@noble/curves 0.6.1 → 0.6.3

package/README.md

@@ -22,8 +22,7 @@ Package consists of two parts:
 
 Curves incorporate work from previous noble packages
 ([secp256k1](https://github.com/paulmillr/noble-secp256k1),
-[ed25519](https://github.com/paulmillr/noble-ed25519),
-[bls12-381](https://github.com/paulmillr/noble-bls12-381)),
+[ed25519](https://github.com/paulmillr/noble-ed25519)),
 which had security audits and were developed from 2019 to 2022.
 Check out [Upgrading](#upgrading) section if you've used them before.
 
@@ -31,14 +30,14 @@ Check out [Upgrading](#upgrading) section if you've used them before.
 
 > **noble-crypto** — high-security, easily auditable set of contained cryptographic libraries and tools.
 
-- Minimal dependencies, small files
+- Protection against supply chain attacks
 - Easily auditable TypeScript/JS code
 - Supported in all major browsers and stable node.js versions
 - All releases are signed with PGP keys
 - Check out [homepage](https://paulmillr.com/noble/) & all libraries:
-  [curves](https://github.com/paulmillr/noble-curves) ([secp256k1](https://github.com/paulmillr/noble-secp256k1),
-  [ed25519](https://github.com/paulmillr/noble-ed25519),
-  [bls12-381](https://github.com/paulmillr/noble-bls12-381)),
+  [curves](https://github.com/paulmillr/noble-curves)
+  ([secp256k1](https://github.com/paulmillr/noble-secp256k1),
+  [ed25519](https://github.com/paulmillr/noble-ed25519)),
   [hashes](https://github.com/paulmillr/noble-hashes)
 
 ## Usage
@@ -48,23 +47,7 @@ Use NPM in node.js / browser, or include single file from
 
 > npm install @noble/curves
 
-The library does not have an entry point. It allows you to select specific primitives and drop everything else. If you only want to use secp256k1, just use the library with rollup or other bundlers. This is done to make your bundles tiny.
-
-```ts
-// Common.js and ECMAScript Modules (ESM)
-import { secp256k1 } from '@noble/curves/secp256k1';
-
-const key = secp256k1.utils.randomPrivateKey();
-const pub = secp256k1.getPublicKey(key);
-const msg = new Uint8Array(32).fill(1);
-const sig = secp256k1.sign(msg, key);
-secp256k1.verify(sig, msg, pub) === true;
-sig.recoverPublicKey(msg) === pub;
-const someonesPub = secp256k1.getPublicKey(secp256k1.utils.randomPrivateKey());
-const shared = secp256k1.getSharedSecret(key, someonesPub);
-```
-
-All curves:
+The library does not have an entry point. It allows you to select specific primitives and drop everything else. If you only want to use secp256k1, just use the library with rollup or other bundlers. This is done to make your bundles tiny. All curves:
 
 ```ts
 import { secp256k1 } from '@noble/curves/secp256k1';
@@ -80,7 +63,25 @@ import { bn254 } from '@noble/curves/bn';
 import { jubjub } from '@noble/curves/jubjub';
 ```
 
-To define a custom curve, check out API below.
+Every curve can be used in the following way:
+
+```ts
+import { secp256k1 } from '@noble/curves/secp256k1'; // Common.js and ECMAScript Modules (ESM)
+
+const key = secp256k1.utils.randomPrivateKey();
+const pub = secp256k1.getPublicKey(key);
+const msg = new Uint8Array(32).fill(1);
+const sig = secp256k1.sign(msg, key);
+// weierstrass curves should use extraEntropy: https://moderncrypto.org/mail-archive/curves/2017/000925.html
+const sigImprovedSecurity = secp256k1.sign(msg, key, { extraEntropy: true });
+secp256k1.verify(sig, msg, pub) === true;
+// secp, p*, pasta curves allow pub recovery
+sig.recoverPublicKey(msg) === pub;
+const someonesPub = secp256k1.getPublicKey(secp256k1.utils.randomPrivateKey());
+const shared = secp256k1.getSharedSecret(key, someonesPub);
+```
+
+To define a custom curve, check out docs below.
 
 ## API
 
@@ -109,17 +110,20 @@ import * as utils from '@noble/curves/abstract/utils';
 They allow to define a new curve in a few lines of code:
 
 ```ts
-import { Fp } from '@noble/curves/abstract/modular';
+import { Field } from '@noble/curves/abstract/modular';
 import { weierstrass } from '@noble/curves/abstract/weierstrass';
 import { hmac } from '@noble/hashes/hmac';
 import { sha256 } from '@noble/hashes/sha256';
 import { concatBytes, randomBytes } from '@noble/hashes/utils';
 
-const secp256k1 = weierstrass({
+// secq (NOT secp) 256k1: cycle of secp256k1 with Fp/N flipped.
+// https://zcash.github.io/halo2/background/curves.html#cycles-of-curves
+// https://personaelabs.org/posts/spartan-ecdsa
+const secq256k1 = weierstrass({
   a: 0n,
   b: 7n,
-  Fp: Fp(2n ** 256n - 2n ** 32n - 2n ** 9n - 2n ** 8n - 2n ** 7n - 2n ** 6n - 2n ** 4n - 1n),
-  n: 2n ** 256n - 432420386565659656852420866394968145599n,
+  Fp: Field(2n ** 256n - 432420386565659656852420866394968145599n),
+  n: 2n ** 256n - 2n ** 32n - 2n ** 9n - 2n ** 8n - 2n ** 7n - 2n ** 6n - 2n ** 4n - 1n,
   Gx: 55066263022277343669578718895168534326250603453777594175500187360389116729240n,
   Gy: 32670510020758816978083085130507043184471273380659243275938904335757337482424n,
   hash: sha256,
@@ -329,47 +333,54 @@ The module allows to hash arbitrary strings to elliptic curve points.
 
 - `expand_message_xmd` [(spec)](https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hash-to-curve-11#section-5.4.1) produces a uniformly random byte string using a cryptographic hash function H that outputs b bits..
 
-    ```ts
-    function expand_message_xmd(
-      msg: Uint8Array, DST: Uint8Array, lenInBytes: number, H: CHash
-    ): Uint8Array;
-    function expand_message_xof(
-      msg: Uint8Array, DST: Uint8Array, lenInBytes: number, k: number, H: CHash
-    ): Uint8Array;
-    ```
+  ```ts
+  function expand_message_xmd(
+    msg: Uint8Array,
+    DST: Uint8Array,
+    lenInBytes: number,
+    H: CHash
+  ): Uint8Array;
+  function expand_message_xof(
+    msg: Uint8Array,
+    DST: Uint8Array,
+    lenInBytes: number,
+    k: number,
+    H: CHash
+  ): Uint8Array;
+  ```
 
 - `hash_to_field(msg, count, options)` [(spec)](https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-hash-to-curve-11#section-5.3)
-hashes arbitrary-length byte strings to a list of one or more elements of a finite field F.
-    * `msg` a byte string containing the message to hash
-    * `count` the number of elements of F to output
-    * `options` `{DST: string, p: bigint, m: number, k: number, expand: 'xmd' | 'xof', hash: H}`
-    * Returns `[u_0, ..., u_(count - 1)]`, a list of field elements.
-
-    ```ts
-    function hash_to_field(msg: Uint8Array, count: number, options: htfOpts): bigint[][];
-    type htfOpts = {
-      // DST: a domain separation tag
-      // defined in section 2.2.5
-      DST: string;
-      // p: the characteristic of F
-      //    where F is a finite field of characteristic p and order q = p^m
-      p: bigint;
-      // m: the extension degree of F, m >= 1
-      //     where F is a finite field of characteristic p and order q = p^m
-      m: number;
-      // k: the target security level for the suite in bits
-      // defined in section 5.1
-      k: number;
-      // option to use a message that has already been processed by
-      // expand_message_xmd
-      expand?: 'xmd' | 'xof';
-      // Hash functions for: expand_message_xmd is appropriate for use with a
-      // wide range of hash functions, including SHA-2, SHA-3, BLAKE2, and others.
-      // BBS+ uses blake2: https://github.com/hyperledger/aries-framework-go/issues/2247
-      // TODO: verify that hash is shake if expand==='xof' via types
-      hash: CHash;
-    };
-    ```
+  hashes arbitrary-length byte strings to a list of one or more elements of a finite field F.
+  _ `msg` a byte string containing the message to hash
+  _ `count` the number of elements of F to output
+  _ `options` `{DST: string, p: bigint, m: number, k: number, expand: 'xmd' | 'xof', hash: H}`
+  _ Returns `[u_0, ..., u_(count - 1)]`, a list of field elements.
+
+      ```ts
+      function hash_to_field(msg: Uint8Array, count: number, options: htfOpts): bigint[][];
+      type htfOpts = {
+        // DST: a domain separation tag
+        // defined in section 2.2.5
+        DST: string;
+        // p: the characteristic of F
+        //    where F is a finite field of characteristic p and order q = p^m
+        p: bigint;
+        // m: the extension degree of F, m >= 1
+        //     where F is a finite field of characteristic p and order q = p^m
+        m: number;
+        // k: the target security level for the suite in bits
+        // defined in section 5.1
+        k: number;
+        // option to use a message that has already been processed by
+        // expand_message_xmd
+        expand?: 'xmd' | 'xof';
+        // Hash functions for: expand_message_xmd is appropriate for use with a
+        // wide range of hash functions, including SHA-2, SHA-3, BLAKE2, and others.
+        // BBS+ uses blake2: https://github.com/hyperledger/aries-framework-go/issues/2247
+        // TODO: verify that hash is shake if expand==='xof' via types
+        hash: CHash;
+      };
+      ```
 
 ### abstract/poseidon: Poseidon hash
 
@@ -516,11 +527,11 @@ Upgrading from @noble/secp256k1 1.7:
 - Compressed (33-byte) public keys are now returned by default, instead of uncompressed
 - Methods are now synchronous. Setting `secp.utils.hmacSha256` is no longer required
 - `sign()`
-    - `der`, `recovered` options were removed
-    - `canonical` was renamed to `lowS`
-    - Return type is now `{ r: bigint, s: bigint, recovery: number }` instance of `Signature`
+  - `der`, `recovered` options were removed
+  - `canonical` was renamed to `lowS`
+  - Return type is now `{ r: bigint, s: bigint, recovery: number }` instance of `Signature`
 - `verify()`
-    - `strict` was renamed to `lowS`
+  - `strict` was renamed to `lowS`
 - `recoverPublicKey()`: moved to sig instance `Signature#recoverPublicKey(msgHash)`
 - `Point` was removed: use `ProjectivePoint` in xyz coordinates
 - `utils`: Many methods were removed, others were moved to `schnorr` namespace
@@ -532,6 +543,7 @@ Upgrading from @noble/ed25519 1.7:
 - `Point` was removed: use `ExtendedPoint` in xyzt coordinates
 - `Signature` was removed
 - `getSharedSecret` was removed: use separate x25519 sub-module
+- `bigint` is no longer allowed in `getPublicKey`, `sign`, `verify`. Reason: ed25519 is LE, can lead to bugs
 
 ## Contributing & testing
 

package/lib/abstract/curve.d.ts

@@ -26,15 +26,19 @@ export declare function wNAF<T extends Group<T>>(c: GroupConstructor<T>, bits: n
     /**
      * Creates a wNAF precomputation window. Used for caching.
      * Default window size is set by `utils.precompute()` and is equal to 8.
-     * Which means we are caching 65536 points: 256 points for every bit from 0 to 256.
-     * @returns 65K precomputed points, depending on W
+     * Number of precomputed points depends on the curve size:
+     * 2^(𝑊−1) * (Math.ceil(𝑛 / 𝑊) + 1), where:
+     * - 𝑊 is the window size
+     * - 𝑛 is the bitlength of the curve order.
+     * For a 256-bit curve and window size 8, the number of precomputed points is 128 * 33 = 4224.
+     * @returns precomputed point tables flattened to a single array
      */
     precomputeWindow(elm: T, W: number): Group<T>[];
     /**
-     * Implements w-ary non-adjacent form for calculating ec multiplication.
+     * Implements ec multiplication using precomputed tables and w-ary non-adjacent form.
      * @param W window size
-     * @param affinePoint optional 2d point to save cached precompute windows on it.
-     * @param n bits
+     * @param precomputes precomputed tables
+     * @param n scalar (we don't check here, but should be less than curve order)
      * @returns real and fake (for const-time) points
      */
     wNAF(W: number, precomputes: T[], n: bigint): {

package/lib/abstract/curve.js

@@ -7,8 +7,17 @@ const modular_js_1 = require("./modular.js");
 const utils_js_1 = require("./utils.js");
 const _0n = BigInt(0);
 const _1n = BigInt(1);
-// Elliptic curve multiplication of Point by scalar. Complicated and fragile. Uses wNAF method.
-// Windowed method is 10% faster, but takes 2x longer to generate & consumes 2x memory.
+// Elliptic curve multiplication of Point by scalar. Fragile.
+// Scalars should always be less than curve order: this should be checked inside of a curve itself.
+// Creates precomputation tables for fast multiplication:
+// - private scalar is split by fixed size windows of W bits
+// - every window point is collected from window's table & added to accumulator
+// - since windows are different, same point inside tables won't be accessed more than once per calc
+// - each multiplication is 'Math.ceil(CURVE_ORDER / 𝑊) + 1' point additions (fixed for any scalar)
+// - +1 window is neccessary for wNAF
+// - wNAF reduces table size: 2x less memory + 2x faster generation, but 10% slower multiplication
+// TODO: Research returning 2d JS array of windows, instead of a single window. This would allow
+// windows to be in different memory locations
 function wNAF(c, bits) {
     const constTimeNegate = (condition, item) => {
         const neg = item.negate();
@@ -36,8 +45,12 @@ function wNAF(c, bits) {
         /**
          * Creates a wNAF precomputation window. Used for caching.
          * Default window size is set by `utils.precompute()` and is equal to 8.
-         * Which means we are caching 65536 points: 256 points for every bit from 0 to 256.
-         * @returns 65K precomputed points, depending on W
+         * Number of precomputed points depends on the curve size:
+         * 2^(𝑊−1) * (Math.ceil(𝑛 / 𝑊) + 1), where:
+         * - 𝑊 is the window size
+         * - 𝑛 is the bitlength of the curve order.
+         * For a 256-bit curve and window size 8, the number of precomputed points is 128 * 33 = 4224.
+         * @returns precomputed point tables flattened to a single array
          */
         precomputeWindow(elm, W) {
             const { windows, windowSize } = opts(W);
@@ -57,14 +70,14 @@ function wNAF(c, bits) {
             return points;
         },
         /**
-         * Implements w-ary non-adjacent form for calculating ec multiplication.
+         * Implements ec multiplication using precomputed tables and w-ary non-adjacent form.
          * @param W window size
-         * @param affinePoint optional 2d point to save cached precompute windows on it.
-         * @param n bits
+         * @param precomputes precomputed tables
+         * @param n scalar (we don't check here, but should be less than curve order)
          * @returns real and fake (for const-time) points
          */
         wNAF(W, precomputes, n) {
-            // TODO: maybe check that scalar is less than group order? wNAF will fail otherwise
+            // TODO: maybe check that scalar is less than group order? wNAF behavious is undefined otherwise
             // But need to carefully remove other checks before wNAF. ORDER == bits here
             const { windows, windowSize } = opts(W);
             let p = c.ZERO;

package/lib/abstract/edwards.js

@@ -109,7 +109,30 @@ function twistedEdwards(curveDef) {
             this._WINDOW_SIZE = windowSize;
             pointPrecomputes.delete(this);
         }
-        assertValidity() { }
+        // Not required for fromHex(), which always creates valid points.
+        // Could be useful for fromAffine().
+        assertValidity() {
+            const { a, d } = CURVE;
+            if (this.is0())
+                throw new Error('bad point: ZERO'); // TODO: optimize, with vars below?
+            // Equation in affine coordinates: ax² + y² = 1 + dx²y²
+            // Equation in projective coordinates (X/Z, Y/Z, Z):  (aX² + Y²)Z² = Z⁴ + dX²Y²
+            const { ex: X, ey: Y, ez: Z, et: T } = this;
+            const X2 = modP(X * X); // X²
+            const Y2 = modP(Y * Y); // Y²
+            const Z2 = modP(Z * Z); // Z²
+            const Z4 = modP(Z2 * Z2); // Z⁴
+            const aX2 = modP(X2 * a); // aX²
+            const left = modP(Z2 * modP(aX2 + Y2)); // (aX² + Y²)Z²
+            const right = modP(Z4 + modP(d * modP(X2 * Y2))); // Z⁴ + dX²Y²
+            if (left !== right)
+                throw new Error('bad point: equation left != right (1)');
+            // In Extended coordinates we also have T, which is x*y=T/Z: check X*Y == Z*T
+            const XY = modP(X * Y);
+            const ZT = modP(Z * T);
+            if (XY !== ZT)
+                throw new Error('bad point: equation left != right (2)');
+        }
         // Compare one point to another.
         equals(other) {
             isPoint(other);

package/lib/abstract/hash-to-curve.d.ts

@@ -11,7 +11,6 @@ export declare type Opts = {
     expand?: 'xmd' | 'xof';
     hash: CHash;
 };
-export declare function validateOpts(opts: Opts): void;
 export declare function stringToBytes(str: string): Uint8Array;
 export declare function expand_message_xmd(msg: Uint8Array, DST: Uint8Array, lenInBytes: number, H: CHash): Uint8Array;
 export declare function expand_message_xof(msg: Uint8Array, DST: Uint8Array, lenInBytes: number, k: number, H: CHash): Uint8Array;

package/lib/abstract/hash-to-curve.js

@@ -1,23 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.hashToCurve = exports.isogenyMap = exports.hash_to_field = exports.expand_message_xof = exports.expand_message_xmd = exports.stringToBytes = exports.validateOpts = void 0;
+exports.hashToCurve = exports.isogenyMap = exports.hash_to_field = exports.expand_message_xof = exports.expand_message_xmd = exports.stringToBytes = void 0;
 const modular_js_1 = require("./modular.js");
 const utils_js_1 = require("./utils.js");
-function validateOpts(opts) {
-    if (typeof opts.DST !== 'string')
-        throw new Error('Invalid htf/DST');
-    if (typeof opts.p !== 'bigint')
-        throw new Error('Invalid htf/p');
-    if (typeof opts.m !== 'number')
-        throw new Error('Invalid htf/m');
-    if (typeof opts.k !== 'number')
-        throw new Error('Invalid htf/k');
-    if (opts.expand !== 'xmd' && opts.expand !== 'xof' && opts.expand !== undefined)
-        throw new Error('Invalid htf/expand');
-    if (typeof opts.hash !== 'function' || !Number.isSafeInteger(opts.hash.outputLen))
-        throw new Error('Invalid htf/hash function');
-}
-exports.validateOpts = validateOpts;
 function stringToBytes(str) {
     if (typeof str !== 'string') {
         throw new Error(`utf8ToBytes expected string, got ${typeof str}`);
@@ -143,7 +128,15 @@ function isogenyMap(field, map) {
 }
 exports.isogenyMap = isogenyMap;
 function hashToCurve(Point, mapToCurve, def) {
-    validateOpts(def);
+    (0, utils_js_1.validateObject)(def, {
+        DST: 'string',
+        p: 'bigint',
+        m: 'isSafeInteger',
+        k: 'isSafeInteger',
+        hash: 'hash',
+    });
+    if (def.expand !== 'xmd' && def.expand !== 'xof' && def.expand !== undefined)
+        throw new Error('Invalid htf/expand');
     if (typeof mapToCurve !== 'function')
         throw new Error('hashToCurve: mapToCurve() has not been defined');
     return {

package/lib/abstract/modular.d.ts

@@ -42,7 +42,7 @@ export interface Field<T> {
     fromBytes(bytes: Uint8Array): T;
     cmov(a: T, b: T, c: boolean): T;
 }
-export declare function validateField<T>(field: Field<T>): object;
+export declare function validateField<T>(field: Field<T>): Field<T>;
 export declare function FpPow<T>(f: Field<T>, num: T, power: bigint): T;
 export declare function FpInvertBatch<T>(f: Field<T>, nums: T[]): T[];
 export declare function FpDiv<T>(f: Field<T>, lhs: T, rhs: T | bigint): T;

package/lib/abstract/montgomery.js

@@ -121,7 +121,9 @@ function montgomery(curveDef) {
         // This is very ugly way, but it works because fieldLen-1 is outside of bounds for X448, so this becomes NOOP
         // fieldLen - scalaryBytes = 1 for X448 and = 0 for X25519
         const u = (0, utils_js_1.ensureBytes)(uEnc, montgomeryBytes);
-        u[fieldLen - 1] &= 127; // 0b0111_1111
+        // u[fieldLen-1] crashes QuickJS (TypeError: out-of-bound numeric index)
+        if (fieldLen === montgomeryBytes)
+            u[fieldLen - 1] &= 127; // 0b0111_1111
         return (0, utils_js_1.bytesToNumberLE)(u);
     }
     function decodeScalar(n) {

package/lib/abstract/utils.d.ts

@@ -25,6 +25,19 @@ export declare function bitLen(n: bigint): number;
 export declare const bitGet: (n: bigint, pos: number) => bigint;
 export declare const bitSet: (n: bigint, pos: number, value: boolean) => bigint;
 export declare const bitMask: (n: number) => bigint;
-declare type ValMap = Record<string, string>;
-export declare function validateObject(object: object, validators: ValMap, optValidators?: ValMap): object;
+declare const validatorFns: {
+    readonly bigint: (val: any) => boolean;
+    readonly function: (val: any) => boolean;
+    readonly boolean: (val: any) => boolean;
+    readonly string: (val: any) => boolean;
+    readonly isSafeInteger: (val: any) => boolean;
+    readonly array: (val: any) => boolean;
+    readonly field: (val: any, object: any) => any;
+    readonly hash: (val: any) => boolean;
+};
+declare type Validator = keyof typeof validatorFns;
+declare type ValMap<T extends Record<string, any>> = {
+    [K in keyof T]?: Validator;
+};
+export declare function validateObject<T extends Record<string, any>>(object: T, validators: ValMap<T>, optValidators?: ValMap<T>): T;
 export {};

package/lib/abstract/utils.js

@@ -27,7 +27,7 @@ function hexToNumber(hex) {
     if (typeof hex !== 'string')
         throw new Error('string expected, got ' + typeof hex);
     // Big Endian
-    return BigInt(`0x${hex}`);
+    return BigInt(hex === '' ? '0' : `0x${hex}`);
 }
 exports.hexToNumber = hexToNumber;
 // Caching slows it down 2-3x
@@ -118,18 +118,18 @@ exports.bitSet = bitSet;
 // Not using ** operator with bigints for old engines.
 const bitMask = (n) => (_2n << BigInt(n - 1)) - _1n;
 exports.bitMask = bitMask;
+const validatorFns = {
+    bigint: (val) => typeof val === 'bigint',
+    function: (val) => typeof val === 'function',
+    boolean: (val) => typeof val === 'boolean',
+    string: (val) => typeof val === 'string',
+    isSafeInteger: (val) => Number.isSafeInteger(val),
+    array: (val) => Array.isArray(val),
+    field: (val, object) => object.Fp.isValid(val),
+    hash: (val) => typeof val === 'function' && Number.isSafeInteger(val.outputLen),
+};
+// type Record<K extends string | number | symbol, T> = { [P in K]: T; }
 function validateObject(object, validators, optValidators = {}) {
-    const validatorFns = {
-        bigint: (val) => typeof val === 'bigint',
-        function: (val) => typeof val === 'function',
-        boolean: (val) => typeof val === 'boolean',
-        string: (val) => typeof val === 'string',
-        isSafeInteger: (val) => Number.isSafeInteger(val),
-        array: (val) => Array.isArray(val),
-        field: (val) => object.Fp.isValid(val),
-        hash: (val) => typeof val === 'function' && Number.isSafeInteger(val.outputLen),
-    };
-    // type Key = keyof typeof validators;
     const checkField = (fieldName, type, isOptional) => {
         const checkVal = validatorFns[type];
         if (typeof checkVal !== 'function')
@@ -137,14 +137,22 @@ function validateObject(object, validators, optValidators = {}) {
         const val = object[fieldName];
         if (isOptional && val === undefined)
             return;
-        if (!checkVal(val)) {
-            throw new Error(`Invalid param ${fieldName}=${val} (${typeof val}), expected ${type}`);
+        if (!checkVal(val, object)) {
+            throw new Error(`Invalid param ${String(fieldName)}=${val} (${typeof val}), expected ${type}`);
         }
     };
-    for (let [fieldName, type] of Object.entries(validators))
+    for (const [fieldName, type] of Object.entries(validators))
         checkField(fieldName, type, false);
-    for (let [fieldName, type] of Object.entries(optValidators))
+    for (const [fieldName, type] of Object.entries(optValidators))
         checkField(fieldName, type, true);
     return object;
 }
 exports.validateObject = validateObject;
+// validate type tests
+// const o: { a: number; b: number; c: number } = { a: 1, b: 5, c: 6 };
+// const z0 = validateObject(o, { a: 'isSafeInteger' }, { c: 'bigint' }); // Ok!
+// // Should fail type-check
+// const z1 = validateObject(o, { a: 'tmp' }, { c: 'zz' });
+// const z2 = validateObject(o, { a: 'isSafeInteger' }, { c: 'zz' });
+// const z3 = validateObject(o, { test: 'boolean', z: 'bug' });
+// const z4 = validateObject(o, { a: 'boolean', z: 'bug' });

package/lib/abstract/weierstrass.js

@@ -19,6 +19,7 @@ function validatePointOpts(curve) {
         wrapPrivateKey: 'boolean',
         isTorsionFree: 'function',
         clearCofactor: 'function',
+        allowInfinityPoint: 'boolean',
     });
     const { endo, Fp, a } = opts;
     if (endo) {
@@ -157,6 +158,8 @@ function weierstrassPoints(opts) {
             if (pz == null || !Fp.isValid(pz))
                 throw new Error('z required');
         }
+        // Does not validate if the point is on-curve.
+        // Use fromHex instead, or call assertValidity() later.
         static fromAffine(p) {
             const { x, y } = p || {};
             if (!p || !Fp.isValid(x) || !Fp.isValid(y))

package/lib/esm/abstract/curve.js

@@ -4,8 +4,17 @@ import { validateField, nLength } from './modular.js';
 import { validateObject } from './utils.js';
 const _0n = BigInt(0);
 const _1n = BigInt(1);
-// Elliptic curve multiplication of Point by scalar. Complicated and fragile. Uses wNAF method.
-// Windowed method is 10% faster, but takes 2x longer to generate & consumes 2x memory.
+// Elliptic curve multiplication of Point by scalar. Fragile.
+// Scalars should always be less than curve order: this should be checked inside of a curve itself.
+// Creates precomputation tables for fast multiplication:
+// - private scalar is split by fixed size windows of W bits
+// - every window point is collected from window's table & added to accumulator
+// - since windows are different, same point inside tables won't be accessed more than once per calc
+// - each multiplication is 'Math.ceil(CURVE_ORDER / 𝑊) + 1' point additions (fixed for any scalar)
+// - +1 window is neccessary for wNAF
+// - wNAF reduces table size: 2x less memory + 2x faster generation, but 10% slower multiplication
+// TODO: Research returning 2d JS array of windows, instead of a single window. This would allow
+// windows to be in different memory locations
 export function wNAF(c, bits) {
     const constTimeNegate = (condition, item) => {
         const neg = item.negate();
@@ -33,8 +42,12 @@ export function wNAF(c, bits) {
         /**
          * Creates a wNAF precomputation window. Used for caching.
          * Default window size is set by `utils.precompute()` and is equal to 8.
-         * Which means we are caching 65536 points: 256 points for every bit from 0 to 256.
-         * @returns 65K precomputed points, depending on W
+         * Number of precomputed points depends on the curve size:
+         * 2^(𝑊−1) * (Math.ceil(𝑛 / 𝑊) + 1), where:
+         * - 𝑊 is the window size
+         * - 𝑛 is the bitlength of the curve order.
+         * For a 256-bit curve and window size 8, the number of precomputed points is 128 * 33 = 4224.
+         * @returns precomputed point tables flattened to a single array
          */
         precomputeWindow(elm, W) {
             const { windows, windowSize } = opts(W);
@@ -54,14 +67,14 @@ export function wNAF(c, bits) {
             return points;
         },
         /**
-         * Implements w-ary non-adjacent form for calculating ec multiplication.
+         * Implements ec multiplication using precomputed tables and w-ary non-adjacent form.
          * @param W window size
-         * @param affinePoint optional 2d point to save cached precompute windows on it.
-         * @param n bits
+         * @param precomputes precomputed tables
+         * @param n scalar (we don't check here, but should be less than curve order)
          * @returns real and fake (for const-time) points
          */
         wNAF(W, precomputes, n) {
-            // TODO: maybe check that scalar is less than group order? wNAF will fail otherwise
+            // TODO: maybe check that scalar is less than group order? wNAF behavious is undefined otherwise
             // But need to carefully remove other checks before wNAF. ORDER == bits here
             const { windows, windowSize } = opts(W);
             let p = c.ZERO;

package/lib/esm/abstract/edwards.js

@@ -106,7 +106,30 @@ export function twistedEdwards(curveDef) {
             this._WINDOW_SIZE = windowSize;
             pointPrecomputes.delete(this);
         }
-        assertValidity() { }
+        // Not required for fromHex(), which always creates valid points.
+        // Could be useful for fromAffine().
+        assertValidity() {
+            const { a, d } = CURVE;
+            if (this.is0())
+                throw new Error('bad point: ZERO'); // TODO: optimize, with vars below?
+            // Equation in affine coordinates: ax² + y² = 1 + dx²y²
+            // Equation in projective coordinates (X/Z, Y/Z, Z):  (aX² + Y²)Z² = Z⁴ + dX²Y²
+            const { ex: X, ey: Y, ez: Z, et: T } = this;
+            const X2 = modP(X * X); // X²
+            const Y2 = modP(Y * Y); // Y²
+            const Z2 = modP(Z * Z); // Z²
+            const Z4 = modP(Z2 * Z2); // Z⁴
+            const aX2 = modP(X2 * a); // aX²
+            const left = modP(Z2 * modP(aX2 + Y2)); // (aX² + Y²)Z²
+            const right = modP(Z4 + modP(d * modP(X2 * Y2))); // Z⁴ + dX²Y²
+            if (left !== right)
+                throw new Error('bad point: equation left != right (1)');
+            // In Extended coordinates we also have T, which is x*y=T/Z: check X*Y == Z*T
+            const XY = modP(X * Y);
+            const ZT = modP(Z * T);
+            if (XY !== ZT)
+                throw new Error('bad point: equation left != right (2)');
+        }
         // Compare one point to another.
         equals(other) {
             isPoint(other);

package/lib/esm/abstract/hash-to-curve.js

@@ -1,19 +1,5 @@
 import { mod } from './modular.js';
-import { concatBytes, ensureBytes } from './utils.js';
-export function validateOpts(opts) {
-    if (typeof opts.DST !== 'string')
-        throw new Error('Invalid htf/DST');
-    if (typeof opts.p !== 'bigint')
-        throw new Error('Invalid htf/p');
-    if (typeof opts.m !== 'number')
-        throw new Error('Invalid htf/m');
-    if (typeof opts.k !== 'number')
-        throw new Error('Invalid htf/k');
-    if (opts.expand !== 'xmd' && opts.expand !== 'xof' && opts.expand !== undefined)
-        throw new Error('Invalid htf/expand');
-    if (typeof opts.hash !== 'function' || !Number.isSafeInteger(opts.hash.outputLen))
-        throw new Error('Invalid htf/hash function');
-}
+import { concatBytes, ensureBytes, validateObject } from './utils.js';
 export function stringToBytes(str) {
     if (typeof str !== 'string') {
         throw new Error(`utf8ToBytes expected string, got ${typeof str}`);
@@ -134,7 +120,15 @@ export function isogenyMap(field, map) {
     };
 }
 export function hashToCurve(Point, mapToCurve, def) {
-    validateOpts(def);
+    validateObject(def, {
+        DST: 'string',
+        p: 'bigint',
+        m: 'isSafeInteger',
+        k: 'isSafeInteger',
+        hash: 'hash',
+    });
+    if (def.expand !== 'xmd' && def.expand !== 'xof' && def.expand !== undefined)
+        throw new Error('Invalid htf/expand');
     if (typeof mapToCurve !== 'function')
         throw new Error('hashToCurve: mapToCurve() has not been defined');
     return {

package/lib/esm/abstract/montgomery.js

@@ -118,7 +118,9 @@ export function montgomery(curveDef) {
         // This is very ugly way, but it works because fieldLen-1 is outside of bounds for X448, so this becomes NOOP
         // fieldLen - scalaryBytes = 1 for X448 and = 0 for X25519
         const u = ensureBytes(uEnc, montgomeryBytes);
-        u[fieldLen - 1] &= 127; // 0b0111_1111
+        // u[fieldLen-1] crashes QuickJS (TypeError: out-of-bound numeric index)
+        if (fieldLen === montgomeryBytes)
+            u[fieldLen - 1] &= 127; // 0b0111_1111
         return bytesToNumberLE(u);
     }
     function decodeScalar(n) {

package/lib/esm/abstract/utils.js

@@ -22,7 +22,7 @@ export function hexToNumber(hex) {
     if (typeof hex !== 'string')
         throw new Error('string expected, got ' + typeof hex);
     // Big Endian
-    return BigInt(`0x${hex}`);
+    return BigInt(hex === '' ? '0' : `0x${hex}`);
 }
 // Caching slows it down 2-3x
 export function hexToBytes(hex) {
@@ -99,18 +99,18 @@ export const bitSet = (n, pos, value) => n | ((value ? _1n : _0n) << BigInt(pos)
 // Return mask for N bits (Same as BigInt(`0b${Array(i).fill('1').join('')}`))
 // Not using ** operator with bigints for old engines.
 export const bitMask = (n) => (_2n << BigInt(n - 1)) - _1n;
+const validatorFns = {
+    bigint: (val) => typeof val === 'bigint',
+    function: (val) => typeof val === 'function',
+    boolean: (val) => typeof val === 'boolean',
+    string: (val) => typeof val === 'string',
+    isSafeInteger: (val) => Number.isSafeInteger(val),
+    array: (val) => Array.isArray(val),
+    field: (val, object) => object.Fp.isValid(val),
+    hash: (val) => typeof val === 'function' && Number.isSafeInteger(val.outputLen),
+};
+// type Record<K extends string | number | symbol, T> = { [P in K]: T; }
 export function validateObject(object, validators, optValidators = {}) {
-    const validatorFns = {
-        bigint: (val) => typeof val === 'bigint',
-        function: (val) => typeof val === 'function',
-        boolean: (val) => typeof val === 'boolean',
-        string: (val) => typeof val === 'string',
-        isSafeInteger: (val) => Number.isSafeInteger(val),
-        array: (val) => Array.isArray(val),
-        field: (val) => object.Fp.isValid(val),
-        hash: (val) => typeof val === 'function' && Number.isSafeInteger(val.outputLen),
-    };
-    // type Key = keyof typeof validators;
     const checkField = (fieldName, type, isOptional) => {
         const checkVal = validatorFns[type];
         if (typeof checkVal !== 'function')
@@ -118,13 +118,21 @@ export function validateObject(object, validators, optValidators = {}) {
         const val = object[fieldName];
         if (isOptional && val === undefined)
             return;
-        if (!checkVal(val)) {
-            throw new Error(`Invalid param ${fieldName}=${val} (${typeof val}), expected ${type}`);
+        if (!checkVal(val, object)) {
+            throw new Error(`Invalid param ${String(fieldName)}=${val} (${typeof val}), expected ${type}`);
         }
     };
-    for (let [fieldName, type] of Object.entries(validators))
+    for (const [fieldName, type] of Object.entries(validators))
         checkField(fieldName, type, false);
-    for (let [fieldName, type] of Object.entries(optValidators))
+    for (const [fieldName, type] of Object.entries(optValidators))
         checkField(fieldName, type, true);
     return object;
 }
+// validate type tests
+// const o: { a: number; b: number; c: number } = { a: 1, b: 5, c: 6 };
+// const z0 = validateObject(o, { a: 'isSafeInteger' }, { c: 'bigint' }); // Ok!
+// // Should fail type-check
+// const z1 = validateObject(o, { a: 'tmp' }, { c: 'zz' });
+// const z2 = validateObject(o, { a: 'isSafeInteger' }, { c: 'zz' });
+// const z3 = validateObject(o, { test: 'boolean', z: 'bug' });
+// const z4 = validateObject(o, { a: 'boolean', z: 'bug' });

package/lib/esm/abstract/weierstrass.js

@@ -16,6 +16,7 @@ function validatePointOpts(curve) {
         wrapPrivateKey: 'boolean',
         isTorsionFree: 'function',
         clearCofactor: 'function',
+        allowInfinityPoint: 'boolean',
     });
     const { endo, Fp, a } = opts;
     if (endo) {
@@ -154,6 +155,8 @@ export function weierstrassPoints(opts) {
             if (pz == null || !Fp.isValid(pz))
                 throw new Error('z required');
         }
+        // Does not validate if the point is on-curve.
+        // Use fromHex instead, or call assertValidity() later.
         static fromAffine(p) {
             const { x, y } = p || {};
             if (!p || !Fp.isValid(x) || !Fp.isValid(y))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noble/curves",
-  "version": "0.6.1",
+  "version": "0.6.3",
   "description": "Minimal, auditable JS implementation of elliptic curve cryptography",
   "files": [
     "lib"
@@ -21,19 +21,17 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@noble/hashes": "1.1.5"
+    "@noble/hashes": "1.2.0"
   },
   "devDependencies": {
-    "@rollup/plugin-node-resolve": "13.3.0",
     "@scure/base": "~1.1.1",
-    "@scure/bip32": "~1.1.1",
-    "@scure/bip39": "~1.1.0",
+    "@scure/bip32": "~1.1.5",
+    "@scure/bip39": "~1.1.1",
     "@types/node": "18.11.3",
     "fast-check": "3.0.0",
     "micro-bmark": "0.3.0",
     "micro-should": "0.4.0",
     "prettier": "2.8.3",
-    "rollup": "2.75.5",
     "typescript": "4.7.3"
   },
   "main": "index.js",