goscript 0.1.0 → 0.1.2

package/gs/crypto/ecdh/index.ts

@@ -0,0 +1,274 @@
+import * as $ from '@goscript/builtin/index.js'
+import * as io from '@goscript/io/index.js'
+
+export type Curve = x25519Curve | unsupportedCurve
+export type KeyExchanger = PrivateKey
+
+const x25519PublicKeySize = 32
+const x25519PrivateKeySize = 32
+const x25519SharedSecretSize = 32
+const p = (1n << 255n) - 19n
+const a24 = 121665n
+
+export class PublicKey {
+  public curve: Curve
+  public publicKey: $.Bytes
+
+  constructor(init?: Partial<{ curve: Curve; publicKey: $.Bytes }>) {
+    this.curve = init?.curve ?? x25519
+    this.publicKey = copyBytes(init?.publicKey ?? null)
+  }
+
+  public Bytes(): $.Bytes {
+    return copyBytes(this.publicKey)
+  }
+
+  public Curve(): Curve {
+    return this.curve
+  }
+
+  public Equal(x: PublicKey | $.VarRef<PublicKey> | null): boolean {
+    const other = $.pointerValueOrNil(x)
+    return other instanceof PublicKey && bytesEqual(this.publicKey, other.publicKey)
+  }
+}
+
+export class PrivateKey {
+  public curve: Curve
+  public privateKey: $.Bytes
+  public publicKey: PublicKey
+
+  constructor(
+    init?: Partial<{ curve: Curve; privateKey: $.Bytes; publicKey: PublicKey }>,
+  ) {
+    this.curve = init?.curve ?? x25519
+    this.privateKey = copyBytes(init?.privateKey ?? null)
+    this.publicKey = init?.publicKey ?? new PublicKey({ curve: this.curve })
+  }
+
+  public Bytes(): $.Bytes {
+    return copyBytes(this.privateKey)
+  }
+
+  public Curve(): Curve {
+    return this.curve
+  }
+
+  public ECDH(remote: PublicKey | $.VarRef<PublicKey> | null): [$.Bytes, $.GoError] {
+    const remoteKey = $.pointerValueOrNil(remote)
+    if (remoteKey == null || remoteKey.curve !== this.curve) {
+      return [null, $.newError('crypto/ecdh: private key and public key curves do not match')]
+    }
+    return this.curve.ecdh(this, remoteKey)
+  }
+
+  public Equal(x: PrivateKey | $.VarRef<PrivateKey> | null): boolean {
+    const other = $.pointerValueOrNil(x)
+    return other instanceof PrivateKey && bytesEqual(this.privateKey, other.privateKey)
+  }
+
+  public Public(): PublicKey {
+    return this.publicKey
+  }
+
+  public PublicKey(): PublicKey {
+    return this.publicKey
+  }
+}
+
+export class x25519Curve {
+  public GenerateKey(r: io.Reader | null): [PrivateKey | null, $.GoError] {
+    const key = new Uint8Array(x25519PrivateKeySize)
+    if (r != null) {
+      throw new Error('crypto/ecdh: custom random readers are not implemented in GoScript')
+    }
+    globalThis.crypto.getRandomValues(key)
+    return this.NewPrivateKey(key)
+  }
+
+  public NewPrivateKey(key: $.Bytes): [PrivateKey | null, $.GoError] {
+    if ($.len(key) !== x25519PrivateKeySize) {
+      return [null, $.newError('crypto/ecdh: invalid private key size')]
+    }
+    const privateKey = copyBytes(key)
+    const publicKey = scalarMult(privateKey, basepoint())
+    return [
+      new PrivateKey({
+        curve: this,
+        privateKey,
+        publicKey: new PublicKey({ curve: this, publicKey }),
+      }),
+      null,
+    ]
+  }
+
+  public NewPublicKey(key: $.Bytes): [PublicKey | null, $.GoError] {
+    if ($.len(key) !== x25519PublicKeySize) {
+      return [null, $.newError('crypto/ecdh: invalid public key')]
+    }
+    return [new PublicKey({ curve: this, publicKey: key }), null]
+  }
+
+  public String(): string {
+    return 'X25519'
+  }
+
+  public ecdh(local: PrivateKey | null, remote: PublicKey | null): [$.Bytes, $.GoError] {
+    const out = scalarMult(local?.privateKey ?? null, remote?.publicKey ?? null)
+    if (isZero(out)) {
+      return [null, $.newError('crypto/ecdh: bad X25519 remote ECDH input: low order point')]
+    }
+    return [out, null]
+  }
+}
+
+export function X25519(): Curve {
+  return x25519
+}
+
+export const x25519 = new x25519Curve()
+
+export class unsupportedCurve {
+  constructor(private readonly name: string) {}
+
+  public GenerateKey(_r: io.Reader | null): [PrivateKey | null, $.GoError] {
+    return [null, $.newError(`crypto/ecdh: ${this.name} is not implemented in GoScript`)]
+  }
+
+  public NewPrivateKey(_key: $.Bytes): [PrivateKey | null, $.GoError] {
+    return [null, $.newError(`crypto/ecdh: ${this.name} is not implemented in GoScript`)]
+  }
+
+  public NewPublicKey(_key: $.Bytes): [PublicKey | null, $.GoError] {
+    return [null, $.newError(`crypto/ecdh: ${this.name} is not implemented in GoScript`)]
+  }
+
+  public String(): string {
+    return this.name
+  }
+
+  public ecdh(_local: PrivateKey | null, _remote: PublicKey | null): [$.Bytes, $.GoError] {
+    return [null, $.newError(`crypto/ecdh: ${this.name} is not implemented in GoScript`)]
+  }
+}
+
+export function P256(): Curve {
+  return p256
+}
+
+export function P384(): Curve {
+  return p384
+}
+
+export function P521(): Curve {
+  return p521
+}
+
+const p256 = new unsupportedCurve('P-256')
+const p384 = new unsupportedCurve('P-384')
+const p521 = new unsupportedCurve('P-521')
+
+function scalarMult(scalar: $.Bytes, point: $.Bytes): Uint8Array {
+  const e = copyBytes(scalar)
+  const uBytes = copyBytes(point)
+  e[0] &= 248
+  e[31] &= 127
+  e[31] |= 64
+  uBytes[31] &= 127
+
+  const x1 = decodeLittleEndian(uBytes)
+  let x2 = 1n
+  let z2 = 0n
+  let x3 = x1
+  let z3 = 1n
+  let swap = 0n
+
+  for (let t = 254; t >= 0; t--) {
+    const k = (BigInt(e[Math.floor(t / 8)]) >> BigInt(t & 7)) & 1n
+    swap ^= k
+    ;[x2, x3] = cswap(swap, x2, x3)
+    ;[z2, z3] = cswap(swap, z2, z3)
+    swap = k
+
+    const a = mod(x2 + z2)
+    const aa = mod(a * a)
+    const b = mod(x2 - z2)
+    const bb = mod(b * b)
+    const eDiff = mod(aa - bb)
+    const c = mod(x3 + z3)
+    const d = mod(x3 - z3)
+    const da = mod(d * a)
+    const cb = mod(c * b)
+    x3 = mod((da + cb) ** 2n)
+    z3 = mod(x1 * mod((da - cb) ** 2n))
+    x2 = mod(aa * bb)
+    z2 = mod(eDiff * mod(aa + a24 * eDiff))
+  }
+
+  x2 = cswap(swap, x2, x3)[0]
+  z2 = cswap(swap, z2, z3)[0]
+
+  return encodeLittleEndian(mod(x2 * modInverse(z2)))
+}
+
+function cswap(swap: bigint, x: bigint, y: bigint): [bigint, bigint] {
+  const mask = -swap
+  const t = mask & (x ^ y)
+  return [x ^ t, y ^ t]
+}
+
+function mod(value: bigint): bigint {
+  const result = value % p
+  return result >= 0n ? result : result + p
+}
+
+function modInverse(value: bigint): bigint {
+  let lm = 1n
+  let hm = 0n
+  let low = mod(value)
+  let high = p
+  while (low > 1n) {
+    const r = high / low
+    ;[lm, hm] = [hm - lm * r, lm]
+    ;[low, high] = [high - low * r, low]
+  }
+  return mod(lm)
+}
+
+function decodeLittleEndian(bytes: Uint8Array): bigint {
+  let out = 0n
+  for (let i = bytes.length - 1; i >= 0; i--) {
+    out = (out << 8n) | BigInt(bytes[i])
+  }
+  return out
+}
+
+function encodeLittleEndian(value: bigint): Uint8Array {
+  const out = new Uint8Array(x25519SharedSecretSize)
+  let v = mod(value)
+  for (let i = 0; i < out.length; i++) {
+    out[i] = Number(v & 0xffn)
+    v >>= 8n
+  }
+  return out
+}
+
+function basepoint(): Uint8Array {
+  const out = new Uint8Array(x25519PublicKeySize)
+  out[0] = 9
+  return out
+}
+
+function copyBytes(bytes: $.Bytes | null): Uint8Array {
+  return new Uint8Array($.bytesToUint8Array(bytes ?? null))
+}
+
+function bytesEqual(a: $.Bytes, b: $.Bytes): boolean {
+  const aa = $.bytesToUint8Array(a)
+  const bb = $.bytesToUint8Array(b)
+  return aa.length === bb.length && aa.every((v, i) => v === bb[i])
+}
+
+function isZero(bytes: Uint8Array): boolean {
+  return bytes.every((b) => b === 0)
+}

package/gs/crypto/ed25519/index.test.ts

@@ -0,0 +1,41 @@
+import { describe, expect, test } from 'vitest'
+import * as $ from '@goscript/builtin/index.js'
+
+import {
+  GenerateKey,
+  PrivateKeySize,
+  PrivateKey_Public,
+  PublicKeySize,
+  SignatureSize,
+  Sign,
+  Verify,
+} from './index.js'
+
+describe('crypto/ed25519 override', () => {
+  test('generates keys and verifies signatures', async () => {
+    const [pub, priv, err] = await GenerateKey(null)
+    expect(err).toBeNull()
+    expect($.len(pub)).toBe(PublicKeySize)
+    expect($.len(priv)).toBe(PrivateKeySize)
+
+    const message = $.stringToBytes('goscript')
+    const sig = await Sign(priv, message)
+    expect($.len(sig)).toBe(SignatureSize)
+    expect(await Verify(pub, message, sig)).toBe(true)
+    expect(await Verify(pub, $.stringToBytes('wrong'), sig)).toBe(false)
+  })
+
+  test('boxes public keys as crypto public keys', async () => {
+    const [pub, priv, err] = await GenerateKey(null)
+    expect(err).toBeNull()
+
+    const boxed = PrivateKey_Public(priv)
+    const [unboxed, ok] = $.typeAssertTuple<Uint8Array>(
+      boxed,
+      'ed25519.PublicKey',
+    )
+    expect(ok).toBe(true)
+    expect(Array.from(unboxed)).toEqual(Array.from(pub))
+    expect((boxed as any).Equal(boxed)).toBe(true)
+  })
+})

package/gs/crypto/ed25519/index.ts

@@ -0,0 +1,238 @@
+import * as $ from '@goscript/builtin/index.js'
+import * as io from '@goscript/io/index.js'
+
+export type PublicKey = $.Bytes
+export type PrivateKey = $.Bytes
+type Hash = number
+type PublicKeyInterface = any
+type PrivateKeyInterface = any
+type SignerOpts = { HashFunc(): Hash }
+
+export const PublicKeySize = 32
+export const PrivateKeySize = 64
+export const SignatureSize = 64
+export const SeedSize = 32
+
+const pkcs8Prefix = new Uint8Array([
+  0x30, 0x2e, 0x02, 0x01, 0x00, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70,
+  0x04, 0x22, 0x04, 0x20,
+])
+
+export class Options {
+  public Hash: Hash = 0
+  public Context = ''
+
+  constructor(init?: Partial<{ Hash: Hash; Context: string }>) {
+    this.Hash = init?.Hash ?? 0
+    this.Context = init?.Context ?? ''
+  }
+
+  public HashFunc(): Hash {
+    return this.Hash
+  }
+}
+
+export function PublicKey_Equal(pub: PublicKey, x: PublicKeyInterface | null): boolean {
+  const [xx, ok] = $.typeAssertTuple<PublicKey>(x, 'ed25519.PublicKey')
+  return ok && bytesEqual(pub, xx)
+}
+
+export function PrivateKey_Public(priv: PrivateKey): PublicKeyInterface | null {
+  const publicKey = new Uint8Array(PublicKeySize)
+  publicKey.set($.bytesToUint8Array(priv).subarray(SeedSize, PrivateKeySize))
+  return $.namedValueInterfaceValue<PublicKeyInterface | null>(
+    publicKey,
+    'ed25519.PublicKey',
+    { Equal: PublicKey_Equal },
+  )
+}
+
+export function PrivateKey_Equal(priv: PrivateKey, x: PrivateKeyInterface | null): boolean {
+  const [xx, ok] = $.typeAssertTuple<PrivateKey>(x, 'ed25519.PrivateKey')
+  return ok && bytesEqual(priv, xx)
+}
+
+export function PrivateKey_Seed(priv: PrivateKey): $.Bytes {
+  return new Uint8Array($.bytesToUint8Array(priv).subarray(0, SeedSize))
+}
+
+export async function PrivateKey_Sign(
+  priv: PrivateKey,
+  _rand: io.Reader | null,
+  message: $.Bytes,
+  opts: SignerOpts | null,
+): Promise<[$.Bytes, $.GoError]> {
+  if (opts != null && opts.HashFunc() !== 0) {
+    return [null, new Ed25519Error('ed25519: expected opts.HashFunc() zero')]
+  }
+  return [await Sign(priv, message), null]
+}
+
+export async function GenerateKey(random: io.Reader | null): Promise<[PublicKey, PrivateKey, $.GoError]> {
+  const seed = new Uint8Array(SeedSize)
+  if (random == null) {
+    const subtle = subtleCrypto()
+    if (subtle == null) {
+      return [
+        null as PublicKey,
+        null as PrivateKey,
+        new Ed25519Error('crypto/ed25519: WebCrypto is unavailable'),
+      ]
+    }
+    globalThis.crypto.getRandomValues(seed)
+  } else {
+    const [, err] = await io.ReadFull(random, seed)
+    if (err != null) {
+      return [null as PublicKey, null as PrivateKey, err]
+    }
+  }
+
+  const privateKey = await NewKeyFromSeed(seed)
+  return [
+    $.mustTypeAssert<PublicKey>(
+      PrivateKey_Public(privateKey),
+      'ed25519.PublicKey',
+    ),
+    privateKey,
+    null,
+  ]
+}
+
+export async function NewKeyFromSeed(seed: $.Bytes): Promise<PrivateKey> {
+  const seedBytes = $.bytesToUint8Array(seed)
+  if (seedBytes.length !== SeedSize) {
+    throw new Error(`ed25519: bad seed length: ${seedBytes.length}`)
+  }
+
+  const subtle = requireSubtle()
+  const key = await subtle.importKey(
+    'pkcs8',
+    pkcs8FromSeed(seedBytes) as unknown as BufferSource,
+    { name: 'Ed25519' },
+    true,
+    ['sign'],
+  )
+  const jwk = await subtle.exportKey('jwk', key)
+  if (typeof jwk.x !== 'string') {
+    throw new Error('crypto/ed25519: imported key did not expose public key')
+  }
+
+  const publicKey = base64URLDecode(jwk.x)
+  const privateKey = new Uint8Array(PrivateKeySize)
+  privateKey.set(seedBytes, 0)
+  privateKey.set(publicKey, SeedSize)
+  return privateKey
+}
+
+export async function Sign(privateKey: PrivateKey, message: $.Bytes): Promise<$.Bytes> {
+  const priv = $.bytesToUint8Array(privateKey)
+  if (priv.length !== PrivateKeySize) {
+    throw new Error(`ed25519: bad private key length: ${priv.length}`)
+  }
+
+  const key = await requireSubtle().importKey(
+    'pkcs8',
+    pkcs8FromSeed(priv.subarray(0, SeedSize)) as unknown as BufferSource,
+    { name: 'Ed25519' },
+    false,
+    ['sign'],
+  )
+  const sig = await requireSubtle().sign(
+    'Ed25519',
+    key,
+    $.bytesToUint8Array(message) as unknown as BufferSource,
+  )
+  return new Uint8Array(sig)
+}
+
+export async function Verify(
+  publicKey: PublicKey,
+  message: $.Bytes,
+  sig: $.Bytes,
+): Promise<boolean> {
+  return (await VerifyWithOptions(publicKey, message, sig, new Options())) == null
+}
+
+export async function VerifyWithOptions(
+  publicKey: PublicKey,
+  message: $.Bytes,
+  sig: $.Bytes,
+  opts: Options | $.VarRef<Options> | null,
+): Promise<$.GoError> {
+  if ($.len(publicKey) !== PublicKeySize) {
+    throw new Error(`ed25519: bad public key length: ${$.len(publicKey)}`)
+  }
+  if ($.len(sig) !== SignatureSize) {
+    return new Ed25519Error('ed25519: bad signature length')
+  }
+
+  const options = $.pointerValueOrNil(opts)
+  if (options != null && (options.Hash !== 0 || options.Context !== '')) {
+    return new Ed25519Error('ed25519: only pure Ed25519 is supported')
+  }
+
+  const key = await requireSubtle().importKey(
+    'raw',
+    $.bytesToUint8Array(publicKey) as unknown as BufferSource,
+    { name: 'Ed25519' },
+    false,
+    ['verify'],
+  )
+  const ok = await requireSubtle().verify(
+    'Ed25519',
+    key,
+    $.bytesToUint8Array(sig) as unknown as BufferSource,
+    $.bytesToUint8Array(message) as unknown as BufferSource,
+  )
+  return ok ? null : new Ed25519Error('ed25519: invalid signature')
+}
+
+class Ed25519Error {
+  constructor(private readonly message: string) {}
+
+  Error(): string {
+    return this.message
+  }
+}
+
+function requireSubtle(): SubtleCrypto {
+  const subtle = subtleCrypto()
+  if (subtle == null) {
+    throw new Error('crypto/ed25519: WebCrypto Ed25519 is unavailable')
+  }
+  return subtle
+}
+
+function subtleCrypto(): SubtleCrypto | null {
+  const crypto = globalThis.crypto
+  if (crypto?.subtle && typeof crypto.subtle.importKey === 'function') {
+    return crypto.subtle
+  }
+  return null
+}
+
+function pkcs8FromSeed(seed: Uint8Array): Uint8Array {
+  const out = new Uint8Array(pkcs8Prefix.length + SeedSize)
+  out.set(pkcs8Prefix)
+  out.set(seed, pkcs8Prefix.length)
+  return out
+}
+
+function bytesEqual(a: $.Bytes, b: $.Bytes): boolean {
+  const aa = $.bytesToUint8Array(a)
+  const bb = $.bytesToUint8Array(b)
+  if (aa.length !== bb.length) {
+    return false
+  }
+  let diff = 0
+  for (let i = 0; i < aa.length; i++) {
+    diff |= aa[i] ^ bb[i]
+  }
+  return diff === 0
+}
+
+function base64URLDecode(value: string): Uint8Array {
+  const normalized = value.replace(/-/g, '+').replace(/_/g, '/')
+  const padded = normalized.padEnd(Math.ceil(normalized.length / 4) * 4, '=')
+  return Uint8Array.from(atob(padded), (c) => c.charCodeAt(0))
+}

package/gs/crypto/ed25519/meta.json

@@ -0,0 +1,13 @@
+{
+  "dependencies": [
+    "io"
+  ],
+  "asyncFunctions": {
+    "GenerateKey": true,
+    "NewKeyFromSeed": true,
+    "Sign": true,
+    "Verify": true,
+    "VerifyWithOptions": true,
+    "PrivateKey_Sign": true
+  }
+}

package/gs/crypto/internal/constanttime/index.test.ts

@@ -0,0 +1,25 @@
+import { describe, expect, test } from 'vitest'
+
+import { ByteEq, Eq, LessOrEq, Select } from './index.js'
+
+describe('crypto/internal/constanttime override', () => {
+  test('selects on any non-zero selector', () => {
+    expect(Select(0, 11, 22)).toBe(22)
+    expect(Select(1, 11, 22)).toBe(11)
+    expect(Select(7, 11, 22)).toBe(11)
+  })
+
+  test('compares bytes and int32 values', () => {
+    expect(ByteEq(0xff, 0xff)).toBe(1)
+    expect(ByteEq(0x1ff, 0xff)).toBe(1)
+    expect(ByteEq(0x01, 0x02)).toBe(0)
+    expect(Eq(12, 12)).toBe(1)
+    expect(Eq(12, 13)).toBe(0)
+  })
+
+  test('compares integer ordering', () => {
+    expect(LessOrEq(1, 1)).toBe(1)
+    expect(LessOrEq(1, 2)).toBe(1)
+    expect(LessOrEq(2, 1)).toBe(0)
+  })
+})

package/gs/crypto/internal/constanttime/index.ts

@@ -0,0 +1,22 @@
+import * as $ from '@goscript/builtin/index.js'
+
+export function Select(v: number, x: number, y: number): number {
+  v = boolToUint8(v !== 0)
+  return (~(v - 1) & x) | ((v - 1) & y)
+}
+
+export function ByteEq(x: number, y: number): number {
+  return $.int(boolToUint8($.uint(x, 8) === $.uint(y, 8)))
+}
+
+export function Eq(x: number, y: number): number {
+  return $.int(boolToUint8($.int(x, 32) === $.int(y, 32)))
+}
+
+export function LessOrEq(x: number, y: number): number {
+  return $.int(boolToUint8(x <= y))
+}
+
+function boolToUint8(b: boolean): number {
+  return b ? 1 : 0
+}

package/gs/crypto/internal/fips140deps/byteorder/index.ts

@@ -0,0 +1 @@
+export * from '@goscript/internal/byteorder/index.js'

package/gs/crypto/internal/fips140deps/godebug/index.ts

@@ -0,0 +1 @@
+export { New, Setting, Value } from '@goscript/internal/godebug/index.js'