@swiftbrowser/swift 0.1.0 → 0.3.0

package/Sources/CryptoKit/Curve25519.swift

@@ -0,0 +1,317 @@
+// Curve25519: Ed25519 signatures (`Curve25519.Signing`, RFC 8032) and X25519
+// key agreement (`Curve25519.KeyAgreement`, RFC 7748), in plain Swift over
+// the Montgomery field arithmetic of P256.swift (RevenueCat verifies its
+// server's signed responses with an Ed25519 public key). Points on the
+// Edwards curve use extended coordinates. As with P-256, nothing here is
+// constant-time: fine for keys the page makes and checks, not for a server.
+// Signatures are deterministic (RFC 8032); CryptoKit's add randomness, and
+// either kind verifies with either implementation.
+
+import struct Foundation.Data
+import protocol Foundation.ContiguousBytes
+import protocol Foundation.DataProtocol
+
+public enum Curve25519 {
+    public enum Signing {
+        public struct PrivateKey: Sendable {
+            /// The 32-byte seed.
+            let seed: [UInt8]
+            let scalar: _U256
+            let prefix: [UInt8]
+            public let publicKey: PublicKey
+
+            /// A new random key.
+            public init() {
+                var generator = SystemRandomNumberGenerator()
+                self.init(seed: (0..<32).map { _ in UInt8.random(in: .min ... .max, using: &generator) })
+            }
+
+            /// The 32-byte seed.
+            public init<D: ContiguousBytes>(rawRepresentation data: D) throws {
+                let seed = data.withUnsafeBytes { Array($0) }
+                guard seed.count == 32 else { throw CryptoKitError.incorrectKeySize }
+                self.init(seed: seed)
+            }
+
+            init(seed: [UInt8]) {
+                self.seed = seed
+                let hash = Array(SHA512.hash(data: seed))
+                var clamped = Array(hash[0..<32])
+                clamped[0] &= 248
+                clamped[31] &= 127
+                clamped[31] |= 64
+                scalar = _U256(littleEndian: clamped)
+                prefix = Array(hash[32..<64])
+                publicKey = PublicKey(encoded: _Ed25519.encode(_Ed25519.multiply(_Ed25519.base, by: scalar)))
+            }
+
+            public var rawRepresentation: Data { Data(seed) }
+
+            /// The 64-byte signature `R ‖ S` of `data`.
+            public func signature<D: DataProtocol>(for data: D) throws -> Data {
+                let message = Array(data)
+                let r = _Ed25519.reducedHash(prefix + message)
+                let encodedR = _Ed25519.encode(_Ed25519.multiply(_Ed25519.base, by: r))
+                let k = _Ed25519.reducedHash(encodedR + publicKey.encoded + message)
+                let s = _Ed25519.scalars.add(r, _Ed25519.scalarProduct(k, _Ed25519.reduced(scalar)))
+                return Data(encodedR + s.littleEndianBytes)
+            }
+        }
+
+        public struct PublicKey: Sendable {
+            let encoded: [UInt8]
+
+            init(encoded: [UInt8]) { self.encoded = encoded }
+
+            /// The 32-byte encoded point.
+            public init<D: ContiguousBytes>(rawRepresentation data: D) throws {
+                let bytes = data.withUnsafeBytes { Array($0) }
+                guard bytes.count == 32 else { throw CryptoKitError.incorrectKeySize }
+                guard _Ed25519.decode(bytes) != nil else { throw CryptoKitError.invalidParameter }
+                encoded = bytes
+            }
+
+            public var rawRepresentation: Data { Data(encoded) }
+
+            /// Whether `signature` is this key's signature of `data`.
+            public func isValidSignature<S: DataProtocol, D: DataProtocol>(_ signature: S, for data: D) -> Bool {
+                let signature = Array(signature)
+                guard signature.count == 64, let point = _Ed25519.decode(encoded) else { return false }
+                let encodedR = Array(signature[0..<32])
+                let s = _U256(littleEndian: Array(signature[32..<64]))
+                guard s < _Ed25519.l else { return false }
+                let k = _Ed25519.reducedHash(encodedR + encoded + Array(data))
+                // [S]B − [k]A must be R.
+                let sB = _Ed25519.multiply(_Ed25519.base, by: s)
+                let kA = _Ed25519.multiply(point, by: k)
+                return _Ed25519.encode(_Ed25519.add(sB, _Ed25519.negate(kA))) == encodedR
+            }
+        }
+    }
+
+    public enum KeyAgreement {
+        public struct PrivateKey: Sendable {
+            let bytes: [UInt8]
+
+            /// A new random key.
+            public init() {
+                var generator = SystemRandomNumberGenerator()
+                bytes = (0..<32).map { _ in UInt8.random(in: .min ... .max, using: &generator) }
+            }
+
+            public init<D: ContiguousBytes>(rawRepresentation data: D) throws {
+                let bytes = data.withUnsafeBytes { Array($0) }
+                guard bytes.count == 32 else { throw CryptoKitError.incorrectKeySize }
+                self.bytes = bytes
+            }
+
+            public var rawRepresentation: Data { Data(bytes) }
+
+            public var publicKey: PublicKey { PublicKey(bytes: _X25519.multiply(bytes, _X25519.basePoint)) }
+
+            /// X25519 of this key and `publicKeyShare`; an all-zero result (a
+            /// point of small order) is refused, as CryptoKit refuses it.
+            public func sharedSecretFromKeyAgreement(with publicKeyShare: PublicKey) throws -> SharedSecret {
+                let shared = _X25519.multiply(bytes, publicKeyShare.bytes)
+                guard shared.contains(where: { $0 != 0 }) else { throw CryptoKitError.invalidParameter }
+                return SharedSecret(bytes: shared)
+            }
+        }
+
+        public struct PublicKey: Sendable {
+            let bytes: [UInt8]
+
+            init(bytes: [UInt8]) { self.bytes = bytes }
+
+            public init<D: ContiguousBytes>(rawRepresentation data: D) throws {
+                let bytes = data.withUnsafeBytes { Array($0) }
+                guard bytes.count == 32 else { throw CryptoKitError.incorrectKeySize }
+                self.bytes = bytes
+            }
+
+            public var rawRepresentation: Data { Data(bytes) }
+        }
+    }
+}
+
+// MARK: - Little-endian integers
+
+extension _U256 {
+    init(littleEndian bytes: [UInt8]) { self.init(bigEndian: bytes.reversed()) }
+    var littleEndianBytes: [UInt8] { bigEndianBytes.reversed() }
+}
+
+// MARK: - The field and the Edwards curve
+
+enum _Ed25519 {
+    /// 2²⁵⁵ − 19.
+    static let p = _U256([0xFFFF_FFFF_FFFF_FFED, 0xFFFF_FFFF_FFFF_FFFF, 0xFFFF_FFFF_FFFF_FFFF, 0x7FFF_FFFF_FFFF_FFFF])
+    /// The order of the base point, 2²⁵² + 27742317777372353535851937790883648493.
+    static let l = _U256([0x5812_631A_5CF5_D3ED, 0x14DE_F9DE_A2F7_9CD6, 0, 0x1000_0000_0000_0000])
+    static let field = _MontgomeryField(modulus: p)
+    static let scalars = _MontgomeryField(modulus: l)
+
+    static let one = field.toMontgomery(_U256([1, 0, 0, 0]))
+    static let zero = _U256([0, 0, 0, 0])
+    /// −121665/121666, in Montgomery form.
+    static let d = field.multiply(field.subtract(zero, field.toMontgomery(_U256([121_665, 0, 0, 0]))),
+                                  field.inverse(field.toMontgomery(_U256([121_666, 0, 0, 0]))))
+    static let d2 = field.add(d, d)
+    /// √−1 = 2^((p−1)/4).
+    static let sqrtMinusOne = power(field.toMontgomery(_U256([2, 0, 0, 0])),
+                                    _U256([0xFFFF_FFFF_FFFF_FFFB, 0xFFFF_FFFF_FFFF_FFFF, 0xFFFF_FFFF_FFFF_FFFF, 0x1FFF_FFFF_FFFF_FFFF]))
+    /// y = 4/5 with even x.
+    static let base: Point = {
+        let y = field.fromMontgomery(field.multiply(field.toMontgomery(_U256([4, 0, 0, 0])),
+                                                    field.inverse(field.toMontgomery(_U256([5, 0, 0, 0])))))
+        return decode(y.littleEndianBytes)!
+    }()
+
+    /// A point in extended coordinates (Montgomery form): x = X/Z, y = Y/Z, xy = T/Z.
+    struct Point: Sendable {
+        var x, y, z, t: _U256
+    }
+
+    static let identity = Point(x: zero, y: one, z: one, t: zero)
+
+    static func power(_ base: _U256, _ exponent: _U256) -> _U256 {
+        var result = one
+        for index in (0..<256).reversed() {
+            result = field.multiply(result, result)
+            if exponent.bit(index) { result = field.multiply(result, base) }
+        }
+        return result
+    }
+
+    /// The point a 32-byte encoding names, or nil when it names none.
+    static func decode(_ bytes: [UInt8]) -> Point? {
+        guard bytes.count == 32 else { return nil }
+        var yBytes = bytes
+        let sign = yBytes[31] >> 7
+        yBytes[31] &= 0x7F
+        let yPlain = _U256(littleEndian: yBytes)
+        guard yPlain < p else { return nil }
+        let y = field.toMontgomery(yPlain)
+        let y2 = field.multiply(y, y)
+        let u = field.subtract(y2, one)
+        let v = field.add(field.multiply(d, y2), one)
+        // x = u·v³·(u·v⁷)^((p−5)/8)
+        let v3 = field.multiply(field.multiply(v, v), v)
+        let v7 = field.multiply(field.multiply(v3, v3), v)
+        let exponent = _U256([0xFFFF_FFFF_FFFF_FFFD, 0xFFFF_FFFF_FFFF_FFFF, 0xFFFF_FFFF_FFFF_FFFF, 0x0FFF_FFFF_FFFF_FFFF])
+        var x = field.multiply(field.multiply(u, v3), power(field.multiply(u, v7), exponent))
+        let vx2 = field.multiply(v, field.multiply(x, x))
+        if vx2 == u {
+            // x is a root.
+        } else if vx2 == field.subtract(zero, u) {
+            x = field.multiply(x, sqrtMinusOne)
+        } else {
+            return nil
+        }
+        let xPlain = field.fromMontgomery(x)
+        if xPlain.isZero && sign == 1 { return nil }
+        if UInt8(xPlain.limbs[0] & 1) != sign { x = field.subtract(zero, x) }
+        return Point(x: x, y: y, z: one, t: field.multiply(x, y))
+    }
+
+    static func encode(_ point: Point) -> [UInt8] {
+        let inverse = field.inverse(point.z)
+        let x = field.fromMontgomery(field.multiply(point.x, inverse))
+        var bytes = field.fromMontgomery(field.multiply(point.y, inverse)).littleEndianBytes
+        bytes[31] |= UInt8(x.limbs[0] & 1) << 7
+        return bytes
+    }
+
+    /// The sum of two points (unified: also doubles).
+    static func add(_ p1: Point, _ p2: Point) -> Point {
+        let a = field.multiply(field.subtract(p1.y, p1.x), field.subtract(p2.y, p2.x))
+        let b = field.multiply(field.add(p1.y, p1.x), field.add(p2.y, p2.x))
+        let c = field.multiply(field.multiply(p1.t, d2), p2.t)
+        let zz = field.multiply(p1.z, p2.z)
+        let dd = field.add(zz, zz)
+        let e = field.subtract(b, a)
+        let f = field.subtract(dd, c)
+        let g = field.add(dd, c)
+        let h = field.add(b, a)
+        return Point(x: field.multiply(e, f), y: field.multiply(g, h), z: field.multiply(f, g), t: field.multiply(e, h))
+    }
+
+    static func negate(_ point: Point) -> Point {
+        Point(x: field.subtract(zero, point.x), y: point.y, z: point.z, t: field.subtract(zero, point.t))
+    }
+
+    static func multiply(_ point: Point, by scalar: _U256) -> Point {
+        var result = identity
+        for index in (0..<256).reversed() {
+            result = add(result, result)
+            if scalar.bit(index) { result = add(result, point) }
+        }
+        return result
+    }
+
+    // MARK: Scalars modulo l
+
+    /// `x` mod l, for any 256-bit `x` (plain form in and out).
+    static func reduced(_ x: _U256) -> _U256 { scalars.fromMontgomery(scalars.toMontgomery(x)) }
+
+    /// SHA-512 of `bytes`, as a little-endian integer mod l.
+    static func reducedHash(_ bytes: [UInt8]) -> _U256 {
+        let hash = Array(SHA512.hash(data: bytes))
+        let low = _U256(littleEndian: Array(hash[0..<32]))
+        let high = _U256(littleEndian: Array(hash[32..<64]))
+        // high·2²⁵⁶ + low: toMontgomery(high) is high·2²⁵⁶ mod l.
+        return scalars.add(scalars.toMontgomery(high), reduced(low))
+    }
+
+    /// a·b mod l (plain form).
+    static func scalarProduct(_ a: _U256, _ b: _U256) -> _U256 {
+        scalars.fromMontgomery(scalars.multiply(scalars.toMontgomery(a), scalars.toMontgomery(b)))
+    }
+}
+
+
+// MARK: - X25519
+
+enum _X25519 {
+    static let basePoint: [UInt8] = [9] + [UInt8](repeating: 0, count: 31)
+
+    /// The Montgomery ladder of RFC 7748: the u-coordinate of `scalar`·`u`.
+    static func multiply(_ scalarBytes: [UInt8], _ uBytes: [UInt8]) -> [UInt8] {
+        let field = _Ed25519.field
+        var k = scalarBytes
+        k[0] &= 248
+        k[31] &= 127
+        k[31] |= 64
+        let scalar = _U256(littleEndian: k)
+        var uMasked = uBytes
+        uMasked[31] &= 127
+        var uPlain = _U256(littleEndian: uMasked)
+        if !(uPlain < _Ed25519.p) { uPlain = uPlain.subtracting(_Ed25519.p).0 }
+        let x1 = field.toMontgomery(uPlain)
+        let a24 = field.toMontgomery(_U256([121_665, 0, 0, 0]))
+        var (x2, z2, x3, z3) = (_Ed25519.one, _Ed25519.zero, x1, _Ed25519.one)
+        var swapped = false
+        for index in (0..<255).reversed() {
+            let bit = scalar.bit(index)
+            if swapped != bit { swap(&x2, &x3); swap(&z2, &z3) }
+            swapped = bit
+            let a = field.add(x2, z2)
+            let aa = field.multiply(a, a)
+            let b = field.subtract(x2, z2)
+            let bb = field.multiply(b, b)
+            let e = field.subtract(aa, bb)
+            let c = field.add(x3, z3)
+            let dd = field.subtract(x3, z3)
+            let da = field.multiply(dd, a)
+            let cb = field.multiply(c, b)
+            let sum = field.add(da, cb)
+            let difference = field.subtract(da, cb)
+            x3 = field.multiply(sum, sum)
+            z3 = field.multiply(x1, field.multiply(difference, difference))
+            x2 = field.multiply(aa, bb)
+            z2 = field.multiply(e, field.add(aa, field.multiply(a24, e)))
+        }
+        if swapped { swap(&x2, &x3); swap(&z2, &z3) }
+        return field.fromMontgomery(field.multiply(x2, field.inverse(z2))).littleEndianBytes
+    }
+}

package/Sources/CryptoKit/P256.swift

@@ -0,0 +1,321 @@
+// P-256 key agreement (`P256.KeyAgreement`): private keys, their public
+// keys in CryptoKit's representations, and ECDH shared secrets, computed in
+// plain Swift (Ice Cubes registers a P-256 public key with its push relay).
+// Field elements are four 64-bit limbs in Montgomery form; points use
+// Jacobian coordinates. The scalar multiplication is not constant-time:
+// fine for keys the page makes and keeps for itself, not for a server.
+// P-256 signing, HKDF and AES are not here (Curve25519.swift and
+// ChaChaPoly.swift have the other curve and cipher).
+
+import struct Foundation.Data
+import protocol Foundation.DataProtocol
+
+public enum CryptoKitError: Error, Equatable, Sendable {
+    case incorrectKeySize
+    case incorrectParameterSize
+    case invalidParameter
+    case underlyingCoreCryptoError(error: Int32)
+    case authenticationFailure
+}
+
+public enum P256 {
+    public enum KeyAgreement {
+        public struct PrivateKey: Sendable {
+            let scalar: _U256
+
+            /// A new random key.
+            public init(compactRepresentable: Bool = true) {
+                var generator = SystemRandomNumberGenerator()
+                while true {
+                    let candidate = _U256((0..<4).map { _ in generator.next() as UInt64 })
+                    if !candidate.isZero && candidate < _P256.n { scalar = candidate; return }
+                }
+            }
+
+            /// The 32-byte big-endian scalar.
+            public init<D: DataProtocol>(rawRepresentation data: D) throws {
+                let bytes = Array(data)
+                guard bytes.count == 32 else { throw CryptoKitError.incorrectKeySize }
+                let scalar = _U256(bigEndian: bytes)
+                guard !scalar.isZero, scalar < _P256.n else { throw CryptoKitError.invalidParameter }
+                self.scalar = scalar
+            }
+
+            public var rawRepresentation: Data { Data(scalar.bigEndianBytes) }
+
+            public var publicKey: PublicKey { PublicKey(point: _P256.multiply(_P256.generator, by: scalar)) }
+
+            /// The x coordinate of this key times `publicKeyShare`.
+            public func sharedSecretFromKeyAgreement(with publicKeyShare: PublicKey) throws -> SharedSecret {
+                let point = _P256.multiply(publicKeyShare.point, by: scalar)
+                return SharedSecret(bytes: point.x.bigEndianBytes)
+            }
+        }
+
+        public struct PublicKey: Sendable {
+            let point: _P256.Affine
+
+            init(point: _P256.Affine) { self.point = point }
+
+            /// `04 ‖ x ‖ y` (65 bytes).
+            public init<D: DataProtocol>(x963Representation data: D) throws {
+                let bytes = Array(data)
+                guard bytes.count == 65, bytes[0] == 4 else { throw CryptoKitError.incorrectParameterSize }
+                try self.init(x: Array(bytes[1..<33]), y: Array(bytes[33..<65]))
+            }
+
+            /// `x ‖ y` (64 bytes).
+            public init<D: DataProtocol>(rawRepresentation data: D) throws {
+                let bytes = Array(data)
+                guard bytes.count == 64 else { throw CryptoKitError.incorrectParameterSize }
+                try self.init(x: Array(bytes[0..<32]), y: Array(bytes[32..<64]))
+            }
+
+            init(x: [UInt8], y: [UInt8]) throws {
+                let point = _P256.Affine(x: _U256(bigEndian: x), y: _U256(bigEndian: y))
+                guard _P256.isOnCurve(point) else { throw CryptoKitError.invalidParameter }
+                self.point = point
+            }
+
+            public var x963Representation: Data { Data([4] + point.x.bigEndianBytes + point.y.bigEndianBytes) }
+            public var rawRepresentation: Data { Data(point.x.bigEndianBytes + point.y.bigEndianBytes) }
+            /// `02`/`03` (the parity of y) ‖ x.
+            public var compressedRepresentation: Data { Data([point.y.limbs[0] & 1 == 0 ? 2 : 3] + point.x.bigEndianBytes) }
+        }
+    }
+}
+
+/// The result of a key agreement: here, the shared point's x coordinate.
+public struct SharedSecret: Sendable, CustomStringConvertible {
+    let bytes: [UInt8]
+
+    public func withUnsafeBytes<R>(_ body: (UnsafeRawBufferPointer) throws -> R) rethrows -> R {
+        try bytes.withUnsafeBytes(body)
+    }
+
+    public var description: String { "SharedSecret: \(bytes.map { String($0, radix: 16) }.joined())" }
+}
+
+// MARK: - 256-bit arithmetic
+
+/// An unsigned 256-bit integer: four 64-bit limbs, least significant first.
+struct _U256: Comparable, Sendable {
+    var limbs: [UInt64]
+
+    init(_ limbs: [UInt64]) { self.limbs = limbs }
+
+    init(bigEndian bytes: [UInt8]) {
+        limbs = (0..<4).map { i in
+            (0..<8).reduce(UInt64(0)) { $0 << 8 | UInt64(bytes[32 - 8 * (i + 1) + $1]) }
+        }
+    }
+
+    var bigEndianBytes: [UInt8] {
+        limbs.reversed().flatMap { limb in (0..<8).reversed().map { UInt8(truncatingIfNeeded: limb >> (8 * $0)) } }
+    }
+
+    var isZero: Bool { limbs.allSatisfy { $0 == 0 } }
+
+    func bit(_ index: Int) -> Bool { limbs[index / 64] >> (index % 64) & 1 == 1 }
+
+    static func < (lhs: _U256, rhs: _U256) -> Bool {
+        for i in (0..<4).reversed() where lhs.limbs[i] != rhs.limbs[i] { return lhs.limbs[i] < rhs.limbs[i] }
+        return false
+    }
+
+    /// `self + other`, and whether it overflowed 2²⁵⁶.
+    func adding(_ other: _U256) -> (_U256, Bool) {
+        var result = [UInt64](repeating: 0, count: 4)
+        var carry = false
+        for i in 0..<4 {
+            let (sum1, o1) = limbs[i].addingReportingOverflow(other.limbs[i])
+            let (sum2, o2) = sum1.addingReportingOverflow(carry ? 1 : 0)
+            result[i] = sum2
+            carry = o1 || o2
+        }
+        return (_U256(result), carry)
+    }
+
+    /// `self − other`, and whether it borrowed.
+    func subtracting(_ other: _U256) -> (_U256, Bool) {
+        var result = [UInt64](repeating: 0, count: 4)
+        var borrow = false
+        for i in 0..<4 {
+            let (d1, b1) = limbs[i].subtractingReportingOverflow(other.limbs[i])
+            let (d2, b2) = d1.subtractingReportingOverflow(borrow ? 1 : 0)
+            result[i] = d2
+            borrow = b1 || b2
+        }
+        return (_U256(result), borrow)
+    }
+}
+
+/// Arithmetic modulo an odd 256-bit modulus, in Montgomery form (x·2²⁵⁶ mod m).
+struct _MontgomeryField: Sendable {
+    let modulus: _U256
+    let mPrime: UInt64
+    let r2: _U256
+
+    init(modulus: _U256) {
+        self.modulus = modulus
+        var inverse: UInt64 = 1
+        for _ in 0..<6 { inverse = inverse &* (2 &- modulus.limbs[0] &* inverse) }
+        mPrime = 0 &- inverse
+        // 2⁵¹² mod m, by doubling 1 that many times.
+        var value = _U256([1, 0, 0, 0])
+        for _ in 0..<512 {
+            let (doubled, overflow) = value.adding(value)
+            value = overflow || !(doubled < modulus) ? doubled.subtracting(modulus).0 : doubled
+        }
+        r2 = value
+    }
+
+    func add(_ a: _U256, _ b: _U256) -> _U256 {
+        let (sum, overflow) = a.adding(b)
+        return overflow || !(sum < modulus) ? sum.subtracting(modulus).0 : sum
+    }
+
+    func subtract(_ a: _U256, _ b: _U256) -> _U256 {
+        let (difference, borrow) = a.subtracting(b)
+        return borrow ? difference.adding(modulus).0 : difference
+    }
+
+    /// a·b·2⁻²⁵⁶ mod m (CIOS).
+    func multiply(_ a: _U256, _ b: _U256) -> _U256 {
+        var t = [UInt64](repeating: 0, count: 6)
+        let m = modulus.limbs
+        for i in 0..<4 {
+            var carry: UInt64 = 0
+            for j in 0..<4 { (t[j], carry) = Self.multiplyAdd(a.limbs[j], b.limbs[i], t[j], carry) }
+            let (sum, overflow) = t[4].addingReportingOverflow(carry)
+            t[4] = sum
+            t[5] = overflow ? 1 : 0
+            let factor = t[0] &* mPrime
+            (_, carry) = Self.multiplyAdd(factor, m[0], t[0], 0)
+            for j in 1..<4 { (t[j - 1], carry) = Self.multiplyAdd(factor, m[j], t[j], carry) }
+            let (top, overflow2) = t[4].addingReportingOverflow(carry)
+            t[3] = top
+            t[4] = t[5] + (overflow2 ? 1 : 0)
+        }
+        let result = _U256(Array(t[0..<4]))
+        return t[4] != 0 || !(result < modulus) ? result.subtracting(modulus).0 : result
+    }
+
+    /// a·b + c + d, as (low, high) limbs.
+    static func multiplyAdd(_ a: UInt64, _ b: UInt64, _ c: UInt64, _ d: UInt64) -> (UInt64, UInt64) {
+        var (high, low) = a.multipliedFullWidth(by: b)
+        var overflow: Bool
+        (low, overflow) = low.addingReportingOverflow(c)
+        if overflow { high &+= 1 }
+        (low, overflow) = low.addingReportingOverflow(d)
+        if overflow { high &+= 1 }
+        return (low, high)
+    }
+
+    func toMontgomery(_ a: _U256) -> _U256 { multiply(a, r2) }
+    func fromMontgomery(_ a: _U256) -> _U256 { multiply(a, _U256([1, 0, 0, 0])) }
+
+    /// a⁻¹ by Fermat (a^(m−2)), in Montgomery form.
+    func inverse(_ a: _U256) -> _U256 {
+        let exponent = modulus.subtracting(_U256([2, 0, 0, 0])).0
+        var result = toMontgomery(_U256([1, 0, 0, 0]))
+        for index in (0..<256).reversed() {
+            result = multiply(result, result)
+            if exponent.bit(index) { result = multiply(result, a) }
+        }
+        return result
+    }
+}
+
+// MARK: - The curve
+
+enum _P256 {
+    static let p = _U256([0xFFFF_FFFF_FFFF_FFFF, 0x0000_0000_FFFF_FFFF, 0, 0xFFFF_FFFF_0000_0001])
+    static let n = _U256([0xF3B9_CAC2_FC63_2551, 0xBCE6_FAAD_A717_9E84, 0xFFFF_FFFF_FFFF_FFFF, 0xFFFF_FFFF_0000_0000])
+    static let b = _U256([0x3BCE_3C3E_27D2_604B, 0x651D_06B0_CC53_B0F6, 0xB3EB_BD55_7698_86BC, 0x5AC6_35D8_AA3A_93E7])
+    static let generator = Affine(
+        x: _U256([0xF4A1_3945_D898_C296, 0x7703_7D81_2DEB_33A0, 0xF8BC_E6E5_63A4_40F2, 0x6B17_D1F2_E12C_4247]),
+        y: _U256([0xCBB6_4068_37BF_51F5, 0x2BCE_3357_6B31_5ECE, 0x8EE7_EB4A_7C0F_9E16, 0x4FE3_42E2_FE1A_7F9B]))
+    static let field = _MontgomeryField(modulus: p)
+
+    /// A point in plain (not Montgomery) coordinates.
+    struct Affine: Sendable {
+        let x: _U256
+        let y: _U256
+    }
+
+    /// A point in Jacobian coordinates, Montgomery form; z = 0 is the point at infinity.
+    struct Jacobian {
+        var x: _U256
+        var y: _U256
+        var z: _U256
+        static let infinity = Jacobian(x: _U256([0, 0, 0, 0]), y: _U256([0, 0, 0, 0]), z: _U256([0, 0, 0, 0]))
+    }
+
+    /// y² = x³ − 3x + b, with both coordinates below p.
+    static func isOnCurve(_ point: Affine) -> Bool {
+        guard point.x < p, point.y < p else { return false }
+        let f = field
+        let x = f.toMontgomery(point.x), y = f.toMontgomery(point.y)
+        let x3 = f.multiply(f.multiply(x, x), x)
+        let threeX = f.add(f.add(x, x), x)
+        let right = f.add(f.subtract(x3, threeX), f.toMontgomery(b))
+        return f.fromMontgomery(f.multiply(y, y)).limbs == f.fromMontgomery(right).limbs
+    }
+
+    static func double(_ point: Jacobian) -> Jacobian {
+        if point.z.isZero || point.y.isZero { return .infinity }
+        let f = field
+        let delta = f.multiply(point.z, point.z)
+        let gamma = f.multiply(point.y, point.y)
+        let beta = f.multiply(point.x, gamma)
+        let product = f.multiply(f.subtract(point.x, delta), f.add(point.x, delta))
+        let alpha = f.add(f.add(product, product), product)
+        let fourBeta = f.add(f.add(beta, beta), f.add(beta, beta))
+        let x3 = f.subtract(f.multiply(alpha, alpha), f.add(fourBeta, fourBeta))
+        let yz = f.add(point.y, point.z)
+        let z3 = f.subtract(f.subtract(f.multiply(yz, yz), gamma), delta)
+        let gamma2 = f.multiply(gamma, gamma)
+        let eightGamma2 = f.add(f.add(f.add(gamma2, gamma2), f.add(gamma2, gamma2)), f.add(f.add(gamma2, gamma2), f.add(gamma2, gamma2)))
+        let y3 = f.subtract(f.multiply(alpha, f.subtract(fourBeta, x3)), eightGamma2)
+        return Jacobian(x: x3, y: y3, z: z3)
+    }
+
+    /// `point + other`, `other` affine in Montgomery form (madd-2007-bl).
+    static func add(_ point: Jacobian, _ other: (x: _U256, y: _U256)) -> Jacobian {
+        let f = field
+        if point.z.isZero { return Jacobian(x: other.x, y: other.y, z: f.toMontgomery(_U256([1, 0, 0, 0]))) }
+        let z1z1 = f.multiply(point.z, point.z)
+        let u2 = f.multiply(other.x, z1z1)
+        let s2 = f.multiply(f.multiply(other.y, point.z), z1z1)
+        let h = f.subtract(u2, point.x)
+        let r0 = f.subtract(s2, point.y)
+        if h.isZero { return r0.isZero ? double(point) : .infinity }
+        let hh = f.multiply(h, h)
+        let i = f.add(f.add(hh, hh), f.add(hh, hh))
+        let j = f.multiply(h, i)
+        let r = f.add(r0, r0)
+        let v = f.multiply(point.x, i)
+        let x3 = f.subtract(f.subtract(f.multiply(r, r), j), f.add(v, v))
+        let y1j = f.multiply(point.y, j)
+        let y3 = f.subtract(f.multiply(r, f.subtract(v, x3)), f.add(y1j, y1j))
+        let zh = f.add(point.z, h)
+        let z3 = f.subtract(f.subtract(f.multiply(zh, zh), z1z1), hh)
+        return Jacobian(x: x3, y: y3, z: z3)
+    }
+
+    /// scalar · point, by double-and-add. The scalar is in [1, n), so the result is never infinity.
+    static func multiply(_ point: Affine, by scalar: _U256) -> Affine {
+        let f = field
+        let base = (x: f.toMontgomery(point.x), y: f.toMontgomery(point.y))
+        var result = Jacobian.infinity
+        for index in (0..<256).reversed() {
+            result = double(result)
+            if scalar.bit(index) { result = add(result, base) }
+        }
+        let zInverse = f.inverse(result.z)
+        let zInverse2 = f.multiply(zInverse, zInverse)
+        return Affine(x: f.fromMontgomery(f.multiply(result.x, zInverse2)),
+                      y: f.fromMontgomery(f.multiply(result.y, f.multiply(zInverse2, zInverse))))
+    }
+}