@protontech/openpgp 6.0.0-beta.0.patch.0 → 6.0.0-beta.2

package/dist/lightweight/noble_curves.mjs

@@ -1,10 +1,7 @@
-/*! OpenPGP.js v6.0.0-beta.0.patch.0 - 2024-04-19 - this is LGPL licensed code, see LICENSE/our website https://openpgpjs.org/ for more information. */
+/*! OpenPGP.js v6.0.0-beta.2 - 2024-07-05 - this is LGPL licensed code, see LICENSE/our website https://openpgpjs.org/ for more information. */
 const globalThis = typeof window !== 'undefined' ? window : typeof global !== 'undefined' ? global : typeof self !== 'undefined' ? self : {};
 
 import { H as Hash, h as hash, t as toBytes, e as exists, b as bytes, c as concatBytes$1, r as randomBytes, s as sha256, a as sha384, d as sha512, w as wrapConstructor, u as utf8ToBytes$1, f as shake256 } from './sha3.mjs';
-import { B as BigInteger } from './interface.mjs';
-import './native.interface.mjs';
-import './bn.interface.mjs';
 
 // HMAC (RFC 2104)
 class HMAC extends Hash {
@@ -81,25 +78,29 @@ class HMAC extends Hash {
 const hmac = (hash, key, message) => new HMAC(hash, key).update(message).digest();
 hmac.create = (hash, key) => new HMAC(hash, key);
 
-// TODOOOOOO use noble-hashes utils instead
 /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
 // 100 lines of code in the file are duplicated from noble-hashes (utils).
 // This is OK: `abstract` directory does not use noble-hashes.
 // User may opt-in into using different hashing library. This way, noble-hashes
 // won't be included into their bundle.
-const _2n$5 = Object.freeze(BigInteger.new(2));
+const _0n$5 = BigInt(0);
+const _1n$7 = BigInt(1);
+const _2n$4 = BigInt(2);
 function isBytes(a) {
     return (a instanceof Uint8Array ||
         (a != null && typeof a === 'object' && a.constructor.name === 'Uint8Array'));
 }
+function abytes(item) {
+    if (!isBytes(item))
+        throw new Error('Uint8Array expected');
+}
 // Array where index 0xf0 (240) is mapped to string 'f0'
 const hexes = /* @__PURE__ */ Array.from({ length: 256 }, (_, i) => i.toString(16).padStart(2, '0'));
 /**
  * @example bytesToHex(Uint8Array.from([0xca, 0xfe, 0x01, 0x23])) // 'cafe0123'
  */
 function bytesToHex(bytes) {
-    if (!isBytes(bytes))
-        throw new Error('Uint8Array expected');
+    abytes(bytes);
     // pre-caching improves the speed 6x
     let hex = '';
     for (let i = 0; i < bytes.length; i++) {
@@ -108,14 +109,14 @@ function bytesToHex(bytes) {
     return hex;
 }
 function numberToHexUnpadded(num) {
-    const hex = num instanceof BigInteger ? bytesToHex(num.toUint8Array()) : num.toString(16);
+    const hex = num.toString(16);
     return hex.length & 1 ? `0${hex}` : hex;
 }
 function hexToNumber(hex) {
     if (typeof hex !== 'string')
         throw new Error('hex string expected, got ' + typeof hex);
     // Big Endian
-    return BigInteger.new(hex === '' ? '0' : `0x${hex}`);
+    return BigInt(hex === '' ? '0' : `0x${hex}`);
 }
 // We use optimized technique to convert hex string to byte array
 const asciis = { _0: 48, _9: 57, _A: 65, _F: 70, _a: 97, _f: 102 };
@@ -152,20 +153,19 @@ function hexToBytes(hex) {
 }
 // BE: Big Endian, LE: Little Endian
 function bytesToNumberBE(bytes) {
-    return BigInteger.new(bytes);
+    return hexToNumber(bytesToHex(bytes));
 }
 function bytesToNumberLE(bytes) {
-    if (!isBytes(bytes))
-        throw new Error('Uint8Array expected');
-    return BigInteger.new(bytes.slice().reverse()); // reverse() is in place
+    abytes(bytes);
+    return hexToNumber(bytesToHex(Uint8Array.from(bytes).reverse()));
 }
 function numberToBytesBE(n, len) {
-    return n.toUint8Array('be', len);
+    return hexToBytes(n.toString(16).padStart(len * 2, '0'));
 }
 function numberToBytesLE(n, len) {
-    return n.toUint8Array('le', len);
+    return numberToBytesBE(n, len).reverse();
 }
-// Returns variable number bytes (minimal bigint encoding?)
+// Unpadded, rarely used
 function numberToVarBytesBE(n) {
     return hexToBytes(numberToHexUnpadded(n));
 }
@@ -191,7 +191,7 @@ function ensureBytes(title, hex, expectedLength) {
     else if (isBytes(hex)) {
         // Uint8Array.from() instead of hash.slice() because node.js Buffer
         // is instance of Uint8Array, and its slice() creates **mutable** copy
-        res = new Uint8Array(hex);
+        res = Uint8Array.from(hex);
     }
     else {
         throw new Error(`${title} must be hex string or Uint8Array`);
@@ -208,13 +208,11 @@ function concatBytes(...arrays) {
     let sum = 0;
     for (let i = 0; i < arrays.length; i++) {
         const a = arrays[i];
-        if (!isBytes(a))
-            throw new Error('Uint8Array expected');
+        abytes(a);
         sum += a.length;
     }
-    let res = new Uint8Array(sum);
-    let pad = 0;
-    for (let i = 0; i < arrays.length; i++) {
+    const res = new Uint8Array(sum);
+    for (let i = 0, pad = 0; i < arrays.length; i++) {
         const a = arrays[i];
         res.set(a, pad);
         pad += a.length;
@@ -244,27 +242,30 @@ function utf8ToBytes(str) {
  * Same as `n.toString(2).length`
  */
 function bitLen(n) {
-    return n.bitLength();
+    let len;
+    for (len = 0; n > _0n$5; n >>= _1n$7, len += 1)
+        ;
+    return len;
 }
 /**
  * Gets single bit at position.
  * NOTE: first bit position is 0 (same as arrays)
  * Same as `!!+Array.from(n.toString(2)).reverse()[pos]`
  */
-const bitGet = (n, pos) => n.getBit(pos);
+function bitGet(n, pos) {
+    return (n >> BigInt(pos)) & _1n$7;
+}
 /**
  * Sets single bit at position.
  */
-// @ts-ignore unused params
-const bitSet = (n, pos, value) => {
-    throw new Error('unsupported bitSet');
-    // return n | ((value ? _1n : _0n) << BigInt(pos));
-};
+function bitSet(n, pos, value) {
+    return n | ((value ? _1n$7 : _0n$5) << BigInt(pos));
+}
 /**
  * Calculate mask for N bits. Not using ** operator with bigints because of old engines.
  * Same as BigInt(`0b${Array(i).fill('1').join('')}`)
  */
-const bitMask = (n) => (_2n$5.leftShift(BigInteger.new(n - 1))).idec();
+const bitMask = (n) => (_2n$4 << BigInt(n - 1)) - _1n$7;
 // DRBG
 const u8n = (data) => new Uint8Array(data); // creates Uint8Array
 const u8fr = (arr) => Uint8Array.from(arr); // another shortcut
@@ -328,7 +329,7 @@ function createHmacDrbg(hashLen, qByteLen, hmacFn) {
 }
 // Validating curves and fields
 const validatorFns = {
-    BigInteger: (val) => val instanceof BigInteger,
+    bigint: (val) => typeof val === 'bigint',
     function: (val) => typeof val === 'function',
     boolean: (val) => typeof val === 'boolean',
     string: (val) => typeof val === 'string',
@@ -342,9 +343,8 @@ const validatorFns = {
 function validateObject(object, validators, optValidators = {}) {
     const checkField = (fieldName, type, isOptional) => {
         const checkVal = validatorFns[type];
-        if (typeof checkVal !== 'function') {
+        if (typeof checkVal !== 'function')
             throw new Error(`Invalid validator "${type}", expected function`);
-        }
         const val = object[fieldName];
         if (isOptional && val === undefined)
             return;
@@ -369,6 +369,7 @@ function validateObject(object, validators, optValidators = {}) {
 
 var ut = /*#__PURE__*/Object.freeze({
     __proto__: null,
+    abytes: abytes,
     bitGet: bitGet,
     bitLen: bitLen,
     bitMask: bitMask,
@@ -393,18 +394,16 @@ var ut = /*#__PURE__*/Object.freeze({
 
 /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
 // Utilities for modular arithmetics and finite fields
-const _0n$4 = Object.freeze(BigInteger.new(0));
-const _1n$6 = Object.freeze(BigInteger.new(1));
-const _2n$4 = Object.freeze(BigInteger.new(2));
-const _3n$3 = Object.freeze(BigInteger.new(3));
-const _4n = Object.freeze(BigInteger.new(4));
-const _5n = Object.freeze(BigInteger.new(5));
-const _8n$1 = Object.freeze(BigInteger.new(8));
-const _9n = Object.freeze(BigInteger.new(9));
-const _16n = Object.freeze(BigInteger.new(16));
+// prettier-ignore
+const _0n$4 = BigInt(0), _1n$6 = BigInt(1), _2n$3 = BigInt(2), _3n$2 = BigInt(3);
+// prettier-ignore
+const _4n = BigInt(4), _5n = BigInt(5), _8n$1 = BigInt(8);
+// prettier-ignore
+BigInt(9); BigInt(16);
 // Calculates a modulo b
 function mod(a, b) {
-    return a.mod(b);
+    const result = a % b;
+    return result >= _0n$4 ? result : b + result;
 }
 /**
  * Efficiently raise num to power and do modular division.
@@ -414,29 +413,51 @@ function mod(a, b) {
  */
 // TODO: use field version && remove
 function pow(num, power, modulo) {
-    // if (modulo <= _0n || power < _0n) throw new Error('Expected power/modulo > 0');
-    // if (modulo === _1n) return _0n;
-    // let res = _1n;
-    // while (power > _0n) {
-    //   if (power & _1n) res = (res * num) % modulo;
-    //   num = (num * num) % modulo;
-    //   power >>= _1n;
-    // }
-    return num.modExp(power, modulo);
+    if (modulo <= _0n$4 || power < _0n$4)
+        throw new Error('Expected power/modulo > 0');
+    if (modulo === _1n$6)
+        return _0n$4;
+    let res = _1n$6;
+    while (power > _0n$4) {
+        if (power & _1n$6)
+            res = (res * num) % modulo;
+        num = (num * num) % modulo;
+        power >>= _1n$6;
+    }
+    return res;
 }
 // Does x ^ (2 ^ power) mod p. pow2(30, 4) == 30 ^ (2 ^ 4)
 function pow2(x, power, modulo) {
-    // let res = x;
-    // while (power-- > _0n) {
-    //   res *= res;
-    //   res %= modulo;
-    // }
-    // return res;
-    return x.modExp(_2n$4.leftShift(power.dec()), modulo);
+    let res = x;
+    while (power-- > _0n$4) {
+        res *= res;
+        res %= modulo;
+    }
+    return res;
 }
 // Inverses number over modulo
 function invert(number, modulo) {
-    return number.modInv(modulo);
+    if (number === _0n$4 || modulo <= _0n$4) {
+        throw new Error(`invert: expected positive integers, got n=${number} mod=${modulo}`);
+    }
+    // Euclidean GCD https://brilliant.org/wiki/extended-euclidean-algorithm/
+    // Fermat's little theorem "CT-like" version inv(n) = n^(m-2) mod m is 30x slower.
+    let a = mod(number, modulo);
+    let b = modulo;
+    // prettier-ignore
+    let x = _0n$4, u = _1n$6;
+    while (a !== _0n$4) {
+        // JIT applies optimization if those two lines follow each other
+        const q = b / a;
+        const r = b % a;
+        const m = x - u * q;
+        // prettier-ignore
+        b = a, a = r, x = u, u = m;
+    }
+    const gcd = b;
+    if (gcd !== _1n$6)
+        throw new Error('invert: does not exist');
+    return mod(x, modulo);
 }
 /**
  * Tonelli-Shanks square root search algorithm.
@@ -452,24 +473,18 @@ function tonelliShanks(P) {
     // (a | p) ≡ 1    if a is a square (mod p)
     // (a | p) ≡ -1   if a is not a square (mod p)
     // (a | p) ≡ 0    if a ≡ 0 (mod p)
-    const legendreC = P.dec().rightShift(_1n$6);
-    let Q = P.dec();
-    let S = BigInteger.new(0);
+    const legendreC = (P - _1n$6) / _2n$3;
+    let Q, S, Z;
     // Step 1: By factoring out powers of 2 from p - 1,
     // find q and s such that p - 1 = q*(2^s) with q odd
-    while (Q.isEven()) {
-        Q.irightShift(_1n$6);
-        S.iinc();
-    }
-    let Z = BigInteger.new(2);
-    const Pminus1 = P.dec();
+    for (Q = P - _1n$6, S = 0; Q % _2n$3 === _0n$4; Q /= _2n$3, S++)
+        ;
     // Step 2: Select a non-square z such that (z | p) ≡ -1 and set c ≡ zq
-    while (Z.lt(P) && !pow(Z, legendreC, P).equal(Pminus1)) {
-        Z.iinc();
-    }
+    for (Z = _2n$3; Z < P && pow(Z, legendreC, P) !== P - _1n$6; Z++)
+        ;
     // Fast-path
-    if (S.isOne()) {
-        const p1div4 = P.inc().irightShift(_2n$4);
+    if (S === 1) {
+        const p1div4 = (P + _1n$6) / _4n;
         return function tonelliFast(Fp, n) {
             const root = Fp.pow(n, p1div4);
             if (!Fp.eql(Fp.sqr(root), n))
@@ -478,10 +493,10 @@ function tonelliShanks(P) {
         };
     }
     // Slow-path
-    const Q1div2 = Q.inc().irightShift(_1n$6);
+    const Q1div2 = (Q + _1n$6) / _2n$3;
     return function tonelliSlow(Fp, n) {
         // Step 0: Check that n is indeed a square: (n | p) should not be ≡ -1
-        if (Fp.eql(Fp.pow(n, legendreC), Fp.neg(Fp.ONE)))
+        if (Fp.pow(n, legendreC) === Fp.neg(Fp.ONE))
             throw new Error('Cannot find square root');
         let r = S;
         // TODO: will fail at Fp2/etc
@@ -492,14 +507,14 @@ function tonelliShanks(P) {
             if (Fp.eql(b, Fp.ZERO))
                 return Fp.ZERO; // https://en.wikipedia.org/wiki/Tonelli%E2%80%93Shanks_algorithm (4. If t = 0, return r = 0)
             // Find m such b^(2^m)==1
-            let m = BigInteger.new(1);
-            for (let t2 = Fp.sqr(b); m.lt(r); m.iinc()) {
+            let m = 1;
+            for (let t2 = Fp.sqr(b); m < r; m++) {
                 if (Fp.eql(t2, Fp.ONE))
                     break;
                 t2 = Fp.sqr(t2); // t2 *= t2
             }
             // NOTE: r-m-1 can be bigger than 32, need to convert to bigint before shift, otherwise there will be overflow
-            const ge = Fp.pow(g, _1n$6.leftShift(r.sub(m).idec())); // ge = 2^(r-m-1)
+            const ge = Fp.pow(g, _1n$6 << BigInt(r - m - 1)); // ge = 2^(r-m-1)
             g = Fp.sqr(ge); // g = ge * ge
             x = Fp.mul(x, ge); // x *= ge
             b = Fp.mul(b, g); // b *= g
@@ -513,12 +528,12 @@ function FpSqrt(P) {
     // For example there is FpSqrtOdd/FpSqrtEven to choice root based on oddness (used for hash-to-curve).
     // P ≡ 3 (mod 4)
     // √n = n^((P+1)/4)
-    if (P.mod(_4n).equal(_3n$3)) {
+    if (P % _4n === _3n$2) {
         // Not all roots possible!
         // const ORDER =
         //   0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaabn;
         // const NUM = 72057594037927816n;
-        const p1div4 = P.add(_1n$6).irightShift(_2n$4); // .idiv(_4n);
+        const p1div4 = (P + _1n$6) / _4n;
         return function sqrt3mod4(Fp, n) {
             const root = Fp.pow(n, p1div4);
             // Throw if root**2 != n
@@ -528,21 +543,19 @@ function FpSqrt(P) {
         };
     }
     // Atkin algorithm for q ≡ 5 (mod 8), https://eprint.iacr.org/2012/685.pdf (page 10)
-    if (P.mod(_8n$1).equal(_5n)) {
-        const c1 = P.sub(_5n).irightShift(_3n$3);
+    if (P % _8n$1 === _5n) {
+        const c1 = (P - _5n) / _8n$1;
         return function sqrt5mod8(Fp, n) {
-            const n2 = Fp.mul(n, _2n$4);
+            const n2 = Fp.mul(n, _2n$3);
             const v = Fp.pow(n2, c1);
             const nv = Fp.mul(n, v);
-            const i = Fp.mul(Fp.mul(nv, _2n$4), v);
+            const i = Fp.mul(Fp.mul(nv, _2n$3), v);
             const root = Fp.mul(nv, Fp.sub(i, Fp.ONE));
             if (!Fp.eql(Fp.sqr(root), n))
                 throw new Error('Cannot find square root');
             return root;
         };
     }
-    // P ≡ 9 (mod 16)
-    if (P.mod(_16n).equal(_9n)) ;
     // Other cases: Tonelli-Shanks algorithm
     return tonelliShanks(P);
 }
@@ -554,8 +567,8 @@ const FIELD_FIELDS = [
 ];
 function validateField(field) {
     const initial = {
-        ORDER: 'BigInteger',
-        MASK: 'BigInteger',
+        ORDER: 'bigint',
+        MASK: 'bigint',
         BYTES: 'isSafeInteger',
         BITS: 'isSafeInteger',
     };
@@ -573,19 +586,19 @@ function validateField(field) {
 function FpPow(f, num, power) {
     // Should have same speed as pow for bigints
     // TODO: benchmark!
-    if (power.isNegative())
+    if (power < _0n$4)
         throw new Error('Expected power > 0');
-    if (power.isZero())
+    if (power === _0n$4)
         return f.ONE;
-    if (power.isOne())
+    if (power === _1n$6)
         return num;
     let p = f.ONE;
     let d = num;
-    while (power.gt(_0n$4)) {
-        if (!power.isEven())
+    while (power > _0n$4) {
+        if (power & _1n$6)
             p = f.mul(p, d);
         d = f.sqr(d);
-        power = power.rightShift(_1n$6);
+        power >>= _1n$6;
     }
     return p;
 }
@@ -616,7 +629,7 @@ function FpInvertBatch(f, nums) {
 // CURVE.n lengths
 function nLength(n, nBitLength) {
     // Bit size, byte size of CURVE.n
-    const _nBitLength = nBitLength !== undefined ? nBitLength : n.bitLength();
+    const _nBitLength = nBitLength !== undefined ? nBitLength : n.toString(2).length;
     const nByteLength = Math.ceil(_nBitLength / 8);
     return { nBitLength: _nBitLength, nByteLength };
 }
@@ -633,7 +646,7 @@ function nLength(n, nBitLength) {
  * @param redef optional faster redefinitions of sqrt and other methods
  */
 function Field(ORDER, bitLen, isLE = false, redef = {}) {
-    if (ORDER.lte(_0n$4))
+    if (ORDER <= _0n$4)
         throw new Error(`Expected Field ORDER > 0, got ${ORDER}`);
     const { nBitLength: BITS, nByteLength: BYTES } = nLength(ORDER, bitLen);
     if (BYTES > 2048)
@@ -648,25 +661,25 @@ function Field(ORDER, bitLen, isLE = false, redef = {}) {
         ONE: _1n$6,
         create: (num) => mod(num, ORDER),
         isValid: (num) => {
-            if (!(num instanceof BigInteger))
+            if (typeof num !== 'bigint')
                 throw new Error(`Invalid field element: expected bigint, got ${typeof num}`);
-            return _0n$4.lte(num) && num.lt(ORDER); // 0 is valid element, but it's not invertible
+            return _0n$4 <= num && num < ORDER; // 0 is valid element, but it's not invertible
         },
-        is0: (num) => num.isZero(),
-        isOdd: (num) => !num.isEven(),
-        neg: (num) => mod(num.negate(), ORDER),
-        eql: (lhs, rhs) => lhs.equal(rhs),
-        sqr: (num) => mod(num.mul(num), ORDER),
-        add: (lhs, rhs) => mod(lhs.add(rhs), ORDER),
-        sub: (lhs, rhs) => mod(lhs.sub(rhs), ORDER),
-        mul: (lhs, rhs) => mod(lhs.mul(rhs), ORDER),
+        is0: (num) => num === _0n$4,
+        isOdd: (num) => (num & _1n$6) === _1n$6,
+        neg: (num) => mod(-num, ORDER),
+        eql: (lhs, rhs) => lhs === rhs,
+        sqr: (num) => mod(num * num, ORDER),
+        add: (lhs, rhs) => mod(lhs + rhs, ORDER),
+        sub: (lhs, rhs) => mod(lhs - rhs, ORDER),
+        mul: (lhs, rhs) => mod(lhs * rhs, ORDER),
         pow: (num, power) => FpPow(f, num, power),
-        div: (lhs, rhs) => mod(lhs.mul(invert(rhs, ORDER)), ORDER),
+        div: (lhs, rhs) => mod(lhs * invert(rhs, ORDER), ORDER),
         // Same as above, but doesn't normalize
-        sqrN: (num) => num.mul(num),
-        addN: (lhs, rhs) => lhs.add(rhs),
-        subN: (lhs, rhs) => lhs.sub(rhs),
-        mulN: (lhs, rhs) => lhs.mul(rhs),
+        sqrN: (num) => num * num,
+        addN: (lhs, rhs) => lhs + rhs,
+        subN: (lhs, rhs) => lhs - rhs,
+        mulN: (lhs, rhs) => lhs * rhs,
         inv: (num) => invert(num, ORDER),
         sqrt: redef.sqrt || ((n) => sqrtP(f, n)),
         invertBatch: (lst) => FpInvertBatch(f, lst),
@@ -689,9 +702,10 @@ function Field(ORDER, bitLen, isLE = false, redef = {}) {
  * @returns byte length of field
  */
 function getFieldBytesLength(fieldOrder) {
-    if (!(fieldOrder instanceof BigInteger))
+    if (typeof fieldOrder !== 'bigint')
         throw new Error('field order must be bigint');
-    return fieldOrder.byteLength();
+    const bitLength = fieldOrder.toString(2).length;
+    return Math.ceil(bitLength / 8);
 }
 /**
  * Returns minimal amount of bytes that can be safely reduced
@@ -726,14 +740,14 @@ function mapHashToField(key, fieldOrder, isLE = false) {
         throw new Error(`expected ${minLen}-1024 bytes of input, got ${len}`);
     const num = isLE ? bytesToNumberBE(key) : bytesToNumberLE(key);
     // `mod(x, 11)` can sometimes produce 0. `mod(x, 10) + 1` is the same, but no 0
-    const reduced = mod(num, fieldOrder.dec()).inc();
+    const reduced = mod(num, fieldOrder - _1n$6) + _1n$6;
     return isLE ? numberToBytesLE(reduced, fieldLen) : numberToBytesBE(reduced, fieldLen);
 }
 
 /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
 // Abelian group utilities
-const _0n$3 = Object.freeze(BigInteger.new(0));
-const _1n$5 = Object.freeze(BigInteger.new(1));
+const _0n$3 = BigInt(0);
+const _1n$5 = BigInt(1);
 // Elliptic curve multiplication of Point by scalar. Fragile.
 // Scalars should always be less than curve order: this should be checked inside of a curve itself.
 // Creates precomputation tables for fast multiplication:
@@ -758,15 +772,14 @@ function wNAF(c, bits) {
     return {
         constTimeNegate,
         // non-const time multiplication ladder
-        unsafeLadder(elm, exp) {
-            const n = exp.clone();
+        unsafeLadder(elm, n) {
             let p = c.ZERO;
             let d = elm;
-            while (n.gt(_0n$3)) {
-                if (!n.isEven())
+            while (n > _0n$3) {
+                if (n & _1n$5)
                     p = p.add(d);
                 d = d.double();
-                n.irightShift(_1n$5);
+                n >>= _1n$5;
             }
             return p;
         },
@@ -804,27 +817,26 @@ function wNAF(c, bits) {
          * @param n scalar (we don't check here, but should be less than curve order)
          * @returns real and fake (for const-time) points
          */
-        wNAF(W, precomputes, scalar) {
-            const n = scalar.clone();
+        wNAF(W, precomputes, n) {
             // TODO: maybe check that scalar is less than group order? wNAF behavious is undefined otherwise
             // But need to carefully remove other checks before wNAF. ORDER == bits here
             const { windows, windowSize } = opts(W);
             let p = c.ZERO;
             let f = c.BASE;
-            const mask = BigInteger.new(2 ** W - 1); // Create mask with W ones: 0b1111 for W=4 etc.
+            const mask = BigInt(2 ** W - 1); // Create mask with W ones: 0b1111 for W=4 etc.
             const maxNumber = 2 ** W;
-            const shiftBy = BigInteger.new(W);
+            const shiftBy = BigInt(W);
             for (let window = 0; window < windows; window++) {
                 const offset = window * windowSize;
                 // Extract W bits.
-                let wbits = n.bitwiseAnd(mask).toNumber();
+                let wbits = Number(n & mask);
                 // Shift number by W bits.
-                n.irightShift(shiftBy);
+                n >>= shiftBy;
                 // If the bits are bigger than max size, we'll split those.
                 // +224 => 256 - 32
                 if (wbits > windowSize) {
                     wbits -= maxNumber;
-                    n.iinc();
+                    n += _1n$5;
                 }
                 // This code was first written with assumption that 'f' and 'p' will never be infinity point:
                 // since each addition is multiplied by 2 ** W, it cannot cancel each other. However,
@@ -870,8 +882,8 @@ function wNAF(c, bits) {
 function validateBasic(curve) {
     validateField(curve.Fp);
     validateObject(curve, {
-        n: 'BigInteger',
-        h: 'BigInteger',
+        n: 'bigint',
+        h: 'bigint',
         Gx: 'field',
         Gy: 'field',
     }, {
@@ -908,7 +920,7 @@ function validatePointOpts(curve) {
             throw new Error('Endomorphism can only be defined for Koblitz curves that have a=0');
         }
         if (typeof endo !== 'object' ||
-            !(endo.beta instanceof BigInteger) ||
+            typeof endo.beta !== 'bigint' ||
             typeof endo.splitScalar !== 'function') {
             throw new Error('Expected endomorphism with beta: bigint and splitScalar: function');
         }
@@ -946,8 +958,7 @@ const DER = {
         // parse DER signature
         const { Err: E } = DER;
         const data = typeof hex === 'string' ? h2b(hex) : hex;
-        if (!isBytes(data))
-            throw new Error('ui8a expected');
+        abytes(data);
         let l = data.length;
         if (l < 2 || data[0] != 0x30)
             throw new E('Invalid signature tag');
@@ -963,7 +974,7 @@ const DER = {
         // Add leading zero if first byte has negative bit enabled. More details in '_parseInt'
         const slice = (s) => (Number.parseInt(s[0], 16) & 0b1000 ? '00' + s : s);
         const h = (num) => {
-            const hex = num instanceof BigInteger ? bytesToHex(num.toUint8Array()) : num.toString(16);
+            const hex = num.toString(16);
             return hex.length & 1 ? `0${hex}` : hex;
         };
         const s = slice(h(sig.s));
@@ -977,11 +988,7 @@ const DER = {
 };
 // Be friendly to bad ECMAScript parsers by not using bigint literals
 // prettier-ignore
-const _0n$2 = Object.freeze(BigInteger.new(0));
-const _1n$4 = Object.freeze(BigInteger.new(1));
-Object.freeze(BigInteger.new(2));
-const _3n$2 = Object.freeze(BigInteger.new(3));
-Object.freeze(BigInteger.new(4));
+const _0n$2 = BigInt(0), _1n$4 = BigInt(1); BigInt(2); const _3n$1 = BigInt(3); BigInt(4);
 function weierstrassPoints(opts) {
     const CURVE = validatePointOpts(opts);
     const { Fp } = CURVE; // All curves has same field / group length as for now, but they can differ
@@ -1017,7 +1024,7 @@ function weierstrassPoints(opts) {
         throw new Error('bad generator point: equation left != right');
     // Valid group elements reside in range 1..n-1
     function isWithinCurveOrder(num) {
-        return num instanceof BigInteger && _0n$2.lt(num) && num.lt(CURVE.n);
+        return typeof num === 'bigint' && _0n$2 < num && num < CURVE.n;
     }
     function assertGE(num) {
         if (!isWithinCurveOrder(num))
@@ -1027,7 +1034,7 @@ function weierstrassPoints(opts) {
     // Supports options allowedPrivateKeyLengths and wrapPrivateKey.
     function normPrivateKeyToScalar(key) {
         const { allowedPrivateKeyLengths: lengths, nByteLength, wrapPrivateKey, n } = CURVE;
-        if (lengths && !(key instanceof BigInteger)) {
+        if (lengths && typeof key !== 'bigint') {
             if (isBytes(key))
                 key = bytesToHex(key);
             // Normalize to hex string, pad. E.g. P521 would norm 130-132 char hex to 132-char bytes
@@ -1038,7 +1045,7 @@ function weierstrassPoints(opts) {
         let num;
         try {
             num =
-                key instanceof BigInteger
+                typeof key === 'bigint'
                     ? key
                     : bytesToNumberBE(ensureBytes('private key', key, nByteLength));
         }
@@ -1171,7 +1178,7 @@ function weierstrassPoints(opts) {
         // Cost: 8M + 3S + 3*a + 2*b3 + 15add.
         double() {
             const { a, b } = CURVE;
-            const b3 = Fp.mul(b, _3n$2);
+            const b3 = Fp.mul(b, _3n$1);
             const { px: X1, py: Y1, pz: Z1 } = this;
             let X3 = Fp.ZERO, Y3 = Fp.ZERO, Z3 = Fp.ZERO; // prettier-ignore
             let t0 = Fp.mul(X1, X1); // step 1
@@ -1217,7 +1224,7 @@ function weierstrassPoints(opts) {
             const { px: X2, py: Y2, pz: Z2 } = other;
             let X3 = Fp.ZERO, Y3 = Fp.ZERO, Z3 = Fp.ZERO; // prettier-ignore
             const a = CURVE.a;
-            const b3 = Fp.mul(CURVE.b, _3n$2);
+            const b3 = Fp.mul(CURVE.b, _3n$1);
             let t0 = Fp.mul(X1, X2); // step 1
             let t1 = Fp.mul(Y1, Y2);
             let t2 = Fp.mul(Z1, Z2);
@@ -1279,10 +1286,10 @@ function weierstrassPoints(opts) {
          */
         multiplyUnsafe(n) {
             const I = Point.ZERO;
-            if (n.isZero())
+            if (n === _0n$2)
                 return I;
             assertGE(n); // Will throw on 0
-            if (n.isOne())
+            if (n === _1n$4)
                 return this;
             const { endo } = CURVE;
             if (!endo)
@@ -1292,14 +1299,14 @@ function weierstrassPoints(opts) {
             let k1p = I;
             let k2p = I;
             let d = this;
-            while (k1.gt(_0n$2) || k2.gt(_0n$2)) {
-                if (!k1.isEven())
+            while (k1 > _0n$2 || k2 > _0n$2) {
+                if (k1 & _1n$4)
                     k1p = k1p.add(d);
-                if (!k2.isEven())
+                if (k2 & _1n$4)
                     k2p = k2p.add(d);
                 d = d.double();
-                k1 = k1.rightShift(_1n$4);
-                k2 = k2.rightShift(_1n$4);
+                k1 >>= _1n$4;
+                k2 >>= _1n$4;
             }
             if (k1neg)
                 k1p = k1p.negate();
@@ -1349,7 +1356,7 @@ function weierstrassPoints(opts) {
         multiplyAndAddUnsafe(Q, a, b) {
             const G = Point.BASE; // No Strauss-Shamir trick: we have 10% faster G precomputes
             const mul = (P, a // Select faster multiply() method
-            ) => (a.isZero() || a.isOne() || !P.equals(G) ? P.multiplyUnsafe(a) : P.multiply(a));
+            ) => (a === _0n$2 || a === _1n$4 || !P.equals(G) ? P.multiplyUnsafe(a) : P.multiply(a));
             const sum = mul(this, a).add(mul(Q, b));
             return sum.is0() ? undefined : sum;
         }
@@ -1374,7 +1381,7 @@ function weierstrassPoints(opts) {
         }
         isTorsionFree() {
             const { h: cofactor, isTorsionFree } = CURVE;
-            if (cofactor.isOne())
+            if (cofactor === _1n$4)
                 return true; // No subgroups, always torsion-free
             if (isTorsionFree)
                 return isTorsionFree(Point, this);
@@ -1382,7 +1389,7 @@ function weierstrassPoints(opts) {
         }
         clearCofactor() {
             const { h: cofactor, clearCofactor } = CURVE;
-            if (cofactor.isOne())
+            if (cofactor === _1n$4)
                 return this; // Fast-path
             if (clearCofactor)
                 return clearCofactor(Point, this);
@@ -1428,7 +1435,7 @@ function weierstrass(curveDef) {
     const compressedLen = Fp.BYTES + 1; // e.g. 33 for 32
     const uncompressedLen = 2 * Fp.BYTES + 1; // e.g. 65 for 32
     function isValidFieldElement(num) {
-        return _0n$2.lt(num) && num.lt(Fp.ORDER); // 0 is banned since it's not invertible FE
+        return _0n$2 < num && num < Fp.ORDER; // 0 is banned since it's not invertible FE
     }
     function modN(a) {
         return mod(a, CURVE_ORDER);
@@ -1459,8 +1466,15 @@ function weierstrass(curveDef) {
                 if (!isValidFieldElement(x))
                     throw new Error('Point is not on curve');
                 const y2 = weierstrassEquation(x); // y² = x³ + ax + b
-                let y = Fp.sqrt(y2); // y = y² ^ (p+1)/4
-                const isYOdd = !y.isEven();
+                let y;
+                try {
+                    y = Fp.sqrt(y2); // y = y² ^ (p+1)/4
+                }
+                catch (sqrtError) {
+                    const suffix = sqrtError instanceof Error ? ': ' + sqrtError.message : '';
+                    throw new Error('Point is not on curve' + suffix);
+                }
+                const isYOdd = (y & _1n$4) === _1n$4;
                 // ECDSA
                 const isHeadOdd = (head & 1) === 1;
                 if (isHeadOdd !== isYOdd)
@@ -1479,11 +1493,11 @@ function weierstrass(curveDef) {
     });
     const numToNByteStr = (num) => bytesToHex(numberToBytesBE(num, CURVE.nByteLength));
     function isBiggerThanHalfOrder(number) {
-        const HALF = CURVE_ORDER.rightShift(_1n$4);
-        return number.gt(HALF);
+        const HALF = CURVE_ORDER >> _1n$4;
+        return number > HALF;
     }
     function normalizeS(s) {
-        return isBiggerThanHalfOrder(s) ? modN(s.negate()) : s;
+        return isBiggerThanHalfOrder(s) ? modN(-s) : s;
     }
     // slice bytes num
     const slcNum = (b, from, to) => bytesToNumberBE(b.slice(from, to));
@@ -1524,14 +1538,14 @@ function weierstrass(curveDef) {
             const h = bits2int_modN(ensureBytes('msgHash', msgHash)); // Truncate hash
             if (rec == null || ![0, 1, 2, 3].includes(rec))
                 throw new Error('recovery id invalid');
-            const radj = rec === 2 || rec === 3 ? r.add(CURVE.n) : r;
-            if (radj.gte(Fp.ORDER))
+            const radj = rec === 2 || rec === 3 ? r + CURVE.n : r;
+            if (radj >= Fp.ORDER)
                 throw new Error('recovery id 2 or 3 invalid');
             const prefix = (rec & 1) === 0 ? '02' : '03';
             const R = Point.fromHex(prefix + numToNByteStr(radj));
             const ir = invN(radj); // r^-1
-            const u1 = modN(h.negate().imul(ir)); // -hr^-1
-            const u2 = modN(s.mul(ir)); // sr^-1
+            const u1 = modN(-h * ir); // -hr^-1
+            const u2 = modN(s * ir); // sr^-1
             const Q = Point.BASE.multiplyAndAddUnsafe(R, u1, u2); // (sr^-1)R-(hr^-1)G = -(hr^-1)G + (sr^-1)
             if (!Q)
                 throw new Error('point at infinify'); // unsafe is fine: no priv data leaked
@@ -1543,7 +1557,7 @@ function weierstrass(curveDef) {
             return isBiggerThanHalfOrder(this.s);
         }
         normalizeS() {
-            return this.hasHighS() ? new Signature(this.r, modN(this.s.negate()), this.recovery) : this;
+            return this.hasHighS() ? new Signature(this.r, modN(-this.s), this.recovery) : this;
         }
         // DER-encoded
         toDERRawBytes() {
@@ -1589,7 +1603,7 @@ function weierstrass(curveDef) {
          */
         precompute(windowSize = 8, point = Point.BASE) {
             point._setWindowSize(windowSize);
-            point.multiply(BigInteger.new(3)); // 3 is arbitrary, just need any number here
+            point.multiply(BigInt(3)); // 3 is arbitrary, just need any number here
             return point;
         },
     };
@@ -1645,7 +1659,7 @@ function weierstrass(curveDef) {
             // for some cases, since bytes.length * 8 is not actual bitLength.
             const num = bytesToNumberBE(bytes); // check for == u8 done here
             const delta = bytes.length * 8 - CURVE.nBitLength; // truncate to nBitLength leftmost bits
-            return delta > 0 ? num.rightShift(BigInteger.new(delta)) : num;
+            return delta > 0 ? num >> BigInt(delta) : num;
         };
     const bits2int_modN = CURVE.bits2int_modN ||
         function (bytes) {
@@ -1657,9 +1671,9 @@ function weierstrass(curveDef) {
      * Converts to bytes. Checks if num in `[0..ORDER_MASK-1]` e.g.: `[0..2^256-1]`.
      */
     function int2octets(num) {
-        if (!(num instanceof BigInteger))
+        if (typeof num !== 'bigint')
             throw new Error('bigint expected');
-        if (!(_0n$2.lte(num) && num.lt(ORDER_MASK)))
+        if (!(_0n$2 <= num && num < ORDER_MASK))
             throw new Error(`bigint expected < 2^${CURVE.nBitLength}`);
         // works with order, can have different size than numToField!
         return numberToBytesBE(num, CURVE.nByteLength);
@@ -1686,7 +1700,7 @@ function weierstrass(curveDef) {
         const d = normPrivateKeyToScalar(privateKey); // validate private key, convert to bigint
         const seedArgs = [int2octets(d), int2octets(h1int)];
         // extraEntropy. RFC6979 3.6: additional k' (optional).
-        if (ent != null) {
+        if (ent != null && ent !== false) {
             // K = HMAC_K(V || 0x00 || int2octets(x) || bits2octets(h1) || k')
             const e = ent === true ? randomBytes(Fp.BYTES) : ent; // generate random bytes OR pass as-is
             seedArgs.push(ensureBytes('extraEntropy', e)); // check for being bytes
@@ -1702,15 +1716,15 @@ function weierstrass(curveDef) {
             const ik = invN(k); // k^-1 mod n
             const q = Point.BASE.multiply(k).toAffine(); // q = Gk
             const r = modN(q.x); // r = q.x mod n
-            if (r.isZero())
+            if (r === _0n$2)
                 return;
             // Can use scalar blinding b^-1(bm + bdr) where b ∈ [1,q−1] according to
             // https://tches.iacr.org/index.php/TCHES/article/view/7337/6509. We've decided against it:
             // a) dependency on CSPRNG b) 15% slowdown c) doesn't really help since bigints are not CT
-            const s = modN(ik.mul(modN(m.add(r.mul(d))))); // Not using blinding here
-            if (s.isZero())
+            const s = modN(ik * modN(m + r * d)); // Not using blinding here
+            if (s === _0n$2)
                 return;
-            let recovery = (q.x.equal(r) ? 0 : 2) | q.y.getBit(0); // recovery bit (2 or 3, when q.x > n)
+            let recovery = (q.x === r ? 0 : 2) | Number(q.y & _1n$4); // recovery bit (2 or 3, when q.x > n)
             let normS = s;
             if (lowS && isBiggerThanHalfOrder(s)) {
                 normS = normalizeS(s); // if lowS was passed, ensure s is always
@@ -1779,7 +1793,7 @@ function weierstrass(curveDef) {
                     _sig = Signature.fromCompact(sg);
                 }
             }
-            else if (typeof sg === 'object' && sg.r instanceof BigInteger && sg.s instanceof BigInteger) {
+            else if (typeof sg === 'object' && typeof sg.r === 'bigint' && typeof sg.s === 'bigint') {
                 const { r, s } = sg;
                 _sig = new Signature(r, s);
             }
@@ -1800,13 +1814,13 @@ function weierstrass(curveDef) {
         const { r, s } = _sig;
         const h = bits2int_modN(msgHash); // Cannot use fields methods, since it is group element
         const is = invN(s); // s^-1
-        const u1 = modN(h.mul(is)); // u1 = hs^-1 mod n
-        const u2 = modN(r.mul(is)); // u2 = rs^-1 mod n
+        const u1 = modN(h * is); // u1 = hs^-1 mod n
+        const u2 = modN(r * is); // u2 = rs^-1 mod n
         const R = Point.BASE.multiplyAndAddUnsafe(P, u1, u2)?.toAffine(); // R = u1⋅G + u2⋅P
         if (!R)
             return false;
         const v = modN(R.x);
-        return v.equal(r);
+        return v === r;
     }
     return {
         CURVE,
@@ -1821,7 +1835,6 @@ function weierstrass(curveDef) {
 }
 
 /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-// import { BigInteger } from '@openpgp/noble-hashes/biginteger';
 // connects noble-curves to noble-hashes
 function getHash(hash) {
     return {
@@ -1838,20 +1851,20 @@ function createCurve(curveDef, defHash) {
 /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
 // NIST secp256r1 aka p256
 // https://www.secg.org/sec2-v2.pdf, https://neuromancer.sk/std/nist/P-256
-const Fp$7 = Field(BigInteger.new('0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff'));
-const CURVE_A$4 = Fp$7.create(BigInteger.new('-3'));
-const CURVE_B$4 = BigInteger.new('0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b');
+const Fp$7 = Field(BigInt('0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff'));
+const CURVE_A$4 = Fp$7.create(BigInt('-3'));
+const CURVE_B$4 = BigInt('0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b');
 // prettier-ignore
 const p256 = createCurve({
     a: CURVE_A$4, // Equation params: a, b
     b: CURVE_B$4,
     Fp: Fp$7, // Field: 2n**224n * (2n**32n-1n) + 2n**192n + 2n**96n-1n
     // Curve order, total count of valid points in the field
-    n: BigInteger.new('0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551'),
+    n: BigInt('0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551'),
     // Base (generator) point (x, y)
-    Gx: BigInteger.new('0x6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296'),
-    Gy: BigInteger.new('0x4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5'),
-    h: BigInteger.new(1),
+    Gx: BigInt('0x6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296'),
+    Gy: BigInt('0x4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5'),
+    h: BigInt(1),
     lowS: false,
 }, sha256);
 
@@ -1860,22 +1873,22 @@ const p256 = createCurve({
 // https://www.secg.org/sec2-v2.pdf, https://neuromancer.sk/std/nist/P-384
 // Field over which we'll do calculations.
 // prettier-ignore
-const P$1 = BigInteger.new('0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffff0000000000000000ffffffff');
+const P$1 = BigInt('0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffff0000000000000000ffffffff');
 const Fp$6 = Field(P$1);
-const CURVE_A$3 = Fp$6.create(BigInteger.new('-3'));
+const CURVE_A$3 = Fp$6.create(BigInt('-3'));
 // prettier-ignore
-const CURVE_B$3 = BigInteger.new('0xb3312fa7e23ee7e4988e056be3f82d19181d9c6efe8141120314088f5013875ac656398d8a2ed19d2a85c8edd3ec2aef');
+const CURVE_B$3 = BigInt('0xb3312fa7e23ee7e4988e056be3f82d19181d9c6efe8141120314088f5013875ac656398d8a2ed19d2a85c8edd3ec2aef');
 // prettier-ignore
 const p384 = createCurve({
     a: CURVE_A$3, // Equation params: a, b
     b: CURVE_B$3,
     Fp: Fp$6, // Field: 2n**384n - 2n**128n - 2n**96n + 2n**32n - 1n
     // Curve order, total count of valid points in the field.
-    n: BigInteger.new('0xffffffffffffffffffffffffffffffffffffffffffffffffc7634d81f4372ddf581a0db248b0a77aecec196accc52973'),
+    n: BigInt('0xffffffffffffffffffffffffffffffffffffffffffffffffc7634d81f4372ddf581a0db248b0a77aecec196accc52973'),
     // Base (generator) point (x, y)
-    Gx: BigInteger.new('0xaa87ca22be8b05378eb1c71ef320ad746e1d3b628ba79b9859f741e082542a385502f25dbf55296c3a545e3872760ab7'),
-    Gy: BigInteger.new('0x3617de4a96262c6f5d9e98bf9292dc29f8f41dbd289a147ce9da3113b5f0b8c00a60b1ce1d7e819d7a431d7c90ea0e5f'),
-    h: BigInteger.new(1),
+    Gx: BigInt('0xaa87ca22be8b05378eb1c71ef320ad746e1d3b628ba79b9859f741e082542a385502f25dbf55296c3a545e3872760ab7'),
+    Gy: BigInt('0x3617de4a96262c6f5d9e98bf9292dc29f8f41dbd289a147ce9da3113b5f0b8c00a60b1ce1d7e819d7a431d7c90ea0e5f'),
+    h: BigInt(1),
     lowS: false,
 }, sha384);
 
@@ -1885,16 +1898,16 @@ const p384 = createCurve({
 // https://www.secg.org/sec2-v2.pdf, https://neuromancer.sk/std/nist/P-521
 // Field over which we'll do calculations.
 // prettier-ignore
-const P = BigInteger.new('0x1ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff');
+const P = BigInt('0x1ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff');
 const Fp$5 = Field(P);
 const CURVE = {
-    a: Fp$5.create(BigInteger.new('-3')),
-    b: BigInteger.new('0x0051953eb9618e1c9a1f929a21a0b68540eea2da725b99b315f3b8b489918ef109e156193951ec7e937b1652c0bd3bb1bf073573df883d2c34f1ef451fd46b503f00'),
+    a: Fp$5.create(BigInt('-3')),
+    b: BigInt('0x0051953eb9618e1c9a1f929a21a0b68540eea2da725b99b315f3b8b489918ef109e156193951ec7e937b1652c0bd3bb1bf073573df883d2c34f1ef451fd46b503f00'),
     Fp: Fp$5,
-    n: BigInteger.new('0x01fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffa51868783bf2f966b7fcc0148f709a5d03bb5c9b8899c47aebb6fb71e91386409'),
-    Gx: BigInteger.new('0x00c6858e06b70404e9cd9e3ecb662395b4429c648139053fb521f828af606b4d3dbaa14b5e77efe75928fe1dc127a2ffa8de3348b3c1856a429bf97e7e31c2e5bd66'),
-    Gy: BigInteger.new('0x011839296a789a3bc0045c8a5fb42c7d1bd998f54449579b446817afbd17273e662c97ee72995ef42640c550b9013fad0761353c7086a272c24088be94769fd16650'),
-    h: BigInteger.new(1),
+    n: BigInt('0x01fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffa51868783bf2f966b7fcc0148f709a5d03bb5c9b8899c47aebb6fb71e91386409'),
+    Gx: BigInt('0x00c6858e06b70404e9cd9e3ecb662395b4429c648139053fb521f828af606b4d3dbaa14b5e77efe75928fe1dc127a2ffa8de3348b3c1856a429bf97e7e31c2e5bd66'),
+    Gy: BigInt('0x011839296a789a3bc0045c8a5fb42c7d1bd998f54449579b446817afbd17273e662c97ee72995ef42640c550b9013fad0761353c7086a272c24088be94769fd16650'),
+    h: BigInt(1),
 };
 // prettier-ignore
 const p521 = createCurve({
@@ -1910,77 +1923,19 @@ const p521 = createCurve({
     allowedPrivateKeyLengths: [130, 131, 132] // P521 keys are variable-length. Normalize to 132b
 }, sha512);
 
-// brainpoolP256r1: https://datatracker.ietf.org/doc/html/rfc5639#section-3.4
-const Fp$4 = Field(BigInteger.new('0xa9fb57dba1eea9bc3e660a909d838d726e3bf623d52620282013481d1f6e5377'));
-const CURVE_A$2 = Fp$4.create(BigInteger.new('0x7d5a0975fc2c3057eef67530417affe7fb8055c126dc5c6ce94a4b44f330b5d9'));
-const CURVE_B$2 = BigInteger.new('0x26dc5c6ce94a4b44f330b5d9bbd77cbf958416295cf7e1ce6bccdc18ff8c07b6');
-// prettier-ignore
-const brainpoolP256r1 = createCurve({
-    a: CURVE_A$2, // Equation params: a, b
-    b: CURVE_B$2,
-    Fp: Fp$4,
-    // Curve order (q), total count of valid points in the field
-    n: BigInteger.new('0xa9fb57dba1eea9bc3e660a909d838d718c397aa3b561a6f7901e0e82974856a7'),
-    // Base (generator) point (x, y)
-    Gx: BigInteger.new('0x8bd2aeb9cb7e57cb2c4b482ffc81b7afb9de27e1e3bd23c23a4453bd9ace3262'),
-    Gy: BigInteger.new('0x547ef835c3dac4fd97f8461a14611dc9c27745132ded8e545c1d54c72f046997'),
-    h: BigInteger.new(1),
-    lowS: false,
-}, sha256);
-
-// brainpoolP384 r1: https://datatracker.ietf.org/doc/html/rfc5639#section-3.6
-const Fp$3 = Field(BigInteger.new('0x8cb91e82a3386d280f5d6f7e50e641df152f7109ed5456b412b1da197fb71123acd3a729901d1a71874700133107ec53'));
-const CURVE_A$1 = Fp$3.create(BigInteger.new('0x7bc382c63d8c150c3c72080ace05afa0c2bea28e4fb22787139165efba91f90f8aa5814a503ad4eb04a8c7dd22ce2826'));
-const CURVE_B$1 = BigInteger.new('0x04a8c7dd22ce28268b39b55416f0447c2fb77de107dcd2a62e880ea53eeb62d57cb4390295dbc9943ab78696fa504c11');
-// prettier-ignore
-const brainpoolP384r1 = createCurve({
-    a: CURVE_A$1, // Equation params: a, b
-    b: CURVE_B$1,
-    Fp: Fp$3,
-    // Curve order (q), total count of valid points in the field
-    n: BigInteger.new('0x8cb91e82a3386d280f5d6f7e50e641df152f7109ed5456b31f166e6cac0425a7cf3ab6af6b7fc3103b883202e9046565'),
-    // Base (generator) point (x, y)
-    Gx: BigInteger.new('0x1d1c64f068cf45ffa2a63a81b7c13f6b8847a3e77ef14fe3db7fcafe0cbd10e8e826e03436d646aaef87b2e247d4af1e'),
-    Gy: BigInteger.new('0x8abe1d7520f9c2a45cb1eb8e95cfd55262b70b29feec5864e19c054ff99129280e4646217791811142820341263c5315'),
-    h: BigInteger.new(1),
-    lowS: false,
-}, sha384);
-
-// brainpoolP512r1: https://datatracker.ietf.org/doc/html/rfc5639#section-3.7
-const Fp$2 = Field(BigInteger.new('0xaadd9db8dbe9c48b3fd4e6ae33c9fc07cb308db3b3c9d20ed6639cca703308717d4d9b009bc66842aecda12ae6a380e62881ff2f2d82c68528aa6056583a48f3'));
-const CURVE_A = Fp$2.create(BigInteger.new('0x7830a3318b603b89e2327145ac234cc594cbdd8d3df91610a83441caea9863bc2ded5d5aa8253aa10a2ef1c98b9ac8b57f1117a72bf2c7b9e7c1ac4d77fc94ca'));
-const CURVE_B = BigInteger.new('0x3df91610a83441caea9863bc2ded5d5aa8253aa10a2ef1c98b9ac8b57f1117a72bf2c7b9e7c1ac4d77fc94cadc083e67984050b75ebae5dd2809bd638016f723');
-// prettier-ignore
-const brainpoolP512r1 = createCurve({
-    a: CURVE_A, // Equation params: a, b
-    b: CURVE_B,
-    Fp: Fp$2,
-    // Curve order (q), total count of valid points in the field
-    n: BigInteger.new('0xaadd9db8dbe9c48b3fd4e6ae33c9fc07cb308db3b3c9d20ed6639cca70330870553e5c414ca92619418661197fac10471db1d381085ddaddb58796829ca90069'),
-    // Base (generator) point (x, y)
-    Gx: BigInteger.new('0x81aee4bdd82ed9645a21322e9c4c6a9385ed9f70b5d916c1b43b62eef4d0098eff3b1f78e2d0d48d50d1687b93b97d5f7c6d5047406a5e688b352209bcb9f822'),
-    Gy: BigInteger.new('0x7dde385d566332ecc0eabfa9cf7822fdf209f70024a57b1aa000c55b881f8111b2dcde494a5f485e5bca4bd88a2763aed1ca2b2fa8f0540678cd1e0f3ad80892'),
-    h: BigInteger.new(1),
-    lowS: false,
-}, sha512);
-
 /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
 // Twisted Edwards curve. The formula is: ax² + y² = 1 + dx²y²
 // Be friendly to bad ECMAScript parsers by not using bigint literals
 // prettier-ignore
-const _0n$1 = Object.freeze(BigInteger.new(0));
-const _1n$3 = Object.freeze(BigInteger.new(1));
-const _2n$3 = Object.freeze(BigInteger.new(2));
-const _3n$1 = Object.freeze(BigInteger.new(3));
-const _8n = Object.freeze(BigInteger.new(8));
+const _0n$1 = BigInt(0), _1n$3 = BigInt(1), _2n$2 = BigInt(2), _8n = BigInt(8);
 // verification rule is either zip215 or rfc8032 / nist186-5. Consult fromHex:
 const VERIFY_DEFAULT = { zip215: true };
 function validateOpts$1(curve) {
     const opts = validateBasic(curve);
     validateObject(curve, {
         hash: 'function',
-        a: 'BigInteger',
-        d: 'BigInteger',
+        a: 'bigint',
+        d: 'bigint',
         randomBytes: 'function',
     }, {
         adjustScalarBytes: 'function',
@@ -1995,14 +1950,13 @@ function validateOpts$1(curve) {
 function twistedEdwards(curveDef) {
     const CURVE = validateOpts$1(curveDef);
     const { Fp, n: CURVE_ORDER, prehash: prehash, hash: cHash, randomBytes, nByteLength, h: cofactor, } = CURVE;
-    const MASK = _2n$3.leftShift(BigInteger.new(nByteLength * 8).idec());
+    const MASK = _2n$2 << (BigInt(nByteLength * 8) - _1n$3);
     const modP = Fp.create; // Function overrides
     // sqrt(u/v)
     const uvRatio = CURVE.uvRatio ||
         ((u, v) => {
             try {
-                const res = { isValid: true, value: Fp.sqrt(u.mul(Fp.inv(v))) };
-                return res;
+                return { isValid: true, value: Fp.sqrt(u * Fp.inv(v)) };
             }
             catch (e) {
                 return { isValid: false, value: _0n$1 };
@@ -2015,9 +1969,9 @@ function twistedEdwards(curveDef) {
                 throw new Error('Contexts/pre-hash are not supported');
             return data;
         }); // NOOP
-    const inBig = (n) => n instanceof BigInteger && n.gt(_0n$1); // n in [1..]
-    const inRange = (n, max) => inBig(n) && inBig(max) && n.lt(max); // n in [1..max-1]
-    const in0MaskRange = (n) => n.isZero() || inRange(n, MASK); // n in [0..MASK-1]
+    const inBig = (n) => typeof n === 'bigint' && _0n$1 < n; // n in [1..]
+    const inRange = (n, max) => inBig(n) && inBig(max) && n < max; // n in [1..max-1]
+    const in0MaskRange = (n) => n === _0n$1 || inRange(n, MASK); // n in [0..MASK-1]
     function assertInRange(n, max) {
         // n in [1..max-1]
         if (inRange(n, max))
@@ -2026,7 +1980,7 @@ function twistedEdwards(curveDef) {
     }
     function assertGE0(n) {
         // n in [0..CURVE_ORDER-1]
-        return n.isZero() ? n : assertInRange(n, CURVE_ORDER); // GE = prime subgroup, not full group
+        return n === _0n$1 ? n : assertInRange(n, CURVE_ORDER); // GE = prime subgroup, not full group
     }
     const pointPrecomputes = new Map();
     function isPoint(other) {
@@ -2062,7 +2016,7 @@ function twistedEdwards(curveDef) {
             const { x, y } = p || {};
             if (!in0MaskRange(x) || !in0MaskRange(y))
                 throw new Error('invalid affine point');
-            return new Point(x, y, _1n$3, modP(x.mul(y)));
+            return new Point(x, y, _1n$3, modP(x * y));
         }
         static normalizeZ(points) {
             const toInv = Fp.invertBatch(points.map((p) => p.ez));
@@ -2082,19 +2036,19 @@ function twistedEdwards(curveDef) {
             // Equation in affine coordinates: ax² + y² = 1 + dx²y²
             // Equation in projective coordinates (X/Z, Y/Z, Z):  (aX² + Y²)Z² = Z⁴ + dX²Y²
             const { ex: X, ey: Y, ez: Z, et: T } = this;
-            const X2 = modP(X.mul(X)); // X²
-            const Y2 = modP(Y.mul(Y)); // Y²
-            const Z2 = modP(Z.mul(Z)); // Z²
-            const Z4 = modP(Z2.mul(Z2)); // Z⁴
-            const aX2 = modP(X2.mul(a)); // aX²
-            const left = modP(Z2.mul(modP(aX2.add(Y2)))); // (aX² + Y²)Z²
-            const right = modP(Z4.add(modP(d.mul(modP(X2.mul(Y2)))))); // Z⁴ + dX²Y²
-            if (!left.equal(right))
+            const X2 = modP(X * X); // X²
+            const Y2 = modP(Y * Y); // Y²
+            const Z2 = modP(Z * Z); // Z²
+            const Z4 = modP(Z2 * Z2); // Z⁴
+            const aX2 = modP(X2 * a); // aX²
+            const left = modP(Z2 * modP(aX2 + Y2)); // (aX² + Y²)Z²
+            const right = modP(Z4 + modP(d * modP(X2 * Y2))); // Z⁴ + dX²Y²
+            if (left !== right)
                 throw new Error('bad point: equation left != right (1)');
             // In Extended coordinates we also have T, which is x*y=T/Z: check X*Y == Z*T
-            const XY = modP(X.mul(Y));
-            const ZT = modP(Z.mul(T));
-            if (!XY.equal(ZT))
+            const XY = modP(X * Y);
+            const ZT = modP(Z * T);
+            if (XY !== ZT)
                 throw new Error('bad point: equation left != right (2)');
         }
         // Compare one point to another.
@@ -2102,18 +2056,18 @@ function twistedEdwards(curveDef) {
             isPoint(other);
             const { ex: X1, ey: Y1, ez: Z1 } = this;
             const { ex: X2, ey: Y2, ez: Z2 } = other;
-            const X1Z2 = modP(X1.mul(Z2));
-            const X2Z1 = modP(X2.mul(Z1));
-            const Y1Z2 = modP(Y1.mul(Z2));
-            const Y2Z1 = modP(Y2.mul(Z1));
-            return X1Z2.equal(X2Z1) && Y1Z2.equal(Y2Z1);
+            const X1Z2 = modP(X1 * Z2);
+            const X2Z1 = modP(X2 * Z1);
+            const Y1Z2 = modP(Y1 * Z2);
+            const Y2Z1 = modP(Y2 * Z1);
+            return X1Z2 === X2Z1 && Y1Z2 === Y2Z1;
         }
         is0() {
             return this.equals(Point.ZERO);
         }
         negate() {
             // Flips point sign to a negative one (-x, y in affine coords)
-            return new Point(modP(this.ex.negate()), this.ey, this.ez, modP(this.et.negate()));
+            return new Point(modP(-this.ex), this.ey, this.ez, modP(-this.et));
         }
         // Fast algo for doubling Extended Point.
         // https://hyperelliptic.org/EFD/g1p/auto-twisted-extended.html#doubling-dbl-2008-hwcd
@@ -2121,19 +2075,19 @@ function twistedEdwards(curveDef) {
         double() {
             const { a } = CURVE;
             const { ex: X1, ey: Y1, ez: Z1 } = this;
-            const A = modP(X1.mul(X1)); // A = X12
-            const B = modP(Y1.mul(Y1)); // B = Y12
-            const C = modP(_2n$3.mul(modP(Z1.mul(Z1)))); // C = 2*Z12
-            const D = modP(a.mul(A)); // D = a*A
-            const x1y1 = X1.add(Y1);
-            const E = modP(modP(x1y1.mul(x1y1)).sub(A).isub(B)); // E = (X1+Y1)2-A-B
-            const G = D.add(B); // G = D+B
-            const F = G.sub(C); // F = G-C
-            const H = D.sub(B); // H = D-B
-            const X3 = modP(E.mul(F)); // X3 = E*F
-            const Y3 = modP(G.mul(H)); // Y3 = G*H
-            const T3 = modP(E.mul(H)); // T3 = E*H
-            const Z3 = modP(F.mul(G)); // Z3 = F*G
+            const A = modP(X1 * X1); // A = X12
+            const B = modP(Y1 * Y1); // B = Y12
+            const C = modP(_2n$2 * modP(Z1 * Z1)); // C = 2*Z12
+            const D = modP(a * A); // D = a*A
+            const x1y1 = X1 + Y1;
+            const E = modP(modP(x1y1 * x1y1) - A - B); // E = (X1+Y1)2-A-B
+            const G = D + B; // G = D+B
+            const F = G - C; // F = G-C
+            const H = D - B; // H = D-B
+            const X3 = modP(E * F); // X3 = E*F
+            const Y3 = modP(G * H); // Y3 = G*H
+            const T3 = modP(E * H); // T3 = E*H
+            const Z3 = modP(F * G); // Z3 = F*G
             return new Point(X3, Y3, Z3, T3);
         }
         // Fast algo for adding 2 Extended Points.
@@ -2148,35 +2102,35 @@ function twistedEdwards(curveDef) {
             // http://hyperelliptic.org/EFD/g1p/auto-twisted-extended-1.html#addition-add-2008-hwcd-4
             // Cost: 8M + 8add + 2*2.
             // Note: It does not check whether the `other` point is valid.
-            if (a.equal(BigInteger.new(-1))) {
-                const A = modP(Y1.sub(X1).imul(Y2.add(X2)));
-                const B = modP(Y1.add(X1).imul(Y2.sub(X2)));
-                const F = modP(B.sub(A));
-                if (F.isZero())
+            if (a === BigInt(-1)) {
+                const A = modP((Y1 - X1) * (Y2 + X2));
+                const B = modP((Y1 + X1) * (Y2 - X2));
+                const F = modP(B - A);
+                if (F === _0n$1)
                     return this.double(); // Same point. Tests say it doesn't affect timing
-                const C = modP(Z1.mul(_2n$3).imul(T2));
-                const D = modP(T1.mul(_2n$3).imul(Z2));
-                const E = D.add(C);
-                const G = B.add(A);
-                const H = D.sub(C);
-                const X3 = modP(E.mul(F));
-                const Y3 = modP(G.mul(H));
-                const T3 = modP(E.mul(H));
-                const Z3 = modP(F.mul(G));
+                const C = modP(Z1 * _2n$2 * T2);
+                const D = modP(T1 * _2n$2 * Z2);
+                const E = D + C;
+                const G = B + A;
+                const H = D - C;
+                const X3 = modP(E * F);
+                const Y3 = modP(G * H);
+                const T3 = modP(E * H);
+                const Z3 = modP(F * G);
                 return new Point(X3, Y3, Z3, T3);
             }
-            const A = modP(X1.mul(X2)); // A = X1*X2
-            const B = modP(Y1.mul(Y2)); // B = Y1*Y2
-            const C = modP(T1.mul(d).imul(T2)); // C = T1*d*T2
-            const D = modP(Z1.mul(Z2)); // D = Z1*Z2
-            const E = modP(X1.add(Y1).imul(X2.add(Y2)).isub(A).isub(B)); // E = (X1+Y1)*(X2+Y2)-A-B
-            const F = D.sub(C); // F = D-C
-            const G = D.add(C); // G = D+C
-            const H = modP(B.sub(a.mul(A))); // H = B-a*A
-            const X3 = modP(E.mul(F)); // X3 = E*F
-            const Y3 = modP(G.mul(H)); // Y3 = G*H
-            const T3 = modP(E.mul(H)); // T3 = E*H
-            const Z3 = modP(F.mul(G)); // Z3 = F*G
+            const A = modP(X1 * X2); // A = X1*X2
+            const B = modP(Y1 * Y2); // B = Y1*Y2
+            const C = modP(T1 * d * T2); // C = T1*d*T2
+            const D = modP(Z1 * Z2); // D = Z1*Z2
+            const E = modP((X1 + Y1) * (X2 + Y2) - A - B); // E = (X1+Y1)*(X2+Y2)-A-B
+            const F = D - C; // F = D-C
+            const G = D + C; // G = D+C
+            const H = modP(B - a * A); // H = B-a*A
+            const X3 = modP(E * F); // X3 = E*F
+            const Y3 = modP(G * H); // Y3 = G*H
+            const T3 = modP(E * H); // T3 = E*H
+            const Z3 = modP(F * G); // Z3 = F*G
             return new Point(X3, Y3, Z3, T3);
         }
         subtract(other) {
@@ -2196,9 +2150,9 @@ function twistedEdwards(curveDef) {
         // Does NOT allow scalars higher than CURVE.n.
         multiplyUnsafe(scalar) {
             let n = assertGE0(scalar); // 0 <= scalar < CURVE.n
-            if (n.isZero())
+            if (n === _0n$1)
                 return I;
-            if (this.equals(I) || n.isOne())
+            if (this.equals(I) || n === _1n$3)
                 return this;
             if (this.equals(G))
                 return this.wNAF(n).p;
@@ -2223,18 +2177,18 @@ function twistedEdwards(curveDef) {
             const is0 = this.is0();
             if (iz == null)
                 iz = is0 ? _8n : Fp.inv(z); // 8 was chosen arbitrarily
-            const ax = modP(x.mul(iz));
-            const ay = modP(y.mul(iz));
-            const zz = modP(z.mul(iz));
+            const ax = modP(x * iz);
+            const ay = modP(y * iz);
+            const zz = modP(z * iz);
             if (is0)
-                return { x: _0n$1.clone(), y: _1n$3.clone() };
-            if (!zz.isOne())
+                return { x: _0n$1, y: _1n$3 };
+            if (zz !== _1n$3)
                 throw new Error('invZ was invalid');
             return { x: ax, y: ay };
         }
         clearCofactor() {
             const { h: cofactor } = CURVE;
-            if (cofactor.isOne())
+            if (cofactor === _1n$3)
                 return this;
             return this.multiplyUnsafe(cofactor);
         }
@@ -2248,7 +2202,7 @@ function twistedEdwards(curveDef) {
             const lastByte = hex[len - 1]; // select last byte
             normed[len - 1] = lastByte & ~0x80; // clear last bit
             const y = bytesToNumberLE(normed);
-            if (y.isZero()) ;
+            if (y === _0n$1) ;
             else {
                 // RFC8032 prohibits >= p, but ZIP215 doesn't
                 if (zip215)
@@ -2258,19 +2212,19 @@ function twistedEdwards(curveDef) {
             }
             // Ed25519: x² = (y²-1)/(dy²+1) mod p. Ed448: x² = (y²-1)/(dy²-1) mod p. Generic case:
             // ax²+y²=1+dx²y² => y²-1=dx²y²-ax² => y²-1=x²(dy²-a) => x²=(y²-1)/(dy²-a)
-            const y2 = modP(y.mul(y)); // denominator is always non-0 mod p.
-            const u = modP(y2.dec()); // u = y² - 1
-            const v = modP(d.mul(y2).isub(a)); // v = d y² + 1.
+            const y2 = modP(y * y); // denominator is always non-0 mod p.
+            const u = modP(y2 - _1n$3); // u = y² - 1
+            const v = modP(d * y2 - a); // v = d y² + 1.
             let { isValid, value: x } = uvRatio(u, v); // √(u/v)
             if (!isValid)
                 throw new Error('Point.fromHex: invalid y coordinate');
-            const isXOdd = !x.isEven(); // There are 2 square roots. Use x_0 bit to select proper
+            const isXOdd = (x & _1n$3) === _1n$3; // There are 2 square roots. Use x_0 bit to select proper
             const isLastByteOdd = (lastByte & 0x80) !== 0; // x_0, last bit
-            if (!zip215 && x.isZero() && isLastByteOdd)
+            if (!zip215 && x === _0n$1 && isLastByteOdd)
                 // if x=0 and x_0 = 1, fail
                 throw new Error('Point.fromHex: x=0 and x_0=1');
             if (isLastByteOdd !== isXOdd)
-                x = modP(x.negate()); // if x_0 != x mod 2, set x = p-x
+                x = modP(-x); // if x_0 != x mod 2, set x = p-x
             return Point.fromAffine({ x, y });
         }
         static fromPrivateKey(privKey) {
@@ -2278,15 +2232,15 @@ function twistedEdwards(curveDef) {
         }
         toRawBytes() {
             const { x, y } = this.toAffine();
-            const bytes = y.toUint8Array('le', Fp.BYTES); // each y has 2 x values (x, -y)
-            bytes[bytes.length - 1] |= x.isEven() ? 0 : 0x80; // when compressing, it's enough to store y
+            const bytes = numberToBytesLE(y, Fp.BYTES); // each y has 2 x values (x, -y)
+            bytes[bytes.length - 1] |= x & _1n$3 ? 0x80 : 0; // when compressing, it's enough to store y
             return bytes; // and use the last byte to encode sign of x
         }
         toHex() {
             return bytesToHex(this.toRawBytes()); // Same as toRawBytes, but returns string.
         }
     }
-    Point.BASE = new Point(CURVE.Gx, CURVE.Gy, _1n$3, modP(CURVE.Gx.mul(CURVE.Gy)));
+    Point.BASE = new Point(CURVE.Gx, CURVE.Gy, _1n$3, modP(CURVE.Gx * CURVE.Gy));
     Point.ZERO = new Point(_0n$1, _1n$3, _1n$3, _0n$1); // 0, 1, 1, 0
     const { BASE: G, ZERO: I } = Point;
     const wnaf = wNAF(Point, nByteLength * 8);
@@ -2329,9 +2283,9 @@ function twistedEdwards(curveDef) {
         const r = hashDomainToScalar(options.context, prefix, msg); // r = dom2(F, C) || prefix || PH(M)
         const R = G.multiply(r).toRawBytes(); // R = rG
         const k = hashDomainToScalar(options.context, R, pointBytes, msg); // R || A || PH(M)
-        const s = modN(r.add(k.mul(scalar))); // S = (r + k * s) mod L
+        const s = modN(r + k * scalar); // S = (r + k * s) mod L
         assertGE0(s); // 0 <= s < l
-        const res = concatBytes(R, s.toUint8Array('le', Fp.BYTES));
+        const res = concatBytes(R, numberToBytesLE(s, Fp.BYTES));
         return ensureBytes('result', res, nByteLength * 2); // 64-byte signature
     }
     const verifyOpts = VERIFY_DEFAULT;
@@ -2374,7 +2328,7 @@ function twistedEdwards(curveDef) {
          */
         precompute(windowSize = 8, point = Point.BASE) {
             point._setWindowSize(windowSize);
-            point.multiply(_3n$1);
+            point.multiply(BigInt(3));
             return point;
         },
     };
@@ -2389,19 +2343,18 @@ function twistedEdwards(curveDef) {
 }
 
 /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-const _0n = Object.freeze(BigInteger.new(0));
-const _1n$2 = Object.freeze(BigInteger.new(1));
-const _2n$2 = Object.freeze(BigInteger.new(2));
+const _0n = BigInt(0);
+const _1n$2 = BigInt(1);
 function validateOpts(curve) {
     validateObject(curve, {
-        a: 'BigInteger',
+        a: 'bigint',
     }, {
         montgomeryBits: 'isSafeInteger',
         nByteLength: 'isSafeInteger',
         adjustScalarBytes: 'function',
         domain: 'function',
         powPminus2: 'function',
-        Gu: 'BigInteger',
+        Gu: 'bigint',
     });
     // Set defaults
     return Object.freeze({ ...curve });
@@ -2416,7 +2369,7 @@ function montgomery(curveDef) {
     const montgomeryBytes = Math.ceil(montgomeryBits / 8);
     const fieldLen = CURVE.nByteLength;
     const adjustScalarBytes = CURVE.adjustScalarBytes || ((bytes) => bytes);
-    const powPminus2 = CURVE.powPminus2 || ((x) => pow(x, P.sub(_2n$2), P));
+    const powPminus2 = CURVE.powPminus2 || ((x) => pow(x, P - BigInt(2), P));
     // cswap from RFC7748. But it is not from RFC7748!
     /*
       cswap(swap, x_2, x_3):
@@ -2428,20 +2381,20 @@ function montgomery(curveDef) {
      and x_3, computed, e.g., as mask(swap) = 0 - swap.
     */
     function cswap(swap, x_2, x_3) {
-        const dummy = modP(swap.mul(x_2.sub(x_3)));
-        x_2 = modP(x_2.sub(dummy));
-        x_3 = modP(x_3.add(dummy));
+        const dummy = modP(swap * (x_2 - x_3));
+        x_2 = modP(x_2 - dummy);
+        x_3 = modP(x_3 + dummy);
         return [x_2, x_3];
     }
     // Accepts 0 as well
     function assertFieldElement(n) {
-        if (n instanceof BigInteger && !n.isNegative() && n.lt(P))
+        if (typeof n === 'bigint' && _0n <= n && n < P)
             return n;
         throw new Error('Expected valid scalar 0 < scalar < CURVE.P');
     }
     // x25519 from 4
     // The constant a24 is (486662 - 2) / 4 = 121665 for curve25519/X25519
-    const a24 = CURVE.a.sub(_2n$2).irightShift(_2n$2);
+    const a24 = (CURVE.a - BigInt(2)) / BigInt(4);
     /**
      *
      * @param pointU u coordinate (x) on Montgomery Curve 25519
@@ -2458,11 +2411,11 @@ function montgomery(curveDef) {
         let z_2 = _0n;
         let x_3 = u;
         let z_3 = _1n$2;
-        let swap = _0n.clone();
+        let swap = _0n;
         let sw;
-        for (let t = BigInteger.new(montgomeryBits - 1); !t.isNegative(); t.idec()) {
-            const k_t = BigInteger.new((k.rightShift(t)).getBit(0));
-            swap.ixor(k_t);
+        for (let t = BigInt(montgomeryBits - 1); t >= _0n; t--) {
+            const k_t = (k >> t) & _1n$2;
+            swap ^= k_t;
             sw = cswap(swap, x_2, x_3);
             x_2 = sw[0];
             x_3 = sw[1];
@@ -2470,21 +2423,21 @@ function montgomery(curveDef) {
             z_2 = sw[0];
             z_3 = sw[1];
             swap = k_t;
-            const A = x_2.add(z_2);
-            const AA = modP(A.mul(A));
-            const B = x_2.sub(z_2);
-            const BB = modP(B.mul(B));
-            const E = AA.sub(BB);
-            const C = x_3.add(z_3);
-            const D = x_3.sub(z_3);
-            const DA = modP(D.mul(A));
-            const CB = modP(C.mul(B));
-            const dacb = DA.add(CB);
-            const da_cb = DA.sub(CB);
-            x_3 = modP(dacb.mul(dacb));
-            z_3 = modP(x_1.mul(modP(da_cb.mul(da_cb))));
-            x_2 = modP(AA.mul(BB));
-            z_2 = modP(E.mul(AA.add(modP(a24.mul(E)))));
+            const A = x_2 + z_2;
+            const AA = modP(A * A);
+            const B = x_2 - z_2;
+            const BB = modP(B * B);
+            const E = AA - BB;
+            const C = x_3 + z_3;
+            const D = x_3 - z_3;
+            const DA = modP(D * A);
+            const CB = modP(C * B);
+            const dacb = DA + CB;
+            const da_cb = DA - CB;
+            x_3 = modP(dacb * dacb);
+            z_3 = modP(x_1 * modP(da_cb * da_cb));
+            x_2 = modP(AA * BB);
+            z_2 = modP(E * (AA + modP(a24 * E)));
         }
         // (x_2, x_3) = cswap(swap, x_2, x_3)
         sw = cswap(swap, x_2, x_3);
@@ -2497,7 +2450,7 @@ function montgomery(curveDef) {
         // z_2^(p - 2)
         const z2 = powPminus2(z_2);
         // Return x_2 * (z_2^(p - 2))
-        return modP(x_2.mul(z2));
+        return modP(x_2 * z2);
     }
     function encodeUCoordinate(u) {
         return numberToBytesLE(modP(u), montgomeryBytes);
@@ -2523,7 +2476,7 @@ function montgomery(curveDef) {
         const pu = montgomeryLadder(pointU, _scalar);
         // The result was not contributory
         // https://cr.yp.to/ecdh.html#validate
-        if (pu.isZero())
+        if (pu === _0n)
             throw new Error('Invalid private or public key received');
         return encodeUCoordinate(pu);
     }
@@ -2552,29 +2505,29 @@ function montgomery(curveDef) {
  */
 const shake256_114 = wrapConstructor(() => shake256.create({ dkLen: 114 }));
 const shake256_64 = wrapConstructor(() => shake256.create({ dkLen: 64 }));
-const ed448P = BigInteger.new('726838724295606890549323807888004534353641360687318060281490199180612328166730772686396383698676545930088884461843637361053498018365439');
+const ed448P = BigInt('726838724295606890549323807888004534353641360687318060281490199180612328166730772686396383698676545930088884461843637361053498018365439');
 // prettier-ignore
-const _1n$1 = BigInteger.new(1), _2n$1 = BigInteger.new(2), _3n = BigInteger.new(3), _11n = BigInteger.new(11);
+const _1n$1 = BigInt(1), _2n$1 = BigInt(2), _3n = BigInt(3); BigInt(4); const _11n = BigInt(11);
 // prettier-ignore
-const _22n = BigInteger.new(22), _44n = BigInteger.new(44), _88n = BigInteger.new(88), _223n = BigInteger.new(223);
+const _22n = BigInt(22), _44n = BigInt(44), _88n = BigInt(88), _223n = BigInt(223);
 // powPminus3div4 calculates z = x^k mod p, where k = (p-3)/4.
 // Used for efficient square root calculation.
 // ((P-3)/4).toString(2) would produce bits [223x 1, 0, 222x 1]
 function ed448_pow_Pminus3div4(x) {
     const P = ed448P;
-    const b2 = x.modExp(_3n, P);
-    const b3 = b2.mul(b2).imul(x).imod(P);
-    const b6 = pow2(b3, _3n, P).imul(b3).imod(P);
-    const b9 = pow2(b6, _3n, P).imul(b3).imod(P);
-    const b11 = pow2(b9, _2n$1, P).imul(b2).imod(P);
-    const b22 = pow2(b11, _11n, P).imul(b11).imod(P);
-    const b44 = pow2(b22, _22n, P).imul(b22).imod(P);
-    const b88 = pow2(b44, _44n, P).imul(b44).imod(P);
-    const b176 = pow2(b88, _88n, P).imul(b88).imod(P);
-    const b220 = pow2(b176, _44n, P).imul(b44).imod(P);
-    const b222 = pow2(b220, _2n$1, P).imul(b2).imod(P);
-    const b223 = pow2(b222, _1n$1, P).imul(x).imod(P);
-    return pow2(b223, _223n, P).imul(b222).imod(P);
+    const b2 = (x * x * x) % P;
+    const b3 = (b2 * b2 * x) % P;
+    const b6 = (pow2(b3, _3n, P) * b3) % P;
+    const b9 = (pow2(b6, _3n, P) * b3) % P;
+    const b11 = (pow2(b9, _2n$1, P) * b2) % P;
+    const b22 = (pow2(b11, _11n, P) * b11) % P;
+    const b44 = (pow2(b22, _22n, P) * b22) % P;
+    const b88 = (pow2(b44, _44n, P) * b44) % P;
+    const b176 = (pow2(b88, _88n, P) * b88) % P;
+    const b220 = (pow2(b176, _44n, P) * b44) % P;
+    const b222 = (pow2(b220, _2n$1, P) * b2) % P;
+    const b223 = (pow2(b222, _1n$1, P) * x) % P;
+    return (pow2(b223, _223n, P) * b222) % P;
 }
 function adjustScalarBytes(bytes) {
     // Section 5: Likewise, for X448, set the two least significant bits of the first byte to 0, and the most
@@ -2596,35 +2549,35 @@ function uvRatio(u, v) {
     // following trick, to use a single modular powering for both the
     // inversion of v and the square root:
     // x = (u/v)^((p+1)/4)   = u³v(u⁵v³)^((p-3)/4)   (mod p)
-    const u2v = mod(u.mul(u).imul(v), P); // u²v
-    const u3v = mod(u2v.mul(u), P); // u³v
-    const u5v3 = mod(u3v.mul(u2v).imul(v), P); // u⁵v³
+    const u2v = mod(u * u * v, P); // u²v
+    const u3v = mod(u2v * u, P); // u³v
+    const u5v3 = mod(u3v * u2v * v, P); // u⁵v³
     const root = ed448_pow_Pminus3div4(u5v3);
-    const x = mod(u3v.mul(root), P);
+    const x = mod(u3v * root, P);
     // Verify that root is exists
-    const x2 = mod(x.mul(x), P); // x²
+    const x2 = mod(x * x, P); // x²
     // If vx² = u, the recovered x-coordinate is x.  Otherwise, no
     // square root exists, and the decoding fails.
-    return { isValid: mod(x2.mul(v), P).equal(u), value: x };
+    return { isValid: mod(x2 * v, P) === u, value: x };
 }
-const Fp$1 = Field(ed448P, 456, true);
+const Fp$4 = Field(ed448P, 456, true);
 const ED448_DEF = {
     // Param: a
-    a: BigInteger.new(1),
+    a: BigInt(1),
     // -39081. Negative number is P - number
-    d: BigInteger.new('726838724295606890549323807888004534353641360687318060281490199180612328166730772686396383698676545930088884461843637361053498018326358'),
+    d: BigInt('726838724295606890549323807888004534353641360687318060281490199180612328166730772686396383698676545930088884461843637361053498018326358'),
     // Finite field 𝔽p over which we'll do calculations; 2n**448n - 2n**224n - 1n
-    Fp: Fp$1,
+    Fp: Fp$4,
     // Subgroup order: how many points curve has;
     // 2n**446n - 13818066809895115352007386748515426880336692474882178609894547503885n
-    n: BigInteger.new('181709681073901722637330951972001133588410340171829515070372549795146003961539585716195755291692375963310293709091662304773755859649779'),
+    n: BigInt('181709681073901722637330951972001133588410340171829515070372549795146003961539585716195755291692375963310293709091662304773755859649779'),
     // RFC 7748 has 56-byte keys, RFC 8032 has 57-byte keys
     nBitLength: 456,
     // Cofactor
-    h: BigInteger.new(4),
+    h: BigInt(4),
     // Base point (x, y) aka generator point
-    Gx: BigInteger.new('224580040295924300187604334099896036246789641632564134246125461686950415467406032909029192869357953282578032075146446173674602635247710'),
-    Gy: BigInteger.new('298819210078481492676017930443930673437544040154080242095928241372331506189835876003536878655418784733982303233503462500531545062832660'),
+    Gx: BigInt('224580040295924300187604334099896036246789641632564134246125461686950415467406032909029192869357953282578032075146446173674602635247710'),
+    Gy: BigInt('298819210078481492676017930443930673437544040154080242095928241372331506189835876003536878655418784733982303233503462500531545062832660'),
     // SHAKE256(dom4(phflag,context)||x, 114)
     hash: shake256_114,
     randomBytes,
@@ -2641,42 +2594,41 @@ const ed448 = /* @__PURE__ */ twistedEdwards(ED448_DEF);
 // NOTE: there is no ed448ctx, since ed448 supports ctx by default
 /* @__PURE__ */ twistedEdwards({ ...ED448_DEF, prehash: shake256_64 });
 const x448 = /* @__PURE__ */ (() => montgomery({
-    a: BigInteger.new(156326),
+    a: BigInt(156326),
+    // RFC 7748 has 56-byte keys, RFC 8032 has 57-byte keys
     montgomeryBits: 448,
     nByteLength: 56,
     P: ed448P,
-    Gu: BigInteger.new(5),
+    Gu: BigInt(5),
     powPminus2: (x) => {
         const P = ed448P;
         const Pminus3div4 = ed448_pow_Pminus3div4(x);
-        const Pminus3 = pow2(Pminus3div4, BigInteger.new(2), P);
-        return mod(Pminus3.mul(x), P); // Pminus3 * x = Pminus2
+        const Pminus3 = pow2(Pminus3div4, BigInt(2), P);
+        return mod(Pminus3 * x, P); // Pminus3 * x = Pminus2
     },
     adjustScalarBytes,
     randomBytes,
 }))();
 // TODO: add edwardsToMontgomeryPriv, similar to ed25519 version
-Object.freeze(BigInteger.new(4));
 // Hash To Curve Elligator2 Map
-Fp$1.ORDER.sub(_3n).irightShift(_2n$1); // 1. c1 = (q - 3) / 4         # Integer arithmetic
-BigInteger.new(156326);
+(Fp$4.ORDER - BigInt(3)) / BigInt(4); // 1. c1 = (q - 3) / 4         # Integer arithmetic
+BigInt(156326);
 // 1-d
-BigInteger.new('39082');
+BigInt('39082');
 // 1-2d
-BigInteger.new('78163');
+BigInt('78163');
 // √(-d)
-BigInteger.new('98944233647732219769177004876929019128417576295529901074099889598043702116001257856802131563896515373927712232092845883226922417596214');
+BigInt('98944233647732219769177004876929019128417576295529901074099889598043702116001257856802131563896515373927712232092845883226922417596214');
 // 1 / √(-d)
-BigInteger.new('315019913931389607337177038330951043522456072897266928557328499619017160722351061360252776265186336876723201881398623946864393857820716');
-BigInteger.new('0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff');
+BigInt('315019913931389607337177038330951043522456072897266928557328499619017160722351061360252776265186336876723201881398623946864393857820716');
+BigInt('0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff');
 
 /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-const secp256k1P = Object.freeze(BigInteger.new('0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f'));
-const secp256k1N = Object.freeze(BigInteger.new('0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141'));
-Object.freeze(BigInteger.new(0));
-const _1n = Object.freeze(BigInteger.new(1));
-const _2n = Object.freeze(BigInteger.new(2));
-const divNearest = (a, b) => a.add(b.rightShift(_1n)).idiv(b);
+const secp256k1P = BigInt('0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f');
+const secp256k1N = BigInt('0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141');
+const _1n = BigInt(1);
+const _2n = BigInt(2);
+const divNearest = (a, b) => (a + b / _2n) / b;
 /**
  * √n = n^((p+1)/4) for fields p = 3 mod 4. We unwrap the loop and multiply bit-by-bit.
  * (P+1n/4n).toString(2) would produce bits [223x 1, 0, 22x 1, 4x 0, 11, 00]
@@ -2684,37 +2636,37 @@ const divNearest = (a, b) => a.add(b.rightShift(_1n)).idiv(b);
 function sqrtMod(y) {
     const P = secp256k1P;
     // prettier-ignore
-    const _3n = BigInteger.new(3), _6n = BigInteger.new(6), _11n = BigInteger.new(11), _22n = BigInteger.new(22);
+    const _3n = BigInt(3), _6n = BigInt(6), _11n = BigInt(11), _22n = BigInt(22);
     // prettier-ignore
-    const _23n = BigInteger.new(23), _44n = BigInteger.new(44), _88n = BigInteger.new(88);
-    const b2 = y.mul(y).imul(y).imod(P); // x^3, 11
-    const b3 = b2.mul(b2).imul(y).imod(P); // x^7
-    const b6 = pow2(b3, _3n, P).imul(b3).imod(P);
-    const b9 = pow2(b6, _3n, P).imul(b3).imod(P);
-    const b11 = pow2(b9, _2n, P).imul(b2).imod(P);
-    const b22 = pow2(b11, _11n, P).imul(b11).imod(P);
-    const b44 = pow2(b22, _22n, P).imul(b22).imod(P);
-    const b88 = pow2(b44, _44n, P).imul(b44).imod(P);
-    const b176 = pow2(b88, _88n, P).imul(b88).imod(P);
-    const b220 = pow2(b176, _44n, P).imul(b44).imod(P);
-    const b223 = pow2(b220, _3n, P).imul(b3).imod(P);
-    const t1 = pow2(b223, _23n, P).imul(b22).imod(P);
-    const t2 = pow2(t1, _6n, P).imul(b2).imod(P);
+    const _23n = BigInt(23), _44n = BigInt(44), _88n = BigInt(88);
+    const b2 = (y * y * y) % P; // x^3, 11
+    const b3 = (b2 * b2 * y) % P; // x^7
+    const b6 = (pow2(b3, _3n, P) * b3) % P;
+    const b9 = (pow2(b6, _3n, P) * b3) % P;
+    const b11 = (pow2(b9, _2n, P) * b2) % P;
+    const b22 = (pow2(b11, _11n, P) * b11) % P;
+    const b44 = (pow2(b22, _22n, P) * b22) % P;
+    const b88 = (pow2(b44, _44n, P) * b44) % P;
+    const b176 = (pow2(b88, _88n, P) * b88) % P;
+    const b220 = (pow2(b176, _44n, P) * b44) % P;
+    const b223 = (pow2(b220, _3n, P) * b3) % P;
+    const t1 = (pow2(b223, _23n, P) * b22) % P;
+    const t2 = (pow2(t1, _6n, P) * b2) % P;
     const root = pow2(t2, _2n, P);
-    if (!Fp.eql(Fp.sqr(root), y))
+    if (!Fp$3.eql(Fp$3.sqr(root), y))
         throw new Error('Cannot find square root');
     return root;
 }
-const Fp = Field(secp256k1P, undefined, undefined, { sqrt: sqrtMod });
+const Fp$3 = Field(secp256k1P, undefined, undefined, { sqrt: sqrtMod });
 const secp256k1 = createCurve({
-    a: BigInteger.new(0), // equation params: a, b
-    b: BigInteger.new(7), // Seem to be rigid: bitcointalk.org/index.php?topic=289795.msg3183975#msg3183975
-    Fp, // Field's prime: 2n**256n - 2n**32n - 2n**9n - 2n**8n - 2n**7n - 2n**6n - 2n**4n - 1n
+    a: BigInt(0), // equation params: a, b
+    b: BigInt(7), // Seem to be rigid: bitcointalk.org/index.php?topic=289795.msg3183975#msg3183975
+    Fp: Fp$3, // Field's prime: 2n**256n - 2n**32n - 2n**9n - 2n**8n - 2n**7n - 2n**6n - 2n**4n - 1n
     n: secp256k1N, // Curve order, total count of valid points in the field
     // Base point (x, y) aka generator point
-    Gx: BigInteger.new('55066263022277343669578718895168534326250603453777594175500187360389116729240'),
-    Gy: BigInteger.new('32670510020758816978083085130507043184471273380659243275938904335757337482424'),
-    h: BigInteger.new(1), // Cofactor
+    Gx: BigInt('55066263022277343669578718895168534326250603453777594175500187360389116729240'),
+    Gy: BigInt('32670510020758816978083085130507043184471273380659243275938904335757337482424'),
+    h: BigInt(1), // Cofactor
     lowS: true, // Allow only low-S signatures by default in sign() and verify()
     /**
      * secp256k1 belongs to Koblitz curves: it has efficiently computable endomorphism.
@@ -2723,33 +2675,93 @@ const secp256k1 = createCurve({
      * Explanation: https://gist.github.com/paulmillr/eb670806793e84df628a7c434a873066
      */
     endo: {
-        beta: BigInteger.new('0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee'),
+        beta: BigInt('0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee'),
         splitScalar: (k) => {
             const n = secp256k1N;
-            const a1 = BigInteger.new('0x3086d221a7d46bcde86c90e49284eb15');
-            const b1 = _1n.negate().imul(BigInteger.new('0xe4437ed6010e88286f547fa90abfe4c3'));
-            const a2 = BigInteger.new('0x114ca50f7a8e2f3f657c1108d9d44cfd8');
+            const a1 = BigInt('0x3086d221a7d46bcde86c90e49284eb15');
+            const b1 = -_1n * BigInt('0xe4437ed6010e88286f547fa90abfe4c3');
+            const a2 = BigInt('0x114ca50f7a8e2f3f657c1108d9d44cfd8');
             const b2 = a1;
-            const POW_2_128 = BigInteger.new('0x100000000000000000000000000000000'); // (2n**128n).toString(16)
-            const c1 = divNearest(b2.mul(k), n);
-            const c2 = divNearest(b1.negate().imul(k), n);
-            let k1 = mod(k.sub(c1.mul(a1)).sub(c2.mul(a2)), n);
-            let k2 = mod(c1.negate().mul(b1).isub(c2.mul(b2)), n);
-            const k1neg = k1.gt(POW_2_128);
-            const k2neg = k2.gt(POW_2_128);
+            const POW_2_128 = BigInt('0x100000000000000000000000000000000'); // (2n**128n).toString(16)
+            const c1 = divNearest(b2 * k, n);
+            const c2 = divNearest(-b1 * k, n);
+            let k1 = mod(k - c1 * a1 - c2 * a2, n);
+            let k2 = mod(-c1 * b1 - c2 * b2, n);
+            const k1neg = k1 > POW_2_128;
+            const k2neg = k2 > POW_2_128;
             if (k1neg)
-                k1 = n.sub(k1);
+                k1 = n - k1;
             if (k2neg)
-                k2 = n.sub(k2);
-            if (k1.gt(POW_2_128) || k2.gt(POW_2_128)) {
+                k2 = n - k2;
+            if (k1 > POW_2_128 || k2 > POW_2_128) {
                 throw new Error('splitScalar: Endomorphism failed, k=' + k);
             }
             return { k1neg, k1, k2neg, k2 };
         },
     },
 }, sha256);
+// Schnorr signatures are superior to ECDSA from above. Below is Schnorr-specific BIP0340 code.
+// https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki
+BigInt(0);
 secp256k1.ProjectivePoint;
 
+// brainpoolP256r1: https://datatracker.ietf.org/doc/html/rfc5639#section-3.4
+// eslint-disable-next-line new-cap
+const Fp$2 = Field(BigInt('0xa9fb57dba1eea9bc3e660a909d838d726e3bf623d52620282013481d1f6e5377'));
+const CURVE_A$2 = Fp$2.create(BigInt('0x7d5a0975fc2c3057eef67530417affe7fb8055c126dc5c6ce94a4b44f330b5d9'));
+const CURVE_B$2 = BigInt('0x26dc5c6ce94a4b44f330b5d9bbd77cbf958416295cf7e1ce6bccdc18ff8c07b6');
+// prettier-ignore
+const brainpoolP256r1 = createCurve({
+    a: CURVE_A$2, // Equation params: a, b
+    b: CURVE_B$2,
+    Fp: Fp$2,
+    // Curve order (q), total count of valid points in the field
+    n: BigInt('0xa9fb57dba1eea9bc3e660a909d838d718c397aa3b561a6f7901e0e82974856a7'),
+    // Base (generator) point (x, y)
+    Gx: BigInt('0x8bd2aeb9cb7e57cb2c4b482ffc81b7afb9de27e1e3bd23c23a4453bd9ace3262'),
+    Gy: BigInt('0x547ef835c3dac4fd97f8461a14611dc9c27745132ded8e545c1d54c72f046997'),
+    h: BigInt(1),
+    lowS: false
+}, sha256);
+
+// brainpoolP384 r1: https://datatracker.ietf.org/doc/html/rfc5639#section-3.6
+// eslint-disable-next-line new-cap
+const Fp$1 = Field(BigInt('0x8cb91e82a3386d280f5d6f7e50e641df152f7109ed5456b412b1da197fb71123acd3a729901d1a71874700133107ec53'));
+const CURVE_A$1 = Fp$1.create(BigInt('0x7bc382c63d8c150c3c72080ace05afa0c2bea28e4fb22787139165efba91f90f8aa5814a503ad4eb04a8c7dd22ce2826'));
+const CURVE_B$1 = BigInt('0x04a8c7dd22ce28268b39b55416f0447c2fb77de107dcd2a62e880ea53eeb62d57cb4390295dbc9943ab78696fa504c11');
+// prettier-ignore
+const brainpoolP384r1 = createCurve({
+    a: CURVE_A$1, // Equation params: a, b
+    b: CURVE_B$1,
+    Fp: Fp$1,
+    // Curve order (q), total count of valid points in the field
+    n: BigInt('0x8cb91e82a3386d280f5d6f7e50e641df152f7109ed5456b31f166e6cac0425a7cf3ab6af6b7fc3103b883202e9046565'),
+    // Base (generator) point (x, y)
+    Gx: BigInt('0x1d1c64f068cf45ffa2a63a81b7c13f6b8847a3e77ef14fe3db7fcafe0cbd10e8e826e03436d646aaef87b2e247d4af1e'),
+    Gy: BigInt('0x8abe1d7520f9c2a45cb1eb8e95cfd55262b70b29feec5864e19c054ff99129280e4646217791811142820341263c5315'),
+    h: BigInt(1),
+    lowS: false
+}, sha384);
+
+// brainpoolP512r1: https://datatracker.ietf.org/doc/html/rfc5639#section-3.7
+// eslint-disable-next-line new-cap
+const Fp = Field(BigInt('0xaadd9db8dbe9c48b3fd4e6ae33c9fc07cb308db3b3c9d20ed6639cca703308717d4d9b009bc66842aecda12ae6a380e62881ff2f2d82c68528aa6056583a48f3'));
+const CURVE_A = Fp.create(BigInt('0x7830a3318b603b89e2327145ac234cc594cbdd8d3df91610a83441caea9863bc2ded5d5aa8253aa10a2ef1c98b9ac8b57f1117a72bf2c7b9e7c1ac4d77fc94ca'));
+const CURVE_B = BigInt('0x3df91610a83441caea9863bc2ded5d5aa8253aa10a2ef1c98b9ac8b57f1117a72bf2c7b9e7c1ac4d77fc94cadc083e67984050b75ebae5dd2809bd638016f723');
+// prettier-ignore
+const brainpoolP512r1 = createCurve({
+    a: CURVE_A, // Equation params: a, b
+    b: CURVE_B,
+    Fp,
+    // Curve order (q), total count of valid points in the field
+    n: BigInt('0xaadd9db8dbe9c48b3fd4e6ae33c9fc07cb308db3b3c9d20ed6639cca70330870553e5c414ca92619418661197fac10471db1d381085ddaddb58796829ca90069'),
+    // Base (generator) point (x, y)
+    Gx: BigInt('0x81aee4bdd82ed9645a21322e9c4c6a9385ed9f70b5d916c1b43b62eef4d0098eff3b1f78e2d0d48d50d1687b93b97d5f7c6d5047406a5e688b352209bcb9f822'),
+    Gy: BigInt('0x7dde385d566332ecc0eabfa9cf7822fdf209f70024a57b1aa000c55b881f8111b2dcde494a5f485e5bca4bd88a2763aed1ca2b2fa8f0540678cd1e0f3ad80892'),
+    h: BigInt(1),
+    lowS: false
+}, sha512);
+
 /**
  * This file is needed to dynamic import the noble-curves.
  * Separate dynamic imports are not convenient as they result in too many chunks,