@opeqlabs/sdk 0.0.0-stage → 0.1.0

package/src/lib/evmwots.js

@@ -0,0 +1,322 @@
+import { keccak256 } from "./keccak.js";
+import { sha256 } from "./sha256.js";
+import { FACTORY_INIT, ACCOUNT_INIT } from "./evmcode.js";
+
+export const N = 16;
+export const W = 256;
+export const CHAINS = 18;
+export const HEIGHT = 10;
+export const LEAVES = 1 << HEIGHT;
+export const SIG_LEN = CHAINS * N;
+export const PATH_LEN = HEIGHT * N;
+export const PROOF_LEN = SIG_LEN + PATH_LEN;
+export const REKEY_RESERVE = 64;
+export const EXEC_LIMIT = LEAVES - REKEY_RESERVE;
+export const GRIND_TRIES = 1 << 17;
+
+const T_CHAIN = 0, T_LEAF = 1, T_NODE = 2, T_PRF = 3;
+const enc = new TextEncoder();
+
+export const TAG_EXEC = keccak256(enc.encode("opeq/evm/exec/v1"));
+export const CREATE_SELECTOR = keccak256(enc.encode("create(bytes16,bytes16)")).slice(0, 4);
+export const TAG_REKEY = keccak256(enc.encode("opeq/evm/rekey/v1"));
+export const EXECUTE_SELECTOR = keccak256(enc.encode("execute((address,uint256,bytes)[],uint32,uint64,uint32,bytes16,bytes)")).slice(0, 4);
+export const REKEY_SELECTOR = keccak256(enc.encode("rekey(bytes16,bytes16,uint32,uint64,uint32,bytes16,bytes)")).slice(0, 4);
+
+export function adrs(kind, a, b, idx) {
+  return new Uint8Array([kind, a, b, 0, (idx >>> 24) & 0xff, (idx >>> 16) & 0xff, (idx >>> 8) & 0xff, idx & 0xff]);
+}
+
+const cbuf = new Uint8Array(40);
+
+export function chainRun(pubSeed, leaf, c, x, start, steps) {
+  cbuf.set(pubSeed, 0);
+  cbuf.set(adrs(T_CHAIN, c, 0, leaf), 16);
+  cbuf.set(x, 24);
+  for (let pos = start; pos < start + steps; pos++) {
+    cbuf[18] = pos;
+    cbuf.set(keccak256(cbuf).subarray(0, N), 24);
+  }
+  return cbuf.slice(24, 40);
+}
+
+export function secret(skSeed, leaf, c) {
+  return keccak256(skSeed, adrs(T_PRF, c, 0, leaf)).slice(0, N);
+}
+
+export function leafCompress(pubSeed, leaf, pks) {
+  return keccak256(pubSeed, adrs(T_LEAF, 0, 0, leaf), ...pks).slice(0, N);
+}
+
+export function node(pubSeed, height, index, left, right) {
+  return keccak256(pubSeed, adrs(T_NODE, height, 0, index), left, right).slice(0, N);
+}
+
+export function digits(d16) {
+  const d = Array.from(d16);
+  let csum = 0;
+  for (const x of d) csum += W - 1 - x;
+  return d.concat([csum >> 8, csum & 0xff]);
+}
+
+export function verifyCost(d16) {
+  return digits(d16).reduce((s, x) => s + (W - 1 - x), 0);
+}
+
+export function leafPk(skSeed, pubSeed, leaf) {
+  const pks = [];
+  for (let c = 0; c < CHAINS; c++) pks.push(chainRun(pubSeed, leaf, c, secret(skSeed, leaf, c), 0, W - 1));
+  return leafCompress(pubSeed, leaf, pks);
+}
+
+export function rootFromProof(pubSeed, leaf, d16, proof) {
+  const ds = digits(d16);
+  const pks = [];
+  for (let c = 0; c < CHAINS; c++) pks.push(chainRun(pubSeed, leaf, c, proof.subarray(c * N, c * N + N), ds[c], W - 1 - ds[c]));
+  let x = leafCompress(pubSeed, leaf, pks);
+  for (let h = 0; h < HEIGHT; h++) {
+    const sib = proof.subarray(SIG_LEN + h * N, SIG_LEN + h * N + N);
+    const idx = leaf >>> (h + 1);
+    x = (leaf >>> h) & 1 ? node(pubSeed, h + 1, idx, sib, x) : node(pubSeed, h + 1, idx, x, sib);
+  }
+  return x;
+}
+
+export class EvmTreeKey {
+  constructor(skSeed, pubSeed, leaves) {
+    this.skSeed = skSeed;
+    this.pubSeed = pubSeed;
+    this.levels = [leaves];
+    for (let h = 0; h < HEIGHT; h++) {
+      const prev = this.levels[h], next = [];
+      for (let i = 0; i < prev.length / 2; i++) next.push(node(pubSeed, h + 1, i, prev[2 * i], prev[2 * i + 1]));
+      this.levels.push(next);
+    }
+    this.root = this.levels[HEIGHT][0];
+  }
+
+  static generate(skSeed, pubSeed, progress) {
+    const leaves = [];
+    for (let i = 0; i < LEAVES; i++) {
+      leaves.push(leafPk(skSeed, pubSeed, i));
+      if (progress && (i & 31) === 31) progress((i + 1) / LEAVES);
+    }
+    return new EvmTreeKey(skSeed, pubSeed, leaves);
+  }
+
+  sign(leaf, d16) {
+    const out = new Uint8Array(PROOF_LEN);
+    digits(d16).forEach((d, c) => out.set(chainRun(this.pubSeed, leaf, c, secret(this.skSeed, leaf, c), 0, d), c * N));
+    for (let h = 0; h < HEIGHT; h++) out.set(this.levels[h][(leaf >>> h) ^ 1], SIG_LEN + h * N);
+    return out;
+  }
+}
+
+function u32be(v) { return new Uint8Array([(v >>> 24) & 0xff, (v >>> 16) & 0xff, (v >>> 8) & 0xff, v & 0xff]); }
+
+function u64be(v) {
+  const b = BigInt(v), out = new Uint8Array(8);
+  for (let i = 0; i < 8; i++) out[i] = Number((b >> BigInt(56 - 8 * i)) & 0xffn);
+  return out;
+}
+
+export const CHAIN_SLOTS = Object.freeze({ 8453: 0, 84532: 1, 31337: 2, 1: 3, 42161: 4, 4663: 5, 421614: 6, 11155111: 7, 99901: 8 });
+
+export function chainSlot(chainId) {
+  const s = CHAIN_SLOTS[chainId];
+  if (s === undefined) throw new Error("chain " + chainId + " has no identity slot");
+  return s;
+}
+
+export function identitySeeds(master, factory = factoryAddress()) {
+  const f = addressBytes(factory);
+  return {
+    skSeed: sha256(enc.encode("opeq/evm/id/sk/v2"), master, f),
+    pubSeed: sha256(enc.encode("opeq/evm/id/pub/v2"), master, f).slice(0, N),
+  };
+}
+
+export function chainTreeSeeds(master, chainId, account, epoch, pubSeed) {
+  if (!Number.isInteger(epoch) || epoch < 1 || epoch > 0xffffffff) throw new Error("chain tree epoch must be 1 or more");
+  if (!(pubSeed instanceof Uint8Array) || pubSeed.length !== N) throw new Error("pubSeed must be 16 bytes");
+  chainSlot(chainId);
+  return { skSeed: sha256(enc.encode("opeq/evm/tree/sk/v3"), master, u64be(chainId), addressBytes(account), u32be(epoch), pubSeed), pubSeed: pubSeed.slice() };
+}
+
+export function deriveIdentityTree(master, progress, factory = factoryAddress()) {
+  const { skSeed, pubSeed } = identitySeeds(master, factory);
+  return EvmTreeKey.generate(skSeed, pubSeed, progress);
+}
+
+export function deriveChainTree(master, chainId, account, epoch, pubSeed, progress) {
+  const s = chainTreeSeeds(master, chainId, account, epoch, pubSeed);
+  return EvmTreeKey.generate(s.skSeed, s.pubSeed, progress);
+}
+
+export function word(n) {
+  let v = BigInt(n);
+  if (v < 0n || v >= 1n << 256n) throw new Error("value does not fit in 256 bits");
+  const out = new Uint8Array(32);
+  for (let i = 31; i >= 0; i--) { out[i] = Number(v & 0xffn); v >>= 8n; }
+  return out;
+}
+
+export function leftWord(bytes) {
+  if (bytes.length > 32) throw new Error("fixed bytes longer than 32");
+  const out = new Uint8Array(32);
+  out.set(bytes, 0);
+  return out;
+}
+
+export function addressBytes(addr) {
+  if (typeof addr !== "string" || !/^0x[0-9a-fA-F]{40}$/.test(addr)) throw new Error("not an EVM address");
+  return Uint8Array.from(addr.slice(2).match(/../g), (h) => parseInt(h, 16));
+}
+
+export function addressWord(addr) {
+  const out = new Uint8Array(32);
+  out.set(addressBytes(addr), 12);
+  return out;
+}
+
+export function concat(...parts) {
+  const n = parts.reduce((s, p) => s + p.length, 0);
+  const out = new Uint8Array(n);
+  let o = 0;
+  for (const p of parts) { out.set(p, o); o += p.length; }
+  return out;
+}
+
+export function dynBytes(data) {
+  const pad = (32 - (data.length % 32)) % 32;
+  return concat(word(data.length), data, new Uint8Array(pad));
+}
+
+export function encodeCalls(calls) {
+  const bodies = calls.map((c) => concat(addressWord(c.to), word(c.value), word(96), dynBytes(c.data || new Uint8Array(0))));
+  const heads = [];
+  let off = 32 * calls.length;
+  for (const b of bodies) { heads.push(word(off)); off += b.length; }
+  return concat(word(calls.length), ...heads, ...bodies);
+}
+
+export function callsHash(calls) {
+  return keccak256(word(32), encodeCalls(calls));
+}
+
+export function execHasher(rnd, chainId, account, epoch, leaf, deadline, calls) {
+  if (rnd.length !== N) throw new Error("randomizer must be 16 bytes");
+  const head = concat(leftWord(rnd), TAG_EXEC, word(chainId), addressWord(account), word(epoch), word(leaf), word(deadline), callsHash(calls));
+  return (salt) => keccak256(head, word(salt)).slice(0, N);
+}
+
+export function rekeyHasher(rnd, chainId, account, epoch, leaf, deadline, newPubSeed, newRoot) {
+  if (rnd.length !== N) throw new Error("randomizer must be 16 bytes");
+  const head = concat(leftWord(rnd), TAG_REKEY, word(chainId), addressWord(account), word(epoch), word(leaf), word(deadline), leftWord(newPubSeed), leftWord(newRoot));
+  return (salt) => keccak256(head, word(salt)).slice(0, N);
+}
+
+export function grind(hasher, tries = GRIND_TRIES, progress) {
+  let best = null;
+  for (let salt = 0; salt < tries; salt++) {
+    const d = hasher(salt);
+    const c = verifyCost(d);
+    if (!best || c < best.cost) best = { salt, digest: d, cost: c };
+    if (progress && (salt & 8191) === 8191) progress((salt + 1) / tries);
+  }
+  return best;
+}
+
+export function encodeExecute(calls, leaf, deadline, salt, rnd, proof) {
+  if (proof.length !== PROOF_LEN) throw new Error("proof must be 448 bytes");
+  const callsEnc = encodeCalls(calls);
+  const headLen = 32 * 6;
+  return concat(
+    EXECUTE_SELECTOR,
+    word(headLen), word(leaf), word(deadline), word(salt), leftWord(rnd), word(headLen + callsEnc.length),
+    callsEnc,
+    dynBytes(proof),
+  );
+}
+
+export function encodeRekey(newPubSeed, newRoot, leaf, deadline, salt, rnd, proof) {
+  if (proof.length !== PROOF_LEN) throw new Error("proof must be 448 bytes");
+  return concat(
+    REKEY_SELECTOR,
+    leftWord(newPubSeed), leftWord(newRoot), word(leaf), word(deadline), word(salt), leftWord(rnd), word(32 * 7),
+    dynBytes(proof),
+  );
+}
+
+export function encodeCreate(pubSeed, root) {
+  return concat(CREATE_SELECTOR, leftWord(pubSeed), leftWord(root));
+}
+
+export const CREATE2_DEPLOYER = "0x4e59b44847b379578588920ca78fbf26c0b4956c";
+
+function fromHex(h) {
+  return Uint8Array.from(h.match(/../g), (x) => parseInt(x, 16));
+}
+
+function toAddr(b) {
+  return "0x" + Array.from(b, (x) => x.toString(16).padStart(2, "0")).join("");
+}
+
+function create2(deployer, salt, initHash) {
+  return toAddr(keccak256(Uint8Array.of(0xff), addressBytes(deployer), salt, initHash).slice(12));
+}
+
+const FACTORY_INIT_BYTES = fromHex(FACTORY_INIT);
+const ACCOUNT_INIT_BYTES = fromHex(ACCOUNT_INIT);
+
+export function factoryAddress() {
+  return create2(CREATE2_DEPLOYER, new Uint8Array(32), keccak256(FACTORY_INIT_BYTES));
+}
+
+export function factoryDeployData() {
+  return concat(new Uint8Array(32), FACTORY_INIT_BYTES);
+}
+
+export function accountSalt(pubSeed, root) {
+  const tag = enc.encode("opeq/evm/id/v1");
+  return keccak256(word(96), leftWord(pubSeed), leftWord(root), dynBytes(tag));
+}
+
+export function accountAddress(pubSeed, root, factory = factoryAddress()) {
+  return create2(factory, accountSalt(pubSeed, root), keccak256(ACCOUNT_INIT_BYTES, leftWord(pubSeed), leftWord(root)));
+}
+
+export function bootSeeds(master, chainId, account) {
+  chainSlot(chainId);
+  const acct = addressBytes(account);
+  return {
+    pubSeed: sha256(enc.encode("opeq/evm/chain/pub/v2"), master, u64be(chainId), acct).slice(0, N),
+    rnd: sha256(enc.encode("opeq/evm/boot/rnd/v2"), master, u64be(chainId), acct).slice(0, N),
+  };
+}
+
+export function bootstrapCall(master, chainId, account, identity, progress) {
+  if (account.toLowerCase() !== accountAddress(identity.pubSeed, identity.root)) throw new Error("refusing to sign a bootstrap for an account that is not this identity's account on the OPEQ factory");
+  const { pubSeed, rnd } = bootSeeds(master, chainId, account);
+  const tree = deriveChainTree(master, chainId, account, 1, pubSeed, progress);
+  const slot = chainSlot(chainId);
+  const g = grind(rekeyHasher(rnd, chainId, account, 0, slot, 0, tree.pubSeed, tree.root));
+  return { tree, cost: g.cost, calldata: encodeRekey(tree.pubSeed, tree.root, slot, 0, g.salt, rnd, identity.sign(slot, g.digest)) };
+}
+
+export function treeFromLeaves(skSeed, pubSeed, bytes) {
+  if (bytes.length !== LEAVES * N) throw new Error("stored key tree has the wrong size");
+  const leaves = [];
+  for (let i = 0; i < LEAVES; i++) leaves.push(bytes.slice(i * N, i * N + N));
+  return new EvmTreeKey(skSeed, pubSeed, leaves);
+}
+
+export function leavesBytes(tree) {
+  const out = new Uint8Array(LEAVES * N);
+  tree.levels[0].forEach((l, i) => out.set(l, i * N));
+  return out;
+}
+
+export function encodeErc20Transfer(to, amount) {
+  return concat(keccak256(enc.encode("transfer(address,uint256)")).slice(0, 4), addressWord(to), word(amount));
+}

package/src/lib/keccak.js

@@ -0,0 +1,165 @@
+const RC = new Int32Array([
+  0x00000001, 0x00000000, 0x00008082, 0x00000000, 0x0000808a, 0x80000000, 0x80008000, 0x80000000,
+  0x0000808b, 0x00000000, 0x80000001, 0x00000000, 0x80008081, 0x80000000, 0x00008009, 0x80000000,
+  0x0000008a, 0x00000000, 0x00000088, 0x00000000, 0x80008009, 0x00000000, 0x8000000a, 0x00000000,
+  0x8000808b, 0x00000000, 0x0000008b, 0x80000000, 0x00008089, 0x80000000, 0x00008003, 0x80000000,
+  0x00008002, 0x80000000, 0x00000080, 0x80000000, 0x0000800a, 0x00000000, 0x8000000a, 0x80000000,
+  0x80008081, 0x80000000, 0x00008080, 0x80000000, 0x80000001, 0x00000000, 0x80008008, 0x80000000,
+]);
+
+const S = new Int32Array(50);
+const RATE = 136;
+
+function permute() {
+  let a0l = S[0], a0h = S[1], a1l = S[2], a1h = S[3], a2l = S[4], a2h = S[5], a3l = S[6], a3h = S[7], a4l = S[8], a4h = S[9], a5l = S[10], a5h = S[11], a6l = S[12], a6h = S[13], a7l = S[14], a7h = S[15], a8l = S[16], a8h = S[17], a9l = S[18], a9h = S[19], a10l = S[20], a10h = S[21], a11l = S[22], a11h = S[23], a12l = S[24], a12h = S[25], a13l = S[26], a13h = S[27], a14l = S[28], a14h = S[29], a15l = S[30], a15h = S[31], a16l = S[32], a16h = S[33], a17l = S[34], a17h = S[35], a18l = S[36], a18h = S[37], a19l = S[38], a19h = S[39], a20l = S[40], a20h = S[41], a21l = S[42], a21h = S[43], a22l = S[44], a22h = S[45], a23l = S[46], a23h = S[47], a24l = S[48], a24h = S[49];
+  for (let round = 0; round < 48; round += 2) {
+    const c0l = a0l ^ a5l ^ a10l ^ a15l ^ a20l, c0h = a0h ^ a5h ^ a10h ^ a15h ^ a20h;
+    const c1l = a1l ^ a6l ^ a11l ^ a16l ^ a21l, c1h = a1h ^ a6h ^ a11h ^ a16h ^ a21h;
+    const c2l = a2l ^ a7l ^ a12l ^ a17l ^ a22l, c2h = a2h ^ a7h ^ a12h ^ a17h ^ a22h;
+    const c3l = a3l ^ a8l ^ a13l ^ a18l ^ a23l, c3h = a3h ^ a8h ^ a13h ^ a18h ^ a23h;
+    const c4l = a4l ^ a9l ^ a14l ^ a19l ^ a24l, c4h = a4h ^ a9h ^ a14h ^ a19h ^ a24h;
+    const d0l = c4l ^ ((c1l << 1) | (c1h >>> 31)), d0h = c4h ^ ((c1h << 1) | (c1l >>> 31));
+    const d1l = c0l ^ ((c2l << 1) | (c2h >>> 31)), d1h = c0h ^ ((c2h << 1) | (c2l >>> 31));
+    const d2l = c1l ^ ((c3l << 1) | (c3h >>> 31)), d2h = c1h ^ ((c3h << 1) | (c3l >>> 31));
+    const d3l = c2l ^ ((c4l << 1) | (c4h >>> 31)), d3h = c2h ^ ((c4h << 1) | (c4l >>> 31));
+    const d4l = c3l ^ ((c0l << 1) | (c0h >>> 31)), d4h = c3h ^ ((c0h << 1) | (c0l >>> 31));
+    const t0l = a0l ^ d0l, t0h = a0h ^ d0h;
+    const t1l = a1l ^ d1l, t1h = a1h ^ d1h;
+    const t2l = a2l ^ d2l, t2h = a2h ^ d2h;
+    const t3l = a3l ^ d3l, t3h = a3h ^ d3h;
+    const t4l = a4l ^ d4l, t4h = a4h ^ d4h;
+    const t5l = a5l ^ d0l, t5h = a5h ^ d0h;
+    const t6l = a6l ^ d1l, t6h = a6h ^ d1h;
+    const t7l = a7l ^ d2l, t7h = a7h ^ d2h;
+    const t8l = a8l ^ d3l, t8h = a8h ^ d3h;
+    const t9l = a9l ^ d4l, t9h = a9h ^ d4h;
+    const t10l = a10l ^ d0l, t10h = a10h ^ d0h;
+    const t11l = a11l ^ d1l, t11h = a11h ^ d1h;
+    const t12l = a12l ^ d2l, t12h = a12h ^ d2h;
+    const t13l = a13l ^ d3l, t13h = a13h ^ d3h;
+    const t14l = a14l ^ d4l, t14h = a14h ^ d4h;
+    const t15l = a15l ^ d0l, t15h = a15h ^ d0h;
+    const t16l = a16l ^ d1l, t16h = a16h ^ d1h;
+    const t17l = a17l ^ d2l, t17h = a17h ^ d2h;
+    const t18l = a18l ^ d3l, t18h = a18h ^ d3h;
+    const t19l = a19l ^ d4l, t19h = a19h ^ d4h;
+    const t20l = a20l ^ d0l, t20h = a20h ^ d0h;
+    const t21l = a21l ^ d1l, t21h = a21h ^ d1h;
+    const t22l = a22l ^ d2l, t22h = a22h ^ d2h;
+    const t23l = a23l ^ d3l, t23h = a23h ^ d3h;
+    const t24l = a24l ^ d4l, t24h = a24h ^ d4h;
+    const b0l = t0l, b0h = t0h;
+    const b10l = (t1l << 1) | (t1h >>> 31), b10h = (t1h << 1) | (t1l >>> 31);
+    const b20l = (t2h << 30) | (t2l >>> 2), b20h = (t2l << 30) | (t2h >>> 2);
+    const b5l = (t3l << 28) | (t3h >>> 4), b5h = (t3h << 28) | (t3l >>> 4);
+    const b15l = (t4l << 27) | (t4h >>> 5), b15h = (t4h << 27) | (t4l >>> 5);
+    const b16l = (t5h << 4) | (t5l >>> 28), b16h = (t5l << 4) | (t5h >>> 28);
+    const b1l = (t6h << 12) | (t6l >>> 20), b1h = (t6l << 12) | (t6h >>> 20);
+    const b11l = (t7l << 6) | (t7h >>> 26), b11h = (t7h << 6) | (t7l >>> 26);
+    const b21l = (t8h << 23) | (t8l >>> 9), b21h = (t8l << 23) | (t8h >>> 9);
+    const b6l = (t9l << 20) | (t9h >>> 12), b6h = (t9h << 20) | (t9l >>> 12);
+    const b7l = (t10l << 3) | (t10h >>> 29), b7h = (t10h << 3) | (t10l >>> 29);
+    const b17l = (t11l << 10) | (t11h >>> 22), b17h = (t11h << 10) | (t11l >>> 22);
+    const b2l = (t12h << 11) | (t12l >>> 21), b2h = (t12l << 11) | (t12h >>> 21);
+    const b12l = (t13l << 25) | (t13h >>> 7), b12h = (t13h << 25) | (t13l >>> 7);
+    const b22l = (t14h << 7) | (t14l >>> 25), b22h = (t14l << 7) | (t14h >>> 25);
+    const b23l = (t15h << 9) | (t15l >>> 23), b23h = (t15l << 9) | (t15h >>> 23);
+    const b8l = (t16h << 13) | (t16l >>> 19), b8h = (t16l << 13) | (t16h >>> 19);
+    const b18l = (t17l << 15) | (t17h >>> 17), b18h = (t17h << 15) | (t17l >>> 17);
+    const b3l = (t18l << 21) | (t18h >>> 11), b3h = (t18h << 21) | (t18l >>> 11);
+    const b13l = (t19l << 8) | (t19h >>> 24), b13h = (t19h << 8) | (t19l >>> 24);
+    const b14l = (t20l << 18) | (t20h >>> 14), b14h = (t20h << 18) | (t20l >>> 14);
+    const b24l = (t21l << 2) | (t21h >>> 30), b24h = (t21h << 2) | (t21l >>> 30);
+    const b9l = (t22h << 29) | (t22l >>> 3), b9h = (t22l << 29) | (t22h >>> 3);
+    const b19l = (t23h << 24) | (t23l >>> 8), b19h = (t23l << 24) | (t23h >>> 8);
+    const b4l = (t24l << 14) | (t24h >>> 18), b4h = (t24h << 14) | (t24l >>> 18);
+    a0l = b0l ^ (~b1l & b2l); a0h = b0h ^ (~b1h & b2h);
+    a1l = b1l ^ (~b2l & b3l); a1h = b1h ^ (~b2h & b3h);
+    a2l = b2l ^ (~b3l & b4l); a2h = b2h ^ (~b3h & b4h);
+    a3l = b3l ^ (~b4l & b0l); a3h = b3h ^ (~b4h & b0h);
+    a4l = b4l ^ (~b0l & b1l); a4h = b4h ^ (~b0h & b1h);
+    a5l = b5l ^ (~b6l & b7l); a5h = b5h ^ (~b6h & b7h);
+    a6l = b6l ^ (~b7l & b8l); a6h = b6h ^ (~b7h & b8h);
+    a7l = b7l ^ (~b8l & b9l); a7h = b7h ^ (~b8h & b9h);
+    a8l = b8l ^ (~b9l & b5l); a8h = b8h ^ (~b9h & b5h);
+    a9l = b9l ^ (~b5l & b6l); a9h = b9h ^ (~b5h & b6h);
+    a10l = b10l ^ (~b11l & b12l); a10h = b10h ^ (~b11h & b12h);
+    a11l = b11l ^ (~b12l & b13l); a11h = b11h ^ (~b12h & b13h);
+    a12l = b12l ^ (~b13l & b14l); a12h = b12h ^ (~b13h & b14h);
+    a13l = b13l ^ (~b14l & b10l); a13h = b13h ^ (~b14h & b10h);
+    a14l = b14l ^ (~b10l & b11l); a14h = b14h ^ (~b10h & b11h);
+    a15l = b15l ^ (~b16l & b17l); a15h = b15h ^ (~b16h & b17h);
+    a16l = b16l ^ (~b17l & b18l); a16h = b16h ^ (~b17h & b18h);
+    a17l = b17l ^ (~b18l & b19l); a17h = b17h ^ (~b18h & b19h);
+    a18l = b18l ^ (~b19l & b15l); a18h = b18h ^ (~b19h & b15h);
+    a19l = b19l ^ (~b15l & b16l); a19h = b19h ^ (~b15h & b16h);
+    a20l = b20l ^ (~b21l & b22l); a20h = b20h ^ (~b21h & b22h);
+    a21l = b21l ^ (~b22l & b23l); a21h = b21h ^ (~b22h & b23h);
+    a22l = b22l ^ (~b23l & b24l); a22h = b22h ^ (~b23h & b24h);
+    a23l = b23l ^ (~b24l & b20l); a23h = b23h ^ (~b24h & b20h);
+    a24l = b24l ^ (~b20l & b21l); a24h = b24h ^ (~b20h & b21h);
+    a0l ^= RC[round]; a0h ^= RC[round + 1];
+  }
+  S[0] = a0l; S[1] = a0h;
+  S[2] = a1l; S[3] = a1h;
+  S[4] = a2l; S[5] = a2h;
+  S[6] = a3l; S[7] = a3h;
+  S[8] = a4l; S[9] = a4h;
+  S[10] = a5l; S[11] = a5h;
+  S[12] = a6l; S[13] = a6h;
+  S[14] = a7l; S[15] = a7h;
+  S[16] = a8l; S[17] = a8h;
+  S[18] = a9l; S[19] = a9h;
+  S[20] = a10l; S[21] = a10h;
+  S[22] = a11l; S[23] = a11h;
+  S[24] = a12l; S[25] = a12h;
+  S[26] = a13l; S[27] = a13h;
+  S[28] = a14l; S[29] = a14h;
+  S[30] = a15l; S[31] = a15h;
+  S[32] = a16l; S[33] = a16h;
+  S[34] = a17l; S[35] = a17h;
+  S[36] = a18l; S[37] = a18h;
+  S[38] = a19l; S[39] = a19h;
+  S[40] = a20l; S[41] = a20h;
+  S[42] = a21l; S[43] = a21h;
+  S[44] = a22l; S[45] = a22h;
+  S[46] = a23l; S[47] = a23h;
+  S[48] = a24l; S[49] = a24h;
+}
+
+function absorbByte(pos, v) {
+  const lane = pos >> 3, k = pos & 7;
+  if (k < 4) S[2 * lane] ^= v << (8 * k);
+  else S[2 * lane + 1] ^= v << (8 * (k - 4));
+}
+
+export function keccak256(...parts) {
+  S.fill(0);
+  let pos = 0;
+  for (const part of parts) {
+    let i = 0;
+    const n = part.length;
+    while (i < n) {
+      if ((pos & 3) === 0 && i + 4 <= n && pos + 4 <= RATE) {
+        const w = part[i] | (part[i + 1] << 8) | (part[i + 2] << 16) | (part[i + 3] << 24);
+        S[pos >> 2] ^= w;
+        i += 4;
+        pos += 4;
+      } else {
+        absorbByte(pos, part[i]);
+        i++;
+        pos++;
+      }
+      if (pos === RATE) { permute(); pos = 0; }
+    }
+  }
+  absorbByte(pos, 0x01);
+  absorbByte(RATE - 1, 0x80);
+  permute();
+  const out = new Uint8Array(32);
+  for (let i = 0; i < 32; i++) {
+    const lane = i >> 3, k = i & 7;
+    out[i] = (k < 4 ? S[2 * lane] >>> (8 * k) : S[2 * lane + 1] >>> (8 * (k - 4))) & 0xff;
+  }
+  return out;
+}

package/src/lib/mnemonic.js

@@ -0,0 +1,80 @@
+import { sha256 } from "./sha256.js";
+import { WORDS } from "./wordlist.js";
+import { N, TreeKey } from "./wots.js";
+
+const INDEX = new Map(WORDS.map((w, i) => [w, i]));
+
+export function newMaster() {
+  return crypto.getRandomValues(new Uint8Array(32));
+}
+
+export function toWords(entropy) {
+  if (entropy.length !== 32) throw new Error("master seed must be 32 bytes");
+  let bits = 0n;
+  for (const b of entropy) bits = (bits << 8n) | BigInt(b);
+  bits = (bits << 8n) | BigInt(sha256(entropy)[0]);
+  const words = [];
+  for (let i = 0; i < 24; i++) words.push(WORDS[Number((bits >> BigInt(11 * (23 - i))) & 0x7ffn)]);
+  return words;
+}
+
+export function fromWords(text) {
+  const words = text.toLowerCase().split(/[^a-z]+/).filter(Boolean);
+  if (words.length !== 24) throw new Error(`expected 24 words, got ${words.length}`);
+  let bits = 0n;
+  for (let w of words) {
+    if (!INDEX.has(w)) {
+      const m = w.length >= 4 ? WORDS.filter((x) => x.startsWith(w.slice(0, 4))) : [];
+      if (m.length !== 1) throw new Error(`unknown word: ${w}`);
+      w = m[0];
+    }
+    bits = (bits << 11n) | BigInt(INDEX.get(w));
+  }
+  const entropy = new Uint8Array(32);
+  let e = bits >> 8n;
+  for (let i = 31; i >= 0; i--) { entropy[i] = Number(e & 0xffn); e >>= 8n; }
+  if (Number(bits & 0xffn) !== sha256(entropy)[0]) throw new Error("checksum mismatch: a word is wrong or out of order");
+  return entropy;
+}
+
+function epochBytes(epoch) {
+  return new Uint8Array([epoch & 0xff, (epoch >>> 8) & 0xff, (epoch >>> 16) & 0xff, epoch >>> 24]);
+}
+
+const enc = new TextEncoder();
+
+export const LEGACY_PROGRAM = "424ckcA6GGswYmQbrGjQmzdfhk4G9eB2zD1gK8xLw7sN";
+const LEGACY_KEY = new Uint8Array([44, 216, 187, 13, 164, 190, 62, 155, 179, 6, 213, 191, 6, 217, 96, 213, 232, 64, 39, 146, 16, 203, 155, 85, 10, 188, 52, 192, 39, 183, 52, 1]);
+
+export function isLegacy(program) {
+  if (!(program instanceof Uint8Array) || program.length !== 32) throw new Error("tree derivation needs the 32-byte program id");
+  return program.every((b, i) => b === LEGACY_KEY[i]);
+}
+
+export function chainSeeded(program, epoch) {
+  return !isLegacy(program) && epoch > 0;
+}
+
+export function treeSeeds(master, epoch, program, pubSeed) {
+  if (!Number.isInteger(epoch) || epoch < 0 || epoch > 0xffffffff) throw new Error("epoch out of range");
+  const e = epochBytes(epoch);
+  if (chainSeeded(program, epoch)) {
+    if (!(pubSeed instanceof Uint8Array) || pubSeed.length !== N) throw new Error("this key tree needs its 16-byte public seed from the chain");
+    return { skSeed: sha256(enc.encode("opeq/tree/sk/v3"), program, master, e, pubSeed), pubSeed: pubSeed.slice() };
+  }
+  if (isLegacy(program)) {
+    return {
+      skSeed: sha256(enc.encode("opeq/tree/sk/v1"), master, e),
+      pubSeed: sha256(enc.encode("opeq/tree/pub/v1"), master, e).slice(0, N),
+    };
+  }
+  return {
+    skSeed: sha256(enc.encode("opeq/tree/sk/v2"), program, master, e),
+    pubSeed: sha256(enc.encode("opeq/tree/pub/v2"), program, master, e).slice(0, N),
+  };
+}
+
+export function deriveTree(master, epoch, progress, program, pubSeed) {
+  const { skSeed, pubSeed: ps } = treeSeeds(master, epoch, program, pubSeed);
+  return TreeKey.generate(skSeed, ps, progress);
+}