ox 1.1.0 → 1.2.0

package/src/wasm/_test/Secp256k1.test.ts

@@ -0,0 +1,354 @@
+import { secp256k1 } from '@noble/curves/secp256k1.js'
+import { describe, expect, test } from 'vp/test'
+import * as Secp256k1 from '../Secp256k1.js'
+import * as secp256k1_internal from '../internal/secp256k1.js'
+
+const privateKey = fromHex(
+  'ac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80',
+)
+const privateKeyB = fromHex(
+  '59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d',
+)
+const curveOrder = BigInt(
+  '0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141',
+)
+
+describe('engine', () => {
+  test('behavior: exposes only deterministic primitives', async () => {
+    const engine = await Secp256k1.engine()
+
+    expect(Object.keys(engine).sort()).toMatchInlineSnapshot(`
+      [
+        "getPublicKey",
+        "getSharedSecret",
+        "recoverPublicKey",
+        "sign",
+        "verify",
+      ]
+    `)
+  })
+
+  test('behavior: matches public keys and compressed shared points', async () => {
+    const engine = await Secp256k1.engine()
+    const publicKey = secp256k1.getPublicKey(privateKey, false)
+    const publicKeyB = secp256k1.getPublicKey(privateKeyB, false)
+    const compressedPublicKeyB = secp256k1.getPublicKey(privateKeyB, true)
+    const expected = secp256k1.getSharedSecret(privateKey, publicKeyB, true)
+
+    expect(engine.getPublicKey(privateKey)).toEqual(publicKey)
+    expect(engine.getSharedSecret(privateKey, publicKeyB)).toEqual(expected)
+    expect(engine.getSharedSecret(privateKey, compressedPublicKeyB)).toEqual(
+      expected,
+    )
+    expect(engine.getSharedSecret(privateKeyB, publicKey)).toEqual(expected)
+    expect(expected).toHaveLength(33)
+  })
+
+  test('behavior: matches signing across payload and entropy boundaries', async () => {
+    const engine = await Secp256k1.engine()
+    const publicKey = secp256k1.getPublicKey(privateKey, false)
+
+    for (const size of [0, 1, 31, 32, 33, 63, 64, 65, 127, 1024, 8192])
+      for (const prehash of [false, true])
+        for (const extraEntropy of [
+          false,
+          new Uint8Array(),
+          Uint8Array.of(1),
+          new Uint8Array(32).fill(7),
+          new Uint8Array(100).fill(9),
+        ] as const) {
+          const payload = bytes(size)
+          const signature = engine.sign(payload, privateKey, {
+            extraEntropy,
+            prehash,
+          })
+          const expected = secp256k1.sign(payload, privateKey, {
+            extraEntropy,
+            format: 'recovered',
+            lowS: true,
+            prehash,
+          })
+
+          expect(signature).toEqual(expected)
+          expect(
+            engine.verify(signature.slice(1), payload, publicKey, { prehash }),
+          ).toBe(true)
+          expect(signature[0]).toBeOneOf([0, 1])
+        }
+  })
+
+  test('behavior: generates host entropy for hedged signing', async () => {
+    const engine = await Secp256k1.engine()
+    const payload = bytes(32)
+    const publicKey = engine.getPublicKey(privateKey)
+    const signatureA = engine.sign(payload, privateKey, {
+      extraEntropy: true,
+      prehash: false,
+    })
+    const signatureB = engine.sign(payload, privateKey, {
+      extraEntropy: true,
+      prehash: false,
+    })
+
+    expect(signatureA).not.toEqual(signatureB)
+    expect(
+      engine.verify(signatureA.slice(1), payload, publicKey, {
+        prehash: false,
+      }),
+    ).toBe(true)
+    expect(
+      engine.verify(signatureB.slice(1), payload, publicKey, {
+        prehash: false,
+      }),
+    ).toBe(true)
+  })
+
+  test('behavior: recovers the public key with both parities', async () => {
+    const engine = await Secp256k1.engine()
+    const publicKey = engine.getPublicKey(privateKey)
+    const signatures = new Map<
+      number,
+      { payload: Uint8Array; signature: Uint8Array }
+    >()
+
+    for (let index = 0; signatures.size < 2; index++) {
+      const payload = bytes(32, index)
+      const signature = engine.sign(payload, privateKey, {
+        extraEntropy: false,
+        prehash: false,
+      })
+      signatures.set(signature[0]!, { payload, signature })
+      if (index > 100)
+        throw new Error('could not produce both recovery parities')
+    }
+
+    for (const { payload, signature } of signatures.values())
+      expect(engine.recoverPublicKey(signature, payload)).toEqual(publicKey)
+  })
+
+  test('behavior: rejects high-S signatures', async () => {
+    const engine = await Secp256k1.engine()
+    const payload = bytes(32)
+    const publicKey = engine.getPublicKey(privateKey)
+    const signature = engine
+      .sign(payload, privateKey, {
+        extraEntropy: false,
+        prehash: false,
+      })
+      .slice(1)
+    const highS = signature.slice()
+    highS.set(toBytes(curveOrder - toBigInt(signature.slice(32))), 32)
+
+    expect(
+      engine.verify(signature, payload, publicKey, { prehash: false }),
+    ).toBe(true)
+    expect(engine.verify(highS, payload, publicKey, { prehash: false })).toBe(
+      false,
+    )
+  })
+
+  test('behavior: matches large payload boundaries', async () => {
+    const engine = await Secp256k1.engine()
+    const payload = bytes(8193)
+    const publicKey = engine.getPublicKey(privateKey)
+    const truncatedSignature = secp256k1.sign(
+      payload.slice(0, 32),
+      privateKey,
+      {
+        extraEntropy: false,
+        format: 'compact',
+        lowS: true,
+        prehash: false,
+      },
+    )
+
+    expect(() =>
+      engine.sign(payload, privateKey, {
+        extraEntropy: false,
+        prehash: false,
+      }),
+    ).toThrowError(
+      'Secp256k1 unhashed payload must not exceed 8192 bytes, got 8193',
+    )
+    expect(
+      engine.verify(new Uint8Array(64), payload, publicKey, {
+        prehash: false,
+      }),
+    ).toBe(false)
+    expect(
+      secp256k1.verify(truncatedSignature, payload, publicKey, {
+        lowS: true,
+        prehash: false,
+      }),
+    ).toBe(false)
+    expect(
+      engine.verify(truncatedSignature, payload, publicKey, { prehash: false }),
+    ).toBe(false)
+    expect(() =>
+      engine.recoverPublicKey(new Uint8Array(65), payload),
+    ).toThrowError(
+      'Secp256k1 unhashed payload must not exceed 8192 bytes, got 8193',
+    )
+
+    const signature = engine.sign(payload, privateKey, {
+      extraEntropy: false,
+      prehash: true,
+    })
+    expect(
+      engine.verify(signature.slice(1), payload, publicKey, { prehash: true }),
+    ).toBe(true)
+  })
+
+  test('behavior: rejects malformed keys and recovered signatures', async () => {
+    const engine = await Secp256k1.engine()
+    const publicKey = engine.getPublicKey(privateKey)
+    const payload = bytes(32)
+
+    for (const size of [0, 1, 31, 33, 64, 65]) {
+      if (size !== 32) {
+        expect(() => engine.getPublicKey(new Uint8Array(size))).toThrowError(
+          `Secp256k1 private key must be 32 bytes, got ${size}`,
+        )
+        expect(() =>
+          engine.sign(payload, new Uint8Array(size), {
+            extraEntropy: false,
+            prehash: false,
+          }),
+        ).toThrowError(`Secp256k1 private key must be 32 bytes, got ${size}`)
+      }
+      if (size !== 64)
+        expect(() =>
+          engine.verify(new Uint8Array(size), payload, publicKey, {
+            prehash: false,
+          }),
+        ).toThrowError(`Secp256k1 signature must be 64 bytes, got ${size}`)
+      if (size !== 65)
+        expect(() =>
+          engine.recoverPublicKey(new Uint8Array(size), payload),
+        ).toThrowError(`Secp256k1 signature must be 65 bytes, got ${size}`)
+    }
+
+    for (const size of [0, 1, 32, 34, 64, 66])
+      expect(() =>
+        engine.getSharedSecret(privateKey, new Uint8Array(size)),
+      ).toThrowError(`Secp256k1 public key must be 33 or 65 bytes, got ${size}`)
+
+    const invalidPrivateKeys = [
+      new Uint8Array(32),
+      toBytes(curveOrder),
+      toBytes(curveOrder + 1n),
+    ]
+    for (const value of invalidPrivateKeys) {
+      expect(() => engine.getPublicKey(value)).toThrow(
+        Secp256k1.InvalidInputError,
+      )
+      expect(() => engine.getSharedSecret(value, publicKey)).toThrow(
+        Secp256k1.InvalidInputError,
+      )
+      expect(() =>
+        engine.sign(payload, value, {
+          extraEntropy: false,
+          prehash: false,
+        }),
+      ).toThrow(Secp256k1.InvalidInputError)
+    }
+
+    for (const publicKeySize of [33, 65]) {
+      const invalidPublicKey = new Uint8Array(publicKeySize)
+      expect(() =>
+        engine.getSharedSecret(privateKey, invalidPublicKey),
+      ).toThrow(Secp256k1.InvalidInputError)
+      expect(
+        engine.verify(new Uint8Array(64), payload, invalidPublicKey, {
+          prehash: false,
+        }),
+      ).toBe(false)
+    }
+
+    const invalidRecovery = new Uint8Array(65)
+    invalidRecovery[0] = 2
+    expect(() => engine.recoverPublicKey(invalidRecovery, payload)).toThrow(
+      Secp256k1.InvalidInputError,
+    )
+    expect(() => engine.recoverPublicKey(new Uint8Array(65), payload)).toThrow(
+      Secp256k1.InvalidInputError,
+    )
+    expect(
+      engine.verify(new Uint8Array(64), payload, publicKey, {
+        prehash: false,
+      }),
+    ).toBe(false)
+  })
+
+  test('behavior: preserves subviews, input ownership, and output ownership', async () => {
+    const engine = await Secp256k1.engine()
+    const key = offsetView(privateKey)
+    const payload = offsetView(bytes(257))
+    const publicKey = offsetView(engine.getPublicKey(key))
+    const before = {
+      key: key.slice(),
+      payload: payload.slice(),
+      publicKey: publicKey.slice(),
+    }
+    const signature = engine.sign(payload, key, {
+      extraEntropy: false,
+      prehash: false,
+    })
+    const outputs = [
+      engine.getPublicKey(key),
+      engine.getSharedSecret(key, publicKey),
+      signature,
+      engine.recoverPublicKey(signature, payload),
+    ]
+    const snapshots = outputs.map((output) => output.slice())
+
+    engine.sign(new Uint8Array(1024 * 1024), key, {
+      extraEntropy: false,
+      prehash: true,
+    })
+
+    expect(outputs).toEqual(snapshots)
+    expect({ key, payload, publicKey }).toEqual(before)
+  })
+
+  test('behavior: clears the shared staging region', async () => {
+    const engine = await Secp256k1.engine()
+    const payload = new Uint8Array(1024).fill(0xa5)
+    const entropy = new Uint8Array(17).fill(0x5a)
+    engine.sign(payload, privateKey, {
+      extraEntropy: entropy,
+      prehash: false,
+    })
+
+    const module = await secp256k1_internal.load()
+    const size = payload.length + 32 + entropy.length + 65
+    expect(
+      module
+        .view()
+        .subarray(module.heapBase, module.heapBase + size)
+        .every((byte) => byte === 0),
+    ).toBe(true)
+  })
+})
+
+function bytes(length: number, offset = length): Uint8Array {
+  return Uint8Array.from({ length }, (_, index) => (index * 29 + offset) % 251)
+}
+
+function fromHex(value: string): Uint8Array {
+  return Uint8Array.from(Buffer.from(value, 'hex'))
+}
+
+function offsetView(value: Uint8Array): Uint8Array {
+  const bytes = new Uint8Array(value.length + 4).fill(0xff)
+  bytes.set(value, 2)
+  return bytes.subarray(2, -2)
+}
+
+function toBigInt(value: Uint8Array): bigint {
+  return BigInt(`0x${Buffer.from(value).toString('hex')}`)
+}
+
+function toBytes(value: bigint): Uint8Array {
+  return fromHex(value.toString(16).padStart(64, '0'))
+}

package/src/wasm/_test/X25519.test-d.ts

@@ -0,0 +1,21 @@
+import { expectTypeOf, test } from 'vp/test'
+import type * as Engine from '../../core/Engine.js'
+import * as core_X25519 from '../../core/X25519.js'
+import * as X25519 from '../X25519.js'
+
+type Slot = Awaited<ReturnType<typeof X25519.engine>>
+
+test('return type exposes only implemented X25519 primitives', () => {
+  expectTypeOf<Slot['getPublicKey']>().toEqualTypeOf<
+    NonNullable<Engine.Ecdh['getPublicKey']>
+  >()
+  expectTypeOf<Slot['getSharedSecret']>().toEqualTypeOf<
+    NonNullable<Engine.Ecdh['getSharedSecret']>
+  >()
+  expectTypeOf<Slot>().not.toHaveProperty('randomSecretKey')
+})
+
+test('the WASM namespace exposes the public X25519 API', () => {
+  expectTypeOf(X25519.getPublicKey).toEqualTypeOf(core_X25519.getPublicKey)
+  expectTypeOf<typeof X25519>().not.toHaveProperty('create')
+})

package/src/wasm/_test/X25519.test.ts

@@ -0,0 +1,194 @@
+import * as fs from 'node:fs'
+import { x25519 } from '@noble/curves/ed25519.js'
+import { describe, expect, test } from 'vp/test'
+import * as X25519 from '../X25519.js'
+import * as crypto25519 from '../internal/crypto25519.js'
+import { wasmBase64 } from '../internal/crypto25519.wasm.js'
+import * as internal from '../internal/instantiate.js'
+import * as x25519_internal from '../internal/x25519.js'
+import { x25519LowOrder } from './fixtures.js'
+
+const alicePrivateKey = fromHex(
+  '77076d0a7318a57d3c16c17251b26645df4c2f87ebc0992ab177fba51db92c2a',
+)
+const bobPrivateKey = fromHex(
+  '5dab087e624a8a4b79e17f8b83800ee66f3bb1292618b6fd1c2f8b27ff88e0eb',
+)
+
+describe('engine', () => {
+  test('vectors: matches RFC 7748 key agreement', async () => {
+    const engine = await X25519.engine()
+    const alicePublicKey = engine.getPublicKey(alicePrivateKey)
+    const bobPublicKey = engine.getPublicKey(bobPrivateKey)
+
+    expect(toHex(alicePublicKey)).toMatchInlineSnapshot(
+      `"8520f0098930a754748b7ddcb43ef75a0dbf3a0d26381af4eba4a98eaa9b4e6a"`,
+    )
+    expect(toHex(bobPublicKey)).toMatchInlineSnapshot(
+      `"de9edb7d7b7dc1b4d35b61c2ece435373f8343c85b78674dadfc7e146f882b4f"`,
+    )
+    expect(
+      toHex(engine.getSharedSecret(alicePrivateKey, bobPublicKey)),
+    ).toMatchInlineSnapshot(
+      `"4a5d9d5ba4ce2de1728e3bf480350f25e07e21c947d19e3376f09b3c1e161742"`,
+    )
+  })
+
+  test('vectors: matches RFC 7748 arbitrary-point cases', async () => {
+    const engine = await X25519.engine()
+    const vectors = [
+      [
+        'a546e36bf0527c9d3b16154b82465edd62144c0ac1fc5a18506a2244ba449ac4',
+        'e6db6867583030db3594c1a424b15f7c726624ec26b3353b10a903a6d0ab1c4c',
+        'c3da55379de9c6908e94ea4df28d084f32eccf03491c71f754b4075577a28552',
+      ],
+      [
+        '4b66e9d4d1b4673c5ad22691957d6af5c11b6421e0ea01d42ca4169e7918ba0d',
+        'e5210f12786811d3f4b7959d0538ae2c31dbe7106fc03c3efc4cd549c715a493',
+        '95cbde9476e8907d7aade45cb4b873f88b595a68799fa152e6f8f7647aac7957',
+      ],
+    ] as const
+
+    for (const [privateKey, publicKey, expected] of vectors)
+      expect(
+        toHex(engine.getSharedSecret(fromHex(privateKey), fromHex(publicKey))),
+      ).toBe(expected)
+  })
+
+  test('vectors: matches RFC 7748 iterated cases', async () => {
+    const engine = await X25519.engine()
+    let privateKey = Uint8Array.of(9, ...new Uint8Array(31))
+    let publicKey = privateKey
+    const expected = new Map([
+      [1, '422c8e7a6227d7bca1350b3e2bb7279f7897b87bb6854b783c60e80311ae3079'],
+      [
+        1000,
+        '684cf59ba83309552800ef566f2f4d3c1c3887c49360e3875f2eb94d99532c51',
+      ],
+    ])
+
+    for (let iteration = 1; iteration <= 1000; iteration++) {
+      const previousPrivateKey = privateKey
+      privateKey = engine.getSharedSecret(privateKey, publicKey)
+      publicKey = previousPrivateKey
+      if (expected.has(iteration))
+        expect(toHex(privateKey), `iteration ${iteration}`).toBe(
+          expected.get(iteration),
+        )
+    }
+  })
+
+  test('behavior: accepts masked and noncanonical u-coordinates', async () => {
+    const engine = await X25519.engine()
+    const publicKey = x25519.getPublicKey(bobPrivateKey)
+    const masked = publicKey.slice()
+    masked[31]! |= 0x80
+    const noncanonicalBasePoint = fromHex(`f6${'ff'.repeat(30)}7f`)
+
+    expect(engine.getSharedSecret(alicePrivateKey, masked)).toEqual(
+      engine.getSharedSecret(alicePrivateKey, publicKey),
+    )
+    expect(
+      engine.getSharedSecret(alicePrivateKey, noncanonicalBasePoint),
+    ).toEqual(engine.getPublicKey(alicePrivateKey))
+  })
+
+  test('behavior: rejects low-order and malformed public keys', async () => {
+    const engine = await X25519.engine()
+
+    expect(x25519LowOrder).toEqual(
+      JSON.parse(
+        fs.readFileSync(
+          new URL(
+            '../../../test/vectors/x25519/low-order.json',
+            import.meta.url,
+          ),
+          'utf8',
+        ),
+      ),
+    )
+    expect(x25519LowOrder).toHaveLength(7)
+    for (const vector of x25519LowOrder) {
+      const publicKey = fromHex(vector.publicKey)
+      const highBitAlias = publicKey.slice()
+      highBitAlias[31]! |= 0x80
+      for (const value of [publicKey, highBitAlias])
+        expect(() =>
+          engine.getSharedSecret(alicePrivateKey, value),
+        ).toThrowError(`invalid private or public key received`)
+    }
+
+    for (const size of [0, 1, 31, 33, 64]) {
+      expect(() => engine.getPublicKey(new Uint8Array(size))).toThrowError(
+        `X25519 private key must be 32 bytes, got ${size}`,
+      )
+      expect(() =>
+        engine.getSharedSecret(alicePrivateKey, new Uint8Array(size)),
+      ).toThrowError(`X25519 public key must be 32 bytes, got ${size}`)
+    }
+  })
+
+  test('behavior: respects subviews, ownership, and cleanup', async () => {
+    const engine = await X25519.engine()
+    const privateKey = offsetView(alicePrivateKey)
+    const publicKey = offsetView(x25519.getPublicKey(bobPrivateKey))
+    const before = {
+      privateKey: privateKey.slice(),
+      publicKey: publicKey.slice(),
+    }
+    const sharedSecret = engine.getSharedSecret(privateKey, publicKey)
+    const snapshot = sharedSecret.slice()
+
+    engine.getPublicKey(new Uint8Array(32).fill(0xa5))
+    expect(sharedSecret).toEqual(snapshot)
+    expect({ privateKey, publicKey }).toEqual(before)
+
+    const module = await crypto25519.load()
+    expect(
+      module
+        .view()
+        .subarray(module.heapBase, module.heapBase + 96)
+        .every((byte) => byte === 0),
+    ).toBe(true)
+  })
+
+  test('behavior: clears both keys and the shared secret after a late trap', async () => {
+    const module = await internal.instantiate<crypto25519.Exports>(wasmBase64)
+    const publicKey = x25519.getPublicKey(bobPrivateKey)
+    const exports: crypto25519.Exports = {
+      ...module.exports,
+      x25519_get_shared_secret(...parameters) {
+        module.exports.x25519_get_shared_secret(...parameters)
+        throw new WebAssembly.RuntimeError('forced late trap')
+      },
+    }
+
+    expect(() =>
+      x25519_internal.getSharedSecret(
+        { ...module, exports },
+        alicePrivateKey,
+        publicKey,
+      ),
+    ).toThrow(WebAssembly.RuntimeError)
+    expect(
+      module
+        .view()
+        .subarray(module.heapBase, module.heapBase + 96)
+        .every((byte) => byte === 0),
+    ).toBe(true)
+  })
+})
+
+function fromHex(value: string): Uint8Array {
+  return Uint8Array.from(Buffer.from(value, 'hex'))
+}
+
+function offsetView(value: Uint8Array): Uint8Array {
+  const bytes = new Uint8Array(value.length + 4).fill(0xff)
+  bytes.set(value, 2)
+  return bytes.subarray(2, -2)
+}
+
+function toHex(value: Uint8Array): string {
+  return Buffer.from(value).toString('hex')
+}

package/src/wasm/_test/fixtures.ts

@@ -0,0 +1,4 @@
+import { lowOrder } from '../../../test/vectors/x25519/index.js'
+
+/** Complete libsodium X25519 low-order corpus. */
+export const x25519LowOrder = lowOrder