web-dc-api 0.0.58 → 0.0.59

package/dist/cjs/node_modules/@noble/curves/esm/abstract/weierstrass.js

@@ -0,0 +1,1190 @@
+'use strict';
+
+var curve = require('./curve.js');
+var modular = require('./modular.js');
+var utils = require('./utils.js');
+
+/**
+ * Short Weierstrass curve methods. The formula is: y² = x³ + ax + b.
+ *
+ * ### Parameters
+ *
+ * To initialize a weierstrass curve, one needs to pass following params:
+ *
+ * * a: formula param
+ * * b: formula param
+ * * Fp: finite field of prime characteristic P; may be complex (Fp2). Arithmetics is done in field
+ * * n: order of prime subgroup a.k.a total amount of valid curve points
+ * * Gx: Base point (x, y) aka generator point. Gx = x coordinate
+ * * Gy: ...y coordinate
+ * * h: cofactor, usually 1. h*n = curve group order (n is only subgroup order)
+ * * lowS: whether to enable (default) or disable "low-s" non-malleable signatures
+ *
+ * ### Design rationale for types
+ *
+ * * Interaction between classes from different curves should fail:
+ *   `k256.Point.BASE.add(p256.Point.BASE)`
+ * * For this purpose we want to use `instanceof` operator, which is fast and works during runtime
+ * * Different calls of `curve()` would return different classes -
+ *   `curve(params) !== curve(params)`: if somebody decided to monkey-patch their curve,
+ *   it won't affect others
+ *
+ * TypeScript can't infer types for classes created inside a function. Classes is one instance
+ * of nominative types in TypeScript and interfaces only check for shape, so it's hard to create
+ * unique type for every function call.
+ *
+ * We can use generic types via some param, like curve opts, but that would:
+ *     1. Enable interaction between `curve(params)` and `curve(params)` (curves of same params)
+ *     which is hard to debug.
+ *     2. Params can be generic and we can't enforce them to be constant value:
+ *     if somebody creates curve from non-constant params,
+ *     it would be allowed to interact with other curves with non-constant params
+ *
+ * @todo https://www.typescriptlang.org/docs/handbook/release-notes/typescript-2-7.html#unique-symbol
+ * @module
+ */
+/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+// prettier-ignore
+function validateSigVerOpts(opts) {
+  if (opts.lowS !== undefined) utils.abool('lowS', opts.lowS);
+  if (opts.prehash !== undefined) utils.abool('prehash', opts.prehash);
+}
+function validatePointOpts(curve$1) {
+  const opts = curve.validateBasic(curve$1);
+  utils.validateObject(opts, {
+    a: 'field',
+    b: 'field'
+  }, {
+    allowInfinityPoint: 'boolean',
+    allowedPrivateKeyLengths: 'array',
+    clearCofactor: 'function',
+    fromBytes: 'function',
+    isTorsionFree: 'function',
+    toBytes: 'function',
+    wrapPrivateKey: 'boolean'
+  });
+  const {
+    endo,
+    Fp,
+    a
+  } = opts;
+  if (endo) {
+    if (!Fp.eql(a, Fp.ZERO)) {
+      throw new Error('invalid endo: CURVE.a must be 0');
+    }
+    if (typeof endo !== 'object' || typeof endo.beta !== 'bigint' || typeof endo.splitScalar !== 'function') {
+      throw new Error('invalid endo: expected "beta": bigint and "splitScalar": function');
+    }
+  }
+  return Object.freeze({
+    ...opts
+  });
+}
+class DERErr extends Error {
+  constructor() {
+    let m = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : '';
+    super(m);
+  }
+}
+/**
+ * ASN.1 DER encoding utilities. ASN is very complex & fragile. Format:
+ *
+ *     [0x30 (SEQUENCE), bytelength, 0x02 (INTEGER), intLength, R, 0x02 (INTEGER), intLength, S]
+ *
+ * Docs: https://letsencrypt.org/docs/a-warm-welcome-to-asn1-and-der/, https://luca.ntop.org/Teaching/Appunti/asn1.html
+ */
+const DER = {
+  // asn.1 DER encoding utils
+  Err: DERErr,
+  // Basic building block is TLV (Tag-Length-Value)
+  _tlv: {
+    encode: (tag, data) => {
+      const {
+        Err: E
+      } = DER;
+      if (tag < 0 || tag > 256) throw new E('tlv.encode: wrong tag');
+      if (data.length & 1) throw new E('tlv.encode: unpadded data');
+      const dataLen = data.length / 2;
+      const len = utils.numberToHexUnpadded(dataLen);
+      if (len.length / 2 & 128) throw new E('tlv.encode: long form length too big');
+      // length of length with long form flag
+      const lenLen = dataLen > 127 ? utils.numberToHexUnpadded(len.length / 2 | 128) : '';
+      const t = utils.numberToHexUnpadded(tag);
+      return t + lenLen + len + data;
+    },
+    // v - value, l - left bytes (unparsed)
+    decode(tag, data) {
+      const {
+        Err: E
+      } = DER;
+      let pos = 0;
+      if (tag < 0 || tag > 256) throw new E('tlv.encode: wrong tag');
+      if (data.length < 2 || data[pos++] !== tag) throw new E('tlv.decode: wrong tlv');
+      const first = data[pos++];
+      const isLong = !!(first & 128); // First bit of first length byte is flag for short/long form
+      let length = 0;
+      if (!isLong) length = first;else {
+        // Long form: [longFlag(1bit), lengthLength(7bit), length (BE)]
+        const lenLen = first & 127;
+        if (!lenLen) throw new E('tlv.decode(long): indefinite length not supported');
+        if (lenLen > 4) throw new E('tlv.decode(long): byte length is too big'); // this will overflow u32 in js
+        const lengthBytes = data.subarray(pos, pos + lenLen);
+        if (lengthBytes.length !== lenLen) throw new E('tlv.decode: length bytes not complete');
+        if (lengthBytes[0] === 0) throw new E('tlv.decode(long): zero leftmost byte');
+        for (const b of lengthBytes) length = length << 8 | b;
+        pos += lenLen;
+        if (length < 128) throw new E('tlv.decode(long): not minimal encoding');
+      }
+      const v = data.subarray(pos, pos + length);
+      if (v.length !== length) throw new E('tlv.decode: wrong value length');
+      return {
+        v,
+        l: data.subarray(pos + length)
+      };
+    }
+  },
+  // https://crypto.stackexchange.com/a/57734 Leftmost bit of first byte is 'negative' flag,
+  // since we always use positive integers here. It must always be empty:
+  // - add zero byte if exists
+  // - if next byte doesn't have a flag, leading zero is not allowed (minimal encoding)
+  _int: {
+    encode(num) {
+      const {
+        Err: E
+      } = DER;
+      if (num < _0n) throw new E('integer: negative integers are not allowed');
+      let hex = utils.numberToHexUnpadded(num);
+      // Pad with zero byte if negative flag is present
+      if (Number.parseInt(hex[0], 16) & 0b1000) hex = '00' + hex;
+      if (hex.length & 1) throw new E('unexpected DER parsing assertion: unpadded hex');
+      return hex;
+    },
+    decode(data) {
+      const {
+        Err: E
+      } = DER;
+      if (data[0] & 128) throw new E('invalid signature integer: negative');
+      if (data[0] === 0x00 && !(data[1] & 128)) throw new E('invalid signature integer: unnecessary leading zero');
+      return utils.bytesToNumberBE(data);
+    }
+  },
+  toSig(hex) {
+    // parse DER signature
+    const {
+      Err: E,
+      _int: int,
+      _tlv: tlv
+    } = DER;
+    const data = utils.ensureBytes('signature', hex);
+    const {
+      v: seqBytes,
+      l: seqLeftBytes
+    } = tlv.decode(0x30, data);
+    if (seqLeftBytes.length) throw new E('invalid signature: left bytes after parsing');
+    const {
+      v: rBytes,
+      l: rLeftBytes
+    } = tlv.decode(0x02, seqBytes);
+    const {
+      v: sBytes,
+      l: sLeftBytes
+    } = tlv.decode(0x02, rLeftBytes);
+    if (sLeftBytes.length) throw new E('invalid signature: left bytes after parsing');
+    return {
+      r: int.decode(rBytes),
+      s: int.decode(sBytes)
+    };
+  },
+  hexFromSig(sig) {
+    const {
+      _tlv: tlv,
+      _int: int
+    } = DER;
+    const rs = tlv.encode(0x02, int.encode(sig.r));
+    const ss = tlv.encode(0x02, int.encode(sig.s));
+    const seq = rs + ss;
+    return tlv.encode(0x30, seq);
+  }
+};
+function numToSizedHex(num, size) {
+  return utils.bytesToHex(utils.numberToBytesBE(num, size));
+}
+// Be friendly to bad ECMAScript parsers by not using bigint literals
+// prettier-ignore
+const _0n = BigInt(0),
+  _1n = BigInt(1);
+  BigInt(2);
+  const _3n = BigInt(3),
+  _4n = BigInt(4);
+function weierstrassPoints(opts) {
+  const CURVE = validatePointOpts(opts);
+  const {
+    Fp
+  } = CURVE; // All curves has same field / group length as for now, but they can differ
+  const Fn = modular.Field(CURVE.n, CURVE.nBitLength);
+  const toBytes = CURVE.toBytes || ((_c, point, _isCompressed) => {
+    const a = point.toAffine();
+    return utils.concatBytes(Uint8Array.from([0x04]), Fp.toBytes(a.x), Fp.toBytes(a.y));
+  });
+  const fromBytes = CURVE.fromBytes || (bytes => {
+    // const head = bytes[0];
+    const tail = bytes.subarray(1);
+    // if (head !== 0x04) throw new Error('Only non-compressed encoding is supported');
+    const x = Fp.fromBytes(tail.subarray(0, Fp.BYTES));
+    const y = Fp.fromBytes(tail.subarray(Fp.BYTES, 2 * Fp.BYTES));
+    return {
+      x,
+      y
+    };
+  });
+  /**
+   * y² = x³ + ax + b: Short weierstrass curve formula. Takes x, returns y².
+   * @returns y²
+   */
+  function weierstrassEquation(x) {
+    const {
+      a,
+      b
+    } = CURVE;
+    const x2 = Fp.sqr(x); // x * x
+    const x3 = Fp.mul(x2, x); // x² * x
+    return Fp.add(Fp.add(x3, Fp.mul(x, a)), b); // x³ + a * x + b
+  }
+  function isValidXY(x, y) {
+    const left = Fp.sqr(y); // y²
+    const right = weierstrassEquation(x); // x³ + ax + b
+    return Fp.eql(left, right);
+  }
+  // Validate whether the passed curve params are valid.
+  // Test 1: equation y² = x³ + ax + b should work for generator point.
+  if (!isValidXY(CURVE.Gx, CURVE.Gy)) throw new Error('bad curve params: generator point');
+  // Test 2: discriminant Δ part should be non-zero: 4a³ + 27b² != 0.
+  // Guarantees curve is genus-1, smooth (non-singular).
+  const _4a3 = Fp.mul(Fp.pow(CURVE.a, _3n), _4n);
+  const _27b2 = Fp.mul(Fp.sqr(CURVE.b), BigInt(27));
+  if (Fp.is0(Fp.add(_4a3, _27b2))) throw new Error('bad curve params: a or b');
+  // Valid group elements reside in range 1..n-1
+  function isWithinCurveOrder(num) {
+    return utils.inRange(num, _1n, CURVE.n);
+  }
+  // Validates if priv key is valid and converts it to bigint.
+  // Supports options allowedPrivateKeyLengths and wrapPrivateKey.
+  function normPrivateKeyToScalar(key) {
+    const {
+      allowedPrivateKeyLengths: lengths,
+      nByteLength,
+      wrapPrivateKey,
+      n: N
+    } = CURVE;
+    if (lengths && typeof key !== 'bigint') {
+      if (utils.isBytes(key)) key = utils.bytesToHex(key);
+      // Normalize to hex string, pad. E.g. P521 would norm 130-132 char hex to 132-char bytes
+      if (typeof key !== 'string' || !lengths.includes(key.length)) throw new Error('invalid private key');
+      key = key.padStart(nByteLength * 2, '0');
+    }
+    let num;
+    try {
+      num = typeof key === 'bigint' ? key : utils.bytesToNumberBE(utils.ensureBytes('private key', key, nByteLength));
+    } catch (error) {
+      throw new Error('invalid private key, expected hex or ' + nByteLength + ' bytes, got ' + typeof key);
+    }
+    if (wrapPrivateKey) num = modular.mod(num, N); // disabled by default, enabled for BLS
+    utils.aInRange('private key', num, _1n, N); // num in range [1..N-1]
+    return num;
+  }
+  function aprjpoint(other) {
+    if (!(other instanceof Point)) throw new Error('ProjectivePoint expected');
+  }
+  // Memoized toAffine / validity check. They are heavy. Points are immutable.
+  // Converts Projective point to affine (x, y) coordinates.
+  // Can accept precomputed Z^-1 - for example, from invertBatch.
+  // (X, Y, Z) ∋ (x=X/Z, y=Y/Z)
+  const toAffineMemo = utils.memoized((p, iz) => {
+    const {
+      px: x,
+      py: y,
+      pz: z
+    } = p;
+    // Fast-path for normalized points
+    if (Fp.eql(z, Fp.ONE)) return {
+      x,
+      y
+    };
+    const is0 = p.is0();
+    // If invZ was 0, we return zero point. However we still want to execute
+    // all operations, so we replace invZ with a random number, 1.
+    if (iz == null) iz = is0 ? Fp.ONE : Fp.inv(z);
+    const ax = Fp.mul(x, iz);
+    const ay = Fp.mul(y, iz);
+    const zz = Fp.mul(z, iz);
+    if (is0) return {
+      x: Fp.ZERO,
+      y: Fp.ZERO
+    };
+    if (!Fp.eql(zz, Fp.ONE)) throw new Error('invZ was invalid');
+    return {
+      x: ax,
+      y: ay
+    };
+  });
+  // NOTE: on exception this will crash 'cached' and no value will be set.
+  // Otherwise true will be return
+  const assertValidMemo = utils.memoized(p => {
+    if (p.is0()) {
+      // (0, 1, 0) aka ZERO is invalid in most contexts.
+      // In BLS, ZERO can be serialized, so we allow it.
+      // (0, 0, 0) is invalid representation of ZERO.
+      if (CURVE.allowInfinityPoint && !Fp.is0(p.py)) return;
+      throw new Error('bad point: ZERO');
+    }
+    // Some 3rd-party test vectors require different wording between here & `fromCompressedHex`
+    const {
+      x,
+      y
+    } = p.toAffine();
+    // Check if x, y are valid field elements
+    if (!Fp.isValid(x) || !Fp.isValid(y)) throw new Error('bad point: x or y not FE');
+    if (!isValidXY(x, y)) throw new Error('bad point: equation left != right');
+    if (!p.isTorsionFree()) throw new Error('bad point: not in prime-order subgroup');
+    return true;
+  });
+  /**
+   * Projective Point works in 3d / projective (homogeneous) coordinates: (X, Y, Z) ∋ (x=X/Z, y=Y/Z)
+   * Default Point works in 2d / affine coordinates: (x, y)
+   * We're doing calculations in projective, because its operations don't require costly inversion.
+   */
+  class Point {
+    constructor(px, py, pz) {
+      if (px == null || !Fp.isValid(px)) throw new Error('x required');
+      if (py == null || !Fp.isValid(py) || Fp.is0(py)) throw new Error('y required');
+      if (pz == null || !Fp.isValid(pz)) throw new Error('z required');
+      this.px = px;
+      this.py = py;
+      this.pz = pz;
+      Object.freeze(this);
+    }
+    // Does not validate if the point is on-curve.
+    // Use fromHex instead, or call assertValidity() later.
+    static fromAffine(p) {
+      const {
+        x,
+        y
+      } = p || {};
+      if (!p || !Fp.isValid(x) || !Fp.isValid(y)) throw new Error('invalid affine point');
+      if (p instanceof Point) throw new Error('projective point not allowed');
+      const is0 = i => Fp.eql(i, Fp.ZERO);
+      // fromAffine(x:0, y:0) would produce (x:0, y:0, z:1), but we need (x:0, y:1, z:0)
+      if (is0(x) && is0(y)) return Point.ZERO;
+      return new Point(x, y, Fp.ONE);
+    }
+    get x() {
+      return this.toAffine().x;
+    }
+    get y() {
+      return this.toAffine().y;
+    }
+    /**
+     * Takes a bunch of Projective Points but executes only one
+     * inversion on all of them. Inversion is very slow operation,
+     * so this improves performance massively.
+     * Optimization: converts a list of projective points to a list of identical points with Z=1.
+     */
+    static normalizeZ(points) {
+      const toInv = modular.FpInvertBatch(Fp, points.map(p => p.pz));
+      return points.map((p, i) => p.toAffine(toInv[i])).map(Point.fromAffine);
+    }
+    /**
+     * Converts hash string or Uint8Array to Point.
+     * @param hex short/long ECDSA hex
+     */
+    static fromHex(hex) {
+      const P = Point.fromAffine(fromBytes(utils.ensureBytes('pointHex', hex)));
+      P.assertValidity();
+      return P;
+    }
+    // Multiplies generator point by privateKey.
+    static fromPrivateKey(privateKey) {
+      return Point.BASE.multiply(normPrivateKeyToScalar(privateKey));
+    }
+    // Multiscalar Multiplication
+    static msm(points, scalars) {
+      return curve.pippenger(Point, Fn, points, scalars);
+    }
+    // "Private method", don't use it directly
+    _setWindowSize(windowSize) {
+      wnaf.setWindowSize(this, windowSize);
+    }
+    // A point on curve is valid if it conforms to equation.
+    assertValidity() {
+      assertValidMemo(this);
+    }
+    hasEvenY() {
+      const {
+        y
+      } = this.toAffine();
+      if (Fp.isOdd) return !Fp.isOdd(y);
+      throw new Error("Field doesn't support isOdd");
+    }
+    /**
+     * Compare one point to another.
+     */
+    equals(other) {
+      aprjpoint(other);
+      const {
+        px: X1,
+        py: Y1,
+        pz: Z1
+      } = this;
+      const {
+        px: X2,
+        py: Y2,
+        pz: Z2
+      } = other;
+      const U1 = Fp.eql(Fp.mul(X1, Z2), Fp.mul(X2, Z1));
+      const U2 = Fp.eql(Fp.mul(Y1, Z2), Fp.mul(Y2, Z1));
+      return U1 && U2;
+    }
+    /**
+     * Flips point to one corresponding to (x, -y) in Affine coordinates.
+     */
+    negate() {
+      return new Point(this.px, Fp.neg(this.py), this.pz);
+    }
+    // Renes-Costello-Batina exception-free doubling formula.
+    // There is 30% faster Jacobian formula, but it is not complete.
+    // https://eprint.iacr.org/2015/1060, algorithm 3
+    // Cost: 8M + 3S + 3*a + 2*b3 + 15add.
+    double() {
+      const {
+        a,
+        b
+      } = CURVE;
+      const b3 = Fp.mul(b, _3n);
+      const {
+        px: X1,
+        py: Y1,
+        pz: Z1
+      } = this;
+      let X3 = Fp.ZERO,
+        Y3 = Fp.ZERO,
+        Z3 = Fp.ZERO; // prettier-ignore
+      let t0 = Fp.mul(X1, X1); // step 1
+      let t1 = Fp.mul(Y1, Y1);
+      let t2 = Fp.mul(Z1, Z1);
+      let t3 = Fp.mul(X1, Y1);
+      t3 = Fp.add(t3, t3); // step 5
+      Z3 = Fp.mul(X1, Z1);
+      Z3 = Fp.add(Z3, Z3);
+      X3 = Fp.mul(a, Z3);
+      Y3 = Fp.mul(b3, t2);
+      Y3 = Fp.add(X3, Y3); // step 10
+      X3 = Fp.sub(t1, Y3);
+      Y3 = Fp.add(t1, Y3);
+      Y3 = Fp.mul(X3, Y3);
+      X3 = Fp.mul(t3, X3);
+      Z3 = Fp.mul(b3, Z3); // step 15
+      t2 = Fp.mul(a, t2);
+      t3 = Fp.sub(t0, t2);
+      t3 = Fp.mul(a, t3);
+      t3 = Fp.add(t3, Z3);
+      Z3 = Fp.add(t0, t0); // step 20
+      t0 = Fp.add(Z3, t0);
+      t0 = Fp.add(t0, t2);
+      t0 = Fp.mul(t0, t3);
+      Y3 = Fp.add(Y3, t0);
+      t2 = Fp.mul(Y1, Z1); // step 25
+      t2 = Fp.add(t2, t2);
+      t0 = Fp.mul(t2, t3);
+      X3 = Fp.sub(X3, t0);
+      Z3 = Fp.mul(t2, t1);
+      Z3 = Fp.add(Z3, Z3); // step 30
+      Z3 = Fp.add(Z3, Z3);
+      return new Point(X3, Y3, Z3);
+    }
+    // Renes-Costello-Batina exception-free addition formula.
+    // There is 30% faster Jacobian formula, but it is not complete.
+    // https://eprint.iacr.org/2015/1060, algorithm 1
+    // Cost: 12M + 0S + 3*a + 3*b3 + 23add.
+    add(other) {
+      aprjpoint(other);
+      const {
+        px: X1,
+        py: Y1,
+        pz: Z1
+      } = this;
+      const {
+        px: X2,
+        py: Y2,
+        pz: Z2
+      } = other;
+      let X3 = Fp.ZERO,
+        Y3 = Fp.ZERO,
+        Z3 = Fp.ZERO; // prettier-ignore
+      const a = CURVE.a;
+      const b3 = Fp.mul(CURVE.b, _3n);
+      let t0 = Fp.mul(X1, X2); // step 1
+      let t1 = Fp.mul(Y1, Y2);
+      let t2 = Fp.mul(Z1, Z2);
+      let t3 = Fp.add(X1, Y1);
+      let t4 = Fp.add(X2, Y2); // step 5
+      t3 = Fp.mul(t3, t4);
+      t4 = Fp.add(t0, t1);
+      t3 = Fp.sub(t3, t4);
+      t4 = Fp.add(X1, Z1);
+      let t5 = Fp.add(X2, Z2); // step 10
+      t4 = Fp.mul(t4, t5);
+      t5 = Fp.add(t0, t2);
+      t4 = Fp.sub(t4, t5);
+      t5 = Fp.add(Y1, Z1);
+      X3 = Fp.add(Y2, Z2); // step 15
+      t5 = Fp.mul(t5, X3);
+      X3 = Fp.add(t1, t2);
+      t5 = Fp.sub(t5, X3);
+      Z3 = Fp.mul(a, t4);
+      X3 = Fp.mul(b3, t2); // step 20
+      Z3 = Fp.add(X3, Z3);
+      X3 = Fp.sub(t1, Z3);
+      Z3 = Fp.add(t1, Z3);
+      Y3 = Fp.mul(X3, Z3);
+      t1 = Fp.add(t0, t0); // step 25
+      t1 = Fp.add(t1, t0);
+      t2 = Fp.mul(a, t2);
+      t4 = Fp.mul(b3, t4);
+      t1 = Fp.add(t1, t2);
+      t2 = Fp.sub(t0, t2); // step 30
+      t2 = Fp.mul(a, t2);
+      t4 = Fp.add(t4, t2);
+      t0 = Fp.mul(t1, t4);
+      Y3 = Fp.add(Y3, t0);
+      t0 = Fp.mul(t5, t4); // step 35
+      X3 = Fp.mul(t3, X3);
+      X3 = Fp.sub(X3, t0);
+      t0 = Fp.mul(t3, t1);
+      Z3 = Fp.mul(t5, Z3);
+      Z3 = Fp.add(Z3, t0); // step 40
+      return new Point(X3, Y3, Z3);
+    }
+    subtract(other) {
+      return this.add(other.negate());
+    }
+    is0() {
+      return this.equals(Point.ZERO);
+    }
+    wNAF(n) {
+      return wnaf.wNAFCached(this, n, Point.normalizeZ);
+    }
+    /**
+     * Non-constant-time multiplication. Uses double-and-add algorithm.
+     * It's faster, but should only be used when you don't care about
+     * an exposed private key e.g. sig verification, which works over *public* keys.
+     */
+    multiplyUnsafe(sc) {
+      const {
+        endo,
+        n: N
+      } = CURVE;
+      utils.aInRange('scalar', sc, _0n, N);
+      const I = Point.ZERO;
+      if (sc === _0n) return I;
+      if (this.is0() || sc === _1n) return this;
+      // Case a: no endomorphism. Case b: has precomputes.
+      if (!endo || wnaf.hasPrecomputes(this)) return wnaf.wNAFCachedUnsafe(this, sc, Point.normalizeZ);
+      // Case c: endomorphism
+      /** See docs for {@link EndomorphismOpts} */
+      let {
+        k1neg,
+        k1,
+        k2neg,
+        k2
+      } = endo.splitScalar(sc);
+      let k1p = I;
+      let k2p = I;
+      let d = this;
+      while (k1 > _0n || k2 > _0n) {
+        if (k1 & _1n) k1p = k1p.add(d);
+        if (k2 & _1n) k2p = k2p.add(d);
+        d = d.double();
+        k1 >>= _1n;
+        k2 >>= _1n;
+      }
+      if (k1neg) k1p = k1p.negate();
+      if (k2neg) k2p = k2p.negate();
+      k2p = new Point(Fp.mul(k2p.px, endo.beta), k2p.py, k2p.pz);
+      return k1p.add(k2p);
+    }
+    /**
+     * Constant time multiplication.
+     * Uses wNAF method. Windowed method may be 10% faster,
+     * but takes 2x longer to generate and consumes 2x memory.
+     * Uses precomputes when available.
+     * Uses endomorphism for Koblitz curves.
+     * @param scalar by which the point would be multiplied
+     * @returns New point
+     */
+    multiply(scalar) {
+      const {
+        endo,
+        n: N
+      } = CURVE;
+      utils.aInRange('scalar', scalar, _1n, N);
+      let point, fake; // Fake point is used to const-time mult
+      /** See docs for {@link EndomorphismOpts} */
+      if (endo) {
+        const {
+          k1neg,
+          k1,
+          k2neg,
+          k2
+        } = endo.splitScalar(scalar);
+        let {
+          p: k1p,
+          f: f1p
+        } = this.wNAF(k1);
+        let {
+          p: k2p,
+          f: f2p
+        } = this.wNAF(k2);
+        k1p = wnaf.constTimeNegate(k1neg, k1p);
+        k2p = wnaf.constTimeNegate(k2neg, k2p);
+        k2p = new Point(Fp.mul(k2p.px, endo.beta), k2p.py, k2p.pz);
+        point = k1p.add(k2p);
+        fake = f1p.add(f2p);
+      } else {
+        const {
+          p,
+          f
+        } = this.wNAF(scalar);
+        point = p;
+        fake = f;
+      }
+      // Normalize `z` for both points, but return only real one
+      return Point.normalizeZ([point, fake])[0];
+    }
+    /**
+     * Efficiently calculate `aP + bQ`. Unsafe, can expose private key, if used incorrectly.
+     * Not using Strauss-Shamir trick: precomputation tables are faster.
+     * The trick could be useful if both P and Q are not G (not in our case).
+     * @returns non-zero affine point
+     */
+    multiplyAndAddUnsafe(Q, a, b) {
+      const G = Point.BASE; // No Strauss-Shamir trick: we have 10% faster G precomputes
+      const mul = (P, a // Select faster multiply() method
+      ) => a === _0n || a === _1n || !P.equals(G) ? P.multiplyUnsafe(a) : P.multiply(a);
+      const sum = mul(this, a).add(mul(Q, b));
+      return sum.is0() ? undefined : sum;
+    }
+    // Converts Projective point to affine (x, y) coordinates.
+    // Can accept precomputed Z^-1 - for example, from invertBatch.
+    // (x, y, z) ∋ (x=x/z, y=y/z)
+    toAffine(iz) {
+      return toAffineMemo(this, iz);
+    }
+    isTorsionFree() {
+      const {
+        h: cofactor,
+        isTorsionFree
+      } = CURVE;
+      if (cofactor === _1n) return true; // No subgroups, always torsion-free
+      if (isTorsionFree) return isTorsionFree(Point, this);
+      throw new Error('isTorsionFree() has not been declared for the elliptic curve');
+    }
+    clearCofactor() {
+      const {
+        h: cofactor,
+        clearCofactor
+      } = CURVE;
+      if (cofactor === _1n) return this; // Fast-path
+      if (clearCofactor) return clearCofactor(Point, this);
+      return this.multiplyUnsafe(CURVE.h);
+    }
+    toRawBytes() {
+      let isCompressed = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : true;
+      utils.abool('isCompressed', isCompressed);
+      this.assertValidity();
+      return toBytes(Point, this, isCompressed);
+    }
+    toHex() {
+      let isCompressed = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : true;
+      utils.abool('isCompressed', isCompressed);
+      return utils.bytesToHex(this.toRawBytes(isCompressed));
+    }
+  }
+  // base / generator point
+  Point.BASE = new Point(CURVE.Gx, CURVE.Gy, Fp.ONE);
+  // zero / infinity / identity point
+  Point.ZERO = new Point(Fp.ZERO, Fp.ONE, Fp.ZERO); // 0, 1, 0
+  const {
+    endo,
+    nBitLength
+  } = CURVE;
+  const wnaf = curve.wNAF(Point, endo ? Math.ceil(nBitLength / 2) : nBitLength);
+  return {
+    CURVE,
+    ProjectivePoint: Point,
+    normPrivateKeyToScalar,
+    weierstrassEquation,
+    isWithinCurveOrder
+  };
+}
+function validateOpts(curve$1) {
+  const opts = curve.validateBasic(curve$1);
+  utils.validateObject(opts, {
+    hash: 'hash',
+    hmac: 'function',
+    randomBytes: 'function'
+  }, {
+    bits2int: 'function',
+    bits2int_modN: 'function',
+    lowS: 'boolean'
+  });
+  return Object.freeze({
+    lowS: true,
+    ...opts
+  });
+}
+/**
+ * Creates short weierstrass curve and ECDSA signature methods for it.
+ * @example
+ * import { Field } from '@noble/curves/abstract/modular';
+ * // Before that, define BigInt-s: a, b, p, n, Gx, Gy
+ * const curve = weierstrass({ a, b, Fp: Field(p), n, Gx, Gy, h: 1n })
+ */
+function weierstrass(curveDef) {
+  const CURVE = validateOpts(curveDef);
+  const {
+    Fp,
+    n: CURVE_ORDER,
+    nByteLength,
+    nBitLength
+  } = CURVE;
+  const compressedLen = Fp.BYTES + 1; // e.g. 33 for 32
+  const uncompressedLen = 2 * Fp.BYTES + 1; // e.g. 65 for 32
+  function modN(a) {
+    return modular.mod(a, CURVE_ORDER);
+  }
+  function invN(a) {
+    return modular.invert(a, CURVE_ORDER);
+  }
+  const {
+    ProjectivePoint: Point,
+    normPrivateKeyToScalar,
+    weierstrassEquation,
+    isWithinCurveOrder
+  } = weierstrassPoints({
+    ...CURVE,
+    toBytes(_c, point, isCompressed) {
+      const a = point.toAffine();
+      const x = Fp.toBytes(a.x);
+      const cat = utils.concatBytes;
+      utils.abool('isCompressed', isCompressed);
+      if (isCompressed) {
+        return cat(Uint8Array.from([point.hasEvenY() ? 0x02 : 0x03]), x);
+      } else {
+        return cat(Uint8Array.from([0x04]), x, Fp.toBytes(a.y));
+      }
+    },
+    fromBytes(bytes) {
+      const len = bytes.length;
+      const head = bytes[0];
+      const tail = bytes.subarray(1);
+      // this.assertValidity() is done inside of fromHex
+      if (len === compressedLen && (head === 0x02 || head === 0x03)) {
+        const x = utils.bytesToNumberBE(tail);
+        if (!utils.inRange(x, _1n, Fp.ORDER)) throw new Error('Point is not on curve');
+        const y2 = weierstrassEquation(x); // y² = x³ + ax + b
+        let y;
+        try {
+          y = Fp.sqrt(y2); // y = y² ^ (p+1)/4
+        } catch (sqrtError) {
+          const suffix = sqrtError instanceof Error ? ': ' + sqrtError.message : '';
+          throw new Error('Point is not on curve' + suffix);
+        }
+        const isYOdd = (y & _1n) === _1n;
+        // ECDSA
+        const isHeadOdd = (head & 1) === 1;
+        if (isHeadOdd !== isYOdd) y = Fp.neg(y);
+        return {
+          x,
+          y
+        };
+      } else if (len === uncompressedLen && head === 0x04) {
+        const x = Fp.fromBytes(tail.subarray(0, Fp.BYTES));
+        const y = Fp.fromBytes(tail.subarray(Fp.BYTES, 2 * Fp.BYTES));
+        return {
+          x,
+          y
+        };
+      } else {
+        const cl = compressedLen;
+        const ul = uncompressedLen;
+        throw new Error('invalid Point, expected length of ' + cl + ', or uncompressed ' + ul + ', got ' + len);
+      }
+    }
+  });
+  function isBiggerThanHalfOrder(number) {
+    const HALF = CURVE_ORDER >> _1n;
+    return number > HALF;
+  }
+  function normalizeS(s) {
+    return isBiggerThanHalfOrder(s) ? modN(-s) : s;
+  }
+  // slice bytes num
+  const slcNum = (b, from, to) => utils.bytesToNumberBE(b.slice(from, to));
+  /**
+   * ECDSA signature with its (r, s) properties. Supports DER & compact representations.
+   */
+  class Signature {
+    constructor(r, s, recovery) {
+      utils.aInRange('r', r, _1n, CURVE_ORDER); // r in [1..N]
+      utils.aInRange('s', s, _1n, CURVE_ORDER); // s in [1..N]
+      this.r = r;
+      this.s = s;
+      if (recovery != null) this.recovery = recovery;
+      Object.freeze(this);
+    }
+    // pair (bytes of r, bytes of s)
+    static fromCompact(hex) {
+      const l = nByteLength;
+      hex = utils.ensureBytes('compactSignature', hex, l * 2);
+      return new Signature(slcNum(hex, 0, l), slcNum(hex, l, 2 * l));
+    }
+    // DER encoded ECDSA signature
+    // https://bitcoin.stackexchange.com/questions/57644/what-are-the-parts-of-a-bitcoin-transaction-input-script
+    static fromDER(hex) {
+      const {
+        r,
+        s
+      } = DER.toSig(utils.ensureBytes('DER', hex));
+      return new Signature(r, s);
+    }
+    /**
+     * @todo remove
+     * @deprecated
+     */
+    assertValidity() {}
+    addRecoveryBit(recovery) {
+      return new Signature(this.r, this.s, recovery);
+    }
+    recoverPublicKey(msgHash) {
+      const {
+        r,
+        s,
+        recovery: rec
+      } = this;
+      const h = bits2int_modN(utils.ensureBytes('msgHash', msgHash)); // Truncate hash
+      if (rec == null || ![0, 1, 2, 3].includes(rec)) throw new Error('recovery id invalid');
+      const radj = rec === 2 || rec === 3 ? r + CURVE.n : r;
+      if (radj >= Fp.ORDER) throw new Error('recovery id 2 or 3 invalid');
+      const prefix = (rec & 1) === 0 ? '02' : '03';
+      const R = Point.fromHex(prefix + numToSizedHex(radj, Fp.BYTES));
+      const ir = invN(radj); // r^-1
+      const u1 = modN(-h * ir); // -hr^-1
+      const u2 = modN(s * ir); // sr^-1
+      const Q = Point.BASE.multiplyAndAddUnsafe(R, u1, u2); // (sr^-1)R-(hr^-1)G = -(hr^-1)G + (sr^-1)
+      if (!Q) throw new Error('point at infinify'); // unsafe is fine: no priv data leaked
+      Q.assertValidity();
+      return Q;
+    }
+    // Signatures should be low-s, to prevent malleability.
+    hasHighS() {
+      return isBiggerThanHalfOrder(this.s);
+    }
+    normalizeS() {
+      return this.hasHighS() ? new Signature(this.r, modN(-this.s), this.recovery) : this;
+    }
+    // DER-encoded
+    toDERRawBytes() {
+      return utils.hexToBytes(this.toDERHex());
+    }
+    toDERHex() {
+      return DER.hexFromSig(this);
+    }
+    // padded bytes of r, then padded bytes of s
+    toCompactRawBytes() {
+      return utils.hexToBytes(this.toCompactHex());
+    }
+    toCompactHex() {
+      const l = nByteLength;
+      return numToSizedHex(this.r, l) + numToSizedHex(this.s, l);
+    }
+  }
+  const utils$1 = {
+    isValidPrivateKey(privateKey) {
+      try {
+        normPrivateKeyToScalar(privateKey);
+        return true;
+      } catch (error) {
+        return false;
+      }
+    },
+    normPrivateKeyToScalar: normPrivateKeyToScalar,
+    /**
+     * Produces cryptographically secure private key from random of size
+     * (groupLen + ceil(groupLen / 2)) with modulo bias being negligible.
+     */
+    randomPrivateKey: () => {
+      const length = modular.getMinHashLength(CURVE.n);
+      return modular.mapHashToField(CURVE.randomBytes(length), CURVE.n);
+    },
+    /**
+     * Creates precompute table for an arbitrary EC point. Makes point "cached".
+     * Allows to massively speed-up `point.multiply(scalar)`.
+     * @returns cached point
+     * @example
+     * const fast = utils.precompute(8, ProjectivePoint.fromHex(someonesPubKey));
+     * fast.multiply(privKey); // much faster ECDH now
+     */
+    precompute() {
+      let windowSize = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : 8;
+      let point = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : Point.BASE;
+      point._setWindowSize(windowSize);
+      point.multiply(BigInt(3)); // 3 is arbitrary, just need any number here
+      return point;
+    }
+  };
+  /**
+   * Computes public key for a private key. Checks for validity of the private key.
+   * @param privateKey private key
+   * @param isCompressed whether to return compact (default), or full key
+   * @returns Public key, full when isCompressed=false; short when isCompressed=true
+   */
+  function getPublicKey(privateKey) {
+    let isCompressed = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : true;
+    return Point.fromPrivateKey(privateKey).toRawBytes(isCompressed);
+  }
+  /**
+   * Quick and dirty check for item being public key. Does not validate hex, or being on-curve.
+   */
+  function isProbPub(item) {
+    if (typeof item === 'bigint') return false;
+    if (item instanceof Point) return true;
+    const arr = utils.ensureBytes('key', item);
+    const len = arr.length;
+    const fpl = Fp.BYTES;
+    const compLen = fpl + 1; // e.g. 33 for 32
+    const uncompLen = 2 * fpl + 1; // e.g. 65 for 32
+    if (CURVE.allowedPrivateKeyLengths || nByteLength === compLen) {
+      return undefined;
+    } else {
+      return len === compLen || len === uncompLen;
+    }
+  }
+  /**
+   * ECDH (Elliptic Curve Diffie Hellman).
+   * Computes shared public key from private key and public key.
+   * Checks: 1) private key validity 2) shared key is on-curve.
+   * Does NOT hash the result.
+   * @param privateA private key
+   * @param publicB different public key
+   * @param isCompressed whether to return compact (default), or full key
+   * @returns shared public key
+   */
+  function getSharedSecret(privateA, publicB) {
+    let isCompressed = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : true;
+    if (isProbPub(privateA) === true) throw new Error('first arg must be private key');
+    if (isProbPub(publicB) === false) throw new Error('second arg must be public key');
+    const b = Point.fromHex(publicB); // check for being on-curve
+    return b.multiply(normPrivateKeyToScalar(privateA)).toRawBytes(isCompressed);
+  }
+  // RFC6979: ensure ECDSA msg is X bytes and < N. RFC suggests optional truncating via bits2octets.
+  // FIPS 186-4 4.6 suggests the leftmost min(nBitLen, outLen) bits, which matches bits2int.
+  // bits2int can produce res>N, we can do mod(res, N) since the bitLen is the same.
+  // int2octets can't be used; pads small msgs with 0: unacceptatble for trunc as per RFC vectors
+  const bits2int = CURVE.bits2int || function (bytes) {
+    // Our custom check "just in case", for protection against DoS
+    if (bytes.length > 8192) throw new Error('input is too large');
+    // For curves with nBitLength % 8 !== 0: bits2octets(bits2octets(m)) !== bits2octets(m)
+    // for some cases, since bytes.length * 8 is not actual bitLength.
+    const num = utils.bytesToNumberBE(bytes); // check for == u8 done here
+    const delta = bytes.length * 8 - nBitLength; // truncate to nBitLength leftmost bits
+    return delta > 0 ? num >> BigInt(delta) : num;
+  };
+  const bits2int_modN = CURVE.bits2int_modN || function (bytes) {
+    return modN(bits2int(bytes)); // can't use bytesToNumberBE here
+  };
+  // NOTE: pads output with zero as per spec
+  const ORDER_MASK = utils.bitMask(nBitLength);
+  /**
+   * Converts to bytes. Checks if num in `[0..ORDER_MASK-1]` e.g.: `[0..2^256-1]`.
+   */
+  function int2octets(num) {
+    utils.aInRange('num < 2^' + nBitLength, num, _0n, ORDER_MASK);
+    // works with order, can have different size than numToField!
+    return utils.numberToBytesBE(num, nByteLength);
+  }
+  // Steps A, D of RFC6979 3.2
+  // Creates RFC6979 seed; converts msg/privKey to numbers.
+  // Used only in sign, not in verify.
+  // NOTE: we cannot assume here that msgHash has same amount of bytes as curve order,
+  // this will be invalid at least for P521. Also it can be bigger for P224 + SHA256
+  function prepSig(msgHash, privateKey) {
+    let opts = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : defaultSigOpts;
+    if (['recovered', 'canonical'].some(k => k in opts)) throw new Error('sign() legacy options not supported');
+    const {
+      hash,
+      randomBytes
+    } = CURVE;
+    let {
+      lowS,
+      prehash,
+      extraEntropy: ent
+    } = opts; // generates low-s sigs by default
+    if (lowS == null) lowS = true; // RFC6979 3.2: we skip step A, because we already provide hash
+    msgHash = utils.ensureBytes('msgHash', msgHash);
+    validateSigVerOpts(opts);
+    if (prehash) msgHash = utils.ensureBytes('prehashed msgHash', hash(msgHash));
+    // We can't later call bits2octets, since nested bits2int is broken for curves
+    // with nBitLength % 8 !== 0. Because of that, we unwrap it here as int2octets call.
+    // const bits2octets = (bits) => int2octets(bits2int_modN(bits))
+    const h1int = bits2int_modN(msgHash);
+    const d = normPrivateKeyToScalar(privateKey); // validate private key, convert to bigint
+    const seedArgs = [int2octets(d), int2octets(h1int)];
+    // extraEntropy. RFC6979 3.6: additional k' (optional).
+    if (ent != null && ent !== false) {
+      // K = HMAC_K(V || 0x00 || int2octets(x) || bits2octets(h1) || k')
+      const e = ent === true ? randomBytes(Fp.BYTES) : ent; // generate random bytes OR pass as-is
+      seedArgs.push(utils.ensureBytes('extraEntropy', e)); // check for being bytes
+    }
+    const seed = utils.concatBytes(...seedArgs); // Step D of RFC6979 3.2
+    const m = h1int; // NOTE: no need to call bits2int second time here, it is inside truncateHash!
+    // Converts signature params into point w r/s, checks result for validity.
+    function k2sig(kBytes) {
+      // RFC 6979 Section 3.2, step 3: k = bits2int(T)
+      const k = bits2int(kBytes); // Cannot use fields methods, since it is group element
+      if (!isWithinCurveOrder(k)) return; // Important: all mod() calls here must be done over N
+      const ik = invN(k); // k^-1 mod n
+      const q = Point.BASE.multiply(k).toAffine(); // q = Gk
+      const r = modN(q.x); // r = q.x mod n
+      if (r === _0n) return;
+      // Can use scalar blinding b^-1(bm + bdr) where b ∈ [1,q−1] according to
+      // https://tches.iacr.org/index.php/TCHES/article/view/7337/6509. We've decided against it:
+      // a) dependency on CSPRNG b) 15% slowdown c) doesn't really help since bigints are not CT
+      const s = modN(ik * modN(m + r * d)); // Not using blinding here
+      if (s === _0n) return;
+      let recovery = (q.x === r ? 0 : 2) | Number(q.y & _1n); // recovery bit (2 or 3, when q.x > n)
+      let normS = s;
+      if (lowS && isBiggerThanHalfOrder(s)) {
+        normS = normalizeS(s); // if lowS was passed, ensure s is always
+        recovery ^= 1; // // in the bottom half of N
+      }
+      return new Signature(r, normS, recovery); // use normS, not s
+    }
+    return {
+      seed,
+      k2sig
+    };
+  }
+  const defaultSigOpts = {
+    lowS: CURVE.lowS,
+    prehash: false
+  };
+  const defaultVerOpts = {
+    lowS: CURVE.lowS,
+    prehash: false
+  };
+  /**
+   * Signs message hash with a private key.
+   * ```
+   * sign(m, d, k) where
+   *   (x, y) = G × k
+   *   r = x mod n
+   *   s = (m + dr)/k mod n
+   * ```
+   * @param msgHash NOT message. msg needs to be hashed to `msgHash`, or use `prehash`.
+   * @param privKey private key
+   * @param opts lowS for non-malleable sigs. extraEntropy for mixing randomness into k. prehash will hash first arg.
+   * @returns signature with recovery param
+   */
+  function sign(msgHash, privKey) {
+    let opts = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : defaultSigOpts;
+    const {
+      seed,
+      k2sig
+    } = prepSig(msgHash, privKey, opts); // Steps A, D of RFC6979 3.2.
+    const C = CURVE;
+    const drbg = utils.createHmacDrbg(C.hash.outputLen, C.nByteLength, C.hmac);
+    return drbg(seed, k2sig); // Steps B, C, D, E, F, G
+  }
+  // Enable precomputes. Slows down first publicKey computation by 20ms.
+  Point.BASE._setWindowSize(8);
+  // utils.precompute(8, ProjectivePoint.BASE)
+  /**
+   * Verifies a signature against message hash and public key.
+   * Rejects lowS signatures by default: to override,
+   * specify option `{lowS: false}`. Implements section 4.1.4 from https://www.secg.org/sec1-v2.pdf:
+   *
+   * ```
+   * verify(r, s, h, P) where
+   *   U1 = hs^-1 mod n
+   *   U2 = rs^-1 mod n
+   *   R = U1⋅G - U2⋅P
+   *   mod(R.x, n) == r
+   * ```
+   */
+  function verify(signature, msgHash, publicKey) {
+    let opts = arguments.length > 3 && arguments[3] !== undefined ? arguments[3] : defaultVerOpts;
+    const sg = signature;
+    msgHash = utils.ensureBytes('msgHash', msgHash);
+    publicKey = utils.ensureBytes('publicKey', publicKey);
+    const {
+      lowS,
+      prehash,
+      format
+    } = opts;
+    // Verify opts, deduce signature format
+    validateSigVerOpts(opts);
+    if ('strict' in opts) throw new Error('options.strict was renamed to lowS');
+    if (format !== undefined && format !== 'compact' && format !== 'der') throw new Error('format must be compact or der');
+    const isHex = typeof sg === 'string' || utils.isBytes(sg);
+    const isObj = !isHex && !format && typeof sg === 'object' && sg !== null && typeof sg.r === 'bigint' && typeof sg.s === 'bigint';
+    if (!isHex && !isObj) throw new Error('invalid signature, expected Uint8Array, hex string or Signature instance');
+    let _sig = undefined;
+    let P;
+    try {
+      if (isObj) _sig = new Signature(sg.r, sg.s);
+      if (isHex) {
+        // Signature can be represented in 2 ways: compact (2*nByteLength) & DER (variable-length).
+        // Since DER can also be 2*nByteLength bytes, we check for it first.
+        try {
+          if (format !== 'compact') _sig = Signature.fromDER(sg);
+        } catch (derError) {
+          if (!(derError instanceof DER.Err)) throw derError;
+        }
+        if (!_sig && format !== 'der') _sig = Signature.fromCompact(sg);
+      }
+      P = Point.fromHex(publicKey);
+    } catch (error) {
+      return false;
+    }
+    if (!_sig) return false;
+    if (lowS && _sig.hasHighS()) return false;
+    if (prehash) msgHash = CURVE.hash(msgHash);
+    const {
+      r,
+      s
+    } = _sig;
+    const h = bits2int_modN(msgHash); // Cannot use fields methods, since it is group element
+    const is = invN(s); // s^-1
+    const u1 = modN(h * is); // u1 = hs^-1 mod n
+    const u2 = modN(r * is); // u2 = rs^-1 mod n
+    const R = Point.BASE.multiplyAndAddUnsafe(P, u1, u2)?.toAffine(); // R = u1⋅G + u2⋅P
+    if (!R) return false;
+    const v = modN(R.x);
+    return v === r;
+  }
+  return {
+    CURVE,
+    getPublicKey,
+    getSharedSecret,
+    sign,
+    verify,
+    ProjectivePoint: Point,
+    Signature,
+    utils: utils$1
+  };
+}
+
+exports.DER = DER;
+exports.DERErr = DERErr;
+exports.weierstrass = weierstrass;
+exports.weierstrassPoints = weierstrassPoints;