crowd-funder-for-time-pwa/sw_scripts/secp256k1.js

(function () {
  randomBytes = (length) => self.crypto.getRandomValues(new Uint8Array(length));
  self.Secp256k1 = exports = {};

  function uint256(x, base) {
    return new BN(x, base);
  }

  function rnd(P) {
    return uint256(randomBytes(32)).umod(P); //TODO red
  }

  const A = uint256(0);
  const B = uint256(7);
  const GX = uint256(
    "79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798",
    16,
  );
  const GY = uint256(
    "483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8",
    16,
  );
  const P = uint256(
    "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F",
    16,
  );
  const N = uint256(
    "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141",
    16,
  );
  //const RED = BN.red(P)
  const _0 = uint256(0);
  const _1 = uint256(1);

  // function for elliptic curve multiplication in jacobian coordinates using Double-and-add method
  function ecmul(_p, _d) {
    let R = [_0, _0, _0];

    //return (0,0) if d=0 or (x1,y1)=(0,0)
    if (_d == 0 || (_p[0] == 0 && _p[1] == 0)) {
      return R;
    }
    let T = [
      _p[0], //x-coordinate temp
      _p[1], //y-coordinate temp
      _p[2], //z-coordinate temp
    ];

    const d = _d.clone();
    while (d != 0) {
      if (d.testn(0)) {
        //if last bit is 1 add T to result
        R = ecadd(T, R);
      }
      T = ecdouble(T); //double temporary coordinates
      d.iushrn(1); //"cut off" last bit
    }

    return R;
  }

  function mulmod(a, b, P) {
    return a.mul(b).umod(P); //TODO red
  }

  function addmod(a, b, P) {
    return a.add(b).umod(P); //TODO red
  }

  function invmod(a, P) {
    return a.invm(P); //TODO redq
  }

  function mulG(k) {
    const GinJ = AtoJ(GX, GY);
    const PUBinJ = ecmul(GinJ, k);
    return JtoA(PUBinJ);
  }

  function assert(cond, msg) {
    if (!cond) {
      throw Error("assertion failed: " + msg);
    }
  }

  function ecsign(d, z) {
    assert(d != 0, "d must not be 0");
    assert(z != 0, "z must not be 0");
    while (true) {
      const k = rnd(P);
      const R = mulG(k);
      if (R[0] == 0) continue;
      const s = mulmod(invmod(k, N), addmod(z, mulmod(R[0], d, N), N), N);
      if (s == 0) continue;
      //FIXME: why do I need this
      if (s.testn(255)) continue;
      return { r: toHex(R[0]), s: toHex(s), v: R[1].testn(0) ? 1 : 0 };
    }
  }

  function JtoA(p) {
    const zInv = invmod(p[2], P);
    const zInv2 = mulmod(zInv, zInv, P);
    return [mulmod(p[0], zInv2, P), mulmod(p[1], mulmod(zInv, zInv2, P), P)];
  }

  //point doubling for elliptic curve in jacobian coordinates
  //formula from https://en.wikibooks.org/wiki/Cryptography/Prime_Curve/Jacobian_Coordinates
  function ecdouble(_p) {
    if (_p[1] == 0) {
      //return point at infinity
      return [_1, _1, _0];
    }

    const z2 = mulmod(_p[2], _p[2], P);
    const m = addmod(
      mulmod(A, mulmod(z2, z2, P), P),
      mulmod(uint256(3), mulmod(_p[0], _p[0], P), P),
      P,
    );
    const y2 = mulmod(_p[1], _p[1], P);
    const s = mulmod(uint256(4), mulmod(_p[0], y2, P), P);

    const x = addmod(mulmod(m, m, P), negmod(mulmod(s, uint256(2), P), P), P);
    return [
      x,
      addmod(
        mulmod(m, addmod(s, negmod(x, P), P), P),
        negmod(mulmod(uint256(8), mulmod(y2, y2, P), P), P),
        P,
      ),
      mulmod(uint256(2), mulmod(_p[1], _p[2], P), P),
    ];
  }

  function negmod(a, P) {
    return P.sub(a);
  }

  // point addition for elliptic curve in jacobian coordinates
  // formula from https://en.wikibooks.org/wiki/Cryptography/Prime_Curve/Jacobian_Coordinates
  function ecadd(_p, _q) {
    if (_q[0] == 0 && _q[1] == 0 && _q[2] == 0) {
      return _p;
    }

    let z2 = mulmod(_q[2], _q[2], P);
    const u1 = mulmod(_p[0], z2, P);
    const s1 = mulmod(_p[1], mulmod(z2, _q[2], P), P);
    z2 = mulmod(_p[2], _p[2], P);
    let u2 = mulmod(_q[0], z2, P);
    let s2 = mulmod(_q[1], mulmod(z2, _p[2], P), P);

    if (u1.eq(u2)) {
      if (!s1.eq(s2)) {
        //return point at infinity
        return [_1, _1, _0];
      } else {
        return ecdouble(_p);
      }
    }

    u2 = addmod(u2, negmod(u1, P), P);
    z2 = mulmod(u2, u2, P);
    const t2 = mulmod(u1, z2, P);
    z2 = mulmod(u2, z2, P);
    s2 = addmod(s2, negmod(s1, P), P);
    const x = addmod(
      addmod(mulmod(s2, s2, P), negmod(z2, P), P),
      negmod(mulmod(uint256(2), t2, P), P),
      P,
    );
    return [
      x,
      addmod(
        mulmod(s2, addmod(t2, negmod(x, P), P), P),
        negmod(mulmod(s1, z2, P), P),
        P,
      ),
      mulmod(u2, mulmod(_p[2], _q[2], P), P),
    ];
  }

  function AtoJ(x, y) {
    return [uint256(x), uint256(y), _1];
  }

  function isValidPoint(x, y) {
    const yy = addmod(mulmod(mulmod(x, x, P), x, P), B, P);
    return yy.eq(mulmod(y, y, P));
  }

  function toHex(bn) {
    return (
      "00000000000000000000000000000000000000000000000000000000000000000000000000000000" +
      bn.toString(16)
    ).slice(-64);
  }

  function decompressKey(x, yBit) {
    let redP = BN.red("k256");
    x = x.toRed(redP);
    const y = x.redMul(x).redMul(x).redAdd(B.toRed(redP)).redSqrt();
    const sign = y.testn(0);
    return (sign != yBit ? y.redNeg() : y).fromRed();
  }

  function generatePublicKeyFromPrivateKeyData(pk) {
    const p = mulG(pk);
    return { x: toHex(p[0]), y: toHex(p[1]) };
  }

  function ecrecover(recId, sigr, sigs, message) {
    assert(recId >= 0 && recId <= 3, "recId must be 0..3");
    assert(sigr != 0, "sigr must not be 0");
    assert(sigs != 0, "sigs must not be 0");
    // 1.0 For j from 0 to h   (h == recId here and the loop is outside this function)
    //   1.1 Let x = r + jn
    const x = addmod(uint256(sigr), P.muln(recId >> 1), P);
    //   1.2. Convert the integer x to an octet string X of length mlen using the conversion routine
    //        specified in Section 2.3.7, where mlen = ⌈(log2 p)/8⌉ or mlen = ⌈m/8⌉.
    //   1.3. Convert the octet string (16 set binary digits)||X to an elliptic curve point R using the
    //        conversion routine specified in Section 2.3.4. If this conversion routine outputs “invalid”, then
    //        do another iteration of Step 1.
    //
    // More concisely, what these points mean is to use X as a compressed public key.
    if (x.gte(P)) {
      // Cannot have point co-ordinates larger than this as everything takes place modulo Q.
      return null;
    }
    // Compressed keys require you to know an extra bit of data about the y-coord as there are two possibilities.
    // So it's encoded in the recId.
    const y = decompressKey(x, (recId & 1) == 1);
    //   1.4. If nR != point at infinity, then do another iteration of Step 1 (callers responsibility).
    // if (!R.mul(N).isInfinity())
    //     return null
    //   1.5. Compute e from M using Steps 2 and 3 of ECDSA signature verification.
    const e = uint256(message);
    //   1.6. For k from 1 to 2 do the following.   (loop is outside this function via iterating recId)
    //   1.6.1. Compute a candidate public key as:
    //               Q = mi(r) * (sR - eG)
    //
    // Where mi(x) is the modular multiplicative inverse. We transform this into the following:
    //               Q = (mi(r) * s ** R) + (mi(r) * -e ** G)
    // Where -e is the modular additive inverse of e, that is z such that z + e = 0 (mod n). In the above equation
    // ** is point multiplication and + is point addition (the EC group operator).
    //
    // We can find the additive inverse by subtracting e from zero then taking the mod. For example the additive
    // inverse of 3 modulo 11 is 8 because 3 + 8 mod 11 = 0, and -3 mod 11 = 8.
    const eNeg = negmod(e, N);
    const rInv = invmod(sigr, N);
    const srInv = mulmod(rInv, sigs, N);
    const eNegrInv = mulmod(rInv, eNeg, N);
    const R = AtoJ(x, y);
    const G = AtoJ(GX, GY);
    const qinJ = ecadd(ecmul(G, eNegrInv), ecmul(R, srInv));
    const p = JtoA(qinJ);
    return { x: toHex(p[0]), y: toHex(p[1]) };
  }

  function ecverify(Qx, Qy, sigr, sigs, z) {
    if (sigs == 0 || sigr == 0) {
      return false;
    }
    const w = invmod(sigs, N);
    const u1 = mulmod(z, w, N);
    const u2 = mulmod(sigr, w, N);
    const Q = AtoJ(Qx, Qy);
    const G = AtoJ(GX, GY);
    const RinJ = ecadd(ecmul(G, u1), ecmul(Q, u2));
    const r = JtoA(RinJ);
    return sigr.eq(r[0]);
  }

  exports.uint256 = uint256;
  exports.ecsign = ecsign;
  exports.ecrecover = ecrecover;
  exports.generatePublicKeyFromPrivateKeyData =
    generatePublicKeyFromPrivateKeyData;
  exports.decompressKey = decompressKey;
  exports.isValidPoint = isValidPoint;
  exports.ecverify = ecverify;
})();