@protontech/openpgp 6.0.0-beta.0.patch.0 → 6.0.0-beta.2

package/dist/lightweight/sha3.mjs

@@ -1,30 +1,26 @@
-/*! OpenPGP.js v6.0.0-beta.0.patch.0 - 2024-04-19 - this is LGPL licensed code, see LICENSE/our website https://openpgpjs.org/ for more information. */
+/*! OpenPGP.js v6.0.0-beta.2 - 2024-07-05 - this is LGPL licensed code, see LICENSE/our website https://openpgpjs.org/ for more information. */
 const globalThis = typeof window !== 'undefined' ? window : typeof global !== 'undefined' ? global : typeof self !== 'undefined' ? self : {};
 
-import { B as BigInteger } from './interface.mjs';
-import NativeBigInteger from './native.interface.mjs';
-import BNBigInteger from './bn.interface.mjs';
-
 function number(n) {
     if (!Number.isSafeInteger(n) || n < 0)
-        throw new Error(`Wrong positive integer: ${n}`);
+        throw new Error(`positive integer expected, not ${n}`);
 }
 // copied from utils
-function isBytes$1(a) {
+function isBytes(a) {
     return (a instanceof Uint8Array ||
         (a != null && typeof a === 'object' && a.constructor.name === 'Uint8Array'));
 }
 function bytes(b, ...lengths) {
-    if (!isBytes$1(b))
-        throw new Error('Expected Uint8Array');
+    if (!isBytes(b))
+        throw new Error('Uint8Array expected');
     if (lengths.length > 0 && !lengths.includes(b.length))
-        throw new Error(`Expected Uint8Array of length ${lengths}, not of length=${b.length}`);
+        throw new Error(`Uint8Array expected of length ${lengths}, not of length=${b.length}`);
 }
-function hash(hash) {
-    if (typeof hash !== 'function' || typeof hash.create !== 'function')
+function hash(h) {
+    if (typeof h !== 'function' || typeof h.create !== 'function')
         throw new Error('Hash should be wrapped by utils.wrapConstructor');
-    number(hash.outputLen);
-    number(hash.blockLen);
+    number(h.outputLen);
+    number(h.blockLen);
 }
 function exists(instance, checkFinished = true) {
     if (instance.destroyed)
@@ -40,7 +36,6 @@ function output(out, instance) {
     }
 }
 
-// declare const globalThis: Record<string, any> | undefined;
 const crypto = typeof globalThis === 'object' && 'crypto' in globalThis ? globalThis.crypto : undefined;
 
 /*! noble-hashes - MIT License (c) 2022 Paul Miller (paulmillr.com) */
@@ -51,21 +46,24 @@ const crypto = typeof globalThis === 'object' && 'crypto' in globalThis ? global
 // Makes the utils un-importable in browsers without a bundler.
 // Once node.js 18 is deprecated (2025-04-30), we can just drop the import.
 const u32 = (arr) => new Uint32Array(arr.buffer, arr.byteOffset, Math.floor(arr.byteLength / 4));
-function isBytes(a) {
-    return (a instanceof Uint8Array ||
-        (a != null && typeof a === 'object' && a.constructor.name === 'Uint8Array'));
-}
 // Cast array to view
 const createView = (arr) => new DataView(arr.buffer, arr.byteOffset, arr.byteLength);
 // The rotate right (circular right shift) operation for uint32
 const rotr = (word, shift) => (word << (32 - shift)) | (word >>> shift);
-// big-endian hardware is rare. Just in case someone still decides to run hashes:
-// early-throw an error because we don't support BE yet.
-// Other libraries would silently corrupt the data instead of throwing an error,
-// when they don't support it.
+// The rotate left (circular left shift) operation for uint32
+const rotl = (word, shift) => (word << shift) | ((word >>> (32 - shift)) >>> 0);
 const isLE = new Uint8Array(new Uint32Array([0x11223344]).buffer)[0] === 0x44;
-if (!isLE)
-    throw new Error('Non little-endian hardware is not supported');
+// The byte swap operation for uint32
+const byteSwap = (word) => ((word << 24) & 0xff000000) |
+    ((word << 8) & 0xff0000) |
+    ((word >>> 8) & 0xff00) |
+    ((word >>> 24) & 0xff);
+// In place byte swap for Uint32Array
+function byteSwap32(arr) {
+    for (let i = 0; i < arr.length; i++) {
+        arr[i] = byteSwap(arr[i]);
+    }
+}
 /**
  * @example utf8ToBytes('abc') // new Uint8Array([97, 98, 99])
  */
@@ -82,8 +80,7 @@ function utf8ToBytes(str) {
 function toBytes(data) {
     if (typeof data === 'string')
         data = utf8ToBytes(data);
-    if (!isBytes(data))
-        throw new Error(`expected Uint8Array, got ${typeof data}`);
+    bytes(data);
     return data;
 }
 /**
@@ -93,8 +90,7 @@ function concatBytes(...arrays) {
     let sum = 0;
     for (let i = 0; i < arrays.length; i++) {
         const a = arrays[i];
-        if (!isBytes(a))
-            throw new Error('Uint8Array expected');
+        bytes(a);
         sum += a.length;
     }
     const res = new Uint8Array(sum);
@@ -138,26 +134,28 @@ function randomBytes(bytesLength = 32) {
     throw new Error('crypto.getRandomValues must be defined');
 }
 
-const detectBigInt = () => typeof BigInt !== 'undefined';
-BigInteger.setImplementation(detectBigInt() ? NativeBigInteger : BNBigInteger);
-// About BigInteger interface and bigint replacement:
-// - some functions get a bigint and change its value without reassingment (eg i++). Note that with BigIntegers, you must clone the value before doing so!!!
-
-// Polyfill for Safari <= 14
+// Polyfill for Safari 14
 function setBigUint64(view, byteOffset, value, isLE) {
     if (typeof view.setBigUint64 === 'function')
-        return view.setBigUint64(byteOffset, BigInt(value.toString()), isLE);
-    const _32n = Object.freeze(BigInteger.new(32));
-    const _u32_max = Object.freeze(BigInteger.new(0xffffffff));
-    const wh = value.rightShift(_32n).bitwiseAnd(_u32_max).toNumber();
-    const wl = value.bitwiseAnd(_u32_max).toNumber();
+        return view.setBigUint64(byteOffset, value, isLE);
+    const _32n = BigInt(32);
+    const _u32_max = BigInt(0xffffffff);
+    const wh = Number((value >> _32n) & _u32_max);
+    const wl = Number(value & _u32_max);
     const h = isLE ? 4 : 0;
     const l = isLE ? 0 : 4;
     view.setUint32(byteOffset + h, wh, isLE);
     view.setUint32(byteOffset + l, wl, isLE);
 }
-// Base SHA2 class (RFC 6234)
-class SHA2 extends Hash {
+// Choice: a ? b : c
+const Chi = (a, b, c) => (a & b) ^ (~a & c);
+// Majority function, true if any two inpust is true
+const Maj = (a, b, c) => (a & b) ^ (a & c) ^ (b & c);
+/**
+ * Merkle-Damgard hash construction base class.
+ * Could be used to create MD5, RIPEMD, SHA1, SHA2.
+ */
+class HashMD extends Hash {
     constructor(blockLen, outputLen, padOffset, isLE) {
         super();
         this.blockLen = blockLen;
@@ -209,7 +207,8 @@ class SHA2 extends Hash {
         // append the bit '1' to the message
         buffer[pos++] = 0b10000000;
         this.buffer.subarray(pos).fill(0);
-        // we have less than padOffset left in buffer, so we cannot put length in current block, need process it and pad again
+        // we have less than padOffset left in buffer, so we cannot put length in
+        // current block, need process it and pad again
         if (this.padOffset > blockLen - pos) {
             this.process(view, 0);
             pos = 0;
@@ -220,7 +219,7 @@ class SHA2 extends Hash {
         // Note: sha512 requires length to be 128bit integer, but length in JS will overflow before that
         // You need to write around 2 exabytes (u64_max / 8 / (1024**6)) for this to happen.
         // So we just write lowest 64 bits of that value.
-        setBigUint64(view, blockLen - 8, BigInteger.new(this.length * 8), isLE);
+        setBigUint64(view, blockLen - 8, BigInt(this.length * 8), isLE);
         this.process(view, 0);
         const oview = createView(out);
         const len = this.outputLen;
@@ -257,10 +256,6 @@ class SHA2 extends Hash {
 
 // SHA2-256 need to try 2^128 hashes to execute birthday attack.
 // BTC network is doing 2^67 hashes/sec as per early 2023.
-// Choice: a ? b : c
-const Chi = (a, b, c) => (a & b) ^ (~a & c);
-// Majority function, true if any two inpust is true
-const Maj = (a, b, c) => (a & b) ^ (a & c) ^ (b & c);
 // Round constants:
 // first 32 bits of the fractional parts of the cube roots of the first 64 primes 2..311)
 // prettier-ignore
@@ -274,27 +269,28 @@ const SHA256_K = /* @__PURE__ */ new Uint32Array([
     0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
     0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
 ]);
-// Initial state (first 32 bits of the fractional parts of the square roots of the first 8 primes 2..19):
+// Initial state:
+// first 32 bits of the fractional parts of the square roots of the first 8 primes 2..19
 // prettier-ignore
-const IV = /* @__PURE__ */ new Uint32Array([
+const SHA256_IV = /* @__PURE__ */ new Uint32Array([
     0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19
 ]);
 // Temporary buffer, not used to store anything between runs
 // Named this way because it matches specification.
 const SHA256_W = /* @__PURE__ */ new Uint32Array(64);
-class SHA256 extends SHA2 {
+class SHA256 extends HashMD {
     constructor() {
         super(64, 32, 8, false);
         // We cannot use array here since array allows indexing by variable
         // which means optimizer/compiler cannot use registers.
-        this.A = IV[0] | 0;
-        this.B = IV[1] | 0;
-        this.C = IV[2] | 0;
-        this.D = IV[3] | 0;
-        this.E = IV[4] | 0;
-        this.F = IV[5] | 0;
-        this.G = IV[6] | 0;
-        this.H = IV[7] | 0;
+        this.A = SHA256_IV[0] | 0;
+        this.B = SHA256_IV[1] | 0;
+        this.C = SHA256_IV[2] | 0;
+        this.D = SHA256_IV[3] | 0;
+        this.E = SHA256_IV[4] | 0;
+        this.F = SHA256_IV[5] | 0;
+        this.G = SHA256_IV[6] | 0;
+        this.H = SHA256_IV[7] | 0;
     }
     get() {
         const { A, B, C, D, E, F, G, H } = this;
@@ -379,13 +375,13 @@ class SHA224 extends SHA256 {
 const sha256 = /* @__PURE__ */ wrapConstructor(() => new SHA256());
 const sha224 = /* @__PURE__ */ wrapConstructor(() => new SHA224());
 
-const U32_MASK64 = Object.freeze(BigInteger.new(2 ** 32 - 1));
-const _32n = Object.freeze(BigInteger.new(32));
+const U32_MASK64 = /* @__PURE__ */ BigInt(2 ** 32 - 1);
+const _32n = /* @__PURE__ */ BigInt(32);
 // We are not using BigUint64Array, because they are extremely slow as per 2022
 function fromBig(n, le = false) {
     if (le)
-        return { h: n.bitwiseAnd(U32_MASK64).toNumber(), l: n.rightShift(_32n).bitwiseAnd(U32_MASK64).toNumber() };
-    return { h: n.rightShift(_32n).bitwiseAnd(U32_MASK64).toNumber() | 0, l: n.bitwiseAnd(U32_MASK64).toNumber() | 0 };
+        return { h: Number(n & U32_MASK64), l: Number((n >> _32n) & U32_MASK64) };
+    return { h: Number((n >> _32n) & U32_MASK64) | 0, l: Number(n & U32_MASK64) | 0 };
 }
 function split(lst, le = false) {
     let Ah = new Uint32Array(lst.length);
@@ -396,9 +392,7 @@ function split(lst, le = false) {
     }
     return [Ah, Al];
 }
-const toBig = (h, l) => (BigInteger.new(h >>> 0)
-    .ileftShift(_32n)
-    .ibitwiseOr(BigInteger.new(l >>> 0)));
+const toBig = (h, l) => (BigInt(h >>> 0) << _32n) | BigInt(l >>> 0);
 // for Shift in [0, 32)
 const shrSH = (h, _l, s) => h >>> s;
 const shrSL = (h, l, s) => (h << (32 - s)) | (l >>> s);
@@ -463,11 +457,11 @@ const [SHA512_Kh, SHA512_Kl] = /* @__PURE__ */ (() => u64.split([
     '0x06f067aa72176fba', '0x0a637dc5a2c898a6', '0x113f9804bef90dae', '0x1b710b35131c471b',
     '0x28db77f523047d84', '0x32caab7b40c72493', '0x3c9ebe0a15c9bebc', '0x431d67c49c100d4c',
     '0x4cc5d4becb3e42b6', '0x597f299cfc657e2a', '0x5fcb6fab3ad6faec', '0x6c44198c4a475817'
-].map(n => BigInteger.new(n))))();
+].map(n => BigInt(n))))();
 // Temporary buffer, not used to store anything between runs
 const SHA512_W_H = /* @__PURE__ */ new Uint32Array(80);
 const SHA512_W_L = /* @__PURE__ */ new Uint32Array(80);
-class SHA512 extends SHA2 {
+class SHA512 extends HashMD {
     constructor() {
         super(128, 64, 16, false);
         // We cannot use array here since array allows indexing by variable which means optimizer/compiler cannot use registers.
@@ -623,13 +617,15 @@ const sha384 = /* @__PURE__ */ wrapConstructor(() => new SHA384());
 // SHA3 (keccak) is based on a new design: basically, the internal state is bigger than output size.
 // It's called a sponge function.
 // Various per round constants calculations
-const [SHA3_PI, SHA3_ROTL, _SHA3_IOTA] = [[], [], []];
-const _0n = /* @__PURE__ */ Object.freeze(BigInteger.new(0));
-const _1n = /* @__PURE__ */ Object.freeze(BigInteger.new(1));
-const _2n = /* @__PURE__ */ Object.freeze(BigInteger.new(2));
-const _7n = /* @__PURE__ */ Object.freeze(BigInteger.new(7));
-const _256n = /* @__PURE__ */ Object.freeze(BigInteger.new(256));
-const _0x71n = /* @__PURE__ */ Object.freeze(BigInteger.new(0x71));
+const SHA3_PI = [];
+const SHA3_ROTL = [];
+const _SHA3_IOTA = [];
+const _0n = /* @__PURE__ */ BigInt(0);
+const _1n = /* @__PURE__ */ BigInt(1);
+const _2n = /* @__PURE__ */ BigInt(2);
+const _7n = /* @__PURE__ */ BigInt(7);
+const _256n = /* @__PURE__ */ BigInt(256);
+const _0x71n = /* @__PURE__ */ BigInt(0x71);
 for (let round = 0, R = _1n, x = 1, y = 0; round < 24; round++) {
     // Pi
     [x, y] = [y, (2 * x + 3 * y) % 5];
@@ -637,11 +633,11 @@ for (let round = 0, R = _1n, x = 1, y = 0; round < 24; round++) {
     // Rotational
     SHA3_ROTL.push((((round + 1) * (round + 2)) / 2) % 64);
     // Iota
-    const t = _0n.clone();
+    let t = _0n;
     for (let j = 0; j < 7; j++) {
-        R = R.leftShift(_1n).ixor(R.rightShift(_7n).imul(_0x71n)).imod(_256n);
-        if (!R.bitwiseAnd(_2n).isZero())
-            t.ixor(_1n.leftShift(_1n.leftShift(/* @__PURE__ */ BigInteger.new(j)).idec()));
+        R = ((R << _1n) ^ ((R >> _7n) * _0x71n)) % _256n;
+        if (R & _2n)
+            t ^= _1n << ((_1n << /* @__PURE__ */ BigInt(j)) - _1n);
     }
     _SHA3_IOTA.push(t);
 }
@@ -717,7 +713,11 @@ class Keccak extends Hash {
         this.state32 = u32(this.state);
     }
     keccak() {
+        if (!isLE)
+            byteSwap32(this.state32);
         keccakP(this.state32, this.rounds);
+        if (!isLE)
+            byteSwap32(this.state32);
         this.posOut = 0;
         this.pos = 0;
     }
@@ -814,4 +814,4 @@ const sha3_512 = /* @__PURE__ */ gen(0x06, 72, 512 / 8);
 const genShake = (suffix, blockLen, outputLen) => wrapXOFConstructorWithOpts((opts = {}) => new Keccak(blockLen, suffix, opts.dkLen === undefined ? outputLen : opts.dkLen, true));
 const shake256 = /* @__PURE__ */ genShake(0x1f, 136, 256 / 8);
 
-export { Hash as H, SHA2 as S, sha384 as a, bytes as b, concatBytes as c, sha512 as d, exists as e, shake256 as f, sha224 as g, hash as h, sha3_256 as i, sha3_512 as j, randomBytes as r, sha256 as s, toBytes as t, utf8ToBytes as u, wrapConstructor as w };
+export { Chi as C, Hash as H, Maj as M, sha384 as a, bytes as b, concatBytes as c, sha512 as d, exists as e, shake256 as f, HashMD as g, hash as h, rotl as i, sha224 as j, sha3_256 as k, sha3_512 as l, randomBytes as r, sha256 as s, toBytes as t, utf8ToBytes as u, wrapConstructor as w };