@noble/curves 0.5.2 → 0.6.1

package/lib/esm/abstract/weierstrass.js

@@ -1,74 +1,25 @@
 /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
 // Short Weierstrass curve. The formula is: y² = x³ + ax + b
-// Differences from @noble/secp256k1 1.7:
-// 1. Different double() formula (but same addition)
-// 2. Different sqrt() function
-// 3. truncateHash() truncateOnly mode
-// 4. DRBG supports outputLen bigger than outputLen of hmac
-// 5. Support for different hash functions
 import * as mod from './modular.js';
 import * as ut from './utils.js';
-import { bytesToHex } from './utils.js';
-import { hash_to_field, validateHTFOpts } from './hash-to-curve.js';
-import { wNAF } from './group.js';
-// ASN.1 DER encoding utilities
-class DERError extends Error {
-    constructor(message) {
-        super(message);
-    }
-}
-const DER = {
-    slice(s) {
-        // Proof: any([(i>=0x80) == (int(hex(i).replace('0x', '').zfill(2)[0], 16)>=8)  for i in range(0, 256)])
-        // Padding done by numberToHex
-        return Number.parseInt(s[0], 16) >= 8 ? '00' + s : s;
-    },
-    parseInt(data) {
-        if (data.length < 2 || data[0] !== 0x02) {
-            throw new DERError(`Invalid signature integer tag: ${bytesToHex(data)}`);
-        }
-        const len = data[1];
-        const res = data.subarray(2, len + 2);
-        if (!len || res.length !== len) {
-            throw new DERError(`Invalid signature integer: wrong length`);
-        }
-        // Strange condition, its not about length, but about first bytes of number.
-        if (res[0] === 0x00 && res[1] <= 0x7f) {
-            throw new DERError('Invalid signature integer: trailing length');
-        }
-        return { data: ut.bytesToNumberBE(res), left: data.subarray(len + 2) };
-    },
-    parseSig(data) {
-        if (data.length < 2 || data[0] != 0x30) {
-            throw new DERError(`Invalid signature tag: ${bytesToHex(data)}`);
-        }
-        if (data[1] !== data.length - 2) {
-            throw new DERError('Invalid signature: incorrect length');
-        }
-        const { data: r, left: sBytes } = DER.parseInt(data.subarray(2));
-        const { data: s, left: rBytesLeft } = DER.parseInt(sBytes);
-        if (rBytesLeft.length) {
-            throw new DERError(`Invalid signature: left bytes after parsing: ${bytesToHex(rBytesLeft)}`);
-        }
-        return { r, s };
-    },
-};
+import { ensureBytes } from './utils.js';
+import { wNAF, validateBasic } from './curve.js';
 function validatePointOpts(curve) {
-    const opts = ut.validateOpts(curve);
-    const Fp = opts.Fp;
-    for (const i of ['a', 'b']) {
-        if (!Fp.isValid(curve[i]))
-            throw new Error(`Invalid curve param ${i}=${opts[i]} (${typeof opts[i]})`);
-    }
-    for (const i of ['isTorsionFree', 'clearCofactor', 'mapToCurve']) {
-        if (curve[i] === undefined)
-            continue; // Optional
-        if (typeof curve[i] !== 'function')
-            throw new Error(`Invalid ${i} function`);
-    }
-    const endo = opts.endo;
+    const opts = validateBasic(curve);
+    ut.validateObject(opts, {
+        a: 'field',
+        b: 'field',
+        fromBytes: 'function',
+        toBytes: 'function',
+    }, {
+        allowedPrivateKeyLengths: 'array',
+        wrapPrivateKey: 'boolean',
+        isTorsionFree: 'function',
+        clearCofactor: 'function',
+    });
+    const { endo, Fp, a } = opts;
     if (endo) {
-        if (!Fp.equals(opts.a, Fp.ZERO)) {
+        if (!Fp.eql(a, Fp.ZERO)) {
             throw new Error('Endomorphism can only be defined for Koblitz curves that have a=0');
         }
         if (typeof endo !== 'object' ||
@@ -77,20 +28,65 @@ function validatePointOpts(curve) {
             throw new Error('Expected endomorphism with beta: bigint and splitScalar: function');
         }
     }
-    if (typeof opts.fromBytes !== 'function')
-        throw new Error('Invalid fromBytes function');
-    if (typeof opts.toBytes !== 'function')
-        throw new Error('Invalid fromBytes function');
-    // Requires including hashToCurve file
-    if (opts.htfDefaults !== undefined)
-        validateHTFOpts(opts.htfDefaults);
-    // Set defaults
     return Object.freeze({ ...opts });
 }
+// ASN.1 DER encoding utilities
+const { bytesToNumberBE: b2n, hexToBytes: h2b } = ut;
+const DER = {
+    // asn.1 DER encoding utils
+    Err: class DERErr extends Error {
+        constructor(m = '') {
+            super(m);
+        }
+    },
+    _parseInt(data) {
+        const { Err: E } = DER;
+        if (data.length < 2 || data[0] !== 0x02)
+            throw new E('Invalid signature integer tag');
+        const len = data[1];
+        const res = data.subarray(2, len + 2);
+        if (!len || res.length !== len)
+            throw new E('Invalid signature integer: wrong length');
+        if (res[0] === 0x00 && res[1] <= 0x7f)
+            throw new E('Invalid signature integer: trailing length');
+        // ^ Weird condition: not about length, but about first bytes of number.
+        return { d: b2n(res), l: data.subarray(len + 2) }; // d is data, l is left
+    },
+    toSig(hex) {
+        // parse DER signature
+        const { Err: E } = DER;
+        const data = typeof hex === 'string' ? h2b(hex) : hex;
+        if (!(data instanceof Uint8Array))
+            throw new Error('ui8a expected');
+        let l = data.length;
+        if (l < 2 || data[0] != 0x30)
+            throw new E('Invalid signature tag');
+        if (data[1] !== l - 2)
+            throw new E('Invalid signature: incorrect length');
+        const { d: r, l: sBytes } = DER._parseInt(data.subarray(2));
+        const { d: s, l: rBytesLeft } = DER._parseInt(sBytes);
+        if (rBytesLeft.length)
+            throw new E('Invalid signature: left bytes after parsing');
+        return { r, s };
+    },
+    hexFromSig(sig) {
+        const slice = (s) => (Number.parseInt(s[0], 16) >= 8 ? '00' + s : s); // slice DER
+        const h = (num) => {
+            const hex = num.toString(16);
+            return hex.length & 1 ? `0${hex}` : hex;
+        };
+        const s = slice(h(sig.s));
+        const r = slice(h(sig.r));
+        const shl = s.length / 2;
+        const rhl = r.length / 2;
+        const sl = h(shl);
+        const rl = h(rhl);
+        return `30${h(rhl + shl + 4)}02${rl}${r}02${sl}${s}`;
+    },
+};
 // Be friendly to bad ECMAScript parsers by not using bigint literals like 123n
 const _0n = BigInt(0);
 const _1n = BigInt(1);
-const _3n = BigInt(3);
 export function weierstrassPoints(opts) {
     const CURVE = validatePointOpts(opts);
     const { Fp } = CURVE; // All curves has same field / group length as for now, but they can differ
@@ -100,115 +96,152 @@ export function weierstrassPoints(opts) {
      */
     function weierstrassEquation(x) {
         const { a, b } = CURVE;
-        const x2 = Fp.square(x); // x * x
+        const x2 = Fp.sqr(x); // x * x
         const x3 = Fp.mul(x2, x); // x2 * x
         return Fp.add(Fp.add(x3, Fp.mul(x, a)), b); // x3 + a * x + b
     }
     // Valid group elements reside in range 1..n-1
     function isWithinCurveOrder(num) {
-        return _0n < num && num < CURVE.n;
+        return typeof num === 'bigint' && _0n < num && num < CURVE.n;
     }
-    /**
-     * Validates if a private key is valid and converts it to bigint form.
-     * Supports two options, that are passed when CURVE is initialized:
-     * - `normalizePrivateKey()` executed before all checks
-     * - `wrapPrivateKey` when true, executed after most checks, but before `0 < key < n`
-     */
+    function assertGE(num) {
+        if (!isWithinCurveOrder(num))
+            throw new Error('Expected valid bigint: 0 < bigint < curve.n');
+    }
+    // Validates if priv key is valid and converts it to bigint.
+    // Supports options CURVE.normalizePrivateKey and CURVE.wrapPrivateKey.
     function normalizePrivateKey(key) {
-        const { normalizePrivateKey: custom, nByteLength: groupLen, wrapPrivateKey, n: order } = CURVE;
-        if (typeof custom === 'function')
-            key = custom(key);
-        let num;
-        if (typeof key === 'bigint') {
-            // Curve order check is done below
-            num = key;
-        }
-        else if (ut.isPositiveInt(key)) {
-            num = BigInt(key);
-        }
-        else if (typeof key === 'string') {
-            if (key.length !== 2 * groupLen)
-                throw new Error(`Expected ${groupLen} bytes of private key`);
-            // Validates individual octets
-            num = ut.hexToNumber(key);
+        const { allowedPrivateKeyLengths: lengths, nByteLength, wrapPrivateKey, n } = CURVE;
+        if (lengths && typeof key !== 'bigint') {
+            if (key instanceof Uint8Array)
+                key = ut.bytesToHex(key);
+            // Normalize to hex string, pad. E.g. P521 would norm 130-132 char hex to 132-char bytes
+            if (typeof key !== 'string' || !lengths.includes(key.length))
+                throw new Error('Invalid key');
+            key = key.padStart(nByteLength * 2, '0');
         }
-        else if (key instanceof Uint8Array) {
-            if (key.length !== groupLen)
-                throw new Error(`Expected ${groupLen} bytes of private key`);
-            num = ut.bytesToNumberBE(key);
+        let num;
+        try {
+            num = typeof key === 'bigint' ? key : ut.bytesToNumberBE(ensureBytes(key, nByteLength));
         }
-        else {
-            throw new TypeError('Expected valid private key');
+        catch (error) {
+            throw new Error(`private key must be ${nByteLength} bytes, hex or bigint, not ${typeof key}`);
         }
-        // Useful for curves with cofactor != 1
         if (wrapPrivateKey)
-            num = mod.mod(num, order);
-        if (!isWithinCurveOrder(num))
-            throw new Error('Expected private key: 0 < key < n');
+            num = mod.mod(num, n); // disabled by default, enabled for BLS
+        assertGE(num); // num in range [1..N-1]
         return num;
     }
-    /**
-     * Validates if a scalar ("private number") is valid.
-     * Scalars are valid only if they are less than curve order.
-     */
-    function normalizeScalar(num) {
-        if (ut.isPositiveInt(num))
-            return BigInt(num);
-        if (typeof num === 'bigint' && isWithinCurveOrder(num))
-            return num;
-        throw new TypeError('Expected valid private scalar: 0 < scalar < curve.n');
+    const pointPrecomputes = new Map();
+    function assertPrjPoint(other) {
+        if (!(other instanceof Point))
+            throw new Error('ProjectivePoint expected');
     }
     /**
      * Projective Point works in 3d / projective (homogeneous) coordinates: (x, y, z) ∋ (x=x/z, y=y/z)
      * Default Point works in 2d / affine coordinates: (x, y)
      * We're doing calculations in projective, because its operations don't require costly inversion.
      */
-    class ProjectivePoint {
-        constructor(x, y, z) {
-            this.x = x;
-            this.y = y;
-            this.z = z;
+    class Point {
+        constructor(px, py, pz) {
+            this.px = px;
+            this.py = py;
+            this.pz = pz;
+            if (px == null || !Fp.isValid(px))
+                throw new Error('x required');
+            if (py == null || !Fp.isValid(py))
+                throw new Error('y required');
+            if (pz == null || !Fp.isValid(pz))
+                throw new Error('z required');
         }
         static fromAffine(p) {
-            if (!(p instanceof Point)) {
-                throw new TypeError('ProjectivePoint#fromAffine: expected Point');
-            }
+            const { x, y } = p || {};
+            if (!p || !Fp.isValid(x) || !Fp.isValid(y))
+                throw new Error('invalid affine point');
+            if (p instanceof Point)
+                throw new Error('projective point not allowed');
+            const is0 = (i) => Fp.eql(i, Fp.ZERO);
             // fromAffine(x:0, y:0) would produce (x:0, y:0, z:1), but we need (x:0, y:1, z:0)
-            if (p.equals(Point.ZERO))
-                return ProjectivePoint.ZERO;
-            return new ProjectivePoint(p.x, p.y, Fp.ONE);
+            if (is0(x) && is0(y))
+                return Point.ZERO;
+            return new Point(x, y, Fp.ONE);
+        }
+        get x() {
+            return this.toAffine().x;
+        }
+        get y() {
+            return this.toAffine().y;
         }
         /**
          * Takes a bunch of Projective Points but executes only one
          * inversion on all of them. Inversion is very slow operation,
          * so this improves performance massively.
+         * Optimization: converts a list of projective points to a list of identical points with Z=1.
          */
-        static toAffineBatch(points) {
-            const toInv = Fp.invertBatch(points.map((p) => p.z));
-            return points.map((p, i) => p.toAffine(toInv[i]));
+        static normalizeZ(points) {
+            const toInv = Fp.invertBatch(points.map((p) => p.pz));
+            return points.map((p, i) => p.toAffine(toInv[i])).map(Point.fromAffine);
         }
         /**
-         * Optimization: converts a list of projective points to a list of identical points with Z=1.
+         * Converts hash string or Uint8Array to Point.
+         * @param hex short/long ECDSA hex
          */
-        static normalizeZ(points) {
-            return ProjectivePoint.toAffineBatch(points).map(ProjectivePoint.fromAffine);
+        static fromHex(hex) {
+            const P = Point.fromAffine(CURVE.fromBytes(ensureBytes(hex)));
+            P.assertValidity();
+            return P;
+        }
+        // Multiplies generator point by privateKey.
+        static fromPrivateKey(privateKey) {
+            return Point.BASE.multiply(normalizePrivateKey(privateKey));
+        }
+        // "Private method", don't use it directly
+        _setWindowSize(windowSize) {
+            this._WINDOW_SIZE = windowSize;
+            pointPrecomputes.delete(this);
+        }
+        // A point on curve is valid if it conforms to equation.
+        assertValidity() {
+            // Zero is valid point too!
+            if (this.is0()) {
+                if (CURVE.allowInfinityPoint)
+                    return;
+                throw new Error('bad point: ZERO');
+            }
+            // Some 3rd-party test vectors require different wording between here & `fromCompressedHex`
+            const { x, y } = this.toAffine();
+            // Check if x, y are valid field elements
+            if (!Fp.isValid(x) || !Fp.isValid(y))
+                throw new Error('bad point: x or y not FE');
+            const left = Fp.sqr(y); // y²
+            const right = weierstrassEquation(x); // x³ + ax + b
+            if (!Fp.eql(left, right))
+                throw new Error('bad point: equation left != right');
+            if (!this.isTorsionFree())
+                throw new Error('bad point: not in prime-order subgroup');
+        }
+        hasEvenY() {
+            const { y } = this.toAffine();
+            if (Fp.isOdd)
+                return !Fp.isOdd(y);
+            throw new Error("Field doesn't support isOdd");
         }
         /**
          * Compare one point to another.
          */
         equals(other) {
             assertPrjPoint(other);
-            const { x: X1, y: Y1, z: Z1 } = this;
-            const { x: X2, y: Y2, z: Z2 } = other;
-            const U1 = Fp.equals(Fp.mul(X1, Z2), Fp.mul(X2, Z1));
-            const U2 = Fp.equals(Fp.mul(Y1, Z2), Fp.mul(Y2, Z1));
+            const { px: X1, py: Y1, pz: Z1 } = this;
+            const { px: X2, py: Y2, pz: Z2 } = other;
+            const U1 = Fp.eql(Fp.mul(X1, Z2), Fp.mul(X2, Z1));
+            const U2 = Fp.eql(Fp.mul(Y1, Z2), Fp.mul(Y2, Z1));
             return U1 && U2;
         }
         /**
          * Flips point to one corresponding to (x, -y) in Affine coordinates.
          */
         negate() {
-            return new ProjectivePoint(this.x, Fp.negate(this.y), this.z);
+            return new Point(this.px, Fp.neg(this.py), this.pz);
         }
         // Renes-Costello-Batina exception-free doubling formula.
         // There is 30% faster Jacobian formula, but it is not complete.
@@ -217,7 +250,7 @@ export function weierstrassPoints(opts) {
         double() {
             const { a, b } = CURVE;
             const b3 = Fp.mul(b, 3n);
-            const { x: X1, y: Y1, z: Z1 } = this;
+            const { px: X1, py: Y1, pz: Z1 } = this;
             let X3 = Fp.ZERO, Y3 = Fp.ZERO, Z3 = Fp.ZERO; // prettier-ignore
             let t0 = Fp.mul(X1, X1); // step 1
             let t1 = Fp.mul(Y1, Y1);
@@ -250,7 +283,7 @@ export function weierstrassPoints(opts) {
             Z3 = Fp.mul(t2, t1);
             Z3 = Fp.add(Z3, Z3); // step 30
             Z3 = Fp.add(Z3, Z3);
-            return new ProjectivePoint(X3, Y3, Z3);
+            return new Point(X3, Y3, Z3);
         }
         // Renes-Costello-Batina exception-free addition formula.
         // There is 30% faster Jacobian formula, but it is not complete.
@@ -258,8 +291,8 @@ export function weierstrassPoints(opts) {
         // Cost: 12M + 0S + 3*a + 3*b3 + 23add.
         add(other) {
             assertPrjPoint(other);
-            const { x: X1, y: Y1, z: Z1 } = this;
-            const { x: X2, y: Y2, z: Z2 } = other;
+            const { px: X1, py: Y1, pz: Z1 } = this;
+            const { px: X2, py: Y2, pz: Z2 } = other;
             let X3 = Fp.ZERO, Y3 = Fp.ZERO, Z3 = Fp.ZERO; // prettier-ignore
             const a = CURVE.a;
             const b3 = Fp.mul(CURVE.b, 3n);
@@ -303,30 +336,39 @@ export function weierstrassPoints(opts) {
             t0 = Fp.mul(t3, t1);
             Z3 = Fp.mul(t5, Z3);
             Z3 = Fp.add(Z3, t0); // step 40
-            return new ProjectivePoint(X3, Y3, Z3);
+            return new Point(X3, Y3, Z3);
         }
         subtract(other) {
             return this.add(other.negate());
         }
+        is0() {
+            return this.equals(Point.ZERO);
+        }
+        wNAF(n) {
+            return wnaf.wNAFCached(this, pointPrecomputes, n, (comp) => {
+                const toInv = Fp.invertBatch(comp.map((p) => p.pz));
+                return comp.map((p, i) => p.toAffine(toInv[i])).map(Point.fromAffine);
+            });
+        }
         /**
          * Non-constant-time multiplication. Uses double-and-add algorithm.
          * It's faster, but should only be used when you don't care about
          * an exposed private key e.g. sig verification, which works over *public* keys.
          */
-        multiplyUnsafe(scalar) {
-            const P0 = ProjectivePoint.ZERO;
-            if (typeof scalar === 'bigint' && scalar === _0n)
-                return P0;
-            // Will throw on 0
-            let n = normalizeScalar(scalar);
+        multiplyUnsafe(n) {
+            const I = Point.ZERO;
+            if (n === _0n)
+                return I;
+            assertGE(n); // Will throw on 0
             if (n === _1n)
                 return this;
-            if (!CURVE.endo)
+            const { endo } = CURVE;
+            if (!endo)
                 return wnaf.unsafeLadder(this, n);
             // Apply endomorphism
-            let { k1neg, k1, k2neg, k2 } = CURVE.endo.splitScalar(n);
-            let k1p = P0;
-            let k2p = P0;
+            let { k1neg, k1, k2neg, k2 } = endo.splitScalar(n);
+            let k1p = I;
+            let k2p = I;
             let d = this;
             while (k1 > _0n || k2 > _0n) {
                 if (k1 & _1n)
@@ -341,27 +383,9 @@ export function weierstrassPoints(opts) {
                 k1p = k1p.negate();
             if (k2neg)
                 k2p = k2p.negate();
-            k2p = new ProjectivePoint(Fp.mul(k2p.x, CURVE.endo.beta), k2p.y, k2p.z);
+            k2p = new Point(Fp.mul(k2p.px, endo.beta), k2p.py, k2p.pz);
             return k1p.add(k2p);
         }
-        /**
-         * Implements w-ary non-adjacent form for calculating ec multiplication.
-         */
-        wNAF(n, affinePoint) {
-            if (!affinePoint && this.equals(ProjectivePoint.BASE))
-                affinePoint = Point.BASE;
-            const W = (affinePoint && affinePoint._WINDOW_SIZE) || 1;
-            // Calculate precomputes on a first run, reuse them after
-            let precomputes = affinePoint && pointPrecomputes.get(affinePoint);
-            if (!precomputes) {
-                precomputes = wnaf.precomputeWindow(this, W);
-                if (affinePoint && W !== 1) {
-                    precomputes = ProjectivePoint.normalizeZ(precomputes);
-                    pointPrecomputes.set(affinePoint, precomputes);
-                }
-            }
-            return wnaf.wNAF(W, precomputes, n);
-        }
         /**
          * Constant time multiplication.
          * Uses wNAF method. Windowed method may be 10% faster,
@@ -370,55 +394,65 @@ export function weierstrassPoints(opts) {
          * @param affinePoint optional point ot save cached precompute windows on it
          * @returns New point
          */
-        multiply(scalar, affinePoint) {
-            let n = normalizeScalar(scalar);
-            // Real point.
-            let point;
-            // Fake point, we use it to achieve constant-time multiplication.
-            let fake;
-            if (CURVE.endo) {
-                const { k1neg, k1, k2neg, k2 } = CURVE.endo.splitScalar(n);
-                let { p: k1p, f: f1p } = this.wNAF(k1, affinePoint);
-                let { p: k2p, f: f2p } = this.wNAF(k2, affinePoint);
+        multiply(scalar) {
+            assertGE(scalar);
+            let n = scalar;
+            let point, fake; // Fake point is used to const-time mult
+            const { endo } = CURVE;
+            if (endo) {
+                const { k1neg, k1, k2neg, k2 } = endo.splitScalar(n);
+                let { p: k1p, f: f1p } = this.wNAF(k1);
+                let { p: k2p, f: f2p } = this.wNAF(k2);
                 k1p = wnaf.constTimeNegate(k1neg, k1p);
                 k2p = wnaf.constTimeNegate(k2neg, k2p);
-                k2p = new ProjectivePoint(Fp.mul(k2p.x, CURVE.endo.beta), k2p.y, k2p.z);
+                k2p = new Point(Fp.mul(k2p.px, endo.beta), k2p.py, k2p.pz);
                 point = k1p.add(k2p);
                 fake = f1p.add(f2p);
             }
             else {
-                const { p, f } = this.wNAF(n, affinePoint);
+                const { p, f } = this.wNAF(n);
                 point = p;
                 fake = f;
             }
             // Normalize `z` for both points, but return only real one
-            return ProjectivePoint.normalizeZ([point, fake])[0];
+            return Point.normalizeZ([point, fake])[0];
+        }
+        /**
+         * Efficiently calculate `aP + bQ`. Unsafe, can expose private key, if used incorrectly.
+         * @returns non-zero affine point
+         */
+        multiplyAndAddUnsafe(Q, a, b) {
+            const G = Point.BASE; // No Strauss-Shamir trick: we have 10% faster G precomputes
+            const mul = (P, a // Select faster multiply() method
+            ) => (a === _0n || a === _1n || !P.equals(G) ? P.multiplyUnsafe(a) : P.multiply(a));
+            const sum = mul(this, a).add(mul(Q, b));
+            return sum.is0() ? undefined : sum;
         }
         // Converts Projective point to affine (x, y) coordinates.
         // Can accept precomputed Z^-1 - for example, from invertBatch.
         // (x, y, z) ∋ (x=x/z, y=y/z)
-        toAffine(invZ) {
-            const { x, y, z } = this;
-            const is0 = this.equals(ProjectivePoint.ZERO);
+        toAffine(iz) {
+            const { px: x, py: y, pz: z } = this;
+            const is0 = this.is0();
             // If invZ was 0, we return zero point. However we still want to execute
             // all operations, so we replace invZ with a random number, 1.
-            if (invZ == null)
-                invZ = is0 ? Fp.ONE : Fp.invert(z);
-            const ax = Fp.mul(x, invZ);
-            const ay = Fp.mul(y, invZ);
-            const zz = Fp.mul(z, invZ);
+            if (iz == null)
+                iz = is0 ? Fp.ONE : Fp.inv(z);
+            const ax = Fp.mul(x, iz);
+            const ay = Fp.mul(y, iz);
+            const zz = Fp.mul(z, iz);
             if (is0)
-                return Point.ZERO;
-            if (!Fp.equals(zz, Fp.ONE))
+                return { x: Fp.ZERO, y: Fp.ZERO };
+            if (!Fp.eql(zz, Fp.ONE))
                 throw new Error('invZ was invalid');
-            return new Point(ax, ay);
+            return { x: ax, y: ay };
         }
         isTorsionFree() {
             const { h: cofactor, isTorsionFree } = CURVE;
             if (cofactor === _1n)
                 return true; // No subgroups, always torsion-free
             if (isTorsionFree)
-                return isTorsionFree(ProjectivePoint, this);
+                return isTorsionFree(Point, this);
             throw new Error('isTorsionFree() has not been declared for the elliptic curve');
         }
         clearCofactor() {
@@ -426,227 +460,93 @@ export function weierstrassPoints(opts) {
             if (cofactor === _1n)
                 return this; // Fast-path
             if (clearCofactor)
-                return clearCofactor(ProjectivePoint, this);
+                return clearCofactor(Point, this);
             return this.multiplyUnsafe(CURVE.h);
         }
-    }
-    ProjectivePoint.BASE = new ProjectivePoint(CURVE.Gx, CURVE.Gy, Fp.ONE);
-    ProjectivePoint.ZERO = new ProjectivePoint(Fp.ZERO, Fp.ONE, Fp.ZERO);
-    const _bits = CURVE.nBitLength;
-    const wnaf = wNAF(ProjectivePoint, CURVE.endo ? Math.ceil(_bits / 2) : _bits);
-    function assertPrjPoint(other) {
-        if (!(other instanceof ProjectivePoint))
-            throw new TypeError('ProjectivePoint expected');
-    }
-    // Stores precomputed values for points.
-    const pointPrecomputes = new WeakMap();
-    /**
-     * Default Point works in default aka affine coordinates: (x, y)
-     */
-    class Point {
-        constructor(x, y) {
-            this.x = x;
-            this.y = y;
-        }
-        // "Private method", don't use it directly
-        _setWindowSize(windowSize) {
-            this._WINDOW_SIZE = windowSize;
-            pointPrecomputes.delete(this);
-        }
-        // Checks for y % 2 == 0
-        hasEvenY() {
-            if (Fp.isOdd)
-                return !Fp.isOdd(this.y);
-            throw new Error("Field doesn't support isOdd");
-        }
-        /**
-         * Converts hash string or Uint8Array to Point.
-         * @param hex short/long ECDSA hex
-         */
-        static fromHex(hex) {
-            const { x, y } = CURVE.fromBytes(ut.ensureBytes(hex));
-            const point = new Point(x, y);
-            point.assertValidity();
-            return point;
-        }
-        // Multiplies generator point by privateKey.
-        static fromPrivateKey(privateKey) {
-            return Point.BASE.multiply(normalizePrivateKey(privateKey));
-        }
-        toRawBytes(isCompressed = false) {
+        toRawBytes(isCompressed = true) {
             this.assertValidity();
             return CURVE.toBytes(Point, this, isCompressed);
         }
-        toHex(isCompressed = false) {
-            return bytesToHex(this.toRawBytes(isCompressed));
-        }
-        // A point on curve is valid if it conforms to equation.
-        assertValidity() {
-            // Zero is valid point too!
-            if (this.equals(Point.ZERO)) {
-                if (CURVE.allowInfinityPoint)
-                    return;
-                throw new Error('Point at infinity');
-            }
-            // Some 3rd-party test vectors require different wording between here & `fromCompressedHex`
-            const msg = 'Point is not on elliptic curve';
-            const { x, y } = this;
-            // Check if x, y are valid field elements
-            if (!Fp.isValid(x) || !Fp.isValid(y))
-                throw new Error(msg);
-            const left = Fp.square(y); // y²
-            const right = weierstrassEquation(x); // x³ + ax + b
-            if (!Fp.equals(left, right))
-                throw new Error(msg);
-            if (!this.isTorsionFree())
-                throw new Error('Point must be of prime-order subgroup');
-        }
-        equals(other) {
-            if (!(other instanceof Point))
-                throw new TypeError('Point#equals: expected Point');
-            return Fp.equals(this.x, other.x) && Fp.equals(this.y, other.y);
-        }
-        // Returns the same point with inverted `y`
-        negate() {
-            return new Point(this.x, Fp.negate(this.y));
-        }
-        toProj() {
-            return ProjectivePoint.fromAffine(this);
-        }
-        // Adds point to itself
-        double() {
-            return this.toProj().double().toAffine();
-        }
-        add(other) {
-            return this.toProj().add(ProjectivePoint.fromAffine(other)).toAffine();
-        }
-        subtract(other) {
-            return this.add(other.negate());
-        }
-        multiply(scalar) {
-            return this.toProj().multiply(scalar, this).toAffine();
-        }
-        multiplyUnsafe(scalar) {
-            return this.toProj().multiplyUnsafe(scalar).toAffine();
-        }
-        clearCofactor() {
-            return this.toProj().clearCofactor().toAffine();
-        }
-        isTorsionFree() {
-            return this.toProj().isTorsionFree();
-        }
-        /**
-         * Efficiently calculate `aP + bQ`.
-         * Unsafe, can expose private key, if used incorrectly.
-         * TODO: Utilize Shamir's trick
-         * @returns non-zero affine point
-         */
-        multiplyAndAddUnsafe(Q, a, b) {
-            const P = this.toProj();
-            const aP = a === _0n || a === _1n || this !== Point.BASE ? P.multiplyUnsafe(a) : P.multiply(a);
-            const bQ = ProjectivePoint.fromAffine(Q).multiplyUnsafe(b);
-            const sum = aP.add(bQ);
-            return sum.equals(ProjectivePoint.ZERO) ? undefined : sum.toAffine();
-        }
-        // Encodes byte string to elliptic curve
-        // https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hash-to-curve-11#section-3
-        static hashToCurve(msg, options) {
-            const { mapToCurve } = CURVE;
-            if (!mapToCurve)
-                throw new Error('CURVE.mapToCurve() has not been defined');
-            msg = ut.ensureBytes(msg);
-            const u = hash_to_field(msg, 2, { ...CURVE.htfDefaults, ...options });
-            const { x: x0, y: y0 } = mapToCurve(u[0]);
-            const { x: x1, y: y1 } = mapToCurve(u[1]);
-            return new Point(x0, y0).add(new Point(x1, y1)).clearCofactor();
-        }
-        // https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hash-to-curve-16#section-3
-        static encodeToCurve(msg, options) {
-            const { mapToCurve } = CURVE;
-            if (!mapToCurve)
-                throw new Error('CURVE.mapToCurve() has not been defined');
-            msg = ut.ensureBytes(msg);
-            const u = hash_to_field(msg, 1, { ...CURVE.htfDefaults, ...options });
-            const { x, y } = mapToCurve(u[0]);
-            return new Point(x, y).clearCofactor();
+        toHex(isCompressed = true) {
+            return ut.bytesToHex(this.toRawBytes(isCompressed));
         }
     }
-    /**
-     * Base point aka generator. Any public_key = Point.BASE * private_key
-     */
-    Point.BASE = new Point(CURVE.Gx, CURVE.Gy);
-    /**
-     * Identity point aka point at infinity. p - p = zero_p; p + zero_p = p
-     */
-    Point.ZERO = new Point(Fp.ZERO, Fp.ZERO);
+    Point.BASE = new Point(CURVE.Gx, CURVE.Gy, Fp.ONE);
+    Point.ZERO = new Point(Fp.ZERO, Fp.ONE, Fp.ZERO);
+    const _bits = CURVE.nBitLength;
+    const wnaf = wNAF(Point, CURVE.endo ? Math.ceil(_bits / 2) : _bits);
     return {
-        Point: Point,
-        ProjectivePoint: ProjectivePoint,
+        ProjectivePoint: Point,
         normalizePrivateKey,
         weierstrassEquation,
         isWithinCurveOrder,
     };
 }
 function validateOpts(curve) {
-    const opts = ut.validateOpts(curve);
-    if (typeof opts.hash !== 'function' || !ut.isPositiveInt(opts.hash.outputLen))
-        throw new Error('Invalid hash function');
-    if (typeof opts.hmac !== 'function')
-        throw new Error('Invalid hmac function');
-    if (typeof opts.randomBytes !== 'function')
-        throw new Error('Invalid randomBytes function');
-    // Set defaults
+    const opts = validateBasic(curve);
+    ut.validateObject(opts, {
+        hash: 'hash',
+        hmac: 'function',
+        randomBytes: 'function',
+    }, {
+        bits2int: 'function',
+        bits2int_modN: 'function',
+        lowS: 'boolean',
+    });
     return Object.freeze({ lowS: true, ...opts });
 }
-/**
- * Minimal HMAC-DRBG (NIST 800-90) for signatures.
- * Used only for RFC6979, does not fully implement DRBG spec.
- */
-class HmacDrbg {
-    constructor(hashLen, qByteLen, hmacFn) {
-        this.hashLen = hashLen;
-        this.qByteLen = qByteLen;
-        this.hmacFn = hmacFn;
-        if (typeof hashLen !== 'number' || hashLen < 2)
-            throw new Error('hashLen must be a number');
-        if (typeof qByteLen !== 'number' || qByteLen < 2)
-            throw new Error('qByteLen must be a number');
-        if (typeof hmacFn !== 'function')
-            throw new Error('hmacFn must be a function');
-        // Step B, Step C: set hashLen to 8*ceil(hlen/8)
-        this.v = new Uint8Array(hashLen).fill(1);
-        this.k = new Uint8Array(hashLen).fill(0);
-        this.counter = 0;
-    }
-    hmacSync(...values) {
-        return this.hmacFn(this.k, ...values);
-    }
-    incr() {
-        if (this.counter >= 1000)
-            throw new Error('Tried 1,000 k values for sign(), all were invalid');
-        this.counter += 1;
-    }
-    reseedSync(seed = new Uint8Array()) {
-        this.k = this.hmacSync(this.v, Uint8Array.from([0x00]), seed);
-        this.v = this.hmacSync(this.v);
+const u8n = (data) => new Uint8Array(data); // creates Uint8Array
+const u8fr = (arr) => Uint8Array.from(arr); // another shortcut
+function hmacDrbg(hashLen, qByteLen, hmacFn) {
+    if (typeof hashLen !== 'number' || hashLen < 2)
+        throw new Error('hashLen must be a number');
+    if (typeof qByteLen !== 'number' || qByteLen < 2)
+        throw new Error('qByteLen must be a number');
+    if (typeof hmacFn !== 'function')
+        throw new Error('hmacFn must be a function');
+    // Step B, Step C: set hashLen to 8*ceil(hlen/8)
+    let v = u8n(hashLen); // Minimal non-full-spec HMAC-DRBG from NIST 800-90 for RFC6979 sigs.
+    let k = u8n(hashLen); // Steps B and C of RFC6979 3.2: set hashLen, in our case always same
+    let i = 0; // Iterations counter, will throw when over 1000
+    const reset = () => {
+        v.fill(1);
+        k.fill(0);
+        i = 0;
+    };
+    const h = (...b) => hmacFn(k, v, ...b); // hmac(k)(v, ...values)
+    const reseed = (seed = u8n()) => {
+        // HMAC-DRBG reseed() function. Steps D-G
+        k = h(u8fr([0x00]), seed); // k = hmac(k || v || 0x00 || seed)
+        v = h(); // v = hmac(k || v)
         if (seed.length === 0)
             return;
-        this.k = this.hmacSync(this.v, Uint8Array.from([0x01]), seed);
-        this.v = this.hmacSync(this.v);
-    }
-    // TODO: review
-    generateSync() {
-        this.incr();
+        k = h(u8fr([0x01]), seed); // k = hmac(k || v || 0x01 || seed)
+        v = h(); // v = hmac(k || v)
+    };
+    const gen = () => {
+        // HMAC-DRBG generate() function
+        if (i++ >= 1000)
+            throw new Error('drbg: tried 1000 values');
         let len = 0;
         const out = [];
-        while (len < this.qByteLen) {
-            this.v = this.hmacSync(this.v);
-            const sl = this.v.slice();
+        while (len < qByteLen) {
+            v = h();
+            const sl = v.slice();
             out.push(sl);
-            len += this.v.length;
+            len += v.length;
         }
         return ut.concatBytes(...out);
-    }
+    };
+    const genUntil = (seed, pred) => {
+        reset();
+        reseed(seed); // Steps D-G
+        let res = undefined; // Step H: grind until k is in [1..n-1]
+        while (!(res = pred(gen())))
+            reseed();
+        reset();
+        return res;
+    };
+    return genUntil;
 }
 export function weierstrass(curveDef) {
     const CURVE = validateOpts(curveDef);
@@ -655,93 +555,66 @@ export function weierstrass(curveDef) {
     const compressedLen = Fp.BYTES + 1; // e.g. 33 for 32
     const uncompressedLen = 2 * Fp.BYTES + 1; // e.g. 65 for 32
     function isValidFieldElement(num) {
-        // 0 is disallowed by arbitrary reasons. Probably because infinity point?
-        return _0n < num && num < Fp.ORDER;
+        return _0n < num && num < Fp.ORDER; // 0 is banned since it's not invertible FE
     }
-    const { Point, ProjectivePoint, normalizePrivateKey, weierstrassEquation, isWithinCurveOrder } = weierstrassPoints({
+    function modN(a) {
+        return mod.mod(a, CURVE_ORDER);
+    }
+    function invN(a) {
+        return mod.invert(a, CURVE_ORDER);
+    }
+    const { ProjectivePoint: Point, normalizePrivateKey, weierstrassEquation, isWithinCurveOrder, } = weierstrassPoints({
         ...CURVE,
         toBytes(c, point, isCompressed) {
-            const x = Fp.toBytes(point.x);
+            const a = point.toAffine();
+            const x = Fp.toBytes(a.x);
             const cat = ut.concatBytes;
             if (isCompressed) {
+                // TODO: hasEvenY
                 return cat(Uint8Array.from([point.hasEvenY() ? 0x02 : 0x03]), x);
             }
             else {
-                return cat(Uint8Array.from([0x04]), x, Fp.toBytes(point.y));
+                return cat(Uint8Array.from([0x04]), x, Fp.toBytes(a.y));
             }
         },
         fromBytes(bytes) {
             const len = bytes.length;
-            const header = bytes[0];
+            const head = bytes[0];
+            const tail = bytes.subarray(1);
             // this.assertValidity() is done inside of fromHex
-            if (len === compressedLen && (header === 0x02 || header === 0x03)) {
-                const x = ut.bytesToNumberBE(bytes.subarray(1));
+            if (len === compressedLen && (head === 0x02 || head === 0x03)) {
+                const x = ut.bytesToNumberBE(tail);
                 if (!isValidFieldElement(x))
                     throw new Error('Point is not on curve');
                 const y2 = weierstrassEquation(x); // y² = x³ + ax + b
                 let y = Fp.sqrt(y2); // y = y² ^ (p+1)/4
                 const isYOdd = (y & _1n) === _1n;
                 // ECDSA
-                const isFirstByteOdd = (bytes[0] & 1) === 1;
-                if (isFirstByteOdd !== isYOdd)
-                    y = Fp.negate(y);
+                const isHeadOdd = (head & 1) === 1;
+                if (isHeadOdd !== isYOdd)
+                    y = Fp.neg(y);
                 return { x, y };
             }
-            else if (len === uncompressedLen && header === 0x04) {
-                const x = Fp.fromBytes(bytes.subarray(1, Fp.BYTES + 1));
-                const y = Fp.fromBytes(bytes.subarray(Fp.BYTES + 1, 2 * Fp.BYTES + 1));
+            else if (len === uncompressedLen && head === 0x04) {
+                const x = Fp.fromBytes(tail.subarray(0, Fp.BYTES));
+                const y = Fp.fromBytes(tail.subarray(Fp.BYTES, 2 * Fp.BYTES));
                 return { x, y };
             }
             else {
-                throw new Error(`Point.fromHex: received invalid point. Expected ${compressedLen} compressed bytes or ${uncompressedLen} uncompressed bytes, not ${len}`);
+                throw new Error(`Point of length ${len} was invalid. Expected ${compressedLen} compressed bytes or ${uncompressedLen} uncompressed bytes`);
             }
         },
     });
-    // Do we need these functions at all?
-    function numToField(num) {
-        if (typeof num !== 'bigint')
-            throw new Error('Expected bigint');
-        if (!(_0n <= num && num < Fp.MASK))
-            throw new Error(`Expected number < 2^${Fp.BYTES * 8}`);
-        return Fp.toBytes(num);
-    }
-    const numToFieldStr = (num) => bytesToHex(numToField(num));
-    /**
-     * Normalizes hex, bytes, Point to Point. Checks for curve equation.
-     */
-    function normalizePublicKey(publicKey) {
-        if (publicKey instanceof Point) {
-            publicKey.assertValidity();
-            return publicKey;
-        }
-        else if (publicKey instanceof Uint8Array || typeof publicKey === 'string') {
-            return Point.fromHex(publicKey);
-            // This can happen because PointType can be instance of different class
-        }
-        else
-            throw new Error(`Unknown type of public key: ${publicKey}`);
-    }
+    const numToNByteStr = (num) => ut.bytesToHex(ut.numberToBytesBE(num, CURVE.nByteLength));
     function isBiggerThanHalfOrder(number) {
         const HALF = CURVE_ORDER >> _1n;
         return number > HALF;
     }
     function normalizeS(s) {
-        return isBiggerThanHalfOrder(s) ? mod.mod(-s, CURVE_ORDER) : s;
-    }
-    function bits2int_2(bytes) {
-        const delta = bytes.length * 8 - CURVE.nBitLength;
-        const num = ut.bytesToNumberBE(bytes);
-        return delta > 0 ? num >> BigInt(delta) : num;
+        return isBiggerThanHalfOrder(s) ? modN(-s) : s;
     }
-    // Ensures ECDSA message hashes are 32 bytes and < curve order
-    function _truncateHash(hash, truncateOnly = false) {
-        const h = bits2int_2(hash);
-        if (truncateOnly)
-            return h;
-        const { n } = CURVE;
-        return h >= n ? h - n : h;
-    }
-    const truncateHash = CURVE.truncateHash || _truncateHash;
+    // slice bytes num
+    const slcNum = (b, from, to) => ut.bytesToNumberBE(b.slice(from, to));
     /**
      * ECDSA signature with its (r, s) properties. Supports DER & compact representations.
      */
@@ -754,108 +627,68 @@ export function weierstrass(curveDef) {
         }
         // pair (bytes of r, bytes of s)
         static fromCompact(hex) {
-            const arr = hex instanceof Uint8Array;
-            const name = 'Signature.fromCompact';
-            if (typeof hex !== 'string' && !arr)
-                throw new TypeError(`${name}: Expected string or Uint8Array`);
-            const str = arr ? bytesToHex(hex) : hex;
-            const gl = CURVE.nByteLength * 2; // group length in hex, not ui8a
-            if (str.length !== 2 * gl)
-                throw new Error(`${name}: Expected ${gl / 2}-byte hex`);
-            const slice = (from, to) => ut.hexToNumber(str.slice(from, to));
-            return new Signature(slice(0, gl), slice(gl, 2 * gl));
+            const gl = CURVE.nByteLength;
+            hex = ensureBytes(hex, gl * 2);
+            return new Signature(slcNum(hex, 0, gl), slcNum(hex, gl, 2 * gl));
         }
         // DER encoded ECDSA signature
         // https://bitcoin.stackexchange.com/questions/57644/what-are-the-parts-of-a-bitcoin-transaction-input-script
         static fromDER(hex) {
-            const arr = hex instanceof Uint8Array;
-            if (typeof hex !== 'string' && !arr)
-                throw new TypeError(`Signature.fromDER: Expected string or Uint8Array`);
-            const { r, s } = DER.parseSig(arr ? hex : ut.hexToBytes(hex));
+            if (typeof hex !== 'string' && !(hex instanceof Uint8Array))
+                throw new Error(`Signature.fromDER: Expected string or Uint8Array`);
+            const { r, s } = DER.toSig(ensureBytes(hex));
             return new Signature(r, s);
         }
         assertValidity() {
-            const { r, s } = this;
-            if (!isWithinCurveOrder(r))
-                throw new Error('Invalid Signature: r must be 0 < r < n');
-            if (!isWithinCurveOrder(s))
-                throw new Error('Invalid Signature: s must be 0 < s < n');
+            // can use assertGE here
+            if (!isWithinCurveOrder(this.r))
+                throw new Error('r must be 0 < r < n');
+            if (!isWithinCurveOrder(this.s))
+                throw new Error('s must be 0 < s < n');
         }
-        copyWithRecoveryBit(recovery) {
+        addRecoveryBit(recovery) {
             return new Signature(this.r, this.s, recovery);
         }
-        /**
-         * Recovers public key from signature with recovery bit. Throws on invalid hash.
-         * https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm#Public_key_recovery
-         * It's also possible to recover key without bit: try all 4 bit values and check for sig match.
-         *
-         * ```
-         * recover(r, s, h) where
-         *   u1 = hs^-1 mod n
-         *   u2 = sr^-1 mod n
-         *   Q = u1⋅G + u2⋅R
-         * ```
-         *
-         * @param msgHash message hash
-         * @returns Point corresponding to public key
-         */
         recoverPublicKey(msgHash) {
-            const { r, s, recovery } = this;
-            if (recovery == null)
-                throw new Error('Cannot recover: recovery bit is not present');
-            if (![0, 1, 2, 3].includes(recovery))
-                throw new Error('Cannot recover: invalid recovery bit');
-            const h = truncateHash(ut.ensureBytes(msgHash));
-            const { n } = CURVE;
-            const radj = recovery === 2 || recovery === 3 ? r + n : r;
+            const { n: N } = CURVE; // ECDSA public key recovery secg.org/sec1-v2.pdf 4.1.6
+            const { r, s, recovery: rec } = this;
+            const h = bits2int_modN(ensureBytes(msgHash)); // Truncate hash
+            if (rec == null || ![0, 1, 2, 3].includes(rec))
+                throw new Error('recovery id invalid');
+            const radj = rec === 2 || rec === 3 ? r + N : r;
             if (radj >= Fp.ORDER)
-                throw new Error('Cannot recover: bit 2/3 is invalid with current r');
-            const rinv = mod.invert(radj, n);
-            // Q = u1⋅G + u2⋅R
-            const u1 = mod.mod(-h * rinv, n);
-            const u2 = mod.mod(s * rinv, n);
-            const prefix = recovery & 1 ? '03' : '02';
-            const R = Point.fromHex(prefix + numToFieldStr(radj));
-            const Q = Point.BASE.multiplyAndAddUnsafe(R, u1, u2); // unsafe is fine: no priv data leaked
+                throw new Error('recovery id 2 or 3 invalid');
+            const prefix = (rec & 1) === 0 ? '02' : '03';
+            const R = Point.fromHex(prefix + numToNByteStr(radj));
+            const ir = invN(radj); // r^-1
+            const u1 = modN(-h * ir); // -hr^-1
+            const u2 = modN(s * ir); // sr^-1
+            const Q = Point.BASE.multiplyAndAddUnsafe(R, u1, u2); // (sr^-1)R-(hr^-1)G = -(hr^-1)G + (sr^-1)
             if (!Q)
-                throw new Error('Cannot recover: point at infinify');
+                throw new Error('point at infinify'); // unsafe is fine: no priv data leaked
             Q.assertValidity();
             return Q;
         }
-        /**
-         * Default signatures are always low-s, to prevent malleability.
-         * `sign(lowS: true)` always produces low-s sigs.
-         * `verify(lowS: true)` always fails for high-s.
-         */
+        // Signatures should be low-s, to prevent malleability.
         hasHighS() {
             return isBiggerThanHalfOrder(this.s);
         }
         normalizeS() {
-            return this.hasHighS()
-                ? new Signature(this.r, mod.mod(-this.s, CURVE_ORDER), this.recovery)
-                : this;
+            return this.hasHighS() ? new Signature(this.r, modN(-this.s), this.recovery) : this;
         }
         // DER-encoded
         toDERRawBytes() {
             return ut.hexToBytes(this.toDERHex());
         }
         toDERHex() {
-            const { numberToHexUnpadded: toHex } = ut;
-            const sHex = DER.slice(toHex(this.s));
-            const rHex = DER.slice(toHex(this.r));
-            const sHexL = sHex.length / 2;
-            const rHexL = rHex.length / 2;
-            const sLen = toHex(sHexL);
-            const rLen = toHex(rHexL);
-            const length = toHex(rHexL + sHexL + 4);
-            return `30${length}02${rLen}${rHex}02${sLen}${sHex}`;
+            return DER.hexFromSig({ r: this.r, s: this.s });
         }
         // padded bytes of r, then padded bytes of s
         toCompactRawBytes() {
             return ut.hexToBytes(this.toCompactHex());
         }
         toCompactHex() {
-            return numToFieldStr(this.r) + numToFieldStr(this.s);
+            return numToNByteStr(this.r) + numToNByteStr(this.s);
         }
     }
     const utils = {
@@ -868,17 +701,11 @@ export function weierstrass(curveDef) {
                 return false;
             }
         },
-        _bigintToBytes: numToField,
-        _bigintToString: numToFieldStr,
         _normalizePrivateKey: normalizePrivateKey,
-        _normalizePublicKey: normalizePublicKey,
-        _isWithinCurveOrder: isWithinCurveOrder,
-        _isValidFieldElement: isValidFieldElement,
-        _weierstrassEquation: weierstrassEquation,
         /**
          * Converts some bytes to a valid private key. Needs at least (nBitLength+64) bytes.
          */
-        hashToPrivateKey: (hash) => numToField(ut.hashToPrivateScalar(hash, CURVE_ORDER)),
+        hashToPrivateKey: (hash) => ut.numberToBytesBE(mod.hashToPrivateScalar(hash, CURVE_ORDER), CURVE.nByteLength),
         /**
          * Produces cryptographically secure private key from random of size (nBitLength+64)
          * as per FIPS 186 B.4.1 with modulo bias being neglible.
@@ -893,10 +720,9 @@ export function weierstrass(curveDef) {
          * @returns cached point
          */
         precompute(windowSize = 8, point = Point.BASE) {
-            const cached = point === Point.BASE ? point : new Point(point.x, point.y);
-            cached._setWindowSize(windowSize);
-            cached.multiply(_3n);
-            return cached;
+            point._setWindowSize(windowSize);
+            point.multiply(BigInt(3));
+            return point;
         },
     };
     /**
@@ -905,7 +731,7 @@ export function weierstrass(curveDef) {
      * @param isCompressed whether to return compact (default), or full key
      * @returns Public key, full when isCompressed=false; short when isCompressed=true
      */
-    function getPublicKey(privateKey, isCompressed = false) {
+    function getPublicKey(privateKey, isCompressed = true) {
         return Point.fromPrivateKey(privateKey).toRawBytes(isCompressed);
     }
     /**
@@ -932,101 +758,98 @@ export function weierstrass(curveDef) {
      * @param isCompressed whether to return compact (default), or full key
      * @returns shared public key
      */
-    function getSharedSecret(privateA, publicB, isCompressed = false) {
+    function getSharedSecret(privateA, publicB, isCompressed = true) {
         if (isProbPub(privateA))
-            throw new TypeError('getSharedSecret: first arg must be private key');
+            throw new Error('first arg must be private key');
         if (!isProbPub(publicB))
-            throw new TypeError('getSharedSecret: second arg must be public key');
-        const b = normalizePublicKey(publicB);
-        b.assertValidity();
+            throw new Error('second arg must be public key');
+        const b = Point.fromHex(publicB); // check for being on-curve
         return b.multiply(normalizePrivateKey(privateA)).toRawBytes(isCompressed);
     }
-    // RFC6979 methods
-    function bits2int(bytes) {
-        const { nByteLength } = CURVE;
-        if (!(bytes instanceof Uint8Array))
-            throw new Error('Expected Uint8Array');
-        const slice = bytes.length > nByteLength ? bytes.slice(0, nByteLength) : bytes;
-        // const slice = bytes; nByteLength; nBitLength;
-        let num = ut.bytesToNumberBE(slice);
-        // const { nBitLength } = CURVE;
-        // const delta = (bytes.length * 8) - nBitLength;
-        // if (delta > 0) {
-        //   // console.log('bits=', bytes.length*8, 'CURVE n=', nBitLength, 'delta=', delta);
-        //   // console.log(bytes.length, nBitLength, delta);
-        //   // console.log(bytes, new Error().stack);
-        //   num >>= BigInt(delta);
-        // }
-        return num;
-    }
-    function bits2octets(bytes) {
-        const z1 = bits2int(bytes);
-        const z2 = mod.mod(z1, CURVE_ORDER);
-        return int2octets(z2 < _0n ? z1 : z2);
-    }
+    // RFC6979: ensure ECDSA msg is X bytes and < N. RFC suggests optional truncating via bits2octets.
+    // FIPS 186-4 4.6 suggests the leftmost min(nBitLen, outLen) bits, which matches bits2int.
+    // bits2int can produce res>N, we can do mod(res, N) since the bitLen is the same.
+    // int2octets can't be used; pads small msgs with 0: unacceptatble for trunc as per RFC vectors
+    const bits2int = CURVE.bits2int ||
+        function (bytes) {
+            // For curves with nBitLength % 8 !== 0: bits2octets(bits2octets(m)) !== bits2octets(m)
+            // for some cases, since bytes.length * 8 is not actual bitLength.
+            const delta = bytes.length * 8 - CURVE.nBitLength; // truncate to nBitLength leftmost bits
+            const num = ut.bytesToNumberBE(bytes); // check for == u8 done here
+            return delta > 0 ? num >> BigInt(delta) : num;
+        };
+    const bits2int_modN = CURVE.bits2int_modN ||
+        function (bytes) {
+            return modN(bits2int(bytes)); // can't use bytesToNumberBE here
+        };
+    // NOTE: pads output with zero as per spec
+    const ORDER_MASK = ut.bitMask(CURVE.nBitLength);
     function int2octets(num) {
-        return numToField(num); // prohibits >nByteLength bytes
+        if (typeof num !== 'bigint')
+            throw new Error('bigint expected');
+        if (!(_0n <= num && num < ORDER_MASK))
+            // n in [0..ORDER_MASK-1]
+            throw new Error(`bigint expected < 2^${CURVE.nBitLength}`);
+        // works with order, can have different size than numToField!
+        return ut.numberToBytesBE(num, CURVE.nByteLength);
     }
     // Steps A, D of RFC6979 3.2
     // Creates RFC6979 seed; converts msg/privKey to numbers.
-    function initSigArgs(msgHash, privateKey, extraEntropy) {
+    // Used only in sign, not in verify.
+    // NOTE: we cannot assume here that msgHash has same amount of bytes as curve order, this will be wrong at least for P521.
+    // Also it can be bigger for P224 + SHA256
+    function prepSig(msgHash, privateKey, opts = defaultSigOpts) {
+        const { hash, randomBytes } = CURVE;
         if (msgHash == null)
             throw new Error(`sign: expected valid message hash, not "${msgHash}"`);
-        // Step A is ignored, since we already provide hash instead of msg
-        const h1 = numToField(truncateHash(ut.ensureBytes(msgHash)));
-        const d = normalizePrivateKey(privateKey);
-        // K = HMAC_K(V || 0x00 || int2octets(x) || bits2octets(h1) || k')
-        const seedArgs = [int2octets(d), bits2octets(h1)];
-        // RFC6979 3.6: additional k' could be provided
-        if (extraEntropy != null) {
-            if (extraEntropy === true)
-                extraEntropy = CURVE.randomBytes(Fp.BYTES);
-            const e = ut.ensureBytes(extraEntropy);
-            if (e.length !== Fp.BYTES)
-                throw new Error(`sign: Expected ${Fp.BYTES} bytes of extra data`);
-            seedArgs.push(e);
-        }
-        // seed is constructed from private key and message
-        // Step D
-        // V, 0x00 are done in HmacDRBG constructor.
-        const seed = ut.concatBytes(...seedArgs);
-        const m = bits2int(h1);
-        return { seed, m, d };
-    }
-    /**
-     * Converts signature params into point & r/s, checks them for validity.
-     * k must be in range [1, n-1]
-     * @param k signature's k param: deterministic in our case, random in non-rfc6979 sigs
-     * @param m message that would be signed
-     * @param d private key
-     * @returns Signature with its point on curve Q OR undefined if params were invalid
-     */
-    function kmdToSig(kBytes, m, d, lowS = true) {
-        const { n } = CURVE;
-        const k = truncateHash(kBytes, true);
-        if (!isWithinCurveOrder(k))
-            return;
-        // Important: all mod() calls in the function must be done over `n`
-        const kinv = mod.invert(k, n);
-        const q = Point.BASE.multiply(k);
-        // r = x mod n
-        const r = mod.mod(q.x, n);
-        if (r === _0n)
-            return;
-        // s = (m + dr)/k mod n where x/k == x*inv(k)
-        const s = mod.mod(kinv * mod.mod(m + mod.mod(d * r, n), n), n);
-        if (s === _0n)
-            return;
-        // recovery bit is usually 0 or 1; rarely it's 2 or 3, when q.x > n
-        let recovery = (q.x === r ? 0 : 2) | Number(q.y & _1n);
-        let normS = s;
-        if (lowS && isBiggerThanHalfOrder(s)) {
-            normS = normalizeS(s);
-            recovery ^= 1;
+        if (['recovered', 'canonical'].some((k) => k in opts))
+            // Ban legacy options
+            throw new Error('sign() legacy options not supported');
+        let { lowS, prehash, extraEntropy: ent } = opts; // generates low-s sigs by default
+        if (prehash)
+            msgHash = hash(ensureBytes(msgHash));
+        if (lowS == null)
+            lowS = true; // RFC6979 3.2: we skip step A, because we already provide hash
+        // We can't later call bits2octets, since nested bits2int is broken for curves
+        // with nBitLength % 8 !== 0. Because of that, we unwrap it here as int2octets call.
+        // const bits2octets = (bits) => int2octets(bits2int_modN(bits))
+        const h1int = bits2int_modN(ensureBytes(msgHash));
+        const d = normalizePrivateKey(privateKey); // validate private key, convert to bigint
+        const seedArgs = [int2octets(d), int2octets(h1int)];
+        // extraEntropy. RFC6979 3.6: additional k' (optional).
+        if (ent != null) {
+            // K = HMAC_K(V || 0x00 || int2octets(x) || bits2octets(h1) || k')
+            // Either pass as-is, or generate random bytes. Then validate for being ui8a of size BYTES
+            seedArgs.push(ensureBytes(ent === true ? randomBytes(Fp.BYTES) : ent, Fp.BYTES));
+        }
+        const seed = ut.concatBytes(...seedArgs); // Step D of RFC6979 3.2
+        const m = h1int; // NOTE: no need to call bits2int second time here, it is inside truncateHash!
+        // Converts signature params into point w r/s, checks result for validity.
+        function k2sig(kBytes) {
+            // RFC 6979 Section 3.2, step 3: k = bits2int(T)
+            const k = bits2int(kBytes); // Cannot use fields methods, since it is group element
+            if (!isWithinCurveOrder(k))
+                return; // Important: all mod() calls here must be done over N
+            const ik = invN(k); // k^-1 mod n
+            const q = Point.BASE.multiply(k).toAffine(); // q = Gk
+            const r = modN(q.x); // r = q.x mod n
+            if (r === _0n)
+                return;
+            const s = modN(ik * modN(m + modN(d * r))); // s = k^-1(m + rd) mod n
+            if (s === _0n)
+                return;
+            let recovery = (q.x === r ? 0 : 2) | Number(q.y & _1n); // recovery bit (2 or 3, when q.x > n)
+            let normS = s;
+            if (lowS && isBiggerThanHalfOrder(s)) {
+                normS = normalizeS(s); // if lowS was passed, ensure s is always
+                recovery ^= 1; // // in the bottom half of N
+            }
+            return new Signature(r, normS, recovery); // use normS, not s
         }
-        return new Signature(r, normS, recovery);
+        return { seed, k2sig };
     }
-    const defaultSigOpts = { lowS: CURVE.lowS };
+    const defaultSigOpts = { lowS: CURVE.lowS, prehash: false };
+    const defaultVerOpts = { lowS: CURVE.lowS, prehash: false };
     /**
      * Signs message hash (not message: you need to hash it by yourself).
      * ```
@@ -1035,28 +858,16 @@ export function weierstrass(curveDef) {
      *   r = x mod n
      *   s = (m + dr)/k mod n
      * ```
-     * @param opts `lowS, extraEntropy`
+     * @param opts `lowS, extraEntropy, prehash`
      */
     function sign(msgHash, privKey, opts = defaultSigOpts) {
-        // Steps A, D of RFC6979 3.2.
-        const { seed, m, d } = initSigArgs(msgHash, privKey, opts.extraEntropy);
-        // Steps B, C, D, E, F, G
-        const drbg = new HmacDrbg(CURVE.hash.outputLen, CURVE.nByteLength, CURVE.hmac);
-        drbg.reseedSync(seed);
-        // Step H3, repeat until k is in range [1, n-1]
-        let sig;
-        while (!(sig = kmdToSig(drbg.generateSync(), m, d, opts.lowS)))
-            drbg.reseedSync();
-        return sig;
-    }
-    /**
-     * Signs a message (not message hash).
-     */
-    function signUnhashed(msg, privKey, opts = defaultSigOpts) {
-        return sign(CURVE.hash(ut.ensureBytes(msg)), privKey, opts);
+        const { seed, k2sig } = prepSig(msgHash, privKey, opts); // Steps A, D of RFC6979 3.2.
+        const genUntil = hmacDrbg(CURVE.hash.outputLen, CURVE.nByteLength, CURVE.hmac);
+        return genUntil(seed, k2sig); // Steps B, C, D, E, F, G
     }
     // Enable precomputes. Slows down first publicKey computation by 20ms.
     Point.BASE._setWindowSize(8);
+    // utils.precompute(8, ProjectivePoint.BASE)
     /**
      * Verifies a signature against message hash and public key.
      * Rejects lowS signatures by default: to override,
@@ -1070,50 +881,47 @@ export function weierstrass(curveDef) {
      *   mod(R.x, n) == r
      * ```
      */
-    function verify(signature, msgHash, publicKey, opts = { lowS: CURVE.lowS }) {
+    function verify(signature, msgHash, publicKey, opts = defaultVerOpts) {
+        let P;
+        let _sig = undefined;
+        if (publicKey instanceof Point)
+            throw new Error('publicKey must be hex');
         try {
-            if (signature instanceof Signature) {
-                signature.assertValidity();
+            if (signature && typeof signature === 'object' && !(signature instanceof Uint8Array)) {
+                const { r, s } = signature;
+                _sig = new Signature(r, s); // assertValidity() is executed on creation
             }
             else {
-                // Signature can be represented in 2 ways: compact (64-byte) & DER (variable-length).
-                // Since DER can also be 64 bytes, we check for it first.
+                // Signature can be represented in 2 ways: compact (2*nByteLength) & DER (variable-length).
+                // Since DER can also be 2*nByteLength bytes, we check for it first.
                 try {
-                    signature = Signature.fromDER(signature);
+                    _sig = Signature.fromDER(signature);
                 }
                 catch (derError) {
-                    if (!(derError instanceof DERError))
+                    if (!(derError instanceof DER.Err))
                         throw derError;
-                    signature = Signature.fromCompact(signature);
+                    _sig = Signature.fromCompact(signature);
                 }
             }
-            msgHash = ut.ensureBytes(msgHash);
+            msgHash = ensureBytes(msgHash);
+            P = Point.fromHex(publicKey);
         }
         catch (error) {
             return false;
         }
-        if (opts.lowS && signature.hasHighS())
+        if (opts.lowS && _sig.hasHighS())
             return false;
-        let P;
-        try {
-            P = normalizePublicKey(publicKey);
-        }
-        catch (error) {
-            return false;
-        }
-        const { n } = CURVE;
-        const { r, s } = signature;
-        const h = truncateHash(msgHash);
-        const sinv = mod.invert(s, n); // s^-1
-        // R = u1⋅G - u2⋅P
-        const u1 = mod.mod(h * sinv, n);
-        const u2 = mod.mod(r * sinv, n);
-        // Some implementations compare R.x in projective, without inversion.
-        // The speed-up is <5%, so we don't complicate the code.
-        const R = Point.BASE.multiplyAndAddUnsafe(P, u1, u2);
+        if (opts.prehash)
+            msgHash = CURVE.hash(msgHash);
+        const { r, s } = _sig;
+        const h = bits2int_modN(msgHash); // Cannot use fields methods, since it is group element
+        const is = invN(s); // s^-1
+        const u1 = modN(h * is); // u1 = hs^-1 mod n
+        const u2 = modN(r * is); // u2 = rs^-1 mod n
+        const R = Point.BASE.multiplyAndAddUnsafe(P, u1, u2)?.toAffine(); // R = u1⋅G + u2⋅P
         if (!R)
             return false;
-        const v = mod.mod(R.x, n);
+        const v = modN(R.x);
         return v === r;
     }
     return {
@@ -1121,16 +929,14 @@ export function weierstrass(curveDef) {
         getPublicKey,
         getSharedSecret,
         sign,
-        signUnhashed,
         verify,
-        Point,
-        ProjectivePoint,
+        ProjectivePoint: Point,
         Signature,
         utils,
     };
 }
 // Implementation of the Shallue and van de Woestijne method for any Weierstrass curve
-// TODO: check if there is a way to merge this with uvRation in Edwards && move to modular?
+// TODO: check if there is a way to merge this with uvRatio in Edwards && move to modular?
 // b = True and y = sqrt(u / v) if (u / v) is square in F, and
 // b = False and y = sqrt(Z * (u / v)) otherwise.
 export function SWUFpSqrtRatio(Fp, Z) {
@@ -1149,7 +955,7 @@ export function SWUFpSqrtRatio(Fp, Z) {
     let sqrtRatio = (u, v) => {
         let tv1 = c6; // 1. tv1 = c6
         let tv2 = Fp.pow(v, c4); // 2. tv2 = v^c4
-        let tv3 = Fp.square(tv2); // 3. tv3 = tv2^2
+        let tv3 = Fp.sqr(tv2); // 3. tv3 = tv2^2
         tv3 = Fp.mul(tv3, v); // 4. tv3 = tv3 * v
         let tv5 = Fp.mul(u, tv3); // 5. tv5 = u * tv3
         tv5 = Fp.pow(tv5, c3); // 6. tv5 = tv5^c3
@@ -1158,7 +964,7 @@ export function SWUFpSqrtRatio(Fp, Z) {
         tv3 = Fp.mul(tv5, u); // 9. tv3 = tv5 * u
         let tv4 = Fp.mul(tv3, tv2); // 10. tv4 = tv3 * tv2
         tv5 = Fp.pow(tv4, c5); // 11. tv5 = tv4^c5
-        let isQR = Fp.equals(tv5, Fp.ONE); // 12. isQR = tv5 == 1
+        let isQR = Fp.eql(tv5, Fp.ONE); // 12. isQR = tv5 == 1
         tv2 = Fp.mul(tv3, c7); // 13. tv2 = tv3 * c7
         tv5 = Fp.mul(tv4, tv1); // 14. tv5 = tv4 * tv1
         tv3 = Fp.cmov(tv2, tv3, isQR); // 15. tv3 = CMOV(tv2, tv3, isQR)
@@ -1167,7 +973,7 @@ export function SWUFpSqrtRatio(Fp, Z) {
         for (let i = c1; i > 1; i--) {
             let tv5 = 2n ** (i - 2n); // 18.    tv5 = i - 2;    19.    tv5 = 2^tv5
             let tvv5 = Fp.pow(tv4, tv5); // 20.    tv5 = tv4^tv5
-            const e1 = Fp.equals(tvv5, Fp.ONE); // 21.    e1 = tv5 == 1
+            const e1 = Fp.eql(tvv5, Fp.ONE); // 21.    e1 = tv5 == 1
             tv2 = Fp.mul(tv3, tv1); // 22.    tv2 = tv3 * tv1
             tv1 = Fp.mul(tv1, tv1); // 23.    tv1 = tv1 * tv1
             tvv5 = Fp.mul(tv4, tv1); // 24.    tv5 = tv4 * tv1
@@ -1179,16 +985,16 @@ export function SWUFpSqrtRatio(Fp, Z) {
     if (Fp.ORDER % 4n === 3n) {
         // sqrt_ratio_3mod4(u, v)
         const c1 = (Fp.ORDER - 3n) / 4n; // 1. c1 = (q - 3) / 4     # Integer arithmetic
-        const c2 = Fp.sqrt(Fp.negate(Z)); // 2. c2 = sqrt(-Z)
+        const c2 = Fp.sqrt(Fp.neg(Z)); // 2. c2 = sqrt(-Z)
         sqrtRatio = (u, v) => {
-            let tv1 = Fp.square(v); // 1. tv1 = v^2
+            let tv1 = Fp.sqr(v); // 1. tv1 = v^2
             const tv2 = Fp.mul(u, v); // 2. tv2 = u * v
             tv1 = Fp.mul(tv1, tv2); // 3. tv1 = tv1 * tv2
             let y1 = Fp.pow(tv1, c1); // 4. y1 = tv1^c1
             y1 = Fp.mul(y1, tv2); // 5. y1 = y1 * tv2
             const y2 = Fp.mul(y1, c2); // 6. y2 = y1 * c2
-            const tv3 = Fp.mul(Fp.square(y1), v); // 7. tv3 = y1^2; 8. tv3 = tv3 * v
-            const isQR = Fp.equals(tv3, u); // 9. isQR = tv3 == u
+            const tv3 = Fp.mul(Fp.sqr(y1), v); // 7. tv3 = y1^2; 8. tv3 = tv3 * v
+            const isQR = Fp.eql(tv3, u); // 9. isQR = tv3 == u
             let y = Fp.cmov(y2, y1, isQR); // 10. y = CMOV(y2, y1, isQR)
             return { isValid: isQR, value: y }; // 11. return (isQR, y) isQR ? y : y*c2
         };
@@ -1210,16 +1016,16 @@ export function mapToCurveSimpleSWU(Fp, opts) {
     return (u) => {
         // prettier-ignore
         let tv1, tv2, tv3, tv4, tv5, tv6, x, y;
-        tv1 = Fp.square(u); // 1.  tv1 = u^2
+        tv1 = Fp.sqr(u); // 1.  tv1 = u^2
         tv1 = Fp.mul(tv1, opts.Z); // 2.  tv1 = Z * tv1
-        tv2 = Fp.square(tv1); // 3.  tv2 = tv1^2
+        tv2 = Fp.sqr(tv1); // 3.  tv2 = tv1^2
         tv2 = Fp.add(tv2, tv1); // 4.  tv2 = tv2 + tv1
         tv3 = Fp.add(tv2, Fp.ONE); // 5.  tv3 = tv2 + 1
         tv3 = Fp.mul(tv3, opts.B); // 6.  tv3 = B * tv3
-        tv4 = Fp.cmov(opts.Z, Fp.negate(tv2), !Fp.equals(tv2, Fp.ZERO)); // 7.  tv4 = CMOV(Z, -tv2, tv2 != 0)
+        tv4 = Fp.cmov(opts.Z, Fp.neg(tv2), !Fp.eql(tv2, Fp.ZERO)); // 7.  tv4 = CMOV(Z, -tv2, tv2 != 0)
         tv4 = Fp.mul(tv4, opts.A); // 8.  tv4 = A * tv4
-        tv2 = Fp.square(tv3); // 9.  tv2 = tv3^2
-        tv6 = Fp.square(tv4); // 10. tv6 = tv4^2
+        tv2 = Fp.sqr(tv3); // 9.  tv2 = tv3^2
+        tv6 = Fp.sqr(tv4); // 10. tv6 = tv4^2
         tv5 = Fp.mul(tv6, opts.A); // 11. tv5 = A * tv6
         tv2 = Fp.add(tv2, tv5); // 12. tv2 = tv2 + tv5
         tv2 = Fp.mul(tv2, tv3); // 13. tv2 = tv2 * tv3
@@ -1233,7 +1039,7 @@ export function mapToCurveSimpleSWU(Fp, opts) {
         x = Fp.cmov(x, tv3, isValid); // 21.   x = CMOV(x, tv3, is_gx1_square)
         y = Fp.cmov(y, value, isValid); // 22.   y = CMOV(y, y1, is_gx1_square)
         const e1 = Fp.isOdd(u) === Fp.isOdd(y); // 23.  e1 = sgn0(u) == sgn0(y)
-        y = Fp.cmov(Fp.negate(y), y, e1); // 24.   y = CMOV(-y, y, e1)
+        y = Fp.cmov(Fp.neg(y), y, e1); // 24.   y = CMOV(-y, y, e1)
         x = Fp.div(x, tv4); // 25.   x = x / tv4
         return { x, y };
     };