@norionsoft/hd-derivations 1.0.0-beta.0

package/build/browser/curve-to-key-pair-deriver.map-B3KvVk1f.js

@@ -0,0 +1,361 @@
+import { R as RistrettoPoint, e as ed25519, y as mod } from './ed25519-B6yJrRe1.js';
+import { s as secp256k1, i as isBytes, n as numberToBytesLE, b as bytesToNumberLE, a as bitMask, k as keccakP } from './sha3-3SpCb2s3.js';
+import { s as sha512 } from './sha512-D-HY1fu1.js';
+import { M as concatBytes, S as utf8ToBytes, N as randomBytes, C as u32 } from './_u64-C6ZvL3pZ.js';
+import { h as hasBigInt, i as isReady, s as secp256k1FromSeed, u as u8aToU8a } from './bundle-DjgjuASd.js';
+import { e as ed25519PairFromSeed } from './fromSeed-DfhShSKz.js';
+
+/**
+ * @name u8aEmpty
+ * @summary Tests for a `Uint8Array` for emptyness
+ * @description
+ * Checks to see if the input `Uint8Array` has zero length or contains all 0 values.
+ */
+function u8aEmpty(value) {
+    const len = value.length | 0;
+    // on smaller sizes, the byte-by-byte compare is faster than allocating
+    // another object for DataView (on very large arrays the DataView is faster)
+    for (let i = 0; i < len; i++) {
+        if (value[i] | 0) {
+            return false;
+        }
+    }
+    return true;
+}
+
+/**
+ * @name secp256k1PairFromSeed
+ * @description Returns a object containing a `publicKey` & `secretKey` generated from the supplied seed.
+ */
+function secp256k1PairFromSeed(seed, onlyJs) {
+    if (seed.length !== 32) {
+        throw new Error('Expected valid 32-byte private key as a seed');
+    }
+    if (!hasBigInt || (!onlyJs && isReady())) {
+        const full = secp256k1FromSeed(seed);
+        const publicKey = full.slice(32);
+        // There is an issue with the secp256k1 when running in an ASM.js environment where
+        // it seems that the lazy static section yields invalid results on the _first_ run.
+        // If this happens, fail outright, we cannot allow invalid return values
+        // https://github.com/polkadot-js/wasm/issues/307
+        if (u8aEmpty(publicKey)) {
+            throw new Error('Invalid publicKey generated from WASM interface');
+        }
+        return {
+            publicKey,
+            secretKey: full.slice(0, 32)
+        };
+    }
+    return {
+        publicKey: secp256k1.getPublicKey(seed, true),
+        secretKey: seed
+    };
+}
+
+/**
+ * Minimal JS implementation of sr25519 cryptography for Polkadot.
+ *
+ * Uses [Merlin](https://merlin.cool/index.html),
+ * a transcript construction, built on [Strobe](https://strobe.sourceforge.io).
+ * Merlin ensures two parties agree on the same state when communicating.
+ *
+ * More: https://wiki.polkadot.network/docs/learn-cryptography.
+ */
+// prettier-ignore
+BigInt(0); const _3n = BigInt(3);
+function toData(d) {
+    if (typeof d === 'string')
+        return utf8ToBytes(d);
+    if (isBytes(d))
+        return d;
+    throw new Error('Wrong data');
+}
+// Could've used bytes from hashes/assert, but we add extra arg
+function abytes(title, b, ...lengths) {
+    if (!isBytes(b))
+        throw new Error(`${title}: Uint8Array expected`);
+    if (lengths.length && !lengths.includes(b.length))
+        throw new Error(`${title}: Uint8Array expected of length ${lengths}, not of length=${b.length}`);
+}
+function checkU32(title, n) {
+    if (!Number.isSafeInteger(n) || n < 0 || n > 4294967295)
+        throw new Error(`${title}: wrong u32 integer: ${n}`);
+    return n;
+}
+function cleanBytes(...list) {
+    for (const t of list)
+        t.fill(0);
+}
+const EMPTY = Uint8Array.of();
+const CURVE_ORDER = ed25519.CURVE.n;
+const modN = (n) => mod(n, CURVE_ORDER);
+// STROBE128 (minimal version required for Merlin)
+// - https://strobe.sourceforge.io/specs/
+// We can implement full version, but seems nobody uses this much.
+const STROBE_R = 166;
+const Flags = {
+    I: 1,
+    A: 1 << 1,
+    C: 1 << 2,
+    T: 1 << 3,
+    M: 1 << 4,
+    K: 1 << 5,
+};
+// Differences: suffix, additional methods/flags
+class Strobe128 {
+    constructor(protocolLabel) {
+        this.state = new Uint8Array(200);
+        this.pos = 0;
+        this.posBegin = 0;
+        this.curFlags = 0;
+        this.state.set([1, STROBE_R + 2, 1, 0, 1, 96], 0);
+        this.state.set(utf8ToBytes('STROBEv1.0.2'), 6);
+        this.state32 = u32(this.state);
+        this.keccakF1600();
+        this.metaAD(protocolLabel, false);
+    }
+    keccakF1600() {
+        keccakP(this.state32);
+    }
+    runF() {
+        this.state[this.pos] ^= this.posBegin;
+        this.state[this.pos + 1] ^= 0x04;
+        this.state[STROBE_R + 1] ^= 0x80;
+        this.keccakF1600();
+        this.pos = 0;
+        this.posBegin = 0;
+    }
+    // keccak.update()
+    absorb(data) {
+        for (let i = 0; i < data.length; i++) {
+            this.state[this.pos++] ^= data[i];
+            if (this.pos === STROBE_R)
+                this.runF();
+        }
+    }
+    // keccak.xof()
+    squeeze(len) {
+        const data = new Uint8Array(len);
+        for (let i = 0; i < data.length; i++) {
+            data[i] = this.state[this.pos];
+            this.state[this.pos++] = 0;
+            if (this.pos === STROBE_R)
+                this.runF();
+        }
+        return data;
+    }
+    overwrite(data) {
+        for (let i = 0; i < data.length; i++) {
+            this.state[this.pos++] = data[i];
+            if (this.pos === STROBE_R)
+                this.runF();
+        }
+    }
+    beginOp(flags, more) {
+        if (more) {
+            if (this.curFlags !== flags) {
+                throw new Error(`Continued op with changed flags from ${this.curFlags.toString(2)} to ${flags.toString(2)}`);
+            }
+            return;
+        }
+        if ((flags & Flags.T) !== 0)
+            throw new Error('T flag is not supported');
+        const oldBegin = this.posBegin;
+        this.posBegin = this.pos + 1;
+        this.curFlags = flags;
+        this.absorb(new Uint8Array([oldBegin, flags]));
+        const forceF = (flags & (Flags.C | Flags.K)) !== 0;
+        if (forceF && this.pos !== 0)
+            this.runF();
+    }
+    // Public API
+    metaAD(data, more) {
+        this.beginOp(Flags.M | Flags.A, more);
+        this.absorb(toData(data));
+    }
+    AD(data, more) {
+        this.beginOp(Flags.A, more);
+        this.absorb(toData(data));
+    }
+    PRF(len, more) {
+        this.beginOp(Flags.I | Flags.A | Flags.C, more);
+        return this.squeeze(len);
+    }
+    KEY(data, more) {
+        this.beginOp(Flags.A | Flags.C, more);
+        this.overwrite(toData(data));
+    }
+    // Utils
+    clone() {
+        const n = new Strobe128('0'); // tmp
+        n.pos = this.pos;
+        n.posBegin = this.posBegin;
+        n.state.set(this.state);
+        n.curFlags = this.curFlags;
+        return n;
+    }
+    clean() {
+        this.state.fill(0); // also clears state32, because same buffer
+        this.pos = 0;
+        this.curFlags = 0;
+        this.posBegin = 0;
+    }
+}
+// /STROBE128
+// Merlin
+// https://merlin.cool/index.html
+class Merlin {
+    constructor(label) {
+        this.strobe = new Strobe128('Merlin v1.0');
+        this.appendMessage('dom-sep', label);
+    }
+    appendMessage(label, message) {
+        this.strobe.metaAD(label, false);
+        checkU32('Merlin.appendMessage', message.length);
+        this.strobe.metaAD(numberToBytesLE(message.length, 4), true);
+        this.strobe.AD(message, false);
+    }
+    challengeBytes(label, len) {
+        this.strobe.metaAD(label, false);
+        checkU32('Merlin.challengeBytes', len);
+        this.strobe.metaAD(numberToBytesLE(len, 4), true);
+        return this.strobe.PRF(len, false);
+    }
+    clean() {
+        this.strobe.clean();
+    }
+}
+// /Merlin
+// Merlin signging context/transcript (sr25519 specific stuff, Merlin and Strobe are generic (but minimal))
+class SigningContext extends Merlin {
+    constructor(name, rng = randomBytes) {
+        super(name);
+        this.rng = rng;
+    }
+    label(label) {
+        this.appendMessage('', label);
+    }
+    bytes(bytes) {
+        this.appendMessage('sign-bytes', bytes);
+        return this;
+    }
+    protoName(label) {
+        this.appendMessage('proto-name', label);
+    }
+    commitPoint(label, point) {
+        this.appendMessage(label, point.toRawBytes());
+    }
+    challengeScalar(label) {
+        return modN(bytesToNumberLE(this.challengeBytes(label, 64)));
+    }
+    witnessScalar(label, nonceSeeds = []) {
+        return modN(bytesToNumberLE(this.witnessBytes(label, 64, nonceSeeds)));
+    }
+    witnessBytes(label, len, nonceSeeds = []) {
+        checkU32('SigningContext.witnessBytes', len);
+        const strobeRng = this.strobe.clone();
+        for (const ns of nonceSeeds) {
+            strobeRng.metaAD(label, false);
+            checkU32('SigningContext.witnessBytes nonce length', ns.length);
+            strobeRng.metaAD(numberToBytesLE(ns.length, 4), true);
+            strobeRng.KEY(ns, false);
+        }
+        const random = this.rng(32);
+        strobeRng.metaAD('rng', false);
+        strobeRng.KEY(random, false);
+        strobeRng.metaAD(numberToBytesLE(len, 4), false);
+        return strobeRng.PRF(len, false);
+    }
+}
+// /Merlin signing context
+const MASK = bitMask(256);
+// == (n * CURVE.h) % CURVE_BIT_MASK
+const encodeScalar = (n) => numberToBytesLE((n << _3n) & MASK, 32);
+// n / CURVE.h
+const decodeScalar = (n) => bytesToNumberLE(n) >> _3n;
+// NOTE: secretKey is 64 bytes (key + nonce). This required for HDKD, since key can be derived not only from seed, but from other keys.
+function getPublicKey(secretKey) {
+    abytes('secretKey', secretKey, 64);
+    const scalar = decodeScalar(secretKey.subarray(0, 32));
+    return RistrettoPoint.BASE.multiply(scalar).toRawBytes();
+}
+function secretFromSeed(seed) {
+    abytes('seed', seed, 32);
+    const r = sha512(seed);
+    // NOTE: different from ed25519
+    r[0] &= 248;
+    r[31] &= 63;
+    r[31] |= 64;
+    // this will strip upper 3 bits and lower 3 bits
+    const key = encodeScalar(decodeScalar(r.subarray(0, 32)));
+    const nonce = r.subarray(32, 64);
+    const res = concatBytes(key, nonce);
+    cleanBytes(key, nonce, r);
+    return res;
+}
+// Basic sign. NOTE: context is currently constant. Please open issue if you need different one.
+utf8ToBytes('substrate');
+// Derive
+const HDKD = {
+    secretSoft(secretKey, chainCode, rng = randomBytes) {
+        abytes('secretKey', secretKey, 64);
+        abytes('chainCode', chainCode, 32);
+        const masterScalar = decodeScalar(secretKey.subarray(0, 32));
+        const masterNonce = secretKey.subarray(32, 64);
+        const pubPoint = RistrettoPoint.fromHex(getPublicKey(secretKey));
+        const t = new SigningContext('SchnorrRistrettoHDKD', rng);
+        t.bytes(EMPTY);
+        t.appendMessage('chain-code', chainCode);
+        t.commitPoint('public-key', pubPoint);
+        const scalar = t.challengeScalar('HDKD-scalar');
+        const hdkdChainCode = t.challengeBytes('HDKD-chaincode', 32);
+        const nonceSeed = concatBytes(numberToBytesLE(masterScalar, 32), masterNonce);
+        const nonce = t.witnessBytes('HDKD-nonce', 32, [masterNonce, nonceSeed]);
+        const key = encodeScalar(modN(masterScalar + scalar));
+        const res = concatBytes(key, nonce);
+        cleanBytes(key, nonce, nonceSeed, hdkdChainCode);
+        t.clean();
+        return res;
+    },
+    secretHard(secretKey, chainCode) {
+        abytes('secretKey', secretKey, 64);
+        abytes('chainCode', chainCode, 32);
+        const key = numberToBytesLE(decodeScalar(secretKey.subarray(0, 32)), 32);
+        const t = new SigningContext('SchnorrRistrettoHDKD');
+        t.bytes(EMPTY);
+        t.appendMessage('chain-code', chainCode);
+        t.appendMessage('secret-key', key);
+        const msk = t.challengeBytes('HDKD-hard', 32);
+        const hdkdChainCode = t.challengeBytes('HDKD-chaincode', 32);
+        t.clean();
+        const res = secretFromSeed(msk);
+        cleanBytes(key, msk, hdkdChainCode);
+        t.clean();
+        return res;
+    },
+};
+
+/**
+ * @name sr25519PairFromSeed
+ * @description Returns a object containing a `publicKey` & `secretKey` generated from the supplied seed.
+ */
+function sr25519PairFromSeed(seed) {
+    const seedU8a = u8aToU8a(seed);
+    if (seedU8a.length !== 32) {
+        throw new Error(`Expected a seed matching 32 bytes, found ${seedU8a.length}`);
+    }
+    const sec = secretFromSeed(seedU8a);
+    const pub = getPublicKey(sec);
+    return {
+        publicKey: pub,
+        secretKey: sec
+    };
+}
+
+const curveToKeyPairDeriver = {
+  secp256k1: (seed) => secp256k1PairFromSeed(seed),
+  ed25519: (seed) => ed25519PairFromSeed(seed),
+  sr25519: (seed) => sr25519PairFromSeed(seed)
+};
+
+export { HDKD as H, curveToKeyPairDeriver as c, getPublicKey as g, secp256k1PairFromSeed as s };