ethereum-execution 2.18.0rc6.dev2__py3-none-any.whl

ethereum/crypto/__init__.py

@@ -0,0 +1,3 @@
+"""
+Cryptographic primitives used in Ethereum.
+"""

ethereum/crypto/blake2.py

@@ -0,0 +1,265 @@
+"""The Blake2 Implementation."""
+
+import struct
+from dataclasses import dataclass
+from typing import Final, List, Tuple
+
+from ethereum_types.numeric import Uint
+
+
+def spit_le_to_uint(data: bytes, start: int, num_words: int) -> List[Uint]:
+    """
+    Extracts 8 byte words from a given data.
+
+    Parameters
+    ----------
+    data :
+        The data in bytes from which the words need to be extracted
+    start :
+        Position to start the extraction
+    num_words:
+        The number of words to be extracted
+
+    """
+    words = []
+    for i in range(num_words):
+        start_position = start + (i * 8)
+        words.append(
+            Uint.from_le_bytes(data[start_position : start_position + 8])
+        )
+
+    return words
+
+
+@dataclass
+class Blake2:
+    """
+    Implementation of the BLAKE2 cryptographic hashing algorithm.
+
+    Please refer the following document for details:
+    https://datatracker.ietf.org/doc/html/rfc7693
+    """
+
+    w: Uint
+    mask_bits: Uint
+    word_format: str
+
+    R1: Uint
+    R2: Uint
+    R3: Uint
+    R4: Uint
+
+    @property
+    def max_word(self) -> Uint:
+        """
+        Largest value for a given Blake2 flavor.
+        """
+        return Uint(2) ** self.w
+
+    @property
+    def w_R1(self) -> Uint:
+        """
+        (w - R1) value for a given Blake2 flavor.
+        Used in the function G.
+        """
+        return self.w - self.R1
+
+    @property
+    def w_R2(self) -> Uint:
+        """
+        (w - R2) value for a given Blake2 flavor.
+        Used in the function G.
+        """
+        return self.w - self.R2
+
+    @property
+    def w_R3(self) -> Uint:
+        """
+        (w - R3) value for a given Blake2 flavor.
+        Used in the function G.
+        """
+        return self.w - self.R3
+
+    @property
+    def w_R4(self) -> Uint:
+        """
+        (w - R4) value for a given Blake2 flavor.
+        Used in the function G.
+        """
+        return self.w - self.R4
+
+    sigma: Tuple[Tuple[int, ...], ...] = (
+        (0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15),
+        (14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3),
+        (11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4),
+        (7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8),
+        (9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13),
+        (2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9),
+        (12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11),
+        (13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10),
+        (6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5),
+        (10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13, 0),
+    )
+
+    IV: Tuple[Uint, ...] = (
+        Uint(0x6A09E667F3BCC908),
+        Uint(0xBB67AE8584CAA73B),
+        Uint(0x3C6EF372FE94F82B),
+        Uint(0xA54FF53A5F1D36F1),
+        Uint(0x510E527FADE682D1),
+        Uint(0x9B05688C2B3E6C1F),
+        Uint(0x1F83D9ABFB41BD6B),
+        Uint(0x5BE0CD19137E2179),
+    )
+
+    MIX_TABLE: Final[Tuple[Tuple[Uint, Uint, Uint, Uint], ...]] = (
+        (Uint(0), Uint(4), Uint(8), Uint(12)),
+        (Uint(1), Uint(5), Uint(9), Uint(13)),
+        (Uint(2), Uint(6), Uint(10), Uint(14)),
+        (Uint(3), Uint(7), Uint(11), Uint(15)),
+        (Uint(0), Uint(5), Uint(10), Uint(15)),
+        (Uint(1), Uint(6), Uint(11), Uint(12)),
+        (Uint(2), Uint(7), Uint(8), Uint(13)),
+        (Uint(3), Uint(4), Uint(9), Uint(14)),
+    )
+
+    @property
+    def sigma_len(self) -> int:
+        """
+        Length of the sigma parameter.
+        """
+        return len(self.sigma)
+
+    def get_blake2_parameters(self, data: bytes) -> Tuple:
+        """
+        Extract the parameters required in the Blake2 compression function
+        from the provided bytes data.
+
+        Parameters
+        ----------
+        data :
+            The bytes data that has been passed in the message.
+
+        """
+        rounds = Uint.from_be_bytes(data[:4])
+        h = spit_le_to_uint(data, 4, 8)
+        m = spit_le_to_uint(data, 68, 16)
+        t_0, t_1 = spit_le_to_uint(data, 196, 2)
+        f = Uint.from_be_bytes(data[212:])
+
+        return (rounds, h, m, t_0, t_1, f)
+
+    def G(
+        self, v: List, a: Uint, b: Uint, c: Uint, d: Uint, x: Uint, y: Uint
+    ) -> List:
+        """
+        The mixing function used in Blake2.
+
+        See [RFC 7693] for more details.
+
+        [RFC 7693]: https://datatracker.ietf.org/doc/html/rfc7693#section-3.1
+
+        Parameters
+        ----------
+        v :
+            The working vector to be mixed.
+        a, b, c, d :
+            Indexes within v of the words to be mixed.
+        x, y :
+            The two input words for the mixing.
+
+        """
+        v[a] = (v[a] + v[b] + x) % self.max_word
+        v[d] = ((v[d] ^ v[a]) >> self.R1) ^ (
+            (v[d] ^ v[a]) << self.w_R1
+        ) % self.max_word
+
+        v[c] = (v[c] + v[d]) % self.max_word
+        v[b] = ((v[b] ^ v[c]) >> self.R2) ^ (
+            (v[b] ^ v[c]) << self.w_R2
+        ) % self.max_word
+
+        v[a] = (v[a] + v[b] + y) % self.max_word
+        v[d] = ((v[d] ^ v[a]) >> self.R3) ^ (
+            (v[d] ^ v[a]) << self.w_R3
+        ) % self.max_word
+
+        v[c] = (v[c] + v[d]) % self.max_word
+        v[b] = ((v[b] ^ v[c]) >> self.R4) ^ (
+            (v[b] ^ v[c]) << self.w_R4
+        ) % self.max_word
+
+        return v
+
+    def compress(
+        self,
+        num_rounds: Uint,
+        h: List[Uint],
+        m: List[Uint],
+        t_0: Uint,
+        t_1: Uint,
+        f: bool,
+    ) -> bytes:
+        """
+        'F Compression' from section 3.2 of RFC 7693.
+
+        Parameters
+        ----------
+        num_rounds :
+            The number of rounds. A 32-bit unsigned big-endian word
+        h :
+            The state vector. 8 unsigned 64-bit little-endian words
+        m :
+            The message block vector. 16 unsigned 64-bit little-endian words
+        t_0, t_1 :
+            Offset counters. 2 unsigned 64-bit little-endian words
+        f:
+            The final block indicator flag. An 8-bit word
+
+        """
+        # Initialize local work vector v[0..15]
+        v = [Uint(0)] * 16
+        v[0:8] = h  # First half from state
+        v[8:15] = self.IV  # Second half from IV
+
+        v[12] = t_0 ^ self.IV[4]  # Low word of the offset
+        v[13] = t_1 ^ self.IV[5]  # High word of the offset
+
+        if f:
+            v[14] = v[14] ^ self.mask_bits  # Invert all bits for last block
+
+        # Mixing
+        for r in range(num_rounds):
+            # for more than sigma_len rounds, the schedule
+            # wraps around to the beginning
+            s = self.sigma[r % self.sigma_len]
+
+            v = self.G(v, *self.MIX_TABLE[0], m[s[0]], m[s[1]])
+            v = self.G(v, *self.MIX_TABLE[1], m[s[2]], m[s[3]])
+            v = self.G(v, *self.MIX_TABLE[2], m[s[4]], m[s[5]])
+            v = self.G(v, *self.MIX_TABLE[3], m[s[6]], m[s[7]])
+            v = self.G(v, *self.MIX_TABLE[4], m[s[8]], m[s[9]])
+            v = self.G(v, *self.MIX_TABLE[5], m[s[10]], m[s[11]])
+            v = self.G(v, *self.MIX_TABLE[6], m[s[12]], m[s[13]])
+            v = self.G(v, *self.MIX_TABLE[7], m[s[14]], m[s[15]])
+
+        result_message_words = (h[i] ^ v[i] ^ v[i + 8] for i in range(8))
+        return struct.pack("<8%s" % self.word_format, *result_message_words)
+
+
+# Parameters specific to the Blake2b implementation
+@dataclass
+class Blake2b(Blake2):
+    """
+    The Blake2b flavor (64-bits) of Blake2.
+    This version is used in the pre-compiled contract.
+    """
+
+    w: Uint = Uint(64)
+    mask_bits: Uint = Uint(0xFFFFFFFFFFFFFFFF)
+    word_format: str = "Q"
+
+    R1: Uint = Uint(32)
+    R2: Uint = Uint(24)
+    R3: Uint = Uint(16)
+    R4: Uint = Uint(63)

ethereum/crypto/elliptic_curve.py

@@ -0,0 +1,170 @@
+"""Elliptic Curves."""
+
+import coincurve
+from Crypto.Util.asn1 import DerSequence
+from cryptography.exceptions import InvalidSignature
+from cryptography.hazmat.backends import default_backend
+from cryptography.hazmat.primitives import hashes
+from cryptography.hazmat.primitives.asymmetric import ec
+from cryptography.hazmat.primitives.asymmetric.utils import Prehashed
+from ethereum_types.bytes import Bytes
+from ethereum_types.numeric import U256
+
+from ethereum.exceptions import InvalidSignatureError
+
+from .hash import Hash32
+
+SECP256K1B = U256(7)
+SECP256K1P = U256(
+    0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F
+)
+SECP256K1N = U256(
+    0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
+)
+
+
+def secp256k1_recover(r: U256, s: U256, v: U256, msg_hash: Hash32) -> Bytes:
+    """
+    Recovers the public key from a given signature.
+
+    Parameters
+    ----------
+    r :
+        TODO
+    s :
+        TODO
+    v :
+        TODO
+    msg_hash :
+        Hash of the message being recovered.
+
+    Returns
+    -------
+    public_key : `ethereum.base_types.Bytes`
+        Recovered public key.
+
+    """
+    is_square = pow(
+        pow(r, U256(3), SECP256K1P) + SECP256K1B,
+        (SECP256K1P - U256(1)) // U256(2),
+        SECP256K1P,
+    )
+
+    if is_square != 1:
+        raise InvalidSignatureError(
+            "r is not the x-coordinate of a point on the secp256k1 curve"
+        )
+
+    r_bytes = r.to_be_bytes32()
+    s_bytes = s.to_be_bytes32()
+
+    signature = bytearray([0] * 65)
+    signature[32 - len(r_bytes) : 32] = r_bytes
+    signature[64 - len(s_bytes) : 64] = s_bytes
+    signature[64] = v
+
+    # If the recovery algorithm returns the point at infinity,
+    # the signature is considered invalid
+    # the below function will raise a ValueError.
+    try:
+        public_key = coincurve.PublicKey.from_signature_and_message(
+            bytes(signature), msg_hash, hasher=None
+        )
+    except ValueError as e:
+        raise InvalidSignatureError from e
+
+    public_key = public_key.format(compressed=False)[1:]
+    return public_key
+
+
+SECP256R1N = U256(
+    0xFFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551
+)
+SECP256R1P = U256(
+    0xFFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF
+)
+SECP256R1A = U256(
+    0xFFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFC
+)
+SECP256R1B = U256(
+    0x5AC635D8AA3A93E7B3EBBD55769886BC651D06B0CC53B0F63BCE3C3E27D2604B
+)
+
+
+def secp256r1_verify(
+    r: U256, s: U256, x: U256, y: U256, msg_hash: Hash32
+) -> None:
+    """
+    Verifies a P-256 signature.
+
+    Parameters
+    ----------
+    r :
+        the `r` component of the signature
+    s :
+        the `s` component of the signature
+    x :
+        the `x` coordinate of the public key
+    y :
+        the `y` coordinate of the public key
+    msg_hash :
+        Hash of the message being recovered.
+
+    Raises
+    ------
+    Raises an `InvalidSignatureError` if the signature is not valid.
+
+    """
+    # Convert U256 to regular integers for DerSequence
+    r_int = int(r)
+    s_int = int(s)
+    x_int = int(x)
+    y_int = int(y)
+
+    sig = DerSequence([r_int, s_int]).encode()
+
+    pubnum = ec.EllipticCurvePublicNumbers(x_int, y_int, ec.SECP256R1())
+    pubkey = pubnum.public_key(default_backend())
+
+    try:
+        pubkey.verify(sig, msg_hash, ec.ECDSA(Prehashed(hashes.SHA256())))
+    except InvalidSignature as e:
+        raise InvalidSignatureError from e
+
+
+def is_on_curve_secp256r1(x: U256, y: U256) -> bool:
+    """
+    Checks if a point is on the secp256r1 curve.
+
+    The point (x, y) must satisfy the curve equation:
+    y^2 ≡ x^3 + a*x + b (mod p)
+
+    Parameters
+    ----------
+    x : U256
+        The x-coordinate of the point
+    y : U256
+        The y-coordinate of the point
+
+    Returns
+    -------
+    bool
+        True if the point is on the curve, False otherwise
+
+    """
+    # Convert U256 to int for calculations
+    x_int = int(x)
+    y_int = int(y)
+    p_int = int(SECP256R1P)
+    a_int = int(SECP256R1A)
+    b_int = int(SECP256R1B)
+
+    # Calculate y^2 mod p
+    y_squared = (y_int * y_int) % p_int
+
+    # Calculate x^3 + ax + b mod p
+    x_cubed = (x_int * x_int * x_int) % p_int
+    ax = (a_int * x_int) % p_int
+    right_side = (x_cubed + ax + b_int) % p_int
+
+    return y_squared == right_side

ethereum/crypto/hash.py

@@ -0,0 +1,56 @@
+"""
+Cryptographic Hash Functions.
+
+.. contents:: Table of Contents
+    :backlinks: none
+    :local:
+
+Introduction
+------------
+
+Cryptographic hashing functions.
+"""
+
+from Crypto.Hash import keccak
+from ethereum_types.bytes import Bytes, Bytes32, Bytes64
+
+Hash32 = Bytes32
+Hash64 = Bytes64
+
+
+def keccak256(buffer: Bytes | bytearray) -> Hash32:
+    """
+    Computes the keccak256 hash of the input `buffer`.
+
+    Parameters
+    ----------
+    buffer :
+        Input for the hashing function.
+
+    Returns
+    -------
+    hash : `ethereum.base_types.Hash32`
+        Output of the hash function.
+
+    """
+    k = keccak.new(digest_bits=256)
+    return Hash32(k.update(buffer).digest())
+
+
+def keccak512(buffer: Bytes | bytearray) -> Hash64:
+    """
+    Computes the keccak512 hash of the input `buffer`.
+
+    Parameters
+    ----------
+    buffer :
+        Input for the hashing function.
+
+    Returns
+    -------
+    hash : `ethereum.base_types.Hash32`
+        Output of the hash function.
+
+    """
+    k = keccak.new(digest_bits=512)
+    return Hash64(k.update(buffer).digest())

ethereum/crypto/kzg.py

@@ -0,0 +1,176 @@
+"""The KZG Implementation."""
+
+from hashlib import sha256
+from typing import Tuple
+
+from eth_typing.bls import BLSPubkey, BLSSignature
+from ethereum_types.bytes import Bytes32, Bytes48
+from ethereum_types.numeric import U256
+from py_ecc.bls import G2ProofOfPossession
+from py_ecc.bls.g2_primitives import pubkey_to_G1, signature_to_G2
+from py_ecc.fields import optimized_bls12_381_FQ, optimized_bls12_381_FQ2
+from py_ecc.fields import optimized_bls12_381_FQ12 as FQ12
+from py_ecc.optimized_bls12_381 import add, multiply, neg
+from py_ecc.optimized_bls12_381.optimized_curve import G1, G2
+from py_ecc.optimized_bls12_381.optimized_pairing import (
+    final_exponentiate,
+    pairing,
+)
+
+from ethereum.utils.hexadecimal import hex_to_bytes
+
+FQ = Tuple[
+    optimized_bls12_381_FQ, optimized_bls12_381_FQ, optimized_bls12_381_FQ
+]
+FQ2 = Tuple[
+    optimized_bls12_381_FQ2, optimized_bls12_381_FQ2, optimized_bls12_381_FQ2
+]
+
+
+class KZGCommitment(Bytes48):
+    """KZG commitment to a polynomial."""
+
+    pass
+
+
+class KZGProof(Bytes48):
+    """KZG proof."""
+
+    pass
+
+
+class BLSFieldElement(U256):
+    """A field element in the BLS12-381 field."""
+
+    pass
+
+
+class VersionedHash(Bytes32):
+    """A versioned hash."""
+
+    pass
+
+
+VERSIONED_HASH_VERSION_KZG = hex_to_bytes("0x01")
+BYTES_PER_COMMITMENT = 48
+BYTES_PER_PROOF = 48
+BYTES_PER_FIELD_ELEMENT = 32
+G1_POINT_AT_INFINITY = b"\xc0" + b"\x00" * 47
+BLS_MODULUS = BLSFieldElement(
+    52435875175126190479447740508185965837690552500527637822603658699938581184513  # noqa: E501
+)
+KZG_SETUP_G2_MONOMIAL_1 = "0xb5bfd7dd8cdeb128843bc287230af38926187075cbfbefa81009a2ce615ac53d2914e5870cb452d2afaaab24f3499f72185cbfee53492714734429b7b38608e23926c911cceceac9a36851477ba4c60b087041de621000edc98edada20c1def2"  # noqa: E501
+
+
+def kzg_commitment_to_versioned_hash(
+    kzg_commitment: KZGCommitment,
+) -> VersionedHash:
+    """
+    Convert a KZG commitment to a versioned hash.
+    """
+    return VersionedHash(
+        VERSIONED_HASH_VERSION_KZG
+        + Bytes32(sha256(kzg_commitment).digest())[1:]
+    )
+
+
+def validate_kzg_g1(b: Bytes48) -> None:
+    """
+    Perform BLS validation required by the types `KZGProof`
+    and `KZGCommitment`.
+    """
+    if b == G1_POINT_AT_INFINITY:
+        return
+
+    assert G2ProofOfPossession.KeyValidate(BLSPubkey(b))
+
+
+def bytes_to_kzg_commitment(b: Bytes48) -> KZGCommitment:
+    """
+    Convert untrusted bytes into a trusted and validated KZGCommitment.
+    """
+    validate_kzg_g1(b)
+    return KZGCommitment(b)
+
+
+def bytes_to_bls_field(b: Bytes32) -> BLSFieldElement:
+    """
+    Convert untrusted bytes to a trusted and validated BLS scalar
+    field element. This function does not accept inputs greater than
+    the BLS modulus.
+    """
+    field_element = int.from_bytes(b, "big")
+    assert field_element < int(BLS_MODULUS)
+    return BLSFieldElement(field_element)
+
+
+def bytes_to_kzg_proof(b: Bytes48) -> KZGProof:
+    """
+    Convert untrusted bytes into a trusted and validated KZGProof.
+    """
+    validate_kzg_g1(b)
+    return KZGProof(b)
+
+
+def pairing_check(values: Tuple[Tuple[FQ, FQ2], Tuple[FQ, FQ2]]) -> bool:
+    """
+    Check if the pairings are valid.
+    """
+    p_q_1, p_q_2 = values
+    final_exponentiation = final_exponentiate(
+        pairing(p_q_1[1], p_q_1[0], final_exponentiate=False)
+        * pairing(p_q_2[1], p_q_2[0], final_exponentiate=False)
+    )
+    return final_exponentiation == FQ12.one()
+
+
+def verify_kzg_proof(
+    commitment_bytes: Bytes48,
+    z_bytes: Bytes32,
+    y_bytes: Bytes32,
+    proof_bytes: Bytes48,
+) -> bool:
+    """
+    Verify KZG proof that ``p(z) == y`` where ``p(z)``
+    is the polynomial represented by ``polynomial_kzg``.
+    Receives inputs as bytes.
+    Public method.
+    """
+    assert len(commitment_bytes) == BYTES_PER_COMMITMENT
+    assert len(z_bytes) == BYTES_PER_FIELD_ELEMENT
+    assert len(y_bytes) == BYTES_PER_FIELD_ELEMENT
+    assert len(proof_bytes) == BYTES_PER_PROOF
+
+    return verify_kzg_proof_impl(
+        bytes_to_kzg_commitment(commitment_bytes),
+        bytes_to_bls_field(z_bytes),
+        bytes_to_bls_field(y_bytes),
+        bytes_to_kzg_proof(proof_bytes),
+    )
+
+
+def verify_kzg_proof_impl(
+    commitment: KZGCommitment,
+    z: BLSFieldElement,
+    y: BLSFieldElement,
+    proof: KZGProof,
+) -> bool:
+    """
+    Verify KZG proof that ``p(z) == y`` where ``p(z)``
+    is the polynomial represented by ``polynomial_kzg``.
+    """
+    # Verify: P - y = Q * (X - z)
+    X_minus_z = add(
+        signature_to_G2(BLSSignature(hex_to_bytes(KZG_SETUP_G2_MONOMIAL_1))),
+        multiply(G2, int((BLS_MODULUS - z) % BLS_MODULUS)),
+    )
+    P_minus_y = add(
+        pubkey_to_G1(BLSPubkey(commitment)),
+        multiply(G1, int((BLS_MODULUS - y) % BLS_MODULUS)),
+    )
+    return pairing_check(
+        (
+            (P_minus_y, neg(G2)),
+            (pubkey_to_G1(BLSPubkey(proof)), X_minus_z),
+        )
+    )