@ohos-ports/crypto 0.0.0-stage → 0.3.1-beta.1

package/dist/rust_vrf_reimpl/vrf10_batch.js

@@ -0,0 +1,245 @@
+"use strict";
+var __read = (this && this.__read) || function (o, n) {
+    var m = typeof Symbol === "function" && o[Symbol.iterator];
+    if (!m) return o;
+    var i = m.call(o), r, ar = [], e;
+    try {
+        while ((n === void 0 || n-- > 0) && !(r = i.next()).done) ar.push(r.value);
+    }
+    catch (error) { e = { error: error }; }
+    finally {
+        try {
+            if (r && !r.done && (m = i["return"])) m.call(i);
+        }
+        finally { if (e) throw e.error; }
+    }
+    return ar;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.vrf10_batch_ed25519_sha512_ell2_verify_proof = exports.vrf10_batch_ed25519_sha512_ell2_generate_proof = exports.vrf10_batch_ed25519_sha512_ell2_proof_to_hash = void 0;
+var uint8array_utils_1 = require("@harmoniclabs/uint8array-utils");
+var sha2_512_1 = require("../sha2_512.js");
+var curves_1 = require("./curves.js");
+var vrf10_1 = require("./vrf10.js");
+/**
+4.4. RSA-FDH-VRF Ciphersuites
+
+This document defines RSA-FDH-VRF-SHA256 as follows:
+
+suite_string = 0x01.
+The hash function Hash is SHA-256 as specified in [RFC6234], with hLen = 32.
+MGF_salt = I2OSP(k, 4) || I2OSP(n, k).
+
+This document defines RSA-FDH-VRF-SHA384 as follows:
+
+suite_string = 0x02.
+The hash function Hash is SHA-384 as specified in [RFC6234], with hLen = 48.
+MGF_salt = I2OSP(k, 4) || I2OSP(n, k).
+
+This document defines RSA-FDH-VRF-SHA512 as follows:
+
+suite_string = 0x10.
+The hash function Hash is SHA-512 as specified in [RFC6234], with hLen = 64.
+MGF_salt = I2OSP(k, 4) || I2OSP(n, k).
+
+ */
+var SUITE = 0x04;
+/*
+/// Temporary SUITE identifier, as TAI uses 0x03
+pub const SUITE_TEMP: &[u8] = &[0x03];
+*/
+var SUITE_TEMP = 0x03;
+var ONE = 0x01;
+var TWO = 0x02;
+var THREE = 0x03;
+function vrf10_batch_ed25519_sha512_ell2_proof_to_hash(proof) {
+    var compressed_gamma_cofac = proof.gamma.mul_by_cofactor().compress();
+    var input = new Uint8Array(3 + compressed_gamma_cofac.length);
+    input[0] = SUITE_TEMP;
+    input[1] = THREE;
+    input.set(compressed_gamma_cofac, 2);
+    input[2 + compressed_gamma_cofac.length] = 0;
+    return (0, sha2_512_1.sha2_512_sync)(input);
+}
+exports.vrf10_batch_ed25519_sha512_ell2_proof_to_hash = vrf10_batch_ed25519_sha512_ell2_proof_to_hash;
+function vrf10_batch_ed25519_sha512_ell2_generate_proof(secret_key, public_key, alpha_string) {
+    var _a = __read((0, vrf10_1.extend_secret_key)(secret_key), 2), secret_scalar = _a[0], secret_extension = _a[1];
+    var h = (0, vrf10_1.vrf10_ed25519_sha512_ell2_hash_to_curve)(public_key, alpha_string);
+    var compressed_h = h.compress();
+    var gamma = h.scalarMul(secret_scalar);
+    var compressed_gamma = gamma.compress();
+    var k = (0, vrf10_1.vrf10_ed25519_sha512_ell2_nonce_generation)(secret_extension, compressed_h);
+    var announcement_base = curves_1.ED25519_BASEPOINT_POINT.scalarMul(k);
+    var compressed_announcement_base = announcement_base.compress();
+    var announcement_h = h.scalarMul(k);
+    var compressed_announcement_h = announcement_h.compress();
+    // Self::compute_challenge(&compressed_h, &gamma, &announcement_base, &announcement_h);
+    var challenge = (0, vrf10_1.vrf10_ed25519_sha512_ell2_compute_challenge)(compressed_h, compressed_gamma, compressed_announcement_base, compressed_announcement_h);
+    var response = (0, curves_1.add_scalars)(k, (0, curves_1.mul_scalars)(challenge, secret_scalar));
+    return {
+        gamma: gamma,
+        u_point: announcement_base,
+        v_point: announcement_h,
+        response: response
+    };
+}
+exports.vrf10_batch_ed25519_sha512_ell2_generate_proof = vrf10_batch_ed25519_sha512_ell2_generate_proof;
+function vrf10_batch_ed25519_sha512_ell2_verify_proof(public_key, alpha_string, proof) {
+    var h = (0, vrf10_1.vrf10_ed25519_sha512_ell2_hash_to_curve)(public_key, alpha_string);
+    var compressed_h = h.compress();
+    var decompressed_pk = (0, curves_1.decompressCompressedEdwardsY)(public_key); // pointFromBytes( public_key );
+    if (!decompressed_pk || decompressed_pk.is_small_order())
+        return false;
+    var gamma = proof.gamma;
+    var compressed_gamma = gamma.compress();
+    var compressed_announcement_base = proof.u_point.compress();
+    var compressed_announcement_h = proof.v_point.compress();
+    // Scalar
+    var proof_challenge = (0, vrf10_1.vrf10_ed25519_sha512_ell2_compute_challenge)(compressed_h, compressed_gamma, compressed_announcement_base, compressed_announcement_h);
+    var U = curves_1.EdwardsPoint.vartime_double_scalar_mul_basepoint((0, curves_1.negate_scalar)(proof_challenge), decompressed_pk, proof.response);
+    /*
+    let V = EdwardsPoint::vartime_multiscalar_mul(
+            iter::once(self.response).chain(iter::once(self.challenge.neg())),
+            iter::once(h).chain(iter::once(self.gamma)),
+        );
+    */
+    var V = curves_1.EdwardsPoint.vartime_multiscalar_mul([proof.response, (0, curves_1.negate_scalar)(proof_challenge)], [h, gamma]);
+    // const computed_challenge = vrf10_ed25519_sha512_ell2_compute_challenge(
+    //     compressed_h,
+    //     proof.gamma.compress(),
+    //     U.compress(),
+    //     V.compress()
+    // );
+    return ((0, uint8array_utils_1.uint8ArrayEq)(U.compress(), compressed_announcement_base) &&
+        (0, uint8array_utils_1.uint8ArrayEq)(V.compress(), compressed_announcement_h));
+}
+exports.vrf10_batch_ed25519_sha512_ell2_verify_proof = vrf10_batch_ed25519_sha512_ell2_verify_proof;
+/*
+/// `proof_to_hash` function, following the 10 specification. This computes the output of the VRF
+    /// function. In particular, this function computes
+    /// SHA512(SUITE || THREE || Gamma || ZERO)
+    fn proof_to_hash(&self) -> [u8; OUTPUT_SIZE] {
+        let mut output = [0u8; OUTPUT_SIZE];
+        let gamma_cofac = self.gamma.mul_by_cofactor();
+        let mut hash = Sha512::new();
+        hash.update(SUITE_TEMP);
+        hash.update(THREE);
+        hash.update(gamma_cofac.compress().as_bytes());
+        hash.update(ZERO);
+
+        output.copy_from_slice(hash.finalize().as_slice());
+        output
+    }
+*/
+function vrf10_proof_to_hash(proof) {
+    var compressed_gamma_cofac = proof.gamma.mul_by_cofactor().compress();
+    var hashInput = new Uint8Array(3 + compressed_gamma_cofac.length);
+    hashInput[0] = SUITE_TEMP;
+    hashInput[1] = 0x03;
+    hashInput.set(compressed_gamma_cofac, 2);
+    hashInput[2 + compressed_gamma_cofac.length] = 0;
+    return (0, sha2_512_1.sha2_512_sync)(hashInput);
+}
+/*
+function vrfProofToBytesProof( proof: IVrfBatchProof10 )
+{
+    return {
+        gamma: bigpointToUint8Array( proof.gamma ),
+        challange: encodeInt( proof.challange ),
+        response: encodeInt( proof.response ),
+    }
+}
+//*/
+function edwards_hash_from_bytes(bytes) {
+    var hash = (0, sha2_512_1.sha2_512_sync)(bytes);
+    var res = hash.slice(0, 32);
+    /*
+        //////////////////////////////////////////////////////////////////////////////////////
+        //// We need to be compatible with the third version of the VRF standard, which   ////
+        //// always unsets the sign bit. Given the visibility of the functions used to    ////
+        //// compute the ristretto mapping, we need to fork the original repo, to unset   ////
+        //// bit in this function. This fork should never be used, unless one needs to be ////
+        //// compatible with the version 3 of the VRF standard.                           ////
+        //// https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-vrf-10#section-5.4.1.2 ////
+        //// The goal is to be always a single commit ahead of version 3.2.0, and this    ////
+        //// single commit only changes the following line, and a disclaimer in the       ////
+        //// README.                                                                      ////
+        //////////////////////////////////////////////////////////////////////////////////////
+        let sign_bit = 0;
+
+        let fe = FieldElement::from_bytes(&res);
+
+        let M1 = crate::montgomery::elligator_encode(&fe);
+        let E1_opt = M1.to_edwards(sign_bit);
+
+        E1_opt
+            .expect("Montgomery conversion to Edwards point in Elligator failed")
+            .mul_by_cofactor()
+    */
+    var sign_bit = 0;
+    var fe = curves_1.FieldElem51.fromBytes(res);
+    var M1 = curves_1.FieldElem51.elligator_encode(fe);
+    var E1_opt = M1.to_edwards(sign_bit);
+    if (!E1_opt) {
+        throw new Error("Montgomery conversion to Edwards point in Elligator failed");
+    }
+    return E1_opt.mul_by_cofactor();
+}
+/*
+// Construct a `Scalar` from the low 255 bits of a 256-bit integer.
+    ///
+    /// This function is intended for applications like X25519 which
+    /// require specific bit-patterns when performing scalar
+    /// multiplication.
+    pub const fn from_bits(bytes: [u8; 32]) -> Scalar {
+        let mut s = Scalar{bytes};
+        // Ensure that s < 2^255 by masking the high bit
+        s.bytes[31] &= 0b0111_1111;
+
+        s
+    }
+*/
+function scalar_from_bits_inplace(bytes) {
+    bytes[31] &= 127;
+}
+/**
+ * https://datatracker.ietf.org/doc/html/rfc9381#section-5.1
+ *
+ * test cases:
+ * https://datatracker.ietf.org/doc/html/rfc9381#name-ecvrf-edwards25519-sha512-e
+ * https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-vrf-10#appendix-A.4
+ *
+ * /// Generate a new VRF proof following the 10 standard. It proceeds as follows:
+ * /// - Extend the secret key, into a `secret_scalar` and the `secret_extension`
+ * /// - Evaluate `hash_to_curve` over PK || alpha_string to get `H`
+ * /// - Compute `Gamma = secret_scalar *  H`
+ * /// - Generate a proof of discrete logarithm equality between `PK` and `Gamma` with
+ * ///   bases `generator` and `H` respectively.
+ *
+ * /
+function vrf_ed25519_sha512_ell2_prove(sk: Uint8Array, alpha: Uint8Array): IVrfBatchProof10
+{
+    /// - Extend the secret key, into a `secret_scalar` and the `secret_extension`
+    const [ scalar, extension ] = getExtendEd25519PrivateKeyComponents_sync( sk );
+    // 1. Use SK to derive the VRF secret scalar x and the VRF public key Y = x*B
+    /// - Evaluate `hash_to_curve` over PK || alpha_string to get `H`
+    const pk = new Uint8Array( deriveEd25519PublicKey_sync( sk ) );
+    const H = vrf_ed25519_sha512_ell2_hash_to_curve( pk, alpha );
+    
+    const H_point = pointFromBytes( H );
+    const gamma = scalarMul( H_point, scalar );
+    const compressed_gamma = bigpointToUint8Array( gamma );
+    const k = vrf_ed25519_sha512_ell2_nonce_generation( extension, H );
+    const announcement_1 = bigpointToUint8Array( scalarMultBase( k ) );
+    const announcement_2 = bigpointToUint8Array( scalarMul( H_point, k ) );
+    const challange = scalarFromBytes(
+        vrf_ed25519_sha512_ell2_challenge_generation( H, compressed_gamma, announcement_1, announcement_2 )
+    );
+    const response = k + challange * scalar;
+    return {
+        gamma,
+        challange,
+        response
+    };
+}
+//*/ 

package/dist/secp256k1.d.ts

@@ -0,0 +1,4 @@
+export declare function verifyEcdsaSecp256k1Signature(vk: Uint8Array, // 33 bytes
+messageHash: Uint8Array, // 32 bytes
+signature: Uint8Array): boolean;
+export declare function verifySchnorrSecp256k1Signature(pubKey: Uint8Array, messageHash: Uint8Array, signature: Uint8Array): boolean;

package/dist/secp256k1.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifySchnorrSecp256k1Signature = exports.verifyEcdsaSecp256k1Signature = void 0;
+var secp256k1_1 = require("./noble/secp256k1.js");
+function verifyEcdsaSecp256k1Signature(vk, // 33 bytes
+messageHash, // 32 bytes
+signature) {
+    if (!(vk instanceof Uint8Array &&
+        messageHash instanceof Uint8Array &&
+        signature instanceof Uint8Array &&
+        vk.length === 33 &&
+        messageHash.length === 32 &&
+        signature.length === 64))
+        throw new TypeError("invalid arguments passed to 'verifyEcdsaSecp256k1Signature'");
+    var vkHead = vk[0];
+    if (!(vkHead === 0x02 ||
+        vkHead === 0x03))
+        throw new Error("plutus-machine only supports compressed public keys for 'verifyEcdsaSecp256k1Signature'");
+    return (0, secp256k1_1.verifySecp256k1)(signature, messageHash, vk);
+}
+exports.verifyEcdsaSecp256k1Signature = verifyEcdsaSecp256k1Signature;
+function verifySchnorrSecp256k1Signature(pubKey, messageHash, signature) {
+    if (!(pubKey instanceof Uint8Array &&
+        messageHash instanceof Uint8Array &&
+        signature instanceof Uint8Array &&
+        pubKey.length === 32 &&
+        signature.length === 64))
+        throw new TypeError("invalid arguments passed to 'verifyEcdsaSecp256k1Signature'");
+    // signature 64
+    // pubKey 32
+    return (0, secp256k1_1.verifySchnorr)(signature, messageHash, pubKey);
+}
+exports.verifySchnorrSecp256k1Signature = verifySchnorrSecp256k1Signature;

package/dist/sha2_256.d.ts

@@ -0,0 +1,16 @@
+import { byte } from "./types.js";
+declare function nativeSha2_256(data: Uint8Array | ArrayBuffer): Promise<Uint8Array>;
+/**
+ * getulates sha2-256 (32bytes) hash of a list of uint8 numbers.
+ * Result is also a list of uint8 number.
+ * @example
+ * bytesToHex(sha2_256([0x61, 0x62, 0x63])) => "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad"
+ * @example
+ * sha2_256(textToBytes("Hello, World!")) => [223, 253, 96, 33, 187, 43, 213, 176, 175, 103, 98, 144, 128, 158, 195, 165, 49, 145, 221, 129, 199, 247, 10, 75, 40, 104, 138, 54, 33, 130, 152, 111]
+ * @param {uint5[]} bytes - list of uint8 numbers
+ * @returns {number[]} - list of uint8 numbers
+ */
+export declare function sha2_256_sync(_bytes: byte[] | Uint8Array | ArrayBuffer): Uint8Array;
+export declare const sha2_256: typeof nativeSha2_256;
+export declare const hasNativeSha2_256: boolean;
+export {};