2023-02-13 05:21:11 +03:00
|
|
|
/**
|
|
|
|
* Add details about signing here.
|
|
|
|
*
|
|
|
|
* @_subsection: api/crypto:Signing [about-signing]
|
|
|
|
*/
|
2022-09-05 23:14:43 +03:00
|
|
|
|
2024-04-19 06:05:00 +03:00
|
|
|
import { secp256k1 } from "@tornado/noble-curves/secp256k1";
|
2022-09-05 23:14:43 +03:00
|
|
|
|
2024-04-19 06:05:00 +03:00
|
|
|
import { concat, dataLength, getBytes, getBytesCopy, hexlify, toBeHex, assertArgument } from "../utils/index.js";
|
2022-09-05 23:14:43 +03:00
|
|
|
|
|
|
|
import { Signature } from "./signature.js";
|
|
|
|
|
2022-11-28 05:53:06 +03:00
|
|
|
import type { BytesLike } from "../utils/index.js";
|
2022-09-05 23:14:43 +03:00
|
|
|
|
|
|
|
import type { SignatureLike } from "./index.js";
|
|
|
|
|
2022-12-03 05:23:13 +03:00
|
|
|
/**
|
|
|
|
* A **SigningKey** provides high-level access to the elliptic curve
|
|
|
|
* cryptography (ECC) operations and key management.
|
|
|
|
*/
|
2022-09-05 23:14:43 +03:00
|
|
|
export class SigningKey {
|
|
|
|
#privateKey: string;
|
|
|
|
|
2022-12-03 05:23:13 +03:00
|
|
|
/**
|
|
|
|
* Creates a new **SigningKey** for %%privateKey%%.
|
|
|
|
*/
|
2022-09-05 23:14:43 +03:00
|
|
|
constructor(privateKey: BytesLike) {
|
2022-11-28 05:53:06 +03:00
|
|
|
assertArgument(dataLength(privateKey) === 32, "invalid private key", "privateKey", "[REDACTED]");
|
2022-09-05 23:14:43 +03:00
|
|
|
this.#privateKey = hexlify(privateKey);
|
|
|
|
}
|
|
|
|
|
2022-12-03 05:23:13 +03:00
|
|
|
/**
|
|
|
|
* The private key.
|
|
|
|
*/
|
2024-04-19 06:05:00 +03:00
|
|
|
get privateKey(): string {
|
|
|
|
return this.#privateKey;
|
|
|
|
}
|
2022-12-03 05:23:13 +03:00
|
|
|
|
|
|
|
/**
|
|
|
|
* The uncompressed public key.
|
|
|
|
*
|
|
|
|
* This will always begin with the prefix ``0x04`` and be 132
|
|
|
|
* characters long (the ``0x`` prefix and 130 hexadecimal nibbles).
|
|
|
|
*/
|
2024-04-19 06:05:00 +03:00
|
|
|
get publicKey(): string {
|
|
|
|
return SigningKey.computePublicKey(this.#privateKey);
|
|
|
|
}
|
2022-12-03 05:23:13 +03:00
|
|
|
|
|
|
|
/**
|
|
|
|
* The compressed public key.
|
|
|
|
*
|
|
|
|
* This will always begin with either the prefix ``0x02`` or ``0x03``
|
|
|
|
* and be 68 characters long (the ``0x`` prefix and 33 hexadecimal
|
|
|
|
* nibbles)
|
|
|
|
*/
|
2024-04-19 06:05:00 +03:00
|
|
|
get compressedPublicKey(): string {
|
|
|
|
return SigningKey.computePublicKey(this.#privateKey, true);
|
|
|
|
}
|
2022-09-05 23:14:43 +03:00
|
|
|
|
2022-12-03 05:23:13 +03:00
|
|
|
/**
|
|
|
|
* Return the signature of the signed %%digest%%.
|
|
|
|
*/
|
2022-11-28 05:53:06 +03:00
|
|
|
sign(digest: BytesLike): Signature {
|
2022-10-20 11:59:55 +03:00
|
|
|
assertArgument(dataLength(digest) === 32, "invalid digest length", "digest", digest);
|
2022-09-05 23:14:43 +03:00
|
|
|
|
2023-09-13 10:27:40 +03:00
|
|
|
const sig = secp256k1.sign(getBytesCopy(digest), getBytesCopy(this.#privateKey), {
|
2024-04-19 06:05:00 +03:00
|
|
|
lowS: true,
|
2022-09-05 23:14:43 +03:00
|
|
|
});
|
|
|
|
|
|
|
|
return Signature.from({
|
2023-09-13 10:27:40 +03:00
|
|
|
r: toBeHex(sig.r, 32),
|
|
|
|
s: toBeHex(sig.s, 32),
|
2024-04-19 06:05:00 +03:00
|
|
|
v: sig.recovery ? 0x1c : 0x1b,
|
2022-11-28 05:53:06 +03:00
|
|
|
});
|
2022-09-05 23:14:43 +03:00
|
|
|
}
|
|
|
|
|
2022-12-03 05:23:13 +03:00
|
|
|
/**
|
|
|
|
* Returns the [[link-wiki-ecdh]] shared secret between this
|
|
|
|
* private key and the %%other%% key.
|
|
|
|
*
|
|
|
|
* The %%other%% key may be any type of key, a raw public key,
|
|
|
|
* a compressed/uncompressed pubic key or aprivate key.
|
|
|
|
*
|
|
|
|
* Best practice is usually to use a cryptographic hash on the
|
|
|
|
* returned value before using it as a symetric secret.
|
2022-12-10 02:21:45 +03:00
|
|
|
*
|
|
|
|
* @example:
|
|
|
|
* sign1 = new SigningKey(id("some-secret-1"))
|
|
|
|
* sign2 = new SigningKey(id("some-secret-2"))
|
|
|
|
*
|
|
|
|
* // Notice that privA.computeSharedSecret(pubB)...
|
|
|
|
* sign1.computeSharedSecret(sign2.publicKey)
|
|
|
|
* //_result:
|
|
|
|
*
|
|
|
|
* // ...is equal to privB.computeSharedSecret(pubA).
|
|
|
|
* sign2.computeSharedSecret(sign1.publicKey)
|
|
|
|
* //_result:
|
2022-12-03 05:23:13 +03:00
|
|
|
*/
|
2022-12-10 02:21:45 +03:00
|
|
|
computeSharedSecret(other: BytesLike): string {
|
2022-09-05 23:14:43 +03:00
|
|
|
const pubKey = SigningKey.computePublicKey(other);
|
2023-09-13 10:27:40 +03:00
|
|
|
return hexlify(secp256k1.getSharedSecret(getBytesCopy(this.#privateKey), getBytes(pubKey), false));
|
2022-09-05 23:14:43 +03:00
|
|
|
}
|
|
|
|
|
2022-12-03 05:23:13 +03:00
|
|
|
/**
|
|
|
|
* Compute the public key for %%key%%, optionally %%compressed%%.
|
|
|
|
*
|
|
|
|
* The %%key%% may be any type of key, a raw public key, a
|
|
|
|
* compressed/uncompressed public key or private key.
|
2022-12-10 02:21:45 +03:00
|
|
|
*
|
|
|
|
* @example:
|
|
|
|
* sign = new SigningKey(id("some-secret"));
|
|
|
|
*
|
|
|
|
* // Compute the uncompressed public key for a private key
|
|
|
|
* SigningKey.computePublicKey(sign.privateKey)
|
|
|
|
* //_result:
|
|
|
|
*
|
|
|
|
* // Compute the compressed public key for a private key
|
|
|
|
* SigningKey.computePublicKey(sign.privateKey, true)
|
|
|
|
* //_result:
|
|
|
|
*
|
|
|
|
* // Compute the uncompressed public key
|
|
|
|
* SigningKey.computePublicKey(sign.publicKey, false);
|
|
|
|
* //_result:
|
|
|
|
*
|
|
|
|
* // Compute the Compressed a public key
|
|
|
|
* SigningKey.computePublicKey(sign.publicKey, true);
|
|
|
|
* //_result:
|
2022-12-03 05:23:13 +03:00
|
|
|
*/
|
2022-09-05 23:14:43 +03:00
|
|
|
static computePublicKey(key: BytesLike, compressed?: boolean): string {
|
2022-09-09 06:21:08 +03:00
|
|
|
let bytes = getBytes(key, "key");
|
2022-09-05 23:14:43 +03:00
|
|
|
|
2023-01-23 00:38:38 +03:00
|
|
|
// private key
|
2022-09-05 23:14:43 +03:00
|
|
|
if (bytes.length === 32) {
|
|
|
|
const pubKey = secp256k1.getPublicKey(bytes, !!compressed);
|
|
|
|
return hexlify(pubKey);
|
|
|
|
}
|
|
|
|
|
2023-01-23 00:38:38 +03:00
|
|
|
// raw public key; use uncompressed key with 0x04 prefix
|
2022-09-05 23:14:43 +03:00
|
|
|
if (bytes.length === 64) {
|
|
|
|
const pub = new Uint8Array(65);
|
|
|
|
pub[0] = 0x04;
|
|
|
|
pub.set(bytes, 1);
|
|
|
|
bytes = pub;
|
|
|
|
}
|
|
|
|
|
2023-09-13 10:27:40 +03:00
|
|
|
const point = secp256k1.ProjectivePoint.fromHex(bytes);
|
2022-09-05 23:14:43 +03:00
|
|
|
return hexlify(point.toRawBytes(compressed));
|
|
|
|
}
|
|
|
|
|
2022-12-03 05:23:13 +03:00
|
|
|
/**
|
|
|
|
* Returns the public key for the private key which produced the
|
|
|
|
* %%signature%% for the given %%digest%%.
|
2022-12-10 02:21:45 +03:00
|
|
|
*
|
|
|
|
* @example:
|
|
|
|
* key = new SigningKey(id("some-secret"))
|
|
|
|
* digest = id("hello world")
|
|
|
|
* sig = key.sign(digest)
|
|
|
|
*
|
|
|
|
* // Notice the signer public key...
|
|
|
|
* key.publicKey
|
|
|
|
* //_result:
|
|
|
|
*
|
|
|
|
* // ...is equal to the recovered public key
|
|
|
|
* SigningKey.recoverPublicKey(digest, sig)
|
|
|
|
* //_result:
|
|
|
|
*
|
2022-12-03 05:23:13 +03:00
|
|
|
*/
|
2022-09-05 23:14:43 +03:00
|
|
|
static recoverPublicKey(digest: BytesLike, signature: SignatureLike): string {
|
2022-10-20 11:59:55 +03:00
|
|
|
assertArgument(dataLength(digest) === 32, "invalid digest length", "digest", digest);
|
|
|
|
|
2022-09-05 23:14:43 +03:00
|
|
|
const sig = Signature.from(signature);
|
|
|
|
|
2024-04-19 06:05:00 +03:00
|
|
|
let secpSig = secp256k1.Signature.fromCompact(getBytesCopy(concat([sig.r, sig.s])));
|
2023-09-13 10:27:40 +03:00
|
|
|
secpSig = secpSig.addRecoveryBit(sig.yParity);
|
|
|
|
|
|
|
|
const pubKey = secpSig.recoverPublicKey(getBytesCopy(digest));
|
|
|
|
assertArgument(pubKey != null, "invalid signautre for digest", "signature", signature);
|
2022-09-05 23:14:43 +03:00
|
|
|
|
2023-09-13 10:27:40 +03:00
|
|
|
return "0x" + pubKey.toHex(false);
|
2022-09-05 23:14:43 +03:00
|
|
|
}
|
|
|
|
|
2022-12-03 05:23:13 +03:00
|
|
|
/**
|
|
|
|
* Returns the point resulting from adding the ellipic curve points
|
|
|
|
* %%p0%% and %%p1%%.
|
|
|
|
*
|
|
|
|
* This is not a common function most developers should require, but
|
|
|
|
* can be useful for certain privacy-specific techniques.
|
|
|
|
*
|
|
|
|
* For example, it is used by [[HDNodeWallet]] to compute child
|
|
|
|
* addresses from parent public keys and chain codes.
|
|
|
|
*/
|
|
|
|
static addPoints(p0: BytesLike, p1: BytesLike, compressed?: boolean): string {
|
2023-09-13 10:27:40 +03:00
|
|
|
const pub0 = secp256k1.ProjectivePoint.fromHex(SigningKey.computePublicKey(p0).substring(2));
|
|
|
|
const pub1 = secp256k1.ProjectivePoint.fromHex(SigningKey.computePublicKey(p1).substring(2));
|
2024-04-19 06:05:00 +03:00
|
|
|
return "0x" + pub0.add(pub1).toHex(!!compressed);
|
2022-09-05 23:14:43 +03:00
|
|
|
}
|
|
|
|
}
|