ox 1.1.2 → 1.3.0

package/src/wasm/_test/Keystore.browser.test.ts

@@ -1,4 +1,5 @@
 import { pbkdf2 as pbkdf2_noble } from '@noble/hashes/pbkdf2.js'
+import { scrypt as scrypt_noble } from '@noble/hashes/scrypt.js'
 import { sha256 } from '@noble/hashes/sha2.js'
 import { describe, expect, test } from 'vp/test'
 import * as Bytes from '../../core/Bytes.js'
@@ -15,6 +16,9 @@ describe('engine', () => {
     expect(engine.pbkdf2Sha256(password, salt, { c: 3, dkLen: 65 })).toEqual(
       pbkdf2_noble(sha256, password, salt, { c: 3, dkLen: 65 }),
     )
+    expect(
+      engine.scrypt(password, salt, { N: 1024, dkLen: 65, p: 2, r: 1 }),
+    ).toEqual(scrypt_noble(password, salt, { N: 1024, dkLen: 65, p: 2, r: 1 }))
   })
 
   test('behavior: ox uses synchronous WASM PBKDF2 once installed', async () => {
@@ -39,4 +43,31 @@ describe('engine', () => {
       Engine.reset()
     }
   })
+
+  test('behavior: ox uses synchronous WASM scrypt once installed', async () => {
+    const engine = await WasmKeystore.engine()
+    await Engine.install({ Keystore: engine })
+    try {
+      const salt = new Uint8Array(32).fill(7)
+      const [key] = Keystore.scrypt({
+        n: 1024,
+        p: 2,
+        password: 'testpassword',
+        r: 1,
+        salt,
+      })
+      expect(key()).toBe(
+        Bytes.toHex(
+          scrypt_noble(Bytes.fromString('testpassword'), salt, {
+            N: 1024,
+            dkLen: 32,
+            p: 2,
+            r: 1,
+          }),
+        ),
+      )
+    } finally {
+      Engine.reset()
+    }
+  })
 })

package/src/wasm/_test/Keystore.fuzz.ts

@@ -1,5 +1,6 @@
 import { fc, test } from '@fast-check/vitest'
 import { pbkdf2 as pbkdf2_noble } from '@noble/hashes/pbkdf2.js'
+import { scrypt as scrypt_noble } from '@noble/hashes/scrypt.js'
 import { sha256 } from '@noble/hashes/sha2.js'
 import { beforeAll, describe, expect } from 'vp/test'
 import { numRuns } from '../../../test/fuzz/numRuns.js'
@@ -111,3 +112,52 @@ describe('pbkdf2Sha256', () => {
     expect(derived).toEqual(snapshot)
   })
 })
+
+describe('scrypt', () => {
+  test.prop(
+    {
+      dkLen: arbitraryDkLen,
+      logN: fc.integer({ max: 7, min: 1 }),
+      p: fc.integer({ max: 3, min: 1 }),
+      password: arbitraryPassword,
+      r: fc.integer({ max: 4, min: 1 }),
+      salt: arbitrarySalt,
+    },
+    { numRuns },
+  )(
+    'matches @noble/hashes for arbitrary parameters and inputs',
+    ({ dkLen, logN, p, password, r, salt }) => {
+      const options = { N: 2 ** logN, dkLen, p, r }
+      expect(keystore.scrypt(password, salt, options)).toEqual(
+        scrypt_noble(password, salt, options),
+      )
+    },
+  )
+
+  test.prop(
+    {
+      dkLen: arbitraryDkLen,
+      logN: fc.integer({ max: 7, min: 1 }),
+      p: fc.integer({ max: 3, min: 1 }),
+      password: arbitraryPassword,
+      r: fc.integer({ max: 4, min: 1 }),
+      salt: arbitrarySalt,
+    },
+    { numRuns },
+  )(
+    'handles subviews without mutating either backing buffer',
+    ({ dkLen, logN, p, password, r, salt }) => {
+      const password_ = asSubview(password)
+      const salt_ = asSubview(salt)
+      const passwordSnapshot = password_.backing.slice()
+      const saltSnapshot = salt_.backing.slice()
+      const options = { N: 2 ** logN, dkLen, p, r }
+
+      expect(keystore.scrypt(password_.view, salt_.view, options)).toEqual(
+        scrypt_noble(password_.view, salt_.view, options),
+      )
+      expect(password_.backing).toEqual(passwordSnapshot)
+      expect(salt_.backing).toEqual(saltSnapshot)
+    },
+  )
+})

package/src/wasm/_test/Keystore.test-d.ts

@@ -15,11 +15,20 @@ test('synchronous PBKDF2 is present', () => {
   >()
 })
 
+test('synchronous scrypt is present', () => {
+  expectTypeOf<Slot['scrypt']>().toEqualTypeOf<
+    (
+      password: Uint8Array,
+      salt: Uint8Array,
+      options: { N: number; dkLen: number; p: number; r: number },
+    ) => Uint8Array
+  >()
+})
+
 test('unsupported primitives are absent', () => {
   expectTypeOf<Slot>().not.toHaveProperty('aesCtrDecrypt')
   expectTypeOf<Slot>().not.toHaveProperty('aesCtrEncrypt')
   expectTypeOf<Slot>().not.toHaveProperty('pbkdf2Sha256Async')
-  expectTypeOf<Slot>().not.toHaveProperty('scrypt')
   expectTypeOf<Slot>().not.toHaveProperty('scryptAsync')
 })
 

package/src/wasm/_test/Keystore.test.ts

@@ -1,4 +1,5 @@
 import { pbkdf2 as pbkdf2_noble } from '@noble/hashes/pbkdf2.js'
+import { scrypt as scrypt_noble } from '@noble/hashes/scrypt.js'
 import { sha256 } from '@noble/hashes/sha2.js'
 import { beforeAll, describe, expect, test } from 'vp/test'
 import * as Bytes from '../../core/Bytes.js'
@@ -6,9 +7,11 @@ import * as Engine from '../../core/Engine.js'
 import * as Keystore from '../../core/Keystore.js'
 import * as WasmKeystore from '../Keystore.js'
 import * as hashes from '../internal/hashes.js'
-import { wasmBase64 } from '../internal/hashes.wasm.js'
+import { wasmBase64 as hashesWasmBase64 } from '../internal/hashes.wasm.js'
 import * as internal from '../internal/instantiate.js'
 import * as pbkdf2 from '../internal/pbkdf2.js'
+import * as scrypt from '../internal/scrypt.js'
+import { wasmBase64 as scryptWasmBase64 } from '../internal/scrypt.wasm.js'
 
 let engine: WasmKeystore.engine.ReturnType
 
@@ -25,6 +28,7 @@ describe('engine', () => {
     expect(Object.keys(await WasmKeystore.engine())).toMatchInlineSnapshot(`
       [
         "pbkdf2Sha256",
+        "scrypt",
       ]
     `)
   })
@@ -34,6 +38,11 @@ describe('engine', () => {
     expect(a).toBe(b)
   })
 
+  test('behavior: shares the compiled scrypt instance', async () => {
+    const [a, b] = await Promise.all([scrypt.load(), scrypt.load()])
+    expect(a).toBe(b)
+  })
+
   test('behavior: hands every caller its own engine', async () => {
     const [a, b] = await Promise.all([
       WasmKeystore.engine(),
@@ -105,7 +114,7 @@ describe('pbkdf2Sha256', () => {
   })
 
   test('behavior: clears passwords, salts, outputs, and scratch', async () => {
-    const module = await internal.instantiate<hashes.Exports>(wasmBase64)
+    const module = await internal.instantiate<hashes.Exports>(hashesWasmBase64)
     const password = input(65)
     const salt = input(52)
     const stack = module.view().slice(0, module.heapBase)
@@ -120,7 +129,7 @@ describe('pbkdf2Sha256', () => {
   })
 
   test('behavior: clears the complete region after a late trap', async () => {
-    const module = await internal.instantiate<hashes.Exports>(wasmBase64)
+    const module = await internal.instantiate<hashes.Exports>(hashesWasmBase64)
     const password = input(65)
     const salt = input(52)
     const exports: pbkdf2.Exports = {
@@ -143,7 +152,7 @@ describe('pbkdf2Sha256', () => {
   })
 
   test('behavior: rejects a workspace that overflows wasm32 before growing memory', async () => {
-    const module = await internal.instantiate<hashes.Exports>(wasmBase64)
+    const module = await internal.instantiate<hashes.Exports>(hashesWasmBase64)
     const memory = module.view().length
 
     expect(() =>
@@ -167,6 +176,236 @@ describe('pbkdf2Sha256', () => {
   })
 })
 
+const scryptCases = [
+  { N: 16, dkLen: 64, p: 1, password: 0, r: 1, salt: 0 },
+  { N: 1024, dkLen: 32, p: 1, password: 8, r: 1, salt: 16 },
+  { N: 1024, dkLen: 64, p: 1, password: 65, r: 8, salt: 52 },
+  { N: 1024, dkLen: 33, p: 2, password: 9, r: 4, salt: 17 },
+] as const
+
+describe('scrypt', () => {
+  test.each(scryptCases)(
+    'matches the default for password=$password salt=$salt N=$N r=$r p=$p dkLen=$dkLen',
+    ({ N, dkLen, p, password: passwordLength, r, salt: saltLength }) => {
+      const password = input(passwordLength)
+      const salt = input(saltLength)
+      const options = { N, dkLen, p, r }
+      expect(engine.scrypt(password, salt, options)).toEqual(
+        scrypt_noble(password, salt, options),
+      )
+    },
+  )
+
+  test.each([
+    {
+      N: 16,
+      expected:
+        '0x77d6576238657b203b19ca42c18a0497f16b4844e3074ae8dfdffa3fede21442fcd0069ded0948f8326a753a0fc81f17e8d3e0fb2e0d3628cf35e20c38d18906',
+      p: 1,
+      password: '',
+      r: 1,
+      salt: '',
+    },
+    {
+      N: 1024,
+      expected:
+        '0xfdbabe1c9d3472007856e7190d01e9fe7c6ad7cbc8237830e77376634b3731622eaf30d92e22a3886ff109279d9830dac727afb94a83ee6d8360cbdfa2cc0640',
+      p: 16,
+      password: 'password',
+      r: 8,
+      salt: 'NaCl',
+    },
+    {
+      N: 16_384,
+      expected:
+        '0x7023bdcb3afd7348461c06cd81fd38ebfda8fbba904f8e3ea9b543f6545da1f2d5432955613f0fcf62d49705242a9af9e61e85dc0d651e40dfcf017b45575887',
+      p: 1,
+      password: 'pleaseletmein',
+      r: 8,
+      salt: 'SodiumChloride',
+    },
+  ])(
+    'matches the RFC 7914 vector for N=$N r=$r p=$p',
+    ({ N, expected, p, password, r, salt }) => {
+      expect(
+        Bytes.toHex(
+          engine.scrypt(Bytes.fromString(password), Bytes.fromString(salt), {
+            N,
+            dkLen: 64,
+            p,
+            r,
+          }),
+        ),
+      ).toBe(expected)
+    },
+  )
+
+  test('behavior: reads non-zero-offset views without mutating their backing buffers', () => {
+    const passwordBacking = new Uint8Array(80).fill(0xa5)
+    const saltBacking = new Uint8Array(90).fill(0x5a)
+    const password = passwordBacking.subarray(7, 72)
+    const salt = saltBacking.subarray(11, 63)
+    password.set(input(password.length))
+    salt.set(input(salt.length))
+    const passwordSnapshot = passwordBacking.slice()
+    const saltSnapshot = saltBacking.slice()
+    const options = { N: 1024, dkLen: 65, p: 2, r: 1 }
+
+    expect(engine.scrypt(password, salt, options)).toEqual(
+      scrypt_noble(password, salt, options),
+    )
+    expect(passwordBacking).toEqual(passwordSnapshot)
+    expect(saltBacking).toEqual(saltSnapshot)
+  })
+
+  test('behavior: results are fresh and never alias WASM memory', () => {
+    const first = engine.scrypt(input(65), input(52), {
+      N: 16,
+      dkLen: 65,
+      p: 1,
+      r: 1,
+    })
+    const snapshot = first.slice()
+    const second = engine.scrypt(input(5), input(9), {
+      N: 32,
+      dkLen: 97,
+      p: 1,
+      r: 1,
+    })
+
+    expect(first).not.toBe(second)
+    expect(first).toEqual(snapshot)
+  })
+
+  test('behavior: clears inputs, outputs, and every workspace', async () => {
+    const module = await internal.instantiate<scrypt.Exports>(scryptWasmBase64)
+    const password = input(65)
+    const salt = input(52)
+    const options = { N: 16, dkLen: 65, p: 2, r: 2 }
+    const stack = module.view().slice(0, module.heapBase)
+
+    expect(scrypt.derive(module, password, salt, options)).toEqual(
+      scrypt_noble(password, salt, options),
+    )
+    expect(module.view().slice(0, module.heapBase)).toEqual(stack)
+    expect(module.view().slice(module.heapBase)).toEqual(
+      new Uint8Array(module.view().length - module.heapBase),
+    )
+  })
+
+  test('behavior: clears the complete region after a late trap', async () => {
+    const module = await internal.instantiate<scrypt.Exports>(scryptWasmBase64)
+    const password = input(65)
+    const salt = input(52)
+    const exports: scrypt.Exports = {
+      scrypt(...parameters) {
+        module.exports.scrypt(...parameters)
+        throw new WebAssembly.RuntimeError('forced late trap')
+      },
+      zero: (ptr, length) => module.exports.zero(ptr, length),
+    }
+
+    expect(() =>
+      scrypt.derive({ ...module, exports }, password, salt, {
+        N: 16,
+        dkLen: 65,
+        p: 2,
+        r: 2,
+      }),
+    ).toThrow(WebAssembly.RuntimeError)
+    expect(module.view().slice(module.heapBase)).toEqual(
+      new Uint8Array(module.view().length - module.heapBase),
+    )
+  })
+
+  test('behavior: rejects the workspace limit before growing memory', async () => {
+    const module = await internal.instantiate<scrypt.Exports>(scryptWasmBase64)
+    const memory = module.view().length
+
+    expect(() =>
+      scrypt.derive(module, new Uint8Array(), new Uint8Array(), {
+        N: 1_048_576,
+        dkLen: 32,
+        p: 1,
+        r: 16,
+      }),
+    ).toThrow(
+      '"maxmem" limit was hit: memUsed(128*r*(N+p+1))=2147487744, maxmem=1073742848',
+    )
+    expect(module.view()).toHaveLength(memory)
+  })
+
+  test('behavior: rejects the WASM memory limit before growing memory', async () => {
+    const module = await internal.instantiate<scrypt.Exports>(scryptWasmBase64)
+    const memory = module.view().length
+
+    expect(() =>
+      scrypt.derive(module, new Uint8Array(), new Uint8Array(), {
+        N: 2,
+        dkLen: 1_074_790_400,
+        p: 1,
+        r: 1,
+      }),
+    ).toThrow(internal.MemoryError)
+    expect(module.view()).toHaveLength(memory)
+  })
+
+  test('behavior: rejects reentrant use of one instance without corrupting the outer call', async () => {
+    const module = await internal.instantiate<scrypt.Exports>(scryptWasmBase64)
+    const password = input(8)
+    const salt = input(16)
+    const options = { N: 16, dkLen: 32, p: 1, r: 1 }
+    let reentered = false
+    const wrapper: internal.Module<scrypt.Exports> = {
+      ...module,
+      exports: {
+        scrypt(...parameters) {
+          expect(() => scrypt.derive(wrapper, password, salt, options)).toThrow(
+            'The scrypt WASM instance is already deriving a key.',
+          )
+          reentered = true
+          module.exports.scrypt(...parameters)
+        },
+        zero: (ptr, length) => module.exports.zero(ptr, length),
+      },
+    }
+
+    expect(scrypt.derive(wrapper, password, salt, options)).toEqual(
+      scrypt_noble(password, salt, options),
+    )
+    expect(reentered).toBe(true)
+  })
+
+  test.each([
+    { N: 1, dkLen: 32, p: 1, r: 8 },
+    { N: 3, dkLen: 32, p: 1, r: 8 },
+    { N: 1024.5, dkLen: 32, p: 1, r: 8 },
+    { N: 1024, dkLen: 32, p: 1, r: -1 },
+    { N: 1024, dkLen: 32, p: 0, r: 8 },
+    { N: 1024, dkLen: 0, p: 1, r: 8 },
+    { N: 1024, dkLen: 32, p: 1, r: 0 },
+  ])(
+    'behavior: matches the default error for N=$N r=$r p=$p dkLen=$dkLen',
+    (options) => {
+      const getError = (fn: () => unknown) => {
+        try {
+          fn()
+        } catch (error) {
+          return {
+            message: (error as Error).message,
+            name: (error as Error).constructor.name,
+          }
+        }
+        throw new Error('Expected derivation to throw.')
+      }
+
+      expect(
+        getError(() => engine.scrypt(input(8), input(16), options)),
+      ).toEqual(getError(() => scrypt_noble(input(8), input(16), options)))
+    },
+  )
+})
+
 describe('Engine.install', () => {
   test('behavior: ox uses synchronous WASM PBKDF2 once installed', async () => {
     await Engine.install({ Keystore: engine })
@@ -189,4 +428,50 @@ describe('Engine.install', () => {
       Engine.reset()
     }
   })
+
+  test('behavior: ox uses synchronous WASM scrypt once installed', async () => {
+    const wasm = engine.scrypt
+    let calls = 0
+    await Engine.install({
+      Keystore: {
+        ...engine,
+        scrypt(...parameters) {
+          calls++
+          return wasm(...parameters)
+        },
+      },
+    })
+    try {
+      const salt = input(32)
+      const [key] = Keystore.scrypt({
+        n: 1024,
+        p: 2,
+        password: 'testpassword',
+        r: 1,
+        salt,
+      })
+      expect(key()).toBe(
+        Bytes.toHex(
+          scrypt_noble(Bytes.fromString('testpassword'), salt, {
+            N: 1024,
+            dkLen: 32,
+            p: 2,
+            r: 1,
+          }),
+        ),
+      )
+      expect(calls).toBe(1)
+
+      await Keystore.scryptAsync({
+        n: 1024,
+        p: 1,
+        password: 'testpassword',
+        r: 1,
+        salt,
+      })
+      expect(calls).toBe(1)
+    } finally {
+      Engine.reset()
+    }
+  })
 })

package/src/wasm/_test/Kzg.test-d.ts

@@ -0,0 +1,19 @@
+import { expectTypeOf, test } from 'vp/test'
+import type * as CoreKzg from '../../core/Kzg.js'
+import { mainnet as trustedSetup } from '../../trusted-setups/Setups.js'
+import * as Kzg from '../Kzg.js'
+
+test('create returns a disposable Kzg.Kzg implementation', async () => {
+  const instance = await Kzg.create({ trustedSetup })
+
+  expectTypeOf(instance).toMatchTypeOf<CoreKzg.Kzg>()
+  expectTypeOf<Kzg.create.ReturnType['dispose']>().toEqualTypeOf<() => void>()
+})
+
+test('trusted setup accepts packed bytes', () => {
+  expectTypeOf<Kzg.TrustedSetup>().toEqualTypeOf<{
+    readonly g1_lagrange: Uint8Array | readonly string[]
+    readonly g1_monomial: Uint8Array | readonly string[]
+    readonly g2_monomial: Uint8Array | readonly string[]
+  }>()
+})