goscript 0.1.1 → 0.1.2

package/gs/crypto/ed25519/index.ts

@@ -0,0 +1,238 @@
+import * as $ from '@goscript/builtin/index.js'
+import * as io from '@goscript/io/index.js'
+
+export type PublicKey = $.Bytes
+export type PrivateKey = $.Bytes
+type Hash = number
+type PublicKeyInterface = any
+type PrivateKeyInterface = any
+type SignerOpts = { HashFunc(): Hash }
+
+export const PublicKeySize = 32
+export const PrivateKeySize = 64
+export const SignatureSize = 64
+export const SeedSize = 32
+
+const pkcs8Prefix = new Uint8Array([
+  0x30, 0x2e, 0x02, 0x01, 0x00, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70,
+  0x04, 0x22, 0x04, 0x20,
+])
+
+export class Options {
+  public Hash: Hash = 0
+  public Context = ''
+
+  constructor(init?: Partial<{ Hash: Hash; Context: string }>) {
+    this.Hash = init?.Hash ?? 0
+    this.Context = init?.Context ?? ''
+  }
+
+  public HashFunc(): Hash {
+    return this.Hash
+  }
+}
+
+export function PublicKey_Equal(pub: PublicKey, x: PublicKeyInterface | null): boolean {
+  const [xx, ok] = $.typeAssertTuple<PublicKey>(x, 'ed25519.PublicKey')
+  return ok && bytesEqual(pub, xx)
+}
+
+export function PrivateKey_Public(priv: PrivateKey): PublicKeyInterface | null {
+  const publicKey = new Uint8Array(PublicKeySize)
+  publicKey.set($.bytesToUint8Array(priv).subarray(SeedSize, PrivateKeySize))
+  return $.namedValueInterfaceValue<PublicKeyInterface | null>(
+    publicKey,
+    'ed25519.PublicKey',
+    { Equal: PublicKey_Equal },
+  )
+}
+
+export function PrivateKey_Equal(priv: PrivateKey, x: PrivateKeyInterface | null): boolean {
+  const [xx, ok] = $.typeAssertTuple<PrivateKey>(x, 'ed25519.PrivateKey')
+  return ok && bytesEqual(priv, xx)
+}
+
+export function PrivateKey_Seed(priv: PrivateKey): $.Bytes {
+  return new Uint8Array($.bytesToUint8Array(priv).subarray(0, SeedSize))
+}
+
+export async function PrivateKey_Sign(
+  priv: PrivateKey,
+  _rand: io.Reader | null,
+  message: $.Bytes,
+  opts: SignerOpts | null,
+): Promise<[$.Bytes, $.GoError]> {
+  if (opts != null && opts.HashFunc() !== 0) {
+    return [null, new Ed25519Error('ed25519: expected opts.HashFunc() zero')]
+  }
+  return [await Sign(priv, message), null]
+}
+
+export async function GenerateKey(random: io.Reader | null): Promise<[PublicKey, PrivateKey, $.GoError]> {
+  const seed = new Uint8Array(SeedSize)
+  if (random == null) {
+    const subtle = subtleCrypto()
+    if (subtle == null) {
+      return [
+        null as PublicKey,
+        null as PrivateKey,
+        new Ed25519Error('crypto/ed25519: WebCrypto is unavailable'),
+      ]
+    }
+    globalThis.crypto.getRandomValues(seed)
+  } else {
+    const [, err] = await io.ReadFull(random, seed)
+    if (err != null) {
+      return [null as PublicKey, null as PrivateKey, err]
+    }
+  }
+
+  const privateKey = await NewKeyFromSeed(seed)
+  return [
+    $.mustTypeAssert<PublicKey>(
+      PrivateKey_Public(privateKey),
+      'ed25519.PublicKey',
+    ),
+    privateKey,
+    null,
+  ]
+}
+
+export async function NewKeyFromSeed(seed: $.Bytes): Promise<PrivateKey> {
+  const seedBytes = $.bytesToUint8Array(seed)
+  if (seedBytes.length !== SeedSize) {
+    throw new Error(`ed25519: bad seed length: ${seedBytes.length}`)
+  }
+
+  const subtle = requireSubtle()
+  const key = await subtle.importKey(
+    'pkcs8',
+    pkcs8FromSeed(seedBytes) as unknown as BufferSource,
+    { name: 'Ed25519' },
+    true,
+    ['sign'],
+  )
+  const jwk = await subtle.exportKey('jwk', key)
+  if (typeof jwk.x !== 'string') {
+    throw new Error('crypto/ed25519: imported key did not expose public key')
+  }
+
+  const publicKey = base64URLDecode(jwk.x)
+  const privateKey = new Uint8Array(PrivateKeySize)
+  privateKey.set(seedBytes, 0)
+  privateKey.set(publicKey, SeedSize)
+  return privateKey
+}
+
+export async function Sign(privateKey: PrivateKey, message: $.Bytes): Promise<$.Bytes> {
+  const priv = $.bytesToUint8Array(privateKey)
+  if (priv.length !== PrivateKeySize) {
+    throw new Error(`ed25519: bad private key length: ${priv.length}`)
+  }
+
+  const key = await requireSubtle().importKey(
+    'pkcs8',
+    pkcs8FromSeed(priv.subarray(0, SeedSize)) as unknown as BufferSource,
+    { name: 'Ed25519' },
+    false,
+    ['sign'],
+  )
+  const sig = await requireSubtle().sign(
+    'Ed25519',
+    key,
+    $.bytesToUint8Array(message) as unknown as BufferSource,
+  )
+  return new Uint8Array(sig)
+}
+
+export async function Verify(
+  publicKey: PublicKey,
+  message: $.Bytes,
+  sig: $.Bytes,
+): Promise<boolean> {
+  return (await VerifyWithOptions(publicKey, message, sig, new Options())) == null
+}
+
+export async function VerifyWithOptions(
+  publicKey: PublicKey,
+  message: $.Bytes,
+  sig: $.Bytes,
+  opts: Options | $.VarRef<Options> | null,
+): Promise<$.GoError> {
+  if ($.len(publicKey) !== PublicKeySize) {
+    throw new Error(`ed25519: bad public key length: ${$.len(publicKey)}`)
+  }
+  if ($.len(sig) !== SignatureSize) {
+    return new Ed25519Error('ed25519: bad signature length')
+  }
+
+  const options = $.pointerValueOrNil(opts)
+  if (options != null && (options.Hash !== 0 || options.Context !== '')) {
+    return new Ed25519Error('ed25519: only pure Ed25519 is supported')
+  }
+
+  const key = await requireSubtle().importKey(
+    'raw',
+    $.bytesToUint8Array(publicKey) as unknown as BufferSource,
+    { name: 'Ed25519' },
+    false,
+    ['verify'],
+  )
+  const ok = await requireSubtle().verify(
+    'Ed25519',
+    key,
+    $.bytesToUint8Array(sig) as unknown as BufferSource,
+    $.bytesToUint8Array(message) as unknown as BufferSource,
+  )
+  return ok ? null : new Ed25519Error('ed25519: invalid signature')
+}
+
+class Ed25519Error {
+  constructor(private readonly message: string) {}
+
+  Error(): string {
+    return this.message
+  }
+}
+
+function requireSubtle(): SubtleCrypto {
+  const subtle = subtleCrypto()
+  if (subtle == null) {
+    throw new Error('crypto/ed25519: WebCrypto Ed25519 is unavailable')
+  }
+  return subtle
+}
+
+function subtleCrypto(): SubtleCrypto | null {
+  const crypto = globalThis.crypto
+  if (crypto?.subtle && typeof crypto.subtle.importKey === 'function') {
+    return crypto.subtle
+  }
+  return null
+}
+
+function pkcs8FromSeed(seed: Uint8Array): Uint8Array {
+  const out = new Uint8Array(pkcs8Prefix.length + SeedSize)
+  out.set(pkcs8Prefix)
+  out.set(seed, pkcs8Prefix.length)
+  return out
+}
+
+function bytesEqual(a: $.Bytes, b: $.Bytes): boolean {
+  const aa = $.bytesToUint8Array(a)
+  const bb = $.bytesToUint8Array(b)
+  if (aa.length !== bb.length) {
+    return false
+  }
+  let diff = 0
+  for (let i = 0; i < aa.length; i++) {
+    diff |= aa[i] ^ bb[i]
+  }
+  return diff === 0
+}
+
+function base64URLDecode(value: string): Uint8Array {
+  const normalized = value.replace(/-/g, '+').replace(/_/g, '/')
+  const padded = normalized.padEnd(Math.ceil(normalized.length / 4) * 4, '=')
+  return Uint8Array.from(atob(padded), (c) => c.charCodeAt(0))
+}

package/gs/crypto/ed25519/meta.json

@@ -0,0 +1,13 @@
+{
+  "dependencies": [
+    "io"
+  ],
+  "asyncFunctions": {
+    "GenerateKey": true,
+    "NewKeyFromSeed": true,
+    "Sign": true,
+    "Verify": true,
+    "VerifyWithOptions": true,
+    "PrivateKey_Sign": true
+  }
+}

package/gs/crypto/internal/constanttime/index.test.ts

@@ -0,0 +1,25 @@
+import { describe, expect, test } from 'vitest'
+
+import { ByteEq, Eq, LessOrEq, Select } from './index.js'
+
+describe('crypto/internal/constanttime override', () => {
+  test('selects on any non-zero selector', () => {
+    expect(Select(0, 11, 22)).toBe(22)
+    expect(Select(1, 11, 22)).toBe(11)
+    expect(Select(7, 11, 22)).toBe(11)
+  })
+
+  test('compares bytes and int32 values', () => {
+    expect(ByteEq(0xff, 0xff)).toBe(1)
+    expect(ByteEq(0x1ff, 0xff)).toBe(1)
+    expect(ByteEq(0x01, 0x02)).toBe(0)
+    expect(Eq(12, 12)).toBe(1)
+    expect(Eq(12, 13)).toBe(0)
+  })
+
+  test('compares integer ordering', () => {
+    expect(LessOrEq(1, 1)).toBe(1)
+    expect(LessOrEq(1, 2)).toBe(1)
+    expect(LessOrEq(2, 1)).toBe(0)
+  })
+})

package/gs/crypto/internal/constanttime/index.ts

@@ -0,0 +1,22 @@
+import * as $ from '@goscript/builtin/index.js'
+
+export function Select(v: number, x: number, y: number): number {
+  v = boolToUint8(v !== 0)
+  return (~(v - 1) & x) | ((v - 1) & y)
+}
+
+export function ByteEq(x: number, y: number): number {
+  return $.int(boolToUint8($.uint(x, 8) === $.uint(y, 8)))
+}
+
+export function Eq(x: number, y: number): number {
+  return $.int(boolToUint8($.int(x, 32) === $.int(y, 32)))
+}
+
+export function LessOrEq(x: number, y: number): number {
+  return $.int(boolToUint8(x <= y))
+}
+
+function boolToUint8(b: boolean): number {
+  return b ? 1 : 0
+}

package/gs/crypto/rand/index.test.ts

@@ -2,7 +2,58 @@ import { describe, expect, it } from 'vitest'
 
 import * as $ from '@goscript/builtin/index.js'
 
-import { Read, Reader, Text } from './index.js'
+import { Int, Prime, Read, Reader, Text } from './index.js'
+
+class TestInt {
+  private value = 0
+
+  constructor(value = 0) {
+    this.value = value
+  }
+
+  Sign(): number {
+    return Math.sign(this.value)
+  }
+
+  BitLen(): number {
+    return this.value.toString(2).length
+  }
+
+  SetBytes(bytes: Uint8Array): TestInt {
+    this.value = 0
+    for (const b of bytes) {
+      this.value = this.value * 256 + b
+    }
+    return this
+  }
+
+  Cmp(other: TestInt): number {
+    return Math.sign(this.value - other.value)
+  }
+
+  Value(): number {
+    return this.value
+  }
+
+  ProbablyPrime(): boolean {
+    if (this.value < 2) {
+      return false
+    }
+    for (let i = 2; i * i <= this.value; i++) {
+      if (this.value % i === 0) {
+        return false
+      }
+    }
+    return true
+  }
+}
+
+TestInt.__typeInfo = $.registerStructType(
+  'big.Int',
+  () => new TestInt(),
+  [],
+  TestInt,
+)
 
 describe('crypto/rand override', () => {
   it('fills byte slices from Web Crypto', () => {
@@ -29,4 +80,41 @@ describe('crypto/rand override', () => {
     expect(token).toHaveLength(26)
     expect(token).toMatch(/^[A-Z2-7]+$/)
   })
+
+  it('generates integers below max from an io.Reader', () => {
+    const reader = {
+      Read(dst: Uint8Array): [number, $.GoError] {
+        dst[0] = 42
+        return [dst.length, null]
+      },
+    }
+
+    const [n, err] = Int(reader, new TestInt(100))
+
+    expect(err).toBeNull()
+    expect(n.Value()).toBe(42)
+  })
+
+  it('generates probable primes with the requested bit length', async () => {
+    const reader = {
+      Read(dst: Uint8Array): [number, $.GoError] {
+        dst.fill(0)
+        return [dst.length, null]
+      },
+    }
+
+    const [prime, err] = await Prime(reader, 8)
+
+    expect(err).toBeNull()
+    expect(prime.Value()).toBe(193)
+    expect(prime.BitLen()).toBe(8)
+    expect(prime.ProbablyPrime()).toBe(true)
+  })
+
+  it('rejects prime sizes below two bits', async () => {
+    const [prime, err] = await Prime(Reader, 1)
+
+    expect(prime).toBeNull()
+    expect(err?.Error()).toBe('crypto/rand: prime size must be at least 2-bit')
+  })
 })

package/gs/crypto/rand/index.ts

@@ -35,6 +35,75 @@ export function Read(b: $.Bytes): [number, $.GoError] {
   return [n, null]
 }
 
+export function Int(rand: io.Reader | null, max: any): [any, $.GoError] {
+  if (max == null || typeof max.Sign !== 'function' || max.Sign() <= 0) {
+    return [null, new RandError('crypto/rand: argument to Int is <= 0')]
+  }
+
+  const bitLen = max.BitLen()
+  const byteLen = Math.ceil(bitLen / 8)
+  const excessBits = byteLen * 8 - bitLen
+  const reader = rand ?? Reader
+
+  while (true) {
+    const bytes = new Uint8Array(byteLen)
+    const [n, err] = reader.Read(bytes)
+    if (err != null) {
+      return [null, err]
+    }
+    if (n !== byteLen) {
+      return [null, io.ErrUnexpectedEOF]
+    }
+    if (excessBits > 0) {
+      bytes[0] &= 0xff >>> excessBits
+    }
+
+    const candidate = new max.constructor()
+    candidate.SetBytes(bytes)
+    if (candidate.Cmp(max) < 0) {
+      return [candidate, null]
+    }
+  }
+}
+
+export async function Prime(
+  rand: io.Reader | null,
+  bits: number,
+): Promise<[any, $.GoError]> {
+  if (bits < 2) {
+    return [null, new RandError('crypto/rand: prime size must be at least 2-bit')]
+  }
+
+  const bitOffset = bits % 8
+  const topBits = bitOffset === 0 ? 8 : bitOffset
+  const bytes = new Uint8Array(Math.ceil(bits / 8))
+  const reader = rand ?? Reader
+
+  while (true) {
+    const err = readFull(reader, bytes)
+    if (err != null) {
+      return [null, err]
+    }
+
+    bytes[0] &= (1 << topBits) - 1
+    if (topBits >= 2) {
+      bytes[0] |= 3 << (topBits - 2)
+    } else {
+      bytes[0] |= 1
+      if (bytes.length > 1) {
+        bytes[1] |= 0x80
+      }
+    }
+    bytes[bytes.length - 1] |= 1
+
+    const candidate = newBigInt()
+    candidate.SetBytes(bytes)
+    if (await candidate.ProbablyPrime(20)) {
+      return [candidate, null]
+    }
+  }
+}
+
 export function Text(): string {
   const src = new Uint8Array(26)
   const [, err] = Read(src)
@@ -49,6 +118,37 @@ export function Text(): string {
   return out
 }
 
+function newBigInt(): any {
+  const info = $.getTypeByName('big.Int') as
+    | { zeroValue?: unknown; ctor?: new () => unknown }
+    | undefined
+  if (info?.zeroValue !== undefined) {
+    return typeof info.zeroValue === 'function'
+      ? (info.zeroValue as () => unknown)()
+      : info.zeroValue
+  }
+  if (info?.ctor != null) {
+    return new info.ctor()
+  }
+  throw new Error('crypto/rand: math/big.Int type is not registered')
+}
+
+function readFull(reader: io.Reader, dst: Uint8Array): $.GoError {
+  let offset = 0
+  while (offset < dst.length) {
+    const chunk = dst.subarray(offset)
+    const [n, err] = reader.Read(chunk)
+    if (err != null) {
+      return err
+    }
+    if (n <= 0) {
+      return io.ErrUnexpectedEOF
+    }
+    offset += n
+  }
+  return null
+}
+
 function fillSecureBytes(dst: $.Bytes): $.GoError {
   const length = $.len(dst)
   if (length === 0) {
@@ -57,7 +157,9 @@ function fillSecureBytes(dst: $.Bytes): $.GoError {
 
   const crypto = secureCrypto()
   if (crypto == null) {
-    return new RandError('crypto/rand: Web Crypto getRandomValues is unavailable')
+    return new RandError(
+      'crypto/rand: Web Crypto getRandomValues is unavailable',
+    )
   }
 
   if (dst instanceof Uint8Array) {

package/gs/crypto/rand/meta.json

@@ -1,5 +1,8 @@
 {
   "dependencies": [
     "io"
-  ]
+  ],
+  "asyncFunctions": {
+    "Prime": true
+  }
 }

package/gs/crypto/sha256/index.test.ts

@@ -0,0 +1,78 @@
+import { describe, expect, test } from 'vitest'
+import * as $ from '@goscript/builtin/index.js'
+
+import { New, New224, Size, Size224, Sum224, Sum256 } from './index.js'
+
+describe('crypto/sha256 override', () => {
+  test('sums with WebCrypto', async () => {
+    const sum = await Sum256($.stringToBytes('abc'))
+    expect(Array.from(sum)).toEqual([
+      186, 120, 22, 191, 143, 1, 207, 234, 65, 65, 64, 222, 93, 174, 34, 35,
+      176, 3, 97, 163, 150, 23, 122, 156, 180, 16, 255, 97, 242, 0, 21, 173,
+    ])
+  })
+
+  test('streaming digest appends to prefix', async () => {
+    const digest = New()
+    expect(digest.Write($.stringToBytes('a'))).toEqual([1, null])
+    expect(digest.Write($.stringToBytes('bc'))).toEqual([2, null])
+
+    const out = await digest.Sum(new Uint8Array([1, 2]))
+    expect(Array.from(out).slice(0, 2)).toEqual([1, 2])
+    expect(out.length).toBe(Size + 2)
+    expect(Array.from(out).slice(2)).toEqual(
+      Array.from(await Sum256($.stringToBytes('abc'))),
+    )
+  })
+
+  test('sums SHA-224 with host crypto', async () => {
+    const sum = await Sum224($.stringToBytes('abc'))
+    expect(Array.from(sum)).toEqual([
+      35, 9, 125, 34, 52, 5, 216, 34, 134, 66, 164, 119, 189, 162, 85, 179,
+      42, 173, 188, 228, 189, 160, 179, 247, 227, 108, 157, 167,
+    ])
+  })
+
+  test('streaming SHA-224 digest appends to prefix', async () => {
+    const digest = New224()
+    expect(digest.Write($.stringToBytes('a'))).toEqual([1, null])
+    expect(digest.Write($.stringToBytes('bc'))).toEqual([2, null])
+
+    const out = await digest.Sum(new Uint8Array([1, 2]))
+    expect(Array.from(out).slice(0, 2)).toEqual([1, 2])
+    expect(out.length).toBe(Size224 + 2)
+    expect(Array.from(out).slice(2)).toEqual(
+      Array.from(await Sum224($.stringToBytes('abc'))),
+    )
+  })
+
+  test('streaming Sum does not finalize the digest', async () => {
+    const digest = New()
+    expect(digest.Write($.stringToBytes('abc'))).toEqual([3, null])
+
+    const first = await digest.Sum(null)
+    expect(Array.from(first)).toEqual(
+      Array.from(await Sum256($.stringToBytes('abc'))),
+    )
+
+    expect(digest.Write($.stringToBytes('d'))).toEqual([1, null])
+    const second = await digest.Sum(null)
+    expect(Array.from(second)).toEqual(
+      Array.from(await Sum256($.stringToBytes('abcd'))),
+    )
+  })
+
+  test('streaming digest handles many small writes', async () => {
+    const digest = New()
+    let data = ''
+    for (let i = 0; i < 4096; i++) {
+      const part = `key-${i};`
+      data += part
+      expect(digest.Write($.stringToBytes(part))).toEqual([part.length, null])
+    }
+
+    expect(Array.from(await digest.Sum(null))).toEqual(
+      Array.from(await Sum256($.stringToBytes(data))),
+    )
+  })
+})