@smartledger/bsv 5.1.0 → 5.3.0

package/lib/crypto/point.js

@@ -1,50 +1,108 @@
 'use strict'
 
 var BN = require('./bn')
+var { secp256k1 } = require('@noble/curves/secp256k1.js')
 
-var EC = require('elliptic').ec
-var ec = new EC('secp256k1')
-var ecPoint = ec.curve.point.bind(ec.curve)
-var ecPointFromX = ec.curve.pointFromX.bind(ec.curve)
+// secp256k1 point + curve order from the audited @noble/curves implementation.
+// This module preserves the (elliptic-derived) Point API the rest of the
+// codebase depends on — mul/add/mulAdd/getX/getY/.x/.y/eq/isInfinity/validate,
+// the static getG/getN/fromX/fromBuffer helpers — so ECDSA and key handling are
+// unchanged. Only the underlying EC math moved from `elliptic` to `@noble`.
+var NoblePoint = secp256k1.Point
+var N_BIG = NoblePoint.Fn.ORDER
+
+function bnToBig (bn) {
+  // Coordinates and scalars in this codebase are always non-negative.
+  return BigInt('0x' + (bn.toString(16) || '0'))
+}
+
+function bigToBN (big) {
+  var h = big.toString(16)
+  if (h.length % 2) h = '0' + h
+  return new BN(h, 16)
+}
+
+function toBig (v) {
+  if (v == null) throw new Error('Invalid Point')
+  if (typeof v === 'bigint') return v
+  if (typeof v === 'number') return BigInt(v)
+  if (typeof v === 'string') return BigInt(v.indexOf('0x') === 0 ? v : '0x' + v)
+  if (typeof v.toString === 'function') return bnToBig(v) // BN
+  throw new Error('Invalid Point')
+}
+
+// Wrap a raw @noble point as a Point instance without re-validating (used by
+// internal results of mul/add/getG/fromX which are already valid).
+function wrap (noblePoint) {
+  var p = Object.create(Point.prototype)
+  p._p = noblePoint
+  return p
+}
+
+// Derive the on-curve @noble point at the given X with the requested Y parity.
+// Throws if X is not a valid curve x-coordinate. Low-level (no Point.validate),
+// so it is safe to call from validate() without recursion.
+function nobleFromX (odd, x) {
+  // Build the compressed encoding via hex string padding (not BN.toBuffer) so we
+  // don't perturb BN.toBuffer call counts the rest of the codebase may rely on.
+  var xhex = toBig(x).toString(16).padStart(64, '0')
+  return NoblePoint.fromHex((odd ? '03' : '02') + xhex)
+}
+
+// Check that (xb, yb) — raw bigint coordinates — lie on the curve, producing
+// the same error messages the previous (elliptic) implementation did. Operates
+// on raw coordinates so it works even for inputs @noble's fromAffine rejects
+// outright (e.g. y = 0).
+function checkOnCurve (xb, yb) {
+  var p2
+  try {
+    p2 = nobleFromX((yb & 1n) === 1n, xb)
+  } catch (e) {
+    throw new Error('Point does not lie on the curve')
+  }
+  if (p2.toAffine().y !== yb) {
+    throw new Error('Invalid y value for curve.')
+  }
+}
 
 /**
- * Instantiate a valid secp256k1 Point from the X and Y coordinates. This class
- * is just an extension of the secp256k1 code from the library "elliptic" by
- * Fedor Indutny. It includes a few extra features that are useful in Bitcoin.
- *
+ * Instantiate a valid secp256k1 Point from the X and Y coordinates.
  * @param {BN|String} x - The X coordinate
  * @param {BN|String} y - The Y coordinate
- * @link https://github.com/indutny/elliptic
- * @augments elliptic.curve.point
- * @throws {Error} A validation error if exists
- * @returns {Point} An instance of Point
+ * @returns {Point}
  * @constructor
  */
-var Point = function Point (x, y, isRed) {
+function Point (x, y, isRed) {
+  if (!(this instanceof Point)) {
+    return new Point(x, y, isRed)
+  }
+  var xb, yb
   try {
-    var point = ecPoint(x, y, isRed)
+    xb = toBig(x)
+    yb = toBig(y)
   } catch (e) {
     throw new Error('Invalid Point')
   }
-  point.validate()
-  return point
+  // Validate on the raw coordinates first (gives the specific curve/y errors and
+  // works for coordinates @noble's fromAffine rejects, e.g. y = 0).
+  checkOnCurve(xb, yb)
+  try {
+    this._p = NoblePoint.fromAffine({ x: xb, y: yb })
+  } catch (e) {
+    throw new Error('Invalid Point')
+  }
+  return this
 }
 
-Point.prototype = Object.getPrototypeOf(ec.curve.point())
-
 /**
- *
- * Instantiate a valid secp256k1 Point from only the X coordinate. This is
- * useful to rederive a full point from the compressed form of a point.
- *
+ * Instantiate a valid secp256k1 Point from only the X coordinate.
  * @param {boolean} odd - If the Y coordinate is odd
  * @param {BN|String} x - The X coordinate
- * @throws {Error} A validation error if exists
- * @returns {Point} An instance of Point
+ * @returns {Point}
  */
 Point.fromX = function fromX (odd, x) {
   try {
-    var point = ecPointFromX(x, odd)
+    var point = wrap(nobleFromX(odd, x))
   } catch (e) {
     throw new Error('Invalid X')
   }
@@ -53,89 +111,111 @@ Point.fromX = function fromX (odd, x) {
 }
 
 /**
- *
- * Will return a secp256k1 ECDSA base point.
- *
- * @link https://en.bitcoin.it/wiki/Secp256k1
- * @returns {Point} An instance of the base point.
+ * @returns {Point} the secp256k1 base (generator) point.
  */
 Point.getG = function getG () {
-  return ec.curve.g
+  return wrap(NoblePoint.BASE)
 }
 
 /**
- *
- * Will return the max of range of valid private keys as governed by the
- * secp256k1 ECDSA standard.
- *
- * @link https://en.bitcoin.it/wiki/Private_key#Range_of_valid_ECDSA_private_keys
- * @returns {BN} A BN instance of the number of points on the curve
+ * @returns {BN} the curve order n.
  */
 Point.getN = function getN () {
-  return new BN(ec.curve.n.toArray())
+  return bigToBN(N_BIG)
 }
 
-if (!Point.prototype._getX) { Point.prototype._getX = Point.prototype.getX }
-
 /**
- * Will return the X coordinate of the Point.
- *
- * @returns {BN} A BN instance of the X coordinate
+ * @returns {BN} the X coordinate of the Point.
  */
 Point.prototype.getX = function getX () {
-  return new BN(this._getX().toArray())
+  return bigToBN(this._p.toAffine().x)
 }
 
-if (!Point.prototype._getY) { Point.prototype._getY = Point.prototype.getY }
-
 /**
- * Will return the Y coordinate of the Point.
- *
- * @returns {BN} A BN instance of the Y coordinate
+ * @returns {BN} the Y coordinate of the Point.
  */
 Point.prototype.getY = function getY () {
-  return new BN(this._getY().toArray())
+  return bigToBN(this._p.toAffine().y)
 }
 
+// `.x` / `.y` are accessed directly in a few places (e.g. ECDSA r = Q.x.umod(N)).
+Object.defineProperty(Point.prototype, 'x', {
+  configurable: true,
+  enumerable: true,
+  get: function () { return this.getX() }
+})
+Object.defineProperty(Point.prototype, 'y', {
+  configurable: true,
+  enumerable: true,
+  get: function () { return this.getY() }
+})
+
 /**
- * Will determine if the point is valid.
- *
- * @link https://www.iacr.org/archive/pkc2003/25670211/25670211.pdf
- * @throws {Error} A validation error if exists
- * @returns {Point} An instance of the same Point
+ * Scalar multiply this point. Every valid secp256k1 point has order n
+ * (cofactor 1), so k*P == (k mod n)*P; reducing mod n lets us always use
+ * @noble's *constant-time* `multiply` (important for the secret signing nonce)
+ * and naturally handles the boundary scalars used by validation / recovery
+ * (e.g. n itself reduces to 0 -> the point at infinity).
+ * @param {BN} k
+ * @returns {Point}
  */
-Point.prototype.validate = function validate () {
-  if (this.isInfinity()) {
-    throw new Error('Point cannot be equal to Infinity')
+Point.prototype.mul = function mul (k) {
+  var s = ((toBig(k) % N_BIG) + N_BIG) % N_BIG
+  if (s === 0n || this._p.is0()) {
+    return wrap(NoblePoint.ZERO)
   }
+  return wrap(this._p.multiply(s))
+}
 
-  var p2
-  try {
-    p2 = ecPointFromX(this.getX(), this.getY().isOdd())
-  } catch (e) {
-    throw new Error('Point does not lie on the curve')
-  }
+/**
+ * @param {Point} p
+ * @returns {Point} this + p
+ */
+Point.prototype.add = function add (p) {
+  return wrap(this._p.add(p._p))
+}
 
-  if (p2.y.cmp(this.y) !== 0) {
-    throw new Error('Invalid y value for curve.')
-  }
+/**
+ * @returns {Point} k1*this + k2*p2 (used by ECDSA verification).
+ */
+Point.prototype.mulAdd = function mulAdd (k1, p2, k2) {
+  return this.mul(k1).add(p2.mul(k2))
+}
 
-  // todo: needs test case
-  if (!(this.mul(Point.getN()).isInfinity())) {
-    throw new Error('Point times N must be infinity')
-  }
+/**
+ * @param {Point} p
+ * @returns {boolean}
+ */
+Point.prototype.eq = function eq (p) {
+  return this._p.equals(p._p)
+}
+
+/**
+ * @returns {boolean}
+ */
+Point.prototype.isInfinity = function isInfinity () {
+  return this._p.is0()
+}
 
+/**
+ * Will determine if the point is valid.
+ * @returns {Point} this
+ */
+Point.prototype.validate = function validate () {
+  if (this.isInfinity()) {
+    throw new Error('Point cannot be equal to Infinity')
+  }
+  var a = this._p.toAffine()
+  checkOnCurve(a.x, a.y)
+  // secp256k1 has cofactor 1, so on-curve implies order n; the old explicit
+  // n*P == infinity check is therefore redundant.
   return this
 }
 
 /**
- * A "compressed" format point is the X part of the (X, Y) point plus an extra
- * bit (which takes an entire byte) to indicate whether the Y value is odd or
- * not. Storing points this way takes a bit less space, but requires a bit more
- * computation to rederive the full point.
- *
- * @param {Point} point An instance of Point.
- * @returns {Buffer} A compressed point in the form of a buffer.
+ * A "compressed" format point: the X coordinate plus a parity byte.
+ * @param {Point} point
+ * @returns {Buffer}
  */
 Point.pointToCompressed = function pointToCompressed (point) {
   var xbuf = point.getX().toBuffer({ size: 32 })
@@ -152,17 +232,15 @@ Point.pointToCompressed = function pointToCompressed (point) {
 }
 
 /**
- * Converts a compressed buffer into a point.
- *
  * @param {Buffer} buf A compressed point.
- * @returns {Point} A Point.
+ * @returns {Point}
  */
 Point.pointFromCompressed = function (buf) {
   if (buf.length !== 33) {
     throw new Error('invalid buffer length')
   }
-  let prefix = buf[0]
-  let odd
+  var prefix = buf[0]
+  var odd
   if (prefix === 0x03) {
     odd = true
   } else if (prefix === 0x02) {
@@ -171,45 +249,28 @@ Point.pointFromCompressed = function (buf) {
     throw new Error('invalid value of compressed prefix')
   }
 
-  let xbuf = buf.slice(1, 33)
-  let x = BN.fromBuffer(xbuf)
+  var x = BN.fromBuffer(buf.slice(1, 33))
   return Point.fromX(odd, x)
 }
 
 /**
- * Convert point to a compressed buffer.
- *
- * @returns {Buffer} A compressed point.
+ * @returns {Buffer} this point as a compressed buffer.
  */
 Point.prototype.toBuffer = function () {
   return Point.pointToCompressed(this)
 }
 
 /**
- * Convert point to a compressed hex string.
- *
- * @returns {string} A compressed point as a hex string.
+ * @returns {string} this point as a compressed hex string.
  */
 Point.prototype.toHex = function () {
   return this.toBuffer().toString('hex')
 }
 
-/**
- * Converts a compressed buffer into a point.
- *
- * @param {Buffer} buf A compressed point.
- * @returns {Point} A Point.
- */
 Point.fromBuffer = function (buf) {
   return Point.pointFromCompressed(buf)
 }
 
-/**
- * Converts a compressed buffer into a point.
- *
- * @param {Buffer} hex A compressed point as a hex string.
- * @returns {Point} A Point.
- */
 Point.fromHex = function (hex) {
   return Point.fromBuffer(Buffer.from(hex, 'hex'))
 }

package/lib/ecies/bitcore-ecies.js

@@ -1,25 +1,38 @@
 'use strict'
 
-var bsv = require('../../')
+// Bitcore ECIES, backed by the audited @noble suite (secp256k1 ECDH, SHA-2,
+// HMAC, AES-CBC) instead of the elliptic/aes-js primitives. The wire format is
+// unchanged and byte-compatible with prior versions (locked by the golden
+// known-answer vector in test/ecies/bitcore-ecies.js). The scheme is unchanged:
+//
+//   S       = X coord of (senderPriv * recipientPub)        (ECDH, secp256k1)
+//   kE||kM  = SHA-512(S)                                     (KDF)
+//   c       = IV || AES-256-CBC_PKCS7(kE, IV, message)
+//   d       = HMAC-SHA256(kM, c)                             (encrypt-then-MAC)
+//   out     = [Rpub] || c || d
+//
+// Public API is identical to bitcore-ecies so it is a drop-in: it accepts the
+// same bsv PrivateKey/PublicKey objects. Only key *decoding* touches bsv; all
+// cryptography is @noble.
+
+var { secp256k1 } = require('@noble/curves/secp256k1.js')
+var { sha512, sha256 } = require('@noble/hashes/sha2.js')
+var { hmac } = require('@noble/hashes/hmac.js')
+var { cbc } = require('@noble/ciphers/aes.js')
 
+var bsv = require('../../')
 var PublicKey = bsv.PublicKey
-var Hash = bsv.crypto.Hash
 var $ = bsv.util.preconditions
-var aesjs = require('aes-js')
-var CBC = aesjs.ModeOfOperation.cbc
 var Random = bsv.crypto.Random
 
-// Constant-time buffer comparison. Works in Node and browser bundles alike
-// (crypto.timingSafeEqual is not provided by crypto-browserify). Compares the
-// full length unconditionally so timing does not leak how many bytes matched.
+function buf (u8) { return Buffer.from(u8.buffer, u8.byteOffset, u8.byteLength) }
+function hmacSha256 (key, data) { return buf(hmac(sha256, key, data)) }
+
+// Constant-time buffer comparison (see bitcore-ecies for rationale).
 function constantTimeEqual (a, b) {
-  if (a.length !== b.length) {
-    return false
-  }
+  if (a.length !== b.length) return false
   var diff = 0
-  for (var i = 0; i < a.length; i++) {
-    diff |= a[i] ^ b[i]
-  }
+  for (var i = 0; i < a.length; i++) diff |= a[i] ^ b[i]
   return diff === 0
 }
 
@@ -30,11 +43,8 @@ AESCBC.encrypt = function (messagebuf, cipherkeybuf, ivbuf) {
   $.checkArgument(cipherkeybuf)
   $.checkArgument(ivbuf)
   ivbuf = ivbuf || Random.getRandomBuffer(128 / 8)
-  messagebuf = aesjs.padding.pkcs7.pad(messagebuf)
-  var aesCbc = new CBC(cipherkeybuf, ivbuf)
-  var ctbuf = aesCbc.encrypt(messagebuf)
-  var encbuf = Buffer.concat([ivbuf, ctbuf])
-  return encbuf
+  var ct = cbc(Uint8Array.from(cipherkeybuf), Uint8Array.from(ivbuf)).encrypt(Uint8Array.from(messagebuf))
+  return Buffer.concat([Buffer.from(ivbuf), buf(ct)])
 }
 
 AESCBC.decrypt = function (encbuf, cipherkeybuf) {
@@ -42,33 +52,24 @@ AESCBC.decrypt = function (encbuf, cipherkeybuf) {
   $.checkArgument(cipherkeybuf)
   var ivbuf = encbuf.slice(0, 128 / 8)
   var ctbuf = encbuf.slice(128 / 8)
-  var aesCbc = new CBC(cipherkeybuf, ivbuf)
-  var messagebuf = aesCbc.decrypt(ctbuf)
-  messagebuf = aesjs.padding.pkcs7.strip(messagebuf)
-  return Buffer.from(messagebuf)
+  var msg = cbc(Uint8Array.from(cipherkeybuf), Uint8Array.from(ivbuf)).decrypt(Uint8Array.from(ctbuf))
+  return buf(msg)
 }
 
-// http://en.wikipedia.org/wiki/Integrated_Encryption_Scheme
 var ECIES = function ECIES (opts) {
-  if (!(this instanceof ECIES)) {
-    return new ECIES()
-  }
+  if (!(this instanceof ECIES)) return new ECIES()
   this.opts = opts || {}
 }
 
 ECIES.prototype.privateKey = function (privateKey) {
   $.checkArgument(privateKey, 'no private key provided')
-
   this._privateKey = privateKey || null
-
   return this
 }
 
 ECIES.prototype.publicKey = function (publicKey) {
   $.checkArgument(publicKey, 'no public key provided')
-
   this._publicKey = publicKey || null
-
   return this
 }
 
@@ -79,79 +80,53 @@ var cachedProperty = function (name, getter) {
     enumerable: true,
     get: function () {
       var value = this[cachedName]
-      if (!value) {
-        value = this[cachedName] = getter.apply(this)
-      }
+      if (!value) value = this[cachedName] = getter.apply(this)
       return value
     }
   })
 }
 
+// Sender's compressed public key (R), via @noble from the raw private scalar.
 cachedProperty('Rbuf', function () {
-  return this._privateKey.publicKey.toDER(true)
+  var priv = this._privateKey.bn.toBuffer({ size: 32 })
+  return buf(secp256k1.getPublicKey(Uint8Array.from(priv), true))
 })
 
+// ECDH + KDF: S = X(priv * pub); kE||kM = SHA-512(S).
 cachedProperty('kEkM', function () {
-  var r = this._privateKey.bn
-  var KB = this._publicKey.point
-  var P = KB.mul(r)
-  var S = P.getX()
-  var Sbuf = S.toBuffer({ size: 32 })
-  return Hash.sha512(Sbuf)
-})
-
-cachedProperty('kE', function () {
-  return this.kEkM.slice(0, 32)
+  var priv = this._privateKey.bn.toBuffer({ size: 32 })
+  var pub = this._publicKey.toDER() // SEC-encoded; @noble accepts either form
+  var shared = secp256k1.getSharedSecret(Uint8Array.from(priv), Uint8Array.from(pub), true)
+  var Sbuf = shared.slice(1) // drop the 02/03 prefix -> 32-byte X coordinate
+  return buf(sha512(Sbuf))
 })
 
-cachedProperty('kM', function () {
-  return this.kEkM.slice(32, 64)
-})
+cachedProperty('kE', function () { return this.kEkM.slice(0, 32) })
+cachedProperty('kM', function () { return this.kEkM.slice(32, 64) })
 
-// Encrypts the message (String or Buffer).
-// Optional `ivbuf` contains 16-byte Buffer to be used in AES-CBC.
-// By default, `ivbuf` is computed deterministically from message and private key using HMAC-SHA256.
-// Deterministic IV enables end-to-end test vectors for alternative implementations.
-// Note that identical messages have identical ciphertexts. If your protocol does not include some
-// kind of a sequence identifier inside the message *and* it is important to not allow attacker to learn
-// that message is repeated, then you should use custom IV.
-// For random IV, pass `Random.getRandomBuffer(16)` for the second argument.
 ECIES.prototype.encrypt = function (message, ivbuf) {
   if (!Buffer.isBuffer(message)) message = Buffer.from(message)
   if (ivbuf === undefined) {
-    ivbuf = Hash.sha256hmac(message, this._privateKey.toBuffer()).slice(0, 16)
+    ivbuf = hmacSha256(this._privateKey.toBuffer(), message).slice(0, 16)
   }
   var c = AESCBC.encrypt(message, this.kE, ivbuf)
-  var d = Hash.sha256hmac(c, this.kM)
+  var d = hmacSha256(this.kM, c)
   if (this.opts.shortTag) d = d.slice(0, 4)
-  var encbuf
-  if (this.opts.noKey) {
-    encbuf = Buffer.concat([c, d])
-  } else {
-    encbuf = Buffer.concat([this.Rbuf, c, d])
-  }
-  return encbuf
+  if (this.opts.noKey) return Buffer.concat([c, d])
+  return Buffer.concat([this.Rbuf, c, d])
 }
 
 ECIES.prototype.decrypt = function (encbuf) {
   $.checkArgument(encbuf)
   var offset = 0
-  var tagLength = 32
-  if (this.opts.shortTag) {
-    tagLength = 4
-  }
+  var tagLength = this.opts.shortTag ? 4 : 32
   if (!this.opts.noKey) {
     var pub
     switch (encbuf[0]) {
-      case 4:
-        pub = encbuf.slice(0, 65)
-        break
+      case 4: pub = encbuf.slice(0, 65); break
       case 3:
-      case 2:
-        pub = encbuf.slice(0, 33)
-        break
-      default:
-        throw new Error('Invalid type: ' + encbuf[0])
+      case 2: pub = encbuf.slice(0, 33); break
+      default: throw new Error('Invalid type: ' + encbuf[0])
     }
     this._publicKey = PublicKey.fromDER(pub)
     offset += pub.length
@@ -160,13 +135,9 @@ ECIES.prototype.decrypt = function (encbuf) {
   var c = encbuf.slice(offset, encbuf.length - tagLength)
   var d = encbuf.slice(encbuf.length - tagLength, encbuf.length)
 
-  var d2 = Hash.sha256hmac(c, this.kM)
+  var d2 = hmacSha256(this.kM, c)
   if (this.opts.shortTag) d2 = d2.slice(0, 4)
-
-  // Constant-time MAC comparison (encrypt-then-MAC verification).
-  if (!constantTimeEqual(d, d2)) {
-    throw new Error('Invalid checksum')
-  }
+  if (!constantTimeEqual(d, d2)) throw new Error('Invalid checksum')
 
   return AESCBC.decrypt(c, this.kE)
 }