@feelyourprotocol/evm 8141.0.0

package/src/precompiles/bls12_381/constants.ts

@@ -0,0 +1,278 @@
+import { concatBytes, hexToBytes } from '@feelyourprotocol/util'
+
+// base field modulus as described in the EIP
+export const BLS_FIELD_MODULUS = BigInt(
+  '0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab',
+)
+
+export const BLS_G1_POINT_BYTE_LENGTH = 128
+export const BLS_G2_POINT_BYTE_LENGTH = 256
+
+export const BLS_G1_INFINITY_POINT_BYTES = new Uint8Array(BLS_G1_POINT_BYTE_LENGTH)
+export const BLS_G2_INFINITY_POINT_BYTES = new Uint8Array(BLS_G2_POINT_BYTE_LENGTH)
+
+export const BLS_ZERO_BUFFER = new Uint8Array(32)
+export const BLS_ONE_BUFFER = concatBytes(new Uint8Array(31), hexToBytes('0x01'))
+
+// G1/G2 MSM discount constants taken from EIP-2537
+export const BLS_GAS_DISCOUNT_PAIRS_G1: [number, number][] = [
+  [1, 1000],
+  [2, 949],
+  [3, 848],
+  [4, 797],
+  [5, 764],
+  [6, 750],
+  [7, 738],
+  [8, 728],
+  [9, 719],
+  [10, 712],
+  [11, 705],
+  [12, 698],
+  [13, 692],
+  [14, 687],
+  [15, 682],
+  [16, 677],
+  [17, 673],
+  [18, 669],
+  [19, 665],
+  [20, 661],
+  [21, 658],
+  [22, 654],
+  [23, 651],
+  [24, 648],
+  [25, 645],
+  [26, 642],
+  [27, 640],
+  [28, 637],
+  [29, 635],
+  [30, 632],
+  [31, 630],
+  [32, 627],
+  [33, 625],
+  [34, 623],
+  [35, 621],
+  [36, 619],
+  [37, 617],
+  [38, 615],
+  [39, 613],
+  [40, 611],
+  [41, 609],
+  [42, 608],
+  [43, 606],
+  [44, 604],
+  [45, 603],
+  [46, 601],
+  [47, 599],
+  [48, 598],
+  [49, 596],
+  [50, 595],
+  [51, 593],
+  [52, 592],
+  [53, 591],
+  [54, 589],
+  [55, 588],
+  [56, 586],
+  [57, 585],
+  [58, 584],
+  [59, 582],
+  [60, 581],
+  [61, 580],
+  [62, 579],
+  [63, 577],
+  [64, 576],
+  [65, 575],
+  [66, 574],
+  [67, 573],
+  [68, 572],
+  [69, 570],
+  [70, 569],
+  [71, 568],
+  [72, 567],
+  [73, 566],
+  [74, 565],
+  [75, 564],
+  [76, 563],
+  [77, 562],
+  [78, 561],
+  [79, 560],
+  [80, 559],
+  [81, 558],
+  [82, 557],
+  [83, 556],
+  [84, 555],
+  [85, 554],
+  [86, 553],
+  [87, 552],
+  [88, 551],
+  [89, 550],
+  [90, 549],
+  [91, 548],
+  [92, 547],
+  [93, 547],
+  [94, 546],
+  [95, 545],
+  [96, 544],
+  [97, 543],
+  [98, 542],
+  [99, 541],
+  [100, 540],
+  [101, 540],
+  [102, 539],
+  [103, 538],
+  [104, 537],
+  [105, 536],
+  [106, 536],
+  [107, 535],
+  [108, 534],
+  [109, 533],
+  [110, 532],
+  [111, 532],
+  [112, 531],
+  [113, 530],
+  [114, 529],
+  [115, 528],
+  [116, 528],
+  [117, 527],
+  [118, 526],
+  [119, 525],
+  [120, 525],
+  [121, 524],
+  [122, 523],
+  [123, 522],
+  [124, 522],
+  [125, 521],
+  [126, 520],
+  [127, 520],
+  [128, 519],
+]
+
+export const BLS_GAS_DISCOUNT_PAIRS_G2: [number, number][] = [
+  [1, 1000],
+  [2, 1000],
+  [3, 923],
+  [4, 884],
+  [5, 855],
+  [6, 832],
+  [7, 812],
+  [8, 796],
+  [9, 782],
+  [10, 770],
+  [11, 759],
+  [12, 749],
+  [13, 740],
+  [14, 732],
+  [15, 724],
+  [16, 717],
+  [17, 711],
+  [18, 704],
+  [19, 699],
+  [20, 693],
+  [21, 688],
+  [22, 683],
+  [23, 679],
+  [24, 674],
+  [25, 670],
+  [26, 666],
+  [27, 663],
+  [28, 659],
+  [29, 655],
+  [30, 652],
+  [31, 649],
+  [32, 646],
+  [33, 643],
+  [34, 640],
+  [35, 637],
+  [36, 634],
+  [37, 632],
+  [38, 629],
+  [39, 627],
+  [40, 624],
+  [41, 622],
+  [42, 620],
+  [43, 618],
+  [44, 615],
+  [45, 613],
+  [46, 611],
+  [47, 609],
+  [48, 607],
+  [49, 606],
+  [50, 604],
+  [51, 602],
+  [52, 600],
+  [53, 598],
+  [54, 597],
+  [55, 595],
+  [56, 593],
+  [57, 592],
+  [58, 590],
+  [59, 589],
+  [60, 587],
+  [61, 586],
+  [62, 584],
+  [63, 583],
+  [64, 582],
+  [65, 580],
+  [66, 579],
+  [67, 578],
+  [68, 576],
+  [69, 575],
+  [70, 574],
+  [71, 573],
+  [72, 571],
+  [73, 570],
+  [74, 569],
+  [75, 568],
+  [76, 567],
+  [77, 566],
+  [78, 565],
+  [79, 563],
+  [80, 562],
+  [81, 561],
+  [82, 560],
+  [83, 559],
+  [84, 558],
+  [85, 557],
+  [86, 556],
+  [87, 555],
+  [88, 554],
+  [89, 553],
+  [90, 552],
+  [91, 552],
+  [92, 551],
+  [93, 550],
+  [94, 549],
+  [95, 548],
+  [96, 547],
+  [97, 546],
+  [98, 545],
+  [99, 545],
+  [100, 544],
+  [101, 543],
+  [102, 542],
+  [103, 541],
+  [104, 541],
+  [105, 540],
+  [106, 539],
+  [107, 538],
+  [108, 537],
+  [109, 537],
+  [110, 536],
+  [111, 535],
+  [112, 535],
+  [113, 534],
+  [114, 533],
+  [115, 532],
+  [116, 532],
+  [117, 531],
+  [118, 530],
+  [119, 530],
+  [120, 529],
+  [121, 528],
+  [122, 528],
+  [123, 527],
+  [124, 526],
+  [125, 526],
+  [126, 525],
+  [127, 524],
+  [128, 524],
+]

package/src/precompiles/bls12_381/index.ts

@@ -0,0 +1,4 @@
+export * from './constants.ts'
+export { MCLBLS } from './mcl.ts'
+export { NobleBLS } from './noble.ts'
+export * from './util.ts'

package/src/precompiles/bls12_381/mcl.ts

@@ -0,0 +1,376 @@
+import {
+  bytesToBigInt,
+  bytesToUnprefixedHex,
+  concatBytes,
+  equalsBytes,
+  setLengthLeft,
+  unprefixedHexToBytes,
+} from '@feelyourprotocol/util'
+
+import { EVMError } from '../../errors.ts'
+
+import {
+  BLS_FIELD_MODULUS,
+  BLS_G1_INFINITY_POINT_BYTES,
+  BLS_G1_POINT_BYTE_LENGTH,
+  BLS_G2_INFINITY_POINT_BYTES,
+  BLS_G2_POINT_BYTE_LENGTH,
+  BLS_ONE_BUFFER,
+  BLS_ZERO_BUFFER,
+} from './constants.ts'
+
+import type { EVMBLSInterface } from '../../types.ts'
+
+/**
+ * Converts an Uint8Array to a MCL G1 point. Raises errors if the point is not on the curve
+ * and (if activated) if the point is in the subgroup / order check.
+ * @param input Input Uint8Array. Should be 128 bytes
+ * @param mcl MCL instance
+ * @param verifyOrder Perform the subgroup check (defaults to true)
+ * @returns MCL G1 point
+ */
+function BLS12_381_ToG1Point(input: Uint8Array, mcl: any, verifyOrder = true): any {
+  if (equalsBytes(input, BLS_G1_INFINITY_POINT_BYTES)) {
+    return new mcl.G1()
+  }
+
+  // Using deprecated bytesToUnprefixedHex for performance: mcl library expects unprefixed hex strings.
+  const p_x = bytesToUnprefixedHex(input.subarray(16, BLS_G1_POINT_BYTE_LENGTH / 2))
+  const p_y = bytesToUnprefixedHex(input.subarray(80, BLS_G1_POINT_BYTE_LENGTH))
+
+  const G1 = new mcl.G1()
+
+  const Fp_X = new mcl.Fp()
+  const Fp_Y = new mcl.Fp()
+  const One = new mcl.Fp()
+
+  Fp_X.setStr(p_x, 16)
+  Fp_Y.setStr(p_y, 16)
+  One.setStr('1', 16)
+
+  G1.setX(Fp_X)
+  G1.setY(Fp_Y)
+  G1.setZ(One)
+
+  mcl.verifyOrderG1(verifyOrder)
+  if (verifyOrder && G1.isValidOrder() === false) {
+    throw new EVMError(EVMError.errorMessages.BLS_12_381_POINT_NOT_ON_CURVE)
+  }
+
+  // Check if these coordinates are actually on the curve.
+  if (G1.isValid() === false) {
+    throw new EVMError(EVMError.errorMessages.BLS_12_381_POINT_NOT_ON_CURVE)
+  }
+
+  return G1
+}
+
+// input: a mcl G1 point
+// output: a 128-byte Uint8Array
+function BLS12_381_FromG1Point(input: any): Uint8Array {
+  // TODO: figure out if there is a better way to decode these values.
+  const decodeStr = input.getStr(16) //return a string of pattern "1 <x_coord> <y_coord>"
+  const decoded = decodeStr.match(/"?[0-9a-f]+"?/g) // match above pattern.
+
+  if (decodeStr === '0') {
+    return new Uint8Array(BLS_G1_POINT_BYTE_LENGTH)
+  }
+
+  const xBytes = setLengthLeft(unprefixedHexToBytes(decoded[1]), 64)
+  const yBytes = setLengthLeft(unprefixedHexToBytes(decoded[2]), 64)
+
+  return concatBytes(xBytes, yBytes)
+}
+
+// input: two 64-byte buffers
+// output: a mcl Fp2 point
+
+function BLS12_381_ToFp2Point(fpXCoordinate: Uint8Array, fpYCoordinate: Uint8Array, mcl: any): any {
+  // check if the coordinates are in the field
+  if (bytesToBigInt(fpXCoordinate) >= BLS_FIELD_MODULUS) {
+    throw new EVMError(EVMError.errorMessages.BLS_12_381_FP_NOT_IN_FIELD)
+  }
+  if (bytesToBigInt(fpYCoordinate) >= BLS_FIELD_MODULUS) {
+    throw new EVMError(EVMError.errorMessages.BLS_12_381_FP_NOT_IN_FIELD)
+  }
+
+  const fp_x = new mcl.Fp()
+  const fp_y = new mcl.Fp()
+
+  const fp2 = new mcl.Fp2()
+  // Using deprecated bytesToUnprefixedHex for performance: mcl library expects unprefixed hex strings.
+  fp_x.setStr(bytesToUnprefixedHex(fpXCoordinate.subarray(16)), 16)
+  fp_y.setStr(bytesToUnprefixedHex(fpYCoordinate.subarray(16)), 16)
+
+  fp2.set_a(fp_x)
+  fp2.set_b(fp_y)
+
+  return fp2
+}
+
+/**
+ * Converts an Uint8Array to a MCL G2 point. Raises errors if the point is not on the curve
+ * and (if activated) if the point is in the subgroup / order check.
+ * @param input Input Uint8Array. Should be 256 bytes
+ * @param mcl MCL instance
+ * @param verifyOrder Perform the subgroup check (defaults to true)
+ * @returns MCL G2 point
+ */
+function BLS12_381_ToG2Point(input: Uint8Array, mcl: any, verifyOrder = true): any {
+  if (equalsBytes(input, BLS_G2_INFINITY_POINT_BYTES)) {
+    return new mcl.G2()
+  }
+
+  const p_x_1 = input.subarray(0, 64)
+  const p_x_2 = input.subarray(64, BLS_G2_POINT_BYTE_LENGTH / 2)
+  const p_y_1 = input.subarray(128, 192)
+  const p_y_2 = input.subarray(192, BLS_G2_POINT_BYTE_LENGTH)
+
+  const Fp2X = BLS12_381_ToFp2Point(p_x_1, p_x_2, mcl)
+  const Fp2Y = BLS12_381_ToFp2Point(p_y_1, p_y_2, mcl)
+
+  const FpOne = new mcl.Fp()
+  FpOne.setStr('1', 16)
+
+  const FpZero = new mcl.Fp()
+  FpZero.setStr('0', 16)
+
+  const Fp2One = new mcl.Fp2()
+
+  Fp2One.set_a(FpOne)
+  Fp2One.set_b(FpZero)
+
+  const p = new mcl.G2()
+
+  p.setX(Fp2X)
+  p.setY(Fp2Y)
+  p.setZ(Fp2One)
+
+  mcl.verifyOrderG2(verifyOrder)
+  if (verifyOrder && p.isValidOrder() === false) {
+    throw new EVMError(EVMError.errorMessages.BLS_12_381_POINT_NOT_ON_CURVE)
+  }
+
+  if (p.isValid() === false) {
+    throw new EVMError(EVMError.errorMessages.BLS_12_381_POINT_NOT_ON_CURVE)
+  }
+
+  return p
+}
+
+// input: a mcl G2 point
+// output: a 256-byte Uint8Array
+function BLS12_381_FromG2Point(input: any): Uint8Array {
+  // TODO: figure out if there is a better way to decode these values.
+  const decodeStr = input.getStr(16) //return a string of pattern "1 <x_coord_1> <x_coord_2> <y_coord_1> <y_coord_2>"
+  if (decodeStr === '0') {
+    return new Uint8Array(BLS_G2_POINT_BYTE_LENGTH)
+  }
+  const decoded = decodeStr.match(/"?[0-9a-f]+"?/g) // match above pattern.
+
+  const xBytes1 = setLengthLeft(unprefixedHexToBytes(decoded[1]), 64)
+  const xBytes2 = setLengthLeft(unprefixedHexToBytes(decoded[2]), 64)
+  const yBytes1 = setLengthLeft(unprefixedHexToBytes(decoded[3]), 64)
+  const yBytes2 = setLengthLeft(unprefixedHexToBytes(decoded[4]), 64)
+
+  return concatBytes(xBytes1, xBytes2, yBytes1, yBytes2)
+}
+
+// input: a 32-byte hex scalar Uint8Array
+// output: a mcl Fr point
+
+function BLS12_381_ToFrPoint(input: Uint8Array, mcl: any): any {
+  // Using deprecated bytesToUnprefixedHex for performance: mcl library expects unprefixed hex strings.
+  const mclHex = mcl.fromHexStr(bytesToUnprefixedHex(input))
+  const Fr = new mcl.Fr()
+  Fr.setBigEndianMod(mclHex)
+  return Fr
+}
+
+// input: a 64-byte buffer
+// output: a mcl Fp point
+
+function BLS12_381_ToFpPoint(fpCoordinate: Uint8Array, mcl: any): any {
+  // check if point is in field
+  if (bytesToBigInt(fpCoordinate) >= BLS_FIELD_MODULUS) {
+    throw new EVMError(EVMError.errorMessages.BLS_12_381_FP_NOT_IN_FIELD)
+  }
+
+  const fp = new mcl.Fp()
+
+  // Using deprecated bytesToUnprefixedHex for performance: mcl library expects unprefixed hex strings.
+  fp.setBigEndianMod(mcl.fromHexStr(bytesToUnprefixedHex(fpCoordinate)))
+
+  return fp
+}
+
+/**
+ * Implementation of the `EVMBLSInterface` using the `mcl-wasm` WASM `mcl` wrapper library,
+ * see https://github.com/herumi/mcl-wasm.
+ *
+ * This can be optionally used to replace the build-in Noble implementation (`NobleBLS`) with
+ * a more performant WASM variant. See EVM `bls` constructor option on how to use.
+ */
+export class MCLBLS implements EVMBLSInterface {
+  protected readonly _mcl: any
+
+  constructor(mcl: any) {
+    this._mcl = mcl
+  }
+
+  init() {
+    this._mcl.setMapToMode(this._mcl.IRTF) // set the right map mode; otherwise mapToG2 will return wrong values.
+    this._mcl.verifyOrderG1(true) // subgroup checks for G1
+    this._mcl.verifyOrderG2(true) // subgroup checks for G2
+  }
+
+  addG1(input: Uint8Array): Uint8Array {
+    // convert input to G1 points, add them, and convert the output to a Uint8Array.
+    const p1 = BLS12_381_ToG1Point(input.subarray(0, BLS_G1_POINT_BYTE_LENGTH), this._mcl, false)
+    const p2 = BLS12_381_ToG1Point(
+      input.subarray(BLS_G1_POINT_BYTE_LENGTH, BLS_G1_POINT_BYTE_LENGTH * 2),
+      this._mcl,
+      false,
+    )
+
+    const result = this._mcl.add(p1, p2)
+
+    return BLS12_381_FromG1Point(result)
+  }
+
+  addG2(input: Uint8Array): Uint8Array {
+    // convert input to G1 points, add them, and convert the output to a Uint8Array.
+    const p1 = BLS12_381_ToG2Point(input.subarray(0, BLS_G2_POINT_BYTE_LENGTH), this._mcl, false)
+    const p2 = BLS12_381_ToG2Point(
+      input.subarray(BLS_G2_POINT_BYTE_LENGTH, BLS_G2_POINT_BYTE_LENGTH * 2),
+      this._mcl,
+      false,
+    )
+
+    const result = this._mcl.add(p1, p2)
+
+    return BLS12_381_FromG2Point(result)
+  }
+
+  mapFPtoG1(input: Uint8Array): Uint8Array {
+    // convert input to Fp1 point
+    const Fp1Point = BLS12_381_ToFpPoint(input.subarray(0, 64), this._mcl)
+    // map it to G1
+    const result = Fp1Point.mapToG1()
+
+    return BLS12_381_FromG1Point(result)
+  }
+
+  mapFP2toG2(input: Uint8Array): Uint8Array {
+    // convert input to Fp2 point
+    const Fp2Point = BLS12_381_ToFp2Point(input.subarray(0, 64), input.subarray(64, 128), this._mcl)
+    // map it to G2
+    const result = Fp2Point.mapToG2()
+
+    return BLS12_381_FromG2Point(result)
+  }
+
+  msmG1(input: Uint8Array): Uint8Array {
+    const pairLength = 160
+    const numPairs = input.length / pairLength
+    const G1Array = []
+    const FrArray = []
+
+    for (let k = 0; k < numPairs; k++) {
+      const pairStart = pairLength * k
+      const G1 = BLS12_381_ToG1Point(
+        input.subarray(pairStart, pairStart + BLS_G1_POINT_BYTE_LENGTH),
+        this._mcl,
+      )
+      const Fr = BLS12_381_ToFrPoint(
+        input.subarray(pairStart + BLS_G1_POINT_BYTE_LENGTH, pairStart + pairLength),
+        this._mcl,
+      )
+
+      G1Array.push(G1)
+      FrArray.push(Fr)
+    }
+
+    const result = this._mcl.mulVec(G1Array, FrArray)
+
+    return BLS12_381_FromG1Point(result)
+  }
+
+  msmG2(input: Uint8Array): Uint8Array {
+    const pairLength = 288
+    const numPairs = input.length / pairLength
+    const G2Array = []
+    const FrArray = []
+
+    for (let k = 0; k < numPairs; k++) {
+      const pairStart = pairLength * k
+      const G2 = BLS12_381_ToG2Point(
+        input.subarray(pairStart, pairStart + BLS_G2_POINT_BYTE_LENGTH),
+        this._mcl,
+      )
+      const Fr = BLS12_381_ToFrPoint(
+        input.subarray(pairStart + BLS_G2_POINT_BYTE_LENGTH, pairStart + pairLength),
+        this._mcl,
+      )
+
+      G2Array.push(G2)
+      FrArray.push(Fr)
+    }
+
+    const result = this._mcl.mulVec(G2Array, FrArray)
+    return BLS12_381_FromG2Point(result)
+  }
+
+  pairingCheck(input: Uint8Array): Uint8Array {
+    const pairLength = 384
+    const pairs = []
+    for (let k = 0; k < input.length / pairLength; k++) {
+      const pairStart = pairLength * k
+      const G1 = BLS12_381_ToG1Point(
+        input.subarray(pairStart, pairStart + BLS_G1_POINT_BYTE_LENGTH),
+        this._mcl,
+      )
+
+      const g2start = pairStart + BLS_G1_POINT_BYTE_LENGTH
+      const G2 = BLS12_381_ToG2Point(
+        input.subarray(g2start, g2start + BLS_G2_POINT_BYTE_LENGTH),
+        this._mcl,
+      )
+
+      pairs.push([G1, G2])
+    }
+
+    // run the pairing check
+    // reference (Nethermind): https://github.com/NethermindEth/nethermind/blob/374b036414722b9c8ad27e93d64840b8f63931b9/src/Nethermind/Nethermind.Evm/Precompiles/Bls/Mcl/PairingPrecompile.cs#L93
+    let GT
+    for (let index = 0; index < pairs.length; index++) {
+      const pair = pairs[index]
+      const G1 = pair[0]
+      const G2 = pair[1]
+
+      if (index === 0) {
+        GT = this._mcl.millerLoop(G1, G2)
+      } else {
+        GT = this._mcl.mul(GT, this._mcl.millerLoop(G1, G2))
+      }
+    }
+
+    GT = this._mcl.finalExp(GT)
+
+    if (GT.isOne() === true) {
+      return BLS_ONE_BUFFER
+    } else {
+      return BLS_ZERO_BUFFER
+    }
+  }
+}
+
+export {
+  BLS12_381_FromG1Point,
+  BLS12_381_FromG2Point,
+  BLS12_381_ToFp2Point,
+  BLS12_381_ToFpPoint,
+  BLS12_381_ToFrPoint,
+  BLS12_381_ToG1Point,
+  BLS12_381_ToG2Point,
+}