functionalscript 0.43.1 → 0.44.0

package/fjs/crypto/sha2/module.f.js

@@ -1,266 +0,0 @@
-import { mask } from "../../types/bigint/module.f.js";
-import { vec, length, empty, msb, chunkList, uint } from '../../types/bit_vec/module.f.js';
-import { fold } from '../../types/list/module.f.js';
-const { concat, front } = msb;
-// `chunkList(msb)` depends on neither `chunkLength` nor `v`/`state` — shared
-// across every `base(...)` config (32-bit and 64-bit SHA-2 variants).
-const chunkListMsb = chunkList(msb);
-const lastOne = vec(1n)(1n);
-const base = ({ logBitLen, k, bs0, bs1, ss0, ss1 }) => {
-    const bitLength = 1n << logBitLen;
-    const rotr = (d) => {
-        const r = bitLength - d;
-        return (n) => n >> d | n << r;
-    };
-    const sigma = third => (a, b, c) => {
-        const ra = rotr(a);
-        const rb = rotr(b);
-        const rc = third(c);
-        return x => ra(x) ^ rb(x) ^ rc(x);
-    };
-    const bigSigma = sigma(rotr);
-    const smallSigma = sigma(c => x => x >> c);
-    const bigSigma0 = bigSigma(...bs0);
-    const bigSigma1 = bigSigma(...bs1);
-    const smallSigma0 = smallSigma(...ss0);
-    const smallSigma1 = smallSigma(...ss1);
-    const ch = (x, y, z) => x & y ^ ~x & z;
-    const maj = (x, y, z) => x & y ^ x & z ^ y & z;
-    const m = mask(bitLength);
-    const wi = (a0, a1, a2, a3) => (smallSigma1(a0) + a1 + smallSigma0(a2) + a3) & m;
-    const nextW = (w0, w1, w2, w3, w4, w5, w6, w7, w8, w9, wA, wB, wC, wD, wE, wF) => {
-        w0 = wi(wE, w9, w1, w0);
-        w1 = wi(wF, wA, w2, w1);
-        w2 = wi(w0, wB, w3, w2);
-        w3 = wi(w1, wC, w4, w3);
-        w4 = wi(w2, wD, w5, w4);
-        w5 = wi(w3, wE, w6, w5);
-        w6 = wi(w4, wF, w7, w6);
-        w7 = wi(w5, w0, w8, w7);
-        w8 = wi(w6, w1, w9, w8);
-        w9 = wi(w7, w2, wA, w9);
-        wA = wi(w8, w3, wB, wA);
-        wB = wi(w9, w4, wC, wB);
-        wC = wi(wA, w5, wD, wC);
-        wD = wi(wB, w6, wE, wD);
-        wE = wi(wC, w7, wF, wE);
-        wF = wi(wD, w8, w0, wF);
-        return [w0, w1, w2, w3, w4, w5, w6, w7, w8, w9, wA, wB, wC, wD, wE, wF];
-    };
-    const kLength = k.length;
-    const compressV16 = (a0, b0, c0, d0, e0, f0, g0, h0) => w => {
-        let a = a0;
-        let b = b0;
-        let c = c0;
-        let d = d0;
-        let e = e0;
-        let f = f0;
-        let g = g0;
-        let h = h0;
-        let i = 0;
-        while (true) {
-            const ki = k[i];
-            for (let j = 0; j < 16; ++j) {
-                const t1 = h + bigSigma1(e) + ch(e, f, g) + ki[j] + w[j];
-                const t2 = bigSigma0(a) + maj(a, b, c);
-                h = g;
-                g = f;
-                f = e;
-                e = (d + t1) & m;
-                d = c;
-                c = b;
-                b = a;
-                a = (t1 + t2) & m;
-            }
-            ++i;
-            if (i === kLength) {
-                break;
-            }
-            w = nextW(...w);
-        }
-        return [
-            (a0 + a) & m,
-            (b0 + b) & m,
-            (c0 + c) & m,
-            (d0 + d) & m,
-            (e0 + e) & m,
-            (f0 + f) & m,
-            (g0 + g) & m,
-            (h0 + h) & m,
-        ];
-    };
-    const at = u => i => (u >> (i << logBitLen)) & m;
-    const compress = i => u => {
-        const a = at(u);
-        return compressV16(...i)([
-            a(15n),
-            a(14n),
-            a(13n),
-            a(12n),
-            a(11n),
-            a(10n),
-            a(9n),
-            a(8n),
-            a(7n),
-            a(6n),
-            a(5n),
-            a(4n),
-            a(3n),
-            a(2n),
-            a(1n),
-            a(0n),
-        ]);
-    };
-    const chunkLength = bitLength << 4n; // * 16
-    // `chunkListMsb(chunkLength)` depends on `chunkLength` but not `v`/`state`
-    // — computed once per `base(...)` config, not once per `append` call.
-    const chunkListChunkLength = chunkListMsb(chunkLength);
-    // Folds one block (or the final, shorter-than-`chunkLength` leftover) into
-    // `State`. `chunkList` yields chunks of exactly `chunkLength` bits except
-    // possibly the last one, which is why `remainder` only ever holds that
-    // last chunk (`empty` otherwise) — same shape as `State` itself, so no
-    // separate accumulator type is needed.
-    const appendChunk = (chunk) => (state) => length(chunk) === chunkLength
-        ? { hash: compress(state.hash)(uint(chunk)), len: state.len + chunkLength, remainder: empty }
-        : { ...state, remainder: chunk };
-    // `fold(appendChunk)` depends on neither `v` nor `state` — only the
-    // starting accumulator passed to it per `append` call does.
-    const foldChunks = fold(appendChunk);
-    const fromV8 = (a) => a.reduce((p, v) => (p << bitLength) | v);
-    // See https://www.rfc-editor.org/rfc/rfc6234#section-4
-    const lastChunkLength = chunkLength - 1n - (bitLength << 1n);
-    return {
-        bitLength,
-        chunkLength,
-        compress,
-        fromV8,
-        append: (v) => (state) => foldChunks({ ...state, remainder: empty })(chunkListChunkLength(concat(state.remainder)(v))),
-        end: (hashLength) => {
-            const offset = (bitLength << 3n) - hashLength;
-            const result = vec(hashLength);
-            return (state) => {
-                const { len, remainder } = state;
-                let { hash } = state;
-                const rLen = length(remainder);
-                let u = front(chunkLength)(concat(remainder)(lastOne));
-                // last chunk overflow
-                if (rLen > lastChunkLength) {
-                    hash = compress(hash)(u);
-                    u = 0n;
-                }
-                return result(fromV8(compress(hash)(u | (len + rLen))) >> offset);
-            };
-        }
-    };
-};
-const sha2 = ({ append, end, chunkLength }, hash, hashLength) => ({
-    hashLength,
-    blockLength: chunkLength,
-    init: {
-        hash,
-        len: 0n,
-        remainder: empty,
-    },
-    append,
-    end: end(hashLength),
-});
-/**
- * Computes a SHA-2 hash from a list of message chunks.
- *
- * @param sha2 A SHA-2 algorithm configuration.
- * @returns A function that hashes the full list of chunks.
- */
-export const computeSync = ({ append, init, end }) => {
-    const f = fold(append)(init);
-    return (list) => end(f(list));
-};
-/** 32-bit SHA-2 base configuration shared by SHA-224 and SHA-256. */
-export const base32 = base({
-    logBitLen: 5n,
-    k: [
-        [
-            0x428a2f98n, 0x71374491n, 0xb5c0fbcfn, 0xe9b5dba5n, 0x3956c25bn, 0x59f111f1n, 0x923f82a4n, 0xab1c5ed5n,
-            0xd807aa98n, 0x12835b01n, 0x243185ben, 0x550c7dc3n, 0x72be5d74n, 0x80deb1fen, 0x9bdc06a7n, 0xc19bf174n,
-        ],
-        [
-            0xe49b69c1n, 0xefbe4786n, 0x0fc19dc6n, 0x240ca1ccn, 0x2de92c6fn, 0x4a7484aan, 0x5cb0a9dcn, 0x76f988dan,
-            0x983e5152n, 0xa831c66dn, 0xb00327c8n, 0xbf597fc7n, 0xc6e00bf3n, 0xd5a79147n, 0x06ca6351n, 0x14292967n,
-        ],
-        [
-            0x27b70a85n, 0x2e1b2138n, 0x4d2c6dfcn, 0x53380d13n, 0x650a7354n, 0x766a0abbn, 0x81c2c92en, 0x92722c85n,
-            0xa2bfe8a1n, 0xa81a664bn, 0xc24b8b70n, 0xc76c51a3n, 0xd192e819n, 0xd6990624n, 0xf40e3585n, 0x106aa070n,
-        ],
-        [
-            0x19a4c116n, 0x1e376c08n, 0x2748774cn, 0x34b0bcb5n, 0x391c0cb3n, 0x4ed8aa4an, 0x5b9cca4fn, 0x682e6ff3n,
-            0x748f82een, 0x78a5636fn, 0x84c87814n, 0x8cc70208n, 0x90befffan, 0xa4506cebn, 0xbef9a3f7n, 0xc67178f2n,
-        ],
-    ],
-    bs0: [2n, 13n, 22n],
-    bs1: [6n, 11n, 25n],
-    ss0: [7n, 18n, 3n],
-    ss1: [17n, 19n, 10n],
-});
-/** 64-bit SHA-2 base configuration shared by SHA-384, SHA-512, SHA-512/224 and SHA-512/256. */
-export const base64 = base({
-    logBitLen: 6n,
-    k: [
-        [
-            0x428a2f98d728ae22n, 0x7137449123ef65cdn, 0xb5c0fbcfec4d3b2fn, 0xe9b5dba58189dbbcn,
-            0x3956c25bf348b538n, 0x59f111f1b605d019n, 0x923f82a4af194f9bn, 0xab1c5ed5da6d8118n,
-            0xd807aa98a3030242n, 0x12835b0145706fben, 0x243185be4ee4b28cn, 0x550c7dc3d5ffb4e2n,
-            0x72be5d74f27b896fn, 0x80deb1fe3b1696b1n, 0x9bdc06a725c71235n, 0xc19bf174cf692694n,
-        ],
-        [
-            0xe49b69c19ef14ad2n, 0xefbe4786384f25e3n, 0x0fc19dc68b8cd5b5n, 0x240ca1cc77ac9c65n,
-            0x2de92c6f592b0275n, 0x4a7484aa6ea6e483n, 0x5cb0a9dcbd41fbd4n, 0x76f988da831153b5n,
-            0x983e5152ee66dfabn, 0xa831c66d2db43210n, 0xb00327c898fb213fn, 0xbf597fc7beef0ee4n,
-            0xc6e00bf33da88fc2n, 0xd5a79147930aa725n, 0x06ca6351e003826fn, 0x142929670a0e6e70n,
-        ],
-        [
-            0x27b70a8546d22ffcn, 0x2e1b21385c26c926n, 0x4d2c6dfc5ac42aedn, 0x53380d139d95b3dfn,
-            0x650a73548baf63den, 0x766a0abb3c77b2a8n, 0x81c2c92e47edaee6n, 0x92722c851482353bn,
-            0xa2bfe8a14cf10364n, 0xa81a664bbc423001n, 0xc24b8b70d0f89791n, 0xc76c51a30654be30n,
-            0xd192e819d6ef5218n, 0xd69906245565a910n, 0xf40e35855771202an, 0x106aa07032bbd1b8n,
-        ],
-        [
-            0x19a4c116b8d2d0c8n, 0x1e376c085141ab53n, 0x2748774cdf8eeb99n, 0x34b0bcb5e19b48a8n,
-            0x391c0cb3c5c95a63n, 0x4ed8aa4ae3418acbn, 0x5b9cca4f7763e373n, 0x682e6ff3d6b2b8a3n,
-            0x748f82ee5defb2fcn, 0x78a5636f43172f60n, 0x84c87814a1f0ab72n, 0x8cc702081a6439ecn,
-            0x90befffa23631e28n, 0xa4506cebde82bde9n, 0xbef9a3f7b2c67915n, 0xc67178f2e372532bn,
-        ],
-        [
-            0xca273eceea26619cn, 0xd186b8c721c0c207n, 0xeada7dd6cde0eb1en, 0xf57d4f7fee6ed178n,
-            0x06f067aa72176fban, 0x0a637dc5a2c898a6n, 0x113f9804bef90daen, 0x1b710b35131c471bn,
-            0x28db77f523047d84n, 0x32caab7b40c72493n, 0x3c9ebe0a15c9bebcn, 0x431d67c49c100d4cn,
-            0x4cc5d4becb3e42b6n, 0x597f299cfc657e2an, 0x5fcb6fab3ad6faecn, 0x6c44198c4a475817n,
-        ],
-    ],
-    bs0: [28n, 34n, 39n],
-    bs1: [14n, 18n, 41n],
-    ss0: [1n, 8n, 7n],
-    ss1: [19n, 61n, 6n],
-});
-/** SHA-256 */
-export const sha256 = sha2(base32, [0x6a09e667n, 0xbb67ae85n, 0x3c6ef372n, 0xa54ff53an, 0x510e527fn, 0x9b05688cn, 0x1f83d9abn, 0x5be0cd19n], 256n);
-/** SHA-224 */
-export const sha224 = sha2(base32, [0xc1059ed8n, 0x367cd507n, 0x3070dd17n, 0xf70e5939n, 0xffc00b31n, 0x68581511n, 0x64f98fa7n, 0xbefa4fa4n], 224n);
-/** SHA-512 */
-export const sha512 = sha2(base64, [
-    0x6a09e667f3bcc908n, 0xbb67ae8584caa73bn, 0x3c6ef372fe94f82bn, 0xa54ff53a5f1d36f1n,
-    0x510e527fade682d1n, 0x9b05688c2b3e6c1fn, 0x1f83d9abfb41bd6bn, 0x5be0cd19137e2179n,
-], 512n);
-/** SHA-384 */
-export const sha384 = sha2(base64, [
-    0xcbbb9d5dc1059ed8n, 0x629a292a367cd507n, 0x9159015a3070dd17n, 0x152fecd8f70e5939n,
-    0x67332667ffc00b31n, 0x8eb44a8768581511n, 0xdb0c2e0d64f98fa7n, 0x47b5481dbefa4fa4n,
-], 384n);
-/** SHA-512/256 */
-export const sha512x256 = sha2(base64, [
-    0x22312194fc2bf72cn, 0x9f555fa3c84c64c2n, 0x2393b86b6f53b151n, 0x963877195940eabdn,
-    0x96283ee2a88effe3n, 0xbe5e1e2553863992n, 0x2b0199fc2c85b8aan, 0x0eb72ddc81c52ca2n,
-], 256n);
-/** SHA-512/224 */
-export const sha512x224 = sha2(base64, [
-    0x8c3d37c819544da2n, 0x73e1996689dcd4d6n, 0x1dfab7ae32ff9c82n, 0x679dd514582f9fcfn,
-    0x0f6d2b697bd44da8n, 0x77e36f7304c48942n, 0x3f9d85a86a1d36c8n, 0x1112e6ad91d692a1n,
-], 224n);

package/fjs/crypto/sha2/proof.f.d.ts

@@ -1,31 +0,0 @@
-export declare const proof: {
-    base: {
-        b32: () => {
-            s256: () => void;
-            s224: () => void;
-        };
-        b64: () => {
-            s512: () => void;
-            s384: () => void;
-            s512x256: () => void;
-            s512x224: () => void;
-        };
-    };
-    sha2: {
-        sha256: () => void;
-        sha224: () => void;
-        sha512: () => void;
-        sha384: () => void;
-        sha512x256: () => void;
-        sha512x224: () => void;
-    };
-    utf8: (() => void)[];
-    fill: () => {
-        8: () => void;
-        16: () => void;
-    };
-    padding: {
-        overflow: () => void;
-    };
-    appendLargeVecIsFast: () => void;
-};

package/fjs/crypto/sha2/proof.f.js

@@ -1,139 +0,0 @@
-import { utf8 } from '../../text/module.f.js';
-import { repeat, uint, vec } from '../../types/bit_vec/module.f.js';
-import { flip } from '../../types/function/module.f.js';
-import { assertEq } from '../../asserts/module.f.js';
-import { map } from '../../types/list/module.f.js';
-import { base32, base64, computeSync, sha224, sha256, sha384, sha512, sha512x224, sha512x256, } from './module.f.js';
-const checkEmpty = ({ init, end, hashLength }) => (x) => {
-    const result = end(init);
-    assertEq(result, vec(hashLength)(x), [result, x]);
-};
-// https://en.wikipedia.org/wiki/SHA-2#Test_vectors
-//
-// https://csrc.nist.gov/Projects/Cryptographic-Algorithm-Validation-Program/Secure-Hashing
-export const proof = {
-    base: {
-        b32: () => {
-            const { fromV8, compress, chunkLength } = base32;
-            const e = 1n << (chunkLength - 1n);
-            return {
-                s256: () => {
-                    const result = fromV8(compress(sha256.init.hash)(e));
-                    const x = 0xe3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855n;
-                    assertEq(result, x, [result.toString(16), x.toString(16)]);
-                },
-                s224: () => {
-                    const result = fromV8(compress(sha224.init.hash)(e)) >> 32n;
-                    const x = 0xd14a028c2a3a2bc9476102bb288234c415a2b01f828ea62ac5b3e42fn;
-                    assertEq(result, x, [result, x]);
-                },
-            };
-        },
-        b64: () => {
-            const { fromV8, compress, chunkLength } = base64;
-            const e = 1n << (chunkLength - 1n);
-            return {
-                s512: () => {
-                    const result = fromV8(compress(sha512.init.hash)(e));
-                    const x = 0xcf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3en;
-                    assertEq(result, x, [result, x]);
-                },
-                s384: () => {
-                    const result = fromV8(compress(sha384.init.hash)(e)) >> 128n;
-                    const x = 0x38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95bn;
-                    assertEq(result, x, [result, x]);
-                },
-                s512x256: () => {
-                    const result = fromV8(base64.compress(sha512x256.init.hash)(e)) >> 256n;
-                    const x = 0xc672b8d1ef56ed28ab87c3622c5114069bdd3ad7b8f9737498d0c01ecef0967an;
-                    assertEq(result, x, [result, x]);
-                },
-                s512x224: () => {
-                    const result = fromV8(compress(sha512x224.init.hash)(e)) >> 288n;
-                    const x = 0x6ed0dd02806fa89e25de060c19d3ac86cabb87d6a0ddd05c333b84f4n;
-                    assertEq(result, x, [result, x]);
-                },
-            };
-        }
-    },
-    sha2: {
-        sha256: () => checkEmpty(sha256)(0xe3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855n),
-        sha224: () => checkEmpty(sha224)(0xd14a028c2a3a2bc9476102bb288234c415a2b01f828ea62ac5b3e42fn),
-        sha512: () => checkEmpty(sha512)(0xcf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3en),
-        sha384: () => checkEmpty(sha384)(0x38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95bn),
-        sha512x256: () => checkEmpty(sha512x256)(0xc672b8d1ef56ed28ab87c3622c5114069bdd3ad7b8f9737498d0c01ecef0967an),
-        sha512x224: () => checkEmpty(sha512x224)(0x6ed0dd02806fa89e25de060c19d3ac86cabb87d6a0ddd05c333b84f4n),
-    },
-    utf8: [
-        () => {
-            const e = 0x730e109bd7a8a32b1cb9d9a09aa2325d2430587ddbc0c38bad911525n;
-            {
-                const s = utf8("The quick brown fox jumps over the lazy dog");
-                const h = computeSync(sha224)([s]);
-                assertEq(uint(h), e, h);
-            }
-            {
-                const s = ['The', ' quick', ' brown', ' fox', ' jumps', ' over', ' the', ' lazy', ' dog'];
-                const h = computeSync(sha224)(map(utf8)(s));
-                assertEq(uint(h), e, h);
-            }
-        },
-        () => {
-            const s = utf8("The quick brown fox jumps over the lazy dog.");
-            const h = computeSync(sha224)([s]);
-            assertEq(uint(h), 0x619cba8e8e05826e9b8c519c0a5c68f4fb653e8a3d8aa04bb2c8cd4cn, h);
-        },
-        () => {
-            const s = utf8("hello world");
-            assertEq(uint(s), 0x68656c6c6f20776f726c64n, s);
-            let state = sha256.init;
-            state = sha256.append(s)(state);
-            const h = sha256.end(state);
-            assertEq(uint(h), 0xb94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9n, h);
-        }
-    ],
-    fill: () => {
-        const times = flip(repeat)(vec(32n)(0x31313131n));
-        return {
-            8: () => {
-                const r = times(8n);
-                let state = sha256.init;
-                state = sha256.append(r)(state);
-                const h = uint(sha256.end(state));
-                assertEq(h >> 224n, 0x8a83665fn, h);
-            },
-            16: () => {
-                const r = times(16n);
-                let state = sha256.init;
-                state = sha256.append(r)(state);
-                const h = sha256.end(state);
-                assertEq(uint(h), 0x3138bb9bc78df27c473ecfd1410f7bd45ebac1f59cf3ff9cfe4db77aab7aedd3n, h);
-            }
-        };
-    },
-    padding: {
-        overflow: () => {
-            const zero = vec(8n)(0n);
-            const msg = flip(repeat)(zero)(113n);
-            const h = computeSync(sha384)([msg]);
-            const x = 0x6be9af2cf3cd5dd12c8d9399ec2b34e66034fbd699d4e0221d39074172a380656089caafe8f39963f94cc7c0a07e3d21n;
-            assertEq(uint(h), x, h);
-        },
-    },
-    // Regression guard (sha2-append-quadratic): `append` used to be
-    // quadratic in the input size, not linear — a single call on a
-    // 100,000-byte `Vec` used to cost real seconds and scale worse than
-    // O(n²); now near-linear (~40-60ms on Node, well under `bun test`'s 5s
-    // per-test limit on Bun). No timing assertion (duration varies by
-    // engine/machine); relies on the test runner's own per-test timing to
-    // catch a regression, same convention as `fjs/basen/base64/proof.f.ts`
-    // `encodeLargeVecIsSlow`.
-    appendLargeVecIsFast: () => {
-        const big = repeat(100000n)(vec(8n)(0xffn));
-        let state = sha256.init;
-        state = sha256.append(big)(state);
-        const h = sha256.end(state);
-        const x = 0xbe87f6dbe42cdf682276fbecab3636fbfcaa008cf454d635dd77872b50d940aan;
-        assertEq(uint(h), x, h);
-    },
-};

package/fjs/crypto/sign/module.f.d.ts

@@ -1,33 +0,0 @@
-import type { Array2 } from '../../types/array/module.f.ts';
-import { type Vec } from '../../types/bit_vec/module.f.ts';
-import type { Curve } from '../secp/module.f.ts';
-import { type Sha2 } from '../sha2/module.f.ts';
-export type All = {
-    readonly q: bigint;
-    readonly qlen: bigint;
-    readonly bits2int: (b: Vec) => bigint;
-    readonly int2octets: (x: bigint) => Vec;
-    readonly bits2octets: (b: Vec) => Vec;
-};
-/**
- * Builds RFC6979 helper conversions for a subgroup order.
- *
- * @param q - Subgroup order.
- * @returns Conversion helpers used by deterministic nonce generation.
- */
-export declare const all: (q: bigint) => All;
-/**
- * Builds RFC6979 helper conversions from curve parameters.
- */
-export declare const fromCurve: (c: Curve) => All;
-export declare const concat: (...x: readonly Vec[]) => Vec;
-/**
- * Computes deterministic ECDSA nonce `k` as described by RFC6979.
- */
-export declare const computeK: (_: All) => (_: Sha2) => (x: bigint) => (m: Vec) => bigint;
-type Signature = Array2<bigint>;
-/**
- * Signs a message bit vector and returns an ECDSA `(r, s)` signature pair.
- */
-export declare const sign: (c: Curve) => (hf: Sha2) => (x: bigint) => (m: Vec) => Signature;
-export {};

package/fjs/crypto/sign/module.f.js

@@ -1,163 +0,0 @@
-/**
- * Signing helpers built on secp256k1 and SHA-256 primitives.
- *
- * @module
- */
-import { assertNotNullish } from '../../asserts/module.f.js';
-import { bitLength, divUp8, roundUp8 } from '../../types/bigint/module.f.js';
-import { empty, length, msb, repeat, unpack, vec, vec8 } from '../../types/bit_vec/module.f.js';
-import { hmac } from '../hmac/module.f.js';
-import { computeSync } from '../sha2/module.f.js';
-/**
- * Builds RFC6979 helper conversions for a subgroup order.
- *
- * @param q - Subgroup order.
- * @returns Conversion helpers used by deterministic nonce generation.
- */
-export const all = (q) => {
-    const qlen = bitLength(q);
-    const bits2int = (b) => {
-        const { length, uint } = unpack(b);
-        const diff = length - qlen;
-        return diff > 0n ? uint >> diff : uint;
-    };
-    const int2octets = vec(roundUp8(qlen));
-    return {
-        q,
-        qlen,
-        bits2int,
-        int2octets,
-        // since z2 < 2*q, we can use simple mod with `z1 < q ? z1 : z1 - q`
-        bits2octets: b => int2octets(bits2int(b) % q),
-    };
-};
-/**
- * Builds RFC6979 helper conversions from curve parameters.
- */
-export const fromCurve = (c) => all(c.nf.p);
-const x01 = vec8(0x01n);
-const x00 = vec8(0x00n);
-const { listToVec } = msb;
-export const concat = (...x) => listToVec(x);
-/**
- * Computes deterministic ECDSA nonce `k` as described by RFC6979.
- */
-export const computeK = ({ q, bits2int, qlen, int2octets, bits2octets }) => hf => {
-    // TODO: Look at https://www.rfc-editor.org/rfc/rfc6979#section-3.3 to reformulate
-    //       it using `HMAC_DRBG`.
-    const hmacf = hmac(hf);
-    // b. Set:
-    //      V = 0x01 0x01 0x01 ... 0x01
-    //    such that the length of V, in bits, is equal to 8*ceil(hlen/8).
-    //    For instance, on an octet-based system, if H is SHA-256, then V
-    //    is set to a sequence of 32 octets of value 1.  Note that in this
-    //    step and all subsequent steps, we use the same H function as the
-    //    one used in step 'a' to process the input message; this choice
-    //    will be discussed in more detail in Section 3.6.
-    const rep = repeat(divUp8(hf.hashLength));
-    const v0 = rep(x01);
-    // c. Set:
-    //      K = 0x00 0x00 0x00 ... 0x00
-    //    such that the length of K, in bits, is equal to 8*ceil(hlen/8).
-    const k0 = rep(x00);
-    //
-    return x => m => {
-        let v = v0;
-        let k = k0;
-        // a. Process m through the hash function H, yielding:
-        //      h1 = H(m)
-        //   (h1 is a sequence of hlen bits).
-        const h1 = computeSync(hf)([m]);
-        // d. Set:
-        //      K = HMAC_K(V || 0x00 || int2octets(x) || bits2octets(h1))
-        //    where '||' denotes concatenation.
-        const xh1 = concat(int2octets(x), bits2octets(h1));
-        k = hmacf(k)(concat(v, x00, xh1));
-        // e. Set:
-        //      V = HMAC_K(V)
-        v = hmacf(k)(v);
-        // f. Set:
-        //      K = HMAC_K(V || 0x01 || int2octets(x) || bits2octets(h1))
-        k = hmacf(k)(concat(v, x01, xh1));
-        // g. Set:
-        //      V = HMAC_K(V)
-        v = hmacf(k)(v);
-        // h. Apply the following algorithm until a proper value is for `k`:
-        while (true) {
-            // h. Apply the following algorithm until a proper value is for `k`:
-            //    1. Set `T` to the empty sequence, so `tlen = 0`.
-            let t = empty;
-            //    2. while `tlen < qlen` do:
-            //       - `V = HMAC_K(V)`
-            //       - `T = T || V`
-            // Possible optimizations:
-            // - precompute number of iterations
-            // - `qlen` can't be 0, so we can avoid the first check and
-            //   first concatenation.
-            while (length(t) < qlen) {
-                v = hmacf(k)(v);
-                t = concat(t, v);
-            }
-            //    3. Compute `k = bits2int(T)`. If `k` is not in `[1, q-1]` or `kG = 0` then
-            //       - `K = HMAC_K(V || 0x00)`
-            //       - `V = HMAC_K(V)`
-            //       and loop (try to generate a new `T`, and so on). Return to step `1`.
-            const result = bits2int(t);
-            if (0n < result && result < q) {
-                return result;
-            }
-            k = hmacf(k)(concat(v, x00));
-            v = hmacf(k)(v);
-        }
-    };
-};
-/**
- * Signs a message bit vector and returns an ECDSA `(r, s)` signature pair.
- */
-export const sign = (c) => (hf) => (x) => (m) => {
-    // 2.4 Signature Generation
-    const { nf: { p: q, div }, g } = c;
-    const a = all(q);
-    const { bits2int } = a;
-    // The following steps are then applied:
-    //
-    // 1. H(m) is transformed into an integer modulo q using the bits2int
-    //    transform and an extra modular reduction:
-    //
-    //       h = bits2int(H(m)) mod q
-    //
-    //     As was noted in the description of bits2octets, the extra modular
-    //     reduction is no more than a conditional subtraction.
-    const hm = computeSync(hf)([m]);
-    const h = bits2int(hm) % q;
-    // 2. A random value modulo q, dubbed k, is generated.  That value
-    //    shall not be 0; hence, it lies in the [1, q-1] range.  Most of
-    //    the remainder of this document will revolve around the process
-    //    used to generate k.  In plain DSA or ECDSA, k should be selected
-    //    through a random selection that chooses a value among the q-1
-    //    possible values with uniform probability.
-    const k = computeK(a)(hf)(x)(m);
-    // 3.  A value r (modulo q) is computed from k and the key parameters:
-    //
-    //     *  For ECDSA: the point kG is computed; its X coordinate (a
-    //        member of the field over which E is defined) is converted to
-    //        an integer, which is reduced modulo q, yielding r.
-    //
-    //     If r turns out to be zero, a new k should be selected and r
-    //     computed again (this is an utterly improbable occurrence).
-    // TODO: implement the loop. `computeK` should either
-    // - accept a state (current `k`).
-    // - accept a `is_valid` function.
-    const rxy = assertNotNullish(c.mul(k)(g), 'rxy === null');
-    const [r] = rxy;
-    // 4.  The value s (modulo q) is computed:
-    //
-    //        s = (h+x*r)/k mod q
-    //
-    //     The pair (r, s) is the signature.  How a signature is to be
-    //     encoded is not covered by the DSA and ECDSA standards themselves;
-    //     a common way is to use a DER-encoded ASN.1 structure (a SEQUENCE
-    //     of two INTEGERs, for r and s, in that order).
-    const s = div(h + x * r)(k);
-    return [r, s];
-};

package/fjs/crypto/sign/proof.f.d.ts

@@ -1,11 +0,0 @@
-export declare const proof: {
-    bits2int: () => void;
-    int2octets: () => void;
-    bit2octets: () => void;
-    k: () => void;
-    computeK: () => void;
-    investigate: () => void;
-    kk: () => void;
-    a2: () => void;
-    a2s: () => void;
-};