@aztec/foundation 0.0.1-commit.b655e406 → 0.0.1-commit.b9865e97

package/src/crypto/schnorr/signature.ts

@@ -1,6 +1,5 @@
-import { randomBytes } from '@aztec/foundation/crypto';
-import { Fr } from '@aztec/foundation/fields';
-import { BufferReader, mapTuple } from '@aztec/foundation/serialize';
+import { Fr } from '@aztec/foundation/curves/bn254';
+import { mapTuple } from '@aztec/foundation/serialize';
 
 import type { Signature } from '../signature/index.js';
 
@@ -14,46 +13,12 @@ export class SchnorrSignature implements Signature {
    */
   public static SIZE = 64;
 
-  /**
-   * An empty signature.
-   */
-  public static EMPTY = new SchnorrSignature(Buffer.alloc(64));
-
   constructor(private buffer: Buffer) {
     if (buffer.length !== SchnorrSignature.SIZE) {
       throw new Error(`Invalid signature buffer of length ${buffer.length}.`);
     }
   }
 
-  /**
-   * Determines if the provided signature is valid or not.
-   * @param signature - The data to be checked.
-   * @returns Boolean indicating if the provided data is a valid schnorr signature.
-   */
-  public static isSignature(signature: string) {
-    return /^(0x)?[0-9a-f]{128}$/i.test(signature);
-  }
-
-  /**
-   * Constructs a SchnorrSignature from the provided string.
-   * @param signature - The string to be converted to a schnorr signature.
-   * @returns The constructed schnorr signature.
-   */
-  public static fromString(signature: string) {
-    if (!SchnorrSignature.isSignature(signature)) {
-      throw new Error(`Invalid signature string: ${signature}`);
-    }
-    return new SchnorrSignature(Buffer.from(signature.replace(/^0x/i, ''), 'hex'));
-  }
-
-  /**
-   * Generates a random schnorr signature.
-   * @returns The randomly constructed signature.
-   */
-  public static random() {
-    return new SchnorrSignature(randomBytes(64));
-  }
-
   /**
    * Returns the 's' component of the signature.
    * @returns A buffer containing the signature's 's' component.
@@ -78,16 +43,6 @@ export class SchnorrSignature implements Signature {
     return this.buffer;
   }
 
-  /**
-   * Deserializes from a buffer.
-   * @param buffer - The buffer representation of the object.
-   * @returns The new object.
-   */
-  static fromBuffer(buffer: Buffer | BufferReader): SchnorrSignature {
-    const reader = BufferReader.asReader(buffer);
-    return new SchnorrSignature(reader.readBytes(SchnorrSignature.SIZE));
-  }
-
   /**
    * Returns the full signature as a hex string.
    * @returns A string containing the signature in hex format.
@@ -113,4 +68,20 @@ export class SchnorrSignature implements Signature {
 
     return mapTuple([buf1, buf2, buf3], Fr.fromBuffer);
   }
+
+  /**
+   * Splits the signature into the four 128-bit limbs that Noir's `EmbeddedCurveScalar` consumes:
+   * `[s.lo, s.hi, e.lo, e.hi]`, where each component scalar is encoded as `lo + hi * 2^128`.
+   *
+   * Each 32-byte big-endian component is sliced into its top 16 bytes (`hi`) and bottom 16 bytes
+   * (`lo`); each half is zero-padded into a 32-byte buffer and decoded as `Fr` (big-endian).
+   */
+  toLimbFields(): [Fr, Fr, Fr, Fr] {
+    const limb = (start: number) => {
+      const buf = Buffer.alloc(32);
+      this.buffer.copy(buf, 16, start, start + 16);
+      return Fr.fromBuffer(buf);
+    };
+    return [limb(16), limb(0), limb(48), limb(32)];
+  }
 }

package/src/crypto/secp256k1/index.ts

@@ -27,7 +27,7 @@ export class Secp256k1 {
    * @returns Result of the multiplication.
    */
   public async mul(point: Uint8Array, scalar: Uint8Array) {
-    await BarretenbergSync.initSingleton({ wasmPath: process.env.BB_WASM_PATH });
+    await BarretenbergSync.initSingleton();
     const api = BarretenbergSync.getSingleton();
     const response = api.secp256k1Mul({
       point: { x: point.subarray(0, 32), y: point.subarray(32, 64) },
@@ -41,7 +41,7 @@ export class Secp256k1 {
    * @returns Random field element.
    */
   public async getRandomFr() {
-    await BarretenbergSync.initSingleton({ wasmPath: process.env.BB_WASM_PATH });
+    await BarretenbergSync.initSingleton();
     const api = BarretenbergSync.getSingleton();
     const response = api.secp256k1GetRandomFr({ dummy: 0 });
     return Buffer.from(response.value);
@@ -53,7 +53,7 @@ export class Secp256k1 {
    * @returns Buffer representation of the field element.
    */
   public async reduce512BufferToFr(uint512Buf: Buffer) {
-    await BarretenbergSync.initSingleton({ wasmPath: process.env.BB_WASM_PATH });
+    await BarretenbergSync.initSingleton();
     const api = BarretenbergSync.getSingleton();
     const response = api.secp256k1Reduce512({ input: uint512Buf });
     return Buffer.from(response.value);

package/src/crypto/secp256k1-signer/utils.ts

@@ -210,3 +210,35 @@ export function recoverPublicKey(hash: Buffer32, signature: Signature, opts: Rec
   const publicKey = sig.recoverPublicKey(hash.buffer).toHex(false);
   return Buffer.from(publicKey, 'hex');
 }
+
+/** Arbitrary hash used for testing signature recoverability. */
+const PROBE_HASH = Buffer32.fromBuffer(keccak256(Buffer.from('signature-recoverability-probe')));
+
+/**
+ * Generates a random valid ECDSA signature that is recoverable to some address.
+ * Since Signature.random() produces real signatures via secp256k1 signing, the result is always
+ * recoverable, but we verify defensively by checking tryRecoverAddress.
+ */
+export function generateRecoverableSignature(): Signature {
+  for (let i = 0; i < 100; i++) {
+    const sig = Signature.random();
+    if (tryRecoverAddress(PROBE_HASH, sig) !== undefined) {
+      return sig;
+    }
+  }
+  throw new Secp256k1Error('Failed to generate a recoverable signature after 100 attempts');
+}
+
+/**
+ * Generates a random signature where ECDSA address recovery fails.
+ * Uses random r/s values (not from real signing) so that r is unlikely to be a valid secp256k1 x-coordinate.
+ */
+export function generateUnrecoverableSignature(): Signature {
+  for (let i = 0; i < 100; i++) {
+    const sig = new Signature(Buffer32.random(), Buffer32.random(), 27);
+    if (tryRecoverAddress(PROBE_HASH, sig) === undefined) {
+      return sig;
+    }
+  }
+  throw new Secp256k1Error('Failed to generate an unrecoverable signature after 100 attempts');
+}

package/src/crypto/sha256/index.ts

@@ -1,7 +1,7 @@
 /* eslint-disable camelcase */
 import { default as hash } from 'hash.js';
 
-import { Fr } from '../../fields/fields.js';
+import { Fr } from '../../curves/bn254/field.js';
 import { truncateAndPad } from '../../serialize/free_funcs.js';
 import { type Bufferable, serializeToBuffer } from '../../serialize/serialize.js';
 import type { Hasher } from '../../trees/hasher.js';

package/src/crypto/sha512/index.ts

@@ -1,6 +1,6 @@
 import { default as hash } from 'hash.js';
 
-import { GrumpkinScalar } from '../../fields/fields.js';
+import { GrumpkinScalar } from '../../curves/grumpkin/index.js';
 import { type Bufferable, serializeToBuffer } from '../../serialize/serialize.js';
 
 export const sha512 = (data: Buffer) => Buffer.from(hash.sha512().update(data).digest());

package/src/crypto/signature/index.ts

@@ -1,4 +1,4 @@
-import type { Fr } from '@aztec/foundation/fields';
+import type { Fr } from '@aztec/foundation/curves/bn254';
 
 /**
  * Interface to represent a signature.

package/src/crypto/sync/index.ts

@@ -3,4 +3,4 @@ import { BarretenbergSync } from '@aztec/bb.js';
 export * from './poseidon/index.js';
 export * from './pedersen/index.js';
 
-await BarretenbergSync.initSingleton({ wasmPath: process.env.BB_WASM_PATH });
+await BarretenbergSync.initSingleton();

package/src/crypto/sync/pedersen/index.ts

@@ -1,6 +1,6 @@
 import { BarretenbergSync } from '@aztec/bb.js';
 
-import { Fr } from '../../../fields/fields.js';
+import { Fr } from '../../../curves/bn254/field.js';
 import { type Fieldable, serializeToFields } from '../../../serialize/serialize.js';
 
 /**

package/src/crypto/sync/poseidon/index.ts

@@ -1,6 +1,6 @@
 import { BarretenbergSync } from '@aztec/bb.js';
 
-import { Fr } from '../../../fields/fields.js';
+import { Fr } from '../../../curves/bn254/field.js';
 import { type Fieldable, serializeToFields } from '../../../serialize/serialize.js';
 
 /**
@@ -34,15 +34,6 @@ export function poseidon2HashWithSeparator(input: Fieldable[], separator: number
   return Fr.fromBuffer(Buffer.from(response.hash));
 }
 
-export function poseidon2HashAccumulate(input: Fieldable[]): Fr {
-  const inputFields = serializeToFields(input);
-  const api = BarretenbergSync.getSingleton();
-  const response = api.poseidon2HashAccumulate({
-    inputs: inputFields.map(i => i.toBuffer()),
-  });
-  return Fr.fromBuffer(Buffer.from(response.hash));
-}
-
 /**
  * Runs a Poseidon2 permutation.
  * @param input the input state. Expected to be of size 4.

package/src/{fields/bls12_fields.ts → curves/bls12/field.ts}

@@ -2,12 +2,11 @@
 import { bls12_381 } from '@noble/curves/bls12-381';
 import { inspect } from 'util';
 
-import { toBigIntBE, toBufferBE } from '../bigint-buffer/index.js';
-import { randomBytes } from '../crypto/random/index.js';
-import { hexSchemaFor } from '../schemas/utils.js';
-import { BufferReader } from '../serialize/buffer_reader.js';
-import { TypeRegistry } from '../serialize/type_registry.js';
-import { Fr } from './fields.js';
+import { toBigIntBE, toBufferBE } from '../../bigint-buffer/index.js';
+import { randomBytes } from '../../crypto/random/index.js';
+import { hexSchemaFor } from '../../schemas/utils.js';
+import { BufferReader } from '../../serialize/buffer_reader.js';
+import { Fr } from '../bn254/field.js';
 
 /**
  * Represents a field derived from BLS12Field.
@@ -323,9 +322,6 @@ export class BLS12Fr extends BLS12Field {
   }
 }
 
-// For deserializing JSON.
-TypeRegistry.register('BLS12Fr', BLS12Fr);
-
 /**
  * Fq field class.
  * @dev This class is used to represent elements of BLS12-381 base field.
@@ -458,6 +454,3 @@ export class BLS12Fq extends BLS12Field {
     return hexSchemaFor(BLS12Fq);
   }
 }
-
-// For deserializing JSON.
-TypeRegistry.register('BLS12Fq', BLS12Fq);

package/src/curves/bls12/index.ts

@@ -0,0 +1,2 @@
+export * from './field.js';
+export * from './point.js';

package/src/{fields/bls12_point.ts → curves/bls12/point.ts}

@@ -3,13 +3,13 @@ import type { ProjPointType } from '@noble/curves/abstract/weierstrass';
 import { bls12_381 } from '@noble/curves/bls12-381';
 import { inspect } from 'util';
 
-import { toBufferBE } from '../bigint-buffer/index.js';
-import { randomBoolean } from '../crypto/random/index.js';
-import { hexSchemaFor } from '../schemas/utils.js';
-import { BufferReader, serializeToBuffer } from '../serialize/index.js';
-import { bufferToHex, hexToBuffer } from '../string/index.js';
-import { BLS12Fq, BLS12Fr } from './bls12_fields.js';
-import { Fr } from './fields.js';
+import { toBufferBE } from '../../bigint-buffer/index.js';
+import { randomBoolean } from '../../crypto/random/index.js';
+import { hexSchemaFor } from '../../schemas/utils.js';
+import { BufferReader, serializeToBuffer } from '../../serialize/index.js';
+import { bufferToHex, hexToBuffer } from '../../string/index.js';
+import { Fr } from '../bn254/field.js';
+import { BLS12Fq, BLS12Fr } from './field.js';
 
 /**
  * Represents a Point on an elliptic curve with x and y coordinates.

package/src/{fields/fields.ts → curves/bn254/field.ts}

@@ -2,15 +2,11 @@ import { BarretenbergSync } from '@aztec/bb.js';
 
 import { inspect } from 'util';
 
-import { toBigIntBE, toBufferBE } from '../bigint-buffer/index.js';
-import { randomBytes } from '../crypto/random/index.js';
-import { hexSchemaFor } from '../schemas/utils.js';
-import { BufferReader } from '../serialize/buffer_reader.js';
-import { TypeRegistry } from '../serialize/type_registry.js';
-
-const ZERO_BUFFER = Buffer.alloc(32);
-
-/* eslint-disable @typescript-eslint/no-unsafe-declaration-merging */
+import { toBigIntBE, toBufferBE } from '../../bigint-buffer/index.js';
+import { randomBytes } from '../../crypto/random/index.js';
+import { hexSchemaFor } from '../../schemas/utils.js';
+import { BufferReader } from '../../serialize/buffer_reader.js';
+import type { BufferSink } from '../../serialize/buffer_sink.js';
 
 /**
  * Represents a field derived from BaseField.
@@ -25,14 +21,12 @@ type DerivedField<T extends BaseField> = {
 
 /**
  * Base field class.
- * Conversions from Buffer to BigInt and vice-versa are not cheap.
- * We allow construction with either form and lazily convert to other as needed.
- * We only check we are within the field modulus when initializing with bigint.
+ * Uses bigint as the internal representation.
+ * Buffers are generated on demand from the bigint value.
  */
 abstract class BaseField {
   static SIZE_IN_BYTES = 32;
-  private asBuffer?: Buffer;
-  private asBigInt?: bigint;
+  private readonly asBigInt: bigint;
 
   /**
    * Return bigint representation.
@@ -52,53 +46,47 @@ abstract class BaseField {
       if (value.length > BaseField.SIZE_IN_BYTES) {
         throw new Error(`Value length ${value.length} exceeds ${BaseField.SIZE_IN_BYTES}`);
       }
-      this.asBuffer =
-        value.length === BaseField.SIZE_IN_BYTES
-          ? value
-          : Buffer.concat([Buffer.alloc(BaseField.SIZE_IN_BYTES - value.length), value]);
+      this.asBigInt = toBigIntBE(value);
     } else if (typeof value === 'bigint' || typeof value === 'number' || typeof value === 'boolean') {
       this.asBigInt = BigInt(value);
-      if (this.asBigInt >= this.modulus()) {
-        throw new Error(`Value 0x${this.asBigInt.toString(16)} is greater or equal to field modulus.`);
-      } else if (this.asBigInt < 0n) {
-        throw new Error(`Value 0x${this.asBigInt.toString(16)} is negative.`);
-      }
     } else if (value instanceof BaseField) {
-      this.asBuffer = value.asBuffer;
       this.asBigInt = value.asBigInt;
     } else {
       throw new Error(`Type '${typeof value}' with value '${value}' passed to BaseField ctor.`);
     }
+
+    if (this.asBigInt < 0n) {
+      throw new Error(`Value 0x${this.asBigInt.toString(16)} is negative.`);
+    } else if (this.asBigInt >= this.modulus()) {
+      throw new Error(`Value 0x${this.asBigInt.toString(16)} is greater or equal to field modulus.`);
+    }
   }
 
   protected abstract modulus(): bigint;
 
   /**
-   * We return a copy of the Buffer to ensure this remains immutable.
+   * Converts the bigint to a Buffer. With a sink, streams the 32 big-endian bytes straight in (no allocation)
+   * and returns undefined; without one, returns a freshly allocated buffer.
    */
-  toBuffer(): Buffer {
-    if (!this.asBuffer) {
-      this.asBuffer = toBufferBE(this.asBigInt!, 32);
+  toBuffer(): Buffer;
+  toBuffer(sink: BufferSink): void;
+  toBuffer(sink?: BufferSink): Buffer | void {
+    if (!sink) {
+      return toBufferBE(this.asBigInt, BaseField.SIZE_IN_BYTES);
     }
-    return Buffer.from(this.asBuffer);
+    sink.writeField(this.asBigInt);
   }
 
   toString(): `0x${string}` {
-    return `0x${this.toBuffer().toString('hex')}`;
+    return `0x${this.asBigInt.toString(16).padStart(64, '0')}`;
   }
 
   toBigInt(): bigint {
-    if (this.asBigInt === undefined) {
-      this.asBigInt = toBigIntBE(this.asBuffer!);
-      if (this.asBigInt >= this.modulus()) {
-        throw new Error(`Value 0x${this.asBigInt.toString(16)} is greater or equal to field modulus.`);
-      }
-    }
     return this.asBigInt;
   }
 
   toBool(): boolean {
-    return Boolean(this.toBigInt());
+    return this.asBigInt !== 0n;
   }
 
   /**
@@ -106,11 +94,10 @@ abstract class BaseField {
    * Throws if the underlying value is greater than MAX_SAFE_INTEGER.
    */
   toNumber(): number {
-    const value = this.toBigInt();
-    if (value > Number.MAX_SAFE_INTEGER) {
-      throw new Error(`Value ${value.toString(16)} greater than than max safe integer`);
+    if (this.asBigInt > Number.MAX_SAFE_INTEGER) {
+      throw new Error(`Value ${this.asBigInt.toString(16)} greater than than max safe integer`);
     }
-    return Number(value);
+    return Number(this.asBigInt);
   }
 
   /**
@@ -118,8 +105,7 @@ abstract class BaseField {
    * May cause loss of precision if the underlying value is greater than MAX_SAFE_INTEGER.
    */
   toNumberUnsafe(): number {
-    const value = this.toBigInt();
-    return Number(value);
+    return Number(this.asBigInt);
   }
 
   toShortString(): string {
@@ -128,21 +114,28 @@ abstract class BaseField {
   }
 
   equals(rhs: BaseField): boolean {
-    return this.toBuffer().equals(rhs.toBuffer());
+    return this.asBigInt === rhs.asBigInt;
   }
 
   lt(rhs: BaseField): boolean {
-    return this.toBigInt() < rhs.toBigInt();
+    return this.asBigInt < rhs.asBigInt;
   }
 
   cmp(rhs: BaseField): -1 | 0 | 1 {
-    const lhsBigInt = this.toBigInt();
-    const rhsBigInt = rhs.toBigInt();
-    return lhsBigInt === rhsBigInt ? 0 : lhsBigInt < rhsBigInt ? -1 : 1;
+    return BaseField.cmpAsBigInt(this.asBigInt, rhs.asBigInt);
+  }
+
+  static cmp(lhs: BaseField, rhs: BaseField): -1 | 0 | 1 {
+    return lhs.cmp(rhs);
+  }
+
+  // Actual bigint comparison. Arguments must have been validated previously.
+  static cmpAsBigInt(lhs: bigint, rhs: bigint): -1 | 0 | 1 {
+    return lhs === rhs ? 0 : lhs < rhs ? -1 : 1;
   }
 
   isZero(): boolean {
-    return this.toBuffer().equals(ZERO_BUFFER);
+    return this.asBigInt === 0n;
   }
 
   isEmpty(): boolean {
@@ -195,13 +188,28 @@ function fromHexString<T extends BaseField>(buf: string, f: DerivedField<T>) {
 
   const buffer = Buffer.from(checked.length % 2 === 1 ? '0' + checked : checked, 'hex');
 
-  return new f(buffer);
+  return new f(toBigIntBE(buffer));
 }
 
-/** Branding to ensure fields are not interchangeable types. */
-export interface Fr {
-  /** Brand. */
-  _branding: 'Fr';
+/**
+ * Abstract unbranded base class for BN254 scalar field elements.
+ * Extend this instead of Fr when defining a branded subtype (e.g. BlockHash)
+ * to avoid inheriting Fr's `_branding`.
+ */
+export abstract class BaseFr extends BaseField {
+  static MODULUS = 0x30644e72e131a029b85045b68181585d2833e84879b9709143e1f593f0000001n;
+
+  constructor(value: number | bigint | boolean | BaseField | Buffer) {
+    super(value);
+  }
+
+  protected modulus() {
+    return BaseFr.MODULUS;
+  }
+
+  toJSON() {
+    return this.toString();
+  }
 }
 
 /**
@@ -209,10 +217,12 @@ export interface Fr {
  * @dev This class is used to represent elements of BN254 scalar field or elements in the base field of Grumpkin.
  * (Grumpkin's scalar field corresponds to BN254's base field and vice versa.)
  */
-export class Fr extends BaseField {
+export class Fr extends BaseFr {
+  /** Branding for nominal typing. */
+  declare private readonly _branding: 'Fr';
+  static override MODULUS = 0x30644e72e131a029b85045b68181585d2833e84879b9709143e1f593f0000001n;
   static ZERO = new Fr(0n);
   static ONE = new Fr(1n);
-  static MODULUS = 0x30644e72e131a029b85045b68181585d2833e84879b9709143e1f593f0000001n;
   static MAX_FIELD_VALUE = new Fr(this.MODULUS - 1n);
 
   constructor(value: number | bigint | boolean | Fr | Buffer) {
@@ -223,10 +233,6 @@ export class Fr extends BaseField {
     return `Fr<${this.toString()}>`;
   }
 
-  protected modulus() {
-    return Fr.MODULUS;
-  }
-
   static random() {
     return random(Fr);
   }
@@ -331,32 +337,35 @@ export class Fr extends BaseField {
     return Fr.fromBuffer(Buffer.from(response.value));
   }
 
-  toJSON() {
-    return this.toString();
+  /**
+   * Creates an Fr instance from a plain object without Zod validation.
+   * This method is optimized for performance and skips validation, making it suitable
+   * for deserializing trusted data (e.g., from C++ via MessagePack).
+   * Handles buffers, strings, numbers, bigints, or existing instances.
+   * @param obj - Plain object, buffer, string, number, bigint, boolean, or Fr instance
+   * @returns An Fr instance
+   */
+  static fromPlainObject(obj: any): Fr {
+    if (obj instanceof Fr) {
+      return obj;
+    }
+    return new Fr(obj);
   }
 
   static get schema() {
+    // Serialization from hex string.
     return hexSchemaFor(Fr);
   }
 }
 
-// For deserializing JSON.
-TypeRegistry.register('Fr', Fr);
-
-/**
- * Branding to ensure fields are not interchangeable types.
- */
-export interface Fq {
-  /** Brand. */
-  _branding: 'Fq';
-}
-
 /**
  * Fq field class.
  * @dev This class is used to represent elements of BN254 base field or elements in the scalar field of Grumpkin.
  * (Grumpkin's scalar field corresponds to BN254's base field and vice versa.)
  */
 export class Fq extends BaseField {
+  /** Branding for nominal typing. */
+  declare private readonly _branding: 'Fq';
   static ZERO = new Fq(0n);
   static MODULUS = 0x30644e72e131a029b85045b68181585d97816a916871ca8d3c208c16d87cfd47n;
   private static HIGH_SHIFT = BigInt((BaseField.SIZE_IN_BYTES / 2) * 8);
@@ -465,9 +474,6 @@ export class Fq extends BaseField {
   }
 }
 
-// For deserializing JSON.
-TypeRegistry.register('Fq', Fq);
-
 // Beware: Performance bottleneck below
 
 /**
@@ -495,14 +501,6 @@ function extendedEuclidean(a: bigint, modulus: bigint): [bigint, bigint, bigint]
   }
 }
 
-/**
- * GrumpkinScalar is an Fq.
- * @remarks Called GrumpkinScalar because it is used to represent elements in Grumpkin's scalar field as defined in
- *          the Aztec Protocol Specs.
- */
-export type GrumpkinScalar = Fq;
-export const GrumpkinScalar = Fq;
-
 /** Wraps a function that returns a buffer so that all results are reduced into a field of the given type. */
 export function reduceFn<TInput, TField extends BaseField>(fn: (input: TInput) => Buffer, field: DerivedField<TField>) {
   return (input: TInput) => fromBufferReduce(fn(input), field);

package/src/curves/bn254/index.ts

@@ -0,0 +1,2 @@
+export * from './field.js';
+export * from './point.js';