33 +24,33 @@ export class Schnorr {
   }
 
   /**
-   * Constructs a Schnorr signature given a msg and a private key.
-   * @param msg - Message over which the signature is constructed.
+   * Constructs a Schnorr signature over a 32-byte message field element.
+   * @param msg - The message hash, as a grumpkin base field element.
    * @param privateKey - The private key of the signer.
    * @returns A Schnorr signature of the form (s, e).
    */
-  public async constructSignature(msg: Uint8Array, privateKey: GrumpkinScalar) {
+  public async constructSignature(msg: Fr, privateKey: GrumpkinScalar) {
     await BarretenbergSync.initSingleton();
     const api = BarretenbergSync.getSingleton();
     const response = api.schnorrConstructSignature({
-      message: msg,
+      messageField: msg.toBuffer(),
       privateKey: privateKey.toBuffer(),
     });
     return new SchnorrSignature(Buffer.from([...response.s, ...response.e]));
   }
 
   /**
-   * Verifies a Schnorr signature given a Grumpkin public key.
-   * @param msg - Message over which the signature was constructed.
+   * Verifies a Schnorr signature against a Grumpkin public key.
+   * @param msg - The message hash, as a grumpkin base field element.
    * @param pubKey - The Grumpkin public key of the signer.
    * @param sig - The Schnorr signature.
    * @returns True or false.
    */
-  public async verifySignature(msg: Uint8Array, pubKey: Point, sig: SchnorrSignature) {
+  public async verifySignature(msg: Fr, pubKey: Point, sig: SchnorrSignature) {
     await BarretenbergSync.initSingleton();
     const api = BarretenbergSync.getSingleton();
     const response = api.schnorrVerifySignature({
-      message: msg,
+      messageField: msg.toBuffer(),
       publicKey: { x: pubKey.x.toBuffer(), y: pubKey.y.toBuffer() },
       s: sig.s,
       e: sig.e,

package/src/crypto/schnorr/signature.ts

@@ -1,6 +1,5 @@
-import { randomBytes } from '@aztec/foundation/crypto/random';
 import { Fr } from '@aztec/foundation/curves/bn254';
-import { BufferReader, mapTuple } from '@aztec/foundation/serialize';
+import { mapTuple } from '@aztec/foundation/serialize';
 
 import type { Signature } from '../signature/index.js';
 
@@ -14,46 +13,12 @@ export class SchnorrSignature implements Signature {
    */
   public static SIZE = 64;
 
-  /**
-   * An empty signature.
-   */
-  public static EMPTY = new SchnorrSignature(Buffer.alloc(64));
-
   constructor(private buffer: Buffer) {
     if (buffer.length !== SchnorrSignature.SIZE) {
       throw new Error(`Invalid signature buffer of length ${buffer.length}.`);
     }
   }
 
-  /**
-   * Determines if the provided signature is valid or not.
-   * @param signature - The data to be checked.
-   * @returns Boolean indicating if the provided data is a valid schnorr signature.
-   */
-  public static isSignature(signature: string) {
-    return /^(0x)?[0-9a-f]{128}$/i.test(signature);
-  }
-
-  /**
-   * Constructs a SchnorrSignature from the provided string.
-   * @param signature - The string to be converted to a schnorr signature.
-   * @returns The constructed schnorr signature.
-   */
-  public static fromString(signature: string) {
-    if (!SchnorrSignature.isSignature(signature)) {
-      throw new Error(`Invalid signature string: ${signature}`);
-    }
-    return new SchnorrSignature(Buffer.from(signature.replace(/^0x/i, ''), 'hex'));
-  }
-
-  /**
-   * Generates a random schnorr signature.
-   * @returns The randomly constructed signature.
-   */
-  public static random() {
-    return new SchnorrSignature(randomBytes(64));
-  }
-
   /**
    * Returns the 's' component of the signature.
    * @returns A buffer containing the signature's 's' component.
@@ -78,16 +43,6 @@ export class SchnorrSignature implements Signature {
     return this.buffer;
   }
 
-  /**
-   * Deserializes from a buffer.
-   * @param buffer - The buffer representation of the object.
-   * @returns The new object.
-   */
-  static fromBuffer(buffer: Buffer | BufferReader): SchnorrSignature {
-    const reader = BufferReader.asReader(buffer);
-    return new SchnorrSignature(reader.readBytes(SchnorrSignature.SIZE));
-  }
-
   /**
    * Returns the full signature as a hex string.
    * @returns A string containing the signature in hex format.
@@ -113,4 +68,20 @@ export class SchnorrSignature implements Signature {
 
     return mapTuple([buf1, buf2, buf3], Fr.fromBuffer);
   }
+
+  /**
+   * Splits the signature into the four 128-bit limbs that Noir's `EmbeddedCurveScalar` consumes:
+   * `[s.lo, s.hi, e.lo, e.hi]`, where each component scalar is encoded as `lo + hi * 2^128`.
+   *
+   * Each 32-byte big-endian component is sliced into its top 16 bytes (`hi`) and bottom 16 bytes
+   * (`lo`); each half is zero-padded into a 32-byte buffer and decoded as `Fr` (big-endian).
+   */
+  toLimbFields(): [Fr, Fr, Fr, Fr] {
+    const limb = (start: number) => {
+      const buf = Buffer.alloc(32);
+      this.buffer.copy(buf, 16, start, start + 16);
+      return Fr.fromBuffer(buf);
+    };
+    return [limb(16), limb(0), limb(48), limb(32)];
+  }
 }

package/src/curves/bls12/field.ts

@@ -6,7 +6,6 @@ import { toBigIntBE, toBufferBE } from '../../bigint-buffer/index.js';
 import { randomBytes } from '../../crypto/random/index.js';
 import { hexSchemaFor } from '../../schemas/utils.js';
 import { BufferReader } from '../../serialize/buffer_reader.js';
-import { TypeRegistry } from '../../serialize/type_registry.js';
 import { Fr } from '../bn254/field.js';
 
 /**
@@ -323,9 +322,6 @@ export class BLS12Fr extends BLS12Field {
   }
 }
 
-// For deserializing JSON.
-TypeRegistry.register('BLS12Fr', BLS12Fr);
-
 /**
  * Fq field class.
  * @dev This class is used to represent elements of BLS12-381 base field.
@@ -458,6 +454,3 @@ export class BLS12Fq extends BLS12Field {
     return hexSchemaFor(BLS12Fq);
   }
 }
-
-// For deserializing JSON.
-TypeRegistry.register('BLS12Fq', BLS12Fq);

package/src/curves/bn254/field.ts

@@ -6,9 +6,7 @@ import { toBigIntBE, toBufferBE } from '../../bigint-buffer/index.js';
 import { randomBytes } from '../../crypto/random/index.js';
 import { hexSchemaFor } from '../../schemas/utils.js';
 import { BufferReader } from '../../serialize/buffer_reader.js';
-import { TypeRegistry } from '../../serialize/type_registry.js';
-
-/* eslint-disable @typescript-eslint/no-unsafe-declaration-merging */
+import type { BufferSink } from '../../serialize/buffer_sink.js';
 
 /**
  * Represents a field derived from BaseField.
@@ -67,10 +65,16 @@ abstract class BaseField {
   protected abstract modulus(): bigint;
 
   /**
-   * Converts the bigint to a Buffer.
+   * Converts the bigint to a Buffer. With a sink, streams the 32 big-endian bytes straight in (no allocation)
+   * and returns undefined; without one, returns a freshly allocated buffer.
    */
-  toBuffer(): Buffer {
-    return toBufferBE(this.asBigInt, 32);
+  toBuffer(): Buffer;
+  toBuffer(sink: BufferSink): void;
+  toBuffer(sink?: BufferSink): Buffer | void {
+    if (!sink) {
+      return toBufferBE(this.asBigInt, BaseField.SIZE_IN_BYTES);
+    }
+    sink.writeField(this.asBigInt);
   }
 
   toString(): `0x${string}` {
@@ -187,10 +191,25 @@ function fromHexString<T extends BaseField>(buf: string, f: DerivedField<T>) {
   return new f(toBigIntBE(buffer));
 }
 
-/** Branding to ensure fields are not interchangeable types. */
-export interface Fr {
-  /** Brand. */
-  _branding: 'Fr';
+/**
+ * Abstract unbranded base class for BN254 scalar field elements.
+ * Extend this instead of Fr when defining a branded subtype (e.g. BlockHash)
+ * to avoid inheriting Fr's `_branding`.
+ */
+export abstract class BaseFr extends BaseField {
+  static MODULUS = 0x30644e72e131a029b85045b68181585d2833e84879b9709143e1f593f0000001n;
+
+  constructor(value: number | bigint | boolean | BaseField | Buffer) {
+    super(value);
+  }
+
+  protected modulus() {
+    return BaseFr.MODULUS;
+  }
+
+  toJSON() {
+    return this.toString();
+  }
 }
 
 /**
@@ -198,10 +217,12 @@ export interface Fr {
  * @dev This class is used to represent elements of BN254 scalar field or elements in the base field of Grumpkin.
  * (Grumpkin's scalar field corresponds to BN254's base field and vice versa.)
  */
-export class Fr extends BaseField {
+export class Fr extends BaseFr {
+  /** Branding for nominal typing. */
+  declare private readonly _branding: 'Fr';
+  static override MODULUS = 0x30644e72e131a029b85045b68181585d2833e84879b9709143e1f593f0000001n;
   static ZERO = new Fr(0n);
   static ONE = new Fr(1n);
-  static MODULUS = 0x30644e72e131a029b85045b68181585d2833e84879b9709143e1f593f0000001n;
   static MAX_FIELD_VALUE = new Fr(this.MODULUS - 1n);
 
   constructor(value: number | bigint | boolean | Fr | Buffer) {
@@ -212,10 +233,6 @@ export class Fr extends BaseField {
     return `Fr<${this.toString()}>`;
   }
 
-  protected modulus() {
-    return Fr.MODULUS;
-  }
-
   static random() {
     return random(Fr);
   }
@@ -320,10 +337,6 @@ export class Fr extends BaseField {
     return Fr.fromBuffer(Buffer.from(response.value));
   }
 
-  toJSON() {
-    return this.toString();
-  }
-
   /**
    * Creates an Fr instance from a plain object without Zod validation.
    * This method is optimized for performance and skips validation, making it suitable
@@ -345,23 +358,14 @@ export class Fr extends BaseField {
   }
 }
 
-// For deserializing JSON.
-TypeRegistry.register('Fr', Fr);
-
-/**
- * Branding to ensure fields are not interchangeable types.
- */
-export interface Fq {
-  /** Brand. */
-  _branding: 'Fq';
-}
-
 /**
  * Fq field class.
  * @dev This class is used to represent elements of BN254 base field or elements in the scalar field of Grumpkin.
  * (Grumpkin's scalar field corresponds to BN254's base field and vice versa.)
  */
 export class Fq extends BaseField {
+  /** Branding for nominal typing. */
+  declare private readonly _branding: 'Fq';
   static ZERO = new Fq(0n);
   static MODULUS = 0x30644e72e131a029b85045b68181585d97816a916871ca8d3c208c16d87cfd47n;
   private static HIGH_SHIFT = BigInt((BaseField.SIZE_IN_BYTES / 2) * 8);
@@ -470,9 +474,6 @@ export class Fq extends BaseField {
   }
 }
 
-// For deserializing JSON.
-TypeRegistry.register('Fq', Fq);
-
 // Beware: Performance bottleneck below
 
 /**