1import { randomBytes } from 'crypto'
  2import * as BigNumber from 'bn.js'
  3import { ec, curve } from 'elliptic'
  4import { keccak256 } from "@ethersproject/keccak256"
  5
  6export type Point = curve.base.BasePoint
  7export { BigNumber }
  8
  9const secp256k1 = new ec("secp256k1")
 10const G: Point = secp256k1.g
 11const n = secp256k1.n // as BigNumber
 12
 13export const ecParams = { G, n }
 14
 15export type UserSecretData = { a: BigNumber, b: BigNumber, f: Point }
 16export type UnblindedSignature = { s: BigNumber, f: Point }
 17
 18export function messageToBigNumber(message: string) {
 19    const msg = Buffer.from(message, 'utf8')
 20    return new BigNumber(msg)
 21}
 22
 23export function hashBigNumber(m: BigNumber) {
 24    const mHex = m.toString(16)
 25
 26    if (mHex.length % 2 == 0)
 27        return keccak256('0x' + mHex).slice(2) // Trim 0x
 28    else
 29        return keccak256('0x0' + mHex).slice(2) // Trim 0x
 30}
 31
 32export function stringToBigNumber(s: string) {
 33    return new BigNumber(s)
 34}
 35
 36export function decodePoint(hexPoint: string): Point {
 37    return secp256k1.keyFromPublic(Buffer.from(hexPoint, "hex")).getPublic()
 38}
 39
 40export function newKeyPair() {
 41    const sk = random(32)
 42    return { sk: sk, pk: G.mul(sk) }
 43}
 44
 45export function newRequestParameters() {
 46    const k = random(32)
 47    return { k: k, signerR: G.mul(k) }
 48}
 49
 50/**
 51 * Blinds the message for the signer R.
 52 * @param m The message to blind
 53 * @param signerR
 54 * @returns The blinded signature and the user secret data
 55 */
 56export function blind(m: BigNumber, signerR: Point): { mBlinded: BigNumber, userSecretData: UserSecretData } {
 57    const u: UserSecretData = { a: new BigNumber(0), b: new BigNumber(0), f: G }
 58    u.a = random(32)
 59    u.b = random(32)
 60
 61    const aR = signerR.mul(u.a)
 62    const bG = G.mul(u.b)
 63    u.f = aR.add(bG)
 64
 65    const rx = u.f.getX().mod(n)
 66
 67    const ainv = u.a.invm(n)
 68    const ainvrx = ainv.mul(rx)
 69
 70    const hHex = hashBigNumber(m)
 71
 72    const h = new BigNumber(Buffer.from(hHex, "hex"))
 73    const mBlinded = ainvrx.mul(h)
 74
 75    return { mBlinded: mBlinded.mod(n), userSecretData: u }
 76}
 77
 78/** Performs a signature on a blinded message */
 79export function blindSign(sk: BigNumber, mBlinded: BigNumber, k: BigNumber): BigNumber {
 80    let sBlind = sk.mul(mBlinded)
 81    sBlind = sBlind.add(k)
 82    return sBlind.mod(n)
 83}
 84
 85/**
 86 * Unblinds the blinded signature.
 87 * @param blinded signature
 88 * @param userSecretData
 89 * @returns unblinded signature
 90 */
 91export function unblind(sBlind: BigNumber, userSecretData: UserSecretData): UnblindedSignature {
 92    const s = userSecretData.a.mul(sBlind).add(userSecretData.b)
 93    return { s: s.mod(n), f: userSecretData.f }
 94}
 95
 96export function verify(m: BigNumber, s: UnblindedSignature, q: Point) {
 97    const sG = G.mul(s.s)
 98
 99    const hHex = hashBigNumber(m)
100
101    const h = new BigNumber(Buffer.from(hHex, "hex"))
102
103    const rx = s.f.getX().mod(n)
104    const right = s.f.add(
105        q.mul(
106            rx.mul(h)
107        )
108    )
109
110    if ((sG.getX().toString() == right.getX().toString())
111        && (sG.getY().toString() == right.getY().toString())) {
112        return true
113    }
114    return false
115}
116
117export function signatureToHex(signature: UnblindedSignature): string {
118    if (!signature || !signature.f || !signature.s) throw new Error("The signature is empty")
119    const { f, s } = signature
120
121    // hex(swapEndiannes(s) ) + hex(f)
122    const hexPaddedS = zeroPad(s.toBuffer().toString("hex"), 32)
123    const flippedHexS = Buffer.from(hexPaddedS, "hex").reverse().toString("hex")
124
125    return zeroPad(flippedHexS, 32) + zeroPad(f.encode("hex", false).substr(2), 64)  // strip 04
126}
127
128export function signatureFromHex(hexSignature: string): UnblindedSignature {
129    if (!hexSignature || hexSignature.length != 192) throw new Error("Invalid hex signature (96 bytes expected)")
130
131    const s = new BigNumber(Buffer.from(hexSignature.substr(0, 64), "hex").reverse())
132    const f = decodePoint("04" + hexSignature.substr(64))
133    return { s, f }
134}
135
136// HELPERS
137
138function random(bytes: number) {
139    let k: BigNumber
140    do {
141        k = new BigNumber(randomBytes(bytes))
142    } while (k.toString() == "0" && k.gcd(n).toString() != "1")
143    return k
144}
145
146function zeroPad(hexString: string, byteLength: number) {
147    if (hexString.length > (byteLength * 2)) throw new Error("Out of bounds")
148    while (hexString.length < (byteLength * 2)) {
149        hexString = "0" + hexString
150    }
151    return hexString
152}