@ohos-ports/crypto 0.0.0-stage → 0.3.1-beta.1

package/dist/noble/abstract/edwards.js

@@ -0,0 +1,508 @@
+"use strict";
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
+var __read = (this && this.__read) || function (o, n) {
+    var m = typeof Symbol === "function" && o[Symbol.iterator];
+    if (!m) return o;
+    var i = m.call(o), r, ar = [], e;
+    try {
+        while ((n === void 0 || n-- > 0) && !(r = i.next()).done) ar.push(r.value);
+    }
+    catch (error) { e = { error: error }; }
+    finally {
+        try {
+            if (r && !r.done && (m = i["return"])) m.call(i);
+        }
+        finally { if (e) throw e.error; }
+    }
+    return ar;
+};
+var __spreadArray = (this && this.__spreadArray) || function (to, from, pack) {
+    if (pack || arguments.length === 2) for (var i = 0, l = from.length, ar; i < l; i++) {
+        if (ar || !(i in from)) {
+            if (!ar) ar = Array.prototype.slice.call(from, 0, i);
+            ar[i] = from[i];
+        }
+    }
+    return to.concat(ar || Array.prototype.slice.call(from));
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.twistedEdwards = void 0;
+/**
+ * Twisted Edwards curve. The formula is: ax² + y² = 1 + dx²y².
+ * For design rationale of types / exports, see weierstrass module documentation.
+ * @module
+ */
+/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+var uint8array_utils_1 = require("@harmoniclabs/uint8array-utils");
+var curve_1 = require("./curve.js");
+var modular_js_1 = require("./modular.js");
+var utils_js_1 = require("./utils.js");
+// Be friendly to bad ECMAScript parsers by not using bigint literals
+// prettier-ignore
+var _0n = BigInt(0), _1n = BigInt(1), _2n = BigInt(2), _8n = BigInt(8);
+// verification rule is either zip215 or rfc8032 / nist186-5. Consult fromHex:
+var VERIFY_DEFAULT = { zip215: true };
+function validateOpts(curve) {
+    var opts = (0, curve_1.validateBasic)(curve);
+    (0, utils_js_1.validateObject)(curve, {
+        hash: 'function',
+        a: 'bigint',
+        d: 'bigint',
+        randomBytes: 'function',
+    }, {
+        adjustScalarBytes: 'function',
+        domain: 'function',
+        uvRatio: 'function',
+        mapToCurve: 'function',
+    });
+    // Set defaults
+    return Object.freeze(__assign({}, opts));
+}
+/**
+ * Creates Twisted Edwards curve with EdDSA signatures.
+ * @example
+ * import { Field } from '@noble/curves/abstract/modular';
+ * // Before that, define BigInt-s: a, d, p, n, Gx, Gy, h
+ * const curve = twistedEdwards({ a, d, Fp: Field(p), n, Gx, Gy, h })
+ */
+function twistedEdwards(curveDef) {
+    var CURVE = validateOpts(curveDef);
+    var Fp = CURVE.Fp, CURVE_ORDER = CURVE.n, prehash = CURVE.prehash, cHash = CURVE.hash, randomBytes = CURVE.randomBytes, nByteLength = CURVE.nByteLength, cofactor = CURVE.h;
+    // Important:
+    // There are some places where Fp.BYTES is used instead of nByteLength.
+    // So far, everything has been tested with curves of Fp.BYTES == nByteLength.
+    // TODO: test and find curves which behave otherwise.
+    var MASK = _2n << (BigInt(nByteLength * 8) - _1n);
+    var modP = Fp.create; // Function overrides
+    var Fn = (0, modular_js_1.Field)(CURVE.n, CURVE.nBitLength);
+    // sqrt(u/v)
+    var uvRatio = CURVE.uvRatio ||
+        (function (u, v) {
+            try {
+                return { isValid: true, value: Fp.sqrt(u * Fp.inv(v)) };
+            }
+            catch (e) {
+                return { isValid: false, value: _0n };
+            }
+        });
+    var adjustScalarBytes = CURVE.adjustScalarBytes || (function (bytes) { return bytes; }); // NOOP
+    var domain = CURVE.domain ||
+        (function (data, ctx, phflag) {
+            (0, utils_js_1.abool)('phflag', phflag);
+            if (ctx.length || phflag)
+                throw new Error('Contexts/pre-hash are not supported');
+            return data;
+        }); // NOOP
+    // 0 <= n < MASK
+    // Coordinates larger than Fp.ORDER are allowed for zip215
+    function aCoordinate(title, n) {
+        (0, utils_js_1.aInRange)('coordinate ' + title, n, _0n, MASK);
+    }
+    function assertPoint(other) {
+        if (!(other instanceof Point))
+            throw new Error('ExtendedPoint expected');
+    }
+    // Converts Extended point to default (x, y) coordinates.
+    // Can accept precomputed Z^-1 - for example, from invertBatch.
+    var toAffineMemo = (0, utils_js_1.memoized)(function (p, iz) {
+        var x = p.ex, y = p.ey, z = p.ez;
+        var is0 = p.is0();
+        if (iz == null)
+            iz = is0 ? _8n : Fp.inv(z); // 8 was chosen arbitrarily
+        var ax = modP(x * iz);
+        var ay = modP(y * iz);
+        var zz = modP(z * iz);
+        if (is0)
+            return { x: _0n, y: _1n };
+        if (zz !== _1n)
+            throw new Error('invZ was invalid');
+        return { x: ax, y: ay };
+    });
+    var assertValidMemo = (0, utils_js_1.memoized)(function (p) {
+        var a = CURVE.a, d = CURVE.d;
+        if (p.is0())
+            throw new Error('bad point: ZERO'); // TODO: optimize, with vars below?
+        // Equation in affine coordinates: ax² + y² = 1 + dx²y²
+        // Equation in projective coordinates (X/Z, Y/Z, Z):  (aX² + Y²)Z² = Z⁴ + dX²Y²
+        var X = p.ex, Y = p.ey, Z = p.ez, T = p.et;
+        var X2 = modP(X * X); // X²
+        var Y2 = modP(Y * Y); // Y²
+        var Z2 = modP(Z * Z); // Z²
+        var Z4 = modP(Z2 * Z2); // Z⁴
+        var aX2 = modP(X2 * a); // aX²
+        var left = modP(Z2 * modP(aX2 + Y2)); // (aX² + Y²)Z²
+        var right = modP(Z4 + modP(d * modP(X2 * Y2))); // Z⁴ + dX²Y²
+        if (left !== right)
+            throw new Error('bad point: equation left != right (1)');
+        // In Extended coordinates we also have T, which is x*y=T/Z: check X*Y == Z*T
+        var XY = modP(X * Y);
+        var ZT = modP(Z * T);
+        if (XY !== ZT)
+            throw new Error('bad point: equation left != right (2)');
+        return true;
+    });
+    // Extended Point works in extended coordinates: (x, y, z, t) ∋ (x=x/z, y=y/z, t=xy).
+    // https://en.wikipedia.org/wiki/Twisted_Edwards_curve#Extended_coordinates
+    var Point = /** @class */ (function () {
+        function Point(ex, ey, ez, et) {
+            aCoordinate('x', ex);
+            aCoordinate('y', ey);
+            aCoordinate('z', ez);
+            aCoordinate('t', et);
+            this.ex = ex;
+            this.ey = ey;
+            this.ez = ez;
+            this.et = et;
+            Object.freeze(this);
+        }
+        Object.defineProperty(Point.prototype, "x", {
+            get: function () {
+                return this.toAffine().x;
+            },
+            enumerable: false,
+            configurable: true
+        });
+        Object.defineProperty(Point.prototype, "y", {
+            get: function () {
+                return this.toAffine().y;
+            },
+            enumerable: false,
+            configurable: true
+        });
+        Point.fromAffine = function (p) {
+            if (p instanceof Point)
+                throw new Error('extended point not allowed');
+            var _a = p || {}, x = _a.x, y = _a.y;
+            aCoordinate('x', x);
+            aCoordinate('y', y);
+            return new Point(x, y, _1n, modP(x * y));
+        };
+        Point.normalizeZ = function (points) {
+            var toInv = Fp.invertBatch(points.map(function (p) { return p.ez; }));
+            return points.map(function (p, i) { return p.toAffine(toInv[i]); }).map(Point.fromAffine);
+        };
+        // Multiscalar Multiplication
+        Point.msm = function (points, scalars) {
+            return (0, curve_1.pippenger)(Point, Fn, points, scalars);
+        };
+        // "Private method", don't use it directly
+        Point.prototype._setWindowSize = function (windowSize) {
+            wnaf.setWindowSize(this, windowSize);
+        };
+        // Not required for fromHex(), which always creates valid points.
+        // Could be useful for fromAffine().
+        Point.prototype.assertValidity = function () {
+            assertValidMemo(this);
+        };
+        // Compare one point to another.
+        Point.prototype.equals = function (other) {
+            assertPoint(other);
+            var _a = this, X1 = _a.ex, Y1 = _a.ey, Z1 = _a.ez;
+            var X2 = other.ex, Y2 = other.ey, Z2 = other.ez;
+            var X1Z2 = modP(X1 * Z2);
+            var X2Z1 = modP(X2 * Z1);
+            var Y1Z2 = modP(Y1 * Z2);
+            var Y2Z1 = modP(Y2 * Z1);
+            return X1Z2 === X2Z1 && Y1Z2 === Y2Z1;
+        };
+        Point.prototype.is0 = function () {
+            return this.equals(Point.ZERO);
+        };
+        Point.prototype.negate = function () {
+            // Flips point sign to a negative one (-x, y in affine coords)
+            return new Point(modP(-this.ex), this.ey, this.ez, modP(-this.et));
+        };
+        // Fast algo for doubling Extended Point.
+        // https://hyperelliptic.org/EFD/g1p/auto-twisted-extended.html#doubling-dbl-2008-hwcd
+        // Cost: 4M + 4S + 1*a + 6add + 1*2.
+        Point.prototype.double = function () {
+            var a = CURVE.a;
+            var _a = this, X1 = _a.ex, Y1 = _a.ey, Z1 = _a.ez;
+            var A = modP(X1 * X1); // A = X12
+            var B = modP(Y1 * Y1); // B = Y12
+            var C = modP(_2n * modP(Z1 * Z1)); // C = 2*Z12
+            var D = modP(a * A); // D = a*A
+            var x1y1 = X1 + Y1;
+            var E = modP(modP(x1y1 * x1y1) - A - B); // E = (X1+Y1)2-A-B
+            var G = D + B; // G = D+B
+            var F = G - C; // F = G-C
+            var H = D - B; // H = D-B
+            var X3 = modP(E * F); // X3 = E*F
+            var Y3 = modP(G * H); // Y3 = G*H
+            var T3 = modP(E * H); // T3 = E*H
+            var Z3 = modP(F * G); // Z3 = F*G
+            return new Point(X3, Y3, Z3, T3);
+        };
+        // Fast algo for adding 2 Extended Points.
+        // https://hyperelliptic.org/EFD/g1p/auto-twisted-extended.html#addition-add-2008-hwcd
+        // Cost: 9M + 1*a + 1*d + 7add.
+        Point.prototype.add = function (other) {
+            assertPoint(other);
+            var a = CURVE.a, d = CURVE.d;
+            var _a = this, X1 = _a.ex, Y1 = _a.ey, Z1 = _a.ez, T1 = _a.et;
+            var X2 = other.ex, Y2 = other.ey, Z2 = other.ez, T2 = other.et;
+            // Faster algo for adding 2 Extended Points when curve's a=-1.
+            // http://hyperelliptic.org/EFD/g1p/auto-twisted-extended-1.html#addition-add-2008-hwcd-4
+            // Cost: 8M + 8add + 2*2.
+            // Note: It does not check whether the `other` point is valid.
+            if (a === BigInt(-1)) {
+                var A_1 = modP((Y1 - X1) * (Y2 + X2));
+                var B_1 = modP((Y1 + X1) * (Y2 - X2));
+                var F_1 = modP(B_1 - A_1);
+                if (F_1 === _0n)
+                    return this.double(); // Same point. Tests say it doesn't affect timing
+                var C_1 = modP(Z1 * _2n * T2);
+                var D_1 = modP(T1 * _2n * Z2);
+                var E_1 = D_1 + C_1;
+                var G_1 = B_1 + A_1;
+                var H_1 = D_1 - C_1;
+                var X3_1 = modP(E_1 * F_1);
+                var Y3_1 = modP(G_1 * H_1);
+                var T3_1 = modP(E_1 * H_1);
+                var Z3_1 = modP(F_1 * G_1);
+                return new Point(X3_1, Y3_1, Z3_1, T3_1);
+            }
+            var A = modP(X1 * X2); // A = X1*X2
+            var B = modP(Y1 * Y2); // B = Y1*Y2
+            var C = modP(T1 * d * T2); // C = T1*d*T2
+            var D = modP(Z1 * Z2); // D = Z1*Z2
+            var E = modP((X1 + Y1) * (X2 + Y2) - A - B); // E = (X1+Y1)*(X2+Y2)-A-B
+            var F = D - C; // F = D-C
+            var G = D + C; // G = D+C
+            var H = modP(B - a * A); // H = B-a*A
+            var X3 = modP(E * F); // X3 = E*F
+            var Y3 = modP(G * H); // Y3 = G*H
+            var T3 = modP(E * H); // T3 = E*H
+            var Z3 = modP(F * G); // Z3 = F*G
+            return new Point(X3, Y3, Z3, T3);
+        };
+        Point.prototype.subtract = function (other) {
+            return this.add(other.negate());
+        };
+        Point.prototype.wNAF = function (n) {
+            return wnaf.wNAFCached(this, n, Point.normalizeZ);
+        };
+        // Constant-time multiplication.
+        Point.prototype.multiply = function (scalar) {
+            var n = scalar;
+            (0, utils_js_1.aInRange)('scalar', n, _1n, CURVE_ORDER); // 1 <= scalar < L
+            var _a = this.wNAF(n), p = _a.p, f = _a.f;
+            return Point.normalizeZ([p, f])[0];
+        };
+        // Non-constant-time multiplication. Uses double-and-add algorithm.
+        // It's faster, but should only be used when you don't care about
+        // an exposed private key e.g. sig verification.
+        // Does NOT allow scalars higher than CURVE.n.
+        // Accepts optional accumulator to merge with multiply (important for sparse scalars)
+        Point.prototype.multiplyUnsafe = function (scalar, acc) {
+            if (acc === void 0) { acc = Point.ZERO; }
+            var n = scalar;
+            (0, utils_js_1.aInRange)('scalar', n, _0n, CURVE_ORDER); // 0 <= scalar < L
+            if (n === _0n)
+                return I;
+            if (this.is0() || n === _1n)
+                return this;
+            return wnaf.wNAFCachedUnsafe(this, n, Point.normalizeZ, acc);
+        };
+        // Checks if point is of small order.
+        // If you add something to small order point, you will have "dirty"
+        // point with torsion component.
+        // Multiplies point by cofactor and checks if the result is 0.
+        Point.prototype.isSmallOrder = function () {
+            return this.multiplyUnsafe(cofactor).is0();
+        };
+        // Multiplies point by curve order and checks if the result is 0.
+        // Returns `false` is the point is dirty.
+        Point.prototype.isTorsionFree = function () {
+            return wnaf.unsafeLadder(this, CURVE_ORDER).is0();
+        };
+        // Converts Extended point to default (x, y) coordinates.
+        // Can accept precomputed Z^-1 - for example, from invertBatch.
+        Point.prototype.toAffine = function (iz) {
+            return toAffineMemo(this, iz);
+        };
+        Point.prototype.clearCofactor = function () {
+            var cofactor = CURVE.h;
+            if (cofactor === _1n)
+                return this;
+            return this.multiplyUnsafe(cofactor);
+        };
+        // Converts hash string or Uint8Array to Point.
+        // Uses algo from RFC8032 5.1.3.
+        Point.fromHex = function (hex, zip215) {
+            if (zip215 === void 0) { zip215 = false; }
+            var d = CURVE.d, a = CURVE.a;
+            var len = Fp.BYTES;
+            hex = (0, utils_js_1.ensureBytes)('pointHex', hex, len); // copy hex to a new array
+            (0, utils_js_1.abool)('zip215', zip215);
+            var normed = hex.slice(); // copy again, we'll manipulate it
+            var lastByte = hex[len - 1]; // select last byte
+            normed[len - 1] = lastByte & ~0x80; // clear last bit
+            var y = (0, utils_js_1.bytesToNumberLE)(normed);
+            // zip215=true is good for consensus-critical apps. =false follows RFC8032 / NIST186-5.
+            // RFC8032 prohibits >= p, but ZIP215 doesn't
+            // zip215=true:  0 <= y < MASK (2^256 for ed25519)
+            // zip215=false: 0 <= y < P (2^255-19 for ed25519)
+            var max = zip215 ? MASK : Fp.ORDER;
+            (0, utils_js_1.aInRange)('pointHex.y', y, _0n, max);
+            // Ed25519: x² = (y²-1)/(dy²+1) mod p. Ed448: x² = (y²-1)/(dy²-1) mod p. Generic case:
+            // ax²+y²=1+dx²y² => y²-1=dx²y²-ax² => y²-1=x²(dy²-a) => x²=(y²-1)/(dy²-a)
+            var y2 = modP(y * y); // denominator is always non-0 mod p.
+            var u = modP(y2 - _1n); // u = y² - 1
+            var v = modP(d * y2 - a); // v = d y² + 1.
+            var _a = uvRatio(u, v), isValid = _a.isValid, x = _a.value; // √(u/v)
+            if (!isValid)
+                throw new Error('Point.fromHex: invalid y coordinate');
+            var isXOdd = (x & _1n) === _1n; // There are 2 square roots. Use x_0 bit to select proper
+            var isLastByteOdd = (lastByte & 0x80) !== 0; // x_0, last bit
+            if (!zip215 && x === _0n && isLastByteOdd)
+                // if x=0 and x_0 = 1, fail
+                throw new Error('Point.fromHex: x=0 and x_0=1');
+            if (isLastByteOdd !== isXOdd)
+                x = modP(-x); // if x_0 != x mod 2, set x = p-x
+            return Point.fromAffine({ x: x, y: y });
+        };
+        Point.fromPrivateKey = function (privKey) {
+            return getExtendedPublicKey(privKey).point;
+        };
+        Point.prototype.toRawBytes = function () {
+            var _a = this.toAffine(), x = _a.x, y = _a.y;
+            var bytes = (0, utils_js_1.numberToBytesLE)(y, Fp.BYTES); // each y has 2 x values (x, -y)
+            bytes[bytes.length - 1] |= x & _1n ? 0x80 : 0; // when compressing, it's enough to store y
+            return bytes; // and use the last byte to encode sign of x
+        };
+        Point.prototype.toHex = function () {
+            return (0, uint8array_utils_1.toHex)(this.toRawBytes()); // Same as toRawBytes, but returns string.
+        };
+        Point.BASE = new Point(CURVE.Gx, CURVE.Gy, _1n, modP(CURVE.Gx * CURVE.Gy));
+        Point.ZERO = new Point(_0n, _1n, _1n, _0n); // 0, 1, 1, 0
+        return Point;
+    }());
+    var G = Point.BASE, I = Point.ZERO;
+    var wnaf = (0, curve_1.wNAF)(Point, nByteLength * 8);
+    function modN(a) {
+        return (0, modular_js_1.mod)(a, CURVE_ORDER);
+    }
+    // Little-endian SHA512 with modulo n
+    function modN_LE(hash) {
+        return modN((0, utils_js_1.bytesToNumberLE)(hash));
+    }
+    /** Convenience method that creates public key and other stuff. RFC8032 5.1.5 */
+    function getExtendedPublicKey(key) {
+        var len = Fp.BYTES;
+        key = (0, utils_js_1.ensureBytes)('private key', key, len);
+        // Hash private key with curve's hash function to produce uniformingly random input
+        // Check byte lengths: ensure(64, h(ensure(32, key)))
+        var hashed = (0, utils_js_1.ensureBytes)('hashed private key', cHash(key), 2 * len);
+        var head = adjustScalarBytes(hashed.slice(0, len)); // clear first half bits, produce FE
+        var prefix = hashed.slice(len, 2 * len); // second half is called key prefix (5.1.6)
+        var scalar = modN_LE(head); // The actual private scalar
+        var point = G.multiply(scalar); // Point on Edwards curve aka public key
+        var pointBytes = point.toRawBytes(); // Uint8Array representation
+        return { head: head, prefix: prefix, scalar: scalar, point: point, pointBytes: pointBytes };
+    }
+    // Calculates EdDSA pub key. RFC8032 5.1.5. Privkey is hashed. Use first half with 3 bits cleared
+    function getPublicKey(privKey) {
+        return getExtendedPublicKey(privKey).pointBytes;
+    }
+    // int('LE', SHA512(dom2(F, C) || msgs)) mod N
+    function hashDomainToScalar(context) {
+        if (context === void 0) { context = new Uint8Array(); }
+        var msgs = [];
+        for (var _i = 1; _i < arguments.length; _i++) {
+            msgs[_i - 1] = arguments[_i];
+        }
+        var msg = uint8array_utils_1.concatUint8Array.apply(void 0, __spreadArray([], __read(msgs), false));
+        return modN_LE(cHash(domain(msg, (0, utils_js_1.ensureBytes)('context', context), !!prehash)));
+    }
+    /** Signs message with privateKey. RFC8032 5.1.6 */
+    function sign(msg, privKey, options) {
+        if (options === void 0) { options = {}; }
+        msg = (0, utils_js_1.ensureBytes)('message', msg);
+        if (prehash)
+            msg = prehash(msg); // for ed25519ph etc.
+        var _a = getExtendedPublicKey(privKey), prefix = _a.prefix, scalar = _a.scalar, pointBytes = _a.pointBytes;
+        var r = hashDomainToScalar(options.context, prefix, msg); // r = dom2(F, C) || prefix || PH(M)
+        var R = G.multiply(r).toRawBytes(); // R = rG
+        var k = hashDomainToScalar(options.context, R, pointBytes, msg); // R || A || PH(M)
+        var s = modN(r + k * scalar); // S = (r + k * s) mod L
+        (0, utils_js_1.aInRange)('signature.s', s, _0n, CURVE_ORDER); // 0 <= s < l
+        var res = (0, uint8array_utils_1.concatUint8Array)(R, (0, utils_js_1.numberToBytesLE)(s, Fp.BYTES));
+        return (0, utils_js_1.ensureBytes)('result', res, Fp.BYTES * 2); // 64-byte signature
+    }
+    var verifyOpts = VERIFY_DEFAULT;
+    /**
+     * Verifies EdDSA signature against message and public key. RFC8032 5.1.7.
+     * An extended group equation is checked.
+     */
+    function verify(sig, msg, publicKey, options) {
+        if (options === void 0) { options = verifyOpts; }
+        var context = options.context, zip215 = options.zip215;
+        var len = Fp.BYTES; // Verifies EdDSA signature against message and public key. RFC8032 5.1.7.
+        sig = (0, utils_js_1.ensureBytes)('signature', sig, 2 * len); // An extended group equation is checked.
+        msg = (0, utils_js_1.ensureBytes)('message', msg);
+        publicKey = (0, utils_js_1.ensureBytes)('publicKey', publicKey, len);
+        if (zip215 !== undefined)
+            (0, utils_js_1.abool)('zip215', zip215);
+        if (prehash)
+            msg = prehash(msg); // for ed25519ph, etc
+        var s = (0, utils_js_1.bytesToNumberLE)(sig.slice(len, 2 * len));
+        var A, R, SB;
+        try {
+            // zip215=true is good for consensus-critical apps. =false follows RFC8032 / NIST186-5.
+            // zip215=true:  0 <= y < MASK (2^256 for ed25519)
+            // zip215=false: 0 <= y < P (2^255-19 for ed25519)
+            A = Point.fromHex(publicKey, zip215);
+            R = Point.fromHex(sig.slice(0, len), zip215);
+            SB = G.multiplyUnsafe(s); // 0 <= s < l is done inside
+        }
+        catch (error) {
+            return false;
+        }
+        if (!zip215 && A.isSmallOrder())
+            return false;
+        var k = hashDomainToScalar(context, R.toRawBytes(), A.toRawBytes(), msg);
+        var RkA = R.add(A.multiplyUnsafe(k));
+        // Extended group equation
+        // [8][S]B = [8]R + [8][k]A'
+        return RkA.subtract(SB).clearCofactor().equals(Point.ZERO);
+    }
+    G._setWindowSize(8); // Enable precomputes. Slows down first publicKey computation by 20ms.
+    var utils = {
+        getExtendedPublicKey: getExtendedPublicKey,
+        // ed25519 private keys are uniform 32b. No need to check for modulo bias, like in secp256k1.
+        randomPrivateKey: function () { return randomBytes(Fp.BYTES); },
+        /**
+         * We're doing scalar multiplication (used in getPublicKey etc) with precomputed BASE_POINT
+         * values. This slows down first getPublicKey() by milliseconds (see Speed section),
+         * but allows to speed-up subsequent getPublicKey() calls up to 20x.
+         * @param windowSize 2, 4, 8, 16
+         */
+        precompute: function (windowSize, point) {
+            if (windowSize === void 0) { windowSize = 8; }
+            if (point === void 0) { point = Point.BASE; }
+            point._setWindowSize(windowSize);
+            point.multiply(BigInt(3));
+            return point;
+        },
+    };
+    return {
+        CURVE: CURVE,
+        getPublicKey: getPublicKey,
+        sign: sign,
+        verify: verify,
+        ExtendedPoint: Point,
+        utils: utils,
+    };
+}
+exports.twistedEdwards = twistedEdwards;

package/dist/noble/abstract/hash-to-curve.d.ts

@@ -0,0 +1,57 @@
+/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+import type { Group, GroupConstructor, AffinePoint } from './curve.js';
+import { IField } from './modular.js';
+import type { CHash } from './utils.js';
+/**
+ * * `DST` is a domain separation tag, defined in section 2.2.5
+ * * `p` characteristic of F, where F is a finite field of characteristic p and order q = p^m
+ * * `m` is extension degree (1 for prime fields)
+ * * `k` is the target security target in bits (e.g. 128), from section 5.1
+ * * `expand` is `xmd` (SHA2, SHA3, BLAKE) or `xof` (SHAKE, BLAKE-XOF)
+ * * `hash` conforming to `utils.CHash` interface, with `outputLen` / `blockLen` props
+ */
+type UnicodeOrBytes = string | Uint8Array;
+export type Opts = {
+    DST: UnicodeOrBytes;
+    p: bigint;
+    m: number;
+    k: number;
+    expand: 'xmd' | 'xof';
+    hash: CHash;
+};
+export declare function expand_message_xmd(msg: Uint8Array, DST: Uint8Array, lenInBytes: number, H: CHash): Uint8Array;
+export declare function expand_message_xof(msg: Uint8Array, DST: Uint8Array, lenInBytes: number, k: number, H: CHash): Uint8Array;
+/**
+ * Hashes arbitrary-length byte strings to a list of one or more elements of a finite field F
+ * https://www.rfc-editor.org/rfc/rfc9380#section-5.2
+ * @param msg a byte string containing the message to hash
+ * @param count the number of elements of F to output
+ * @param options `{DST: string, p: bigint, m: number, k: number, expand: 'xmd' | 'xof', hash: H}`, see above
+ * @returns [u_0, ..., u_(count - 1)], a list of field elements.
+ */
+export declare function hash_to_field(msg: Uint8Array, count: number, options: Opts): bigint[][];
+export declare function isogenyMap<T, F extends IField<T>>(field: F, map: [T[], T[], T[], T[]]): (x: T, y: T) => {
+    x: T;
+    y: T;
+};
+export interface H2CPoint<T> extends Group<H2CPoint<T>> {
+    add(rhs: H2CPoint<T>): H2CPoint<T>;
+    toAffine(iz?: bigint): AffinePoint<T>;
+    clearCofactor(): H2CPoint<T>;
+    assertValidity(): void;
+}
+export interface H2CPointConstructor<T> extends GroupConstructor<H2CPoint<T>> {
+    fromAffine(ap: AffinePoint<T>): H2CPoint<T>;
+}
+export type MapToCurve<T> = (scalar: bigint[]) => AffinePoint<T>;
+export type htfBasicOpts = {
+    DST: UnicodeOrBytes;
+};
+export type HTFMethod<ReturnT> = (msg: Uint8Array, options?: htfBasicOpts) => H2CPoint<ReturnT>;
+export declare function createHasher<T>(Point: H2CPointConstructor<T>, mapToCurve: MapToCurve<T>, def: Opts & {
+    encodeDST?: UnicodeOrBytes;
+}): {
+    hashToCurve(msg: Uint8Array, options?: htfBasicOpts): H2CPoint<T>;
+    encodeToCurve(msg: Uint8Array, options?: htfBasicOpts): H2CPoint<T>;
+};
+export {};