ox 1.1.2 → 1.2.0

package/src/wasm/_test/Keystore.test.ts

@@ -1,4 +1,5 @@
 import { pbkdf2 as pbkdf2_noble } from '@noble/hashes/pbkdf2.js'
+import { scrypt as scrypt_noble } from '@noble/hashes/scrypt.js'
 import { sha256 } from '@noble/hashes/sha2.js'
 import { beforeAll, describe, expect, test } from 'vp/test'
 import * as Bytes from '../../core/Bytes.js'
@@ -6,9 +7,11 @@ import * as Engine from '../../core/Engine.js'
 import * as Keystore from '../../core/Keystore.js'
 import * as WasmKeystore from '../Keystore.js'
 import * as hashes from '../internal/hashes.js'
-import { wasmBase64 } from '../internal/hashes.wasm.js'
+import { wasmBase64 as hashesWasmBase64 } from '../internal/hashes.wasm.js'
 import * as internal from '../internal/instantiate.js'
 import * as pbkdf2 from '../internal/pbkdf2.js'
+import * as scrypt from '../internal/scrypt.js'
+import { wasmBase64 as scryptWasmBase64 } from '../internal/scrypt.wasm.js'
 
 let engine: WasmKeystore.engine.ReturnType
 
@@ -25,6 +28,7 @@ describe('engine', () => {
     expect(Object.keys(await WasmKeystore.engine())).toMatchInlineSnapshot(`
       [
         "pbkdf2Sha256",
+        "scrypt",
       ]
     `)
   })
@@ -34,6 +38,11 @@ describe('engine', () => {
     expect(a).toBe(b)
   })
 
+  test('behavior: shares the compiled scrypt instance', async () => {
+    const [a, b] = await Promise.all([scrypt.load(), scrypt.load()])
+    expect(a).toBe(b)
+  })
+
   test('behavior: hands every caller its own engine', async () => {
     const [a, b] = await Promise.all([
       WasmKeystore.engine(),
@@ -105,7 +114,7 @@ describe('pbkdf2Sha256', () => {
   })
 
   test('behavior: clears passwords, salts, outputs, and scratch', async () => {
-    const module = await internal.instantiate<hashes.Exports>(wasmBase64)
+    const module = await internal.instantiate<hashes.Exports>(hashesWasmBase64)
     const password = input(65)
     const salt = input(52)
     const stack = module.view().slice(0, module.heapBase)
@@ -120,7 +129,7 @@ describe('pbkdf2Sha256', () => {
   })
 
   test('behavior: clears the complete region after a late trap', async () => {
-    const module = await internal.instantiate<hashes.Exports>(wasmBase64)
+    const module = await internal.instantiate<hashes.Exports>(hashesWasmBase64)
     const password = input(65)
     const salt = input(52)
     const exports: pbkdf2.Exports = {
@@ -143,7 +152,7 @@ describe('pbkdf2Sha256', () => {
   })
 
   test('behavior: rejects a workspace that overflows wasm32 before growing memory', async () => {
-    const module = await internal.instantiate<hashes.Exports>(wasmBase64)
+    const module = await internal.instantiate<hashes.Exports>(hashesWasmBase64)
     const memory = module.view().length
 
     expect(() =>
@@ -167,6 +176,236 @@ describe('pbkdf2Sha256', () => {
   })
 })
 
+const scryptCases = [
+  { N: 16, dkLen: 64, p: 1, password: 0, r: 1, salt: 0 },
+  { N: 1024, dkLen: 32, p: 1, password: 8, r: 1, salt: 16 },
+  { N: 1024, dkLen: 64, p: 1, password: 65, r: 8, salt: 52 },
+  { N: 1024, dkLen: 33, p: 2, password: 9, r: 4, salt: 17 },
+] as const
+
+describe('scrypt', () => {
+  test.each(scryptCases)(
+    'matches the default for password=$password salt=$salt N=$N r=$r p=$p dkLen=$dkLen',
+    ({ N, dkLen, p, password: passwordLength, r, salt: saltLength }) => {
+      const password = input(passwordLength)
+      const salt = input(saltLength)
+      const options = { N, dkLen, p, r }
+      expect(engine.scrypt(password, salt, options)).toEqual(
+        scrypt_noble(password, salt, options),
+      )
+    },
+  )
+
+  test.each([
+    {
+      N: 16,
+      expected:
+        '0x77d6576238657b203b19ca42c18a0497f16b4844e3074ae8dfdffa3fede21442fcd0069ded0948f8326a753a0fc81f17e8d3e0fb2e0d3628cf35e20c38d18906',
+      p: 1,
+      password: '',
+      r: 1,
+      salt: '',
+    },
+    {
+      N: 1024,
+      expected:
+        '0xfdbabe1c9d3472007856e7190d01e9fe7c6ad7cbc8237830e77376634b3731622eaf30d92e22a3886ff109279d9830dac727afb94a83ee6d8360cbdfa2cc0640',
+      p: 16,
+      password: 'password',
+      r: 8,
+      salt: 'NaCl',
+    },
+    {
+      N: 16_384,
+      expected:
+        '0x7023bdcb3afd7348461c06cd81fd38ebfda8fbba904f8e3ea9b543f6545da1f2d5432955613f0fcf62d49705242a9af9e61e85dc0d651e40dfcf017b45575887',
+      p: 1,
+      password: 'pleaseletmein',
+      r: 8,
+      salt: 'SodiumChloride',
+    },
+  ])(
+    'matches the RFC 7914 vector for N=$N r=$r p=$p',
+    ({ N, expected, p, password, r, salt }) => {
+      expect(
+        Bytes.toHex(
+          engine.scrypt(Bytes.fromString(password), Bytes.fromString(salt), {
+            N,
+            dkLen: 64,
+            p,
+            r,
+          }),
+        ),
+      ).toBe(expected)
+    },
+  )
+
+  test('behavior: reads non-zero-offset views without mutating their backing buffers', () => {
+    const passwordBacking = new Uint8Array(80).fill(0xa5)
+    const saltBacking = new Uint8Array(90).fill(0x5a)
+    const password = passwordBacking.subarray(7, 72)
+    const salt = saltBacking.subarray(11, 63)
+    password.set(input(password.length))
+    salt.set(input(salt.length))
+    const passwordSnapshot = passwordBacking.slice()
+    const saltSnapshot = saltBacking.slice()
+    const options = { N: 1024, dkLen: 65, p: 2, r: 1 }
+
+    expect(engine.scrypt(password, salt, options)).toEqual(
+      scrypt_noble(password, salt, options),
+    )
+    expect(passwordBacking).toEqual(passwordSnapshot)
+    expect(saltBacking).toEqual(saltSnapshot)
+  })
+
+  test('behavior: results are fresh and never alias WASM memory', () => {
+    const first = engine.scrypt(input(65), input(52), {
+      N: 16,
+      dkLen: 65,
+      p: 1,
+      r: 1,
+    })
+    const snapshot = first.slice()
+    const second = engine.scrypt(input(5), input(9), {
+      N: 32,
+      dkLen: 97,
+      p: 1,
+      r: 1,
+    })
+
+    expect(first).not.toBe(second)
+    expect(first).toEqual(snapshot)
+  })
+
+  test('behavior: clears inputs, outputs, and every workspace', async () => {
+    const module = await internal.instantiate<scrypt.Exports>(scryptWasmBase64)
+    const password = input(65)
+    const salt = input(52)
+    const options = { N: 16, dkLen: 65, p: 2, r: 2 }
+    const stack = module.view().slice(0, module.heapBase)
+
+    expect(scrypt.derive(module, password, salt, options)).toEqual(
+      scrypt_noble(password, salt, options),
+    )
+    expect(module.view().slice(0, module.heapBase)).toEqual(stack)
+    expect(module.view().slice(module.heapBase)).toEqual(
+      new Uint8Array(module.view().length - module.heapBase),
+    )
+  })
+
+  test('behavior: clears the complete region after a late trap', async () => {
+    const module = await internal.instantiate<scrypt.Exports>(scryptWasmBase64)
+    const password = input(65)
+    const salt = input(52)
+    const exports: scrypt.Exports = {
+      scrypt(...parameters) {
+        module.exports.scrypt(...parameters)
+        throw new WebAssembly.RuntimeError('forced late trap')
+      },
+      zero: (ptr, length) => module.exports.zero(ptr, length),
+    }
+
+    expect(() =>
+      scrypt.derive({ ...module, exports }, password, salt, {
+        N: 16,
+        dkLen: 65,
+        p: 2,
+        r: 2,
+      }),
+    ).toThrow(WebAssembly.RuntimeError)
+    expect(module.view().slice(module.heapBase)).toEqual(
+      new Uint8Array(module.view().length - module.heapBase),
+    )
+  })
+
+  test('behavior: rejects the workspace limit before growing memory', async () => {
+    const module = await internal.instantiate<scrypt.Exports>(scryptWasmBase64)
+    const memory = module.view().length
+
+    expect(() =>
+      scrypt.derive(module, new Uint8Array(), new Uint8Array(), {
+        N: 1_048_576,
+        dkLen: 32,
+        p: 1,
+        r: 16,
+      }),
+    ).toThrow(
+      '"maxmem" limit was hit: memUsed(128*r*(N+p+1))=2147487744, maxmem=1073742848',
+    )
+    expect(module.view()).toHaveLength(memory)
+  })
+
+  test('behavior: rejects the WASM memory limit before growing memory', async () => {
+    const module = await internal.instantiate<scrypt.Exports>(scryptWasmBase64)
+    const memory = module.view().length
+
+    expect(() =>
+      scrypt.derive(module, new Uint8Array(), new Uint8Array(), {
+        N: 2,
+        dkLen: 1_074_790_400,
+        p: 1,
+        r: 1,
+      }),
+    ).toThrow(internal.MemoryError)
+    expect(module.view()).toHaveLength(memory)
+  })
+
+  test('behavior: rejects reentrant use of one instance without corrupting the outer call', async () => {
+    const module = await internal.instantiate<scrypt.Exports>(scryptWasmBase64)
+    const password = input(8)
+    const salt = input(16)
+    const options = { N: 16, dkLen: 32, p: 1, r: 1 }
+    let reentered = false
+    const wrapper: internal.Module<scrypt.Exports> = {
+      ...module,
+      exports: {
+        scrypt(...parameters) {
+          expect(() => scrypt.derive(wrapper, password, salt, options)).toThrow(
+            'The scrypt WASM instance is already deriving a key.',
+          )
+          reentered = true
+          module.exports.scrypt(...parameters)
+        },
+        zero: (ptr, length) => module.exports.zero(ptr, length),
+      },
+    }
+
+    expect(scrypt.derive(wrapper, password, salt, options)).toEqual(
+      scrypt_noble(password, salt, options),
+    )
+    expect(reentered).toBe(true)
+  })
+
+  test.each([
+    { N: 1, dkLen: 32, p: 1, r: 8 },
+    { N: 3, dkLen: 32, p: 1, r: 8 },
+    { N: 1024.5, dkLen: 32, p: 1, r: 8 },
+    { N: 1024, dkLen: 32, p: 1, r: -1 },
+    { N: 1024, dkLen: 32, p: 0, r: 8 },
+    { N: 1024, dkLen: 0, p: 1, r: 8 },
+    { N: 1024, dkLen: 32, p: 1, r: 0 },
+  ])(
+    'behavior: matches the default error for N=$N r=$r p=$p dkLen=$dkLen',
+    (options) => {
+      const getError = (fn: () => unknown) => {
+        try {
+          fn()
+        } catch (error) {
+          return {
+            message: (error as Error).message,
+            name: (error as Error).constructor.name,
+          }
+        }
+        throw new Error('Expected derivation to throw.')
+      }
+
+      expect(
+        getError(() => engine.scrypt(input(8), input(16), options)),
+      ).toEqual(getError(() => scrypt_noble(input(8), input(16), options)))
+    },
+  )
+})
+
 describe('Engine.install', () => {
   test('behavior: ox uses synchronous WASM PBKDF2 once installed', async () => {
     await Engine.install({ Keystore: engine })
@@ -189,4 +428,50 @@ describe('Engine.install', () => {
       Engine.reset()
     }
   })
+
+  test('behavior: ox uses synchronous WASM scrypt once installed', async () => {
+    const wasm = engine.scrypt
+    let calls = 0
+    await Engine.install({
+      Keystore: {
+        ...engine,
+        scrypt(...parameters) {
+          calls++
+          return wasm(...parameters)
+        },
+      },
+    })
+    try {
+      const salt = input(32)
+      const [key] = Keystore.scrypt({
+        n: 1024,
+        p: 2,
+        password: 'testpassword',
+        r: 1,
+        salt,
+      })
+      expect(key()).toBe(
+        Bytes.toHex(
+          scrypt_noble(Bytes.fromString('testpassword'), salt, {
+            N: 1024,
+            dkLen: 32,
+            p: 2,
+            r: 1,
+          }),
+        ),
+      )
+      expect(calls).toBe(1)
+
+      await Keystore.scryptAsync({
+        n: 1024,
+        p: 1,
+        password: 'testpassword',
+        r: 1,
+        salt,
+      })
+      expect(calls).toBe(1)
+    } finally {
+      Engine.reset()
+    }
+  })
 })

package/src/wasm/_test/Kzg.test-d.ts

@@ -0,0 +1,19 @@
+import { expectTypeOf, test } from 'vp/test'
+import type * as CoreKzg from '../../core/Kzg.js'
+import { mainnet as trustedSetup } from '../../trusted-setups/Setups.js'
+import * as Kzg from '../Kzg.js'
+
+test('create returns a disposable Kzg.Kzg implementation', async () => {
+  const instance = await Kzg.create({ trustedSetup })
+
+  expectTypeOf(instance).toMatchTypeOf<CoreKzg.Kzg>()
+  expectTypeOf<Kzg.create.ReturnType['dispose']>().toEqualTypeOf<() => void>()
+})
+
+test('trusted setup accepts packed bytes', () => {
+  expectTypeOf<Kzg.TrustedSetup>().toEqualTypeOf<{
+    readonly g1_lagrange: Uint8Array | readonly string[]
+    readonly g1_monomial: Uint8Array | readonly string[]
+    readonly g2_monomial: Uint8Array | readonly string[]
+  }>()
+})

package/src/wasm/_test/Kzg.test.ts

@@ -0,0 +1,220 @@
+import { afterAll, beforeAll, describe, expect, test } from 'vp/test'
+import { kzg as reference } from '../../../test/kzg.js'
+import type * as Bytes from '../../core/Bytes.js'
+import type * as CoreKzg from '../../core/Kzg.js'
+import { mainnet as trustedSetup } from '../../trusted-setups/Setups.js'
+import * as Kzg from '../Kzg.js'
+
+const blob = Uint8Array.from({ length: 131_072 }, (_, index) =>
+  index % 32 === 31 ? index % 251 : 0,
+)
+
+let instance: Kzg.create.ReturnType
+let commitment: Bytes.Bytes
+let cells: readonly Bytes.Bytes[]
+let proofs: readonly Bytes.Bytes[]
+
+beforeAll(async () => {
+  instance = await Kzg.create({ trustedSetup })
+  commitment = instance.blobToKzgCommitment(blob)
+  ;({ cells, proofs } = instance.computeCellsAndKzgProofs(blob))
+}, 120_000)
+
+afterAll(() => {
+  instance.dispose()
+})
+
+describe('create', () => {
+  test('returns the injected Kzg.Kzg boundary', () => {
+    expect(instance satisfies CoreKzg.Kzg).toMatchInlineSnapshot(`
+      {
+        "blobToKzgCommitment": [Function],
+        "computeCells": [Function],
+        "computeCellsAndKzgProofs": [Function],
+        "dispose": [Function],
+        "recoverCellsAndKzgProofs": [Function],
+        "verifyCellKzgProofBatch": [Function],
+      }
+    `)
+  })
+
+  test('compiles concurrently into independently owned instances', async () => {
+    const [first, second] = await Promise.all([
+      Kzg.create({ trustedSetup }),
+      Kzg.create({ trustedSetup }),
+    ])
+
+    first.dispose()
+    expect(() => first.blobToKzgCommitment(blob)).toThrow(Kzg.DisposedError)
+    expect(second.blobToKzgCommitment(blob)).toEqual(commitment)
+    second.dispose()
+    second.dispose()
+    expect(() => second.computeCells(blob)).toThrowErrorMatchingInlineSnapshot(
+      `[Kzg.DisposedError: KZG instance has been disposed.]`,
+    )
+  }, 120_000)
+
+  test('rejects precomputation beyond the memory bound', async () => {
+    await expect(
+      Kzg.create({ precompute: 9, trustedSetup }),
+    ).rejects.toThrowErrorMatchingInlineSnapshot(
+      `[Kzg.InvalidPrecomputeError: \`precompute\` must be an integer from 0 through 8. Got 9.]`,
+    )
+  })
+
+  test('rejects malformed trusted setup points', async () => {
+    await expect(
+      Kzg.create({
+        trustedSetup: {
+          ...trustedSetup,
+          g2_monomial: trustedSetup.g2_monomial.slice(1),
+        },
+      }),
+    ).rejects.toThrowErrorMatchingInlineSnapshot(
+      `[Kzg.InvalidTrustedSetupError: \`g2_monomial\` must contain exactly 6240 bytes.]`,
+    )
+  })
+
+  test('rejects invalid trusted setup points', async () => {
+    const g1Lagrange = trustedSetup.g1_lagrange.slice()
+    g1Lagrange.fill(0, 0, 48)
+    await expect(
+      Kzg.create({
+        trustedSetup: {
+          ...trustedSetup,
+          g1_lagrange: g1Lagrange,
+        },
+      }),
+    ).rejects.toThrowErrorMatchingInlineSnapshot(
+      `[Kzg.InvalidTrustedSetupError: c-kzg rejected the trusted setup.]`,
+    )
+  }, 120_000)
+})
+
+describe('blobToKzgCommitment', () => {
+  test('conformance: matches the independent reference implementation', () => {
+    expect(commitment).toEqual(reference.blobToKzgCommitment(blob))
+  })
+
+  test('rejects a malformed blob', () => {
+    expect(() =>
+      instance.blobToKzgCommitment(new Uint8Array(31)),
+    ).toThrowErrorMatchingInlineSnapshot(
+      `[Kzg.InvalidInputError: \`blob\` must contain exactly 131072 bytes.]`,
+    )
+  })
+
+  test('reuses setup and scratch state', () => {
+    for (let i = 0; i < 100; i++)
+      expect(instance.blobToKzgCommitment(blob)).toEqual(commitment)
+  })
+})
+
+describe('computeCells', () => {
+  test('conformance: matches the independent reference implementation', () => {
+    expect(instance.computeCells(blob)).toEqual(reference.computeCells(blob))
+  }, 120_000)
+})
+
+describe('computeCellsAndKzgProofs', () => {
+  test('conformance: matches the independent reference implementation', () => {
+    const expected = reference.computeCellsAndKzgProofs(blob)
+    expect(cells).toEqual(expected.cells)
+    expect(proofs).toEqual(expected.proofs)
+  }, 120_000)
+})
+
+describe('recoverCellsAndKzgProofs', () => {
+  test('conformance: matches the independent reference implementation', () => {
+    const indices = cells.map((_, index) => index).filter((index) => index % 2)
+    const partial = cells.filter((_, index) => index % 2)
+    const expected = reference.recoverCellsAndKzgProofs(indices, partial)
+
+    expect(instance.recoverCellsAndKzgProofs(indices, partial)).toEqual(
+      expected,
+    )
+  }, 120_000)
+
+  test('accepts unordered indices', () => {
+    const indices = cells
+      .map((_, index) => index)
+      .filter((index) => index % 2)
+      .reverse()
+    const partial = indices.map((index) => cells[index]!)
+
+    expect(instance.recoverCellsAndKzgProofs(indices, partial)).toEqual({
+      cells,
+      proofs,
+    })
+  }, 120_000)
+
+  test('rejects duplicate indices', () => {
+    expect(() =>
+      instance.recoverCellsAndKzgProofs(
+        Array.from({ length: 64 }, () => 0),
+        cells.slice(0, 64),
+      ),
+    ).toThrowErrorMatchingInlineSnapshot(
+      `[Kzg.InvalidInputError: \`cellIndices\` must not contain duplicate indices.]`,
+    )
+  })
+})
+
+describe('verifyCellKzgProofBatch', () => {
+  const indices = Array.from({ length: 128 }, (_, index) => index)
+
+  test('conformance: matches the independent reference implementation', () => {
+    const commitments = cells.map(() => commitment)
+    expect(
+      instance.verifyCellKzgProofBatch(commitments, indices, cells, proofs),
+    ).toBe(
+      reference.verifyCellKzgProofBatch(commitments, indices, cells, proofs),
+    )
+  }, 120_000)
+
+  test('returns false for a corrupted cell', () => {
+    const corrupted = cells.map((cell, index) => {
+      if (index !== 7) return cell
+      const value = Uint8Array.from(cell)
+      value[0] = value[0]! ^ 1
+      return value
+    })
+    expect(
+      instance.verifyCellKzgProofBatch(
+        cells.map(() => commitment),
+        indices,
+        corrupted,
+        proofs,
+      ),
+    ).toMatchInlineSnapshot('false')
+  })
+
+  test('rejects mismatched input lengths', () => {
+    expect(() =>
+      instance.verifyCellKzgProofBatch(
+        [commitment],
+        [],
+        [cells[0]!],
+        [proofs[0]!],
+      ),
+    ).toThrowErrorMatchingInlineSnapshot(
+      `[Kzg.InvalidInputError: \`commitments\`, \`cellIndices\`, \`cells\`, and \`proofs\` must have the same non-zero length.]`,
+    )
+  })
+})
+
+test('exports', () => {
+  expect(Object.keys(Kzg)).toMatchInlineSnapshot(`
+    [
+      "create",
+      "DisposedError",
+      "InvalidInputError",
+      "InvalidPrecomputeError",
+      "InvalidTrustedSetupError",
+      "MemoryError",
+      "WasmError",
+      "versionedHashVersion",
+      "from",
+    ]
+  `)
+})

package/src/wasm/_test/Runtime.test.ts

@@ -19,3 +19,12 @@ test('memmove compares flat-memory offsets rather than C object pointers', () =>
   expect(body).toContain('if ((size_t)d < (size_t)s)')
   expect(body).not.toMatch(/if\s*\(\s*d\s*<\s*s\s*\)/)
 })
+
+test('KZG artifact loads only when create runs', () => {
+  const source = readFileSync(new URL('../Kzg.ts', import.meta.url), 'utf8')
+
+  expect(source).not.toMatch(
+    /^import(?!\s+type\b)[^\n]*['"]\.\/internal\/kzg\.js['"]/m,
+  )
+  expect(source).toContain("await import('./internal/kzg.js')")
+})

package/src/wasm/_test/Secp256k1.test-d.ts

@@ -0,0 +1,35 @@
+import { expectTypeOf, test } from 'vp/test'
+import type * as Engine from '../../core/Engine.js'
+import * as core_Secp256k1 from '../../core/Secp256k1.js'
+import * as Secp256k1 from '../Secp256k1.js'
+
+type Slot = Awaited<ReturnType<typeof Secp256k1.engine>>
+
+test('return type exposes only deterministic Secp256k1 primitives', () => {
+  expectTypeOf<Slot['getPublicKey']>().toEqualTypeOf<
+    NonNullable<Engine.Ecdsa['getPublicKey']>
+  >()
+  expectTypeOf<Slot['getSharedSecret']>().toEqualTypeOf<
+    NonNullable<Engine.Ecdsa['getSharedSecret']>
+  >()
+  expectTypeOf<Slot['recoverPublicKey']>().toEqualTypeOf<
+    NonNullable<Engine.Ecdsa['recoverPublicKey']>
+  >()
+  expectTypeOf<Slot['sign']>().toEqualTypeOf<
+    NonNullable<Engine.Ecdsa['sign']>
+  >()
+  expectTypeOf<Slot['verify']>().toEqualTypeOf<
+    NonNullable<Engine.Ecdsa['verify']>
+  >()
+  expectTypeOf<Slot>().not.toHaveProperty('randomSecretKey')
+})
+
+test('the WASM namespace exposes the public Secp256k1 API', () => {
+  expectTypeOf(Secp256k1.getPublicKey).toEqualTypeOf(
+    core_Secp256k1.getPublicKey,
+  )
+  expectTypeOf(Secp256k1.randomPrivateKey).toEqualTypeOf(
+    core_Secp256k1.randomPrivateKey,
+  )
+  expectTypeOf<typeof Secp256k1>().not.toHaveProperty('create')
+})