@ohos-ports/crypto 0.0.0-stage → 0.3.1-beta.1

package/dist/noble/crypto.d.ts

@@ -0,0 +1 @@
+export declare const crypto: any;

package/dist/noble/crypto.js

@@ -0,0 +1,4 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.crypto = void 0;
+exports.crypto = typeof globalThis === 'object' && 'crypto' in globalThis ? globalThis.crypto : undefined;

package/dist/noble/curves/curve.d.ts

@@ -0,0 +1,69 @@
+/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+import { IField } from './modular.js';
+export type AffinePoint<T> = {
+    x: T;
+    y: T;
+} & {
+    z?: never;
+    t?: never;
+};
+export interface Group<T extends Group<T>> {
+    double(): T;
+    negate(): T;
+    add(other: T): T;
+    subtract(other: T): T;
+    equals(other: T): boolean;
+    multiply(scalar: bigint): T;
+}
+export type GroupConstructor<T> = {
+    BASE: T;
+    ZERO: T;
+};
+export type Mapper<T> = (i: T[]) => T[];
+export declare function wNAF<T extends Group<T>>(c: GroupConstructor<T>, bits: number): {
+    constTimeNegate: (condition: boolean, item: T) => T;
+    unsafeLadder(elm: T, n: bigint): T;
+    /**
+     * Creates a wNAF precomputation window. Used for caching.
+     * Default window size is set by `utils.precompute()` and is equal to 8.
+     * Number of precomputed points depends on the curve size:
+     * 2^(𝑊−1) * (Math.ceil(𝑛 / 𝑊) + 1), where:
+     * - 𝑊 is the window size
+     * - 𝑛 is the bitlength of the curve order.
+     * For a 256-bit curve and window size 8, the number of precomputed points is 128 * 33 = 4224.
+     * @returns precomputed point tables flattened to a single array
+     */
+    precomputeWindow(elm: T, W: number): Group<T>[];
+    /**
+     * Implements ec multiplication using precomputed tables and w-ary non-adjacent form.
+     * @param W window size
+     * @param precomputes precomputed tables
+     * @param n scalar (we don't check here, but should be less than curve order)
+     * @returns real and fake (for const-time) points
+     */
+    wNAF(W: number, precomputes: T[], n: bigint): {
+        p: T;
+        f: T;
+    };
+    wNAFCached(P: T, precomputesMap: Map<T, T[]>, n: bigint, transform: Mapper<T>): {
+        p: T;
+        f: T;
+    };
+};
+export type BasicCurve<T> = {
+    Fp: IField<T>;
+    n: bigint;
+    nBitLength?: number;
+    nByteLength?: number;
+    h: bigint;
+    hEff?: bigint;
+    Gx: T;
+    Gy: T;
+    allowInfinityPoint?: boolean;
+};
+export declare function validateBasic<FP, T>(curve: BasicCurve<FP> & T): Readonly<{
+    readonly nBitLength: number;
+    readonly nByteLength: number;
+} & BasicCurve<FP> & T & {
+    p: bigint;
+}>;

package/dist/noble/curves/curve.js

@@ -0,0 +1,167 @@
+"use strict";
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateBasic = exports.wNAF = void 0;
+/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+// Abelian group utilities
+var modular_1 = require("./modular.js");
+var utils_1 = require("./utils.js");
+var _0n = BigInt(0);
+var _1n = BigInt(1);
+// Elliptic curve multiplication of Point by scalar. Fragile.
+// Scalars should always be less than curve order: this should be checked inside of a curve itself.
+// Creates precomputation tables for fast multiplication:
+// - private scalar is split by fixed size windows of W bits
+// - every window point is collected from window's table & added to accumulator
+// - since windows are different, same point inside tables won't be accessed more than once per calc
+// - each multiplication is 'Math.ceil(CURVE_ORDER / 𝑊) + 1' point additions (fixed for any scalar)
+// - +1 window is neccessary for wNAF
+// - wNAF reduces table size: 2x less memory + 2x faster generation, but 10% slower multiplication
+// TODO: Research returning 2d JS array of windows, instead of a single window. This would allow
+// windows to be in different memory locations
+function wNAF(c, bits) {
+    var constTimeNegate = function (condition, item) {
+        var neg = item.negate();
+        return condition ? neg : item;
+    };
+    var opts = function (W) {
+        var windows = Math.ceil(bits / W) + 1; // +1, because
+        var windowSize = Math.pow(2, (W - 1)); // -1 because we skip zero
+        return { windows: windows, windowSize: windowSize };
+    };
+    return {
+        constTimeNegate: constTimeNegate,
+        // non-const time multiplication ladder
+        unsafeLadder: function (elm, n) {
+            var p = c.ZERO;
+            var d = elm;
+            while (n > _0n) {
+                if (n & _1n)
+                    p = p.add(d);
+                d = d.double();
+                n >>= _1n;
+            }
+            return p;
+        },
+        /**
+         * Creates a wNAF precomputation window. Used for caching.
+         * Default window size is set by `utils.precompute()` and is equal to 8.
+         * Number of precomputed points depends on the curve size:
+         * 2^(𝑊−1) * (Math.ceil(𝑛 / 𝑊) + 1), where:
+         * - 𝑊 is the window size
+         * - 𝑛 is the bitlength of the curve order.
+         * For a 256-bit curve and window size 8, the number of precomputed points is 128 * 33 = 4224.
+         * @returns precomputed point tables flattened to a single array
+         */
+        precomputeWindow: function (elm, W) {
+            var _a = opts(W), windows = _a.windows, windowSize = _a.windowSize;
+            var points = [];
+            var p = elm;
+            var base = p;
+            for (var window_1 = 0; window_1 < windows; window_1++) {
+                base = p;
+                points.push(base);
+                // =1, because we skip zero
+                for (var i = 1; i < windowSize; i++) {
+                    base = base.add(p);
+                    points.push(base);
+                }
+                p = base.double();
+            }
+            return points;
+        },
+        /**
+         * Implements ec multiplication using precomputed tables and w-ary non-adjacent form.
+         * @param W window size
+         * @param precomputes precomputed tables
+         * @param n scalar (we don't check here, but should be less than curve order)
+         * @returns real and fake (for const-time) points
+         */
+        wNAF: function (W, precomputes, n) {
+            // TODO: maybe check that scalar is less than group order? wNAF behavious is undefined otherwise
+            // But need to carefully remove other checks before wNAF. ORDER == bits here
+            var _a = opts(W), windows = _a.windows, windowSize = _a.windowSize;
+            var p = c.ZERO;
+            var f = c.BASE;
+            var mask = BigInt(Math.pow(2, W) - 1); // Create mask with W ones: 0b1111 for W=4 etc.
+            var maxNumber = Math.pow(2, W);
+            var shiftBy = BigInt(W);
+            for (var window_2 = 0; window_2 < windows; window_2++) {
+                var offset = window_2 * windowSize;
+                // Extract W bits.
+                var wbits = Number(n & mask);
+                // Shift number by W bits.
+                n >>= shiftBy;
+                // If the bits are bigger than max size, we'll split those.
+                // +224 => 256 - 32
+                if (wbits > windowSize) {
+                    wbits -= maxNumber;
+                    n += _1n;
+                }
+                // This code was first written with assumption that 'f' and 'p' will never be infinity point:
+                // since each addition is multiplied by 2 ** W, it cannot cancel each other. However,
+                // there is negate now: it is possible that negated element from low value
+                // would be the same as high element, which will create carry into next window.
+                // It's not obvious how this can fail, but still worth investigating later.
+                // Check if we're onto Zero point.
+                // Add random point inside current window to f.
+                var offset1 = offset;
+                var offset2 = offset + Math.abs(wbits) - 1; // -1 because we skip zero
+                var cond1 = window_2 % 2 !== 0;
+                var cond2 = wbits < 0;
+                if (wbits === 0) {
+                    // The most important part for const-time getPublicKey
+                    f = f.add(constTimeNegate(cond1, precomputes[offset1]));
+                }
+                else {
+                    p = p.add(constTimeNegate(cond2, precomputes[offset2]));
+                }
+            }
+            // JIT-compiler should not eliminate f here, since it will later be used in normalizeZ()
+            // Even if the variable is still unused, there are some checks which will
+            // throw an exception, so compiler needs to prove they won't happen, which is hard.
+            // At this point there is a way to F be infinity-point even if p is not,
+            // which makes it less const-time: around 1 bigint multiply.
+            return { p: p, f: f };
+        },
+        wNAFCached: function (P, precomputesMap, n, transform) {
+            // @ts-ignore
+            var W = P._WINDOW_SIZE || 1;
+            // Calculate precomputes on a first run, reuse them after
+            var comp = precomputesMap.get(P);
+            if (!comp) {
+                comp = this.precomputeWindow(P, W);
+                if (W !== 1) {
+                    precomputesMap.set(P, transform(comp));
+                }
+            }
+            return this.wNAF(W, comp, n);
+        },
+    };
+}
+exports.wNAF = wNAF;
+function validateBasic(curve) {
+    (0, modular_1.validateField)(curve.Fp);
+    (0, utils_1.validateObject)(curve, {
+        n: 'bigint',
+        h: 'bigint',
+        Gx: 'field',
+        Gy: 'field',
+    }, {
+        nBitLength: 'isSafeInteger',
+        nByteLength: 'isSafeInteger',
+    });
+    // Set defaults
+    return Object.freeze(__assign(__assign(__assign({}, (0, modular_1.nLength)(curve.n, curve.nBitLength)), curve), { p: curve.Fp.ORDER }));
+}
+exports.validateBasic = validateBasic;

package/dist/noble/curves/modular.d.ts

@@ -0,0 +1,122 @@
+export declare function mod(a: bigint, b: bigint): bigint;
+/**
+ * Efficiently raise num to power and do modular division.
+ * Unsafe in some contexts: uses ladder, so can expose bigint bits.
+ * @example
+ * pow(2n, 6n, 11n) // 64n % 11n == 9n
+ */
+export declare function pow(num: bigint, power: bigint, modulo: bigint): bigint;
+export declare function pow2(x: bigint, power: bigint, modulo: bigint): bigint;
+export declare function invert(number: bigint, modulo: bigint): bigint;
+/**
+ * Tonelli-Shanks square root search algorithm.
+ * 1. https://eprint.iacr.org/2012/685.pdf (page 12)
+ * 2. Square Roots from 1; 24, 51, 10 to Dan Shanks
+ * Will start an infinite loop if field order P is not prime.
+ * @param P field order
+ * @returns function that takes field Fp (created from P) and number n
+ */
+export declare function tonelliShanks(P: bigint): <T>(Fp: IField<T>, n: T) => T;
+export declare function FpSqrt(P: bigint): <T>(Fp: IField<T>, n: T) => T;
+export declare const isNegativeLE: (num: bigint, modulo: bigint) => boolean;
+export interface IField<T> {
+    ORDER: bigint;
+    BYTES: number;
+    BITS: number;
+    MASK: bigint;
+    ZERO: T;
+    ONE: T;
+    create: (num: T) => T;
+    isValid: (num: T) => boolean;
+    is0: (num: T) => boolean;
+    neg(num: T): T;
+    inv(num: T): T;
+    sqrt(num: T): T;
+    sqr(num: T): T;
+    eql(lhs: T, rhs: T): boolean;
+    add(lhs: T, rhs: T): T;
+    sub(lhs: T, rhs: T): T;
+    mul(lhs: T, rhs: T | bigint): T;
+    pow(lhs: T, power: bigint): T;
+    div(lhs: T, rhs: T | bigint): T;
+    addN(lhs: T, rhs: T): T;
+    subN(lhs: T, rhs: T): T;
+    mulN(lhs: T, rhs: T | bigint): T;
+    sqrN(num: T): T;
+    isOdd?(num: T): boolean;
+    pow(lhs: T, power: bigint): T;
+    invertBatch: (lst: T[]) => T[];
+    toBytes(num: T): Uint8Array;
+    fromBytes(bytes: Uint8Array): T;
+    cmov(a: T, b: T, c: boolean): T;
+}
+export declare function validateField<T>(field: IField<T>): IField<T>;
+/**
+ * Same as `pow` but for Fp: non-constant-time.
+ * Unsafe in some contexts: uses ladder, so can expose bigint bits.
+ */
+export declare function FpPow<T>(f: IField<T>, num: T, power: bigint): T;
+/**
+ * Efficiently invert an array of Field elements.
+ * `inv(0)` will return `undefined` here: make sure to throw an error.
+ */
+export declare function FpInvertBatch<T>(f: IField<T>, nums: T[]): T[];
+export declare function FpDiv<T>(f: IField<T>, lhs: T, rhs: T | bigint): T;
+export declare function FpIsSquare<T>(f: IField<T>): (x: T) => boolean;
+export declare function nLength(n: bigint, nBitLength?: number): {
+    nBitLength: number;
+    nByteLength: number;
+};
+type FpField = IField<bigint> & Required<Pick<IField<bigint>, 'isOdd'>>;
+/**
+ * Initializes a finite field over prime. **Non-primes are not supported.**
+ * Do not init in loop: slow. Very fragile: always run a benchmark on a change.
+ * Major performance optimizations:
+ * * a) denormalized operations like mulN instead of mul
+ * * b) same object shape: never add or remove keys
+ * * c) Object.freeze
+ * @param ORDER prime positive bigint
+ * @param bitLen how many bits the field consumes
+ * @param isLE (def: false) if encoding / decoding should be in little-endian
+ * @param redef optional faster redefinitions of sqrt and other methods
+ */
+export declare function Field(ORDER: bigint, bitLen?: number, isLE?: boolean, redef?: Partial<IField<bigint>>): Readonly<FpField>;
+export declare function FpSqrtOdd<T>(Fp: IField<T>, elm: T): T;
+export declare function FpSqrtEven<T>(Fp: IField<T>, elm: T): T;
+/**
+ * "Constant-time" private key generation utility.
+ * Same as mapKeyToField, but accepts less bytes (40 instead of 48 for 32-byte field).
+ * Which makes it slightly more biased, less secure.
+ * @deprecated use mapKeyToField instead
+ */
+export declare function hashToPrivateScalar(hash: string | Uint8Array, groupOrder: bigint, isLE?: boolean): bigint;
+/**
+ * Returns total number of bytes consumed by the field element.
+ * For example, 32 bytes for usual 256-bit weierstrass curve.
+ * @param fieldOrder number of field elements, usually CURVE.n
+ * @returns byte length of field
+ */
+export declare function getFieldBytesLength(fieldOrder: bigint): number;
+/**
+ * Returns minimal amount of bytes that can be safely reduced
+ * by field order.
+ * Should be 2^-128 for 128-bit curve such as P256.
+ * @param fieldOrder number of field elements, usually CURVE.n
+ * @returns byte length of target hash
+ */
+export declare function getMinHashLength(fieldOrder: bigint): number;
+/**
+ * "Constant-time" private key generation utility.
+ * Can take (n + n/2) or more bytes of uniform input e.g. from CSPRNG or KDF
+ * and convert them into private scalar, with the modulo bias being negligible.
+ * Needs at least 48 bytes of input for 32-byte private key.
+ * https://research.kudelskisecurity.com/2020/07/28/the-definitive-guide-to-modulo-bias-and-how-to-avoid-it/
+ * FIPS 186-5, A.2 https://csrc.nist.gov/publications/detail/fips/186/5/final
+ * RFC 9380, https://www.rfc-editor.org/rfc/rfc9380#section-5
+ * @param hash hash output from SHA3 or a similar function
+ * @param groupOrder size of subgroup - (e.g. secp256k1.CURVE.n)
+ * @param isLE interpret hash bytes as LE num
+ * @returns valid private scalar
+ */
+export declare function mapHashToField(key: Uint8Array, fieldOrder: bigint, isLE?: boolean): Uint8Array;
+export {};