@ohos-ports/crypto 0.0.0-stage → 0.3.1-beta.1

package/dist/noble/_u64.js

@@ -0,0 +1,116 @@
+"use strict";
+var __read = (this && this.__read) || function (o, n) {
+    var m = typeof Symbol === "function" && o[Symbol.iterator];
+    if (!m) return o;
+    var i = m.call(o), r, ar = [], e;
+    try {
+        while ((n === void 0 || n-- > 0) && !(r = i.next()).done) ar.push(r.value);
+    }
+    catch (error) { e = { error: error }; }
+    finally {
+        try {
+            if (r && !r.done && (m = i["return"])) m.call(i);
+        }
+        finally { if (e) throw e.error; }
+    }
+    return ar;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.add5H = exports.add5L = exports.add4H = exports.add4L = exports.add3H = exports.add3L = exports.add = exports.rotlBL = exports.rotlBH = exports.rotlSL = exports.rotlSH = exports.rotr32L = exports.rotr32H = exports.rotrBL = exports.rotrBH = exports.rotrSL = exports.rotrSH = exports.shrSL = exports.shrSH = exports.toBig = exports.split = exports.fromBig = void 0;
+/*
+THIS IMPLEMENTATION WAS TAKEN FROM `@noble/hashes`
+
+original source: https://github.com/paulmillr/noble-hashes/blob/6ae82e75d4c354d53a488e95b1bfe9cba90bd6ff/src/_u64.ts#L1
+
+it was modified and adapted to this repository to re-use already defined stuff
+
+the main reason for copying over and not using as dependency is because of different target in the `tsconfig.json`
+
+`@noble/hashes` targets es2020, which tends to cause problems with some other (older) packages sometimes
+
+this repo targets ES5+
+*/
+var U32_MASK64 = /* @__PURE__ */ BigInt(Math.pow(2, 32) - 1);
+var _32n = /* @__PURE__ */ BigInt(32);
+// We are not using BigUint64Array, because they are extremely slow as per 2022
+function fromBig(n, le) {
+    if (le === void 0) { le = false; }
+    if (le)
+        return { h: Number(n & U32_MASK64), l: Number((n >> _32n) & U32_MASK64) };
+    return { h: Number((n >> _32n) & U32_MASK64) | 0, l: Number(n & U32_MASK64) | 0 };
+}
+exports.fromBig = fromBig;
+function split(lst, le) {
+    var _a;
+    if (le === void 0) { le = false; }
+    var Ah = new Uint32Array(lst.length);
+    var Al = new Uint32Array(lst.length);
+    for (var i = 0; i < lst.length; i++) {
+        var _b = fromBig(lst[i], le), h = _b.h, l = _b.l;
+        _a = __read([h, l], 2), Ah[i] = _a[0], Al[i] = _a[1];
+    }
+    return [Ah, Al];
+}
+exports.split = split;
+var toBig = function (h, l) { return (BigInt(h >>> 0) << _32n) | BigInt(l >>> 0); };
+exports.toBig = toBig;
+// for Shift in [0, 32)
+var shrSH = function (h, _l, s) { return h >>> s; };
+exports.shrSH = shrSH;
+var shrSL = function (h, l, s) { return (h << (32 - s)) | (l >>> s); };
+exports.shrSL = shrSL;
+// Right rotate for Shift in [1, 32)
+var rotrSH = function (h, l, s) { return (h >>> s) | (l << (32 - s)); };
+exports.rotrSH = rotrSH;
+var rotrSL = function (h, l, s) { return (h << (32 - s)) | (l >>> s); };
+exports.rotrSL = rotrSL;
+// Right rotate for Shift in (32, 64), NOTE: 32 is special case.
+var rotrBH = function (h, l, s) { return (h << (64 - s)) | (l >>> (s - 32)); };
+exports.rotrBH = rotrBH;
+var rotrBL = function (h, l, s) { return (h >>> (s - 32)) | (l << (64 - s)); };
+exports.rotrBL = rotrBL;
+// Right rotate for shift===32 (just swaps l&h)
+var rotr32H = function (_h, l) { return l; };
+exports.rotr32H = rotr32H;
+var rotr32L = function (h, _l) { return h; };
+exports.rotr32L = rotr32L;
+// Left rotate for Shift in [1, 32)
+var rotlSH = function (h, l, s) { return (h << s) | (l >>> (32 - s)); };
+exports.rotlSH = rotlSH;
+var rotlSL = function (h, l, s) { return (l << s) | (h >>> (32 - s)); };
+exports.rotlSL = rotlSL;
+// Left rotate for Shift in (32, 64), NOTE: 32 is special case.
+var rotlBH = function (h, l, s) { return (l << (s - 32)) | (h >>> (64 - s)); };
+exports.rotlBH = rotlBH;
+var rotlBL = function (h, l, s) { return (h << (s - 32)) | (l >>> (64 - s)); };
+exports.rotlBL = rotlBL;
+// JS uses 32-bit signed integers for bitwise operations which means we cannot
+// simple take carry out of low bit sum by shift, we need to use division.
+function add(Ah, Al, Bh, Bl) {
+    var l = (Al >>> 0) + (Bl >>> 0);
+    return { h: (Ah + Bh + ((l / Math.pow(2, 32)) | 0)) | 0, l: l | 0 };
+}
+exports.add = add;
+// Addition with more than 2 elements
+var add3L = function (Al, Bl, Cl) { return (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0); };
+exports.add3L = add3L;
+var add3H = function (low, Ah, Bh, Ch) {
+    return (Ah + Bh + Ch + ((low / Math.pow(2, 32)) | 0)) | 0;
+};
+exports.add3H = add3H;
+var add4L = function (Al, Bl, Cl, Dl) {
+    return (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0);
+};
+exports.add4L = add4L;
+var add4H = function (low, Ah, Bh, Ch, Dh) {
+    return (Ah + Bh + Ch + Dh + ((low / Math.pow(2, 32)) | 0)) | 0;
+};
+exports.add4H = add4H;
+var add5L = function (Al, Bl, Cl, Dl, El) {
+    return (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0) + (El >>> 0);
+};
+exports.add5L = add5L;
+var add5H = function (low, Ah, Bh, Ch, Dh, Eh) {
+    return (Ah + Bh + Ch + Dh + Eh + ((low / Math.pow(2, 32)) | 0)) | 0;
+};
+exports.add5H = add5H;

package/dist/noble/abstract/bls.d.ts

@@ -0,0 +1,119 @@
+/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+/**
+ * BLS (Barreto-Lynn-Scott) family of pairing-friendly curves.
+ * Implements BLS (Boneh-Lynn-Shacham) signatures.
+ * Consists of two curves: G1 and G2:
+ * - G1 is a subgroup of (x, y) E(Fq) over y² = x³ + 4.
+ * - G2 is a subgroup of ((x₁, x₂+i), (y₁, y₂+i)) E(Fq²) over y² = x³ + 4(1 + i) where i is √-1
+ * - Gt, created by bilinear (ate) pairing e(G1, G2), consists of p-th roots of unity in
+ *   Fq^k where k is embedding degree. Only degree 12 is currently supported, 24 is not.
+ * Pairing is used to aggregate and verify signatures.
+ * We are using Fp for private keys (shorter) and Fp₂ for signatures (longer).
+ * Some projects may prefer to swap this relation, it is not supported for now.
+ */
+import { AffinePoint } from './curve.js';
+import { IField } from './modular.js';
+import { Hex, PrivKey, CHash } from './utils.js';
+import { MapToCurve, Opts as HTFOpts, htfBasicOpts, createHasher } from './hash-to-curve.js';
+import { CurvePointsType, ProjPointType as ProjPointType, CurvePointsRes } from '../curves/weierstrass.js';
+type Fp = bigint;
+export type ShortSignatureCoder<Fp> = {
+    fromHex(hex: Hex): ProjPointType<Fp>;
+    toRawBytes(point: ProjPointType<Fp>): Uint8Array;
+    toHex(point: ProjPointType<Fp>): string;
+};
+export type SignatureCoder<Fp2> = {
+    fromHex(hex: Hex): ProjPointType<Fp2>;
+    toRawBytes(point: ProjPointType<Fp2>): Uint8Array;
+    toHex(point: ProjPointType<Fp2>): string;
+};
+export type CurveType<Fp, Fp2, Fp6, Fp12> = {
+    G1: Omit<CurvePointsType<Fp>, 'n'> & {
+        ShortSignature: SignatureCoder<Fp>;
+        mapToCurve: MapToCurve<Fp>;
+        htfDefaults: HTFOpts;
+    };
+    G2: Omit<CurvePointsType<Fp2>, 'n'> & {
+        Signature: SignatureCoder<Fp2>;
+        mapToCurve: MapToCurve<Fp2>;
+        htfDefaults: HTFOpts;
+    };
+    fields: {
+        Fp: IField<Fp>;
+        Fr: IField<bigint>;
+        Fp2: IField<Fp2> & {
+            reim: (num: Fp2) => {
+                re: bigint;
+                im: bigint;
+            };
+            multiplyByB: (num: Fp2) => Fp2;
+            frobeniusMap(num: Fp2, power: number): Fp2;
+        };
+        Fp6: IField<Fp6>;
+        Fp12: IField<Fp12> & {
+            frobeniusMap(num: Fp12, power: number): Fp12;
+            multiplyBy014(num: Fp12, o0: Fp2, o1: Fp2, o4: Fp2): Fp12;
+            conjugate(num: Fp12): Fp12;
+            finalExponentiate(num: Fp12): Fp12;
+        };
+    };
+    params: {
+        x: bigint;
+        r: bigint;
+    };
+    htfDefaults: HTFOpts;
+    hash: CHash;
+    randomBytes: (bytesLength?: number) => Uint8Array;
+};
+export type CurveFn<Fp, Fp2, Fp6, Fp12> = {
+    getPublicKey: (privateKey: PrivKey) => Uint8Array;
+    getPublicKeyForShortSignatures: (privateKey: PrivKey) => Uint8Array;
+    sign: {
+        (message: Hex, privateKey: PrivKey, htfOpts?: htfBasicOpts): Uint8Array;
+        (message: ProjPointType<Fp2>, privateKey: PrivKey, htfOpts?: htfBasicOpts): ProjPointType<Fp2>;
+    };
+    signShortSignature: {
+        (message: Hex, privateKey: PrivKey, htfOpts?: htfBasicOpts): Uint8Array;
+        (message: ProjPointType<Fp>, privateKey: PrivKey, htfOpts?: htfBasicOpts): ProjPointType<Fp>;
+    };
+    verify: (signature: Hex | ProjPointType<Fp2>, message: Hex | ProjPointType<Fp2>, publicKey: Hex | ProjPointType<Fp>, htfOpts?: htfBasicOpts) => boolean;
+    verifyShortSignature: (signature: Hex | ProjPointType<Fp>, message: Hex | ProjPointType<Fp>, publicKey: Hex | ProjPointType<Fp2>, htfOpts?: htfBasicOpts) => boolean;
+    verifyBatch: (signature: Hex | ProjPointType<Fp2>, messages: (Hex | ProjPointType<Fp2>)[], publicKeys: (Hex | ProjPointType<Fp>)[], htfOpts?: htfBasicOpts) => boolean;
+    aggregatePublicKeys: {
+        (publicKeys: Hex[]): Uint8Array;
+        (publicKeys: ProjPointType<Fp>[]): ProjPointType<Fp>;
+    };
+    aggregateSignatures: {
+        (signatures: Hex[]): Uint8Array;
+        (signatures: ProjPointType<Fp2>[]): ProjPointType<Fp2>;
+    };
+    aggregateShortSignatures: {
+        (signatures: Hex[]): Uint8Array;
+        (signatures: ProjPointType<Fp>[]): ProjPointType<Fp>;
+    };
+    millerLoop: (ell: [Fp2, Fp2, Fp2][], g1: [Fp, Fp]) => Fp12;
+    pairing: (P: ProjPointType<Fp>, Q: ProjPointType<Fp2>, withFinalExponent?: boolean) => Fp12;
+    G1: CurvePointsRes<Fp> & ReturnType<typeof createHasher<Fp>>;
+    G2: CurvePointsRes<Fp2> & ReturnType<typeof createHasher<Fp2>>;
+    Signature: SignatureCoder<Fp2>;
+    ShortSignature: ShortSignatureCoder<Fp>;
+    params: {
+        x: bigint;
+        r: bigint;
+        G1b: bigint;
+        G2b: Fp2;
+    };
+    fields: {
+        Fp: IField<Fp>;
+        Fp2: IField<Fp2>;
+        Fp6: IField<Fp6>;
+        Fp12: IField<Fp12>;
+        Fr: IField<bigint>;
+    };
+    utils: {
+        randomPrivateKey: () => Uint8Array;
+        calcPairingPrecomputes: (p: AffinePoint<Fp2>) => [Fp2, Fp2, Fp2][];
+    };
+};
+export declare function bls<Fp2, Fp6, Fp12>(CURVE: CurveType<Fp, Fp2, Fp6, Fp12>): CurveFn<Fp, Fp2, Fp6, Fp12>;
+export {};

package/dist/noble/abstract/bls.js

@@ -0,0 +1,334 @@
+"use strict";
+/*
+THIS IMPLEMENTATION WAS TAKEN FROM `@noble/hashes`
+
+original source: https://github.com/paulmillr/noble-curves/blob/38a4ca1e6b0a80c60b11bbb6b3d71e3bfabd5bbb/src/abstract/bls.ts#
+
+it was modified and adapted to this repository
+
+the main reason for copying over and not using as dependency is because of different target in the `tsconfig.json`
+
+`@noble/hashes` targets es2020, which tends to cause problems with some other (older) packages sometimes
+
+this repo targets ES5+
+*/
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
+var __values = (this && this.__values) || function(o) {
+    var s = typeof Symbol === "function" && Symbol.iterator, m = s && o[s], i = 0;
+    if (m) return m.call(o);
+    if (o && typeof o.length === "number") return {
+        next: function () {
+            if (o && i >= o.length) o = void 0;
+            return { value: o && o[i++], done: !o };
+        }
+    };
+    throw new TypeError(s ? "Object is not iterable." : "Symbol.iterator is not defined.");
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.bls = void 0;
+var modular_1 = require("./modular.js");
+var utils_1 = require("./utils.js");
+// prettier-ignore
+var hash_to_curve_1 = require("./hash-to-curve.js");
+var weierstrass_1 = require("../curves/weierstrass.js");
+// prettier-ignore
+var _2n = BigInt(2), _3n = BigInt(3);
+function bls(CURVE) {
+    // Fields are specific for curve, so for now we'll need to pass them with opts
+    var _a = CURVE.fields, Fp = _a.Fp, Fr = _a.Fr, Fp2 = _a.Fp2, Fp6 = _a.Fp6, Fp12 = _a.Fp12;
+    var BLS_X_LEN = (0, utils_1.bitLen)(CURVE.params.x);
+    // Pre-compute coefficients for sparse multiplication
+    // Point addition and point double calculations is reused for coefficients
+    function calcPairingPrecomputes(p) {
+        var x = p.x, y = p.y;
+        // prettier-ignore
+        var Qx = x, Qy = y, Qz = Fp2.ONE;
+        // prettier-ignore
+        var Rx = Qx, Ry = Qy, Rz = Qz;
+        var ell_coeff = [];
+        for (var i = BLS_X_LEN - 2; i >= 0; i--) {
+            // Double
+            var t0 = Fp2.sqr(Ry); // Ry²
+            var t1 = Fp2.sqr(Rz); // Rz²
+            var t2 = Fp2.multiplyByB(Fp2.mul(t1, _3n)); // 3 * T1 * B
+            var t3 = Fp2.mul(t2, _3n); // 3 * T2
+            var t4 = Fp2.sub(Fp2.sub(Fp2.sqr(Fp2.add(Ry, Rz)), t1), t0); // (Ry + Rz)² - T1 - T0
+            ell_coeff.push([
+                Fp2.sub(t2, t0),
+                Fp2.mul(Fp2.sqr(Rx), _3n),
+                Fp2.neg(t4), // -T4
+            ]);
+            Rx = Fp2.div(Fp2.mul(Fp2.mul(Fp2.sub(t0, t3), Rx), Ry), _2n); // ((T0 - T3) * Rx * Ry) / 2
+            Ry = Fp2.sub(Fp2.sqr(Fp2.div(Fp2.add(t0, t3), _2n)), Fp2.mul(Fp2.sqr(t2), _3n)); // ((T0 + T3) / 2)² - 3 * T2²
+            Rz = Fp2.mul(t0, t4); // T0 * T4
+            if ((0, utils_1.bitGet)(CURVE.params.x, i)) {
+                // Addition
+                var t0_1 = Fp2.sub(Ry, Fp2.mul(Qy, Rz)); // Ry - Qy * Rz
+                var t1_1 = Fp2.sub(Rx, Fp2.mul(Qx, Rz)); // Rx - Qx * Rz
+                ell_coeff.push([
+                    Fp2.sub(Fp2.mul(t0_1, Qx), Fp2.mul(t1_1, Qy)),
+                    Fp2.neg(t0_1),
+                    t1_1, // T1
+                ]);
+                var t2_1 = Fp2.sqr(t1_1); // T1²
+                var t3_1 = Fp2.mul(t2_1, t1_1); // T2 * T1
+                var t4_1 = Fp2.mul(t2_1, Rx); // T2 * Rx
+                var t5 = Fp2.add(Fp2.sub(t3_1, Fp2.mul(t4_1, _2n)), Fp2.mul(Fp2.sqr(t0_1), Rz)); // T3 - 2 * T4 + T0² * Rz
+                Rx = Fp2.mul(t1_1, t5); // T1 * T5
+                Ry = Fp2.sub(Fp2.mul(Fp2.sub(t4_1, t5), t0_1), Fp2.mul(t3_1, Ry)); // (T4 - T5) * T0 - T3 * Ry
+                Rz = Fp2.mul(Rz, t3_1); // Rz * T3
+            }
+        }
+        return ell_coeff;
+    }
+    function millerLoop(ell, g1) {
+        var x = CURVE.params.x;
+        var Px = g1[0];
+        var Py = g1[1];
+        var f12 = Fp12.ONE;
+        for (var j = 0, i = BLS_X_LEN - 2; i >= 0; i--, j++) {
+            var E = ell[j];
+            f12 = Fp12.multiplyBy014(f12, E[0], Fp2.mul(E[1], Px), Fp2.mul(E[2], Py));
+            if ((0, utils_1.bitGet)(x, i)) {
+                j += 1;
+                var F = ell[j];
+                f12 = Fp12.multiplyBy014(f12, F[0], Fp2.mul(F[1], Px), Fp2.mul(F[2], Py));
+            }
+            if (i !== 0)
+                f12 = Fp12.sqr(f12);
+        }
+        return Fp12.conjugate(f12);
+    }
+    var utils = {
+        randomPrivateKey: function () {
+            var length = (0, modular_1.getMinHashLength)(Fr.ORDER);
+            return (0, modular_1.mapHashToField)(CURVE.randomBytes(length), Fr.ORDER);
+        },
+        calcPairingPrecomputes: calcPairingPrecomputes,
+    };
+    // Point on G1 curve: (x, y)
+    var G1_ = (0, weierstrass_1.weierstrassPoints)(__assign({ n: Fr.ORDER }, CURVE.G1));
+    var G1 = Object.assign(G1_, (0, hash_to_curve_1.createHasher)(G1_.ProjectivePoint, CURVE.G1.mapToCurve, __assign(__assign({}, CURVE.htfDefaults), CURVE.G1.htfDefaults)));
+    function pairingPrecomputes(point) {
+        var p = point;
+        if (p._PPRECOMPUTES)
+            return p._PPRECOMPUTES;
+        p._PPRECOMPUTES = calcPairingPrecomputes(point.toAffine());
+        return p._PPRECOMPUTES;
+    }
+    // TODO: export
+    // function clearPairingPrecomputes(point: G2) {
+    //   const p = point as G2 & withPairingPrecomputes;
+    //   p._PPRECOMPUTES = undefined;
+    // }
+    // Point on G2 curve (complex numbers): (x₁, x₂+i), (y₁, y₂+i)
+    var G2_ = (0, weierstrass_1.weierstrassPoints)(__assign({ n: Fr.ORDER }, CURVE.G2));
+    var G2 = Object.assign(G2_, (0, hash_to_curve_1.createHasher)(G2_.ProjectivePoint, CURVE.G2.mapToCurve, __assign(__assign({}, CURVE.htfDefaults), CURVE.G2.htfDefaults)));
+    var ShortSignature = CURVE.G1.ShortSignature;
+    var Signature = CURVE.G2.Signature;
+    // Calculates bilinear pairing
+    function pairing(Q, P, withFinalExponent) {
+        if (withFinalExponent === void 0) { withFinalExponent = true; }
+        if (Q.equals(G1.ProjectivePoint.ZERO) || P.equals(G2.ProjectivePoint.ZERO))
+            throw new Error('pairing is not available for ZERO point');
+        Q.assertValidity();
+        P.assertValidity();
+        // Performance: 9ms for millerLoop and ~14ms for exp.
+        var Qa = Q.toAffine();
+        var looped = millerLoop(pairingPrecomputes(P), [Qa.x, Qa.y]);
+        return withFinalExponent ? Fp12.finalExponentiate(looped) : looped;
+    }
+    function normP1(point) {
+        return point instanceof G1.ProjectivePoint ? point : G1.ProjectivePoint.fromHex(point);
+    }
+    function normP1Hash(point, htfOpts) {
+        return point instanceof G1.ProjectivePoint
+            ? point
+            : G1.hashToCurve((0, utils_1.ensureBytes)('point', point), htfOpts);
+    }
+    function normP2(point) {
+        return point instanceof G2.ProjectivePoint ? point : Signature.fromHex(point);
+    }
+    function normP2Hash(point, htfOpts) {
+        return point instanceof G2.ProjectivePoint
+            ? point
+            : G2.hashToCurve((0, utils_1.ensureBytes)('point', point), htfOpts);
+    }
+    // Multiplies generator (G1) by private key.
+    // P = pk x G
+    function getPublicKey(privateKey) {
+        return G1.ProjectivePoint.fromPrivateKey(privateKey).toRawBytes(true);
+    }
+    // Multiplies generator (G2) by private key.
+    // P = pk x G
+    function getPublicKeyForShortSignatures(privateKey) {
+        return G2.ProjectivePoint.fromPrivateKey(privateKey).toRawBytes(true);
+    }
+    function sign(message, privateKey, htfOpts) {
+        var msgPoint = normP2Hash(message, htfOpts);
+        msgPoint.assertValidity();
+        var sigPoint = msgPoint.multiply(G1.normPrivateKeyToScalar(privateKey));
+        if (message instanceof G2.ProjectivePoint)
+            return sigPoint;
+        return Signature.toRawBytes(sigPoint);
+    }
+    function signShortSignature(message, privateKey, htfOpts) {
+        var msgPoint = normP1Hash(message, htfOpts);
+        msgPoint.assertValidity();
+        var sigPoint = msgPoint.multiply(G1.normPrivateKeyToScalar(privateKey));
+        if (message instanceof G1.ProjectivePoint)
+            return sigPoint;
+        return ShortSignature.toRawBytes(sigPoint);
+    }
+    // Checks if pairing of public key & hash is equal to pairing of generator & signature.
+    // e(P, H(m)) == e(G, S)
+    function verify(signature, message, publicKey, htfOpts) {
+        var P = normP1(publicKey);
+        var Hm = normP2Hash(message, htfOpts);
+        var G = G1.ProjectivePoint.BASE;
+        var S = normP2(signature);
+        // Instead of doing 2 exponentiations, we use property of billinear maps
+        // and do one exp after multiplying 2 points.
+        var ePHm = pairing(P.negate(), Hm, false);
+        var eGS = pairing(G, S, false);
+        var exp = Fp12.finalExponentiate(Fp12.mul(eGS, ePHm));
+        return Fp12.eql(exp, Fp12.ONE);
+    }
+    // Checks if pairing of public key & hash is equal to pairing of generator & signature.
+    // e(S, G) == e(H(m), P)
+    function verifyShortSignature(signature, message, publicKey, htfOpts) {
+        var P = normP2(publicKey);
+        var Hm = normP1Hash(message, htfOpts);
+        var G = G2.ProjectivePoint.BASE;
+        var S = normP1(signature);
+        // Instead of doing 2 exponentiations, we use property of billinear maps
+        // and do one exp after multiplying 2 points.
+        var eHmP = pairing(Hm, P, false);
+        var eSG = pairing(S, G.negate(), false);
+        var exp = Fp12.finalExponentiate(Fp12.mul(eSG, eHmP));
+        return Fp12.eql(exp, Fp12.ONE);
+    }
+    function aggregatePublicKeys(publicKeys) {
+        if (!publicKeys.length)
+            throw new Error('Expected non-empty array');
+        var agg = publicKeys.map(normP1).reduce(function (sum, p) { return sum.add(p); }, G1.ProjectivePoint.ZERO);
+        var aggAffine = agg; //.toAffine();
+        if (publicKeys[0] instanceof G1.ProjectivePoint) {
+            aggAffine.assertValidity();
+            return aggAffine;
+        }
+        // toRawBytes ensures point validity
+        return aggAffine.toRawBytes(true);
+    }
+    function aggregateSignatures(signatures) {
+        if (!signatures.length)
+            throw new Error('Expected non-empty array');
+        var agg = signatures.map(normP2).reduce(function (sum, s) { return sum.add(s); }, G2.ProjectivePoint.ZERO);
+        var aggAffine = agg; //.toAffine();
+        if (signatures[0] instanceof G2.ProjectivePoint) {
+            aggAffine.assertValidity();
+            return aggAffine;
+        }
+        return Signature.toRawBytes(aggAffine);
+    }
+    function aggregateShortSignatures(signatures) {
+        if (!signatures.length)
+            throw new Error('Expected non-empty array');
+        var agg = signatures.map(normP1).reduce(function (sum, s) { return sum.add(s); }, G1.ProjectivePoint.ZERO);
+        var aggAffine = agg; //.toAffine();
+        if (signatures[0] instanceof G1.ProjectivePoint) {
+            aggAffine.assertValidity();
+            return aggAffine;
+        }
+        return ShortSignature.toRawBytes(aggAffine);
+    }
+    // https://ethresear.ch/t/fast-verification-of-multiple-bls-signatures/5407
+    // e(G, S) = e(G, SUM(n)(Si)) = MUL(n)(e(G, Si))
+    function verifyBatch(signature, messages, publicKeys, htfOpts) {
+        // @ts-ignore
+        // console.log('verifyBatch', bytesToHex(signature as any), messages, publicKeys.map(bytesToHex));
+        var e_1, _a;
+        if (!messages.length)
+            throw new Error('Expected non-empty messages array');
+        if (publicKeys.length !== messages.length)
+            throw new Error('Pubkey count should equal msg count');
+        var sig = normP2(signature);
+        var nMessages = messages.map(function (i) { return normP2Hash(i, htfOpts); });
+        var nPublicKeys = publicKeys.map(normP1);
+        try {
+            var paired = [];
+            var _loop_1 = function (message) {
+                var groupPublicKey = nMessages.reduce(function (groupPublicKey, subMessage, i) {
+                    return subMessage === message ? groupPublicKey.add(nPublicKeys[i]) : groupPublicKey;
+                }, G1.ProjectivePoint.ZERO);
+                // const msg = message instanceof PointG2 ? message : await PointG2.hashToCurve(message);
+                // Possible to batch pairing for same msg with different groupPublicKey here
+                paired.push(pairing(groupPublicKey, message, false));
+            };
+            try {
+                for (var _b = __values(new Set(nMessages)), _c = _b.next(); !_c.done; _c = _b.next()) {
+                    var message = _c.value;
+                    _loop_1(message);
+                }
+            }
+            catch (e_1_1) { e_1 = { error: e_1_1 }; }
+            finally {
+                try {
+                    if (_c && !_c.done && (_a = _b.return)) _a.call(_b);
+                }
+                finally { if (e_1) throw e_1.error; }
+            }
+            paired.push(pairing(G1.ProjectivePoint.BASE.negate(), sig, false));
+            var product = paired.reduce(function (a, b) { return Fp12.mul(a, b); }, Fp12.ONE);
+            var exp = Fp12.finalExponentiate(product);
+            return Fp12.eql(exp, Fp12.ONE);
+        }
+        catch (_d) {
+            return false;
+        }
+    }
+    G1.ProjectivePoint.BASE._setWindowSize(4);
+    return {
+        getPublicKey: getPublicKey,
+        getPublicKeyForShortSignatures: getPublicKeyForShortSignatures,
+        sign: sign,
+        signShortSignature: signShortSignature,
+        verify: verify,
+        verifyBatch: verifyBatch,
+        verifyShortSignature: verifyShortSignature,
+        aggregatePublicKeys: aggregatePublicKeys,
+        aggregateSignatures: aggregateSignatures,
+        aggregateShortSignatures: aggregateShortSignatures,
+        millerLoop: millerLoop,
+        pairing: pairing,
+        G1: G1,
+        G2: G2,
+        Signature: Signature,
+        ShortSignature: ShortSignature,
+        fields: {
+            Fr: Fr,
+            Fp: Fp,
+            Fp2: Fp2,
+            Fp6: Fp6,
+            Fp12: Fp12,
+        },
+        params: {
+            x: CURVE.params.x,
+            r: CURVE.params.r,
+            G1b: CURVE.G1.b,
+            G2b: CURVE.G2.b,
+        },
+        utils: utils,
+    };
+}
+exports.bls = bls;

package/dist/noble/abstract/curve.d.ts

@@ -0,0 +1,83 @@
+/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+import { IField } from './modular.js';
+export type AffinePoint<T> = {
+    x: T;
+    y: T;
+} & {
+    z?: never;
+    t?: never;
+};
+export interface Group<T extends Group<T>> {
+    double(): T;
+    negate(): T;
+    add(other: T): T;
+    subtract(other: T): T;
+    equals(other: T): boolean;
+    multiply(scalar: bigint): T;
+}
+export type GroupConstructor<T> = {
+    BASE: T;
+    ZERO: T;
+};
+export type Mapper<T> = (i: T[]) => T[];
+export type IWNAF<T extends Group<T>> = {
+    constTimeNegate: <T extends Group<T>>(condition: boolean, item: T) => T;
+    hasPrecomputes(elm: T): boolean;
+    unsafeLadder(elm: T, n: bigint, p?: T): T;
+    precomputeWindow(elm: T, W: number): Group<T>[];
+    wNAF(W: number, precomputes: T[], n: bigint): {
+        p: T;
+        f: T;
+    };
+    wNAFUnsafe(W: number, precomputes: T[], n: bigint, acc?: T): T;
+    getPrecomputes(W: number, P: T, transform: Mapper<T>): T[];
+    wNAFCached(P: T, n: bigint, transform: Mapper<T>): {
+        p: T;
+        f: T;
+    };
+    wNAFCachedUnsafe(P: T, n: bigint, transform: Mapper<T>, prev?: T): T;
+    setWindowSize(P: T, W: number): void;
+};
+/**
+ * Elliptic curve multiplication of Point by scalar. Fragile.
+ * Scalars should always be less than curve order: this should be checked inside of a curve itself.
+ * Creates precomputation tables for fast multiplication:
+ * - private scalar is split by fixed size windows of W bits
+ * - every window point is collected from window's table & added to accumulator
+ * - since windows are different, same point inside tables won't be accessed more than once per calc
+ * - each multiplication is 'Math.ceil(CURVE_ORDER / 𝑊) + 1' point additions (fixed for any scalar)
+ * - +1 window is neccessary for wNAF
+ * - wNAF reduces table size: 2x less memory + 2x faster generation, but 10% slower multiplication
+ *
+ * @todo Research returning 2d JS array of windows, instead of a single window.
+ * This would allow windows to be in different memory locations
+ */
+export declare function wNAF<T extends Group<T>>(c: GroupConstructor<T>, bits: number): IWNAF<T>;
+export type BasicCurve<T> = {
+    Fp: IField<T>;
+    n: bigint;
+    nBitLength?: number;
+    nByteLength?: number;
+    h: bigint;
+    hEff?: bigint;
+    Gx: T;
+    Gy: T;
+    allowInfinityPoint?: boolean;
+};
+export declare function validateBasic<FP, T>(curve: BasicCurve<FP> & T): Readonly<{
+    readonly nBitLength: number;
+    readonly nByteLength: number;
+} & BasicCurve<FP> & T & {
+    p: bigint;
+}>;
+/**
+ * Pippenger algorithm for multi-scalar multiplication (MSM, Pa + Qb + Rc + ...).
+ * 30x faster vs naive addition on L=4096, 10x faster with precomputes.
+ * For N=254bit, L=1, it does: 1024 ADD + 254 DBL. For L=5: 1536 ADD + 254 DBL.
+ * Algorithmically constant-time (for same L), even when 1 point + scalar, or when scalar = 0.
+ * @param c Curve Point constructor
+ * @param fieldN field over CURVE.N - important that it's not over CURVE.P
+ * @param points array of L curve points
+ * @param scalars array of L scalars (aka private keys / bigints)
+ */
+export declare function pippenger<T extends Group<T>>(c: GroupConstructor<T>, fieldN: IField<bigint>, points: T[], scalars: bigint[]): T;