@coordination-network/issuer-set 0.0.1 → 0.1.0

package/README.md

@@ -44,7 +44,7 @@ const set = await ApprovedIssuerSet.fromContract({
 ### Publishing and retiring keys
 
 ```ts
-const leaf = set.publish(issuerKey) // curve-validated, unlike the constructor
+const leaf = set.publish(issuerKey) // must be in the prime-order subgroup, unlike the constructor
 set.publishMany(issuerKeys)
 set.retire(issuerKey) // tombstones the slot; leafCount never shrinks
 ```

package/dist/index.cjs

@@ -69,8 +69,24 @@ function toFieldElement(value) {
     return element;
 }
 /**
- * Coerces a pair to a Baby Jubjub public key of full order, rejecting a point
- * that is not on the curve or that lies in the small-order subgroup.
+ * Whether a point is a non-identity element of Baby Jubjub's prime-order
+ * subgroup: canonical coordinates, on the curve, and `subOrder` times it is the
+ * identity. Coordinates are checked because zk-kit reduces them mod the field.
+ *
+ * @param point The point as `[x, y]`.
+ */
+function inPrimeOrderSubgroup(point) {
+    if (point.some((c) => c < 0n || c >= SNARK_SCALAR_FIELD))
+        return false;
+    if (!babyJubjub.inCurve(point) || (point[0] === 0n && point[1] === 1n))
+        return false;
+    const [x, y] = babyJubjub.mulPointEscalar(point, babyJubjub.subOrder);
+    return x === 0n && y === 1n;
+}
+/**
+ * Coerces a pair to a Baby Jubjub public key of prime order, rejecting a point
+ * that is not on the curve, that lies in the small-order subgroup, or that
+ * mixes a prime-order part with a torsion part.
  *
  * The set would happily commit to any two field elements, so without the curve
  * check a caller could publish a commitment to a point that does not exist.
@@ -79,8 +95,12 @@ function toFieldElement(value) {
  * in EdDSA verification takes at most eight values whatever the message, so
  * anyone can solve `S·B = R + h·A` for a signature over a claim tree they chose;
  * at the identity it is immediate. Publishing such a key would hand every
- * stranger the member's issuing power. Mirrors the same rejection in
- * `ApprovedIssuerSet.sol`.
+ * stranger the member's issuing power. `ApprovedIssuerSet.sol` rejects the same
+ * low-order points.
+ *
+ * Under the circuit's cofactored EdDSA only the holder of `A`'s secret can sign
+ * under a mixed-order key `A + T`, so it would only let one secret occupy several
+ * leaves. The contract does not reject it; this function is stricter.
  *
  * @param publicKey The signing key as `[x, y]`.
  * @returns The key with both coordinates as bigints.
@@ -96,6 +116,9 @@ function toPublicKey(publicKey) {
     if (x === 0n && y === 1n) {
         throw new Error("ApprovedIssuerSet: the public key has low order");
     }
+    if (!inPrimeOrderSubgroup(point)) {
+        throw new Error("ApprovedIssuerSet: the public key is not in the prime-order subgroup");
+    }
     return point;
 }
 
@@ -215,7 +238,7 @@ class ApprovedIssuerSet {
     /**
      * Publishes a signing key, appended at the next free slot.
      * @returns The leaf commitment inserted.
-     * @throws if the key is off-curve, low-order, or already approved.
+     * @throws if the key is off-curve, not in the prime-order subgroup, or already approved.
      */
     publish(publicKey) {
         const leaf = issuerKeyLeaf(toPublicKey(publicKey));
@@ -248,7 +271,7 @@ class ApprovedIssuerSet {
     /**
      * Tombstones a key's slot to `0`, ending its ability to verify. The slot
      * stays allocated; a republished key gets a new one.
-     * @throws if the key is off-curve, low-order, or not currently approved.
+     * @throws if the key is off-curve, not in the prime-order subgroup, or not currently approved.
      */
     retire(publicKey) {
         const index = this.indexOf(toPublicKey(publicKey));
@@ -258,7 +281,7 @@ class ApprovedIssuerSet {
     }
     /**
      * Generates the membership witness the credential circuit consumes.
-     * @throws if the key is off-curve, low-order, or not currently approved.
+     * @throws if the key is off-curve, not in the prime-order subgroup, or not currently approved.
      */
     generateProof(publicKey) {
         const leaf = issuerKeyLeaf(toPublicKey(publicKey));
@@ -280,6 +303,7 @@ exports.COFACTOR = COFACTOR;
 exports.ISSUER_LEAF_DOMAIN = ISSUER_LEAF_DOMAIN;
 exports.ISSUER_SET_MAX_DEPTH = ISSUER_SET_MAX_DEPTH;
 exports.SNARK_SCALAR_FIELD = SNARK_SCALAR_FIELD;
+exports.inPrimeOrderSubgroup = inPrimeOrderSubgroup;
 exports.internalNode = internalNode;
 exports.issuerKeyLeaf = issuerKeyLeaf;
 exports.issuerLeaf = issuerLeaf;

package/dist/index.js

@@ -1,7 +1,7 @@
 import { LeanIMT } from '@zk-kit/lean-imt';
 import { poseidon2 } from 'poseidon-lite/poseidon2';
 import { poseidon3 } from 'poseidon-lite/poseidon3';
-import { inCurve, mulPointEscalar } from '@zk-kit/baby-jubjub';
+import { inCurve, mulPointEscalar, subOrder } from '@zk-kit/baby-jubjub';
 
 /**
  * The BN254 (alt_bn128) scalar field order. Every leaf and internal-node hash,
@@ -67,8 +67,24 @@ function toFieldElement(value) {
     return element;
 }
 /**
- * Coerces a pair to a Baby Jubjub public key of full order, rejecting a point
- * that is not on the curve or that lies in the small-order subgroup.
+ * Whether a point is a non-identity element of Baby Jubjub's prime-order
+ * subgroup: canonical coordinates, on the curve, and `subOrder` times it is the
+ * identity. Coordinates are checked because zk-kit reduces them mod the field.
+ *
+ * @param point The point as `[x, y]`.
+ */
+function inPrimeOrderSubgroup(point) {
+    if (point.some((c) => c < 0n || c >= SNARK_SCALAR_FIELD))
+        return false;
+    if (!inCurve(point) || (point[0] === 0n && point[1] === 1n))
+        return false;
+    const [x, y] = mulPointEscalar(point, subOrder);
+    return x === 0n && y === 1n;
+}
+/**
+ * Coerces a pair to a Baby Jubjub public key of prime order, rejecting a point
+ * that is not on the curve, that lies in the small-order subgroup, or that
+ * mixes a prime-order part with a torsion part.
  *
  * The set would happily commit to any two field elements, so without the curve
  * check a caller could publish a commitment to a point that does not exist.
@@ -77,8 +93,12 @@ function toFieldElement(value) {
  * in EdDSA verification takes at most eight values whatever the message, so
  * anyone can solve `S·B = R + h·A` for a signature over a claim tree they chose;
  * at the identity it is immediate. Publishing such a key would hand every
- * stranger the member's issuing power. Mirrors the same rejection in
- * `ApprovedIssuerSet.sol`.
+ * stranger the member's issuing power. `ApprovedIssuerSet.sol` rejects the same
+ * low-order points.
+ *
+ * Under the circuit's cofactored EdDSA only the holder of `A`'s secret can sign
+ * under a mixed-order key `A + T`, so it would only let one secret occupy several
+ * leaves. The contract does not reject it; this function is stricter.
  *
  * @param publicKey The signing key as `[x, y]`.
  * @returns The key with both coordinates as bigints.
@@ -94,6 +114,9 @@ function toPublicKey(publicKey) {
     if (x === 0n && y === 1n) {
         throw new Error("ApprovedIssuerSet: the public key has low order");
     }
+    if (!inPrimeOrderSubgroup(point)) {
+        throw new Error("ApprovedIssuerSet: the public key is not in the prime-order subgroup");
+    }
     return point;
 }
 
@@ -213,7 +236,7 @@ class ApprovedIssuerSet {
     /**
      * Publishes a signing key, appended at the next free slot.
      * @returns The leaf commitment inserted.
-     * @throws if the key is off-curve, low-order, or already approved.
+     * @throws if the key is off-curve, not in the prime-order subgroup, or already approved.
      */
     publish(publicKey) {
         const leaf = issuerKeyLeaf(toPublicKey(publicKey));
@@ -246,7 +269,7 @@ class ApprovedIssuerSet {
     /**
      * Tombstones a key's slot to `0`, ending its ability to verify. The slot
      * stays allocated; a republished key gets a new one.
-     * @throws if the key is off-curve, low-order, or not currently approved.
+     * @throws if the key is off-curve, not in the prime-order subgroup, or not currently approved.
      */
     retire(publicKey) {
         const index = this.indexOf(toPublicKey(publicKey));
@@ -256,7 +279,7 @@ class ApprovedIssuerSet {
     }
     /**
      * Generates the membership witness the credential circuit consumes.
-     * @throws if the key is off-curve, low-order, or not currently approved.
+     * @throws if the key is off-curve, not in the prime-order subgroup, or not currently approved.
      */
     generateProof(publicKey) {
         const leaf = issuerKeyLeaf(toPublicKey(publicKey));
@@ -273,4 +296,4 @@ class ApprovedIssuerSet {
     }
 }
 
-export { ApprovedIssuerSet, COFACTOR, ISSUER_LEAF_DOMAIN, ISSUER_SET_MAX_DEPTH, SNARK_SCALAR_FIELD, internalNode, issuerKeyLeaf, issuerLeaf, toFieldElement, toPublicKey };
+export { ApprovedIssuerSet, COFACTOR, ISSUER_LEAF_DOMAIN, ISSUER_SET_MAX_DEPTH, SNARK_SCALAR_FIELD, inPrimeOrderSubgroup, internalNode, issuerKeyLeaf, issuerLeaf, toFieldElement, toPublicKey };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coordination-network/issuer-set",
-  "version": "0.0.1",
+  "version": "0.1.0",
   "description": "Approved-issuer set in TypeScript: publish network members' credential signing keys into the LeanIMT accumulator (dynamic depth, capacity 2^20) spec 03 defines, and generate the membership proofs a credential circuit consumes, as the set itself or as a mirror of one held on chain.",
   "license": "MIT",
   "repository": {

package/src/approved-issuer-set.ts

@@ -143,7 +143,7 @@ export class ApprovedIssuerSet implements IssuerSet {
     /**
      * Publishes a signing key, appended at the next free slot.
      * @returns The leaf commitment inserted.
-     * @throws if the key is off-curve, low-order, or already approved.
+     * @throws if the key is off-curve, not in the prime-order subgroup, or already approved.
      */
     publish(publicKey: IssuerPublicKey): bigint {
         const leaf = issuerKeyLeaf(toPublicKey(publicKey))
@@ -186,7 +186,7 @@ export class ApprovedIssuerSet implements IssuerSet {
     /**
      * Tombstones a key's slot to `0`, ending its ability to verify. The slot
      * stays allocated; a republished key gets a new one.
-     * @throws if the key is off-curve, low-order, or not currently approved.
+     * @throws if the key is off-curve, not in the prime-order subgroup, or not currently approved.
      */
     retire(publicKey: IssuerPublicKey): void {
         const index = this.indexOf(toPublicKey(publicKey))
@@ -197,7 +197,7 @@ export class ApprovedIssuerSet implements IssuerSet {
 
     /**
      * Generates the membership witness the credential circuit consumes.
-     * @throws if the key is off-curve, low-order, or not currently approved.
+     * @throws if the key is off-curve, not in the prime-order subgroup, or not currently approved.
      */
     generateProof(publicKey: IssuerPublicKey): IssuerMembershipWitness {
         const leaf = issuerKeyLeaf(toPublicKey(publicKey))

package/src/index.ts

@@ -9,4 +9,4 @@ export type {
     IssuerPublicKey,
     IssuerSet
 } from "./types"
-export { toFieldElement, toPublicKey } from "./utils"
+export { inPrimeOrderSubgroup, toFieldElement, toPublicKey } from "./utils"

package/src/utils.ts

@@ -1,4 +1,4 @@
-import { inCurve, mulPointEscalar } from "@zk-kit/baby-jubjub"
+import { inCurve, mulPointEscalar, subOrder } from "@zk-kit/baby-jubjub"
 import { COFACTOR, SNARK_SCALAR_FIELD } from "./constants"
 import type { BigNumberish, IssuerPublicKey } from "./types"
 
@@ -30,8 +30,25 @@ export function toFieldElement(value: BigNumberish): bigint {
 }
 
 /**
- * Coerces a pair to a Baby Jubjub public key of full order, rejecting a point
- * that is not on the curve or that lies in the small-order subgroup.
+ * Whether a point is a non-identity element of Baby Jubjub's prime-order
+ * subgroup: canonical coordinates, on the curve, and `subOrder` times it is the
+ * identity. Coordinates are checked because zk-kit reduces them mod the field.
+ *
+ * @param point The point as `[x, y]`.
+ */
+export function inPrimeOrderSubgroup(point: [bigint, bigint]): boolean {
+    if (point.some((c) => c < 0n || c >= SNARK_SCALAR_FIELD)) return false
+    if (!inCurve(point) || (point[0] === 0n && point[1] === 1n)) return false
+
+    const [x, y] = mulPointEscalar(point, subOrder)
+
+    return x === 0n && y === 1n
+}
+
+/**
+ * Coerces a pair to a Baby Jubjub public key of prime order, rejecting a point
+ * that is not on the curve, that lies in the small-order subgroup, or that
+ * mixes a prime-order part with a torsion part.
  *
  * The set would happily commit to any two field elements, so without the curve
  * check a caller could publish a commitment to a point that does not exist.
@@ -40,8 +57,12 @@ export function toFieldElement(value: BigNumberish): bigint {
  * in EdDSA verification takes at most eight values whatever the message, so
  * anyone can solve `S·B = R + h·A` for a signature over a claim tree they chose;
  * at the identity it is immediate. Publishing such a key would hand every
- * stranger the member's issuing power. Mirrors the same rejection in
- * `ApprovedIssuerSet.sol`.
+ * stranger the member's issuing power. `ApprovedIssuerSet.sol` rejects the same
+ * low-order points.
+ *
+ * Under the circuit's cofactored EdDSA only the holder of `A`'s secret can sign
+ * under a mixed-order key `A + T`, so it would only let one secret occupy several
+ * leaves. The contract does not reject it; this function is stricter.
  *
  * @param publicKey The signing key as `[x, y]`.
  * @returns The key with both coordinates as bigints.
@@ -61,5 +82,9 @@ export function toPublicKey(publicKey: IssuerPublicKey): [bigint, bigint] {
         throw new Error("ApprovedIssuerSet: the public key has low order")
     }
 
+    if (!inPrimeOrderSubgroup(point)) {
+        throw new Error("ApprovedIssuerSet: the public key is not in the prime-order subgroup")
+    }
+
     return point
 }

package/types/index.d.ts

@@ -106,7 +106,7 @@ declare class ApprovedIssuerSet implements IssuerSet {
     /**
      * Publishes a signing key, appended at the next free slot.
      * @returns The leaf commitment inserted.
-     * @throws if the key is off-curve, low-order, or already approved.
+     * @throws if the key is off-curve, not in the prime-order subgroup, or already approved.
      */
     publish(publicKey: IssuerPublicKey): bigint;
     /**
@@ -119,12 +119,12 @@ declare class ApprovedIssuerSet implements IssuerSet {
     /**
      * Tombstones a key's slot to `0`, ending its ability to verify. The slot
      * stays allocated; a republished key gets a new one.
-     * @throws if the key is off-curve, low-order, or not currently approved.
+     * @throws if the key is off-curve, not in the prime-order subgroup, or not currently approved.
      */
     retire(publicKey: IssuerPublicKey): void;
     /**
      * Generates the membership witness the credential circuit consumes.
-     * @throws if the key is off-curve, low-order, or not currently approved.
+     * @throws if the key is off-curve, not in the prime-order subgroup, or not currently approved.
      */
     generateProof(publicKey: IssuerPublicKey): IssuerMembershipWitness;
     /** Instance form of {@link ApprovedIssuerSet.verifyProof}, additionally bound to this set's current root. */
@@ -182,8 +182,17 @@ declare function internalNode(left: bigint, right: bigint): bigint;
  */
 declare function toFieldElement(value: BigNumberish): bigint;
 /**
- * Coerces a pair to a Baby Jubjub public key of full order, rejecting a point
- * that is not on the curve or that lies in the small-order subgroup.
+ * Whether a point is a non-identity element of Baby Jubjub's prime-order
+ * subgroup: canonical coordinates, on the curve, and `subOrder` times it is the
+ * identity. Coordinates are checked because zk-kit reduces them mod the field.
+ *
+ * @param point The point as `[x, y]`.
+ */
+declare function inPrimeOrderSubgroup(point: [bigint, bigint]): boolean;
+/**
+ * Coerces a pair to a Baby Jubjub public key of prime order, rejecting a point
+ * that is not on the curve, that lies in the small-order subgroup, or that
+ * mixes a prime-order part with a torsion part.
  *
  * The set would happily commit to any two field elements, so without the curve
  * check a caller could publish a commitment to a point that does not exist.
@@ -192,13 +201,17 @@ declare function toFieldElement(value: BigNumberish): bigint;
  * in EdDSA verification takes at most eight values whatever the message, so
  * anyone can solve `S·B = R + h·A` for a signature over a claim tree they chose;
  * at the identity it is immediate. Publishing such a key would hand every
- * stranger the member's issuing power. Mirrors the same rejection in
- * `ApprovedIssuerSet.sol`.
+ * stranger the member's issuing power. `ApprovedIssuerSet.sol` rejects the same
+ * low-order points.
+ *
+ * Under the circuit's cofactored EdDSA only the holder of `A`'s secret can sign
+ * under a mixed-order key `A + T`, so it would only let one secret occupy several
+ * leaves. The contract does not reject it; this function is stricter.
  *
  * @param publicKey The signing key as `[x, y]`.
  * @returns The key with both coordinates as bigints.
  */
 declare function toPublicKey(publicKey: IssuerPublicKey): [bigint, bigint];
 
-export { ApprovedIssuerSet, COFACTOR, ISSUER_LEAF_DOMAIN, ISSUER_SET_MAX_DEPTH, SNARK_SCALAR_FIELD, internalNode, issuerKeyLeaf, issuerLeaf, toFieldElement, toPublicKey };
+export { ApprovedIssuerSet, COFACTOR, ISSUER_LEAF_DOMAIN, ISSUER_SET_MAX_DEPTH, SNARK_SCALAR_FIELD, inPrimeOrderSubgroup, internalNode, issuerKeyLeaf, issuerLeaf, toFieldElement, toPublicKey };
 export type { BigNumberish, ContractLeafReader, IssuerMembershipProof, IssuerMembershipWitness, IssuerPublicKey, IssuerSet };