@icp-sdk/vetkeys 0.5.0 → 0.7.0

package/dist/lib/utils-CiynM__c.mjs

@@ -0,0 +1,901 @@
+import { bls12_381 as i } from "@noble/curves/bls12-381";
+import { shake256 as Z } from "@noble/hashes/sha3";
+import { hkdf as $ } from "@noble/hashes/hkdf";
+import { sha256 as tt } from "@noble/hashes/sha2";
+const l = 48, a = 96;
+class x {
+  #t;
+  #e;
+  /**
+   * Create a random transport secret key
+   */
+  static random() {
+    return new x(i.utils.randomSecretKey());
+  }
+  /**
+   * Deserialize TransportSecretKey from a bytestring
+   *
+   * The passed value would typically be a string previously returned
+   * by calling serialize on a randomly-created TransportSecretKey.
+   */
+  static deserialize(t) {
+    if (t.length !== 32)
+      throw new Error("Invalid size for transport secret key");
+    return new x(t);
+  }
+  /**
+   * Return the encoding of the transport public key; this value is
+   * sent to the IC
+   */
+  publicKeyBytes() {
+    return this.#e.toBytes(!0);
+  }
+  /**
+   * Return the transport secret key value
+   *
+   * Applications would not normally need to call this
+   */
+  serialize() {
+    return this.#t;
+  }
+  /**
+   * @internal constructor
+   */
+  constructor(t) {
+    this.#t = t;
+    const e = i.G1.Point.BASE.multiply(
+      i.G1.Point.Fn.fromBytes(this.#t)
+    );
+    this.#e = e;
+  }
+}
+function lt(n) {
+  if (n.length != 48)
+    return !1;
+  try {
+    return i.G1.Point.fromHex(n), !0;
+  } catch {
+    return !1;
+  }
+}
+function y(n) {
+  let t = n.length;
+  const e = new Uint8Array(8 + t);
+  for (let r = 7; r >= 0; r--)
+    e[r] = t & 255, t >>>= 8;
+  return e.set(n, 8), e;
+}
+var et = /* @__PURE__ */ ((n) => (n.KEY_1 = "key_1", n.TEST_KEY_1 = "test_key_1", n))(et || {}), rt = /* @__PURE__ */ ((n) => (n.KEY_1 = "key_1", n.TEST_KEY_1 = "test_key_1", n.DFX_TEST_KEY = "dfx_test_key", n))(rt || {});
+function b(n) {
+  const t = new Uint8Array(n.length / 2);
+  for (let e = 0; e < n.length; e += 2)
+    t[e / 2] = parseInt(n.substring(e, e + 2), 16);
+  return t;
+}
+class d {
+  #t;
+  /**
+   * Read a MasterPublicKey from the bytestring encoding
+   *
+   * Normally the bytes provided here will have been returned by
+   * the `vetkd_public_key` management canister interface.
+   */
+  static deserialize(t) {
+    return new d(i.G2.Point.fromHex(t));
+  }
+  /**
+   * Derive a canister master key from the subnet master key
+   *
+   * To create the derived public key in VetKD, a two step derivation is performed. The first step
+   * creates a key that is specific to the canister that is making VetKD requests to the
+   * management canister, sometimes called canister master key.
+   *
+   * This function can be used to compute canister master keys knowing just the subnet master key
+   * plus the canister identity. This avoids having to interact with the IC for performing this
+   * computation.
+   */
+  deriveCanisterKey(t) {
+    const e = "ic-vetkd-bls12-381-g2-canister-id", r = this.publicKeyBytes(), s = new Uint8Array([
+      ...y(r),
+      ...y(t)
+    ]), o = P(s, e), c = i.G2.Point.BASE.multiply(o);
+    return new m(this.#t.add(c));
+  }
+  /**
+   * Return the bytestring encoding of the master public key
+   */
+  publicKeyBytes() {
+    return this.#t.toBytes(!0);
+  }
+  /**
+   * Return the hardcoded master public key used on IC
+   *
+   * This allows performing public key derivation offline
+   */
+  static productionKey(t = "key_1") {
+    if (t == "key_1")
+      return d.deserialize(
+        b(
+          "a9caf9ae8af0c7c7272f8a122133e2e0c7c0899b75e502bda9e109ca8193ded3ef042ed96db1125e1bdaad77d8cc60d917e122fe2501c45b96274f43705edf0cfd455bc66c3c060faa2fcd15486e76351edf91fecb993797273bbc8beaa47404"
+        )
+      );
+    if (t == "test_key_1")
+      return d.deserialize(
+        b(
+          "ad86e8ff845912f022a0838a502d763fdea547c9948f8cb20ea7738dd52c1c38dcb4c6ca9ac29f9ac690fc5ad7681cb41922b8dffbd65d94bff141f5fb5b6624eccc03bf850f222052df888cf9b1e47203556d7522271cbb879b2ef4b8c2bfb1"
+        )
+      );
+    throw new Error(
+      "Unknown MasterPublicKeyId value for productionKey"
+    );
+  }
+  /**
+   * Return the hardcoded master public key used in PocketIC
+   *
+   * This allows performing public key derivation offline
+   */
+  static pocketicKey(t = "key_1") {
+    if (t == "key_1")
+      return d.deserialize(
+        b(
+          "8c800b5cff00463d26e8167369168827f1e48f4d8d60f71dd6a295580f65275b5f5f8e6a792c876b2c72492136530d0710a27522ee63977a76216c3cef9e70bfcb45b88736fc62142e7e0737848ce06cbb1f45a4a6a349b142ae5cf7853561e0"
+        )
+      );
+    if (t == "test_key_1")
+      return d.deserialize(
+        b(
+          "9069b82c7aae418cef27678291e7f2cb1a008a500eceba7199bffca12421b07c158987c6a22618af3d1958738b2835691028801f7663d311799733286c557c8979184bb62cb559a4d582fca7d2e48b860f08ed6641aef66a059ec891889a6218"
+        )
+      );
+    if (t == "dfx_test_key")
+      return d.deserialize(
+        b(
+          "b181c14cf9d04ba45d782c0067a44b0aaa9fc2acf94f1a875f0dae801af4f80339a7e6bf8b09fcf993824c8df3080b3f1409b688ca08cbd44d2cb28db9899f4aa3b5f06b9174240448e10be2f01f9f80079ea5431ce2d11d1c8d1c775333315f"
+        )
+      );
+    throw new Error(
+      "Unknown PocketIcMasterPublicKeyId value for pocketicKey"
+    );
+  }
+  /**
+   * @internal constructor
+   */
+  constructor(t) {
+    this.#t = t;
+  }
+}
+class m {
+  #t;
+  /**
+   * Read a DerivedPublicKey from the bytestring encoding
+   *
+   * Normally the bytes provided here will have been returned by
+   * the `vetkd_public_key` management canister interface.
+   */
+  static deserialize(t) {
+    return new m(i.G2.Point.fromHex(t));
+  }
+  /**
+   * Perform second-stage derivation of a public key
+   *
+   * To create the derived public key in VetKD, a two step derivation is performed. The first step
+   * creates a key that is specific to the canister that is making VetKD requests to the
+   * management canister, sometimes called canister master key. The second step incorporates the
+   * "derivation context" value provided to the `vetkd_public_key` management canister interface.
+   *
+   * If `vetkd_public_key` is invoked with an empty derivation context, it simply returns the
+   * canister master key. Then the second derivation step can be done offline, using this
+   * function. This is useful if you wish to derive multiple keys without having to interact with
+   * the IC each time.
+   *
+   * If `context` is empty, then this simply returns the underlying key. This matches the behavior
+   * of `vetkd_public_key`
+   */
+  deriveSubKey(t) {
+    if (t.length === 0)
+      return this;
+    {
+      const e = "ic-vetkd-bls12-381-g2-context", r = this.publicKeyBytes(), s = new Uint8Array([
+        ...y(r),
+        ...y(t)
+      ]), o = P(s, e), c = i.G2.Point.BASE.multiply(o);
+      return new m(this.getPoint().add(c));
+    }
+  }
+  /**
+   * Return the bytestring encoding of the derived public key
+   *
+   * Applications would not normally need to call this, unless they
+   * are using VetKD for creating a random beacon, in which case
+   * these bytes are used by anyone verifying the beacon.
+   */
+  publicKeyBytes() {
+    return this.#t.toBytes(!0);
+  }
+  /**
+   * @internal getter returning the point element of the derived public key
+   *
+   * Applications would not normally need to call this
+   */
+  getPoint() {
+    return this.#t;
+  }
+  /**
+   * @internal constructor
+   *
+   * This is public for typing reasons but there should be no need
+   * for an application to call this.
+   */
+  constructor(t) {
+    this.#t = t;
+  }
+}
+function P(n, t) {
+  return i.G2.hashToScalar(n, { DST: t });
+}
+function U(n) {
+  if (typeof n == "string")
+    return new TextEncoder().encode(n);
+  const t = new Uint8Array(n.length);
+  return t.set(n), t;
+}
+function T(n, t) {
+  const e = new TextEncoder().encode(n), r = U(t), s = new Uint8Array(e.length + r.length);
+  return s.set(e, 0), s.set(r, e.length), s;
+}
+function A(n, t, e) {
+  const r = new Uint8Array();
+  return $(tt, n, r, t, e);
+}
+function nt(n, t) {
+  const e = "BLS_SIG_BLS12381G1_XMD:SHA-256_SSWU_RO_AUG_", r = n.publicKeyBytes(), s = new Uint8Array([...r, ...t]);
+  return i.G1.Point.fromAffine(
+    i.G1.hashToCurve(s, {
+      DST: e
+    }).toAffine()
+  );
+}
+function O(n, t, e) {
+  const r = n.publicKeyBytes(), s = new Uint8Array([...r, ...t]), c = i.shortSignatures.hash(
+    s,
+    "BLS_SIG_BLS12381G1_XMD:SHA-256_SSWU_RO_AUG_"
+  );
+  return i.shortSignatures.verify(
+    e,
+    c,
+    n.getPoint()
+  );
+}
+class _ {
+  #t;
+  #e;
+  /**
+   * Return the VetKey bytes, aka the BLS signature
+   *
+   * Use the raw bytes only if your design makes use of the fact that VetKeys
+   * are BLS signatures (eg for random beacon or threshold BLS signature
+   * generation). If you are using VetKD for key distribution, instead use
+   * deriveSymmetricKey or asHkdfCryptoKey
+   */
+  signatureBytes() {
+    return this.#e;
+  }
+  /**
+   * Return the serialization of the VetKey
+   *
+   * This is the byte encoding of the unencrypted VetKey.
+   */
+  serialize() {
+    return this.#e;
+  }
+  /**
+   * Derive a symmetric key of the requested length from the VetKey
+   *
+   * As an alternative to this function consider using asDerivedKeyMaterial,
+   * which uses the WebCrypto API and prevents export of the underlying key.
+   *
+   * The `domainSep` parameter should be a string unique to your application and
+   * also your usage of the resulting key. For example say your application
+   * "my-app" is deriving two keys, one for usage "foo" and the other for
+   * "bar". You might use as domain separators "my-app-foo" and "my-app-bar".
+   *
+   * The returned Uint8Array will be `outputLength` bytes long.
+   */
+  deriveSymmetricKey(t, e) {
+    return A(this.#e, t, e);
+  }
+  /**
+   * Return a DerivedKeyMaterial type which is suitable for further key derivation
+   */
+  async asDerivedKeyMaterial() {
+    return v.setup(this.#e);
+  }
+  /**
+   * Deserialize a VetKey from the 48 byte encoding of the BLS signature
+   *
+   * This deserializes the same value as returned by serialize (or signatureBytes)
+   */
+  static deserialize(t) {
+    return new _(i.G1.Point.fromHex(t));
+  }
+  /**
+   * @internal getter returning the point object of the VetKey
+   *
+   * Applications would not usually need to call this
+   */
+  getPoint() {
+    return this.#t;
+  }
+  /**
+   * @internal constructor
+   *
+   * This is public for typing reasons but there is no reason for an application
+   * to call this constructor.
+   */
+  constructor(t) {
+    this.#t = t, this.#e = new Uint8Array(t.toBytes(!0));
+  }
+}
+const E = 12, R = 2, D = "IC GCMv2", C = new TextEncoder().encode(
+  D
+), g = 8;
+class v {
+  #t;
+  #e;
+  /**
+   * @internal constructor
+   */
+  constructor(t, e) {
+    this.#t = t, this.#e = e;
+  }
+  static async fromCryptoKey(t) {
+    const e = {
+      name: "HKDF",
+      hash: "SHA-256",
+      info: new TextEncoder().encode(
+        "ic-vetkd-bls12-381-g2-derived-key-material"
+      ),
+      salt: new Uint8Array()
+    }, r = {
+      name: "AES-GCM",
+      length: 256
+    }, s = await crypto.subtle.deriveKey(
+      e,
+      t,
+      r,
+      !0,
+      // exportable
+      ["encrypt"]
+    ), o = await crypto.subtle.exportKey(
+      "raw",
+      s
+    ), c = await crypto.subtle.importKey(
+      "raw",
+      o,
+      { name: "HKDF" },
+      !1,
+      ["deriveKey", "deriveBits"]
+    );
+    return new v(c, t);
+  }
+  /**
+   * @internal constructor
+   */
+  static async setup(t) {
+    const r = await globalThis.crypto.subtle.importKey(
+      "raw",
+      t,
+      "HKDF",
+      !1,
+      ["deriveKey", "deriveBits"]
+    );
+    return v.fromCryptoKey(r);
+  }
+  /**
+   * Return the CryptoKey
+   */
+  getCryptoKey() {
+    return this.#e;
+  }
+  /**
+   * Return a WebCrypto CryptoKey handle suitable for AES-GCM encryption/decryption
+   *
+   * The key is derived using HKDF with the provided domain separator
+   *
+   * The CryptoKey is not exportable
+   */
+  async deriveAesGcmCryptoKey(t, e) {
+    const r = {
+      name: "HKDF",
+      hash: "SHA-256",
+      length: 256,
+      info: T(
+        "ic-vetkd-bls12-381-g2-aes-gcm-v" + e.toString() + "-",
+        t
+      ),
+      salt: new Uint8Array()
+    }, s = {
+      name: "AES-GCM",
+      length: 256
+    };
+    return globalThis.crypto.subtle.deriveKey(
+      r,
+      this.#t,
+      s,
+      !1,
+      ["encrypt", "decrypt"]
+    );
+  }
+  /**
+   * Encrypt the provided message using AES-GCM and a key derived using HKDF
+   *
+   * The GCM key is derived using HKDF with the provided domain separator
+   */
+  async encryptMessage(t, e, r) {
+    const s = await this.deriveAesGcmCryptoKey(
+      e,
+      R
+    ), o = globalThis.crypto.getRandomValues(
+      new Uint8Array(E)
+    ), c = T(D, r), u = new Uint8Array(
+      await globalThis.crypto.subtle.encrypt(
+        { name: "AES-GCM", iv: o, additionalData: c },
+        s,
+        U(t)
+      )
+    );
+    return new Uint8Array([
+      ...C,
+      ...o,
+      ...u
+    ]);
+  }
+  /**
+   * Decrypt the provided ciphertext using AES-GCM and a key derived using HKDF
+   *
+   * The GCM key is derived using HKDF with the provided domain separator
+   */
+  async decryptMessage(t, e, r) {
+    const o = g + E + 16;
+    if (t.length < o)
+      throw new Error(
+        "Invalid ciphertext, too short to possibly be valid"
+      );
+    const c = t.slice(0, g);
+    if (!z(c, C))
+      if (r.length == 0) {
+        const w = t.slice(
+          0,
+          E
+        ), X = t.slice(
+          E
+        ), q = {
+          name: "HKDF",
+          hash: "SHA-256",
+          length: 256,
+          info: U(e),
+          salt: new Uint8Array()
+        }, j = {
+          name: "AES-GCM",
+          length: 256
+        }, J = await globalThis.crypto.subtle.deriveKey(
+          q,
+          this.#e,
+          j,
+          !1,
+          ["decrypt"]
+        );
+        try {
+          const Q = await globalThis.crypto.subtle.decrypt(
+            { name: "AES-GCM", iv: w },
+            J,
+            X
+          );
+          return new Uint8Array(Q);
+        } catch {
+          throw new Error("Decryption failed");
+        }
+      } else
+        throw new Error(
+          "Unknown header for AES-GCM encrypted ciphertext"
+        );
+    const u = T(D, r), p = t.slice(
+      g,
+      g + E
+    ), G = t.slice(
+      g + E
+    ), K = await this.deriveAesGcmCryptoKey(
+      e,
+      R
+    );
+    try {
+      const w = await globalThis.crypto.subtle.decrypt(
+        { name: "AES-GCM", iv: p, additionalData: u },
+        K,
+        G
+      );
+      return new Uint8Array(w);
+    } catch {
+      throw new Error("Decryption failed");
+    }
+  }
+}
+class N {
+  #t;
+  #e;
+  #r;
+  /**
+   * Parse an encrypted key returned by the `vetkd_derive_encrypted_key`
+   * managment canister interface
+   */
+  static deserialize(t) {
+    if (t.length !== l + a + l)
+      throw new Error("Invalid EncryptedVetKey serialization");
+    const e = i.G1.Point.fromHex(t.subarray(0, l)), r = i.G2.Point.fromHex(
+      t.subarray(l, l + a)
+    ), s = i.G1.Point.fromHex(
+      t.subarray(l + a)
+    );
+    return new N(e, r, s);
+  }
+  /**
+   * Decrypt the encrypted key returning a VetKey
+   */
+  decryptAndVerify(t, e, r) {
+    const s = i.G1.Point.BASE, o = i.G2.Point.BASE.negate(), c = i.fields.Fp12.ONE, u = i.pairingBatch([
+      { g1: this.#t, g2: o },
+      { g1: s, g2: this.#e }
+    ]);
+    if (!i.fields.Fp12.eql(u, c))
+      throw new Error("Invalid VetKey");
+    const p = this.#r.subtract(
+      this.#t.multiply(i.G1.Point.Fn.fromBytes(t.serialize()))
+    );
+    if (O(e, r, p))
+      return new _(p);
+    throw new Error("Invalid VetKey");
+  }
+  /**
+   * @internal constructor
+   */
+  constructor(t, e, r) {
+    this.#t = t, this.#e = e, this.#r = r;
+  }
+}
+const V = new Uint8Array([
+  73,
+  67,
+  32,
+  73,
+  66,
+  69,
+  0,
+  1
+]), f = 8;
+function M(n, t, e) {
+  const r = new Uint8Array([...n, ...t, ...e]);
+  return P(
+    r,
+    "ic-vetkd-bls12-381-ibe-hash-to-mask"
+    /* HashToMask */
+  );
+}
+function W(n, t) {
+  if (n.length !== t.length)
+    throw new Error("xorBuf arguments should have the same length");
+  const e = new Uint8Array(n.length);
+  for (let r = 0; r < n.length; r++)
+    e[r] = n[r] ^ t[r];
+  return e;
+}
+function L(n, t) {
+  if (t.length !== 576)
+    throw new Error("Unexpected size for Gt element");
+  const e = A(
+    t,
+    "ic-vetkd-bls12-381-ibe-mask-seed",
+    n.length
+  );
+  return W(e, n);
+}
+function Y(n, t) {
+  const e = "ic-vetkd-bls12-381-ibe-mask-msg-".concat(
+    n.length.toString().padStart(20, "0")
+  ), r = A(t, e, 32), s = Z(r, { dkLen: n.length });
+  return W(n, s);
+}
+function F(n) {
+  const t = i.fields.Fp12.toBytes(n), e = new Uint8Array(576), r = [11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0];
+  for (let s = 0; s < 12; ++s)
+    for (let o = 0; o < 48; ++o)
+      e[48 * s + o] = t[48 * r[s] + o];
+  return e;
+}
+function z(n, t) {
+  if (n.length !== t.length)
+    return !1;
+  let e = 0;
+  for (let r = 0; r < n.length; ++r)
+    e |= n[r] ^ t[r];
+  return e == 0;
+}
+class B {
+  #t;
+  constructor(t) {
+    this.#t = t;
+  }
+  /**
+   * Create an identity from a byte string
+   */
+  static fromBytes(t) {
+    return new B(t);
+  }
+  /**
+   * Create an identity from a string
+   */
+  static fromString(t) {
+    return B.fromBytes(new TextEncoder().encode(t));
+  }
+  /**
+   * Create an identity from a Principal
+   */
+  static fromPrincipal(t) {
+    return B.fromBytes(t.toUint8Array());
+  }
+  /**
+   * @internal getter returning the encoded
+   */
+  getBytes() {
+    return this.#t;
+  }
+}
+const h = 32;
+class S {
+  #t;
+  constructor(t) {
+    if (t.length !== h)
+      throw new Error("IBE seed must be exactly IBE_SEED_BYTES long");
+    this.#t = t;
+  }
+  /**
+   * Create a seed for IBE encryption from a byte string
+   *
+   * This input should be randomly chosen by a secure random number generator.
+   * If the seed is not securely generated the IBE scheme will be insecure.
+   *
+   * At least 128 bits (16 bytes) must be provided.
+   *
+   * If the input is exactly 256 bits it is used directly. Otherwise the input
+   * is hashed with HKDF to produce a 256 bit seed.
+   */
+  static fromBytes(t) {
+    if (t.length < 16)
+      throw new Error(
+        "Insufficient input material for IbeSeed derivation"
+      );
+    return t.length == h ? new S(t) : new S(
+      A(
+        t,
+        "ic-vetkd-bls12-381-ibe-hash-seed",
+        h
+      )
+    );
+  }
+  /**
+   * Create a random seed for IBE encryption
+   */
+  static random() {
+    return new S(
+      globalThis.crypto.getRandomValues(new Uint8Array(h))
+    );
+  }
+  /**
+   * @internal getter returning the seed bytes
+   */
+  getBytes() {
+    return this.#t;
+  }
+}
+const k = f + h + a;
+class H {
+  #t;
+  #e;
+  #r;
+  #n;
+  /**
+   * Helper function for determining the size of an IBE ciphertext in bytes.
+   */
+  static ciphertextSize(t) {
+    if (t < 0)
+      throw new Error(
+        "IbeCiphertext.ciphertextSize argument cannot be negative"
+      );
+    return t + k;
+  }
+  /**
+   * Helper function for determining the size of an IBE plaintext in bytes.
+   */
+  static plaintextSize(t) {
+    if (t < k)
+      throw new Error(
+        "IbeCiphertext.plaintextSize given ciphertext size is too small to be valid"
+      );
+    return t - k;
+  }
+  /**
+   * Serialize the IBE ciphertext to a bytestring
+   */
+  serialize() {
+    const t = this.#e.toBytes(!0);
+    return new Uint8Array([
+      ...this.#t,
+      ...t,
+      ...this.#r,
+      ...this.#n
+    ]);
+  }
+  /**
+   * Deserialize an IBE ciphertext
+   */
+  static deserialize(t) {
+    if (t.length < f + a + h)
+      throw new Error("Invalid IBE ciphertext");
+    const e = t.subarray(0, f), r = i.G2.Point.fromHex(
+      t.subarray(f, f + a)
+    ), s = t.subarray(
+      f + a,
+      f + a + h
+    ), o = t.subarray(f + a + h);
+    if (!z(e, V))
+      throw new Error("Unexpected header for IBE ciphertext");
+    return new H(e, r, s, o);
+  }
+  /**
+   * Encrypt a message using IBE, returning the ciphertext
+   *
+   * Any user who is able to retrieve the VetKey for the specified derived public key and
+   * identity will be able to decrypt this message.
+   *
+   * There is no fixed upper bound on the size of the message that can be encrypted using
+   * this scheme. However, internally during the encryption process several heap allocations
+   * are performed which are approximately the same length as the message itself, so
+   * encrypting or decrypting very large messages may result in memory allocation errors.
+   *
+   * If you anticipate using IBE to encrypt very large messages, consider using IBE just to
+   * encrypt a symmetric key, and then using a standard cipher such as AES-GCM to encrypt the
+   * data.
+   *
+   * The seed parameter must be a randomly generated value that was generated just for this
+   * one message. Using it for a second message, or for any other purpose, compromises the
+   * security of the IBE scheme.
+   */
+  static encrypt(t, e, r, s) {
+    const o = V, c = M(o, s.getBytes(), r), u = nt(t, e.getBytes()), p = i.fields.Fp12.pow(
+      i.pairing(u, t.getPoint()),
+      c
+    ), G = i.G2.Point.BASE.multiply(c), K = L(s.getBytes(), F(p)), w = Y(r, s.getBytes());
+    return new H(o, G, K, w);
+  }
+  /**
+   * Decrypt an IBE ciphertext, returning the message
+   *
+   * There is no fixed upper bound on the size of the message that can be encrypted using
+   * this scheme. However, internally during the encryption process several heap allocations
+   * are performed which are approximately the same length as the message itself, so
+   * encrypting or decrypting very large messages may result in memory allocation errors.
+   */
+  decrypt(t) {
+    const e = L(
+      this.#r,
+      F(i.pairing(t.getPoint(), this.#e))
+    ), r = Y(this.#n, e), s = M(this.#t, e, r);
+    if (z(
+      i.G2.Point.BASE.multiply(s).toBytes(!0),
+      this.#e.toBytes(!0)
+    ))
+      return r;
+    throw new Error("Decryption failed");
+  }
+  /**
+   * Private constructor
+   */
+  constructor(t, e, r, s) {
+    this.#t = t, this.#e = e, this.#r = r, this.#n = s;
+  }
+}
+const st = 32;
+class I {
+  #t;
+  #e;
+  #r;
+  #n;
+  static computeVrfHash(t, e, r) {
+    const s = new Uint8Array([
+      ...y(t.serialize()),
+      ...y(e.publicKeyBytes()),
+      ...y(r)
+    ]);
+    return A(
+      s,
+      "ic-vetkd-bls12-381-g2-vrf",
+      st
+    );
+  }
+  /**
+   * Serialize a VrfOutput to a byte string
+   */
+  serialize() {
+    return new Uint8Array([
+      ...this.#t.serialize(),
+      ...this.#e.publicKeyBytes(),
+      ...this.#r
+    ]);
+  }
+  /**
+   * Deserialize and verify a VrfOutput
+   *
+   * Note this verifies the VrfOutput with respect to the derived public key
+   * and VRF input which are included in the struct. It is the responsibility
+   * of the application to examine the return value of `publicKey` and `input`
+   * and ensure these values make sense in the context where this VRF is being
+   * used.
+   */
+  static deserialize(t) {
+    if (t.length < l + a)
+      throw new Error(
+        "VrfOutput.deserialize input too short to possibly be valid"
+      );
+    const e = _.deserialize(t.slice(0, l)), r = m.deserialize(
+      t.slice(l, l + a)
+    ), s = t.slice(l + a);
+    if (!O(r, s, e.getPoint()))
+      throw new Error("VrfOutput.deserialize proof is invalid");
+    return new I(e, r, s);
+  }
+  /**
+   * Return the public key under which this VRF output was derived
+   */
+  publicKey() {
+    return this.#e;
+  }
+  /**
+   * Return the input that was used to create this VRF output
+   */
+  input() {
+    return this.#r;
+  }
+  /**
+   * Return the VRF output
+   *
+   * This is a random-looking value which was provably generated by some party with
+   * access to the VRF secret key.
+   */
+  output() {
+    return this.#n;
+  }
+  /**
+   * Private constructor
+   */
+  constructor(t, e, r) {
+    this.#t = t, this.#e = e, this.#r = r, this.#n = I.computeVrfHash(t, e, r);
+  }
+}
+export {
+  v as D,
+  N as E,
+  H as I,
+  d as M,
+  rt as P,
+  x as T,
+  _ as V,
+  m as a,
+  B as b,
+  S as c,
+  et as d,
+  I as e,
+  nt as f,
+  A as g,
+  P as h,
+  lt as i,
+  O as v
+};