@aztec/foundation 0.0.1-commit.d3ec352c → 0.0.1-commit.d58ff9d0

package/src/crypto/bn254/index.ts

@@ -1,173 +1,64 @@
-import {
-  BN254_G1_GENERATOR,
-  BN254_G2_GENERATOR,
-  BarretenbergSync,
-  type Bn254G1Point as BbApiBn254G1Point,
-  type Bn254G2Point as BbApiBn254G2Point,
-} from '@aztec/bb.js';
-
-import { Fq, Fr } from '../../fields/fields.js';
+import { Fr } from '../../curves/bn254/field.js';
+import { Bn254G1Point, Bn254G2Point } from '../../curves/bn254/point.js';
 
 /**
- * BN254 G1 point using foundation field classes.
- * Represents a point on the BN254 elliptic curve in affine coordinates.
+ * BN254 utility functions for point operations.
+ * Provides compression, decompression, and public key generation for the BN254 curve.
+ * Uses the bb.js Barretenberg backend for point operations.
  */
-export class Bn254G1Point {
-  constructor(
-    public readonly x: Fq,
-    public readonly y: Fq,
-  ) {}
-
-  private toBbApiPoint(): BbApiBn254G1Point {
-    return {
-      x: this.x.toBuffer(),
-      y: this.y.toBuffer(),
-    };
-  }
-
-  private static fromBbApiPoint(point: BbApiBn254G1Point): Bn254G1Point {
-    return new Bn254G1Point(Fq.fromBuffer(Buffer.from(point.x)), Fq.fromBuffer(Buffer.from(point.y)));
-  }
-
-  async isOnCurve(): Promise<boolean> {
-    await BarretenbergSync.initSingleton();
-    const api = BarretenbergSync.getSingleton();
-
-    const apiPoint = this.toBbApiPoint();
-    const response = api.bn254G1IsOnCurve({ point: apiPoint });
-    return response.isOnCurve;
-  }
-
-  /**
-   * Get the generator point for BN254 G1, or perform scalar multiplication.
-   * When called without arguments, returns the base generator point.
-   * When called with a scalar, returns scalar * generator (useful for public key derivation).
-   */
-  static async generator(scalar?: Fr): Promise<Bn254G1Point> {
-    if (!scalar) {
-      return new Bn254G1Point(
-        Fq.fromBuffer(Buffer.from(BN254_G1_GENERATOR.x)),
-        Fq.fromBuffer(Buffer.from(BN254_G1_GENERATOR.y)),
-      );
-    }
-
-    await BarretenbergSync.initSingleton();
-    const api = BarretenbergSync.getSingleton();
-
-    const response = api.bn254G1Mul({
-      point: BN254_G1_GENERATOR,
-      scalar: scalar.toBuffer(),
-    });
-
-    return Bn254G1Point.fromBbApiPoint(response.point);
-  }
-
-  /**
-   * Decompress a BN254 G1 point from compressed form (32 bytes).
-   * The compressed format encodes the x-coordinate and the sign bit of the y-coordinate
-   * in the most significant bit.
-   */
-  static async fromCompressed(compressed: Buffer): Promise<Bn254G1Point> {
-    if (compressed.length !== 32) {
-      throw new Error('Invalid compressed point length');
-    }
-    await BarretenbergSync.initSingleton();
-    const api = BarretenbergSync.getSingleton();
-
-    const response = api.bn254G1FromCompressed({
-      compressed: new Uint8Array(compressed),
-    });
-
-    return Bn254G1Point.fromBbApiPoint(response.point);
-  }
 
-  /**
-   * Compress this BN254 G1 point to 32 bytes.
-   * The compressed format encodes the x-coordinate and the sign bit of the y-coordinate
-   * in the most significant bit (bit 255).
-   */
-  compress(): Buffer {
-    const xBytes = this.x.toBuffer();
-    // Get the least significant bit of y to determine the sign
-    const yLsb = this.y.toBigInt() & 1n;
-    // If y is odd, set the most significant bit (bit 255) of the output
-    if (yLsb === 1n) {
-      xBytes[0] |= 0x80;
-    }
-    return xBytes;
-  }
+/**
+ * Generate a compressed BN254 G1 public key from a private key.
+ *
+ * @param privateKeyHex - Private key as 0x-prefixed hex string
+ * @returns Compressed G1 point (32 bytes with sign bit in MSB)
+ */
+export async function computeBn254G1PublicKeyCompressed(privateKeyHex: string): Promise<string> {
+  const sk = BigInt(privateKeyHex);
+  const skReduced = sk % Fr.MODULUS;
 
-  equals(other: Bn254G1Point): boolean {
-    return this.x.equals(other.x) && this.y.equals(other.y);
-  }
+  // Generate G1 point on BN254 curve using bb.js
+  const scalar = Fr.fromString(skReduced.toString());
+  const pk1 = await Bn254G1Point.generator(scalar);
 
-  toString(): string {
-    return `Bn254G1Point(x: ${this.x.toString()}, y: ${this.y.toString()})`;
-  }
+  // Compress the point using the primitive method
+  return '0x' + pk1.compress().toString('hex');
 }
 
 /**
- * BN254 G2 point using foundation field classes.
- * Represents a point on the BN254 G2 curve (twist curve) in affine coordinates.
- * G2 points use extension field coordinates (Fq2).
+ * Generate uncompressed BN254 G1 public key from a private key.
+ *
+ * @param privateKeyHex - Private key as 0x-prefixed hex string
+ * @returns G1 point in affine coordinates
  */
-export class Bn254G2Point {
-  constructor(
-    public readonly x: [Fq, Fq],
-    public readonly y: [Fq, Fq],
-  ) {}
-
-  private toBbApiPoint(): BbApiBn254G2Point {
-    return {
-      x: [this.x[0].toBuffer(), this.x[1].toBuffer()],
-      y: [this.y[0].toBuffer(), this.y[1].toBuffer()],
-    };
-  }
-
-  private static fromBbApiPoint(point: BbApiBn254G2Point): Bn254G2Point {
-    return new Bn254G2Point(
-      [Fq.fromBuffer(Buffer.from(point.x[0])), Fq.fromBuffer(Buffer.from(point.x[1]))],
-      [Fq.fromBuffer(Buffer.from(point.y[0])), Fq.fromBuffer(Buffer.from(point.y[1]))],
-    );
-  }
-
-  /**
-   * Get the generator point for BN254 G2, or perform scalar multiplication.
-   * When called without arguments, returns the base generator point.
-   * When called with a scalar, returns scalar * generator.
-   */
-  static async generator(scalar?: Fr): Promise<Bn254G2Point> {
-    if (!scalar) {
-      return new Bn254G2Point(
-        [Fq.fromBuffer(Buffer.from(BN254_G2_GENERATOR.x[0])), Fq.fromBuffer(Buffer.from(BN254_G2_GENERATOR.x[1]))],
-        [Fq.fromBuffer(Buffer.from(BN254_G2_GENERATOR.y[0])), Fq.fromBuffer(Buffer.from(BN254_G2_GENERATOR.y[1]))],
-      );
-    }
-
-    await BarretenbergSync.initSingleton();
-    const api = BarretenbergSync.getSingleton();
+export async function computeBn254G1PublicKey(privateKeyHex: string): Promise<{ x: bigint; y: bigint }> {
+  const sk = BigInt(privateKeyHex);
+  const skReduced = sk % Fr.MODULUS;
 
-    const response = api.bn254G2Mul({
-      point: BN254_G2_GENERATOR as BbApiBn254G2Point,
-      scalar: scalar.toBuffer(),
-    });
+  const scalar = Fr.fromString(skReduced.toString());
+  const pk1 = await Bn254G1Point.generator(scalar);
 
-    return Bn254G2Point.fromBbApiPoint(response.point);
-  }
-
-  equals(other: Bn254G2Point): boolean {
-    return (
-      this.x[0].equals(other.x[0]) &&
-      this.x[1].equals(other.x[1]) &&
-      this.y[0].equals(other.y[0]) &&
-      this.y[1].equals(other.y[1])
-    );
-  }
-
-  toString(): string {
-    return `Bn254G2Point(x: (${this.x[0].toString()}, ${this.x[1].toString()}), y: (${this.y[0].toString()}, ${this.y[1].toString()}))`;
-  }
+  return { x: pk1.x.toBigInt(), y: pk1.y.toBigInt() };
 }
 
-// Re-export BN254 point utility functions
-export { computeBn254G1PublicKeyCompressed, computeBn254G1PublicKey, computeBn254G2PublicKey } from './bn254_utils.js';
+/**
+ * Generate BN254 G2 public key from a private key.
+ *
+ * @param privateKeyHex - Private key as 0x-prefixed hex string
+ * @returns G2 point in affine coordinates
+ */
+export async function computeBn254G2PublicKey(privateKeyHex: string): Promise<{
+  x: { c0: bigint; c1: bigint };
+  y: { c0: bigint; c1: bigint };
+}> {
+  const sk = BigInt(privateKeyHex);
+  const skReduced = sk % Fr.MODULUS;
+
+  const scalar = Fr.fromString(skReduced.toString());
+  const pk2 = await Bn254G2Point.generator(scalar);
+
+  return {
+    x: { c0: pk2.x[0].toBigInt(), c1: pk2.x[1].toBigInt() },
+    y: { c0: pk2.y[0].toBigInt(), c1: pk2.y[1].toBigInt() },
+  };
+}

package/src/crypto/ecdsa/signature.ts

@@ -1,6 +1,6 @@
 import { toBufferBE } from '@aztec/foundation/bigint-buffer';
-import { randomBytes } from '@aztec/foundation/crypto';
-import { Fr } from '@aztec/foundation/fields';
+import { randomBytes } from '@aztec/foundation/crypto/random';
+import { Fr } from '@aztec/foundation/curves/bn254';
 import { mapTuple } from '@aztec/foundation/serialize';
 
 import type { Signature } from '../signature/index.js';

package/src/crypto/grumpkin/index.ts

@@ -1,5 +1,7 @@
 import { BarretenbergSync } from '@aztec/bb.js';
-import { Fr, type GrumpkinScalar, Point } from '@aztec/foundation/fields';
+import { Fr } from '@aztec/foundation/curves/bn254';
+import type { GrumpkinScalar } from '@aztec/foundation/curves/grumpkin';
+import { Point } from '@aztec/foundation/curves/grumpkin';
 
 /**
  * Grumpkin elliptic curve operations.

package/src/crypto/keys/index.ts

@@ -1,10 +1,26 @@
-import { BarretenbergSync } from '@aztec/bb.js';
+import { BarretenbergSync, CircuitKind } from '@aztec/bb.js';
 
-import { Fr } from '../../fields/fields.js';
+import { Fr } from '../../curves/bn254/field.js';
 
-export async function vkAsFieldsMegaHonk(input: Buffer): Promise<Fr[]> {
+export async function vkAsFields(input: Buffer, kind: CircuitKind): Promise<Fr[]> {
   await BarretenbergSync.initSingleton();
   const api = BarretenbergSync.getSingleton();
-  const response = api.megaVkAsFields({ verificationKey: input });
-  return response.fields.map(field => Fr.fromBuffer(Buffer.from(field)));
+  switch (kind) {
+    case CircuitKind.App: {
+      const response = api.megaAppVkAsFields({ verificationKey: input });
+      return response.fields.map(field => Fr.fromBuffer(Buffer.from(field)));
+    }
+    case CircuitKind.Kernel: {
+      const response = api.megaKernelVkAsFields({ verificationKey: input });
+      return response.fields.map(field => Fr.fromBuffer(Buffer.from(field)));
+    }
+    case CircuitKind.HidingKernel: {
+      const response = api.megaZKVkAsFields({ verificationKey: input });
+      return response.fields.map(field => Fr.fromBuffer(Buffer.from(field)));
+    }
+    default: {
+      const _exhaustive: never = kind;
+      throw new Error(`vkAsFields: unhandled CircuitKind ${_exhaustive}`);
+    }
+  }
 }

package/src/crypto/pedersen/pedersen.wasm.ts

@@ -1,6 +1,6 @@
 import { BarretenbergSync } from '@aztec/bb.js';
 
-import { Fr } from '../../fields/fields.js';
+import { Fr } from '../../curves/bn254/field.js';
 import { type Fieldable, serializeToFields } from '../../serialize/serialize.js';
 
 /**

package/src/crypto/poseidon/index.ts

@@ -1,21 +1,35 @@
-import { BarretenbergSync } from '@aztec/bb.js';
+import { Barretenberg, BarretenbergSync } from '@aztec/bb.js';
 
-import { Fr } from '../../fields/fields.js';
+import { Fr } from '../../curves/bn254/field.js';
 import { type Fieldable, serializeToFields } from '../../serialize/serialize.js';
 
+const IS_BROWSER = typeof self !== 'undefined';
+
+async function poseidon2HashFields(inputFields: Fr[]): Promise<Fr> {
+  if (IS_BROWSER) {
+    await BarretenbergSync.initSingleton();
+    const api = BarretenbergSync.getSingleton();
+    const response = api.poseidon2Hash({
+      inputs: inputFields.map(i => i.toBuffer()),
+    });
+    return Fr.fromBuffer(Buffer.from(response.hash));
+  } else {
+    await Barretenberg.initSingleton();
+    const api = Barretenberg.getSingleton();
+    const response = await api.poseidon2Hash({
+      inputs: inputFields.map(i => i.toBuffer()),
+    });
+    return Fr.fromBuffer(Buffer.from(response.hash));
+  }
+}
+
 /**
  * Create a poseidon hash (field) from an array of input fields.
  * @param input - The input fields to hash.
  * @returns The poseidon hash.
  */
-export async function poseidon2Hash(input: Fieldable[]): Promise<Fr> {
-  const inputFields = serializeToFields(input);
-  await BarretenbergSync.initSingleton();
-  const api = BarretenbergSync.getSingleton();
-  const response = api.poseidon2Hash({
-    inputs: inputFields.map(i => i.toBuffer()),
-  });
-  return Fr.fromBuffer(Buffer.from(response.hash));
+export function poseidon2Hash(input: Fieldable[]): Promise<Fr> {
+  return poseidon2HashFields(serializeToFields(input));
 }
 
 /**
@@ -24,25 +38,10 @@ export async function poseidon2Hash(input: Fieldable[]): Promise<Fr> {
  * @param separator - The domain separator.
  * @returns The poseidon hash.
  */
-export async function poseidon2HashWithSeparator(input: Fieldable[], separator: number): Promise<Fr> {
+export function poseidon2HashWithSeparator(input: Fieldable[], separator: number): Promise<Fr> {
   const inputFields = serializeToFields(input);
   inputFields.unshift(new Fr(separator));
-  await BarretenbergSync.initSingleton();
-  const api = BarretenbergSync.getSingleton();
-  const response = api.poseidon2Hash({
-    inputs: inputFields.map(i => i.toBuffer()),
-  });
-  return Fr.fromBuffer(Buffer.from(response.hash));
-}
-
-export async function poseidon2HashAccumulate(input: Fieldable[]): Promise<Fr> {
-  const inputFields = serializeToFields(input);
-  await BarretenbergSync.initSingleton();
-  const api = BarretenbergSync.getSingleton();
-  const response = api.poseidon2HashAccumulate({
-    inputs: inputFields.map(i => i.toBuffer()),
-  });
-  return Fr.fromBuffer(Buffer.from(response.hash));
+  return poseidon2HashFields(inputFields);
 }
 
 /**
@@ -52,19 +51,24 @@ export async function poseidon2HashAccumulate(input: Fieldable[]): Promise<Fr> {
  */
 export async function poseidon2Permutation(input: Fieldable[]): Promise<Fr[]> {
   const inputFields = serializeToFields(input);
-  // We'd like this assertion but it's not possible to use it in the browser.
-  // assert(input.length === 4, 'Input state must be of size 4');
-  await BarretenbergSync.initSingleton();
-  const api = BarretenbergSync.getSingleton();
-  const response = api.poseidon2Permutation({
-    inputs: inputFields.map(i => i.toBuffer()),
-  });
-  // We'd like this assertion but it's not possible to use it in the browser.
-  // assert(response.outputs.length === 4, 'Output state must be of size 4');
-  return response.outputs.map(o => Fr.fromBuffer(Buffer.from(o)));
+  if (IS_BROWSER) {
+    await BarretenbergSync.initSingleton();
+    const api = BarretenbergSync.getSingleton();
+    const response = api.poseidon2Permutation({
+      inputs: inputFields.map(i => i.toBuffer()),
+    });
+    return response.outputs.map(o => Fr.fromBuffer(Buffer.from(o)));
+  } else {
+    await Barretenberg.initSingleton();
+    const api = Barretenberg.getSingleton();
+    const response = await api.poseidon2Permutation({
+      inputs: inputFields.map(i => i.toBuffer()),
+    });
+    return response.outputs.map(o => Fr.fromBuffer(Buffer.from(o)));
+  }
 }
 
-export async function poseidon2HashBytes(input: Buffer): Promise<Fr> {
+export function poseidon2HashBytes(input: Buffer): Promise<Fr> {
   const inputFields = [];
   for (let i = 0; i < input.length; i += 31) {
     const fieldBytes = Buffer.alloc(32, 0);
@@ -75,11 +79,5 @@ export async function poseidon2HashBytes(input: Buffer): Promise<Fr> {
     inputFields.push(Fr.fromBuffer(fieldBytes));
   }
 
-  await BarretenbergSync.initSingleton();
-  const api = BarretenbergSync.getSingleton();
-  const response = api.poseidon2Hash({
-    inputs: inputFields.map(i => i.toBuffer()),
-  });
-
-  return Fr.fromBuffer(Buffer.from(response.hash));
+  return poseidon2HashFields(inputFields);
 }

package/src/crypto/random/randomness_singleton.ts

@@ -1,4 +1,4 @@
-import { createLogger } from '../../log/pino-logger.js';
+import { type Logger, type LoggerBindings, createLogger } from '../../log/pino-logger.js';
 
 /**
  * A number generator which is used as a source of randomness in the system. If the SEED env variable is set, the
@@ -12,11 +12,13 @@ export class RandomnessSingleton {
   private static instance: RandomnessSingleton;
 
   private counter = 0;
+  private log: Logger;
 
   private constructor(
     private readonly seed?: number,
-    private readonly log = createLogger('foundation:randomness_singleton'),
+    bindings?: LoggerBindings,
   ) {
+    this.log = createLogger('foundation:randomness_singleton', bindings);
     if (seed !== undefined) {
       this.log.debug(`Using pseudo-randomness with seed: ${seed}`);
       this.counter = seed;
@@ -25,10 +27,10 @@ export class RandomnessSingleton {
     }
   }
 
-  public static getInstance(): RandomnessSingleton {
+  public static getInstance(bindings?: LoggerBindings): RandomnessSingleton {
     if (!RandomnessSingleton.instance) {
       const seed = process.env.SEED ? Number(process.env.SEED) : undefined;
-      RandomnessSingleton.instance = new RandomnessSingleton(seed);
+      RandomnessSingleton.instance = new RandomnessSingleton(seed, bindings);
     }
 
     return RandomnessSingleton.instance;

package/src/crypto/schnorr/index.ts

@@ -1,5 +1,7 @@
 import { BarretenbergSync } from '@aztec/bb.js';
-import { type GrumpkinScalar, Point } from '@aztec/foundation/fields';
+import type { Fr } from '@aztec/foundation/curves/bn254';
+import type { GrumpkinScalar } from '@aztec/foundation/curves/grumpkin';
+import { Point } from '@aztec/foundation/curves/grumpkin';
 
 import { SchnorrSignature } from './signature.js';
 
@@ -22,33 +24,33 @@ export class Schnorr {
   }
 
   /**
-   * Constructs a Schnorr signature given a msg and a private key.
-   * @param msg - Message over which the signature is constructed.
+   * Constructs a Schnorr signature over a 32-byte message field element.
+   * @param msg - The message hash, as a grumpkin base field element.
    * @param privateKey - The private key of the signer.
    * @returns A Schnorr signature of the form (s, e).
    */
-  public async constructSignature(msg: Uint8Array, privateKey: GrumpkinScalar) {
+  public async constructSignature(msg: Fr, privateKey: GrumpkinScalar) {
     await BarretenbergSync.initSingleton();
     const api = BarretenbergSync.getSingleton();
     const response = api.schnorrConstructSignature({
-      message: msg,
+      messageField: msg.toBuffer(),
       privateKey: privateKey.toBuffer(),
     });
     return new SchnorrSignature(Buffer.from([...response.s, ...response.e]));
   }
 
   /**
-   * Verifies a Schnorr signature given a Grumpkin public key.
-   * @param msg - Message over which the signature was constructed.
+   * Verifies a Schnorr signature against a Grumpkin public key.
+   * @param msg - The message hash, as a grumpkin base field element.
    * @param pubKey - The Grumpkin public key of the signer.
    * @param sig - The Schnorr signature.
    * @returns True or false.
    */
-  public async verifySignature(msg: Uint8Array, pubKey: Point, sig: SchnorrSignature) {
+  public async verifySignature(msg: Fr, pubKey: Point, sig: SchnorrSignature) {
     await BarretenbergSync.initSingleton();
     const api = BarretenbergSync.getSingleton();
     const response = api.schnorrVerifySignature({
-      message: msg,
+      messageField: msg.toBuffer(),
       publicKey: { x: pubKey.x.toBuffer(), y: pubKey.y.toBuffer() },
       s: sig.s,
       e: sig.e,

package/src/crypto/schnorr/signature.ts

@@ -1,6 +1,5 @@
-import { randomBytes } from '@aztec/foundation/crypto';
-import { Fr } from '@aztec/foundation/fields';
-import { BufferReader, mapTuple } from '@aztec/foundation/serialize';
+import { Fr } from '@aztec/foundation/curves/bn254';
+import { mapTuple } from '@aztec/foundation/serialize';
 
 import type { Signature } from '../signature/index.js';
 
@@ -14,46 +13,12 @@ export class SchnorrSignature implements Signature {
    */
   public static SIZE = 64;
 
-  /**
-   * An empty signature.
-   */
-  public static EMPTY = new SchnorrSignature(Buffer.alloc(64));
-
   constructor(private buffer: Buffer) {
     if (buffer.length !== SchnorrSignature.SIZE) {
       throw new Error(`Invalid signature buffer of length ${buffer.length}.`);
     }
   }
 
-  /**
-   * Determines if the provided signature is valid or not.
-   * @param signature - The data to be checked.
-   * @returns Boolean indicating if the provided data is a valid schnorr signature.
-   */
-  public static isSignature(signature: string) {
-    return /^(0x)?[0-9a-f]{128}$/i.test(signature);
-  }
-
-  /**
-   * Constructs a SchnorrSignature from the provided string.
-   * @param signature - The string to be converted to a schnorr signature.
-   * @returns The constructed schnorr signature.
-   */
-  public static fromString(signature: string) {
-    if (!SchnorrSignature.isSignature(signature)) {
-      throw new Error(`Invalid signature string: ${signature}`);
-    }
-    return new SchnorrSignature(Buffer.from(signature.replace(/^0x/i, ''), 'hex'));
-  }
-
-  /**
-   * Generates a random schnorr signature.
-   * @returns The randomly constructed signature.
-   */
-  public static random() {
-    return new SchnorrSignature(randomBytes(64));
-  }
-
   /**
    * Returns the 's' component of the signature.
    * @returns A buffer containing the signature's 's' component.
@@ -78,16 +43,6 @@ export class SchnorrSignature implements Signature {
     return this.buffer;
   }
 
-  /**
-   * Deserializes from a buffer.
-   * @param buffer - The buffer representation of the object.
-   * @returns The new object.
-   */
-  static fromBuffer(buffer: Buffer | BufferReader): SchnorrSignature {
-    const reader = BufferReader.asReader(buffer);
-    return new SchnorrSignature(reader.readBytes(SchnorrSignature.SIZE));
-  }
-
   /**
    * Returns the full signature as a hex string.
    * @returns A string containing the signature in hex format.
@@ -113,4 +68,20 @@ export class SchnorrSignature implements Signature {
 
     return mapTuple([buf1, buf2, buf3], Fr.fromBuffer);
   }
+
+  /**
+   * Splits the signature into the four 128-bit limbs that Noir's `EmbeddedCurveScalar` consumes:
+   * `[s.lo, s.hi, e.lo, e.hi]`, where each component scalar is encoded as `lo + hi * 2^128`.
+   *
+   * Each 32-byte big-endian component is sliced into its top 16 bytes (`hi`) and bottom 16 bytes
+   * (`lo`); each half is zero-padded into a 32-byte buffer and decoded as `Fr` (big-endian).
+   */
+  toLimbFields(): [Fr, Fr, Fr, Fr] {
+    const limb = (start: number) => {
+      const buf = Buffer.alloc(32);
+      this.buffer.copy(buf, 16, start, start + 16);
+      return Fr.fromBuffer(buf);
+    };
+    return [limb(16), limb(0), limb(48), limb(32)];
+  }
 }

package/src/crypto/secp256k1-signer/utils.ts

@@ -210,3 +210,35 @@ export function recoverPublicKey(hash: Buffer32, signature: Signature, opts: Rec
   const publicKey = sig.recoverPublicKey(hash.buffer).toHex(false);
   return Buffer.from(publicKey, 'hex');
 }
+
+/** Arbitrary hash used for testing signature recoverability. */
+const PROBE_HASH = Buffer32.fromBuffer(keccak256(Buffer.from('signature-recoverability-probe')));
+
+/**
+ * Generates a random valid ECDSA signature that is recoverable to some address.
+ * Since Signature.random() produces real signatures via secp256k1 signing, the result is always
+ * recoverable, but we verify defensively by checking tryRecoverAddress.
+ */
+export function generateRecoverableSignature(): Signature {
+  for (let i = 0; i < 100; i++) {
+    const sig = Signature.random();
+    if (tryRecoverAddress(PROBE_HASH, sig) !== undefined) {
+      return sig;
+    }
+  }
+  throw new Secp256k1Error('Failed to generate a recoverable signature after 100 attempts');
+}
+
+/**
+ * Generates a random signature where ECDSA address recovery fails.
+ * Uses random r/s values (not from real signing) so that r is unlikely to be a valid secp256k1 x-coordinate.
+ */
+export function generateUnrecoverableSignature(): Signature {
+  for (let i = 0; i < 100; i++) {
+    const sig = new Signature(Buffer32.random(), Buffer32.random(), 27);
+    if (tryRecoverAddress(PROBE_HASH, sig) === undefined) {
+      return sig;
+    }
+  }
+  throw new Secp256k1Error('Failed to generate an unrecoverable signature after 100 attempts');
+}

package/src/crypto/sha256/index.ts

@@ -1,7 +1,7 @@
 /* eslint-disable camelcase */
 import { default as hash } from 'hash.js';
 
-import { Fr } from '../../fields/fields.js';
+import { Fr } from '../../curves/bn254/field.js';
 import { truncateAndPad } from '../../serialize/free_funcs.js';
 import { type Bufferable, serializeToBuffer } from '../../serialize/serialize.js';
 import type { Hasher } from '../../trees/hasher.js';

package/src/crypto/sha512/index.ts

@@ -1,6 +1,6 @@
 import { default as hash } from 'hash.js';
 
-import { GrumpkinScalar } from '../../fields/fields.js';
+import { GrumpkinScalar } from '../../curves/grumpkin/index.js';
 import { type Bufferable, serializeToBuffer } from '../../serialize/serialize.js';
 
 export const sha512 = (data: Buffer) => Buffer.from(hash.sha512().update(data).digest());

package/src/crypto/signature/index.ts

@@ -1,4 +1,4 @@
-import type { Fr } from '@aztec/foundation/fields';
+import type { Fr } from '@aztec/foundation/curves/bn254';
 
 /**
  * Interface to represent a signature.

package/src/crypto/sync/pedersen/index.ts

@@ -1,6 +1,6 @@
 import { BarretenbergSync } from '@aztec/bb.js';
 
-import { Fr } from '../../../fields/fields.js';
+import { Fr } from '../../../curves/bn254/field.js';
 import { type Fieldable, serializeToFields } from '../../../serialize/serialize.js';
 
 /**