@smartledger/bsv 5.2.0 → 5.3.0

package/lib/crypto/point.js

@@ -1,50 +1,108 @@
 'use strict'
 
 var BN = require('./bn')
+var { secp256k1 } = require('@noble/curves/secp256k1.js')
 
-var EC = require('elliptic').ec
-var ec = new EC('secp256k1')
-var ecPoint = ec.curve.point.bind(ec.curve)
-var ecPointFromX = ec.curve.pointFromX.bind(ec.curve)
+// secp256k1 point + curve order from the audited @noble/curves implementation.
+// This module preserves the (elliptic-derived) Point API the rest of the
+// codebase depends on — mul/add/mulAdd/getX/getY/.x/.y/eq/isInfinity/validate,
+// the static getG/getN/fromX/fromBuffer helpers — so ECDSA and key handling are
+// unchanged. Only the underlying EC math moved from `elliptic` to `@noble`.
+var NoblePoint = secp256k1.Point
+var N_BIG = NoblePoint.Fn.ORDER
+
+function bnToBig (bn) {
+  // Coordinates and scalars in this codebase are always non-negative.
+  return BigInt('0x' + (bn.toString(16) || '0'))
+}
+
+function bigToBN (big) {
+  var h = big.toString(16)
+  if (h.length % 2) h = '0' + h
+  return new BN(h, 16)
+}
+
+function toBig (v) {
+  if (v == null) throw new Error('Invalid Point')
+  if (typeof v === 'bigint') return v
+  if (typeof v === 'number') return BigInt(v)
+  if (typeof v === 'string') return BigInt(v.indexOf('0x') === 0 ? v : '0x' + v)
+  if (typeof v.toString === 'function') return bnToBig(v) // BN
+  throw new Error('Invalid Point')
+}
+
+// Wrap a raw @noble point as a Point instance without re-validating (used by
+// internal results of mul/add/getG/fromX which are already valid).
+function wrap (noblePoint) {
+  var p = Object.create(Point.prototype)
+  p._p = noblePoint
+  return p
+}
+
+// Derive the on-curve @noble point at the given X with the requested Y parity.
+// Throws if X is not a valid curve x-coordinate. Low-level (no Point.validate),
+// so it is safe to call from validate() without recursion.
+function nobleFromX (odd, x) {
+  // Build the compressed encoding via hex string padding (not BN.toBuffer) so we
+  // don't perturb BN.toBuffer call counts the rest of the codebase may rely on.
+  var xhex = toBig(x).toString(16).padStart(64, '0')
+  return NoblePoint.fromHex((odd ? '03' : '02') + xhex)
+}
+
+// Check that (xb, yb) — raw bigint coordinates — lie on the curve, producing
+// the same error messages the previous (elliptic) implementation did. Operates
+// on raw coordinates so it works even for inputs @noble's fromAffine rejects
+// outright (e.g. y = 0).
+function checkOnCurve (xb, yb) {
+  var p2
+  try {
+    p2 = nobleFromX((yb & 1n) === 1n, xb)
+  } catch (e) {
+    throw new Error('Point does not lie on the curve')
+  }
+  if (p2.toAffine().y !== yb) {
+    throw new Error('Invalid y value for curve.')
+  }
+}
 
 /**
- * Instantiate a valid secp256k1 Point from the X and Y coordinates. This class
- * is just an extension of the secp256k1 code from the library "elliptic" by
- * Fedor Indutny. It includes a few extra features that are useful in Bitcoin.
- *
+ * Instantiate a valid secp256k1 Point from the X and Y coordinates.
  * @param {BN|String} x - The X coordinate
  * @param {BN|String} y - The Y coordinate
- * @link https://github.com/indutny/elliptic
- * @augments elliptic.curve.point
- * @throws {Error} A validation error if exists
- * @returns {Point} An instance of Point
+ * @returns {Point}
  * @constructor
  */
-var Point = function Point (x, y, isRed) {
+function Point (x, y, isRed) {
+  if (!(this instanceof Point)) {
+    return new Point(x, y, isRed)
+  }
+  var xb, yb
   try {
-    var point = ecPoint(x, y, isRed)
+    xb = toBig(x)
+    yb = toBig(y)
   } catch (e) {
     throw new Error('Invalid Point')
   }
-  point.validate()
-  return point
+  // Validate on the raw coordinates first (gives the specific curve/y errors and
+  // works for coordinates @noble's fromAffine rejects, e.g. y = 0).
+  checkOnCurve(xb, yb)
+  try {
+    this._p = NoblePoint.fromAffine({ x: xb, y: yb })
+  } catch (e) {
+    throw new Error('Invalid Point')
+  }
+  return this
 }
 
-Point.prototype = Object.getPrototypeOf(ec.curve.point())
-
 /**
- *
- * Instantiate a valid secp256k1 Point from only the X coordinate. This is
- * useful to rederive a full point from the compressed form of a point.
- *
+ * Instantiate a valid secp256k1 Point from only the X coordinate.
  * @param {boolean} odd - If the Y coordinate is odd
  * @param {BN|String} x - The X coordinate
- * @throws {Error} A validation error if exists
- * @returns {Point} An instance of Point
+ * @returns {Point}
  */
 Point.fromX = function fromX (odd, x) {
   try {
-    var point = ecPointFromX(x, odd)
+    var point = wrap(nobleFromX(odd, x))
   } catch (e) {
     throw new Error('Invalid X')
   }
@@ -53,89 +111,111 @@ Point.fromX = function fromX (odd, x) {
 }
 
 /**
- *
- * Will return a secp256k1 ECDSA base point.
- *
- * @link https://en.bitcoin.it/wiki/Secp256k1
- * @returns {Point} An instance of the base point.
+ * @returns {Point} the secp256k1 base (generator) point.
  */
 Point.getG = function getG () {
-  return ec.curve.g
+  return wrap(NoblePoint.BASE)
 }
 
 /**
- *
- * Will return the max of range of valid private keys as governed by the
- * secp256k1 ECDSA standard.
- *
- * @link https://en.bitcoin.it/wiki/Private_key#Range_of_valid_ECDSA_private_keys
- * @returns {BN} A BN instance of the number of points on the curve
+ * @returns {BN} the curve order n.
  */
 Point.getN = function getN () {
-  return new BN(ec.curve.n.toArray())
+  return bigToBN(N_BIG)
 }
 
-if (!Point.prototype._getX) { Point.prototype._getX = Point.prototype.getX }
-
 /**
- * Will return the X coordinate of the Point.
- *
- * @returns {BN} A BN instance of the X coordinate
+ * @returns {BN} the X coordinate of the Point.
  */
 Point.prototype.getX = function getX () {
-  return new BN(this._getX().toArray())
+  return bigToBN(this._p.toAffine().x)
 }
 
-if (!Point.prototype._getY) { Point.prototype._getY = Point.prototype.getY }
-
 /**
- * Will return the Y coordinate of the Point.
- *
- * @returns {BN} A BN instance of the Y coordinate
+ * @returns {BN} the Y coordinate of the Point.
  */
 Point.prototype.getY = function getY () {
-  return new BN(this._getY().toArray())
+  return bigToBN(this._p.toAffine().y)
 }
 
+// `.x` / `.y` are accessed directly in a few places (e.g. ECDSA r = Q.x.umod(N)).
+Object.defineProperty(Point.prototype, 'x', {
+  configurable: true,
+  enumerable: true,
+  get: function () { return this.getX() }
+})
+Object.defineProperty(Point.prototype, 'y', {
+  configurable: true,
+  enumerable: true,
+  get: function () { return this.getY() }
+})
+
 /**
- * Will determine if the point is valid.
- *
- * @link https://www.iacr.org/archive/pkc2003/25670211/25670211.pdf
- * @throws {Error} A validation error if exists
- * @returns {Point} An instance of the same Point
+ * Scalar multiply this point. Every valid secp256k1 point has order n
+ * (cofactor 1), so k*P == (k mod n)*P; reducing mod n lets us always use
+ * @noble's *constant-time* `multiply` (important for the secret signing nonce)
+ * and naturally handles the boundary scalars used by validation / recovery
+ * (e.g. n itself reduces to 0 -> the point at infinity).
+ * @param {BN} k
+ * @returns {Point}
  */
-Point.prototype.validate = function validate () {
-  if (this.isInfinity()) {
-    throw new Error('Point cannot be equal to Infinity')
+Point.prototype.mul = function mul (k) {
+  var s = ((toBig(k) % N_BIG) + N_BIG) % N_BIG
+  if (s === 0n || this._p.is0()) {
+    return wrap(NoblePoint.ZERO)
   }
+  return wrap(this._p.multiply(s))
+}
 
-  var p2
-  try {
-    p2 = ecPointFromX(this.getX(), this.getY().isOdd())
-  } catch (e) {
-    throw new Error('Point does not lie on the curve')
-  }
+/**
+ * @param {Point} p
+ * @returns {Point} this + p
+ */
+Point.prototype.add = function add (p) {
+  return wrap(this._p.add(p._p))
+}
 
-  if (p2.y.cmp(this.y) !== 0) {
-    throw new Error('Invalid y value for curve.')
-  }
+/**
+ * @returns {Point} k1*this + k2*p2 (used by ECDSA verification).
+ */
+Point.prototype.mulAdd = function mulAdd (k1, p2, k2) {
+  return this.mul(k1).add(p2.mul(k2))
+}
 
-  // todo: needs test case
-  if (!(this.mul(Point.getN()).isInfinity())) {
-    throw new Error('Point times N must be infinity')
-  }
+/**
+ * @param {Point} p
+ * @returns {boolean}
+ */
+Point.prototype.eq = function eq (p) {
+  return this._p.equals(p._p)
+}
+
+/**
+ * @returns {boolean}
+ */
+Point.prototype.isInfinity = function isInfinity () {
+  return this._p.is0()
+}
 
+/**
+ * Will determine if the point is valid.
+ * @returns {Point} this
+ */
+Point.prototype.validate = function validate () {
+  if (this.isInfinity()) {
+    throw new Error('Point cannot be equal to Infinity')
+  }
+  var a = this._p.toAffine()
+  checkOnCurve(a.x, a.y)
+  // secp256k1 has cofactor 1, so on-curve implies order n; the old explicit
+  // n*P == infinity check is therefore redundant.
   return this
 }
 
 /**
- * A "compressed" format point is the X part of the (X, Y) point plus an extra
- * bit (which takes an entire byte) to indicate whether the Y value is odd or
- * not. Storing points this way takes a bit less space, but requires a bit more
- * computation to rederive the full point.
- *
- * @param {Point} point An instance of Point.
- * @returns {Buffer} A compressed point in the form of a buffer.
+ * A "compressed" format point: the X coordinate plus a parity byte.
+ * @param {Point} point
+ * @returns {Buffer}
  */
 Point.pointToCompressed = function pointToCompressed (point) {
   var xbuf = point.getX().toBuffer({ size: 32 })
@@ -152,17 +232,15 @@ Point.pointToCompressed = function pointToCompressed (point) {
 }
 
 /**
- * Converts a compressed buffer into a point.
- *
  * @param {Buffer} buf A compressed point.
- * @returns {Point} A Point.
+ * @returns {Point}
  */
 Point.pointFromCompressed = function (buf) {
   if (buf.length !== 33) {
     throw new Error('invalid buffer length')
   }
-  let prefix = buf[0]
-  let odd
+  var prefix = buf[0]
+  var odd
   if (prefix === 0x03) {
     odd = true
   } else if (prefix === 0x02) {
@@ -171,45 +249,28 @@ Point.pointFromCompressed = function (buf) {
     throw new Error('invalid value of compressed prefix')
   }
 
-  let xbuf = buf.slice(1, 33)
-  let x = BN.fromBuffer(xbuf)
+  var x = BN.fromBuffer(buf.slice(1, 33))
   return Point.fromX(odd, x)
 }
 
 /**
- * Convert point to a compressed buffer.
- *
- * @returns {Buffer} A compressed point.
+ * @returns {Buffer} this point as a compressed buffer.
  */
 Point.prototype.toBuffer = function () {
   return Point.pointToCompressed(this)
 }
 
 /**
- * Convert point to a compressed hex string.
- *
- * @returns {string} A compressed point as a hex string.
+ * @returns {string} this point as a compressed hex string.
  */
 Point.prototype.toHex = function () {
   return this.toBuffer().toString('hex')
 }
 
-/**
- * Converts a compressed buffer into a point.
- *
- * @param {Buffer} buf A compressed point.
- * @returns {Point} A Point.
- */
 Point.fromBuffer = function (buf) {
   return Point.pointFromCompressed(buf)
 }
 
-/**
- * Converts a compressed buffer into a point.
- *
- * @param {Buffer} hex A compressed point as a hex string.
- * @returns {Point} A Point.
- */
 Point.fromHex = function (hex) {
   return Point.fromBuffer(Buffer.from(hex, 'hex'))
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smartledger/bsv",
-  "version": "5.2.0",
+  "version": "5.3.0",
   "description": "🚀 Complete Bitcoin SV development framework with legally-recognizable DID:web + W3C VC-JWT toolkit, Legal Token Protocol (LTP), Global Digital Attestation Framework (GDAF), StatusList2021 revocation, and 16 flexible loading options. Standards-based credentials with ES256/ES256K support, on-chain BSV anchoring, and comprehensive Bitcoin SV API. Perfect for legal tokens, verifiable credentials, DeFi, smart contracts, and secure Bitcoin applications.",
   "author": "SmartLedger Technology <hello@smartledger.technology> (https://smartledger.technology)",
   "homepage": "https://github.com/codenlighten/smartledger-bsv#readme",
@@ -198,7 +198,6 @@
     "bn.js": "=4.11.9",
     "bs58": "=4.0.1",
     "clone-deep": "^4.0.1",
-    "elliptic": "6.6.1",
     "hash.js": "^1.1.7",
     "inherits": "2.0.3",
     "secrets.js-grempe": "^2.0.0",