"use strict";
var nobleCurves = (() => {
var __defProp = Object.defineProperty;
var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
var __getOwnPropNames = Object.getOwnPropertyNames;
var __hasOwnProp = Object.prototype.hasOwnProperty;
var __export = (target, all) => {
for (var name in all)
__defProp(target, name, { get: all[name], enumerable: true });
};
var __copyProps = (to, from, except, desc) => {
if ((from && typeof from === "object") || typeof from === "function") {
for (let key of __getOwnPropNames(from))
if (!__hasOwnProp.call(to, key) && key !== except)
__defProp(to, key, {
get: () => from[key],
enumerable:
!(desc = __getOwnPropDesc(from, key)) || desc.enumerable,
});
}
return to;
};
var __toCommonJS = (mod2) =>
__copyProps(__defProp({}, "__esModule", { value: true }), mod2);
// input.js
var input_exports = {};
__export(input_exports, {
bls12_381: () => bls12_381,
ed25519: () => ed25519,
ed25519_edwardsToMontgomeryPriv: () => edwardsToMontgomeryPriv,
ed25519_edwardsToMontgomeryPub: () => edwardsToMontgomeryPub,
ed448: () => ed448,
ed448_edwardsToMontgomeryPub: () => edwardsToMontgomeryPub2,
p256: () => p256,
p384: () => p384,
p521: () => p521,
secp256k1: () => secp256k1,
secp256k1_schnorr: () => schnorr,
utils: () => utils,
x25519: () => x25519,
x448: () => x448,
});
// ../esm/abstract/utils.js
var utils_exports = {};
__export(utils_exports, {
bitGet: () => bitGet,
bitLen: () => bitLen,
bitMask: () => bitMask,
bitSet: () => bitSet,
bytesToHex: () => bytesToHex,
bytesToNumberBE: () => bytesToNumberBE,
bytesToNumberLE: () => bytesToNumberLE,
concatBytes: () => concatBytes,
createHmacDrbg: () => createHmacDrbg,
ensureBytes: () => ensureBytes,
equalBytes: () => equalBytes,
hexToBytes: () => hexToBytes,
hexToNumber: () => hexToNumber,
numberToBytesBE: () => numberToBytesBE,
numberToBytesLE: () => numberToBytesLE,
numberToHexUnpadded: () => numberToHexUnpadded,
numberToVarBytesBE: () => numberToVarBytesBE,
utf8ToBytes: () => utf8ToBytes,
validateObject: () => validateObject,
});
var _0n = BigInt(0);
var _1n = BigInt(1);
var _2n = BigInt(2);
var u8a = (a) => a instanceof Uint8Array;
var hexes = /* @__PURE__ */ Array.from({ length: 256 }, (_, i) =>
i.toString(16).padStart(2, "0"),
);
function bytesToHex(bytes2) {
if (!u8a(bytes2)) throw new Error("Uint8Array expected");
let hex = "";
for (let i = 0; i < bytes2.length; i++) {
hex += hexes[bytes2[i]];
}
return hex;
}
function numberToHexUnpadded(num) {
const hex = num.toString(16);
return hex.length & 1 ? `0${hex}` : hex;
}
function hexToNumber(hex) {
if (typeof hex !== "string")
throw new Error("hex string expected, got " + typeof hex);
return BigInt(hex === "" ? "0" : `0x${hex}`);
}
function hexToBytes(hex) {
if (typeof hex !== "string")
throw new Error("hex string expected, got " + typeof hex);
const len = hex.length;
if (len % 2)
throw new Error(
"padded hex string expected, got unpadded hex of length " + len,
);
const array = new Uint8Array(len / 2);
for (let i = 0; i < array.length; i++) {
const j = i * 2;
const hexByte = hex.slice(j, j + 2);
const byte = Number.parseInt(hexByte, 16);
if (Number.isNaN(byte) || byte < 0)
throw new Error("Invalid byte sequence");
array[i] = byte;
}
return array;
}
function bytesToNumberBE(bytes2) {
return hexToNumber(bytesToHex(bytes2));
}
function bytesToNumberLE(bytes2) {
if (!u8a(bytes2)) throw new Error("Uint8Array expected");
return hexToNumber(bytesToHex(Uint8Array.from(bytes2).reverse()));
}
function numberToBytesBE(n, len) {
return hexToBytes(n.toString(16).padStart(len * 2, "0"));
}
function numberToBytesLE(n, len) {
return numberToBytesBE(n, len).reverse();
}
function numberToVarBytesBE(n) {
return hexToBytes(numberToHexUnpadded(n));
}
function ensureBytes(title, hex, expectedLength) {
let res;
if (typeof hex === "string") {
try {
res = hexToBytes(hex);
} catch (e) {
throw new Error(
`${title} must be valid hex string, got "${hex}". Cause: ${e}`,
);
}
} else if (u8a(hex)) {
res = Uint8Array.from(hex);
} else {
throw new Error(`${title} must be hex string or Uint8Array`);
}
const len = res.length;
if (typeof expectedLength === "number" && len !== expectedLength)
throw new Error(`${title} expected ${expectedLength} bytes, got ${len}`);
return res;
}
function concatBytes(...arrays) {
const r = new Uint8Array(arrays.reduce((sum, a) => sum + a.length, 0));
let pad = 0;
arrays.forEach((a) => {
if (!u8a(a)) throw new Error("Uint8Array expected");
r.set(a, pad);
pad += a.length;
});
return r;
}
function equalBytes(b1, b2) {
if (b1.length !== b2.length) return false;
for (let i = 0; i < b1.length; i++) if (b1[i] !== b2[i]) return false;
return true;
}
function utf8ToBytes(str) {
if (typeof str !== "string")
throw new Error(`utf8ToBytes expected string, got ${typeof str}`);
return new Uint8Array(new TextEncoder().encode(str));
}
function bitLen(n) {
let len;
for (len = 0; n > _0n; n >>= _1n, len += 1);
return len;
}
function bitGet(n, pos) {
return (n >> BigInt(pos)) & _1n;
}
var bitSet = (n, pos, value) => {
return n | ((value ? _1n : _0n) << BigInt(pos));
};
var bitMask = (n) => (_2n << BigInt(n - 1)) - _1n;
var u8n = (data) => new Uint8Array(data);
var u8fr = (arr) => Uint8Array.from(arr);
function createHmacDrbg(hashLen, qByteLen, hmacFn) {
if (typeof hashLen !== "number" || hashLen < 2)
throw new Error("hashLen must be a number");
if (typeof qByteLen !== "number" || qByteLen < 2)
throw new Error("qByteLen must be a number");
if (typeof hmacFn !== "function")
throw new Error("hmacFn must be a function");
let v = u8n(hashLen);
let k = u8n(hashLen);
let i = 0;
const reset = () => {
v.fill(1);
k.fill(0);
i = 0;
};
const h = (...b) => hmacFn(k, v, ...b);
const reseed = (seed = u8n()) => {
k = h(u8fr([0]), seed);
v = h();
if (seed.length === 0) return;
k = h(u8fr([1]), seed);
v = h();
};
const gen2 = () => {
if (i++ >= 1e3) throw new Error("drbg: tried 1000 values");
let len = 0;
const out = [];
while (len < qByteLen) {
v = h();
const sl = v.slice();
out.push(sl);
len += v.length;
}
return concatBytes(...out);
};
const genUntil = (seed, pred) => {
reset();
reseed(seed);
let res = void 0;
while (!(res = pred(gen2()))) reseed();
reset();
return res;
};
return genUntil;
}
var validatorFns = {
bigint: (val) => typeof val === "bigint",
function: (val) => typeof val === "function",
boolean: (val) => typeof val === "boolean",
string: (val) => typeof val === "string",
stringOrUint8Array: (val) =>
typeof val === "string" || val instanceof Uint8Array,
isSafeInteger: (val) => Number.isSafeInteger(val),
array: (val) => Array.isArray(val),
field: (val, object) => object.Fp.isValid(val),
hash: (val) =>
typeof val === "function" && Number.isSafeInteger(val.outputLen),
};
function validateObject(object, validators, optValidators = {}) {
const checkField = (fieldName, type, isOptional) => {
const checkVal = validatorFns[type];
if (typeof checkVal !== "function")
throw new Error(`Invalid validator "${type}", expected function`);
const val = object[fieldName];
if (isOptional && val === void 0) return;
if (!checkVal(val, object)) {
throw new Error(
`Invalid param ${String(
fieldName,
)}=${val} (${typeof val}), expected ${type}`,
);
}
};
for (const [fieldName, type] of Object.entries(validators))
checkField(fieldName, type, false);
for (const [fieldName, type] of Object.entries(optValidators))
checkField(fieldName, type, true);
return object;
}
// ../node_modules/@noble/hashes/esm/_assert.js
function number(n) {
if (!Number.isSafeInteger(n) || n < 0)
throw new Error(`Wrong positive integer: ${n}`);
}
function bytes(b, ...lengths) {
if (!(b instanceof Uint8Array)) throw new Error("Expected Uint8Array");
if (lengths.length > 0 && !lengths.includes(b.length))
throw new Error(
`Expected Uint8Array of length ${lengths}, not of length=${b.length}`,
);
}
function hash(hash2) {
if (typeof hash2 !== "function" || typeof hash2.create !== "function")
throw new Error("Hash should be wrapped by utils.wrapConstructor");
number(hash2.outputLen);
number(hash2.blockLen);
}
function exists(instance, checkFinished = true) {
if (instance.destroyed) throw new Error("Hash instance has been destroyed");
if (checkFinished && instance.finished)
throw new Error("Hash#digest() has already been called");
}
function output(out, instance) {
bytes(out);
const min = instance.outputLen;
if (out.length < min) {
throw new Error(
`digestInto() expects output buffer of length at least ${min}`,
);
}
}
// ../node_modules/@noble/hashes/esm/crypto.js
var crypto =
typeof globalThis === "object" && "crypto" in globalThis
? globalThis.crypto
: void 0;
// ../node_modules/@noble/hashes/esm/utils.js
var u8a2 = (a) => a instanceof Uint8Array;
var u32 = (arr) =>
new Uint32Array(arr.buffer, arr.byteOffset, Math.floor(arr.byteLength / 4));
var createView = (arr) =>
new DataView(arr.buffer, arr.byteOffset, arr.byteLength);
var rotr = (word, shift) => (word << (32 - shift)) | (word >>> shift);
var isLE = new Uint8Array(new Uint32Array([287454020]).buffer)[0] === 68;
if (!isLE) throw new Error("Non little-endian hardware is not supported");
function utf8ToBytes2(str) {
if (typeof str !== "string")
throw new Error(`utf8ToBytes expected string, got ${typeof str}`);
return new Uint8Array(new TextEncoder().encode(str));
}
function toBytes(data) {
if (typeof data === "string") data = utf8ToBytes2(data);
if (!u8a2(data)) throw new Error(`expected Uint8Array, got ${typeof data}`);
return data;
}
function concatBytes2(...arrays) {
const r = new Uint8Array(arrays.reduce((sum, a) => sum + a.length, 0));
let pad = 0;
arrays.forEach((a) => {
if (!u8a2(a)) throw new Error("Uint8Array expected");
r.set(a, pad);
pad += a.length;
});
return r;
}
var Hash = class {
// Safe version that clones internal state
clone() {
return this._cloneInto();
}
};
var toStr = {}.toString;
function wrapConstructor(hashCons) {
const hashC = (msg) => hashCons().update(toBytes(msg)).digest();
const tmp = hashCons();
hashC.outputLen = tmp.outputLen;
hashC.blockLen = tmp.blockLen;
hashC.create = () => hashCons();
return hashC;
}
function wrapXOFConstructorWithOpts(hashCons) {
const hashC = (msg, opts) => hashCons(opts).update(toBytes(msg)).digest();
const tmp = hashCons({});
hashC.outputLen = tmp.outputLen;
hashC.blockLen = tmp.blockLen;
hashC.create = (opts) => hashCons(opts);
return hashC;
}
function randomBytes(bytesLength = 32) {
if (crypto && typeof crypto.getRandomValues === "function") {
return crypto.getRandomValues(new Uint8Array(bytesLength));
}
throw new Error("crypto.getRandomValues must be defined");
}
// ../node_modules/@noble/hashes/esm/_sha2.js
function setBigUint64(view, byteOffset, value, isLE2) {
if (typeof view.setBigUint64 === "function")
return view.setBigUint64(byteOffset, value, isLE2);
const _32n2 = BigInt(32);
const _u32_max = BigInt(4294967295);
const wh = Number((value >> _32n2) & _u32_max);
const wl = Number(value & _u32_max);
const h = isLE2 ? 4 : 0;
const l = isLE2 ? 0 : 4;
view.setUint32(byteOffset + h, wh, isLE2);
view.setUint32(byteOffset + l, wl, isLE2);
}
var SHA2 = class extends Hash {
constructor(blockLen, outputLen, padOffset, isLE2) {
super();
this.blockLen = blockLen;
this.outputLen = outputLen;
this.padOffset = padOffset;
this.isLE = isLE2;
this.finished = false;
this.length = 0;
this.pos = 0;
this.destroyed = false;
this.buffer = new Uint8Array(blockLen);
this.view = createView(this.buffer);
}
update(data) {
exists(this);
const { view, buffer, blockLen } = this;
data = toBytes(data);
const len = data.length;
for (let pos = 0; pos < len; ) {
const take = Math.min(blockLen - this.pos, len - pos);
if (take === blockLen) {
const dataView = createView(data);
for (; blockLen <= len - pos; pos += blockLen)
this.process(dataView, pos);
continue;
}
buffer.set(data.subarray(pos, pos + take), this.pos);
this.pos += take;
pos += take;
if (this.pos === blockLen) {
this.process(view, 0);
this.pos = 0;
}
}
this.length += data.length;
this.roundClean();
return this;
}
digestInto(out) {
exists(this);
output(out, this);
this.finished = true;
const { buffer, view, blockLen, isLE: isLE2 } = this;
let { pos } = this;
buffer[pos++] = 128;
this.buffer.subarray(pos).fill(0);
if (this.padOffset > blockLen - pos) {
this.process(view, 0);
pos = 0;
}
for (let i = pos; i < blockLen; i++) buffer[i] = 0;
setBigUint64(view, blockLen - 8, BigInt(this.length * 8), isLE2);
this.process(view, 0);
const oview = createView(out);
const len = this.outputLen;
if (len % 4)
throw new Error("_sha2: outputLen should be aligned to 32bit");
const outLen = len / 4;
const state = this.get();
if (outLen > state.length)
throw new Error("_sha2: outputLen bigger than state");
for (let i = 0; i < outLen; i++) oview.setUint32(4 * i, state[i], isLE2);
}
digest() {
const { buffer, outputLen } = this;
this.digestInto(buffer);
const res = buffer.slice(0, outputLen);
this.destroy();
return res;
}
_cloneInto(to) {
to || (to = new this.constructor());
to.set(...this.get());
const { blockLen, buffer, length, finished, destroyed, pos } = this;
to.length = length;
to.pos = pos;
to.finished = finished;
to.destroyed = destroyed;
if (length % blockLen) to.buffer.set(buffer);
return to;
}
};
// ../node_modules/@noble/hashes/esm/sha256.js
var Chi = (a, b, c) => (a & b) ^ (~a & c);
var Maj = (a, b, c) => (a & b) ^ (a & c) ^ (b & c);
var SHA256_K = /* @__PURE__ */ new Uint32Array([
1116352408, 1899447441, 3049323471, 3921009573, 961987163, 1508970993,
2453635748, 2870763221, 3624381080, 310598401, 607225278, 1426881987,
1925078388, 2162078206, 2614888103, 3248222580, 3835390401, 4022224774,
264347078, 604807628, 770255983, 1249150122, 1555081692, 1996064986,
2554220882, 2821834349, 2952996808, 3210313671, 3336571891, 3584528711,
113926993, 338241895, 666307205, 773529912, 1294757372, 1396182291,
1695183700, 1986661051, 2177026350, 2456956037, 2730485921, 2820302411,
3259730800, 3345764771, 3516065817, 3600352804, 4094571909, 275423344,
430227734, 506948616, 659060556, 883997877, 958139571, 1322822218,
1537002063, 1747873779, 1955562222, 2024104815, 2227730452, 2361852424,
2428436474, 2756734187, 3204031479, 3329325298,
]);
var IV = /* @__PURE__ */ new Uint32Array([
1779033703, 3144134277, 1013904242, 2773480762, 1359893119, 2600822924,
528734635, 1541459225,
]);
var SHA256_W = /* @__PURE__ */ new Uint32Array(64);
var SHA256 = class extends SHA2 {
constructor() {
super(64, 32, 8, false);
this.A = IV[0] | 0;
this.B = IV[1] | 0;
this.C = IV[2] | 0;
this.D = IV[3] | 0;
this.E = IV[4] | 0;
this.F = IV[5] | 0;
this.G = IV[6] | 0;
this.H = IV[7] | 0;
}
get() {
const { A, B, C, D, E, F, G, H } = this;
return [A, B, C, D, E, F, G, H];
}
// prettier-ignore
set(A, B, C, D, E, F, G, H) {
this.A = A | 0;
this.B = B | 0;
this.C = C | 0;
this.D = D | 0;
this.E = E | 0;
this.F = F | 0;
this.G = G | 0;
this.H = H | 0;
}
process(view, offset) {
for (let i = 0; i < 16; i++, offset += 4)
SHA256_W[i] = view.getUint32(offset, false);
for (let i = 16; i < 64; i++) {
const W15 = SHA256_W[i - 15];
const W2 = SHA256_W[i - 2];
const s0 = rotr(W15, 7) ^ rotr(W15, 18) ^ (W15 >>> 3);
const s1 = rotr(W2, 17) ^ rotr(W2, 19) ^ (W2 >>> 10);
SHA256_W[i] = (s1 + SHA256_W[i - 7] + s0 + SHA256_W[i - 16]) | 0;
}
let { A, B, C, D, E, F, G, H } = this;
for (let i = 0; i < 64; i++) {
const sigma1 = rotr(E, 6) ^ rotr(E, 11) ^ rotr(E, 25);
const T1 = (H + sigma1 + Chi(E, F, G) + SHA256_K[i] + SHA256_W[i]) | 0;
const sigma0 = rotr(A, 2) ^ rotr(A, 13) ^ rotr(A, 22);
const T2 = (sigma0 + Maj(A, B, C)) | 0;
H = G;
G = F;
F = E;
E = (D + T1) | 0;
D = C;
C = B;
B = A;
A = (T1 + T2) | 0;
}
A = (A + this.A) | 0;
B = (B + this.B) | 0;
C = (C + this.C) | 0;
D = (D + this.D) | 0;
E = (E + this.E) | 0;
F = (F + this.F) | 0;
G = (G + this.G) | 0;
H = (H + this.H) | 0;
this.set(A, B, C, D, E, F, G, H);
}
roundClean() {
SHA256_W.fill(0);
}
destroy() {
this.set(0, 0, 0, 0, 0, 0, 0, 0);
this.buffer.fill(0);
}
};
var sha256 = /* @__PURE__ */ wrapConstructor(() => new SHA256());
// ../esm/abstract/modular.js
var _0n2 = BigInt(0);
var _1n2 = BigInt(1);
var _2n2 = BigInt(2);
var _3n = BigInt(3);
var _4n = BigInt(4);
var _5n = BigInt(5);
var _8n = BigInt(8);
var _9n = BigInt(9);
var _16n = BigInt(16);
function mod(a, b) {
const result = a % b;
return result >= _0n2 ? result : b + result;
}
function pow(num, power, modulo) {
if (modulo <= _0n2 || power < _0n2)
throw new Error("Expected power/modulo > 0");
if (modulo === _1n2) return _0n2;
let res = _1n2;
while (power > _0n2) {
if (power & _1n2) res = (res * num) % modulo;
num = (num * num) % modulo;
power >>= _1n2;
}
return res;
}
function pow2(x, power, modulo) {
let res = x;
while (power-- > _0n2) {
res *= res;
res %= modulo;
}
return res;
}
function invert(number2, modulo) {
if (number2 === _0n2 || modulo <= _0n2) {
throw new Error(
`invert: expected positive integers, got n=${number2} mod=${modulo}`,
);
}
let a = mod(number2, modulo);
let b = modulo;
let x = _0n2,
y = _1n2,
u = _1n2,
v = _0n2;
while (a !== _0n2) {
const q = b / a;
const r = b % a;
const m = x - u * q;
const n = y - v * q;
(b = a), (a = r), (x = u), (y = v), (u = m), (v = n);
}
const gcd = b;
if (gcd !== _1n2) throw new Error("invert: does not exist");
return mod(x, modulo);
}
function tonelliShanks(P3) {
const legendreC = (P3 - _1n2) / _2n2;
let Q, S, Z;
for (Q = P3 - _1n2, S = 0; Q % _2n2 === _0n2; Q /= _2n2, S++);
for (Z = _2n2; Z < P3 && pow(Z, legendreC, P3) !== P3 - _1n2; Z++);
if (S === 1) {
const p1div4 = (P3 + _1n2) / _4n;
return function tonelliFast(Fp8, n) {
const root = Fp8.pow(n, p1div4);
if (!Fp8.eql(Fp8.sqr(root), n))
throw new Error("Cannot find square root");
return root;
};
}
const Q1div2 = (Q + _1n2) / _2n2;
return function tonelliSlow(Fp8, n) {
if (Fp8.pow(n, legendreC) === Fp8.neg(Fp8.ONE))
throw new Error("Cannot find square root");
let r = S;
let g = Fp8.pow(Fp8.mul(Fp8.ONE, Z), Q);
let x = Fp8.pow(n, Q1div2);
let b = Fp8.pow(n, Q);
while (!Fp8.eql(b, Fp8.ONE)) {
if (Fp8.eql(b, Fp8.ZERO)) return Fp8.ZERO;
let m = 1;
for (let t2 = Fp8.sqr(b); m < r; m++) {
if (Fp8.eql(t2, Fp8.ONE)) break;
t2 = Fp8.sqr(t2);
}
const ge2 = Fp8.pow(g, _1n2 << BigInt(r - m - 1));
g = Fp8.sqr(ge2);
x = Fp8.mul(x, ge2);
b = Fp8.mul(b, g);
r = m;
}
return x;
};
}
function FpSqrt(P3) {
if (P3 % _4n === _3n) {
const p1div4 = (P3 + _1n2) / _4n;
return function sqrt3mod4(Fp8, n) {
const root = Fp8.pow(n, p1div4);
if (!Fp8.eql(Fp8.sqr(root), n))
throw new Error("Cannot find square root");
return root;
};
}
if (P3 % _8n === _5n) {
const c1 = (P3 - _5n) / _8n;
return function sqrt5mod8(Fp8, n) {
const n2 = Fp8.mul(n, _2n2);
const v = Fp8.pow(n2, c1);
const nv = Fp8.mul(n, v);
const i = Fp8.mul(Fp8.mul(nv, _2n2), v);
const root = Fp8.mul(nv, Fp8.sub(i, Fp8.ONE));
if (!Fp8.eql(Fp8.sqr(root), n))
throw new Error("Cannot find square root");
return root;
};
}
if (P3 % _16n === _9n) {
}
return tonelliShanks(P3);
}
var isNegativeLE = (num, modulo) => (mod(num, modulo) & _1n2) === _1n2;
var FIELD_FIELDS = [
"create",
"isValid",
"is0",
"neg",
"inv",
"sqrt",
"sqr",
"eql",
"add",
"sub",
"mul",
"pow",
"div",
"addN",
"subN",
"mulN",
"sqrN",
];
function validateField(field) {
const initial = {
ORDER: "bigint",
MASK: "bigint",
BYTES: "isSafeInteger",
BITS: "isSafeInteger",
};
const opts = FIELD_FIELDS.reduce((map, val) => {
map[val] = "function";
return map;
}, initial);
return validateObject(field, opts);
}
function FpPow(f, num, power) {
if (power < _0n2) throw new Error("Expected power > 0");
if (power === _0n2) return f.ONE;
if (power === _1n2) return num;
let p = f.ONE;
let d = num;
while (power > _0n2) {
if (power & _1n2) p = f.mul(p, d);
d = f.sqr(d);
power >>= _1n2;
}
return p;
}
function FpInvertBatch(f, nums) {
const tmp = new Array(nums.length);
const lastMultiplied = nums.reduce((acc, num, i) => {
if (f.is0(num)) return acc;
tmp[i] = acc;
return f.mul(acc, num);
}, f.ONE);
const inverted = f.inv(lastMultiplied);
nums.reduceRight((acc, num, i) => {
if (f.is0(num)) return acc;
tmp[i] = f.mul(acc, tmp[i]);
return f.mul(acc, num);
}, inverted);
return tmp;
}
function nLength(n, nBitLength) {
const _nBitLength =
nBitLength !== void 0 ? nBitLength : n.toString(2).length;
const nByteLength = Math.ceil(_nBitLength / 8);
return { nBitLength: _nBitLength, nByteLength };
}
function Field(ORDER, bitLen2, isLE2 = false, redef = {}) {
if (ORDER <= _0n2)
throw new Error(`Expected Field ORDER > 0, got ${ORDER}`);
const { nBitLength: BITS, nByteLength: BYTES } = nLength(ORDER, bitLen2);
if (BYTES > 2048)
throw new Error("Field lengths over 2048 bytes are not supported");
const sqrtP = FpSqrt(ORDER);
const f = Object.freeze({
ORDER,
BITS,
BYTES,
MASK: bitMask(BITS),
ZERO: _0n2,
ONE: _1n2,
create: (num) => mod(num, ORDER),
isValid: (num) => {
if (typeof num !== "bigint")
throw new Error(
`Invalid field element: expected bigint, got ${typeof num}`,
);
return _0n2 <= num && num < ORDER;
},
is0: (num) => num === _0n2,
isOdd: (num) => (num & _1n2) === _1n2,
neg: (num) => mod(-num, ORDER),
eql: (lhs, rhs) => lhs === rhs,
sqr: (num) => mod(num * num, ORDER),
add: (lhs, rhs) => mod(lhs + rhs, ORDER),
sub: (lhs, rhs) => mod(lhs - rhs, ORDER),
mul: (lhs, rhs) => mod(lhs * rhs, ORDER),
pow: (num, power) => FpPow(f, num, power),
div: (lhs, rhs) => mod(lhs * invert(rhs, ORDER), ORDER),
// Same as above, but doesn't normalize
sqrN: (num) => num * num,
addN: (lhs, rhs) => lhs + rhs,
subN: (lhs, rhs) => lhs - rhs,
mulN: (lhs, rhs) => lhs * rhs,
inv: (num) => invert(num, ORDER),
sqrt: redef.sqrt || ((n) => sqrtP(f, n)),
invertBatch: (lst) => FpInvertBatch(f, lst),
// TODO: do we really need constant cmov?
// We don't have const-time bigints anyway, so probably will be not very useful
cmov: (a, b, c) => (c ? b : a),
toBytes: (num) =>
isLE2 ? numberToBytesLE(num, BYTES) : numberToBytesBE(num, BYTES),
fromBytes: (bytes2) => {
if (bytes2.length !== BYTES)
throw new Error(
`Fp.fromBytes: expected ${BYTES}, got ${bytes2.length}`,
);
return isLE2 ? bytesToNumberLE(bytes2) : bytesToNumberBE(bytes2);
},
});
return Object.freeze(f);
}
function FpSqrtEven(Fp8, elm) {
if (!Fp8.isOdd) throw new Error(`Field doesn't have isOdd`);
const root = Fp8.sqrt(elm);
return Fp8.isOdd(root) ? Fp8.neg(root) : root;
}
function getFieldBytesLength(fieldOrder) {
if (typeof fieldOrder !== "bigint")
throw new Error("field order must be bigint");
const bitLength = fieldOrder.toString(2).length;
return Math.ceil(bitLength / 8);
}
function getMinHashLength(fieldOrder) {
const length = getFieldBytesLength(fieldOrder);
return length + Math.ceil(length / 2);
}
function mapHashToField(key, fieldOrder, isLE2 = false) {
const len = key.length;
const fieldLen = getFieldBytesLength(fieldOrder);
const minLen = getMinHashLength(fieldOrder);
if (len < 16 || len < minLen || len > 1024)
throw new Error(`expected ${minLen}-1024 bytes of input, got ${len}`);
const num = isLE2 ? bytesToNumberBE(key) : bytesToNumberLE(key);
const reduced = mod(num, fieldOrder - _1n2) + _1n2;
return isLE2
? numberToBytesLE(reduced, fieldLen)
: numberToBytesBE(reduced, fieldLen);
}
// ../esm/abstract/curve.js
var _0n3 = BigInt(0);
var _1n3 = BigInt(1);
function wNAF(c, bits) {
const constTimeNegate = (condition, item) => {
const neg = item.negate();
return condition ? neg : item;
};
const opts = (W) => {
const windows = Math.ceil(bits / W) + 1;
const windowSize = 2 ** (W - 1);
return { windows, windowSize };
};
return {
constTimeNegate,
// non-const time multiplication ladder
unsafeLadder(elm, n) {
let p = c.ZERO;
let d = elm;
while (n > _0n3) {
if (n & _1n3) p = p.add(d);
d = d.double();
n >>= _1n3;
}
return p;
},
/**
* Creates a wNAF precomputation window. Used for caching.
* Default window size is set by `utils.precompute()` and is equal to 8.
* Number of precomputed points depends on the curve size:
* 2^(𝑊−1) * (Math.ceil(𝑛 / 𝑊) + 1), where:
* - 𝑊 is the window size
* - 𝑛 is the bitlength of the curve order.
* For a 256-bit curve and window size 8, the number of precomputed points is 128 * 33 = 4224.
* @returns precomputed point tables flattened to a single array
*/
precomputeWindow(elm, W) {
const { windows, windowSize } = opts(W);
const points = [];
let p = elm;
let base = p;
for (let window = 0; window < windows; window++) {
base = p;
points.push(base);
for (let i = 1; i < windowSize; i++) {
base = base.add(p);
points.push(base);
}
p = base.double();
}
return points;
},
/**
* Implements ec multiplication using precomputed tables and w-ary non-adjacent form.
* @param W window size
* @param precomputes precomputed tables
* @param n scalar (we don't check here, but should be less than curve order)
* @returns real and fake (for const-time) points
*/
wNAF(W, precomputes, n) {
const { windows, windowSize } = opts(W);
let p = c.ZERO;
let f = c.BASE;
const mask = BigInt(2 ** W - 1);
const maxNumber = 2 ** W;
const shiftBy = BigInt(W);
for (let window = 0; window < windows; window++) {
const offset = window * windowSize;
let wbits = Number(n & mask);
n >>= shiftBy;
if (wbits > windowSize) {
wbits -= maxNumber;
n += _1n3;
}
const offset1 = offset;
const offset2 = offset + Math.abs(wbits) - 1;
const cond1 = window % 2 !== 0;
const cond2 = wbits < 0;
if (wbits === 0) {
f = f.add(constTimeNegate(cond1, precomputes[offset1]));
} else {
p = p.add(constTimeNegate(cond2, precomputes[offset2]));
}
}
return { p, f };
},
wNAFCached(P3, precomputesMap, n, transform) {
const W = P3._WINDOW_SIZE || 1;
let comp = precomputesMap.get(P3);
if (!comp) {
comp = this.precomputeWindow(P3, W);
if (W !== 1) {
precomputesMap.set(P3, transform(comp));
}
}
return this.wNAF(W, comp, n);
},
};
}
function validateBasic(curve) {
validateField(curve.Fp);
validateObject(
curve,
{
n: "bigint",
h: "bigint",
Gx: "field",
Gy: "field",
},
{
nBitLength: "isSafeInteger",
nByteLength: "isSafeInteger",
},
);
return Object.freeze({
...nLength(curve.n, curve.nBitLength),
...curve,
...{ p: curve.Fp.ORDER },
});
}
// ../esm/abstract/weierstrass.js
function validatePointOpts(curve) {
const opts = validateBasic(curve);
validateObject(
opts,
{
a: "field",
b: "field",
},
{
allowedPrivateKeyLengths: "array",
wrapPrivateKey: "boolean",
isTorsionFree: "function",
clearCofactor: "function",
allowInfinityPoint: "boolean",
fromBytes: "function",
toBytes: "function",
},
);
const { endo, Fp: Fp8, a } = opts;
if (endo) {
if (!Fp8.eql(a, Fp8.ZERO)) {
throw new Error(
"Endomorphism can only be defined for Koblitz curves that have a=0",
);
}
if (
typeof endo !== "object" ||
typeof endo.beta !== "bigint" ||
typeof endo.splitScalar !== "function"
) {
throw new Error(
"Expected endomorphism with beta: bigint and splitScalar: function",
);
}
}
return Object.freeze({ ...opts });
}
var { bytesToNumberBE: b2n, hexToBytes: h2b } = utils_exports;
var DER = {
// asn.1 DER encoding utils
Err: class DERErr extends Error {
constructor(m = "") {
super(m);
}
},
_parseInt(data) {
const { Err: E } = DER;
if (data.length < 2 || data[0] !== 2)
throw new E("Invalid signature integer tag");
const len = data[1];
const res = data.subarray(2, len + 2);
if (!len || res.length !== len)
throw new E("Invalid signature integer: wrong length");
if (res[0] & 128) throw new E("Invalid signature integer: negative");
if (res[0] === 0 && !(res[1] & 128))
throw new E("Invalid signature integer: unnecessary leading zero");
return { d: b2n(res), l: data.subarray(len + 2) };
},
toSig(hex) {
const { Err: E } = DER;
const data = typeof hex === "string" ? h2b(hex) : hex;
if (!(data instanceof Uint8Array)) throw new Error("ui8a expected");
let l = data.length;
if (l < 2 || data[0] != 48) throw new E("Invalid signature tag");
if (data[1] !== l - 2) throw new E("Invalid signature: incorrect length");
const { d: r, l: sBytes } = DER._parseInt(data.subarray(2));
const { d: s, l: rBytesLeft } = DER._parseInt(sBytes);
if (rBytesLeft.length)
throw new E("Invalid signature: left bytes after parsing");
return { r, s };
},
hexFromSig(sig) {
const slice = (s2) => (Number.parseInt(s2[0], 16) & 8 ? "00" + s2 : s2);
const h = (num) => {
const hex = num.toString(16);
return hex.length & 1 ? `0${hex}` : hex;
};
const s = slice(h(sig.s));
const r = slice(h(sig.r));
const shl = s.length / 2;
const rhl = r.length / 2;
const sl = h(shl);
const rl = h(rhl);
return `30${h(rhl + shl + 4)}02${rl}${r}02${sl}${s}`;
},
};
var _0n4 = BigInt(0);
var _1n4 = BigInt(1);
var _2n3 = BigInt(2);
var _3n2 = BigInt(3);
var _4n2 = BigInt(4);
function weierstrassPoints(opts) {
const CURVE2 = validatePointOpts(opts);
const { Fp: Fp8 } = CURVE2;
const toBytes2 =
CURVE2.toBytes ||
((_c, point, _isCompressed) => {
const a = point.toAffine();
return concatBytes(
Uint8Array.from([4]),
Fp8.toBytes(a.x),
Fp8.toBytes(a.y),
);
});
const fromBytes =
CURVE2.fromBytes ||
((bytes2) => {
const tail = bytes2.subarray(1);
const x = Fp8.fromBytes(tail.subarray(0, Fp8.BYTES));
const y = Fp8.fromBytes(tail.subarray(Fp8.BYTES, 2 * Fp8.BYTES));
return { x, y };
});
function weierstrassEquation(x) {
const { a, b } = CURVE2;
const x2 = Fp8.sqr(x);
const x3 = Fp8.mul(x2, x);
return Fp8.add(Fp8.add(x3, Fp8.mul(x, a)), b);
}
if (!Fp8.eql(Fp8.sqr(CURVE2.Gy), weierstrassEquation(CURVE2.Gx)))
throw new Error("bad generator point: equation left != right");
function isWithinCurveOrder(num) {
return typeof num === "bigint" && _0n4 < num && num < CURVE2.n;
}
function assertGE(num) {
if (!isWithinCurveOrder(num))
throw new Error("Expected valid bigint: 0 < bigint < curve.n");
}
function normPrivateKeyToScalar(key) {
const {
allowedPrivateKeyLengths: lengths,
nByteLength,
wrapPrivateKey,
n,
} = CURVE2;
if (lengths && typeof key !== "bigint") {
if (key instanceof Uint8Array) key = bytesToHex(key);
if (typeof key !== "string" || !lengths.includes(key.length))
throw new Error("Invalid key");
key = key.padStart(nByteLength * 2, "0");
}
let num;
try {
num =
typeof key === "bigint"
? key
: bytesToNumberBE(ensureBytes("private key", key, nByteLength));
} catch (error) {
throw new Error(
`private key must be ${nByteLength} bytes, hex or bigint, not ${typeof key}`,
);
}
if (wrapPrivateKey) num = mod(num, n);
assertGE(num);
return num;
}
const pointPrecomputes = /* @__PURE__ */ new Map();
function assertPrjPoint(other) {
if (!(other instanceof Point2))
throw new Error("ProjectivePoint expected");
}
class Point2 {
constructor(px, py, pz) {
this.px = px;
this.py = py;
this.pz = pz;
if (px == null || !Fp8.isValid(px)) throw new Error("x required");
if (py == null || !Fp8.isValid(py)) throw new Error("y required");
if (pz == null || !Fp8.isValid(pz)) throw new Error("z required");
}
// Does not validate if the point is on-curve.
// Use fromHex instead, or call assertValidity() later.
static fromAffine(p) {
const { x, y } = p || {};
if (!p || !Fp8.isValid(x) || !Fp8.isValid(y))
throw new Error("invalid affine point");
if (p instanceof Point2)
throw new Error("projective point not allowed");
const is0 = (i) => Fp8.eql(i, Fp8.ZERO);
if (is0(x) && is0(y)) return Point2.ZERO;
return new Point2(x, y, Fp8.ONE);
}
get x() {
return this.toAffine().x;
}
get y() {
return this.toAffine().y;
}
/**
* Takes a bunch of Projective Points but executes only one
* inversion on all of them. Inversion is very slow operation,
* so this improves performance massively.
* Optimization: converts a list of projective points to a list of identical points with Z=1.
*/
static normalizeZ(points) {
const toInv = Fp8.invertBatch(points.map((p) => p.pz));
return points
.map((p, i) => p.toAffine(toInv[i]))
.map(Point2.fromAffine);
}
/**
* Converts hash string or Uint8Array to Point.
* @param hex short/long ECDSA hex
*/
static fromHex(hex) {
const P3 = Point2.fromAffine(fromBytes(ensureBytes("pointHex", hex)));
P3.assertValidity();
return P3;
}
// Multiplies generator point by privateKey.
static fromPrivateKey(privateKey) {
return Point2.BASE.multiply(normPrivateKeyToScalar(privateKey));
}
// "Private method", don't use it directly
_setWindowSize(windowSize) {
this._WINDOW_SIZE = windowSize;
pointPrecomputes.delete(this);
}
// A point on curve is valid if it conforms to equation.
assertValidity() {
if (this.is0()) {
if (CURVE2.allowInfinityPoint && !Fp8.is0(this.py)) return;
throw new Error("bad point: ZERO");
}
const { x, y } = this.toAffine();
if (!Fp8.isValid(x) || !Fp8.isValid(y))
throw new Error("bad point: x or y not FE");
const left = Fp8.sqr(y);
const right = weierstrassEquation(x);
if (!Fp8.eql(left, right))
throw new Error("bad point: equation left != right");
if (!this.isTorsionFree())
throw new Error("bad point: not in prime-order subgroup");
}
hasEvenY() {
const { y } = this.toAffine();
if (Fp8.isOdd) return !Fp8.isOdd(y);
throw new Error("Field doesn't support isOdd");
}
/**
* Compare one point to another.
*/
equals(other) {
assertPrjPoint(other);
const { px: X1, py: Y1, pz: Z1 } = this;
const { px: X2, py: Y2, pz: Z2 } = other;
const U1 = Fp8.eql(Fp8.mul(X1, Z2), Fp8.mul(X2, Z1));
const U2 = Fp8.eql(Fp8.mul(Y1, Z2), Fp8.mul(Y2, Z1));
return U1 && U2;
}
/**
* Flips point to one corresponding to (x, -y) in Affine coordinates.
*/
negate() {
return new Point2(this.px, Fp8.neg(this.py), this.pz);
}
// Renes-Costello-Batina exception-free doubling formula.
// There is 30% faster Jacobian formula, but it is not complete.
// https://eprint.iacr.org/2015/1060, algorithm 3
// Cost: 8M + 3S + 3*a + 2*b3 + 15add.
double() {
const { a, b } = CURVE2;
const b3 = Fp8.mul(b, _3n2);
const { px: X1, py: Y1, pz: Z1 } = this;
let X3 = Fp8.ZERO,
Y3 = Fp8.ZERO,
Z3 = Fp8.ZERO;
let t0 = Fp8.mul(X1, X1);
let t1 = Fp8.mul(Y1, Y1);
let t2 = Fp8.mul(Z1, Z1);
let t3 = Fp8.mul(X1, Y1);
t3 = Fp8.add(t3, t3);
Z3 = Fp8.mul(X1, Z1);
Z3 = Fp8.add(Z3, Z3);
X3 = Fp8.mul(a, Z3);
Y3 = Fp8.mul(b3, t2);
Y3 = Fp8.add(X3, Y3);
X3 = Fp8.sub(t1, Y3);
Y3 = Fp8.add(t1, Y3);
Y3 = Fp8.mul(X3, Y3);
X3 = Fp8.mul(t3, X3);
Z3 = Fp8.mul(b3, Z3);
t2 = Fp8.mul(a, t2);
t3 = Fp8.sub(t0, t2);
t3 = Fp8.mul(a, t3);
t3 = Fp8.add(t3, Z3);
Z3 = Fp8.add(t0, t0);
t0 = Fp8.add(Z3, t0);
t0 = Fp8.add(t0, t2);
t0 = Fp8.mul(t0, t3);
Y3 = Fp8.add(Y3, t0);
t2 = Fp8.mul(Y1, Z1);
t2 = Fp8.add(t2, t2);
t0 = Fp8.mul(t2, t3);
X3 = Fp8.sub(X3, t0);
Z3 = Fp8.mul(t2, t1);
Z3 = Fp8.add(Z3, Z3);
Z3 = Fp8.add(Z3, Z3);
return new Point2(X3, Y3, Z3);
}
// Renes-Costello-Batina exception-free addition formula.
// There is 30% faster Jacobian formula, but it is not complete.
// https://eprint.iacr.org/2015/1060, algorithm 1
// Cost: 12M + 0S + 3*a + 3*b3 + 23add.
add(other) {
assertPrjPoint(other);
const { px: X1, py: Y1, pz: Z1 } = this;
const { px: X2, py: Y2, pz: Z2 } = other;
let X3 = Fp8.ZERO,
Y3 = Fp8.ZERO,
Z3 = Fp8.ZERO;
const a = CURVE2.a;
const b3 = Fp8.mul(CURVE2.b, _3n2);
let t0 = Fp8.mul(X1, X2);
let t1 = Fp8.mul(Y1, Y2);
let t2 = Fp8.mul(Z1, Z2);
let t3 = Fp8.add(X1, Y1);
let t4 = Fp8.add(X2, Y2);
t3 = Fp8.mul(t3, t4);
t4 = Fp8.add(t0, t1);
t3 = Fp8.sub(t3, t4);
t4 = Fp8.add(X1, Z1);
let t5 = Fp8.add(X2, Z2);
t4 = Fp8.mul(t4, t5);
t5 = Fp8.add(t0, t2);
t4 = Fp8.sub(t4, t5);
t5 = Fp8.add(Y1, Z1);
X3 = Fp8.add(Y2, Z2);
t5 = Fp8.mul(t5, X3);
X3 = Fp8.add(t1, t2);
t5 = Fp8.sub(t5, X3);
Z3 = Fp8.mul(a, t4);
X3 = Fp8.mul(b3, t2);
Z3 = Fp8.add(X3, Z3);
X3 = Fp8.sub(t1, Z3);
Z3 = Fp8.add(t1, Z3);
Y3 = Fp8.mul(X3, Z3);
t1 = Fp8.add(t0, t0);
t1 = Fp8.add(t1, t0);
t2 = Fp8.mul(a, t2);
t4 = Fp8.mul(b3, t4);
t1 = Fp8.add(t1, t2);
t2 = Fp8.sub(t0, t2);
t2 = Fp8.mul(a, t2);
t4 = Fp8.add(t4, t2);
t0 = Fp8.mul(t1, t4);
Y3 = Fp8.add(Y3, t0);
t0 = Fp8.mul(t5, t4);
X3 = Fp8.mul(t3, X3);
X3 = Fp8.sub(X3, t0);
t0 = Fp8.mul(t3, t1);
Z3 = Fp8.mul(t5, Z3);
Z3 = Fp8.add(Z3, t0);
return new Point2(X3, Y3, Z3);
}
subtract(other) {
return this.add(other.negate());
}
is0() {
return this.equals(Point2.ZERO);
}
wNAF(n) {
return wnaf.wNAFCached(this, pointPrecomputes, n, (comp) => {
const toInv = Fp8.invertBatch(comp.map((p) => p.pz));
return comp
.map((p, i) => p.toAffine(toInv[i]))
.map(Point2.fromAffine);
});
}
/**
* Non-constant-time multiplication. Uses double-and-add algorithm.
* It's faster, but should only be used when you don't care about
* an exposed private key e.g. sig verification, which works over *public* keys.
*/
multiplyUnsafe(n) {
const I = Point2.ZERO;
if (n === _0n4) return I;
assertGE(n);
if (n === _1n4) return this;
const { endo } = CURVE2;
if (!endo) return wnaf.unsafeLadder(this, n);
let { k1neg, k1, k2neg, k2 } = endo.splitScalar(n);
let k1p = I;
let k2p = I;
let d = this;
while (k1 > _0n4 || k2 > _0n4) {
if (k1 & _1n4) k1p = k1p.add(d);
if (k2 & _1n4) k2p = k2p.add(d);
d = d.double();
k1 >>= _1n4;
k2 >>= _1n4;
}
if (k1neg) k1p = k1p.negate();
if (k2neg) k2p = k2p.negate();
k2p = new Point2(Fp8.mul(k2p.px, endo.beta), k2p.py, k2p.pz);
return k1p.add(k2p);
}
/**
* Constant time multiplication.
* Uses wNAF method. Windowed method may be 10% faster,
* but takes 2x longer to generate and consumes 2x memory.
* Uses precomputes when available.
* Uses endomorphism for Koblitz curves.
* @param scalar by which the point would be multiplied
* @returns New point
*/
multiply(scalar) {
assertGE(scalar);
let n = scalar;
let point, fake;
const { endo } = CURVE2;
if (endo) {
const { k1neg, k1, k2neg, k2 } = endo.splitScalar(n);
let { p: k1p, f: f1p } = this.wNAF(k1);
let { p: k2p, f: f2p } = this.wNAF(k2);
k1p = wnaf.constTimeNegate(k1neg, k1p);
k2p = wnaf.constTimeNegate(k2neg, k2p);
k2p = new Point2(Fp8.mul(k2p.px, endo.beta), k2p.py, k2p.pz);
point = k1p.add(k2p);
fake = f1p.add(f2p);
} else {
const { p, f } = this.wNAF(n);
point = p;
fake = f;
}
return Point2.normalizeZ([point, fake])[0];
}
/**
* Efficiently calculate `aP + bQ`. Unsafe, can expose private key, if used incorrectly.
* Not using Strauss-Shamir trick: precomputation tables are faster.
* The trick could be useful if both P and Q are not G (not in our case).
* @returns non-zero affine point
*/
multiplyAndAddUnsafe(Q, a, b) {
const G = Point2.BASE;
const mul = (P3, a2) =>
a2 === _0n4 || a2 === _1n4 || !P3.equals(G)
? P3.multiplyUnsafe(a2)
: P3.multiply(a2);
const sum = mul(this, a).add(mul(Q, b));
return sum.is0() ? void 0 : sum;
}
// Converts Projective point to affine (x, y) coordinates.
// Can accept precomputed Z^-1 - for example, from invertBatch.
// (x, y, z) ∋ (x=x/z, y=y/z)
toAffine(iz) {
const { px: x, py: y, pz: z } = this;
const is0 = this.is0();
if (iz == null) iz = is0 ? Fp8.ONE : Fp8.inv(z);
const ax = Fp8.mul(x, iz);
const ay = Fp8.mul(y, iz);
const zz = Fp8.mul(z, iz);
if (is0) return { x: Fp8.ZERO, y: Fp8.ZERO };
if (!Fp8.eql(zz, Fp8.ONE)) throw new Error("invZ was invalid");
return { x: ax, y: ay };
}
isTorsionFree() {
const { h: cofactor, isTorsionFree } = CURVE2;
if (cofactor === _1n4) return true;
if (isTorsionFree) return isTorsionFree(Point2, this);
throw new Error(
"isTorsionFree() has not been declared for the elliptic curve",
);
}
clearCofactor() {
const { h: cofactor, clearCofactor } = CURVE2;
if (cofactor === _1n4) return this;
if (clearCofactor) return clearCofactor(Point2, this);
return this.multiplyUnsafe(CURVE2.h);
}
toRawBytes(isCompressed = true) {
this.assertValidity();
return toBytes2(Point2, this, isCompressed);
}
toHex(isCompressed = true) {
return bytesToHex(this.toRawBytes(isCompressed));
}
}
Point2.BASE = new Point2(CURVE2.Gx, CURVE2.Gy, Fp8.ONE);
Point2.ZERO = new Point2(Fp8.ZERO, Fp8.ONE, Fp8.ZERO);
const _bits = CURVE2.nBitLength;
const wnaf = wNAF(Point2, CURVE2.endo ? Math.ceil(_bits / 2) : _bits);
return {
CURVE: CURVE2,
ProjectivePoint: Point2,
normPrivateKeyToScalar,
weierstrassEquation,
isWithinCurveOrder,
};
}
function validateOpts(curve) {
const opts = validateBasic(curve);
validateObject(
opts,
{
hash: "hash",
hmac: "function",
randomBytes: "function",
},
{
bits2int: "function",
bits2int_modN: "function",
lowS: "boolean",
},
);
return Object.freeze({ lowS: true, ...opts });
}
function weierstrass(curveDef) {
const CURVE2 = validateOpts(curveDef);
const { Fp: Fp8, n: CURVE_ORDER } = CURVE2;
const compressedLen = Fp8.BYTES + 1;
const uncompressedLen = 2 * Fp8.BYTES + 1;
function isValidFieldElement(num) {
return _0n4 < num && num < Fp8.ORDER;
}
function modN2(a) {
return mod(a, CURVE_ORDER);
}
function invN(a) {
return invert(a, CURVE_ORDER);
}
const {
ProjectivePoint: Point2,
normPrivateKeyToScalar,
weierstrassEquation,
isWithinCurveOrder,
} = weierstrassPoints({
...CURVE2,
toBytes(_c, point, isCompressed) {
const a = point.toAffine();
const x = Fp8.toBytes(a.x);
const cat = concatBytes;
if (isCompressed) {
return cat(Uint8Array.from([point.hasEvenY() ? 2 : 3]), x);
} else {
return cat(Uint8Array.from([4]), x, Fp8.toBytes(a.y));
}
},
fromBytes(bytes2) {
const len = bytes2.length;
const head = bytes2[0];
const tail = bytes2.subarray(1);
if (len === compressedLen && (head === 2 || head === 3)) {
const x = bytesToNumberBE(tail);
if (!isValidFieldElement(x)) throw new Error("Point is not on curve");
const y2 = weierstrassEquation(x);
let y = Fp8.sqrt(y2);
const isYOdd = (y & _1n4) === _1n4;
const isHeadOdd = (head & 1) === 1;
if (isHeadOdd !== isYOdd) y = Fp8.neg(y);
return { x, y };
} else if (len === uncompressedLen && head === 4) {
const x = Fp8.fromBytes(tail.subarray(0, Fp8.BYTES));
const y = Fp8.fromBytes(tail.subarray(Fp8.BYTES, 2 * Fp8.BYTES));
return { x, y };
} else {
throw new Error(
`Point of length ${len} was invalid. Expected ${compressedLen} compressed bytes or ${uncompressedLen} uncompressed bytes`,
);
}
},
});
const numToNByteStr = (num) =>
bytesToHex(numberToBytesBE(num, CURVE2.nByteLength));
function isBiggerThanHalfOrder(number2) {
const HALF = CURVE_ORDER >> _1n4;
return number2 > HALF;
}
function normalizeS(s) {
return isBiggerThanHalfOrder(s) ? modN2(-s) : s;
}
const slcNum = (b, from, to) => bytesToNumberBE(b.slice(from, to));
class Signature {
constructor(r, s, recovery) {
this.r = r;
this.s = s;
this.recovery = recovery;
this.assertValidity();
}
// pair (bytes of r, bytes of s)
static fromCompact(hex) {
const l = CURVE2.nByteLength;
hex = ensureBytes("compactSignature", hex, l * 2);
return new Signature(slcNum(hex, 0, l), slcNum(hex, l, 2 * l));
}
// DER encoded ECDSA signature
// https://bitcoin.stackexchange.com/questions/57644/what-are-the-parts-of-a-bitcoin-transaction-input-script
static fromDER(hex) {
const { r, s } = DER.toSig(ensureBytes("DER", hex));
return new Signature(r, s);
}
assertValidity() {
if (!isWithinCurveOrder(this.r))
throw new Error("r must be 0 < r < CURVE.n");
if (!isWithinCurveOrder(this.s))
throw new Error("s must be 0 < s < CURVE.n");
}
addRecoveryBit(recovery) {
return new Signature(this.r, this.s, recovery);
}
recoverPublicKey(msgHash) {
const { r, s, recovery: rec } = this;
const h = bits2int_modN(ensureBytes("msgHash", msgHash));
if (rec == null || ![0, 1, 2, 3].includes(rec))
throw new Error("recovery id invalid");
const radj = rec === 2 || rec === 3 ? r + CURVE2.n : r;
if (radj >= Fp8.ORDER) throw new Error("recovery id 2 or 3 invalid");
const prefix = (rec & 1) === 0 ? "02" : "03";
const R = Point2.fromHex(prefix + numToNByteStr(radj));
const ir = invN(radj);
const u1 = modN2(-h * ir);
const u2 = modN2(s * ir);
const Q = Point2.BASE.multiplyAndAddUnsafe(R, u1, u2);
if (!Q) throw new Error("point at infinify");
Q.assertValidity();
return Q;
}
// Signatures should be low-s, to prevent malleability.
hasHighS() {
return isBiggerThanHalfOrder(this.s);
}
normalizeS() {
return this.hasHighS()
? new Signature(this.r, modN2(-this.s), this.recovery)
: this;
}
// DER-encoded
toDERRawBytes() {
return hexToBytes(this.toDERHex());
}
toDERHex() {
return DER.hexFromSig({ r: this.r, s: this.s });
}
// padded bytes of r, then padded bytes of s
toCompactRawBytes() {
return hexToBytes(this.toCompactHex());
}
toCompactHex() {
return numToNByteStr(this.r) + numToNByteStr(this.s);
}
}
const utils2 = {
isValidPrivateKey(privateKey) {
try {
normPrivateKeyToScalar(privateKey);
return true;
} catch (error) {
return false;
}
},
normPrivateKeyToScalar,
/**
* Produces cryptographically secure private key from random of size
* (groupLen + ceil(groupLen / 2)) with modulo bias being negligible.
*/
randomPrivateKey: () => {
const length = getMinHashLength(CURVE2.n);
return mapHashToField(CURVE2.randomBytes(length), CURVE2.n);
},
/**
* Creates precompute table for an arbitrary EC point. Makes point "cached".
* Allows to massively speed-up `point.multiply(scalar)`.
* @returns cached point
* @example
* const fast = utils.precompute(8, ProjectivePoint.fromHex(someonesPubKey));
* fast.multiply(privKey); // much faster ECDH now
*/
precompute(windowSize = 8, point = Point2.BASE) {
point._setWindowSize(windowSize);
point.multiply(BigInt(3));
return point;
},
};
function getPublicKey(privateKey, isCompressed = true) {
return Point2.fromPrivateKey(privateKey).toRawBytes(isCompressed);
}
function isProbPub(item) {
const arr = item instanceof Uint8Array;
const str = typeof item === "string";
const len = (arr || str) && item.length;
if (arr) return len === compressedLen || len === uncompressedLen;
if (str) return len === 2 * compressedLen || len === 2 * uncompressedLen;
if (item instanceof Point2) return true;
return false;
}
function getSharedSecret(privateA, publicB, isCompressed = true) {
if (isProbPub(privateA)) throw new Error("first arg must be private key");
if (!isProbPub(publicB)) throw new Error("second arg must be public key");
const b = Point2.fromHex(publicB);
return b
.multiply(normPrivateKeyToScalar(privateA))
.toRawBytes(isCompressed);
}
const bits2int =
CURVE2.bits2int ||
function (bytes2) {
const num = bytesToNumberBE(bytes2);
const delta = bytes2.length * 8 - CURVE2.nBitLength;
return delta > 0 ? num >> BigInt(delta) : num;
};
const bits2int_modN =
CURVE2.bits2int_modN ||
function (bytes2) {
return modN2(bits2int(bytes2));
};
const ORDER_MASK = bitMask(CURVE2.nBitLength);
function int2octets(num) {
if (typeof num !== "bigint") throw new Error("bigint expected");
if (!(_0n4 <= num && num < ORDER_MASK))
throw new Error(`bigint expected < 2^${CURVE2.nBitLength}`);
return numberToBytesBE(num, CURVE2.nByteLength);
}
function prepSig(msgHash, privateKey, opts = defaultSigOpts) {
if (["recovered", "canonical"].some((k) => k in opts))
throw new Error("sign() legacy options not supported");
const { hash: hash2, randomBytes: randomBytes2 } = CURVE2;
let { lowS, prehash, extraEntropy: ent } = opts;
if (lowS == null) lowS = true;
msgHash = ensureBytes("msgHash", msgHash);
if (prehash) msgHash = ensureBytes("prehashed msgHash", hash2(msgHash));
const h1int = bits2int_modN(msgHash);
const d = normPrivateKeyToScalar(privateKey);
const seedArgs = [int2octets(d), int2octets(h1int)];
if (ent != null) {
const e = ent === true ? randomBytes2(Fp8.BYTES) : ent;
seedArgs.push(ensureBytes("extraEntropy", e));
}
const seed = concatBytes(...seedArgs);
const m = h1int;
function k2sig(kBytes) {
const k = bits2int(kBytes);
if (!isWithinCurveOrder(k)) return;
const ik = invN(k);
const q = Point2.BASE.multiply(k).toAffine();
const r = modN2(q.x);
if (r === _0n4) return;
const s = modN2(ik * modN2(m + r * d));
if (s === _0n4) return;
let recovery = (q.x === r ? 0 : 2) | Number(q.y & _1n4);
let normS = s;
if (lowS && isBiggerThanHalfOrder(s)) {
normS = normalizeS(s);
recovery ^= 1;
}
return new Signature(r, normS, recovery);
}
return { seed, k2sig };
}
const defaultSigOpts = { lowS: CURVE2.lowS, prehash: false };
const defaultVerOpts = { lowS: CURVE2.lowS, prehash: false };
function sign(msgHash, privKey, opts = defaultSigOpts) {
const { seed, k2sig } = prepSig(msgHash, privKey, opts);
const C = CURVE2;
const drbg = createHmacDrbg(C.hash.outputLen, C.nByteLength, C.hmac);
return drbg(seed, k2sig);
}
Point2.BASE._setWindowSize(8);
function verify(signature, msgHash, publicKey, opts = defaultVerOpts) {
const sg = signature;
msgHash = ensureBytes("msgHash", msgHash);
publicKey = ensureBytes("publicKey", publicKey);
if ("strict" in opts)
throw new Error("options.strict was renamed to lowS");
const { lowS, prehash } = opts;
let _sig = void 0;
let P3;
try {
if (typeof sg === "string" || sg instanceof Uint8Array) {
try {
_sig = Signature.fromDER(sg);
} catch (derError) {
if (!(derError instanceof DER.Err)) throw derError;
_sig = Signature.fromCompact(sg);
}
} else if (
typeof sg === "object" &&
typeof sg.r === "bigint" &&
typeof sg.s === "bigint"
) {
const { r: r2, s: s2 } = sg;
_sig = new Signature(r2, s2);
} else {
throw new Error("PARSE");
}
P3 = Point2.fromHex(publicKey);
} catch (error) {
if (error.message === "PARSE")
throw new Error(
`signature must be Signature instance, Uint8Array or hex string`,
);
return false;
}
if (lowS && _sig.hasHighS()) return false;
if (prehash) msgHash = CURVE2.hash(msgHash);
const { r, s } = _sig;
const h = bits2int_modN(msgHash);
const is = invN(s);
const u1 = modN2(h * is);
const u2 = modN2(r * is);
const R = Point2.BASE.multiplyAndAddUnsafe(P3, u1, u2)?.toAffine();
if (!R) return false;
const v = modN2(R.x);
return v === r;
}
return {
CURVE: CURVE2,
getPublicKey,
getSharedSecret,
sign,
verify,
ProjectivePoint: Point2,
Signature,
utils: utils2,
};
}
function SWUFpSqrtRatio(Fp8, Z) {
const q = Fp8.ORDER;
let l = _0n4;
for (let o = q - _1n4; o % _2n3 === _0n4; o /= _2n3) l += _1n4;
const c1 = l;
const _2n_pow_c1_1 = _2n3 << (c1 - _1n4 - _1n4);
const _2n_pow_c1 = _2n_pow_c1_1 * _2n3;
const c2 = (q - _1n4) / _2n_pow_c1;
const c3 = (c2 - _1n4) / _2n3;
const c4 = _2n_pow_c1 - _1n4;
const c5 = _2n_pow_c1_1;
const c6 = Fp8.pow(Z, c2);
const c7 = Fp8.pow(Z, (c2 + _1n4) / _2n3);
let sqrtRatio = (u, v) => {
let tv1 = c6;
let tv2 = Fp8.pow(v, c4);
let tv3 = Fp8.sqr(tv2);
tv3 = Fp8.mul(tv3, v);
let tv5 = Fp8.mul(u, tv3);
tv5 = Fp8.pow(tv5, c3);
tv5 = Fp8.mul(tv5, tv2);
tv2 = Fp8.mul(tv5, v);
tv3 = Fp8.mul(tv5, u);
let tv4 = Fp8.mul(tv3, tv2);
tv5 = Fp8.pow(tv4, c5);
let isQR = Fp8.eql(tv5, Fp8.ONE);
tv2 = Fp8.mul(tv3, c7);
tv5 = Fp8.mul(tv4, tv1);
tv3 = Fp8.cmov(tv2, tv3, isQR);
tv4 = Fp8.cmov(tv5, tv4, isQR);
for (let i = c1; i > _1n4; i--) {
let tv52 = i - _2n3;
tv52 = _2n3 << (tv52 - _1n4);
let tvv5 = Fp8.pow(tv4, tv52);
const e1 = Fp8.eql(tvv5, Fp8.ONE);
tv2 = Fp8.mul(tv3, tv1);
tv1 = Fp8.mul(tv1, tv1);
tvv5 = Fp8.mul(tv4, tv1);
tv3 = Fp8.cmov(tv2, tv3, e1);
tv4 = Fp8.cmov(tvv5, tv4, e1);
}
return { isValid: isQR, value: tv3 };
};
if (Fp8.ORDER % _4n2 === _3n2) {
const c12 = (Fp8.ORDER - _3n2) / _4n2;
const c22 = Fp8.sqrt(Fp8.neg(Z));
sqrtRatio = (u, v) => {
let tv1 = Fp8.sqr(v);
const tv2 = Fp8.mul(u, v);
tv1 = Fp8.mul(tv1, tv2);
let y1 = Fp8.pow(tv1, c12);
y1 = Fp8.mul(y1, tv2);
const y2 = Fp8.mul(y1, c22);
const tv3 = Fp8.mul(Fp8.sqr(y1), v);
const isQR = Fp8.eql(tv3, u);
let y = Fp8.cmov(y2, y1, isQR);
return { isValid: isQR, value: y };
};
}
return sqrtRatio;
}
function mapToCurveSimpleSWU(Fp8, opts) {
validateField(Fp8);
if (!Fp8.isValid(opts.A) || !Fp8.isValid(opts.B) || !Fp8.isValid(opts.Z))
throw new Error("mapToCurveSimpleSWU: invalid opts");
const sqrtRatio = SWUFpSqrtRatio(Fp8, opts.Z);
if (!Fp8.isOdd) throw new Error("Fp.isOdd is not implemented!");
return (u) => {
let tv1, tv2, tv3, tv4, tv5, tv6, x, y;
tv1 = Fp8.sqr(u);
tv1 = Fp8.mul(tv1, opts.Z);
tv2 = Fp8.sqr(tv1);
tv2 = Fp8.add(tv2, tv1);
tv3 = Fp8.add(tv2, Fp8.ONE);
tv3 = Fp8.mul(tv3, opts.B);
tv4 = Fp8.cmov(opts.Z, Fp8.neg(tv2), !Fp8.eql(tv2, Fp8.ZERO));
tv4 = Fp8.mul(tv4, opts.A);
tv2 = Fp8.sqr(tv3);
tv6 = Fp8.sqr(tv4);
tv5 = Fp8.mul(tv6, opts.A);
tv2 = Fp8.add(tv2, tv5);
tv2 = Fp8.mul(tv2, tv3);
tv6 = Fp8.mul(tv6, tv4);
tv5 = Fp8.mul(tv6, opts.B);
tv2 = Fp8.add(tv2, tv5);
x = Fp8.mul(tv1, tv3);
const { isValid, value } = sqrtRatio(tv2, tv6);
y = Fp8.mul(tv1, u);
y = Fp8.mul(y, value);
x = Fp8.cmov(x, tv3, isValid);
y = Fp8.cmov(y, value, isValid);
const e1 = Fp8.isOdd(u) === Fp8.isOdd(y);
y = Fp8.cmov(Fp8.neg(y), y, e1);
x = Fp8.div(x, tv4);
return { x, y };
};
}
// ../esm/abstract/hash-to-curve.js
function validateDST(dst) {
if (dst instanceof Uint8Array) return dst;
if (typeof dst === "string") return utf8ToBytes(dst);
throw new Error("DST must be Uint8Array or string");
}
var os2ip = bytesToNumberBE;
function i2osp(value, length) {
if (value < 0 || value >= 1 << (8 * length)) {
throw new Error(`bad I2OSP call: value=${value} length=${length}`);
}
const res = Array.from({ length }).fill(0);
for (let i = length - 1; i >= 0; i--) {
res[i] = value & 255;
value >>>= 8;
}
return new Uint8Array(res);
}
function strxor(a, b) {
const arr = new Uint8Array(a.length);
for (let i = 0; i < a.length; i++) {
arr[i] = a[i] ^ b[i];
}
return arr;
}
function isBytes(item) {
if (!(item instanceof Uint8Array)) throw new Error("Uint8Array expected");
}
function isNum(item) {
if (!Number.isSafeInteger(item)) throw new Error("number expected");
}
function expand_message_xmd(msg, DST, lenInBytes, H) {
isBytes(msg);
isBytes(DST);
isNum(lenInBytes);
if (DST.length > 255)
DST = H(concatBytes(utf8ToBytes("H2C-OVERSIZE-DST-"), DST));
const { outputLen: b_in_bytes, blockLen: r_in_bytes } = H;
const ell = Math.ceil(lenInBytes / b_in_bytes);
if (ell > 255) throw new Error("Invalid xmd length");
const DST_prime = concatBytes(DST, i2osp(DST.length, 1));
const Z_pad = i2osp(0, r_in_bytes);
const l_i_b_str = i2osp(lenInBytes, 2);
const b = new Array(ell);
const b_0 = H(concatBytes(Z_pad, msg, l_i_b_str, i2osp(0, 1), DST_prime));
b[0] = H(concatBytes(b_0, i2osp(1, 1), DST_prime));
for (let i = 1; i <= ell; i++) {
const args = [strxor(b_0, b[i - 1]), i2osp(i + 1, 1), DST_prime];
b[i] = H(concatBytes(...args));
}
const pseudo_random_bytes = concatBytes(...b);
return pseudo_random_bytes.slice(0, lenInBytes);
}
function expand_message_xof(msg, DST, lenInBytes, k, H) {
isBytes(msg);
isBytes(DST);
isNum(lenInBytes);
if (DST.length > 255) {
const dkLen = Math.ceil((2 * k) / 8);
DST = H.create({ dkLen })
.update(utf8ToBytes("H2C-OVERSIZE-DST-"))
.update(DST)
.digest();
}
if (lenInBytes > 65535 || DST.length > 255)
throw new Error("expand_message_xof: invalid lenInBytes");
return H.create({ dkLen: lenInBytes })
.update(msg)
.update(i2osp(lenInBytes, 2))
.update(DST)
.update(i2osp(DST.length, 1))
.digest();
}
function hash_to_field(msg, count, options) {
validateObject(options, {
DST: "stringOrUint8Array",
p: "bigint",
m: "isSafeInteger",
k: "isSafeInteger",
hash: "hash",
});
const { p, k, m, hash: hash2, expand, DST: _DST } = options;
isBytes(msg);
isNum(count);
const DST = validateDST(_DST);
const log2p = p.toString(2).length;
const L = Math.ceil((log2p + k) / 8);
const len_in_bytes = count * m * L;
let prb;
if (expand === "xmd") {
prb = expand_message_xmd(msg, DST, len_in_bytes, hash2);
} else if (expand === "xof") {
prb = expand_message_xof(msg, DST, len_in_bytes, k, hash2);
} else if (expand === "_internal_pass") {
prb = msg;
} else {
throw new Error('expand must be "xmd" or "xof"');
}
const u = new Array(count);
for (let i = 0; i < count; i++) {
const e = new Array(m);
for (let j = 0; j < m; j++) {
const elm_offset = L * (j + i * m);
const tv = prb.subarray(elm_offset, elm_offset + L);
e[j] = mod(os2ip(tv), p);
}
u[i] = e;
}
return u;
}
function isogenyMap(field, map) {
const COEFF = map.map((i) => Array.from(i).reverse());
return (x, y) => {
const [xNum, xDen, yNum, yDen] = COEFF.map((val) =>
val.reduce((acc, i) => field.add(field.mul(acc, x), i)),
);
x = field.div(xNum, xDen);
y = field.mul(y, field.div(yNum, yDen));
return { x, y };
};
}
function createHasher(Point2, mapToCurve, def) {
if (typeof mapToCurve !== "function")
throw new Error("mapToCurve() must be defined");
return {
// Encodes byte string to elliptic curve.
// hash_to_curve from https://www.rfc-editor.org/rfc/rfc9380#section-3
hashToCurve(msg, options) {
const u = hash_to_field(msg, 2, { ...def, DST: def.DST, ...options });
const u0 = Point2.fromAffine(mapToCurve(u[0]));
const u1 = Point2.fromAffine(mapToCurve(u[1]));
const P3 = u0.add(u1).clearCofactor();
P3.assertValidity();
return P3;
},
// Encodes byte string to elliptic curve.
// encode_to_curve from https://www.rfc-editor.org/rfc/rfc9380#section-3
encodeToCurve(msg, options) {
const u = hash_to_field(msg, 1, {
...def,
DST: def.encodeDST,
...options,
});
const P3 = Point2.fromAffine(mapToCurve(u[0])).clearCofactor();
P3.assertValidity();
return P3;
},
};
}
// ../node_modules/@noble/hashes/esm/hmac.js
var HMAC = class extends Hash {
constructor(hash2, _key) {
super();
this.finished = false;
this.destroyed = false;
hash(hash2);
const key = toBytes(_key);
this.iHash = hash2.create();
if (typeof this.iHash.update !== "function")
throw new Error("Expected instance of class which extends utils.Hash");
this.blockLen = this.iHash.blockLen;
this.outputLen = this.iHash.outputLen;
const blockLen = this.blockLen;
const pad = new Uint8Array(blockLen);
pad.set(
key.length > blockLen ? hash2.create().update(key).digest() : key,
);
for (let i = 0; i < pad.length; i++) pad[i] ^= 54;
this.iHash.update(pad);
this.oHash = hash2.create();
for (let i = 0; i < pad.length; i++) pad[i] ^= 54 ^ 92;
this.oHash.update(pad);
pad.fill(0);
}
update(buf) {
exists(this);
this.iHash.update(buf);
return this;
}
digestInto(out) {
exists(this);
bytes(out, this.outputLen);
this.finished = true;
this.iHash.digestInto(out);
this.oHash.update(out);
this.oHash.digestInto(out);
this.destroy();
}
digest() {
const out = new Uint8Array(this.oHash.outputLen);
this.digestInto(out);
return out;
}
_cloneInto(to) {
to || (to = Object.create(Object.getPrototypeOf(this), {}));
const { oHash, iHash, finished, destroyed, blockLen, outputLen } = this;
to = to;
to.finished = finished;
to.destroyed = destroyed;
to.blockLen = blockLen;
to.outputLen = outputLen;
to.oHash = oHash._cloneInto(to.oHash);
to.iHash = iHash._cloneInto(to.iHash);
return to;
}
destroy() {
this.destroyed = true;
this.oHash.destroy();
this.iHash.destroy();
}
};
var hmac = (hash2, key, message) =>
new HMAC(hash2, key).update(message).digest();
hmac.create = (hash2, key) => new HMAC(hash2, key);
// ../esm/_shortw_utils.js
function getHash(hash2) {
return {
hash: hash2,
hmac: (key, ...msgs) => hmac(hash2, key, concatBytes2(...msgs)),
randomBytes,
};
}
function createCurve(curveDef, defHash) {
const create = (hash2) => weierstrass({ ...curveDef, ...getHash(hash2) });
return Object.freeze({ ...create(defHash), create });
}
// ../esm/secp256k1.js
var secp256k1P = BigInt(
"0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f",
);
var secp256k1N = BigInt(
"0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141",
);
var _1n5 = BigInt(1);
var _2n4 = BigInt(2);
var divNearest = (a, b) => (a + b / _2n4) / b;
function sqrtMod(y) {
const P3 = secp256k1P;
const _3n6 = BigInt(3),
_6n = BigInt(6),
_11n2 = BigInt(11),
_22n2 = BigInt(22);
const _23n = BigInt(23),
_44n2 = BigInt(44),
_88n2 = BigInt(88);
const b2 = (y * y * y) % P3;
const b3 = (b2 * b2 * y) % P3;
const b6 = (pow2(b3, _3n6, P3) * b3) % P3;
const b9 = (pow2(b6, _3n6, P3) * b3) % P3;
const b11 = (pow2(b9, _2n4, P3) * b2) % P3;
const b22 = (pow2(b11, _11n2, P3) * b11) % P3;
const b44 = (pow2(b22, _22n2, P3) * b22) % P3;
const b88 = (pow2(b44, _44n2, P3) * b44) % P3;
const b176 = (pow2(b88, _88n2, P3) * b88) % P3;
const b220 = (pow2(b176, _44n2, P3) * b44) % P3;
const b223 = (pow2(b220, _3n6, P3) * b3) % P3;
const t1 = (pow2(b223, _23n, P3) * b22) % P3;
const t2 = (pow2(t1, _6n, P3) * b2) % P3;
const root = pow2(t2, _2n4, P3);
if (!Fp.eql(Fp.sqr(root), y)) throw new Error("Cannot find square root");
return root;
}
var Fp = Field(secp256k1P, void 0, void 0, { sqrt: sqrtMod });
var secp256k1 = createCurve(
{
a: BigInt(0),
b: BigInt(7),
Fp,
n: secp256k1N,
// Base point (x, y) aka generator point
Gx: BigInt(
"55066263022277343669578718895168534326250603453777594175500187360389116729240",
),
Gy: BigInt(
"32670510020758816978083085130507043184471273380659243275938904335757337482424",
),
h: BigInt(1),
lowS: true,
/**
* secp256k1 belongs to Koblitz curves: it has efficiently computable endomorphism.
* Endomorphism uses 2x less RAM, speeds up precomputation by 2x and ECDH / key recovery by 20%.
* For precomputed wNAF it trades off 1/2 init time & 1/3 ram for 20% perf hit.
* Explanation: https://gist.github.com/paulmillr/eb670806793e84df628a7c434a873066
*/
endo: {
beta: BigInt(
"0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee",
),
splitScalar: (k) => {
const n = secp256k1N;
const a1 = BigInt("0x3086d221a7d46bcde86c90e49284eb15");
const b1 = -_1n5 * BigInt("0xe4437ed6010e88286f547fa90abfe4c3");
const a2 = BigInt("0x114ca50f7a8e2f3f657c1108d9d44cfd8");
const b2 = a1;
const POW_2_128 = BigInt("0x100000000000000000000000000000000");
const c1 = divNearest(b2 * k, n);
const c2 = divNearest(-b1 * k, n);
let k1 = mod(k - c1 * a1 - c2 * a2, n);
let k2 = mod(-c1 * b1 - c2 * b2, n);
const k1neg = k1 > POW_2_128;
const k2neg = k2 > POW_2_128;
if (k1neg) k1 = n - k1;
if (k2neg) k2 = n - k2;
if (k1 > POW_2_128 || k2 > POW_2_128) {
throw new Error("splitScalar: Endomorphism failed, k=" + k);
}
return { k1neg, k1, k2neg, k2 };
},
},
},
sha256,
);
var _0n5 = BigInt(0);
var fe = (x) => typeof x === "bigint" && _0n5 < x && x < secp256k1P;
var ge = (x) => typeof x === "bigint" && _0n5 < x && x < secp256k1N;
var TAGGED_HASH_PREFIXES = {};
function taggedHash(tag, ...messages) {
let tagP = TAGGED_HASH_PREFIXES[tag];
if (tagP === void 0) {
const tagH = sha256(Uint8Array.from(tag, (c) => c.charCodeAt(0)));
tagP = concatBytes(tagH, tagH);
TAGGED_HASH_PREFIXES[tag] = tagP;
}
return sha256(concatBytes(tagP, ...messages));
}
var pointToBytes = (point) => point.toRawBytes(true).slice(1);
var numTo32b = (n) => numberToBytesBE(n, 32);
var modP = (x) => mod(x, secp256k1P);
var modN = (x) => mod(x, secp256k1N);
var Point = secp256k1.ProjectivePoint;
var GmulAdd = (Q, a, b) => Point.BASE.multiplyAndAddUnsafe(Q, a, b);
function schnorrGetExtPubKey(priv) {
let d_ = secp256k1.utils.normPrivateKeyToScalar(priv);
let p = Point.fromPrivateKey(d_);
const scalar = p.hasEvenY() ? d_ : modN(-d_);
return { scalar, bytes: pointToBytes(p) };
}
function lift_x(x) {
if (!fe(x)) throw new Error("bad x: need 0 < x < p");
const xx = modP(x * x);
const c = modP(xx * x + BigInt(7));
let y = sqrtMod(c);
if (y % _2n4 !== _0n5) y = modP(-y);
const p = new Point(x, y, _1n5);
p.assertValidity();
return p;
}
function challenge(...args) {
return modN(bytesToNumberBE(taggedHash("BIP0340/challenge", ...args)));
}
function schnorrGetPublicKey(privateKey) {
return schnorrGetExtPubKey(privateKey).bytes;
}
function schnorrSign(message, privateKey, auxRand = randomBytes(32)) {
const m = ensureBytes("message", message);
const { bytes: px, scalar: d } = schnorrGetExtPubKey(privateKey);
const a = ensureBytes("auxRand", auxRand, 32);
const t = numTo32b(d ^ bytesToNumberBE(taggedHash("BIP0340/aux", a)));
const rand = taggedHash("BIP0340/nonce", t, px, m);
const k_ = modN(bytesToNumberBE(rand));
if (k_ === _0n5) throw new Error("sign failed: k is zero");
const { bytes: rx, scalar: k } = schnorrGetExtPubKey(k_);
const e = challenge(rx, px, m);
const sig = new Uint8Array(64);
sig.set(rx, 0);
sig.set(numTo32b(modN(k + e * d)), 32);
if (!schnorrVerify(sig, m, px))
throw new Error("sign: Invalid signature produced");
return sig;
}
function schnorrVerify(signature, message, publicKey) {
const sig = ensureBytes("signature", signature, 64);
const m = ensureBytes("message", message);
const pub = ensureBytes("publicKey", publicKey, 32);
try {
const P3 = lift_x(bytesToNumberBE(pub));
const r = bytesToNumberBE(sig.subarray(0, 32));
if (!fe(r)) return false;
const s = bytesToNumberBE(sig.subarray(32, 64));
if (!ge(s)) return false;
const e = challenge(numTo32b(r), pointToBytes(P3), m);
const R = GmulAdd(P3, s, modN(-e));
if (!R || !R.hasEvenY() || R.toAffine().x !== r) return false;
return true;
} catch (error) {
return false;
}
}
var schnorr = /* @__PURE__ */ (() => ({
getPublicKey: schnorrGetPublicKey,
sign: schnorrSign,
verify: schnorrVerify,
utils: {
randomPrivateKey: secp256k1.utils.randomPrivateKey,
lift_x,
pointToBytes,
numberToBytesBE,
bytesToNumberBE,
taggedHash,
mod,
},
}))();
// ../node_modules/@noble/hashes/esm/_u64.js
var U32_MASK64 = /* @__PURE__ */ BigInt(2 ** 32 - 1);
var _32n = /* @__PURE__ */ BigInt(32);
function fromBig(n, le = false) {
if (le)
return { h: Number(n & U32_MASK64), l: Number((n >> _32n) & U32_MASK64) };
return {
h: Number((n >> _32n) & U32_MASK64) | 0,
l: Number(n & U32_MASK64) | 0,
};
}
function split(lst, le = false) {
let Ah = new Uint32Array(lst.length);
let Al = new Uint32Array(lst.length);
for (let i = 0; i < lst.length; i++) {
const { h, l } = fromBig(lst[i], le);
[Ah[i], Al[i]] = [h, l];
}
return [Ah, Al];
}
var toBig = (h, l) => (BigInt(h >>> 0) << _32n) | BigInt(l >>> 0);
var shrSH = (h, _l, s) => h >>> s;
var shrSL = (h, l, s) => (h << (32 - s)) | (l >>> s);
var rotrSH = (h, l, s) => (h >>> s) | (l << (32 - s));
var rotrSL = (h, l, s) => (h << (32 - s)) | (l >>> s);
var rotrBH = (h, l, s) => (h << (64 - s)) | (l >>> (s - 32));
var rotrBL = (h, l, s) => (h >>> (s - 32)) | (l << (64 - s));
var rotr32H = (_h, l) => l;
var rotr32L = (h, _l) => h;
var rotlSH = (h, l, s) => (h << s) | (l >>> (32 - s));
var rotlSL = (h, l, s) => (l << s) | (h >>> (32 - s));
var rotlBH = (h, l, s) => (l << (s - 32)) | (h >>> (64 - s));
var rotlBL = (h, l, s) => (h << (s - 32)) | (l >>> (64 - s));
function add(Ah, Al, Bh, Bl) {
const l = (Al >>> 0) + (Bl >>> 0);
return { h: (Ah + Bh + ((l / 2 ** 32) | 0)) | 0, l: l | 0 };
}
var add3L = (Al, Bl, Cl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0);
var add3H = (low, Ah, Bh, Ch) => (Ah + Bh + Ch + ((low / 2 ** 32) | 0)) | 0;
var add4L = (Al, Bl, Cl, Dl) =>
(Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0);
var add4H = (low, Ah, Bh, Ch, Dh) =>
(Ah + Bh + Ch + Dh + ((low / 2 ** 32) | 0)) | 0;
var add5L = (Al, Bl, Cl, Dl, El) =>
(Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0) + (El >>> 0);
var add5H = (low, Ah, Bh, Ch, Dh, Eh) =>
(Ah + Bh + Ch + Dh + Eh + ((low / 2 ** 32) | 0)) | 0;
var u64 = {
fromBig,
split,
toBig,
shrSH,
shrSL,
rotrSH,
rotrSL,
rotrBH,
rotrBL,
rotr32H,
rotr32L,
rotlSH,
rotlSL,
rotlBH,
rotlBL,
add,
add3L,
add3H,
add4L,
add4H,
add5H,
add5L,
};
var u64_default = u64;
// ../node_modules/@noble/hashes/esm/sha512.js
var [SHA512_Kh, SHA512_Kl] = /* @__PURE__ */ (() =>
u64_default.split(
[
"0x428a2f98d728ae22",
"0x7137449123ef65cd",
"0xb5c0fbcfec4d3b2f",
"0xe9b5dba58189dbbc",
"0x3956c25bf348b538",
"0x59f111f1b605d019",
"0x923f82a4af194f9b",
"0xab1c5ed5da6d8118",
"0xd807aa98a3030242",
"0x12835b0145706fbe",
"0x243185be4ee4b28c",
"0x550c7dc3d5ffb4e2",
"0x72be5d74f27b896f",
"0x80deb1fe3b1696b1",
"0x9bdc06a725c71235",
"0xc19bf174cf692694",
"0xe49b69c19ef14ad2",
"0xefbe4786384f25e3",
"0x0fc19dc68b8cd5b5",
"0x240ca1cc77ac9c65",
"0x2de92c6f592b0275",
"0x4a7484aa6ea6e483",
"0x5cb0a9dcbd41fbd4",
"0x76f988da831153b5",
"0x983e5152ee66dfab",
"0xa831c66d2db43210",
"0xb00327c898fb213f",
"0xbf597fc7beef0ee4",
"0xc6e00bf33da88fc2",
"0xd5a79147930aa725",
"0x06ca6351e003826f",
"0x142929670a0e6e70",
"0x27b70a8546d22ffc",
"0x2e1b21385c26c926",
"0x4d2c6dfc5ac42aed",
"0x53380d139d95b3df",
"0x650a73548baf63de",
"0x766a0abb3c77b2a8",
"0x81c2c92e47edaee6",
"0x92722c851482353b",
"0xa2bfe8a14cf10364",
"0xa81a664bbc423001",
"0xc24b8b70d0f89791",
"0xc76c51a30654be30",
"0xd192e819d6ef5218",
"0xd69906245565a910",
"0xf40e35855771202a",
"0x106aa07032bbd1b8",
"0x19a4c116b8d2d0c8",
"0x1e376c085141ab53",
"0x2748774cdf8eeb99",
"0x34b0bcb5e19b48a8",
"0x391c0cb3c5c95a63",
"0x4ed8aa4ae3418acb",
"0x5b9cca4f7763e373",
"0x682e6ff3d6b2b8a3",
"0x748f82ee5defb2fc",
"0x78a5636f43172f60",
"0x84c87814a1f0ab72",
"0x8cc702081a6439ec",
"0x90befffa23631e28",
"0xa4506cebde82bde9",
"0xbef9a3f7b2c67915",
"0xc67178f2e372532b",
"0xca273eceea26619c",
"0xd186b8c721c0c207",
"0xeada7dd6cde0eb1e",
"0xf57d4f7fee6ed178",
"0x06f067aa72176fba",
"0x0a637dc5a2c898a6",
"0x113f9804bef90dae",
"0x1b710b35131c471b",
"0x28db77f523047d84",
"0x32caab7b40c72493",
"0x3c9ebe0a15c9bebc",
"0x431d67c49c100d4c",
"0x4cc5d4becb3e42b6",
"0x597f299cfc657e2a",
"0x5fcb6fab3ad6faec",
"0x6c44198c4a475817",
].map((n) => BigInt(n)),
))();
var SHA512_W_H = /* @__PURE__ */ new Uint32Array(80);
var SHA512_W_L = /* @__PURE__ */ new Uint32Array(80);
var SHA512 = class extends SHA2 {
constructor() {
super(128, 64, 16, false);
this.Ah = 1779033703 | 0;
this.Al = 4089235720 | 0;
this.Bh = 3144134277 | 0;
this.Bl = 2227873595 | 0;
this.Ch = 1013904242 | 0;
this.Cl = 4271175723 | 0;
this.Dh = 2773480762 | 0;
this.Dl = 1595750129 | 0;
this.Eh = 1359893119 | 0;
this.El = 2917565137 | 0;
this.Fh = 2600822924 | 0;
this.Fl = 725511199 | 0;
this.Gh = 528734635 | 0;
this.Gl = 4215389547 | 0;
this.Hh = 1541459225 | 0;
this.Hl = 327033209 | 0;
}
// prettier-ignore
get() {
const { Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl } = this;
return [Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl];
}
// prettier-ignore
set(Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl) {
this.Ah = Ah | 0;
this.Al = Al | 0;
this.Bh = Bh | 0;
this.Bl = Bl | 0;
this.Ch = Ch | 0;
this.Cl = Cl | 0;
this.Dh = Dh | 0;
this.Dl = Dl | 0;
this.Eh = Eh | 0;
this.El = El | 0;
this.Fh = Fh | 0;
this.Fl = Fl | 0;
this.Gh = Gh | 0;
this.Gl = Gl | 0;
this.Hh = Hh | 0;
this.Hl = Hl | 0;
}
process(view, offset) {
for (let i = 0; i < 16; i++, offset += 4) {
SHA512_W_H[i] = view.getUint32(offset);
SHA512_W_L[i] = view.getUint32((offset += 4));
}
for (let i = 16; i < 80; i++) {
const W15h = SHA512_W_H[i - 15] | 0;
const W15l = SHA512_W_L[i - 15] | 0;
const s0h =
u64_default.rotrSH(W15h, W15l, 1) ^
u64_default.rotrSH(W15h, W15l, 8) ^
u64_default.shrSH(W15h, W15l, 7);
const s0l =
u64_default.rotrSL(W15h, W15l, 1) ^
u64_default.rotrSL(W15h, W15l, 8) ^
u64_default.shrSL(W15h, W15l, 7);
const W2h = SHA512_W_H[i - 2] | 0;
const W2l = SHA512_W_L[i - 2] | 0;
const s1h =
u64_default.rotrSH(W2h, W2l, 19) ^
u64_default.rotrBH(W2h, W2l, 61) ^
u64_default.shrSH(W2h, W2l, 6);
const s1l =
u64_default.rotrSL(W2h, W2l, 19) ^
u64_default.rotrBL(W2h, W2l, 61) ^
u64_default.shrSL(W2h, W2l, 6);
const SUMl = u64_default.add4L(
s0l,
s1l,
SHA512_W_L[i - 7],
SHA512_W_L[i - 16],
);
const SUMh = u64_default.add4H(
SUMl,
s0h,
s1h,
SHA512_W_H[i - 7],
SHA512_W_H[i - 16],
);
SHA512_W_H[i] = SUMh | 0;
SHA512_W_L[i] = SUMl | 0;
}
let { Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl } =
this;
for (let i = 0; i < 80; i++) {
const sigma1h =
u64_default.rotrSH(Eh, El, 14) ^
u64_default.rotrSH(Eh, El, 18) ^
u64_default.rotrBH(Eh, El, 41);
const sigma1l =
u64_default.rotrSL(Eh, El, 14) ^
u64_default.rotrSL(Eh, El, 18) ^
u64_default.rotrBL(Eh, El, 41);
const CHIh = (Eh & Fh) ^ (~Eh & Gh);
const CHIl = (El & Fl) ^ (~El & Gl);
const T1ll = u64_default.add5L(
Hl,
sigma1l,
CHIl,
SHA512_Kl[i],
SHA512_W_L[i],
);
const T1h = u64_default.add5H(
T1ll,
Hh,
sigma1h,
CHIh,
SHA512_Kh[i],
SHA512_W_H[i],
);
const T1l = T1ll | 0;
const sigma0h =
u64_default.rotrSH(Ah, Al, 28) ^
u64_default.rotrBH(Ah, Al, 34) ^
u64_default.rotrBH(Ah, Al, 39);
const sigma0l =
u64_default.rotrSL(Ah, Al, 28) ^
u64_default.rotrBL(Ah, Al, 34) ^
u64_default.rotrBL(Ah, Al, 39);
const MAJh = (Ah & Bh) ^ (Ah & Ch) ^ (Bh & Ch);
const MAJl = (Al & Bl) ^ (Al & Cl) ^ (Bl & Cl);
Hh = Gh | 0;
Hl = Gl | 0;
Gh = Fh | 0;
Gl = Fl | 0;
Fh = Eh | 0;
Fl = El | 0;
({ h: Eh, l: El } = u64_default.add(Dh | 0, Dl | 0, T1h | 0, T1l | 0));
Dh = Ch | 0;
Dl = Cl | 0;
Ch = Bh | 0;
Cl = Bl | 0;
Bh = Ah | 0;
Bl = Al | 0;
const All = u64_default.add3L(T1l, sigma0l, MAJl);
Ah = u64_default.add3H(All, T1h, sigma0h, MAJh);
Al = All | 0;
}
({ h: Ah, l: Al } = u64_default.add(
this.Ah | 0,
this.Al | 0,
Ah | 0,
Al | 0,
));
({ h: Bh, l: Bl } = u64_default.add(
this.Bh | 0,
this.Bl | 0,
Bh | 0,
Bl | 0,
));
({ h: Ch, l: Cl } = u64_default.add(
this.Ch | 0,
this.Cl | 0,
Ch | 0,
Cl | 0,
));
({ h: Dh, l: Dl } = u64_default.add(
this.Dh | 0,
this.Dl | 0,
Dh | 0,
Dl | 0,
));
({ h: Eh, l: El } = u64_default.add(
this.Eh | 0,
this.El | 0,
Eh | 0,
El | 0,
));
({ h: Fh, l: Fl } = u64_default.add(
this.Fh | 0,
this.Fl | 0,
Fh | 0,
Fl | 0,
));
({ h: Gh, l: Gl } = u64_default.add(
this.Gh | 0,
this.Gl | 0,
Gh | 0,
Gl | 0,
));
({ h: Hh, l: Hl } = u64_default.add(
this.Hh | 0,
this.Hl | 0,
Hh | 0,
Hl | 0,
));
this.set(Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl);
}
roundClean() {
SHA512_W_H.fill(0);
SHA512_W_L.fill(0);
}
destroy() {
this.buffer.fill(0);
this.set(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);
}
};
var SHA384 = class extends SHA512 {
constructor() {
super();
this.Ah = 3418070365 | 0;
this.Al = 3238371032 | 0;
this.Bh = 1654270250 | 0;
this.Bl = 914150663 | 0;
this.Ch = 2438529370 | 0;
this.Cl = 812702999 | 0;
this.Dh = 355462360 | 0;
this.Dl = 4144912697 | 0;
this.Eh = 1731405415 | 0;
this.El = 4290775857 | 0;
this.Fh = 2394180231 | 0;
this.Fl = 1750603025 | 0;
this.Gh = 3675008525 | 0;
this.Gl = 1694076839 | 0;
this.Hh = 1203062813 | 0;
this.Hl = 3204075428 | 0;
this.outputLen = 48;
}
};
var sha512 = /* @__PURE__ */ wrapConstructor(() => new SHA512());
var sha384 = /* @__PURE__ */ wrapConstructor(() => new SHA384());
// ../esm/abstract/edwards.js
var _0n6 = BigInt(0);
var _1n6 = BigInt(1);
var _2n5 = BigInt(2);
var _8n2 = BigInt(8);
var VERIFY_DEFAULT = { zip215: true };
function validateOpts2(curve) {
const opts = validateBasic(curve);
validateObject(
curve,
{
hash: "function",
a: "bigint",
d: "bigint",
randomBytes: "function",
},
{
adjustScalarBytes: "function",
domain: "function",
uvRatio: "function",
mapToCurve: "function",
},
);
return Object.freeze({ ...opts });
}
function twistedEdwards(curveDef) {
const CURVE2 = validateOpts2(curveDef);
const {
Fp: Fp8,
n: CURVE_ORDER,
prehash,
hash: cHash,
randomBytes: randomBytes2,
nByteLength,
h: cofactor,
} = CURVE2;
const MASK = _2n5 << (BigInt(nByteLength * 8) - _1n6);
const modP2 = Fp8.create;
const uvRatio3 =
CURVE2.uvRatio ||
((u, v) => {
try {
return { isValid: true, value: Fp8.sqrt(u * Fp8.inv(v)) };
} catch (e) {
return { isValid: false, value: _0n6 };
}
});
const adjustScalarBytes3 = CURVE2.adjustScalarBytes || ((bytes2) => bytes2);
const domain =
CURVE2.domain ||
((data, ctx, phflag) => {
if (ctx.length || phflag)
throw new Error("Contexts/pre-hash are not supported");
return data;
});
const inBig = (n) => typeof n === "bigint" && _0n6 < n;
const inRange = (n, max) => inBig(n) && inBig(max) && n < max;
const in0MaskRange = (n) => n === _0n6 || inRange(n, MASK);
function assertInRange(n, max) {
if (inRange(n, max)) return n;
throw new Error(`Expected valid scalar < ${max}, got ${typeof n} ${n}`);
}
function assertGE0(n) {
return n === _0n6 ? n : assertInRange(n, CURVE_ORDER);
}
const pointPrecomputes = /* @__PURE__ */ new Map();
function isPoint(other) {
if (!(other instanceof Point2)) throw new Error("ExtendedPoint expected");
}
class Point2 {
constructor(ex, ey, ez, et) {
this.ex = ex;
this.ey = ey;
this.ez = ez;
this.et = et;
if (!in0MaskRange(ex)) throw new Error("x required");
if (!in0MaskRange(ey)) throw new Error("y required");
if (!in0MaskRange(ez)) throw new Error("z required");
if (!in0MaskRange(et)) throw new Error("t required");
}
get x() {
return this.toAffine().x;
}
get y() {
return this.toAffine().y;
}
static fromAffine(p) {
if (p instanceof Point2) throw new Error("extended point not allowed");
const { x, y } = p || {};
if (!in0MaskRange(x) || !in0MaskRange(y))
throw new Error("invalid affine point");
return new Point2(x, y, _1n6, modP2(x * y));
}
static normalizeZ(points) {
const toInv = Fp8.invertBatch(points.map((p) => p.ez));
return points
.map((p, i) => p.toAffine(toInv[i]))
.map(Point2.fromAffine);
}
// "Private method", don't use it directly
_setWindowSize(windowSize) {
this._WINDOW_SIZE = windowSize;
pointPrecomputes.delete(this);
}
// Not required for fromHex(), which always creates valid points.
// Could be useful for fromAffine().
assertValidity() {
const { a, d } = CURVE2;
if (this.is0()) throw new Error("bad point: ZERO");
const { ex: X, ey: Y, ez: Z, et: T } = this;
const X2 = modP2(X * X);
const Y2 = modP2(Y * Y);
const Z2 = modP2(Z * Z);
const Z4 = modP2(Z2 * Z2);
const aX2 = modP2(X2 * a);
const left = modP2(Z2 * modP2(aX2 + Y2));
const right = modP2(Z4 + modP2(d * modP2(X2 * Y2)));
if (left !== right)
throw new Error("bad point: equation left != right (1)");
const XY = modP2(X * Y);
const ZT = modP2(Z * T);
if (XY !== ZT) throw new Error("bad point: equation left != right (2)");
}
// Compare one point to another.
equals(other) {
isPoint(other);
const { ex: X1, ey: Y1, ez: Z1 } = this;
const { ex: X2, ey: Y2, ez: Z2 } = other;
const X1Z2 = modP2(X1 * Z2);
const X2Z1 = modP2(X2 * Z1);
const Y1Z2 = modP2(Y1 * Z2);
const Y2Z1 = modP2(Y2 * Z1);
return X1Z2 === X2Z1 && Y1Z2 === Y2Z1;
}
is0() {
return this.equals(Point2.ZERO);
}
negate() {
return new Point2(modP2(-this.ex), this.ey, this.ez, modP2(-this.et));
}
// Fast algo for doubling Extended Point.
// https://hyperelliptic.org/EFD/g1p/auto-twisted-extended.html#doubling-dbl-2008-hwcd
// Cost: 4M + 4S + 1*a + 6add + 1*2.
double() {
const { a } = CURVE2;
const { ex: X1, ey: Y1, ez: Z1 } = this;
const A = modP2(X1 * X1);
const B = modP2(Y1 * Y1);
const C = modP2(_2n5 * modP2(Z1 * Z1));
const D = modP2(a * A);
const x1y1 = X1 + Y1;
const E = modP2(modP2(x1y1 * x1y1) - A - B);
const G2 = D + B;
const F = G2 - C;
const H = D - B;
const X3 = modP2(E * F);
const Y3 = modP2(G2 * H);
const T3 = modP2(E * H);
const Z3 = modP2(F * G2);
return new Point2(X3, Y3, Z3, T3);
}
// Fast algo for adding 2 Extended Points.
// https://hyperelliptic.org/EFD/g1p/auto-twisted-extended.html#addition-add-2008-hwcd
// Cost: 9M + 1*a + 1*d + 7add.
add(other) {
isPoint(other);
const { a, d } = CURVE2;
const { ex: X1, ey: Y1, ez: Z1, et: T1 } = this;
const { ex: X2, ey: Y2, ez: Z2, et: T2 } = other;
if (a === BigInt(-1)) {
const A2 = modP2((Y1 - X1) * (Y2 + X2));
const B2 = modP2((Y1 + X1) * (Y2 - X2));
const F2 = modP2(B2 - A2);
if (F2 === _0n6) return this.double();
const C2 = modP2(Z1 * _2n5 * T2);
const D2 = modP2(T1 * _2n5 * Z2);
const E2 = D2 + C2;
const G3 = B2 + A2;
const H2 = D2 - C2;
const X32 = modP2(E2 * F2);
const Y32 = modP2(G3 * H2);
const T32 = modP2(E2 * H2);
const Z32 = modP2(F2 * G3);
return new Point2(X32, Y32, Z32, T32);
}
const A = modP2(X1 * X2);
const B = modP2(Y1 * Y2);
const C = modP2(T1 * d * T2);
const D = modP2(Z1 * Z2);
const E = modP2((X1 + Y1) * (X2 + Y2) - A - B);
const F = D - C;
const G2 = D + C;
const H = modP2(B - a * A);
const X3 = modP2(E * F);
const Y3 = modP2(G2 * H);
const T3 = modP2(E * H);
const Z3 = modP2(F * G2);
return new Point2(X3, Y3, Z3, T3);
}
subtract(other) {
return this.add(other.negate());
}
wNAF(n) {
return wnaf.wNAFCached(this, pointPrecomputes, n, Point2.normalizeZ);
}
// Constant-time multiplication.
multiply(scalar) {
const { p, f } = this.wNAF(assertInRange(scalar, CURVE_ORDER));
return Point2.normalizeZ([p, f])[0];
}
// Non-constant-time multiplication. Uses double-and-add algorithm.
// It's faster, but should only be used when you don't care about
// an exposed private key e.g. sig verification.
// Does NOT allow scalars higher than CURVE.n.
multiplyUnsafe(scalar) {
let n = assertGE0(scalar);
if (n === _0n6) return I;
if (this.equals(I) || n === _1n6) return this;
if (this.equals(G)) return this.wNAF(n).p;
return wnaf.unsafeLadder(this, n);
}
// Checks if point is of small order.
// If you add something to small order point, you will have "dirty"
// point with torsion component.
// Multiplies point by cofactor and checks if the result is 0.
isSmallOrder() {
return this.multiplyUnsafe(cofactor).is0();
}
// Multiplies point by curve order and checks if the result is 0.
// Returns `false` is the point is dirty.
isTorsionFree() {
return wnaf.unsafeLadder(this, CURVE_ORDER).is0();
}
// Converts Extended point to default (x, y) coordinates.
// Can accept precomputed Z^-1 - for example, from invertBatch.
toAffine(iz) {
const { ex: x, ey: y, ez: z } = this;
const is0 = this.is0();
if (iz == null) iz = is0 ? _8n2 : Fp8.inv(z);
const ax = modP2(x * iz);
const ay = modP2(y * iz);
const zz = modP2(z * iz);
if (is0) return { x: _0n6, y: _1n6 };
if (zz !== _1n6) throw new Error("invZ was invalid");
return { x: ax, y: ay };
}
clearCofactor() {
const { h: cofactor2 } = CURVE2;
if (cofactor2 === _1n6) return this;
return this.multiplyUnsafe(cofactor2);
}
// Converts hash string or Uint8Array to Point.
// Uses algo from RFC8032 5.1.3.
static fromHex(hex, zip215 = false) {
const { d, a } = CURVE2;
const len = Fp8.BYTES;
hex = ensureBytes("pointHex", hex, len);
const normed = hex.slice();
const lastByte = hex[len - 1];
normed[len - 1] = lastByte & ~128;
const y = bytesToNumberLE(normed);
if (y === _0n6) {
} else {
if (zip215) assertInRange(y, MASK);
else assertInRange(y, Fp8.ORDER);
}
const y2 = modP2(y * y);
const u = modP2(y2 - _1n6);
const v = modP2(d * y2 - a);
let { isValid, value: x } = uvRatio3(u, v);
if (!isValid) throw new Error("Point.fromHex: invalid y coordinate");
const isXOdd = (x & _1n6) === _1n6;
const isLastByteOdd = (lastByte & 128) !== 0;
if (!zip215 && x === _0n6 && isLastByteOdd)
throw new Error("Point.fromHex: x=0 and x_0=1");
if (isLastByteOdd !== isXOdd) x = modP2(-x);
return Point2.fromAffine({ x, y });
}
static fromPrivateKey(privKey) {
return getExtendedPublicKey(privKey).point;
}
toRawBytes() {
const { x, y } = this.toAffine();
const bytes2 = numberToBytesLE(y, Fp8.BYTES);
bytes2[bytes2.length - 1] |= x & _1n6 ? 128 : 0;
return bytes2;
}
toHex() {
return bytesToHex(this.toRawBytes());
}
}
Point2.BASE = new Point2(
CURVE2.Gx,
CURVE2.Gy,
_1n6,
modP2(CURVE2.Gx * CURVE2.Gy),
);
Point2.ZERO = new Point2(_0n6, _1n6, _1n6, _0n6);
const { BASE: G, ZERO: I } = Point2;
const wnaf = wNAF(Point2, nByteLength * 8);
function modN2(a) {
return mod(a, CURVE_ORDER);
}
function modN_LE(hash2) {
return modN2(bytesToNumberLE(hash2));
}
function getExtendedPublicKey(key) {
const len = nByteLength;
key = ensureBytes("private key", key, len);
const hashed = ensureBytes("hashed private key", cHash(key), 2 * len);
const head = adjustScalarBytes3(hashed.slice(0, len));
const prefix = hashed.slice(len, 2 * len);
const scalar = modN_LE(head);
const point = G.multiply(scalar);
const pointBytes = point.toRawBytes();
return { head, prefix, scalar, point, pointBytes };
}
function getPublicKey(privKey) {
return getExtendedPublicKey(privKey).pointBytes;
}
function hashDomainToScalar(context = new Uint8Array(), ...msgs) {
const msg = concatBytes(...msgs);
return modN_LE(
cHash(domain(msg, ensureBytes("context", context), !!prehash)),
);
}
function sign(msg, privKey, options = {}) {
msg = ensureBytes("message", msg);
if (prehash) msg = prehash(msg);
const { prefix, scalar, pointBytes } = getExtendedPublicKey(privKey);
const r = hashDomainToScalar(options.context, prefix, msg);
const R = G.multiply(r).toRawBytes();
const k = hashDomainToScalar(options.context, R, pointBytes, msg);
const s = modN2(r + k * scalar);
assertGE0(s);
const res = concatBytes(R, numberToBytesLE(s, Fp8.BYTES));
return ensureBytes("result", res, nByteLength * 2);
}
const verifyOpts = VERIFY_DEFAULT;
function verify(sig, msg, publicKey, options = verifyOpts) {
const { context, zip215 } = options;
const len = Fp8.BYTES;
sig = ensureBytes("signature", sig, 2 * len);
msg = ensureBytes("message", msg);
if (prehash) msg = prehash(msg);
const s = bytesToNumberLE(sig.slice(len, 2 * len));
let A, R, SB;
try {
A = Point2.fromHex(publicKey, zip215);
R = Point2.fromHex(sig.slice(0, len), zip215);
SB = G.multiplyUnsafe(s);
} catch (error) {
return false;
}
if (!zip215 && A.isSmallOrder()) return false;
const k = hashDomainToScalar(
context,
R.toRawBytes(),
A.toRawBytes(),
msg,
);
const RkA = R.add(A.multiplyUnsafe(k));
return RkA.subtract(SB).clearCofactor().equals(Point2.ZERO);
}
G._setWindowSize(8);
const utils2 = {
getExtendedPublicKey,
// ed25519 private keys are uniform 32b. No need to check for modulo bias, like in secp256k1.
randomPrivateKey: () => randomBytes2(Fp8.BYTES),
/**
* We're doing scalar multiplication (used in getPublicKey etc) with precomputed BASE_POINT
* values. This slows down first getPublicKey() by milliseconds (see Speed section),
* but allows to speed-up subsequent getPublicKey() calls up to 20x.
* @param windowSize 2, 4, 8, 16
*/
precompute(windowSize = 8, point = Point2.BASE) {
point._setWindowSize(windowSize);
point.multiply(BigInt(3));
return point;
},
};
return {
CURVE: CURVE2,
getPublicKey,
sign,
verify,
ExtendedPoint: Point2,
utils: utils2,
};
}
// ../esm/abstract/montgomery.js
var _0n7 = BigInt(0);
var _1n7 = BigInt(1);
function validateOpts3(curve) {
validateObject(
curve,
{
a: "bigint",
},
{
montgomeryBits: "isSafeInteger",
nByteLength: "isSafeInteger",
adjustScalarBytes: "function",
domain: "function",
powPminus2: "function",
Gu: "bigint",
},
);
return Object.freeze({ ...curve });
}
function montgomery(curveDef) {
const CURVE2 = validateOpts3(curveDef);
const { P: P3 } = CURVE2;
const modP2 = (n) => mod(n, P3);
const montgomeryBits = CURVE2.montgomeryBits;
const montgomeryBytes = Math.ceil(montgomeryBits / 8);
const fieldLen = CURVE2.nByteLength;
const adjustScalarBytes3 = CURVE2.adjustScalarBytes || ((bytes2) => bytes2);
const powPminus2 = CURVE2.powPminus2 || ((x) => pow(x, P3 - BigInt(2), P3));
function cswap(swap, x_2, x_3) {
const dummy = modP2(swap * (x_2 - x_3));
x_2 = modP2(x_2 - dummy);
x_3 = modP2(x_3 + dummy);
return [x_2, x_3];
}
function assertFieldElement(n) {
if (typeof n === "bigint" && _0n7 <= n && n < P3) return n;
throw new Error("Expected valid scalar 0 < scalar < CURVE.P");
}
const a24 = (CURVE2.a - BigInt(2)) / BigInt(4);
function montgomeryLadder(pointU, scalar) {
const u = assertFieldElement(pointU);
const k = assertFieldElement(scalar);
const x_1 = u;
let x_2 = _1n7;
let z_2 = _0n7;
let x_3 = u;
let z_3 = _1n7;
let swap = _0n7;
let sw;
for (let t = BigInt(montgomeryBits - 1); t >= _0n7; t--) {
const k_t = (k >> t) & _1n7;
swap ^= k_t;
sw = cswap(swap, x_2, x_3);
x_2 = sw[0];
x_3 = sw[1];
sw = cswap(swap, z_2, z_3);
z_2 = sw[0];
z_3 = sw[1];
swap = k_t;
const A = x_2 + z_2;
const AA = modP2(A * A);
const B = x_2 - z_2;
const BB = modP2(B * B);
const E = AA - BB;
const C = x_3 + z_3;
const D = x_3 - z_3;
const DA = modP2(D * A);
const CB = modP2(C * B);
const dacb = DA + CB;
const da_cb = DA - CB;
x_3 = modP2(dacb * dacb);
z_3 = modP2(x_1 * modP2(da_cb * da_cb));
x_2 = modP2(AA * BB);
z_2 = modP2(E * (AA + modP2(a24 * E)));
}
sw = cswap(swap, x_2, x_3);
x_2 = sw[0];
x_3 = sw[1];
sw = cswap(swap, z_2, z_3);
z_2 = sw[0];
z_3 = sw[1];
const z2 = powPminus2(z_2);
return modP2(x_2 * z2);
}
function encodeUCoordinate(u) {
return numberToBytesLE(modP2(u), montgomeryBytes);
}
function decodeUCoordinate(uEnc) {
const u = ensureBytes("u coordinate", uEnc, montgomeryBytes);
if (fieldLen === montgomeryBytes) u[fieldLen - 1] &= 127;
return bytesToNumberLE(u);
}
function decodeScalar(n) {
const bytes2 = ensureBytes("scalar", n);
if (bytes2.length !== montgomeryBytes && bytes2.length !== fieldLen)
throw new Error(
`Expected ${montgomeryBytes} or ${fieldLen} bytes, got ${bytes2.length}`,
);
return bytesToNumberLE(adjustScalarBytes3(bytes2));
}
function scalarMult(scalar, u) {
const pointU = decodeUCoordinate(u);
const _scalar = decodeScalar(scalar);
const pu = montgomeryLadder(pointU, _scalar);
if (pu === _0n7)
throw new Error("Invalid private or public key received");
return encodeUCoordinate(pu);
}
const GuBytes = encodeUCoordinate(CURVE2.Gu);
function scalarMultBase(scalar) {
return scalarMult(scalar, GuBytes);
}
return {
scalarMult,
scalarMultBase,
getSharedSecret: (privateKey, publicKey) =>
scalarMult(privateKey, publicKey),
getPublicKey: (privateKey) => scalarMultBase(privateKey),
utils: { randomPrivateKey: () => CURVE2.randomBytes(CURVE2.nByteLength) },
GuBytes,
};
}
// ../esm/ed25519.js
var ED25519_P = BigInt(
"57896044618658097711785492504343953926634992332820282019728792003956564819949",
);
var ED25519_SQRT_M1 = BigInt(
"19681161376707505956807079304988542015446066515923890162744021073123829784752",
);
var _0n8 = BigInt(0);
var _1n8 = BigInt(1);
var _2n6 = BigInt(2);
var _5n2 = BigInt(5);
var _10n = BigInt(10);
var _20n = BigInt(20);
var _40n = BigInt(40);
var _80n = BigInt(80);
function ed25519_pow_2_252_3(x) {
const P3 = ED25519_P;
const x2 = (x * x) % P3;
const b2 = (x2 * x) % P3;
const b4 = (pow2(b2, _2n6, P3) * b2) % P3;
const b5 = (pow2(b4, _1n8, P3) * x) % P3;
const b10 = (pow2(b5, _5n2, P3) * b5) % P3;
const b20 = (pow2(b10, _10n, P3) * b10) % P3;
const b40 = (pow2(b20, _20n, P3) * b20) % P3;
const b80 = (pow2(b40, _40n, P3) * b40) % P3;
const b160 = (pow2(b80, _80n, P3) * b80) % P3;
const b240 = (pow2(b160, _80n, P3) * b80) % P3;
const b250 = (pow2(b240, _10n, P3) * b10) % P3;
const pow_p_5_8 = (pow2(b250, _2n6, P3) * x) % P3;
return { pow_p_5_8, b2 };
}
function adjustScalarBytes(bytes2) {
bytes2[0] &= 248;
bytes2[31] &= 127;
bytes2[31] |= 64;
return bytes2;
}
function uvRatio(u, v) {
const P3 = ED25519_P;
const v3 = mod(v * v * v, P3);
const v7 = mod(v3 * v3 * v, P3);
const pow3 = ed25519_pow_2_252_3(u * v7).pow_p_5_8;
let x = mod(u * v3 * pow3, P3);
const vx2 = mod(v * x * x, P3);
const root1 = x;
const root2 = mod(x * ED25519_SQRT_M1, P3);
const useRoot1 = vx2 === u;
const useRoot2 = vx2 === mod(-u, P3);
const noRoot = vx2 === mod(-u * ED25519_SQRT_M1, P3);
if (useRoot1) x = root1;
if (useRoot2 || noRoot) x = root2;
if (isNegativeLE(x, P3)) x = mod(-x, P3);
return { isValid: useRoot1 || useRoot2, value: x };
}
var Fp2 = Field(ED25519_P, void 0, true);
var ed25519Defaults = {
// Param: a
a: BigInt(-1),
// d is equal to -121665/121666 over finite field.
// Negative number is P - number, and division is invert(number, P)
d: BigInt(
"37095705934669439343138083508754565189542113879843219016388785533085940283555",
),
// Finite field 𝔽p over which we'll do calculations; 2n**255n - 19n
Fp: Fp2,
// Subgroup order: how many points curve has
// 2n**252n + 27742317777372353535851937790883648493n;
n: BigInt(
"7237005577332262213973186563042994240857116359379907606001950938285454250989",
),
// Cofactor
h: BigInt(8),
// Base point (x, y) aka generator point
Gx: BigInt(
"15112221349535400772501151409588531511454012693041857206046113283949847762202",
),
Gy: BigInt(
"46316835694926478169428394003475163141307993866256225615783033603165251855960",
),
hash: sha512,
randomBytes,
adjustScalarBytes,
// dom2
// Ratio of u to v. Allows us to combine inversion and square root. Uses algo from RFC8032 5.1.3.
// Constant-time, u/√v
uvRatio,
};
var ed25519 = /* @__PURE__ */ twistedEdwards(ed25519Defaults);
function ed25519_domain(data, ctx, phflag) {
if (ctx.length > 255) throw new Error("Context is too big");
return concatBytes2(
utf8ToBytes2("SigEd25519 no Ed25519 collisions"),
new Uint8Array([phflag ? 1 : 0, ctx.length]),
ctx,
data,
);
}
var ed25519ctx = /* @__PURE__ */ twistedEdwards({
...ed25519Defaults,
domain: ed25519_domain,
});
var ed25519ph = /* @__PURE__ */ twistedEdwards({
...ed25519Defaults,
domain: ed25519_domain,
prehash: sha512,
});
var x25519 = /* @__PURE__ */ (() =>
montgomery({
P: ED25519_P,
a: BigInt(486662),
montgomeryBits: 255,
nByteLength: 32,
Gu: BigInt(9),
powPminus2: (x) => {
const P3 = ED25519_P;
const { pow_p_5_8, b2 } = ed25519_pow_2_252_3(x);
return mod(pow2(pow_p_5_8, BigInt(3), P3) * b2, P3);
},
adjustScalarBytes,
randomBytes,
}))();
function edwardsToMontgomeryPub(edwardsPub) {
const { y } = ed25519.ExtendedPoint.fromHex(edwardsPub);
const _1n12 = BigInt(1);
return Fp2.toBytes(Fp2.create((_1n12 + y) * Fp2.inv(_1n12 - y)));
}
function edwardsToMontgomeryPriv(edwardsPriv) {
const hashed = ed25519Defaults.hash(edwardsPriv.subarray(0, 32));
return ed25519Defaults.adjustScalarBytes(hashed).subarray(0, 32);
}
var ELL2_C1 = (Fp2.ORDER + BigInt(3)) / BigInt(8);
var ELL2_C2 = Fp2.pow(_2n6, ELL2_C1);
var ELL2_C3 = Fp2.sqrt(Fp2.neg(Fp2.ONE));
var ELL2_C4 = (Fp2.ORDER - BigInt(5)) / BigInt(8);
var ELL2_J = BigInt(486662);
var ELL2_C1_EDWARDS = FpSqrtEven(Fp2, Fp2.neg(BigInt(486664)));
var SQRT_AD_MINUS_ONE = BigInt(
"25063068953384623474111414158702152701244531502492656460079210482610430750235",
);
var INVSQRT_A_MINUS_D = BigInt(
"54469307008909316920995813868745141605393597292927456921205312896311721017578",
);
var ONE_MINUS_D_SQ = BigInt(
"1159843021668779879193775521855586647937357759715417654439879720876111806838",
);
var D_MINUS_ONE_SQ = BigInt(
"40440834346308536858101042469323190826248399146238708352240133220865137265952",
);
var MAX_255B = BigInt(
"0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
);
// ../node_modules/@noble/hashes/esm/sha3.js
var [SHA3_PI, SHA3_ROTL, _SHA3_IOTA] = [[], [], []];
var _0n9 = /* @__PURE__ */ BigInt(0);
var _1n9 = /* @__PURE__ */ BigInt(1);
var _2n7 = /* @__PURE__ */ BigInt(2);
var _7n = /* @__PURE__ */ BigInt(7);
var _256n = /* @__PURE__ */ BigInt(256);
var _0x71n = /* @__PURE__ */ BigInt(113);
for (let round = 0, R = _1n9, x = 1, y = 0; round < 24; round++) {
[x, y] = [y, (2 * x + 3 * y) % 5];
SHA3_PI.push(2 * (5 * y + x));
SHA3_ROTL.push((((round + 1) * (round + 2)) / 2) % 64);
let t = _0n9;
for (let j = 0; j < 7; j++) {
R = ((R << _1n9) ^ ((R >> _7n) * _0x71n)) % _256n;
if (R & _2n7) t ^= _1n9 << ((_1n9 << /* @__PURE__ */ BigInt(j)) - _1n9);
}
_SHA3_IOTA.push(t);
}
var [SHA3_IOTA_H, SHA3_IOTA_L] = /* @__PURE__ */ split(_SHA3_IOTA, true);
var rotlH = (h, l, s) => (s > 32 ? rotlBH(h, l, s) : rotlSH(h, l, s));
var rotlL = (h, l, s) => (s > 32 ? rotlBL(h, l, s) : rotlSL(h, l, s));
function keccakP(s, rounds = 24) {
const B = new Uint32Array(5 * 2);
for (let round = 24 - rounds; round < 24; round++) {
for (let x = 0; x < 10; x++)
B[x] = s[x] ^ s[x + 10] ^ s[x + 20] ^ s[x + 30] ^ s[x + 40];
for (let x = 0; x < 10; x += 2) {
const idx1 = (x + 8) % 10;
const idx0 = (x + 2) % 10;
const B0 = B[idx0];
const B1 = B[idx0 + 1];
const Th = rotlH(B0, B1, 1) ^ B[idx1];
const Tl = rotlL(B0, B1, 1) ^ B[idx1 + 1];
for (let y = 0; y < 50; y += 10) {
s[x + y] ^= Th;
s[x + y + 1] ^= Tl;
}
}
let curH = s[2];
let curL = s[3];
for (let t = 0; t < 24; t++) {
const shift = SHA3_ROTL[t];
const Th = rotlH(curH, curL, shift);
const Tl = rotlL(curH, curL, shift);
const PI = SHA3_PI[t];
curH = s[PI];
curL = s[PI + 1];
s[PI] = Th;
s[PI + 1] = Tl;
}
for (let y = 0; y < 50; y += 10) {
for (let x = 0; x < 10; x++) B[x] = s[y + x];
for (let x = 0; x < 10; x++)
s[y + x] ^= ~B[(x + 2) % 10] & B[(x + 4) % 10];
}
s[0] ^= SHA3_IOTA_H[round];
s[1] ^= SHA3_IOTA_L[round];
}
B.fill(0);
}
var Keccak = class _Keccak extends Hash {
// NOTE: we accept arguments in bytes instead of bits here.
constructor(blockLen, suffix, outputLen, enableXOF = false, rounds = 24) {
super();
this.blockLen = blockLen;
this.suffix = suffix;
this.outputLen = outputLen;
this.enableXOF = enableXOF;
this.rounds = rounds;
this.pos = 0;
this.posOut = 0;
this.finished = false;
this.destroyed = false;
number(outputLen);
if (0 >= this.blockLen || this.blockLen >= 200)
throw new Error("Sha3 supports only keccak-f1600 function");
this.state = new Uint8Array(200);
this.state32 = u32(this.state);
}
keccak() {
keccakP(this.state32, this.rounds);
this.posOut = 0;
this.pos = 0;
}
update(data) {
exists(this);
const { blockLen, state } = this;
data = toBytes(data);
const len = data.length;
for (let pos = 0; pos < len; ) {
const take = Math.min(blockLen - this.pos, len - pos);
for (let i = 0; i < take; i++) state[this.pos++] ^= data[pos++];
if (this.pos === blockLen) this.keccak();
}
return this;
}
finish() {
if (this.finished) return;
this.finished = true;
const { state, suffix, pos, blockLen } = this;
state[pos] ^= suffix;
if ((suffix & 128) !== 0 && pos === blockLen - 1) this.keccak();
state[blockLen - 1] ^= 128;
this.keccak();
}
writeInto(out) {
exists(this, false);
bytes(out);
this.finish();
const bufferOut = this.state;
const { blockLen } = this;
for (let pos = 0, len = out.length; pos < len; ) {
if (this.posOut >= blockLen) this.keccak();
const take = Math.min(blockLen - this.posOut, len - pos);
out.set(bufferOut.subarray(this.posOut, this.posOut + take), pos);
this.posOut += take;
pos += take;
}
return out;
}
xofInto(out) {
if (!this.enableXOF)
throw new Error("XOF is not possible for this instance");
return this.writeInto(out);
}
xof(bytes2) {
number(bytes2);
return this.xofInto(new Uint8Array(bytes2));
}
digestInto(out) {
output(out, this);
if (this.finished) throw new Error("digest() was already called");
this.writeInto(out);
this.destroy();
return out;
}
digest() {
return this.digestInto(new Uint8Array(this.outputLen));
}
destroy() {
this.destroyed = true;
this.state.fill(0);
}
_cloneInto(to) {
const { blockLen, suffix, outputLen, rounds, enableXOF } = this;
to || (to = new _Keccak(blockLen, suffix, outputLen, enableXOF, rounds));
to.state32.set(this.state32);
to.pos = this.pos;
to.posOut = this.posOut;
to.finished = this.finished;
to.rounds = rounds;
to.suffix = suffix;
to.outputLen = outputLen;
to.enableXOF = enableXOF;
to.destroyed = this.destroyed;
return to;
}
};
var gen = (suffix, blockLen, outputLen) =>
wrapConstructor(() => new Keccak(blockLen, suffix, outputLen));
var sha3_224 = /* @__PURE__ */ gen(6, 144, 224 / 8);
var sha3_256 = /* @__PURE__ */ gen(6, 136, 256 / 8);
var sha3_384 = /* @__PURE__ */ gen(6, 104, 384 / 8);
var sha3_512 = /* @__PURE__ */ gen(6, 72, 512 / 8);
var keccak_224 = /* @__PURE__ */ gen(1, 144, 224 / 8);
var keccak_256 = /* @__PURE__ */ gen(1, 136, 256 / 8);
var keccak_384 = /* @__PURE__ */ gen(1, 104, 384 / 8);
var keccak_512 = /* @__PURE__ */ gen(1, 72, 512 / 8);
var genShake = (suffix, blockLen, outputLen) =>
wrapXOFConstructorWithOpts(
(opts = {}) =>
new Keccak(
blockLen,
suffix,
opts.dkLen === void 0 ? outputLen : opts.dkLen,
true,
),
);
var shake128 = /* @__PURE__ */ genShake(31, 168, 128 / 8);
var shake256 = /* @__PURE__ */ genShake(31, 136, 256 / 8);
// ../esm/ed448.js
var shake256_114 = wrapConstructor(() => shake256.create({ dkLen: 114 }));
var shake256_64 = wrapConstructor(() => shake256.create({ dkLen: 64 }));
var ed448P = BigInt(
"726838724295606890549323807888004534353641360687318060281490199180612328166730772686396383698676545930088884461843637361053498018365439",
);
var _1n10 = BigInt(1);
var _2n8 = BigInt(2);
var _3n3 = BigInt(3);
var _4n3 = BigInt(4);
var _11n = BigInt(11);
var _22n = BigInt(22);
var _44n = BigInt(44);
var _88n = BigInt(88);
var _223n = BigInt(223);
function ed448_pow_Pminus3div4(x) {
const P3 = ed448P;
const b2 = (x * x * x) % P3;
const b3 = (b2 * b2 * x) % P3;
const b6 = (pow2(b3, _3n3, P3) * b3) % P3;
const b9 = (pow2(b6, _3n3, P3) * b3) % P3;
const b11 = (pow2(b9, _2n8, P3) * b2) % P3;
const b22 = (pow2(b11, _11n, P3) * b11) % P3;
const b44 = (pow2(b22, _22n, P3) * b22) % P3;
const b88 = (pow2(b44, _44n, P3) * b44) % P3;
const b176 = (pow2(b88, _88n, P3) * b88) % P3;
const b220 = (pow2(b176, _44n, P3) * b44) % P3;
const b222 = (pow2(b220, _2n8, P3) * b2) % P3;
const b223 = (pow2(b222, _1n10, P3) * x) % P3;
return (pow2(b223, _223n, P3) * b222) % P3;
}
function adjustScalarBytes2(bytes2) {
bytes2[0] &= 252;
bytes2[55] |= 128;
bytes2[56] = 0;
return bytes2;
}
function uvRatio2(u, v) {
const P3 = ed448P;
const u2v = mod(u * u * v, P3);
const u3v = mod(u2v * u, P3);
const u5v3 = mod(u3v * u2v * v, P3);
const root = ed448_pow_Pminus3div4(u5v3);
const x = mod(u3v * root, P3);
const x2 = mod(x * x, P3);
return { isValid: mod(x2 * v, P3) === u, value: x };
}
var Fp3 = Field(ed448P, 456, true);
var ED448_DEF = {
// Param: a
a: BigInt(1),
// -39081. Negative number is P - number
d: BigInt(
"726838724295606890549323807888004534353641360687318060281490199180612328166730772686396383698676545930088884461843637361053498018326358",
),
// Finite field 𝔽p over which we'll do calculations; 2n**448n - 2n**224n - 1n
Fp: Fp3,
// Subgroup order: how many points curve has;
// 2n**446n - 13818066809895115352007386748515426880336692474882178609894547503885n
n: BigInt(
"181709681073901722637330951972001133588410340171829515070372549795146003961539585716195755291692375963310293709091662304773755859649779",
),
nBitLength: 456,
// Cofactor
h: BigInt(4),
// Base point (x, y) aka generator point
Gx: BigInt(
"224580040295924300187604334099896036246789641632564134246125461686950415467406032909029192869357953282578032075146446173674602635247710",
),
Gy: BigInt(
"298819210078481492676017930443930673437544040154080242095928241372331506189835876003536878655418784733982303233503462500531545062832660",
),
// SHAKE256(dom4(phflag,context)||x, 114)
hash: shake256_114,
randomBytes,
adjustScalarBytes: adjustScalarBytes2,
// dom4
domain: (data, ctx, phflag) => {
if (ctx.length > 255)
throw new Error(`Context is too big: ${ctx.length}`);
return concatBytes2(
utf8ToBytes2("SigEd448"),
new Uint8Array([phflag ? 1 : 0, ctx.length]),
ctx,
data,
);
},
uvRatio: uvRatio2,
};
var ed448 = /* @__PURE__ */ twistedEdwards(ED448_DEF);
var ed448ph = /* @__PURE__ */ twistedEdwards({
...ED448_DEF,
prehash: shake256_64,
});
var x448 = /* @__PURE__ */ (() =>
montgomery({
a: BigInt(156326),
montgomeryBits: 448,
nByteLength: 57,
P: ed448P,
Gu: BigInt(5),
powPminus2: (x) => {
const P3 = ed448P;
const Pminus3div4 = ed448_pow_Pminus3div4(x);
const Pminus3 = pow2(Pminus3div4, BigInt(2), P3);
return mod(Pminus3 * x, P3);
},
adjustScalarBytes: adjustScalarBytes2,
randomBytes,
}))();
function edwardsToMontgomeryPub2(edwardsPub) {
const { y } = ed448.ExtendedPoint.fromHex(edwardsPub);
const _1n12 = BigInt(1);
return Fp3.toBytes(Fp3.create((y - _1n12) * Fp3.inv(y + _1n12)));
}
var ELL2_C12 = (Fp3.ORDER - BigInt(3)) / BigInt(4);
var ELL2_J2 = BigInt(156326);
var ONE_MINUS_D = BigInt("39082");
var ONE_MINUS_TWO_D = BigInt("78163");
var SQRT_MINUS_D = BigInt(
"98944233647732219769177004876929019128417576295529901074099889598043702116001257856802131563896515373927712232092845883226922417596214",
);
var INVSQRT_MINUS_D = BigInt(
"315019913931389607337177038330951043522456072897266928557328499619017160722351061360252776265186336876723201881398623946864393857820716",
);
var MAX_448B = BigInt(
"0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
);
// ../esm/p256.js
var Fp4 = Field(
BigInt(
"0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff",
),
);
var CURVE_A = Fp4.create(BigInt("-3"));
var CURVE_B = BigInt(
"0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b",
);
var p256 = createCurve(
{
a: CURVE_A,
b: CURVE_B,
Fp: Fp4,
// Curve order, total count of valid points in the field
n: BigInt(
"0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551",
),
// Base (generator) point (x, y)
Gx: BigInt(
"0x6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296",
),
Gy: BigInt(
"0x4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5",
),
h: BigInt(1),
lowS: false,
},
sha256,
);
// ../esm/p384.js
var P = BigInt(
"0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffff0000000000000000ffffffff",
);
var Fp5 = Field(P);
var CURVE_A2 = Fp5.create(BigInt("-3"));
var CURVE_B2 = BigInt(
"0xb3312fa7e23ee7e4988e056be3f82d19181d9c6efe8141120314088f5013875ac656398d8a2ed19d2a85c8edd3ec2aef",
);
var p384 = createCurve(
{
a: CURVE_A2,
b: CURVE_B2,
Fp: Fp5,
// Curve order, total count of valid points in the field.
n: BigInt(
"0xffffffffffffffffffffffffffffffffffffffffffffffffc7634d81f4372ddf581a0db248b0a77aecec196accc52973",
),
// Base (generator) point (x, y)
Gx: BigInt(
"0xaa87ca22be8b05378eb1c71ef320ad746e1d3b628ba79b9859f741e082542a385502f25dbf55296c3a545e3872760ab7",
),
Gy: BigInt(
"0x3617de4a96262c6f5d9e98bf9292dc29f8f41dbd289a147ce9da3113b5f0b8c00a60b1ce1d7e819d7a431d7c90ea0e5f",
),
h: BigInt(1),
lowS: false,
},
sha384,
);
// ../esm/p521.js
var P2 = BigInt(
"0x1ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
);
var Fp6 = Field(P2);
var CURVE = {
a: Fp6.create(BigInt("-3")),
b: BigInt(
"0x0051953eb9618e1c9a1f929a21a0b68540eea2da725b99b315f3b8b489918ef109e156193951ec7e937b1652c0bd3bb1bf073573df883d2c34f1ef451fd46b503f00",
),
Fp: Fp6,
n: BigInt(
"0x01fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffa51868783bf2f966b7fcc0148f709a5d03bb5c9b8899c47aebb6fb71e91386409",
),
Gx: BigInt(
"0x00c6858e06b70404e9cd9e3ecb662395b4429c648139053fb521f828af606b4d3dbaa14b5e77efe75928fe1dc127a2ffa8de3348b3c1856a429bf97e7e31c2e5bd66",
),
Gy: BigInt(
"0x011839296a789a3bc0045c8a5fb42c7d1bd998f54449579b446817afbd17273e662c97ee72995ef42640c550b9013fad0761353c7086a272c24088be94769fd16650",
),
h: BigInt(1),
};
var p521 = createCurve(
{
a: CURVE.a,
b: CURVE.b,
Fp: Fp6,
// Curve order, total count of valid points in the field
n: CURVE.n,
Gx: CURVE.Gx,
Gy: CURVE.Gy,
h: CURVE.h,
lowS: false,
allowedPrivateKeyLengths: [130, 131, 132],
// P521 keys are variable-length. Normalize to 132b
},
sha512,
);
// ../esm/abstract/bls.js
var _2n9 = BigInt(2);
var _3n4 = BigInt(3);
function bls(CURVE2) {
const {
Fp: Fp8,
Fr: Fr2,
Fp2: Fp23,
Fp6: Fp63,
Fp12: Fp122,
} = CURVE2.fields;
const BLS_X_LEN2 = bitLen(CURVE2.params.x);
function calcPairingPrecomputes(p) {
const { x, y } = p;
const Qx = x,
Qy = y,
Qz = Fp23.ONE;
let Rx = Qx,
Ry = Qy,
Rz = Qz;
let ell_coeff = [];
for (let i = BLS_X_LEN2 - 2; i >= 0; i--) {
let t0 = Fp23.sqr(Ry);
let t1 = Fp23.sqr(Rz);
let t2 = Fp23.multiplyByB(Fp23.mul(t1, _3n4));
let t3 = Fp23.mul(t2, _3n4);
let t4 = Fp23.sub(Fp23.sub(Fp23.sqr(Fp23.add(Ry, Rz)), t1), t0);
ell_coeff.push([
Fp23.sub(t2, t0),
Fp23.mul(Fp23.sqr(Rx), _3n4),
Fp23.neg(t4),
// -T4
]);
Rx = Fp23.div(Fp23.mul(Fp23.mul(Fp23.sub(t0, t3), Rx), Ry), _2n9);
Ry = Fp23.sub(
Fp23.sqr(Fp23.div(Fp23.add(t0, t3), _2n9)),
Fp23.mul(Fp23.sqr(t2), _3n4),
);
Rz = Fp23.mul(t0, t4);
if (bitGet(CURVE2.params.x, i)) {
let t02 = Fp23.sub(Ry, Fp23.mul(Qy, Rz));
let t12 = Fp23.sub(Rx, Fp23.mul(Qx, Rz));
ell_coeff.push([
Fp23.sub(Fp23.mul(t02, Qx), Fp23.mul(t12, Qy)),
Fp23.neg(t02),
t12,
// T1
]);
let t22 = Fp23.sqr(t12);
let t32 = Fp23.mul(t22, t12);
let t42 = Fp23.mul(t22, Rx);
let t5 = Fp23.add(
Fp23.sub(t32, Fp23.mul(t42, _2n9)),
Fp23.mul(Fp23.sqr(t02), Rz),
);
Rx = Fp23.mul(t12, t5);
Ry = Fp23.sub(Fp23.mul(Fp23.sub(t42, t5), t02), Fp23.mul(t32, Ry));
Rz = Fp23.mul(Rz, t32);
}
}
return ell_coeff;
}
function millerLoop(ell, g1) {
const { x } = CURVE2.params;
const Px = g1[0];
const Py = g1[1];
let f12 = Fp122.ONE;
for (let j = 0, i = BLS_X_LEN2 - 2; i >= 0; i--, j++) {
const E = ell[j];
f12 = Fp122.multiplyBy014(
f12,
E[0],
Fp23.mul(E[1], Px),
Fp23.mul(E[2], Py),
);
if (bitGet(x, i)) {
j += 1;
const F = ell[j];
f12 = Fp122.multiplyBy014(
f12,
F[0],
Fp23.mul(F[1], Px),
Fp23.mul(F[2], Py),
);
}
if (i !== 0) f12 = Fp122.sqr(f12);
}
return Fp122.conjugate(f12);
}
const utils2 = {
randomPrivateKey: () => {
const length = getMinHashLength(Fr2.ORDER);
return mapHashToField(CURVE2.randomBytes(length), Fr2.ORDER);
},
calcPairingPrecomputes,
};
const G1_ = weierstrassPoints({ n: Fr2.ORDER, ...CURVE2.G1 });
const G1 = Object.assign(
G1_,
createHasher(G1_.ProjectivePoint, CURVE2.G1.mapToCurve, {
...CURVE2.htfDefaults,
...CURVE2.G1.htfDefaults,
}),
);
function pairingPrecomputes(point) {
const p = point;
if (p._PPRECOMPUTES) return p._PPRECOMPUTES;
p._PPRECOMPUTES = calcPairingPrecomputes(point.toAffine());
return p._PPRECOMPUTES;
}
const G2_ = weierstrassPoints({ n: Fr2.ORDER, ...CURVE2.G2 });
const G2 = Object.assign(
G2_,
createHasher(G2_.ProjectivePoint, CURVE2.G2.mapToCurve, {
...CURVE2.htfDefaults,
...CURVE2.G2.htfDefaults,
}),
);
const { Signature } = CURVE2.G2;
function pairing(Q, P3, withFinalExponent = true) {
if (
Q.equals(G1.ProjectivePoint.ZERO) ||
P3.equals(G2.ProjectivePoint.ZERO)
)
throw new Error("pairing is not available for ZERO point");
Q.assertValidity();
P3.assertValidity();
const Qa = Q.toAffine();
const looped = millerLoop(pairingPrecomputes(P3), [Qa.x, Qa.y]);
return withFinalExponent ? Fp122.finalExponentiate(looped) : looped;
}
function normP1(point) {
return point instanceof G1.ProjectivePoint
? point
: G1.ProjectivePoint.fromHex(point);
}
function normP2(point) {
return point instanceof G2.ProjectivePoint
? point
: Signature.fromHex(point);
}
function normP2Hash(point, htfOpts) {
return point instanceof G2.ProjectivePoint
? point
: G2.hashToCurve(ensureBytes("point", point), htfOpts);
}
function getPublicKey(privateKey) {
return G1.ProjectivePoint.fromPrivateKey(privateKey).toRawBytes(true);
}
function sign(message, privateKey, htfOpts) {
const msgPoint = normP2Hash(message, htfOpts);
msgPoint.assertValidity();
const sigPoint = msgPoint.multiply(G1.normPrivateKeyToScalar(privateKey));
if (message instanceof G2.ProjectivePoint) return sigPoint;
return Signature.toRawBytes(sigPoint);
}
function verify(signature, message, publicKey, htfOpts) {
const P3 = normP1(publicKey);
const Hm = normP2Hash(message, htfOpts);
const G = G1.ProjectivePoint.BASE;
const S = normP2(signature);
const ePHm = pairing(P3.negate(), Hm, false);
const eGS = pairing(G, S, false);
const exp = Fp122.finalExponentiate(Fp122.mul(eGS, ePHm));
return Fp122.eql(exp, Fp122.ONE);
}
function aggregatePublicKeys(publicKeys) {
if (!publicKeys.length) throw new Error("Expected non-empty array");
const agg = publicKeys
.map(normP1)
.reduce((sum, p) => sum.add(p), G1.ProjectivePoint.ZERO);
const aggAffine = agg;
if (publicKeys[0] instanceof G1.ProjectivePoint) {
aggAffine.assertValidity();
return aggAffine;
}
return aggAffine.toRawBytes(true);
}
function aggregateSignatures(signatures) {
if (!signatures.length) throw new Error("Expected non-empty array");
const agg = signatures
.map(normP2)
.reduce((sum, s) => sum.add(s), G2.ProjectivePoint.ZERO);
const aggAffine = agg;
if (signatures[0] instanceof G2.ProjectivePoint) {
aggAffine.assertValidity();
return aggAffine;
}
return Signature.toRawBytes(aggAffine);
}
function verifyBatch(signature, messages, publicKeys, htfOpts) {
if (!messages.length)
throw new Error("Expected non-empty messages array");
if (publicKeys.length !== messages.length)
throw new Error("Pubkey count should equal msg count");
const sig = normP2(signature);
const nMessages = messages.map((i) => normP2Hash(i, htfOpts));
const nPublicKeys = publicKeys.map(normP1);
try {
const paired = [];
for (const message of new Set(nMessages)) {
const groupPublicKey = nMessages.reduce(
(groupPublicKey2, subMessage, i) =>
subMessage === message
? groupPublicKey2.add(nPublicKeys[i])
: groupPublicKey2,
G1.ProjectivePoint.ZERO,
);
paired.push(pairing(groupPublicKey, message, false));
}
paired.push(pairing(G1.ProjectivePoint.BASE.negate(), sig, false));
const product = paired.reduce((a, b) => Fp122.mul(a, b), Fp122.ONE);
const exp = Fp122.finalExponentiate(product);
return Fp122.eql(exp, Fp122.ONE);
} catch {
return false;
}
}
G1.ProjectivePoint.BASE._setWindowSize(4);
return {
getPublicKey,
sign,
verify,
verifyBatch,
aggregatePublicKeys,
aggregateSignatures,
millerLoop,
pairing,
G1,
G2,
Signature,
fields: {
Fr: Fr2,
Fp: Fp8,
Fp2: Fp23,
Fp6: Fp63,
Fp12: Fp122,
},
params: {
x: CURVE2.params.x,
r: CURVE2.params.r,
G1b: CURVE2.G1.b,
G2b: CURVE2.G2.b,
},
utils: utils2,
};
}
// ../esm/bls12-381.js
var _0n10 = BigInt(0);
var _1n11 = BigInt(1);
var _2n10 = BigInt(2);
var _3n5 = BigInt(3);
var _4n4 = BigInt(4);
var _8n3 = BigInt(8);
var _16n2 = BigInt(16);
var Fp_raw = BigInt(
"0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab",
);
var Fp7 = Field(Fp_raw);
var Fr = Field(
BigInt(
"0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001",
),
);
var Fp2Add = ({ c0, c1 }, { c0: r0, c1: r1 }) => ({
c0: Fp7.add(c0, r0),
c1: Fp7.add(c1, r1),
});
var Fp2Subtract = ({ c0, c1 }, { c0: r0, c1: r1 }) => ({
c0: Fp7.sub(c0, r0),
c1: Fp7.sub(c1, r1),
});
var Fp2Multiply = ({ c0, c1 }, rhs) => {
if (typeof rhs === "bigint")
return { c0: Fp7.mul(c0, rhs), c1: Fp7.mul(c1, rhs) };
const { c0: r0, c1: r1 } = rhs;
let t1 = Fp7.mul(c0, r0);
let t2 = Fp7.mul(c1, r1);
const o0 = Fp7.sub(t1, t2);
const o1 = Fp7.sub(
Fp7.mul(Fp7.add(c0, c1), Fp7.add(r0, r1)),
Fp7.add(t1, t2),
);
return { c0: o0, c1: o1 };
};
var Fp2Square = ({ c0, c1 }) => {
const a = Fp7.add(c0, c1);
const b = Fp7.sub(c0, c1);
const c = Fp7.add(c0, c0);
return { c0: Fp7.mul(a, b), c1: Fp7.mul(c, c1) };
};
var FP2_ORDER = Fp_raw * Fp_raw;
var Fp22 = {
ORDER: FP2_ORDER,
BITS: bitLen(FP2_ORDER),
BYTES: Math.ceil(bitLen(FP2_ORDER) / 8),
MASK: bitMask(bitLen(FP2_ORDER)),
ZERO: { c0: Fp7.ZERO, c1: Fp7.ZERO },
ONE: { c0: Fp7.ONE, c1: Fp7.ZERO },
create: (num) => num,
isValid: ({ c0, c1 }) => typeof c0 === "bigint" && typeof c1 === "bigint",
is0: ({ c0, c1 }) => Fp7.is0(c0) && Fp7.is0(c1),
eql: ({ c0, c1 }, { c0: r0, c1: r1 }) => Fp7.eql(c0, r0) && Fp7.eql(c1, r1),
neg: ({ c0, c1 }) => ({ c0: Fp7.neg(c0), c1: Fp7.neg(c1) }),
pow: (num, power) => FpPow(Fp22, num, power),
invertBatch: (nums) => FpInvertBatch(Fp22, nums),
// Normalized
add: Fp2Add,
sub: Fp2Subtract,
mul: Fp2Multiply,
sqr: Fp2Square,
// NonNormalized stuff
addN: Fp2Add,
subN: Fp2Subtract,
mulN: Fp2Multiply,
sqrN: Fp2Square,
// Why inversion for bigint inside Fp instead of Fp2? it is even used in that context?
div: (lhs, rhs) =>
Fp22.mul(
lhs,
typeof rhs === "bigint" ? Fp7.inv(Fp7.create(rhs)) : Fp22.inv(rhs),
),
inv: ({ c0: a, c1: b }) => {
const factor = Fp7.inv(Fp7.create(a * a + b * b));
return {
c0: Fp7.mul(factor, Fp7.create(a)),
c1: Fp7.mul(factor, Fp7.create(-b)),
};
},
sqrt: (num) => {
if (Fp22.eql(num, Fp22.ZERO)) return Fp22.ZERO;
const candidateSqrt = Fp22.pow(num, (Fp22.ORDER + _8n3) / _16n2);
const check = Fp22.div(Fp22.sqr(candidateSqrt), num);
const R = FP2_ROOTS_OF_UNITY;
const divisor = [R[0], R[2], R[4], R[6]].find((r) => Fp22.eql(r, check));
if (!divisor) throw new Error("No root");
const index = R.indexOf(divisor);
const root = R[index / 2];
if (!root) throw new Error("Invalid root");
const x1 = Fp22.div(candidateSqrt, root);
const x2 = Fp22.neg(x1);
const { re: re1, im: im1 } = Fp22.reim(x1);
const { re: re2, im: im2 } = Fp22.reim(x2);
if (im1 > im2 || (im1 === im2 && re1 > re2)) return x1;
return x2;
},
// Same as sgn0_m_eq_2 in RFC 9380
isOdd: (x) => {
const { re: x0, im: x1 } = Fp22.reim(x);
const sign_0 = x0 % _2n10;
const zero_0 = x0 === _0n10;
const sign_1 = x1 % _2n10;
return BigInt(sign_0 || (zero_0 && sign_1)) == _1n11;
},
// Bytes util
fromBytes(b) {
if (b.length !== Fp22.BYTES)
throw new Error(`fromBytes wrong length=${b.length}`);
return {
c0: Fp7.fromBytes(b.subarray(0, Fp7.BYTES)),
c1: Fp7.fromBytes(b.subarray(Fp7.BYTES)),
};
},
toBytes: ({ c0, c1 }) => concatBytes(Fp7.toBytes(c0), Fp7.toBytes(c1)),
cmov: ({ c0, c1 }, { c0: r0, c1: r1 }, c) => ({
c0: Fp7.cmov(c0, r0, c),
c1: Fp7.cmov(c1, r1, c),
}),
// Specific utils
// toString() {
// return `Fp2(${this.c0} + ${this.c1}×i)`;
// }
reim: ({ c0, c1 }) => ({ re: c0, im: c1 }),
// multiply by u + 1
mulByNonresidue: ({ c0, c1 }) => ({
c0: Fp7.sub(c0, c1),
c1: Fp7.add(c0, c1),
}),
multiplyByB: ({ c0, c1 }) => {
let t0 = Fp7.mul(c0, _4n4);
let t1 = Fp7.mul(c1, _4n4);
return { c0: Fp7.sub(t0, t1), c1: Fp7.add(t0, t1) };
},
fromBigTuple: (tuple) => {
if (tuple.length !== 2) throw new Error("Invalid tuple");
const fps = tuple.map((n) => Fp7.create(n));
return { c0: fps[0], c1: fps[1] };
},
frobeniusMap: ({ c0, c1 }, power) => ({
c0,
c1: Fp7.mul(c1, FP2_FROBENIUS_COEFFICIENTS[power % 2]),
}),
};
var FP2_FROBENIUS_COEFFICIENTS = [
BigInt("0x1"),
BigInt(
"0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaaa",
),
].map((item) => Fp7.create(item));
var rv1 = BigInt(
"0x6af0e0437ff400b6831e36d6bd17ffe48395dabc2d3435e77f76e17009241c5ee67992f72ec05f4c81084fbede3cc09",
);
var FP2_ROOTS_OF_UNITY = [
[_1n11, _0n10],
[rv1, -rv1],
[_0n10, _1n11],
[rv1, rv1],
[-_1n11, _0n10],
[-rv1, rv1],
[_0n10, -_1n11],
[-rv1, -rv1],
].map((pair) => Fp22.fromBigTuple(pair));
var Fp6Add = ({ c0, c1, c2 }, { c0: r0, c1: r1, c2: r2 }) => ({
c0: Fp22.add(c0, r0),
c1: Fp22.add(c1, r1),
c2: Fp22.add(c2, r2),
});
var Fp6Subtract = ({ c0, c1, c2 }, { c0: r0, c1: r1, c2: r2 }) => ({
c0: Fp22.sub(c0, r0),
c1: Fp22.sub(c1, r1),
c2: Fp22.sub(c2, r2),
});
var Fp6Multiply = ({ c0, c1, c2 }, rhs) => {
if (typeof rhs === "bigint") {
return {
c0: Fp22.mul(c0, rhs),
c1: Fp22.mul(c1, rhs),
c2: Fp22.mul(c2, rhs),
};
}
const { c0: r0, c1: r1, c2: r2 } = rhs;
const t0 = Fp22.mul(c0, r0);
const t1 = Fp22.mul(c1, r1);
const t2 = Fp22.mul(c2, r2);
return {
// t0 + (c1 + c2) * (r1 * r2) - (T1 + T2) * (u + 1)
c0: Fp22.add(
t0,
Fp22.mulByNonresidue(
Fp22.sub(
Fp22.mul(Fp22.add(c1, c2), Fp22.add(r1, r2)),
Fp22.add(t1, t2),
),
),
),
// (c0 + c1) * (r0 + r1) - (T0 + T1) + T2 * (u + 1)
c1: Fp22.add(
Fp22.sub(
Fp22.mul(Fp22.add(c0, c1), Fp22.add(r0, r1)),
Fp22.add(t0, t1),
),
Fp22.mulByNonresidue(t2),
),
// T1 + (c0 + c2) * (r0 + r2) - T0 + T2
c2: Fp22.sub(
Fp22.add(t1, Fp22.mul(Fp22.add(c0, c2), Fp22.add(r0, r2))),
Fp22.add(t0, t2),
),
};
};
var Fp6Square = ({ c0, c1, c2 }) => {
let t0 = Fp22.sqr(c0);
let t1 = Fp22.mul(Fp22.mul(c0, c1), _2n10);
let t3 = Fp22.mul(Fp22.mul(c1, c2), _2n10);
let t4 = Fp22.sqr(c2);
return {
c0: Fp22.add(Fp22.mulByNonresidue(t3), t0),
c1: Fp22.add(Fp22.mulByNonresidue(t4), t1),
// T1 + (c0 - c1 + c2)² + T3 - T0 - T4
c2: Fp22.sub(
Fp22.sub(
Fp22.add(Fp22.add(t1, Fp22.sqr(Fp22.add(Fp22.sub(c0, c1), c2))), t3),
t0,
),
t4,
),
};
};
var Fp62 = {
ORDER: Fp22.ORDER,
BITS: 3 * Fp22.BITS,
BYTES: 3 * Fp22.BYTES,
MASK: bitMask(3 * Fp22.BITS),
ZERO: { c0: Fp22.ZERO, c1: Fp22.ZERO, c2: Fp22.ZERO },
ONE: { c0: Fp22.ONE, c1: Fp22.ZERO, c2: Fp22.ZERO },
create: (num) => num,
isValid: ({ c0, c1, c2 }) =>
Fp22.isValid(c0) && Fp22.isValid(c1) && Fp22.isValid(c2),
is0: ({ c0, c1, c2 }) => Fp22.is0(c0) && Fp22.is0(c1) && Fp22.is0(c2),
neg: ({ c0, c1, c2 }) => ({
c0: Fp22.neg(c0),
c1: Fp22.neg(c1),
c2: Fp22.neg(c2),
}),
eql: ({ c0, c1, c2 }, { c0: r0, c1: r1, c2: r2 }) =>
Fp22.eql(c0, r0) && Fp22.eql(c1, r1) && Fp22.eql(c2, r2),
sqrt: () => {
throw new Error("Not implemented");
},
// Do we need division by bigint at all? Should be done via order:
div: (lhs, rhs) =>
Fp62.mul(
lhs,
typeof rhs === "bigint" ? Fp7.inv(Fp7.create(rhs)) : Fp62.inv(rhs),
),
pow: (num, power) => FpPow(Fp62, num, power),
invertBatch: (nums) => FpInvertBatch(Fp62, nums),
// Normalized
add: Fp6Add,
sub: Fp6Subtract,
mul: Fp6Multiply,
sqr: Fp6Square,
// NonNormalized stuff
addN: Fp6Add,
subN: Fp6Subtract,
mulN: Fp6Multiply,
sqrN: Fp6Square,
inv: ({ c0, c1, c2 }) => {
let t0 = Fp22.sub(Fp22.sqr(c0), Fp22.mulByNonresidue(Fp22.mul(c2, c1)));
let t1 = Fp22.sub(Fp22.mulByNonresidue(Fp22.sqr(c2)), Fp22.mul(c0, c1));
let t2 = Fp22.sub(Fp22.sqr(c1), Fp22.mul(c0, c2));
let t4 = Fp22.inv(
Fp22.add(
Fp22.mulByNonresidue(Fp22.add(Fp22.mul(c2, t1), Fp22.mul(c1, t2))),
Fp22.mul(c0, t0),
),
);
return {
c0: Fp22.mul(t4, t0),
c1: Fp22.mul(t4, t1),
c2: Fp22.mul(t4, t2),
};
},
// Bytes utils
fromBytes: (b) => {
if (b.length !== Fp62.BYTES)
throw new Error(`fromBytes wrong length=${b.length}`);
return {
c0: Fp22.fromBytes(b.subarray(0, Fp22.BYTES)),
c1: Fp22.fromBytes(b.subarray(Fp22.BYTES, 2 * Fp22.BYTES)),
c2: Fp22.fromBytes(b.subarray(2 * Fp22.BYTES)),
};
},
toBytes: ({ c0, c1, c2 }) =>
concatBytes(Fp22.toBytes(c0), Fp22.toBytes(c1), Fp22.toBytes(c2)),
cmov: ({ c0, c1, c2 }, { c0: r0, c1: r1, c2: r2 }, c) => ({
c0: Fp22.cmov(c0, r0, c),
c1: Fp22.cmov(c1, r1, c),
c2: Fp22.cmov(c2, r2, c),
}),
// Utils
// fromTriple(triple: [Fp2, Fp2, Fp2]) {
// return new Fp6(...triple);
// }
// toString() {
// return `Fp6(${this.c0} + ${this.c1} * v, ${this.c2} * v^2)`;
// }
fromBigSix: (t) => {
if (!Array.isArray(t) || t.length !== 6)
throw new Error("Invalid Fp6 usage");
return {
c0: Fp22.fromBigTuple(t.slice(0, 2)),
c1: Fp22.fromBigTuple(t.slice(2, 4)),
c2: Fp22.fromBigTuple(t.slice(4, 6)),
};
},
frobeniusMap: ({ c0, c1, c2 }, power) => ({
c0: Fp22.frobeniusMap(c0, power),
c1: Fp22.mul(
Fp22.frobeniusMap(c1, power),
FP6_FROBENIUS_COEFFICIENTS_1[power % 6],
),
c2: Fp22.mul(
Fp22.frobeniusMap(c2, power),
FP6_FROBENIUS_COEFFICIENTS_2[power % 6],
),
}),
mulByNonresidue: ({ c0, c1, c2 }) => ({
c0: Fp22.mulByNonresidue(c2),
c1: c0,
c2: c1,
}),
// Sparse multiplication
multiplyBy1: ({ c0, c1, c2 }, b1) => ({
c0: Fp22.mulByNonresidue(Fp22.mul(c2, b1)),
c1: Fp22.mul(c0, b1),
c2: Fp22.mul(c1, b1),
}),
// Sparse multiplication
multiplyBy01({ c0, c1, c2 }, b0, b1) {
let t0 = Fp22.mul(c0, b0);
let t1 = Fp22.mul(c1, b1);
return {
// ((c1 + c2) * b1 - T1) * (u + 1) + T0
c0: Fp22.add(
Fp22.mulByNonresidue(Fp22.sub(Fp22.mul(Fp22.add(c1, c2), b1), t1)),
t0,
),
// (b0 + b1) * (c0 + c1) - T0 - T1
c1: Fp22.sub(
Fp22.sub(Fp22.mul(Fp22.add(b0, b1), Fp22.add(c0, c1)), t0),
t1,
),
// (c0 + c2) * b0 - T0 + T1
c2: Fp22.add(Fp22.sub(Fp22.mul(Fp22.add(c0, c2), b0), t0), t1),
};
},
multiplyByFp2: ({ c0, c1, c2 }, rhs) => ({
c0: Fp22.mul(c0, rhs),
c1: Fp22.mul(c1, rhs),
c2: Fp22.mul(c2, rhs),
}),
};
var FP6_FROBENIUS_COEFFICIENTS_1 = [
[BigInt("0x1"), BigInt("0x0")],
[
BigInt("0x0"),
BigInt(
"0x1a0111ea397fe699ec02408663d4de85aa0d857d89759ad4897d29650fb85f9b409427eb4f49fffd8bfd00000000aaac",
),
],
[
BigInt(
"0x00000000000000005f19672fdf76ce51ba69c6076a0f77eaddb3a93be6f89688de17d813620a00022e01fffffffefffe",
),
BigInt("0x0"),
],
[BigInt("0x0"), BigInt("0x1")],
[
BigInt(
"0x1a0111ea397fe699ec02408663d4de85aa0d857d89759ad4897d29650fb85f9b409427eb4f49fffd8bfd00000000aaac",
),
BigInt("0x0"),
],
[
BigInt("0x0"),
BigInt(
"0x00000000000000005f19672fdf76ce51ba69c6076a0f77eaddb3a93be6f89688de17d813620a00022e01fffffffefffe",
),
],
].map((pair) => Fp22.fromBigTuple(pair));
var FP6_FROBENIUS_COEFFICIENTS_2 = [
[BigInt("0x1"), BigInt("0x0")],
[
BigInt(
"0x1a0111ea397fe699ec02408663d4de85aa0d857d89759ad4897d29650fb85f9b409427eb4f49fffd8bfd00000000aaad",
),
BigInt("0x0"),
],
[
BigInt(
"0x1a0111ea397fe699ec02408663d4de85aa0d857d89759ad4897d29650fb85f9b409427eb4f49fffd8bfd00000000aaac",
),
BigInt("0x0"),
],
[
BigInt(
"0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaaa",
),
BigInt("0x0"),
],
[
BigInt(
"0x00000000000000005f19672fdf76ce51ba69c6076a0f77eaddb3a93be6f89688de17d813620a00022e01fffffffefffe",
),
BigInt("0x0"),
],
[
BigInt(
"0x00000000000000005f19672fdf76ce51ba69c6076a0f77eaddb3a93be6f89688de17d813620a00022e01fffffffeffff",
),
BigInt("0x0"),
],
].map((pair) => Fp22.fromBigTuple(pair));
var BLS_X = BigInt("0xd201000000010000");
var BLS_X_LEN = bitLen(BLS_X);
var Fp12Add = ({ c0, c1 }, { c0: r0, c1: r1 }) => ({
c0: Fp62.add(c0, r0),
c1: Fp62.add(c1, r1),
});
var Fp12Subtract = ({ c0, c1 }, { c0: r0, c1: r1 }) => ({
c0: Fp62.sub(c0, r0),
c1: Fp62.sub(c1, r1),
});
var Fp12Multiply = ({ c0, c1 }, rhs) => {
if (typeof rhs === "bigint")
return { c0: Fp62.mul(c0, rhs), c1: Fp62.mul(c1, rhs) };
let { c0: r0, c1: r1 } = rhs;
let t1 = Fp62.mul(c0, r0);
let t2 = Fp62.mul(c1, r1);
return {
c0: Fp62.add(t1, Fp62.mulByNonresidue(t2)),
// (c0 + c1) * (r0 + r1) - (T1 + T2)
c1: Fp62.sub(
Fp62.mul(Fp62.add(c0, c1), Fp62.add(r0, r1)),
Fp62.add(t1, t2),
),
};
};
var Fp12Square = ({ c0, c1 }) => {
let ab = Fp62.mul(c0, c1);
return {
// (c1 * v + c0) * (c0 + c1) - AB - AB * v
c0: Fp62.sub(
Fp62.sub(
Fp62.mul(Fp62.add(Fp62.mulByNonresidue(c1), c0), Fp62.add(c0, c1)),
ab,
),
Fp62.mulByNonresidue(ab),
),
c1: Fp62.add(ab, ab),
};
};
function Fp4Square(a, b) {
const a2 = Fp22.sqr(a);
const b2 = Fp22.sqr(b);
return {
first: Fp22.add(Fp22.mulByNonresidue(b2), a2),
second: Fp22.sub(Fp22.sub(Fp22.sqr(Fp22.add(a, b)), a2), b2),
// (a + b)² - a² - b²
};
}
var Fp12 = {
ORDER: Fp22.ORDER,
BITS: 2 * Fp22.BITS,
BYTES: 2 * Fp22.BYTES,
MASK: bitMask(2 * Fp22.BITS),
ZERO: { c0: Fp62.ZERO, c1: Fp62.ZERO },
ONE: { c0: Fp62.ONE, c1: Fp62.ZERO },
create: (num) => num,
isValid: ({ c0, c1 }) => Fp62.isValid(c0) && Fp62.isValid(c1),
is0: ({ c0, c1 }) => Fp62.is0(c0) && Fp62.is0(c1),
neg: ({ c0, c1 }) => ({ c0: Fp62.neg(c0), c1: Fp62.neg(c1) }),
eql: ({ c0, c1 }, { c0: r0, c1: r1 }) =>
Fp62.eql(c0, r0) && Fp62.eql(c1, r1),
sqrt: () => {
throw new Error("Not implemented");
},
inv: ({ c0, c1 }) => {
let t = Fp62.inv(
Fp62.sub(Fp62.sqr(c0), Fp62.mulByNonresidue(Fp62.sqr(c1))),
);
return { c0: Fp62.mul(c0, t), c1: Fp62.neg(Fp62.mul(c1, t)) };
},
div: (lhs, rhs) =>
Fp12.mul(
lhs,
typeof rhs === "bigint" ? Fp7.inv(Fp7.create(rhs)) : Fp12.inv(rhs),
),
pow: (num, power) => FpPow(Fp12, num, power),
invertBatch: (nums) => FpInvertBatch(Fp12, nums),
// Normalized
add: Fp12Add,
sub: Fp12Subtract,
mul: Fp12Multiply,
sqr: Fp12Square,
// NonNormalized stuff
addN: Fp12Add,
subN: Fp12Subtract,
mulN: Fp12Multiply,
sqrN: Fp12Square,
// Bytes utils
fromBytes: (b) => {
if (b.length !== Fp12.BYTES)
throw new Error(`fromBytes wrong length=${b.length}`);
return {
c0: Fp62.fromBytes(b.subarray(0, Fp62.BYTES)),
c1: Fp62.fromBytes(b.subarray(Fp62.BYTES)),
};
},
toBytes: ({ c0, c1 }) => concatBytes(Fp62.toBytes(c0), Fp62.toBytes(c1)),
cmov: ({ c0, c1 }, { c0: r0, c1: r1 }, c) => ({
c0: Fp62.cmov(c0, r0, c),
c1: Fp62.cmov(c1, r1, c),
}),
// Utils
// toString() {
// return `Fp12(${this.c0} + ${this.c1} * w)`;
// },
// fromTuple(c: [Fp6, Fp6]) {
// return new Fp12(...c);
// }
fromBigTwelve: (t) => ({
c0: Fp62.fromBigSix(t.slice(0, 6)),
c1: Fp62.fromBigSix(t.slice(6, 12)),
}),
// Raises to q**i -th power
frobeniusMap(lhs, power) {
const r0 = Fp62.frobeniusMap(lhs.c0, power);
const { c0, c1, c2 } = Fp62.frobeniusMap(lhs.c1, power);
const coeff = FP12_FROBENIUS_COEFFICIENTS[power % 12];
return {
c0: r0,
c1: Fp62.create({
c0: Fp22.mul(c0, coeff),
c1: Fp22.mul(c1, coeff),
c2: Fp22.mul(c2, coeff),
}),
};
},
// Sparse multiplication
multiplyBy014: ({ c0, c1 }, o0, o1, o4) => {
let t0 = Fp62.multiplyBy01(c0, o0, o1);
let t1 = Fp62.multiplyBy1(c1, o4);
return {
c0: Fp62.add(Fp62.mulByNonresidue(t1), t0),
// (c1 + c0) * [o0, o1+o4] - T0 - T1
c1: Fp62.sub(
Fp62.sub(
Fp62.multiplyBy01(Fp62.add(c1, c0), o0, Fp22.add(o1, o4)),
t0,
),
t1,
),
};
},
multiplyByFp2: ({ c0, c1 }, rhs) => ({
c0: Fp62.multiplyByFp2(c0, rhs),
c1: Fp62.multiplyByFp2(c1, rhs),
}),
conjugate: ({ c0, c1 }) => ({ c0, c1: Fp62.neg(c1) }),
// A cyclotomic group is a subgroup of Fp^n defined by
// GΦₙ(p) = {α ∈ Fpⁿ : α^Φₙ(p) = 1}
// The result of any pairing is in a cyclotomic subgroup
// https://eprint.iacr.org/2009/565.pdf
_cyclotomicSquare: ({ c0, c1 }) => {
const { c0: c0c0, c1: c0c1, c2: c0c2 } = c0;
const { c0: c1c0, c1: c1c1, c2: c1c2 } = c1;
const { first: t3, second: t4 } = Fp4Square(c0c0, c1c1);
const { first: t5, second: t6 } = Fp4Square(c1c0, c0c2);
const { first: t7, second: t8 } = Fp4Square(c0c1, c1c2);
let t9 = Fp22.mulByNonresidue(t8);
return {
c0: Fp62.create({
c0: Fp22.add(Fp22.mul(Fp22.sub(t3, c0c0), _2n10), t3),
c1: Fp22.add(Fp22.mul(Fp22.sub(t5, c0c1), _2n10), t5),
c2: Fp22.add(Fp22.mul(Fp22.sub(t7, c0c2), _2n10), t7),
}),
c1: Fp62.create({
c0: Fp22.add(Fp22.mul(Fp22.add(t9, c1c0), _2n10), t9),
c1: Fp22.add(Fp22.mul(Fp22.add(t4, c1c1), _2n10), t4),
c2: Fp22.add(Fp22.mul(Fp22.add(t6, c1c2), _2n10), t6),
}),
};
},
_cyclotomicExp(num, n) {
let z = Fp12.ONE;
for (let i = BLS_X_LEN - 1; i >= 0; i--) {
z = Fp12._cyclotomicSquare(z);
if (bitGet(n, i)) z = Fp12.mul(z, num);
}
return z;
},
// https://eprint.iacr.org/2010/354.pdf
// https://eprint.iacr.org/2009/565.pdf
finalExponentiate: (num) => {
const x = BLS_X;
const t0 = Fp12.div(Fp12.frobeniusMap(num, 6), num);
const t1 = Fp12.mul(Fp12.frobeniusMap(t0, 2), t0);
const t2 = Fp12.conjugate(Fp12._cyclotomicExp(t1, x));
const t3 = Fp12.mul(Fp12.conjugate(Fp12._cyclotomicSquare(t1)), t2);
const t4 = Fp12.conjugate(Fp12._cyclotomicExp(t3, x));
const t5 = Fp12.conjugate(Fp12._cyclotomicExp(t4, x));
const t6 = Fp12.mul(
Fp12.conjugate(Fp12._cyclotomicExp(t5, x)),
Fp12._cyclotomicSquare(t2),
);
const t7 = Fp12.conjugate(Fp12._cyclotomicExp(t6, x));
const t2_t5_pow_q2 = Fp12.frobeniusMap(Fp12.mul(t2, t5), 2);
const t4_t1_pow_q3 = Fp12.frobeniusMap(Fp12.mul(t4, t1), 3);
const t6_t1c_pow_q1 = Fp12.frobeniusMap(
Fp12.mul(t6, Fp12.conjugate(t1)),
1,
);
const t7_t3c_t1 = Fp12.mul(Fp12.mul(t7, Fp12.conjugate(t3)), t1);
return Fp12.mul(
Fp12.mul(Fp12.mul(t2_t5_pow_q2, t4_t1_pow_q3), t6_t1c_pow_q1),
t7_t3c_t1,
);
},
};
var FP12_FROBENIUS_COEFFICIENTS = [
[BigInt("0x1"), BigInt("0x0")],
[
BigInt(
"0x1904d3bf02bb0667c231beb4202c0d1f0fd603fd3cbd5f4f7b2443d784bab9c4f67ea53d63e7813d8d0775ed92235fb8",
),
BigInt(
"0x00fc3e2b36c4e03288e9e902231f9fb854a14787b6c7b36fec0c8ec971f63c5f282d5ac14d6c7ec22cf78a126ddc4af3",
),
],
[
BigInt(
"0x00000000000000005f19672fdf76ce51ba69c6076a0f77eaddb3a93be6f89688de17d813620a00022e01fffffffeffff",
),
BigInt("0x0"),
],
[
BigInt(
"0x135203e60180a68ee2e9c448d77a2cd91c3dedd930b1cf60ef396489f61eb45e304466cf3e67fa0af1ee7b04121bdea2",
),
BigInt(
"0x06af0e0437ff400b6831e36d6bd17ffe48395dabc2d3435e77f76e17009241c5ee67992f72ec05f4c81084fbede3cc09",
),
],
[
BigInt(
"0x00000000000000005f19672fdf76ce51ba69c6076a0f77eaddb3a93be6f89688de17d813620a00022e01fffffffefffe",
),
BigInt("0x0"),
],
[
BigInt(
"0x144e4211384586c16bd3ad4afa99cc9170df3560e77982d0db45f3536814f0bd5871c1908bd478cd1ee605167ff82995",
),
BigInt(
"0x05b2cfd9013a5fd8df47fa6b48b1e045f39816240c0b8fee8beadf4d8e9c0566c63a3e6e257f87329b18fae980078116",
),
],
[
BigInt(
"0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaaa",
),
BigInt("0x0"),
],
[
BigInt(
"0x00fc3e2b36c4e03288e9e902231f9fb854a14787b6c7b36fec0c8ec971f63c5f282d5ac14d6c7ec22cf78a126ddc4af3",
),
BigInt(
"0x1904d3bf02bb0667c231beb4202c0d1f0fd603fd3cbd5f4f7b2443d784bab9c4f67ea53d63e7813d8d0775ed92235fb8",
),
],
[
BigInt(
"0x1a0111ea397fe699ec02408663d4de85aa0d857d89759ad4897d29650fb85f9b409427eb4f49fffd8bfd00000000aaac",
),
BigInt("0x0"),
],
[
BigInt(
"0x06af0e0437ff400b6831e36d6bd17ffe48395dabc2d3435e77f76e17009241c5ee67992f72ec05f4c81084fbede3cc09",
),
BigInt(
"0x135203e60180a68ee2e9c448d77a2cd91c3dedd930b1cf60ef396489f61eb45e304466cf3e67fa0af1ee7b04121bdea2",
),
],
[
BigInt(
"0x1a0111ea397fe699ec02408663d4de85aa0d857d89759ad4897d29650fb85f9b409427eb4f49fffd8bfd00000000aaad",
),
BigInt("0x0"),
],
[
BigInt(
"0x05b2cfd9013a5fd8df47fa6b48b1e045f39816240c0b8fee8beadf4d8e9c0566c63a3e6e257f87329b18fae980078116",
),
BigInt(
"0x144e4211384586c16bd3ad4afa99cc9170df3560e77982d0db45f3536814f0bd5871c1908bd478cd1ee605167ff82995",
),
],
].map((n) => Fp22.fromBigTuple(n));
var isogenyMapG2 = isogenyMap(
Fp22,
[
// xNum
[
[
"0x5c759507e8e333ebb5b7a9a47d7ed8532c52d39fd3a042a88b58423c50ae15d5c2638e343d9c71c6238aaaaaaaa97d6",
"0x5c759507e8e333ebb5b7a9a47d7ed8532c52d39fd3a042a88b58423c50ae15d5c2638e343d9c71c6238aaaaaaaa97d6",
],
[
"0x0",
"0x11560bf17baa99bc32126fced787c88f984f87adf7ae0c7f9a208c6b4f20a4181472aaa9cb8d555526a9ffffffffc71a",
],
[
"0x11560bf17baa99bc32126fced787c88f984f87adf7ae0c7f9a208c6b4f20a4181472aaa9cb8d555526a9ffffffffc71e",
"0x8ab05f8bdd54cde190937e76bc3e447cc27c3d6fbd7063fcd104635a790520c0a395554e5c6aaaa9354ffffffffe38d",
],
[
"0x171d6541fa38ccfaed6dea691f5fb614cb14b4e7f4e810aa22d6108f142b85757098e38d0f671c7188e2aaaaaaaa5ed1",
"0x0",
],
],
// xDen
[
[
"0x0",
"0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaa63",
],
[
"0xc",
"0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaa9f",
],
["0x1", "0x0"],
// LAST 1
],
// yNum
[
[
"0x1530477c7ab4113b59a4c18b076d11930f7da5d4a07f649bf54439d87d27e500fc8c25ebf8c92f6812cfc71c71c6d706",
"0x1530477c7ab4113b59a4c18b076d11930f7da5d4a07f649bf54439d87d27e500fc8c25ebf8c92f6812cfc71c71c6d706",
],
[
"0x0",
"0x5c759507e8e333ebb5b7a9a47d7ed8532c52d39fd3a042a88b58423c50ae15d5c2638e343d9c71c6238aaaaaaaa97be",
],
[
"0x11560bf17baa99bc32126fced787c88f984f87adf7ae0c7f9a208c6b4f20a4181472aaa9cb8d555526a9ffffffffc71c",
"0x8ab05f8bdd54cde190937e76bc3e447cc27c3d6fbd7063fcd104635a790520c0a395554e5c6aaaa9354ffffffffe38f",
],
[
"0x124c9ad43b6cf79bfbf7043de3811ad0761b0f37a1e26286b0e977c69aa274524e79097a56dc4bd9e1b371c71c718b10",
"0x0",
],
],
// yDen
[
[
"0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffa8fb",
"0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffa8fb",
],
[
"0x0",
"0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffa9d3",
],
[
"0x12",
"0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaa99",
],
["0x1", "0x0"],
// LAST 1
],
].map((i) => i.map((pair) => Fp22.fromBigTuple(pair.map(BigInt)))),
);
var isogenyMapG1 = isogenyMap(
Fp7,
[
// xNum
[
"0x11a05f2b1e833340b809101dd99815856b303e88a2d7005ff2627b56cdb4e2c85610c2d5f2e62d6eaeac1662734649b7",
"0x17294ed3e943ab2f0588bab22147a81c7c17e75b2f6a8417f565e33c70d1e86b4838f2a6f318c356e834eef1b3cb83bb",
"0xd54005db97678ec1d1048c5d10a9a1bce032473295983e56878e501ec68e25c958c3e3d2a09729fe0179f9dac9edcb0",
"0x1778e7166fcc6db74e0609d307e55412d7f5e4656a8dbf25f1b33289f1b330835336e25ce3107193c5b388641d9b6861",
"0xe99726a3199f4436642b4b3e4118e5499db995a1257fb3f086eeb65982fac18985a286f301e77c451154ce9ac8895d9",
"0x1630c3250d7313ff01d1201bf7a74ab5db3cb17dd952799b9ed3ab9097e68f90a0870d2dcae73d19cd13c1c66f652983",
"0xd6ed6553fe44d296a3726c38ae652bfb11586264f0f8ce19008e218f9c86b2a8da25128c1052ecaddd7f225a139ed84",
"0x17b81e7701abdbe2e8743884d1117e53356de5ab275b4db1a682c62ef0f2753339b7c8f8c8f475af9ccb5618e3f0c88e",
"0x80d3cf1f9a78fc47b90b33563be990dc43b756ce79f5574a2c596c928c5d1de4fa295f296b74e956d71986a8497e317",
"0x169b1f8e1bcfa7c42e0c37515d138f22dd2ecb803a0c5c99676314baf4bb1b7fa3190b2edc0327797f241067be390c9e",
"0x10321da079ce07e272d8ec09d2565b0dfa7dccdde6787f96d50af36003b14866f69b771f8c285decca67df3f1605fb7b",
"0x6e08c248e260e70bd1e962381edee3d31d79d7e22c837bc23c0bf1bc24c6b68c24b1b80b64d391fa9c8ba2e8ba2d229",
],
// xDen
[
"0x8ca8d548cff19ae18b2e62f4bd3fa6f01d5ef4ba35b48ba9c9588617fc8ac62b558d681be343df8993cf9fa40d21b1c",
"0x12561a5deb559c4348b4711298e536367041e8ca0cf0800c0126c2588c48bf5713daa8846cb026e9e5c8276ec82b3bff",
"0xb2962fe57a3225e8137e629bff2991f6f89416f5a718cd1fca64e00b11aceacd6a3d0967c94fedcfcc239ba5cb83e19",
"0x3425581a58ae2fec83aafef7c40eb545b08243f16b1655154cca8abc28d6fd04976d5243eecf5c4130de8938dc62cd8",
"0x13a8e162022914a80a6f1d5f43e7a07dffdfc759a12062bb8d6b44e833b306da9bd29ba81f35781d539d395b3532a21e",
"0xe7355f8e4e667b955390f7f0506c6e9395735e9ce9cad4d0a43bcef24b8982f7400d24bc4228f11c02df9a29f6304a5",
"0x772caacf16936190f3e0c63e0596721570f5799af53a1894e2e073062aede9cea73b3538f0de06cec2574496ee84a3a",
"0x14a7ac2a9d64a8b230b3f5b074cf01996e7f63c21bca68a81996e1cdf9822c580fa5b9489d11e2d311f7d99bbdcc5a5e",
"0xa10ecf6ada54f825e920b3dafc7a3cce07f8d1d7161366b74100da67f39883503826692abba43704776ec3a79a1d641",
"0x95fc13ab9e92ad4476d6e3eb3a56680f682b4ee96f7d03776df533978f31c1593174e4b4b7865002d6384d168ecdd0a",
"0x000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001",
// LAST 1
],
// yNum
[
"0x90d97c81ba24ee0259d1f094980dcfa11ad138e48a869522b52af6c956543d3cd0c7aee9b3ba3c2be9845719707bb33",
"0x134996a104ee5811d51036d776fb46831223e96c254f383d0f906343eb67ad34d6c56711962fa8bfe097e75a2e41c696",
"0xcc786baa966e66f4a384c86a3b49942552e2d658a31ce2c344be4b91400da7d26d521628b00523b8dfe240c72de1f6",
"0x1f86376e8981c217898751ad8746757d42aa7b90eeb791c09e4a3ec03251cf9de405aba9ec61deca6355c77b0e5f4cb",
"0x8cc03fdefe0ff135caf4fe2a21529c4195536fbe3ce50b879833fd221351adc2ee7f8dc099040a841b6daecf2e8fedb",
"0x16603fca40634b6a2211e11db8f0a6a074a7d0d4afadb7bd76505c3d3ad5544e203f6326c95a807299b23ab13633a5f0",
"0x4ab0b9bcfac1bbcb2c977d027796b3ce75bb8ca2be184cb5231413c4d634f3747a87ac2460f415ec961f8855fe9d6f2",
"0x987c8d5333ab86fde9926bd2ca6c674170a05bfe3bdd81ffd038da6c26c842642f64550fedfe935a15e4ca31870fb29",
"0x9fc4018bd96684be88c9e221e4da1bb8f3abd16679dc26c1e8b6e6a1f20cabe69d65201c78607a360370e577bdba587",
"0xe1bba7a1186bdb5223abde7ada14a23c42a0ca7915af6fe06985e7ed1e4d43b9b3f7055dd4eba6f2bafaaebca731c30",
"0x19713e47937cd1be0dfd0b8f1d43fb93cd2fcbcb6caf493fd1183e416389e61031bf3a5cce3fbafce813711ad011c132",
"0x18b46a908f36f6deb918c143fed2edcc523559b8aaf0c2462e6bfe7f911f643249d9cdf41b44d606ce07c8a4d0074d8e",
"0xb182cac101b9399d155096004f53f447aa7b12a3426b08ec02710e807b4633f06c851c1919211f20d4c04f00b971ef8",
"0x245a394ad1eca9b72fc00ae7be315dc757b3b080d4c158013e6632d3c40659cc6cf90ad1c232a6442d9d3f5db980133",
"0x5c129645e44cf1102a159f748c4a3fc5e673d81d7e86568d9ab0f5d396a7ce46ba1049b6579afb7866b1e715475224b",
"0x15e6be4e990f03ce4ea50b3b42df2eb5cb181d8f84965a3957add4fa95af01b2b665027efec01c7704b456be69c8b604",
],
// yDen
[
"0x16112c4c3a9c98b252181140fad0eae9601a6de578980be6eec3232b5be72e7a07f3688ef60c206d01479253b03663c1",
"0x1962d75c2381201e1a0cbd6c43c348b885c84ff731c4d59ca4a10356f453e01f78a4260763529e3532f6102c2e49a03d",
"0x58df3306640da276faaae7d6e8eb15778c4855551ae7f310c35a5dd279cd2eca6757cd636f96f891e2538b53dbf67f2",
"0x16b7d288798e5395f20d23bf89edb4d1d115c5dbddbcd30e123da489e726af41727364f2c28297ada8d26d98445f5416",
"0xbe0e079545f43e4b00cc912f8228ddcc6d19c9f0f69bbb0542eda0fc9dec916a20b15dc0fd2ededda39142311a5001d",
"0x8d9e5297186db2d9fb266eaac783182b70152c65550d881c5ecd87b6f0f5a6449f38db9dfa9cce202c6477faaf9b7ac",
"0x166007c08a99db2fc3ba8734ace9824b5eecfdfa8d0cf8ef5dd365bc400a0051d5fa9c01a58b1fb93d1a1399126a775c",
"0x16a3ef08be3ea7ea03bcddfabba6ff6ee5a4375efa1f4fd7feb34fd206357132b920f5b00801dee460ee415a15812ed9",
"0x1866c8ed336c61231a1be54fd1d74cc4f9fb0ce4c6af5920abc5750c4bf39b4852cfe2f7bb9248836b233d9d55535d4a",
"0x167a55cda70a6e1cea820597d94a84903216f763e13d87bb5308592e7ea7d4fbc7385ea3d529b35e346ef48bb8913f55",
"0x4d2f259eea405bd48f010a01ad2911d9c6dd039bb61a6290e591b36e636a5c871a5c29f4f83060400f8b49cba8f6aa8",
"0xaccbb67481d033ff5852c1e48c50c477f94ff8aefce42d28c0f9a88cea7913516f968986f7ebbea9684b529e2561092",
"0xad6b9514c767fe3c3613144b45f1496543346d98adf02267d5ceef9a00d9b8693000763e3b90ac11e99b138573345cc",
"0x2660400eb2e4f3b628bdd0d53cd76f2bf565b94e72927c1cb748df27942480e420517bd8714cc80d1fadc1326ed06f7",
"0xe0fa1d816ddc03e6b24255e0d7819c171c40f65e273b853324efcd6356caa205ca2f570f13497804415473a1d634b8f",
"0x000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001",
// LAST 1
],
].map((i) => i.map((j) => BigInt(j))),
);
var G2_SWU = mapToCurveSimpleSWU(Fp22, {
A: Fp22.create({ c0: Fp7.create(_0n10), c1: Fp7.create(BigInt(240)) }),
B: Fp22.create({
c0: Fp7.create(BigInt(1012)),
c1: Fp7.create(BigInt(1012)),
}),
Z: Fp22.create({ c0: Fp7.create(BigInt(-2)), c1: Fp7.create(BigInt(-1)) }),
// Z: -(2 + I)
});
var G1_SWU = mapToCurveSimpleSWU(Fp7, {
A: Fp7.create(
BigInt(
"0x144698a3b8e9433d693a02c96d4982b0ea985383ee66a8d8e8981aefd881ac98936f8da0e0f97f5cf428082d584c1d",
),
),
B: Fp7.create(
BigInt(
"0x12e2908d11688030018b12e8753eee3b2016c1f0f24f4070a0b9c14fcef35ef55a23215a316ceaa5d1cc48e98e172be0",
),
),
Z: Fp7.create(BigInt(11)),
});
var ut_root = Fp62.create({ c0: Fp22.ZERO, c1: Fp22.ONE, c2: Fp22.ZERO });
var wsq = Fp12.create({ c0: ut_root, c1: Fp62.ZERO });
var wcu = Fp12.create({ c0: Fp62.ZERO, c1: ut_root });
var [wsq_inv, wcu_inv] = Fp12.invertBatch([wsq, wcu]);
function psi(x, y) {
const x2 = Fp12.mul(
Fp12.frobeniusMap(Fp12.multiplyByFp2(wsq_inv, x), 1),
wsq,
).c0.c0;
const y2 = Fp12.mul(
Fp12.frobeniusMap(Fp12.multiplyByFp2(wcu_inv, y), 1),
wcu,
).c0.c0;
return [x2, y2];
}
function G2psi(c, P3) {
const affine = P3.toAffine();
const p = psi(affine.x, affine.y);
return new c(p[0], p[1], Fp22.ONE);
}
var PSI2_C1 = BigInt(
"0x1a0111ea397fe699ec02408663d4de85aa0d857d89759ad4897d29650fb85f9b409427eb4f49fffd8bfd00000000aaac",
);
function psi2(x, y) {
return [Fp22.mul(x, PSI2_C1), Fp22.neg(y)];
}
function G2psi2(c, P3) {
const affine = P3.toAffine();
const p = psi2(affine.x, affine.y);
return new c(p[0], p[1], Fp22.ONE);
}
var htfDefaults = Object.freeze({
// DST: a domain separation tag
// defined in section 2.2.5
// Use utils.getDSTLabel(), utils.setDSTLabel(value)
DST: "BLS_SIG_BLS12381G2_XMD:SHA-256_SSWU_RO_NUL_",
encodeDST: "BLS_SIG_BLS12381G2_XMD:SHA-256_SSWU_RO_NUL_",
// p: the characteristic of F
// where F is a finite field of characteristic p and order q = p^m
p: Fp7.ORDER,
// m: the extension degree of F, m >= 1
// where F is a finite field of characteristic p and order q = p^m
m: 2,
// k: the target security level for the suite in bits
// defined in section 5.1
k: 128,
// option to use a message that has already been processed by
// expand_message_xmd
expand: "xmd",
// Hash functions for: expand_message_xmd is appropriate for use with a
// wide range of hash functions, including SHA-2, SHA-3, BLAKE2, and others.
// BBS+ uses blake2: https://github.com/hyperledger/aries-framework-go/issues/2247
hash: sha256,
});
var C_BIT_POS = Fp7.BITS;
var I_BIT_POS = Fp7.BITS + 1;
var S_BIT_POS = Fp7.BITS + 2;
var COMPRESSED_ZERO = Fp7.toBytes(
bitSet(bitSet(_0n10, I_BIT_POS, true), S_BIT_POS, true),
);
function signatureG2ToRawBytes(point) {
point.assertValidity();
const len = Fp7.BYTES;
if (point.equals(bls12_381.G2.ProjectivePoint.ZERO))
return concatBytes(COMPRESSED_ZERO, numberToBytesBE(_0n10, len));
const { x, y } = point.toAffine();
const { re: x0, im: x1 } = Fp22.reim(x);
const { re: y0, im: y1 } = Fp22.reim(y);
const tmp = y1 > _0n10 ? y1 * _2n10 : y0 * _2n10;
const aflag1 = Boolean((tmp / Fp7.ORDER) & _1n11);
const z1 = bitSet(bitSet(x1, 381, aflag1), S_BIT_POS, true);
const z2 = x0;
return concatBytes(numberToBytesBE(z1, len), numberToBytesBE(z2, len));
}
var bls12_381 = bls({
// Fields
fields: {
Fp: Fp7,
Fp2: Fp22,
Fp6: Fp62,
Fp12,
Fr,
},
// G1 is the order-q subgroup of E1(Fp) : y² = x³ + 4, #E1(Fp) = h1q, where
// characteristic; z + (z⁴ - z² + 1)(z - 1)²/3
G1: {
Fp: Fp7,
// cofactor; (z - 1)²/3
h: BigInt("0x396c8c005555e1568c00aaab0000aaab"),
// generator's coordinates
// x = 3685416753713387016781088315183077757961620795782546409894578378688607592378376318836054947676345821548104185464507
// y = 1339506544944476473020471379941921221584933875938349620426543736416511423956333506472724655353366534992391756441569
Gx: BigInt(
"0x17f1d3a73197d7942695638c4fa9ac0fc3688c4f9774b905a14e3a3f171bac586c55e83ff97a1aeffb3af00adb22c6bb",
),
Gy: BigInt(
"0x08b3f481e3aaa0f1a09e30ed741d8ae4fcf5e095d5d00af600db18cb2c04b3edd03cc744a2888ae40caa232946c5e7e1",
),
a: Fp7.ZERO,
b: _4n4,
htfDefaults: { ...htfDefaults, m: 1 },
wrapPrivateKey: true,
allowInfinityPoint: true,
// Checks is the point resides in prime-order subgroup.
// point.isTorsionFree() should return true for valid points
// It returns false for shitty points.
// https://eprint.iacr.org/2021/1130.pdf
isTorsionFree: (c, point) => {
const cubicRootOfUnityModP = BigInt(
"0x5f19672fdf76ce51ba69c6076a0f77eaddb3a93be6f89688de17d813620a00022e01fffffffefffe",
);
const phi = new c(
Fp7.mul(point.px, cubicRootOfUnityModP),
point.py,
point.pz,
);
const xP = point.multiplyUnsafe(bls12_381.params.x).negate();
const u2P = xP.multiplyUnsafe(bls12_381.params.x);
return u2P.equals(phi);
},
// Clear cofactor of G1
// https://eprint.iacr.org/2019/403
clearCofactor: (_c, point) => {
return point.multiplyUnsafe(bls12_381.params.x).add(point);
},
mapToCurve: (scalars) => {
const { x, y } = G1_SWU(Fp7.create(scalars[0]));
return isogenyMapG1(x, y);
},
fromBytes: (bytes2) => {
bytes2 = bytes2.slice();
if (bytes2.length === 48) {
const P3 = Fp7.ORDER;
const compressedValue = bytesToNumberBE(bytes2);
const bflag = bitGet(compressedValue, I_BIT_POS);
if (bflag === _1n11) return { x: _0n10, y: _0n10 };
const x = Fp7.create(compressedValue & Fp7.MASK);
const right = Fp7.add(
Fp7.pow(x, _3n5),
Fp7.create(bls12_381.params.G1b),
);
let y = Fp7.sqrt(right);
if (!y) throw new Error("Invalid compressed G1 point");
const aflag = bitGet(compressedValue, C_BIT_POS);
if ((y * _2n10) / P3 !== aflag) y = Fp7.neg(y);
return { x: Fp7.create(x), y: Fp7.create(y) };
} else if (bytes2.length === 96) {
if ((bytes2[0] & (1 << 6)) !== 0)
return bls12_381.G1.ProjectivePoint.ZERO.toAffine();
const x = bytesToNumberBE(bytes2.subarray(0, Fp7.BYTES));
const y = bytesToNumberBE(bytes2.subarray(Fp7.BYTES));
return { x: Fp7.create(x), y: Fp7.create(y) };
} else {
throw new Error("Invalid point G1, expected 48/96 bytes");
}
},
toBytes: (c, point, isCompressed) => {
const isZero = point.equals(c.ZERO);
const { x, y } = point.toAffine();
if (isCompressed) {
if (isZero) return COMPRESSED_ZERO.slice();
const P3 = Fp7.ORDER;
let num;
num = bitSet(x, C_BIT_POS, Boolean((y * _2n10) / P3));
num = bitSet(num, S_BIT_POS, true);
return numberToBytesBE(num, Fp7.BYTES);
} else {
if (isZero) {
const x2 = concatBytes(
new Uint8Array([64]),
new Uint8Array(2 * Fp7.BYTES - 1),
);
return x2;
} else {
return concatBytes(
numberToBytesBE(x, Fp7.BYTES),
numberToBytesBE(y, Fp7.BYTES),
);
}
}
},
},
// G2 is the order-q subgroup of E2(Fp²) : y² = x³+4(1+√−1),
// where Fp2 is Fp[√−1]/(x2+1). #E2(Fp2 ) = h2q, where
// G² - 1
// h2q
G2: {
Fp: Fp22,
// cofactor
h: BigInt(
"0x5d543a95414e7f1091d50792876a202cd91de4547085abaa68a205b2e5a7ddfa628f1cb4d9e82ef21537e293a6691ae1616ec6e786f0c70cf1c38e31c7238e5",
),
Gx: Fp22.fromBigTuple([
BigInt(
"0x024aa2b2f08f0a91260805272dc51051c6e47ad4fa403b02b4510b647ae3d1770bac0326a805bbefd48056c8c121bdb8",
),
BigInt(
"0x13e02b6052719f607dacd3a088274f65596bd0d09920b61ab5da61bbdc7f5049334cf11213945d57e5ac7d055d042b7e",
),
]),
// y =
// 927553665492332455747201965776037880757740193453592970025027978793976877002675564980949289727957565575433344219582,
// 1985150602287291935568054521177171638300868978215655730859378665066344726373823718423869104263333984641494340347905
Gy: Fp22.fromBigTuple([
BigInt(
"0x0ce5d527727d6e118cc9cdc6da2e351aadfd9baa8cbdd3a76d429a695160d12c923ac9cc3baca289e193548608b82801",
),
BigInt(
"0x0606c4a02ea734cc32acd2b02bc28b99cb3e287e85a763af267492ab572e99ab3f370d275cec1da1aaa9075ff05f79be",
),
]),
a: Fp22.ZERO,
b: Fp22.fromBigTuple([_4n4, _4n4]),
hEff: BigInt(
"0xbc69f08f2ee75b3584c6a0ea91b352888e2a8e9145ad7689986ff031508ffe1329c2f178731db956d82bf015d1212b02ec0ec69d7477c1ae954cbc06689f6a359894c0adebbf6b4e8020005aaa95551",
),
htfDefaults: { ...htfDefaults },
wrapPrivateKey: true,
allowInfinityPoint: true,
mapToCurve: (scalars) => {
const { x, y } = G2_SWU(Fp22.fromBigTuple(scalars));
return isogenyMapG2(x, y);
},
// Checks is the point resides in prime-order subgroup.
// point.isTorsionFree() should return true for valid points
// It returns false for shitty points.
// https://eprint.iacr.org/2021/1130.pdf
isTorsionFree: (c, P3) => {
return P3.multiplyUnsafe(bls12_381.params.x)
.negate()
.equals(G2psi(c, P3));
},
// Maps the point into the prime-order subgroup G2.
// clear_cofactor_bls12381_g2 from cfrg-hash-to-curve-11
// https://eprint.iacr.org/2017/419.pdf
// prettier-ignore
clearCofactor: (c, P3) => {
const x = bls12_381.params.x;
let t1 = P3.multiplyUnsafe(x).negate();
let t2 = G2psi(c, P3);
let t3 = P3.double();
t3 = G2psi2(c, t3);
t3 = t3.subtract(t2);
t2 = t1.add(t2);
t2 = t2.multiplyUnsafe(x).negate();
t3 = t3.add(t2);
t3 = t3.subtract(t1);
const Q = t3.subtract(P3);
return Q;
},
fromBytes: (bytes2) => {
bytes2 = bytes2.slice();
const m_byte = bytes2[0] & 224;
if (m_byte === 32 || m_byte === 96 || m_byte === 224) {
throw new Error("Invalid encoding flag: " + m_byte);
}
const bitC = m_byte & 128;
const bitI = m_byte & 64;
const bitS = m_byte & 32;
const L = Fp7.BYTES;
const slc = (b, from, to) => bytesToNumberBE(b.slice(from, to));
if (bytes2.length === 96 && bitC) {
const b = bls12_381.params.G2b;
const P3 = Fp7.ORDER;
bytes2[0] = bytes2[0] & 31;
if (bitI) {
if (bytes2.reduce((p, c) => (p !== 0 ? c + 1 : c), 0) > 0) {
throw new Error("Invalid compressed G2 point");
}
return { x: Fp22.ZERO, y: Fp22.ZERO };
}
const x_1 = slc(bytes2, 0, L);
const x_0 = slc(bytes2, L, 2 * L);
const x = Fp22.create({ c0: Fp7.create(x_0), c1: Fp7.create(x_1) });
const right = Fp22.add(Fp22.pow(x, _3n5), b);
let y = Fp22.sqrt(right);
const Y_bit =
y.c1 === _0n10
? (y.c0 * _2n10) / P3
: (y.c1 * _2n10) / P3
? _1n11
: _0n10;
y = bitS > 0 && Y_bit > 0 ? y : Fp22.neg(y);
return { x, y };
} else if (bytes2.length === 192 && !bitC) {
if ((bytes2[0] & (1 << 6)) !== 0) {
return { x: Fp22.ZERO, y: Fp22.ZERO };
}
const x1 = slc(bytes2, 0, L);
const x0 = slc(bytes2, L, 2 * L);
const y1 = slc(bytes2, 2 * L, 3 * L);
const y0 = slc(bytes2, 3 * L, 4 * L);
return {
x: Fp22.fromBigTuple([x0, x1]),
y: Fp22.fromBigTuple([y0, y1]),
};
} else {
throw new Error("Invalid point G2, expected 96/192 bytes");
}
},
toBytes: (c, point, isCompressed) => {
const { BYTES: len, ORDER: P3 } = Fp7;
const isZero = point.equals(c.ZERO);
const { x, y } = point.toAffine();
if (isCompressed) {
if (isZero)
return concatBytes(COMPRESSED_ZERO, numberToBytesBE(_0n10, len));
const flag = Boolean(
y.c1 === _0n10 ? (y.c0 * _2n10) / P3 : (y.c1 * _2n10) / P3,
);
let x_1 = bitSet(x.c1, C_BIT_POS, flag);
x_1 = bitSet(x_1, S_BIT_POS, true);
return concatBytes(
numberToBytesBE(x_1, len),
numberToBytesBE(x.c0, len),
);
} else {
if (isZero)
return concatBytes(
new Uint8Array([64]),
new Uint8Array(4 * len - 1),
);
const { re: x0, im: x1 } = Fp22.reim(x);
const { re: y0, im: y1 } = Fp22.reim(y);
return concatBytes(
numberToBytesBE(x1, len),
numberToBytesBE(x0, len),
numberToBytesBE(y1, len),
numberToBytesBE(y0, len),
);
}
},
Signature: {
// TODO: Optimize, it's very slow because of sqrt.
fromHex(hex) {
hex = ensureBytes("signatureHex", hex);
const P3 = Fp7.ORDER;
const half = hex.length / 2;
if (half !== 48 && half !== 96)
throw new Error(
"Invalid compressed signature length, must be 96 or 192",
);
const z1 = bytesToNumberBE(hex.slice(0, half));
const z2 = bytesToNumberBE(hex.slice(half));
const bflag1 = bitGet(z1, I_BIT_POS);
if (bflag1 === _1n11) return bls12_381.G2.ProjectivePoint.ZERO;
const x1 = Fp7.create(z1 & Fp7.MASK);
const x2 = Fp7.create(z2);
const x = Fp22.create({ c0: x2, c1: x1 });
const y2 = Fp22.add(Fp22.pow(x, _3n5), bls12_381.params.G2b);
let y = Fp22.sqrt(y2);
if (!y) throw new Error("Failed to find a square root");
const { re: y0, im: y1 } = Fp22.reim(y);
const aflag1 = bitGet(z1, 381);
const isGreater = y1 > _0n10 && (y1 * _2n10) / P3 !== aflag1;
const isZero = y1 === _0n10 && (y0 * _2n10) / P3 !== aflag1;
if (isGreater || isZero) y = Fp22.neg(y);
const point = bls12_381.G2.ProjectivePoint.fromAffine({ x, y });
point.assertValidity();
return point;
},
toRawBytes(point) {
return signatureG2ToRawBytes(point);
},
toHex(point) {
return bytesToHex(signatureG2ToRawBytes(point));
},
},
},
params: {
x: BLS_X,
r: Fr.ORDER,
// order; z⁴ − z² + 1; CURVE.n from other curves
},
htfDefaults,
hash: sha256,
randomBytes,
});
// input.js
var utils = { bytesToHex, concatBytes, hexToBytes };
return __toCommonJS(input_exports);
})();
/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
/*! Bundled license information:
@noble/hashes/esm/utils.js:
(*! noble-hashes - MIT License (c) 2022 Paul Miller (paulmillr.com) *)
*/