stark: switch to new weierstrass methods

src/stark.ts

@@ -16,6 +16,15 @@ const CURVE_N = BigInt(
   '3618502788666131213697322783095070105526743751716087489154079457884512865583'
 );
 const nBitLength = 252;
+// Copy-pasted from weierstrass.ts
+function bits2int(bytes: Uint8Array): bigint {
+  const delta = bytes.length * 8 - nBitLength;
+  const num = cutils.bytesToNumberBE(bytes);
+  return delta > 0 ? num >> BigInt(delta) : num;
+}
+function bits2int_modN(bytes: Uint8Array): bigint {
+  return mod(bits2int(bytes), CURVE_N);
+}
 export const starkCurve = weierstrass({
   // Params: a, b
   a: BigInt(1),
@@ -33,24 +42,20 @@ export const starkCurve = weierstrass({
   // Default options
   lowS: false,
   ...getHash(sha256),
-  truncateHash: (hash: Uint8Array, truncateOnly = false): Uint8Array => {
+  // Custom truncation routines for stark curve
-    // Fix truncation
+  bits2int: (bytes: Uint8Array): bigint => {
-    if (!truncateOnly) {
+    while (bytes[0] === 0) bytes = bytes.subarray(1);
-      let hashS = bytesToNumber0x(hash).toString(16);
+    return bits2int(bytes);
+  },
+  bits2int_modN: (bytes: Uint8Array): bigint => {
+    let hashS = cutils.bytesToNumberBE(bytes).toString(16);
     if (hashS.length === 63) {
       hashS += '0';
-        hash = hexToBytes0x(hashS);
+      bytes = hexToBytes0x(hashS);
-      }
     }
     // Truncate zero bytes on left (compat with elliptic)
-    while (hash[0] === 0) hash = hash.subarray(1);
+    while (bytes[0] === 0) bytes = bytes.subarray(1);
-    // bits2int + part of bits2octets (mod if !truncateOnly)
+    return bits2int_modN(bytes);
-    const byteLength = hash.length;
-    const delta = byteLength * 8 - nBitLength; // size of curve.n (252 bits)
-    let h = hash.length ? bytesToNumber0x(hash) : 0n;
-    if (delta > 0) h = h >> BigInt(delta); // truncate to nBitLength leftmost bits
-    if (!truncateOnly) h = mod(h, CURVE_N);
-    return cutils.numberToVarBytesBE(h);
   },
 });
 
@@ -134,7 +139,7 @@ type Hex = Uint8Array | string;
 function hashKeyWithIndex(key: Uint8Array, index: number) {
   let indexHex = cutils.numberToHexUnpadded(index);
   if (indexHex.length & 1) indexHex = '0' + indexHex;
-  return bytesToNumber0x(sha256(cutils.concatBytes(key, hexToBytes0x(indexHex))));
+  return sha256Num(cutils.concatBytes(key, hexToBytes0x(indexHex)));
 }
 
 export function grindKey(seed: Hex) {
@@ -167,8 +172,8 @@ export function getAccountPath(
   ethereumAddress: string,
   index: number
 ) {
-  const layerNum = int31(bytesToNumber0x(sha256(layer)));
+  const layerNum = int31(sha256Num(layer));
-  const applicationNum = int31(bytesToNumber0x(sha256(application)));
+  const applicationNum = int31(sha256Num(application));
   const eth = hexToNumber0x(ethereumAddress);
   return `m/2645'/${layerNum}'/${applicationNum}'/${int31(eth)}'/${int31(eth >> 31n)}'/${index}`;
 }
@@ -264,7 +269,8 @@ export const computeHashOnElements = (data: PedersenArg[], fn = pedersen) =>
   [0, ...data, data.length].reduce((x, y) => fn(x, y));
 
 const MASK_250 = cutils.bitMask(250);
-export const keccak = (data: Uint8Array) => bytesToNumber0x(keccak_256(data)) & MASK_250;
+export const keccak = (data: Uint8Array): bigint => bytesToNumber0x(keccak_256(data)) & MASK_250;
+const sha256Num = (data: Uint8Array | string): bigint => cutils.bytesToNumberBE(sha256(data));
 
 // Poseidon hash
 export const Fp253 = Fp(

test/stark/stark.test.js

@@ -1,5 +1,5 @@
 import { deepStrictEqual, throws } from 'assert';
-import { should } from 'micro-should';
+import { describe, should } from 'micro-should';
 import { hex, utf8 } from '@scure/base';
 import * as bip32 from '@scure/bip32';
 import * as bip39 from '@scure/bip39';
@@ -7,22 +7,23 @@ import * as starknet from '../../lib/esm/stark.js';
 import { default as sigVec } from './fixtures/rfc6979_signature_test_vector.json' assert { type: 'json' };
 import { default as precomputedKeys } from './fixtures/keys_precomputed.json' assert { type: 'json' };
 
-should('Starknet keccak', () => {
+describe('starknet', () => {
+  should('custom keccak', () => {
     const value = starknet.keccak(utf8.decode('hello'));
     deepStrictEqual(value, 0x8aff950685c2ed4bc3174f3472287b56d9517b9c948127319a09a7a36deac8n);
     deepStrictEqual(value < 2n ** 250n, true);
-});
+  });
 
-should('RFC6979', () => {
+  should('RFC6979', () => {
     for (const msg of sigVec.messages) {
       const { r, s } = starknet.sign(msg.hash, sigVec.private_key);
       // const { r, s } = starknet.Signature.fromDER(sig);
       deepStrictEqual(r.toString(10), msg.r);
       deepStrictEqual(s.toString(10), msg.s);
     }
-});
+  });
 
-should('Signatures', () => {
+  should('Signatures', () => {
     const vectors = [
       {
         // Message hash of length 61.
@@ -59,9 +60,9 @@ should('Signatures', () => {
       deepStrictEqual(s.toString(16), v.s, 's equality');
       deepStrictEqual(starknet.verify(sig, v.msg, publicKey), true, 'verify');
     }
-});
+  });
 
-should('Invalid signatures', () => {
+  should('Invalid signatures', () => {
     /*
 
     it('should not verify invalid signature inputs lengths', () => {
@@ -155,11 +156,11 @@ should('Invalid signatures', () => {
         starkwareCrypto.verify(keyPairPub, msgHash.toString(16), msgSignature)
       ).to.be.false;
     });
-});
+  });
     */
-});
+  });
 
-should('Pedersen', () => {
+  should('Pedersen', () => {
     deepStrictEqual(
       starknet.pedersen(
         '0x3d937c035c878245caf64531a5756109c53068da139362728feb561405371cb',
@@ -174,13 +175,13 @@ should('Pedersen', () => {
       ),
       '0x68cc0b76cddd1dd4ed2301ada9b7c872b23875d5ff837b3a87993e0d9996b87'
     );
-});
+  });
 
-should('Hash chain', () => {
+  should('Hash chain', () => {
     deepStrictEqual(starknet.hashChain([1, 2, 3]), starknet.pedersen(1, starknet.pedersen(2, 3)));
-});
+  });
 
-should('Key grinding', () => {
+  should('Key grinding', () => {
     deepStrictEqual(
       starknet.grindKey('86F3E7293141F20A8BAFF320E8EE4ACCB9D4A4BF2B4D295E8CEE784DB46E0519'),
       '5c8c8683596c732541a59e03007b2d30dbbbb873556fe65b5fb63c16688f941'
@@ -190,9 +191,9 @@ should('Key grinding', () => {
       starknet.grindKey('94F3E7293141F20A8BAFF320E8EE4ACCB9D4A4BF2B4D295E8CEE784DB46E0595'),
       '33880b9aba464c1c01c9f8f5b4fc1134698f9b0a8d18505cab6cdd34d93dc02'
     );
-});
+  });
 
-should('Private to stark key', () => {
+  should('Private to stark key', () => {
     deepStrictEqual(
       starknet.getStarkKey('0x178047D3869489C055D7EA54C014FFB834A069C9595186ABE04EA4D1223A03F'),
       '0x1895a6a77ae14e7987b9cb51329a5adfb17bd8e7c638f92d6892d76e51cebcf'
@@ -200,9 +201,9 @@ should('Private to stark key', () => {
     for (const [privKey, expectedPubKey] of Object.entries(precomputedKeys)) {
       deepStrictEqual(starknet.getStarkKey(privKey), expectedPubKey);
     }
-});
+  });
 
-should('Private stark key from eth signature', () => {
+  should('Private stark key from eth signature', () => {
     const ethSignature =
       '0x21fbf0696d5e0aa2ef41a2b4ffb623bcaf070461d61cf7251c74161f82fec3a43' +
       '70854bc0a34b3ab487c1bc021cd318c734c51ae29374f2beb0e6f2dd49b4bf41c';
@@ -210,9 +211,9 @@ should('Private stark key from eth signature', () => {
       starknet.ethSigToPrivate(ethSignature),
       '766f11e90cd7c7b43085b56da35c781f8c067ac0d578eabdceebc4886435bda'
     );
-});
+  });
 
-should('Key derivation', () => {
+  should('Key derivation', () => {
     const layer = 'starkex';
     const application = 'starkdeployement';
     const mnemonic =
@@ -242,10 +243,10 @@ should('Key derivation', () => {
       deepStrictEqual(realPath, path);
       deepStrictEqual(starknet.grindKey(hd.derive(realPath).privateKey), privateKey);
     }
-});
+  });
 
-// Verified against starknet.js
+  // Verified against starknet.js
-should('Starknet.js cross-tests', () => {
+  should('Starknet.js cross-tests', () => {
     const privateKey = '0x019800ea6a9a73f94aee6a3d2edf018fc770443e90c7ba121e8303ec6b349279';
     // NOTE: there is no compressed keys here, getPubKey returns stark-key (which is schnorr-like X coordinate)
     // But it is not used in signing/verifying
@@ -277,6 +278,7 @@ should('Starknet.js cross-tests', () => {
       2440689354481625417078677634625227600823892606910345662891037256374285369343n
     );
     deepStrictEqual(starknet.verify(sig2.toDERHex(), hashMsg2, pubKey), true);
+  });
 });
 
 // ESM is broken.