@noble/curves 0.6.2 → 0.6.3

package/README.md

@@ -22,8 +22,7 @@ Package consists of two parts:
 
 Curves incorporate work from previous noble packages
 ([secp256k1](https://github.com/paulmillr/noble-secp256k1),
-[ed25519](https://github.com/paulmillr/noble-ed25519),
-[bls12-381](https://github.com/paulmillr/noble-bls12-381)),
+[ed25519](https://github.com/paulmillr/noble-ed25519)),
 which had security audits and were developed from 2019 to 2022.
 Check out [Upgrading](#upgrading) section if you've used them before.
 
@@ -31,14 +30,14 @@ Check out [Upgrading](#upgrading) section if you've used them before.
 
 > **noble-crypto** — high-security, easily auditable set of contained cryptographic libraries and tools.
 
-- Minimal dependencies, small files
+- Protection against supply chain attacks
 - Easily auditable TypeScript/JS code
 - Supported in all major browsers and stable node.js versions
 - All releases are signed with PGP keys
 - Check out [homepage](https://paulmillr.com/noble/) & all libraries:
-  [curves](https://github.com/paulmillr/noble-curves) ([secp256k1](https://github.com/paulmillr/noble-secp256k1),
-  [ed25519](https://github.com/paulmillr/noble-ed25519),
-  [bls12-381](https://github.com/paulmillr/noble-bls12-381)),
+  [curves](https://github.com/paulmillr/noble-curves)
+  ([secp256k1](https://github.com/paulmillr/noble-secp256k1),
+  [ed25519](https://github.com/paulmillr/noble-ed25519)),
   [hashes](https://github.com/paulmillr/noble-hashes)
 
 ## Usage
@@ -48,23 +47,7 @@ Use NPM in node.js / browser, or include single file from
 
 > npm install @noble/curves
 
-The library does not have an entry point. It allows you to select specific primitives and drop everything else. If you only want to use secp256k1, just use the library with rollup or other bundlers. This is done to make your bundles tiny.
-
-```ts
-// Common.js and ECMAScript Modules (ESM)
-import { secp256k1 } from '@noble/curves/secp256k1';
-
-const key = secp256k1.utils.randomPrivateKey();
-const pub = secp256k1.getPublicKey(key);
-const msg = new Uint8Array(32).fill(1);
-const sig = secp256k1.sign(msg, key);
-secp256k1.verify(sig, msg, pub) === true;
-sig.recoverPublicKey(msg) === pub;
-const someonesPub = secp256k1.getPublicKey(secp256k1.utils.randomPrivateKey());
-const shared = secp256k1.getSharedSecret(key, someonesPub);
-```
-
-All curves:
+The library does not have an entry point. It allows you to select specific primitives and drop everything else. If you only want to use secp256k1, just use the library with rollup or other bundlers. This is done to make your bundles tiny. All curves:
 
 ```ts
 import { secp256k1 } from '@noble/curves/secp256k1';
@@ -80,7 +63,25 @@ import { bn254 } from '@noble/curves/bn';
 import { jubjub } from '@noble/curves/jubjub';
 ```
 
-To define a custom curve, check out API below.
+Every curve can be used in the following way:
+
+```ts
+import { secp256k1 } from '@noble/curves/secp256k1'; // Common.js and ECMAScript Modules (ESM)
+
+const key = secp256k1.utils.randomPrivateKey();
+const pub = secp256k1.getPublicKey(key);
+const msg = new Uint8Array(32).fill(1);
+const sig = secp256k1.sign(msg, key);
+// weierstrass curves should use extraEntropy: https://moderncrypto.org/mail-archive/curves/2017/000925.html
+const sigImprovedSecurity = secp256k1.sign(msg, key, { extraEntropy: true });
+secp256k1.verify(sig, msg, pub) === true;
+// secp, p*, pasta curves allow pub recovery
+sig.recoverPublicKey(msg) === pub;
+const someonesPub = secp256k1.getPublicKey(secp256k1.utils.randomPrivateKey());
+const shared = secp256k1.getSharedSecret(key, someonesPub);
+```
+
+To define a custom curve, check out docs below.
 
 ## API
 
@@ -109,17 +110,20 @@ import * as utils from '@noble/curves/abstract/utils';
 They allow to define a new curve in a few lines of code:
 
 ```ts
-import { Fp } from '@noble/curves/abstract/modular';
+import { Field } from '@noble/curves/abstract/modular';
 import { weierstrass } from '@noble/curves/abstract/weierstrass';
 import { hmac } from '@noble/hashes/hmac';
 import { sha256 } from '@noble/hashes/sha256';
 import { concatBytes, randomBytes } from '@noble/hashes/utils';
 
-const secp256k1 = weierstrass({
+// secq (NOT secp) 256k1: cycle of secp256k1 with Fp/N flipped.
+// https://zcash.github.io/halo2/background/curves.html#cycles-of-curves
+// https://personaelabs.org/posts/spartan-ecdsa
+const secq256k1 = weierstrass({
   a: 0n,
   b: 7n,
-  Fp: Fp(2n ** 256n - 2n ** 32n - 2n ** 9n - 2n ** 8n - 2n ** 7n - 2n ** 6n - 2n ** 4n - 1n),
-  n: 2n ** 256n - 432420386565659656852420866394968145599n,
+  Fp: Field(2n ** 256n - 432420386565659656852420866394968145599n),
+  n: 2n ** 256n - 2n ** 32n - 2n ** 9n - 2n ** 8n - 2n ** 7n - 2n ** 6n - 2n ** 4n - 1n,
   Gx: 55066263022277343669578718895168534326250603453777594175500187360389116729240n,
   Gy: 32670510020758816978083085130507043184471273380659243275938904335757337482424n,
   hash: sha256,

package/lib/abstract/curve.d.ts

@@ -26,15 +26,19 @@ export declare function wNAF<T extends Group<T>>(c: GroupConstructor<T>, bits: n
     /**
      * Creates a wNAF precomputation window. Used for caching.
      * Default window size is set by `utils.precompute()` and is equal to 8.
-     * Which means we are caching 65536 points: 256 points for every bit from 0 to 256.
-     * @returns 65K precomputed points, depending on W
+     * Number of precomputed points depends on the curve size:
+     * 2^(𝑊−1) * (Math.ceil(𝑛 / 𝑊) + 1), where:
+     * - 𝑊 is the window size
+     * - 𝑛 is the bitlength of the curve order.
+     * For a 256-bit curve and window size 8, the number of precomputed points is 128 * 33 = 4224.
+     * @returns precomputed point tables flattened to a single array
      */
     precomputeWindow(elm: T, W: number): Group<T>[];
     /**
-     * Implements w-ary non-adjacent form for calculating ec multiplication.
+     * Implements ec multiplication using precomputed tables and w-ary non-adjacent form.
      * @param W window size
-     * @param affinePoint optional 2d point to save cached precompute windows on it.
-     * @param n bits
+     * @param precomputes precomputed tables
+     * @param n scalar (we don't check here, but should be less than curve order)
      * @returns real and fake (for const-time) points
      */
     wNAF(W: number, precomputes: T[], n: bigint): {

package/lib/abstract/curve.js

@@ -7,8 +7,17 @@ const modular_js_1 = require("./modular.js");
 const utils_js_1 = require("./utils.js");
 const _0n = BigInt(0);
 const _1n = BigInt(1);
-// Elliptic curve multiplication of Point by scalar. Complicated and fragile. Uses wNAF method.
-// Windowed method is 10% faster, but takes 2x longer to generate & consumes 2x memory.
+// Elliptic curve multiplication of Point by scalar. Fragile.
+// Scalars should always be less than curve order: this should be checked inside of a curve itself.
+// Creates precomputation tables for fast multiplication:
+// - private scalar is split by fixed size windows of W bits
+// - every window point is collected from window's table & added to accumulator
+// - since windows are different, same point inside tables won't be accessed more than once per calc
+// - each multiplication is 'Math.ceil(CURVE_ORDER / 𝑊) + 1' point additions (fixed for any scalar)
+// - +1 window is neccessary for wNAF
+// - wNAF reduces table size: 2x less memory + 2x faster generation, but 10% slower multiplication
+// TODO: Research returning 2d JS array of windows, instead of a single window. This would allow
+// windows to be in different memory locations
 function wNAF(c, bits) {
     const constTimeNegate = (condition, item) => {
         const neg = item.negate();
@@ -36,8 +45,12 @@ function wNAF(c, bits) {
         /**
          * Creates a wNAF precomputation window. Used for caching.
          * Default window size is set by `utils.precompute()` and is equal to 8.
-         * Which means we are caching 65536 points: 256 points for every bit from 0 to 256.
-         * @returns 65K precomputed points, depending on W
+         * Number of precomputed points depends on the curve size:
+         * 2^(𝑊−1) * (Math.ceil(𝑛 / 𝑊) + 1), where:
+         * - 𝑊 is the window size
+         * - 𝑛 is the bitlength of the curve order.
+         * For a 256-bit curve and window size 8, the number of precomputed points is 128 * 33 = 4224.
+         * @returns precomputed point tables flattened to a single array
          */
         precomputeWindow(elm, W) {
             const { windows, windowSize } = opts(W);
@@ -57,14 +70,14 @@ function wNAF(c, bits) {
             return points;
         },
         /**
-         * Implements w-ary non-adjacent form for calculating ec multiplication.
+         * Implements ec multiplication using precomputed tables and w-ary non-adjacent form.
          * @param W window size
-         * @param affinePoint optional 2d point to save cached precompute windows on it.
-         * @param n bits
+         * @param precomputes precomputed tables
+         * @param n scalar (we don't check here, but should be less than curve order)
          * @returns real and fake (for const-time) points
          */
         wNAF(W, precomputes, n) {
-            // TODO: maybe check that scalar is less than group order? wNAF will fail otherwise
+            // TODO: maybe check that scalar is less than group order? wNAF behavious is undefined otherwise
             // But need to carefully remove other checks before wNAF. ORDER == bits here
             const { windows, windowSize } = opts(W);
             let p = c.ZERO;

package/lib/abstract/hash-to-curve.d.ts

@@ -11,7 +11,6 @@ export declare type Opts = {
     expand?: 'xmd' | 'xof';
     hash: CHash;
 };
-export declare function validateOpts(opts: Opts): void;
 export declare function stringToBytes(str: string): Uint8Array;
 export declare function expand_message_xmd(msg: Uint8Array, DST: Uint8Array, lenInBytes: number, H: CHash): Uint8Array;
 export declare function expand_message_xof(msg: Uint8Array, DST: Uint8Array, lenInBytes: number, k: number, H: CHash): Uint8Array;

package/lib/abstract/hash-to-curve.js

@@ -1,23 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.hashToCurve = exports.isogenyMap = exports.hash_to_field = exports.expand_message_xof = exports.expand_message_xmd = exports.stringToBytes = exports.validateOpts = void 0;
+exports.hashToCurve = exports.isogenyMap = exports.hash_to_field = exports.expand_message_xof = exports.expand_message_xmd = exports.stringToBytes = void 0;
 const modular_js_1 = require("./modular.js");
 const utils_js_1 = require("./utils.js");
-function validateOpts(opts) {
-    if (typeof opts.DST !== 'string')
-        throw new Error('Invalid htf/DST');
-    if (typeof opts.p !== 'bigint')
-        throw new Error('Invalid htf/p');
-    if (typeof opts.m !== 'number')
-        throw new Error('Invalid htf/m');
-    if (typeof opts.k !== 'number')
-        throw new Error('Invalid htf/k');
-    if (opts.expand !== 'xmd' && opts.expand !== 'xof' && opts.expand !== undefined)
-        throw new Error('Invalid htf/expand');
-    if (typeof opts.hash !== 'function' || !Number.isSafeInteger(opts.hash.outputLen))
-        throw new Error('Invalid htf/hash function');
-}
-exports.validateOpts = validateOpts;
 function stringToBytes(str) {
     if (typeof str !== 'string') {
         throw new Error(`utf8ToBytes expected string, got ${typeof str}`);
@@ -143,7 +128,15 @@ function isogenyMap(field, map) {
 }
 exports.isogenyMap = isogenyMap;
 function hashToCurve(Point, mapToCurve, def) {
-    validateOpts(def);
+    (0, utils_js_1.validateObject)(def, {
+        DST: 'string',
+        p: 'bigint',
+        m: 'isSafeInteger',
+        k: 'isSafeInteger',
+        hash: 'hash',
+    });
+    if (def.expand !== 'xmd' && def.expand !== 'xof' && def.expand !== undefined)
+        throw new Error('Invalid htf/expand');
     if (typeof mapToCurve !== 'function')
         throw new Error('hashToCurve: mapToCurve() has not been defined');
     return {

package/lib/esm/abstract/curve.js

@@ -4,8 +4,17 @@ import { validateField, nLength } from './modular.js';
 import { validateObject } from './utils.js';
 const _0n = BigInt(0);
 const _1n = BigInt(1);
-// Elliptic curve multiplication of Point by scalar. Complicated and fragile. Uses wNAF method.
-// Windowed method is 10% faster, but takes 2x longer to generate & consumes 2x memory.
+// Elliptic curve multiplication of Point by scalar. Fragile.
+// Scalars should always be less than curve order: this should be checked inside of a curve itself.
+// Creates precomputation tables for fast multiplication:
+// - private scalar is split by fixed size windows of W bits
+// - every window point is collected from window's table & added to accumulator
+// - since windows are different, same point inside tables won't be accessed more than once per calc
+// - each multiplication is 'Math.ceil(CURVE_ORDER / 𝑊) + 1' point additions (fixed for any scalar)
+// - +1 window is neccessary for wNAF
+// - wNAF reduces table size: 2x less memory + 2x faster generation, but 10% slower multiplication
+// TODO: Research returning 2d JS array of windows, instead of a single window. This would allow
+// windows to be in different memory locations
 export function wNAF(c, bits) {
     const constTimeNegate = (condition, item) => {
         const neg = item.negate();
@@ -33,8 +42,12 @@ export function wNAF(c, bits) {
         /**
          * Creates a wNAF precomputation window. Used for caching.
          * Default window size is set by `utils.precompute()` and is equal to 8.
-         * Which means we are caching 65536 points: 256 points for every bit from 0 to 256.
-         * @returns 65K precomputed points, depending on W
+         * Number of precomputed points depends on the curve size:
+         * 2^(𝑊−1) * (Math.ceil(𝑛 / 𝑊) + 1), where:
+         * - 𝑊 is the window size
+         * - 𝑛 is the bitlength of the curve order.
+         * For a 256-bit curve and window size 8, the number of precomputed points is 128 * 33 = 4224.
+         * @returns precomputed point tables flattened to a single array
          */
         precomputeWindow(elm, W) {
             const { windows, windowSize } = opts(W);
@@ -54,14 +67,14 @@ export function wNAF(c, bits) {
             return points;
         },
         /**
-         * Implements w-ary non-adjacent form for calculating ec multiplication.
+         * Implements ec multiplication using precomputed tables and w-ary non-adjacent form.
          * @param W window size
-         * @param affinePoint optional 2d point to save cached precompute windows on it.
-         * @param n bits
+         * @param precomputes precomputed tables
+         * @param n scalar (we don't check here, but should be less than curve order)
          * @returns real and fake (for const-time) points
          */
         wNAF(W, precomputes, n) {
-            // TODO: maybe check that scalar is less than group order? wNAF will fail otherwise
+            // TODO: maybe check that scalar is less than group order? wNAF behavious is undefined otherwise
             // But need to carefully remove other checks before wNAF. ORDER == bits here
             const { windows, windowSize } = opts(W);
             let p = c.ZERO;

package/lib/esm/abstract/hash-to-curve.js

@@ -1,19 +1,5 @@
 import { mod } from './modular.js';
-import { concatBytes, ensureBytes } from './utils.js';
-export function validateOpts(opts) {
-    if (typeof opts.DST !== 'string')
-        throw new Error('Invalid htf/DST');
-    if (typeof opts.p !== 'bigint')
-        throw new Error('Invalid htf/p');
-    if (typeof opts.m !== 'number')
-        throw new Error('Invalid htf/m');
-    if (typeof opts.k !== 'number')
-        throw new Error('Invalid htf/k');
-    if (opts.expand !== 'xmd' && opts.expand !== 'xof' && opts.expand !== undefined)
-        throw new Error('Invalid htf/expand');
-    if (typeof opts.hash !== 'function' || !Number.isSafeInteger(opts.hash.outputLen))
-        throw new Error('Invalid htf/hash function');
-}
+import { concatBytes, ensureBytes, validateObject } from './utils.js';
 export function stringToBytes(str) {
     if (typeof str !== 'string') {
         throw new Error(`utf8ToBytes expected string, got ${typeof str}`);
@@ -134,7 +120,15 @@ export function isogenyMap(field, map) {
     };
 }
 export function hashToCurve(Point, mapToCurve, def) {
-    validateOpts(def);
+    validateObject(def, {
+        DST: 'string',
+        p: 'bigint',
+        m: 'isSafeInteger',
+        k: 'isSafeInteger',
+        hash: 'hash',
+    });
+    if (def.expand !== 'xmd' && def.expand !== 'xof' && def.expand !== undefined)
+        throw new Error('Invalid htf/expand');
     if (typeof mapToCurve !== 'function')
         throw new Error('hashToCurve: mapToCurve() has not been defined');
     return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noble/curves",
-  "version": "0.6.2",
+  "version": "0.6.3",
   "description": "Minimal, auditable JS implementation of elliptic curve cryptography",
   "files": [
     "lib"
@@ -21,19 +21,17 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@noble/hashes": "1.1.5"
+    "@noble/hashes": "1.2.0"
   },
   "devDependencies": {
-    "@rollup/plugin-node-resolve": "13.3.0",
     "@scure/base": "~1.1.1",
-    "@scure/bip32": "~1.1.1",
-    "@scure/bip39": "~1.1.0",
+    "@scure/bip32": "~1.1.5",
+    "@scure/bip39": "~1.1.1",
     "@types/node": "18.11.3",
     "fast-check": "3.0.0",
     "micro-bmark": "0.3.0",
     "micro-should": "0.4.0",
     "prettier": "2.8.3",
-    "rollup": "2.75.5",
     "typescript": "4.7.3"
   },
   "main": "index.js",