@noble/curves 1.9.4 → 1.9.5

package/src/bls12-381.ts

@@ -84,6 +84,7 @@ import {
   abytes,
   bitGet,
   bitLen,
+  bitMask,
   bytesToHex,
   bytesToNumberBE,
   concatBytes,
@@ -146,7 +147,7 @@ const bls12_381_CURVE_G1: WeierstrassOpts<bigint> = {
 };
 
 // CURVE FIELDS
-export const bls12_381_Fr: IField<bigint> = Field(bls12_381_CURVE_G1.n, { modOnDecode: true });
+export const bls12_381_Fr: IField<bigint> = Field(bls12_381_CURVE_G1.n, { modFromBytes: true });
 const { Fp, Fp2, Fp6, Fp4Square, Fp12 } = tower12({
   // Order of Fp
   ORDER: bls12_381_CURVE_G1.p,
@@ -330,7 +331,7 @@ function pointG1FromBytes(bytes: Uint8Array): AffinePoint<Fp> {
   if (value.length === 48 && compressed) {
     const compressedValue = bytesToNumberBE(value);
     // Zero
-    const x = Fp.create(compressedValue & Fp.MASK);
+    const x = Fp.create(compressedValue & bitMask(Fp.BITS));
     if (infinity) {
       if (x !== _0n) throw new Error('invalid G1 point: non-empty, at infinity, with compression');
       return { x: _0n, y: _0n };
@@ -361,7 +362,7 @@ function signatureG1FromBytes(hex: Hex): WeierstrassPoint<Fp> {
   const compressedValue = bytesToNumberBE(value);
   // Zero
   if (infinity) return Point.ZERO;
-  const x = Fp.create(compressedValue & Fp.MASK);
+  const x = Fp.create(compressedValue & bitMask(Fp.BITS));
   const right = Fp.add(Fp.pow(x, _3n), Fp.create(bls12_381_CURVE_G1.b)); // y² = x³ + b
   let y = Fp.sqrt(right);
   if (!y) throw new Error('invalid G1 point: compressed');
@@ -472,7 +473,7 @@ function signatureG2FromBytes(hex: Hex) {
   const z2 = bytesToNumberBE(value.slice(half));
   // Indicates the infinity point
   if (infinity) return Point.ZERO;
-  const x1 = Fp.create(z1 & Fp.MASK);
+  const x1 = Fp.create(z1 & bitMask(Fp.BITS));
   const x2 = Fp.create(z2);
   const x = Fp2.create({ c0: x2, c1: x1 });
   const y2 = Fp2.add(Fp2.pow(x, _3n), bls12_381_CURVE_G2.b); // y² = x³ + 4

package/src/ed25519.ts

@@ -42,12 +42,17 @@ const _0n = BigInt(0), _1n = BigInt(1), _2n = BigInt(2), _3n = BigInt(3);
 // prettier-ignore
 const _5n = BigInt(5), _8n = BigInt(8);
 
+// 2n**255n-19n
+const ed25519_CURVE_p = BigInt(
+  '0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffed'
+);
+
 // P = 2n**255n - 19n
 // N = 2n**252n + 27742317777372353535851937790883648493n
 // a = Fp.create(BigInt(-1))
 // d = -121665/121666 a.k.a. Fp.neg(121665 * Fp.inv(121666))
 const ed25519_CURVE: EdwardsOpts = {
-  p: BigInt('0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffed'),
+  p: ed25519_CURVE_p,
   n: BigInt('0x1000000000000000000000000000000014def9dea2f79cd65812631a5cf5d3ed'),
   h: _8n,
   a: BigInt('0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffec'),
@@ -59,7 +64,7 @@ const ed25519_CURVE: EdwardsOpts = {
 function ed25519_pow_2_252_3(x: bigint) {
   // prettier-ignore
   const _10n = BigInt(10), _20n = BigInt(20), _40n = BigInt(40), _80n = BigInt(80);
-  const P = ed25519_CURVE.p;
+  const P = ed25519_CURVE_p;
   const x2 = (x * x) % P;
   const b2 = (x2 * x) % P; // x^3, 11
   const b4 = (pow2(b2, _2n, P) * b2) % P; // x^15, 1111
@@ -94,7 +99,7 @@ const ED25519_SQRT_M1 = /* @__PURE__ */ BigInt(
 );
 // sqrt(u/v)
 function uvRatio(u: bigint, v: bigint): { isValid: boolean; value: bigint } {
-  const P = ed25519_CURVE.p;
+  const P = ed25519_CURVE_p;
   const v3 = mod(v * v * v, P); // v³
   const v7 = mod(v3 * v3 * v, P); // v⁷
   // (p+3)/8 and (p-5)/8
@@ -175,7 +180,7 @@ export const ed25519ph: CurveFn = /* @__PURE__ */ (() =>
  * x25519.getPublicKey(x25519.utils.randomSecretKey());
  */
 export const x25519: XCurveFn = /* @__PURE__ */ (() => {
-  const P = ed25519_CURVE.p;
+  const P = ed25519.CURVE.Fp.ORDER;
   return montgomery({
     P,
     type: 'x25519',
@@ -188,18 +193,6 @@ export const x25519: XCurveFn = /* @__PURE__ */ (() => {
   });
 })();
 
-/** @deprecated use `ed25519.utils.toMontgomery` */
-export function edwardsToMontgomeryPub(edwardsPub: Hex): Uint8Array {
-  return ed25519.utils.toMontgomery(ensureBytes('pub', edwardsPub));
-}
-/** @deprecated use `ed25519.utils.toMontgomery` */
-export const edwardsToMontgomery: typeof edwardsToMontgomeryPub = edwardsToMontgomeryPub;
-
-/** @deprecated use `ed25519.utils.toMontgomeryPriv` */
-export function edwardsToMontgomeryPriv(edwardsPriv: Uint8Array): Uint8Array {
-  return ed25519.utils.toMontgomeryPriv(ensureBytes('pub', edwardsPriv));
-}
-
 // Hash To Curve Elligator2 Map (NOTE: different from ristretto255 elligator)
 // NOTE: very important part is usage of FpSqrtEven for ELL2_C1_EDWARDS, since
 // SageMath returns different root first and everything falls apart
@@ -249,7 +242,7 @@ function map_to_curve_elligator2_curve25519(u: bigint) {
   let e3 = Fp.eql(tv2, gx1);    //  34.  e3 = tv2 == gx1
   let xn = Fp.cmov(x2n, x1n, e3); //  35.  xn = CMOV(x2n, x1n, e3)  # If e3, x = x1, else x = x2
   let y = Fp.cmov(y2, y1, e3);  //  36.   y = CMOV(y2, y1, e3)    # If e3, y = y1, else y = y2
-  let e4 = Fp.isOdd(y);         //  37.  e4 = sgn0(y) == 1        # Fix sign of y
+  let e4 = Fp.isOdd!(y);         //  37.  e4 = sgn0(y) == 1        # Fix sign of y
   y = Fp.cmov(y, Fp.neg(y), e3 !== e4); //  38.   y = CMOV(y, -y, e3 XOR e4)
   return { xMn: xn, xMd: xd, yMn: y, yMd: _1n }; //  39. return (xn, xd, y, 1)
 }
@@ -314,7 +307,7 @@ const MAX_255B = /* @__PURE__ */ BigInt(
   '0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
 );
 const bytes255ToNumberLE = (bytes: Uint8Array) =>
-  ed25519.CURVE.Fp.create(bytesToNumberLE(bytes) & MAX_255B);
+  ed25519.Point.Fp.create(bytesToNumberLE(bytes) & MAX_255B);
 
 type ExtendedPoint = EdwardsPoint;
 
@@ -324,9 +317,9 @@ type ExtendedPoint = EdwardsPoint;
  * the [website](https://ristretto.group/formulas/elligator.html).
  */
 function calcElligatorRistrettoMap(r0: bigint): ExtendedPoint {
-  const { d } = ed25519.CURVE;
-  const P = ed25519.CURVE.Fp.ORDER;
-  const mod = ed25519.CURVE.Fp.create;
+  const { d } = ed25519_CURVE;
+  const P = Fp.ORDER;
+  const mod = (n: bigint) => Fp.create(n);
   const r = mod(SQRT_M1 * r0 * r0); // 1
   const Ns = mod((r + _1n) * ONE_MINUS_D_SQ); // 2
   let c = BigInt(-1); // 3
@@ -374,10 +367,10 @@ class _RistrettoPoint extends PrimeEdwardsPoint<_RistrettoPoint> {
     /* @__PURE__ */ (() => new _RistrettoPoint(ed25519.Point.ZERO))();
   // prettier-ignore
   static Fp: IField<bigint> =
-    /* @__PURE__ */ Fp;
+    /* @__PURE__ */ (() => Fp)();
   // prettier-ignore
   static Fn: IField<bigint> =
-    /* @__PURE__ */ Fn;
+    /* @__PURE__ */ (() => Fn)();
 
   constructor(ep: ExtendedPoint) {
     super(ep);
@@ -402,9 +395,9 @@ class _RistrettoPoint extends PrimeEdwardsPoint<_RistrettoPoint> {
 
   static fromBytes(bytes: Uint8Array): _RistrettoPoint {
     abytes(bytes, 32);
-    const { a, d } = ed25519.CURVE;
-    const P = Fp.ORDER;
-    const mod = Fp.create;
+    const { a, d } = ed25519_CURVE;
+    const P = ed25519_CURVE_p;
+    const mod = (n: bigint) => Fp.create(n);
     const s = bytes255ToNumberLE(bytes);
     // 1. Check that s_bytes is the canonical encoding of a field element, or else abort.
     // 3. Check that s is non-negative, or else abort
@@ -447,8 +440,8 @@ class _RistrettoPoint extends PrimeEdwardsPoint<_RistrettoPoint> {
    */
   toBytes(): Uint8Array {
     let { X, Y, Z, T } = this.ep;
-    const P = Fp.ORDER;
-    const mod = Fp.create;
+    const P = ed25519_CURVE_p;
+    const mod = (n: bigint) => Fp.create(n);
     const u1 = mod(mod(Z + Y) * mod(Z - Y)); // 1
     const u2 = mod(X * Y); // 2
     // Square root always exists
@@ -481,7 +474,7 @@ class _RistrettoPoint extends PrimeEdwardsPoint<_RistrettoPoint> {
     this.assertSame(other);
     const { X: X1, Y: Y1 } = this.ep;
     const { X: X2, Y: Y2 } = other.ep;
-    const mod = Fp.create;
+    const mod = (n: bigint) => Fp.create(n);
     // (x1 * y2 == y1 * x2) | (y1 * y2 == x1 * x2)
     const one = mod(X1 * Y2) === mod(Y1 * X2);
     const two = mod(Y1 * Y2) === mod(X1 * X2);
@@ -493,9 +486,6 @@ class _RistrettoPoint extends PrimeEdwardsPoint<_RistrettoPoint> {
   }
 }
 
-/** @deprecated use `ristretto255.Point` */
-export const RistrettoPoint: typeof _RistrettoPoint = _RistrettoPoint;
-
 export const ristretto255: {
   Point: typeof _RistrettoPoint;
 } = { Point: _RistrettoPoint };
@@ -507,7 +497,8 @@ export const ristretto255_hasher: H2CHasherBase<bigint> = {
     return ristretto255_map(expand_message_xmd(msg, DST, 64, sha512));
   },
   hashToScalar(msg: Uint8Array, options: htfBasicOpts = { DST: _DST_scalar }) {
-    return Fn.create(bytesToNumberLE(expand_message_xmd(msg, options.DST, 64, sha512)));
+    const xmd = expand_message_xmd(msg, options.DST, 64, sha512);
+    return ristretto255.Point.Fn.create(bytesToNumberLE(xmd));
   },
 };
 
@@ -519,19 +510,6 @@ export const ristretto255_hasher: H2CHasherBase<bigint> = {
 //   hashToScalar: ristretto255_hasher.hashToScalar,
 // });
 
-/** @deprecated use `import { ed25519_hasher } from '@noble/curves/ed25519.js';` */
-export const hashToCurve: H2CMethod<bigint> = /* @__PURE__ */ (() => ed25519_hasher.hashToCurve)();
-/** @deprecated use `import { ed25519_hasher } from '@noble/curves/ed25519.js';` */
-export const encodeToCurve: H2CMethod<bigint> = /* @__PURE__ */ (() =>
-  ed25519_hasher.encodeToCurve)();
-type RistHasher = (msg: Uint8Array, options: htfBasicOpts) => _RistrettoPoint;
-/** @deprecated use `import { ristretto255_hasher } from '@noble/curves/ed25519.js';` */
-export const hashToRistretto255: RistHasher = /* @__PURE__ */ (() =>
-  ristretto255_hasher.hashToCurve as RistHasher)();
-/** @deprecated use `import { ristretto255_hasher } from '@noble/curves/ed25519.js';` */
-export const hash_to_ristretto255: RistHasher = /* @__PURE__ */ (() =>
-  ristretto255_hasher.hashToCurve as RistHasher)();
-
 /**
  * Weird / bogus points, useful for debugging.
  * All 8 ed25519 points of 8-torsion subgroup can be generated from the point
@@ -548,3 +526,30 @@ export const ED25519_TORSION_SUBGROUP: string[] = [
   '0000000000000000000000000000000000000000000000000000000000000000',
   'c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac03fa',
 ];
+
+/** @deprecated use `ed25519.utils.toMontgomery` */
+export function edwardsToMontgomeryPub(edwardsPub: Hex): Uint8Array {
+  return ed25519.utils.toMontgomery(ensureBytes('pub', edwardsPub));
+}
+/** @deprecated use `ed25519.utils.toMontgomery` */
+export const edwardsToMontgomery: typeof edwardsToMontgomeryPub = edwardsToMontgomeryPub;
+
+/** @deprecated use `ed25519.utils.toMontgomeryPriv` */
+export function edwardsToMontgomeryPriv(edwardsPriv: Uint8Array): Uint8Array {
+  return ed25519.utils.toMontgomeryPriv(ensureBytes('pub', edwardsPriv));
+}
+
+/** @deprecated use `ristretto255.Point` */
+export const RistrettoPoint: typeof _RistrettoPoint = _RistrettoPoint;
+/** @deprecated use `import { ed25519_hasher } from '@noble/curves/ed25519.js';` */
+export const hashToCurve: H2CMethod<bigint> = /* @__PURE__ */ (() => ed25519_hasher.hashToCurve)();
+/** @deprecated use `import { ed25519_hasher } from '@noble/curves/ed25519.js';` */
+export const encodeToCurve: H2CMethod<bigint> = /* @__PURE__ */ (() =>
+  ed25519_hasher.encodeToCurve)();
+type RistHasher = (msg: Uint8Array, options: htfBasicOpts) => _RistrettoPoint;
+/** @deprecated use `import { ristretto255_hasher } from '@noble/curves/ed25519.js';` */
+export const hashToRistretto255: RistHasher = /* @__PURE__ */ (() =>
+  ristretto255_hasher.hashToCurve as RistHasher)();
+/** @deprecated use `import { ristretto255_hasher } from '@noble/curves/ed25519.js';` */
+export const hash_to_ristretto255: RistHasher = /* @__PURE__ */ (() =>
+  ristretto255_hasher.hashToCurve as RistHasher)();

package/src/ed448.ts

@@ -108,12 +108,11 @@ function ed448_pow_Pminus3div4(x: bigint): bigint {
 }
 
 function adjustScalarBytes(bytes: Uint8Array): Uint8Array {
-  // Section 5: Likewise, for X448, set the two least significant bits of the first byte to 0, and the most
-  // significant bit of the last byte to 1.
+  // Section 5: Likewise, for X448, set the two least significant bits of the first byte to 0,
   bytes[0] &= 252; // 0b11111100
   // and the most significant bit of the last byte to 1.
   bytes[55] |= 128; // 0b10000000
-  // NOTE: is is NOOP for 56 bytes scalars (X25519/X448)
+  // NOTE: is NOOP for 56 bytes scalars (X25519/X448)
   bytes[56] = 0; // Byte outside of group (456 buts vs 448 bits)
   return bytes;
 }
@@ -144,25 +143,28 @@ function uvRatio(u: bigint, v: bigint): { isValid: boolean; value: bigint } {
 const Fp = /* @__PURE__ */ (() => Field(ed448_CURVE.p, { BITS: 456, isLE: true }))();
 // RFC 7748 has 56-byte keys, RFC 8032 has 57-byte keys
 const Fn = /* @__PURE__ */ (() => Field(ed448_CURVE.n, { BITS: 448, isLE: true }))();
-// const Fn456 = /* @__PURE__ */ (() => Field(ed448_CURVE.n, { BITS: 456, isLE: true }))();
+// Fn456 has BITS: 456
 
 // SHAKE256(dom4(phflag,context)||x, 114)
+function dom4(data: Uint8Array, ctx: Uint8Array, phflag: boolean) {
+  if (ctx.length > 255) throw new Error('context must be smaller than 255, got: ' + ctx.length);
+  return concatBytes(
+    utf8ToBytes('SigEd448'),
+    new Uint8Array([phflag ? 1 : 0, ctx.length]),
+    ctx,
+    data
+  );
+}
+// const ed448_eddsa_opts = { adjustScalarBytes, domain: dom4 };
+// const ed448_Point = edwards(ed448_CURVE, { Fp, Fn, uvRatio });
+
 const ED448_DEF = /* @__PURE__ */ (() => ({
   ...ed448_CURVE,
   Fp,
   Fn,
   hash: shake256_114,
   adjustScalarBytes,
-  // dom4
-  domain: (data: Uint8Array, ctx: Uint8Array, phflag: boolean) => {
-    if (ctx.length > 255) throw new Error('context must be smaller than 255, got: ' + ctx.length);
-    return concatBytes(
-      utf8ToBytes('SigEd448'),
-      new Uint8Array([phflag ? 1 : 0, ctx.length]),
-      ctx,
-      data
-    );
-  },
+  domain: dom4,
   uvRatio,
 }))();
 
@@ -211,14 +213,6 @@ export const x448: XCurveFn = /* @__PURE__ */ (() => {
   });
 })();
 
-/** @deprecated use `ed448.utils.toMontgomery` */
-export function edwardsToMontgomeryPub(edwardsPub: string | Uint8Array): Uint8Array {
-  return ed448.utils.toMontgomery(ensureBytes('pub', edwardsPub));
-}
-
-/** @deprecated use `ed448.utils.toMontgomery` */
-export const edwardsToMontgomery: typeof edwardsToMontgomeryPub = edwardsToMontgomeryPub;
-
 // Hash To Curve Elligator2 Map
 const ELL2_C1 = /* @__PURE__ */ (() => (Fp.ORDER - BigInt(3)) / BigInt(4))(); // 1. c1 = (q - 3) / 4         # Integer arithmetic
 const ELL2_J = /* @__PURE__ */ BigInt(156326);
@@ -336,9 +330,9 @@ type ExtendedPoint = EdwardsPoint;
  * and [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-element-derivation-2).
  */
 function calcElligatorDecafMap(r0: bigint): ExtendedPoint {
-  const { d } = ed448.CURVE;
+  const { d } = ed448_CURVE;
   const P = Fp.ORDER;
-  const mod = Fp.create;
+  const mod = (n: bigint) => Fp.create(n);
 
   const r = mod(-(r0 * r0)); // 1
   const u0 = mod(d * (r - _1n)); // 2
@@ -390,10 +384,10 @@ class _DecafPoint extends PrimeEdwardsPoint<_DecafPoint> {
     /* @__PURE__ */ (() => new _DecafPoint(ed448.Point.ZERO))();
   // prettier-ignore
   static Fp: IField<bigint> =
-    /* @__PURE__ */ Fp;
+    /* @__PURE__ */ (() => Fp)();
   // prettier-ignore
   static Fn: IField<bigint> =
-    /* @__PURE__ */ Fn;
+    /* @__PURE__ */ (() => Fn)();
 
   constructor(ep: ExtendedPoint) {
     super(ep);
@@ -418,9 +412,9 @@ class _DecafPoint extends PrimeEdwardsPoint<_DecafPoint> {
 
   static fromBytes(bytes: Uint8Array): _DecafPoint {
     abytes(bytes, 56);
-    const { d } = ed448.CURVE;
+    const { d } = ed448_CURVE;
     const P = Fp.ORDER;
-    const mod = Fp.create;
+    const mod = (n: bigint) => Fp.create(n);
     const s = bytes448ToNumberLE(bytes);
 
     // 1. Check that s_bytes is the canonical encoding of a field element, or else abort.
@@ -467,7 +461,7 @@ class _DecafPoint extends PrimeEdwardsPoint<_DecafPoint> {
   toBytes(): Uint8Array {
     const { X, Z, T } = this.ep;
     const P = Fp.ORDER;
-    const mod = Fp.create;
+    const mod = (n: bigint) => Fp.create(n);
 
     const u1 = mod(mod(X + T) * mod(X - T)); // 1
     const x2 = mod(X * X);
@@ -492,7 +486,7 @@ class _DecafPoint extends PrimeEdwardsPoint<_DecafPoint> {
     this.assertSame(other);
     const { X: X1, Y: Y1 } = this.ep;
     const { X: X2, Y: Y2 } = other.ep;
-    const mod = Fp.create;
+    const mod = (n: bigint) => Fp.create(n);
     // (x1 * y2 == y1 * x2)
     return mod(X1 * Y2) === mod(Y1 * X2);
   }
@@ -502,8 +496,6 @@ class _DecafPoint extends PrimeEdwardsPoint<_DecafPoint> {
   }
 }
 
-/** @deprecated use `decaf448.Point` */
-export const DecafPoint: typeof _DecafPoint = _DecafPoint;
 export const decaf448: {
   Point: typeof _DecafPoint;
 } = { Point: _DecafPoint };
@@ -527,8 +519,23 @@ export const decaf448_hasher: H2CHasherBase<bigint> = {
 //   hashToScalar: decaf448_hasher.hashToScalar,
 // });
 
+/**
+ * Weird / bogus points, useful for debugging.
+ * Unlike ed25519, there is no ed448 generator point which can produce full T subgroup.
+ * Instead, there is a Klein four-group, which spans over 2 independent 2-torsion points:
+ * (0, 1), (0, -1), (-1, 0), (1, 0).
+ */
+export const ED448_TORSION_SUBGROUP: string[] = [
+  '010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000',
+  'fefffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffffffffffffffffffffffffffffffffffffffffffffffffff00',
+  '000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000',
+  '000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080',
+];
+
 type DcfHasher = (msg: Uint8Array, options: htfBasicOpts) => _DecafPoint;
 
+/** @deprecated use `decaf448.Point` */
+export const DecafPoint: typeof _DecafPoint = _DecafPoint;
 /** @deprecated use `import { ed448_hasher } from '@noble/curves/ed448.js';` */
 export const hashToCurve: H2CMethod<bigint> = /* @__PURE__ */ (() => ed448_hasher.hashToCurve)();
 /** @deprecated use `import { ed448_hasher } from '@noble/curves/ed448.js';` */
@@ -541,15 +548,10 @@ export const hashToDecaf448: DcfHasher = /* @__PURE__ */ (() =>
 export const hash_to_decaf448: DcfHasher = /* @__PURE__ */ (() =>
   decaf448_hasher.hashToCurve as DcfHasher)();
 
-/**
- * Weird / bogus points, useful for debugging.
- * Unlike ed25519, there is no ed448 generator point which can produce full T subgroup.
- * Instead, there is a Klein four-group, which spans over 2 independent 2-torsion points:
- * (0, 1), (0, -1), (-1, 0), (1, 0).
- */
-export const ED448_TORSION_SUBGROUP: string[] = [
-  '010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000',
-  'fefffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffffffffffffffffffffffffffffffffffffffffffffffffff00',
-  '000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000',
-  '000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080',
-];
+/** @deprecated use `ed448.utils.toMontgomery` */
+export function edwardsToMontgomeryPub(edwardsPub: string | Uint8Array): Uint8Array {
+  return ed448.utils.toMontgomery(ensureBytes('pub', edwardsPub));
+}
+
+/** @deprecated use `ed448.utils.toMontgomery` */
+export const edwardsToMontgomery: typeof edwardsToMontgomeryPub = edwardsToMontgomeryPub;

package/src/misc.ts

@@ -64,9 +64,9 @@ export function jubjub_groupHash(tag: Uint8Array, personalization: Uint8Array):
   h.update(jubjub_gh_first_block);
   h.update(tag);
   // NOTE: returns ExtendedPoint, in case it will be multiplied later
-  let p = jubjub.Point.fromHex(h.digest());
+  let p = jubjub.Point.fromBytes(h.digest());
   // NOTE: cannot replace with isSmallOrder, returns Point*8
-  p = p.multiply(jubjub.CURVE.h);
+  p = p.multiply(jubjub_CURVE.h);
   if (p.equals(jubjub.Point.ZERO)) throw new Error('Point has small order');
   return p;
 }

package/src/nist.ts

@@ -160,6 +160,13 @@ export const p521: CurveFnWithCreate = createCurve(
   sha512
 );
 
+/** @deprecated use `p256` for consistency with `p256_hasher` */
+export const secp256r1: typeof p256 = p256;
+/** @deprecated use `p384` for consistency with `p384_hasher` */
+export const secp384r1: typeof p384 = p384;
+/** @deprecated use `p521` for consistency with `p521_hasher` */
+export const secp521r1: typeof p521 = p521;
+
 /** Hashing / encoding to p521 points / field. RFC 9380 methods. */
 export const p521_hasher: H2CHasher<bigint> = /* @__PURE__ */ (() => {
   return createHasher(

package/src/secp256k1.ts

@@ -9,7 +9,7 @@
 import { sha256 } from '@noble/hashes/sha2.js';
 import { randomBytes } from '@noble/hashes/utils.js';
 import { createCurve, type CurveFnWithCreate } from './_shortw_utils.ts';
-import type { CurveInfo } from './abstract/curve.ts';
+import type { CurveLengths } from './abstract/curve.ts';
 import {
   createHasher,
   type H2CHasher,
@@ -33,6 +33,7 @@ import {
   ensureBytes,
   inRange,
   numberToBytesBE,
+  utf8ToBytes,
 } from './utils.ts';
 
 // Seems like generator was produced from some seed:
@@ -88,7 +89,7 @@ function sqrtMod(y: bigint): bigint {
   return root;
 }
 
-const Fpk1 = Field(secp256k1_CURVE.p, undefined, undefined, { sqrt: sqrtMod });
+const Fpk1 = Field(secp256k1_CURVE.p, { sqrt: sqrtMod });
 
 /**
  * secp256k1 curve, ECDSA and ECDH methods.
@@ -116,7 +117,7 @@ const TAGGED_HASH_PREFIXES: { [tag: string]: Uint8Array } = {};
 function taggedHash(tag: string, ...messages: Uint8Array[]): Uint8Array {
   let tagP = TAGGED_HASH_PREFIXES[tag];
   if (tagP === undefined) {
-    const tagH = sha256(Uint8Array.from(tag, (c) => c.charCodeAt(0)));
+    const tagH = sha256(utf8ToBytes(tag));
     tagP = concatBytes(tagH, tagH);
     TAGGED_HASH_PREFIXES[tag] = tagP;
   }
@@ -237,7 +238,7 @@ export type SecpSchnorr = {
     /** @deprecated use `modular` */
     mod: typeof mod;
   };
-  info: { type: 'weierstrass'; publicKeyHasPrefix: false; lengths: CurveInfo['lengths'] };
+  lengths: CurveLengths;
 };
 /**
  * Schnorr signatures over secp256k1.
@@ -282,15 +283,12 @@ export const schnorr: SecpSchnorr = /* @__PURE__ */ (() => {
       bytesToNumberBE,
       mod,
     },
-    info: {
-      type: 'weierstrass',
+    lengths: {
+      secret: size,
+      public: size,
+      signature: size * 2,
+      seed: seedLength,
       publicKeyHasPrefix: false,
-      lengths: {
-        secret: size,
-        public: size,
-        signature: size * 2,
-        seed: seedLength,
-      },
     },
   };
 })();

package/src/utils.ts

@@ -37,6 +37,30 @@ export function abool(title: string, value: boolean): void {
   if (typeof value !== 'boolean') throw new Error(title + ' boolean expected, got ' + value);
 }
 
+// tmp name until v2
+export function _abool2(value: boolean, title: string = ''): boolean {
+  if (typeof value !== 'boolean') {
+    const prefix = title && `"${title}"`;
+    throw new Error(prefix + 'expected boolean, got type=' + typeof value);
+  }
+  return value;
+}
+
+// tmp name until v2
+/** Asserts something is Uint8Array. */
+export function _abytes2(value: Uint8Array, length?: number, title: string = ''): Uint8Array {
+  const bytes = isBytes_(value);
+  const len = value?.length;
+  const needsLen = length !== undefined;
+  if (!bytes || (needsLen && len !== length)) {
+    const prefix = title && `"${title}"`;
+    const ofLen = needsLen ? ` of length ${length}` : '';
+    const got = bytes ? `length=${len}` : `type=${typeof value}`;
+    throw new Error(prefix + 'expected Uint8Array' + ofLen + ', got ' + got);
+  }
+  return value;
+}
+
 // Used in weierstrass, der
 export function numberToHexUnpadded(num: number | bigint): string {
   const hex = num.toString(16);
@@ -105,6 +129,30 @@ export function equalBytes(a: Uint8Array, b: Uint8Array): boolean {
   for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];
   return diff === 0;
 }
+/**
+ * Copies Uint8Array. We can't use u8a.slice(), because u8a can be Buffer,
+ * and Buffer#slice creates mutable copy. Never use Buffers!
+ */
+export function copyBytes(bytes: Uint8Array): Uint8Array {
+  return Uint8Array.from(bytes);
+}
+
+/**
+ * Decodes 7-bit ASCII string to Uint8Array, throws on non-ascii symbols
+ * Should be safe to use for things expected to be ASCII.
+ * Returns exact same result as utf8ToBytes for ASCII or throws.
+ */
+export function asciiToBytes(ascii: string): Uint8Array {
+  return Uint8Array.from(ascii, (c, i) => {
+    const charCode = c.charCodeAt(0);
+    if (c.length !== 1 || charCode > 127) {
+      throw new Error(
+        `string contains non-ASCII character "${ascii[i]}" with code ${charCode} at position ${i}`
+      );
+    }
+    return charCode;
+  });
+}
 
 /**
  * @example utf8ToBytes('abc') // new Uint8Array([97, 98, 99])

package/utils.d.ts

@@ -11,6 +11,9 @@ export type CHash = {
 };
 export type FHash = (message: Uint8Array | string) => Uint8Array;
 export declare function abool(title: string, value: boolean): void;
+export declare function _abool2(value: boolean, title?: string): boolean;
+/** Asserts something is Uint8Array. */
+export declare function _abytes2(value: Uint8Array, length?: number, title?: string): Uint8Array;
 export declare function numberToHexUnpadded(num: number | bigint): string;
 export declare function hexToNumber(hex: string): bigint;
 export declare function bytesToNumberBE(bytes: Uint8Array): bigint;
@@ -29,6 +32,17 @@ export declare function numberToVarBytesBE(n: number | bigint): Uint8Array;
  */
 export declare function ensureBytes(title: string, hex: Hex, expectedLength?: number): Uint8Array;
 export declare function equalBytes(a: Uint8Array, b: Uint8Array): boolean;
+/**
+ * Copies Uint8Array. We can't use u8a.slice(), because u8a can be Buffer,
+ * and Buffer#slice creates mutable copy. Never use Buffers!
+ */
+export declare function copyBytes(bytes: Uint8Array): Uint8Array;
+/**
+ * Decodes 7-bit ASCII string to Uint8Array, throws on non-ascii symbols
+ * Should be safe to use for things expected to be ASCII.
+ * Returns exact same result as utf8ToBytes for ASCII or throws.
+ */
+export declare function asciiToBytes(ascii: string): Uint8Array;
 export declare function inRange(n: bigint, min: bigint, max: bigint): boolean;
 /**
  * Asserts min <= n < max. NOTE: It's < max and not <= max.

package/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["src/utils.ts"],"names":[],"mappings":"AAYA,OAAO,EACL,MAAM,EACN,OAAO,EACP,UAAU,EACV,WAAW,EACX,WAAW,EACX,UAAU,EACV,OAAO,EACP,WAAW,EACX,WAAW,GACZ,MAAM,wBAAwB,CAAC;AAGhC,MAAM,MAAM,GAAG,GAAG,UAAU,GAAG,MAAM,CAAC;AACtC,MAAM,MAAM,OAAO,GAAG,GAAG,GAAG,MAAM,CAAC;AACnC,MAAM,MAAM,KAAK,GAAG;IAClB,CAAC,OAAO,EAAE,UAAU,GAAG,MAAM,GAAG,UAAU,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,GAAG,CAAC;CACxC,CAAC;AACF,MAAM,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,UAAU,GAAG,MAAM,KAAK,UAAU,CAAC;AAEjE,wBAAgB,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAEzD;AAGD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAGhE;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAG/C;AAGD,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAEzD;AACD,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAGzD;AAED,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,UAAU,CAE3E;AACD,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,UAAU,CAE3E;AAED,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,UAAU,CAEjE;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,UAAU,CAmBxF;AAGD,wBAAgB,UAAU,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,GAAG,OAAO,CAKhE;AAeD,wBAAgB,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAEpE;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAQjF;AAID;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAIxC;AAED;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;GAEG;AACH,wBAAgB,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAErE;AAED;;;GAGG;AACH,eAAO,MAAM,OAAO,GAAI,GAAG,MAAM,KAAG,MAAkC,CAAC;AAIvE,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,KAAK,CAAC,GAAG,SAAS,CAAC;AAChD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAC9B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,QAAQ,EAAE,UAAU,EAAE,KAAK,UAAU,GACjE,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CA8C7C;AAID,QAAA,MAAM,YAAY;2BACF,GAAG,KAAG,OAAO;6BACX,GAAG,KAAG,OAAO;4BACd,GAAG,KAAG,OAAO;2BACd,GAAG,KAAG,OAAO;uCACD,GAAG,KAAG,OAAO;kCAClB,GAAG,KAAG,OAAO;0BACrB,GAAG,KAAG,OAAO;0BACb,GAAG,UAAU,GAAG,KAAG,GAAG;yBACvB,GAAG,KAAG,OAAO;CACjB,CAAC;AACX,KAAK,SAAS,GAAG,MAAM,OAAO,YAAY,CAAC;AAC3C,KAAK,MAAM,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI;KAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS;CAAE,CAAC;AAG5E,wBAAgB,cAAc,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1D,MAAM,EAAE,CAAC,EACT,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,EACrB,aAAa,GAAE,MAAM,CAAC,CAAC,CAAM,GAC5B,CAAC,CAgBH;AAUD,wBAAgB,MAAM,CAAC,GAAG,EAAE,KAAK,GAAG,OAAO,CAE1C;AACD,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,SAAS,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GACrC,IAAI,CAYN;AAED;;GAEG;AACH,eAAO,MAAM,cAAc,QAAO,KAEjC,CAAC;AAEF;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,CAAC,SAAS,GAAG,EAAE,EAC3D,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,CAAC,GAC5B,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,CAAC,CAS3B"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["src/utils.ts"],"names":[],"mappings":"AAYA,OAAO,EACL,MAAM,EACN,OAAO,EACP,UAAU,EACV,WAAW,EACX,WAAW,EACX,UAAU,EACV,OAAO,EACP,WAAW,EACX,WAAW,GACZ,MAAM,wBAAwB,CAAC;AAGhC,MAAM,MAAM,GAAG,GAAG,UAAU,GAAG,MAAM,CAAC;AACtC,MAAM,MAAM,OAAO,GAAG,GAAG,GAAG,MAAM,CAAC;AACnC,MAAM,MAAM,KAAK,GAAG;IAClB,CAAC,OAAO,EAAE,UAAU,GAAG,MAAM,GAAG,UAAU,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,GAAG,CAAC;CACxC,CAAC;AACF,MAAM,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,UAAU,GAAG,MAAM,KAAK,UAAU,CAAC;AAEjE,wBAAgB,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAEzD;AAGD,wBAAgB,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,GAAE,MAAW,GAAG,OAAO,CAMnE;AAGD,uCAAuC;AACvC,wBAAgB,QAAQ,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,GAAE,MAAW,GAAG,UAAU,CAW3F;AAGD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAGhE;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAG/C;AAGD,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAEzD;AACD,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAGzD;AAED,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,UAAU,CAE3E;AACD,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,UAAU,CAE3E;AAED,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,UAAU,CAEjE;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,UAAU,CAmBxF;AAGD,wBAAgB,UAAU,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,GAAG,OAAO,CAKhE;AACD;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU,CAEvD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAUtD;AAeD,wBAAgB,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAEpE;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAQjF;AAID;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAIxC;AAED;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;GAEG;AACH,wBAAgB,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAErE;AAED;;;GAGG;AACH,eAAO,MAAM,OAAO,GAAI,GAAG,MAAM,KAAG,MAAkC,CAAC;AAIvE,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,KAAK,CAAC,GAAG,SAAS,CAAC;AAChD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAC9B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,QAAQ,EAAE,UAAU,EAAE,KAAK,UAAU,GACjE,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CA8C7C;AAID,QAAA,MAAM,YAAY;2BACF,GAAG,KAAG,OAAO;6BACX,GAAG,KAAG,OAAO;4BACd,GAAG,KAAG,OAAO;2BACd,GAAG,KAAG,OAAO;uCACD,GAAG,KAAG,OAAO;kCAClB,GAAG,KAAG,OAAO;0BACrB,GAAG,KAAG,OAAO;0BACb,GAAG,UAAU,GAAG,KAAG,GAAG;yBACvB,GAAG,KAAG,OAAO;CACjB,CAAC;AACX,KAAK,SAAS,GAAG,MAAM,OAAO,YAAY,CAAC;AAC3C,KAAK,MAAM,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI;KAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS;CAAE,CAAC;AAG5E,wBAAgB,cAAc,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1D,MAAM,EAAE,CAAC,EACT,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,EACrB,aAAa,GAAE,MAAM,CAAC,CAAC,CAAM,GAC5B,CAAC,CAgBH;AAUD,wBAAgB,MAAM,CAAC,GAAG,EAAE,KAAK,GAAG,OAAO,CAE1C;AACD,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,SAAS,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GACrC,IAAI,CAYN;AAED;;GAEG;AACH,eAAO,MAAM,cAAc,QAAO,KAEjC,CAAC;AAEF;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,CAAC,SAAS,GAAG,EAAE,EAC3D,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,CAAC,GAC5B,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,CAAC,CAS3B"}