Release 0.2.1.

README.md

@@ -2,15 +2,21 @@
 
 Minimal, zero-dependency JS implementation of elliptic curve cryptography.
 
-Implements Short Weierstrass curves with ECDSA signature scheme.
+- Short Weierstrass curve with ECDSA signatures
+- Twisted Edwards curve with EdDSA signatures
+- Montgomery curve for ECDH key agreement
 
-To keep the package minimal, no curve definitions are provided out-of-box.
-Main reason for that is the fact hashing library is usually required for full functionality. Use separate package that defines popular curves: `micro-curve-definitions` for P192, P224, P256, P384, P521, secp256k1, stark curve, bn254, pasta (pallas/vesta) - it depends on `@noble/hashes`.
+To keep the package minimal, no curve definitions are provided out-of-box. Use `micro-curve-definitions` module:
+
+- It provides P192, P224, P256, P384, P521, secp256k1, stark curve, bn254, pasta (pallas/vesta) short weierstrass curves
+- It also provides ed25519 and ed448 twisted edwards curves
+- Main reason for separate package is the fact hashing library (like `@noble/hashes`) is required for full functionality
+- We may reconsider merging packages in future, when a stable version would be ready
 
 Future plans:
 
-- Edwards, Twisted Edwards & Montgomery curves
-- hash-to-curve standard
+- hash to curve standard
+- point indistinguishability
 - pairings
 
 ### This library belongs to _noble_ crypto
@@ -33,39 +39,352 @@ Future plans:
 Use NPM in node.js / browser, or include single file from
 [GitHub's releases page](https://github.com/paulmillr/noble-curves/releases):
 
-## Usage
+> npm install @noble/curves
 
-```sh
-npm install @noble/curves
-```
+The library does not have an entry point. It allows you to select specific primitives and drop everything else. If you only want to use secp256k1, just use the library with rollup or other bundlers. This is done to make your bundles tiny.
 
 ```ts
-// Short Weierstrass curve
-import shortw from '@noble/curves/shortw';
+import { weierstrass } from '@noble/curves/weierstrass'; // Short Weierstrass curve
 import { sha256 } from '@noble/hashes/sha256';
 import { hmac } from '@noble/hashes/hmac';
 import { concatBytes, randomBytes } from '@noble/hashes/utils';
 
-export const secp256k1 = shortw({
+const secp256k1 = weierstrass({
   a: 0n,
   b: 7n,
-  // Field over which we'll do calculations
-  P: 2n ** 256n - 2n ** 32n - 2n ** 9n - 2n ** 8n - 2n ** 7n - 2n ** 6n - 2n ** 4n - 1n,
-  // Curve order, total count of valid points in the field
+  P: 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2fn,
   n: 0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141n,
-  // Base point (x, y) aka generator point
   Gx: 55066263022277343669578718895168534326250603453777594175500187360389116729240n,
   Gy: 32670510020758816978083085130507043184471273380659243275938904335757337482424n,
   hash: sha256,
   hmac: (k: Uint8Array, ...msgs: Uint8Array[]) => hmac(sha256, key, concatBytes(...msgs)),
-  randomBytes: randomBytes
 });
 
-// secp256k1.getPublicKey(priv)
-// secp256k1.sign(msg, priv)
-// secp256k1.verify(sig, msg, pub)
+const key = secp256k1.utils.randomPrivateKey();
+const pub = secp256k1.getPublicKey(key);
+const msg = randomBytes(32);
+const sig = secp256k1.sign(msg, key);
+secp256k1.verify(sig, msg, pub); // true
+sig.recoverPublicKey(msg); // == pub
+const someonesPubkey = secp256k1.getPublicKey(secp256k1.utils.randomPrivateKey());
+const shared = secp256k1.getSharedSecret(key, someonesPubkey);
 ```
 
+## API
+
+- [Overview](#overview)
+- [edwards: Twisted Edwards curve](#edwards-twisted-edwards-curve)
+- [montgomery: Montgomery curve](#montgomery-montgomery-curve)
+- [weierstrass: Short Weierstrass curve](#weierstrass-short-weierstrass-curve)
+- [modular](#modular)
+- [utils](#utils)
+
+### Overview
+
+* All arithmetics is done with JS bigints in finite fields
+* Curve variables, order (number of points on curve), field prime (over which the modular division would be done)
+  are required
+* Many features require hashing, which is not provided. `@noble/hashes` can be used for this purpose.
+  Any other library must conform to the CHash interface:
+    ```ts
+    export type CHash = {
+      (message: Uint8Array): Uint8Array;
+      blockLen: number; outputLen: number; create(): any;
+    };
+    ```
+* w-ary non-adjacent form (wNAF) method with constant-time adjustments is used for point multiplication.
+  It is possible to enable precomputes for edwards & weierstrass curves.
+  Precomputes are calculated once (takes ~20-40ms), after that most `G` multiplications
+  - for example, `getPublicKey()`, `sign()` and similar methods - would be much faster.
+  Use `curve.utils.precompute()`
+* Special params that tune performance can be optionally provided.
+  For example, square root calculation, which is commonly used in point decompression routines
+* Curves export `Point`, which conforms to `Group` interface, which has following methods:
+    - `double()`, `negate()`
+    - `add()`, `subtract()`, `equals()`
+    - `multiply()`
+    Every group also has `BASE` (generator) and `ZERO` (infinity) static properties.
+* Curves export `CURVE` object
+* Curves export `utils`:
+    * `randomPrivateKey()` specific for the curve, avoiding modulo bias
+    * `mod()` & `invert()` methods: function from `modular` with default `P` set to CURVE
+
+### edwards: Twisted Edwards curve
+
+Twisted Edwards curve's formula is: ax² + y² = 1 + dx²y².
+
+* You must specify curve params `a`, `d`, field `P`, order `n`, cofactor `h`, and coordinates `Gx`, `Gy` of generator point.
+* For EdDSA signatures, params `hash` is also required. `adjustScalarBytes` which instructs how to change private scalars could be specified.
+
+```typescript
+import { twistedEdwards } from '@noble/curves/edwards'; // Twisted Edwards curve
+import { sha512 } from '@noble/hashes/sha512';
+import { div } from '@noble/curves/modular';
+
+const ed25519 = twistedEdwards({
+  a: -1n,
+  d: div(-121665n, 121666n, 2n ** 255n - 19n), // -121665n/121666n
+  P: 2n ** 255n - 19n,
+  n: 2n ** 252n + 27742317777372353535851937790883648493n,
+  h: 8n,
+  Gx: 15112221349535400772501151409588531511454012693041857206046113283949847762202n,
+  Gy: 46316835694926478169428394003475163141307993866256225615783033603165251855960n,
+  hash: sha512,
+  randomBytes,
+  adjustScalarBytes(bytes) { // could be no-op
+    bytes[0] &= 248;
+    bytes[31] &= 127;
+    bytes[31] |= 64;
+    return bytes;
+  },
+} as const);
+ed25519.getPublicKey(ed25519.utils.randomPrivateKey());
+```
+
+`twistedEdwards()` returns `CurveFn` of following type:
+
+```ts
+export type CurveFn = {
+  CURVE: ReturnType<typeof validateOpts>;
+  getPublicKey: (privateKey: PrivKey, isCompressed?: boolean) => Uint8Array;
+  sign: (message: Hex, privateKey: Hex) => Uint8Array;
+  verify: (sig: SigType, message: Hex, publicKey: PubKey) => boolean;
+  Point: PointConstructor;
+  ExtendedPoint: ExtendedPointConstructor;
+  Signature: SignatureConstructor;
+  utils: {
+    mod: (a: bigint, b?: bigint) => bigint;
+    invert: (number: bigint, modulo?: bigint) => bigint;
+    randomPrivateKey: () => Uint8Array;
+    getExtendedPublicKey: (key: PrivKey) => {
+      head: Uint8Array;
+      prefix: Uint8Array;
+      scalar: bigint;
+      point: PointType;
+      pointBytes: Uint8Array;
+    };
+  };
+};
+```
+
+### montgomery: Montgomery curve
+
+For now the module only contains methods for x-only ECDH on Curve25519 / Curve448 from RFC7748.
+
+Proper Elliptic Curve Points are not implemented yet.
+
+You must specify curve field, `a24` special variable, `montgomeryBits`, `nByteLength`, and coordinate `u` of generator point.
+
+```typescript
+const x25519 = montgomery({
+  P: 2n ** 255n - 19n,
+  a24: 121665n, // TODO: change to a
+  montgomeryBits: 255,
+  nByteLength: 32,
+  Gu: '0900000000000000000000000000000000000000000000000000000000000000',
+
+  // Optional params
+  powPminus2: (x: bigint): bigint => { return mod.pow(x, P-2, P); },
+  adjustScalarBytes(bytes) {
+    bytes[0] &= 248;
+    bytes[31] &= 127;
+    bytes[31] |= 64;
+    return bytes;
+  },
+});
+```
+
+### weierstrass: Short Weierstrass curve
+
+Short Weierstrass curve's formula is: y² = x³ + ax + b. Uses deterministic ECDSA from RFC6979. You can also specify `extraEntropy` in `sign()`.
+
+* You must specify curve params: `a`, `b`; field `P`; curve order `n`; coordinates `Gx`, `Gy` of generator point
+* For ECDSA, you must specify `hash`, `hmac`. It is also possible to recover keys from signatures
+* For ECDH, use `getSharedSecret(privKeyA, pubKeyB)`
+* Optional params are `lowS` (default value), `sqrtMod` (square root chain) and `endo` (endomorphism)
+
+```typescript
+import { weierstrass } from '@noble/curves/weierstrass'; // Short Weierstrass curve
+import { sha256 } from '@noble/hashes/sha256';
+import { hmac } from '@noble/hashes/hmac';
+import { concatBytes, randomBytes } from '@noble/hashes/utils';
+
+const secp256k1 = weierstrass({
+  // Required params
+  a: 0n,
+  b: 7n,
+  P: 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2fn,
+  n: 0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141n,
+  Gx: 55066263022277343669578718895168534326250603453777594175500187360389116729240n,
+  Gy: 32670510020758816978083085130507043184471273380659243275938904335757337482424n,
+  hash: sha256,
+  hmac: (k: Uint8Array, ...msgs: Uint8Array[]) => hmac(sha256, key, concatBytes(...msgs)),
+  randomBytes,
+
+  // Optional params
+  // Cofactor
+  h: BigInt(1),
+  // Allow only low-S signatures by default in sign() and verify()
+  lowS: true,
+  // More efficient curve-specific implementation of square root
+  sqrtMod(y: bigint) { return sqrt(y); },
+  // Endomorphism options
+  endo: {
+    // Beta param
+    beta: BigInt('0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee'),
+    // Split scalar k into k1, k2
+    splitScalar: (k: bigint) => {
+      return { k1neg: true, k1: 512n, k2neg: false, k2: 448n };
+    },
+  },
+});
+
+// Usage
+const key = secp256k1.utils.randomPrivateKey();
+const pub = secp256k1.getPublicKey(key);
+const msg = randomBytes(32);
+const sig = secp256k1.sign(msg, key);
+secp256k1.verify(sig, msg, pub); // true
+sig.recoverPublicKey(msg); // == pub
+const someonesPubkey = secp256k1.getPublicKey(secp256k1.utils.randomPrivateKey());
+const shared = secp256k1.getSharedSecret(key, someonesPubkey);
+```
+
+`weierstrass()` returns `CurveFn`:
+
+```ts
+export type CurveFn = {
+  CURVE: ReturnType<typeof validateOpts>;
+  getPublicKey: (privateKey: PrivKey, isCompressed?: boolean) => Uint8Array;
+  getSharedSecret: (privateA: PrivKey, publicB: PubKey, isCompressed?: boolean) => Uint8Array;
+  sign: (msgHash: Hex, privKey: PrivKey, opts?: SignOpts) => SignatureType;
+  verify: (
+    signature: Hex | SignatureType, msgHash: Hex, publicKey: PubKey, opts?: {lowS?: boolean;}
+  ) => boolean;
+  Point: PointConstructor;
+  JacobianPoint: JacobianPointConstructor;
+  Signature: SignatureConstructor;
+  utils: {
+    mod: (a: bigint, b?: bigint) => bigint;
+    invert: (number: bigint, modulo?: bigint) => bigint;
+    isValidPrivateKey(privateKey: PrivKey): boolean;
+    hashToPrivateKey: (hash: Hex) => Uint8Array;
+    randomPrivateKey: () => Uint8Array;
+  };
+};
+```
+
+### modular
+
+Modular arithmetics utilities.
+
+```typescript
+import * as mod from '@noble/curves/modular';
+mod.mod(21n, 10n); // 21 mod 10 == 1n; fixed version of 21 % 10
+mod.invert(17n, 10n); // invert(17) mod 10; modular multiplicative inverse
+mod.div(5n, 17n, 10n); // 5/17 mod 10 == 5 * invert(17) mod 10; division
+mod.invertBatch([1n, 2n, 4n], 21n); // => [1n, 11n, 16n] in one inversion
+mod.sqrt(21n, 73n); // sqrt(21) mod 73; square root
+```
+
+### utils
+
+```typescript
+import * as utils from '@noble/curves/utils';
+
+utils.bytesToHex(Uint8Array.from([0xde, 0xad, 0xbe, 0xef]));
+utils.hexToBytes('deadbeef');
+utils.hexToNumber();
+utils.bytesToNumberBE(Uint8Array.from([0xde, 0xad, 0xbe, 0xef]));
+utils.bytesToNumberLE(Uint8Array.from([0xde, 0xad, 0xbe, 0xef]));
+utils.numberToBytesBE(123n);
+utils.numberToBytesLE(123n);
+utils.numberToHexUnpadded(123n);
+utils.concatBytes(Uint8Array.from([0xde, 0xad]), Uint8Array.from([0xbe, 0xef]));
+utils.nLength(255n);
+utils.hashToPrivateScalar(sha512_of_something, secp256r1.n);
+utils.equalBytes(Uint8Array.from([0xde]), Uint8Array.from([0xde]));
+```
+
+## Security
+
+The library had no prior security audit.
+
+[Timing attack](https://en.wikipedia.org/wiki/Timing_attack) considerations: _JIT-compiler_ and _Garbage Collector_ make "constant time" extremely hard to achieve in a scripting language. Which means _any other JS library can't have constant-timeness_. Even statically typed Rust, a language without GC, [makes it harder to achieve constant-time](https://www.chosenplaintext.ca/open-source/rust-timing-shield/security) for some cases. If your goal is absolute security, don't use any JS lib — including bindings to native ones. Use low-level libraries & languages. Nonetheless we're targetting algorithmic constant time.
+
+We consider infrastructure attacks like rogue NPM modules very important; that's why it's crucial to minimize the amount of 3rd-party dependencies & native bindings. If your app uses 500 dependencies, any dep could get hacked and you'll be downloading malware with every `npm install`. Our goal is to minimize this attack vector.
+
+## Speed
+
+Benchmark results on Apple M2 with node v18.10:
+
+```
+==== secp256k1 ====
+  - getPublicKey1 (samples: 10000)
+    noble_old x 8,131 ops/sec @ 122μs/op
+    secp256k1 x 7,374 ops/sec @ 135μs/op
+  - getPublicKey255 (samples: 10000)
+    noble_old x 7,894 ops/sec @ 126μs/op
+    secp256k1 x 7,327 ops/sec @ 136μs/op
+  - sign (samples: 5000)
+    noble_old x 5,243 ops/sec @ 190μs/op
+    secp256k1 x 4,834 ops/sec @ 206μs/op
+  - getSharedSecret (samples: 1000)
+    noble_old x 653 ops/sec @ 1ms/op
+    secp256k1 x 634 ops/sec @ 1ms/op
+  - verify (samples: 1000)
+    secp256k1_old x 1,038 ops/sec @ 962μs/op
+    secp256k1 x 1,009 ops/sec @ 990μs/op
+==== ed25519 ====
+  - getPublicKey (samples: 10000)
+    old x 8,632 ops/sec @ 115μs/op
+    noble x 8,390 ops/sec @ 119μs/op
+  - sign (samples: 5000)
+    old x 4,376 ops/sec @ 228μs/op
+    noble x 4,233 ops/sec @ 236μs/op
+  - verify (samples: 1000)
+    old x 865 ops/sec @ 1ms/op
+    noble x 860 ops/sec @ 1ms/op
+==== ed448 ====
+  - getPublicKey (samples: 5000)
+    noble x 3,224 ops/sec @ 310μs/op
+  - sign (samples: 2500)
+    noble x 1,561 ops/sec @ 640μs/op
+  - verify (samples: 500)
+    noble x 313 ops/sec @ 3ms/op
+==== nist ====
+  - getPublicKey (samples: 2500)
+    P256 x 7,993 ops/sec @ 125μs/op
+    P384 x 3,819 ops/sec @ 261μs/op
+    P521 x 2,074 ops/sec @ 481μs/op
+  - sign (samples: 1000)
+    P256 x 5,327 ops/sec @ 187μs/op
+    P384 x 2,728 ops/sec @ 366μs/op
+    P521 x 1,594 ops/sec @ 626μs/op
+  - verify (samples: 250)
+    P256 x 806 ops/sec @ 1ms/op
+    P384 x 353 ops/sec @ 2ms/op
+    P521 x 171 ops/sec @ 5ms/op
+==== stark ====
+  - pedersen (samples: 500)
+    old x 85 ops/sec @ 11ms/op
+    noble x 1,216 ops/sec @ 822μs/op
+  - verify (samples: 500)
+    old x 302 ops/sec @ 3ms/op
+    noble x 698 ops/sec @ 1ms/op
+```
+
+## Contributing & testing
+
+1. Clone the repository
+2. `npm install` to install build dependencies like TypeScript
+3. `npm run build` to compile TypeScript code
+4. `npm run test` will execute all main tests
+
 ## License
 
-MIT (c) Paul Miller [(https://paulmillr.com)](https://paulmillr.com), see LICENSE file.
+The MIT License (MIT)
+
+Copyright (c) 2022 Paul Miller [(https://paulmillr.com)](https://paulmillr.com)
+
+See LICENSE file.

curve-definitions/benchmark/index.js

@@ -0,0 +1,231 @@
+import * as bench from 'micro-bmark';
+const { run, mark } = bench; // or bench.mark
+// Curves
+import { secp256k1 } from '../lib/secp256k1.js';
+import { P256 } from '../lib/p256.js';
+import { P384 } from '../lib/p384.js';
+import { P521 } from '../lib/p521.js';
+import { ed25519 } from '../lib/ed25519.js';
+import { ed448 } from '../lib/ed448.js';
+
+// Others
+import { hmac } from '@noble/hashes/hmac';
+import { sha256 } from '@noble/hashes/sha256';
+import { sha512 } from '@noble/hashes/sha512';
+
+import * as old_secp from '@noble/secp256k1';
+import { concatBytes, hexToBytes } from '@noble/hashes/utils';
+
+import * as starkwareCrypto from '@starkware-industries/starkware-crypto-utils';
+import * as stark from '../lib/stark.js';
+
+old_secp.utils.sha256Sync = (...msgs) =>
+  sha256
+    .create()
+    .update(concatBytes(...msgs))
+    .digest();
+old_secp.utils.hmacSha256Sync = (key, ...msgs) =>
+  hmac
+    .create(sha256, key)
+    .update(concatBytes(...msgs))
+    .digest();
+import * as noble_ed25519 from '@noble/ed25519';
+noble_ed25519.utils.sha512Sync = (...m) => sha512(concatBytes(...m));
+
+for (let item of [secp256k1, ed25519, ed448, P256, P384, P521, old_secp, noble_ed25519]) {
+  item.utils.precompute(8);
+}
+
+const ONLY_NOBLE = process.argv[2] === 'noble';
+
+function generateData(namespace) {
+  const priv = namespace.utils.randomPrivateKey();
+  const pub = namespace.getPublicKey(priv);
+  const msg = namespace.utils.randomPrivateKey();
+  const sig = namespace.sign(msg, priv);
+  return { priv, pub, msg, sig };
+}
+
+export const CURVES = {
+  secp256k1: {
+    data: () => {
+      return generateData(secp256k1);
+    },
+    getPublicKey1: {
+      samples: 10000,
+      secp256k1_old: () => old_secp.getPublicKey(3n),
+      secp256k1: () => secp256k1.getPublicKey(3n),
+    },
+    getPublicKey255: {
+      samples: 10000,
+      secp256k1_old: () => old_secp.getPublicKey(2n**255n-1n),
+      secp256k1: () => secp256k1.getPublicKey(2n**255n-1n),
+    },
+    sign: {
+      samples: 5000,
+      secp256k1_old: ({ msg, priv }) => old_secp.signSync(msg, priv),
+      secp256k1: ({ msg, priv }) => secp256k1.sign(msg, priv),
+    },
+    verify: {
+      samples: 1000,
+      secp256k1_old: ({ sig, msg, pub }) => {
+        return old_secp.verify((new old_secp.Signature(sig.r, sig.s)), msg, pub);
+      },
+      secp256k1: ({ sig, msg, pub }) => secp256k1.verify(sig, msg, pub)
+    },
+    getSharedSecret: {
+      samples: 1000,
+      secp256k1_old: ({ pub, priv }) => old_secp.getSharedSecret(priv, pub),
+      secp256k1: ({ pub, priv }) => secp256k1.getSharedSecret(priv, pub),
+    },
+    recoverPublicKey: {
+      samples: 1000,
+      secp256k1_old: ({ sig, msg }) =>
+        old_secp.recoverPublicKey(msg, (new old_secp.Signature(sig.r, sig.s)), sig.recovery),
+      secp256k1: ({ sig, msg }) => sig.recoverPublicKey(msg)
+    }
+  },
+  ed25519: {
+    data: () => {
+      function to32Bytes(numOrStr) {
+        const hex = typeof numOrStr === 'string' ? numOrStr : numOrStr.toString(16);
+        return hexToBytes(hex.padStart(64, '0'));
+      }
+      const priv = to32Bytes(0x9d61b19deffd5a60ba844af492ec2cc44449c5697b326919703bac031cae7f60n);
+      const pub = noble_ed25519.sync.getPublicKey(priv);
+      const msg = to32Bytes('deadbeefdeadbeefdeadbeefdeadbeefdeadbeef');
+      const sig = noble_ed25519.sync.sign(msg, priv);
+      return { pub, priv, msg, sig };
+    },
+    getPublicKey: {
+      samples: 10000,
+      old: () => noble_ed25519.sync.getPublicKey(noble_ed25519.utils.randomPrivateKey()),
+      noble: () => ed25519.getPublicKey(ed25519.utils.randomPrivateKey()),
+    },
+    sign: {
+      samples: 5000,
+      old: ({ msg, priv }) => noble_ed25519.sync.sign(msg, priv),
+      noble: ({ msg, priv }) => ed25519.sign(msg, priv),
+    },
+    verify: {
+      samples: 1000,
+      old: ({ sig, msg, pub }) => noble_ed25519.sync.verify(sig, msg, pub),
+      noble: ({ sig, msg, pub }) => ed25519.verify(sig, msg, pub),
+    },
+  },
+  ed448: {
+    data: () => {
+      const priv = ed448.utils.randomPrivateKey();
+      const pub = ed448.getPublicKey(priv);
+      const msg = ed448.utils.randomPrivateKey();
+      const sig = ed448.sign(msg, priv);
+      return { priv, pub, msg, sig };
+    },
+    getPublicKey: {
+      samples: 5000,
+      noble: () => ed448.getPublicKey(ed448.utils.randomPrivateKey()),
+    },
+    sign: {
+      samples: 2500,
+      noble: ({ msg, priv }) => ed448.sign(msg, priv),
+    },
+    verify: {
+      samples: 500,
+      noble: ({ sig, msg, pub }) => ed448.verify(sig, msg, pub)
+    }
+  },
+  nist: {
+    data: () => {
+      return { p256: generateData(P256), p384: generateData(P384), p521: generateData(P521) }
+    },
+    getPublicKey: {
+      samples: 2500,
+      P256: () => P256.getPublicKey(P256.utils.randomPrivateKey()),
+      P384: () => P384.getPublicKey(P384.utils.randomPrivateKey()),
+      P521: () => P521.getPublicKey(P521.utils.randomPrivateKey()),
+    },
+    sign: {
+      samples: 1000,
+      P256: ({ p256: {msg, priv} }) => P256.sign(msg, priv),
+      P384: ({ p384: {msg, priv} }) => P384.sign(msg, priv),
+      P521: ({ p521: {msg, priv} }) => P521.sign(msg, priv),
+    },
+    verify: {
+      samples: 250,
+      P256: ({ p256: {sig, msg, pub} }) => P256.verify(sig, msg, pub),
+      P384: ({ p384: {sig, msg, pub} }) => P384.verify(sig, msg, pub),
+      P521: ({ p521: {sig, msg, pub} }) => P521.verify(sig, msg, pub),
+    }
+  },
+  stark: {
+    data: () => {
+      const priv = '2dccce1da22003777062ee0870e9881b460a8b7eca276870f57c601f182136c';
+      const msg = 'c465dd6b1bbffdb05442eb17f5ca38ad1aa78a6f56bf4415bdee219114a47';
+      const pub = stark.getPublicKey(priv);
+      const sig = stark.sign(msg, priv);
+
+      const privateKey = '2dccce1da22003777062ee0870e9881b460a8b7eca276870f57c601f182136c';
+      const msgHash = 'c465dd6b1bbffdb05442eb17f5ca38ad1aa78a6f56bf4415bdee219114a47';
+      const keyPair = starkwareCrypto.default.ec.keyFromPrivate(privateKey, 'hex');
+      const publicKeyStark = starkwareCrypto.default.ec.keyFromPublic(
+        keyPair.getPublic(true, 'hex'), 'hex'
+      );
+
+      return { priv, sig, msg, pub, publicKeyStark, msgHash, keyPair }
+    },
+    pedersen: {
+      samples: 500,
+      old: () => {
+        return starkwareCrypto.default.pedersen([
+          '3d937c035c878245caf64531a5756109c53068da139362728feb561405371cb',
+          '208a0a10250e382e1e4bbe2880906c2791bf6275695e02fbbc6aeff9cd8b31a',
+        ])
+      },
+      noble: () => {
+        return stark.pedersen(
+          '3d937c035c878245caf64531a5756109c53068da139362728feb561405371cb',
+          '208a0a10250e382e1e4bbe2880906c2791bf6275695e02fbbc6aeff9cd8b31a'
+        )
+      }
+    },
+    verify: {
+      samples: 500,
+      old: ({ publicKeyStark, msgHash, keyPair }) => {
+        return starkwareCrypto.default.verify(
+          publicKeyStark,
+          msgHash,
+          starkwareCrypto.default.sign(keyPair, msgHash)
+        );
+      },
+      noble: ({ priv, msg, pub }) => {
+        return stark.verify(stark.sign(msg, priv), msg, pub)
+      }
+    }
+  }
+};
+
+const main = () =>
+  run(async () => {
+    for (const [name, curve] of Object.entries(CURVES)) {
+      console.log(`==== ${name} ====`);
+      const data = curve.data();
+      for (const [fnName, libs] of Object.entries(curve)) {
+        if (fnName === 'data') continue;
+        const samples = libs.samples;
+        console.log(`  - ${fnName} (samples: ${samples})`);
+        for (const [lib, fn] of Object.entries(libs)) {
+          if (lib === 'samples') continue;
+          if (ONLY_NOBLE && lib !== 'noble') continue;
+          await mark(`    ${lib}`, samples, () => fn(data));
+        }
+      }
+    }
+    // Log current RAM
+    bench.logMem();
+  });
+
+// ESM is broken.
+import url from 'url';
+if (import.meta.url === url.pathToFileURL(process.argv[1]).href) {
+  main();
+}

curve-definitions/benchmark/package.json

@@ -0,0 +1,22 @@
+{
+    "name": "benchmark",
+    "private": true,
+    "version": "0.1.0",
+    "description": "benchmarks",
+    "main": "index.js",
+    "type": "module",
+    "scripts": {
+        "bench": "node index.js"
+    },
+    "keywords": [],
+    "author": "",
+    "license": "MIT",
+    "devDependencies": {
+        "micro-bmark": "0.2.0"
+    },
+    "dependencies": {
+        "@noble/ed25519": "^1.7.1",
+        "@noble/secp256k1": "^1.7.0",
+        "@starkware-industries/starkware-crypto-utils": "^0.0.2"
+    }
+}

curve-definitions/lib/esm/package.json

@@ -0,0 +1,7 @@
+{
+  "type": "module",
+  "browser": {
+    "crypto": false,
+    "./crypto": "./esm/cryptoBrowser.js"
+  }
+}

curve-definitions/package.json

@@ -1,26 +1,22 @@
 {
   "name": "micro-curve-definitions",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "description": "Curve definitions for @noble/curves",
   "files": [
-    "index.js",
-    "index.d.ts",
-    "index.d.ts.map",
-    "index.ts"
+    "lib"
   ],
-  "type": "module",
-  "main": "index.js",
-  "module": "index.js",
-  "types": "index.d.ts",
+  "main": "lib/index.js",
+  "module": "lib/index.js",
+  "types": "lib/index.d.ts",
   "dependencies": {
-    "@noble/curves": "~0.1.0",
-    "@noble/hashes": "1.1.4"
+    "@noble/curves": "0.2.1",
+    "@noble/hashes": "1.1.5"
   },
   "devDependencies": {
     "@scure/base": "~1.1.0",
     "@scure/bip32": "^1.1.1",
     "@scure/bip39": "^1.1.0",
-    "@types/node": "^18.11.3",
+    "@types/node": "18.11.3",
     "fast-check": "3.0.0",
     "micro-should": "0.2.0",
     "prettier": "2.6.2",
@@ -34,8 +30,8 @@
     "url": "git+https://github.com/paulmillr/noble-curves.git"
   },
   "scripts": {
-    "build": "tsc",
-    "lint": "prettier --check index.ts",
+    "build": "tsc && tsc -p tsconfig.esm.json",
+    "lint": "prettier --check src",
     "test": "node test/index.test.js"
   },
   "keywords": [

curve-definitions/src/_shortw_utils.ts

@@ -0,0 +1,17 @@
+import { hmac } from '@noble/hashes/hmac';
+import { concatBytes, randomBytes } from '@noble/hashes/utils';
+import { weierstrass, CurveType, CHash } from '@noble/curves/weierstrass';
+
+export function getHash(hash: CHash) {
+  return {
+    hash,
+    hmac: (key: Uint8Array, ...msgs: Uint8Array[]) => hmac(hash, key, concatBytes(...msgs)),
+    randomBytes,
+  };
+}
+// Same API as @noble/hashes, with ability to create curve with custom hash
+type CurveDef = Readonly<Omit<CurveType, 'hash' | 'hmac' | 'randomBytes'>>;
+export function createCurve(curveDef: CurveDef, defHash: CHash) {
+  const create = (hash: CHash) => weierstrass({ ...curveDef, ...getHash(hash) });
+  return Object.freeze({ ...create(defHash), create });
+}

curve-definitions/src/bn.ts

@@ -1,25 +1,21 @@
 /*! @noble/curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-import { weierstrass, CHash } from '@noble/curves/shortw';
-import { concatBytes, randomBytes } from '@noble/hashes/utils';
-import { hmac } from '@noble/hashes/hmac';
+import { weierstrass } from '@noble/curves/weierstrass';
 import { sha256 } from '@noble/hashes/sha256';
+import { getHash } from './_shortw_utils.js';
 
-function getHash(hash: CHash) {
-  return {
-    hash,
-    hmac: (key: Uint8Array, ...msgs: Uint8Array[]) => hmac(hash, key, concatBytes(...msgs)),
-    randomBytes,
-  };
-}
-
-// Was known as alt_bn128 when it had 128-bit security. Now that it's much lower, the naming
-// has been changed to its prime bit count.
+/**
+ * bn254 pairing-friendly curve.
+ * Previously known as alt_bn_128, when it had 128-bit security.
+ * Recent research shown it's weaker, the naming has been adjusted to its prime bit count.
+ * https://github.com/zcash/zcash/issues/2502
+ */
 export const bn254 = weierstrass({
-  a: 0n,
-  b: 3n,
-  P: 0x30644e72e131a029b85045b68181585d97816a916871ca8d3c208c16d87cfd47n,
-  n: 0x30644e72e131a029b85045b68181585d2833e84879b9709143e1f593f0000001n,
-  Gx: 1n,
-  Gy: 2n,
+  a: BigInt(0),
+  b: BigInt(3),
+  P: BigInt('0x30644e72e131a029b85045b68181585d97816a916871ca8d3c208c16d87cfd47'),
+  n: BigInt('0x30644e72e131a029b85045b68181585d2833e84879b9709143e1f593f0000001'),
+  Gx: BigInt(1),
+  Gy: BigInt(2),
+  h: BigInt(1),
   ...getHash(sha256),
 });

curve-definitions/src/ed25519.ts

@@ -0,0 +1,341 @@
+/*! @noble/curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+import { sha512 } from '@noble/hashes/sha512';
+import { concatBytes, randomBytes, utf8ToBytes } from '@noble/hashes/utils';
+import { twistedEdwards, ExtendedPointType } from '@noble/curves/edwards';
+import { montgomery } from '@noble/curves/montgomery';
+import { mod, pow2, isNegativeLE } from '@noble/curves/modular';
+import {
+  ensureBytes,
+  equalBytes,
+  bytesToHex,
+  bytesToNumberLE,
+  numberToBytesLE,
+  Hex,
+} from '@noble/curves/utils';
+
+/**
+ * ed25519 Twisted Edwards curve with following addons:
+ * - X25519 ECDH
+ * - Ristretto cofactor elimination
+ * - Elligator hash-to-group / point indistinguishability
+ */
+
+const ED25519_P = BigInt(
+  '57896044618658097711785492504343953926634992332820282019728792003956564819949'
+);
+// √(-1) aka √(a) aka 2^((p-1)/4)
+const ED25519_SQRT_M1 = BigInt(
+  '19681161376707505956807079304988542015446066515923890162744021073123829784752'
+);
+
+// prettier-ignore
+const _0n = BigInt(0), _1n = BigInt(1), _2n = BigInt(2), _5n = BigInt(5);
+// prettier-ignore
+const _10n = BigInt(10), _20n = BigInt(20), _40n = BigInt(40), _80n = BigInt(80);
+function ed25519_pow_2_252_3(x: bigint) {
+  const P = ED25519_P;
+  const x2 = (x * x) % P;
+  const b2 = (x2 * x) % P; // x^3, 11
+  const b4 = (pow2(b2, _2n, P) * b2) % P; // x^15, 1111
+  const b5 = (pow2(b4, _1n, P) * x) % P; // x^31
+  const b10 = (pow2(b5, _5n, P) * b5) % P;
+  const b20 = (pow2(b10, _10n, P) * b10) % P;
+  const b40 = (pow2(b20, _20n, P) * b20) % P;
+  const b80 = (pow2(b40, _40n, P) * b40) % P;
+  const b160 = (pow2(b80, _80n, P) * b80) % P;
+  const b240 = (pow2(b160, _80n, P) * b80) % P;
+  const b250 = (pow2(b240, _10n, P) * b10) % P;
+  const pow_p_5_8 = (pow2(b250, _2n, P) * x) % P;
+  // ^ To pow to (p+3)/8, multiply it by x.
+  return { pow_p_5_8, b2 };
+}
+
+/**
+ * For X25519, in order to decode 32 random bytes as an integer scalar,
+ * set the
+ * three least significant bits of the first byte 0b1111_1000,
+ * and the most significant bit of the last to zero 0b0111_1111,
+ * set the second most significant bit of the last byte to 1 0b0100_0000
+ */
+function adjustScalarBytes(bytes: Uint8Array): Uint8Array {
+  bytes[0] &= 248;
+  bytes[31] &= 127;
+  bytes[31] |= 64;
+  return bytes;
+}
+// sqrt(u/v)
+function uvRatio(u: bigint, v: bigint): { isValid: boolean; value: bigint } {
+  const P = ED25519_P;
+  const v3 = mod(v * v * v, P); // v³
+  const v7 = mod(v3 * v3 * v, P); // v⁷
+  // (p+3)/8 and (p-5)/8
+  const pow = ed25519_pow_2_252_3(u * v7).pow_p_5_8;
+  let x = mod(u * v3 * pow, P); // (uv³)(uv⁷)^(p-5)/8
+  const vx2 = mod(v * x * x, P); // vx²
+  const root1 = x; // First root candidate
+  const root2 = mod(x * ED25519_SQRT_M1, P); // Second root candidate
+  const useRoot1 = vx2 === u; // If vx² = u (mod p), x is a square root
+  const useRoot2 = vx2 === mod(-u, P); // If vx² = -u, set x <-- x * 2^((p-1)/4)
+  const noRoot = vx2 === mod(-u * ED25519_SQRT_M1, P); // There is no valid root, vx² = -u√(-1)
+  if (useRoot1) x = root1;
+  if (useRoot2 || noRoot) x = root2; // We return root2 anyway, for const-time
+  if (isNegativeLE(x, P)) x = mod(-x, P);
+  return { isValid: useRoot1 || useRoot2, value: x };
+}
+
+// Just in case
+export const ED25519_TORSION_SUBGROUP = [
+  '0100000000000000000000000000000000000000000000000000000000000000',
+  'c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac037a',
+  '0000000000000000000000000000000000000000000000000000000000000080',
+  '26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc05',
+  'ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f',
+  '26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc85',
+  '0000000000000000000000000000000000000000000000000000000000000000',
+  'c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac03fa',
+];
+
+const ED25519_DEF = {
+  // Param: a
+  a: BigInt(-1),
+  // Equal to -121665/121666 over finite field.
+  // Negative number is P - number, and division is invert(number, P)
+  d: BigInt('37095705934669439343138083508754565189542113879843219016388785533085940283555'),
+  // Finite field 𝔽p over which we'll do calculations; 2n ** 255n - 19n
+  P: ED25519_P,
+  // Subgroup order: how many points ed25519 has
+  // 2n ** 252n + 27742317777372353535851937790883648493n;
+  n: BigInt('7237005577332262213973186563042994240857116359379907606001950938285454250989'),
+  // Cofactor
+  h: BigInt(8),
+  // Base point (x, y) aka generator point
+  Gx: BigInt('15112221349535400772501151409588531511454012693041857206046113283949847762202'),
+  Gy: BigInt('46316835694926478169428394003475163141307993866256225615783033603165251855960'),
+  hash: sha512,
+  randomBytes,
+  adjustScalarBytes,
+  // dom2
+  // Ratio of u to v. Allows us to combine inversion and square root. Uses algo from RFC8032 5.1.3.
+  // Constant-time, u/√v
+  uvRatio,
+} as const;
+
+export const ed25519 = twistedEdwards(ED25519_DEF);
+function ed25519_domain(data: Uint8Array, ctx: Uint8Array, phflag: boolean) {
+  if (ctx.length > 255) throw new Error('Context is too big');
+  return concatBytes(
+    utf8ToBytes('SigEd25519 no Ed25519 collisions'),
+    new Uint8Array([phflag ? 1 : 0, ctx.length]),
+    ctx,
+    data
+  );
+}
+export const ed25519ctx = twistedEdwards({ ...ED25519_DEF, domain: ed25519_domain });
+export const ed25519ph = twistedEdwards({
+  ...ED25519_DEF,
+  domain: ed25519_domain,
+  preHash: sha512,
+});
+
+export const x25519 = montgomery({
+  P: ED25519_P,
+  a24: BigInt('121665'),
+  montgomeryBits: 255, // n is 253 bits
+  nByteLength: 32,
+  Gu: '0900000000000000000000000000000000000000000000000000000000000000',
+  powPminus2: (x: bigint): bigint => {
+    const P = ED25519_P;
+    // x^(p-2) aka x^(2^255-21)
+    const { pow_p_5_8, b2 } = ed25519_pow_2_252_3(x);
+    return mod(pow2(pow_p_5_8, BigInt(3), P) * b2, P);
+  },
+  adjustScalarBytes,
+});
+
+function assertRstPoint(other: unknown) {
+  if (!(other instanceof RistrettoPoint)) throw new TypeError('RistrettoPoint expected');
+}
+// √(-1) aka √(a) aka 2^((p-1)/4)
+const SQRT_M1 = BigInt(
+  '19681161376707505956807079304988542015446066515923890162744021073123829784752'
+);
+// √(ad - 1)
+const SQRT_AD_MINUS_ONE = BigInt(
+  '25063068953384623474111414158702152701244531502492656460079210482610430750235'
+);
+// 1 / √(a-d)
+const INVSQRT_A_MINUS_D = BigInt(
+  '54469307008909316920995813868745141605393597292927456921205312896311721017578'
+);
+// 1-d²
+const ONE_MINUS_D_SQ = BigInt(
+  '1159843021668779879193775521855586647937357759715417654439879720876111806838'
+);
+// (d-1)²
+const D_MINUS_ONE_SQ = BigInt(
+  '40440834346308536858101042469323190826248399146238708352240133220865137265952'
+);
+// Calculates 1/√(number)
+const invertSqrt = (number: bigint) => uvRatio(_1n, number);
+
+const MAX_255B = BigInt('0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff');
+const bytes255ToNumberLE = (bytes: Uint8Array) =>
+  ed25519.utils.mod(bytesToNumberLE(bytes) & MAX_255B);
+
+type ExtendedPoint = ExtendedPointType;
+
+/**
+ * Each ed25519/ExtendedPoint has 8 different equivalent points. This can be
+ * a source of bugs for protocols like ring signatures. Ristretto was created to solve this.
+ * Ristretto point operates in X:Y:Z:T extended coordinates like ExtendedPoint,
+ * but it should work in its own namespace: do not combine those two.
+ * https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-ristretto255-decaf448
+ */
+export class RistrettoPoint {
+  static BASE = new RistrettoPoint(ed25519.ExtendedPoint.BASE);
+  static ZERO = new RistrettoPoint(ed25519.ExtendedPoint.ZERO);
+
+  // Private property to discourage combining ExtendedPoint + RistrettoPoint
+  // Always use Ristretto encoding/decoding instead.
+  constructor(private readonly ep: ExtendedPoint) {}
+
+  // Computes Elligator map for Ristretto
+  // https://ristretto.group/formulas/elligator.html
+  private static calcElligatorRistrettoMap(r0: bigint): ExtendedPoint {
+    const { d, P } = ed25519.CURVE;
+    const { mod } = ed25519.utils;
+    const r = mod(SQRT_M1 * r0 * r0); // 1
+    const Ns = mod((r + _1n) * ONE_MINUS_D_SQ); // 2
+    let c = BigInt(-1); // 3
+    const D = mod((c - d * r) * mod(r + d)); // 4
+    let { isValid: Ns_D_is_sq, value: s } = uvRatio(Ns, D); // 5
+    let s_ = mod(s * r0); // 6
+    if (!isNegativeLE(s_, P)) s_ = mod(-s_);
+    if (!Ns_D_is_sq) s = s_; // 7
+    if (!Ns_D_is_sq) c = r; // 8
+    const Nt = mod(c * (r - _1n) * D_MINUS_ONE_SQ - D); // 9
+    const s2 = s * s;
+    const W0 = mod((s + s) * D); // 10
+    const W1 = mod(Nt * SQRT_AD_MINUS_ONE); // 11
+    const W2 = mod(_1n - s2); // 12
+    const W3 = mod(_1n + s2); // 13
+    return new ed25519.ExtendedPoint(mod(W0 * W3), mod(W2 * W1), mod(W1 * W3), mod(W0 * W2));
+  }
+
+  /**
+   * Takes uniform output of 64-bit hash function like sha512 and converts it to `RistrettoPoint`.
+   * The hash-to-group operation applies Elligator twice and adds the results.
+   * **Note:** this is one-way map, there is no conversion from point to hash.
+   * https://ristretto.group/formulas/elligator.html
+   * @param hex 64-bit output of a hash function
+   */
+  static hashToCurve(hex: Hex): RistrettoPoint {
+    hex = ensureBytes(hex, 64);
+    const r1 = bytes255ToNumberLE(hex.slice(0, 32));
+    const R1 = this.calcElligatorRistrettoMap(r1);
+    const r2 = bytes255ToNumberLE(hex.slice(32, 64));
+    const R2 = this.calcElligatorRistrettoMap(r2);
+    return new RistrettoPoint(R1.add(R2));
+  }
+
+  /**
+   * Converts ristretto-encoded string to ristretto point.
+   * https://ristretto.group/formulas/decoding.html
+   * @param hex Ristretto-encoded 32 bytes. Not every 32-byte string is valid ristretto encoding
+   */
+  static fromHex(hex: Hex): RistrettoPoint {
+    hex = ensureBytes(hex, 32);
+    const { a, d, P } = ed25519.CURVE;
+    const { mod } = ed25519.utils;
+    const emsg = 'RistrettoPoint.fromHex: the hex is not valid encoding of RistrettoPoint';
+    const s = bytes255ToNumberLE(hex);
+    // 1. Check that s_bytes is the canonical encoding of a field element, or else abort.
+    // 3. Check that s is non-negative, or else abort
+    if (!equalBytes(numberToBytesLE(s, 32), hex) || isNegativeLE(s, P)) throw new Error(emsg);
+    const s2 = mod(s * s);
+    const u1 = mod(_1n + a * s2); // 4 (a is -1)
+    const u2 = mod(_1n - a * s2); // 5
+    const u1_2 = mod(u1 * u1);
+    const u2_2 = mod(u2 * u2);
+    const v = mod(a * d * u1_2 - u2_2); // 6
+    const { isValid, value: I } = invertSqrt(mod(v * u2_2)); // 7
+    const Dx = mod(I * u2); // 8
+    const Dy = mod(I * Dx * v); // 9
+    let x = mod((s + s) * Dx); // 10
+    if (isNegativeLE(x, P)) x = mod(-x); // 10
+    const y = mod(u1 * Dy); // 11
+    const t = mod(x * y); // 12
+    if (!isValid || isNegativeLE(t, P) || y === _0n) throw new Error(emsg);
+    return new RistrettoPoint(new ed25519.ExtendedPoint(x, y, _1n, t));
+  }
+
+  /**
+   * Encodes ristretto point to Uint8Array.
+   * https://ristretto.group/formulas/encoding.html
+   */
+  toRawBytes(): Uint8Array {
+    let { x, y, z, t } = this.ep;
+    const { P } = ed25519.CURVE;
+    const { mod } = ed25519.utils;
+    const u1 = mod(mod(z + y) * mod(z - y)); // 1
+    const u2 = mod(x * y); // 2
+    // Square root always exists
+    const u2sq = mod(u2 * u2);
+    const { value: invsqrt } = invertSqrt(mod(u1 * u2sq)); // 3
+    const D1 = mod(invsqrt * u1); // 4
+    const D2 = mod(invsqrt * u2); // 5
+    const zInv = mod(D1 * D2 * t); // 6
+    let D: bigint; // 7
+    if (isNegativeLE(t * zInv, P)) {
+      let _x = mod(y * SQRT_M1);
+      let _y = mod(x * SQRT_M1);
+      x = _x;
+      y = _y;
+      D = mod(D1 * INVSQRT_A_MINUS_D);
+    } else {
+      D = D2; // 8
+    }
+    if (isNegativeLE(x * zInv, P)) y = mod(-y); // 9
+    let s = mod((z - y) * D); // 10 (check footer's note, no sqrt(-a))
+    if (isNegativeLE(s, P)) s = mod(-s);
+    return numberToBytesLE(s, 32); // 11
+  }
+
+  toHex(): string {
+    return bytesToHex(this.toRawBytes());
+  }
+
+  toString(): string {
+    return this.toHex();
+  }
+
+  // Compare one point to another.
+  equals(other: RistrettoPoint): boolean {
+    assertRstPoint(other);
+    const a = this.ep;
+    const b = other.ep;
+    const { mod } = ed25519.utils;
+    // (x1 * y2 == y1 * x2) | (y1 * y2 == x1 * x2)
+    const one = mod(a.x * b.y) === mod(a.y * b.x);
+    const two = mod(a.y * b.y) === mod(a.x * b.x);
+    return one || two;
+  }
+
+  add(other: RistrettoPoint): RistrettoPoint {
+    assertRstPoint(other);
+    return new RistrettoPoint(this.ep.add(other.ep));
+  }
+
+  subtract(other: RistrettoPoint): RistrettoPoint {
+    assertRstPoint(other);
+    return new RistrettoPoint(this.ep.subtract(other.ep));
+  }
+
+  multiply(scalar: number | bigint): RistrettoPoint {
+    return new RistrettoPoint(this.ep.multiply(scalar));
+  }
+
+  multiplyUnsafe(scalar: number | bigint): RistrettoPoint {
+    return new RistrettoPoint(this.ep.multiplyUnsafe(scalar));
+  }
+}

curve-definitions/src/ed448.ts

@@ -0,0 +1,146 @@
+/*! @noble/curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+import { shake256 } from '@noble/hashes/sha3';
+import { concatBytes, randomBytes, utf8ToBytes, wrapConstructor } from '@noble/hashes/utils';
+import { twistedEdwards } from '@noble/curves/edwards';
+import { mod, pow2 } from '@noble/curves/modular';
+import { montgomery } from '../../lib/montgomery.js';
+
+/**
+ * Edwards448 (not Ed448-Goldilocks) curve with following addons:
+ * * X448 ECDH
+ * Conforms to RFC 8032 https://www.rfc-editor.org/rfc/rfc8032.html#section-5.2
+ */
+
+const shake256_114 = wrapConstructor(() => shake256.create({ dkLen: 114 }));
+const shake256_64 = wrapConstructor(() => shake256.create({ dkLen: 64 }));
+const ed448P = BigInt(
+  '726838724295606890549323807888004534353641360687318060281490199180612328166730772686396383698676545930088884461843637361053498018365439'
+);
+
+// powPminus3div4 calculates z = x^k mod p, where k = (p-3)/4.
+function ed448_pow_Pminus3div4(x: bigint): bigint {
+  const P = ed448P;
+  // prettier-ignore
+  let [_1n, _2n, _3n, _11n, _22n, _44n, _88n, _223n] = [1, 2, 3, 11, 22, 44, 88, 223]
+    .map(n => BigInt(n));
+  // x ** ((P - 3n)/4n) % P
+  // [223 of 1, 0, 222 of 1], almost same as secp!
+  const b2 = (x * x * x) % P;
+  const b3 = (b2 * b2 * x) % P;
+  const b6 = (pow2(b3, _3n, P) * b3) % P;
+  const b9 = (pow2(b6, _3n, P) * b3) % P;
+  const b11 = (pow2(b9, _2n, P) * b2) % P;
+  const b22 = (pow2(b11, _11n, P) * b11) % P;
+  const b44 = (pow2(b22, _22n, P) * b22) % P;
+  const b88 = (pow2(b44, _44n, P) * b44) % P;
+  const b176 = (pow2(b88, _88n, P) * b88) % P;
+  const b220 = (pow2(b176, _44n, P) * b44) % P;
+  const b222 = (pow2(b220, _2n, P) * b2) % P;
+  const b223 = (pow2(b222, _1n, P) * x) % P;
+  return (pow2(b223, _223n, P) * b222) % P;
+}
+
+function adjustScalarBytes(bytes: Uint8Array): Uint8Array {
+  // Section 5: Likewise, for X448, set the two least significant bits of the first byte to 0, and the most
+  // significant bit of the last byte to 1.
+  bytes[0] &= 252; // 0b11111100
+  // and the most significant bit of the last byte to 1.
+  bytes[55] |= 128; // 0b10000000
+  // NOTE: is is NOOP for 56 bytes scalars (X25519/X448)
+  bytes[56] = 0; // Byte outside of group (456 buts vs 448 bits)
+  return bytes;
+}
+
+const ED448_DEF = {
+  // Param: a
+  a: BigInt(1),
+  // -39081. Negative number is P - number
+  d: BigInt(
+    '726838724295606890549323807888004534353641360687318060281490199180612328166730772686396383698676545930088884461843637361053498018326358'
+  ),
+  // Finite field 𝔽p over which we'll do calculations; 2n ** 448n - 2n ** 224n - 1n
+  P: ed448P,
+  // Subgroup order: how many points ed448 has; 2n**446n - 13818066809895115352007386748515426880336692474882178609894547503885n
+  n: BigInt(
+    '181709681073901722637330951972001133588410340171829515070372549795146003961539585716195755291692375963310293709091662304773755859649779'
+  ),
+  nBitLength: 456,
+  // Cofactor
+  h: BigInt(4),
+  // Base point (x, y) aka generator point
+  Gx: BigInt(
+    '224580040295924300187604334099896036246789641632564134246125461686950415467406032909029192869357953282578032075146446173674602635247710'
+  ),
+  Gy: BigInt(
+    '298819210078481492676017930443930673437544040154080242095928241372331506189835876003536878655418784733982303233503462500531545062832660'
+  ),
+  // SHAKE256(dom4(phflag,context)||x, 114)
+  hash: shake256_114,
+  randomBytes,
+  adjustScalarBytes,
+  // dom4
+  domain: (data: Uint8Array, ctx: Uint8Array, phflag: boolean) => {
+    if (ctx.length > 255) throw new Error(`Context is too big: ${ctx.length}`);
+    return concatBytes(
+      utf8ToBytes('SigEd448'),
+      new Uint8Array([phflag ? 1 : 0, ctx.length]),
+      ctx,
+      data
+    );
+  },
+  // Constant-time ratio of u to v. Allows to combine inversion and square root u/√v.
+  // Uses algo from RFC8032 5.1.3.
+  uvRatio: (u: bigint, v: bigint): { isValid: boolean; value: bigint } => {
+    const P = ed448P;
+    // https://datatracker.ietf.org/doc/html/rfc8032#section-5.2.3
+    // To compute the square root of (u/v), the first step is to compute the
+    //   candidate root x = (u/v)^((p+1)/4).  This can be done using the
+    // following trick, to use a single modular powering for both the
+    // inversion of v and the square root:
+    //           (p+1)/4    3            (p-3)/4
+    // x = (u/v)        = u  v (u^5 v^3)         (mod p)
+    const u2v = mod(u * u * v, P);
+    const u3v = mod(u2v * u, P); // u^2v
+    const u5v3 = mod(u3v * u2v * v, P); // u^5v^3
+    const root = ed448_pow_Pminus3div4(u5v3);
+    const x = mod(u3v * root, P);
+    // Verify that root is exists
+    const x2 = mod(x * x, P); // x^2
+    // If v * x^2 = u, the recovered x-coordinate is x.  Otherwise, no
+    // square root exists, and the decoding fails.
+    return { isValid: mod(x2 * v, P) === u, value: x };
+  },
+} as const;
+
+export const ed448 = twistedEdwards(ED448_DEF);
+// NOTE: there is no ed448ctx, since ed448 supports ctx by default
+export const ed448ph = twistedEdwards({ ...ED448_DEF, preHash: shake256_64 });
+
+export const x448 = montgomery({
+  a24: BigInt(39081),
+  montgomeryBits: 448,
+  nByteLength: 57,
+  P: ed448P,
+  Gu: '0500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000',
+  powPminus2: (x: bigint): bigint => {
+    const P = ed448P;
+    const Pminus3div4 = ed448_pow_Pminus3div4(x);
+    const Pminus3 = pow2(Pminus3div4, BigInt(2), P);
+    return mod(Pminus3 * x, P); // Pminus3 * x = Pminus2
+  },
+  adjustScalarBytes,
+  // The 4-isogeny maps between the Montgomery curve and this Edwards
+  // curve are:
+  //   (u, v) = (y^2/x^2, (2 - x^2 - y^2)*y/x^3)
+  //   (x, y) = (4*v*(u^2 - 1)/(u^4 - 2*u^2 + 4*v^2 + 1),
+  //             -(u^5 - 2*u^3 - 4*u*v^2 + u)/
+  //             (u^5 - 2*u^2*v^2 - 2*u^3 - 2*v^2 + u))
+  // xyToU: (p: PointType) => {
+  //   const P = ed448P;
+  //   const { x, y } = p;
+  //   if (x === _0n) throw new Error(`Point with x=0 doesn't have mapping`);
+  //   const invX = invert(x * x, P); // x^2
+  //   const u = mod(y * y * invX, P); // (y^2/x^2)
+  //   return numberToBytesLE(u, 56);
+  // },
+});

curve-definitions/src/index.ts

@@ -0,0 +1 @@
+throw new Error('Incorrect usage. Import submodules instead');

curve-definitions/src/jubjub.ts

@@ -0,0 +1,56 @@
+/*! @noble/curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+import { sha256 } from '@noble/hashes/sha256';
+import { concatBytes, randomBytes, utf8ToBytes } from '@noble/hashes/utils';
+import { twistedEdwards } from '@noble/curves/edwards';
+import { blake2s } from '@noble/hashes/blake2s';
+
+/**
+ * jubjub Twisted Edwards curve.
+ * https://neuromancer.sk/std/other/JubJub
+ */
+
+export const jubjub = twistedEdwards({
+  // Params: a, d
+  a: BigInt('0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000000'),
+  d: BigInt('0x2a9318e74bfa2b48f5fd9207e6bd7fd4292d7f6d37579d2601065fd6d6343eb1'),
+  // Finite field 𝔽p over which we'll do calculations
+  P: BigInt('0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001'),
+  // Subgroup order: how many points ed25519 has
+  // 2n ** 252n + 27742317777372353535851937790883648493n;
+  n: BigInt('0xe7db4ea6533afa906673b0101343b00a6682093ccc81082d0970e5ed6f72cb7'),
+  // Cofactor
+  h: BigInt(8),
+  // Base point (x, y) aka generator point
+  Gx: BigInt('0x11dafe5d23e1218086a365b99fbf3d3be72f6afd7d1f72623e6b071492d1122b'),
+  Gy: BigInt('0x1d523cf1ddab1a1793132e78c866c0c33e26ba5cc220fed7cc3f870e59d292aa'),
+  hash: sha256,
+  randomBytes,
+} as const);
+
+const GH_FIRST_BLOCK = utf8ToBytes(
+  '096b36a5804bfacef1691e173c366a47ff5ba84a44f26ddd7e8d9f79d5b42df0'
+);
+
+// Returns point at JubJub curve which is prime order and not zero
+export function groupHash(tag: Uint8Array, personalization: Uint8Array) {
+  const h = blake2s.create({ personalization, dkLen: 32 });
+  h.update(GH_FIRST_BLOCK);
+  h.update(tag);
+  // NOTE: returns ExtendedPoint, in case it will be multiplied later
+  let p = jubjub.ExtendedPoint.fromAffine(jubjub.Point.fromHex(h.digest()));
+  // NOTE: cannot replace with isSmallOrder, returns Point*8
+  p = p.multiply(jubjub.CURVE.h);
+  if (p.equals(jubjub.ExtendedPoint.ZERO)) throw new Error('Point has small order');
+  return p;
+}
+
+export function findGroupHash(m: Uint8Array, personalization: Uint8Array) {
+  const tag = concatBytes(m, new Uint8Array([0]));
+  for (let i = 0; i < 256; i++) {
+    tag[tag.length - 1] = i;
+    try {
+      return groupHash(tag, personalization);
+    } catch (e) {}
+  }
+  throw new Error('findGroupHash tag overflow');
+}

curve-definitions/src/nist.ts

@@ -1,190 +0,0 @@
-/*! @noble/curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-import { hmac } from '@noble/hashes/hmac';
-import { sha256 } from '@noble/hashes/sha256';
-import { sha384, sha512 } from '@noble/hashes/sha512';
-import { concatBytes, randomBytes } from '@noble/hashes/utils';
-import { weierstrass, CHash } from '@noble/curves/shortw';
-import { mod, pow2 } from '@noble/curves/modular';
-
-function getHash(hash: CHash) {
-  return {
-    hash,
-    hmac: (key: Uint8Array, ...msgs: Uint8Array[]) => hmac(hash, key, concatBytes(...msgs)),
-    randomBytes,
-  };
-}
-
-// https://www.secg.org/sec2-v2.pdf
-// https://neuromancer.sk/std/secg/secp192r1
-export const P192 = weierstrass({
-  // Params: a, b
-  a: BigInt('0xfffffffffffffffffffffffffffffffefffffffffffffffc'),
-  b: BigInt('0x64210519e59c80e70fa7e9ab72243049feb8deecc146b9b1'),
-  // Field over which we'll do calculations. Verify with: 2n ** 192n - 2n ** 64n - 1n
-  P: BigInt('0xfffffffffffffffffffffffffffffffeffffffffffffffff'),
-  // Curve order, total count of valid points in the field. Verify with:
-  n: BigInt('0xffffffffffffffffffffffff99def836146bc9b1b4d22831'),
-  // Base point (x, y) aka generator point
-  Gx: BigInt('0x188da80eb03090f67cbf20eb43a18800f4ff0afd82ff1012'),
-  Gy: BigInt('0x07192b95ffc8da78631011ed6b24cdd573f977a11e794811'),
-  lowS: false,
-  // Default options
-  ...getHash(sha256),
-} as const);
-export const secp192r1 = P192;
-// https://neuromancer.sk/std/nist/P-224
-export const P224 = weierstrass({
-  // Params: a, b
-  a: BigInt('0xfffffffffffffffffffffffffffffffefffffffffffffffffffffffe'),
-  b: BigInt('0xb4050a850c04b3abf54132565044b0b7d7bfd8ba270b39432355ffb4'),
-  // Field over which we'll do calculations. Verify with:
-  P: 2n ** 224n - 2n ** 96n + 1n,
-  // Curve order, total count of valid points in the field. Verify with:
-  n: BigInt('0xffffffffffffffffffffffffffff16a2e0b8f03e13dd29455c5c2a3d'),
-  // Base point (x, y) aka generator point
-  Gx: BigInt('0xb70e0cbd6bb4bf7f321390b94a03c1d356c21122343280d6115c1d21'),
-  Gy: BigInt('0xbd376388b5f723fb4c22dfe6cd4375a05a07476444d5819985007e34'),
-  lowS: false,
-  // Default options
-  ...getHash(sha256),
-} as const);
-export const secp224r1 = P224;
-// https://neuromancer.sk/std/nist/P-256
-export const P256 = weierstrass({
-  // Params: a, b
-  a: BigInt('0xffffffff00000001000000000000000000000000fffffffffffffffffffffffc'),
-  b: BigInt('0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b'),
-  // Field over which we'll do calculations. Verify with:
-  // 2n ** 224n * (2n ** 32n - 1n) + 2n ** 192n + 2n ** 96n - 1n,
-  P: BigInt('0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff'),
-  // Curve order, total count of valid points in the field. Verify with:
-  n: BigInt('0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551'),
-  // Base point (x, y) aka generator point
-  Gx: BigInt('0x6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296'),
-  Gy: BigInt('0x4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5'),
-  lowS: false,
-  // Default options
-  ...getHash(sha256),
-} as const);
-export const secp256r1 = P256;
-// https://neuromancer.sk/std/nist/P-384
-// prettier-ignore
-export const P384 = weierstrass({
-  // Params: a, b
-  a: BigInt('0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffff0000000000000000fffffffc'),
-  b: BigInt('0xb3312fa7e23ee7e4988e056be3f82d19181d9c6efe8141120314088f5013875ac656398d8a2ed19d2a85c8edd3ec2aef'),
-  // Field over which we'll do calculations. Verify with:
-  // 2n ** 384n - 2n ** 128n - 2n ** 96n + 2n ** 32n - 1n
-  P: BigInt('0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffff0000000000000000ffffffff'),
-  // Curve order, total count of valid points in the field. Verify with:
-  n: BigInt('0xffffffffffffffffffffffffffffffffffffffffffffffffc7634d81f4372ddf581a0db248b0a77aecec196accc52973'),
-  // Base point (x, y) aka generator point
-  Gx: BigInt('0xaa87ca22be8b05378eb1c71ef320ad746e1d3b628ba79b9859f741e082542a385502f25dbf55296c3a545e3872760ab7'),
-  Gy: BigInt('0x3617de4a96262c6f5d9e98bf9292dc29f8f41dbd289a147ce9da3113b5f0b8c00a60b1ce1d7e819d7a431d7c90ea0e5f'),
-  lowS: false,
-  // Default options
-  ...getHash(sha384),
-} as const);
-export const secp384r1 = P384;
-// https://neuromancer.sk/std/nist/P-521
-// prettier-ignore
-export const P521 = weierstrass({
-  // Params: a, b
-  a: BigInt('0x01fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc'),
-  b: BigInt('0x0051953eb9618e1c9a1f929a21a0b68540eea2da725b99b315f3b8b489918ef109e156193951ec7e937b1652c0bd3bb1bf073573df883d2c34f1ef451fd46b503f00'),
-  // Field over which we'll do calculations. Verify with:
-  // 2n ** 521n - 1n,
-  P: BigInt('0x1ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'),
-  // Curve order, total count of valid points in the field. Verify with:
-  n: BigInt('0x01fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffa51868783bf2f966b7fcc0148f709a5d03bb5c9b8899c47aebb6fb71e91386409'),
-  // Base point (x, y) aka generator point
-  Gx: BigInt('0x00c6858e06b70404e9cd9e3ecb662395b4429c648139053fb521f828af606b4d3dbaa14b5e77efe75928fe1dc127a2ffa8de3348b3c1856a429bf97e7e31c2e5bd66'),
-  Gy: BigInt('0x011839296a789a3bc0045c8a5fb42c7d1bd998f54449579b446817afbd17273e662c97ee72995ef42640c550b9013fad0761353c7086a272c24088be94769fd16650'),
-  lowS: false,
-  // Default options
-  ...getHash(sha512),
-} as const);
-export const secp521r1 = P521;
-
-/**
- * secp256k1 definition with efficient square root and endomorphism.
- * Endomorphism works only for Koblitz curves with a == 0.
- * It improves efficiency:
- * Uses 2x less RAM, speeds up precomputation by 2x and ECDH / sign key recovery by 20%.
- * Should always be used for Jacobian's double-and-add multiplication.
- * For affines cached multiplication, it trades off 1/2 init time & 1/3 ram for 20% perf hit.
- * https://gist.github.com/paulmillr/eb670806793e84df628a7c434a873066
- */
-const secp256k1P = BigInt('0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f');
-const secp256k1N = BigInt('0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141');
-const _1n = BigInt(1);
-const _2n = BigInt(2);
-const divNearest = (a: bigint, b: bigint) => (a + b / _2n) / b;
-export const secp256k1 = weierstrass({
-  a: 0n,
-  b: 7n,
-  // Field over which we'll do calculations. Verify with:
-  // 2n ** 256n - 2n ** 32n - 2n ** 9n - 2n ** 8n - 2n ** 7n - 2n ** 6n - 2n ** 4n - 1n
-  P: secp256k1P,
-  // Curve order, total count of valid points in the field. Verify with:
-  n: secp256k1N,
-  // Base point (x, y) aka generator point
-  Gx: BigInt('55066263022277343669578718895168534326250603453777594175500187360389116729240'),
-  Gy: BigInt('32670510020758816978083085130507043184471273380659243275938904335757337482424'),
-  ...getHash(sha256),
-  // noble-secp256k1 compat
-  lowS: true,
-  // Used to calculate y - the square root of y².
-  // Exponentiates it to very big number (P+1)/4.
-  // We are unwrapping the loop because it's 2x faster.
-  // (P+1n/4n).toString(2) would produce bits [223x 1, 0, 22x 1, 4x 0, 11, 00]
-  // We are multiplying it bit-by-bit
-  sqrtMod: (x: bigint): bigint => {
-    const P = secp256k1P;
-    const _3n = BigInt(3);
-    const _6n = BigInt(6);
-    const _11n = BigInt(11);
-    const _22n = BigInt(22);
-    const _23n = BigInt(23);
-    const _44n = BigInt(44);
-    const _88n = BigInt(88);
-    const b2 = (x * x * x) % P; // x^3, 11
-    const b3 = (b2 * b2 * x) % P; // x^7
-    const b6 = (pow2(b3, _3n, P) * b3) % P;
-    const b9 = (pow2(b6, _3n, P) * b3) % P;
-    const b11 = (pow2(b9, _2n, P) * b2) % P;
-    const b22 = (pow2(b11, _11n, P) * b11) % P;
-    const b44 = (pow2(b22, _22n, P) * b22) % P;
-    const b88 = (pow2(b44, _44n, P) * b44) % P;
-    const b176 = (pow2(b88, _88n, P) * b88) % P;
-    const b220 = (pow2(b176, _44n, P) * b44) % P;
-    const b223 = (pow2(b220, _3n, P) * b3) % P;
-    const t1 = (pow2(b223, _23n, P) * b22) % P;
-    const t2 = (pow2(t1, _6n, P) * b2) % P;
-    return pow2(t2, _2n, P);
-  },
-  endo: {
-    beta: BigInt('0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee'),
-    splitScalar: (k: bigint) => {
-      const n = secp256k1N;
-      const a1 = BigInt('0x3086d221a7d46bcde86c90e49284eb15');
-      const b1 = -_1n * BigInt('0xe4437ed6010e88286f547fa90abfe4c3');
-      const a2 = BigInt('0x114ca50f7a8e2f3f657c1108d9d44cfd8');
-      const b2 = a1;
-      const POW_2_128 = BigInt('0x100000000000000000000000000000000');
-
-      const c1 = divNearest(b2 * k, n);
-      const c2 = divNearest(-b1 * k, n);
-      let k1 = mod(k - c1 * a1 - c2 * a2, n);
-      let k2 = mod(-c1 * b1 - c2 * b2, n);
-      const k1neg = k1 > POW_2_128;
-      const k2neg = k2 > POW_2_128;
-      if (k1neg) k1 = n - k1;
-      if (k2neg) k2 = n - k2;
-      if (k1 > POW_2_128 || k2 > POW_2_128) {
-        throw new Error('splitScalar: Endomorphism failed, k=' + k);
-      }
-      return { k1neg, k1, k2neg, k2 };
-    },
-  },
-});

curve-definitions/src/p192.ts

@@ -0,0 +1,24 @@
+/*! @noble/curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+import { createCurve } from './_shortw_utils.js';
+import { sha256 } from '@noble/hashes/sha256';
+
+// NIST secp192r1 aka P192
+// https://www.secg.org/sec2-v2.pdf, https://neuromancer.sk/std/secg/secp192r1
+export const P192 = createCurve(
+  {
+    // Params: a, b
+    a: BigInt('0xfffffffffffffffffffffffffffffffefffffffffffffffc'),
+    b: BigInt('0x64210519e59c80e70fa7e9ab72243049feb8deecc146b9b1'),
+    // Field over which we'll do calculations; 2n ** 192n - 2n ** 64n - 1n
+    P: BigInt('0xfffffffffffffffffffffffffffffffeffffffffffffffff'),
+    // Curve order, total count of valid points in the field.
+    n: BigInt('0xffffffffffffffffffffffff99def836146bc9b1b4d22831'),
+    // Base point (x, y) aka generator point
+    Gx: BigInt('0x188da80eb03090f67cbf20eb43a18800f4ff0afd82ff1012'),
+    Gy: BigInt('0x07192b95ffc8da78631011ed6b24cdd573f977a11e794811'),
+    h: BigInt(1),
+    lowS: false,
+  } as const,
+  sha256
+);
+export const secp192r1 = P192;

curve-definitions/src/p224.ts

@@ -0,0 +1,24 @@
+/*! @noble/curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+import { createCurve } from './_shortw_utils.js';
+import { sha256 } from '@noble/hashes/sha256';
+
+// NIST secp224r1 aka P224
+// https://www.secg.org/sec2-v2.pdf, https://neuromancer.sk/std/nist/P-224
+export const P224 = createCurve(
+  {
+    // Params: a, b
+    a: BigInt('0xfffffffffffffffffffffffffffffffefffffffffffffffffffffffe'),
+    b: BigInt('0xb4050a850c04b3abf54132565044b0b7d7bfd8ba270b39432355ffb4'),
+    // Field over which we'll do calculations; 2n**224n - 2n**96n + 1n
+    P: BigInt('0xffffffffffffffffffffffffffffffff000000000000000000000001'),
+    // Curve order, total count of valid points in the field
+    n: BigInt('0xffffffffffffffffffffffffffff16a2e0b8f03e13dd29455c5c2a3d'),
+    // Base point (x, y) aka generator point
+    Gx: BigInt('0xb70e0cbd6bb4bf7f321390b94a03c1d356c21122343280d6115c1d21'),
+    Gy: BigInt('0xbd376388b5f723fb4c22dfe6cd4375a05a07476444d5819985007e34'),
+    h: BigInt(1),
+    lowS: false,
+  } as const,
+  sha256 // TODO: replace with sha224 when new @noble/hashes released
+);
+export const secp224r1 = P224;

curve-definitions/src/p256.ts

@@ -0,0 +1,24 @@
+/*! @noble/curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+import { createCurve } from './_shortw_utils.js';
+import { sha256 } from '@noble/hashes/sha256';
+
+// NIST secp256r1 aka P256
+// https://www.secg.org/sec2-v2.pdf, https://neuromancer.sk/std/nist/P-256
+export const P256 = createCurve(
+  {
+    // Params: a, b
+    a: BigInt('0xffffffff00000001000000000000000000000000fffffffffffffffffffffffc'),
+    b: BigInt('0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b'),
+    // Field over which we'll do calculations; 2n**224n * (2n**32n-1n) + 2n**192n + 2n**96n-1n
+    P: BigInt('0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff'),
+    // Curve order, total count of valid points in the field
+    n: BigInt('0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551'),
+    // Base point (x, y) aka generator point
+    Gx: BigInt('0x6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296'),
+    Gy: BigInt('0x4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5'),
+    h: BigInt(1),
+    lowS: false,
+  } as const,
+  sha256
+);
+export const secp256r1 = P256;

curve-definitions/src/p384.ts

@@ -0,0 +1,22 @@
+/*! @noble/curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+import { createCurve } from './_shortw_utils.js';
+import { sha384 } from '@noble/hashes/sha512';
+
+// NIST secp384r1 aka P384
+// https://www.secg.org/sec2-v2.pdf, https://neuromancer.sk/std/nist/P-384
+// prettier-ignore
+export const P384 = createCurve({
+  // Params: a, b
+  a: BigInt('0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffff0000000000000000fffffffc'),
+  b: BigInt('0xb3312fa7e23ee7e4988e056be3f82d19181d9c6efe8141120314088f5013875ac656398d8a2ed19d2a85c8edd3ec2aef'),
+  // Field over which we'll do calculations. 2n**384n - 2n**128n - 2n**96n + 2n**32n - 1n
+  P: BigInt('0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffff0000000000000000ffffffff'),
+  // Curve order, total count of valid points in the field.
+  n: BigInt('0xffffffffffffffffffffffffffffffffffffffffffffffffc7634d81f4372ddf581a0db248b0a77aecec196accc52973'),
+  // Base point (x, y) aka generator point
+  Gx: BigInt('0xaa87ca22be8b05378eb1c71ef320ad746e1d3b628ba79b9859f741e082542a385502f25dbf55296c3a545e3872760ab7'),
+  Gy: BigInt('0x3617de4a96262c6f5d9e98bf9292dc29f8f41dbd289a147ce9da3113b5f0b8c00a60b1ce1d7e819d7a431d7c90ea0e5f'),
+  h: BigInt(1),
+  lowS: false,
+} as const, sha384);
+export const secp384r1 = P384;

curve-definitions/src/p521.ts

@@ -0,0 +1,23 @@
+/*! @noble/curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+import { createCurve } from './_shortw_utils.js';
+import { sha512 } from '@noble/hashes/sha512';
+
+// NIST secp521r1 aka P521
+// Note that it's 521, which differs from 512 of its hash function.
+// https://www.secg.org/sec2-v2.pdf, https://neuromancer.sk/std/nist/P-521
+// prettier-ignore
+export const P521 = createCurve({
+  // Params: a, b
+  a: BigInt('0x01fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc'),
+  b: BigInt('0x0051953eb9618e1c9a1f929a21a0b68540eea2da725b99b315f3b8b489918ef109e156193951ec7e937b1652c0bd3bb1bf073573df883d2c34f1ef451fd46b503f00'),
+  // Field over which we'll do calculations; 2n**521n - 1n
+  P: BigInt('0x1ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'),
+  // Curve order, total count of valid points in the field
+  n: BigInt('0x01fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffa51868783bf2f966b7fcc0148f709a5d03bb5c9b8899c47aebb6fb71e91386409'),
+  // Base point (x, y) aka generator point
+  Gx: BigInt('0x00c6858e06b70404e9cd9e3ecb662395b4429c648139053fb521f828af606b4d3dbaa14b5e77efe75928fe1dc127a2ffa8de3348b3c1856a429bf97e7e31c2e5bd66'),
+  Gy: BigInt('0x011839296a789a3bc0045c8a5fb42c7d1bd998f54449579b446817afbd17273e662c97ee72995ef42640c550b9013fad0761353c7086a272c24088be94769fd16650'),
+  h: BigInt(1),
+  lowS: false,
+} as const, sha512);
+export const secp521r1 = P521;

curve-definitions/src/pasta.ts

@@ -1,35 +1,31 @@
 /*! @noble/curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-import { hmac } from '@noble/hashes/hmac';
 import { sha256 } from '@noble/hashes/sha256';
-import { concatBytes, randomBytes } from '@noble/hashes/utils';
-import { weierstrass, CHash } from '@noble/curves/shortw';
+import { weierstrass } from '@noble/curves/weierstrass';
+import { getHash } from './_shortw_utils.js';
+import * as mod from '@noble/curves/modular';
 
-function getHash(hash: CHash) {
-  return {
-    hash,
-    hmac: (key: Uint8Array, ...msgs: Uint8Array[]) => hmac(hash, key, concatBytes(...msgs)),
-    randomBytes,
-  };
-}
 const p = BigInt('0x40000000000000000000000000000000224698fc094cf91b992d30ed00000001');
 const q = BigInt('0x40000000000000000000000000000000224698fc0994a8dd8c46eb2100000001');
 
+// https://neuromancer.sk/std/other/Pallas
 export const pallas = weierstrass({
   a: BigInt(0),
   b: BigInt(5),
   P: p,
   n: q,
-  Gx: BigInt(-1),
+  Gx: mod.mod(BigInt(-1), p),
   Gy: BigInt(2),
+  h: BigInt(1),
   ...getHash(sha256),
 });
-
+// https://neuromancer.sk/std/other/Vesta
 export const vesta = weierstrass({
   a: BigInt(0),
   b: BigInt(5),
   P: q,
   n: p,
-  Gx: BigInt(-1),
+  Gx: mod.mod(BigInt(-1), q),
   Gy: BigInt(2),
+  h: BigInt(1),
   ...getHash(sha256),
 });

curve-definitions/src/secp256k1.ts

@@ -0,0 +1,262 @@
+/*! @noble/curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+import { sha256 } from '@noble/hashes/sha256';
+import { mod, pow2 } from '@noble/curves/modular';
+import { createCurve } from './_shortw_utils.js';
+import { PointType } from '@noble/curves/weierstrass';
+import {
+  ensureBytes,
+  concatBytes,
+  Hex,
+  hexToBytes,
+  bytesToNumberBE,
+  PrivKey,
+} from '@noble/curves/utils';
+import { randomBytes } from '@noble/hashes/utils';
+
+/**
+ * secp256k1 belongs to Koblitz curves: it has
+ * efficiently computable Frobenius endomorphism.
+ * Endomorphism improves efficiency:
+ * Uses 2x less RAM, speeds up precomputation by 2x and ECDH / sign key recovery by 20%.
+ * Should always be used for Jacobian's double-and-add multiplication.
+ * For affines cached multiplication, it trades off 1/2 init time & 1/3 ram for 20% perf hit.
+ * https://gist.github.com/paulmillr/eb670806793e84df628a7c434a873066
+ */
+
+const secp256k1P = BigInt('0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f');
+const secp256k1N = BigInt('0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141');
+const _1n = BigInt(1);
+const _2n = BigInt(2);
+const divNearest = (a: bigint, b: bigint) => (a + b / _2n) / b;
+
+/**
+ * Allows to compute square root √y 2x faster.
+ * To calculate √y, we need to exponentiate it to a very big number:
+ * `y² = x³ + ax + b; y = y² ^ (p+1)/4`
+ * We are unwrapping the loop and multiplying it bit-by-bit.
+ * (P+1n/4n).toString(2) would produce bits [223x 1, 0, 22x 1, 4x 0, 11, 00]
+ */
+// prettier-ignore
+function sqrtMod(y: bigint): bigint {
+  const P = secp256k1P;
+  const _3n = BigInt(3), _6n = BigInt(6), _11n = BigInt(11); const _22n = BigInt(22);
+  const _23n = BigInt(23), _44n = BigInt(44), _88n = BigInt(88);
+  const b2 = (y * y * y) % P; // x^3, 11
+  const b3 = (b2 * b2 * y) % P; // x^7
+  const b6 = (pow2(b3, _3n, P) * b3) % P;
+  const b9 = (pow2(b6, _3n, P) * b3) % P;
+  const b11 = (pow2(b9, _2n, P) * b2) % P;
+  const b22 = (pow2(b11, _11n, P) * b11) % P;
+  const b44 = (pow2(b22, _22n, P) * b22) % P;
+  const b88 = (pow2(b44, _44n, P) * b44) % P;
+  const b176 = (pow2(b88, _88n, P) * b88) % P;
+  const b220 = (pow2(b176, _44n, P) * b44) % P;
+  const b223 = (pow2(b220, _3n, P) * b3) % P;
+  const t1 = (pow2(b223, _23n, P) * b22) % P;
+  const t2 = (pow2(t1, _6n, P) * b2) % P;
+  return pow2(t2, _2n, P);
+}
+
+export const secp256k1 = createCurve(
+  {
+    // Params: a, b
+    // Seem to be rigid https://bitcointalk.org/index.php?topic=289795.msg3183975#msg3183975
+    a: BigInt(0),
+    b: BigInt(7),
+    // Field over which we'll do calculations;
+    // 2n**256n - 2n**32n - 2n**9n - 2n**8n - 2n**7n - 2n**6n - 2n**4n - 1n
+    P: secp256k1P,
+    // Curve order, total count of valid points in the field
+    n: secp256k1N,
+    // Base point (x, y) aka generator point
+    Gx: BigInt('55066263022277343669578718895168534326250603453777594175500187360389116729240'),
+    Gy: BigInt('32670510020758816978083085130507043184471273380659243275938904335757337482424'),
+    h: BigInt(1),
+    // Alllow only low-S signatures by default in sign() and verify()
+    lowS: true,
+    sqrtMod,
+    endo: {
+      // Params taken from https://gist.github.com/paulmillr/eb670806793e84df628a7c434a873066
+      beta: BigInt('0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee'),
+      splitScalar: (k: bigint) => {
+        const n = secp256k1N;
+        const a1 = BigInt('0x3086d221a7d46bcde86c90e49284eb15');
+        const b1 = -_1n * BigInt('0xe4437ed6010e88286f547fa90abfe4c3');
+        const a2 = BigInt('0x114ca50f7a8e2f3f657c1108d9d44cfd8');
+        const b2 = a1;
+        const POW_2_128 = BigInt('0x100000000000000000000000000000000');
+
+        const c1 = divNearest(b2 * k, n);
+        const c2 = divNearest(-b1 * k, n);
+        let k1 = mod(k - c1 * a1 - c2 * a2, n);
+        let k2 = mod(-c1 * b1 - c2 * b2, n);
+        const k1neg = k1 > POW_2_128;
+        const k2neg = k2 > POW_2_128;
+        if (k1neg) k1 = n - k1;
+        if (k2neg) k2 = n - k2;
+        if (k1 > POW_2_128 || k2 > POW_2_128) {
+          throw new Error('splitScalar: Endomorphism failed, k=' + k);
+        }
+        return { k1neg, k1, k2neg, k2 };
+      },
+    },
+  },
+  sha256
+);
+
+// Schnorr
+const _0n = BigInt(0);
+const numTo32b = secp256k1.utils._bigintToBytes;
+const numTo32bStr = secp256k1.utils._bigintToString;
+const normalizePrivateKey = secp256k1.utils._normalizePrivateKey;
+
+// TODO: export?
+function normalizePublicKey(publicKey: Hex | PointType): PointType {
+  if (publicKey instanceof secp256k1.Point) {
+    publicKey.assertValidity();
+    return publicKey;
+  } else {
+    const bytes = ensureBytes(publicKey);
+    // Schnorr is 32 bytes
+    if (bytes.length === 32) {
+      const x = bytesToNumberBE(bytes);
+      if (!isValidFieldElement(x)) throw new Error('Point is not on curve');
+      const y2 = secp256k1.utils._weierstrassEquation(x); // y² = x³ + ax + b
+      let y = sqrtMod(y2); // y = y² ^ (p+1)/4
+      const isYOdd = (y & _1n) === _1n;
+      // Schnorr
+      if (isYOdd) y = mod(-y, secp256k1.CURVE.P);
+      const point = new secp256k1.Point(x, y);
+      point.assertValidity();
+      return point;
+    }
+    // Do we need that in schnorr at all?
+    return secp256k1.Point.fromHex(publicKey);
+  }
+}
+
+const isWithinCurveOrder = secp256k1.utils._isWithinCurveOrder;
+const isValidFieldElement = secp256k1.utils._isValidFieldElement;
+
+const TAGS = {
+  challenge: 'BIP0340/challenge',
+  aux: 'BIP0340/aux',
+  nonce: 'BIP0340/nonce',
+} as const;
+
+/** An object mapping tags to their tagged hash prefix of [SHA256(tag) | SHA256(tag)] */
+const TAGGED_HASH_PREFIXES: { [tag: string]: Uint8Array } = {};
+export function taggedHash(tag: string, ...messages: Uint8Array[]): Uint8Array {
+  let tagP = TAGGED_HASH_PREFIXES[tag];
+  if (tagP === undefined) {
+    const tagH = sha256(Uint8Array.from(tag, (c) => c.charCodeAt(0)));
+    tagP = concatBytes(tagH, tagH);
+    TAGGED_HASH_PREFIXES[tag] = tagP;
+  }
+  return sha256(concatBytes(tagP, ...messages));
+}
+
+const toRawX = (point: PointType) => point.toRawBytes(true).slice(1);
+
+// Schnorr signatures are superior to ECDSA from above.
+// Below is Schnorr-specific code as per BIP0340.
+function schnorrChallengeFinalize(ch: Uint8Array): bigint {
+  return mod(bytesToNumberBE(ch), secp256k1.CURVE.n);
+}
+// Do we need this at all for Schnorr?
+class SchnorrSignature {
+  constructor(readonly r: bigint, readonly s: bigint) {
+    this.assertValidity();
+  }
+  static fromHex(hex: Hex) {
+    const bytes = ensureBytes(hex);
+    if (bytes.length !== 64)
+      throw new TypeError(`SchnorrSignature.fromHex: expected 64 bytes, not ${bytes.length}`);
+    const r = bytesToNumberBE(bytes.subarray(0, 32));
+    const s = bytesToNumberBE(bytes.subarray(32, 64));
+    return new SchnorrSignature(r, s);
+  }
+  assertValidity() {
+    const { r, s } = this;
+    if (!isValidFieldElement(r) || !isWithinCurveOrder(s)) throw new Error('Invalid signature');
+  }
+  toHex(): string {
+    return numTo32bStr(this.r) + numTo32bStr(this.s);
+  }
+  toRawBytes(): Uint8Array {
+    return hexToBytes(this.toHex());
+  }
+}
+
+function schnorrGetScalar(priv: bigint) {
+  const point = secp256k1.Point.fromPrivateKey(priv);
+  const scalar = point.hasEvenY() ? priv : secp256k1.CURVE.n - priv;
+  return { point, scalar, x: toRawX(point) };
+}
+/**
+ * Synchronously creates Schnorr signature. Improved security: verifies itself before
+ * producing an output.
+ * @param msg message (not message hash)
+ * @param privateKey private key
+ * @param auxRand random bytes that would be added to k. Bad RNG won't break it.
+ */
+function schnorrSign(
+  message: Hex,
+  privateKey: PrivKey,
+  auxRand: Hex = randomBytes(32)
+): Uint8Array {
+  if (message == null) throw new TypeError(`sign: Expected valid message, not "${message}"`);
+  const m = ensureBytes(message);
+  // checks for isWithinCurveOrder
+  const { x: px, scalar: d } = schnorrGetScalar(normalizePrivateKey(privateKey));
+  const rand = ensureBytes(auxRand);
+  if (rand.length !== 32) throw new TypeError('sign: Expected 32 bytes of aux randomness');
+  const tag = taggedHash;
+  const t0h = tag(TAGS.aux, rand);
+  const t = numTo32b(d ^ bytesToNumberBE(t0h));
+  const k0h = tag(TAGS.nonce, t, px, m);
+  const k0 = mod(bytesToNumberBE(k0h), secp256k1.CURVE.n);
+  if (k0 === _0n) throw new Error('sign: Creation of signature failed. k is zero');
+  const { point: R, x: rx, scalar: k } = schnorrGetScalar(k0);
+  const e = schnorrChallengeFinalize(tag(TAGS.challenge, rx, px, m));
+  const sig = new SchnorrSignature(R.x, mod(k + e * d, secp256k1.CURVE.n)).toRawBytes();
+  if (!schnorrVerify(sig, m, px)) throw new Error('sign: Invalid signature produced');
+  return sig;
+}
+
+/**
+ * Verifies Schnorr signature synchronously.
+ */
+function schnorrVerify(signature: Hex, message: Hex, publicKey: Hex): boolean {
+  try {
+    const raw = signature instanceof SchnorrSignature;
+    const sig: SchnorrSignature = raw ? signature : SchnorrSignature.fromHex(signature);
+    if (raw) sig.assertValidity(); // just in case
+
+    const { r, s } = sig;
+    const m = ensureBytes(message);
+    const P = normalizePublicKey(publicKey);
+    const e = schnorrChallengeFinalize(taggedHash(TAGS.challenge, numTo32b(r), toRawX(P), m));
+    // Finalize
+    // R = s⋅G - e⋅P
+    // -eP == (n-e)P
+    const R = secp256k1.Point.BASE.multiplyAndAddUnsafe(
+      P,
+      normalizePrivateKey(s),
+      mod(-e, secp256k1.CURVE.n)
+    );
+    if (!R || !R.hasEvenY() || R.x !== r) return false;
+    return true;
+  } catch (error) {
+    return false;
+  }
+}
+
+export const schnorr = {
+  Signature: SchnorrSignature,
+  // Schnorr's pubkey is just `x` of Point (BIP340)
+  getPublicKey: (privateKey: PrivKey): Uint8Array =>
+    toRawX(secp256k1.Point.fromPrivateKey(privateKey)),
+  sign: schnorrSign,
+  verify: schnorrVerify,
+};

curve-definitions/src/stark.ts

@@ -3,9 +3,13 @@ import { keccak_256 } from '@noble/hashes/sha3';
 import { sha256 } from '@noble/hashes/sha256';
 import { hmac } from '@noble/hashes/hmac';
 import { concatBytes, randomBytes } from '@noble/hashes/utils';
-import { weierstrass, CHash, JacobianPointType } from '@noble/curves/shortw';
+import { weierstrass, CHash, JacobianPointType } from '@noble/curves/weierstrass';
 import * as cutils from '@noble/curves/utils';
 
+// Stark-friendly elliptic curve
+// https://docs.starkware.co/starkex/stark-curve.html
+// TODO: clarify exports; it is exporting both starkCurve and sign() now, can be confusing
+
 function getHash(hash: CHash) {
   return {
     hash,
@@ -14,22 +18,24 @@ function getHash(hash: CHash) {
   };
 }
 
-const CURVE_N = 3618502788666131213697322783095070105526743751716087489154079457884512865583n;
+const CURVE_N = BigInt(
+  '3618502788666131213697322783095070105526743751716087489154079457884512865583'
+);
 const nBitLength = 252;
-// https://docs.starkware.co/starkex/stark-curve.html
 export const starkCurve = weierstrass({
   // Params: a, b
-  a: 1n,
-  b: 3141592653589793238462643383279502884197169399375105820974944592307816406665n,
-  // Field over which we'll do calculations. Verify with:
-  // NOTE: there is no efficient sqrt for field (P%4==1)
-  P: 2n ** 251n + 17n * 2n ** 192n + 1n,
-  // Curve order, total count of valid points in the field. Verify with:
+  a: BigInt(1),
+  b: BigInt('3141592653589793238462643383279502884197169399375105820974944592307816406665'),
+  // Field over which we'll do calculations; 2n**251n + 17n * 2n**192n + 1n
+  // There is no efficient sqrt for field (P%4==1)
+  P: BigInt('0x800000000000011000000000000000000000000000000000000000000000001'),
+  // Curve order, total count of valid points in the field.
   n: CURVE_N,
   nBitLength: nBitLength, // len(bin(N).replace('0b',''))
   // Base point (x, y) aka generator point
-  Gx: 874739451078007766457464989774322083649278607533249481151382481072868806602n,
-  Gy: 152666792071518830868575557812948353041420400780739481342941381225525861407n,
+  Gx: BigInt('874739451078007766457464989774322083649278607533249481151382481072868806602'),
+  Gy: BigInt('152666792071518830868575557812948353041420400780739481342941381225525861407'),
+  h: BigInt(1),
   // Default options
   lowS: false,
   ...getHash(sha256),

curve-definitions/test/basic.test.js

@@ -1,95 +1,315 @@
 import { deepStrictEqual, throws } from 'assert';
 import { should } from 'micro-should';
-import * as nist from '../lib/nist.js';
-import { hexToBytes } from '@noble/curves/utils';
-import { default as ecdsa } from './fixtures/ecdsa_test.json' assert { type: 'json' };
-import { default as ecdh } from './fixtures/ecdh_test.json' assert { type: 'json' };
+import * as fc from 'fast-check';
+import * as mod from '@noble/curves/modular';
+import { randomBytes } from '@noble/hashes/utils';
+// Generic tests for all curves in package
+import { secp192r1 } from '../lib/p192.js';
+import { secp224r1 } from '../lib/p224.js';
+import { secp256r1 } from '../lib/p256.js';
+import { secp384r1 } from '../lib/p384.js';
+import { secp521r1 } from '../lib/p521.js';
+import { secp256k1 } from '../lib/secp256k1.js';
+import { ed25519, ed25519ctx, ed25519ph } from '../lib/ed25519.js';
+import { ed448, ed448ph } from '../lib/ed448.js';
+import { starkCurve } from '../lib/stark.js';
+import { pallas, vesta } from '../lib/pasta.js';
+import { bn254 } from '../lib/bn.js';
+import { jubjub } from '../lib/jubjub.js';
 
-// import { hexToBytes } from '@noble/curves';
+// prettier-ignore
+const CURVES = {
+  secp192r1, secp224r1, secp256r1, secp384r1, secp521r1,
+  secp256k1,
+  ed25519, ed25519ctx, ed25519ph,
+  ed448, ed448ph,
+  starkCurve,
+  pallas, vesta,
+  bn254,
+  jubjub,
+};
 
-should('Curve Fields', () => {
-  const vectors = {
-    secp192r1: 0xfffffffffffffffffffffffffffffffeffffffffffffffffn,
-    secp224r1: 0xffffffffffffffffffffffffffffffff000000000000000000000001n,
-    secp256r1: 0xffffffff00000001000000000000000000000000ffffffffffffffffffffffffn,
-    secp256k1: 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2fn,
-    secp384r1:
-      0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffff0000000000000000ffffffffn,
-    secp521r1:
-      0x01ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffn,
-  };
-  for (const n in vectors) deepStrictEqual(nist[n].CURVE.P, vectors[n]);
-});
+const NUM_RUNS = 5;
+const getXY = (p) => ({ x: p.x, y: p.y });
 
-should('wychenproof ECDSA vectors', () => {
-  for (const group of ecdsa.testGroups) {
-    // Tested in secp256k1.test.js
-    if (group.key.curve === 'secp256k1') continue;
-    // We don't have SHA-224
-    if (group.key.curve === 'secp224r1' && group.sha === 'SHA-224') continue;
-    const CURVE = nist[group.key.curve];
-    if (!CURVE) continue;
-    const pubKey = CURVE.Point.fromHex(group.key.uncompressed);
-    deepStrictEqual(pubKey.x, BigInt(`0x${group.key.wx}`));
-    deepStrictEqual(pubKey.y, BigInt(`0x${group.key.wy}`));
-    for (const test of group.tests) {
-      if (['Hash weaker than DL-group'].includes(test.comment)) {
-        continue;
+function equal(a, b, comment) {
+  deepStrictEqual(a.equals(b), true, `eq(${comment})`);
+  if (a.toAffine && b.toAffine) {
+    deepStrictEqual(getXY(a.toAffine()), getXY(b.toAffine()), `eqToAffine(${comment})`);
+  } else if (!a.toAffine && !b.toAffine) {
+    // Already affine
+    deepStrictEqual(getXY(a), getXY(b), `eqAffine(${comment})`);
+  } else throw new Error('Different point types');
+}
+
+for (const name in CURVES) {
+  const C = CURVES[name];
+  const CURVE_ORDER = C.CURVE.n;
+  const FC_BIGINT = fc.bigInt(1n + 1n, CURVE_ORDER - 1n);
+
+  // Check that curve doesn't accept points from other curves
+  const O = name === 'secp256k1' ? secp256r1 : secp256k1;
+  const POINTS = {};
+  const OTHER_POINTS = {};
+  for (const name of ['Point', 'JacobianPoint', 'ExtendedPoint', 'ProjectivePoint']) {
+    POINTS[name] = C[name];
+    OTHER_POINTS[name] = O[name];
   }
-      const m = CURVE.CURVE.hash(hexToBytes(test.msg));
-      if (test.result === 'valid' || test.result === 'acceptable') {
-        try {
-          CURVE.Signature.fromDER(test.sig);
-        } catch (e) {
-          // Some test has invalid signature which we don't accept
-          if (e.message.includes('Invalid signature: incorrect length')) continue;
-          throw e;
+
+  for (const pointName in POINTS) {
+    const p = POINTS[pointName];
+    const o = OTHER_POINTS[pointName];
+    if (!p) continue;
+
+    const G = [p.ZERO, p.BASE];
+    for (let i = 2; i < 10; i++) G.push(G[1].multiply(i));
+    // Here we check basic group laws, to verify that points works as group
+    should(`${name}/${pointName}/Basic group laws (zero)`, () => {
+      equal(G[0].double(), G[0], '(0*G).double() = 0');
+      equal(G[0].add(G[0]), G[0], '0*G + 0*G = 0');
+      equal(G[0].subtract(G[0]), G[0], '0*G - 0*G = 0');
+      equal(G[0].negate(), G[0], '-0 = 0');
+      for (let i = 0; i < G.length; i++) {
+        const p = G[i];
+        equal(p, p.add(G[0]), `${i}*G + 0 = ${i}*G`);
+        equal(G[0].multiply(i + 1), G[0], `${i + 1}*0 = 0`);
       }
-        const verified = CURVE.verify(test.sig, m, pubKey);
-        deepStrictEqual(verified, true, 'valid');
-      } else if (test.result === 'invalid') {
-        let failed = false;
+    });
+    should(`${name}/${pointName}/Basic group laws (one)`, () => {
+      equal(G[1].double(), G[2], '(1*G).double() = 2*G');
+      equal(G[1].subtract(G[1]), G[0], '1*G - 1*G = 0');
+      equal(G[1].add(G[1]), G[2], '1*G + 1*G = 2*G');
+    });
+    should(`${name}/${pointName}/Basic group laws (sanity tests)`, () => {
+      equal(G[2].double(), G[4], `(2*G).double() = 4*G`);
+      equal(G[2].add(G[2]), G[4], `2*G + 2*G = 4*G`);
+      equal(G[7].add(G[3].negate()), G[4], `7*G - 3*G = 4*G`);
+    });
+    should(`${name}/${pointName}/Basic group laws (addition commutativity)`, () => {
+      equal(G[4].add(G[3]), G[3].add(G[4]), `4*G + 3*G = 3*G + 4*G`);
+      equal(G[4].add(G[3]), G[3].add(G[2]).add(G[2]), `4*G + 3*G = 3*G + 2*G + 2*G`);
+    });
+    should(`${name}/${pointName}/Basic group laws (double)`, () => {
+      equal(G[3].double(), G[6], '(3*G).double() = 6*G');
+    });
+    should(`${name}/${pointName}/Basic group laws (multiply)`, () => {
+      equal(G[2].multiply(3), G[6], '(2*G).multiply(3) = 6*G');
+    });
+    should(`${name}/${pointName}/Basic group laws (same point addition)`, () => {
+      equal(G[3].add(G[3]), G[6], `3*G + 3*G = 6*G`);
+    });
+    should(`${name}/${pointName}/Basic group laws (same point (negative) addition)`, () => {
+      equal(G[3].add(G[3].negate()), G[0], '3*G + (- 3*G) = 0*G');
+      equal(G[3].subtract(G[3]), G[0], '3*G - 3*G = 0*G');
+    });
+    should(`${name}/${pointName}/Basic group laws (curve order)`, () => {
+      equal(G[1].multiply(CURVE_ORDER - 1n).add(G[1]), G[0], '(N-1)*G + G = 0');
+      equal(G[1].multiply(CURVE_ORDER - 1n).add(G[2]), G[1], '(N-1)*G + 2*G = 1*G');
+      equal(G[1].multiply(CURVE_ORDER - 2n).add(G[2]), G[0], '(N-2)*G + 2*G = 0');
+      const half = CURVE_ORDER / 2n;
+      const carry = CURVE_ORDER % 2n === 1n ? G[1] : G[0];
+      equal(G[1].multiply(half).double().add(carry), G[0], '((N/2) * G).double() = 0');
+    });
+    should(`${name}/${pointName}/Basic group laws (inversion)`, () => {
+      const a = 1234n;
+      const b = 5678n;
+      const c = a * b;
+      equal(G[1].multiply(a).multiply(b), G[1].multiply(c), 'a*b*G = c*G');
+      const inv = mod.invert(b, CURVE_ORDER);
+      equal(G[1].multiply(c).multiply(inv), G[1].multiply(a), 'c*G * (1/b)*G = a*G');
+    });
+    should(`${name}/${pointName}/Basic group laws (multiply, rand)`, () =>
+      fc.assert(
+        fc.property(FC_BIGINT, FC_BIGINT, (a, b) => {
+          const c = mod.mod(a + b, CURVE_ORDER);
+          if (c === CURVE_ORDER || c < 1n) return;
+          const pA = G[1].multiply(a);
+          const pB = G[1].multiply(b);
+          const pC = G[1].multiply(c);
+          equal(pA.add(pB), pB.add(pA), `pA + pB = pB + pA`);
+          equal(pA.add(pB), pC, `pA + pB = pC`);
+        }),
+        { numRuns: NUM_RUNS }
+      )
+    );
+    should(`${name}/${pointName}/Basic group laws (multiply2, rand)`, () =>
+      fc.assert(
+        fc.property(FC_BIGINT, FC_BIGINT, (a, b) => {
+          const c = mod.mod(a * b, CURVE_ORDER);
+          const pA = G[1].multiply(a);
+          const pB = G[1].multiply(b);
+          equal(pA.multiply(b), pB.multiply(a), `b*pA = a*pB`);
+          equal(pA.multiply(b), G[1].multiply(c), `b*pA = c*G`);
+        }),
+        { numRuns: NUM_RUNS }
+      )
+    );
+
+    for (const op of ['add', 'subtract']) {
+      should(`${name}/${pointName}/${op} type check`, () => {
+        throws(() => G[1][op](0), '0');
+        throws(() => G[1][op](0n), '0n');
+        G[1][op](G[2]);
+        throws(() => G[1][op](CURVE_ORDER), 'CURVE_ORDER');
+        throws(() => G[1][op](123.456), '123.456');
+        throws(() => G[1][op](true), 'true');
+        throws(() => G[1][op]('1'), "'1'");
+        throws(() => G[1][op]({ x: 1n, y: 1n, z: 1n, t: 1n }), '{ x: 1n, y: 1n, z: 1n, t: 1n }');
+        throws(() => G[1][op](new Uint8Array([])), 'ui8a([])');
+        throws(() => G[1][op](new Uint8Array([0])), 'ui8a([0])');
+        throws(() => G[1][op](new Uint8Array([1])), 'ui8a([1])');
+        throws(() => G[1][op](new Uint8Array(4096).fill(1)), 'ui8a(4096*[1])');
+        if (G[1].toAffine) throws(() => G[1][op](C.Point.BASE), `Point ${op} ${pointName}`);
+        throws(() => G[1][op](o.BASE), `${op}/other curve point`);
+      });
+    }
+
+    should(`${name}/${pointName}/equals type check`, () => {
+      throws(() => G[1].equals(0), '0');
+      throws(() => G[1].equals(0n), '0n');
+      deepStrictEqual(G[1].equals(G[2]), false, '1*G != 2*G');
+      deepStrictEqual(G[1].equals(G[1]), true, '1*G == 1*G');
+      deepStrictEqual(G[2].equals(G[2]), true, '2*G == 2*G');
+      throws(() => G[1].equals(CURVE_ORDER), 'CURVE_ORDER');
+      throws(() => G[1].equals(123.456), '123.456');
+      throws(() => G[1].equals(true), 'true');
+      throws(() => G[1].equals('1'), "'1'");
+      throws(() => G[1].equals({ x: 1n, y: 1n, z: 1n, t: 1n }), '{ x: 1n, y: 1n, z: 1n, t: 1n }');
+      throws(() => G[1].equals(new Uint8Array([])), 'ui8a([])');
+      throws(() => G[1].equals(new Uint8Array([0])), 'ui8a([0])');
+      throws(() => G[1].equals(new Uint8Array([1])), 'ui8a([1])');
+      throws(() => G[1].equals(new Uint8Array(4096).fill(1)), 'ui8a(4096*[1])');
+      if (G[1].toAffine) throws(() => G[1].equals(C.Point.BASE), `Point.equals(${pointName})`);
+      throws(() => G[1].equals(o.BASE), 'other curve point');
+    });
+
+    for (const op of ['multiply', 'multiplyUnsafe']) {
+      if (!p.BASE[op]) continue;
+      should(`${name}/${pointName}/${op} type check`, () => {
+        if (op !== 'multiplyUnsafe') {
+          throws(() => G[1][op](0), '0');
+          throws(() => G[1][op](0n), '0n');
+        }
+        G[1][op](1n);
+        G[1][op](CURVE_ORDER - 1n);
+        throws(() => G[1][op](G[2]), 'G[2]');
+        throws(() => G[1][op](CURVE_ORDER), 'CURVE_ORDER');
+        throws(() => G[1][op](CURVE_ORDER + 1n), 'CURVE_ORDER+1');
+        throws(() => G[1][op](123.456), '123.456');
+        throws(() => G[1][op](true), 'true');
+        throws(() => G[1][op]('1'), '1');
+        throws(() => G[1][op](new Uint8Array([])), 'ui8a([])');
+        throws(() => G[1][op](new Uint8Array([0])), 'ui8a([0])');
+        throws(() => G[1][op](new Uint8Array([1])), 'ui8a([1])');
+        throws(() => G[1][op](new Uint8Array(4096).fill(1)), 'ui8a(4096*[1])');
+        throws(() => G[1][op](o.BASE), 'other curve point');
+      });
+    }
+    // Complex point (Extended/Jacobian/Projective?)
+    if (p.BASE.toAffine) {
+      should(`${name}/${pointName}/toAffine()`, () => {
+        equal(p.ZERO.toAffine(), C.Point.ZERO, `0 = 0`);
+        equal(p.BASE.toAffine(), C.Point.BASE, `1 = 1`);
+      });
+    }
+    if (p.fromAffine) {
+      should(`${name}/${pointName}/fromAffine()`, () => {
+        equal(p.ZERO, p.fromAffine(C.Point.ZERO), `0 = 0`);
+        equal(p.BASE, p.fromAffine(C.Point.BASE), `1 = 1`);
+      });
+    }
+    // toHex/fromHex (if available)
+    if (p.fromHex && p.BASE.toHex) {
+      should(`${name}/${pointName}/fromHex(toHex()) roundtrip`, () => {
+        fc.assert(
+          fc.property(FC_BIGINT, (x) => {
+            const hex = p.BASE.multiply(x).toHex();
+            deepStrictEqual(p.fromHex(hex).toHex(), hex);
+          })
+        );
+      });
+    }
+  }
+  // Generic complex things (getPublicKey/sign/verify/getSharedSecret)
+  should(`${name}/getPublicKey type check`, () => {
+    throws(() => C.getPublicKey(0), '0');
+    throws(() => C.getPublicKey(0n), '0n');
+    throws(() => C.getPublicKey(false), 'false');
+    throws(() => C.getPublicKey(123.456), '123.456');
+    throws(() => C.getPublicKey(true), 'true');
+    throws(() => C.getPublicKey(''), "''");
+    // NOTE: passes because of disabled hex padding checks for starknet, maybe enable?
+    //throws(() => C.getPublicKey('1'), "'1'");
+    throws(() => C.getPublicKey('key'), "'key'");
+    throws(() => C.getPublicKey(new Uint8Array([])));
+    throws(() => C.getPublicKey(new Uint8Array([0])));
+    throws(() => C.getPublicKey(new Uint8Array([1])));
+    throws(() => C.getPublicKey(new Uint8Array(4096).fill(1)));
+  });
+  should(`${name}.verify()/should verify random signatures`, () =>
+    fc.assert(
+      fc.property(fc.hexaString({ minLength: 64, maxLength: 64 }), (msg) => {
+        const priv = C.utils.randomPrivateKey();
+        const pub = C.getPublicKey(priv);
+        const sig = C.sign(msg, priv);
+        deepStrictEqual(C.verify(sig, msg, pub), true);
+      }),
+      { numRuns: NUM_RUNS }
+    )
+  );
+  should(`${name}.sign()/edge cases`, () => {
+    throws(() => C.sign());
+    throws(() => C.sign(''));
+  });
+
+  should(`${name}.verify()/should not verify signature with wrong hash`, () => {
+    const MSG = '01'.repeat(32);
+    const PRIV_KEY = 0x2n;
+    const WRONG_MSG = '11'.repeat(32);
+    const signature = C.sign(MSG, PRIV_KEY);
+    const publicKey = C.getPublicKey(PRIV_KEY);
+    deepStrictEqual(C.verify(signature, WRONG_MSG, publicKey), false);
+  });
+  // NOTE: fails for ed, because of empty message. Since we convert it to scalar,
+  // need to check what other implementations do. Empty message != new Uint8Array([0]), but what scalar should be in that case?
+  // should(`${name}/should not verify signature with wrong message`, () => {
+  //   fc.assert(
+  //     fc.property(
+  //       fc.array(fc.integer({ min: 0x00, max: 0xff })),
+  //       fc.array(fc.integer({ min: 0x00, max: 0xff })),
+  //       (bytes, wrongBytes) => {
+  //         const privKey = C.utils.randomPrivateKey();
+  //         const message = new Uint8Array(bytes);
+  //         const wrongMessage = new Uint8Array(wrongBytes);
+  //         const publicKey = C.getPublicKey(privKey);
+  //         const signature = C.sign(message, privKey);
+  //         deepStrictEqual(
+  //           C.verify(signature, wrongMessage, publicKey),
+  //           bytes.toString() === wrongBytes.toString()
+  //         );
+  //       }
+  //     ),
+  //     { numRuns: NUM_RUNS }
+  //   );
+  // });
+
+  if (C.getSharedSecret) {
+    should(`${name}/getSharedSecret() should be commutative`, () => {
+      for (let i = 0; i < NUM_RUNS; i++) {
+        const asec = C.utils.randomPrivateKey();
+        const apub = C.getPublicKey(asec);
+        const bsec = C.utils.randomPrivateKey();
+        const bpub = C.getPublicKey(bsec);
         try {
-          failed = !CURVE.verify(test.sig, m, pubKey);
+          deepStrictEqual(C.getSharedSecret(asec, bpub), C.getSharedSecret(bsec, apub));
         } catch (error) {
-          failed = true;
-        }
-        deepStrictEqual(failed, true, 'invalid');
-      } else throw new Error('unknown test result');
+          console.error('not commutative', { asec, apub, bsec, bpub });
+          throw error;
         }
       }
-});
-
-should('wychenproof ECDH vectors', () => {
-  for (const group of ecdh.testGroups) {
-    // // Tested in secp256k1.test.js
-    // if (group.key.curve === 'secp256k1') continue;
-    // We don't have SHA-224
-    const CURVE = nist[group.curve];
-    if (!CURVE) continue;
-    for (const test of group.tests) {
-      if (test.result === 'valid' || test.result === 'acceptable') {
-        try {
-          const pub = CURVE.Point.fromHex(test.public);
-        } catch (e) {
-          if (e.message.includes('Point.fromHex: received invalid point.')) continue;
-          throw e;
+    });
   }
-        const shared = CURVE.getSharedSecret(test.private, test.public);
-        deepStrictEqual(shared, test.shared, 'valid');
-      } else if (test.result === 'invalid') {
-        let failed = false;
-        try {
-          CURVE.getSharedSecret(test.private, test.public);
-        } catch (error) {
-          failed = true;
-        }
-        deepStrictEqual(failed, true, 'invalid');
-      } else throw new Error('unknown test result');
-    }
-  }
-});
-
+}
 // ESM is broken.
 import url from 'url';
 if (import.meta.url === url.pathToFileURL(process.argv[1]).href) {

curve-definitions/test/ed25519.test.js

@@ -0,0 +1,657 @@
+import { deepStrictEqual, throws } from 'assert';
+import { should } from 'micro-should';
+import * as fc from 'fast-check';
+import { ed25519, ed25519ctx, ed25519ph, x25519, RistrettoPoint } from '../lib/ed25519.js';
+import { readFileSync } from 'fs';
+import { default as zip215 } from './ed25519/zip215.json' assert { type: 'json' };
+import { hexToBytes, bytesToHex, randomBytes } from '@noble/hashes/utils';
+import { numberToBytesLE } from '@noble/curves/utils';
+import { sha512 } from '@noble/hashes/sha512';
+import { default as ed25519vectors } from './wycheproof/eddsa_test.json' assert { type: 'json' };
+import { default as x25519vectors } from './wycheproof/x25519_test.json' assert { type: 'json' };
+
+const ed = ed25519;
+const hex = bytesToHex;
+
+function to32Bytes(numOrStr) {
+  let hex = typeof numOrStr === 'string' ? numOrStr : numOrStr.toString(16);
+  return hexToBytes(hex.padStart(64, '0'));
+}
+
+function utf8ToBytes(str) {
+  if (typeof str !== 'string') {
+    throw new TypeError(`utf8ToBytes expected string, got ${typeof str}`);
+  }
+  return new TextEncoder().encode(str);
+}
+
+ed.utils.precompute(8);
+
+should('ed25519/should not accept >32byte private keys', () => {
+  const invalidPriv =
+    100000000000000000000000000000000000009000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800073278156000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000n;
+  throws(() => ed.getPublicKey(invalidPriv));
+});
+should('ed25519/should verify recent signature', () => {
+  fc.assert(
+    fc.property(
+      fc.hexaString({ minLength: 2, maxLength: 32 }),
+      fc.bigInt(2n, ed.CURVE.n),
+      (message, privateKey) => {
+        const publicKey = ed.getPublicKey(to32Bytes(privateKey));
+        const signature = ed.sign(to32Bytes(message), to32Bytes(privateKey));
+        deepStrictEqual(publicKey.length, 32);
+        deepStrictEqual(signature.length, 64);
+        deepStrictEqual(ed.verify(signature, to32Bytes(message), publicKey), true);
+      }
+    ),
+    { numRuns: 5 }
+  );
+});
+should('ed25519/should not verify signature with wrong message', () => {
+  fc.assert(
+    fc.property(
+      fc.array(fc.integer({ min: 0x00, max: 0xff })),
+      fc.array(fc.integer({ min: 0x00, max: 0xff })),
+      fc.bigInt(1n, ed.CURVE.n),
+      (bytes, wrongBytes, privateKey) => {
+        const privKey = to32Bytes(privateKey);
+        const message = new Uint8Array(bytes);
+        const wrongMessage = new Uint8Array(wrongBytes);
+        const publicKey = ed.getPublicKey(privKey);
+        const signature = ed.sign(message, privKey);
+        deepStrictEqual(
+          ed.verify(signature, wrongMessage, publicKey),
+          bytes.toString() === wrongBytes.toString()
+        );
+      }
+    ),
+    { numRuns: 5 }
+  );
+});
+const privKey = to32Bytes('a665a45920422f9d417e4867ef');
+const msg = hexToBytes('874f9960c5d2b7a9b5fad383e1ba44719ebb743a');
+const wrongMsg = hexToBytes('589d8c7f1da0a24bc07b7381ad48b1cfc211af1c');
+should('ed25519/basic methods/should sign and verify', () => {
+  const publicKey = ed.getPublicKey(privKey);
+  const signature = ed.sign(msg, privKey);
+  deepStrictEqual(ed.verify(signature, msg, publicKey), true);
+});
+should('ed25519/basic methods/should not verify signature with wrong public key', () => {
+  const publicKey = ed.getPublicKey(12);
+  const signature = ed.sign(msg, privKey);
+  deepStrictEqual(ed.verify(signature, msg, publicKey), false);
+});
+should('ed25519/basic methods/should not verify signature with wrong hash', () => {
+  const publicKey = ed.getPublicKey(privKey);
+  const signature = ed.sign(msg, privKey);
+  deepStrictEqual(ed.verify(signature, wrongMsg, publicKey), false);
+});
+
+should('ed25519/sync methods/should sign and verify', () => {
+  const publicKey = ed.getPublicKey(privKey);
+  const signature = ed.sign(msg, privKey);
+  deepStrictEqual(ed.verify(signature, msg, publicKey), true);
+});
+should('ed25519/sync methods/should not verify signature with wrong public key', () => {
+  const publicKey = ed.getPublicKey(12);
+  const signature = ed.sign(msg, privKey);
+  deepStrictEqual(ed.verify(signature, msg, publicKey), false);
+});
+should('ed25519/sync methods/should not verify signature with wrong hash', () => {
+  const publicKey = ed.getPublicKey(privKey);
+  const signature = ed.sign(msg, privKey);
+  deepStrictEqual(ed.verify(signature, wrongMsg, publicKey), false);
+});
+
+// https://xmr.llcoins.net/addresstests.html
+should(
+  'ed25519/BASE_POINT.multiply()/should create right publicKey without SHA-512 hashing TEST 1',
+  () => {
+    const publicKey =
+      ed.Point.BASE.multiply(0x90af56259a4b6bfbc4337980d5d75fbe3c074630368ff3804d33028e5dbfa77n);
+    deepStrictEqual(
+      publicKey.toHex(),
+      '0f3b913371411b27e646b537e888f685bf929ea7aab93c950ed84433f064480d'
+    );
+  }
+);
+should(
+  'ed25519/BASE_POINT.multiply()/should create right publicKey without SHA-512 hashing TEST 2',
+  () => {
+    const publicKey =
+      ed.Point.BASE.multiply(0x364e8711a60780382a5d57b061c126f039940f28a9e91fe039d4d3094d8b88n);
+    deepStrictEqual(
+      publicKey.toHex(),
+      'ad545340b58610f0cd62f17d55af1ab11ecde9c084d5476865ddb4dbda015349'
+    );
+  }
+);
+should(
+  'ed25519/BASE_POINT.multiply()/should create right publicKey without SHA-512 hashing TEST 3',
+  () => {
+    const publicKey =
+      ed.Point.BASE.multiply(0xb9bf90ff3abec042752cac3a07a62f0c16cfb9d32a3fc2305d676ec2d86e941n);
+    deepStrictEqual(
+      publicKey.toHex(),
+      'e097c4415fe85724d522b2e449e8fd78dd40d20097bdc9ae36fe8ec6fe12cb8c'
+    );
+  }
+);
+should(
+  'ed25519/BASE_POINT.multiply()/should create right publicKey without SHA-512 hashing TEST 4',
+  () => {
+    const publicKey =
+      ed.Point.BASE.multiply(0x69d896f02d79524c9878e080308180e2859d07f9f54454e0800e8db0847a46en);
+    deepStrictEqual(
+      publicKey.toHex(),
+      'f12cb7c43b59971395926f278ce7c2eaded9444fbce62ca717564cb508a0db1d'
+    );
+  }
+);
+should('ed25519/BASE_POINT.multiply()/should throw Point#multiply on TEST 5', () => {
+  for (const num of [0n, 0, -1n, -1, 1.1]) {
+    throws(() => ed.Point.BASE.multiply(num));
+  }
+});
+
+// https://ed25519.cr.yp.to/python/sign.py
+// https://ed25519.cr.yp.to/python/sign.input
+const data = readFileSync('./test/ed25519/vectors.txt', 'utf-8');
+const vectors = data
+  .trim()
+  .split('\n')
+  .map((line) => line.split(':'));
+should('ed25519 official vectors/should match 1024 official vectors', () => {
+  for (let i = 0; i < vectors.length; i++) {
+    const vector = vectors[i];
+    // Extract.
+    const priv = vector[0].slice(0, 64);
+    const expectedPub = vector[1];
+    const msg = vector[2];
+    const expectedSignature = vector[3].slice(0, 128);
+
+    // Calculate
+    const pub = ed.getPublicKey(to32Bytes(priv));
+    deepStrictEqual(hex(pub), expectedPub);
+    deepStrictEqual(pub, ed.Point.fromHex(pub).toRawBytes());
+
+    const signature = hex(ed.sign(msg, priv));
+    // console.log('vector', i);
+    // expect(pub).toBe(expectedPub);
+    deepStrictEqual(signature, expectedSignature);
+  }
+});
+
+// https://tools.ietf.org/html/rfc8032#section-7
+should('rfc8032 vectors/should create right signature for 0x9d and empty string', () => {
+  const privateKey = '9d61b19deffd5a60ba844af492ec2cc44449c5697b326919703bac031cae7f60';
+  const publicKey = ed.getPublicKey(privateKey);
+  const message = '';
+  const signature = ed.sign(message, privateKey);
+  deepStrictEqual(
+    hex(publicKey),
+    'd75a980182b10ab7d54bfed3c964073a0ee172f3daa62325af021a68f707511a'
+  );
+  deepStrictEqual(
+    hex(signature),
+    'e5564300c360ac729086e2cc806e828a84877f1eb8e5d974d873e065224901555fb8821590a33bacc61e39701cf9b46bd25bf5f0595bbe24655141438e7a100b'
+  );
+});
+should('rfc8032 vectors/should create right signature for 0x4c and 72', () => {
+  const privateKey = '4ccd089b28ff96da9db6c346ec114e0f5b8a319f35aba624da8cf6ed4fb8a6fb';
+  const publicKey = ed.getPublicKey(privateKey);
+  const message = '72';
+  const signature = ed.sign(message, privateKey);
+  deepStrictEqual(
+    hex(publicKey),
+    '3d4017c3e843895a92b70aa74d1b7ebc9c982ccf2ec4968cc0cd55f12af4660c'
+  );
+  deepStrictEqual(
+    hex(signature),
+    '92a009a9f0d4cab8720e820b5f642540a2b27b5416503f8fb3762223ebdb69da085ac1e43e15996e458f3613d0f11d8c387b2eaeb4302aeeb00d291612bb0c00'
+  );
+});
+should('rfc8032 vectors/should create right signature for 0x00 and 5a', () => {
+  const privateKey = '002fdd1f7641793ab064bb7aa848f762e7ec6e332ffc26eeacda141ae33b1783';
+  const publicKey = ed.getPublicKey(privateKey);
+  const message =
+    '5ac1dfc324f43e6cb79a87ab0470fa857b51fb944982e19074ca44b1e40082c1d07b92efa7ea55ad42b7c027e0b9e33756d95a2c1796a7c2066811dc41858377d4b835c1688d638884cd2ad8970b74c1a54aadd27064163928a77988b24403aa85af82ceab6b728e554761af7175aeb99215b7421e4474c04d213e01ff03e3529b11077cdf28964b8c49c5649e3a46fa0a09dcd59dcad58b9b922a83210acd5e65065531400234f5e40cddcf9804968e3e9ac6f5c44af65001e158067fc3a660502d13fa8874fa93332138d9606bc41b4cee7edc39d753dae12a873941bb357f7e92a4498847d6605456cb8c0b425a47d7d3ca37e54e903a41e6450a35ebe5237c6f0c1bbbc1fd71fb7cd893d189850295c199b7d88af26bc8548975fda1099ffefee42a52f3428ddff35e0173d3339562507ac5d2c45bbd2c19cfe89b';
+  const signature = ed.sign(message, privateKey);
+  deepStrictEqual(
+    hex(publicKey),
+    '77d1d8ebacd13f4e2f8a40e28c4a63bc9ce3bfb69716334bcb28a33eb134086c'
+  );
+  deepStrictEqual(
+    hex(signature),
+    '0df3aa0d0999ad3dc580378f52d152700d5b3b057f56a66f92112e441e1cb9123c66f18712c87efe22d2573777296241216904d7cdd7d5ea433928bd2872fa0c'
+  );
+});
+should('rfc8032 vectors/should create right signature for 0xf5 and long msg', () => {
+  const privateKey = 'f5e5767cf153319517630f226876b86c8160cc583bc013744c6bf255f5cc0ee5';
+  const publicKey = ed.getPublicKey(privateKey);
+  const message =
+    '08b8b2b733424243760fe426a4b54908632110a66c2f6591eabd3345e3e4eb98fa6e264bf09efe12ee50f8f54e9f77b1e355f6c50544e23fb1433ddf73be84d879de7c0046dc4996d9e773f4bc9efe5738829adb26c81b37c93a1b270b20329d658675fc6ea534e0810a4432826bf58c941efb65d57a338bbd2e26640f89ffbc1a858efcb8550ee3a5e1998bd177e93a7363c344fe6b199ee5d02e82d522c4feba15452f80288a821a579116ec6dad2b3b310da903401aa62100ab5d1a36553e06203b33890cc9b832f79ef80560ccb9a39ce767967ed628c6ad573cb116dbefefd75499da96bd68a8a97b928a8bbc103b6621fcde2beca1231d206be6cd9ec7aff6f6c94fcd7204ed3455c68c83f4a41da4af2b74ef5c53f1d8ac70bdcb7ed185ce81bd84359d44254d95629e9855a94a7c1958d1f8ada5d0532ed8a5aa3fb2d17ba70eb6248e594e1a2297acbbb39d502f1a8c6eb6f1ce22b3de1a1f40cc24554119a831a9aad6079cad88425de6bde1a9187ebb6092cf67bf2b13fd65f27088d78b7e883c8759d2c4f5c65adb7553878ad575f9fad878e80a0c9ba63bcbcc2732e69485bbc9c90bfbd62481d9089beccf80cfe2df16a2cf65bd92dd597b0707e0917af48bbb75fed413d238f5555a7a569d80c3414a8d0859dc65a46128bab27af87a71314f318c782b23ebfe808b82b0ce26401d2e22f04d83d1255dc51addd3b75a2b1ae0784504df543af8969be3ea7082ff7fc9888c144da2af58429ec96031dbcad3dad9af0dcbaaaf268cb8fcffead94f3c7ca495e056a9b47acdb751fb73e666c6c655ade8297297d07ad1ba5e43f1bca32301651339e22904cc8c42f58c30c04aafdb038dda0847dd988dcda6f3bfd15c4b4c4525004aa06eeff8ca61783aacec57fb3d1f92b0fe2fd1a85f6724517b65e614ad6808d6f6ee34dff7310fdc82aebfd904b01e1dc54b2927094b2db68d6f903b68401adebf5a7e08d78ff4ef5d63653a65040cf9bfd4aca7984a74d37145986780fc0b16ac451649de6188a7dbdf191f64b5fc5e2ab47b57f7f7276cd419c17a3ca8e1b939ae49e488acba6b965610b5480109c8b17b80e1b7b750dfc7598d5d5011fd2dcc5600a32ef5b52a1ecc820e308aa342721aac0943bf6686b64b2579376504ccc493d97e6aed3fb0f9cd71a43dd497f01f17c0e2cb3797aa2a2f256656168e6c496afc5fb93246f6b1116398a346f1a641f3b041e989f7914f90cc2c7fff357876e506b50d334ba77c225bc307ba537152f3f1610e4eafe595f6d9d90d11faa933a15ef1369546868a7f3a45a96768d40fd9d03412c091c6315cf4fde7cb68606937380db2eaaa707b4c4185c32eddcdd306705e4dc1ffc872eeee475a64dfac86aba41c0618983f8741c5ef68d3a101e8a3b8cac60c905c15fc910840b94c00a0b9d0';
+  const signature = ed.sign(message, privateKey);
+  deepStrictEqual(
+    hex(publicKey),
+    '278117fc144c72340f67d0f2316e8386ceffbf2b2428c9c51fef7c597f1d426e'
+  );
+  deepStrictEqual(
+    hex(signature),
+    '0aab4c900501b3e24d7cdf4663326a3a87df5e4843b2cbdb67cbf6e460fec350aa5371b1508f9f4528ecea23c436d94b5e8fcd4f681e30a6ac00a9704a188a03'
+  );
+});
+
+// const PRIVATE_KEY = 0xa665a45920422f9d417e4867efn;
+// const MESSAGE = ripemd160(new Uint8Array([97, 98, 99, 100, 101, 102, 103]));
+// prettier-ignore
+// const MESSAGE = new Uint8Array([
+//   135, 79, 153, 96, 197, 210, 183, 169, 181, 250, 211, 131, 225, 186, 68, 113, 158, 187, 116, 58,
+// ]);
+// const WRONG_MESSAGE = ripemd160(new Uint8Array([98, 99, 100, 101, 102, 103]));
+// prettier-ignore
+// const WRONG_MESSAGE = new Uint8Array([
+//   88, 157, 140, 127, 29, 160, 162, 75, 192, 123, 115, 129, 173, 72, 177, 207, 194, 17, 175, 28,
+// ]);
+// // it("should verify just signed message", async () => {
+// //   await fc.assert(fc.asyncProperty(
+// //     fc.hexa(),
+// //     fc.bigInt(2n, ristretto25519.PRIME_ORDER),
+// //     async (message, privateKey) => {
+// //       const publicKey = await ristretto25519.getPublicKey(privateKey);
+// //       const signature = await ristretto25519.sign(message, privateKey);
+// //       expect(publicKey.length).toBe(32);
+// //       expect(signature.length).toBe(64);
+// //       expect(await ristretto25519.verify(signature, message, publicKey)).toBe(true);
+// //     }),
+// //    { numRuns: 1 }
+// //   );
+// // });
+// // it("should not verify sign with wrong message", async () => {
+// //   await fc.assert(fc.asyncProperty(
+// //     fc.array(fc.integer(0x00, 0xff)),
+// //     fc.array(fc.integer(0x00, 0xff)),
+// //     fc.bigInt(2n, ristretto25519.PRIME_ORDER),
+// //     async (bytes, wrongBytes, privateKey) => {
+// //       const message = new Uint8Array(bytes);
+// //       const wrongMessage = new Uint8Array(wrongBytes);
+// //       const publicKey = await ristretto25519.getPublicKey(privateKey);
+// //       const signature = await ristretto25519.sign(message, privateKey);
+// //       expect(await ristretto25519.verify(signature, wrongMessage, publicKey)).toBe(
+// //         bytes.toString() === wrongBytes.toString()
+// //       );
+// //     }),
+// //    { numRuns: 1 }
+// //   );
+// // });
+// // it("should sign and verify", async () => {
+// //   const publicKey = await ristretto25519.getPublicKey(PRIVATE_KEY);
+// //   const signature = await ristretto25519.sign(MESSAGE, PRIVATE_KEY);
+// //   expect(await ristretto25519.verify(signature, MESSAGE, publicKey)).toBe(true);
+// // });
+// // it("should not verify signature with wrong public key", async () => {
+// //   const publicKey = await ristretto25519.getPublicKey(12);
+// //   const signature = await ristretto25519.sign(MESSAGE, PRIVATE_KEY);
+// //   expect(await ristretto25519.verify(signature, MESSAGE, publicKey)).toBe(false);
+// // });
+// // it("should not verify signature with wrong hash", async () => {
+// //   const publicKey = await ristretto25519.getPublicKey(PRIVATE_KEY);
+// //   const signature = await ristretto25519.sign(MESSAGE, PRIVATE_KEY);
+// //   expect(await ristretto25519.verify(signature, WRONG_MESSAGE, publicKey)).toBe(false);
+// // });
+should('ristretto255/should follow the byte encodings of small multiples', () => {
+  const encodingsOfSmallMultiples = [
+    // This is the identity point
+    '0000000000000000000000000000000000000000000000000000000000000000',
+    // This is the basepoint
+    'e2f2ae0a6abc4e71a884a961c500515f58e30b6aa582dd8db6a65945e08d2d76',
+    // These are small multiples of the basepoint
+    '6a493210f7499cd17fecb510ae0cea23a110e8d5b901f8acadd3095c73a3b919',
+    '94741f5d5d52755ece4f23f044ee27d5d1ea1e2bd196b462166b16152a9d0259',
+    'da80862773358b466ffadfe0b3293ab3d9fd53c5ea6c955358f568322daf6a57',
+    'e882b131016b52c1d3337080187cf768423efccbb517bb495ab812c4160ff44e',
+    'f64746d3c92b13050ed8d80236a7f0007c3b3f962f5ba793d19a601ebb1df403',
+    '44f53520926ec81fbd5a387845beb7df85a96a24ece18738bdcfa6a7822a176d',
+    '903293d8f2287ebe10e2374dc1a53e0bc887e592699f02d077d5263cdd55601c',
+    '02622ace8f7303a31cafc63f8fc48fdc16e1c8c8d234b2f0d6685282a9076031',
+    '20706fd788b2720a1ed2a5dad4952b01f413bcf0e7564de8cdc816689e2db95f',
+    'bce83f8ba5dd2fa572864c24ba1810f9522bc6004afe95877ac73241cafdab42',
+    'e4549ee16b9aa03099ca208c67adafcafa4c3f3e4e5303de6026e3ca8ff84460',
+    'aa52e000df2e16f55fb1032fc33bc42742dad6bd5a8fc0be0167436c5948501f',
+    '46376b80f409b29dc2b5f6f0c52591990896e5716f41477cd30085ab7f10301e',
+    'e0c418f7c8d9c4cdd7395b93ea124f3ad99021bb681dfc3302a9d99a2e53e64e',
+  ];
+  let B = RistrettoPoint.BASE;
+  let P = RistrettoPoint.ZERO;
+  for (const encoded of encodingsOfSmallMultiples) {
+    deepStrictEqual(P.toHex(), encoded);
+    deepStrictEqual(RistrettoPoint.fromHex(encoded).toHex(), encoded);
+    P = P.add(B);
+  }
+});
+should('ristretto255/should not convert bad bytes encoding', () => {
+  const badEncodings = [
+    // These are all bad because they're non-canonical field encodings.
+    '00ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff',
+    'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f',
+    'f3ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f',
+    'edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f',
+    // These are all bad because they're negative field elements.
+    '0100000000000000000000000000000000000000000000000000000000000000',
+    '01ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f',
+    'ed57ffd8c914fb201471d1c3d245ce3c746fcbe63a3679d51b6a516ebebe0e20',
+    'c34c4e1826e5d403b78e246e88aa051c36ccf0aafebffe137d148a2bf9104562',
+    'c940e5a4404157cfb1628b108db051a8d439e1a421394ec4ebccb9ec92a8ac78',
+    '47cfc5497c53dc8e61c91d17fd626ffb1c49e2bca94eed052281b510b1117a24',
+    'f1c6165d33367351b0da8f6e4511010c68174a03b6581212c71c0e1d026c3c72',
+    '87260f7a2f12495118360f02c26a470f450dadf34a413d21042b43b9d93e1309',
+    // These are all bad because they give a nonsquare x^2.
+    '26948d35ca62e643e26a83177332e6b6afeb9d08e4268b650f1f5bbd8d81d371',
+    '4eac077a713c57b4f4397629a4145982c661f48044dd3f96427d40b147d9742f',
+    'de6a7b00deadc788eb6b6c8d20c0ae96c2f2019078fa604fee5b87d6e989ad7b',
+    'bcab477be20861e01e4a0e295284146a510150d9817763caf1a6f4b422d67042',
+    '2a292df7e32cababbd9de088d1d1abec9fc0440f637ed2fba145094dc14bea08',
+    'f4a9e534fc0d216c44b218fa0c42d99635a0127ee2e53c712f70609649fdff22',
+    '8268436f8c4126196cf64b3c7ddbda90746a378625f9813dd9b8457077256731',
+    '2810e5cbc2cc4d4eece54f61c6f69758e289aa7ab440b3cbeaa21995c2f4232b',
+    // These are all bad because they give a negative xy value.
+    '3eb858e78f5a7254d8c9731174a94f76755fd3941c0ac93735c07ba14579630e',
+    'a45fdc55c76448c049a1ab33f17023edfb2be3581e9c7aade8a6125215e04220',
+    'd483fe813c6ba647ebbfd3ec41adca1c6130c2beeee9d9bf065c8d151c5f396e',
+    '8a2e1d30050198c65a54483123960ccc38aef6848e1ec8f5f780e8523769ba32',
+    '32888462f8b486c68ad7dd9610be5192bbeaf3b443951ac1a8118419d9fa097b',
+    '227142501b9d4355ccba290404bde41575b037693cef1f438c47f8fbf35d1165',
+    '5c37cc491da847cfeb9281d407efc41e15144c876e0170b499a96a22ed31e01e',
+    '445425117cb8c90edcbc7c1cc0e74f747f2c1efa5630a967c64f287792a48a4b',
+    // This is s = -1, which causes y = 0.
+    'ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f',
+  ];
+  for (const badBytes of badEncodings) {
+    const b = hexToBytes(badBytes);
+    throws(() => RistrettoPoint.fromHex(b), badBytes);
+  }
+});
+should('ristretto255/should create right points from uniform hash', async () => {
+  const labels = [
+    'Ristretto is traditionally a short shot of espresso coffee',
+    'made with the normal amount of ground coffee but extracted with',
+    'about half the amount of water in the same amount of time',
+    'by using a finer grind.',
+    'This produces a concentrated shot of coffee per volume.',
+    'Just pulling a normal shot short will produce a weaker shot',
+    'and is not a Ristretto as some believe.',
+  ];
+  const encodedHashToPoints = [
+    '3066f82a1a747d45120d1740f14358531a8f04bbffe6a819f86dfe50f44a0a46',
+    'f26e5b6f7d362d2d2a94c5d0e7602cb4773c95a2e5c31a64f133189fa76ed61b',
+    '006ccd2a9e6867e6a2c5cea83d3302cc9de128dd2a9a57dd8ee7b9d7ffe02826',
+    'f8f0c87cf237953c5890aec3998169005dae3eca1fbb04548c635953c817f92a',
+    'ae81e7dedf20a497e10c304a765c1767a42d6e06029758d2d7e8ef7cc4c41179',
+    'e2705652ff9f5e44d3e841bf1c251cf7dddb77d140870d1ab2ed64f1a9ce8628',
+    '80bd07262511cdde4863f8a7434cef696750681cb9510eea557088f76d9e5065',
+  ];
+
+  for (let i = 0; i < labels.length; i++) {
+    const hash = sha512(utf8ToBytes(labels[i]));
+    const point = RistrettoPoint.hashToCurve(hash);
+    deepStrictEqual(point.toHex(), encodedHashToPoints[i]);
+  }
+});
+
+should('input immutability: sign/verify are immutable', () => {
+  const privateKey = ed.utils.randomPrivateKey();
+  const publicKey = ed.getPublicKey(privateKey);
+
+  for (let i = 0; i < 100; i++) {
+    let payload = randomBytes(100);
+    let signature = ed.sign(payload, privateKey);
+    if (!ed.verify(signature, payload, publicKey)) {
+      throw new Error('Signature verification failed');
+    }
+    const signatureCopy = Buffer.alloc(signature.byteLength);
+    signatureCopy.set(signature, 0); // <-- breaks
+    payload = payload.slice();
+    signature = signature.slice();
+
+    if (!ed.verify(signatureCopy, payload, publicKey))
+      throw new Error('Copied signature verification failed');
+  }
+});
+
+// https://zips.z.cash/zip-0215
+// Vectors from https://gist.github.com/hdevalence/93ed42d17ecab8e42138b213812c8cc7
+should('ZIP-215 compliance tests/should pass all of them', () => {
+  const str = utf8ToBytes('Zcash');
+  for (let v of zip215) {
+    let noble = false;
+    try {
+      noble = ed.verify(v.sig_bytes, str, v.vk_bytes);
+    } catch (e) {
+      noble = false;
+    }
+    deepStrictEqual(noble, v.valid_zip215);
+  }
+});
+should('ZIP-215 compliance tests/disallows sig.s >= CURVE.n', () => {
+  const sig = new ed.Signature(ed.Point.BASE, 1n);
+  sig.s = ed.CURVE.n + 1n;
+  throws(() => ed.verify(sig, 'deadbeef', ed.Point.BASE));
+});
+
+const rfc7748Mul = [
+  {
+    scalar: 'a546e36bf0527c9d3b16154b82465edd62144c0ac1fc5a18506a2244ba449ac4',
+    u: 'e6db6867583030db3594c1a424b15f7c726624ec26b3353b10a903a6d0ab1c4c',
+    outputU: 'c3da55379de9c6908e94ea4df28d084f32eccf03491c71f754b4075577a28552',
+  },
+  {
+    scalar: '4b66e9d4d1b4673c5ad22691957d6af5c11b6421e0ea01d42ca4169e7918ba0d',
+    u: 'e5210f12786811d3f4b7959d0538ae2c31dbe7106fc03c3efc4cd549c715a493',
+    outputU: '95cbde9476e8907d7aade45cb4b873f88b595a68799fa152e6f8f7647aac7957',
+  },
+];
+for (let i = 0; i < rfc7748Mul.length; i++) {
+  const v = rfc7748Mul[i];
+  should(`RFC7748: scalarMult (${i})`, () => {
+    deepStrictEqual(hex(x25519.scalarMult(v.u, v.scalar)), v.outputU);
+  });
+}
+
+const rfc7748Iter = [
+  { scalar: '422c8e7a6227d7bca1350b3e2bb7279f7897b87bb6854b783c60e80311ae3079', iters: 1 },
+  { scalar: '684cf59ba83309552800ef566f2f4d3c1c3887c49360e3875f2eb94d99532c51', iters: 1000 },
+  // { scalar: '7c3911e0ab2586fd864497297e575e6f3bc601c0883c30df5f4dd2d24f665424', iters: 1000000 },
+];
+for (let i = 0; i < rfc7748Iter.length; i++) {
+  const { scalar, iters } = rfc7748Iter[i];
+  should(`RFC7748: scalarMult iteration (${i})`, () => {
+    let k = x25519.Gu;
+    for (let i = 0, u = k; i < iters; i++) [k, u] = [x25519.scalarMult(u, k), k];
+    deepStrictEqual(hex(k), scalar);
+  });
+}
+
+should('RFC7748 getSharedKey', () => {
+  const alicePrivate = '77076d0a7318a57d3c16c17251b26645df4c2f87ebc0992ab177fba51db92c2a';
+  const alicePublic = '8520f0098930a754748b7ddcb43ef75a0dbf3a0d26381af4eba4a98eaa9b4e6a';
+  const bobPrivate = '5dab087e624a8a4b79e17f8b83800ee66f3bb1292618b6fd1c2f8b27ff88e0eb';
+  const bobPublic = 'de9edb7d7b7dc1b4d35b61c2ece435373f8343c85b78674dadfc7e146f882b4f';
+  const shared = '4a5d9d5ba4ce2de1728e3bf480350f25e07e21c947d19e3376f09b3c1e161742';
+  deepStrictEqual(alicePublic, hex(x25519.getPublicKey(alicePrivate)));
+  deepStrictEqual(bobPublic, hex(x25519.getPublicKey(bobPrivate)));
+  deepStrictEqual(hex(x25519.scalarMult(bobPublic, alicePrivate)), shared);
+  deepStrictEqual(hex(x25519.scalarMult(alicePublic, bobPrivate)), shared);
+});
+
+// should('X25519/getSharedSecret() should be commutative', () => {
+//   for (let i = 0; i < 512; i++) {
+//     const asec = ed.utils.randomPrivateKey();
+//     const apub = ed.getPublicKey(asec);
+//     const bsec = ed.utils.randomPrivateKey();
+//     const bpub = ed.getPublicKey(bsec);
+//     try {
+//       deepStrictEqual(ed.getSharedSecret(asec, bpub), ed.getSharedSecret(bsec, apub));
+//     } catch (error) {
+//       console.error('not commutative', { asec, apub, bsec, bpub });
+//       throw error;
+//     }
+//   }
+// });
+
+// should('X25519: should convert base point to montgomery using fromPoint', () => {
+//   deepStrictEqual(
+//     hex(ed.montgomeryCurve.UfromPoint(ed.Point.BASE)),
+//     ed.montgomeryCurve.BASE_POINT_U
+//   );
+// });
+
+{
+  const group = x25519vectors.testGroups[0];
+  should(`Wycheproof/X25519`, () => {
+    for (let i = 0; i < group.tests.length; i++) {
+      const v = group.tests[i];
+      const comment = `(${i}, ${v.result}) ${v.comment}`;
+      if (v.result === 'valid' || v.result === 'acceptable') {
+        try {
+          const shared = hex(x25519.scalarMult(v.public, v.private));
+          deepStrictEqual(shared, v.shared, comment);
+        } catch (e) {
+          // We are more strict
+          if (e.message.includes('Expected valid scalar')) return;
+          if (e.message.includes('Invalid private or public key received')) return;
+          throw e;
+        }
+      } else if (v.result === 'invalid') {
+        let failed = false;
+        try {
+          x25519.scalarMult(v.public, v.private);
+        } catch (error) {
+          failed = true;
+        }
+        deepStrictEqual(failed, true, comment);
+      } else throw new Error('unknown test result');
+    }
+  });
+}
+
+should(`Wycheproof/ED25519`, () => {
+  for (let g = 0; g < ed25519vectors.testGroups.length; g++) {
+    const group = ed25519vectors.testGroups[g];
+    const key = group.key;
+    deepStrictEqual(hex(ed.getPublicKey(key.sk)), key.pk, `(${g}, public)`);
+    for (let i = 0; i < group.tests.length; i++) {
+      const v = group.tests[i];
+      const comment = `(${g}/${i}, ${v.result}): ${v.comment}`;
+      if (v.result === 'valid' || v.result === 'acceptable') {
+        deepStrictEqual(hex(ed.sign(v.msg, key.sk)), v.sig, comment);
+        deepStrictEqual(ed.verify(v.sig, v.msg, key.pk), true, comment);
+      } else if (v.result === 'invalid') {
+        let failed = false;
+        try {
+          failed = !ed.verify(v.sig, v.msg, key.pk);
+        } catch (error) {
+          failed = true;
+        }
+        deepStrictEqual(failed, true, comment);
+      } else throw new Error('unknown test result');
+    }
+  }
+});
+
+should('Property test issue #1', () => {
+  const message = new Uint8Array([12, 12, 12]);
+  const signature = ed.sign(message, to32Bytes(1n));
+  const publicKey = ed.getPublicKey(to32Bytes(1n)); // <- was 1n
+  deepStrictEqual(ed.verify(signature, message, publicKey), true);
+});
+
+const VECTORS_RFC8032_CTX = [
+  {
+    secretKey: '0305334e381af78f141cb666f6199f57bc3495335a256a95bd2a55bf546663f6',
+    publicKey: 'dfc9425e4f968f7f0c29f0259cf5f9aed6851c2bb4ad8bfb860cfee0ab248292',
+    message: 'f726936d19c800494e3fdaff20b276a8',
+    context: '666f6f',
+    signature:
+      '55a4cc2f70a54e04288c5f4cd1e45a7b' +
+      'b520b36292911876cada7323198dd87a' +
+      '8b36950b95130022907a7fb7c4e9b2d5' +
+      'f6cca685a587b4b21f4b888e4e7edb0d',
+  },
+  {
+    secretKey: '0305334e381af78f141cb666f6199f57bc3495335a256a95bd2a55bf546663f6',
+    publicKey: 'dfc9425e4f968f7f0c29f0259cf5f9aed6851c2bb4ad8bfb860cfee0ab248292',
+    message: 'f726936d19c800494e3fdaff20b276a8',
+    context: '626172',
+    signature:
+      'fc60d5872fc46b3aa69f8b5b4351d580' +
+      '8f92bcc044606db097abab6dbcb1aee3' +
+      '216c48e8b3b66431b5b186d1d28f8ee1' +
+      '5a5ca2df6668346291c2043d4eb3e90d',
+  },
+  {
+    secretKey: '0305334e381af78f141cb666f6199f57bc3495335a256a95bd2a55bf546663f6',
+    publicKey: 'dfc9425e4f968f7f0c29f0259cf5f9aed6851c2bb4ad8bfb860cfee0ab248292',
+    message: '508e9e6882b979fea900f62adceaca35',
+    context: '666f6f',
+    signature:
+      '8b70c1cc8310e1de20ac53ce28ae6e72' +
+      '07f33c3295e03bb5c0732a1d20dc6490' +
+      '8922a8b052cf99b7c4fe107a5abb5b2c' +
+      '4085ae75890d02df26269d8945f84b0b',
+  },
+  {
+    secretKey: 'ab9c2853ce297ddab85c993b3ae14bcad39b2c682beabc27d6d4eb20711d6560',
+    publicKey: '0f1d1274943b91415889152e893d80e93275a1fc0b65fd71b4b0dda10ad7d772',
+    message: 'f726936d19c800494e3fdaff20b276a8',
+    context: '666f6f',
+    signature:
+      '21655b5f1aa965996b3f97b3c849eafb' +
+      'a922a0a62992f73b3d1b73106a84ad85' +
+      'e9b86a7b6005ea868337ff2d20a7f5fb' +
+      'd4cd10b0be49a68da2b2e0dc0ad8960f',
+  },
+];
+
+for (let i = 0; i < VECTORS_RFC8032_CTX.length; i++) {
+  const v = VECTORS_RFC8032_CTX[i];
+  should(`RFC8032ctx/${i}`, () => {
+    deepStrictEqual(hex(ed25519ctx.getPublicKey(v.secretKey)), v.publicKey);
+    deepStrictEqual(hex(ed25519ctx.sign(v.message, v.secretKey, v.context)), v.signature);
+    deepStrictEqual(ed25519ctx.verify(v.signature, v.message, v.publicKey, v.context), true);
+  });
+}
+
+const VECTORS_RFC8032_PH = [
+  {
+    secretKey: '833fe62409237b9d62ec77587520911e9a759cec1d19755b7da901b96dca3d42',
+    publicKey: 'ec172b93ad5e563bf4932c70e1245034c35467ef2efd4d64ebf819683467e2bf',
+    message: '616263',
+    signature:
+      '98a70222f0b8121aa9d30f813d683f80' +
+      '9e462b469c7ff87639499bb94e6dae41' +
+      '31f85042463c2a355a2003d062adf5aa' +
+      'a10b8c61e636062aaad11c2a26083406',
+  },
+];
+
+for (let i = 0; i < VECTORS_RFC8032_PH.length; i++) {
+  const v = VECTORS_RFC8032_PH[i];
+  should(`RFC8032ph/${i}`, () => {
+    deepStrictEqual(hex(ed25519ph.getPublicKey(v.secretKey)), v.publicKey);
+    deepStrictEqual(hex(ed25519ph.sign(v.message, v.secretKey)), v.signature);
+    deepStrictEqual(ed25519ph.verify(v.signature, v.message, v.publicKey), true);
+  });
+}
+
+should('X25519 base point', () => {
+  const { y } = ed25519.Point.BASE;
+  const u = ed25519.utils.mod((y + 1n) * ed25519.utils.invert(1n - y, ed25519.CURVE.P));
+  deepStrictEqual(hex(numberToBytesLE(u, 32)), x25519.Gu);
+});
+
+// ESM is broken.
+import url from 'url';
+if (import.meta.url === url.pathToFileURL(process.argv[1]).href) {
+  should.run();
+}

curve-definitions/test/ed448.test.js

@@ -0,0 +1,664 @@
+import { deepStrictEqual, throws } from 'assert';
+import { should } from 'micro-should';
+import * as fc from 'fast-check';
+import { ed448, ed448ph, x448 } from '../lib/ed448.js';
+import { hexToBytes, bytesToHex, randomBytes } from '@noble/hashes/utils';
+import { numberToBytesLE } from '@noble/curves/utils';
+import { default as ed448vectors } from './wycheproof/ed448_test.json' assert { type: 'json' };
+import { default as x448vectors } from './wycheproof/x448_test.json' assert { type: 'json' };
+
+const ed = ed448;
+const hex = bytesToHex;
+ed.utils.precompute(4);
+
+should(`Basic`, () => {
+  const G1 = ed.Point.BASE;
+  deepStrictEqual(
+    G1.x,
+    224580040295924300187604334099896036246789641632564134246125461686950415467406032909029192869357953282578032075146446173674602635247710n
+  );
+  deepStrictEqual(
+    G1.y,
+    298819210078481492676017930443930673437544040154080242095928241372331506189835876003536878655418784733982303233503462500531545062832660n
+  );
+  const G2 = ed.Point.BASE.multiply(2n);
+  deepStrictEqual(
+    G2.x,
+    484559149530404593699549205258669689569094240458212040187660132787056912146709081364401144455726350866276831544947397859048262938744149n
+  );
+  deepStrictEqual(
+    G2.y,
+    494088759867433727674302672526735089350544552303727723746126484473087719117037293890093462157703888342865036477787453078312060500281069n
+  );
+  const G3 = ed.Point.BASE.multiply(3n);
+  deepStrictEqual(
+    G3.x,
+    23839778817283171003887799738662344287085130522697782688245073320169861206004018274567429238677677920280078599146891901463786155880335n
+  );
+  deepStrictEqual(
+    G3.y,
+    636046652612779686502873775776967954190574036985351036782021535703553242737829645273154208057988851307101009474686328623630835377952508n
+  );
+});
+
+should('Basic/decompress', () => {
+  const G1 = ed.Point.BASE;
+  const G2 = ed.Point.BASE.multiply(2n);
+  const G3 = ed.Point.BASE.multiply(3n);
+  const points = [G1, G2, G3];
+  const getXY = (p) => ({ x: p.x, y: p.y });
+  for (const p of points) deepStrictEqual(getXY(ed.Point.fromHex(p.toHex())), getXY(p));
+});
+
+const VECTORS_RFC8032 = [
+  {
+    secretKey:
+      '6c82a562cb808d10d632be89c8513ebf' +
+      '6c929f34ddfa8c9f63c9960ef6e348a3' +
+      '528c8a3fcc2f044e39a3fc5b94492f8f' +
+      '032e7549a20098f95b',
+    publicKey:
+      '5fd7449b59b461fd2ce787ec616ad46a' +
+      '1da1342485a70e1f8a0ea75d80e96778' +
+      'edf124769b46c7061bd6783df1e50f6c' +
+      'd1fa1abeafe8256180',
+    message: '',
+    signature:
+      '533a37f6bbe457251f023c0d88f976ae' +
+      '2dfb504a843e34d2074fd823d41a591f' +
+      '2b233f034f628281f2fd7a22ddd47d78' +
+      '28c59bd0a21bfd3980ff0d2028d4b18a' +
+      '9df63e006c5d1c2d345b925d8dc00b41' +
+      '04852db99ac5c7cdda8530a113a0f4db' +
+      'b61149f05a7363268c71d95808ff2e65' +
+      '2600',
+  },
+  {
+    secretKey:
+      'c4eab05d357007c632f3dbb48489924d' +
+      '552b08fe0c353a0d4a1f00acda2c463a' +
+      'fbea67c5e8d2877c5e3bc397a659949e' +
+      'f8021e954e0a12274e',
+    publicKey:
+      '43ba28f430cdff456ae531545f7ecd0a' +
+      'c834a55d9358c0372bfa0c6c6798c086' +
+      '6aea01eb00742802b8438ea4cb82169c' +
+      '235160627b4c3a9480',
+
+    message: '03',
+    signature:
+      '26b8f91727bd62897af15e41eb43c377' +
+      'efb9c610d48f2335cb0bd0087810f435' +
+      '2541b143c4b981b7e18f62de8ccdf633' +
+      'fc1bf037ab7cd779805e0dbcc0aae1cb' +
+      'cee1afb2e027df36bc04dcecbf154336' +
+      'c19f0af7e0a6472905e799f1953d2a0f' +
+      'f3348ab21aa4adafd1d234441cf807c0' +
+      '3a00',
+  },
+  {
+    secretKey:
+      'cd23d24f714274e744343237b93290f5' +
+      '11f6425f98e64459ff203e8985083ffd' +
+      'f60500553abc0e05cd02184bdb89c4cc' +
+      'd67e187951267eb328',
+    publicKey:
+      'dcea9e78f35a1bf3499a831b10b86c90' +
+      'aac01cd84b67a0109b55a36e9328b1e3' +
+      '65fce161d71ce7131a543ea4cb5f7e9f' +
+      '1d8b00696447001400',
+    message: '0c3e544074ec63b0265e0c',
+    signature:
+      '1f0a8888ce25e8d458a21130879b840a' +
+      '9089d999aaba039eaf3e3afa090a09d3' +
+      '89dba82c4ff2ae8ac5cdfb7c55e94d5d' +
+      '961a29fe0109941e00b8dbdeea6d3b05' +
+      '1068df7254c0cdc129cbe62db2dc957d' +
+      'bb47b51fd3f213fb8698f064774250a5' +
+      '028961c9bf8ffd973fe5d5c206492b14' +
+      '0e00',
+  },
+  {
+    secretKey:
+      '258cdd4ada32ed9c9ff54e63756ae582' +
+      'fb8fab2ac721f2c8e676a72768513d93' +
+      '9f63dddb55609133f29adf86ec9929dc' +
+      'cb52c1c5fd2ff7e21b',
+    publicKey:
+      '3ba16da0c6f2cc1f30187740756f5e79' +
+      '8d6bc5fc015d7c63cc9510ee3fd44adc' +
+      '24d8e968b6e46e6f94d19b945361726b' +
+      'd75e149ef09817f580',
+    message: '64a65f3cdedcdd66811e2915',
+    signature:
+      '7eeeab7c4e50fb799b418ee5e3197ff6' +
+      'bf15d43a14c34389b59dd1a7b1b85b4a' +
+      'e90438aca634bea45e3a2695f1270f07' +
+      'fdcdf7c62b8efeaf00b45c2c96ba457e' +
+      'b1a8bf075a3db28e5c24f6b923ed4ad7' +
+      '47c3c9e03c7079efb87cb110d3a99861' +
+      'e72003cbae6d6b8b827e4e6c143064ff' +
+      '3c00',
+  },
+  {
+    secretKey:
+      '7ef4e84544236752fbb56b8f31a23a10' +
+      'e42814f5f55ca037cdcc11c64c9a3b29' +
+      '49c1bb60700314611732a6c2fea98eeb' +
+      'c0266a11a93970100e',
+    publicKey:
+      'b3da079b0aa493a5772029f0467baebe' +
+      'e5a8112d9d3a22532361da294f7bb381' +
+      '5c5dc59e176b4d9f381ca0938e13c6c0' +
+      '7b174be65dfa578e80',
+    message: '64a65f3cdedcdd66811e2915e7',
+    signature:
+      '6a12066f55331b6c22acd5d5bfc5d712' +
+      '28fbda80ae8dec26bdd306743c5027cb' +
+      '4890810c162c027468675ecf645a8317' +
+      '6c0d7323a2ccde2d80efe5a1268e8aca' +
+      '1d6fbc194d3f77c44986eb4ab4177919' +
+      'ad8bec33eb47bbb5fc6e28196fd1caf5' +
+      '6b4e7e0ba5519234d047155ac727a105' +
+      '3100',
+  },
+  {
+    secretKey:
+      'd65df341ad13e008567688baedda8e9d' +
+      'cdc17dc024974ea5b4227b6530e339bf' +
+      'f21f99e68ca6968f3cca6dfe0fb9f4fa' +
+      'b4fa135d5542ea3f01',
+    publicKey:
+      'df9705f58edbab802c7f8363cfe5560a' +
+      'b1c6132c20a9f1dd163483a26f8ac53a' +
+      '39d6808bf4a1dfbd261b099bb03b3fb5' +
+      '0906cb28bd8a081f00',
+    message:
+      'bd0f6a3747cd561bdddf4640a332461a' +
+      '4a30a12a434cd0bf40d766d9c6d458e5' +
+      '512204a30c17d1f50b5079631f64eb31' +
+      '12182da3005835461113718d1a5ef944',
+    signature:
+      '554bc2480860b49eab8532d2a533b7d5' +
+      '78ef473eeb58c98bb2d0e1ce488a98b1' +
+      '8dfde9b9b90775e67f47d4a1c3482058' +
+      'efc9f40d2ca033a0801b63d45b3b722e' +
+      'f552bad3b4ccb667da350192b61c508c' +
+      'f7b6b5adadc2c8d9a446ef003fb05cba' +
+      '5f30e88e36ec2703b349ca229c267083' +
+      '3900',
+  },
+  {
+    secretKey:
+      '2ec5fe3c17045abdb136a5e6a913e32a' +
+      'b75ae68b53d2fc149b77e504132d3756' +
+      '9b7e766ba74a19bd6162343a21c8590a' +
+      'a9cebca9014c636df5',
+    publicKey:
+      '79756f014dcfe2079f5dd9e718be4171' +
+      'e2ef2486a08f25186f6bff43a9936b9b' +
+      'fe12402b08ae65798a3d81e22e9ec80e' +
+      '7690862ef3d4ed3a00',
+    message:
+      '15777532b0bdd0d1389f636c5f6b9ba7' +
+      '34c90af572877e2d272dd078aa1e567c' +
+      'fa80e12928bb542330e8409f31745041' +
+      '07ecd5efac61ae7504dabe2a602ede89' +
+      'e5cca6257a7c77e27a702b3ae39fc769' +
+      'fc54f2395ae6a1178cab4738e543072f' +
+      'c1c177fe71e92e25bf03e4ecb72f47b6' +
+      '4d0465aaea4c7fad372536c8ba516a60' +
+      '39c3c2a39f0e4d832be432dfa9a706a6' +
+      'e5c7e19f397964ca4258002f7c0541b5' +
+      '90316dbc5622b6b2a6fe7a4abffd9610' +
+      '5eca76ea7b98816af0748c10df048ce0' +
+      '12d901015a51f189f3888145c03650aa' +
+      '23ce894c3bd889e030d565071c59f409' +
+      'a9981b51878fd6fc110624dcbcde0bf7' +
+      'a69ccce38fabdf86f3bef6044819de11',
+    signature:
+      'c650ddbb0601c19ca11439e1640dd931' +
+      'f43c518ea5bea70d3dcde5f4191fe53f' +
+      '00cf966546b72bcc7d58be2b9badef28' +
+      '743954e3a44a23f880e8d4f1cfce2d7a' +
+      '61452d26da05896f0a50da66a239a8a1' +
+      '88b6d825b3305ad77b73fbac0836ecc6' +
+      '0987fd08527c1a8e80d5823e65cafe2a' +
+      '3d00',
+  },
+  {
+    secretKey:
+      '872d093780f5d3730df7c212664b37b8' +
+      'a0f24f56810daa8382cd4fa3f77634ec' +
+      '44dc54f1c2ed9bea86fafb7632d8be19' +
+      '9ea165f5ad55dd9ce8',
+    publicKey:
+      'a81b2e8a70a5ac94ffdbcc9badfc3feb' +
+      '0801f258578bb114ad44ece1ec0e799d' +
+      'a08effb81c5d685c0c56f64eecaef8cd' +
+      'f11cc38737838cf400',
+    message:
+      '6ddf802e1aae4986935f7f981ba3f035' +
+      '1d6273c0a0c22c9c0e8339168e675412' +
+      'a3debfaf435ed651558007db4384b650' +
+      'fcc07e3b586a27a4f7a00ac8a6fec2cd' +
+      '86ae4bf1570c41e6a40c931db27b2faa' +
+      '15a8cedd52cff7362c4e6e23daec0fbc' +
+      '3a79b6806e316efcc7b68119bf46bc76' +
+      'a26067a53f296dafdbdc11c77f7777e9' +
+      '72660cf4b6a9b369a6665f02e0cc9b6e' +
+      'dfad136b4fabe723d2813db3136cfde9' +
+      'b6d044322fee2947952e031b73ab5c60' +
+      '3349b307bdc27bc6cb8b8bbd7bd32321' +
+      '9b8033a581b59eadebb09b3c4f3d2277' +
+      'd4f0343624acc817804728b25ab79717' +
+      '2b4c5c21a22f9c7839d64300232eb66e' +
+      '53f31c723fa37fe387c7d3e50bdf9813' +
+      'a30e5bb12cf4cd930c40cfb4e1fc6225' +
+      '92a49588794494d56d24ea4b40c89fc0' +
+      '596cc9ebb961c8cb10adde976a5d602b' +
+      '1c3f85b9b9a001ed3c6a4d3b1437f520' +
+      '96cd1956d042a597d561a596ecd3d173' +
+      '5a8d570ea0ec27225a2c4aaff26306d1' +
+      '526c1af3ca6d9cf5a2c98f47e1c46db9' +
+      'a33234cfd4d81f2c98538a09ebe76998' +
+      'd0d8fd25997c7d255c6d66ece6fa56f1' +
+      '1144950f027795e653008f4bd7ca2dee' +
+      '85d8e90f3dc315130ce2a00375a318c7' +
+      'c3d97be2c8ce5b6db41a6254ff264fa6' +
+      '155baee3b0773c0f497c573f19bb4f42' +
+      '40281f0b1f4f7be857a4e59d416c06b4' +
+      'c50fa09e1810ddc6b1467baeac5a3668' +
+      'd11b6ecaa901440016f389f80acc4db9' +
+      '77025e7f5924388c7e340a732e554440' +
+      'e76570f8dd71b7d640b3450d1fd5f041' +
+      '0a18f9a3494f707c717b79b4bf75c984' +
+      '00b096b21653b5d217cf3565c9597456' +
+      'f70703497a078763829bc01bb1cbc8fa' +
+      '04eadc9a6e3f6699587a9e75c94e5bab' +
+      '0036e0b2e711392cff0047d0d6b05bd2' +
+      'a588bc109718954259f1d86678a579a3' +
+      '120f19cfb2963f177aeb70f2d4844826' +
+      '262e51b80271272068ef5b3856fa8535' +
+      'aa2a88b2d41f2a0e2fda7624c2850272' +
+      'ac4a2f561f8f2f7a318bfd5caf969614' +
+      '9e4ac824ad3460538fdc25421beec2cc' +
+      '6818162d06bbed0c40a387192349db67' +
+      'a118bada6cd5ab0140ee273204f628aa' +
+      'd1c135f770279a651e24d8c14d75a605' +
+      '9d76b96a6fd857def5e0b354b27ab937' +
+      'a5815d16b5fae407ff18222c6d1ed263' +
+      'be68c95f32d908bd895cd76207ae7264' +
+      '87567f9a67dad79abec316f683b17f2d' +
+      '02bf07e0ac8b5bc6162cf94697b3c27c' +
+      'd1fea49b27f23ba2901871962506520c' +
+      '392da8b6ad0d99f7013fbc06c2c17a56' +
+      '9500c8a7696481c1cd33e9b14e40b82e' +
+      '79a5f5db82571ba97bae3ad3e0479515' +
+      'bb0e2b0f3bfcd1fd33034efc6245eddd' +
+      '7ee2086ddae2600d8ca73e214e8c2b0b' +
+      'db2b047c6a464a562ed77b73d2d841c4' +
+      'b34973551257713b753632efba348169' +
+      'abc90a68f42611a40126d7cb21b58695' +
+      '568186f7e569d2ff0f9e745d0487dd2e' +
+      'b997cafc5abf9dd102e62ff66cba87',
+    signature:
+      'e301345a41a39a4d72fff8df69c98075' +
+      'a0cc082b802fc9b2b6bc503f926b65bd' +
+      'df7f4c8f1cb49f6396afc8a70abe6d8a' +
+      'ef0db478d4c6b2970076c6a0484fe76d' +
+      '76b3a97625d79f1ce240e7c576750d29' +
+      '5528286f719b413de9ada3e8eb78ed57' +
+      '3603ce30d8bb761785dc30dbc320869e' +
+      '1a00',
+  },
+];
+
+for (let i = 0; i < VECTORS_RFC8032.length; i++) {
+  const v = VECTORS_RFC8032[i];
+  should(`RFC8032/${i}`, () => {
+    deepStrictEqual(hex(ed.getPublicKey(v.secretKey)), v.publicKey);
+    deepStrictEqual(hex(ed.sign(v.message, v.secretKey)), v.signature);
+    deepStrictEqual(ed.verify(v.signature, v.message, v.publicKey), true);
+  });
+}
+
+should('ed448/should not accept >57byte private keys', async () => {
+  const invalidPriv =
+    100000000000000000000000000000000000009000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800073278156000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000n;
+  throws(() => ed.getPublicKey(invalidPriv));
+});
+
+function to57Bytes(numOrStr) {
+  let hex = typeof numOrStr === 'string' ? numOrStr : numOrStr.toString(16);
+  return hexToBytes(hex.padStart(114, '0'));
+}
+
+should('ed448/should verify recent signature', () => {
+  fc.assert(
+    fc.property(
+      fc.hexaString({ minLength: 2, maxLength: 57 }),
+      fc.bigInt(2n, ed.CURVE.n),
+      (message, privateKey) => {
+        const publicKey = ed.getPublicKey(to57Bytes(privateKey));
+        const signature = ed.sign(to57Bytes(message), to57Bytes(privateKey));
+        deepStrictEqual(publicKey.length, 57);
+        deepStrictEqual(signature.length, 114);
+        deepStrictEqual(ed.verify(signature, to57Bytes(message), publicKey), true);
+      }
+    ),
+    { numRuns: 5 }
+  );
+});
+should('ed448/should not verify signature with wrong message', () => {
+  fc.assert(
+    fc.property(
+      fc.array(fc.integer({ min: 0x00, max: 0xff })),
+      fc.array(fc.integer({ min: 0x00, max: 0xff })),
+      fc.bigInt(1n, ed.CURVE.n),
+      (bytes, wrongBytes, privateKey) => {
+        const message = new Uint8Array(bytes);
+        const wrongMessage = new Uint8Array(wrongBytes);
+        const priv = to57Bytes(privateKey);
+        const publicKey = ed.getPublicKey(priv);
+        const signature = ed.sign(message, priv);
+        deepStrictEqual(
+          ed.verify(signature, wrongMessage, publicKey),
+          bytes.toString() === wrongBytes.toString()
+        );
+      }
+    ),
+    { numRuns: 5 }
+  );
+});
+const privKey = to57Bytes('a665a45920422f9d417e4867ef');
+const msg = hexToBytes('874f9960c5d2b7a9b5fad383e1ba44719ebb743a');
+const wrongMsg = hexToBytes('589d8c7f1da0a24bc07b7381ad48b1cfc211af1c');
+should('ed25519/basic methods/should sign and verify', () => {
+  const publicKey = ed.getPublicKey(privKey);
+  const signature = ed.sign(msg, privKey);
+  deepStrictEqual(ed.verify(signature, msg, publicKey), true);
+});
+should('ed25519/basic methods/should not verify signature with wrong public key', () => {
+  const publicKey = ed.getPublicKey(12);
+  const signature = ed.sign(msg, privKey);
+  deepStrictEqual(ed.verify(signature, msg, publicKey), false);
+});
+should('ed25519/basic methods/should not verify signature with wrong hash', () => {
+  const publicKey = ed.getPublicKey(privKey);
+  const signature = ed.sign(msg, privKey);
+  deepStrictEqual(ed.verify(signature, wrongMsg, publicKey), false);
+});
+
+should('ed25519/sync methods/should sign and verify', () => {
+  const publicKey = ed.getPublicKey(privKey);
+  const signature = ed.sign(msg, privKey);
+  deepStrictEqual(ed.verify(signature, msg, publicKey), true);
+});
+should('ed25519/sync methods/should not verify signature with wrong public key', async () => {
+  const publicKey = ed.getPublicKey(12);
+  const signature = ed.sign(msg, privKey);
+  deepStrictEqual(ed.verify(signature, msg, publicKey), false);
+});
+should('ed25519/sync methods/should not verify signature with wrong hash', async () => {
+  const publicKey = ed.getPublicKey(privKey);
+  const signature = ed.sign(msg, privKey);
+  deepStrictEqual(ed.verify(signature, wrongMsg, publicKey), false);
+});
+
+should('ed25519/BASE_POINT.multiply()/should throw Point#multiply on TEST 5', () => {
+  for (const num of [0n, 0, -1n, -1, 1.1]) {
+    throws(() => ed.Point.BASE.multiply(num));
+  }
+});
+
+should('input immutability: sign/verify are immutable', () => {
+  const privateKey = ed.utils.randomPrivateKey();
+  const publicKey = ed.getPublicKey(privateKey);
+
+  for (let i = 0; i < 100; i++) {
+    let payload = randomBytes(100);
+    let signature = ed.sign(payload, privateKey);
+    if (!ed.verify(signature, payload, publicKey)) {
+      throw new Error('Signature verification failed');
+    }
+    const signatureCopy = Buffer.alloc(signature.byteLength);
+    signatureCopy.set(signature, 0); // <-- breaks
+    payload = payload.slice();
+    signature = signature.slice();
+
+    if (!ed.verify(signatureCopy, payload, publicKey))
+      throw new Error('Copied signature verification failed');
+  }
+});
+
+{
+  for (let g = 0; g < ed448vectors.testGroups.length; g++) {
+    const group = ed448vectors.testGroups[g];
+    const key = group.key;
+    should(`Wycheproof/ED448(${g}, public)`, () => {
+      deepStrictEqual(hex(ed.getPublicKey(key.sk)), key.pk);
+    });
+    should(`Wycheproof/ED448`, () => {
+      for (let i = 0; i < group.tests.length; i++) {
+        const v = group.tests[i];
+        const index = `${g}/${i} ${v.comment}`;
+        if (v.result === 'valid' || v.result === 'acceptable') {
+          deepStrictEqual(hex(ed.sign(v.msg, key.sk)), v.sig, index);
+          deepStrictEqual(ed.verify(v.sig, v.msg, key.pk), true, index);
+        } else if (v.result === 'invalid') {
+          let failed = false;
+          try {
+            failed = !ed.verify(v.sig, v.msg, key.pk);
+          } catch (error) {
+            failed = true;
+          }
+          deepStrictEqual(failed, true, index);
+        } else throw new Error('unknown test result');
+      }
+    });
+  }
+}
+
+// ECDH
+const rfc7748Mul = [
+  {
+    scalar:
+      '3d262fddf9ec8e88495266fea19a34d28882acef045104d0d1aae121700a779c984c24f8cdd78fbff44943eba368f54b29259a4f1c600ad3',
+    u: '06fce640fa3487bfda5f6cf2d5263f8aad88334cbd07437f020f08f9814dc031ddbdc38c19c6da2583fa5429db94ada18aa7a7fb4ef8a086',
+    outputU:
+      'ce3e4ff95a60dc6697da1db1d85e6afbdf79b50a2412d7546d5f239fe14fbaadeb445fc66a01b0779d98223961111e21766282f73dd96b6f',
+  },
+  {
+    scalar:
+      '203d494428b8399352665ddca42f9de8fef600908e0d461cb021f8c538345dd77c3e4806e25f46d3315c44e0a5b4371282dd2c8d5be3095f',
+    u: '0fbcc2f993cd56d3305b0b7d9e55d4c1a8fb5dbb52f8e9a1e9b6201b165d015894e56c4d3570bee52fe205e28a78b91cdfbde71ce8d157db',
+    outputU:
+      '884a02576239ff7a2f2f63b2db6a9ff37047ac13568e1e30fe63c4a7ad1b3ee3a5700df34321d62077e63633c575c1c954514e99da7c179d',
+  },
+];
+for (let i = 0; i < rfc7748Mul.length; i++) {
+  const v = rfc7748Mul[i];
+  should(`RFC7748: scalarMult (${i})`, () => {
+    deepStrictEqual(hex(x448.scalarMult(v.u, v.scalar)), v.outputU);
+  });
+}
+
+const rfc7748Iter = [
+  {
+    scalar:
+      '3f482c8a9f19b01e6c46ee9711d9dc14fd4bf67af30765c2ae2b846a4d23a8cd0db897086239492caf350b51f833868b9bc2b3bca9cf4113',
+    iters: 1,
+  },
+  {
+    scalar:
+      'aa3b4749d55b9daf1e5b00288826c467274ce3ebbdd5c17b975e09d4af6c67cf10d087202db88286e2b79fceea3ec353ef54faa26e219f38',
+    iters: 1000,
+  },
+  // { scalar: '077f453681caca3693198420bbe515cae0002472519b3e67661a7e89cab94695c8f4bcd66e61b9b9c946da8d524de3d69bd9d9d66b997e37', iters: 1000000 },
+];
+for (let i = 0; i < rfc7748Iter.length; i++) {
+  const { scalar, iters } = rfc7748Iter[i];
+  should(`RFC7748: scalarMult iteration (${i})`, () => {
+    let k = x448.Gu;
+    for (let i = 0, u = k; i < iters; i++) [k, u] = [x448.scalarMult(u, k), k];
+    deepStrictEqual(hex(k), scalar);
+  });
+}
+
+should('RFC7748 getSharedKey', () => {
+  const alicePrivate =
+    '9a8f4925d1519f5775cf46b04b5800d4ee9ee8bae8bc5565d498c28dd9c9baf574a9419744897391006382a6f127ab1d9ac2d8c0a598726b';
+  const alicePublic =
+    '9b08f7cc31b7e3e67d22d5aea121074a273bd2b83de09c63faa73d2c22c5d9bbc836647241d953d40c5b12da88120d53177f80e532c41fa0';
+  const bobPrivate =
+    '1c306a7ac2a0e2e0990b294470cba339e6453772b075811d8fad0d1d6927c120bb5ee8972b0d3e21374c9c921b09d1b0366f10b65173992d';
+  const bobPublic =
+    '3eb7a829b0cd20f5bcfc0b599b6feccf6da4627107bdb0d4f345b43027d8b972fc3e34fb4232a13ca706dcb57aec3dae07bdc1c67bf33609';
+  const shared =
+    '07fff4181ac6cc95ec1c16a94a0f74d12da232ce40a77552281d282bb60c0b56fd2464c335543936521c24403085d59a449a5037514a879d';
+  deepStrictEqual(alicePublic, hex(x448.getPublicKey(alicePrivate)));
+  deepStrictEqual(bobPublic, hex(x448.getPublicKey(bobPrivate)));
+  deepStrictEqual(hex(x448.scalarMult(bobPublic, alicePrivate)), shared);
+  deepStrictEqual(hex(x448.scalarMult(alicePublic, bobPrivate)), shared);
+});
+
+{
+  const group = x448vectors.testGroups[0];
+  should(`Wycheproof/X448`, () => {
+    for (let i = 0; i < group.tests.length; i++) {
+      const v = group.tests[i];
+      const index = `(${i}, ${v.result}) ${v.comment}`;
+      if (v.result === 'valid' || v.result === 'acceptable') {
+        try {
+          const shared = hex(x448.scalarMult(v.public, v.private));
+          deepStrictEqual(shared, v.shared, index);
+        } catch (e) {
+          // We are more strict
+          if (e.message.includes('Expected valid scalar')) return;
+          if (e.message.includes('Invalid private or public key received')) return;
+          if (e.message.includes('Expected 56 bytes')) return;
+          throw e;
+        }
+      } else if (v.result === 'invalid') {
+        let failed = false;
+        try {
+          x448.scalarMult(v.public, v.private);
+        } catch (error) {
+          failed = true;
+        }
+        deepStrictEqual(failed, true, index);
+      } else throw new Error('unknown test result');
+    }
+  });
+}
+
+// should('X448: should convert base point to montgomery using fromPoint', () => {
+//   deepStrictEqual(
+//     hex(ed.montgomeryCurve.UfromPoint(ed.Point.BASE)),
+//     ed.montgomeryCurve.BASE_POINT_U
+//   );
+// });
+
+// should('X448/getSharedSecret() should be commutative', async () => {
+//   for (let i = 0; i < 512; i++) {
+//     const asec = ed.utils.randomPrivateKey();
+//     const apub = ed.getPublicKey(asec);
+//     const bsec = ed.utils.randomPrivateKey();
+//     const bpub = ed.getPublicKey(bsec);
+//     try {
+//       deepStrictEqual(ed.getSharedSecret(asec, bpub), ed.getSharedSecret(bsec, apub));
+//     } catch (error) {
+//       console.error('not commutative', { asec, apub, bsec, bpub });
+//       throw error;
+//     }
+//   }
+// });
+
+const VECTORS_RFC8032_CTX = [
+  {
+    secretKey:
+      'c4eab05d357007c632f3dbb48489924d552b08fe0c353a0d4a1f00acda2c463afbea67c5e8d2877c5e3bc397a659949ef8021e954e0a12274e',
+    publicKey:
+      '43ba28f430cdff456ae531545f7ecd0ac834a55d9358c0372bfa0c6c6798c0866aea01eb00742802b8438ea4cb82169c235160627b4c3a9480',
+    message: '03',
+    context: '666f6f',
+    signature:
+      'd4f8f6131770dd46f40867d6fd5d5055' +
+      'de43541f8c5e35abbcd001b32a89f7d2' +
+      '151f7647f11d8ca2ae279fb842d60721' +
+      '7fce6e042f6815ea000c85741de5c8da' +
+      '1144a6a1aba7f96de42505d7a7298524' +
+      'fda538fccbbb754f578c1cad10d54d0d' +
+      '5428407e85dcbc98a49155c13764e66c' +
+      '3c00',
+  },
+];
+
+for (let i = 0; i < VECTORS_RFC8032_CTX.length; i++) {
+  const v = VECTORS_RFC8032_CTX[i];
+  should(`RFC8032ctx/${i}`, () => {
+    deepStrictEqual(hex(ed.getPublicKey(v.secretKey)), v.publicKey);
+    deepStrictEqual(hex(ed.sign(v.message, v.secretKey, v.context)), v.signature);
+    deepStrictEqual(ed.verify(v.signature, v.message, v.publicKey, v.context), true);
+  });
+}
+
+const VECTORS_RFC8032_PH = [
+  {
+    secretKey:
+      '833fe62409237b9d62ec77587520911e9a759cec1d19755b7da901b96dca3d42ef7822e0d5104127dc05d6dbefde69e3ab2cec7c867c6e2c49',
+    publicKey:
+      '259b71c19f83ef77a7abd26524cbdb3161b590a48f7d17de3ee0ba9c52beb743c09428a131d6b1b57303d90d8132c276d5ed3d5d01c0f53880',
+    message: '616263',
+    signature:
+      '822f6901f7480f3d5f562c592994d969' +
+      '3602875614483256505600bbc281ae38' +
+      '1f54d6bce2ea911574932f52a4e6cadd' +
+      '78769375ec3ffd1b801a0d9b3f4030cd' +
+      '433964b6457ea39476511214f97469b5' +
+      '7dd32dbc560a9a94d00bff07620464a3' +
+      'ad203df7dc7ce360c3cd3696d9d9fab9' +
+      '0f00',
+  },
+  {
+    secretKey:
+      '833fe62409237b9d62ec77587520911e9a759cec1d19755b7da901b96dca3d42ef7822e0d5104127dc05d6dbefde69e3ab2cec7c867c6e2c49',
+    publicKey:
+      '259b71c19f83ef77a7abd26524cbdb3161b590a48f7d17de3ee0ba9c52beb743c09428a131d6b1b57303d90d8132c276d5ed3d5d01c0f53880',
+    message: '616263',
+    context: '666f6f',
+    signature:
+      'c32299d46ec8ff02b54540982814dce9' +
+      'a05812f81962b649d528095916a2aa48' +
+      '1065b1580423ef927ecf0af5888f90da' +
+      '0f6a9a85ad5dc3f280d91224ba9911a3' +
+      '653d00e484e2ce232521481c8658df30' +
+      '4bb7745a73514cdb9bf3e15784ab7128' +
+      '4f8d0704a608c54a6b62d97beb511d13' +
+      '2100',
+  },
+];
+
+for (let i = 0; i < VECTORS_RFC8032_PH.length; i++) {
+  const v = VECTORS_RFC8032_PH[i];
+  should(`RFC8032ph/${i}`, () => {
+    deepStrictEqual(hex(ed448ph.getPublicKey(v.secretKey)), v.publicKey);
+    deepStrictEqual(hex(ed448ph.sign(v.message, v.secretKey, v.context)), v.signature);
+    deepStrictEqual(ed448ph.verify(v.signature, v.message, v.publicKey, v.context), true);
+  });
+}
+
+should('X448 base point', () => {
+  const { x, y } = ed448.Point.BASE;
+  const { P } = ed448.CURVE;
+  const invX = ed448.utils.invert(x * x, P); // x^2
+  const u = ed448.utils.mod(y * y * invX, P); // (y^2/x^2)
+  deepStrictEqual(hex(numberToBytesLE(u, 56)), x448.Gu);
+});
+
+// ESM is broken.
+import url from 'url';
+if (import.meta.url === url.pathToFileURL(process.argv[1]).href) {
+  should.run();
+}

curve-definitions/test/index.test.js

@@ -1,8 +1,12 @@
 import { should } from 'micro-should';
 
+// Should be first to catch obvious things
 import './basic.test.js';
-import './rfc6979.test.js';
+import './nist.test.js';
+import './ed448.test.js';
+import './ed25519.test.js';
 import './secp256k1.test.js';
-import './starknet/starknet.test.js';
+import './stark/stark.test.js';
+import './jubjub.test.js';
 
 should.run();

curve-definitions/test/jubjub.test.js

@@ -0,0 +1,74 @@
+import { jubjub, findGroupHash } from '../lib/jubjub.js';
+import { should } from 'micro-should';
+import { deepStrictEqual, throws } from 'assert';
+import { hexToBytes, bytesToHex } from '@noble/hashes/utils';
+
+const G_SPEND = new jubjub.ExtendedPoint(
+  0x055f1f24f0f0512287e51c3c5a0a6903fc0baf8711de9eafd7c0e66f69d8d2dbn,
+  0x566178b2505fdd52132a5007d80a04652842e78ffb376897588f406278214ed7n,
+  0x0141fafa1f11088a3b2007c14d652375888f3b37838ba6bdffae096741ceddfen,
+  0x12eada93c0b7d595f5f04f5ebfb4b7d033ef2884136475cab5e41ce17db5be9cn
+);
+const G_PROOF = new jubjub.ExtendedPoint(
+  0x0174d54ce9fad258a2f8a86a1deabf15c7a2b51106b0fbcd9d29020f78936f71n,
+  0x16871d6d877dcd222e4ec3bccb3f37cb1865a2d37dd3a5dcbc032a69b62b4445n,
+  0x57a3cd31e496d82bd4aa78bd5ecd751cfb76d54a5d3f4560866379f9fc11c9b3n,
+  0x42cc53f6b519d1f4f52c47ff1256463a616c2c2f49ffe77765481eca04c72081n
+);
+
+const getXY = (p) => ({ x: p.x, y: p.y });
+
+should('toHex/fromHex', () => {
+  // More than field
+  throws(() =>
+    jubjub.Point.fromHex(
+      new Uint8Array([
+        255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255,
+        255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255,
+      ])
+    )
+  );
+  // Multiplicative generator (sqrt == null), not on curve.
+  throws(() =>
+    jubjub.Point.fromHex(
+      new Uint8Array([
+        7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        0,
+      ])
+    )
+  );
+  const tmp = jubjub.Point.fromHex(
+    new Uint8Array([
+      0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+      0,
+    ])
+  );
+  deepStrictEqual(tmp.x, 0x8d51ccce760304d0ec030002760300000001000000000000n);
+  deepStrictEqual(tmp.y, 0n);
+
+  const S = G_SPEND.toAffine().toRawBytes();
+  const S2 = G_SPEND.double().toAffine().toRawBytes();
+  const P = G_PROOF.toAffine().toRawBytes();
+  const P2 = G_PROOF.double().toAffine().toRawBytes();
+  const S_exp = jubjub.Point.fromHex(S);
+  const S2_exp = jubjub.Point.fromHex(S2);
+  const P_exp = jubjub.Point.fromHex(P);
+  const P2_exp = jubjub.Point.fromHex(P2);
+  deepStrictEqual(getXY(G_SPEND.toAffine()), getXY(S_exp));
+  deepStrictEqual(getXY(G_SPEND.double().toAffine()), getXY(S2_exp));
+  deepStrictEqual(getXY(G_PROOF.toAffine()), getXY(P_exp));
+  deepStrictEqual(getXY(G_PROOF.double().toAffine()), getXY(P2_exp));
+});
+
+should('Find generators', () => {
+  const spend = findGroupHash(new Uint8Array(), new Uint8Array([90, 99, 97, 115, 104, 95, 71, 95]));
+  const proof = findGroupHash(new Uint8Array(), new Uint8Array([90, 99, 97, 115, 104, 95, 72, 95]));
+  deepStrictEqual(getXY(spend.toAffine()), getXY(G_SPEND.toAffine()));
+  deepStrictEqual(getXY(proof.toAffine()), getXY(G_PROOF.toAffine()));
+});
+
+// ESM is broken.
+import url from 'url';
+if (import.meta.url === url.pathToFileURL(process.argv[1]).href) {
+  should.run();
+}

curve-definitions/test/nist.test.js

@@ -0,0 +1,387 @@
+import { deepStrictEqual, throws } from 'assert';
+import { should } from 'micro-should';
+import { secp192r1, P192 } from '../lib/p192.js';
+import { secp224r1, P224 } from '../lib/p224.js';
+import { secp256r1, P256 } from '../lib/p256.js';
+import { secp384r1, P384 } from '../lib/p384.js';
+import { secp521r1, P521 } from '../lib/p521.js';
+import { secp256k1 } from '../lib/secp256k1.js';
+import { hexToBytes, bytesToHex } from '@noble/curves/utils';
+import { default as ecdsa } from './wycheproof/ecdsa_test.json' assert { type: 'json' };
+import { default as ecdh } from './wycheproof/ecdh_test.json' assert { type: 'json' };
+import { default as rfc6979 } from './fixtures/rfc6979.json' assert { type: 'json' };
+
+const hex = bytesToHex;
+
+// prettier-ignore
+const NIST = {
+  secp192r1, P192,
+  secp224r1, P224,
+  secp256r1, P256,
+  secp384r1, P384,
+  secp521r1, P521,
+  secp256k1,
+};
+
+should('Curve Fields', () => {
+  const vectors = {
+    secp192r1: 0xfffffffffffffffffffffffffffffffeffffffffffffffffn,
+    secp224r1: 0xffffffffffffffffffffffffffffffff000000000000000000000001n,
+    secp256r1: 0xffffffff00000001000000000000000000000000ffffffffffffffffffffffffn,
+    secp256k1: 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2fn,
+    secp384r1:
+      0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffff0000000000000000ffffffffn,
+    secp521r1:
+      0x01ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffn,
+  };
+  for (const n in vectors) deepStrictEqual(NIST[n].CURVE.P, vectors[n]);
+});
+
+should('wychenproof ECDSA vectors', () => {
+  for (const group of ecdsa.testGroups) {
+    // Tested in secp256k1.test.js
+    if (group.key.curve === 'secp256k1') continue;
+    // We don't have SHA-224
+    if (group.key.curve === 'secp224r1' && group.sha === 'SHA-224') continue;
+    const CURVE = NIST[group.key.curve];
+    if (!CURVE) continue;
+    const pubKey = CURVE.Point.fromHex(group.key.uncompressed);
+    deepStrictEqual(pubKey.x, BigInt(`0x${group.key.wx}`));
+    deepStrictEqual(pubKey.y, BigInt(`0x${group.key.wy}`));
+    for (const test of group.tests) {
+      if (['Hash weaker than DL-group'].includes(test.comment)) {
+        continue;
+      }
+      const m = CURVE.CURVE.hash(hexToBytes(test.msg));
+      if (test.result === 'valid' || test.result === 'acceptable') {
+        try {
+          CURVE.Signature.fromDER(test.sig);
+        } catch (e) {
+          // Some test has invalid signature which we don't accept
+          if (e.message.includes('Invalid signature: incorrect length')) continue;
+          throw e;
+        }
+        const verified = CURVE.verify(test.sig, m, pubKey);
+        deepStrictEqual(verified, true, 'valid');
+      } else if (test.result === 'invalid') {
+        let failed = false;
+        try {
+          failed = !CURVE.verify(test.sig, m, pubKey);
+        } catch (error) {
+          failed = true;
+        }
+        deepStrictEqual(failed, true, 'invalid');
+      } else throw new Error('unknown test result');
+    }
+  }
+});
+
+should('wychenproof ECDH vectors', () => {
+  for (const group of ecdh.testGroups) {
+    // // Tested in secp256k1.test.js
+    // if (group.key.curve === 'secp256k1') continue;
+    // We don't have SHA-224
+    const CURVE = NIST[group.curve];
+    if (!CURVE) continue;
+    for (const test of group.tests) {
+      if (test.result === 'valid' || test.result === 'acceptable') {
+        try {
+          const pub = CURVE.Point.fromHex(test.public);
+        } catch (e) {
+          if (e.message.includes('Point.fromHex: received invalid point.')) continue;
+          throw e;
+        }
+        const shared = CURVE.getSharedSecret(test.private, test.public);
+        deepStrictEqual(shared, test.shared, 'valid');
+      } else if (test.result === 'invalid') {
+        let failed = false;
+        try {
+          CURVE.getSharedSecret(test.private, test.public);
+        } catch (error) {
+          failed = true;
+        }
+        deepStrictEqual(failed, true, 'invalid');
+      } else throw new Error('unknown test result');
+    }
+  }
+});
+
+import { default as ecdh_secp224r1_test } from './wycheproof/ecdh_secp224r1_test.json' assert { type: 'json' };
+import { default as ecdh_secp256r1_test } from './wycheproof/ecdh_secp256r1_test.json' assert { type: 'json' };
+import { default as ecdh_secp256k1_test } from './wycheproof/ecdh_secp256k1_test.json' assert { type: 'json' };
+import { default as ecdh_secp384r1_test } from './wycheproof/ecdh_secp384r1_test.json' assert { type: 'json' };
+import { default as ecdh_secp521r1_test } from './wycheproof/ecdh_secp521r1_test.json' assert { type: 'json' };
+
+// More per curve tests
+const WYCHEPROOF_ECDH = {
+  P224: {
+    curve: P224,
+    tests: [ecdh_secp224r1_test],
+  },
+  P256: {
+    curve: P256,
+    tests: [ecdh_secp256r1_test],
+  },
+  secp256k1: {
+    curve: secp256k1,
+    tests: [ecdh_secp256k1_test],
+  },
+  P384: {
+    curve: P384,
+    tests: [ecdh_secp384r1_test],
+  },
+  P521: {
+    curve: P521,
+    tests: [ecdh_secp521r1_test],
+  },
+};
+
+for (const name in WYCHEPROOF_ECDH) {
+  const { curve, tests } = WYCHEPROOF_ECDH[name];
+  for (let i = 0; i < tests.length; i++) {
+    const test = tests[i];
+    for (let j = 0; j < test.testGroups.length; j++) {
+      const group = test.testGroups[j];
+      should(`Wycheproof/ECDH ${name} (${i}/${j})`, () => {
+        for (const test of group.tests) {
+          if (test.result === 'valid' || test.result === 'acceptable') {
+            try {
+              const pub = curve.Point.fromHex(test.public);
+            } catch (e) {
+              if (e.message.includes('Point.fromHex: received invalid point.')) continue;
+              throw e;
+            }
+            const shared = curve.getSharedSecret(test.private, test.public);
+            deepStrictEqual(hex(shared), test.shared, 'valid');
+          } else if (test.result === 'invalid') {
+            let failed = false;
+            try {
+              curve.getSharedSecret(test.private, test.public);
+            } catch (error) {
+              failed = true;
+            }
+            deepStrictEqual(failed, true, 'invalid');
+          } else throw new Error('unknown test result');
+        }
+      });
+    }
+  }
+}
+
+// Tests with custom hashes
+import { default as secp224r1_sha224_test } from './wycheproof/ecdsa_secp224r1_sha224_test.json' assert { type: 'json' };
+import { default as secp224r1_sha256_test } from './wycheproof/ecdsa_secp224r1_sha256_test.json' assert { type: 'json' };
+import { default as secp224r1_sha3_224_test } from './wycheproof/ecdsa_secp224r1_sha3_224_test.json' assert { type: 'json' };
+import { default as secp224r1_sha3_256_test } from './wycheproof/ecdsa_secp224r1_sha3_256_test.json' assert { type: 'json' };
+import { default as secp224r1_sha3_512_test } from './wycheproof/ecdsa_secp224r1_sha3_512_test.json' assert { type: 'json' };
+import { default as secp224r1_sha512_test } from './wycheproof/ecdsa_secp224r1_sha512_test.json' assert { type: 'json' };
+
+import { default as secp256k1_sha256_test } from './wycheproof/ecdsa_secp256k1_sha256_test.json' assert { type: 'json' };
+import { default as secp256k1_sha3_256_test } from './wycheproof/ecdsa_secp256k1_sha3_256_test.json' assert { type: 'json' };
+import { default as secp256k1_sha3_512_test } from './wycheproof/ecdsa_secp256k1_sha3_512_test.json' assert { type: 'json' };
+import { default as secp256k1_sha512_test } from './wycheproof/ecdsa_secp256k1_sha512_test.json' assert { type: 'json' };
+
+import { default as secp256r1_sha256_test } from './wycheproof/ecdsa_secp256r1_sha256_test.json' assert { type: 'json' };
+import { default as secp256r1_sha3_256_test } from './wycheproof/ecdsa_secp256r1_sha3_256_test.json' assert { type: 'json' };
+import { default as secp256r1_sha3_512_test } from './wycheproof/ecdsa_secp256r1_sha3_512_test.json' assert { type: 'json' };
+import { default as secp256r1_sha512_test } from './wycheproof/ecdsa_secp256r1_sha512_test.json' assert { type: 'json' };
+
+import { default as secp384r1_sha384_test } from './wycheproof/ecdsa_secp384r1_sha384_test.json' assert { type: 'json' };
+import { default as secp384r1_sha3_384_test } from './wycheproof/ecdsa_secp384r1_sha3_384_test.json' assert { type: 'json' };
+import { default as secp384r1_sha3_512_test } from './wycheproof/ecdsa_secp384r1_sha3_512_test.json' assert { type: 'json' };
+import { default as secp384r1_sha512_test } from './wycheproof/ecdsa_secp384r1_sha512_test.json' assert { type: 'json' };
+
+import { default as secp521r1_sha3_512_test } from './wycheproof/ecdsa_secp521r1_sha3_512_test.json' assert { type: 'json' };
+import { default as secp521r1_sha512_test } from './wycheproof/ecdsa_secp521r1_sha512_test.json' assert { type: 'json' };
+
+import { sha3_224, sha3_256, sha3_384, sha3_512 } from '@noble/hashes/sha3';
+import { sha512, sha384 } from '@noble/hashes/sha512';
+import { sha256 } from '@noble/hashes/sha256';
+
+const WYCHEPROOF_ECDSA = {
+  P224: {
+    curve: P224,
+    hashes: {
+      // sha224 not released yet
+      // sha224: {
+      //   hash: sha224,
+      //   tests: [secp224r1_sha224_test],
+      // },
+      sha256: {
+        hash: sha256,
+        tests: [secp224r1_sha256_test],
+      },
+      sha3_224: {
+        hash: sha3_224,
+        tests: [secp224r1_sha3_224_test],
+      },
+      sha3_256: {
+        hash: sha3_256,
+        tests: [secp224r1_sha3_256_test],
+      },
+      sha3_512: {
+        hash: sha3_512,
+        tests: [secp224r1_sha3_512_test],
+      },
+      sha512: {
+        hash: sha512,
+        tests: [secp224r1_sha512_test],
+      },
+    },
+  },
+  secp256k1: {
+    curve: secp256k1,
+    hashes: {
+      // TODO: debug why fails, can be bug
+      sha256: {
+        hash: sha256,
+        tests: [secp256k1_sha256_test],
+      },
+      sha3_256: {
+        hash: sha3_256,
+        tests: [secp256k1_sha3_256_test],
+      },
+      sha3_512: {
+        hash: sha3_512,
+        tests: [secp256k1_sha3_512_test],
+      },
+      sha512: {
+        hash: sha512,
+        tests: [secp256k1_sha512_test],
+      },
+    },
+  },
+  P256: {
+    curve: P256,
+    hashes: {
+      sha256: {
+        hash: sha256,
+        tests: [secp256r1_sha256_test],
+      },
+      sha3_256: {
+        hash: sha3_256,
+        tests: [secp256r1_sha3_256_test],
+      },
+      sha3_512: {
+        hash: sha3_512,
+        tests: [secp256r1_sha3_512_test],
+      },
+      sha512: {
+        hash: sha512,
+        tests: [secp256r1_sha512_test],
+      },
+    },
+  },
+  P384: {
+    curve: P384,
+    hashes: {
+      sha384: {
+        hash: sha384,
+        tests: [secp384r1_sha384_test],
+      },
+      sha3_384: {
+        hash: sha3_384,
+        tests: [secp384r1_sha3_384_test],
+      },
+      sha3_512: {
+        hash: sha3_512,
+        tests: [secp384r1_sha3_512_test],
+      },
+      sha512: {
+        hash: sha512,
+        tests: [secp384r1_sha512_test],
+      },
+    },
+  },
+  P521: {
+    curve: P521,
+    hashes: {
+      sha3_512: {
+        hash: sha3_512,
+        tests: [secp521r1_sha3_512_test],
+      },
+      sha512: {
+        hash: sha512,
+        tests: [secp521r1_sha512_test],
+      },
+    },
+  },
+};
+
+function runWycheproof(name, CURVE, group, index) {
+  const pubKey = CURVE.Point.fromHex(group.key.uncompressed);
+  deepStrictEqual(pubKey.x, BigInt(`0x${group.key.wx}`));
+  deepStrictEqual(pubKey.y, BigInt(`0x${group.key.wy}`));
+  for (const test of group.tests) {
+    const m = CURVE.CURVE.hash(hexToBytes(test.msg));
+
+    if (test.result === 'valid' || test.result === 'acceptable') {
+      try {
+        CURVE.Signature.fromDER(test.sig);
+      } catch (e) {
+        // Some tests has invalid signature which we don't accept
+        if (e.message.includes('Invalid signature: incorrect length')) continue;
+        throw e;
+      }
+      const verified = CURVE.verify(test.sig, m, pubKey);
+      if (name === 'secp256k1') {
+        // lowS: true for secp256k1
+        deepStrictEqual(verified, !CURVE.Signature.fromDER(test.sig).hasHighS(), `${index}: valid`);
+      } else {
+        deepStrictEqual(verified, true, `${index}: valid`);
+      }
+
+    } else if (test.result === 'invalid') {
+      let failed = false;
+      try {
+        failed = !CURVE.verify(test.sig, m, pubKey);
+      } catch (error) {
+        failed = true;
+      }
+      deepStrictEqual(failed, true, `${index}: invalid`);
+    } else throw new Error('unknown test result');
+  }
+}
+
+for (const name in WYCHEPROOF_ECDSA) {
+  const { curve, hashes } = WYCHEPROOF_ECDSA[name];
+  for (const hName in hashes) {
+    const { hash, tests } = hashes[hName];
+    const CURVE = curve.create(hash);
+    should(`Wycheproof/WYCHEPROOF_ECDSA ${name}/${hName}`, () => {
+      for (let i = 0; i < tests.length; i++) {
+        const groups = tests[i].testGroups;
+        for (let j = 0; j < groups.length; j++) {
+          const group = groups[j];
+          runWycheproof(name, CURVE, group, `${i}/${j}`);
+        }
+      }
+    });
+  }
+}
+
+const hexToBigint = (hex) => BigInt(`0x${hex}`);
+should('RFC6979', () => {
+  for (const v of rfc6979) {
+    const curve = NIST[v.curve];
+    deepStrictEqual(curve.CURVE.n, hexToBigint(v.q));
+    const pubKey = curve.getPublicKey(v.private);
+    const pubPoint = curve.Point.fromHex(pubKey);
+    deepStrictEqual(pubPoint.x, hexToBigint(v.Ux));
+    deepStrictEqual(pubPoint.y, hexToBigint(v.Uy));
+    for (const c of v.cases) {
+      const h = curve.CURVE.hash(c.message);
+      const sigObj = curve.sign(h, v.private);
+      deepStrictEqual(sigObj.r, hexToBigint(c.r), 'R');
+      deepStrictEqual(sigObj.s, hexToBigint(c.s), 'S');
+      deepStrictEqual(curve.verify(sigObj.toDERRawBytes(), h, pubKey), true, 'verify(1)');
+      deepStrictEqual(curve.verify(sigObj, h, pubKey), true, 'verify(2)');
+    }
+  }
+});
+
+// ESM is broken.
+import url from 'url';
+if (import.meta.url === url.pathToFileURL(process.argv[1]).href) {
+  should.run();
+}

curve-definitions/test/package.json

@@ -0,0 +1,7 @@
+{
+  "type": "module",
+  "browser": {
+    "crypto": false,
+    "./crypto": "./esm/cryptoBrowser.js"
+  }
+}

curve-definitions/test/rfc6979.test.js

@@ -1,33 +0,0 @@
-import { deepStrictEqual } from 'assert';
-import { should } from 'micro-should';
-import * as nist from '../lib/nist.js';
-import { default as rfc6979 } from './fixtures/rfc6979.json' assert { type: 'json' };
-function hexToBigint(hex) {
-  return BigInt('0x' + hex)
-}
-
-should('RFC6979', () => {
-  for (const v of rfc6979) {
-    const curve = nist[v.curve];
-    deepStrictEqual(curve.CURVE.n, hexToBigint(v.q));
-    const pubKey = curve.getPublicKey(v.private);
-    const pubPoint = curve.Point.fromHex(pubKey);
-    deepStrictEqual(pubPoint.x, hexToBigint(v.Ux));
-    deepStrictEqual(pubPoint.y, hexToBigint(v.Uy));
-    for (const c of v.cases) {
-      const h = curve.CURVE.hash(c.message);
-      const sigObj = curve.sign(h, v.private);
-      // const sigObj = curve.Signature.fromDER(sig);
-      deepStrictEqual(sigObj.r, hexToBigint(c.r), 'R');
-      deepStrictEqual(sigObj.s, hexToBigint(c.s), 'S');
-      deepStrictEqual(curve.verify(sigObj.toDERRawBytes(), h, pubKey), true, 'verify(1)');
-      deepStrictEqual(curve.verify(sigObj, h, pubKey), true, 'verify(2)');
-    }
-  }
-});
-
-// ESM is broken.
-import url from 'url';
-if (import.meta.url === url.pathToFileURL(process.argv[1]).href) {
-  should.run();
-}

curve-definitions/test/secp256k1.test.js

@@ -1,5 +1,5 @@
 import * as fc from 'fast-check';
-import * as nist from '../lib/nist.js';
+import { secp256k1, schnorr } from '../lib/secp256k1.js';
 import { readFileSync } from 'fs';
 import { default as ecdsa } from './vectors/ecdsa.json' assert { type: 'json' };
 import { default as ecdh } from './vectors/ecdh.json' assert { type: 'json' };
@@ -7,11 +7,11 @@ import { default as privates } from './vectors/privates.json' assert { type: 'js
 import { default as points } from './vectors/points.json' assert { type: 'json' };
 import { default as wp } from './vectors/wychenproof.json' assert { type: 'json' };
 import { should } from 'micro-should';
-import { deepStrictEqual, throws, rejects } from 'assert';
+import { deepStrictEqual, throws } from 'assert';
 import { hexToBytes, bytesToHex } from '@noble/hashes/utils';
 
 const hex = bytesToHex;
-const secp = nist.secp256k1;
+const secp = secp256k1;
 const privatesTxt = readFileSync('./test/vectors/privates-2.txt', 'utf-8');
 const schCsv = readFileSync('./test/vectors/schnorr.csv', 'utf-8');
 
@@ -192,35 +192,28 @@ should('secp256k1.Signature.fromDERHex() roundtrip', () => {
   );
 });
 
-should('secp256k1.sign()/should create deterministic signatures with RFC 6979', async () => {
+should('secp256k1.sign()/should create deterministic signatures with RFC 6979', () => {
   for (const vector of ecdsa.valid) {
-    let usig = await secp.sign(vector.m, vector.d);
-    let sig = (usig.toCompactHex());
+    let usig = secp.sign(vector.m, vector.d);
+    let sig = usig.toCompactHex();
     const vsig = vector.signature;
     deepStrictEqual(sig.slice(0, 64), vsig.slice(0, 64));
     deepStrictEqual(sig.slice(64, 128), vsig.slice(64, 128));
   }
 });
 
-should(
-  'secp256k1.sign()/should not create invalid deterministic signatures with RFC 6979',
-  async () => {
+should('secp256k1.sign()/should not create invalid deterministic signatures with RFC 6979', () => {
   for (const vector of ecdsa.invalid.sign) {
-      throws(() => {
-        return secp.sign(vector.m, vector.d);
-      });
+    throws(() => secp.sign(vector.m, vector.d));
   }
-  }
-);
-
-should('secp256k1.sign()/edge cases', () => {
-  // @ts-ignore
-  rejects(async () => await secp.sign());
-  // @ts-ignore
-  rejects(async () => await secp.sign(''));
 });
 
-should('secp256k1.sign()/should create correct DER encoding against libsecp256k1', async () => {
+should('secp256k1.sign()/edge cases', () => {
+  throws(() => secp.sign());
+  throws(() => secp.sign(''));
+});
+
+should('secp256k1.sign()/should create correct DER encoding against libsecp256k1', () => {
   const CASES = [
     [
       'd1a9dc8ed4e46a6a3e5e594615ca351d7d7ef44df1e4c94c1802f3592183794b',
@@ -236,14 +229,14 @@ should('secp256k1.sign()/should create correct DER encoding against libsecp256k1
     ],
   ];
   const privKey = hexToBytes('0101010101010101010101010101010101010101010101010101010101010101');
-  for (let [msg, exp] of CASES) {
-    const res = await secp.sign(msg, privKey, { extraEntropy: undefined });
-    deepStrictEqual((res.toDERHex()), exp);
+  for (const [msg, exp] of CASES) {
+    const res = secp.sign(msg, privKey, { extraEntropy: undefined });
+    deepStrictEqual(res.toDERHex(), exp);
     const rs = secp.Signature.fromDER(res.toDERHex()).toCompactHex();
     deepStrictEqual(secp.Signature.fromCompact(rs).toDERHex(), exp);
   }
 });
-should('secp256k1.sign()/sign ecdsa extraData', async () => {
+should('secp256k1.sign()/sign ecdsa extraData', () => {
   const ent1 = '0000000000000000000000000000000000000000000000000000000000000000';
   const ent2 = '0000000000000000000000000000000000000000000000000000000000000001';
   const ent3 = '6e723d3fd94ed5d2b6bdd4f123364b0f3ca52af829988a63f8afe91d29db1c33';
@@ -251,56 +244,52 @@ should('secp256k1.sign()/sign ecdsa extraData', async () => {
   const ent5 = 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff';
 
   for (const e of ecdsa.extraEntropy) {
-    const sign = async (extraEntropy) => {
-      const s = secp.sign(e.m, e.d, {extraEntropy }).toCompactHex();
+    const sign = (extraEntropy) => {
+      const s = secp.sign(e.m, e.d, { extraEntropy }).toCompactHex();
       return s;
     };
-    deepStrictEqual(await sign(), e.signature);
-    deepStrictEqual(await sign(ent1), e.extraEntropy0);
-    deepStrictEqual(await sign(ent2), e.extraEntropy1);
-    deepStrictEqual(await sign(ent3), e.extraEntropyRand);
-    deepStrictEqual(await sign(ent4), e.extraEntropyN);
-    deepStrictEqual(await sign(ent5), e.extraEntropyMax);
+    deepStrictEqual(sign(), e.signature);
+    deepStrictEqual(sign(ent1), e.extraEntropy0);
+    deepStrictEqual(sign(ent2), e.extraEntropy1);
+    deepStrictEqual(sign(ent3), e.extraEntropyRand);
+    deepStrictEqual(sign(ent4), e.extraEntropyN);
+    deepStrictEqual(sign(ent5), e.extraEntropyMax);
   }
 });
 
-should('secp256k1.verify()/should verify signature', async () => {
+should('secp256k1.verify()/should verify signature', () => {
   const MSG = '01'.repeat(32);
   const PRIV_KEY = 0x2n;
-  const signature = await secp.sign(MSG, PRIV_KEY);
+  const signature = secp.sign(MSG, PRIV_KEY);
   const publicKey = secp.getPublicKey(PRIV_KEY);
   deepStrictEqual(publicKey.length, 65);
   deepStrictEqual(secp.verify(signature, MSG, publicKey), true);
 });
-should('secp256k1.verify()/should not verify signature with wrong public key', async () => {
+should('secp256k1.verify()/should not verify signature with wrong public key', () => {
   const MSG = '01'.repeat(32);
   const PRIV_KEY = 0x2n;
   const WRONG_PRIV_KEY = 0x22n;
-  const signature = await secp.sign(MSG, PRIV_KEY);
+  const signature = secp.sign(MSG, PRIV_KEY);
   const publicKey = secp.Point.fromPrivateKey(WRONG_PRIV_KEY).toHex();
   deepStrictEqual(publicKey.length, 130);
   deepStrictEqual(secp.verify(signature, MSG, publicKey), false);
 });
-should('secp256k1.verify()/should not verify signature with wrong hash', async () => {
+should('secp256k1.verify()/should not verify signature with wrong hash', () => {
   const MSG = '01'.repeat(32);
   const PRIV_KEY = 0x2n;
   const WRONG_MSG = '11'.repeat(32);
-  const signature = await secp.sign(MSG, PRIV_KEY);
+  const signature = secp.sign(MSG, PRIV_KEY);
   const publicKey = secp.getPublicKey(PRIV_KEY);
   deepStrictEqual(publicKey.length, 65);
   deepStrictEqual(secp.verify(signature, WRONG_MSG, publicKey), false);
 });
-should('secp256k1.verify()/should verify random signatures', async () =>
+should('secp256k1.verify()/should verify random signatures', () =>
   fc.assert(
-    fc.asyncProperty(
-      FC_BIGINT,
-      fc.hexaString({ minLength: 64, maxLength: 64 }),
-      async (privKey, msg) => {
+    fc.property(FC_BIGINT, fc.hexaString({ minLength: 64, maxLength: 64 }), (privKey, msg) => {
       const pub = secp.getPublicKey(privKey);
-        const sig = await secp.sign(msg, privKey);
+      const sig = secp.sign(msg, privKey);
       deepStrictEqual(secp.verify(sig, msg, pub), true);
-      }
-    )
+    })
   )
 );
 should('secp256k1.verify()/should not verify signature with invalid r/s', () => {
@@ -315,16 +304,14 @@ should('secp256k1.verify()/should not verify signature with invalid r/s', () =>
 
   const pub = new secp.Point(x, y);
   const signature = new secp.Signature(2n, 2n);
-  // @ts-ignore
   signature.r = r;
-  // @ts-ignore
   signature.s = s;
 
   const verified = secp.verify(signature, msg, pub);
   // Verifies, but it shouldn't, because signature S > curve order
   deepStrictEqual(verified, false);
 });
-should('secp256k1.verify()/should not verify msg = curve order', async () => {
+should('secp256k1.verify()/should not verify msg = curve order', () => {
   const msg = 'fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141';
   const x = 55066263022277343669578718895168534326250603453777594175500187360389116729240n;
   const y = 32670510020758816978083085130507043184471273380659243275938904335757337482424n;
@@ -334,7 +321,7 @@ should('secp256k1.verify()/should not verify msg = curve order', async () => {
   const sig = new secp.Signature(r, s);
   deepStrictEqual(secp.verify(sig, msg, pub), false);
 });
-should('secp256k1.verify()/should verify non-strict msg bb5a...', async () => {
+should('secp256k1.verify()/should verify non-strict msg bb5a...', () => {
   const msg = 'bb5a52f42f9c9261ed4361f59422a1e30036e7c32b270c8807a419feca605023';
   const x = 3252872872578928810725465493269682203671229454553002637820453004368632726370n;
   const y = 17482644437196207387910659778872952193236850502325156318830589868678978890912n;
@@ -354,47 +341,35 @@ should(
   }
 );
 
-// describe('schnorr', () => {
-//   // index,secret key,public key,aux_rand,message,signature,verification result,comment
-//   const vectors = schCsv
-//     .split('\n')
-//     .map((line: string) => line.split(','))
-//     .slice(1, -1);
-//   for (let vec of vectors) {
-//     const [index, sec, pub, rnd, msg, expSig, passes, comment] = vec;
-//     it(`should sign with Schnorr scheme vector ${index}`, async () => {
-//       if (sec) {
-//         expect(hex(secp.schnorr.getPublicKey(sec))).toBe(pub.toLowerCase());
-//         const sig = await secp.schnorr.sign(msg, sec, rnd);
-//         const sigS = secp.schnorr.signSync(msg, sec, rnd);
-//         expect(hex(sig)).toBe(expSig.toLowerCase());
-//         expect(hex(sigS)).toBe(expSig.toLowerCase());
-//         expect(await secp.schnorr.verify(sigS, msg, pub)).toBe(true);
-//         expect(secp.schnorr.verifySync(sig, msg, pub)).toBe(true);
-//       } else {
-//         const passed = await secp.schnorr.verify(expSig, msg, pub);
-//         const passedS = secp.schnorr.verifySync(expSig, msg, pub);
-//         if (passes === 'TRUE') {
-//           expect(passed).toBeTruthy();
-//           expect(passedS).toBeTruthy();
-//         } else {
-//           expect(passed).toBeFalsy();
-//           expect(passedS).toBeFalsy();
-//         }
-//       }
-//     });
-//   }
-// });
+// index,secret key,public key,aux_rand,message,signature,verification result,comment
+const vectors = schCsv
+  .split('\n')
+  .map((line) => line.split(','))
+  .slice(1, -1);
+for (let vec of vectors) {
+  const [index, sec, pub, rnd, msg, expSig, passes, comment] = vec;
+  should(`sign with Schnorr scheme vector ${index}`, () => {
+    if (sec) {
+      deepStrictEqual(hex(schnorr.getPublicKey(sec)), pub.toLowerCase());
+      const sig = schnorr.sign(msg, sec, rnd);
+      deepStrictEqual(hex(sig), expSig.toLowerCase());
+      deepStrictEqual(schnorr.verify(sig, msg, pub), true);
+    } else {
+      const passed = schnorr.verify(expSig, msg, pub);
+      deepStrictEqual(passed, passes === 'TRUE');
+    }
+  });
+}
 
-should('secp256k1.recoverPublicKey()/should recover public key from recovery bit', async () => {
+should('secp256k1.recoverPublicKey()/should recover public key from recovery bit', () => {
   const message = '00000000000000000000000000000000000000000000000000000000deadbeef';
   const privateKey = 123456789n;
   const publicKey = secp.Point.fromHex(secp.getPublicKey(privateKey)).toHex(false);
-  const sig = await secp.sign(message, privateKey);
+  const sig = secp.sign(message, privateKey);
   const recoveredPubkey = sig.recoverPublicKey(message);
   // const recoveredPubkey = secp.recoverPublicKey(message, signature, recovery);
   deepStrictEqual(recoveredPubkey !== null, true);
-  deepStrictEqual((recoveredPubkey).toHex(), publicKey);
+  deepStrictEqual(recoveredPubkey.toHex(), publicKey);
   deepStrictEqual(secp.verify(sig, message, publicKey), true);
 });
 should('secp256k1.recoverPublicKey()/should not recover zero points', () => {
@@ -404,22 +379,22 @@ should('secp256k1.recoverPublicKey()/should not recover zero points', () => {
   const recovery = 0;
   throws(() => secp.recoverPublicKey(msgHash, sig, recovery));
 });
-should('secp256k1.recoverPublicKey()/should handle all-zeros msghash', async () => {
+should('secp256k1.recoverPublicKey()/should handle all-zeros msghash', () => {
   const privKey = secp.utils.randomPrivateKey();
   const pub = secp.getPublicKey(privKey);
   const zeros = '0000000000000000000000000000000000000000000000000000000000000000';
-  const sig = await secp.sign(zeros, privKey, { recovered: true });
+  const sig = secp.sign(zeros, privKey, { recovered: true });
   const recoveredKey = sig.recoverPublicKey(zeros);
   deepStrictEqual(recoveredKey.toRawBytes(), pub);
 });
-should('secp256k1.recoverPublicKey()/should handle RFC 6979 vectors', async () => {
+should('secp256k1.recoverPublicKey()/should handle RFC 6979 vectors', () => {
   for (const vector of ecdsa.valid) {
     if (secp.utils.mod(hexToNumber(vector.m), secp.CURVE.n) === 0n) continue;
     let usig = secp.sign(vector.m, vector.d);
-    let sig = (usig).toDERHex();
+    let sig = usig.toDERHex();
     const vpub = secp.getPublicKey(vector.d);
     const recovered = usig.recoverPublicKey(vector.m);
-    deepStrictEqual((recovered).toHex(), hex(vpub));
+    deepStrictEqual(recovered.toHex(), hex(vpub));
   }
 });
 

curve-definitions/test/stark/basic.test.js

@@ -1,6 +1,6 @@
 import { deepStrictEqual, throws } from 'assert';
 import { should } from 'micro-should';
-import * as starknet from '../../lib/starknet.js';
+import * as starknet from '../../lib/stark.js';
 import { default as issue2 } from './fixtures/issue2.json' assert { type: 'json' };
 
 should('Basic elliptic sanity check', () => {

curve-definitions/test/stark/benchmark/index.js

@@ -1,4 +1,4 @@
-import * as microStark from '../../../lib/starknet.js';
+import * as microStark from '../../../lib/stark.js';
 import * as starkwareCrypto from '@starkware-industries/starkware-crypto-utils';
 import * as bench from 'micro-bmark';
 const { run, mark } = bench; // or bench.mark

curve-definitions/test/stark/index.test.js

@@ -1,5 +1,5 @@
 
 import './basic.test.js';
-import './starknet.test.js';
+import './stark.test.js';
 import './property.test.js';
 

curve-definitions/test/stark/property.test.js

@@ -1,6 +1,6 @@
 import { deepStrictEqual, throws } from 'assert';
 import { should } from 'micro-should';
-import * as starknet from '../../lib/starknet.js';
+import * as starknet from '../../lib/stark.js';
 import * as fc from 'fast-check';
 
 const FC_BIGINT = fc.bigInt(1n + 1n, starknet.CURVE.n - 1n);

curve-definitions/test/stark/stark.test.js

@@ -3,7 +3,7 @@ import { should } from 'micro-should';
 import { hex, utf8 } from '@scure/base';
 import * as bip32 from '@scure/bip32';
 import * as bip39 from '@scure/bip39';
-import * as starknet from '../../lib/starknet.js';
+import * as starknet from '../../lib/stark.js';
 import { default as sigVec } from './fixtures/rfc6979_signature_test_vector.json' assert { type: 'json' };
 import { default as precomputedKeys } from './fixtures/keys_precomputed.json' assert { type: 'json' };
 

curve-definitions/test/wycheproof/ed448_test.json

@@ -0,0 +1,908 @@
+{
+  "algorithm" : "EDDSA",
+  "generatorVersion" : "0.8r12",
+  "numberOfTests" : 86,
+  "header" : [
+    "Test vectors of type EddsaVerify are intended for testing",
+    "the verification of Eddsa signatures."
+  ],
+  "notes" : {
+    "SignatureMalleability" : "EdDSA signatures are non-malleable, if implemented accordingly. Failing to check the range of S allows to modify signatures. See RFC 8032, Section 5.2.7 and Section 8.4."
+  },
+  "schema" : "eddsa_verify_schema.json",
+  "testGroups" : [
+    {
+      "jwk" : {
+        "crv" : "Ed448",
+        "d" : "iDAeB2UY01N_kwLuD1Ij5LY-HwFgB9PC69_sX3CZfoEZxrrQrnuAP0h5HKjsVJqiobhi96UVkLnV",
+        "kid" : "none",
+        "kty" : "OKP",
+        "x" : "QZYQpTSvEn9YOwSBjNt_D_MAsCXy4BaCvK4z_Wkc7gOVEd8M3caQ7peEJuizjlDOWvfc-6UPcEwA"
+      },
+      "key" : {
+        "curve" : "edwards448",
+        "keySize" : 448,
+        "pk" : "419610a534af127f583b04818cdb7f0ff300b025f2e01682bcae33fd691cee039511df0cddc690ee978426e8b38e50ce5af7dcfba50f704c00",
+        "sk" : "88301e076518d3537f9302ee0f5223e4b63e1f016007d3c2ebdfec5f70997e8119c6bad0ae7b803f48791ca8ec549aa2a1b862f7a51590b9d5",
+        "type" : "EDDSAKeyPair"
+      },
+      "keyDer" : "3043300506032b6571033a00419610a534af127f583b04818cdb7f0ff300b025f2e01682bcae33fd691cee039511df0cddc690ee978426e8b38e50ce5af7dcfba50f704c00",
+      "keyPem" : "-----BEGIN PUBLIC KEY-----\nMEMwBQYDK2VxAzoAQZYQpTSvEn9YOwSBjNt/D/MAsCXy4BaCvK4z/Wkc7gOVEd8M3caQ7peEJuizjlDOWvfc+6UPcEwA\n-----END PUBLIC KEY-----\n",
+      "type" : "EddsaVerify",
+      "tests" : [
+        {
+          "tcId" : 1,
+          "comment" : "",
+          "msg" : "",
+          "sig" : "cf7953007666e12f73af9ec92e3e018da5ee5a8d5b17f5100a354c58f1d5f4bb37ab835c52f72374c72d612689149cf6d36a70db6dc5a6c400b597348e0e31e51e65bb144e63c892a367b4c055c036aa6cd7e728cdd2a098963bda863903e6dd025b5a5d891209f4e28537694804e50b0800",
+          "result" : "valid",
+          "flags" : []
+        },
+        {
+          "tcId" : 2,
+          "comment" : "",
+          "msg" : "78",
+          "sig" : "c56e94d5c9ca860c244f33db556bf6b3cec38b024b77604a35d6a07211b1316b9a027133c374b86f72665cc45ce01583a2e0f2775c6172da801acef168717cab1196cddfb149359dfef589756257cc2d6b02fc516d8d41b4adaa3f11428f41410ef0dc3c1b008d3d052173d4389508ed0100",
+          "result" : "valid",
+          "flags" : []
+        },
+        {
+          "tcId" : 3,
+          "comment" : "",
+          "msg" : "54657374",
+          "sig" : "5d053ff5b71f6ec3284525d35d77933178c8e19879886d08eccc6c7d27e9e5b5e02537dbc4d4723506e8d171fc1733857573dd02d18f48f28031d67d699a188a9ca46b4eabe2107aef237ca609cb462e24c91d25d286402b6ef7862b78a386950246ff38d6d2f458136d12e3c97fdd982600",
+          "result" : "valid",
+          "flags" : []
+        },
+        {
+          "tcId" : 4,
+          "comment" : "",
+          "msg" : "48656c6c6f",
+          "sig" : "442e33780f199dd7bc71d1335f74df7f3a0ec789e21a175c1bffddb6e50091998d969ac8194b3acefb7702f6c222f84f7eeca3b80406f1fe80687915e7925bf52deb47b6b779e26d30eec7c5fef03580f280a089eefd0bacc9fbbb6a4d73a591d1671d192e6bbcfdb79ad3db5673a1263000",
+          "result" : "valid",
+          "flags" : []
+        },
+        {
+          "tcId" : 5,
+          "comment" : "",
+          "msg" : "313233343030",
+          "sig" : "5db94c53101f521f6c1f43b60ea4d7e06fbd49c2e8afaf4fcc289e645e0880a87b8e55858df4cf2291a7303ffda446b82a117b4dd408cff28060a05236fc9c1682b0e55b60a082c9a57bffe61ef4dda5ce65df539805122b3a09a05976d41ad68ab52df85428152c57da93531e5d16920e00",
+          "result" : "valid",
+          "flags" : []
+        },
+        {
+          "tcId" : 6,
+          "comment" : "",
+          "msg" : "000000000000000000000000",
+          "sig" : "a8ca64d1ab00eae77fd2854d8422db3ae12fca91c14f274f30a44df98590786ec4cbb96a9564fc1b9b16c22d2bd00aa65f0876323729f5ac809fb0b89a4d3f27afbabb596851d835173d60ea34e0875359f3d6adb13cef1395b7eaa5f9147583ff38b4deb183062874915bf194ae61072300",
+          "result" : "valid",
+          "flags" : []
+        },
+        {
+          "tcId" : 7,
+          "comment" : "",
+          "msg" : "6161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161",
+          "sig" : "b205d3e24ccef64c1e86f15f48ddfa682453503489475188b04a8f55860b3c8a9c01e6de820bb7d9b15daff8de25a4a870e987157a115ec1802da0d0606da12842ea7eab658b5eea6dd1f3a641a5174425578003cd318b8d6b8dcb4de954b5078d1912c578ad8281515d6df3672b94173f00",
+          "result" : "valid",
+          "flags" : []
+        },
+        {
+          "tcId" : 8,
+          "comment" : "",
+          "msg" : "202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f60",
+          "sig" : "3492ef66e5fdf1503e9e206c5c2f0d4b7891aad793575527d2251e0df1b97c2feac188bc382ce3c92c4bc36ba2695f32bedadd480eaa932300d0db1f9a9c60844d2ea5aea64933c7be46c4f9d21cb48b39eae23d08496de7ce9501197185cc5d4ff8aa4b018ce7ad321f6a7d778c4a070400",
+          "result" : "valid",
+          "flags" : []
+        },
+        {
+          "tcId" : 9,
+          "comment" : "",
+          "msg" : "ffffffffffffffffffffffffffffffff",
+          "sig" : "545e1905af1b5886552eaf78e17304c6f83fcfb3444df2d1ea056486db615e3bb29131bb0c1fd295364dc515dae581967148eb23c6c9012e806d3623baff00548c648e3cb3756aaaaf659f2fb7dd2e71c7611448593ca63f2a98913ab7f182e6820eaf1334e2745e0e7bc0dccab98de71600",
+          "result" : "valid",
+          "flags" : []
+        },
+        {
+          "tcId" : 10,
+          "comment" : "special values for r and s",
+          "msg" : "3f",
+          "sig" : "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 11,
+          "comment" : "special values for r and s",
+          "msg" : "3f",
+          "sig" : "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 12,
+          "comment" : "special values for r and s",
+          "msg" : "3f",
+          "sig" : "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f24458ab92c27823558fc58d72c26c219036d6ae49db4ec4e923ca7cffffffffffffffffffffffffffffffffffffffffffffffffffffff3f",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 13,
+          "comment" : "special values for r and s",
+          "msg" : "3f",
+          "sig" : "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f34458ab92c27823558fc58d72c26c219036d6ae49db4ec4e923ca7cffffffffffffffffffffffffffffffffffffffffffffffffffffff3f",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 14,
+          "comment" : "special values for r and s",
+          "msg" : "3f",
+          "sig" : "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 15,
+          "comment" : "special values for r and s",
+          "msg" : "3f",
+          "sig" : "01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 16,
+          "comment" : "special values for r and s",
+          "msg" : "3f",
+          "sig" : "01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 17,
+          "comment" : "special values for r and s",
+          "msg" : "3f",
+          "sig" : "0100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f24458ab92c27823558fc58d72c26c219036d6ae49db4ec4e923ca7cffffffffffffffffffffffffffffffffffffffffffffffffffffff3f",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 18,
+          "comment" : "special values for r and s",
+          "msg" : "3f",
+          "sig" : "0100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f34458ab92c27823558fc58d72c26c219036d6ae49db4ec4e923ca7cffffffffffffffffffffffffffffffffffffffffffffffffffffff3f",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 19,
+          "comment" : "special values for r and s",
+          "msg" : "3f",
+          "sig" : "0100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 20,
+          "comment" : "special values for r and s",
+          "msg" : "3f",
+          "sig" : "f34458ab92c27823558fc58d72c26c219036d6ae49db4ec4e923ca7cffffffffffffffffffffffffffffffffffffffffffffffffffffff3f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 21,
+          "comment" : "special values for r and s",
+          "msg" : "3f",
+          "sig" : "f34458ab92c27823558fc58d72c26c219036d6ae49db4ec4e923ca7cffffffffffffffffffffffffffffffffffffffffffffffffffffff3f0100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 22,
+          "comment" : "special values for r and s",
+          "msg" : "3f",
+          "sig" : "f34458ab92c27823558fc58d72c26c219036d6ae49db4ec4e923ca7cffffffffffffffffffffffffffffffffffffffffffffffffffffff3ff24458ab92c27823558fc58d72c26c219036d6ae49db4ec4e923ca7cffffffffffffffffffffffffffffffffffffffffffffffffffffff3f",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 23,
+          "comment" : "special values for r and s",
+          "msg" : "3f",
+          "sig" : "f34458ab92c27823558fc58d72c26c219036d6ae49db4ec4e923ca7cffffffffffffffffffffffffffffffffffffffffffffffffffffff3ff34458ab92c27823558fc58d72c26c219036d6ae49db4ec4e923ca7cffffffffffffffffffffffffffffffffffffffffffffffffffffff3f",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 24,
+          "comment" : "special values for r and s",
+          "msg" : "3f",
+          "sig" : "f34458ab92c27823558fc58d72c26c219036d6ae49db4ec4e923ca7cffffffffffffffffffffffffffffffffffffffffffffffffffffff3ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 25,
+          "comment" : "special values for r and s",
+          "msg" : "3f",
+          "sig" : "fffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffffffffffffffffffffffffffffffffffffffffffffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 26,
+          "comment" : "special values for r and s",
+          "msg" : "3f",
+          "sig" : "fffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffffffffffffffffffffffffffffffffffffffffffffffffff0100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 27,
+          "comment" : "special values for r and s",
+          "msg" : "3f",
+          "sig" : "fffffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffffffffffffffffffffffffffffffffffffffffffffffffffff24458ab92c27823558fc58d72c26c219036d6ae49db4ec4e923ca7cffffffffffffffffffffffffffffffffffffffffffffffffffffff3f",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 28,
+          "comment" : "special values for r and s",
+          "msg" : "3f",
+          "sig" : "fffffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffffffffffffffffffffffffffffffffffffffffffffffffffff34458ab92c27823558fc58d72c26c219036d6ae49db4ec4e923ca7cffffffffffffffffffffffffffffffffffffffffffffffffffffff3f",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 29,
+          "comment" : "special values for r and s",
+          "msg" : "3f",
+          "sig" : "fffffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 30,
+          "comment" : "empty signature",
+          "msg" : "54657374",
+          "sig" : "",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 31,
+          "comment" : "s missing",
+          "msg" : "54657374",
+          "sig" : "5d053ff5b71f6ec3284525d35d77933178c8e19879886d08eccc6c7d27e9e5b5e02537dbc4d4723506e8d171fc1733857573dd02d18f48f280",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 32,
+          "comment" : "signature too short",
+          "msg" : "54657374",
+          "sig" : "5d053ff5b71f6ec3284525d35d77933178c8e19879886d08eccc6c7d27e9e5b5e02537dbc4d4723506e8d171fc1733857573dd02d18f48f28031d67d699a188a9ca46b4eabe2107aef237ca609cb462e24c91d25d286402b6ef7862b78a386950246ff38d6d2f458136d12e3c97fdd98",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 33,
+          "comment" : "signature too long",
+          "msg" : "54657374",
+          "sig" : "5d053ff5b71f6ec3284525d35d77933178c8e19879886d08eccc6c7d27e9e5b5e02537dbc4d4723506e8d171fc1733857573dd02d18f48f28031d67d699a188a9ca46b4eabe2107aef237ca609cb462e24c91d25d286402b6ef7862b78a386950246ff38d6d2f458136d12e3c97fdd9826002020",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 34,
+          "comment" : "include pk in signature",
+          "msg" : "54657374",
+          "sig" : "5d053ff5b71f6ec3284525d35d77933178c8e19879886d08eccc6c7d27e9e5b5e02537dbc4d4723506e8d171fc1733857573dd02d18f48f28031d67d699a188a9ca46b4eabe2107aef237ca609cb462e24c91d25d286402b6ef7862b78a386950246ff38d6d2f458136d12e3c97fdd982600419610a534af127f583b04818cdb7f0ff300b025f2e01682bcae33fd691cee039511df0cddc690ee978426e8b38e50ce5af7dcfba50f704c00",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 35,
+          "comment" : "prepending 0 byte to signature",
+          "msg" : "54657374",
+          "sig" : "005d053ff5b71f6ec3284525d35d77933178c8e19879886d08eccc6c7d27e9e5b5e02537dbc4d4723506e8d171fc1733857573dd02d18f48f28031d67d699a188a9ca46b4eabe2107aef237ca609cb462e24c91d25d286402b6ef7862b78a386950246ff38d6d2f458136d12e3c97fdd982600",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 36,
+          "comment" : "prepending 0 byte to s",
+          "msg" : "54657374",
+          "sig" : "5d053ff5b71f6ec3284525d35d77933178c8e19879886d08eccc6c7d27e9e5b5e02537dbc4d4723506e8d171fc1733857573dd02d18f48f2800031d67d699a188a9ca46b4eabe2107aef237ca609cb462e24c91d25d286402b6ef7862b78a386950246ff38d6d2f458136d12e3c97fdd982600",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 37,
+          "comment" : "appending 0 byte to signature",
+          "msg" : "54657374",
+          "sig" : "5d053ff5b71f6ec3284525d35d77933178c8e19879886d08eccc6c7d27e9e5b5e02537dbc4d4723506e8d171fc1733857573dd02d18f48f28031d67d699a188a9ca46b4eabe2107aef237ca609cb462e24c91d25d286402b6ef7862b78a386950246ff38d6d2f458136d12e3c97fdd98260000",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 38,
+          "comment" : "removing 0 byte from signature",
+          "msg" : "5465737430",
+          "sig" : "dbd6384516ab6b0eb2d609414564ec217383b66040dfb0676128251ae24c1d7c179c21a9ee307dc13f8fe6550bc40187f093da85617bcf5d009d3ee8b798ad978b6e683bc4e911940ea82ea0b7e95dc24fe0b29e44663211892c2aaa3451379d22c289b94378f11fb700f1689d4a00d73e",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 39,
+          "comment" : "removing 0 byte from signature",
+          "msg" : "546573743535",
+          "sig" : "ce2b2fff0bf445a36813cf2a76e0cc5619a4f16ee53f0fe3cd46fc0414db7248b32fbda54bbb37e708d6238076ea12bf850b964b044520bb80fbaf0e1d1ed3bcab261462df5e7f2de73ac9cbae26dfa29015039acf90575961fc9b91b9ca276dae7d5fa805bd202c5579a0f4c66e801400",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 40,
+          "comment" : "dropping byte from signature",
+          "msg" : "546573743633",
+          "sig" : "c283ed36d78c275a5d02f7939aed2c4ef68320ae1bf6fc25e834b758046a6d52a480216a942dfe771f3bd307f4ce7d3f446e0824961bd5de80cda42b5cc38e6ec3d53f386978b9877d3c98a28ac8fc66630ffd178933a18de1aee23cab5011c9ff4c9277311b4c6c33acb8e82b8c693c00",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 41,
+          "comment" : "removing leading 0 byte from signature",
+          "msg" : "54657374333631",
+          "sig" : "62e629bd2b8f595df401c362c766216d45de89fceecd99c69d323b5c53ad5ac3ea7224963feba2f2895551d94f548248ef8597d2a959f880d59934a5e8f07847834d66ba1a6b09de5dba692172b13f768f0c29e8196144c130d2353445d63cbd0b690794fdad30a48e8bb7cc2504f80700",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 42,
+          "comment" : "modified bit 0 in R",
+          "msg" : "313233343030",
+          "sig" : "5cb94c53101f521f6c1f43b60ea4d7e06fbd49c2e8afaf4fcc289e645e0880a87b8e55858df4cf2291a7303ffda446b82a117b4dd408cff280afc33a525116cc12e0d1c3a1fde6de518a6544f360d0fe18d5be7770b057a2bf792db4b7648fa84a6eaecae909e33fa59c5dfe4804ba2623",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 43,
+          "comment" : "modified bit 1 in R",
+          "msg" : "313233343030",
+          "sig" : "5fb94c53101f521f6c1f43b60ea4d7e06fbd49c2e8afaf4fcc289e645e0880a87b8e55858df4cf2291a7303ffda446b82a117b4dd408cff280f91386c3e9dd9e7c9af7ca6bbef8b7a44ae3d68eeade449d7dfbb31de8419eb943e2ecbcdd06df5227e82b9ded519a56e70f0a1c0fc17b06",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 44,
+          "comment" : "modified bit 2 in R",
+          "msg" : "313233343030",
+          "sig" : "59b94c53101f521f6c1f43b60ea4d7e06fbd49c2e8afaf4fcc289e645e0880a87b8e55858df4cf2291a7303ffda446b82a117b4dd408cff280f1aab07b4ad069dfafc01b4532e1e44cbf7177e1bdda197fc87434046db5b935afd9114ac5e1138eaead23c3b59dba9026d2da4a86fe800b",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 45,
+          "comment" : "modified bit 7 in R",
+          "msg" : "313233343030",
+          "sig" : "ddb94c53101f521f6c1f43b60ea4d7e06fbd49c2e8afaf4fcc289e645e0880a87b8e55858df4cf2291a7303ffda446b82a117b4dd408cff2807668402b7b093fc754019324077c1f842a7d2e35adf7b87094115cec459ad5419e162988ef42b1988d9b944d9d5a7ce09c6f342afa500839",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 46,
+          "comment" : "modified bit 8 in R",
+          "msg" : "313233343030",
+          "sig" : "5db84c53101f521f6c1f43b60ea4d7e06fbd49c2e8afaf4fcc289e645e0880a87b8e55858df4cf2291a7303ffda446b82a117b4dd408cff280279b70338586b9e13e669191cc0dfc2a937d50a6118758de04a4ca41f4877abdb971afa87fe4b83bc243b8dfd2cb368aa389a4cb11e83e31",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 47,
+          "comment" : "modified bit 16 in R",
+          "msg" : "313233343030",
+          "sig" : "5db94d53101f521f6c1f43b60ea4d7e06fbd49c2e8afaf4fcc289e645e0880a87b8e55858df4cf2291a7303ffda446b82a117b4dd408cff280c7b847556b3a6f9447483899ab730a23004c695054dd57b1c3214fa87f632f39c8ff1471f0532b8eee4154930e1ca30d574b8f9e85b0432b",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 48,
+          "comment" : "modified bit 31 in R",
+          "msg" : "313233343030",
+          "sig" : "5db94cd3101f521f6c1f43b60ea4d7e06fbd49c2e8afaf4fcc289e645e0880a87b8e55858df4cf2291a7303ffda446b82a117b4dd408cff2800b017917472b130a1cc1c8e995a252617d5ddaf1f3d48930b4876fa0d2cfedec90a8c85c8274892a1ca3b6cfce63ebfebc307210b844ae0c",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 49,
+          "comment" : "modified bit 32 in R",
+          "msg" : "313233343030",
+          "sig" : "5db94c53111f521f6c1f43b60ea4d7e06fbd49c2e8afaf4fcc289e645e0880a87b8e55858df4cf2291a7303ffda446b82a117b4dd408cff2805f38f6371860fcc4f2ec515afd35cb05d8941e2448cc469a15b8537e758b16d46b123581613462c2bb20d8a07299ab795d0998e1e4277931",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 50,
+          "comment" : "modified bit 63 in R",
+          "msg" : "313233343030",
+          "sig" : "5db94c53101f529f6c1f43b60ea4d7e06fbd49c2e8afaf4fcc289e645e0880a87b8e55858df4cf2291a7303ffda446b82a117b4dd408cff28017111ba6fefd45e2490f1d53a184007fa073470706d7f4a9606fcad2954e74c32116ba7701d225b76e55164e64df3245c1031f0df734bd31",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 51,
+          "comment" : "modified bit 64 in R",
+          "msg" : "313233343030",
+          "sig" : "5db94c53101f521f6d1f43b60ea4d7e06fbd49c2e8afaf4fcc289e645e0880a87b8e55858df4cf2291a7303ffda446b82a117b4dd408cff2808d7d0aa1fd81d0e31789921771c654338f96f0b557b615e3da55670271608a0e022e4e8cf393e309f8f6412281b6147e7fce42b089eb1e0c",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 52,
+          "comment" : "modified bit 97 in R",
+          "msg" : "313233343030",
+          "sig" : "5db94c53101f521f6c1f43b60ca4d7e06fbd49c2e8afaf4fcc289e645e0880a87b8e55858df4cf2291a7303ffda446b82a117b4dd408cff280b08d3be6ebf4e60bf6d74e105ea2fa9b965c62816bbd22ea3bb0c1acfd12300523ca76f94b6f789488a957fbeb212d713baccf95fd594f3d",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 53,
+          "comment" : "modified bit 127 in R",
+          "msg" : "313233343030",
+          "sig" : "5db94c53101f521f6c1f43b60ea4d7606fbd49c2e8afaf4fcc289e645e0880a87b8e55858df4cf2291a7303ffda446b82a117b4dd408cff280a23f54857e9b0f72b2ef90d2768834590464d75933ed08c454faa762b3702a2b631c33c339d05b2e24c20a8214f99af31f93f80f416a1129",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 54,
+          "comment" : "modified bit 240 in R",
+          "msg" : "313233343030",
+          "sig" : "5db94c53101f521f6c1f43b60ea4d7e06fbd49c2e8afaf4fcc289e645e0881a87b8e55858df4cf2291a7303ffda446b82a117b4dd408cff280734bdc399273d3403d934ceaae16e87a68c6bff6b77d8037ff41c97922498a58e704c29ab519d41bab70735f71fc26f589361e2b21754300",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 55,
+          "comment" : "modified bit 247 in R",
+          "msg" : "313233343030",
+          "sig" : "5db94c53101f521f6c1f43b60ea4d7e06fbd49c2e8afaf4fcc289e645e0800a87b8e55858df4cf2291a7303ffda446b82a117b4dd408cff280ba961cc8d0765c99d57470ee1c0c77f0a562a198fd0175eddb0c033e0fb8525328c5e2c516e2b00f73609c7f769195eb1a02ff54090d781f",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 56,
+          "comment" : "modified bit 248 in R",
+          "msg" : "313233343030",
+          "sig" : "5db94c53101f521f6c1f43b60ea4d7e06fbd49c2e8afaf4fcc289e645e0880a97b8e55858df4cf2291a7303ffda446b82a117b4dd408cff280e72685907da9e5a64e4142ed02fc0c6bf95763201db5942aac055fa87e6fdd32e483fd21ed4110d5d7ef619b740fef2ad8a71fe821e42a2a",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 57,
+          "comment" : "modified bit 253 in R",
+          "msg" : "313233343030",
+          "sig" : "5db94c53101f521f6c1f43b60ea4d7e06fbd49c2e8afaf4fcc289e645e0880887b8e55858df4cf2291a7303ffda446b82a117b4dd408cff280500646d67c74f13471f0ad034da530f7238fe7897e532af8ec2977643a410b1d054934df567e170276389e66b3f3ccb3c15aed239d04f72b",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 58,
+          "comment" : "modified bit 254 in R",
+          "msg" : "313233343030",
+          "sig" : "5db94c53101f521f6c1f43b60ea4d7e06fbd49c2e8afaf4fcc289e645e0880e87b8e55858df4cf2291a7303ffda446b82a117b4dd408cff2807bb153b8e350aa736a91c921217578539600c1299ab76522ef8f6902d79c93f274073ee6beafe6200ecaf59f7cd11bb1c833f24bf30ed52d",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 59,
+          "comment" : "modified bit 255 in R",
+          "msg" : "313233343030",
+          "sig" : "5db94c53101f521f6c1f43b60ea4d7e06fbd49c2e8afaf4fcc289e645e0880287b8e55858df4cf2291a7303ffda446b82a117b4dd408cff2804a67b22be599d6433b87ea961c82c457ab50f64ac6b7efb0b2f90988927f83742303c278f8248e02d5679b41ed505aba0fb51110d0def810",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 60,
+          "comment" : "modified bit 440 in R",
+          "msg" : "313233343030",
+          "sig" : "5db94c53101f521f6c1f43b60ea4d7e06fbd49c2e8afaf4fcc289e645e0880a87b8e55858df4cf2291a7303ffda446b82a117b4dd408cff3807f452efb0cd97dab5506028b7b876830dee02a9c0cbd140dcde509638d4d546c30856b2151bdf79930df5bbb11f2beb66bcdc25ad75f2116",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 61,
+          "comment" : "modified bit 441 in R",
+          "msg" : "313233343030",
+          "sig" : "5db94c53101f521f6c1f43b60ea4d7e06fbd49c2e8afaf4fcc289e645e0880a87b8e55858df4cf2291a7303ffda446b82a117b4dd408cff0808d78231bb3c9a87c5b8d168fe05f8197503a3d73a6d700f436b5a76ab866388baa6930191a077aca7970058932c88b7f9e6ecb13c89dcd1d",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 62,
+          "comment" : "modified bit 447 in R",
+          "msg" : "313233343030",
+          "sig" : "5db94c53101f521f6c1f43b60ea4d7e06fbd49c2e8afaf4fcc289e645e0880a87b8e55858df4cf2291a7303ffda446b82a117b4dd408cf72809e5a8406063fb3545f0fb627f841b2e3a85ad5d378018e8b58fe58e14ee5520d57abc9140e9c5a75a8b09ac3334dd0cad69b48771284321d",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 63,
+          "comment" : "modified bit 448 in R",
+          "msg" : "313233343030",
+          "sig" : "5db94c53101f521f6c1f43b60ea4d7e06fbd49c2e8afaf4fcc289e645e0880a87b8e55858df4cf2291a7303ffda446b82a117b4dd408cff2811adf92201088e051ee48b57aecf46edfc68e5baeed5ae4910ba5681d370f75ab593811e18293ef0808581c254196bcbf2b4c454136a6711b",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 64,
+          "comment" : "modified bit 449 in R",
+          "msg" : "313233343030",
+          "sig" : "5db94c53101f521f6c1f43b60ea4d7e06fbd49c2e8afaf4fcc289e645e0880a87b8e55858df4cf2291a7303ffda446b82a117b4dd408cff2825e06c3999e8308be439c40940b0075d3e4f65147c1608cbe6e9c432e33bed6686f9393ae2568f0ad60febcb4b6179c0d90d034e7c3c46810",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 65,
+          "comment" : "modified bit 454 in R",
+          "msg" : "313233343030",
+          "sig" : "5db94c53101f521f6c1f43b60ea4d7e06fbd49c2e8afaf4fcc289e645e0880a87b8e55858df4cf2291a7303ffda446b82a117b4dd408cff2c02456bbd141df048dbf1843be6d5fef402483314c2af547b361a09f3319489eaede43404df9faf634c1298d678b5261c808b0be3726013e39",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 66,
+          "comment" : "modified bit 455 in R",
+          "msg" : "313233343030",
+          "sig" : "5db94c53101f521f6c1f43b60ea4d7e06fbd49c2e8afaf4fcc289e645e0880a87b8e55858df4cf2291a7303ffda446b82a117b4dd408cff2007106d2a896a7fec6dee53eea272d9b6e738c340295416b50f39a9463a5635450b9f93c4c06737affd42ae06cee5879c96c0bd58a91345503",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 67,
+          "comment" : "R==0",
+          "msg" : "313233343030",
+          "sig" : "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000027ab98ab862e4e7ec3361a45ac1993e9b47d9ac40db91faed752399cee0413122b47346594fd7d2c8949b43e4cabaf17d8339ea0e307023f",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 68,
+          "comment" : "invalid R",
+          "msg" : "313233343030",
+          "sig" : "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd11bae33a0999fd3fd2bed6fa5577685e8fd595e79c006e58fd35f69f91b1d853553fb4006019a07725aa37773883dbe12253812887ac828",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 69,
+          "comment" : "all bits flipped in R",
+          "msg" : "313233343030",
+          "sig" : "a246b3acefe0ade093e0bc49f15b281f9042b63d175050b033d7619ba1f77f578471aa7a720b30dd6e58cfc0025bb947d5ee84b22bf7300d7f334e48141af0fade1469f5dedb851c9e725d27bd65012bada05e70cde641aad9ce0bea4983164f73816b6f13095e6b93eb03e850cad0cf0d",
+          "result" : "invalid",
+          "flags" : []
+        },
+        {
+          "tcId" : 70,
+          "comment" : "checking malleability ",
+          "msg" : "54657374",
+          "sig" : "5d053ff5b71f6ec3284525d35d77933178c8e19879886d08eccc6c7d27e9e5b5e02537dbc4d4723506e8d171fc1733857573dd02d18f48f280241bd6142ddb02c0f9fa133955d3e610b4b27cb814227de8b241ef4e86402b6ef7862b78a386950246ff38d6d2f458136d12e3c97fdd9866",
+          "result" : "invalid",
+          "flags" : [
+            "SignatureMalleability"
+          ]
+        },
+        {
+          "tcId" : 71,
+          "comment" : "checking malleability ",
+          "msg" : "54657374",
+          "sig" : "5d053ff5b71f6ec3284525d35d77933178c8e19879886d08eccc6c7d27e9e5b5e02537dbc4d4723506e8d171fc1733857573dd02d18f48f28017602ec0bf9d7be34e8ad9c6c795533244e952675efdcbac9c65b9cb85402b6ef7862b78a386950246ff38d6d2f458136d12e3c97fdd98a6",
+          "result" : "invalid",
+          "flags" : [
+            "SignatureMalleability"
+          ]
+        },
+        {
+          "tcId" : 72,
+          "comment" : "checking malleability ",
+          "msg" : "54657374",
+          "sig" : "5d053ff5b71f6ec3284525d35d77933178c8e19879886d08eccc6c7d27e9e5b5e02537dbc4d4723506e8d171fc1733857573dd02d18f48f280fde9de16e5226d2af9a864e2ac1a2d756456ffc4f1b3693570ad4dc584402b6ef7862b78a386950246ff38d6d2f458136d12e3c97fdd9826",
+          "result" : "invalid",
+          "flags" : [
+            "SignatureMalleability"
+          ]
+        },
+        {
+          "tcId" : 73,
+          "comment" : "checking malleability ",
+          "msg" : "54657374",
+          "sig" : "5d053ff5b71f6ec3284525d35d77933178c8e19879886d08eccc6c7d27e9e5b5e02537dbc4d4723506e8d171fc1733857573dd02d18f48f280c9fd3fc42f2d50b84de67a197724e0faa43058801821a546173d76b882402b6ef7862b78a386950246ff38d6d2f458136d12e3c97fdd9826",
+          "result" : "invalid",
+          "flags" : [
+            "SignatureMalleability"
+          ]
+        },
+        {
+          "tcId" : 74,
+          "comment" : "checking malleability ",
+          "msg" : "54657374",
+          "sig" : "5d053ff5b71f6ec3284525d35d77933178c8e19879886d08eccc6c7d27e9e5b5e02537dbc4d4723506e8d171fc1733857573dd02d18f48f28031d67d699a188a9ca46b4eabe2107aef237ca609cb462e24c91d25d286402b6ef7862b78a386950246ff38d6d2f458136d12e3c97fdd9866",
+          "result" : "invalid",
+          "flags" : [
+            "SignatureMalleability"
+          ]
+        },
+        {
+          "tcId" : 75,
+          "comment" : "checking malleability ",
+          "msg" : "54657374",
+          "sig" : "5d053ff5b71f6ec3284525d35d77933178c8e19879886d08eccc6c7d27e9e5b5e02537dbc4d4723506e8d171fc1733857573dd02d18f48f28031d67d699a188a9ca46b4eabe2107aef237ca609cb462e24c91d25d286402b6ef7862b78a386950246ff38d6d2f458136d12e3c97fdd98a6",
+          "result" : "invalid",
+          "flags" : [
+            "SignatureMalleability"
+          ]
+        },
+        {
+          "tcId" : 76,
+          "comment" : "checking malleability ",
+          "msg" : "54657374",
+          "sig" : "5d053ff5b71f6ec3284525d35d77933178c8e19879886d08eccc6c7d27e9e5b5e02537dbc4d4723506e8d171fc1733857573dd02d18f48f28031d67d699a188a9ca46b4eabe2107aef237ca609cb462e24c91d25d286402b6ef7862b78a386950246ff38d6d2f458136d12e3c97fdd9826",
+          "result" : "invalid",
+          "flags" : [
+            "SignatureMalleability"
+          ]
+        },
+        {
+          "tcId" : 77,
+          "comment" : "checking malleability ",
+          "msg" : "54657374",
+          "sig" : "5d053ff5b71f6ec3284525d35d77933178c8e19879886d08eccc6c7d27e9e5b5e02537dbc4d4723506e8d171fc1733857573dd02d18f48f28030d67d699a188a9ca46b4eabe2107aef237ca609cb462e24c91d25d285402b6ef7862b78a386950246ff38d6d2f458136d12e3c97fdd9826",
+          "result" : "invalid",
+          "flags" : [
+            "SignatureMalleability"
+          ]
+        }
+      ]
+    },
+    {
+      "jwk" : {
+        "crv" : "Ed448",
+        "d" : "bIKlYsuAjRDWMr6JyFE-v2ySnzTd-oyfY8mWDvbjSKNSjIo_zC8ETjmj_FuUSS-PAy51SaIAmPlb",
+        "kid" : "none",
+        "kty" : "OKP",
+        "x" : "X9dEm1m0Yf0s54fsYWrUah2hNCSFpw4fig6nXYDpZ3jt8SR2m0bHBhvWeD3x5Q9s0foavq_oJWGA"
+      },
+      "key" : {
+        "curve" : "edwards448",
+        "keySize" : 448,
+        "pk" : "5fd7449b59b461fd2ce787ec616ad46a1da1342485a70e1f8a0ea75d80e96778edf124769b46c7061bd6783df1e50f6cd1fa1abeafe8256180",
+        "sk" : "6c82a562cb808d10d632be89c8513ebf6c929f34ddfa8c9f63c9960ef6e348a3528c8a3fcc2f044e39a3fc5b94492f8f032e7549a20098f95b",
+        "type" : "EDDSAKeyPair"
+      },
+      "keyDer" : "3043300506032b6571033a005fd7449b59b461fd2ce787ec616ad46a1da1342485a70e1f8a0ea75d80e96778edf124769b46c7061bd6783df1e50f6cd1fa1abeafe8256180",
+      "keyPem" : "-----BEGIN PUBLIC KEY-----\nMEMwBQYDK2VxAzoAX9dEm1m0Yf0s54fsYWrUah2hNCSFpw4fig6nXYDpZ3jt8SR2m0bHBhvWeD3x5Q9s0foavq/oJWGA\n-----END PUBLIC KEY-----\n",
+      "type" : "EddsaVerify",
+      "tests" : [
+        {
+          "tcId" : 78,
+          "comment" : "RFC 8032",
+          "msg" : "",
+          "sig" : "533a37f6bbe457251f023c0d88f976ae2dfb504a843e34d2074fd823d41a591f2b233f034f628281f2fd7a22ddd47d7828c59bd0a21bfd3980ff0d2028d4b18a9df63e006c5d1c2d345b925d8dc00b4104852db99ac5c7cdda8530a113a0f4dbb61149f05a7363268c71d95808ff2e652600",
+          "result" : "valid",
+          "flags" : []
+        }
+      ]
+    },
+    {
+      "jwk" : {
+        "crv" : "Ed448",
+        "d" : "xOqwXTVwB8Yy89u0hImSTVUrCP4MNToNSh8ArNosRjr76mfF6NKHfF47w5emWZSe-AIelU4KEidO",
+        "kid" : "none",
+        "kty" : "OKP",
+        "x" : "Q7oo9DDN_0Vq5TFUX37NCsg0pV2TWMA3K_oMbGeYwIZq6gHrAHQoArhDjqTLghacI1FgYntMOpSA"
+      },
+      "key" : {
+        "curve" : "edwards448",
+        "keySize" : 448,
+        "pk" : "43ba28f430cdff456ae531545f7ecd0ac834a55d9358c0372bfa0c6c6798c0866aea01eb00742802b8438ea4cb82169c235160627b4c3a9480",
+        "sk" : "c4eab05d357007c632f3dbb48489924d552b08fe0c353a0d4a1f00acda2c463afbea67c5e8d2877c5e3bc397a659949ef8021e954e0a12274e",
+        "type" : "EDDSAKeyPair"
+      },
+      "keyDer" : "3043300506032b6571033a0043ba28f430cdff456ae531545f7ecd0ac834a55d9358c0372bfa0c6c6798c0866aea01eb00742802b8438ea4cb82169c235160627b4c3a9480",
+      "keyPem" : "-----BEGIN PUBLIC KEY-----\nMEMwBQYDK2VxAzoAQ7oo9DDN/0Vq5TFUX37NCsg0pV2TWMA3K/oMbGeYwIZq6gHrAHQoArhDjqTLghacI1FgYntMOpSA\n-----END PUBLIC KEY-----\n",
+      "type" : "EddsaVerify",
+      "tests" : [
+        {
+          "tcId" : 79,
+          "comment" : "RFC 8032: 1 octet",
+          "msg" : "03",
+          "sig" : "26b8f91727bd62897af15e41eb43c377efb9c610d48f2335cb0bd0087810f4352541b143c4b981b7e18f62de8ccdf633fc1bf037ab7cd779805e0dbcc0aae1cbcee1afb2e027df36bc04dcecbf154336c19f0af7e0a6472905e799f1953d2a0ff3348ab21aa4adafd1d234441cf807c03a00",
+          "result" : "valid",
+          "flags" : []
+        },
+        {
+          "tcId" : 80,
+          "comment" : "RFC 8032: 1 octet with context",
+          "msg" : "03",
+          "sig" : "d4f8f6131770dd46f40867d6fd5d5055de43541f8c5e35abbcd001b32a89f7d2151f7647f11d8ca2ae279fb842d607217fce6e042f6815ea000c85741de5c8da1144a6a1aba7f96de42505d7a7298524fda538fccbbb754f578c1cad10d54d0d5428407e85dcbc98a49155c13764e66c3c00",
+          "result" : "invalid",
+          "flags" : []
+        }
+      ]
+    },
+    {
+      "jwk" : {
+        "crv" : "Ed448",
+        "d" : "zSPST3FCdOdENDI3uTKQ9RH2Ql-Y5kRZ_yA-iYUIP_32BQBVOrwOBc0CGEvbicTM1n4YeVEmfrMo",
+        "kid" : "none",
+        "kty" : "OKP",
+        "x" : "3OqeePNaG_NJmoMbELhskKrAHNhLZ6AQm1WjbpMoseNl_OFh1xznExpUPqTLX36fHYsAaWRHABQA"
+      },
+      "key" : {
+        "curve" : "edwards448",
+        "keySize" : 448,
+        "pk" : "dcea9e78f35a1bf3499a831b10b86c90aac01cd84b67a0109b55a36e9328b1e365fce161d71ce7131a543ea4cb5f7e9f1d8b00696447001400",
+        "sk" : "cd23d24f714274e744343237b93290f511f6425f98e64459ff203e8985083ffdf60500553abc0e05cd02184bdb89c4ccd67e187951267eb328",
+        "type" : "EDDSAKeyPair"
+      },
+      "keyDer" : "3043300506032b6571033a00dcea9e78f35a1bf3499a831b10b86c90aac01cd84b67a0109b55a36e9328b1e365fce161d71ce7131a543ea4cb5f7e9f1d8b00696447001400",
+      "keyPem" : "-----BEGIN PUBLIC KEY-----\nMEMwBQYDK2VxAzoA3OqeePNaG/NJmoMbELhskKrAHNhLZ6AQm1WjbpMoseNl/OFh1xznExpUPqTLX36fHYsAaWRHABQA\n-----END PUBLIC KEY-----\n",
+      "type" : "EddsaVerify",
+      "tests" : [
+        {
+          "tcId" : 81,
+          "comment" : "RFC 8032: 11 bytes",
+          "msg" : "0c3e544074ec63b0265e0c",
+          "sig" : "1f0a8888ce25e8d458a21130879b840a9089d999aaba039eaf3e3afa090a09d389dba82c4ff2ae8ac5cdfb7c55e94d5d961a29fe0109941e00b8dbdeea6d3b051068df7254c0cdc129cbe62db2dc957dbb47b51fd3f213fb8698f064774250a5028961c9bf8ffd973fe5d5c206492b140e00",
+          "result" : "valid",
+          "flags" : []
+        }
+      ]
+    },
+    {
+      "jwk" : {
+        "crv" : "Ed448",
+        "d" : "JYzdStoy7Zyf9U5jdWrlgvuPqyrHIfLI5nanJ2hRPZOfY93bVWCRM_Ka34bsmSncy1LBxf0v9-Ib",
+        "kid" : "none",
+        "kty" : "OKP",
+        "x" : "O6FtoMbyzB8wGHdAdW9eeY1rxfwBXXxjzJUQ7j_UStwk2OlotuRub5TRm5RTYXJr114UnvCYF_WA"
+      },
+      "key" : {
+        "curve" : "edwards448",
+        "keySize" : 448,
+        "pk" : "3ba16da0c6f2cc1f30187740756f5e798d6bc5fc015d7c63cc9510ee3fd44adc24d8e968b6e46e6f94d19b945361726bd75e149ef09817f580",
+        "sk" : "258cdd4ada32ed9c9ff54e63756ae582fb8fab2ac721f2c8e676a72768513d939f63dddb55609133f29adf86ec9929dccb52c1c5fd2ff7e21b",
+        "type" : "EDDSAKeyPair"
+      },
+      "keyDer" : "3043300506032b6571033a003ba16da0c6f2cc1f30187740756f5e798d6bc5fc015d7c63cc9510ee3fd44adc24d8e968b6e46e6f94d19b945361726bd75e149ef09817f580",
+      "keyPem" : "-----BEGIN PUBLIC KEY-----\nMEMwBQYDK2VxAzoAO6FtoMbyzB8wGHdAdW9eeY1rxfwBXXxjzJUQ7j/UStwk2OlotuRub5TRm5RTYXJr114UnvCYF/WA\n-----END PUBLIC KEY-----\n",
+      "type" : "EddsaVerify",
+      "tests" : [
+        {
+          "tcId" : 82,
+          "comment" : "RFC 8032: 12 bytes",
+          "msg" : "64a65f3cdedcdd66811e2915",
+          "sig" : "7eeeab7c4e50fb799b418ee5e3197ff6bf15d43a14c34389b59dd1a7b1b85b4ae90438aca634bea45e3a2695f1270f07fdcdf7c62b8efeaf00b45c2c96ba457eb1a8bf075a3db28e5c24f6b923ed4ad747c3c9e03c7079efb87cb110d3a99861e72003cbae6d6b8b827e4e6c143064ff3c00",
+          "result" : "valid",
+          "flags" : []
+        }
+      ]
+    },
+    {
+      "jwk" : {
+        "crv" : "Ed448",
+        "d" : "fvToRUQjZ1L7tWuPMaI6EOQoFPX1XKA3zcwRxkyaOylJwbtgcAMUYRcypsL-qY7rwCZqEak5cBAO",
+        "kid" : "none",
+        "kty" : "OKP",
+        "x" : "s9oHmwqkk6V3ICnwRnuuvuWoES2dOiJTI2HaKU97s4FcXcWeF2tNnzgcoJOOE8bAexdL5l36V46A"
+      },
+      "key" : {
+        "curve" : "edwards448",
+        "keySize" : 448,
+        "pk" : "b3da079b0aa493a5772029f0467baebee5a8112d9d3a22532361da294f7bb3815c5dc59e176b4d9f381ca0938e13c6c07b174be65dfa578e80",
+        "sk" : "7ef4e84544236752fbb56b8f31a23a10e42814f5f55ca037cdcc11c64c9a3b2949c1bb60700314611732a6c2fea98eebc0266a11a93970100e",
+        "type" : "EDDSAKeyPair"
+      },
+      "keyDer" : "3043300506032b6571033a00b3da079b0aa493a5772029f0467baebee5a8112d9d3a22532361da294f7bb3815c5dc59e176b4d9f381ca0938e13c6c07b174be65dfa578e80",
+      "keyPem" : "-----BEGIN PUBLIC KEY-----\nMEMwBQYDK2VxAzoAs9oHmwqkk6V3ICnwRnuuvuWoES2dOiJTI2HaKU97s4FcXcWeF2tNnzgcoJOOE8bAexdL5l36V46A\n-----END PUBLIC KEY-----\n",
+      "type" : "EddsaVerify",
+      "tests" : [
+        {
+          "tcId" : 83,
+          "comment" : "RFC 8032: 13 bytes",
+          "msg" : "64a65f3cdedcdd66811e2915e7",
+          "sig" : "6a12066f55331b6c22acd5d5bfc5d71228fbda80ae8dec26bdd306743c5027cb4890810c162c027468675ecf645a83176c0d7323a2ccde2d80efe5a1268e8aca1d6fbc194d3f77c44986eb4ab4177919ad8bec33eb47bbb5fc6e28196fd1caf56b4e7e0ba5519234d047155ac727a1053100",
+          "result" : "valid",
+          "flags" : []
+        }
+      ]
+    },
+    {
+      "jwk" : {
+        "crv" : "Ed448",
+        "d" : "1l3zQa0T4AhWdoi67dqOnc3BfcAkl06ltCJ7ZTDjOb_yH5nmjKaWjzzKbf4PufT6tPoTXVVC6j8B",
+        "kid" : "none",
+        "kty" : "OKP",
+        "x" : "35cF9Y7bq4Asf4Njz-VWCrHGEywgqfHdFjSDom-KxTo51oCL9KHfvSYbCZuwOz-1CQbLKL2KCB8A"
+      },
+      "key" : {
+        "curve" : "edwards448",
+        "keySize" : 448,
+        "pk" : "df9705f58edbab802c7f8363cfe5560ab1c6132c20a9f1dd163483a26f8ac53a39d6808bf4a1dfbd261b099bb03b3fb50906cb28bd8a081f00",
+        "sk" : "d65df341ad13e008567688baedda8e9dcdc17dc024974ea5b4227b6530e339bff21f99e68ca6968f3cca6dfe0fb9f4fab4fa135d5542ea3f01",
+        "type" : "EDDSAKeyPair"
+      },
+      "keyDer" : "3043300506032b6571033a00df9705f58edbab802c7f8363cfe5560ab1c6132c20a9f1dd163483a26f8ac53a39d6808bf4a1dfbd261b099bb03b3fb50906cb28bd8a081f00",
+      "keyPem" : "-----BEGIN PUBLIC KEY-----\nMEMwBQYDK2VxAzoA35cF9Y7bq4Asf4Njz+VWCrHGEywgqfHdFjSDom+KxTo51oCL9KHfvSYbCZuwOz+1CQbLKL2KCB8A\n-----END PUBLIC KEY-----\n",
+      "type" : "EddsaVerify",
+      "tests" : [
+        {
+          "tcId" : 84,
+          "comment" : "RFC 8032: 64 bytes",
+          "msg" : "bd0f6a3747cd561bdddf4640a332461a4a30a12a434cd0bf40d766d9c6d458e5512204a30c17d1f50b5079631f64eb3112182da3005835461113718d1a5ef944",
+          "sig" : "554bc2480860b49eab8532d2a533b7d578ef473eeb58c98bb2d0e1ce488a98b18dfde9b9b90775e67f47d4a1c3482058efc9f40d2ca033a0801b63d45b3b722ef552bad3b4ccb667da350192b61c508cf7b6b5adadc2c8d9a446ef003fb05cba5f30e88e36ec2703b349ca229c2670833900",
+          "result" : "valid",
+          "flags" : []
+        }
+      ]
+    },
+    {
+      "jwk" : {
+        "crv" : "Ed448",
+        "d" : "LsX-PBcEWr2xNqXmqRPjKrda5otT0vwUm3flBBMtN1abfnZrp0oZvWFiNDohyFkKqc68qQFMY231",
+        "kid" : "none",
+        "kty" : "OKP",
+        "x" : "eXVvAU3P4gefXdnnGL5BceLvJIagjyUYb2v_Q6mTa5v-EkArCK5leYo9geIunsgOdpCGLvPU7ToA"
+      },
+      "key" : {
+        "curve" : "edwards448",
+        "keySize" : 448,
+        "pk" : "79756f014dcfe2079f5dd9e718be4171e2ef2486a08f25186f6bff43a9936b9bfe12402b08ae65798a3d81e22e9ec80e7690862ef3d4ed3a00",
+        "sk" : "2ec5fe3c17045abdb136a5e6a913e32ab75ae68b53d2fc149b77e504132d37569b7e766ba74a19bd6162343a21c8590aa9cebca9014c636df5",
+        "type" : "EDDSAKeyPair"
+      },
+      "keyDer" : "3043300506032b6571033a0079756f014dcfe2079f5dd9e718be4171e2ef2486a08f25186f6bff43a9936b9bfe12402b08ae65798a3d81e22e9ec80e7690862ef3d4ed3a00",
+      "keyPem" : "-----BEGIN PUBLIC KEY-----\nMEMwBQYDK2VxAzoAeXVvAU3P4gefXdnnGL5BceLvJIagjyUYb2v/Q6mTa5v+EkArCK5leYo9geIunsgOdpCGLvPU7ToA\n-----END PUBLIC KEY-----\n",
+      "type" : "EddsaVerify",
+      "tests" : [
+        {
+          "tcId" : 85,
+          "comment" : "RFC 8032: 256 bytes",
+          "msg" : "15777532b0bdd0d1389f636c5f6b9ba734c90af572877e2d272dd078aa1e567cfa80e12928bb542330e8409f3174504107ecd5efac61ae7504dabe2a602ede89e5cca6257a7c77e27a702b3ae39fc769fc54f2395ae6a1178cab4738e543072fc1c177fe71e92e25bf03e4ecb72f47b64d0465aaea4c7fad372536c8ba516a6039c3c2a39f0e4d832be432dfa9a706a6e5c7e19f397964ca4258002f7c0541b590316dbc5622b6b2a6fe7a4abffd96105eca76ea7b98816af0748c10df048ce012d901015a51f189f3888145c03650aa23ce894c3bd889e030d565071c59f409a9981b51878fd6fc110624dcbcde0bf7a69ccce38fabdf86f3bef6044819de11",
+          "sig" : "c650ddbb0601c19ca11439e1640dd931f43c518ea5bea70d3dcde5f4191fe53f00cf966546b72bcc7d58be2b9badef28743954e3a44a23f880e8d4f1cfce2d7a61452d26da05896f0a50da66a239a8a188b6d825b3305ad77b73fbac0836ecc60987fd08527c1a8e80d5823e65cafe2a3d00",
+          "result" : "valid",
+          "flags" : []
+        }
+      ]
+    },
+    {
+      "jwk" : {
+        "crv" : "Ed448",
+        "d" : "hy0JN4D103MN98ISZks3uKDyT1aBDaqDgs1Po_d2NOxE3FTxwu2b6ob6-3Yy2L4ZnqFl9a1V3Zzo",
+        "kid" : "none",
+        "kty" : "OKP",
+        "x" : "qBsuinClrJT_28ybrfw_6wgB8lhXi7EUrUTs4ewOeZ2gjv-4HF1oXAxW9k7srvjN8RzDhzeDjPQA"
+      },
+      "key" : {
+        "curve" : "edwards448",
+        "keySize" : 448,
+        "pk" : "a81b2e8a70a5ac94ffdbcc9badfc3feb0801f258578bb114ad44ece1ec0e799da08effb81c5d685c0c56f64eecaef8cdf11cc38737838cf400",
+        "sk" : "872d093780f5d3730df7c212664b37b8a0f24f56810daa8382cd4fa3f77634ec44dc54f1c2ed9bea86fafb7632d8be199ea165f5ad55dd9ce8",
+        "type" : "EDDSAKeyPair"
+      },
+      "keyDer" : "3043300506032b6571033a00a81b2e8a70a5ac94ffdbcc9badfc3feb0801f258578bb114ad44ece1ec0e799da08effb81c5d685c0c56f64eecaef8cdf11cc38737838cf400",
+      "keyPem" : "-----BEGIN PUBLIC KEY-----\nMEMwBQYDK2VxAzoAqBsuinClrJT/28ybrfw/6wgB8lhXi7EUrUTs4ewOeZ2gjv+4HF1oXAxW9k7srvjN8RzDhzeDjPQA\n-----END PUBLIC KEY-----\n",
+      "type" : "EddsaVerify",
+      "tests" : [
+        {
+          "tcId" : 86,
+          "comment" : "RFC 8032: 1023 bytes",
+          "msg" : "6ddf802e1aae4986935f7f981ba3f0351d6273c0a0c22c9c0e8339168e675412a3debfaf435ed651558007db4384b650fcc07e3b586a27a4f7a00ac8a6fec2cd86ae4bf1570c41e6a40c931db27b2faa15a8cedd52cff7362c4e6e23daec0fbc3a79b6806e316efcc7b68119bf46bc76a26067a53f296dafdbdc11c77f7777e972660cf4b6a9b369a6665f02e0cc9b6edfad136b4fabe723d2813db3136cfde9b6d044322fee2947952e031b73ab5c603349b307bdc27bc6cb8b8bbd7bd323219b8033a581b59eadebb09b3c4f3d2277d4f0343624acc817804728b25ab797172b4c5c21a22f9c7839d64300232eb66e53f31c723fa37fe387c7d3e50bdf9813a30e5bb12cf4cd930c40cfb4e1fc622592a49588794494d56d24ea4b40c89fc0596cc9ebb961c8cb10adde976a5d602b1c3f85b9b9a001ed3c6a4d3b1437f52096cd1956d042a597d561a596ecd3d1735a8d570ea0ec27225a2c4aaff26306d1526c1af3ca6d9cf5a2c98f47e1c46db9a33234cfd4d81f2c98538a09ebe76998d0d8fd25997c7d255c6d66ece6fa56f11144950f027795e653008f4bd7ca2dee85d8e90f3dc315130ce2a00375a318c7c3d97be2c8ce5b6db41a6254ff264fa6155baee3b0773c0f497c573f19bb4f4240281f0b1f4f7be857a4e59d416c06b4c50fa09e1810ddc6b1467baeac5a3668d11b6ecaa901440016f389f80acc4db977025e7f5924388c7e340a732e554440e76570f8dd71b7d640b3450d1fd5f0410a18f9a3494f707c717b79b4bf75c98400b096b21653b5d217cf3565c9597456f70703497a078763829bc01bb1cbc8fa04eadc9a6e3f6699587a9e75c94e5bab0036e0b2e711392cff0047d0d6b05bd2a588bc109718954259f1d86678a579a3120f19cfb2963f177aeb70f2d4844826262e51b80271272068ef5b3856fa8535aa2a88b2d41f2a0e2fda7624c2850272ac4a2f561f8f2f7a318bfd5caf9696149e4ac824ad3460538fdc25421beec2cc6818162d06bbed0c40a387192349db67a118bada6cd5ab0140ee273204f628aad1c135f770279a651e24d8c14d75a6059d76b96a6fd857def5e0b354b27ab937a5815d16b5fae407ff18222c6d1ed263be68c95f32d908bd895cd76207ae726487567f9a67dad79abec316f683b17f2d02bf07e0ac8b5bc6162cf94697b3c27cd1fea49b27f23ba2901871962506520c392da8b6ad0d99f7013fbc06c2c17a569500c8a7696481c1cd33e9b14e40b82e79a5f5db82571ba97bae3ad3e0479515bb0e2b0f3bfcd1fd33034efc6245eddd7ee2086ddae2600d8ca73e214e8c2b0bdb2b047c6a464a562ed77b73d2d841c4b34973551257713b753632efba348169abc90a68f42611a40126d7cb21b58695568186f7e569d2ff0f9e745d0487dd2eb997cafc5abf9dd102e62ff66cba87",
+          "sig" : "e301345a41a39a4d72fff8df69c98075a0cc082b802fc9b2b6bc503f926b65bddf7f4c8f1cb49f6396afc8a70abe6d8aef0db478d4c6b2970076c6a0484fe76d76b3a97625d79f1ce240e7c576750d295528286f719b413de9ada3e8eb78ed573603ce30d8bb761785dc30dbc320869e1a00",
+          "result" : "valid",
+          "flags" : []
+        }
+      ]
+    }
+  ]
+}

curve-definitions/tsconfig.esm.json

@@ -0,0 +1,25 @@
+{
+  "compilerOptions": {
+    "strict": true,
+    "declaration": true,
+    "declarationMap": true,
+    "target": "es2020",
+    "lib": [
+      "es2020",
+      "dom"
+    ],
+    "module": "es6",
+    "moduleResolution": "node16",
+    "outDir": "lib/esm",
+    "noImplicitAny": true,
+    "preserveConstEnums": true,
+    "baseUrl": ".",
+  },
+  "include": [
+    "src",
+  ],
+  "exclude": [
+    "node_modules",
+    "lib"
+  ]
+}

curve-definitions/tsconfig.json

@@ -8,7 +8,7 @@
       "es2020",
       "dom"
     ],
-    "module": "es6",
+    "module": "commonjs",
     "moduleResolution": "node16",
     "outDir": "lib",
     "noImplicitAny": true,

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noble/curves",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "description": "Minimal, zero-dependency JS implementation of elliptic curve cryptography",
   "files": [
     "index.js",
@@ -8,7 +8,7 @@
     "lib/esm"
   ],
   "scripts": {
-    "bench": "node test/benchmark/index.js",
+    "bench": "node curve-definitions/benchmark/index.js",
     "build": "tsc && tsc -p tsconfig.esm.json",
     "build:release": "rollup -c rollup.config.js",
     "lint": "prettier --check 'src/**/*.{js,ts}' 'curve-definitions/src/**/*.{js,ts}'",
@@ -32,15 +32,25 @@
   },
   "main": "index.js",
   "exports": {
+    "./edwards": {
+      "types": "./lib/edwards.d.ts",
+      "import": "./lib/esm/edwards.js",
+      "default": "./lib/edwards.js"
+    },
     "./modular": {
       "types": "./lib/modular.d.ts",
       "import": "./lib/esm/modular.js",
       "default": "./lib/modular.js"
     },
-    "./shortw": {
-      "types": "./lib/shortw.d.ts",
-      "import": "./lib/esm/shortw.js",
-      "default": "./lib/shortw.js"
+    "./montgomery": {
+      "types": "./lib/montgomery.d.ts",
+      "import": "./lib/esm/montgomery.js",
+      "default": "./lib/montgomery.js"
+    },
+    "./weierstrass": {
+      "types": "./lib/weierstrass.d.ts",
+      "import": "./lib/esm/weierstrass.js",
+      "default": "./lib/weierstrass.js"
     },
     "./utils": {
       "types": "./lib/utils.d.ts",
@@ -53,14 +63,16 @@
     "curve",
     "cryptography",
     "hyperelliptic",
+    "weierstrass",
+    "edwards",
+    "montgomery",
+    "secp256k1",
+    "ed25519",
+    "ed448",
     "p256",
     "p384",
     "p521",
     "nist",
-    "weierstrass",
-    "edwards",
-    "montgomery",
-    "hashes",
     "ecc",
     "ecdsa",
     "eddsa",

src/edwards.ts

@@ -0,0 +1,684 @@
+/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+// Implementation of Twisted Edwards curve. The formula is: ax² + y² = 1 + dx²y²
+
+// Differences from @noble/ed25519 1.7:
+// 1. Different field element lengths in ed448:
+//   EDDSA (RFC8032) is 456 bits / 57 bytes, ECDH (RFC7748) is 448 bits / 56 bytes
+// 2. Different addition formula (doubling is same)
+// 3. uvRatio differs between curves (half-expected, not only pow fn changes)
+// 4. Point decompression code is different too (unexpected), now using generalized formula
+// 5. Domain function was no-op for ed25519, but adds some data even with empty context for ed448
+
+import * as mod from './modular.js';
+import {
+  bytesToHex,
+  concatBytes,
+  ensureBytes,
+  numberToBytesLE,
+  bytesToNumberLE,
+  hashToPrivateScalar,
+  BasicCurve,
+  validateOpts as utilOpts,
+  Hex,
+  PrivKey,
+} from './utils.js'; // TODO: import * as u from './utils.js'?
+import { Group, GroupConstructor, wNAF } from './group.js';
+
+// Be friendly to bad ECMAScript parsers by not using bigint literals like 123n
+const _0n = BigInt(0);
+const _1n = BigInt(1);
+const _2n = BigInt(2);
+const _8n = BigInt(8);
+
+export type CHash = {
+  (message: Uint8Array | string): Uint8Array;
+  blockLen: number;
+  outputLen: number;
+  create(): any;
+};
+
+export type CurveType = BasicCurve & {
+  // Params: a, d
+  a: bigint;
+  d: bigint;
+  // Hashes
+  hash: CHash; // Because we need outputLen for DRBG
+  randomBytes: (bytesLength?: number) => Uint8Array;
+  adjustScalarBytes?: (bytes: Uint8Array) => Uint8Array;
+  domain?: (data: Uint8Array, ctx: Uint8Array, phflag: boolean) => Uint8Array;
+  uvRatio?: (u: bigint, v: bigint) => { isValid: boolean; value: bigint };
+  preHash?: CHash;
+};
+
+// Should be separate from overrides, since overrides can use information about curve (for example nBits)
+function validateOpts(curve: CurveType) {
+  const opts = utilOpts(curve);
+  if (typeof opts.hash !== 'function' || !Number.isSafeInteger(opts.hash.outputLen))
+    throw new Error('Invalid hash function');
+  for (const i of ['a', 'd'] as const) {
+    if (typeof opts[i] !== 'bigint')
+      throw new Error(`Invalid curve param ${i}=${opts[i]} (${typeof opts[i]})`);
+  }
+  for (const fn of ['randomBytes'] as const) {
+    if (typeof opts[fn] !== 'function') throw new Error(`Invalid ${fn} function`);
+  }
+  for (const fn of ['adjustScalarBytes', 'domain', 'uvRatio'] as const) {
+    if (opts[fn] === undefined) continue; // Optional
+    if (typeof opts[fn] !== 'function') throw new Error(`Invalid ${fn} function`);
+  }
+  // Set defaults
+  return Object.freeze({ ...opts } as const);
+}
+
+// Instance
+export interface SignatureType {
+  readonly r: PointType;
+  readonly s: bigint;
+  assertValidity(): SignatureType;
+  toRawBytes(): Uint8Array;
+  toHex(): string;
+}
+// Static methods
+export type SignatureConstructor = {
+  new (r: PointType, s: bigint): SignatureType;
+  fromHex(hex: Hex): SignatureType;
+};
+
+// Instance
+export interface ExtendedPointType extends Group<ExtendedPointType> {
+  readonly x: bigint;
+  readonly y: bigint;
+  readonly z: bigint;
+  readonly t: bigint;
+  multiply(scalar: number | bigint, affinePoint?: PointType): ExtendedPointType;
+  multiplyUnsafe(scalar: number | bigint): ExtendedPointType;
+  isSmallOrder(): boolean;
+  isTorsionFree(): boolean;
+  toAffine(invZ?: bigint): PointType;
+}
+// Static methods
+export interface ExtendedPointConstructor extends GroupConstructor<ExtendedPointType> {
+  new (x: bigint, y: bigint, z: bigint, t: bigint): ExtendedPointType;
+  fromAffine(p: PointType): ExtendedPointType;
+  toAffineBatch(points: ExtendedPointType[]): PointType[];
+  normalizeZ(points: ExtendedPointType[]): ExtendedPointType[];
+}
+
+// Instance
+export interface PointType extends Group<PointType> {
+  readonly x: bigint;
+  readonly y: bigint;
+  _setWindowSize(windowSize: number): void;
+  toRawBytes(isCompressed?: boolean): Uint8Array;
+  toHex(isCompressed?: boolean): string;
+  isTorsionFree(): boolean;
+}
+// Static methods
+export interface PointConstructor extends GroupConstructor<PointType> {
+  new (x: bigint, y: bigint): PointType;
+  fromHex(hex: Hex): PointType;
+  fromPrivateKey(privateKey: PrivKey): PointType;
+}
+
+export type PubKey = Hex | PointType;
+export type SigType = Hex | SignatureType;
+
+export type CurveFn = {
+  CURVE: ReturnType<typeof validateOpts>;
+  getPublicKey: (privateKey: PrivKey, isCompressed?: boolean) => Uint8Array;
+  sign: (message: Hex, privateKey: Hex) => Uint8Array;
+  verify: (sig: SigType, message: Hex, publicKey: PubKey) => boolean;
+  Point: PointConstructor;
+  ExtendedPoint: ExtendedPointConstructor;
+  Signature: SignatureConstructor;
+  utils: {
+    mod: (a: bigint, b?: bigint) => bigint;
+    invert: (number: bigint, modulo?: bigint) => bigint;
+    randomPrivateKey: () => Uint8Array;
+    getExtendedPublicKey: (key: PrivKey) => {
+      head: Uint8Array;
+      prefix: Uint8Array;
+      scalar: bigint;
+      point: PointType;
+      pointBytes: Uint8Array;
+    };
+  };
+};
+
+// NOTE: it is not generic twisted curve for now, but ed25519/ed448 generic implementation
+export function twistedEdwards(curveDef: CurveType): CurveFn {
+  const CURVE = validateOpts(curveDef) as ReturnType<typeof validateOpts>;
+  const CURVE_ORDER = CURVE.n;
+  const fieldLen = CURVE.nByteLength; // 32 (length of one field element)
+  if (fieldLen > 2048) throw new Error('Field lengths over 2048 are not supported');
+  const groupLen = CURVE.nByteLength;
+  // (2n ** 256n).toString(16);
+  const maxGroupElement = _2n ** BigInt(groupLen * 8); // previous POW_2_256
+
+  // Function overrides
+  const { P, randomBytes } = CURVE;
+  const modP = (a: bigint) => mod.mod(a, P);
+
+  // sqrt(u/v)
+  function _uvRatio(u: bigint, v: bigint) {
+    try {
+      const value = mod.sqrt(u * mod.invert(v, P), P);
+      return { isValid: true, value };
+    } catch (e) {
+      return { isValid: false, value: _0n };
+    }
+  }
+  const uvRatio = CURVE.uvRatio || _uvRatio;
+
+  const _adjustScalarBytes = (bytes: Uint8Array) => bytes; // NOOP
+  const adjustScalarBytes = CURVE.adjustScalarBytes || _adjustScalarBytes;
+  function _domain(data: Uint8Array, ctx: Uint8Array, phflag: boolean) {
+    if (ctx.length || phflag) throw new Error('Contexts/pre-hash are not supported');
+    return data;
+  }
+  const domain = CURVE.domain || _domain; // NOOP
+
+  /**
+   * Extended Point works in extended coordinates: (x, y, z, t) ∋ (x=x/z, y=y/z, t=xy).
+   * Default Point works in affine coordinates: (x, y)
+   * https://en.wikipedia.org/wiki/Twisted_Edwards_curve#Extended_coordinates
+   */
+  class ExtendedPoint implements ExtendedPointType {
+    constructor(readonly x: bigint, readonly y: bigint, readonly z: bigint, readonly t: bigint) {}
+
+    static BASE = new ExtendedPoint(CURVE.Gx, CURVE.Gy, _1n, modP(CURVE.Gx * CURVE.Gy));
+    static ZERO = new ExtendedPoint(_0n, _1n, _1n, _0n);
+    static fromAffine(p: Point): ExtendedPoint {
+      if (!(p instanceof Point)) {
+        throw new TypeError('ExtendedPoint#fromAffine: expected Point');
+      }
+      if (p.equals(Point.ZERO)) return ExtendedPoint.ZERO;
+      return new ExtendedPoint(p.x, p.y, _1n, modP(p.x * p.y));
+    }
+    // Takes a bunch of Jacobian Points but executes only one
+    // invert on all of them. invert is very slow operation,
+    // so this improves performance massively.
+    static toAffineBatch(points: ExtendedPoint[]): Point[] {
+      const toInv = mod.invertBatch(
+        points.map((p) => p.z),
+        P
+      );
+      return points.map((p, i) => p.toAffine(toInv[i]));
+    }
+
+    static normalizeZ(points: ExtendedPoint[]): ExtendedPoint[] {
+      return this.toAffineBatch(points).map(this.fromAffine);
+    }
+
+    // Compare one point to another.
+    equals(other: ExtendedPoint): boolean {
+      assertExtPoint(other);
+      const { x: X1, y: Y1, z: Z1 } = this;
+      const { x: X2, y: Y2, z: Z2 } = other;
+      const X1Z2 = modP(X1 * Z2);
+      const X2Z1 = modP(X2 * Z1);
+      const Y1Z2 = modP(Y1 * Z2);
+      const Y2Z1 = modP(Y2 * Z1);
+      return X1Z2 === X2Z1 && Y1Z2 === Y2Z1;
+    }
+
+    // Inverses point to one corresponding to (x, -y) in Affine coordinates.
+    negate(): ExtendedPoint {
+      return new ExtendedPoint(modP(-this.x), this.y, this.z, modP(-this.t));
+    }
+
+    // Fast algo for doubling Extended Point.
+    // https://hyperelliptic.org/EFD/g1p/auto-twisted-extended.html#doubling-dbl-2008-hwcd
+    // Cost: 4M + 4S + 1*a + 6add + 1*2.
+    double(): ExtendedPoint {
+      const { a } = CURVE;
+      const { x: X1, y: Y1, z: Z1 } = this;
+      const A = modP(X1 * X1); // A = X12
+      const B = modP(Y1 * Y1); // B = Y12
+      const C = modP(_2n * modP(Z1 * Z1)); // C = 2*Z12
+      const D = modP(a * A); // D = a*A
+      const x1y1 = X1 + Y1;
+      const E = modP(modP(x1y1 * x1y1) - A - B); // E = (X1+Y1)2-A-B
+      const G = D + B; // G = D+B
+      const F = G - C; // F = G-C
+      const H = D - B; // H = D-B
+      const X3 = modP(E * F); // X3 = E*F
+      const Y3 = modP(G * H); // Y3 = G*H
+      const T3 = modP(E * H); // T3 = E*H
+      const Z3 = modP(F * G); // Z3 = F*G
+      return new ExtendedPoint(X3, Y3, Z3, T3);
+    }
+
+    // Fast algo for adding 2 Extended Points.
+    // https://hyperelliptic.org/EFD/g1p/auto-twisted-extended.html#addition-add-2008-hwcd
+    // Cost: 9M + 1*a + 1*d + 7add.
+    add(other: ExtendedPoint) {
+      assertExtPoint(other);
+      const { a, d } = CURVE;
+      const { x: X1, y: Y1, z: Z1, t: T1 } = this;
+      const { x: X2, y: Y2, z: Z2, t: T2 } = other;
+      // Faster algo for adding 2 Extended Points when curve's a=-1.
+      // http://hyperelliptic.org/EFD/g1p/auto-twisted-extended-1.html#addition-add-2008-hwcd-4
+      // Cost: 8M + 8add + 2*2.
+      // Note: It does not check whether the `other` point is valid.
+      if (a === BigInt(-1)) {
+        const A = modP((Y1 - X1) * (Y2 + X2));
+        const B = modP((Y1 + X1) * (Y2 - X2));
+        const F = modP(B - A);
+        if (F === _0n) return this.double(); // Same point.
+        const C = modP(Z1 * _2n * T2);
+        const D = modP(T1 * _2n * Z2);
+        const E = D + C;
+        const G = B + A;
+        const H = D - C;
+        const X3 = modP(E * F);
+        const Y3 = modP(G * H);
+        const T3 = modP(E * H);
+        const Z3 = modP(F * G);
+        return new ExtendedPoint(X3, Y3, Z3, T3);
+      }
+      const A = modP(X1 * X2); // A = X1*X2
+      const B = modP(Y1 * Y2); // B = Y1*Y2
+      const C = modP(T1 * d * T2); // C = T1*d*T2
+      const D = modP(Z1 * Z2); // D = Z1*Z2
+      const E = modP((X1 + Y1) * (X2 + Y2) - A - B); // E = (X1+Y1)*(X2+Y2)-A-B
+      // TODO: do we need to check for same point here? Looks like working without it
+      const F = D - C; // F = D-C
+      const G = D + C; // G = D+C
+      const H = modP(B - a * A); // H = B-a*A
+      const X3 = modP(E * F); // X3 = E*F
+      const Y3 = modP(G * H); // Y3 = G*H
+      const T3 = modP(E * H); // T3 = E*H
+      const Z3 = modP(F * G); // Z3 = F*G
+
+      return new ExtendedPoint(X3, Y3, Z3, T3);
+    }
+
+    subtract(other: ExtendedPoint): ExtendedPoint {
+      return this.add(other.negate());
+    }
+
+    private wNAF(n: bigint, affinePoint?: Point): ExtendedPoint {
+      if (!affinePoint && this.equals(ExtendedPoint.BASE)) affinePoint = Point.BASE;
+      const W = (affinePoint && affinePoint._WINDOW_SIZE) || 1;
+      let precomputes = affinePoint && pointPrecomputes.get(affinePoint);
+      if (!precomputes) {
+        precomputes = wnaf.precomputeWindow(this, W) as ExtendedPoint[];
+        if (affinePoint && W !== 1) {
+          precomputes = ExtendedPoint.normalizeZ(precomputes);
+          pointPrecomputes.set(affinePoint, precomputes);
+        }
+      }
+      const { p, f } = wnaf.wNAF(W, precomputes, n);
+      return ExtendedPoint.normalizeZ([p, f])[0];
+    }
+
+    // Constant time multiplication.
+    // Uses wNAF method. Windowed method may be 10% faster,
+    // but takes 2x longer to generate and consumes 2x memory.
+    multiply(scalar: number | bigint, affinePoint?: Point): ExtendedPoint {
+      return this.wNAF(normalizeScalar(scalar, CURVE_ORDER), affinePoint);
+    }
+
+    // Non-constant-time multiplication. Uses double-and-add algorithm.
+    // It's faster, but should only be used when you don't care about
+    // an exposed private key e.g. sig verification.
+    // Allows scalar bigger than curve order, but less than 2^256
+    multiplyUnsafe(scalar: number | bigint): ExtendedPoint {
+      let n = normalizeScalar(scalar, CURVE_ORDER, false);
+      const G = ExtendedPoint.BASE;
+      const P0 = ExtendedPoint.ZERO;
+      if (n === _0n) return P0;
+      if (this.equals(P0) || n === _1n) return this;
+      if (this.equals(G)) return this.wNAF(n);
+      return wnaf.unsafeLadder(this, n);
+    }
+
+    // Multiplies point by cofactor and checks if the result is 0.
+    isSmallOrder(): boolean {
+      return this.multiplyUnsafe(CURVE.h).equals(ExtendedPoint.ZERO);
+    }
+
+    // Multiplies point by a very big scalar n and checks if the result is 0.
+    isTorsionFree(): boolean {
+      return this.multiplyUnsafe(CURVE_ORDER).equals(ExtendedPoint.ZERO);
+    }
+
+    // Converts Extended point to default (x, y) coordinates.
+    // Can accept precomputed Z^-1 - for example, from invertBatch.
+    toAffine(invZ?: bigint): Point {
+      const { x, y, z } = this;
+      const is0 = this.equals(ExtendedPoint.ZERO);
+      if (invZ == null) invZ = is0 ? _8n : mod.invert(z, P); // 8 was chosen arbitrarily
+      const ax = modP(x * invZ);
+      const ay = modP(y * invZ);
+      const zz = modP(z * invZ);
+      if (is0) return Point.ZERO;
+      if (zz !== _1n) throw new Error('invZ was invalid');
+      return new Point(ax, ay);
+    }
+  }
+  const wnaf = wNAF(ExtendedPoint, groupLen * 8);
+
+  function assertExtPoint(other: unknown) {
+    if (!(other instanceof ExtendedPoint)) throw new TypeError('ExtendedPoint expected');
+  }
+  // Stores precomputed values for points.
+  const pointPrecomputes = new WeakMap<Point, ExtendedPoint[]>();
+
+  /**
+   * Default Point works in affine coordinates: (x, y)
+   */
+  class Point implements PointType {
+    // Base point aka generator
+    // public_key = Point.BASE * private_key
+    static BASE: Point = new Point(CURVE.Gx, CURVE.Gy);
+    // Identity point aka point at infinity
+    // point = point + zero_point
+    static ZERO: Point = new Point(_0n, _1n);
+    // We calculate precomputes for elliptic curve point multiplication
+    // using windowed method. This specifies window size and
+    // stores precomputed values. Usually only base point would be precomputed.
+    _WINDOW_SIZE?: number;
+
+    constructor(readonly x: bigint, readonly y: bigint) {}
+
+    // "Private method", don't use it directly.
+    _setWindowSize(windowSize: number) {
+      this._WINDOW_SIZE = windowSize;
+      pointPrecomputes.delete(this);
+    }
+
+    // Converts hash string or Uint8Array to Point.
+    // Uses algo from RFC8032 5.1.3.
+    static fromHex(hex: Hex, strict = true) {
+      const { d, P, a } = CURVE;
+      hex = ensureBytes(hex, fieldLen);
+      // 1.  First, interpret the string as an integer in little-endian
+      // representation. Bit 255 of this number is the least significant
+      // bit of the x-coordinate and denote this value x_0.  The
+      // y-coordinate is recovered simply by clearing this bit.  If the
+      // resulting value is >= p, decoding fails.
+      const normed = hex.slice();
+      const lastByte = hex[fieldLen - 1];
+      normed[fieldLen - 1] = lastByte & ~0x80;
+      const y = bytesToNumberLE(normed);
+
+      if (strict && y >= P) throw new Error('Expected 0 < hex < P');
+      if (!strict && y >= maxGroupElement) throw new Error('Expected 0 < hex < 2**256');
+
+      // 2.  To recover the x-coordinate, the curve equation implies
+      // Ed25519: x² = (y² - 1) / (d y² + 1) (mod p).
+      // Ed448: x² = (y² - 1) / (d y² - 1) (mod p).
+      // For generic case:
+      // a*x²+y²=1+d*x²*y²
+      // -> y²-1 = d*x²*y²-a*x²
+      // -> y²-1 = x² (d*y²-a)
+      // -> x² = (y²-1) / (d*y²-a)
+
+      // The denominator is always non-zero mod p.  Let u = y² - 1 and v = d y² + 1.
+      const y2 = modP(y * y);
+      const u = modP(y2 - _1n);
+      const v = modP(d * y2 - a);
+      let { isValid, value: x } = uvRatio(u, v);
+      if (!isValid) throw new Error('Point.fromHex: invalid y coordinate');
+      // 4.  Finally, use the x_0 bit to select the right square root.  If
+      // x = 0, and x_0 = 1, decoding fails.  Otherwise, if x_0 != x mod
+      // 2, set x <-- p - x.  Return the decoded point (x,y).
+      const isXOdd = (x & _1n) === _1n;
+      const isLastByteOdd = (lastByte & 0x80) !== 0;
+      if (isLastByteOdd !== isXOdd) x = modP(-x);
+      return new Point(x, y);
+    }
+
+    static fromPrivateKey(privateKey: PrivKey) {
+      return getExtendedPublicKey(privateKey).point;
+    }
+
+    // There can always be only two x values (x, -x) for any y
+    // When compressing point, it's enough to only store its y coordinate
+    // and use the last byte to encode sign of x.
+    toRawBytes(): Uint8Array {
+      const bytes = numberToBytesLE(this.y, fieldLen);
+      bytes[fieldLen - 1] |= this.x & _1n ? 0x80 : 0;
+      return bytes;
+    }
+
+    // Same as toRawBytes, but returns string.
+    toHex(): string {
+      return bytesToHex(this.toRawBytes());
+    }
+
+    isTorsionFree(): boolean {
+      return ExtendedPoint.fromAffine(this).isTorsionFree();
+    }
+
+    equals(other: Point): boolean {
+      if (!(other instanceof Point)) throw new TypeError('Point#equals: expected Point');
+      return this.x === other.x && this.y === other.y;
+    }
+
+    negate(): Point {
+      return new Point(modP(-this.x), this.y);
+    }
+
+    double(): Point {
+      return ExtendedPoint.fromAffine(this).double().toAffine();
+    }
+
+    add(other: Point) {
+      return ExtendedPoint.fromAffine(this).add(ExtendedPoint.fromAffine(other)).toAffine();
+    }
+
+    subtract(other: Point) {
+      return this.add(other.negate());
+    }
+
+    /**
+     * Constant time multiplication.
+     * @param scalar Big-Endian number
+     * @returns new point
+     */
+    multiply(scalar: number | bigint): Point {
+      return ExtendedPoint.fromAffine(this).multiply(scalar, this).toAffine();
+    }
+  }
+
+  /**
+   * EDDSA signature.
+   */
+  class Signature implements SignatureType {
+    constructor(readonly r: Point, readonly s: bigint) {
+      this.assertValidity();
+    }
+
+    static fromHex(hex: Hex) {
+      const bytes = ensureBytes(hex, 2 * fieldLen);
+      const r = Point.fromHex(bytes.slice(0, fieldLen), false);
+      const s = bytesToNumberLE(bytes.slice(fieldLen, 2 * fieldLen));
+      return new Signature(r, s);
+    }
+
+    assertValidity() {
+      const { r, s } = this;
+      if (!(r instanceof Point)) throw new Error('Expected Point instance');
+      // 0 <= s < l
+      normalizeScalar(s, CURVE_ORDER, false);
+      return this;
+    }
+
+    toRawBytes() {
+      return concatBytes(this.r.toRawBytes(), numberToBytesLE(this.s, fieldLen));
+    }
+
+    toHex() {
+      return bytesToHex(this.toRawBytes());
+    }
+  }
+
+  // Little-endian SHA512 with modulo n
+  function modlLE(hash: Uint8Array): bigint {
+    return mod.mod(bytesToNumberLE(hash), CURVE_ORDER);
+  }
+
+  /**
+   * Checks for num to be in range:
+   * For strict == true:  `0 <  num < max`.
+   * For strict == false: `0 <= num < max`.
+   * Converts non-float safe numbers to bigints.
+   */
+  function normalizeScalar(num: number | bigint, max: bigint, strict = true): bigint {
+    if (!max) throw new TypeError('Specify max value');
+    if (typeof num === 'number' && Number.isSafeInteger(num)) num = BigInt(num);
+    if (typeof num === 'bigint' && num < max) {
+      if (strict) {
+        if (_0n < num) return num;
+      } else {
+        if (_0n <= num) return num;
+      }
+    }
+    throw new TypeError('Expected valid scalar: 0 < scalar < max');
+  }
+
+  function checkPrivateKey(key: PrivKey) {
+    // Normalize bigint / number / string to Uint8Array
+    key =
+      typeof key === 'bigint' || typeof key === 'number'
+        ? numberToBytesLE(normalizeScalar(key, maxGroupElement), groupLen)
+        : ensureBytes(key);
+    if (key.length !== groupLen) throw new Error(`Expected ${groupLen} bytes, got ${key.length}`);
+    return key;
+  }
+
+  // Takes 64 bytes
+  function getKeyFromHash(hashed: Uint8Array) {
+    // First 32 bytes of 64b uniformingly random input are taken,
+    // clears 3 bits of it to produce a random field element.
+    const head = adjustScalarBytes(hashed.slice(0, groupLen));
+    // Second 32 bytes is called key prefix (5.1.6)
+    const prefix = hashed.slice(groupLen, 2 * groupLen);
+    // The actual private scalar
+    const scalar = modlLE(head);
+    // Point on Edwards curve aka public key
+    const point = Point.BASE.multiply(scalar);
+    const pointBytes = point.toRawBytes();
+    return { head, prefix, scalar, point, pointBytes };
+  }
+
+  /** Convenience method that creates public key and other stuff. RFC8032 5.1.5 */
+  function getExtendedPublicKey(key: PrivKey) {
+    return getKeyFromHash(CURVE.hash(checkPrivateKey(key)));
+  }
+
+  /**
+   * Calculates ed25519 public key. RFC8032 5.1.5
+   * 1. private key is hashed with sha512, then first 32 bytes are taken from the hash
+   * 2. 3 least significant bits of the first byte are cleared
+   */
+  function getPublicKey(privateKey: PrivKey): Uint8Array {
+    return getExtendedPublicKey(privateKey).pointBytes;
+  }
+
+  const EMPTY = new Uint8Array();
+  function hashDomainToScalar(message: Uint8Array, context: Hex = EMPTY) {
+    context = ensureBytes(context);
+    return modlLE(CURVE.hash(domain(message, context, !!CURVE.preHash)));
+  }
+
+  /** Signs message with privateKey. RFC8032 5.1.6 */
+  function sign(message: Hex, privateKey: Hex, context?: Hex): Uint8Array {
+    message = ensureBytes(message);
+    if (CURVE.preHash) message = CURVE.preHash(message);
+    const { prefix, scalar, pointBytes } = getExtendedPublicKey(privateKey);
+    const r = hashDomainToScalar(concatBytes(prefix, message), context);
+    const R = Point.BASE.multiply(r); // R = rG
+    const k = hashDomainToScalar(concatBytes(R.toRawBytes(), pointBytes, message), context); // k = hash(R+P+msg)
+    const s = mod.mod(r + k * scalar, CURVE_ORDER); // s = r + kp
+    return new Signature(R, s).toRawBytes();
+  }
+
+  /**
+   * Verifies EdDSA signature against message and public key.
+   * An extended group equation is checked.
+   * RFC8032 5.1.7
+   * Compliant with ZIP215:
+   * 0 <= sig.R/publicKey < 2**256 (can be >= curve.P)
+   * 0 <= sig.s < l
+   * Not compliant with RFC8032: it's not possible to comply to both ZIP & RFC at the same time.
+   */
+  function verify(sig: SigType, message: Hex, publicKey: PubKey, context?: Hex): boolean {
+    message = ensureBytes(message);
+    if (CURVE.preHash) message = CURVE.preHash(message);
+    // When hex is passed, we check public key fully.
+    // When Point instance is passed, we assume it has already been checked, for performance.
+    // If user passes Point/Sig instance, we assume it has been already verified.
+    // We don't check its equations for performance. We do check for valid bounds for s though
+    // We always check for: a) s bounds. b) hex validity
+    if (publicKey instanceof Point) {
+      // ignore
+    } else if (publicKey instanceof Uint8Array || typeof publicKey === 'string') {
+      publicKey = Point.fromHex(publicKey, false);
+    } else {
+      throw new Error(`Invalid publicKey: ${publicKey}`);
+    }
+
+    if (sig instanceof Signature) sig.assertValidity();
+    else if (sig instanceof Uint8Array || typeof sig === 'string') sig = Signature.fromHex(sig);
+    else throw new Error(`Wrong signature: ${sig}`);
+
+    const { r, s } = sig;
+    const SB = ExtendedPoint.BASE.multiplyUnsafe(s);
+    const k = hashDomainToScalar(
+      concatBytes(r.toRawBytes(), publicKey.toRawBytes(), message),
+      context
+    );
+    const kA = ExtendedPoint.fromAffine(publicKey).multiplyUnsafe(k);
+    const RkA = ExtendedPoint.fromAffine(r).add(kA);
+    // [8][S]B = [8]R + [8][k]A'
+    return RkA.subtract(SB).multiplyUnsafe(CURVE.h).equals(ExtendedPoint.ZERO);
+  }
+
+  // Enable precomputes. Slows down first publicKey computation by 20ms.
+  Point.BASE._setWindowSize(8);
+
+  const utils = {
+    getExtendedPublicKey,
+    mod: modP,
+    invert: (a: bigint, m = CURVE.P) => mod.invert(a, m),
+
+    /**
+     * Not needed for ed25519 private keys. Needed if you use scalars directly (rare).
+     */
+    hashToPrivateScalar: (hash: Hex): bigint => hashToPrivateScalar(hash, CURVE_ORDER, true),
+
+    /**
+     * ed25519 private keys are uniform 32-bit strings. We do not need to check for
+     * modulo bias like we do in secp256k1 randomPrivateKey()
+     */
+    randomPrivateKey: (): Uint8Array => randomBytes(fieldLen),
+
+    /**
+     * We're doing scalar multiplication (used in getPublicKey etc) with precomputed BASE_POINT
+     * values. This slows down first getPublicKey() by milliseconds (see Speed section),
+     * but allows to speed-up subsequent getPublicKey() calls up to 20x.
+     * @param windowSize 2, 4, 8, 16
+     */
+    precompute(windowSize = 8, point = Point.BASE): Point {
+      const cached = point.equals(Point.BASE) ? point : new Point(point.x, point.y);
+      cached._setWindowSize(windowSize);
+      cached.multiply(_2n);
+      return cached;
+    },
+  };
+
+  return {
+    CURVE,
+    getPublicKey,
+    sign,
+    verify,
+    ExtendedPoint,
+    Point,
+    Signature,
+    utils,
+  };
+}

src/group.ts

@@ -0,0 +1,127 @@
+/*! @noble/curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+// Default group related functions
+const _0n = BigInt(0);
+const _1n = BigInt(1);
+
+export interface Group<T extends Group<T>> {
+  double(): T;
+  negate(): T;
+  add(other: T): T;
+  subtract(other: T): T;
+  equals(other: T): boolean;
+  multiply(scalar: number | bigint): T;
+}
+
+export type GroupConstructor<T> = {
+  BASE: T;
+  ZERO: T;
+};
+// Not big, but pretty complex and it is easy to break stuff. To avoid too much copy paste
+export function wNAF<T extends Group<T>>(c: GroupConstructor<T>, bits: number) {
+  const constTimeNegate = (condition: boolean, item: T): T => {
+    const neg = item.negate();
+    return condition ? neg : item;
+  };
+  const opts = (W: number) => {
+    if (256 % W) throw new Error('Invalid precomputation window, must be power of 2');
+    const windows = Math.ceil(bits / W) + 1; // +1, because
+    const windowSize = 2 ** (W - 1); // -1 because we skip zero
+    return { windows, windowSize };
+  };
+  return {
+    constTimeNegate,
+    // non-const time multiplication ladder
+    unsafeLadder(elm: T, n: bigint) {
+      let p = c.ZERO;
+      let d: T = elm;
+      while (n > _0n) {
+        if (n & _1n) p = p.add(d);
+        d = d.double();
+        n >>= _1n;
+      }
+      return p;
+    },
+
+    /**
+     * Creates a wNAF precomputation window. Used for caching.
+     * Default window size is set by `utils.precompute()` and is equal to 8.
+     * Which means we are caching 65536 points: 256 points for every bit from 0 to 256.
+     * @returns 65K precomputed points, depending on W
+     */
+    precomputeWindow(elm: T, W: number): Group<T>[] {
+      const { windows, windowSize } = opts(W);
+      const points: T[] = [];
+      let p: T = elm;
+      let base = p;
+      for (let window = 0; window < windows; window++) {
+        base = p;
+        points.push(base);
+        // =1, because we skip zero
+        for (let i = 1; i < windowSize; i++) {
+          base = base.add(p);
+          points.push(base);
+        }
+        p = base.double();
+      }
+      return points;
+    },
+
+    /**
+     * Implements w-ary non-adjacent form for calculating ec multiplication.
+     * @param n
+     * @param affinePoint optional 2d point to save cached precompute windows on it.
+     * @returns real and fake (for const-time) points
+     */
+    wNAF(W: number, precomputes: T[], n: bigint): { p: T; f: T } {
+      const { windows, windowSize } = opts(W);
+
+      let p = c.ZERO;
+      let f = c.BASE;
+
+      const mask = BigInt(2 ** W - 1); // Create mask with W ones: 0b1111 for W=4 etc.
+      const maxNumber = 2 ** W;
+      const shiftBy = BigInt(W);
+
+      for (let window = 0; window < windows; window++) {
+        const offset = window * windowSize;
+        // Extract W bits.
+        let wbits = Number(n & mask);
+
+        // Shift number by W bits.
+        n >>= shiftBy;
+
+        // If the bits are bigger than max size, we'll split those.
+        // +224 => 256 - 32
+        if (wbits > windowSize) {
+          wbits -= maxNumber;
+          n += _1n;
+        }
+
+        // This code was first written with assumption that 'f' and 'p' will never be infinity point:
+        // since each addition is multiplied by 2 ** W, it cannot cancel each other. However,
+        // there is negate now: it is possible that negated element from low value
+        // would be the same as high element, which will create carry into next window.
+        // It's not obvious how this can fail, but still worth investigating later.
+
+        // Check if we're onto Zero point.
+        // Add random point inside current window to f.
+        const offset1 = offset;
+        const offset2 = offset + Math.abs(wbits) - 1; // -1 because we skip zero
+        const cond1 = window % 2 !== 0;
+        const cond2 = wbits < 0;
+        if (wbits === 0) {
+          // The most important part for const-time getPublicKey
+          f = f.add(constTimeNegate(cond1, precomputes[offset1]));
+        } else {
+          p = p.add(constTimeNegate(cond2, precomputes[offset2]));
+        }
+      }
+      // JIT-compiler should not eliminate f here, since it will later be used in normalizeZ()
+      // Even if the variable is still unused, there are some checks which will
+      // throw an exception, so compiler needs to prove they won't happen, which is hard.
+      // At this point there is a way to F be infinity-point even if p is not,
+      // which makes it less const-time: around 1 bigint multiply.
+      return { p, f };
+    },
+  };
+}

src/modular.ts

@@ -1,4 +1,6 @@
 /*! @noble/curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+
+// Utilities for modular arithmetics
 const _0n = BigInt(0);
 const _1n = BigInt(1);
 const _2n = BigInt(2);
@@ -62,6 +64,16 @@ export function invert(number: bigint, modulo: bigint): bigint {
   return mod(x, modulo);
 }
 
+/**
+ * Division over finite field.
+ * `a/b mod p == a * invert(b) mod p`
+ */
+export function div(numerator: bigint, denominator: bigint, modulo: bigint): bigint {
+  const num = mod(numerator, modulo);
+  const iden = invert(denominator, modulo);
+  return mod(num * iden, modulo);
+}
+
 /**
  * Takes a list of numbers, efficiently inverts all of them.
  * @param nums list of bigints
@@ -97,7 +109,6 @@ export function legendre(num: bigint, fieldPrime: bigint): bigint {
 
 /**
  * Calculates square root of a number in a finite field.
- * Used to calculate y - the square root of y².
  */
 export function sqrt(number: bigint, modulo: bigint): bigint {
   const n = number;
@@ -107,6 +118,7 @@ export function sqrt(number: bigint, modulo: bigint): bigint {
   // P = 3 (mod 4)
   // sqrt n = n^((P+1)/4)
   if (P % _4n === _3n) return pow(n, p1div4, P);
+
   // P = 5 (mod 8)
   if (P % _8n === _5n) {
     const n2 = mod(n * _2n, P);
@@ -144,3 +156,14 @@ export function sqrt(number: bigint, modulo: bigint): bigint {
   }
   return r;
 }
+
+// Little-endian check for first LE bit (last BE bit);
+export const isNegativeLE = (num: bigint, modulo: bigint) => (mod(num, modulo) & _1n) === _1n;
+
+// An idea on modular arithmetic for bls12-381:
+// const FIELD = {add, pow, sqrt, mul};
+// Functions will take field elements, no need for an additional class
+// Could be faster. 1 bigint field will just do operations and mod later:
+// instead of 'r = mod(r * b, P)' we will write r = mul(r, b);
+// Could be insecure without shape check, so it needs to be done.
+// Functions could be inlined by JIT.

src/montgomery.ts

@@ -0,0 +1,213 @@
+import * as mod from './modular.js';
+import {
+  ensureBytes,
+  numberToBytesLE,
+  bytesToNumberLE,
+  // nLength,
+} from './utils.js';
+
+const _0n = BigInt(0);
+const _1n = BigInt(1);
+type Hex = string | Uint8Array;
+
+export type CurveType = {
+  // Field over which we'll do calculations. Verify with:
+  P: bigint;
+  nByteLength: number;
+  adjustScalarBytes?: (bytes: Uint8Array) => Uint8Array;
+  domain?: (data: Uint8Array, ctx: Uint8Array, phflag: boolean) => Uint8Array;
+  a24: bigint; // Related to d, but cannot be derived from it
+  montgomeryBits: number;
+  powPminus2?: (x: bigint) => bigint;
+  xyToU?: (x: bigint, y: bigint) => bigint;
+  Gu: string;
+};
+export type CurveFn = {
+  scalarMult: (u: Hex, scalar: Hex) => Uint8Array;
+  scalarMultBase: (scalar: Hex) => Uint8Array;
+  getPublicKey: (privateKey: Hex) => Uint8Array;
+  Gu: string;
+};
+
+function validateOpts(curve: CurveType) {
+  for (const i of ['a24'] as const) {
+    if (typeof curve[i] !== 'bigint')
+      throw new Error(`Invalid curve param ${i}=${curve[i]} (${typeof curve[i]})`);
+  }
+  for (const i of ['montgomeryBits', 'nByteLength'] as const) {
+    if (curve[i] === undefined) continue; // Optional
+    if (!Number.isSafeInteger(curve[i]))
+      throw new Error(`Invalid curve param ${i}=${curve[i]} (${typeof curve[i]})`);
+  }
+  for (const fn of ['adjustScalarBytes', 'domain', 'powPminus2'] as const) {
+    if (curve[fn] === undefined) continue; // Optional
+    if (typeof curve[fn] !== 'function') throw new Error(`Invalid ${fn} function`);
+  }
+  for (const i of ['Gu'] as const) {
+    if (curve[i] === undefined) continue; // Optional
+    if (typeof curve[i] !== 'string')
+      throw new Error(`Invalid curve param ${i}=${curve[i]} (${typeof curve[i]})`);
+  }
+  // Set defaults
+  // ...nLength(curve.n, curve.nBitLength),
+  return Object.freeze({ ...curve } as const);
+}
+
+// NOTE: not really montgomery curve, just bunch of very specific methods for X25519/X448 (RFC 7748, https://www.rfc-editor.org/rfc/rfc7748)
+// Uses only one coordinate instead of two
+export function montgomery(curveDef: CurveType): CurveFn {
+  const CURVE = validateOpts(curveDef);
+  const { P } = CURVE;
+  const modP = (a: bigint) => mod.mod(a, P);
+  const montgomeryBits = CURVE.montgomeryBits;
+  const montgomeryBytes = Math.ceil(montgomeryBits / 8);
+  const fieldLen = CURVE.nByteLength;
+  const adjustScalarBytes = CURVE.adjustScalarBytes || ((bytes: Uint8Array) => bytes);
+  const powPminus2 = CURVE.powPminus2 || ((x: bigint) => mod.pow(x, P - BigInt(2), P));
+
+  /**
+   * Checks for num to be in range:
+   * For strict == true:  `0 <  num < max`.
+   * For strict == false: `0 <= num < max`.
+   * Converts non-float safe numbers to bigints.
+   */
+  function normalizeScalar(num: number | bigint, max: bigint, strict = true): bigint {
+    if (!max) throw new TypeError('Specify max value');
+    if (typeof num === 'number' && Number.isSafeInteger(num)) num = BigInt(num);
+    if (typeof num === 'bigint' && num < max) {
+      if (strict) {
+        if (_0n < num) return num;
+      } else {
+        if (_0n <= num) return num;
+      }
+    }
+    throw new TypeError('Expected valid scalar: 0 < scalar < max');
+  }
+
+  // cswap from RFC7748
+  // NOTE: cswap is not from RFC7748!
+  /* 
+    cswap(swap, x_2, x_3):
+         dummy = mask(swap) AND (x_2 XOR x_3)
+         x_2 = x_2 XOR dummy
+         x_3 = x_3 XOR dummy
+         Return (x_2, x_3)
+  Where mask(swap) is the all-1 or all-0 word of the same length as x_2
+   and x_3, computed, e.g., as mask(swap) = 0 - swap.
+  */
+  function cswap(swap: bigint, x_2: bigint, x_3: bigint): [bigint, bigint] {
+    const dummy = modP(swap * (x_2 - x_3));
+    x_2 = modP(x_2 - dummy);
+    x_3 = modP(x_3 + dummy);
+    return [x_2, x_3];
+  }
+
+  // x25519 from 4
+  /**
+   *
+   * @param pointU u coordinate (x) on Montgomery Curve 25519
+   * @param scalar by which the point would be multiplied
+   * @returns new Point on Montgomery curve
+   */
+  function montgomeryLadder(pointU: bigint, scalar: bigint): bigint {
+    const { P } = CURVE;
+    const u = normalizeScalar(pointU, P);
+    // Section 5: Implementations MUST accept non-canonical values and process them as
+    // if they had been reduced modulo the field prime.
+    const k = normalizeScalar(scalar, P);
+    // The constant a24 is (486662 - 2) / 4 = 121665 for curve25519/X25519
+    const a24 = CURVE.a24;
+    const x_1 = u;
+    let x_2 = _1n;
+    let z_2 = _0n;
+    let x_3 = u;
+    let z_3 = _1n;
+    let swap = _0n;
+    let sw: [bigint, bigint];
+    for (let t = BigInt(montgomeryBits - 1); t >= _0n; t--) {
+      const k_t = (k >> t) & _1n;
+      swap ^= k_t;
+      sw = cswap(swap, x_2, x_3);
+      x_2 = sw[0];
+      x_3 = sw[1];
+      sw = cswap(swap, z_2, z_3);
+      z_2 = sw[0];
+      z_3 = sw[1];
+      swap = k_t;
+
+      const A = x_2 + z_2;
+      const AA = modP(A * A);
+      const B = x_2 - z_2;
+      const BB = modP(B * B);
+      const E = AA - BB;
+      const C = x_3 + z_3;
+      const D = x_3 - z_3;
+      const DA = modP(D * A);
+      const CB = modP(C * B);
+      const dacb = DA + CB;
+      const da_cb = DA - CB;
+      x_3 = modP(dacb * dacb);
+      z_3 = modP(x_1 * modP(da_cb * da_cb));
+      x_2 = modP(AA * BB);
+      z_2 = modP(E * (AA + modP(a24 * E)));
+    }
+    // (x_2, x_3) = cswap(swap, x_2, x_3)
+    sw = cswap(swap, x_2, x_3);
+    x_2 = sw[0];
+    x_3 = sw[1];
+    // (z_2, z_3) = cswap(swap, z_2, z_3)
+    sw = cswap(swap, z_2, z_3);
+    z_2 = sw[0];
+    z_3 = sw[1];
+    // z_2^(p - 2)
+    const z2 = powPminus2(z_2);
+    // Return x_2 * (z_2^(p - 2))
+    return modP(x_2 * z2);
+  }
+
+  function encodeUCoordinate(u: bigint): Uint8Array {
+    return numberToBytesLE(modP(u), montgomeryBytes);
+  }
+
+  function decodeUCoordinate(uEnc: Hex): bigint {
+    const u = ensureBytes(uEnc, montgomeryBytes);
+    // Section 5: When receiving such an array, implementations of X25519
+    // MUST mask the most significant bit in the final byte.
+    // This is very ugly way, but it works because fieldLen-1 is outside of bounds for X448, so this becomes NOOP
+    // fieldLen - scalaryBytes = 1 for X448 and = 0 for X25519
+    u[fieldLen - 1] &= 127; // 0b0111_1111
+    return bytesToNumberLE(u);
+  }
+
+  function decodeScalar(n: Hex): bigint {
+    const bytes = ensureBytes(n);
+    if (bytes.length !== montgomeryBytes && bytes.length !== fieldLen)
+      throw new Error(`Expected ${montgomeryBytes} or ${fieldLen} bytes, got ${bytes.length}`);
+    return bytesToNumberLE(adjustScalarBytes(bytes));
+  }
+  // Multiply point u by scalar
+  function scalarMult(u: Hex, scalar: Hex): Uint8Array {
+    const pointU = decodeUCoordinate(u);
+    const _scalar = decodeScalar(scalar);
+    const pu = montgomeryLadder(pointU, _scalar);
+    // The result was not contributory
+    // https://cr.yp.to/ecdh.html#validate
+    if (pu === _0n) throw new Error('Invalid private or public key received');
+    return encodeUCoordinate(pu);
+  }
+  // Multiply base point by scalar
+  function scalarMultBase(scalar: Hex): Uint8Array {
+    return scalarMult(CURVE.Gu, scalar);
+  }
+
+  return {
+    // NOTE: we can get 'y' coordinate from 'u', but Point.fromHex also wants 'x' coordinate oddity flag, and we cannot get 'x' without knowing 'v'
+    // Need to add generic conversion between twisted edwards and complimentary curve for JubJub
+    scalarMult,
+    scalarMultBase,
+    // NOTE: these function work on complimentary montgomery curve
+    // getSharedSecret: (privateKey: Hex, publicKey: Hex) => scalarMult(publicKey, privateKey),
+    getPublicKey: (privateKey: Hex): Uint8Array => scalarMultBase(privateKey),
+    Gu: CURVE.Gu,
+  };
+}

src/utils.ts

@@ -1,6 +1,44 @@
 /*! @noble/curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-// Convert between types
-// ---------------------
+
+// We accept hex strings besides Uint8Array for simplicity
+export type Hex = Uint8Array | string;
+// Very few implementations accept numbers, we do it to ease learning curve
+export type PrivKey = Hex | bigint | number;
+
+// NOTE: these are generic, even if curve is on some polynominal field (bls), it will still have P/n/h
+// But generator can be different (Fp2/Fp6 for bls?)
+export type BasicCurve = {
+  // Field over which we'll do calculations (Fp)
+  P: bigint;
+  // Curve order, total count of valid points in the field
+  n: bigint;
+  // Bit/byte length of curve order
+  nBitLength?: number;
+  nByteLength?: number;
+  // Cofactor
+  // NOTE: we can assign default value of 1, but then users will just ignore it, without validating with spec
+  // Has not use for now, but nice to have in API
+  h: bigint;
+  // Base point (x, y) aka generator point
+  Gx: bigint;
+  Gy: bigint;
+};
+
+export function validateOpts<T extends BasicCurve>(curve: T) {
+  for (const i of ['P', 'n', 'h', 'Gx', 'Gy'] as const) {
+    if (typeof curve[i] !== 'bigint')
+      throw new Error(`Invalid curve param ${i}=${curve[i]} (${typeof curve[i]})`);
+  }
+  for (const i of ['nBitLength', 'nByteLength'] as const) {
+    if (curve[i] === undefined) continue; // Optional
+    if (!Number.isSafeInteger(curve[i]))
+      throw new Error(`Invalid curve param ${i}=${curve[i]} (${typeof curve[i]})`);
+  }
+  // Set defaults
+  return Object.freeze({ ...nLength(curve.n, curve.nBitLength), ...curve } as const);
+}
+
+import * as mod from './modular.js';
 
 const hexes = Array.from({ length: 256 }, (v, i) => i.toString(16).padStart(2, '0'));
 export function bytesToHex(uint8a: Uint8Array): string {
@@ -44,14 +82,25 @@ export function hexToBytes(hex: string): Uint8Array {
 }
 
 // Big Endian
-export function bytesToNumber(bytes: Uint8Array): bigint {
+export function bytesToNumberBE(bytes: Uint8Array): bigint {
   return hexToNumber(bytesToHex(bytes));
 }
+export function bytesToNumberLE(uint8a: Uint8Array): bigint {
+  if (!(uint8a instanceof Uint8Array)) throw new Error('Expected Uint8Array');
+  return BigInt('0x' + bytesToHex(Uint8Array.from(uint8a).reverse()));
+}
 
-export function ensureBytes(hex: string | Uint8Array): Uint8Array {
+export const numberToBytesBE = (n: bigint, len: number) =>
+  hexToBytes(n.toString(16).padStart(len * 2, '0'));
+export const numberToBytesLE = (n: bigint, len: number) => numberToBytesBE(n, len).reverse();
+
+export function ensureBytes(hex: Hex, expectedLength?: number): Uint8Array {
   // Uint8Array.from() instead of hash.slice() because node.js Buffer
   // is instance of Uint8Array, and its slice() creates **mutable** copy
-  return hex instanceof Uint8Array ? Uint8Array.from(hex) : hexToBytes(hex);
+  const bytes = hex instanceof Uint8Array ? Uint8Array.from(hex) : hexToBytes(hex);
+  if (typeof expectedLength === 'number' && bytes.length !== expectedLength)
+    throw new Error(`Expected ${expectedLength} bytes`);
+  return bytes;
 }
 
 // Copies several Uint8Arrays into one.
@@ -67,3 +116,37 @@ export function concatBytes(...arrays: Uint8Array[]): Uint8Array {
   }
   return result;
 }
+
+// CURVE.n lengths
+export function nLength(n: bigint, nBitLength?: number) {
+  // Bit size, byte size of CURVE.n
+  const _nBitLength = nBitLength !== undefined ? nBitLength : n.toString(2).length;
+  const nByteLength = Math.ceil(_nBitLength / 8);
+  return { nBitLength: _nBitLength, nByteLength };
+}
+
+/**
+ * Can take (n+8) or more bytes of uniform input e.g. from CSPRNG or KDF
+ * and convert them into private scalar, with the modulo bias being neglible.
+ * As per FIPS 186 B.4.1.
+ * https://research.kudelskisecurity.com/2020/07/28/the-definitive-guide-to-modulo-bias-and-how-to-avoid-it/
+ * @param hash hash output from sha512, or a similar function
+ * @returns valid private scalar
+ */
+const _1n = BigInt(1);
+export function hashToPrivateScalar(hash: Hex, CURVE_ORDER: bigint, isLE = false): bigint {
+  hash = ensureBytes(hash);
+  const orderLen = nLength(CURVE_ORDER).nByteLength;
+  const minLen = orderLen + 8;
+  if (orderLen < 16 || hash.length < minLen || hash.length > 1024)
+    throw new Error('Expected valid bytes of private key as per FIPS 186');
+  const num = isLE ? bytesToNumberLE(hash) : bytesToNumberBE(hash);
+  return mod.mod(num, CURVE_ORDER - _1n) + _1n;
+}
+
+export function equalBytes(b1: Uint8Array, b2: Uint8Array) {
+  // We don't care about timing attacks here
+  if (b1.length !== b2.length) return false;
+  for (let i = 0; i < b1.length; i++) if (b1[i] !== b2[i]) return false;
+  return true;
+}

src/weierstrass.ts

@@ -1,18 +1,30 @@
 /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-// Implementation of Short weierstrass curve. The formula is: y² = x³ + ax + b
+// Implementation of Short Weierstrass curve. The formula is: y² = x³ + ax + b
 
 // TODO: sync vs async naming
 // TODO: default randomBytes
+// Differences from @noble/secp256k1 1.7:
+// 1. Different double() formula (but same addition)
+// 2. Different sqrt() function
+// 3. truncateHash() truncateOnly mode
+// 4. DRBG supports outputLen bigger than outputLen of hmac
+
 import * as mod from './modular.js';
 import {
   bytesToHex,
-  bytesToNumber,
+  bytesToNumberBE,
   concatBytes,
   ensureBytes,
   hexToBytes,
   hexToNumber,
   numberToHexUnpadded,
+  hashToPrivateScalar,
+  BasicCurve,
+  validateOpts as utilOpts,
+  Hex,
+  PrivKey,
 } from './utils.js';
+import { Group, GroupConstructor, wNAF } from './group.js';
 
 export type CHash = {
   (message: Uint8Array | string): Uint8Array;
@@ -26,61 +38,39 @@ type EndomorphismOpts = {
   splitScalar: (k: bigint) => { k1neg: boolean; k1: bigint; k2neg: boolean; k2: bigint };
 };
 
-export type CurveType = {
+export type CurveType = BasicCurve & {
   // Params: a, b
   a: bigint;
   b: bigint;
-  // Field over which we'll do calculations. Verify with:
-  P: bigint;
-  // Curve order, total count of valid points in the field. Verify with:
-  n: bigint;
-  nBitLength?: number;
-  nByteLength?: number;
-  // Base point (x, y) aka generator point
-  Gx: bigint;
-  Gy: bigint;
-
   // Default options
   lowS?: boolean;
-
   // Hashes
   hash: CHash; // Because we need outputLen for DRBG
   hmac: HmacFnSync;
   randomBytes: (bytesLength?: number) => Uint8Array;
-
   truncateHash?: (hash: Uint8Array, truncateOnly?: boolean) => bigint;
   // Some fields can have specialized fast case
   sqrtMod?: (n: bigint) => bigint;
-
   // TODO: move into options?
   // Endomorphism options for Koblitz curves
   endo?: EndomorphismOpts;
 };
 
-// We accept hex strings besides Uint8Array for simplicity
-type Hex = Uint8Array | string;
-// Very few implementations accept numbers, we do it to ease learning curve
-type PrivKey = Hex | bigint | number;
-
 // Should be separate from overrides, since overrides can use information about curve (for example nBits)
 function validateOpts(curve: CurveType) {
-  if (typeof curve.hash !== 'function' || !Number.isSafeInteger(curve.hash.outputLen))
+  const opts = utilOpts(curve);
+  if (typeof opts.hash !== 'function' || !Number.isSafeInteger(opts.hash.outputLen))
     throw new Error('Invalid hash function');
-  if (typeof curve.hmac !== 'function') throw new Error('Invalid hmac function');
-  if (typeof curve.randomBytes !== 'function') throw new Error('Invalid randomBytes function');
+  if (typeof opts.hmac !== 'function') throw new Error('Invalid hmac function');
+  if (typeof opts.randomBytes !== 'function') throw new Error('Invalid randomBytes function');
 
-  for (const i of ['a', 'b', 'P', 'n', 'Gx', 'Gy'] as const) {
-    if (typeof curve[i] !== 'bigint')
-      throw new Error(`Invalid curve param ${i}=${curve[i]} (${typeof curve[i]})`);
+  for (const i of ['a', 'b'] as const) {
+    if (typeof opts[i] !== 'bigint')
+      throw new Error(`Invalid curve param ${i}=${opts[i]} (${typeof opts[i]})`);
   }
-  for (const i of ['nBitLength', 'nByteLength'] as const) {
-    if (curve[i] === undefined) continue; // Optional
-    if (!Number.isSafeInteger(curve[i]))
-      throw new Error(`Invalid curve param ${i}=${curve[i]} (${typeof curve[i]})`);
-  }
-  const endo = curve.endo;
+  const endo = opts.endo;
   if (endo) {
-    if (curve.a !== _0n) {
+    if (opts.a !== _0n) {
       throw new Error('Endomorphism can only be defined for Koblitz curves that have a=0');
     }
     if (
@@ -91,10 +81,8 @@ function validateOpts(curve: CurveType) {
       throw new Error('Expected endomorphism with beta: bigint and splitScalar: function');
     }
   }
-  const nBitLength = curve.n.toString(2).length; // Bit size of CURVE.n
-  const nByteLength = Math.ceil(nBitLength / 8); // Byte size of CURVE.n
   // Set defaults
-  return Object.freeze({ lowS: true, nBitLength, nByteLength, ...curve } as const);
+  return Object.freeze({ lowS: true, ...opts } as const);
 }
 
 // TODO: convert bits to bytes aligned to 32 bits? (224 for example)
@@ -125,7 +113,7 @@ function parseDERInt(data: Uint8Array) {
   if (res[0] === 0x00 && res[1] <= 0x7f) {
     throw new DERError('Invalid signature integer: trailing length');
   }
-  return { data: bytesToNumber(res), left: data.subarray(len + 2) };
+  return { data: bytesToNumberBE(res), left: data.subarray(len + 2) };
 }
 
 function parseDERSignature(data: Uint8Array) {
@@ -199,30 +187,23 @@ export type SignatureConstructor = {
 };
 
 // Instance
-export interface JacobianPointType {
+export interface JacobianPointType extends Group<JacobianPointType> {
   readonly x: bigint;
   readonly y: bigint;
   readonly z: bigint;
-  equals(other: JacobianPointType): boolean;
-  negate(): JacobianPointType;
-  double(): JacobianPointType;
-  add(other: JacobianPointType): JacobianPointType;
-  subtract(other: JacobianPointType): JacobianPointType;
-  multiplyUnsafe(scalar: bigint): JacobianPointType;
   multiply(scalar: number | bigint, affinePoint?: PointType): JacobianPointType;
+  multiplyUnsafe(scalar: bigint): JacobianPointType;
   toAffine(invZ?: bigint): PointType;
 }
 // Static methods
-export type JacobianPointConstructor = {
+export interface JacobianPointConstructor extends GroupConstructor<JacobianPointType> {
   new (x: bigint, y: bigint, z: bigint): JacobianPointType;
-  BASE: JacobianPointType;
-  ZERO: JacobianPointType;
   fromAffine(p: PointType): JacobianPointType;
   toAffineBatch(points: JacobianPointType[]): PointType[];
   normalizeZ(points: JacobianPointType[]): JacobianPointType[];
-};
+}
 // Instance
-export interface PointType {
+export interface PointType extends Group<PointType> {
   readonly x: bigint;
   readonly y: bigint;
   _setWindowSize(windowSize: number): void;
@@ -230,22 +211,14 @@ export interface PointType {
   toRawBytes(isCompressed?: boolean): Uint8Array;
   toHex(isCompressed?: boolean): string;
   assertValidity(): void;
-  equals(other: PointType): boolean;
-  negate(): PointType;
-  double(): PointType;
-  add(other: PointType): PointType;
-  subtract(other: PointType): PointType;
-  multiply(scalar: number | bigint): PointType;
   multiplyAndAddUnsafe(Q: PointType, a: bigint, b: bigint): PointType | undefined;
 }
 // Static methods
-export type PointConstructor = {
-  BASE: PointType;
-  ZERO: PointType;
+export interface PointConstructor extends GroupConstructor<PointType> {
   new (x: bigint, y: bigint): PointType;
   fromHex(hex: Hex): PointType;
   fromPrivateKey(privateKey: PrivKey): PointType;
-};
+}
 
 export type PubKey = Hex | PointType;
 
@@ -268,6 +241,13 @@ export type CurveFn = {
   utils: {
     mod: (a: bigint, b?: bigint) => bigint;
     invert: (number: bigint, modulo?: bigint) => bigint;
+    _bigintToBytes: (num: bigint) => Uint8Array;
+    _bigintToString: (num: bigint) => string;
+    _normalizePrivateKey: (key: PrivKey) => bigint;
+    _normalizePublicKey: (publicKey: PubKey) => PointType;
+    _isWithinCurveOrder: (num: bigint) => boolean;
+    _isValidFieldElement: (num: bigint) => boolean;
+    _weierstrassEquation: (x: bigint) => bigint;
     isValidPrivateKey(privateKey: PrivKey): boolean;
     hashToPrivateKey: (hash: Hex) => Uint8Array;
     randomPrivateKey: () => Uint8Array;
@@ -287,8 +267,8 @@ class HmacDrbg {
     if (typeof qByteLen !== 'number' || qByteLen < 2) throw new Error('qByteLen must be a number');
     if (typeof hmacFn !== 'function') throw new Error('hmacFn must be a function');
     // Step B, Step C: set hashLen to 8*ceil(hlen/8)
-    this.v = new Uint8Array(this.hashLen).fill(1);
-    this.k = new Uint8Array(this.hashLen).fill(0);
+    this.v = new Uint8Array(hashLen).fill(1);
+    this.k = new Uint8Array(hashLen).fill(0);
     this.counter = 0;
   }
   private hmacSync(...values: Uint8Array[]) {
@@ -327,8 +307,11 @@ class HmacDrbg {
 // Use only input from curveOpts!
 export function weierstrass(curveDef: CurveType): CurveFn {
   const CURVE = validateOpts(curveDef) as ReturnType<typeof validateOpts>;
+  const CURVE_ORDER = CURVE.n;
   // Lengths
-  const fieldLen = CURVE.nByteLength!; // 32 (length of one field element)
+  // All curves has same field / group length as for now, but it can be different for other curves
+  const groupLen = CURVE.nByteLength;
+  const fieldLen = CURVE.nByteLength; // 32 (length of one field element)
   if (fieldLen > 2048) throw new Error('Field lengths over 2048 are not supported');
 
   const compressedLen = fieldLen + 1; // 33
@@ -378,12 +361,12 @@ export function weierstrass(curveDef: CurveType): CurveFn {
     } else if (typeof key === 'number' && Number.isSafeInteger(key) && key > 0) {
       num = BigInt(key);
     } else if (typeof key === 'string') {
-      key = key.padStart(2 * fieldLen, '0'); // Eth-like hexes
-      if (key.length !== 2 * fieldLen) throw new Error(`Expected ${fieldLen} bytes of private key`);
+      key = key.padStart(2 * groupLen, '0'); // Eth-like hexes
+      if (key.length !== 2 * groupLen) throw new Error(`Expected ${groupLen} bytes of private key`);
       num = hexToNumber(key);
     } else if (key instanceof Uint8Array) {
-      if (key.length !== fieldLen) throw new Error(`Expected ${fieldLen} bytes of private key`);
-      num = bytesToNumber(key);
+      if (key.length !== groupLen) throw new Error(`Expected ${groupLen} bytes of private key`);
+      num = bytesToNumberBE(key);
     } else {
       throw new TypeError('Expected valid private key');
     }
@@ -405,12 +388,12 @@ export function weierstrass(curveDef: CurveType): CurveFn {
   }
 
   function isBiggerThanHalfOrder(number: bigint) {
-    const HALF = CURVE.n >> _1n;
+    const HALF = CURVE_ORDER >> _1n;
     return number > HALF;
   }
 
   function normalizeS(s: bigint) {
-    return isBiggerThanHalfOrder(s) ? mod.mod(-s, CURVE.n) : s;
+    return isBiggerThanHalfOrder(s) ? mod.mod(-s, CURVE_ORDER) : s;
   }
 
   function normalizeScalar(num: number | bigint): bigint {
@@ -426,7 +409,7 @@ export function weierstrass(curveDef: CurveType): CurveFn {
     const { n, nBitLength } = CURVE;
     const byteLength = hash.length;
     const delta = byteLength * 8 - nBitLength; // size of curve.n (252 bits)
-    let h = bytesToNumber(hash);
+    let h = bytesToNumberBE(hash);
     if (delta > 0) h = h >> BigInt(delta);
     if (!truncateOnly && h >= n) h -= n;
     return h;
@@ -499,6 +482,23 @@ export function weierstrass(curveDef: CurveType): CurveFn {
     double(): JacobianPoint {
       const { x: X1, y: Y1, z: Z1 } = this;
       const { a } = CURVE;
+
+      // Faster algorithm: when a=0
+      // From: https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-0.html#doubling-dbl-2009-l
+      // Cost: 2M + 5S + 6add + 3*2 + 1*3 + 1*8.
+      if (a === _0n) {
+        const A = modP(X1 * X1);
+        const B = modP(Y1 * Y1);
+        const C = modP(B * B);
+        const x1b = X1 + B;
+        const D = modP(_2n * (modP(x1b * x1b) - A - C));
+        const E = modP(_3n * A);
+        const F = modP(E * E);
+        const X3 = modP(F - _2n * D);
+        const Y3 = modP(E * (D - X3) - _8n * C);
+        const Z3 = modP(_2n * Y1 * Z1);
+        return new JacobianPoint(X3, Y3, Z3);
+      }
       const XX = modP(X1 * X1);
       const YY = modP(Y1 * Y1);
       const YYYY = modP(YY * YY);
@@ -520,8 +520,6 @@ export function weierstrass(curveDef: CurveType): CurveFn {
     // Note: 2007 Bernstein-Lange (11M + 5S + 9add + 4*2) is actually 10% slower.
     add(other: JacobianPoint): JacobianPoint {
       if (!(other instanceof JacobianPoint)) throw new TypeError('JacobianPoint expected');
-      // TODO: remove
-      if (this.equals(JacobianPoint.ZERO)) return other;
       const { x: X1, y: Y1, z: Z1 } = this;
       const { x: X2, y: Y2, z: Z2 } = other;
       if (X2 === _0n || Y2 === _0n) return this;
@@ -562,16 +560,7 @@ export function weierstrass(curveDef: CurveType): CurveFn {
       let n = normalizeScalar(scalar);
       if (n === _1n) return this;
 
-      if (!CURVE.endo) {
-        let p = P0;
-        let d: JacobianPoint = this;
-        while (n > _0n) {
-          if (n & _1n) p = p.add(d);
-          d = d.double();
-          n >>= _1n;
-        }
-        return p;
-      }
+      if (!CURVE.endo) return wnaf.unsafeLadder(this, n);
 
       // Apply endomorphism
       let { k1neg, k1, k2neg, k2 } = CURVE.endo.splitScalar(n);
@@ -591,106 +580,22 @@ export function weierstrass(curveDef: CurveType): CurveFn {
       return k1p.add(k2p);
     }
 
-    /**
-     * Creates a wNAF precomputation window. Used for caching.
-     * Default window size is set by `utils.precompute()` and is equal to 8.
-     * Which means we are caching 65536 points: 256 points for every bit from 0 to 256.
-     * @returns 65K precomputed points, depending on W
-     */
-    private precomputeWindow(W: number): JacobianPoint[] {
-      const windows = CURVE.endo
-        ? Math.ceil(CURVE.nBitLength / 2) / W + 1
-        : CURVE.nBitLength / W + 1;
-      const points: JacobianPoint[] = [];
-      let p: JacobianPoint = this;
-      let base = p;
-      for (let window = 0; window < windows; window++) {
-        base = p;
-        points.push(base);
-        for (let i = 1; i < 2 ** (W - 1); i++) {
-          base = base.add(p);
-          points.push(base);
-        }
-        p = base.double();
-      }
-      return points;
-    }
-
     /**
      * Implements w-ary non-adjacent form for calculating ec multiplication.
-     * @param n
-     * @param affinePoint optional 2d point to save cached precompute windows on it.
-     * @returns real and fake (for const-time) points
      */
     private wNAF(n: bigint, affinePoint?: Point): { p: JacobianPoint; f: JacobianPoint } {
       if (!affinePoint && this.equals(JacobianPoint.BASE)) affinePoint = Point.BASE;
       const W = (affinePoint && affinePoint._WINDOW_SIZE) || 1;
-      if (256 % W) {
-        throw new Error('Point#wNAF: Invalid precomputation window, must be power of 2');
-      }
-
       // Calculate precomputes on a first run, reuse them after
       let precomputes = affinePoint && pointPrecomputes.get(affinePoint);
       if (!precomputes) {
-        precomputes = this.precomputeWindow(W);
+        precomputes = wnaf.precomputeWindow(this, W) as JacobianPoint[];
         if (affinePoint && W !== 1) {
           precomputes = JacobianPoint.normalizeZ(precomputes);
           pointPrecomputes.set(affinePoint, precomputes);
         }
       }
-
-      // Initialize real and fake points for const-time
-      let p = JacobianPoint.ZERO;
-      // Should be G (base) point, since otherwise f can be infinity point in the end
-      let f = JacobianPoint.BASE;
-
-      const nBits = CURVE.endo ? CURVE.nBitLength / 2 : CURVE.nBitLength;
-      const windows = 1 + Math.ceil(nBits / W); // W=8 17
-      const windowSize = 2 ** (W - 1); // W=8 128
-      const mask = BigInt(2 ** W - 1); // Create mask with W ones: 0b11111111 for W=8
-      const maxNumber = 2 ** W; // W=8 256
-      const shiftBy = BigInt(W); // W=8 8
-
-      for (let window = 0; window < windows; window++) {
-        const offset = window * windowSize;
-        // Extract W bits.
-        let wbits = Number(n & mask);
-
-        // Shift number by W bits.
-        n >>= shiftBy;
-
-        // If the bits are bigger than max size, we'll split those.
-        // +224 => 256 - 32
-        if (wbits > windowSize) {
-          wbits -= maxNumber;
-          n += _1n;
-        }
-
-        // This code was first written with assumption that 'f' and 'p' will never be infinity point:
-        // since each addition is multiplied by 2 ** W, it cannot cancel each other. However,
-        // there is negate now: it is possible that negated element from low value
-        // would be the same as high element, which will create carry into next window.
-        // It's not obvious how this can fail, but still worth investigating later.
-
-        // Check if we're onto Zero point.
-        // Add random point inside current window to f.
-        const offset1 = offset;
-        const offset2 = offset + Math.abs(wbits) - 1;
-        const cond1 = window % 2 !== 0;
-        const cond2 = wbits < 0;
-        if (wbits === 0) {
-          // The most important part for const-time getPublicKey
-          f = f.add(constTimeNegate(cond1, precomputes[offset1]));
-        } else {
-          p = p.add(constTimeNegate(cond2, precomputes[offset2]));
-        }
-      }
-      // JIT-compiler should not eliminate f here, since it will later be used in normalizeZ()
-      // Even if the variable is still unused, there are some checks which will
-      // throw an exception, so compiler needs to prove they won't happen, which is hard.
-      // At this point there is a way to F be infinity-point even if p is not,
-      // which makes it less const-time: around 1 bigint multiply.
-      return { p, f };
+      return wnaf.wNAF(W, precomputes, n);
     }
 
     /**
@@ -712,8 +617,8 @@ export function weierstrass(curveDef: CurveType): CurveFn {
         const { k1neg, k1, k2neg, k2 } = CURVE.endo.splitScalar(n);
         let { p: k1p, f: f1p } = this.wNAF(k1, affinePoint);
         let { p: k2p, f: f2p } = this.wNAF(k2, affinePoint);
-        k1p = constTimeNegate(k1neg, k1p);
-        k2p = constTimeNegate(k2neg, k2p);
+        k1p = wnaf.constTimeNegate(k1neg, k1p);
+        k2p = wnaf.constTimeNegate(k2neg, k2p);
         k2p = new JacobianPoint(modP(k2p.x * CURVE.endo.beta), k2p.y, k2p.z);
         point = k1p.add(k2p);
         fake = f1p.add(f2p);
@@ -747,11 +652,7 @@ export function weierstrass(curveDef: CurveType): CurveFn {
       return new Point(ax, ay);
     }
   }
-  // Const-time utility for wNAF
-  function constTimeNegate(condition: boolean, item: JacobianPoint) {
-    const neg = item.negate();
-    return condition ? neg : item;
-  }
+  const wnaf = wNAF(JacobianPoint, CURVE.endo ? CURVE.nBitLength / 2 : CURVE.nBitLength);
   // Stores precomputed values for points.
   const pointPrecomputes = new WeakMap<Point, JacobianPoint[]>();
 
@@ -787,13 +688,12 @@ export function weierstrass(curveDef: CurveType): CurveFn {
     }
 
     /**
-     * Supports compressed ECDSA (33-byte) points
-     * @param bytes 33 bytes
+     * Supports compressed ECDSA points
      * @returns Point instance
      */
     private static fromCompressedHex(bytes: Uint8Array) {
       const P = CURVE.P;
-      const x = bytesToNumber(bytes.subarray(1));
+      const x = bytesToNumberBE(bytes.subarray(1));
       if (!isValidFieldElement(x)) throw new Error('Point is not on curve');
       const y2 = weierstrassEquation(x); // y² = x³ + ax + b
       let y = sqrtModCurve(y2, P); // y = y² ^ (p+1)/4
@@ -807,8 +707,8 @@ export function weierstrass(curveDef: CurveType): CurveFn {
     }
 
     private static fromUncompressedHex(bytes: Uint8Array) {
-      const x = bytesToNumber(bytes.subarray(1, fieldLen + 1));
-      const y = bytesToNumber(bytes.subarray(fieldLen + 1, 2 * fieldLen + 1));
+      const x = bytesToNumberBE(bytes.subarray(1, fieldLen + 1));
+      const y = bytesToNumberBE(bytes.subarray(fieldLen + 1, 2 * fieldLen + 1));
       const point = new Point(x, y);
       point.assertValidity();
       return point;
@@ -816,7 +716,7 @@ export function weierstrass(curveDef: CurveType): CurveFn {
 
     /**
      * Converts hash string or Uint8Array to Point.
-     * @param hex 33/65-byte (ECDSA) hex
+     * @param hex short/long ECDSA hex
      */
     static fromHex(hex: Hex): Point {
       const bytes = ensureBytes(hex);
@@ -852,7 +752,8 @@ export function weierstrass(curveDef: CurveType): CurveFn {
 
     // A point on curve is valid if it conforms to equation.
     assertValidity(): void {
-      const msg = 'Point is not on curve';
+      // Some 3rd-party test vectors require different wording between here & `fromCompressedHex`
+      const msg = 'Point is not on elliptic curve';
       const { x, y } = this;
       if (!isValidFieldElement(x) || !isValidFieldElement(y)) throw new Error(msg);
       const left = modP(y * y);
@@ -861,6 +762,7 @@ export function weierstrass(curveDef: CurveType): CurveFn {
     }
 
     equals(other: Point): boolean {
+      if (!(other instanceof Point)) throw new TypeError('Point#equals: expected Point');
       return this.x === other.x && this.y === other.y;
     }
 
@@ -986,7 +888,7 @@ export function weierstrass(curveDef: CurveType): CurveFn {
 
     normalizeS() {
       return this.hasHighS()
-        ? new Signature(this.r, mod.mod(-this.s, CURVE.n), this.recovery)
+        ? new Signature(this.r, mod.mod(-this.s, CURVE_ORDER), this.recovery)
         : this;
     }
 
@@ -1025,28 +927,22 @@ export function weierstrass(curveDef: CurveType): CurveFn {
       }
     },
     _bigintToBytes: numToField,
+    _bigintToString: numToFieldStr,
     _normalizePrivateKey: normalizePrivateKey,
+    _normalizePublicKey: normalizePublicKey,
+    _isWithinCurveOrder: isWithinCurveOrder,
+    _isValidFieldElement: isValidFieldElement,
+    _weierstrassEquation: weierstrassEquation,
 
     /**
-     * Can take (keyLength + 8) or more bytes of uniform input e.g. from CSPRNG or KDF
-     * and convert them into private key, with the modulo bias being neglible.
-     * As per FIPS 186 B.4.1.
-     * https://research.kudelskisecurity.com/2020/07/28/the-definitive-guide-to-modulo-bias-and-how-to-avoid-it/
-     * @param hash hash output from sha512, or a similar function
-     * @returns valid private key
+     * Converts some bytes to a valid private key. Needs at least (nBitLength+64) bytes.
      */
-    hashToPrivateKey: (hash: Hex): Uint8Array => {
-      hash = ensureBytes(hash);
-      const minLen = fieldLen + 8;
-      if (hash.length < minLen || hash.length > 1024) {
-        throw new Error(`Expected ${minLen}-1024 bytes of private key as per FIPS 186`);
-      }
-      const num = mod.mod(bytesToNumber(hash), CURVE.n - _1n) + _1n;
-      return numToField(num);
-    },
+    hashToPrivateKey: (hash: Hex): Uint8Array => numToField(hashToPrivateScalar(hash, CURVE_ORDER)),
 
-    // Takes curve order + 64 bits from CSPRNG
-    // so that modulo bias is neglible, matches FIPS 186 B.4.1.
+    /**
+     * Produces cryptographically secure private key from random of size (nBitLength+64)
+     * as per FIPS 186 B.4.1 with modulo bias being neglible.
+     */
     randomPrivateKey: (): Uint8Array => utils.hashToPrivateKey(CURVE.randomBytes(fieldLen + 8)),
 
     /**
@@ -1067,8 +963,8 @@ export function weierstrass(curveDef: CurveType): CurveFn {
 
   /**
    * Computes public key for a private key.
-   * @param privateKey 32-byte private key
-   * @param isCompressed whether to return compact (33-byte), or full (65-byte) key
+   * @param privateKey private key
+   * @param isCompressed whether to return compact, or full key
    * @returns Public key, full by default; short when isCompressed=true
    */
   function getPublicKey(privateKey: PrivKey, isCompressed = false): Uint8Array {
@@ -1108,11 +1004,11 @@ export function weierstrass(curveDef: CurveType): CurveFn {
   // RFC6979 methods
   function bits2int(bytes: Uint8Array) {
     const slice = bytes.length > fieldLen ? bytes.slice(0, fieldLen) : bytes;
-    return bytesToNumber(slice);
+    return bytesToNumberBE(slice);
   }
   function bits2octets(bytes: Uint8Array): Uint8Array {
     const z1 = bits2int(bytes);
-    const z2 = mod.mod(z1, CURVE.n);
+    const z2 = mod.mod(z1, CURVE_ORDER);
     return int2octets(z2 < _0n ? z1 : z2);
   }
   function int2octets(num: bigint): Uint8Array {
@@ -1253,7 +1149,6 @@ export function weierstrass(curveDef: CurveType): CurveFn {
     getSharedSecret,
     sign,
     verify,
-
     Point,
     JacobianPoint,
     Signature,