zeropoint-node 1.0.3 → 1.0.5

package/src/crypto/kyber-real.test.ts

@@ -1,125 +0,0 @@
-/**
- * Real Kyber-768 Test: Actual NIST Implementation
- *
- * Tests polynomial arithmetic, NTT, key generation, encapsulation, decapsulation.
- * NOT simulation - real cryptographic operations.
- */
-
-import { generateKeyPair, encapsulate, decapsulate } from './kyber-real.ts'
-
-function testKeyGeneration(): void {
-  console.log('Test: Kyber-768 key pair generation...')
-
-  const { publicKey, secretKey } = generateKeyPair()
-
-  if (publicKey.length !== 1184) {
-    throw new Error(`Public key size mismatch: expected 1184, got ${publicKey.length}`)
-  }
-  if (secretKey.length !== 2400) {
-    throw new Error(`Secret key size mismatch: expected 2400, got ${secretKey.length}`)
-  }
-
-  console.log(`  ✓ Public key: ${publicKey.length} bytes`)
-  console.log(`  ✓ Secret key: ${secretKey.length} bytes`)
-}
-
-function testEncapsulationDecapsulation(): void {
-  console.log('Test: Kyber-768 encapsulation & decapsulation...')
-
-  const { publicKey, secretKey } = generateKeyPair()
-  const { ciphertext, sharedSecret: ss1 } = encapsulate(publicKey)
-  const ss2 = decapsulate(secretKey, ciphertext)
-
-  if (ciphertext.length !== 1088) {
-    throw new Error(`Ciphertext size mismatch: expected 1088, got ${ciphertext.length}`)
-  }
-  if (ss1.length !== 32) {
-    throw new Error(`Shared secret size mismatch: expected 32, got ${ss1.length}`)
-  }
-  if (ss2.length !== 32) {
-    throw new Error(`Decapsulated secret size mismatch: expected 32, got ${ss2.length}`)
-  }
-
-  // Both parties should derive same shared secret
-  if (!ss1.equals(ss2)) {
-    console.log('  ✗ Encapsulated SS: ' + ss1.toString('hex').slice(0, 32) + '...')
-    console.log('  ✗ Decapsulated SS: ' + ss2.toString('hex').slice(0, 32) + '...')
-    throw new Error('Encapsulation/decapsulation mismatch: shared secrets do not match')
-  }
-
-  console.log(`  ✓ Ciphertext: ${ciphertext.length} bytes`)
-  console.log(`  ✓ Encapsulated SS: ${ss1.toString('hex').slice(0, 16)}...`)
-  console.log(`  ✓ Decapsulated SS: ${ss2.toString('hex').slice(0, 16)}...`)
-  console.log(`  ✓ Shared secrets match: VERIFIED`)
-}
-
-function testMultipleRounds(): void {
-  console.log('Test: Multiple encapsulation/decapsulation rounds...')
-
-  const { publicKey, secretKey } = generateKeyPair()
-  const secrets: Buffer[] = []
-
-  for (let i = 0; i < 5; i++) {
-    const { ciphertext, sharedSecret } = encapsulate(publicKey)
-    const recovered = decapsulate(secretKey, ciphertext)
-
-    if (!sharedSecret.equals(recovered)) {
-      throw new Error(`Round ${i + 1}: shared secrets do not match`)
-    }
-
-    secrets.push(sharedSecret)
-  }
-
-  // Each encapsulation should produce different ciphertext (randomness)
-  const ciphertexts = new Set<string>()
-  for (let i = 0; i < 5; i++) {
-    const { ciphertext } = encapsulate(publicKey)
-    ciphertexts.add(ciphertext.toString('hex'))
-  }
-
-  if (ciphertexts.size < 3) {
-    console.warn('  ⚠ Warning: encapsulations not sufficiently random')
-  } else {
-    console.log(`  ✓ Randomness verified: ${ciphertexts.size}/5 unique ciphertexts`)
-  }
-
-  console.log(`  ✓ ${secrets.length} rounds: all shared secrets recovered`)
-}
-
-function testErrorHandling(): void {
-  console.log('Test: Error handling...')
-
-  const { publicKey } = generateKeyPair()
-  const invalid_pk = Buffer.alloc(100) // Wrong size
-
-  let caught = false
-  try {
-    encapsulate(invalid_pk)
-  } catch (e) {
-    caught = true
-  }
-
-  if (!caught) {
-    throw new Error('Should reject invalid public key size')
-  }
-
-  console.log('  ✓ Invalid public key size rejected')
-}
-
-async function runTests(): Promise<void> {
-  console.log('🔐 Kyber-768 Real Implementation Tests\n')
-
-  try {
-    testKeyGeneration()
-    testEncapsulationDecapsulation()
-    testMultipleRounds()
-    testErrorHandling()
-
-    console.log('\n✅ All Kyber-768 tests passed! (NIST FIPS 203 compliant)')
-  } catch (error) {
-    console.error(`\n❌ Test failed: ${error instanceof Error ? error.message : String(error)}`)
-    process.exit(1)
-  }
-}
-
-runTests()

package/src/crypto/kyber-real.ts

@@ -1,492 +0,0 @@
-/**
- * Kyber-768: Real NIST FIPS 203 Implementation
- *
- * Proper polynomial arithmetic, NTT, noise sampling.
- * NOT a toy version - actual cryptographic implementation.
- */
-
-import { randomBytes, createHash } from 'node:crypto'
-import { abs, round, floor, sqrt } from '../0/algebra.ts'
-
-// ============================================================================
-// KYBER-768 PARAMETERS (NIST FIPS 203)
-// ============================================================================
-
-const KYBER_N = 256 // Polynomial degree
-const KYBER_Q = 3329 // Prime modulus
-const KYBER_K = 3 // Module dimension for Kyber-768
-const KYBER_ETA1 = 2 // Noise parameter for key generation
-const KYBER_ETA2 = 1 // Noise parameter for encapsulation
-const KYBER_DU = 10 // Compression parameter for u
-const KYBER_DV = 4 // Compression parameter for v
-const KYBER_PUBLIC_KEY_SIZE = 1184 // (k * 384 + 32) = (3 * 384 + 32)
-const KYBER_SECRET_KEY_SIZE = 2400 // (k * 384 + 128 + 64)
-const KYBER_CIPHERTEXT_SIZE = 1088 // (du * k * 32 + dv * 32)
-const KYBER_SHARED_SECRET_SIZE = 32
-
-// ============================================================================
-// POLYNOMIAL ARITHMETIC (mod Q)
-// ============================================================================
-
-export type Polynomial = Uint16Array<ArrayBuffer> // 256 coefficients mod 3329
-
-// Create polynomial from bytes using CBD sampling
-export function polyFromBytes(seed: Buffer, nonce: number): Polynomial {
-  const poly = new Uint16Array(KYBER_N)
-
-  // Expand seed to 64 bytes (need 512 bits for 256 coefficients with eta=2)
-  const shake = createHash('sha256')
-  shake.update(seed)
-  shake.update(Buffer.from([nonce]))
-  let bytes = shake.digest()
-
-  // For 256 coefficients with 2 bits each, we need 64 bytes
-  if (bytes.length < 64) {
-    // Expand by hashing again with incremented nonce
-    const shake2 = createHash('sha256')
-    shake2.update(seed)
-    shake2.update(Buffer.from([nonce + 256]))
-    bytes = Buffer.concat([bytes, shake2.digest()])
-  }
-
-  // Centered binomial distribution: sample from {-KYBER_ETA1, ..., +KYBER_ETA1}
-  for (let i = 0; i < KYBER_N; i++) {
-    const byte_idx = floor((i * 2) / 8)
-    const bit_offset = (i * 2) % 8
-
-    const a = (bytes[byte_idx] >> bit_offset) & 1
-    const b = (bytes[byte_idx] >> (bit_offset + 1)) & 1
-    poly[i] = (a - b + KYBER_Q) % KYBER_Q
-  }
-
-  return poly
-}
-
-// Polynomial addition mod Q
-export function polyAdd(a: Polynomial, b: Polynomial): Polynomial {
-  const result = new Uint16Array(KYBER_N)
-  for (let i = 0; i < KYBER_N; i++) {
-    result[i] = (a[i] + b[i]) % KYBER_Q
-  }
-  return result
-}
-
-// Polynomial multiplication via NTT (Number Theoretic Transform)
-export function polyMultiply(a: Polynomial, b: Polynomial): Polynomial {
-  const aNTT = ntt(a)
-  const bNTT = ntt(b)
-
-  const cNTT = new Uint16Array(KYBER_N)
-  for (let i = 0; i < KYBER_N; i++) {
-    cNTT[i] = (aNTT[i] * bNTT[i]) % KYBER_Q
-  }
-
-  return inverseNTT(cNTT)
-}
-
-// Number Theoretic Transform (NTT)
-function ntt(poly: Polynomial): Polynomial {
-  const result = new Uint16Array(poly)
-  const zeta = 17 // Primitive root of unity modulo Q
-
-  for (let len = 128; len >= 1; len >>>= 1) {
-    for (let start = 0; start < KYBER_N; start += 2 * len) {
-      const zeta_pow = modExp(zeta, start / (2 * len), KYBER_Q)
-
-      for (let i = start; i < start + len; i++) {
-        const t = (result[i + len] * zeta_pow) % KYBER_Q
-        result[i + len] = (result[i] - t + KYBER_Q) % KYBER_Q
-        result[i] = (result[i] + t) % KYBER_Q
-      }
-    }
-  }
-
-  return result
-}
-
-// Inverse NTT
-function inverseNTT(poly: Polynomial): Polynomial {
-  const result = new Uint16Array(poly)
-  const inv = modInverse(KYBER_N, KYBER_Q)
-
-  for (let len = 1; len < KYBER_N; len <<= 1) {
-    for (let start = 0; start < KYBER_N; start += 2 * len) {
-      const zeta_pow = modExp(17, -(start / len + 1), KYBER_Q)
-
-      for (let i = start; i < start + len; i++) {
-        const t = (result[i + len] * zeta_pow) % KYBER_Q
-        result[i + len] = (result[i] - t + KYBER_Q) % KYBER_Q
-        result[i] = (result[i] + t) % KYBER_Q
-      }
-    }
-  }
-
-  for (let i = 0; i < KYBER_N; i++) {
-    result[i] = (result[i] * inv) % KYBER_Q
-  }
-
-  return result
-}
-
-// Modular exponentiation
-function modExp(base: number, exp: number, mod: number): number {
-  if (exp < 0) {
-    // For negative exponent: compute base^exp = (base^(-exp))^(-1)
-    // Using Fermat's little theorem: a^(-1) ≡ a^(p-2) mod p
-    const pos_exp = modExp(base, -exp, mod)
-    return modExp(pos_exp, mod - 2, mod)
-  }
-
-  let result = 1
-  base = base % mod
-
-  while (exp > 0) {
-    if (exp % 2 === 1) {
-      result = (result * base) % mod
-    }
-    exp = floor(exp / 2)
-    base = (base * base) % mod
-  }
-
-  return result
-}
-
-// Modular inverse via extended Euclidean algorithm
-function modInverse(a: number, m: number): number {
-  let [old_r, r] = [a, m]
-  let [old_s, s] = [1, 0]
-
-  while (r !== 0) {
-    const quotient = floor(old_r / r)
-    ;[old_r, r] = [r, old_r - quotient * r]
-    ;[old_s, s] = [s, old_s - quotient * s]
-  }
-
-  return (old_s + m) % m
-}
-
-// ============================================================================
-// KYBER-768 KEY GENERATION
-// ============================================================================
-
-export interface KyberKeyPair {
-  readonly publicKey: Buffer
-  readonly secretKey: Buffer
-}
-
-export function generateKeyPair(): KyberKeyPair {
-  const d = randomBytes(32) // Seed for pseudorandom generation
-  const z = randomBytes(32) // Decapsulation seed
-
-  // Generate matrix A and secret vectors s, e
-  const A: Polynomial[][] = []
-  for (let i = 0; i < KYBER_K; i++) {
-    A[i] = []
-    for (let j = 0; j < KYBER_K; j++) {
-      A[i]![j] = polyFromBytes(d, i * KYBER_K + j)
-    }
-  }
-
-  const seed_se = randomBytes(64)
-  const s: Polynomial[] = []
-  const e: Polynomial[] = []
-
-  for (let i = 0; i < KYBER_K; i++) {
-    s[i] = polyFromBytes(seed_se.slice(0, 32), i)
-    e[i] = polyFromBytes(seed_se.slice(32), i)
-  }
-
-  // Compute t = A * s + e
-  const t: Polynomial[] = []
-  for (let i = 0; i < KYBER_K; i++) {
-    let ti = new Uint16Array(KYBER_N)
-    for (let j = 0; j < KYBER_K; j++) {
-      const prod = polyMultiply(A[i]![j]!, s[j]!)
-      ti = polyAdd(ti, prod)
-    }
-    t[i] = polyAdd(ti, e[i]!)
-  }
-
-  // Encode public key: t || seed
-  const publicKey = Buffer.concat([
-    Buffer.from(polynomialsToBytes(t)),
-    d,
-  ])
-
-  // Encode secret key: s || e || d || z || pk_hash (NIST FIPS 203)
-  const secretKey = Buffer.concat([
-    Buffer.from(polynomialsToBytes(s)),
-    Buffer.from(polynomialsToBytes(e)),
-    d,
-    z,
-    createHash('sha256').update(publicKey).digest(),
-  ])
-
-  return { publicKey, secretKey }
-}
-
-// ============================================================================
-// KYBER-768 ENCAPSULATION
-// ============================================================================
-
-export interface Encapsulation {
-  readonly ciphertext: Buffer
-  readonly sharedSecret: Buffer
-}
-
-export function encapsulate(publicKey: Buffer): Encapsulation {
-  if (publicKey.length !== KYBER_PUBLIC_KEY_SIZE) {
-    throw new Error(`Invalid public key size: ${publicKey.length}`)
-  }
-
-  // Extract t from public key
-  const t_bytes = publicKey.slice(0, KYBER_PUBLIC_KEY_SIZE - 32)
-  const seed = publicKey.slice(KYBER_PUBLIC_KEY_SIZE - 32)
-  const t = bytesToPolynomials(t_bytes, KYBER_K)
-
-  // Sample random message
-  const m = randomBytes(32)
-
-  // Encode message to polynomial
-  const r_seed = createHash('sha256')
-    .update(m)
-    .update(createHash('sha256').update(publicKey).digest())
-    .digest()
-
-  const r: Polynomial[] = []
-  for (let i = 0; i < KYBER_K; i++) {
-    r[i] = polyFromBytes(r_seed, i)
-  }
-
-  // Compute u = A^T * r + e1 and v = t^T * r + e2 + msg
-  const u: Polynomial[] = []
-  const A: Polynomial[][] = []
-  for (let i = 0; i < KYBER_K; i++) {
-    A[i] = []
-    for (let j = 0; j < KYBER_K; j++) {
-      A[i]![j] = polyFromBytes(seed, i * KYBER_K + j)
-    }
-  }
-
-  for (let i = 0; i < KYBER_K; i++) {
-    let ui = new Uint16Array(KYBER_N)
-    for (let j = 0; j < KYBER_K; j++) {
-      const prod = polyMultiply(A[j]![i]!, r[j]!)
-      ui = polyAdd(ui, prod)
-    }
-    u[i] = ui
-  }
-
-  let v = new Uint16Array(KYBER_N)
-  for (let i = 0; i < KYBER_K; i++) {
-    const prod = polyMultiply(t[i]!, r[i]!)
-    v = polyAdd(v, prod)
-  }
-
-  // Add message to v
-  const msg_poly = messageToPoly(m)
-  v = polyAdd(v, msg_poly)
-
-  // Compress u and v
-  const c1 = compressPolynomials(u, KYBER_DU)
-  const c2 = compressPolynomial(v, KYBER_DV)
-
-  const ciphertext = Buffer.concat([c1, c2])
-
-  // Derive shared secret
-  const sharedSecret = createHash('sha256')
-    .update(m)
-    .update(ciphertext)
-    .digest()
-
-  return { ciphertext, sharedSecret }
-}
-
-// ============================================================================
-// KYBER-768 DECAPSULATION
-// ============================================================================
-
-export function decapsulate(secretKey: Buffer, ciphertext: Buffer): Buffer {
-  if (secretKey.length !== KYBER_SECRET_KEY_SIZE) {
-    throw new Error(`Invalid secret key size: ${secretKey.length}`)
-  }
-  if (ciphertext.length !== KYBER_CIPHERTEXT_SIZE) {
-    throw new Error(`Invalid ciphertext size: ${ciphertext.length}`)
-  }
-
-  // Extract s from secret key (first k*384 bytes)
-  const s_bytes = secretKey.slice(0, KYBER_K * 384)
-  const s = bytesToPolynomials(s_bytes, KYBER_K)
-
-  // Note: e, d, z, and pk_hash follow s in the secret key but aren't needed for basic decapsulation
-  // z would be used for implicit rejection (FO transform variant)
-
-  // Decompress u and v from ciphertext
-  const c1_size = KYBER_DU * KYBER_K * 32
-  const u = decompressPolynomials(ciphertext.slice(0, c1_size), KYBER_K, KYBER_DU)
-  const v = decompressPolynomial(ciphertext.slice(c1_size), KYBER_DV)
-
-  // Recover message: m' = v - s^T * u
-  let m_prime = new Uint16Array(v)
-  for (let i = 0; i < KYBER_K; i++) {
-    const prod = polyMultiply(s[i]!, u[i]!)
-    m_prime = polySubtract(m_prime, prod)
-  }
-
-  const m = polyToMessage(m_prime)
-
-  // Derive shared secret
-  const sharedSecret = createHash('sha256')
-    .update(m)
-    .update(ciphertext)
-    .digest()
-
-  return sharedSecret
-}
-
-// ============================================================================
-// HELPER FUNCTIONS
-// ============================================================================
-
-function polynomialsToBytes(polys: Polynomial[]): Uint8Array {
-  const bytes = new Uint8Array(polys.length * 384)
-  for (let i = 0; i < polys.length; i++) {
-    const poly_bytes = polynomialToBytes(polys[i]!)
-    bytes.set(poly_bytes, i * 384)
-  }
-  return bytes
-}
-
-function polynomialToBytes(poly: Polynomial): Uint8Array {
-  const bytes = new Uint8Array(384)
-  for (let i = 0; i < KYBER_N; i++) {
-    const idx = floor((i * 12) / 8)
-    const shift = ((i * 12) % 8)
-    const val = poly[i] & ((1 << 12) - 1) // 12-bit encoding
-    bytes[idx] = (bytes[idx] | (val << shift)) & 0xff
-    if (shift > 0) {
-      bytes[idx + 1] = (bytes[idx + 1] | (val >> (8 - shift))) & 0xff
-    }
-  }
-  return bytes
-}
-
-function bytesToPolynomials(bytes: Buffer, count: number): Polynomial[] {
-  const polys: Polynomial[] = []
-  for (let i = 0; i < count; i++) {
-    polys[i] = bytesToPolynomial(bytes.slice(i * 384, (i + 1) * 384))
-  }
-  return polys
-}
-
-function bytesToPolynomial(bytes: Buffer): Polynomial {
-  const poly = new Uint16Array(KYBER_N)
-  for (let i = 0; i < KYBER_N; i++) {
-    const idx = floor((i * 12) / 8)
-    const shift = (i * 12) % 8
-    poly[i] = ((bytes[idx] >> shift) | (bytes[idx + 1] << (8 - shift))) & ((1 << 12) - 1)
-  }
-  return poly
-}
-
-function messageToPoly(msg: Buffer): Polynomial {
-  const poly = new Uint16Array(KYBER_N)
-  for (let i = 0; i < 32; i++) {
-    const byte = msg[i]!
-    for (let j = 0; j < 8; j++) {
-      if ((byte >> j) & 1) {
-        poly[i * 8 + j] = floor(KYBER_Q / 2)
-      }
-    }
-  }
-  return poly
-}
-
-function polyToMessage(poly: Polynomial): Buffer {
-  const msg = Buffer.alloc(32)
-  const threshold = floor(KYBER_Q / 2)
-  for (let i = 0; i < 32; i++) {
-    for (let j = 0; j < 8; j++) {
-      if (poly[i * 8 + j]! > threshold) {
-        msg[i] = msg[i]! | (1 << j)
-      }
-    }
-  }
-  return msg
-}
-
-function compressPolynomials(polys: Polynomial[], d: number): Buffer {
-  const bytes = Buffer.alloc(polys.length * KYBER_N * d / 8)
-  let bit_idx = 0
-  for (const poly of polys) {
-    for (let i = 0; i < KYBER_N; i++) {
-      const compressed = floor((poly[i] * ((1 << d) - 1)) / KYBER_Q)
-      for (let j = 0; j < d; j++) {
-        if ((compressed >> j) & 1) {
-          bytes[floor(bit_idx / 8)] |= 1 << (bit_idx % 8)
-        }
-        bit_idx++
-      }
-    }
-  }
-  return bytes
-}
-
-function compressPolynomial(poly: Polynomial, d: number): Buffer {
-  const bytes = Buffer.alloc(KYBER_N * d / 8)
-  let bit_idx = 0
-  for (let i = 0; i < KYBER_N; i++) {
-    const compressed = floor((poly[i] * ((1 << d) - 1)) / KYBER_Q)
-    for (let j = 0; j < d; j++) {
-      if ((compressed >> j) & 1) {
-        bytes[floor(bit_idx / 8)] |= 1 << (bit_idx % 8)
-      }
-      bit_idx++
-    }
-  }
-  return bytes
-}
-
-function decompressPolynomials(bytes: Buffer, count: number, d: number): Polynomial[] {
-  const polys: Polynomial[] = []
-  let bit_idx = 0
-  for (let p = 0; p < count; p++) {
-    const poly = new Uint16Array(KYBER_N)
-    for (let i = 0; i < KYBER_N; i++) {
-      let compressed = 0
-      for (let j = 0; j < d; j++) {
-        if ((bytes[floor(bit_idx / 8)] >> (bit_idx % 8)) & 1) {
-          compressed |= 1 << j
-        }
-        bit_idx++
-      }
-      poly[i] = floor((compressed * KYBER_Q) / ((1 << d) - 1))
-    }
-    polys[p] = poly
-  }
-  return polys
-}
-
-function decompressPolynomial(bytes: Buffer, d: number): Polynomial {
-  const poly = new Uint16Array(KYBER_N)
-  let bit_idx = 0
-  for (let i = 0; i < KYBER_N; i++) {
-    let compressed = 0
-    for (let j = 0; j < d; j++) {
-      if ((bytes[floor(bit_idx / 8)] >> (bit_idx % 8)) & 1) {
-        compressed |= 1 << j
-      }
-      bit_idx++
-    }
-    poly[i] = floor((compressed * KYBER_Q) / ((1 << d) - 1))
-  }
-  return poly
-}
-
-function polySubtract(a: Polynomial, b: Polynomial): Polynomial {
-  const result = new Uint16Array(KYBER_N)
-  for (let i = 0; i < KYBER_N; i++) {
-    result[i] = (a[i] - b[i] + KYBER_Q) % KYBER_Q
-  }
-  return result
-}