@haneullabs/haneul 0.1.0

package/src/keypairs/ed25519/ed25519-hd-key.ts

@@ -0,0 +1,83 @@
+// Copyright (c) Mysten Labs, Inc.
+// SPDX-License-Identifier: Apache-2.0
+
+// This is adapted from https://github.com/alepop/ed25519-hd-key replacing create-hmac
+// with @noble/hashes to be browser compatible.
+
+import { fromHex } from '@haneullabs/bcs';
+import { hmac } from '@noble/hashes/hmac';
+import { sha512 } from '@noble/hashes/sha512';
+
+type Hex = string;
+type Path = string;
+
+type Keys = {
+	key: Uint8Array;
+	chainCode: Uint8Array;
+};
+
+const ED25519_CURVE = 'ed25519 seed';
+const HARDENED_OFFSET = 0x80000000;
+
+const pathRegex = new RegExp("^m(\\/[0-9]+')+$");
+
+const replaceDerive = (val: string): string => val.replace("'", '');
+
+const getMasterKeyFromSeed = (seed: Hex): Keys => {
+	const h = hmac.create(sha512, ED25519_CURVE);
+	const I = h.update(fromHex(seed)).digest();
+	const IL = I.slice(0, 32);
+	const IR = I.slice(32);
+	return {
+		key: IL,
+		chainCode: IR,
+	};
+};
+
+const CKDPriv = ({ key, chainCode }: Keys, index: number): Keys => {
+	const indexBuffer = new ArrayBuffer(4);
+	const cv = new DataView(indexBuffer);
+	cv.setUint32(0, index);
+
+	const data = new Uint8Array(1 + key.length + indexBuffer.byteLength);
+	data.set(new Uint8Array(1).fill(0));
+	data.set(key, 1);
+	data.set(new Uint8Array(indexBuffer, 0, indexBuffer.byteLength), key.length + 1);
+
+	const I = hmac.create(sha512, chainCode).update(data).digest();
+	const IL = I.slice(0, 32);
+	const IR = I.slice(32);
+	return {
+		key: IL,
+		chainCode: IR,
+	};
+};
+
+const isValidPath = (path: string): boolean => {
+	if (!pathRegex.test(path)) {
+		return false;
+	}
+	return !path
+		.split('/')
+		.slice(1)
+		.map(replaceDerive)
+		.some(isNaN as any /* ts T_T*/);
+};
+
+export const derivePath = (path: Path, seed: Hex, offset = HARDENED_OFFSET): Keys => {
+	if (!isValidPath(path)) {
+		throw new Error('Invalid derivation path');
+	}
+
+	const { key, chainCode } = getMasterKeyFromSeed(seed);
+	const segments = path
+		.split('/')
+		.slice(1)
+		.map(replaceDerive)
+		.map((el) => parseInt(el, 10));
+
+	return segments.reduce((parentKeys, segment) => CKDPriv(parentKeys, segment + offset), {
+		key,
+		chainCode,
+	});
+};

package/src/keypairs/ed25519/index.ts

@@ -0,0 +1,9 @@
+// Copyright (c) Mysten Labs, Inc.
+// SPDX-License-Identifier: Apache-2.0
+
+export {
+	DEFAULT_ED25519_DERIVATION_PATH,
+	Ed25519Keypair,
+	type Ed25519KeypairData,
+} from './keypair.js';
+export { Ed25519PublicKey } from './publickey.js';

package/src/keypairs/ed25519/keypair.ts

@@ -0,0 +1,181 @@
+// Copyright (c) Mysten Labs, Inc.
+// SPDX-License-Identifier: Apache-2.0
+
+import { ed25519 } from '@noble/curves/ed25519';
+
+import {
+	decodeHaneulPrivateKey,
+	encodeHaneulPrivateKey,
+	Keypair,
+	PRIVATE_KEY_SIZE,
+} from '../../cryptography/keypair.js';
+import { isValidHardenedPath, mnemonicToSeedHex } from '../../cryptography/mnemonics.js';
+import type { SignatureScheme } from '../../cryptography/signature-scheme.js';
+import { derivePath } from './ed25519-hd-key.js';
+import { Ed25519PublicKey } from './publickey.js';
+
+export const DEFAULT_ED25519_DERIVATION_PATH = "m/44'/784'/0'/0'/0'";
+
+/**
+ * Ed25519 Keypair data. The publickey is the 32-byte public key and
+ * the secretkey is 64-byte, where the first 32 bytes is the secret
+ * key and the last 32 bytes is the public key.
+ */
+export interface Ed25519KeypairData {
+	publicKey: Uint8Array;
+	secretKey: Uint8Array;
+}
+
+/**
+ * An Ed25519 Keypair used for signing transactions.
+ */
+export class Ed25519Keypair extends Keypair {
+	private keypair: Ed25519KeypairData;
+
+	/**
+	 * Create a new Ed25519 keypair instance.
+	 * Generate random keypair if no {@link Ed25519Keypair} is provided.
+	 *
+	 * @param keypair Ed25519 keypair
+	 */
+	constructor(keypair?: Ed25519KeypairData) {
+		super();
+		if (keypair) {
+			this.keypair = {
+				publicKey: keypair.publicKey,
+				secretKey: keypair.secretKey.slice(0, 32),
+			};
+		} else {
+			const privateKey = ed25519.utils.randomPrivateKey();
+			this.keypair = {
+				publicKey: ed25519.getPublicKey(privateKey),
+				secretKey: privateKey,
+			};
+		}
+	}
+
+	/**
+	 * Get the key scheme of the keypair ED25519
+	 */
+	getKeyScheme(): SignatureScheme {
+		return 'ED25519';
+	}
+
+	/**
+	 * Generate a new random Ed25519 keypair
+	 */
+	static generate(): Ed25519Keypair {
+		const secretKey = ed25519.utils.randomPrivateKey();
+		return new Ed25519Keypair({
+			publicKey: ed25519.getPublicKey(secretKey),
+			secretKey,
+		});
+	}
+
+	/**
+	 * Create a Ed25519 keypair from a raw secret key byte array, also known as seed.
+	 * This is NOT the private scalar which is result of hashing and bit clamping of
+	 * the raw secret key.
+	 *
+	 * @throws error if the provided secret key is invalid and validation is not skipped.
+	 *
+	 * @param secretKey secret key as a byte array or Bech32 secret key string
+	 * @param options: skip secret key validation
+	 */
+	static fromSecretKey(
+		secretKey: Uint8Array | string,
+		options?: { skipValidation?: boolean },
+	): Ed25519Keypair {
+		if (typeof secretKey === 'string') {
+			const decoded = decodeHaneulPrivateKey(secretKey);
+
+			if (decoded.schema !== 'ED25519') {
+				throw new Error(`Expected a ED25519 keypair, got ${decoded.schema}`);
+			}
+
+			return this.fromSecretKey(decoded.secretKey, options);
+		}
+
+		const secretKeyLength = secretKey.length;
+		if (secretKeyLength !== PRIVATE_KEY_SIZE) {
+			throw new Error(
+				`Wrong secretKey size. Expected ${PRIVATE_KEY_SIZE} bytes, got ${secretKeyLength}.`,
+			);
+		}
+		const keypair = {
+			publicKey: ed25519.getPublicKey(secretKey),
+			secretKey,
+		};
+
+		if (!options || !options.skipValidation) {
+			const encoder = new TextEncoder();
+			const signData = encoder.encode('sui validation');
+			const signature = ed25519.sign(signData, secretKey);
+			if (!ed25519.verify(signature, signData, keypair.publicKey)) {
+				throw new Error('provided secretKey is invalid');
+			}
+		}
+		return new Ed25519Keypair(keypair);
+	}
+
+	/**
+	 * The public key for this Ed25519 keypair
+	 */
+	getPublicKey(): Ed25519PublicKey {
+		return new Ed25519PublicKey(this.keypair.publicKey);
+	}
+
+	/**
+	 * The Bech32 secret key string for this Ed25519 keypair
+	 */
+	getSecretKey(): string {
+		return encodeHaneulPrivateKey(
+			this.keypair.secretKey.slice(0, PRIVATE_KEY_SIZE),
+			this.getKeyScheme(),
+		);
+	}
+
+	/**
+	 * Return the signature for the provided data using Ed25519.
+	 */
+	async sign(data: Uint8Array) {
+		return ed25519.sign(data, this.keypair.secretKey) as Uint8Array<ArrayBuffer>;
+	}
+
+	/**
+	 * Derive Ed25519 keypair from mnemonics and path. The mnemonics must be normalized
+	 * and validated against the english wordlist.
+	 *
+	 * If path is none, it will default to m/44'/784'/0'/0'/0', otherwise the path must
+	 * be compliant to SLIP-0010 in form m/44'/784'/{account_index}'/{change_index}'/{address_index}'.
+	 */
+	static deriveKeypair(mnemonics: string, path?: string): Ed25519Keypair {
+		if (path == null) {
+			path = DEFAULT_ED25519_DERIVATION_PATH;
+		}
+		if (!isValidHardenedPath(path)) {
+			throw new Error('Invalid derivation path');
+		}
+		const { key } = derivePath(path, mnemonicToSeedHex(mnemonics));
+
+		return Ed25519Keypair.fromSecretKey(key);
+	}
+
+	/**
+	 * Derive Ed25519 keypair from mnemonicSeed and path.
+	 *
+	 * If path is none, it will default to m/44'/784'/0'/0'/0', otherwise the path must
+	 * be compliant to SLIP-0010 in form m/44'/784'/{account_index}'/{change_index}'/{address_index}'.
+	 */
+	static deriveKeypairFromSeed(seedHex: string, path?: string): Ed25519Keypair {
+		if (path == null) {
+			path = DEFAULT_ED25519_DERIVATION_PATH;
+		}
+		if (!isValidHardenedPath(path)) {
+			throw new Error('Invalid derivation path');
+		}
+		const { key } = derivePath(path, seedHex);
+
+		return Ed25519Keypair.fromSecretKey(key);
+	}
+}

package/src/keypairs/ed25519/publickey.ts

@@ -0,0 +1,89 @@
+// Copyright (c) Mysten Labs, Inc.
+// SPDX-License-Identifier: Apache-2.0
+
+import { fromBase64 } from '@haneullabs/bcs';
+import { ed25519 } from '@noble/curves/ed25519';
+
+import {
+	bytesEqual,
+	parseSerializedKeypairSignature,
+	PublicKey,
+} from '../../cryptography/publickey.js';
+import type { PublicKeyInitData } from '../../cryptography/publickey.js';
+import { SIGNATURE_SCHEME_TO_FLAG } from '../../cryptography/signature-scheme.js';
+
+const PUBLIC_KEY_SIZE = 32;
+
+/**
+ * An Ed25519 public key
+ */
+export class Ed25519PublicKey extends PublicKey {
+	static SIZE = PUBLIC_KEY_SIZE;
+	private data: Uint8Array<ArrayBuffer>;
+
+	/**
+	 * Create a new Ed25519PublicKey object
+	 * @param value ed25519 public key as buffer or base-64 encoded string
+	 */
+	constructor(value: PublicKeyInitData) {
+		super();
+
+		if (typeof value === 'string') {
+			this.data = fromBase64(value);
+		} else if (value instanceof Uint8Array) {
+			this.data = value as Uint8Array<ArrayBuffer>;
+		} else {
+			this.data = Uint8Array.from(value);
+		}
+
+		if (this.data.length !== PUBLIC_KEY_SIZE) {
+			throw new Error(
+				`Invalid public key input. Expected ${PUBLIC_KEY_SIZE} bytes, got ${this.data.length}`,
+			);
+		}
+	}
+
+	/**
+	 * Checks if two Ed25519 public keys are equal
+	 */
+	override equals(publicKey: Ed25519PublicKey): boolean {
+		return super.equals(publicKey);
+	}
+
+	/**
+	 * Return the byte array representation of the Ed25519 public key
+	 */
+	toRawBytes(): Uint8Array<ArrayBuffer> {
+		return this.data;
+	}
+
+	/**
+	 * Return the Haneul address associated with this Ed25519 public key
+	 */
+	flag(): number {
+		return SIGNATURE_SCHEME_TO_FLAG['ED25519'];
+	}
+
+	/**
+	 * Verifies that the signature is valid for for the provided message
+	 */
+	async verify(message: Uint8Array, signature: Uint8Array | string): Promise<boolean> {
+		let bytes;
+		if (typeof signature === 'string') {
+			const parsed = parseSerializedKeypairSignature(signature);
+			if (parsed.signatureScheme !== 'ED25519') {
+				throw new Error('Invalid signature scheme');
+			}
+
+			if (!bytesEqual(this.toRawBytes(), parsed.publicKey)) {
+				throw new Error('Signature does not match public key');
+			}
+
+			bytes = parsed.signature;
+		} else {
+			bytes = signature;
+		}
+
+		return ed25519.verify(bytes, message, this.toRawBytes());
+	}
+}

package/src/keypairs/passkey/index.ts

@@ -0,0 +1,5 @@
+// Copyright (c) Mysten Labs, Inc.
+// SPDX-License-Identifier: Apache-2.0
+export { PasskeyKeypair, BrowserPasskeyProvider, findCommonPublicKey } from './keypair.js';
+export type { PasskeyProvider, BrowserPasswordProviderOptions } from './keypair.js';
+export { PasskeyPublicKey } from './publickey.js';

package/src/keypairs/passkey/keypair.ts

@@ -0,0 +1,306 @@
+// Copyright (c) Mysten Labs, Inc.
+// SPDX-License-Identifier: Apache-2.0
+
+import { toBase64 } from '@haneullabs/bcs';
+import { secp256r1 } from '@noble/curves/p256';
+import { blake2b } from '@noble/hashes/blake2b';
+import { sha256 } from '@noble/hashes/sha256';
+import { randomBytes } from '@noble/hashes/utils';
+
+import { PasskeyAuthenticator } from '../../bcs/bcs.js';
+import type { IntentScope, SignatureWithBytes } from '../../cryptography/index.js';
+import { messageWithIntent, SIGNATURE_SCHEME_TO_FLAG, Signer } from '../../cryptography/index.js';
+import type { PublicKey } from '../../cryptography/publickey.js';
+import type { SignatureScheme } from '../../cryptography/signature-scheme.js';
+import {
+	parseDerSPKI,
+	PASSKEY_PUBLIC_KEY_SIZE,
+	PASSKEY_SIGNATURE_SIZE,
+	PasskeyPublicKey,
+} from './publickey.js';
+import type { AuthenticationCredential, RegistrationCredential } from './types.js';
+
+type DeepPartialConfigKeys = 'rp' | 'user' | 'authenticatorSelection';
+
+type DeepPartial<T> = T extends object
+	? {
+			[P in keyof T]?: DeepPartial<T[P]>;
+		}
+	: T;
+
+export type BrowserPasswordProviderOptions = Pick<
+	DeepPartial<PublicKeyCredentialCreationOptions>,
+	DeepPartialConfigKeys
+> &
+	Omit<
+		Partial<PublicKeyCredentialCreationOptions>,
+		DeepPartialConfigKeys | 'pubKeyCredParams' | 'challenge'
+	>;
+
+export interface PasskeyProvider {
+	create(): Promise<RegistrationCredential>;
+	get(challenge: Uint8Array): Promise<AuthenticationCredential>;
+}
+
+// Default browser implementation
+export class BrowserPasskeyProvider implements PasskeyProvider {
+	#name: string;
+	#options: BrowserPasswordProviderOptions;
+
+	constructor(name: string, options: BrowserPasswordProviderOptions) {
+		this.#name = name;
+		this.#options = options;
+	}
+
+	async create(): Promise<RegistrationCredential> {
+		return (await navigator.credentials.create({
+			publicKey: {
+				timeout: this.#options.timeout ?? 60000,
+				...this.#options,
+				rp: {
+					name: this.#name,
+					...this.#options.rp,
+				},
+				user: {
+					name: this.#name,
+					displayName: this.#name,
+					...this.#options.user,
+					id: randomBytes(10) as BufferSource,
+				},
+				challenge: new TextEncoder().encode('Create passkey wallet on Haneul'),
+				pubKeyCredParams: [{ alg: -7, type: 'public-key' }],
+				authenticatorSelection: {
+					authenticatorAttachment: 'cross-platform',
+					residentKey: 'required',
+					requireResidentKey: true,
+					userVerification: 'required',
+					...this.#options.authenticatorSelection,
+				},
+			},
+		})) as RegistrationCredential;
+	}
+
+	async get(challenge: Uint8Array): Promise<AuthenticationCredential> {
+		return (await navigator.credentials.get({
+			publicKey: {
+				challenge: challenge as BufferSource,
+				userVerification: this.#options.authenticatorSelection?.userVerification || 'required',
+				timeout: this.#options.timeout ?? 60000,
+			},
+		})) as AuthenticationCredential;
+	}
+}
+
+/**
+ * @experimental
+ * A passkey signer used for signing transactions. This is a client side implementation for [SIP-9](https://github.com/sui-foundation/sips/blob/main/sips/sip-9.md).
+ */
+export class PasskeyKeypair extends Signer {
+	private publicKey: Uint8Array;
+	private provider: PasskeyProvider;
+
+	/**
+	 * Get the key scheme of passkey,
+	 */
+	getKeyScheme(): SignatureScheme {
+		return 'Passkey';
+	}
+
+	/**
+	 * Creates an instance of Passkey signer. If no passkey wallet had created before,
+	 * use `getPasskeyInstance`. For example:
+	 * ```
+	 * let provider = new BrowserPasskeyProvider('Sui Passkey Example',{
+	 * 	  rpName: 'Sui Passkey Example',
+	 * 	  rpId: window.location.hostname,
+	 * } as BrowserPasswordProviderOptions);
+	 * const signer = await PasskeyKeypair.getPasskeyInstance(provider);
+	 * ```
+	 *
+	 * If there are existing passkey wallet, use `signAndRecover` to identify the correct
+	 * public key and then initialize the instance. See usage in `signAndRecover`.
+	 */
+	constructor(publicKey: Uint8Array, provider: PasskeyProvider) {
+		super();
+		this.publicKey = publicKey;
+		this.provider = provider;
+	}
+
+	/**
+	 * Creates an instance of Passkey signer invoking the passkey from navigator.
+	 * Note that this will invoke the passkey device to create a fresh credential.
+	 * Should only be called if passkey wallet is created for the first time.
+	 *
+	 * @param provider - the passkey provider.
+	 * @returns the passkey instance.
+	 */
+	static async getPasskeyInstance(provider: PasskeyProvider): Promise<PasskeyKeypair> {
+		// create a passkey secp256r1 with the provider.
+		const credential = await provider.create();
+
+		if (!credential.response.getPublicKey()) {
+			throw new Error('Invalid credential create response');
+		} else {
+			const derSPKI = credential.response.getPublicKey()!;
+			const pubkeyUncompressed = parseDerSPKI(new Uint8Array(derSPKI));
+			const pubkey = secp256r1.ProjectivePoint.fromHex(pubkeyUncompressed);
+			const pubkeyCompressed = pubkey.toRawBytes(true);
+			return new PasskeyKeypair(pubkeyCompressed, provider);
+		}
+	}
+
+	/**
+	 * Return the public key for this passkey.
+	 */
+	getPublicKey(): PublicKey {
+		return new PasskeyPublicKey(this.publicKey);
+	}
+
+	/**
+	 * Return the signature for the provided data (i.e. blake2b(intent_message)).
+	 * This is sent to passkey as the challenge field.
+	 */
+	async sign(data: Uint8Array) {
+		// asks the passkey to sign over challenge as the data.
+		const credential = await this.provider.get(data);
+
+		// parse authenticatorData (as bytes), clientDataJSON (decoded as string).
+		const authenticatorData = new Uint8Array(credential.response.authenticatorData);
+		const clientDataJSON = new Uint8Array(credential.response.clientDataJSON); // response.clientDataJSON is already UTF-8 encoded JSON
+		const decoder = new TextDecoder();
+		const clientDataJSONString: string = decoder.decode(clientDataJSON);
+
+		// parse the signature from DER format, normalize and convert to compressed format (33 bytes).
+		const sig = secp256r1.Signature.fromDER(new Uint8Array(credential.response.signature));
+		const normalized = sig.normalizeS().toCompactRawBytes();
+
+		if (
+			normalized.length !== PASSKEY_SIGNATURE_SIZE ||
+			this.publicKey.length !== PASSKEY_PUBLIC_KEY_SIZE
+		) {
+			throw new Error('Invalid signature or public key length');
+		}
+
+		// construct userSignature as flag || sig || pubkey for the secp256r1 signature.
+		const arr = new Uint8Array(1 + normalized.length + this.publicKey.length);
+		arr.set([SIGNATURE_SCHEME_TO_FLAG['Secp256r1']]);
+		arr.set(normalized, 1);
+		arr.set(this.publicKey, 1 + normalized.length);
+
+		// serialize all fields into a passkey signature according to https://github.com/sui-foundation/sips/blob/main/sips/sip-9.md#signature-encoding
+		return PasskeyAuthenticator.serialize({
+			authenticatorData: authenticatorData,
+			clientDataJson: clientDataJSONString,
+			userSignature: arr,
+		}).toBytes();
+	}
+
+	/**
+	 * This overrides the base class implementation that accepts the raw bytes and signs its
+	 * digest of the intent message, then serialize it with the passkey flag.
+	 */
+	async signWithIntent(bytes: Uint8Array, intent: IntentScope): Promise<SignatureWithBytes> {
+		// prepend it into an intent message and computes the digest.
+		const intentMessage = messageWithIntent(intent, bytes);
+		const digest = blake2b(intentMessage, { dkLen: 32 });
+
+		// sign the digest.
+		const signature = await this.sign(digest);
+
+		// prepend with the passkey flag.
+		const serializedSignature = new Uint8Array(1 + signature.length);
+		serializedSignature.set([SIGNATURE_SCHEME_TO_FLAG[this.getKeyScheme()]]);
+		serializedSignature.set(signature, 1);
+		return {
+			signature: toBase64(serializedSignature),
+			bytes: toBase64(bytes),
+		};
+	}
+
+	/**
+	 * Given a message, asks the passkey device to sign it and return all (up to 4) possible public keys.
+	 * See: https://bitcoin.stackexchange.com/questions/81232/how-is-public-key-extracted-from-message-digital-signature-address
+	 *
+	 * This is useful if the user previously created passkey wallet with the origin, but the wallet session
+	 * does not have the public key / address. By calling this method twice with two different messages, the
+	 * wallet can compare the returned public keys and uniquely identify the previously created passkey wallet
+	 * using `findCommonPublicKey`.
+	 *
+	 * Alternatively, one call can be made and all possible public keys should be checked onchain to see if
+	 * there is any assets.
+	 *
+	 * Once the correct public key is identified, a passkey instance can then be initialized with this public key.
+	 *
+	 * Example usage to recover wallet with two signing calls:
+	 * ```
+	 * let provider = new BrowserPasskeyProvider('Sui Passkey Example',{
+	 *     rpName: 'Sui Passkey Example',
+	 * 	   rpId: window.location.hostname,
+	 * } as BrowserPasswordProviderOptions);
+	 * const testMessage = new TextEncoder().encode('Hello world!');
+	 * const possiblePks = await PasskeyKeypair.signAndRecover(provider, testMessage);
+	 * const testMessage2 = new TextEncoder().encode('Hello world 2!');
+	 * const possiblePks2 = await PasskeyKeypair.signAndRecover(provider, testMessage2);
+	 * const commonPk = findCommonPublicKey(possiblePks, possiblePks2);
+	 * const signer = new PasskeyKeypair(provider, commonPk.toRawBytes());
+	 * ```
+	 *
+	 * @param provider - the passkey provider.
+	 * @param message - the message to sign.
+	 * @returns all possible public keys.
+	 */
+	static async signAndRecover(
+		provider: PasskeyProvider,
+		message: Uint8Array,
+	): Promise<PublicKey[]> {
+		const credential = await provider.get(message);
+		const fullMessage = messageFromAssertionResponse(credential.response);
+		const sig = secp256r1.Signature.fromDER(new Uint8Array(credential.response.signature));
+
+		const res = [];
+		for (let i = 0; i < 4; i++) {
+			const s = sig.addRecoveryBit(i);
+			try {
+				const pubkey = s.recoverPublicKey(sha256(fullMessage));
+				const pk = new PasskeyPublicKey(pubkey.toRawBytes(true));
+				res.push(pk);
+			} catch {
+				continue;
+			}
+		}
+		return res;
+	}
+}
+
+/**
+ * Finds the unique public key that exists in both arrays, throws error if the common
+ * pubkey does not equal to one.
+ *
+ * @param arr1 - The first pubkeys array.
+ * @param arr2 - The second pubkeys array.
+ * @returns The only common pubkey in both arrays.
+ */
+export function findCommonPublicKey(arr1: PublicKey[], arr2: PublicKey[]): PublicKey {
+	const matchingPubkeys: PublicKey[] = [];
+	for (const pubkey1 of arr1) {
+		for (const pubkey2 of arr2) {
+			if (pubkey1.equals(pubkey2)) {
+				matchingPubkeys.push(pubkey1);
+			}
+		}
+	}
+	if (matchingPubkeys.length !== 1) {
+		throw new Error('No unique public key found');
+	}
+	return matchingPubkeys[0];
+}
+
+/**
+ * Constructs the message that the passkey signature is produced over as authenticatorData || sha256(clientDataJSON).
+ */
+function messageFromAssertionResponse(response: AuthenticatorAssertionResponse): Uint8Array {
+	const authenticatorData = new Uint8Array(response.authenticatorData);
+	const clientDataJSON = new Uint8Array(response.clientDataJSON);
+	const clientDataJSONDigest = sha256(clientDataJSON);
+	return new Uint8Array([...authenticatorData, ...clientDataJSONDigest]);
+}