@smartledger/bsv 8.3.0 → 9.0.0

package/test/notaryhash/batch_leaf.js

@@ -0,0 +1,140 @@
+'use strict'
+
+/* global describe, it */
+
+// BRC-220 batch mode: what is in a Merkle leaf.
+//
+// The spec writes `leaf = SHA256(0x00 ‖ d)` and never binds `d`. That is RFC 6962's own
+// generic notation for the construction, quoted to identify WHICH tree — domain
+// separation, the power-of-two split, no duplicated last leaf — not to define the leaf's
+// contents. `canonicalBytes` appears once in the whole document, in the proofHash
+// definition, and nowhere in the batch text.
+//
+// This library reads `d` as proofHash. The alternative reading, d = canonicalBytes, is
+// equally sound cryptographically and produces a DIFFERENT root — so the two do not
+// interoperate, and the failure is silent: the fold just does not reach the root.
+//
+// These tests pin the choice, and pin the divergence too. A comment saying "we use
+// proofHash" would not fail if someone changed it; this does.
+//
+// Reasoning and proposed spec text: docs/BRC220_BATCH_LEAF_AMENDMENT.md
+
+require('chai').should()
+var NotaryHash = require('../../lib/notaryhash')
+var Merkle = require('../../lib/notaryhash/merkle')
+var Hash = require('../../lib/crypto/hash')
+var NotaryScript = require('../../lib/notaryhash/script')
+
+// Four fixed proofHash values, standing in for a four-proof batch.
+var PROOF_HASHES = [
+  '00'.repeat(31) + '01',
+  '00'.repeat(31) + '02',
+  'ab'.repeat(32),
+  'ff'.repeat(32)
+].map(function (h) { return Buffer.from(h, 'hex') })
+
+function batchCertificate (index, leaves) {
+  return {
+    mode: NotaryScript.MODE.BATCH,
+    proofHash: leaves[index].toString('hex'),
+    merkle: {
+      root: Merkle.root(leaves).toString('hex'),
+      leafIndex: index,
+      leafCount: leaves.length,
+      path: Merkle.path(leaves, index).map(function (n) { return n.toString('hex') })
+    }
+  }
+}
+
+describe('BRC-220 batch leaf', function () {
+  describe('the leaf datum is proofHash', function () {
+    it('a leaf is SHA-256(0x00 || proofHash)', function () {
+      var proofHash = PROOF_HASHES[0]
+      Merkle.hashLeaf(proofHash).toString('hex').should.equal(
+        Hash.sha256(Buffer.concat([Buffer.from([0x00]), proofHash])).toString('hex')
+      )
+    })
+
+    // Stated the long way round, because this is the identity the spec leaves open.
+    it('is therefore SHA-256(0x00 || SHA-256(canonicalBytes))', function () {
+      var canonicalBytes = Buffer.from('any canonical proof bytes at all')
+      var proofHash = Hash.sha256(canonicalBytes)
+      Merkle.hashLeaf(proofHash).toString('hex').should.equal(
+        Hash.sha256(Buffer.concat([
+          Buffer.from([0x00]), Hash.sha256(canonicalBytes)
+        ])).toString('hex')
+      )
+    })
+
+    it('verifies inclusion for every leaf of a four-proof batch', function () {
+      for (var i = 0; i < PROOF_HASHES.length; i++) {
+        var report = NotaryHash.verifyBatchInclusion(batchCertificate(i, PROOF_HASHES))
+        report.valid.should.equal(true, 'leaf ' + i + ' should verify')
+        report.errors.should.deep.equal([])
+      }
+    })
+  })
+
+  describe('the two readings of `d` are not interchangeable', function () {
+    var canonicalBytesSet = [
+      Buffer.from('proof one canonical bytes'),
+      Buffer.from('proof two canonical bytes'),
+      Buffer.from('proof three canonical bytes'),
+      Buffer.from('proof four canonical bytes')
+    ]
+    var proofHashes = canonicalBytesSet.map(function (b) { return Hash.sha256(b) })
+
+    it('produces a different root under each reading', function () {
+      Merkle.root(proofHashes).toString('hex')
+        .should.not.equal(Merkle.root(canonicalBytesSet).toString('hex'))
+    })
+
+    // The interoperability failure, made concrete. This is what a batch built by an
+    // implementation using the other reading would look like to this verifier.
+    it('REJECTS a certificate whose tree was built over canonicalBytes', function () {
+      var certificate = {
+        mode: NotaryScript.MODE.BATCH,
+        proofHash: proofHashes[1].toString('hex'),
+        merkle: {
+          // Root and path from the canonicalBytes tree — the other reading.
+          root: Merkle.root(canonicalBytesSet).toString('hex'),
+          leafIndex: 1,
+          leafCount: 4,
+          path: Merkle.path(canonicalBytesSet, 1).map(function (n) { return n.toString('hex') })
+        }
+      }
+      var report = NotaryHash.verifyBatchInclusion(certificate)
+      report.valid.should.equal(false)
+      report.errors.should.deep.equal(['merkle inclusion proof does not fold to the batch root'])
+    })
+
+    // Both are sound; neither is being called wrong. The point is only that a choice had
+    // to be made and that it is checkable.
+    it('both readings are domain-separated and second-preimage resistant', function () {
+      var leafBytes = Buffer.alloc(64, 7)
+      Merkle.hashLeaf(leafBytes).toString('hex')
+        .should.not.equal(Merkle.hashNode(Buffer.alloc(32, 7), Buffer.alloc(32, 7)).toString('hex'))
+    })
+  })
+
+  describe('the verdict is a strict report, not a truthy object', function () {
+    it('reports valid:false rather than throwing on a malformed merkle object', function () {
+      var report = NotaryHash.verifyBatchInclusion({
+        mode: NotaryScript.MODE.BATCH,
+        proofHash: PROOF_HASHES[0].toString('hex'),
+        merkle: { root: 'not-hex', leafIndex: 0, leafCount: 1, path: [] }
+      })
+      report.valid.should.equal(false)
+      report.errors.length.should.be.above(0)
+    })
+
+    it('rejects a non-batch certificate by mode', function () {
+      var report = NotaryHash.verifyBatchInclusion({
+        mode: NotaryScript.MODE.FULL,
+        proofHash: PROOF_HASHES[0].toString('hex')
+      })
+      report.valid.should.equal(false)
+      report.errors.should.deep.equal(['certificate is not in batch mode'])
+    })
+  })
+})

package/test/notaryhash/batch_vector.js

@@ -0,0 +1,282 @@
+'use strict'
+
+/* global describe, it */
+
+// The BRC-220 batch-mode golden vector.
+//
+// BRC-220 writes the batch leaf as `SHA256(0x00 ‖ d)` and never says what `d` is. Prose
+// cannot reliably close that gap — two implementers read the same sentence and chose
+// differently — so this file holds a concrete vector that any implementation can check
+// itself against.
+//
+// What this vector is: a CONFORMANCE TARGET produced by this library. It is not external
+// validation, and nothing here proves our reading is the one the spec intended. What makes
+// it worth having is that the tree underneath it IS externally anchored — the RFC 6962
+// construction is checked against the published Certificate Transparency roots in
+// merkle.js. Given a tree that provably matches RFC 6962, this vector pins the one thing
+// the spec leaves open.
+//
+// These tests rebuild every value from the recorded inputs rather than reading the
+// recorded outputs back. A test that asserts `vector.root === vector.root` would pass
+// forever while proving nothing, which is the failure mode this repository has fixed most
+// often.
+//
+// See docs/BRC220_BATCH_LEAF_AMENDMENT.md and tools/gen-brc220-batch-vector.js.
+
+require('chai').should()
+var vector = require('../data/brc220-batch-vector.json')
+var Hash = require('../../lib/crypto/hash')
+var Encoding = require('../../lib/notaryhash/encoding')
+var Merkle = require('../../lib/notaryhash/merkle')
+var Suites = require('../../lib/notaryhash/suites')
+var NotaryHash = require('../../lib/notaryhash')
+var NotaryScript = require('../../lib/notaryhash/script')
+var BN = require('../../lib/crypto/bn')
+var PrivateKey = require('../../lib/privatekey')
+// Deliberately a SECOND implementation: see the independent-verification test below.
+var { secp256k1 } = require('@noble/curves/secp256k1.js')
+
+function hex (s) { return Buffer.from(s, 'hex') }
+
+describe('BRC-220 batch golden vector', function () {
+  describe('the vector describes the shape it claims', function () {
+    it('is five leaves, which is deliberate', function () {
+      // n=5 splits 4/1 under RFC 6962 (largest power of two BELOW n), where a midpoint
+      // split would give 2/3 and a different root. Odd n also exercises the rule that the
+      // last leaf is never duplicated. A power-of-two vector would catch neither.
+      vector.leafCount.should.equal(5)
+      vector.proofs.length.should.equal(5)
+      Merkle.largestPowerOfTwoBelow(5).should.equal(4)
+    })
+
+    it('names its tree and leaf datum explicitly', function () {
+      vector.tree.should.equal('RFC 6962')
+      vector.leafDatum.should.equal('proofHash')
+    })
+
+    // The 4/1 split shows up in the path lengths: the lone right-hand leaf needs one
+    // sibling, the four on the left need three. If a future change altered the split rule,
+    // this would move before any root did.
+    it('has path lengths matching a 4/1 split', function () {
+      vector.proofs.map(function (p) { return p.path.length })
+        .should.deep.equal([3, 3, 3, 3, 1])
+    })
+  })
+
+  describe('every input is derived, so the vector is reproducible', function () {
+    it('rebuilds each payloadHash from its recorded preimage', function () {
+      vector.proofs.forEach(function (p) {
+        Hash.sha256(Buffer.from(p.payloadPreimage, 'utf8')).toString('hex')
+          .should.equal(p.payloadHash, 'leaf ' + p.leafIndex)
+      })
+    })
+
+    it('records the preimage labels the generator actually uses', function () {
+      vector.proofs.forEach(function (p, i) {
+        p.keyPreimage.should.equal('BRC-220/batch-vector/key/' + i)
+        p.payloadPreimage.should.equal('BRC-220/batch-vector/payload/' + i)
+      })
+    })
+
+    it('uses raw encoding: 64-byte signatures and 33-byte compressed keys', function () {
+      vector.proofs.forEach(function (p) {
+        p.encoding.should.equal('raw')
+        hex(p.signature).length.should.equal(64, 'leaf ' + p.leafIndex + ' signature')
+        hex(p.publicKey).length.should.equal(33, 'leaf ' + p.leafIndex + ' publicKey')
+      })
+    })
+
+    it('rebuilds createdAtUnix from the recorded ISO timestamp', function () {
+      vector.proofs.forEach(function (p) {
+        Encoding.toUnixSeconds(p.createdAt).should.equal(p.createdAtUnix)
+      })
+    })
+  })
+
+  describe('every proof stands on its own', function () {
+    // Each signature must verify independently. Without this the vector could pin a tree
+    // built over five values that are not valid proofs at all.
+    it('verifies all five signatures under the named suite', function () {
+      vector.proofs.forEach(function (p) {
+        Suites.verify(p.algorithm, hex(p.payloadHash), hex(p.signature), hex(p.publicKey))
+          .should.equal(true, 'leaf ' + p.leafIndex + ' signature must verify')
+      })
+    })
+
+    // THE test this file most needs, and the one it originally lacked.
+    //
+    // The assertion above uses our own suite, and the generator uses our own signer, so
+    // the two agree by construction. The first version of this vector was generated with
+    // `endian: 'little'` — matching a verifier bug — and every signature in it was
+    // unverifiable by any other implementation. Both tests above still passed, because
+    // both sides of the comparison were wrong in the same direction.
+    //
+    // @noble/curves shares no signing or verification code with lib/crypto/ecdsa.js. If
+    // this vector is ever regenerated by a signer that disagrees with the rest of the
+    // world, this is the assertion that says so.
+    //
+    // { prehash: false } is REQUIRED: noble v2 hashes its input by default, so omitting
+    // it would compare our signature over `payloadHash` against noble's over
+    // `sha256(payloadHash)` — a mismatch that looks exactly like the bug this guards.
+    it('verifies all five signatures under an INDEPENDENT implementation', function () {
+      vector.proofs.forEach(function (p) {
+        secp256k1.verify(hex(p.signature), hex(p.payloadHash), hex(p.publicKey), { prehash: false })
+          .should.equal(true,
+            'leaf ' + p.leafIndex + ' signature must verify under @noble/curves, not just ours')
+      })
+    })
+
+    it('derives each public key from the recorded key preimage', function () {
+      // Ties the published public keys back to their labelled preimages, so a third party
+      // can reproduce the keys and not merely check the signatures against them.
+      vector.proofs.forEach(function (p) {
+        var priv = PrivateKey.fromObject({
+          bn: BN.fromBuffer(Hash.sha256(Buffer.from(p.keyPreimage, 'utf8'))),
+          compressed: true,
+          network: 'livenet'
+        })
+        priv.publicKey.toBuffer().toString('hex')
+          .should.equal(p.publicKey, 'leaf ' + p.leafIndex + ' public key must derive from its preimage')
+      })
+    })
+
+    it('rebuilds each canonicalBytes from the recorded fields', function () {
+      vector.proofs.forEach(function (p) {
+        Encoding.canonicalBytes({
+          algorithm: p.algorithm,
+          hashAlgorithm: p.hashAlgorithm,
+          payloadHash: hex(p.payloadHash),
+          publicKey: hex(p.publicKey),
+          signature: hex(p.signature),
+          createdAtUnix: p.createdAtUnix
+        }).toString('hex').should.equal(p.canonicalBytes, 'leaf ' + p.leafIndex)
+      })
+    })
+
+    it('rebuilds each proofHash as SHA-256 of those canonical bytes', function () {
+      vector.proofs.forEach(function (p) {
+        Hash.sha256(hex(p.canonicalBytes)).toString('hex')
+          .should.equal(p.proofHash, 'leaf ' + p.leafIndex)
+      })
+    })
+  })
+
+  describe('the leaf definition the spec leaves open', function () {
+    it('rebuilds each leaf as SHA-256(0x00 || proofHash)', function () {
+      vector.proofs.forEach(function (p) {
+        Merkle.hashLeaf(hex(p.proofHash)).toString('hex')
+          .should.equal(p.leafHash, 'leaf ' + p.leafIndex)
+      })
+    })
+
+    it('rebuilds the root from the five proofHash values', function () {
+      Merkle.root(vector.proofs.map(function (p) { return hex(p.proofHash) }))
+        .toString('hex').should.equal(vector.root)
+    })
+
+    it('rebuilds every inclusion path and folds each back to the root', function () {
+      var leaves = vector.proofs.map(function (p) { return hex(p.proofHash) })
+      vector.proofs.forEach(function (p, i) {
+        Merkle.path(leaves, i).map(function (n) { return n.toString('hex') })
+          .should.deep.equal(p.path, 'path for leaf ' + i)
+        Merkle.verifyInclusion(leaves[i], i, vector.leafCount,
+          p.path.map(hex), hex(vector.root)).should.equal(true, 'fold for leaf ' + i)
+      })
+    })
+
+    it('encodes leafCount as u32be for the on-chain record', function () {
+      var buf = Buffer.alloc(4)
+      buf.writeUInt32BE(vector.leafCount, 0)
+      buf.toString('hex').should.equal(vector.onChainRecordTail.leafCountU32be)
+      vector.onChainRecordTail.merkleRoot.should.equal(vector.root)
+    })
+  })
+
+  describe('the rejected reading is recorded and really does diverge', function () {
+    it('reproduces the canonicalBytes-leaf root the vector records', function () {
+      Merkle.root(vector.proofs.map(function (p) { return hex(p.canonicalBytes) }))
+        .toString('hex').should.equal(vector.rejectedReading.root)
+    })
+
+    // The whole reason the vector exists. Equal in strength, different root.
+    it('is a different root from the proofHash reading', function () {
+      vector.root.should.not.equal(vector.rejectedReading.root)
+    })
+
+    it('records each leaf hash under both readings, and they differ', function () {
+      vector.proofs.forEach(function (p) {
+        Merkle.hashLeaf(hex(p.canonicalBytes)).toString('hex')
+          .should.equal(p.leafHashUnderRejectedReading, 'leaf ' + p.leafIndex)
+        p.leafHash.should.not.equal(p.leafHashUnderRejectedReading)
+      })
+    })
+  })
+
+  // The amendment publishes these values as the text to put in the spec. A document that
+  // has drifted from the artifact it describes is worse than no document, and nothing
+  // else would notice: the doc is prose, the vector is JSON, and they are edited
+  // separately.
+  describe('the amendment document publishes the same values', function () {
+    var fs = require('fs')
+    var path = require('path')
+    var doc = fs.readFileSync(
+      path.join(__dirname, '..', '..', 'docs', 'BRC220_BATCH_LEAF_AMENDMENT.md'), 'utf8')
+
+    it('publishes the root', function () {
+      doc.indexOf(vector.root).should.be.above(-1, 'root missing from the amendment')
+    })
+
+    it('publishes the rejected reading root, so the divergence is diagnosable', function () {
+      doc.indexOf(vector.rejectedReading.root)
+        .should.be.above(-1, 'rejected reading root missing from the amendment')
+    })
+
+    it('publishes every proofHash', function () {
+      vector.proofs.forEach(function (p) {
+        doc.indexOf(p.proofHash).should.be.above(-1,
+          'proofHash for leaf ' + p.leafIndex + ' missing from the amendment')
+      })
+    })
+
+    it('publishes the leaf-4 audit path and the u32be leaf count', function () {
+      doc.indexOf(vector.proofs[4].path[0]).should.be.above(-1, 'leaf 4 path missing')
+      doc.indexOf(vector.onChainRecordTail.leafCountU32be).should.be.above(-1,
+        'u32be leaf count missing')
+    })
+  })
+
+  describe('the library verifies certificates built from this vector', function () {
+    it('accepts a batch certificate for every leaf', function () {
+      vector.proofs.forEach(function (p, i) {
+        var report = NotaryHash.verifyBatchInclusion({
+          mode: NotaryScript.MODE.BATCH,
+          proofHash: p.proofHash,
+          merkle: {
+            root: vector.root,
+            leafIndex: i,
+            leafCount: vector.leafCount,
+            path: p.path
+          }
+        })
+        report.valid.should.equal(true, 'leaf ' + i)
+        report.errors.should.deep.equal([])
+      })
+    })
+
+    // An implementation that chose the other reading produces exactly this, and this is
+    // what it looks like when it reaches our verifier.
+    it('rejects a certificate carrying the rejected reading root', function () {
+      var report = NotaryHash.verifyBatchInclusion({
+        mode: NotaryScript.MODE.BATCH,
+        proofHash: vector.proofs[0].proofHash,
+        merkle: {
+          root: vector.rejectedReading.root,
+          leafIndex: 0,
+          leafCount: vector.leafCount,
+          path: vector.proofs[0].path
+        }
+      })
+      report.valid.should.equal(false)
+    })
+  })
+})

package/test/notaryhash/interop.js

@@ -0,0 +1,112 @@
+'use strict'
+
+/* global describe, it */
+
+// BRC-220 signature interoperability.
+//
+// Every other test in this directory signs with `lib/crypto/ecdsa.js` and verifies
+// through `lib/notaryhash/suites.js`, which also uses `lib/crypto/ecdsa.js`. That
+// proves the module agrees with itself. It cannot prove the module agrees with the
+// spec, and in 8.3.0 it did not: the suite set `endian: 'little'` before verifying,
+// so it rejected any signature produced the way BRC-220 describes and accepted only
+// signatures made with bsv's own byte-reversed convention. Twenty-odd passing tests
+// said nothing about it, because they all signed the same wrong way.
+//
+// So this file verifies against `@noble/curves` instead — a separate implementation
+// that shares no verification code with ours. It is the only test here that can fail
+// when our code and our tests are wrong together.
+//
+// One trap worth naming, because it cost real time when this was diagnosed: noble v2
+// PREHASHES by default. `secp256k1.sign(digest, key)` signs `sha256(digest)`, and
+// `secp256k1.verify` prehashes to match, so noble looks self-consistent while
+// disagreeing with everyone. BRC-220 signs the payloadHash itself, so every call
+// below passes `{ prehash: false }`. Omit it and these tests compare the wrong things
+// and "pass" for the wrong reason.
+
+require('chai').should()
+var bsv = require('../..')
+var Suites = require('../../lib/notaryhash/suites')
+var Hash = require('../../lib/crypto/hash')
+var { secp256k1 } = require('@noble/curves/secp256k1.js')
+
+var PAYLOAD_HASH = Hash.sha256(Buffer.from('the document nobody sees'))
+
+// A fixed key, so a failure is reproducible rather than one-in-N flaky.
+var SECRET = Buffer.from('c0ffee00c0ffee00c0ffee00c0ffee00c0ffee00c0ffee00c0ffee00c0ffee01', 'hex')
+var PUBLIC_KEY = Buffer.from(secp256k1.getPublicKey(SECRET, true))
+
+function rawSig (sig) {
+  return Buffer.concat([
+    sig.r.toArrayLike(Buffer, 'be', 32),
+    sig.s.toArrayLike(Buffer, 'be', 32)
+  ])
+}
+
+describe('BRC-220 signature interop', function () {
+  it('agrees with @noble/curves on the public key for a given secret', function () {
+    // If this fails nothing below means anything — the two libraries would be
+    // signing under different keys.
+    var ours = bsv.PrivateKey.fromBuffer(SECRET).toPublicKey().toBuffer()
+    ours.toString('hex').should.equal(PUBLIC_KEY.toString('hex'))
+  })
+
+  it('ACCEPTS a signature made the way the spec describes', function () {
+    // This is the regression. Under 8.3.0 this assertion fails.
+    var conformant = Buffer.from(secp256k1.sign(PAYLOAD_HASH, SECRET, { prehash: false }))
+    Suites.verify('ECDSA-secp256k1', PAYLOAD_HASH, conformant, PUBLIC_KEY)
+      .should.equal(true, 'a conformant BRC-220 signature must verify')
+  })
+
+  it('emits signatures an independent implementation accepts', function () {
+    var key = bsv.PrivateKey.fromBuffer(SECRET)
+    var ecdsa = bsv.crypto.ECDSA().set({ hashbuf: PAYLOAD_HASH, privkey: key })
+    ecdsa.sign()
+    secp256k1.verify(rawSig(ecdsa.sig), PAYLOAD_HASH, PUBLIC_KEY, { prehash: false })
+      .should.equal(true, 'our signature must verify under @noble/curves')
+  })
+
+  it('REJECTS a signature over the byte-reversed digest', function () {
+    // The 8.3.0 convention. It must now fail: accepting both would mean two valid
+    // signatures exist for one signing act, and both are inside proofHash.
+    var key = bsv.PrivateKey.fromBuffer(SECRET)
+    var ecdsa = bsv.crypto.ECDSA().set({ hashbuf: PAYLOAD_HASH, endian: 'little', privkey: key })
+    ecdsa.sign()
+    Suites.verify('ECDSA-secp256k1', PAYLOAD_HASH, rawSig(ecdsa.sig), PUBLIC_KEY)
+      .should.equal(false, 'the pre-8.3.1 little-endian convention must not verify')
+  })
+
+  it('round-trips both ways over many payloads, not just one', function () {
+    // A single vector can pass by coincidence — the reversal of a digest whose bytes
+    // happen to be near-palindromic still differs, but a lucky scalar could mask a
+    // subtler bug. Twenty payloads with distinct digests makes that implausible.
+    var key = bsv.PrivateKey.fromBuffer(SECRET)
+    for (var i = 0; i < 20; i++) {
+      var h = Hash.sha256(Buffer.from('payload ' + i))
+
+      var theirs = Buffer.from(secp256k1.sign(h, SECRET, { prehash: false }))
+      Suites.verify('ECDSA-secp256k1', h, theirs, PUBLIC_KEY)
+        .should.equal(true, 'noble sig ' + i + ' rejected by our suite')
+
+      var ecdsa = bsv.crypto.ECDSA().set({ hashbuf: h, privkey: key })
+      ecdsa.sign()
+      secp256k1.verify(rawSig(ecdsa.sig), h, PUBLIC_KEY, { prehash: false })
+        .should.equal(true, 'our sig ' + i + ' rejected by noble')
+    }
+  })
+
+  it('still rejects a signature over a DIFFERENT payload', function () {
+    // Guards against the fix degenerating into "accept anything". A verifier that
+    // returns true unconditionally would pass every test above.
+    var other = Hash.sha256(Buffer.from('a different document'))
+    var sig = Buffer.from(secp256k1.sign(other, SECRET, { prehash: false }))
+    Suites.verify('ECDSA-secp256k1', PAYLOAD_HASH, sig, PUBLIC_KEY)
+      .should.equal(false)
+  })
+
+  it('still rejects a signature from a DIFFERENT key', function () {
+    var otherSecret = Buffer.from('a11ce00a11ce00a11ce00a11ce00a11ce00a11ce00a11ce00a11ce00a11ce001', 'hex')
+    var sig = Buffer.from(secp256k1.sign(PAYLOAD_HASH, otherSecret, { prehash: false }))
+    Suites.verify('ECDSA-secp256k1', PAYLOAD_HASH, sig, PUBLIC_KEY)
+      .should.equal(false)
+  })
+})

package/test/notaryhash/verify.js

@@ -41,8 +41,11 @@ describe('BRC-220 verification', function () {
     publicKey = key.toPublicKey().toBuffer()
     payloadHash = Hash.sha256(Buffer.from('the document nobody sees'))
 
-    // The signer signs the 32-byte payloadHash DIRECTLY — spec §Algorithms.
-    var ecdsa = bsv.crypto.ECDSA().set({ hashbuf: payloadHash, endian: 'little', privkey: key })
+    // The signer signs the 32-byte payloadHash DIRECTLY — spec §Algorithms. No endian
+    // option: the digest IS the scalar, big-endian. Until 8.3.1 this line passed
+    // `endian: 'little'` while the comment above it said "directly", and the suite
+    // reversed to match, so the two agreed with each other and with nothing else.
+    var ecdsa = bsv.crypto.ECDSA().set({ hashbuf: payloadHash, privkey: key })
     ecdsa.sign()
     signature = rawSig(ecdsa.sig)
 

package/test/ordinals/inscription.js

@@ -223,16 +223,19 @@ describe('Ordinals inscriptions', function () {
     })
   })
 
-  // The case that motivated making the script-size cap configurable: transferring a
-  // large inscription. The envelope is inert, so the spend is an ordinary P2PKH — but
-  // the interpreter could not even load the script, because total script size was a
-  // hard-coded 10,000 bytes that useGenesisLimits() did not lift.
+  // Transferring a large inscription. The envelope is inert, so the spend is an
+  // ordinary P2PKH — but under pre-Genesis rules the interpreter could not even load
+  // the script, because total script size was capped at 10,000 bytes.
   describe('transferring a large inscription', function () {
     var I = bsv.Script.Interpreter
     var Sighash = bsv.Transaction.Sighash
     var BN = bsv.crypto.BN
     var SIGHASH = bsv.crypto.Signature.SIGHASH_ALL | bsv.crypto.Signature.SIGHASH_FORKID
+    // Pre-Genesis: no era bit, so the 520-byte element cap and the 10,000-byte script
+    // cap both still apply. Kept deliberately, to show what they reject.
     var FLAGS = I.SCRIPT_VERIFY_STRICTENC | I.SCRIPT_ENABLE_SIGHASH_FORKID
+    // Current mainnet, where Genesis lifted both.
+    var MAINNET = I.mainnetFlags()
     var saved
 
     beforeEach(function () { saved = I.getLimits() })
@@ -265,35 +268,43 @@ describe('Ordinals inscriptions', function () {
       return { lock: lock, unlock: unlock, spend: spend, sig: sig, owner: owner }
     }
 
-    function evaluate (t) {
+    // Both caps are derived from the ERA flags, not from the limit statics: see
+    // Interpreter#maxScriptElementSize and #maxScriptSize, each of which branches on
+    // isAfterGenesis(). Passing the era is therefore the whole fix — these tests used
+    // to call SmartContract.enableGenesis(), which raised process-wide statics instead
+    // and had to be undone in an afterEach or it changed the rules for every test that
+    // ran later.
+    function evaluate (t, flags) {
       var interp = new I()
-      var ok = interp.verify(t.unlock, t.lock, t.spend, 0, FLAGS, new BN(1))
+      var ok = interp.verify(t.unlock, t.lock, t.spend, 0,
+        flags === undefined ? MAINNET : flags, new BN(1))
       return { ok: ok, err: interp.errstr }
     }
 
     it('cannot be evaluated under pre-Genesis limits — two separate caps bite', function () {
+      // Explicitly pre-Genesis: FLAGS carries no era bit, so both caps still apply.
       // Under 10 KB the script loads and the 520-byte push cap rejects the content...
-      var small = evaluate(transfer(3))
+      var small = evaluate(transfer(3), FLAGS)
       small.ok.should.equal(false)
       small.err.should.equal('SCRIPT_ERR_PUSH_SIZE')
       // ...over 10 KB it never gets that far: evaluate() refuses the script outright.
-      // This is the cap useGenesisLimits() could not lift.
-      var big = evaluate(transfer(50))
+      var big = evaluate(transfer(50), FLAGS)
       big.ok.should.equal(false)
       big.err.should.equal('SCRIPT_ERR_SCRIPT_SIZE')
     })
 
-    it('evaluates once Genesis limits are enabled', function () {
-      bsv.SmartContract.enableGenesis()
+    it('evaluates under mainnet consensus, with the limit statics untouched', function () {
+      var before = JSON.stringify(I.getLimits())
       var t = transfer(50)
-      t.lock.toBuffer().length.should.be.above(10000) // past the old hard-coded cap
+      t.lock.toBuffer().length.should.be.above(10000) // past the pre-Genesis cap
       evaluate(t).ok.should.equal(true)
+      // The point of the change: no process-wide mutation was needed to get here.
+      JSON.stringify(I.getLimits()).should.equal(before)
     })
 
     it('agrees with a direct signature check against the sighash', function () {
       // The fallback used when the interpreter cannot run: verify the signature over
       // the sighash directly. It must agree with the interpreter where both work.
-      bsv.SmartContract.enableGenesis()
       var t = transfer(50)
       var hash = Sighash.sighash(t.spend, SIGHASH, 0, t.lock, new BN(1), FLAGS)
       var sigOk = bsv.crypto.ECDSA.verify(hash, t.sig, t.owner.toPublicKey(), 'little')
@@ -302,7 +313,6 @@ describe('Ordinals inscriptions', function () {
     })
 
     it('rejects a signature made over the base lock instead of the full script', function () {
-      bsv.SmartContract.enableGenesis()
       var t = transfer(50)
       var baseLock = bsv.Script.buildPublicKeyHashOut(t.owner.toAddress())
       var wrong = Sighash.sign(t.spend, t.owner, SIGHASH, 0, baseLock, new BN(1), FLAGS)