1const bigInt = require("big-integer");
  2const ZqField = require("fflib").ZqField;
  3const utils = require("./utils.js");
  4
  5exports.addPoint = addPoint;
  6exports.mulPointEscalar = mulPointEscalar;
  7exports.inCurve = inCurve;
  8exports.inSubgroup = inSubgroup;
  9exports.packPoint = packPoint;
 10exports.unpackPoint = unpackPoint;
 11exports.Generator = [
 12    bigInt("995203441582195749578291179787384436505546430278305826713579947235728471134"),
 13    bigInt("5472060717959818805561601436314318772137091100104008585924551046643952123905")
 14];
 15exports.Base8 = [
 16    bigInt("5299619240641551281634865583518297030282874472190772894086521144482721001553"),
 17    bigInt("16950150798460657717958625567821834550301663161624707787222815936182638968203")
 18];
 19exports.order = bigInt("21888242871839275222246405745257275088614511777268538073601725287587578984328");
 20exports.subOrder = exports.order.shiftRight(3);
 21exports.p = bigInt("21888242871839275222246405745257275088548364400416034343698204186575808495617");
 22exports.A = bigInt("168700");
 23exports.D = bigInt("168696");
 24
 25
 26function addPoint(a,b) {
 27    const F = new ZqField(exports.p);
 28
 29    const res = [];
 30
 31    /* does the equivalent of:
 32     res[0] = bigInt((a[0]*b[1] + b[0]*a[1]) *  bigInt(bigInt("1") + d*a[0]*b[0]*a[1]*b[1]).inverse(q)).affine(q);
 33    res[1] = bigInt((a[1]*b[1] - cta*a[0]*b[0]) * bigInt(bigInt("1") - d*a[0]*b[0]*a[1]*b[1]).inverse(q)).affine(q);
 34    */
 35
 36    const beta = F.mul(a[0],b[1]);
 37    const gamma = F.mul(a[1],b[0]);
 38    const delta = F.mul(
 39        F.sub(a[1], F.mul(exports.A, a[0])),
 40        F.add(b[0], b[1])
 41    );
 42    const tau = F.mul(beta, gamma);
 43    const dtau = F.mul(exports.D, tau);
 44
 45    res[0] = F.div(
 46        F.add(beta, gamma),
 47        F.add(bigInt.one, dtau)
 48    );
 49
 50    res[1] = F.div(
 51        F.add(delta, F.sub(F.mul(exports.A,beta), gamma)),
 52        F.sub(bigInt.one, dtau)
 53    );
 54
 55    return res;
 56}
 57
 58function mulPointEscalar(base, e) {
 59    let res = [bigInt("0"),bigInt("1")];
 60    let rem = bigInt(e);
 61    let exp = base;
 62
 63    while (! rem.isZero()) {
 64        if (rem.isOdd()) {
 65            res = addPoint(res, exp);
 66        }
 67        exp = addPoint(exp, exp);
 68        rem = rem.shiftRight(1);
 69    }
 70
 71    return res;
 72}
 73
 74function inSubgroup(P) {
 75    if (!inCurve(P)) return false;
 76    const res= mulPointEscalar(P, exports.subOrder);
 77    return (res[0].equals(bigInt(0))) && (res[1].equals(bigInt(1)));
 78}
 79
 80function inCurve(P) {
 81    const F = new ZqField(exports.p);
 82
 83    const x2 = F.square(P[0]);
 84    const y2 = F.square(P[1]);
 85
 86    if (!F.eq(
 87        F.add(F.mul(exports.A, x2), y2),
 88        F.add(F.one, F.mul(F.mul(x2, y2), exports.D)))) return false;
 89
 90    return true;
 91}
 92
 93function packPoint(P) {
 94    const buff = utils.leInt2Buff(P[1], 32);
 95    if (P[0].greater(exports.p.shiftRight(1))) {
 96        buff[31] = buff[31] | 0x80;
 97    }
 98    return buff;
 99}
100
101function unpackPoint(_buff) {
102    const F = new ZqField(exports.p);
103
104    const buff = Buffer.from(_buff);
105    let sign = false;
106    const P = new Array(2);
107    if (buff[31] & 0x80) {
108        sign = true;
109        buff[31] = buff[31] & 0x7F;
110    }
111    P[1] = utils.leBuff2int(buff);
112    if (P[1].greaterOrEquals(exports.p)) return null;
113
114    const y2 = F.square(P[1]);
115
116    let x = F.sqrt(F.div(
117        F.sub(F.one, y2),
118        F.sub(exports.A, F.mul(exports.D, y2))));
119
120    if (x == null) return null;
121
122    if (sign) x = F.neg(x);
123
124    P[0] = x;
125
126    return P;
127}