@ohos-ports/crypto 0.0.0-stage → 0.3.1-beta.1

package/dist/noble/abstract/hash-to-curve.js

@@ -0,0 +1,220 @@
+"use strict";
+/*
+THIS IMPLEMENTATION WAS TAKEN FROM `@noble/hashes`
+
+original source: https://github.com/paulmillr/noble-curves/blob/38a4ca1e6b0a80c60b11bbb6b3d71e3bfabd5bbb/src/abstract/hash-to-curve.ts
+
+it was modified and adapted to this repository
+
+the main reason for copying over and not using as dependency is because of different target in the `tsconfig.json`
+
+`@noble/hashes` targets es2020, which tends to cause problems with some other (older) packages sometimes
+
+this repo targets ES5+
+*/
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
+var __read = (this && this.__read) || function (o, n) {
+    var m = typeof Symbol === "function" && o[Symbol.iterator];
+    if (!m) return o;
+    var i = m.call(o), r, ar = [], e;
+    try {
+        while ((n === void 0 || n-- > 0) && !(r = i.next()).done) ar.push(r.value);
+    }
+    catch (error) { e = { error: error }; }
+    finally {
+        try {
+            if (r && !r.done && (m = i["return"])) m.call(i);
+        }
+        finally { if (e) throw e.error; }
+    }
+    return ar;
+};
+var __spreadArray = (this && this.__spreadArray) || function (to, from, pack) {
+    if (pack || arguments.length === 2) for (var i = 0, l = from.length, ar; i < l; i++) {
+        if (ar || !(i in from)) {
+            if (!ar) ar = Array.prototype.slice.call(from, 0, i);
+            ar[i] = from[i];
+        }
+    }
+    return to.concat(ar || Array.prototype.slice.call(from));
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createHasher = exports.isogenyMap = exports.hash_to_field = exports.expand_message_xof = exports.expand_message_xmd = void 0;
+var modular_1 = require("./modular.js");
+var utils_1 = require("./utils.js");
+// Octet Stream to Integer. "spec" implementation of os2ip is 2.5x slower vs bytesToNumberBE.
+var os2ip = utils_1.bytesToNumberBE;
+// Integer to Octet Stream (numberToBytesBE)
+function i2osp(value, length) {
+    if (value < 0 || value >= 1 << (8 * length)) {
+        throw new Error("bad I2OSP call: value=".concat(value, " length=").concat(length));
+    }
+    var res = Array.from({ length: length }).fill(0);
+    for (var i = length - 1; i >= 0; i--) {
+        res[i] = value & 0xff;
+        value >>>= 8;
+    }
+    return new Uint8Array(res);
+}
+function strxor(a, b) {
+    var arr = new Uint8Array(a.length);
+    for (var i = 0; i < a.length; i++) {
+        arr[i] = a[i] ^ b[i];
+    }
+    return arr;
+}
+function anum(item) {
+    if (!Number.isSafeInteger(item))
+        throw new Error('number expected');
+}
+// Produces a uniformly random byte string using a cryptographic hash function H that outputs b bits
+// https://www.rfc-editor.org/rfc/rfc9380#section-5.3.1
+function expand_message_xmd(msg, DST, lenInBytes, H) {
+    (0, utils_1.abytes)(msg);
+    (0, utils_1.abytes)(DST);
+    anum(lenInBytes);
+    // https://www.rfc-editor.org/rfc/rfc9380#section-5.3.3
+    if (DST.length > 255)
+        DST = H((0, utils_1.concatBytes)((0, utils_1.utf8ToBytes)('H2C-OVERSIZE-DST-'), DST));
+    var b_in_bytes = H.outputLen, r_in_bytes = H.blockLen;
+    var ell = Math.ceil(lenInBytes / b_in_bytes);
+    if (ell > 255)
+        throw new Error('Invalid xmd length');
+    var DST_prime = (0, utils_1.concatBytes)(DST, i2osp(DST.length, 1));
+    var Z_pad = i2osp(0, r_in_bytes);
+    var l_i_b_str = i2osp(lenInBytes, 2); // len_in_bytes_str
+    var b = new Array(ell);
+    var b_0 = H((0, utils_1.concatBytes)(Z_pad, msg, l_i_b_str, i2osp(0, 1), DST_prime));
+    b[0] = H((0, utils_1.concatBytes)(b_0, i2osp(1, 1), DST_prime));
+    for (var i = 1; i <= ell; i++) {
+        var args = [strxor(b_0, b[i - 1]), i2osp(i + 1, 1), DST_prime];
+        b[i] = H(utils_1.concatBytes.apply(void 0, __spreadArray([], __read(args), false)));
+    }
+    var pseudo_random_bytes = utils_1.concatBytes.apply(void 0, __spreadArray([], __read(b), false));
+    return pseudo_random_bytes.slice(0, lenInBytes);
+}
+exports.expand_message_xmd = expand_message_xmd;
+// Produces a uniformly random byte string using an extendable-output function (XOF) H.
+// 1. The collision resistance of H MUST be at least k bits.
+// 2. H MUST be an XOF that has been proved indifferentiable from
+//    a random oracle under a reasonable cryptographic assumption.
+// https://www.rfc-editor.org/rfc/rfc9380#section-5.3.2
+function expand_message_xof(msg, DST, lenInBytes, k, H) {
+    (0, utils_1.abytes)(msg);
+    (0, utils_1.abytes)(DST);
+    anum(lenInBytes);
+    // https://www.rfc-editor.org/rfc/rfc9380#section-5.3.3
+    // DST = H('H2C-OVERSIZE-DST-' || a_very_long_DST, Math.ceil((lenInBytes * k) / 8));
+    if (DST.length > 255) {
+        var dkLen = Math.ceil((2 * k) / 8);
+        DST = H.create({ dkLen: dkLen }).update((0, utils_1.utf8ToBytes)('H2C-OVERSIZE-DST-')).update(DST).digest();
+    }
+    if (lenInBytes > 65535 || DST.length > 255)
+        throw new Error('expand_message_xof: invalid lenInBytes');
+    return (H.create({ dkLen: lenInBytes })
+        .update(msg)
+        .update(i2osp(lenInBytes, 2))
+        // 2. DST_prime = DST || I2OSP(len(DST), 1)
+        .update(DST)
+        .update(i2osp(DST.length, 1))
+        .digest());
+}
+exports.expand_message_xof = expand_message_xof;
+/**
+ * Hashes arbitrary-length byte strings to a list of one or more elements of a finite field F
+ * https://www.rfc-editor.org/rfc/rfc9380#section-5.2
+ * @param msg a byte string containing the message to hash
+ * @param count the number of elements of F to output
+ * @param options `{DST: string, p: bigint, m: number, k: number, expand: 'xmd' | 'xof', hash: H}`, see above
+ * @returns [u_0, ..., u_(count - 1)], a list of field elements.
+ */
+function hash_to_field(msg, count, options) {
+    (0, utils_1.validateObject)(options, {
+        DST: 'stringOrUint8Array',
+        p: 'bigint',
+        m: 'isSafeInteger',
+        k: 'isSafeInteger',
+        hash: 'hash',
+    });
+    var p = options.p, k = options.k, m = options.m, hash = options.hash, expand = options.expand, _DST = options.DST;
+    (0, utils_1.abytes)(msg);
+    anum(count);
+    var DST = typeof _DST === 'string' ? (0, utils_1.utf8ToBytes)(_DST) : _DST;
+    var log2p = p.toString(2).length;
+    var L = Math.ceil((log2p + k) / 8); // section 5.1 of ietf draft link above
+    var len_in_bytes = count * m * L;
+    var prb; // pseudo_random_bytes
+    if (expand === 'xmd') {
+        prb = expand_message_xmd(msg, DST, len_in_bytes, hash);
+    }
+    else if (expand === 'xof') {
+        prb = expand_message_xof(msg, DST, len_in_bytes, k, hash);
+    }
+    else if (expand === '_internal_pass') {
+        // for internal tests only
+        prb = msg;
+    }
+    else {
+        throw new Error('expand must be "xmd" or "xof"');
+    }
+    var u = new Array(count);
+    for (var i = 0; i < count; i++) {
+        var e = new Array(m);
+        for (var j = 0; j < m; j++) {
+            var elm_offset = L * (j + i * m);
+            var tv = prb.subarray(elm_offset, elm_offset + L);
+            e[j] = (0, modular_1.mod)(os2ip(tv), p);
+        }
+        u[i] = e;
+    }
+    return u;
+}
+exports.hash_to_field = hash_to_field;
+function isogenyMap(field, map) {
+    // Make same order as in spec
+    var COEFF = map.map(function (i) { return Array.from(i).reverse(); });
+    return function (x, y) {
+        var _a = __read(COEFF.map(function (val) {
+            return val.reduce(function (acc, i) { return field.add(field.mul(acc, x), i); });
+        }), 4), xNum = _a[0], xDen = _a[1], yNum = _a[2], yDen = _a[3];
+        x = field.div(xNum, xDen); // xNum / xDen
+        y = field.mul(y, field.div(yNum, yDen)); // y * (yNum / yDev)
+        return { x: x, y: y };
+    };
+}
+exports.isogenyMap = isogenyMap;
+function createHasher(Point, mapToCurve, def) {
+    if (typeof mapToCurve !== 'function')
+        throw new Error('mapToCurve() must be defined');
+    return {
+        // Encodes byte string to elliptic curve.
+        // hash_to_curve from https://www.rfc-editor.org/rfc/rfc9380#section-3
+        hashToCurve: function (msg, options) {
+            var u = hash_to_field(msg, 2, __assign(__assign(__assign({}, def), { DST: def.DST }), options));
+            var u0 = Point.fromAffine(mapToCurve(u[0]));
+            var u1 = Point.fromAffine(mapToCurve(u[1]));
+            var P = u0.add(u1).clearCofactor();
+            P.assertValidity();
+            return P;
+        },
+        // Encodes byte string to elliptic curve.
+        // encode_to_curve from https://www.rfc-editor.org/rfc/rfc9380#section-3
+        encodeToCurve: function (msg, options) {
+            var u = hash_to_field(msg, 1, __assign(__assign(__assign({}, def), { DST: def.encodeDST }), options));
+            var P = Point.fromAffine(mapToCurve(u[0])).clearCofactor();
+            P.assertValidity();
+            return P;
+        },
+    };
+}
+exports.createHasher = createHasher;

package/dist/noble/abstract/modular.d.ts

@@ -0,0 +1,122 @@
+export declare function mod(a: bigint, b: bigint): bigint;
+/**
+ * Efficiently raise num to power and do modular division.
+ * Unsafe in some contexts: uses ladder, so can expose bigint bits.
+ * @example
+ * pow(2n, 6n, 11n) // 64n % 11n == 9n
+ */
+export declare function pow(num: bigint, power: bigint, modulo: bigint): bigint;
+export declare function pow2(x: bigint, power: bigint, modulo: bigint): bigint;
+export declare function invert(number: bigint, modulo: bigint): bigint;
+/**
+ * Tonelli-Shanks square root search algorithm.
+ * 1. https://eprint.iacr.org/2012/685.pdf (page 12)
+ * 2. Square Roots from 1; 24, 51, 10 to Dan Shanks
+ * Will start an infinite loop if field order P is not prime.
+ * @param P field order
+ * @returns function that takes field Fp (created from P) and number n
+ */
+export declare function tonelliShanks(P: bigint): <T>(Fp: IField<T>, n: T) => T;
+export declare function FpSqrt(P: bigint): <T>(Fp: IField<T>, n: T) => T;
+export declare const isNegativeLE: (num: bigint, modulo: bigint) => boolean;
+export interface IField<T> {
+    ORDER: bigint;
+    BYTES: number;
+    BITS: number;
+    MASK: bigint;
+    ZERO: T;
+    ONE: T;
+    create: (num: T) => T;
+    isValid: (num: T) => boolean;
+    is0: (num: T) => boolean;
+    neg(num: T): T;
+    inv(num: T): T;
+    sqrt(num: T): T;
+    sqr(num: T): T;
+    eql(lhs: T, rhs: T): boolean;
+    add(lhs: T, rhs: T): T;
+    sub(lhs: T, rhs: T): T;
+    mul(lhs: T, rhs: T | bigint): T;
+    pow(lhs: T, power: bigint): T;
+    div(lhs: T, rhs: T | bigint): T;
+    addN(lhs: T, rhs: T): T;
+    subN(lhs: T, rhs: T): T;
+    mulN(lhs: T, rhs: T | bigint): T;
+    sqrN(num: T): T;
+    isOdd?(num: T): boolean;
+    pow(lhs: T, power: bigint): T;
+    invertBatch: (lst: T[]) => T[];
+    toBytes(num: T): Uint8Array;
+    fromBytes(bytes: Uint8Array): T;
+    cmov(a: T, b: T, c: boolean): T;
+}
+export declare function validateField<T>(field: IField<T>): IField<T>;
+/**
+ * Same as `pow` but for Fp: non-constant-time.
+ * Unsafe in some contexts: uses ladder, so can expose bigint bits.
+ */
+export declare function FpPow<T>(f: IField<T>, num: T, power: bigint): T;
+/**
+ * Efficiently invert an array of Field elements.
+ * `inv(0)` will return `undefined` here: make sure to throw an error.
+ */
+export declare function FpInvertBatch<T>(f: IField<T>, nums: T[]): T[];
+export declare function FpDiv<T>(f: IField<T>, lhs: T, rhs: T | bigint): T;
+export declare function FpIsSquare<T>(f: IField<T>): (x: T) => boolean;
+export declare function nLength(n: bigint, nBitLength?: number): {
+    nBitLength: number;
+    nByteLength: number;
+};
+type FpField = IField<bigint> & Required<Pick<IField<bigint>, 'isOdd'>>;
+/**
+ * Initializes a finite field over prime. **Non-primes are not supported.**
+ * Do not init in loop: slow. Very fragile: always run a benchmark on a change.
+ * Major performance optimizations:
+ * * a) denormalized operations like mulN instead of mul
+ * * b) same object shape: never add or remove keys
+ * * c) Object.freeze
+ * @param ORDER prime positive bigint
+ * @param bitLen how many bits the field consumes
+ * @param isLE (def: false) if encoding / decoding should be in little-endian
+ * @param redef optional faster redefinitions of sqrt and other methods
+ */
+export declare function Field(ORDER: bigint, bitLen?: number, isLE?: boolean, redef?: Partial<IField<bigint>>): Readonly<FpField>;
+export declare function FpSqrtOdd<T>(Fp: IField<T>, elm: T): T;
+export declare function FpSqrtEven<T>(Fp: IField<T>, elm: T): T;
+/**
+ * "Constant-time" private key generation utility.
+ * Same as mapKeyToField, but accepts less bytes (40 instead of 48 for 32-byte field).
+ * Which makes it slightly more biased, less secure.
+ * @deprecated use mapKeyToField instead
+ */
+export declare function hashToPrivateScalar(hash: string | Uint8Array, groupOrder: bigint, isLE?: boolean): bigint;
+/**
+ * Returns total number of bytes consumed by the field element.
+ * For example, 32 bytes for usual 256-bit weierstrass curve.
+ * @param fieldOrder number of field elements, usually CURVE.n
+ * @returns byte length of field
+ */
+export declare function getFieldBytesLength(fieldOrder: bigint): number;
+/**
+ * Returns minimal amount of bytes that can be safely reduced
+ * by field order.
+ * Should be 2^-128 for 128-bit curve such as P256.
+ * @param fieldOrder number of field elements, usually CURVE.n
+ * @returns byte length of target hash
+ */
+export declare function getMinHashLength(fieldOrder: bigint): number;
+/**
+ * "Constant-time" private key generation utility.
+ * Can take (n + n/2) or more bytes of uniform input e.g. from CSPRNG or KDF
+ * and convert them into private scalar, with the modulo bias being negligible.
+ * Needs at least 48 bytes of input for 32-byte private key.
+ * https://research.kudelskisecurity.com/2020/07/28/the-definitive-guide-to-modulo-bias-and-how-to-avoid-it/
+ * FIPS 186-5, A.2 https://csrc.nist.gov/publications/detail/fips/186/5/final
+ * RFC 9380, https://www.rfc-editor.org/rfc/rfc9380#section-5
+ * @param hash hash output from SHA3 or a similar function
+ * @param groupOrder size of subgroup - (e.g. secp256k1.CURVE.n)
+ * @param isLE interpret hash bytes as LE num
+ * @returns valid private scalar
+ */
+export declare function mapHashToField(key: Uint8Array, fieldOrder: bigint, isLE?: boolean): Uint8Array;
+export {};