@noble/curves 1.9.5 → 2.0.0-beta.1

package/abstract/weierstrass.js

@@ -1,16 +1,3 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DER = exports.DERErr = void 0;
-exports._splitEndoScalar = _splitEndoScalar;
-exports._normFnElement = _normFnElement;
-exports.weierstrassN = weierstrassN;
-exports.SWUFpSqrtRatio = SWUFpSqrtRatio;
-exports.mapToCurveSimpleSWU = mapToCurveSimpleSWU;
-exports.ecdh = ecdh;
-exports.ecdsa = ecdsa;
-exports.weierstrassPoints = weierstrassPoints;
-exports._legacyHelperEquat = _legacyHelperEquat;
-exports.weierstrass = weierstrass;
 /**
  * Short Weierstrass curve methods. The formula is: y² = x³ + ax + b.
  *
@@ -38,17 +25,17 @@ exports.weierstrass = weierstrass;
  * @module
  */
 /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-const hmac_js_1 = require("@noble/hashes/hmac.js");
-const utils_1 = require("@noble/hashes/utils");
-const utils_ts_1 = require("../utils.js");
-const curve_ts_1 = require("./curve.js");
-const modular_ts_1 = require("./modular.js");
+import { hmac as nobleHmac } from '@noble/hashes/hmac.js';
+import { ahash } from '@noble/hashes/utils.js';
+import { _validateObject, abool, abytes, aInRange, bitLen, bitMask, bytesToHex, bytesToNumberBE, concatBytes, createHmacDrbg, hexToBytes, isBytes, memoized, numberToHexUnpadded, randomBytes as wcRandomBytes, } from "../utils.js";
+import { _createCurveFields, mulEndoUnsafe, negateCt, normalizeZ, wNAF, } from "./curve.js";
+import { FpInvertBatch, getMinHashLength, mapHashToField, validateField, } from "./modular.js";
 // We construct basis in such way that den is always positive and equals n, but num sign depends on basis (not on secret value)
 const divNearest = (num, den) => (num + (num >= 0 ? den : -den) / _2n) / den;
 /**
  * Splits scalar for GLV endomorphism.
  */
-function _splitEndoScalar(k, basis, n) {
+export function _splitEndoScalar(k, basis, n) {
     // Split scalar into two such that part is ~half bits: `abs(part) < sqrt(N)`
     // Since part can be negative, we need to do this on point.
     // TODO: verifyScalar function which consumes lambda
@@ -67,7 +54,7 @@ function _splitEndoScalar(k, basis, n) {
         k2 = -k2;
     // Double check that resulting scalar less than half bits of N: otherwise wNAF will fail.
     // This should only happen on wrong basises. Also, math inside is too complex and I don't trust it.
-    const MAX_NUM = (0, utils_ts_1.bitMask)(Math.ceil((0, utils_ts_1.bitLen)(n) / 2)) + _1n; // Half bits of N
+    const MAX_NUM = bitMask(Math.ceil(bitLen(n) / 2)) + _1n; // Half bits of N
     if (k1 < _0n || k1 >= MAX_NUM || k2 < _0n || k2 >= MAX_NUM) {
         throw new Error('splitScalar (endomorphism): failed, k=' + k);
     }
@@ -84,18 +71,17 @@ function validateSigOpts(opts, def) {
         // @ts-ignore
         optsn[optName] = opts[optName] === undefined ? def[optName] : opts[optName];
     }
-    (0, utils_ts_1._abool2)(optsn.lowS, 'lowS');
-    (0, utils_ts_1._abool2)(optsn.prehash, 'prehash');
+    abool(optsn.lowS, 'lowS');
+    abool(optsn.prehash, 'prehash');
     if (optsn.format !== undefined)
         validateSigFormat(optsn.format);
     return optsn;
 }
-class DERErr extends Error {
+export class DERErr extends Error {
     constructor(m = '') {
         super(m);
     }
 }
-exports.DERErr = DERErr;
 /**
  * ASN.1 DER encoding utilities. ASN is very complex & fragile. Format:
  *
@@ -103,42 +89,42 @@ exports.DERErr = DERErr;
  *
  * Docs: https://letsencrypt.org/docs/a-warm-welcome-to-asn1-and-der/, https://luca.ntop.org/Teaching/Appunti/asn1.html
  */
-exports.DER = {
+export const DER = {
     // asn.1 DER encoding utils
     Err: DERErr,
     // Basic building block is TLV (Tag-Length-Value)
     _tlv: {
         encode: (tag, data) => {
-            const { Err: E } = exports.DER;
+            const { Err: E } = DER;
             if (tag < 0 || tag > 256)
                 throw new E('tlv.encode: wrong tag');
             if (data.length & 1)
                 throw new E('tlv.encode: unpadded data');
             const dataLen = data.length / 2;
-            const len = (0, utils_ts_1.numberToHexUnpadded)(dataLen);
-            if ((len.length / 2) & 128)
+            const len = numberToHexUnpadded(dataLen);
+            if ((len.length / 2) & 0b1000_0000)
                 throw new E('tlv.encode: long form length too big');
             // length of length with long form flag
-            const lenLen = dataLen > 127 ? (0, utils_ts_1.numberToHexUnpadded)((len.length / 2) | 128) : '';
-            const t = (0, utils_ts_1.numberToHexUnpadded)(tag);
+            const lenLen = dataLen > 127 ? numberToHexUnpadded((len.length / 2) | 0b1000_0000) : '';
+            const t = numberToHexUnpadded(tag);
             return t + lenLen + len + data;
         },
         // v - value, l - left bytes (unparsed)
         decode(tag, data) {
-            const { Err: E } = exports.DER;
+            const { Err: E } = DER;
             let pos = 0;
             if (tag < 0 || tag > 256)
                 throw new E('tlv.encode: wrong tag');
             if (data.length < 2 || data[pos++] !== tag)
                 throw new E('tlv.decode: wrong tlv');
             const first = data[pos++];
-            const isLong = !!(first & 128); // First bit of first length byte is flag for short/long form
+            const isLong = !!(first & 0b1000_0000); // First bit of first length byte is flag for short/long form
             let length = 0;
             if (!isLong)
                 length = first;
             else {
                 // Long form: [longFlag(1bit), lengthLength(7bit), length (BE)]
-                const lenLen = first & 127;
+                const lenLen = first & 0b0111_1111;
                 if (!lenLen)
                     throw new E('tlv.decode(long): indefinite length not supported');
                 if (lenLen > 4)
@@ -166,10 +152,10 @@ exports.DER = {
     // - if next byte doesn't have a flag, leading zero is not allowed (minimal encoding)
     _int: {
         encode(num) {
-            const { Err: E } = exports.DER;
+            const { Err: E } = DER;
             if (num < _0n)
                 throw new E('integer: negative integers are not allowed');
-            let hex = (0, utils_ts_1.numberToHexUnpadded)(num);
+            let hex = numberToHexUnpadded(num);
             // Pad with zero byte if negative flag is present
             if (Number.parseInt(hex[0], 16) & 0b1000)
                 hex = '00' + hex;
@@ -178,18 +164,18 @@ exports.DER = {
             return hex;
         },
         decode(data) {
-            const { Err: E } = exports.DER;
-            if (data[0] & 128)
+            const { Err: E } = DER;
+            if (data[0] & 0b1000_0000)
                 throw new E('invalid signature integer: negative');
-            if (data[0] === 0x00 && !(data[1] & 128))
+            if (data[0] === 0x00 && !(data[1] & 0b1000_0000))
                 throw new E('invalid signature integer: unnecessary leading zero');
-            return (0, utils_ts_1.bytesToNumberBE)(data);
+            return bytesToNumberBE(data);
         },
     },
-    toSig(hex) {
+    toSig(bytes) {
         // parse DER signature
-        const { Err: E, _int: int, _tlv: tlv } = exports.DER;
-        const data = (0, utils_ts_1.ensureBytes)('signature', hex);
+        const { Err: E, _int: int, _tlv: tlv } = DER;
+        const data = abytes(bytes, undefined, 'signature');
         const { v: seqBytes, l: seqLeftBytes } = tlv.decode(0x30, data);
         if (seqLeftBytes.length)
             throw new E('invalid signature: left bytes after parsing');
@@ -200,7 +186,7 @@ exports.DER = {
         return { r: int.decode(rBytes), s: int.decode(sBytes) };
     },
     hexFromSig(sig) {
-        const { _tlv: tlv, _int: int } = exports.DER;
+        const { _tlv: tlv, _int: int } = DER;
         const rs = tlv.encode(0x02, int.encode(sig.r));
         const ss = tlv.encode(0x02, int.encode(sig.s));
         const seq = rs + ss;
@@ -210,25 +196,6 @@ exports.DER = {
 // Be friendly to bad ECMAScript parsers by not using bigint literals
 // prettier-ignore
 const _0n = BigInt(0), _1n = BigInt(1), _2n = BigInt(2), _3n = BigInt(3), _4n = BigInt(4);
-function _normFnElement(Fn, key) {
-    const { BYTES: expected } = Fn;
-    let num;
-    if (typeof key === 'bigint') {
-        num = key;
-    }
-    else {
-        let bytes = (0, utils_ts_1.ensureBytes)('private key', key);
-        try {
-            num = Fn.fromBytes(bytes);
-        }
-        catch (error) {
-            throw new Error(`invalid private key: expected ui8a of size ${expected}, got ${typeof key}`);
-        }
-    }
-    if (!Fn.isValidNot0(num))
-        throw new Error('invalid private key: out of range [1..N-1]');
-    return num;
-}
 /**
  * Creates weierstrass Point constructor, based on specified curve options.
  *
@@ -246,12 +213,12 @@ const opts = {
 const p256_Point = weierstrass(opts);
 ```
  */
-function weierstrassN(params, extraOpts = {}) {
-    const validated = (0, curve_ts_1._createCurveFields)('weierstrass', params, extraOpts);
+export function weierstrass(params, extraOpts = {}) {
+    const validated = _createCurveFields('weierstrass', params, extraOpts);
     const { Fp, Fn } = validated;
     let CURVE = validated.CURVE;
     const { h: cofactor, n: CURVE_ORDER } = CURVE;
-    (0, utils_ts_1._validateObject)(extraOpts, {}, {
+    _validateObject(extraOpts, {}, {
         allowInfinityPoint: 'boolean',
         clearCofactor: 'function',
         isTorsionFree: 'function',
@@ -276,19 +243,19 @@ function weierstrassN(params, extraOpts = {}) {
     function pointToBytes(_c, point, isCompressed) {
         const { x, y } = point.toAffine();
         const bx = Fp.toBytes(x);
-        (0, utils_ts_1._abool2)(isCompressed, 'isCompressed');
+        abool(isCompressed, 'isCompressed');
         if (isCompressed) {
             assertCompressionIsSupported();
             const hasEvenY = !Fp.isOdd(y);
-            return (0, utils_ts_1.concatBytes)(pprefix(hasEvenY), bx);
+            return concatBytes(pprefix(hasEvenY), bx);
         }
         else {
-            return (0, utils_ts_1.concatBytes)(Uint8Array.of(0x04), bx, Fp.toBytes(y));
+            return concatBytes(Uint8Array.of(0x04), bx, Fp.toBytes(y));
         }
     }
     function pointFromBytes(bytes) {
-        (0, utils_ts_1._abytes2)(bytes, undefined, 'Point');
-        const { public: comp, publicUncompressed: uncomp } = lengths; // e.g. for 32-byte: 33, 65
+        abytes(bytes, undefined, 'Point');
+        const { publicKey: comp, publicKeyUncompressed: uncomp } = lengths; // e.g. for 32-byte: 33, 65
         const length = bytes.length;
         const head = bytes[0];
         const tail = bytes.subarray(1);
@@ -369,7 +336,7 @@ function weierstrassN(params, extraOpts = {}) {
     // Converts Projective point to affine (x, y) coordinates.
     // Can accept precomputed Z^-1 - for example, from invertBatch.
     // (X, Y, Z) ∋ (x=X/Z, y=Y/Z)
-    const toAffineMemo = (0, utils_ts_1.memoized)((p, iz) => {
+    const toAffineMemo = memoized((p, iz) => {
         const { X, Y, Z } = p;
         // Fast-path for normalized points
         if (Fp.eql(Z, Fp.ONE))
@@ -390,7 +357,7 @@ function weierstrassN(params, extraOpts = {}) {
     });
     // NOTE: on exception this will crash 'cached' and no value will be set.
     // Otherwise true will be return
-    const assertValidMemo = (0, utils_ts_1.memoized)((p) => {
+    const assertValidMemo = memoized((p) => {
         if (p.is0()) {
             // (0, 1, 0) aka ZERO is invalid in most contexts.
             // In BLS, ZERO can be serialized, so we allow it.
@@ -411,8 +378,8 @@ function weierstrassN(params, extraOpts = {}) {
     });
     function finishEndo(endoBeta, k1p, k2p, k1neg, k2neg) {
         k2p = new Point(Fp.mul(k2p.X, endoBeta), k2p.Y, k2p.Z);
-        k1p = (0, curve_ts_1.negateCt)(k1neg, k1p);
-        k2p = (0, curve_ts_1.negateCt)(k2neg, k2p);
+        k1p = negateCt(k1neg, k1p);
+        k2p = negateCt(k2neg, k2p);
         return k1p.add(k2p);
     }
     /**
@@ -421,6 +388,17 @@ function weierstrassN(params, extraOpts = {}) {
      * We're doing calculations in projective, because its operations don't require costly inversion.
      */
     class Point {
+        // base / generator point
+        static BASE = new Point(CURVE.Gx, CURVE.Gy, Fp.ONE);
+        // zero / infinity / identity point
+        static ZERO = new Point(Fp.ZERO, Fp.ONE, Fp.ZERO); // 0, 1, 0
+        // math field
+        static Fp = Fp;
+        // scalar field
+        static Fn = Fn;
+        X;
+        Y;
+        Z;
         /** Does NOT validate if the point is valid. Use `.assertValidity()`. */
         constructor(X, Y, Z) {
             this.X = acoord('x', X);
@@ -444,12 +422,12 @@ function weierstrassN(params, extraOpts = {}) {
             return new Point(x, y, Fp.ONE);
         }
         static fromBytes(bytes) {
-            const P = Point.fromAffine(decodePoint((0, utils_ts_1._abytes2)(bytes, undefined, 'point')));
+            const P = Point.fromAffine(decodePoint(abytes(bytes, undefined, 'point')));
             P.assertValidity();
             return P;
         }
         static fromHex(hex) {
-            return Point.fromBytes((0, utils_ts_1.ensureBytes)('pointHex', hex));
+            return Point.fromBytes(hexToBytes(hex));
         }
         get x() {
             return this.toAffine().x;
@@ -608,7 +586,7 @@ function weierstrassN(params, extraOpts = {}) {
             if (!Fn.isValidNot0(scalar))
                 throw new Error('invalid scalar: out of range'); // 0 is invalid
             let point, fake; // Fake point is used to const-time mult
-            const mul = (n) => wnaf.cached(this, n, (p) => (0, curve_ts_1.normalizeZ)(Point, p));
+            const mul = (n) => wnaf.cached(this, n, (p) => normalizeZ(Point, p));
             /** See docs for {@link EndomorphismOpts} */
             if (endo) {
                 const { k1neg, k1, k2neg, k2 } = splitEndoScalarN(scalar);
@@ -623,7 +601,7 @@ function weierstrassN(params, extraOpts = {}) {
                 fake = f;
             }
             // Normalize `z` for both points, but return only real one
-            return (0, curve_ts_1.normalizeZ)(Point, [point, fake])[0];
+            return normalizeZ(Point, [point, fake])[0];
         }
         /**
          * Non-constant-time multiplication. Uses double-and-add algorithm.
@@ -643,7 +621,7 @@ function weierstrassN(params, extraOpts = {}) {
                 return this.multiply(sc);
             if (endo) {
                 const { k1neg, k1, k2neg, k2 } = splitEndoScalarN(sc);
-                const { p1, p2 } = (0, curve_ts_1.mulEndoUnsafe)(Point, p, k1, k2); // 30% faster vs wnaf.unsafe
+                const { p1, p2 } = mulEndoUnsafe(Point, p, k1, k2); // 30% faster vs wnaf.unsafe
                 return finishEndo(endo.beta, p1, p2, k1neg, k2neg);
             }
             else {
@@ -686,52 +664,20 @@ function weierstrassN(params, extraOpts = {}) {
             return this.multiplyUnsafe(cofactor).is0();
         }
         toBytes(isCompressed = true) {
-            (0, utils_ts_1._abool2)(isCompressed, 'isCompressed');
+            abool(isCompressed, 'isCompressed');
             this.assertValidity();
             return encodePoint(Point, this, isCompressed);
         }
         toHex(isCompressed = true) {
-            return (0, utils_ts_1.bytesToHex)(this.toBytes(isCompressed));
+            return bytesToHex(this.toBytes(isCompressed));
         }
         toString() {
             return `<Point ${this.is0() ? 'ZERO' : this.toHex()}>`;
         }
-        // TODO: remove
-        get px() {
-            return this.X;
-        }
-        get py() {
-            return this.X;
-        }
-        get pz() {
-            return this.Z;
-        }
-        toRawBytes(isCompressed = true) {
-            return this.toBytes(isCompressed);
-        }
-        _setWindowSize(windowSize) {
-            this.precompute(windowSize);
-        }
-        static normalizeZ(points) {
-            return (0, curve_ts_1.normalizeZ)(Point, points);
-        }
-        static msm(points, scalars) {
-            return (0, curve_ts_1.pippenger)(Point, Fn, points, scalars);
-        }
-        static fromPrivateKey(privateKey) {
-            return Point.BASE.multiply(_normFnElement(Fn, privateKey));
-        }
     }
-    // base / generator point
-    Point.BASE = new Point(CURVE.Gx, CURVE.Gy, Fp.ONE);
-    // zero / infinity / identity point
-    Point.ZERO = new Point(Fp.ZERO, Fp.ONE, Fp.ZERO); // 0, 1, 0
-    // math field
-    Point.Fp = Fp;
-    // scalar field
-    Point.Fn = Fn;
     const bits = Fn.BITS;
-    const wnaf = new curve_ts_1.wNAF(Point, extraOpts.endo ? Math.ceil(bits / 2) : bits);
+    const wnaf = new wNAF(Point, extraOpts.endo ? Math.ceil(bits / 2) : bits);
+    Point.BASE.precompute(8); // Enable precomputes. Slows down first publicKey computation by 20ms.
     return Point;
 }
 // Points start with byte 0x02 when y is even; otherwise 0x03
@@ -747,7 +693,7 @@ function pprefix(hasEvenY) {
  * @param Z
  * @returns
  */
-function SWUFpSqrtRatio(Fp, Z) {
+export function SWUFpSqrtRatio(Fp, Z) {
     // Generic implementation
     const q = Fp.ORDER;
     let l = _0n;
@@ -820,8 +766,8 @@ function SWUFpSqrtRatio(Fp, Z) {
  * Simplified Shallue-van de Woestijne-Ulas Method
  * https://www.rfc-editor.org/rfc/rfc9380#section-6.6.2
  */
-function mapToCurveSimpleSWU(Fp, opts) {
-    (0, modular_ts_1.validateField)(Fp);
+export function mapToCurveSimpleSWU(Fp, opts) {
+    validateField(Fp);
     const { A, B, Z } = opts;
     if (!Fp.isValid(A) || !Fp.isValid(B) || !Fp.isValid(Z))
         throw new Error('mapToCurveSimpleSWU: invalid opts');
@@ -857,16 +803,16 @@ function mapToCurveSimpleSWU(Fp, opts) {
         y = Fp.cmov(y, value, isValid); // 22.   y = CMOV(y, y1, is_gx1_square)
         const e1 = Fp.isOdd(u) === Fp.isOdd(y); // 23.  e1 = sgn0(u) == sgn0(y)
         y = Fp.cmov(Fp.neg(y), y, e1); // 24.   y = CMOV(-y, y, e1)
-        const tv4_inv = (0, modular_ts_1.FpInvertBatch)(Fp, [tv4], true)[0];
+        const tv4_inv = FpInvertBatch(Fp, [tv4], true)[0];
         x = Fp.mul(x, tv4_inv); // 25.   x = x / tv4
         return { x, y };
     };
 }
 function getWLengths(Fp, Fn) {
     return {
-        secret: Fn.BYTES,
-        public: 1 + Fp.BYTES,
-        publicUncompressed: 1 + 2 * Fp.BYTES,
+        secretKey: Fn.BYTES,
+        publicKey: 1 + Fp.BYTES,
+        publicKeyUncompressed: 1 + 2 * Fp.BYTES,
         publicKeyHasPrefix: true,
         signature: 2 * Fn.BYTES,
     };
@@ -875,25 +821,26 @@ function getWLengths(Fp, Fn) {
  * Sometimes users only need getPublicKey, getSharedSecret, and secret key handling.
  * This helper ensures no signature functionality is present. Less code, smaller bundle size.
  */
-function ecdh(Point, ecdhOpts = {}) {
+export function ecdh(Point, ecdhOpts = {}) {
     const { Fn } = Point;
-    const randomBytes_ = ecdhOpts.randomBytes || utils_ts_1.randomBytes;
-    const lengths = Object.assign(getWLengths(Point.Fp, Fn), { seed: (0, modular_ts_1.getMinHashLength)(Fn.ORDER) });
+    const randomBytes_ = ecdhOpts.randomBytes || wcRandomBytes;
+    const lengths = Object.assign(getWLengths(Point.Fp, Fn), { seed: getMinHashLength(Fn.ORDER) });
     function isValidSecretKey(secretKey) {
         try {
-            return !!_normFnElement(Fn, secretKey);
+            const num = Fn.fromBytes(secretKey);
+            return Fn.isValidNot0(num);
         }
         catch (error) {
             return false;
         }
     }
     function isValidPublicKey(publicKey, isCompressed) {
-        const { public: comp, publicUncompressed } = lengths;
+        const { publicKey: comp, publicKeyUncompressed } = lengths;
         try {
             const l = publicKey.length;
             if (isCompressed === true && l !== comp)
                 return false;
-            if (isCompressed === false && l !== publicUncompressed)
+            if (isCompressed === false && l !== publicKeyUncompressed)
                 return false;
             return !!Point.fromBytes(publicKey);
         }
@@ -906,7 +853,7 @@ function ecdh(Point, ecdhOpts = {}) {
      * (groupLen + ceil(groupLen / 2)) with modulo bias being negligible.
      */
     function randomSecretKey(seed = randomBytes_(lengths.seed)) {
-        return (0, modular_ts_1.mapHashToField)((0, utils_ts_1._abytes2)(seed, lengths.seed, 'seed'), Fn.ORDER);
+        return mapHashToField(abytes(seed, lengths.seed, 'seed'), Fn.ORDER);
     }
     /**
      * Computes public key for a secret key. Checks for validity of the secret key.
@@ -914,7 +861,7 @@ function ecdh(Point, ecdhOpts = {}) {
      * @returns Public key, full when isCompressed=false; short when isCompressed=true
      */
     function getPublicKey(secretKey, isCompressed = true) {
-        return Point.BASE.multiply(_normFnElement(Fn, secretKey)).toBytes(isCompressed);
+        return Point.BASE.multiply(Fn.fromBytes(secretKey)).toBytes(isCompressed);
     }
     function keygen(seed) {
         const secretKey = randomSecretKey(seed);
@@ -924,14 +871,13 @@ function ecdh(Point, ecdhOpts = {}) {
      * Quick and dirty check for item being public key. Does not validate hex, or being on-curve.
      */
     function isProbPub(item) {
-        if (typeof item === 'bigint')
-            return false;
-        if (item instanceof Point)
-            return true;
-        if (Fn.allowedLengths || lengths.secret === lengths.public)
+        const { secretKey, publicKey, publicKeyUncompressed } = lengths;
+        if (!isBytes(item))
+            return undefined;
+        if (('_lengths' in Fn && Fn._lengths) || secretKey === publicKey)
             return undefined;
-        const l = (0, utils_ts_1.ensureBytes)('key', item).length;
-        return l === lengths.public || l === lengths.publicUncompressed;
+        const l = abytes(item, undefined, 'key').length;
+        return l === publicKey || l === publicKeyUncompressed;
     }
     /**
      * ECDH (Elliptic Curve Diffie Hellman).
@@ -946,21 +892,14 @@ function ecdh(Point, ecdhOpts = {}) {
             throw new Error('first arg must be private key');
         if (isProbPub(publicKeyB) === false)
             throw new Error('second arg must be public key');
-        const s = _normFnElement(Fn, secretKeyA);
-        const b = Point.fromHex(publicKeyB); // checks for being on-curve
+        const s = Fn.fromBytes(secretKeyA);
+        const b = Point.fromBytes(publicKeyB); // checks for being on-curve
         return b.multiply(s).toBytes(isCompressed);
     }
     const utils = {
         isValidSecretKey,
         isValidPublicKey,
         randomSecretKey,
-        // TODO: remove
-        isValidPrivateKey: isValidSecretKey,
-        randomPrivateKey: randomSecretKey,
-        normPrivateKeyToScalar: (key) => _normFnElement(Fn, key),
-        precompute(windowSize = 8, point = Point.BASE) {
-            return point.precompute(windowSize, false);
-        },
     };
     return Object.freeze({ getPublicKey, getSharedSecret, keygen, Point, utils, lengths });
 }
@@ -977,46 +916,53 @@ function ecdh(Point, ecdhOpts = {}) {
  * const p256_Point = weierstrass(...);
  * const p256_sha256 = ecdsa(p256_Point, sha256);
  * const p256_sha224 = ecdsa(p256_Point, sha224);
+ * const p256_sha224_r = ecdsa(p256_Point, sha224, { randomBytes: (length) => { ... } });
  * ```
  */
-function ecdsa(Point, hash, ecdsaOpts = {}) {
-    (0, utils_1.ahash)(hash);
-    (0, utils_ts_1._validateObject)(ecdsaOpts, {}, {
+export function ecdsa(Point, hash, ecdsaOpts = {}) {
+    ahash(hash);
+    _validateObject(ecdsaOpts, {}, {
         hmac: 'function',
         lowS: 'boolean',
         randomBytes: 'function',
         bits2int: 'function',
         bits2int_modN: 'function',
     });
-    const randomBytes_ = ecdsaOpts.randomBytes || utils_ts_1.randomBytes;
-    const hmac_ = ecdsaOpts.hmac ||
-        ((key, ...msgs) => (0, hmac_js_1.hmac)(hash, key, (0, utils_ts_1.concatBytes)(...msgs)));
+    ecdsaOpts = Object.assign({}, ecdsaOpts);
+    const randomBytes = ecdsaOpts.randomBytes || wcRandomBytes;
+    const hmac = ecdsaOpts.hmac ||
+        ((key, ...msgs) => nobleHmac(hash, key, concatBytes(...msgs)));
     const { Fp, Fn } = Point;
     const { ORDER: CURVE_ORDER, BITS: fnBits } = Fn;
     const { keygen, getPublicKey, getSharedSecret, utils, lengths } = ecdh(Point, ecdsaOpts);
     const defaultSigOpts = {
-        prehash: false,
-        lowS: typeof ecdsaOpts.lowS === 'boolean' ? ecdsaOpts.lowS : false,
-        format: undefined, //'compact' as ECDSASigFormat,
+        prehash: true,
+        lowS: typeof ecdsaOpts.lowS === 'boolean' ? ecdsaOpts.lowS : true,
+        format: 'compact',
         extraEntropy: false,
     };
-    const defaultSigOpts_format = 'compact';
     function isBiggerThanHalfOrder(number) {
         const HALF = CURVE_ORDER >> _1n;
         return number > HALF;
     }
-    function normalizeS(s) {
-        return isBiggerThanHalfOrder(s) ? Fn.neg(s) : s;
-    }
     function validateRS(title, num) {
         if (!Fn.isValidNot0(num))
             throw new Error(`invalid signature ${title}: out of range 1..Point.Fn.ORDER`);
         return num;
     }
+    function validateSigLength(bytes, format) {
+        validateSigFormat(format);
+        const size = lengths.signature;
+        const sizer = format === 'compact' ? size : format === 'recovered' ? size + 1 : undefined;
+        return abytes(bytes, sizer);
+    }
     /**
      * ECDSA signature with its (r, s) properties. Supports compact, recovered & DER representations.
      */
     class Signature {
+        r;
+        s;
+        recovery;
         constructor(r, s, recovery) {
             this.r = validateRS('r', r); // r in [1..N-1];
             this.s = validateRS('s', s); // s in [1..N-1];
@@ -1024,33 +970,30 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
                 this.recovery = recovery;
             Object.freeze(this);
         }
-        static fromBytes(bytes, format = defaultSigOpts_format) {
-            validateSigFormat(format);
-            const size = lengths.signature;
+        static fromBytes(bytes, format = defaultSigOpts.format) {
+            validateSigLength(bytes, format);
             let recid;
             if (format === 'der') {
-                const { r, s } = exports.DER.toSig((0, utils_ts_1._abytes2)(bytes));
+                const { r, s } = DER.toSig(abytes(bytes));
                 return new Signature(r, s);
             }
             if (format === 'recovered') {
-                (0, utils_ts_1._abytes2)(bytes, size + 1);
                 recid = bytes[0];
                 format = 'compact';
                 bytes = bytes.subarray(1);
             }
-            (0, utils_ts_1._abytes2)(bytes, size);
-            const L = size / 2;
+            const L = lengths.signature / 2;
             const r = bytes.subarray(0, L);
             const s = bytes.subarray(L, L * 2);
             return new Signature(Fn.fromBytes(r), Fn.fromBytes(s), recid);
         }
         static fromHex(hex, format) {
-            return this.fromBytes((0, utils_ts_1.hexToBytes)(hex), format);
+            return this.fromBytes(hexToBytes(hex), format);
         }
         addRecoveryBit(recovery) {
             return new Signature(this.r, this.s, recovery);
         }
-        recoverPublicKey(msgHash) {
+        recoverPublicKey(messageHash) {
             const FIELD_ORDER = Fp.ORDER;
             const { r, s, recovery: rec } = this;
             if (rec == null || ![0, 1, 2, 3].includes(rec))
@@ -1070,9 +1013,9 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
             if (!Fp.isValid(radj))
                 throw new Error('recovery id 2 or 3 invalid');
             const x = Fp.toBytes(radj);
-            const R = Point.fromBytes((0, utils_ts_1.concatBytes)(pprefix((rec & 1) === 0), x));
+            const R = Point.fromBytes(concatBytes(pprefix((rec & 1) === 0), x));
             const ir = Fn.inv(radj); // r^-1
-            const h = bits2int_modN((0, utils_ts_1.ensureBytes)('msgHash', msgHash)); // Truncate hash
+            const h = bits2int_modN(abytes(messageHash, undefined, 'msgHash')); // Truncate hash
             const u1 = Fn.create(-h * ir); // -hr^-1
             const u2 = Fn.create(s * ir); // sr^-1
             // (sr^-1)R-(hr^-1)G = -(hr^-1)G + (sr^-1). unsafe is fine: there is no private data.
@@ -1086,44 +1029,21 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
         hasHighS() {
             return isBiggerThanHalfOrder(this.s);
         }
-        toBytes(format = defaultSigOpts_format) {
+        toBytes(format = defaultSigOpts.format) {
             validateSigFormat(format);
             if (format === 'der')
-                return (0, utils_ts_1.hexToBytes)(exports.DER.hexFromSig(this));
+                return hexToBytes(DER.hexFromSig(this));
             const r = Fn.toBytes(this.r);
             const s = Fn.toBytes(this.s);
             if (format === 'recovered') {
                 if (this.recovery == null)
                     throw new Error('recovery bit must be present');
-                return (0, utils_ts_1.concatBytes)(Uint8Array.of(this.recovery), r, s);
+                return concatBytes(Uint8Array.of(this.recovery), r, s);
             }
-            return (0, utils_ts_1.concatBytes)(r, s);
+            return concatBytes(r, s);
         }
         toHex(format) {
-            return (0, utils_ts_1.bytesToHex)(this.toBytes(format));
-        }
-        // TODO: remove
-        assertValidity() { }
-        static fromCompact(hex) {
-            return Signature.fromBytes((0, utils_ts_1.ensureBytes)('sig', hex), 'compact');
-        }
-        static fromDER(hex) {
-            return Signature.fromBytes((0, utils_ts_1.ensureBytes)('sig', hex), 'der');
-        }
-        normalizeS() {
-            return this.hasHighS() ? new Signature(this.r, Fn.neg(this.s), this.recovery) : this;
-        }
-        toDERRawBytes() {
-            return this.toBytes('der');
-        }
-        toDERHex() {
-            return (0, utils_ts_1.bytesToHex)(this.toBytes('der'));
-        }
-        toCompactRawBytes() {
-            return this.toBytes('compact');
-        }
-        toCompactHex() {
-            return (0, utils_ts_1.bytesToHex)(this.toBytes('compact'));
+            return bytesToHex(this.toBytes(format));
         }
     }
     // RFC6979: ensure ECDSA msg is X bytes and < N. RFC suggests optional truncating via bits2octets.
@@ -1131,30 +1051,32 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
     // bits2int can produce res>N, we can do mod(res, N) since the bitLen is the same.
     // int2octets can't be used; pads small msgs with 0: unacceptatble for trunc as per RFC vectors
     const bits2int = ecdsaOpts.bits2int ||
-        function (bytes) {
+        function bits2int_def(bytes) {
             // Our custom check "just in case", for protection against DoS
             if (bytes.length > 8192)
                 throw new Error('input is too large');
             // For curves with nBitLength % 8 !== 0: bits2octets(bits2octets(m)) !== bits2octets(m)
             // for some cases, since bytes.length * 8 is not actual bitLength.
-            const num = (0, utils_ts_1.bytesToNumberBE)(bytes); // check for == u8 done here
+            const num = bytesToNumberBE(bytes); // check for == u8 done here
             const delta = bytes.length * 8 - fnBits; // truncate to nBitLength leftmost bits
             return delta > 0 ? num >> BigInt(delta) : num;
         };
     const bits2int_modN = ecdsaOpts.bits2int_modN ||
-        function (bytes) {
+        function bits2int_modN_def(bytes) {
             return Fn.create(bits2int(bytes)); // can't use bytesToNumberBE here
         };
-    // NOTE: pads output with zero as per spec
-    const ORDER_MASK = (0, utils_ts_1.bitMask)(fnBits);
-    /**
-     * Converts to bytes. Checks if num in `[0..ORDER_MASK-1]` e.g.: `[0..2^256-1]`.
-     */
+    // Pads output with zero as per spec
+    const ORDER_MASK = bitMask(fnBits);
+    /** Converts to bytes. Checks if num in `[0..ORDER_MASK-1]` e.g.: `[0..2^256-1]`. */
     function int2octets(num) {
         // IMPORTANT: the check ensures working for case `Fn.BYTES != Fn.BITS * 8`
-        (0, utils_ts_1.aInRange)('num < 2^' + fnBits, num, _0n, ORDER_MASK);
+        aInRange('num < 2^' + fnBits, num, _0n, ORDER_MASK);
         return Fn.toBytes(num);
     }
+    function validateMsgAndHash(message, prehash) {
+        abytes(message, undefined, 'message');
+        return prehash ? abytes(hash(message), undefined, 'prehashed message') : message;
+    }
     /**
      * Steps A, D of RFC6979 3.2.
      * Creates RFC6979 seed; converts msg/privKey to numbers.
@@ -1164,28 +1086,25 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
      * this will be invalid at least for P521. Also it can be bigger for P224 + SHA256.
      */
     function prepSig(message, privateKey, opts) {
-        if (['recovered', 'canonical'].some((k) => k in opts))
-            throw new Error('sign() legacy options not supported');
         const { lowS, prehash, extraEntropy } = validateSigOpts(opts, defaultSigOpts);
-        // RFC6979 3.2: we skip step A, because we already provide hash
-        message = (0, utils_ts_1._abytes2)(message, undefined, 'message');
-        if (prehash)
-            message = (0, utils_ts_1._abytes2)(hash(message), undefined, 'prehashed message');
+        message = validateMsgAndHash(message, prehash); // RFC6979 3.2 A: h1 = H(m)
         // We can't later call bits2octets, since nested bits2int is broken for curves
         // with fnBits % 8 !== 0. Because of that, we unwrap it here as int2octets call.
         // const bits2octets = (bits) => int2octets(bits2int_modN(bits))
         const h1int = bits2int_modN(message);
-        const d = _normFnElement(Fn, privateKey); // validate secret key, convert to bigint
+        const d = Fn.fromBytes(privateKey); // validate secret key, convert to bigint
+        if (!Fn.isValidNot0(d))
+            throw new Error('invalid private key');
         const seedArgs = [int2octets(d), int2octets(h1int)];
         // extraEntropy. RFC6979 3.6: additional k' (optional).
         if (extraEntropy != null && extraEntropy !== false) {
             // K = HMAC_K(V || 0x00 || int2octets(x) || bits2octets(h1) || k')
             // gen random bytes OR pass as-is
-            const e = extraEntropy === true ? randomBytes_(lengths.secret) : extraEntropy;
-            seedArgs.push((0, utils_ts_1.ensureBytes)('extraEntropy', e)); // check for being bytes
+            const e = extraEntropy === true ? randomBytes(lengths.secretKey) : extraEntropy;
+            seedArgs.push(abytes(e, undefined, 'extraEntropy')); // check for being bytes
         }
-        const seed = (0, utils_ts_1.concatBytes)(...seedArgs); // Step D of RFC6979 3.2
-        const m = h1int; // NOTE: no need to call bits2int second time here, it is inside truncateHash!
+        const seed = concatBytes(...seedArgs); // Step D of RFC6979 3.2
+        const m = h1int; // no need to call bits2int second time here, it is inside truncateHash!
         // Converts signature params into point w r/s, checks result for validity.
         // To transform k => Signature:
         // q = k⋅G
@@ -1197,7 +1116,7 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
         function k2sig(kBytes) {
             // RFC 6979 Section 3.2, step 3: k = bits2int(T)
             // Important: all mod() calls here must be done over N
-            const k = bits2int(kBytes); // mod n, not mod p
+            const k = bits2int(kBytes); // Cannot use fields methods, since it is group element
             if (!Fn.isValidNot0(k))
                 return; // Valid scalars (including k) must be in 1..N-1
             const ik = Fn.inv(k); // k^-1 mod n
@@ -1211,7 +1130,7 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
             let recovery = (q.x === r ? 0 : 2) | Number(q.y & _1n); // recovery bit (2 or 3, when q.x > n)
             let normS = s;
             if (lowS && isBiggerThanHalfOrder(s)) {
-                normS = normalizeS(s); // if lowS was passed, ensure s is always
+                normS = Fn.neg(s); // if lowS was passed, ensure s is always
                 recovery ^= 1; // // in the bottom half of N
             }
             return new Signature(r, normS, recovery); // use normS, not s
@@ -1230,14 +1149,11 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
      * ```
      */
     function sign(message, secretKey, opts = {}) {
-        message = (0, utils_ts_1.ensureBytes)('message', message);
         const { seed, k2sig } = prepSig(message, secretKey, opts); // Steps A, D of RFC6979 3.2.
-        const drbg = (0, utils_ts_1.createHmacDrbg)(hash.outputLen, Fn.BYTES, hmac_);
+        const drbg = createHmacDrbg(hash.outputLen, Fn.BYTES, hmac);
         const sig = drbg(seed, k2sig); // Steps B, C, D, E, F, G
-        return sig;
+        return sig.toBytes(opts.format);
     }
-    // Enable precomputes. Slows down first publicKey computation by 20ms.
-    Point.BASE.precompute(8);
     /**
      * Verifies a signature against message and public key.
      * Rejects lowS signatures by default: see {@link ECDSAVerifyOpts}.
@@ -1252,68 +1168,20 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
      * ```
      */
     function verify(signature, message, publicKey, opts = {}) {
-        const sg = signature;
-        message = (0, utils_ts_1.ensureBytes)('msgHash', message);
-        publicKey = (0, utils_ts_1.ensureBytes)('publicKey', publicKey);
         const { lowS, prehash, format } = validateSigOpts(opts, defaultSigOpts);
-        let _sig = undefined;
-        let P;
-        if ('strict' in opts)
-            throw new Error('options.strict was renamed to lowS');
-        if (format === undefined) {
-            // Try to deduce format
-            const isHex = typeof sg === 'string' || (0, utils_ts_1.isBytes)(sg);
-            const isObj = !isHex &&
-                sg !== null &&
-                typeof sg === 'object' &&
-                typeof sg.r === 'bigint' &&
-                typeof sg.s === 'bigint';
-            if (!isHex && !isObj)
-                throw new Error('invalid signature, expected Uint8Array, hex string or Signature instance');
-            if (isObj) {
-                _sig = new Signature(sg.r, sg.s);
-            }
-            else if (isHex) {
-                // TODO: remove this malleable check
-                // Signature can be represented in 2 ways: compact (2*Fn.BYTES) & DER (variable-length).
-                // Since DER can also be 2*Fn.BYTES bytes, we check for it first.
-                try {
-                    _sig = Signature.fromDER(sg);
-                }
-                catch (derError) {
-                    if (!(derError instanceof exports.DER.Err))
-                        throw derError;
-                }
-                if (!_sig) {
-                    try {
-                        _sig = Signature.fromCompact(sg);
-                    }
-                    catch (error) {
-                        return false;
-                    }
-                }
-            }
-        }
-        else {
-            if (format === 'compact' || format === 'der') {
-                if (typeof sg !== 'string' && !(0, utils_ts_1.isBytes)(sg))
-                    throw new Error('"der" / "compact" format expects Uint8Array signature');
-                _sig = Signature.fromBytes((0, utils_ts_1.ensureBytes)('sig', sg), format);
-            }
-            else {
-                throw new Error('format must be "compact", "der" or "js"');
-            }
+        publicKey = abytes(publicKey, undefined, 'publicKey');
+        message = validateMsgAndHash(message, prehash);
+        if (!isBytes(signature)) {
+            const end = signature instanceof Signature ? ', use sig.toBytes()' : '';
+            throw new Error('verify expects Uint8Array signature' + end);
         }
-        if (!_sig)
-            return false;
+        validateSigLength(signature, format); // execute this twice because we want loud error
         try {
-            P = Point.fromHex(publicKey);
-            if (lowS && _sig.hasHighS())
+            const sig = Signature.fromBytes(signature, format);
+            const P = Point.fromBytes(publicKey);
+            if (lowS && sig.hasHighS())
                 return false;
-            // todo: optional.hash => hash
-            if (prehash)
-                message = hash(message);
-            const { r, s } = _sig;
+            const { r, s } = sig;
             const h = bits2int_modN(message); // mod n, not mod p
             const is = Fn.inv(s); // s^-1 mod n
             const u1 = Fn.create(h * is); // u1 = hs^-1 mod n
@@ -1329,11 +1197,8 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
         }
     }
     function recoverPublicKey(signature, message, opts = {}) {
-        const prehash = opts.prehash !== undefined ? opts.prehash : defaultSigOpts.prehash;
-        (0, utils_ts_1._abool2)(prehash, 'prehash');
-        message = (0, utils_ts_1._abytes2)(message, undefined, 'message');
-        if (prehash)
-            message = (0, utils_ts_1._abytes2)(hash(message), undefined, 'prehashed message');
+        const { prehash } = validateSigOpts(opts, defaultSigOpts);
+        message = validateMsgAndHash(message, prehash);
         return Signature.fromBytes(signature, 'recovered').recoverPublicKey(message).toBytes();
     }
     return Object.freeze({
@@ -1350,93 +1215,4 @@ function ecdsa(Point, hash, ecdsaOpts = {}) {
         hash,
     });
 }
-/** @deprecated use `weierstrass` in newer releases */
-function weierstrassPoints(c) {
-    const { CURVE, curveOpts } = _weierstrass_legacy_opts_to_new(c);
-    const Point = weierstrassN(CURVE, curveOpts);
-    return _weierstrass_new_output_to_legacy(c, Point);
-}
-function _weierstrass_legacy_opts_to_new(c) {
-    const CURVE = {
-        a: c.a,
-        b: c.b,
-        p: c.Fp.ORDER,
-        n: c.n,
-        h: c.h,
-        Gx: c.Gx,
-        Gy: c.Gy,
-    };
-    const Fp = c.Fp;
-    let allowedLengths = c.allowedPrivateKeyLengths
-        ? Array.from(new Set(c.allowedPrivateKeyLengths.map((l) => Math.ceil(l / 2))))
-        : undefined;
-    const Fn = (0, modular_ts_1.Field)(CURVE.n, {
-        BITS: c.nBitLength,
-        allowedLengths: allowedLengths,
-        modFromBytes: c.wrapPrivateKey,
-    });
-    const curveOpts = {
-        Fp,
-        Fn,
-        allowInfinityPoint: c.allowInfinityPoint,
-        endo: c.endo,
-        isTorsionFree: c.isTorsionFree,
-        clearCofactor: c.clearCofactor,
-        fromBytes: c.fromBytes,
-        toBytes: c.toBytes,
-    };
-    return { CURVE, curveOpts };
-}
-function _ecdsa_legacy_opts_to_new(c) {
-    const { CURVE, curveOpts } = _weierstrass_legacy_opts_to_new(c);
-    const ecdsaOpts = {
-        hmac: c.hmac,
-        randomBytes: c.randomBytes,
-        lowS: c.lowS,
-        bits2int: c.bits2int,
-        bits2int_modN: c.bits2int_modN,
-    };
-    return { CURVE, curveOpts, hash: c.hash, ecdsaOpts };
-}
-function _legacyHelperEquat(Fp, a, b) {
-    /**
-     * y² = x³ + ax + b: Short weierstrass curve formula. Takes x, returns y².
-     * @returns y²
-     */
-    function weierstrassEquation(x) {
-        const x2 = Fp.sqr(x); // x * x
-        const x3 = Fp.mul(x2, x); // x² * x
-        return Fp.add(Fp.add(x3, Fp.mul(x, a)), b); // x³ + a * x + b
-    }
-    return weierstrassEquation;
-}
-function _weierstrass_new_output_to_legacy(c, Point) {
-    const { Fp, Fn } = Point;
-    function isWithinCurveOrder(num) {
-        return (0, utils_ts_1.inRange)(num, _1n, Fn.ORDER);
-    }
-    const weierstrassEquation = _legacyHelperEquat(Fp, c.a, c.b);
-    return Object.assign({}, {
-        CURVE: c,
-        Point: Point,
-        ProjectivePoint: Point,
-        normPrivateKeyToScalar: (key) => _normFnElement(Fn, key),
-        weierstrassEquation,
-        isWithinCurveOrder,
-    });
-}
-function _ecdsa_new_output_to_legacy(c, _ecdsa) {
-    const Point = _ecdsa.Point;
-    return Object.assign({}, _ecdsa, {
-        ProjectivePoint: Point,
-        CURVE: Object.assign({}, c, (0, modular_ts_1.nLength)(Point.Fn.ORDER, Point.Fn.BITS)),
-    });
-}
-// _ecdsa_legacy
-function weierstrass(c) {
-    const { CURVE, curveOpts, hash, ecdsaOpts } = _ecdsa_legacy_opts_to_new(c);
-    const Point = weierstrassN(CURVE, curveOpts);
-    const signs = ecdsa(Point, hash, ecdsaOpts);
-    return _ecdsa_new_output_to_legacy(c, signs);
-}
 //# sourceMappingURL=weierstrass.js.map