1const F1Field = require("ffjavascript").F1Field;
  2const Scalar = require("ffjavascript").Scalar;
  3const utils = require("ffjavascript").utils;
  4
  5exports.addPoint = addPoint;
  6exports.mulPointEscalar = mulPointEscalar;
  7exports.inCurve = inCurve;
  8exports.inSubgroup = inSubgroup;
  9exports.packPoint = packPoint;
 10exports.unpackPoint = unpackPoint;
 11
 12
 13exports.p = Scalar.fromString("21888242871839275222246405745257275088548364400416034343698204186575808495617");
 14const F = new F1Field(exports.p);
 15exports.F = F;
 16
 17exports.Generator = [
 18    F.e("995203441582195749578291179787384436505546430278305826713579947235728471134"),
 19    F.e("5472060717959818805561601436314318772137091100104008585924551046643952123905")
 20];
 21exports.Base8 = [
 22    F.e("5299619240641551281634865583518297030282874472190772894086521144482721001553"),
 23    F.e("16950150798460657717958625567821834550301663161624707787222815936182638968203")
 24];
 25exports.order = Scalar.fromString("21888242871839275222246405745257275088614511777268538073601725287587578984328");
 26exports.subOrder = Scalar.shiftRight(exports.order, 3);
 27exports.A = F.e("168700");
 28exports.D = F.e("168696");
 29
 30
 31function addPoint(a,b) {
 32
 33    const res = [];
 34
 35    /* does the equivalent of:
 36     res[0] = bigInt((a[0]*b[1] + b[0]*a[1]) *  bigInt(bigInt("1") + d*a[0]*b[0]*a[1]*b[1]).inverse(q)).affine(q);
 37    res[1] = bigInt((a[1]*b[1] - cta*a[0]*b[0]) * bigInt(bigInt("1") - d*a[0]*b[0]*a[1]*b[1]).inverse(q)).affine(q);
 38    */
 39
 40    const beta = F.mul(a[0],b[1]);
 41    const gamma = F.mul(a[1],b[0]);
 42    const delta = F.mul(
 43        F.sub(a[1], F.mul(exports.A, a[0])),
 44        F.add(b[0], b[1])
 45    );
 46    const tau = F.mul(beta, gamma);
 47    const dtau = F.mul(exports.D, tau);
 48
 49    res[0] = F.div(
 50        F.add(beta, gamma),
 51        F.add(F.one, dtau)
 52    );
 53
 54    res[1] = F.div(
 55        F.add(delta, F.sub(F.mul(exports.A,beta), gamma)),
 56        F.sub(F.one, dtau)
 57    );
 58
 59    return res;
 60}
 61
 62function mulPointEscalar(base, e) {
 63    let res = [F.e("0"),F.e("1")];
 64    let rem = e;
 65    let exp = base;
 66
 67    while (! Scalar.isZero(rem)) {
 68        if (Scalar.isOdd(rem)) {
 69            res = addPoint(res, exp);
 70        }
 71        exp = addPoint(exp, exp);
 72        rem = Scalar.shiftRight(rem, 1);
 73    }
 74
 75    return res;
 76}
 77
 78function inSubgroup(P) {
 79    if (!inCurve(P)) return false;
 80    const res= mulPointEscalar(P, exports.subOrder);
 81    return (F.isZero(res[0]) && F.eq(res[1], F.one));
 82}
 83
 84function inCurve(P) {
 85
 86    const x2 = F.square(P[0]);
 87    const y2 = F.square(P[1]);
 88
 89    if (!F.eq(
 90        F.add(F.mul(exports.A, x2), y2),
 91        F.add(F.one, F.mul(F.mul(x2, y2), exports.D)))) return false;
 92
 93    return true;
 94}
 95
 96function packPoint(P) {
 97    const buff = utils.leInt2Buff(P[1], 32);
 98    if (F.lt(P[0], F.zero)) {
 99        buff[31] = buff[31] | 0x80;
100    }
101    return buff;
102}
103
104function unpackPoint(_buff) {
105    const buff = Buffer.from(_buff);
106    let sign = false;
107    const P = new Array(2);
108    if (buff[31] & 0x80) {
109        sign = true;
110        buff[31] = buff[31] & 0x7F;
111    }
112    P[1] = utils.leBuff2int(buff);
113    if (Scalar.gt(P[1], exports.p)) return null;
114
115    const y2 = F.square(P[1]);
116
117    let x = F.sqrt(F.div(
118        F.sub(F.one, y2),
119        F.sub(exports.A, F.mul(exports.D, y2))));
120
121    if (x == null) return null;
122
123    if (sign) x = F.neg(x);
124
125    P[0] = x;
126
127    return P;
128}