@noble/curves 1.9.4 → 1.9.6

package/abstract/weierstrass.js

@@ -2,13 +2,14 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DER = exports.DERErr = void 0;
 exports._splitEndoScalar = _splitEndoScalar;
-exports._legacyHelperEquat = _legacyHelperEquat;
 exports._normFnElement = _normFnElement;
 exports.weierstrassN = weierstrassN;
-exports.weierstrassPoints = weierstrassPoints;
 exports.SWUFpSqrtRatio = SWUFpSqrtRatio;
 exports.mapToCurveSimpleSWU = mapToCurveSimpleSWU;
+exports.ecdh = ecdh;
 exports.ecdsa = ecdsa;
+exports.weierstrassPoints = weierstrassPoints;
+exports._legacyHelperEquat = _legacyHelperEquat;
 exports.weierstrass = weierstrass;
 /**
  * Short Weierstrass curve methods. The formula is: y² = x³ + ax + b.
@@ -72,11 +73,22 @@ function _splitEndoScalar(k, basis, n) {
     }
     return { k1neg, k1, k2neg, k2 };
 }
-function validateSigVerOpts(opts) {
-    if (opts.lowS !== undefined)
-        (0, utils_ts_1.abool)('lowS', opts.lowS);
-    if (opts.prehash !== undefined)
-        (0, utils_ts_1.abool)('prehash', opts.prehash);
+function validateSigFormat(format) {
+    if (!['compact', 'recovered', 'der'].includes(format))
+        throw new Error('Signature format must be "compact", "recovered", or "der"');
+    return format;
+}
+function validateSigOpts(opts, def) {
+    const optsn = {};
+    for (let optName of Object.keys(def)) {
+        // @ts-ignore
+        optsn[optName] = opts[optName] === undefined ? def[optName] : opts[optName];
+    }
+    (0, utils_ts_1._abool2)(optsn.lowS, 'lowS');
+    (0, utils_ts_1._abool2)(optsn.prehash, 'prehash');
+    if (optsn.format !== undefined)
+        validateSigFormat(optsn.format);
+    return optsn;
 }
 class DERErr extends Error {
     constructor(m = '') {
@@ -198,19 +210,6 @@ exports.DER = {
 // Be friendly to bad ECMAScript parsers by not using bigint literals
 // prettier-ignore
 const _0n = BigInt(0), _1n = BigInt(1), _2n = BigInt(2), _3n = BigInt(3), _4n = BigInt(4);
-// TODO: remove
-function _legacyHelperEquat(Fp, a, b) {
-    /**
-     * y² = x³ + ax + b: Short weierstrass curve formula. Takes x, returns y².
-     * @returns y²
-     */
-    function weierstrassEquation(x) {
-        const x2 = Fp.sqr(x); // x * x
-        const x3 = Fp.mul(x2, x); // x² * x
-        return Fp.add(Fp.add(x3, Fp.mul(x, a)), b); // x³ + a * x + b
-    }
-    return weierstrassEquation;
-}
 function _normFnElement(Fn, key) {
     const { BYTES: expected } = Fn;
     let num;
@@ -230,10 +229,29 @@ function _normFnElement(Fn, key) {
         throw new Error('invalid private key: out of range [1..N-1]');
     return num;
 }
-function weierstrassN(CURVE, curveOpts = {}) {
-    const { Fp, Fn } = (0, curve_ts_1._createCurveFields)('weierstrass', CURVE, curveOpts);
+/**
+ * Creates weierstrass Point constructor, based on specified curve options.
+ *
+ * @example
+```js
+const opts = {
+  p: BigInt('0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff'),
+  n: BigInt('0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551'),
+  h: BigInt(1),
+  a: BigInt('0xffffffff00000001000000000000000000000000fffffffffffffffffffffffc'),
+  b: BigInt('0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b'),
+  Gx: BigInt('0x6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296'),
+  Gy: BigInt('0x4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5'),
+};
+const p256_Point = weierstrass(opts);
+```
+ */
+function weierstrassN(params, extraOpts = {}) {
+    const validated = (0, curve_ts_1._createCurveFields)('weierstrass', params, extraOpts);
+    const { Fp, Fn } = validated;
+    let CURVE = validated.CURVE;
     const { h: cofactor, n: CURVE_ORDER } = CURVE;
-    (0, utils_ts_1._validateObject)(curveOpts, {}, {
+    (0, utils_ts_1._validateObject)(extraOpts, {}, {
         allowInfinityPoint: 'boolean',
         clearCofactor: 'function',
         isTorsionFree: 'function',
@@ -242,13 +260,14 @@ function weierstrassN(CURVE, curveOpts = {}) {
         endo: 'object',
         wrapPrivateKey: 'boolean',
     });
-    const { endo } = curveOpts;
+    const { endo } = extraOpts;
     if (endo) {
         // validateObject(endo, { beta: 'bigint', splitScalar: 'function' });
         if (!Fp.is0(CURVE.a) || typeof endo.beta !== 'bigint' || !Array.isArray(endo.basises)) {
             throw new Error('invalid endo: expected "beta": bigint and "basises": array');
         }
     }
+    const lengths = getWLengths(Fp, Fn);
     function assertCompressionIsSupported() {
         if (!Fp.isOdd)
             throw new Error('compression is not supported: Field does not have .isOdd()');
@@ -257,7 +276,7 @@ function weierstrassN(CURVE, curveOpts = {}) {
     function pointToBytes(_c, point, isCompressed) {
         const { x, y } = point.toAffine();
         const bx = Fp.toBytes(x);
-        (0, utils_ts_1.abool)('isCompressed', isCompressed);
+        (0, utils_ts_1._abool2)(isCompressed, 'isCompressed');
         if (isCompressed) {
             assertCompressionIsSupported();
             const hasEvenY = !Fp.isOdd(y);
@@ -268,15 +287,13 @@ function weierstrassN(CURVE, curveOpts = {}) {
         }
     }
     function pointFromBytes(bytes) {
-        (0, utils_ts_1.abytes)(bytes);
-        const L = Fp.BYTES;
-        const LC = L + 1; // length compressed, e.g. 33 for 32-byte field
-        const LU = 2 * L + 1; // length uncompressed, e.g. 65 for 32-byte field
+        (0, utils_ts_1._abytes2)(bytes, undefined, 'Point');
+        const { publicKey: comp, publicKeyUncompressed: uncomp } = lengths; // e.g. for 32-byte: 33, 65
         const length = bytes.length;
         const head = bytes[0];
         const tail = bytes.subarray(1);
         // No actual validation is done here: use .assertValidity()
-        if (length === LC && (head === 0x02 || head === 0x03)) {
+        if (length === comp && (head === 0x02 || head === 0x03)) {
             const x = Fp.fromBytes(tail);
             if (!Fp.isValid(x))
                 throw new Error('bad point: is not on curve, wrong x');
@@ -296,21 +313,26 @@ function weierstrassN(CURVE, curveOpts = {}) {
                 y = Fp.neg(y);
             return { x, y };
         }
-        else if (length === LU && head === 0x04) {
+        else if (length === uncomp && head === 0x04) {
             // TODO: more checks
-            const x = Fp.fromBytes(tail.subarray(L * 0, L * 1));
-            const y = Fp.fromBytes(tail.subarray(L * 1, L * 2));
+            const L = Fp.BYTES;
+            const x = Fp.fromBytes(tail.subarray(0, L));
+            const y = Fp.fromBytes(tail.subarray(L, L * 2));
             if (!isValidXY(x, y))
                 throw new Error('bad point: is not on curve');
             return { x, y };
         }
         else {
-            throw new Error(`bad point: got length ${length}, expected compressed=${LC} or uncompressed=${LU}`);
+            throw new Error(`bad point: got length ${length}, expected compressed=${comp} or uncompressed=${uncomp}`);
         }
     }
-    const toBytes = curveOpts.toBytes || pointToBytes;
-    const fromBytes = curveOpts.fromBytes || pointFromBytes;
-    const weierstrassEquation = _legacyHelperEquat(Fp, CURVE.a, CURVE.b);
+    const encodePoint = extraOpts.toBytes || pointToBytes;
+    const decodePoint = extraOpts.fromBytes || pointFromBytes;
+    function weierstrassEquation(x) {
+        const x2 = Fp.sqr(x); // x * x
+        const x3 = Fp.mul(x2, x); // x² * x
+        return Fp.add(Fp.add(x3, Fp.mul(x, CURVE.a)), CURVE.b); // x³ + a * x + b
+    }
     // TODO: move top-level
     /** Checks whether equation holds for given x, y: y² == x³ + ax + b */
     function isValidXY(x, y) {
@@ -373,7 +395,7 @@ function weierstrassN(CURVE, curveOpts = {}) {
             // (0, 1, 0) aka ZERO is invalid in most contexts.
             // In BLS, ZERO can be serialized, so we allow it.
             // (0, 0, 0) is invalid representation of ZERO.
-            if (curveOpts.allowInfinityPoint && !Fp.is0(p.Y))
+            if (extraOpts.allowInfinityPoint && !Fp.is0(p.Y))
                 return;
             throw new Error('bad point: ZERO');
         }
@@ -406,6 +428,9 @@ function weierstrassN(CURVE, curveOpts = {}) {
             this.Z = acoord('z', Z);
             Object.freeze(this);
         }
+        static CURVE() {
+            return CURVE;
+        }
         /** Does NOT validate if the point is valid. Use `.assertValidity()`. */
         static fromAffine(p) {
             const { x, y } = p || {};
@@ -418,45 +443,19 @@ function weierstrassN(CURVE, curveOpts = {}) {
                 return Point.ZERO;
             return new Point(x, y, Fp.ONE);
         }
-        get x() {
-            return this.toAffine().x;
-        }
-        get y() {
-            return this.toAffine().y;
-        }
-        // TODO: remove
-        get px() {
-            return this.X;
-        }
-        get py() {
-            return this.X;
-        }
-        get pz() {
-            return this.Z;
-        }
-        static normalizeZ(points) {
-            return (0, curve_ts_1.normalizeZ)(Point, points);
-        }
         static fromBytes(bytes) {
-            (0, utils_ts_1.abytes)(bytes);
-            return Point.fromHex(bytes);
-        }
-        /** Converts hash string or Uint8Array to Point. */
-        static fromHex(hex) {
-            const P = Point.fromAffine(fromBytes((0, utils_ts_1.ensureBytes)('pointHex', hex)));
+            const P = Point.fromAffine(decodePoint((0, utils_ts_1._abytes2)(bytes, undefined, 'point')));
             P.assertValidity();
             return P;
         }
-        /** Multiplies generator point by privateKey. */
-        static fromPrivateKey(privateKey) {
-            return Point.BASE.multiply(_normFnElement(Fn, privateKey));
+        static fromHex(hex) {
+            return Point.fromBytes((0, utils_ts_1.ensureBytes)('pointHex', hex));
         }
-        // TODO: remove
-        static msm(points, scalars) {
-            return (0, curve_ts_1.pippenger)(Point, Fn, points, scalars);
+        get x() {
+            return this.toAffine().x;
         }
-        _setWindowSize(windowSize) {
-            this.precompute(windowSize);
+        get y() {
+            return this.toAffine().y;
         }
         /**
          *
@@ -605,7 +604,7 @@ function weierstrassN(CURVE, curveOpts = {}) {
          * @returns New point
          */
         multiply(scalar) {
-            const { endo } = curveOpts;
+            const { endo } = extraOpts;
             if (!Fn.isValidNot0(scalar))
                 throw new Error('invalid scalar: out of range'); // 0 is invalid
             let point, fake; // Fake point is used to const-time mult
@@ -632,7 +631,7 @@ function weierstrassN(CURVE, curveOpts = {}) {
          * an exposed secret key e.g. sig verification, which works over *public* keys.
          */
         multiplyUnsafe(sc) {
-            const { endo } = curveOpts;
+            const { endo } = extraOpts;
             const p = this;
             if (!Fn.isValid(sc))
                 throw new Error('invalid scalar: out of range'); // 0 is valid
@@ -667,7 +666,7 @@ function weierstrassN(CURVE, curveOpts = {}) {
          * Always torsion-free for cofactor=1 curves.
          */
         isTorsionFree() {
-            const { isTorsionFree } = curveOpts;
+            const { isTorsionFree } = extraOpts;
             if (cofactor === _1n)
                 return true;
             if (isTorsionFree)
@@ -675,7 +674,7 @@ function weierstrassN(CURVE, curveOpts = {}) {
             return wnaf.unsafe(this, CURVE_ORDER).is0();
         }
         clearCofactor() {
-            const { clearCofactor } = curveOpts;
+            const { clearCofactor } = extraOpts;
             if (cofactor === _1n)
                 return this; // Fast-path
             if (clearCofactor)
@@ -687,13 +686,9 @@ function weierstrassN(CURVE, curveOpts = {}) {
             return this.multiplyUnsafe(cofactor).is0();
         }
         toBytes(isCompressed = true) {
-            (0, utils_ts_1.abool)('isCompressed', isCompressed);
+            (0, utils_ts_1._abool2)(isCompressed, 'isCompressed');
             this.assertValidity();
-            return toBytes(Point, this, isCompressed);
-        }
-        /** @deprecated use `toBytes` */
-        toRawBytes(isCompressed = true) {
-            return this.toBytes(isCompressed);
+            return encodePoint(Point, this, isCompressed);
         }
         toHex(isCompressed = true) {
             return (0, utils_ts_1.bytesToHex)(this.toBytes(isCompressed));
@@ -701,26 +696,45 @@ function weierstrassN(CURVE, curveOpts = {}) {
         toString() {
             return `<Point ${this.is0() ? 'ZERO' : this.toHex()}>`;
         }
+        // TODO: remove
+        get px() {
+            return this.X;
+        }
+        get py() {
+            return this.X;
+        }
+        get pz() {
+            return this.Z;
+        }
+        toRawBytes(isCompressed = true) {
+            return this.toBytes(isCompressed);
+        }
+        _setWindowSize(windowSize) {
+            this.precompute(windowSize);
+        }
+        static normalizeZ(points) {
+            return (0, curve_ts_1.normalizeZ)(Point, points);
+        }
+        static msm(points, scalars) {
+            return (0, curve_ts_1.pippenger)(Point, Fn, points, scalars);
+        }
+        static fromPrivateKey(privateKey) {
+            return Point.BASE.multiply(_normFnElement(Fn, privateKey));
+        }
     }
     // base / generator point
     Point.BASE = new Point(CURVE.Gx, CURVE.Gy, Fp.ONE);
     // zero / infinity / identity point
     Point.ZERO = new Point(Fp.ZERO, Fp.ONE, Fp.ZERO); // 0, 1, 0
-    // fields
+    // math field
     Point.Fp = Fp;
+    // scalar field
     Point.Fn = Fn;
     const bits = Fn.BITS;
-    const wnaf = new curve_ts_1.wNAF(Point, curveOpts.endo ? Math.ceil(bits / 2) : bits);
+    const wnaf = new curve_ts_1.wNAF(Point, extraOpts.endo ? Math.ceil(bits / 2) : bits);
+    Point.BASE.precompute(8); // Enable precomputes. Slows down first publicKey computation by 20ms.
     return Point;
 }
-// _legacyWeierstrass
-// TODO: remove
-/** @deprecated use `weierstrass` in newer releases */
-function weierstrassPoints(c) {
-    const { CURVE, curveOpts } = _weierstrass_legacy_opts_to_new(c);
-    const Point = weierstrassN(CURVE, curveOpts);
-    return _weierstrass_new_output_to_legacy(c, Point);
-}
 // Points start with byte 0x02 when y is even; otherwise 0x03
 function pprefix(hasEvenY) {
     return Uint8Array.of(hasEvenY ? 0x02 : 0x03);
@@ -849,8 +863,124 @@ function mapToCurveSimpleSWU(Fp, opts) {
         return { x, y };
     };
 }
+function getWLengths(Fp, Fn) {
+    return {
+        secretKey: Fn.BYTES,
+        publicKey: 1 + Fp.BYTES,
+        publicKeyUncompressed: 1 + 2 * Fp.BYTES,
+        publicKeyHasPrefix: true,
+        signature: 2 * Fn.BYTES,
+    };
+}
+/**
+ * Sometimes users only need getPublicKey, getSharedSecret, and secret key handling.
+ * This helper ensures no signature functionality is present. Less code, smaller bundle size.
+ */
+function ecdh(Point, ecdhOpts = {}) {
+    const { Fn } = Point;
+    const randomBytes_ = ecdhOpts.randomBytes || utils_ts_1.randomBytes;
+    const lengths = Object.assign(getWLengths(Point.Fp, Fn), { seed: (0, modular_ts_1.getMinHashLength)(Fn.ORDER) });
+    function isValidSecretKey(secretKey) {
+        try {
+            return !!_normFnElement(Fn, secretKey);
+        }
+        catch (error) {
+            return false;
+        }
+    }
+    function isValidPublicKey(publicKey, isCompressed) {
+        const { publicKey: comp, publicKeyUncompressed } = lengths;
+        try {
+            const l = publicKey.length;
+            if (isCompressed === true && l !== comp)
+                return false;
+            if (isCompressed === false && l !== publicKeyUncompressed)
+                return false;
+            return !!Point.fromBytes(publicKey);
+        }
+        catch (error) {
+            return false;
+        }
+    }
+    /**
+     * Produces cryptographically secure secret key from random of size
+     * (groupLen + ceil(groupLen / 2)) with modulo bias being negligible.
+     */
+    function randomSecretKey(seed = randomBytes_(lengths.seed)) {
+        return (0, modular_ts_1.mapHashToField)((0, utils_ts_1._abytes2)(seed, lengths.seed, 'seed'), Fn.ORDER);
+    }
+    /**
+     * Computes public key for a secret key. Checks for validity of the secret key.
+     * @param isCompressed whether to return compact (default), or full key
+     * @returns Public key, full when isCompressed=false; short when isCompressed=true
+     */
+    function getPublicKey(secretKey, isCompressed = true) {
+        return Point.BASE.multiply(_normFnElement(Fn, secretKey)).toBytes(isCompressed);
+    }
+    function keygen(seed) {
+        const secretKey = randomSecretKey(seed);
+        return { secretKey, publicKey: getPublicKey(secretKey) };
+    }
+    /**
+     * Quick and dirty check for item being public key. Does not validate hex, or being on-curve.
+     */
+    function isProbPub(item) {
+        if (typeof item === 'bigint')
+            return false;
+        if (item instanceof Point)
+            return true;
+        const { secretKey, publicKey, publicKeyUncompressed } = lengths;
+        if (Fn.allowedLengths || secretKey === publicKey)
+            return undefined;
+        const l = (0, utils_ts_1.ensureBytes)('key', item).length;
+        return l === publicKey || l === publicKeyUncompressed;
+    }
+    /**
+     * ECDH (Elliptic Curve Diffie Hellman).
+     * Computes shared public key from secret key A and public key B.
+     * Checks: 1) secret key validity 2) shared key is on-curve.
+     * Does NOT hash the result.
+     * @param isCompressed whether to return compact (default), or full key
+     * @returns shared public key
+     */
+    function getSharedSecret(secretKeyA, publicKeyB, isCompressed = true) {
+        if (isProbPub(secretKeyA) === true)
+            throw new Error('first arg must be private key');
+        if (isProbPub(publicKeyB) === false)
+            throw new Error('second arg must be public key');
+        const s = _normFnElement(Fn, secretKeyA);
+        const b = Point.fromHex(publicKeyB); // checks for being on-curve
+        return b.multiply(s).toBytes(isCompressed);
+    }
+    const utils = {
+        isValidSecretKey,
+        isValidPublicKey,
+        randomSecretKey,
+        // TODO: remove
+        isValidPrivateKey: isValidSecretKey,
+        randomPrivateKey: randomSecretKey,
+        normPrivateKeyToScalar: (key) => _normFnElement(Fn, key),
+        precompute(windowSize = 8, point = Point.BASE) {
+            return point.precompute(windowSize, false);
+        },
+    };
+    return Object.freeze({ getPublicKey, getSharedSecret, keygen, Point, utils, lengths });
+}
 /**
- * Creates ECDSA for given elliptic curve Point and hash function.
+ * Creates ECDSA signing interface for given elliptic curve `Point` and `hash` function.
+ * We need `hash` for 2 features:
+ * 1. Message prehash-ing. NOT used if `sign` / `verify` are called with `prehash: false`
+ * 2. k generation in `sign`, using HMAC-drbg(hash)
+ *
+ * ECDSAOpts are only rarely needed.
+ *
+ * @example
+ * ```js
+ * const p256_Point = weierstrass(...);
+ * const p256_sha256 = ecdsa(p256_Point, sha256);
+ * const p256_sha224 = ecdsa(p256_Point, sha224);
+ * const p256_sha224_r = ecdsa(p256_Point, sha224, { randomBytes: (length) => { ... } });
+ * ```
  */
 function ecdsa(Point, hash, ecdsaOpts = {}) {
     (0, utils_1.ahash)(hash);
@@ -861,57 +991,61 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
         bits2int: 'function',
         bits2int_modN: 'function',
     });
-    const randomBytes_ = ecdsaOpts.randomBytes || utils_ts_1.randomBytes;
-    const hmac_ = ecdsaOpts.hmac ||
+    const randomBytes = ecdsaOpts.randomBytes || utils_ts_1.randomBytes;
+    const hmac = ecdsaOpts.hmac ||
         ((key, ...msgs) => (0, hmac_js_1.hmac)(hash, key, (0, utils_ts_1.concatBytes)(...msgs)));
     const { Fp, Fn } = Point;
     const { ORDER: CURVE_ORDER, BITS: fnBits } = Fn;
-    const seedLen = (0, modular_ts_1.getMinHashLength)(CURVE_ORDER);
-    const lengths = {
-        secret: Fn.BYTES,
-        public: 1 + Fp.BYTES,
-        publicUncompressed: 1 + 2 * Fp.BYTES,
-        signature: 2 * Fn.BYTES,
-        seed: seedLen,
+    const { keygen, getPublicKey, getSharedSecret, utils, lengths } = ecdh(Point, ecdsaOpts);
+    const defaultSigOpts = {
+        prehash: false,
+        lowS: typeof ecdsaOpts.lowS === 'boolean' ? ecdsaOpts.lowS : false,
+        format: undefined, //'compact' as ECDSASigFormat,
+        extraEntropy: false,
     };
+    const defaultSigOpts_format = 'compact';
     function isBiggerThanHalfOrder(number) {
         const HALF = CURVE_ORDER >> _1n;
         return number > HALF;
     }
-    function normalizeS(s) {
-        return isBiggerThanHalfOrder(s) ? Fn.neg(s) : s;
-    }
-    function aValidRS(title, num) {
+    function validateRS(title, num) {
         if (!Fn.isValidNot0(num))
-            throw new Error(`invalid signature ${title}: out of range 1..CURVE.n`);
+            throw new Error(`invalid signature ${title}: out of range 1..Point.Fn.ORDER`);
+        return num;
+    }
+    function validateSigLength(bytes, format) {
+        validateSigFormat(format);
+        const size = lengths.signature;
+        const sizer = format === 'compact' ? size : format === 'recovered' ? size + 1 : undefined;
+        return (0, utils_ts_1._abytes2)(bytes, sizer, `${format} signature`);
     }
     /**
-     * ECDSA signature with its (r, s) properties. Supports DER & compact representations.
+     * ECDSA signature with its (r, s) properties. Supports compact, recovered & DER representations.
      */
     class Signature {
         constructor(r, s, recovery) {
-            aValidRS('r', r); // r in [1..N-1]
-            aValidRS('s', s); // s in [1..N-1]
-            this.r = r;
-            this.s = s;
+            this.r = validateRS('r', r); // r in [1..N-1];
+            this.s = validateRS('s', s); // s in [1..N-1];
             if (recovery != null)
                 this.recovery = recovery;
             Object.freeze(this);
         }
-        static fromBytes(bytes, format = 'compact') {
-            if (format === 'compact') {
-                const L = Fn.BYTES;
-                (0, utils_ts_1.abytes)(bytes, L * 2);
-                const r = bytes.subarray(0, L);
-                const s = bytes.subarray(L, L * 2);
-                return new Signature(Fn.fromBytes(r), Fn.fromBytes(s));
-            }
+        static fromBytes(bytes, format = defaultSigOpts_format) {
+            validateSigLength(bytes, format);
+            let recid;
             if (format === 'der') {
-                (0, utils_ts_1.abytes)(bytes);
-                const { r, s } = exports.DER.toSig(bytes);
+                const { r, s } = exports.DER.toSig((0, utils_ts_1._abytes2)(bytes));
                 return new Signature(r, s);
             }
-            throw new Error('invalid format');
+            if (format === 'recovered') {
+                recid = bytes[0];
+                format = 'compact';
+                bytes = bytes.subarray(1);
+            }
+            const L = Fn.BYTES;
+            const r = bytes.subarray(0, L);
+            const s = bytes.subarray(L, L * 2);
+            return new Signature(Fn.fromBytes(r), Fn.fromBytes(s), recid);
         }
         static fromHex(hex, format) {
             return this.fromBytes((0, utils_ts_1.hexToBytes)(hex), format);
@@ -919,8 +1053,7 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
         addRecoveryBit(recovery) {
             return new Signature(this.r, this.s, recovery);
         }
-        // ProjPointType<bigint>
-        recoverPublicKey(msgHash) {
+        recoverPublicKey(messageHash) {
             const FIELD_ORDER = Fp.ORDER;
             const { r, s, recovery: rec } = this;
             if (rec == null || ![0, 1, 2, 3].includes(rec))
@@ -940,9 +1073,9 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
             if (!Fp.isValid(radj))
                 throw new Error('recovery id 2 or 3 invalid');
             const x = Fp.toBytes(radj);
-            const R = Point.fromHex((0, utils_ts_1.concatBytes)(pprefix((rec & 1) === 0), x));
+            const R = Point.fromBytes((0, utils_ts_1.concatBytes)(pprefix((rec & 1) === 0), x));
             const ir = Fn.inv(radj); // r^-1
-            const h = bits2int_modN((0, utils_ts_1.ensureBytes)('msgHash', msgHash)); // Truncate hash
+            const h = bits2int_modN((0, utils_ts_1.ensureBytes)('msgHash', messageHash)); // Truncate hash
             const u1 = Fn.create(-h * ir); // -hr^-1
             const u2 = Fn.create(s * ir); // sr^-1
             // (sr^-1)R-(hr^-1)G = -(hr^-1)G + (sr^-1). unsafe is fine: there is no private data.
@@ -956,15 +1089,18 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
         hasHighS() {
             return isBiggerThanHalfOrder(this.s);
         }
-        normalizeS() {
-            return this.hasHighS() ? new Signature(this.r, Fn.neg(this.s), this.recovery) : this;
-        }
-        toBytes(format = 'compact') {
-            if (format === 'compact')
-                return (0, utils_ts_1.concatBytes)(Fn.toBytes(this.r), Fn.toBytes(this.s));
+        toBytes(format = defaultSigOpts_format) {
+            validateSigFormat(format);
             if (format === 'der')
                 return (0, utils_ts_1.hexToBytes)(exports.DER.hexFromSig(this));
-            throw new Error('invalid format');
+            const r = Fn.toBytes(this.r);
+            const s = Fn.toBytes(this.s);
+            if (format === 'recovered') {
+                if (this.recovery == null)
+                    throw new Error('recovery bit must be present');
+                return (0, utils_ts_1.concatBytes)(Uint8Array.of(this.recovery), r, s);
+            }
+            return (0, utils_ts_1.concatBytes)(r, s);
         }
         toHex(format) {
             return (0, utils_ts_1.bytesToHex)(this.toBytes(format));
@@ -977,6 +1113,9 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
         static fromDER(hex) {
             return Signature.fromBytes((0, utils_ts_1.ensureBytes)('sig', hex), 'der');
         }
+        normalizeS() {
+            return this.hasHighS() ? new Signature(this.r, Fn.neg(this.s), this.recovery) : this;
+        }
         toDERRawBytes() {
             return this.toBytes('der');
         }
@@ -990,92 +1129,12 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
             return (0, utils_ts_1.bytesToHex)(this.toBytes('compact'));
         }
     }
-    function isValidSecretKey(privateKey) {
-        try {
-            return !!_normFnElement(Fn, privateKey);
-        }
-        catch (error) {
-            return false;
-        }
-    }
-    function isValidPublicKey(publicKey, isCompressed) {
-        try {
-            const l = publicKey.length;
-            if (isCompressed === true && l !== lengths.public)
-                return false;
-            if (isCompressed === false && l !== lengths.publicUncompressed)
-                return false;
-            return !!Point.fromBytes(publicKey);
-        }
-        catch (error) {
-            return false;
-        }
-    }
-    /**
-     * Produces cryptographically secure secret key from random of size
-     * (groupLen + ceil(groupLen / 2)) with modulo bias being negligible.
-     */
-    function randomSecretKey(seed = randomBytes_(seedLen)) {
-        return (0, modular_ts_1.mapHashToField)(seed, CURVE_ORDER);
-    }
-    const utils = {
-        isValidSecretKey,
-        isValidPublicKey,
-        randomSecretKey,
-        // TODO: remove
-        isValidPrivateKey: isValidSecretKey,
-        randomPrivateKey: randomSecretKey,
-        normPrivateKeyToScalar: (key) => _normFnElement(Fn, key),
-        precompute(windowSize = 8, point = Point.BASE) {
-            return point.precompute(windowSize, false);
-        },
-    };
-    /**
-     * Computes public key for a secret key. Checks for validity of the secret key.
-     * @param isCompressed whether to return compact (default), or full key
-     * @returns Public key, full when isCompressed=false; short when isCompressed=true
-     */
-    function getPublicKey(secretKey, isCompressed = true) {
-        return Point.BASE.multiply(_normFnElement(Fn, secretKey)).toBytes(isCompressed);
-    }
-    /**
-     * Quick and dirty check for item being public key. Does not validate hex, or being on-curve.
-     */
-    function isProbPub(item) {
-        // TODO: remove
-        if (typeof item === 'bigint')
-            return false;
-        // TODO: remove
-        if (item instanceof Point)
-            return true;
-        if (Fn.allowedLengths || lengths.secret === lengths.public)
-            return undefined;
-        const l = (0, utils_ts_1.ensureBytes)('key', item).length;
-        return l === lengths.public || l === lengths.publicUncompressed;
-    }
-    /**
-     * ECDH (Elliptic Curve Diffie Hellman).
-     * Computes shared public key from secret key A and public key B.
-     * Checks: 1) secret key validity 2) shared key is on-curve.
-     * Does NOT hash the result.
-     * @param isCompressed whether to return compact (default), or full key
-     * @returns shared public key
-     */
-    function getSharedSecret(secretKeyA, publicKeyB, isCompressed = true) {
-        if (isProbPub(secretKeyA) === true)
-            throw new Error('first arg must be private key');
-        if (isProbPub(publicKeyB) === false)
-            throw new Error('second arg must be public key');
-        const s = _normFnElement(Fn, secretKeyA);
-        const b = Point.fromHex(publicKeyB); // checks for being on-curve
-        return b.multiply(s).toBytes(isCompressed);
-    }
     // RFC6979: ensure ECDSA msg is X bytes and < N. RFC suggests optional truncating via bits2octets.
     // FIPS 186-4 4.6 suggests the leftmost min(nBitLen, outLen) bits, which matches bits2int.
     // bits2int can produce res>N, we can do mod(res, N) since the bitLen is the same.
     // int2octets can't be used; pads small msgs with 0: unacceptatble for trunc as per RFC vectors
     const bits2int = ecdsaOpts.bits2int ||
-        function (bytes) {
+        function bits2int_def(bytes) {
             // Our custom check "just in case", for protection against DoS
             if (bytes.length > 8192)
                 throw new Error('input is too large');
@@ -1086,44 +1145,45 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
             return delta > 0 ? num >> BigInt(delta) : num;
         };
     const bits2int_modN = ecdsaOpts.bits2int_modN ||
-        function (bytes) {
+        function bits2int_modN_def(bytes) {
             return Fn.create(bits2int(bytes)); // can't use bytesToNumberBE here
         };
-    // NOTE: pads output with zero as per spec
+    // Pads output with zero as per spec
     const ORDER_MASK = (0, utils_ts_1.bitMask)(fnBits);
-    /**
-     * Converts to bytes. Checks if num in `[0..ORDER_MASK-1]` e.g.: `[0..2^256-1]`.
-     */
+    /** Converts to bytes. Checks if num in `[0..ORDER_MASK-1]` e.g.: `[0..2^256-1]`. */
     function int2octets(num) {
         // IMPORTANT: the check ensures working for case `Fn.BYTES != Fn.BITS * 8`
         (0, utils_ts_1.aInRange)('num < 2^' + fnBits, num, _0n, ORDER_MASK);
         return Fn.toBytes(num);
     }
-    // Steps A, D of RFC6979 3.2
-    // Creates RFC6979 seed; converts msg/privKey to numbers.
-    // Used only in sign, not in verify.
-    // NOTE: we cannot assume here that msgHash has same amount of bytes as curve order,
-    // this will be invalid at least for P521. Also it can be bigger for P224 + SHA256
-    function prepSig(msgHash, privateKey, opts = defaultSigOpts) {
+    function validateMsgAndHash(message, prehash) {
+        (0, utils_ts_1._abytes2)(message, undefined, 'message');
+        return prehash ? (0, utils_ts_1._abytes2)(hash(message), undefined, 'prehashed message') : message;
+    }
+    /**
+     * Steps A, D of RFC6979 3.2.
+     * Creates RFC6979 seed; converts msg/privKey to numbers.
+     * Used only in sign, not in verify.
+     *
+     * Warning: we cannot assume here that message has same amount of bytes as curve order,
+     * this will be invalid at least for P521. Also it can be bigger for P224 + SHA256.
+     */
+    function prepSig(message, privateKey, opts) {
         if (['recovered', 'canonical'].some((k) => k in opts))
             throw new Error('sign() legacy options not supported');
-        let { lowS, prehash, extraEntropy: ent } = opts; // generates low-s sigs by default
-        if (lowS == null)
-            lowS = true; // RFC6979 3.2: we skip step A, because we already provide hash
-        msgHash = (0, utils_ts_1.ensureBytes)('msgHash', msgHash);
-        validateSigVerOpts(opts);
-        if (prehash)
-            msgHash = (0, utils_ts_1.ensureBytes)('prehashed msgHash', hash(msgHash));
+        const { lowS, prehash, extraEntropy } = validateSigOpts(opts, defaultSigOpts);
+        message = validateMsgAndHash(message, prehash); // RFC6979 3.2 A: h1 = H(m)
         // We can't later call bits2octets, since nested bits2int is broken for curves
         // with fnBits % 8 !== 0. Because of that, we unwrap it here as int2octets call.
         // const bits2octets = (bits) => int2octets(bits2int_modN(bits))
-        const h1int = bits2int_modN(msgHash);
+        const h1int = bits2int_modN(message);
         const d = _normFnElement(Fn, privateKey); // validate secret key, convert to bigint
         const seedArgs = [int2octets(d), int2octets(h1int)];
         // extraEntropy. RFC6979 3.6: additional k' (optional).
-        if (ent != null && ent !== false) {
+        if (extraEntropy != null && extraEntropy !== false) {
             // K = HMAC_K(V || 0x00 || int2octets(x) || bits2octets(h1) || k')
-            const e = ent === true ? randomBytes_(lengths.secret) : ent; // gen random bytes OR pass as-is
+            // gen random bytes OR pass as-is
+            const e = extraEntropy === true ? randomBytes(lengths.secretKey) : extraEntropy;
             seedArgs.push((0, utils_ts_1.ensureBytes)('extraEntropy', e)); // check for being bytes
         }
         const seed = (0, utils_ts_1.concatBytes)(...seedArgs); // Step D of RFC6979 3.2
@@ -1139,7 +1199,7 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
         function k2sig(kBytes) {
             // RFC 6979 Section 3.2, step 3: k = bits2int(T)
             // Important: all mod() calls here must be done over N
-            const k = bits2int(kBytes); // Cannot use fields methods, since it is group element
+            const k = bits2int(kBytes); // mod n, not mod p
             if (!Fn.isValidNot0(k))
                 return; // Valid scalars (including k) must be in 1..N-1
             const ik = Fn.inv(k); // k^-1 mod n
@@ -1153,120 +1213,100 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
             let recovery = (q.x === r ? 0 : 2) | Number(q.y & _1n); // recovery bit (2 or 3, when q.x > n)
             let normS = s;
             if (lowS && isBiggerThanHalfOrder(s)) {
-                normS = normalizeS(s); // if lowS was passed, ensure s is always
+                normS = Fn.neg(s); // if lowS was passed, ensure s is always
                 recovery ^= 1; // // in the bottom half of N
             }
             return new Signature(r, normS, recovery); // use normS, not s
         }
         return { seed, k2sig };
     }
-    const defaultSigOpts = { lowS: ecdsaOpts.lowS, prehash: false };
-    const defaultVerOpts = { lowS: ecdsaOpts.lowS, prehash: false };
     /**
      * Signs message hash with a secret key.
+     *
      * ```
-     * sign(m, d, k) where
+     * sign(m, d) where
+     *   k = rfc6979_hmac_drbg(m, d)
      *   (x, y) = G × k
      *   r = x mod n
-     *   s = (m + dr)/k mod n
+     *   s = (m + dr) / k mod n
      * ```
      */
-    function sign(msgHash, secretKey, opts = defaultSigOpts) {
-        const { seed, k2sig } = prepSig(msgHash, secretKey, opts); // Steps A, D of RFC6979 3.2.
-        const drbg = (0, utils_ts_1.createHmacDrbg)(hash.outputLen, Fn.BYTES, hmac_);
-        return drbg(seed, k2sig); // Steps B, C, D, E, F, G
+    function sign(message, secretKey, opts = {}) {
+        message = (0, utils_ts_1.ensureBytes)('message', message);
+        const { seed, k2sig } = prepSig(message, secretKey, opts); // Steps A, D of RFC6979 3.2.
+        const drbg = (0, utils_ts_1.createHmacDrbg)(hash.outputLen, Fn.BYTES, hmac);
+        const sig = drbg(seed, k2sig); // Steps B, C, D, E, F, G
+        return sig;
+    }
+    function tryParsingSig(sg) {
+        // Try to deduce format
+        let sig = undefined;
+        const isHex = typeof sg === 'string' || (0, utils_ts_1.isBytes)(sg);
+        const isObj = !isHex &&
+            sg !== null &&
+            typeof sg === 'object' &&
+            typeof sg.r === 'bigint' &&
+            typeof sg.s === 'bigint';
+        if (!isHex && !isObj)
+            throw new Error('invalid signature, expected Uint8Array, hex string or Signature instance');
+        if (isObj) {
+            sig = new Signature(sg.r, sg.s);
+        }
+        else if (isHex) {
+            try {
+                sig = Signature.fromBytes((0, utils_ts_1.ensureBytes)('sig', sg), 'der');
+            }
+            catch (derError) {
+                if (!(derError instanceof exports.DER.Err))
+                    throw derError;
+            }
+            if (!sig) {
+                try {
+                    sig = Signature.fromBytes((0, utils_ts_1.ensureBytes)('sig', sg), 'compact');
+                }
+                catch (error) {
+                    return false;
+                }
+            }
+        }
+        if (!sig)
+            return false;
+        return sig;
     }
-    // Enable precomputes. Slows down first publicKey computation by 20ms.
-    Point.BASE.precompute(8);
     /**
-     * Verifies a signature against message hash and public key.
-     * Rejects lowS signatures by default: to override,
-     * specify option `{lowS: false}`. Implements section 4.1.4 from https://www.secg.org/sec1-v2.pdf:
+     * Verifies a signature against message and public key.
+     * Rejects lowS signatures by default: see {@link ECDSAVerifyOpts}.
+     * Implements section 4.1.4 from https://www.secg.org/sec1-v2.pdf:
      *
      * ```
      * verify(r, s, h, P) where
-     *   U1 = hs^-1 mod n
-     *   U2 = rs^-1 mod n
-     *   R = U1⋅G - U2⋅P
+     *   u1 = hs^-1 mod n
+     *   u2 = rs^-1 mod n
+     *   R = u1⋅G + u2⋅P
      *   mod(R.x, n) == r
      * ```
      */
-    function verify(signature, msgHash, publicKey, opts = defaultVerOpts) {
-        const sg = signature;
-        msgHash = (0, utils_ts_1.ensureBytes)('msgHash', msgHash);
+    function verify(signature, message, publicKey, opts = {}) {
+        const { lowS, prehash, format } = validateSigOpts(opts, defaultSigOpts);
         publicKey = (0, utils_ts_1.ensureBytes)('publicKey', publicKey);
-        // Verify opts
-        validateSigVerOpts(opts);
-        const { lowS, prehash, format } = opts;
-        // TODO: remove
+        message = validateMsgAndHash((0, utils_ts_1.ensureBytes)('message', message), prehash);
         if ('strict' in opts)
             throw new Error('options.strict was renamed to lowS');
-        let _sig = undefined;
-        let P;
-        if (format === undefined) {
-            // Try to deduce format
-            const isHex = typeof sg === 'string' || (0, utils_ts_1.isBytes)(sg);
-            const isObj = !isHex &&
-                sg !== null &&
-                typeof sg === 'object' &&
-                typeof sg.r === 'bigint' &&
-                typeof sg.s === 'bigint';
-            if (!isHex && !isObj)
-                throw new Error('invalid signature, expected Uint8Array, hex string or Signature instance');
-            if (isObj) {
-                _sig = new Signature(sg.r, sg.s);
-            }
-            else if (isHex) {
-                // TODO: remove this malleable check
-                // Signature can be represented in 2 ways: compact (2*Fn.BYTES) & DER (variable-length).
-                // Since DER can also be 2*Fn.BYTES bytes, we check for it first.
-                try {
-                    _sig = Signature.fromDER(sg);
-                }
-                catch (derError) {
-                    if (!(derError instanceof exports.DER.Err))
-                        throw derError;
-                }
-                if (!_sig) {
-                    try {
-                        _sig = Signature.fromCompact(sg);
-                    }
-                    catch (error) {
-                        return false;
-                    }
-                }
-            }
-        }
-        else {
-            if (format === 'compact' || format === 'der') {
-                if (typeof sg !== 'string' && !(0, utils_ts_1.isBytes)(sg))
-                    throw new Error('"der" / "compact" format expects Uint8Array signature');
-                _sig = Signature.fromBytes((0, utils_ts_1.ensureBytes)('sig', sg), format);
-            }
-            else if (format === 'js') {
-                if (!(sg instanceof Signature))
-                    throw new Error('"js" format expects Signature instance');
-                _sig = sg;
-            }
-            else {
-                throw new Error('format must be "compact", "der" or "js"');
-            }
-        }
-        if (!_sig)
+        const sig = format === undefined
+            ? tryParsingSig(signature)
+            : Signature.fromBytes((0, utils_ts_1.ensureBytes)('sig', signature), format);
+        if (sig === false)
             return false;
         try {
-            P = Point.fromHex(publicKey);
-            if (lowS && _sig.hasHighS())
+            const P = Point.fromBytes(publicKey);
+            if (lowS && sig.hasHighS())
                 return false;
-            // todo: optional.hash => hash
-            if (prehash)
-                msgHash = hash(msgHash);
-            const { r, s } = _sig;
-            const h = bits2int_modN(msgHash); // Cannot use fields methods, since it is group element
-            const is = Fn.inv(s); // s^-1
+            const { r, s } = sig;
+            const h = bits2int_modN(message); // mod n, not mod p
+            const is = Fn.inv(s); // s^-1 mod n
             const u1 = Fn.create(h * is); // u1 = hs^-1 mod n
             const u2 = Fn.create(r * is); // u2 = rs^-1 mod n
-            const R = Point.BASE.multiplyUnsafe(u1).add(P.multiplyUnsafe(u2));
+            const R = Point.BASE.multiplyUnsafe(u1).add(P.multiplyUnsafe(u2)); // u1⋅G + u2⋅P
             if (R.is0())
                 return false;
             const v = Fn.create(R.x); // v = r.x mod n
@@ -1276,23 +1316,31 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
             return false;
         }
     }
-    function keygen(seed) {
-        const secretKey = utils.randomSecretKey(seed);
-        return { secretKey, publicKey: getPublicKey(secretKey) };
+    function recoverPublicKey(signature, message, opts = {}) {
+        const { prehash } = validateSigOpts(opts, defaultSigOpts);
+        message = validateMsgAndHash(message, prehash);
+        return Signature.fromBytes(signature, 'recovered').recoverPublicKey(message).toBytes();
     }
     return Object.freeze({
         keygen,
         getPublicKey,
-        sign,
-        verify,
         getSharedSecret,
         utils,
+        lengths,
         Point,
+        sign,
+        verify,
+        recoverPublicKey,
         Signature,
-        info: { type: 'weierstrass', lengths, publicKeyHasPrefix: true },
+        hash,
     });
 }
-// TODO: remove
+/** @deprecated use `weierstrass` in newer releases */
+function weierstrassPoints(c) {
+    const { CURVE, curveOpts } = _weierstrass_legacy_opts_to_new(c);
+    const Point = weierstrassN(CURVE, curveOpts);
+    return _weierstrass_new_output_to_legacy(c, Point);
+}
 function _weierstrass_legacy_opts_to_new(c) {
     const CURVE = {
         a: c.a,
@@ -1310,7 +1358,7 @@ function _weierstrass_legacy_opts_to_new(c) {
     const Fn = (0, modular_ts_1.Field)(CURVE.n, {
         BITS: c.nBitLength,
         allowedLengths: allowedLengths,
-        modOnDecode: c.wrapPrivateKey,
+        modFromBytes: c.wrapPrivateKey,
     });
     const curveOpts = {
         Fp,
@@ -1335,10 +1383,20 @@ function _ecdsa_legacy_opts_to_new(c) {
     };
     return { CURVE, curveOpts, hash: c.hash, ecdsaOpts };
 }
-// TODO: remove
+function _legacyHelperEquat(Fp, a, b) {
+    /**
+     * y² = x³ + ax + b: Short weierstrass curve formula. Takes x, returns y².
+     * @returns y²
+     */
+    function weierstrassEquation(x) {
+        const x2 = Fp.sqr(x); // x * x
+        const x3 = Fp.mul(x2, x); // x² * x
+        return Fp.add(Fp.add(x3, Fp.mul(x, a)), b); // x³ + a * x + b
+    }
+    return weierstrassEquation;
+}
 function _weierstrass_new_output_to_legacy(c, Point) {
     const { Fp, Fn } = Point;
-    // TODO: remove
     function isWithinCurveOrder(num) {
         return (0, utils_ts_1.inRange)(num, _1n, Fn.ORDER);
     }
@@ -1352,11 +1410,11 @@ function _weierstrass_new_output_to_legacy(c, Point) {
         isWithinCurveOrder,
     });
 }
-// TODO: remove
-function _ecdsa_new_output_to_legacy(c, ecdsa) {
-    return Object.assign({}, ecdsa, {
-        ProjectivePoint: ecdsa.Point,
-        CURVE: c,
+function _ecdsa_new_output_to_legacy(c, _ecdsa) {
+    const Point = _ecdsa.Point;
+    return Object.assign({}, _ecdsa, {
+        ProjectivePoint: Point,
+        CURVE: Object.assign({}, c, (0, modular_ts_1.nLength)(Point.Fn.ORDER, Point.Fn.BITS)),
     });
 }
 // _ecdsa_legacy