web-dc-api 0.0.58 → 0.0.60

package/dist/cjs/node_modules/@noble/curves/esm/abstract/modular.js

@@ -0,0 +1,410 @@
+'use strict';
+
+var utils$1 = require('../../../hashes/esm/utils.js');
+var utils = require('./utils.js');
+
+/**
+ * Utils for modular division and finite fields.
+ * A finite field over 11 is integer number operations `mod 11`.
+ * There is no division: it is replaced by modular multiplicative inverse.
+ * @module
+ */
+/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+// prettier-ignore
+const _0n = BigInt(0),
+  _1n = BigInt(1),
+  _2n = /* @__PURE__ */BigInt(2),
+  _3n = /* @__PURE__ */BigInt(3);
+// prettier-ignore
+const _4n = /* @__PURE__ */BigInt(4),
+  _5n = /* @__PURE__ */BigInt(5),
+  _8n = /* @__PURE__ */BigInt(8);
+// Calculates a modulo b
+function mod(a, b) {
+  const result = a % b;
+  return result >= _0n ? result : b + result;
+}
+/** Does `x^(2^power)` mod p. `pow2(30, 4)` == `30^(2^4)` */
+function pow2(x, power, modulo) {
+  let res = x;
+  while (power-- > _0n) {
+    res *= res;
+    res %= modulo;
+  }
+  return res;
+}
+/**
+ * Inverses number over modulo.
+ * Implemented using [Euclidean GCD](https://brilliant.org/wiki/extended-euclidean-algorithm/).
+ */
+function invert(number, modulo) {
+  if (number === _0n) throw new Error('invert: expected non-zero number');
+  if (modulo <= _0n) throw new Error('invert: expected positive modulus, got ' + modulo);
+  // Fermat's little theorem "CT-like" version inv(n) = n^(m-2) mod m is 30x slower.
+  let a = mod(number, modulo);
+  let b = modulo;
+  // prettier-ignore
+  let x = _0n,
+    u = _1n;
+  while (a !== _0n) {
+    // JIT applies optimization if those two lines follow each other
+    const q = b / a;
+    const r = b % a;
+    const m = x - u * q;
+    // prettier-ignore
+    b = a, a = r, x = u, u = m;
+  }
+  const gcd = b;
+  if (gcd !== _1n) throw new Error('invert: does not exist');
+  return mod(x, modulo);
+}
+// Not all roots are possible! Example which will throw:
+// const NUM =
+// n = 72057594037927816n;
+// Fp = Field(BigInt('0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab'));
+function sqrt3mod4(Fp, n) {
+  const p1div4 = (Fp.ORDER + _1n) / _4n;
+  const root = Fp.pow(n, p1div4);
+  // Throw if root^2 != n
+  if (!Fp.eql(Fp.sqr(root), n)) throw new Error('Cannot find square root');
+  return root;
+}
+function sqrt5mod8(Fp, n) {
+  const p5div8 = (Fp.ORDER - _5n) / _8n;
+  const n2 = Fp.mul(n, _2n);
+  const v = Fp.pow(n2, p5div8);
+  const nv = Fp.mul(n, v);
+  const i = Fp.mul(Fp.mul(nv, _2n), v);
+  const root = Fp.mul(nv, Fp.sub(i, Fp.ONE));
+  if (!Fp.eql(Fp.sqr(root), n)) throw new Error('Cannot find square root');
+  return root;
+}
+// TODO: Commented-out for now. Provide test vectors.
+// Tonelli is too slow for extension fields Fp2.
+// That means we can't use sqrt (c1, c2...) even for initialization constants.
+// if (P % _16n === _9n) return sqrt9mod16;
+// // prettier-ignore
+// function sqrt9mod16<T>(Fp: IField<T>, n: T, p7div16?: bigint) {
+//   if (p7div16 === undefined) p7div16 = (Fp.ORDER + BigInt(7)) / _16n;
+//   const c1 = Fp.sqrt(Fp.neg(Fp.ONE)); //  1. c1 = sqrt(-1) in F, i.e., (c1^2) == -1 in F
+//   const c2 = Fp.sqrt(c1);             //  2. c2 = sqrt(c1) in F, i.e., (c2^2) == c1 in F
+//   const c3 = Fp.sqrt(Fp.neg(c1));     //  3. c3 = sqrt(-c1) in F, i.e., (c3^2) == -c1 in F
+//   const c4 = p7div16;                 //  4. c4 = (q + 7) / 16        # Integer arithmetic
+//   let tv1 = Fp.pow(n, c4);            //  1. tv1 = x^c4
+//   let tv2 = Fp.mul(c1, tv1);          //  2. tv2 = c1 * tv1
+//   const tv3 = Fp.mul(c2, tv1);        //  3. tv3 = c2 * tv1
+//   let tv4 = Fp.mul(c3, tv1);          //  4. tv4 = c3 * tv1
+//   const e1 = Fp.eql(Fp.sqr(tv2), n);  //  5.  e1 = (tv2^2) == x
+//   const e2 = Fp.eql(Fp.sqr(tv3), n);  //  6.  e2 = (tv3^2) == x
+//   tv1 = Fp.cmov(tv1, tv2, e1); //  7. tv1 = CMOV(tv1, tv2, e1)  # Select tv2 if (tv2^2) == x
+//   tv2 = Fp.cmov(tv4, tv3, e2); //  8. tv2 = CMOV(tv4, tv3, e2)  # Select tv3 if (tv3^2) == x
+//   const e3 = Fp.eql(Fp.sqr(tv2), n);  //  9.  e3 = (tv2^2) == x
+//   return Fp.cmov(tv1, tv2, e3); // 10.  z = CMOV(tv1, tv2, e3) # Select the sqrt from tv1 and tv2
+// }
+/**
+ * Tonelli-Shanks square root search algorithm.
+ * 1. https://eprint.iacr.org/2012/685.pdf (page 12)
+ * 2. Square Roots from 1; 24, 51, 10 to Dan Shanks
+ * @param P field order
+ * @returns function that takes field Fp (created from P) and number n
+ */
+function tonelliShanks(P) {
+  // Initialization (precomputation).
+  if (P < BigInt(3)) throw new Error('sqrt is not defined for small field');
+  // Factor P - 1 = Q * 2^S, where Q is odd
+  let Q = P - _1n;
+  let S = 0;
+  while (Q % _2n === _0n) {
+    Q /= _2n;
+    S++;
+  }
+  // Find the first quadratic non-residue Z >= 2
+  let Z = _2n;
+  const _Fp = Field(P);
+  while (FpLegendre(_Fp, Z) === 1) {
+    // Basic primality test for P. After x iterations, chance of
+    // not finding quadratic non-residue is 2^x, so 2^1000.
+    if (Z++ > 1000) throw new Error('Cannot find square root: probably non-prime P');
+  }
+  // Fast-path; usually done before Z, but we do "primality test".
+  if (S === 1) return sqrt3mod4;
+  // Slow-path
+  // TODO: test on Fp2 and others
+  let cc = _Fp.pow(Z, Q); // c = z^Q
+  const Q1div2 = (Q + _1n) / _2n;
+  return function tonelliSlow(Fp, n) {
+    if (Fp.is0(n)) return n;
+    // Check if n is a quadratic residue using Legendre symbol
+    if (FpLegendre(Fp, n) !== 1) throw new Error('Cannot find square root');
+    // Initialize variables for the main loop
+    let M = S;
+    let c = Fp.mul(Fp.ONE, cc); // c = z^Q, move cc from field _Fp into field Fp
+    let t = Fp.pow(n, Q); // t = n^Q, first guess at the fudge factor
+    let R = Fp.pow(n, Q1div2); // R = n^((Q+1)/2), first guess at the square root
+    // Main loop
+    // while t != 1
+    while (!Fp.eql(t, Fp.ONE)) {
+      if (Fp.is0(t)) return Fp.ZERO; // if t=0 return R=0
+      let i = 1;
+      // Find the smallest i >= 1 such that t^(2^i) ≡ 1 (mod P)
+      let t_tmp = Fp.sqr(t); // t^(2^1)
+      while (!Fp.eql(t_tmp, Fp.ONE)) {
+        i++;
+        t_tmp = Fp.sqr(t_tmp); // t^(2^2)...
+        if (i === M) throw new Error('Cannot find square root');
+      }
+      // Calculate the exponent for b: 2^(M - i - 1)
+      const exponent = _1n << BigInt(M - i - 1); // bigint is important
+      const b = Fp.pow(c, exponent); // b = 2^(M - i - 1)
+      // Update variables
+      M = i;
+      c = Fp.sqr(b); // c = b^2
+      t = Fp.mul(t, c); // t = (t * b^2)
+      R = Fp.mul(R, b); // R = R*b
+    }
+    return R;
+  };
+}
+/**
+ * Square root for a finite field. Will try optimized versions first:
+ *
+ * 1. P ≡ 3 (mod 4)
+ * 2. P ≡ 5 (mod 8)
+ * 3. Tonelli-Shanks algorithm
+ *
+ * Different algorithms can give different roots, it is up to user to decide which one they want.
+ * For example there is FpSqrtOdd/FpSqrtEven to choice root based on oddness (used for hash-to-curve).
+ */
+function FpSqrt(P) {
+  // P ≡ 3 (mod 4) => √n = n^((P+1)/4)
+  if (P % _4n === _3n) return sqrt3mod4;
+  // P ≡ 5 (mod 8) => Atkin algorithm, page 10 of https://eprint.iacr.org/2012/685.pdf
+  if (P % _8n === _5n) return sqrt5mod8;
+  // P ≡ 9 (mod 16) not implemented, see above
+  // Tonelli-Shanks algorithm
+  return tonelliShanks(P);
+}
+// Little-endian check for first LE bit (last BE bit);
+const isNegativeLE = (num, modulo) => (mod(num, modulo) & _1n) === _1n;
+// prettier-ignore
+const FIELD_FIELDS = ['create', 'isValid', 'is0', 'neg', 'inv', 'sqrt', 'sqr', 'eql', 'add', 'sub', 'mul', 'pow', 'div', 'addN', 'subN', 'mulN', 'sqrN'];
+function validateField(field) {
+  const initial = {
+    ORDER: 'bigint',
+    MASK: 'bigint',
+    BYTES: 'isSafeInteger',
+    BITS: 'isSafeInteger'
+  };
+  const opts = FIELD_FIELDS.reduce((map, val) => {
+    map[val] = 'function';
+    return map;
+  }, initial);
+  return utils.validateObject(field, opts);
+}
+// Generic field functions
+/**
+ * Same as `pow` but for Fp: non-constant-time.
+ * Unsafe in some contexts: uses ladder, so can expose bigint bits.
+ */
+function FpPow(Fp, num, power) {
+  if (power < _0n) throw new Error('invalid exponent, negatives unsupported');
+  if (power === _0n) return Fp.ONE;
+  if (power === _1n) return num;
+  let p = Fp.ONE;
+  let d = num;
+  while (power > _0n) {
+    if (power & _1n) p = Fp.mul(p, d);
+    d = Fp.sqr(d);
+    power >>= _1n;
+  }
+  return p;
+}
+/**
+ * Efficiently invert an array of Field elements.
+ * Exception-free. Will return `undefined` for 0 elements.
+ * @param passZero map 0 to 0 (instead of undefined)
+ */
+function FpInvertBatch(Fp, nums) {
+  let passZero = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : false;
+  const inverted = new Array(nums.length).fill(passZero ? Fp.ZERO : undefined);
+  // Walk from first to last, multiply them by each other MOD p
+  const multipliedAcc = nums.reduce((acc, num, i) => {
+    if (Fp.is0(num)) return acc;
+    inverted[i] = acc;
+    return Fp.mul(acc, num);
+  }, Fp.ONE);
+  // Invert last element
+  const invertedAcc = Fp.inv(multipliedAcc);
+  // Walk from last to first, multiply them by inverted each other MOD p
+  nums.reduceRight((acc, num, i) => {
+    if (Fp.is0(num)) return acc;
+    inverted[i] = Fp.mul(acc, inverted[i]);
+    return Fp.mul(acc, num);
+  }, invertedAcc);
+  return inverted;
+}
+/**
+ * Legendre symbol.
+ * Legendre constant is used to calculate Legendre symbol (a | p)
+ * which denotes the value of a^((p-1)/2) (mod p).
+ *
+ * * (a | p) ≡ 1    if a is a square (mod p), quadratic residue
+ * * (a | p) ≡ -1   if a is not a square (mod p), quadratic non residue
+ * * (a | p) ≡ 0    if a ≡ 0 (mod p)
+ */
+function FpLegendre(Fp, n) {
+  // We can use 3rd argument as optional cache of this value
+  // but seems unneeded for now. The operation is very fast.
+  const p1mod2 = (Fp.ORDER - _1n) / _2n;
+  const powered = Fp.pow(n, p1mod2);
+  const yes = Fp.eql(powered, Fp.ONE);
+  const zero = Fp.eql(powered, Fp.ZERO);
+  const no = Fp.eql(powered, Fp.neg(Fp.ONE));
+  if (!yes && !zero && !no) throw new Error('invalid Legendre symbol result');
+  return yes ? 1 : zero ? 0 : -1;
+}
+// CURVE.n lengths
+function nLength(n, nBitLength) {
+  // Bit size, byte size of CURVE.n
+  if (nBitLength !== undefined) utils$1.anumber(nBitLength);
+  const _nBitLength = nBitLength !== undefined ? nBitLength : n.toString(2).length;
+  const nByteLength = Math.ceil(_nBitLength / 8);
+  return {
+    nBitLength: _nBitLength,
+    nByteLength
+  };
+}
+/**
+ * Initializes a finite field over prime.
+ * Major performance optimizations:
+ * * a) denormalized operations like mulN instead of mul
+ * * b) same object shape: never add or remove keys
+ * * c) Object.freeze
+ * Fragile: always run a benchmark on a change.
+ * Security note: operations don't check 'isValid' for all elements for performance reasons,
+ * it is caller responsibility to check this.
+ * This is low-level code, please make sure you know what you're doing.
+ * @param ORDER prime positive bigint
+ * @param bitLen how many bits the field consumes
+ * @param isLE (def: false) if encoding / decoding should be in little-endian
+ * @param redef optional faster redefinitions of sqrt and other methods
+ */
+function Field(ORDER, bitLen) {
+  let isLE = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : false;
+  let redef = arguments.length > 3 && arguments[3] !== undefined ? arguments[3] : {};
+  if (ORDER <= _0n) throw new Error('invalid field: expected ORDER > 0, got ' + ORDER);
+  const {
+    nBitLength: BITS,
+    nByteLength: BYTES
+  } = nLength(ORDER, bitLen);
+  if (BYTES > 2048) throw new Error('invalid field: expected ORDER of <= 2048 bytes');
+  let sqrtP; // cached sqrtP
+  const f = Object.freeze({
+    ORDER,
+    isLE,
+    BITS,
+    BYTES,
+    MASK: utils.bitMask(BITS),
+    ZERO: _0n,
+    ONE: _1n,
+    create: num => mod(num, ORDER),
+    isValid: num => {
+      if (typeof num !== 'bigint') throw new Error('invalid field element: expected bigint, got ' + typeof num);
+      return _0n <= num && num < ORDER; // 0 is valid element, but it's not invertible
+    },
+    is0: num => num === _0n,
+    isOdd: num => (num & _1n) === _1n,
+    neg: num => mod(-num, ORDER),
+    eql: (lhs, rhs) => lhs === rhs,
+    sqr: num => mod(num * num, ORDER),
+    add: (lhs, rhs) => mod(lhs + rhs, ORDER),
+    sub: (lhs, rhs) => mod(lhs - rhs, ORDER),
+    mul: (lhs, rhs) => mod(lhs * rhs, ORDER),
+    pow: (num, power) => FpPow(f, num, power),
+    div: (lhs, rhs) => mod(lhs * invert(rhs, ORDER), ORDER),
+    // Same as above, but doesn't normalize
+    sqrN: num => num * num,
+    addN: (lhs, rhs) => lhs + rhs,
+    subN: (lhs, rhs) => lhs - rhs,
+    mulN: (lhs, rhs) => lhs * rhs,
+    inv: num => invert(num, ORDER),
+    sqrt: redef.sqrt || (n => {
+      if (!sqrtP) sqrtP = FpSqrt(ORDER);
+      return sqrtP(f, n);
+    }),
+    toBytes: num => isLE ? utils.numberToBytesLE(num, BYTES) : utils.numberToBytesBE(num, BYTES),
+    fromBytes: bytes => {
+      if (bytes.length !== BYTES) throw new Error('Field.fromBytes: expected ' + BYTES + ' bytes, got ' + bytes.length);
+      return isLE ? utils.bytesToNumberLE(bytes) : utils.bytesToNumberBE(bytes);
+    },
+    // TODO: we don't need it here, move out to separate fn
+    invertBatch: lst => FpInvertBatch(f, lst),
+    // We can't move this out because Fp6, Fp12 implement it
+    // and it's unclear what to return in there.
+    cmov: (a, b, c) => c ? b : a
+  });
+  return Object.freeze(f);
+}
+/**
+ * Returns total number of bytes consumed by the field element.
+ * For example, 32 bytes for usual 256-bit weierstrass curve.
+ * @param fieldOrder number of field elements, usually CURVE.n
+ * @returns byte length of field
+ */
+function getFieldBytesLength(fieldOrder) {
+  if (typeof fieldOrder !== 'bigint') throw new Error('field order must be bigint');
+  const bitLength = fieldOrder.toString(2).length;
+  return Math.ceil(bitLength / 8);
+}
+/**
+ * Returns minimal amount of bytes that can be safely reduced
+ * by field order.
+ * Should be 2^-128 for 128-bit curve such as P256.
+ * @param fieldOrder number of field elements, usually CURVE.n
+ * @returns byte length of target hash
+ */
+function getMinHashLength(fieldOrder) {
+  const length = getFieldBytesLength(fieldOrder);
+  return length + Math.ceil(length / 2);
+}
+/**
+ * "Constant-time" private key generation utility.
+ * Can take (n + n/2) or more bytes of uniform input e.g. from CSPRNG or KDF
+ * and convert them into private scalar, with the modulo bias being negligible.
+ * Needs at least 48 bytes of input for 32-byte private key.
+ * https://research.kudelskisecurity.com/2020/07/28/the-definitive-guide-to-modulo-bias-and-how-to-avoid-it/
+ * FIPS 186-5, A.2 https://csrc.nist.gov/publications/detail/fips/186/5/final
+ * RFC 9380, https://www.rfc-editor.org/rfc/rfc9380#section-5
+ * @param hash hash output from SHA3 or a similar function
+ * @param groupOrder size of subgroup - (e.g. secp256k1.CURVE.n)
+ * @param isLE interpret hash bytes as LE num
+ * @returns valid private scalar
+ */
+function mapHashToField(key, fieldOrder) {
+  let isLE = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : false;
+  const len = key.length;
+  const fieldLen = getFieldBytesLength(fieldOrder);
+  const minLen = getMinHashLength(fieldOrder);
+  // No small numbers: need to understand bias story. No huge numbers: easier to detect JS timings.
+  if (len < 16 || len < minLen || len > 1024) throw new Error('expected ' + minLen + '-1024 bytes of input, got ' + len);
+  const num = isLE ? utils.bytesToNumberLE(key) : utils.bytesToNumberBE(key);
+  // `mod(x, 11)` can sometimes produce 0. `mod(x, 10) + 1` is the same, but no 0
+  const reduced = mod(num, fieldOrder - _1n) + _1n;
+  return isLE ? utils.numberToBytesLE(reduced, fieldLen) : utils.numberToBytesBE(reduced, fieldLen);
+}
+
+exports.Field = Field;
+exports.FpInvertBatch = FpInvertBatch;
+exports.FpLegendre = FpLegendre;
+exports.FpPow = FpPow;
+exports.FpSqrt = FpSqrt;
+exports.getFieldBytesLength = getFieldBytesLength;
+exports.getMinHashLength = getMinHashLength;
+exports.invert = invert;
+exports.isNegativeLE = isNegativeLE;
+exports.mapHashToField = mapHashToField;
+exports.mod = mod;
+exports.nLength = nLength;
+exports.pow2 = pow2;
+exports.tonelliShanks = tonelliShanks;
+exports.validateField = validateField;

package/dist/cjs/node_modules/@noble/curves/esm/abstract/montgomery.js

@@ -0,0 +1,160 @@
+'use strict';
+
+var modular = require('./modular.js');
+var utils = require('./utils.js');
+
+/**
+ * Montgomery curve methods. It's not really whole montgomery curve,
+ * just bunch of very specific methods for X25519 / X448 from
+ * [RFC 7748](https://www.rfc-editor.org/rfc/rfc7748)
+ * @module
+ */
+/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+const _0n = BigInt(0);
+const _1n = BigInt(1);
+const _2n = BigInt(2);
+function validateOpts(curve) {
+  utils.validateObject(curve, {
+    adjustScalarBytes: 'function',
+    powPminus2: 'function'
+  });
+  return Object.freeze({
+    ...curve
+  });
+}
+function montgomery(curveDef) {
+  const CURVE = validateOpts(curveDef);
+  const {
+    P,
+    type,
+    adjustScalarBytes,
+    powPminus2
+  } = CURVE;
+  const is25519 = type === 'x25519';
+  if (!is25519 && type !== 'x448') throw new Error('invalid type');
+  const montgomeryBits = is25519 ? 255 : 448;
+  const fieldLen = is25519 ? 32 : 56;
+  const Gu = is25519 ? BigInt(9) : BigInt(5);
+  // RFC 7748 #5:
+  // The constant a24 is (486662 - 2) / 4 = 121665 for curve25519/X25519 and
+  // (156326 - 2) / 4 = 39081 for curve448/X448
+  // const a = is25519 ? 156326n : 486662n;
+  const a24 = is25519 ? BigInt(121665) : BigInt(39081);
+  // RFC: x25519 "the resulting integer is of the form 2^254 plus
+  // eight times a value between 0 and 2^251 - 1 (inclusive)"
+  // x448: "2^447 plus four times a value between 0 and 2^445 - 1 (inclusive)"
+  const minScalar = is25519 ? _2n ** BigInt(254) : _2n ** BigInt(447);
+  const maxAdded = is25519 ? BigInt(8) * _2n ** BigInt(251) - _1n : BigInt(4) * _2n ** BigInt(445) - _1n;
+  const maxScalar = minScalar + maxAdded + _1n; // (inclusive)
+  const modP = n => modular.mod(n, P);
+  const GuBytes = encodeU(Gu);
+  function encodeU(u) {
+    return utils.numberToBytesLE(modP(u), fieldLen);
+  }
+  function decodeU(u) {
+    const _u = utils.ensureBytes('u coordinate', u, fieldLen);
+    // RFC: When receiving such an array, implementations of X25519
+    // (but not X448) MUST mask the most significant bit in the final byte.
+    if (is25519) _u[31] &= 127; // 0b0111_1111
+    // RFC: Implementations MUST accept non-canonical values and process them as
+    // if they had been reduced modulo the field prime.  The non-canonical
+    // values are 2^255 - 19 through 2^255 - 1 for X25519 and 2^448 - 2^224
+    // - 1 through 2^448 - 1 for X448.
+    return modP(utils.bytesToNumberLE(_u));
+  }
+  function decodeScalar(scalar) {
+    return utils.bytesToNumberLE(adjustScalarBytes(utils.ensureBytes('scalar', scalar, fieldLen)));
+  }
+  function scalarMult(scalar, u) {
+    const pu = montgomeryLadder(decodeU(u), decodeScalar(scalar));
+    // Some public keys are useless, of low-order. Curve author doesn't think
+    // it needs to be validated, but we do it nonetheless.
+    // https://cr.yp.to/ecdh.html#validate
+    if (pu === _0n) throw new Error('invalid private or public key received');
+    return encodeU(pu);
+  }
+  // Computes public key from private. By doing scalar multiplication of base point.
+  function scalarMultBase(scalar) {
+    return scalarMult(scalar, GuBytes);
+  }
+  // cswap from RFC7748 "example code"
+  function cswap(swap, x_2, x_3) {
+    // dummy = mask(swap) AND (x_2 XOR x_3)
+    // Where mask(swap) is the all-1 or all-0 word of the same length as x_2
+    // and x_3, computed, e.g., as mask(swap) = 0 - swap.
+    const dummy = modP(swap * (x_2 - x_3));
+    x_2 = modP(x_2 - dummy); // x_2 = x_2 XOR dummy
+    x_3 = modP(x_3 + dummy); // x_3 = x_3 XOR dummy
+    return {
+      x_2,
+      x_3
+    };
+  }
+  /**
+   * Montgomery x-only multiplication ladder.
+   * @param pointU u coordinate (x) on Montgomery Curve 25519
+   * @param scalar by which the point would be multiplied
+   * @returns new Point on Montgomery curve
+   */
+  function montgomeryLadder(u, scalar) {
+    utils.aInRange('u', u, _0n, P);
+    utils.aInRange('scalar', scalar, minScalar, maxScalar);
+    const k = scalar;
+    const x_1 = u;
+    let x_2 = _1n;
+    let z_2 = _0n;
+    let x_3 = u;
+    let z_3 = _1n;
+    let swap = _0n;
+    for (let t = BigInt(montgomeryBits - 1); t >= _0n; t--) {
+      const k_t = k >> t & _1n;
+      swap ^= k_t;
+      ({
+        x_2,
+        x_3
+      } = cswap(swap, x_2, x_3));
+      ({
+        x_2: z_2,
+        x_3: z_3
+      } = cswap(swap, z_2, z_3));
+      swap = k_t;
+      const A = x_2 + z_2;
+      const AA = modP(A * A);
+      const B = x_2 - z_2;
+      const BB = modP(B * B);
+      const E = AA - BB;
+      const C = x_3 + z_3;
+      const D = x_3 - z_3;
+      const DA = modP(D * A);
+      const CB = modP(C * B);
+      const dacb = DA + CB;
+      const da_cb = DA - CB;
+      x_3 = modP(dacb * dacb);
+      z_3 = modP(x_1 * modP(da_cb * da_cb));
+      x_2 = modP(AA * BB);
+      z_2 = modP(E * (AA + modP(a24 * E)));
+    }
+    ({
+      x_2,
+      x_3
+    } = cswap(swap, x_2, x_3));
+    ({
+      x_2: z_2,
+      x_3: z_3
+    } = cswap(swap, z_2, z_3));
+    const z2 = powPminus2(z_2); // `Fp.pow(x, P - _2n)` is much slower equivalent
+    return modP(x_2 * z2); // Return x_2 * (z_2^(p - 2))
+  }
+  return {
+    scalarMult,
+    scalarMultBase,
+    getSharedSecret: (privateKey, publicKey) => scalarMult(privateKey, publicKey),
+    getPublicKey: privateKey => scalarMultBase(privateKey),
+    utils: {
+      randomPrivateKey: () => CURVE.randomBytes(fieldLen)
+    },
+    GuBytes: GuBytes.slice()
+  };
+}
+
+exports.montgomery = montgomery;