@ohos-ports/crypto 0.0.0-stage → 0.3.1-beta.1

package/dist/noble/abstract/curve.js

@@ -0,0 +1,319 @@
+"use strict";
+/*
+THIS IMPLEMENTATION WAS TAKEN FROM `@noble/hashes`
+
+original source: https://github.com/paulmillr/noble-curves/blob/38a4ca1e6b0a80c60b11bbb6b3d71e3bfabd5bbb/src/abstract/curve.ts
+
+it was modified and adapted to this repository
+
+the main reason for copying over and not using as dependency is because of different target in the `tsconfig.json`
+
+`@noble/hashes` targets es2020, which tends to cause problems with some other (older) packages sometimes
+
+this repo targets ES5+
+*/
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.pippenger = exports.validateBasic = exports.wNAF = void 0;
+/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+// Abelian group utilities
+var modular_1 = require("./modular.js");
+var utils_1 = require("./utils.js");
+var _0n = BigInt(0);
+var _1n = BigInt(1);
+// Since points in different groups cannot be equal (different object constructor),
+// we can have single place to store precomputes
+var pointPrecomputes = new WeakMap();
+var pointWindowSizes = new WeakMap(); // This allows use make points immutable (nothing changes inside)
+function getW(P) {
+    return pointWindowSizes.get(P) || 1;
+}
+function constTimeNegate(condition, item) {
+    var neg = item.negate();
+    return condition ? neg : item;
+}
+function validateW(W, bits) {
+    if (!Number.isSafeInteger(W) || W <= 0 || W > bits)
+        throw new Error('invalid window size, expected [1..' + bits + '], got W=' + W);
+}
+function calcWOpts(W, bits) {
+    validateW(W, bits);
+    var windows = Math.ceil(bits / W) + 1; // +1, because
+    var windowSize = Math.pow(2, (W - 1)); // -1 because we skip zero
+    return { windows: windows, windowSize: windowSize };
+}
+/**
+ * Elliptic curve multiplication of Point by scalar. Fragile.
+ * Scalars should always be less than curve order: this should be checked inside of a curve itself.
+ * Creates precomputation tables for fast multiplication:
+ * - private scalar is split by fixed size windows of W bits
+ * - every window point is collected from window's table & added to accumulator
+ * - since windows are different, same point inside tables won't be accessed more than once per calc
+ * - each multiplication is 'Math.ceil(CURVE_ORDER / 𝑊) + 1' point additions (fixed for any scalar)
+ * - +1 window is neccessary for wNAF
+ * - wNAF reduces table size: 2x less memory + 2x faster generation, but 10% slower multiplication
+ *
+ * @todo Research returning 2d JS array of windows, instead of a single window.
+ * This would allow windows to be in different memory locations
+ */
+function wNAF(c, bits) {
+    return {
+        constTimeNegate: constTimeNegate,
+        hasPrecomputes: function (elm) {
+            return getW(elm) !== 1;
+        },
+        // non-const time multiplication ladder
+        unsafeLadder: function (elm, n, p) {
+            if (p === void 0) { p = c.ZERO; }
+            var d = elm;
+            while (n > _0n) {
+                if (n & _1n)
+                    p = p.add(d);
+                d = d.double();
+                n >>= _1n;
+            }
+            return p;
+        },
+        /**
+         * Creates a wNAF precomputation window. Used for caching.
+         * Default window size is set by `utils.precompute()` and is equal to 8.
+         * Number of precomputed points depends on the curve size:
+         * 2^(𝑊−1) * (Math.ceil(𝑛 / 𝑊) + 1), where:
+         * - 𝑊 is the window size
+         * - 𝑛 is the bitlength of the curve order.
+         * For a 256-bit curve and window size 8, the number of precomputed points is 128 * 33 = 4224.
+         * @param elm Point instance
+         * @param W window size
+         * @returns precomputed point tables flattened to a single array
+         */
+        precomputeWindow: function (elm, W) {
+            var _a = calcWOpts(W, bits), windows = _a.windows, windowSize = _a.windowSize;
+            var points = [];
+            var p = elm;
+            var base = p;
+            for (var window_1 = 0; window_1 < windows; window_1++) {
+                base = p;
+                points.push(base);
+                // =1, because we skip zero
+                for (var i = 1; i < windowSize; i++) {
+                    base = base.add(p);
+                    points.push(base);
+                }
+                p = base.double();
+            }
+            return points;
+        },
+        /**
+         * Implements ec multiplication using precomputed tables and w-ary non-adjacent form.
+         * @param W window size
+         * @param precomputes precomputed tables
+         * @param n scalar (we don't check here, but should be less than curve order)
+         * @returns real and fake (for const-time) points
+         */
+        wNAF: function (W, precomputes, n) {
+            n = BigInt(n);
+            // TODO: maybe check that scalar is less than group order? wNAF behavious is undefined otherwise
+            // But need to carefully remove other checks before wNAF. ORDER == bits here
+            var _a = calcWOpts(W, bits), windows = _a.windows, windowSize = _a.windowSize;
+            var p = c.ZERO;
+            var f = c.BASE;
+            var mask = BigInt(Math.pow(2, W) - 1); // Create mask with W ones: 0b1111 for W=4 etc.
+            var maxNumber = Math.pow(2, W);
+            var shiftBy = BigInt(W);
+            for (var window_2 = 0; window_2 < windows; window_2++) {
+                var offset = window_2 * windowSize;
+                // Extract W bits.
+                var wbits = Number(n & mask);
+                // Shift number by W bits.
+                n >>= shiftBy;
+                // If the bits are bigger than max size, we'll split those.
+                // +224 => 256 - 32
+                if (wbits > windowSize) {
+                    wbits -= maxNumber;
+                    n += _1n;
+                }
+                // This code was first written with assumption that 'f' and 'p' will never be infinity point:
+                // since each addition is multiplied by 2 ** W, it cannot cancel each other. However,
+                // there is negate now: it is possible that negated element from low value
+                // would be the same as high element, which will create carry into next window.
+                // It's not obvious how this can fail, but still worth investigating later.
+                // Check if we're onto Zero point.
+                // Add random point inside current window to f.
+                var offset1 = offset;
+                var offset2 = offset + Math.abs(wbits) - 1; // -1 because we skip zero
+                var cond1 = window_2 % 2 !== 0;
+                var cond2 = wbits < 0;
+                if (wbits === 0) {
+                    // The most important part for const-time getPublicKey
+                    f = f.add(constTimeNegate(cond1, precomputes[offset1]));
+                }
+                else {
+                    p = p.add(constTimeNegate(cond2, precomputes[offset2]));
+                }
+            }
+            // JIT-compiler should not eliminate f here, since it will later be used in normalizeZ()
+            // Even if the variable is still unused, there are some checks which will
+            // throw an exception, so compiler needs to prove they won't happen, which is hard.
+            // At this point there is a way to F be infinity-point even if p is not,
+            // which makes it less const-time: around 1 bigint multiply.
+            return { p: p, f: f };
+        },
+        /**
+         * Implements ec unsafe (non const-time) multiplication using precomputed tables and w-ary non-adjacent form.
+         * @param W window size
+         * @param precomputes precomputed tables
+         * @param n scalar (we don't check here, but should be less than curve order)
+         * @param acc accumulator point to add result of multiplication
+         * @returns point
+         */
+        wNAFUnsafe: function (W, precomputes, n, acc) {
+            if (acc === void 0) { acc = c.ZERO; }
+            var _a = calcWOpts(W, bits), windows = _a.windows, windowSize = _a.windowSize;
+            var mask = BigInt(Math.pow(2, W) - 1); // Create mask with W ones: 0b1111 for W=4 etc.
+            var maxNumber = Math.pow(2, W);
+            var shiftBy = BigInt(W);
+            for (var window_3 = 0; window_3 < windows; window_3++) {
+                var offset = window_3 * windowSize;
+                if (n === _0n)
+                    break; // No need to go over empty scalar
+                // Extract W bits.
+                var wbits = Number(n & mask);
+                // Shift number by W bits.
+                n >>= shiftBy;
+                // If the bits are bigger than max size, we'll split those.
+                // +224 => 256 - 32
+                if (wbits > windowSize) {
+                    wbits -= maxNumber;
+                    n += _1n;
+                }
+                if (wbits === 0)
+                    continue;
+                var curr = precomputes[offset + Math.abs(wbits) - 1]; // -1 because we skip zero
+                if (wbits < 0)
+                    curr = curr.negate();
+                // NOTE: by re-using acc, we can save a lot of additions in case of MSM
+                acc = acc.add(curr);
+            }
+            return acc;
+        },
+        getPrecomputes: function (W, P, transform) {
+            // Calculate precomputes on a first run, reuse them after
+            var comp = pointPrecomputes.get(P);
+            if (!comp) {
+                comp = this.precomputeWindow(P, W);
+                if (W !== 1)
+                    pointPrecomputes.set(P, transform(comp));
+            }
+            return comp;
+        },
+        wNAFCached: function (P, n, transform) {
+            var W = getW(P);
+            return this.wNAF(W, this.getPrecomputes(W, P, transform), n);
+        },
+        wNAFCachedUnsafe: function (P, n, transform, prev) {
+            var W = getW(P);
+            if (W === 1)
+                return this.unsafeLadder(P, n, prev); // For W=1 ladder is ~x2 faster
+            return this.wNAFUnsafe(W, this.getPrecomputes(W, P, transform), n, prev);
+        },
+        // We calculate precomputes for elliptic curve point multiplication
+        // using windowed method. This specifies window size and
+        // stores precomputed values. Usually only base point would be precomputed.
+        setWindowSize: function (P, W) {
+            validateW(W, bits);
+            pointWindowSizes.set(P, W);
+            pointPrecomputes.delete(P);
+        },
+    };
+}
+exports.wNAF = wNAF;
+function validateBasic(curve) {
+    (0, modular_1.validateField)(curve.Fp);
+    (0, utils_1.validateObject)(curve, {
+        n: 'bigint',
+        h: 'bigint',
+        Gx: 'field',
+        Gy: 'field',
+    }, {
+        nBitLength: 'isSafeInteger',
+        nByteLength: 'isSafeInteger',
+    });
+    // Set defaults
+    return Object.freeze(__assign(__assign(__assign({}, (0, modular_1.nLength)(curve.n, curve.nBitLength)), curve), { p: curve.Fp.ORDER }));
+}
+exports.validateBasic = validateBasic;
+function validateMSMPoints(points, c) {
+    if (!Array.isArray(points))
+        throw new Error('array expected');
+    points.forEach(function (p, i) {
+        if (!(p instanceof c))
+            throw new Error('invalid point at index ' + i);
+    });
+}
+function validateMSMScalars(scalars, field) {
+    if (!Array.isArray(scalars))
+        throw new Error('array of scalars expected');
+    scalars.forEach(function (s, i) {
+        if (!field.isValid(s))
+            throw new Error('invalid scalar at index ' + i);
+    });
+}
+/**
+ * Pippenger algorithm for multi-scalar multiplication (MSM, Pa + Qb + Rc + ...).
+ * 30x faster vs naive addition on L=4096, 10x faster with precomputes.
+ * For N=254bit, L=1, it does: 1024 ADD + 254 DBL. For L=5: 1536 ADD + 254 DBL.
+ * Algorithmically constant-time (for same L), even when 1 point + scalar, or when scalar = 0.
+ * @param c Curve Point constructor
+ * @param fieldN field over CURVE.N - important that it's not over CURVE.P
+ * @param points array of L curve points
+ * @param scalars array of L scalars (aka private keys / bigints)
+ */
+function pippenger(c, fieldN, points, scalars) {
+    // If we split scalars by some window (let's say 8 bits), every chunk will only
+    // take 256 buckets even if there are 4096 scalars, also re-uses double.
+    // TODO:
+    // - https://eprint.iacr.org/2024/750.pdf
+    // - https://tches.iacr.org/index.php/TCHES/article/view/10287
+    // 0 is accepted in scalars
+    validateMSMPoints(points, c);
+    validateMSMScalars(scalars, fieldN);
+    if (points.length !== scalars.length)
+        throw new Error('arrays of points and scalars must have equal length');
+    var zero = c.ZERO;
+    var wbits = (0, utils_1.bitLen)(BigInt(points.length));
+    var windowSize = wbits > 12 ? wbits - 3 : wbits > 4 ? wbits - 2 : wbits ? 2 : 1; // in bits
+    var MASK = (1 << windowSize) - 1;
+    var buckets = new Array(MASK + 1).fill(zero); // +1 for zero array
+    var lastBits = Math.floor((fieldN.BITS - 1) / windowSize) * windowSize;
+    var sum = zero;
+    for (var i = lastBits; i >= 0; i -= windowSize) {
+        buckets.fill(zero);
+        for (var j = 0; j < scalars.length; j++) {
+            var scalar = scalars[j];
+            var wbits_1 = Number((scalar >> BigInt(i)) & BigInt(MASK));
+            buckets[wbits_1] = buckets[wbits_1].add(points[j]);
+        }
+        var resI = zero; // not using this will do small speed-up, but will lose ct
+        // Skip first bucket, because it is zero
+        for (var j = buckets.length - 1, sumI = zero; j > 0; j--) {
+            sumI = sumI.add(buckets[j]);
+            resI = resI.add(sumI);
+        }
+        sum = sum.add(resI);
+        if (i !== 0)
+            for (var j = 0; j < windowSize; j++)
+                sum = sum.double();
+    }
+    return sum;
+}
+exports.pippenger = pippenger;

package/dist/noble/abstract/edwards.d.ts

@@ -0,0 +1,85 @@
+import { type AffinePoint, type BasicCurve, type Group, type GroupConstructor } from "./curve.js";
+import { type FHash, type Hex } from './utils.js';
+/** Edwards curves must declare params a & d. */
+export type CurveType = BasicCurve<bigint> & {
+    a: bigint;
+    d: bigint;
+    hash: FHash;
+    randomBytes: (bytesLength?: number) => Uint8Array;
+    adjustScalarBytes?: (bytes: Uint8Array) => Uint8Array;
+    domain?: (data: Uint8Array, ctx: Uint8Array, phflag: boolean) => Uint8Array;
+    uvRatio?: (u: bigint, v: bigint) => {
+        isValid: boolean;
+        value: bigint;
+    };
+    prehash?: FHash;
+    mapToCurve?: (scalar: bigint[]) => AffinePoint<bigint>;
+};
+export type CurveTypeWithLength = Readonly<CurveType & {
+    nByteLength: number;
+    nBitLength: number;
+}>;
+declare function validateOpts(curve: CurveType): CurveTypeWithLength;
+/** Instance of Extended Point with coordinates in X, Y, Z, T. */
+export interface ExtPointType extends Group<ExtPointType> {
+    readonly ex: bigint;
+    readonly ey: bigint;
+    readonly ez: bigint;
+    readonly et: bigint;
+    get x(): bigint;
+    get y(): bigint;
+    assertValidity(): void;
+    multiply(scalar: bigint): ExtPointType;
+    multiplyUnsafe(scalar: bigint): ExtPointType;
+    isSmallOrder(): boolean;
+    isTorsionFree(): boolean;
+    clearCofactor(): ExtPointType;
+    toAffine(iz?: bigint): AffinePoint<bigint>;
+    toRawBytes(isCompressed?: boolean): Uint8Array;
+    toHex(isCompressed?: boolean): string;
+    _setWindowSize(windowSize: number): void;
+}
+/** Static methods of Extended Point with coordinates in X, Y, Z, T. */
+export interface ExtPointConstructor extends GroupConstructor<ExtPointType> {
+    new (x: bigint, y: bigint, z: bigint, t: bigint): ExtPointType;
+    fromAffine(p: AffinePoint<bigint>): ExtPointType;
+    fromHex(hex: Hex): ExtPointType;
+    fromPrivateKey(privateKey: Hex): ExtPointType;
+    msm(points: ExtPointType[], scalars: bigint[]): ExtPointType;
+}
+/**
+ * Edwards Curve interface.
+ * Main methods: `getPublicKey(priv)`, `sign(msg, priv)`, `verify(sig, msg, pub)`.
+ */
+export type CurveFn = {
+    CURVE: ReturnType<typeof validateOpts>;
+    getPublicKey: (privateKey: Hex) => Uint8Array;
+    sign: (message: Hex, privateKey: Hex, options?: {
+        context?: Hex;
+    }) => Uint8Array;
+    verify: (sig: Hex, message: Hex, publicKey: Hex, options?: {
+        context?: Hex;
+        zip215: boolean;
+    }) => boolean;
+    ExtendedPoint: ExtPointConstructor;
+    utils: {
+        randomPrivateKey: () => Uint8Array;
+        getExtendedPublicKey: (key: Hex) => {
+            head: Uint8Array;
+            prefix: Uint8Array;
+            scalar: bigint;
+            point: ExtPointType;
+            pointBytes: Uint8Array;
+        };
+        precompute: (windowSize?: number, point?: ExtPointType) => ExtPointType;
+    };
+};
+/**
+ * Creates Twisted Edwards curve with EdDSA signatures.
+ * @example
+ * import { Field } from '@noble/curves/abstract/modular';
+ * // Before that, define BigInt-s: a, d, p, n, Gx, Gy, h
+ * const curve = twistedEdwards({ a, d, Fp: Field(p), n, Gx, Gy, h })
+ */
+export declare function twistedEdwards(curveDef: CurveType): CurveFn;
+export {};