feature/1121 implement ucan validation (#1176)

- **refactor: remove unused auth components**
- **refactor: improve devbox configuration and deployment process**
- **refactor: improve devnet and testnet setup**
- **fix: update templ version to v0.2.778**
- **refactor: rename pkl/net.matrix to pkl/matrix.net**
- **refactor: migrate webapp components to nebula**
- **refactor: protobuf types**
- **chore: update dependencies for improved security and stability**
- **feat: implement landing page and vault gateway servers**
- **refactor: Migrate data models to new module structure and update
related files**
- **feature/1121-implement-ucan-validation**
- **refactor: Replace hardcoded constants with model types in attns.go**
- **feature/1121-implement-ucan-validation**
- **chore: add origin Host struct and update main function to handle
multiple hosts**
- **build: remove unused static files from dwn module**
- **build: remove unused static files from dwn module**
- **refactor: Move DWN models to common package**
- **refactor: move models to pkg/common**
- **refactor: move vault web app assets to embed module**
- **refactor: update session middleware import path**
- **chore: configure port labels and auto-forwarding behavior**
- **feat: enhance devcontainer configuration**
- **feat: Add UCAN middleware for Echo with flexible token validation**
- **feat: add JWT middleware for UCAN authentication**
- **refactor: update package URI and versioning in PklProject files**
- **fix: correct sonr.pkl import path**
- **refactor: move JWT related code to auth package**
- **feat: introduce vault configuration retrieval and management**
- **refactor: Move vault components to gateway module and update file
paths**
- **refactor: remove Dexie and SQLite database implementations**
- **feat: enhance frontend with PWA features and WASM integration**
- **feat: add Devbox features and streamline Dockerfile**
- **chore: update dependencies to include TigerBeetle**
- **chore(deps): update go version to 1.23**
- **feat: enhance devnet setup with PATH environment variable and
updated PWA manifest**
- **fix: upgrade tigerbeetle-go dependency and remove indirect
dependency**
- **feat: add PostgreSQL support to devnet and testnet deployments**
- **refactor: rename keyshare cookie to token cookie**
- **feat: upgrade Go version to 1.23.3 and update dependencies**
- **refactor: update devnet and testnet configurations**
- **feat: add IPFS configuration for devnet**
- **I'll help you update the ipfs.config.pkl to include all the peers
from the shell script. Here's the updated configuration:**
- **refactor: move mpc package to crypto directory**
- **feat: add BIP32 support for various cryptocurrencies**
- **feat: enhance ATN.pkl with additional capabilities**
- **refactor: simplify smart account and vault attenuation creation**
- **feat: add new capabilities to the Attenuation type**
- **refactor: Rename MPC files for clarity and consistency**
- **feat: add DIDKey support for cryptographic operations**
- **feat: add devnet and testnet deployment configurations**
- **fix: correct key derivation in bip32 package**
- **refactor: rename crypto/bip32 package to crypto/accaddr**
- **fix: remove duplicate indirect dependency**
- **refactor: move vault package to root directory**
- **refactor: update routes for gateway and vault**
- **refactor: remove obsolete web configuration file**
- **refactor: remove unused TigerBeetle imports and update host
configuration**
- **refactor: adjust styles directory path**
- **feat: add broadcastTx and simulateTx functions to gateway**
- **feat: add PinVault handler**

pkg/common/auth/config.go

@@ -0,0 +1,36 @@
+package auth
+
+import (
+	"github.com/labstack/echo/v4"
+	"github.com/onsonr/sonr/crypto/mpc"
+)
+
+// UCANConfig defines the configuration for UCAN middleware
+type UCANConfig struct {
+	// Skipper defines a function to skip middleware
+	Skipper func(c echo.Context) bool
+
+	// KeySource provides the source for validating UCANs
+	KeySource mpc.KeyshareSource
+
+	// TokenLookup is a string in the form of "<source>:<name>" that is used
+	// to extract token from the request.
+	// Optional. Default value "header:Authorization".
+	// Possible values:
+	// - "header:<name>"
+	// - "query:<name>"
+	// - "param:<name>"
+	// - "cookie:<name>"
+	TokenLookup string
+
+	// AuthScheme to be used in the Authorization header.
+	// Optional. Default value "Bearer".
+	AuthScheme string
+}
+
+// DefaultUCANConfig is the default UCAN middleware config
+var DefaultUCANConfig = UCANConfig{
+	Skipper:     nil,
+	TokenLookup: "header:Authorization",
+	AuthScheme:  "Bearer",
+}

pkg/common/auth/middleware.go

@@ -0,0 +1,119 @@
+package auth
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/labstack/echo/v4"
+	"github.com/onsonr/sonr/crypto/mpc"
+)
+
+// UCAN returns middleware to validate UCAN tokens
+func UCAN(source mpc.KeyshareSource, opts ...Option) echo.MiddlewareFunc {
+	c := DefaultUCANConfig
+	for _, opt := range opts {
+		opt(&c)
+	}
+	c.KeySource = source
+	return UCANWithConfig(c)
+}
+
+// UCANWithConfig returns UCAN middleware with custom config
+func UCANWithConfig(config UCANConfig) echo.MiddlewareFunc {
+	// Defaults
+	if config.Skipper == nil {
+		config.Skipper = DefaultUCANConfig.Skipper
+	}
+	if config.TokenLookup == "" {
+		config.TokenLookup = DefaultUCANConfig.TokenLookup
+	}
+	if config.AuthScheme == "" {
+		config.AuthScheme = DefaultUCANConfig.AuthScheme
+	}
+
+	// Initialize
+	parts := strings.Split(config.TokenLookup, ":")
+	extractor := tokenFromHeader(parts[1], config.AuthScheme)
+	switch parts[0] {
+	case "query":
+		extractor = tokenFromQuery(parts[1])
+	case "param":
+		extractor = tokenFromParam(parts[1])
+	case "cookie":
+		extractor = tokenFromCookie(parts[1])
+	}
+
+	return func(next echo.HandlerFunc) echo.HandlerFunc {
+		return func(c echo.Context) error {
+			if config.Skipper != nil && config.Skipper(c) {
+				return next(c)
+			}
+
+			auth, err := extractor(c)
+			if err != nil {
+				return echo.NewHTTPError(401, err.Error())
+			}
+
+			parser := config.KeySource.UCANParser()
+			token, err := parser.ParseAndVerify(c.Request().Context(), auth)
+			if err != nil {
+				return echo.NewHTTPError(401, "invalid UCAN token")
+			}
+
+			// Store token in context
+			c.Set("ucan", token)
+			return next(c)
+		}
+	}
+}
+
+// tokenFromHeader extracts token from header
+func tokenFromHeader(header string, authScheme string) func(echo.Context) (string, error) {
+	return func(c echo.Context) (string, error) {
+		auth := c.Request().Header.Get(header)
+		if auth == "" {
+			return "", fmt.Errorf("missing auth token")
+		}
+		if authScheme == "" {
+			return auth, nil
+		}
+		l := len(authScheme)
+		if len(auth) > l+1 && auth[:l] == authScheme {
+			return auth[l+1:], nil
+		}
+		return "", fmt.Errorf("invalid auth scheme")
+	}
+}
+
+// tokenFromQuery extracts token from query string
+func tokenFromQuery(param string) func(echo.Context) (string, error) {
+	return func(c echo.Context) (string, error) {
+		token := c.QueryParam(param)
+		if token == "" {
+			return "", fmt.Errorf("missing auth token")
+		}
+		return token, nil
+	}
+}
+
+// tokenFromParam extracts token from url param
+func tokenFromParam(param string) func(echo.Context) (string, error) {
+	return func(c echo.Context) (string, error) {
+		token := c.Param(param)
+		if token == "" {
+			return "", fmt.Errorf("missing auth token")
+		}
+		return token, nil
+	}
+}
+
+// tokenFromCookie extracts token from cookie
+func tokenFromCookie(name string) func(echo.Context) (string, error) {
+	return func(c echo.Context) (string, error) {
+		cookie, err := c.Cookie(name)
+		if err != nil {
+			return "", fmt.Errorf("missing auth token")
+		}
+		return cookie.Value, nil
+	}
+}

pkg/common/auth/options.go

@@ -0,0 +1,26 @@
+package auth
+
+import (
+	"github.com/labstack/echo/v4"
+)
+
+type Option func(c *UCANConfig)
+
+func WithSkipper(skipper func(c echo.Context) bool) Option {
+	return func(c *UCANConfig) {
+		c.Skipper = skipper
+	}
+}
+
+func WithAuthScheme(scheme string) Option {
+	return func(c *UCANConfig) {
+		c.AuthScheme = scheme
+	}
+}
+
+// WithTokenLookup sets the token lookup strategy
+func WithTokenLookup(lookup string) Option {
+	return func(c *UCANConfig) {
+		c.TokenLookup = lookup
+	}
+}

pkg/common/cookie/codec.go

@@ -16,9 +16,6 @@ const (
 	// SonrAddress is the key for the Sonr address cookie.
 	SonrAddress Key = "sonr.address"
 
-	// SonrKeyshare is the key for the Sonr address cookie.
-	SonrKeyshare Key = "sonr.keyshare"
-
 	// SonrDID is the key for the Sonr DID cookie.
 	SonrDID Key = "sonr.did"
 

pkg/common/header/codec.go

@@ -16,8 +16,6 @@ const (
 	UserAgent       Key = "Sec-CH-UA"
 
 	// Sonr Injected
-	ChainID     Key = "X-Chain-ID"
-	IPFSHost    Key = "X-Host-IPFS"
 	SonrAPIURL  Key = "X-Sonr-API"
 	SonrgRPCURL Key = "X-Sonr-GRPC"
 	SonrRPCURL  Key = "X-Sonr-RPC"

pkg/common/httputil/get.go

@@ -1,49 +0,0 @@
-package httputil
-
-import (
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-)
-
-// FetchAndDecode makes a GET request to the specified URL and decodes the JSON response into the provided type T
-func FetchAndDecode[T any](url string) (*T, error) {
-	// Create HTTP client
-	client := &http.Client{}
-
-	// Create request
-	req, err := http.NewRequest("GET", url, nil)
-	if err != nil {
-		return nil, fmt.Errorf("error creating request: %w", err)
-	}
-
-	// Set headers
-	req.Header.Set("Content-Type", "application/json")
-
-	// Make the request
-	resp, err := client.Do(req)
-	if err != nil {
-		return nil, fmt.Errorf("error making request: %w", err)
-	}
-	defer resp.Body.Close()
-
-	// Check status code
-	if resp.StatusCode != http.StatusOK {
-		return nil, fmt.Errorf("unexpected status code: %d", resp.StatusCode)
-	}
-
-	// Read body
-	body, err := io.ReadAll(resp.Body)
-	if err != nil {
-		return nil, fmt.Errorf("error reading response body: %w", err)
-	}
-
-	// Decode JSON into generic type
-	var result T
-	if err := json.Unmarshal(body, &result); err != nil {
-		return nil, fmt.Errorf("error decoding JSON: %w", err)
-	}
-
-	return &result, nil
-}

pkg/common/ipfs/ipfs.go

@@ -1 +0,0 @@
-package ipfs

pkg/common/ipfsapi/ipfsapi.go

@@ -1 +0,0 @@
-package ipfsapi

pkg/common/ipfsget/ipfsget.go

@@ -1 +0,0 @@
-package ipfsget

pkg/common/models/Account.pkl.go

@@ -1,4 +1,4 @@
-// Code generated from Pkl module `common.types.ORM`. DO NOT EDIT.
+// Code generated from Pkl module `sonr.motr.ORM`. DO NOT EDIT.
 package models
 
 type Account struct {

pkg/common/models/Asset.pkl.go

@@ -1,4 +1,4 @@
-// Code generated from Pkl module `common.types.ORM`. DO NOT EDIT.
+// Code generated from Pkl module `sonr.motr.ORM`. DO NOT EDIT.
 package models
 
 type Asset struct {

pkg/common/models/Chain.pkl.go

@@ -1,4 +1,4 @@
-// Code generated from Pkl module `common.types.ORM`. DO NOT EDIT.
+// Code generated from Pkl module `sonr.motr.ORM`. DO NOT EDIT.
 package models
 
 type Chain struct {

pkg/common/models/Credential.pkl.go

@@ -1,4 +1,4 @@
-// Code generated from Pkl module `common.types.ORM`. DO NOT EDIT.
+// Code generated from Pkl module `sonr.motr.ORM`. DO NOT EDIT.
 package models
 
 type Credential struct {

pkg/common/models/DID.pkl.go

@@ -1,4 +1,4 @@
-// Code generated from Pkl module `common.types.ORM`. DO NOT EDIT.
+// Code generated from Pkl module `sonr.motr.ORM`. DO NOT EDIT.
 package models
 
 import (

pkg/common/models/Grant.pkl.go

@@ -1,4 +1,4 @@
-// Code generated from Pkl module `common.types.ORM`. DO NOT EDIT.
+// Code generated from Pkl module `sonr.motr.ORM`. DO NOT EDIT.
 package models
 
 type Grant struct {

pkg/common/models/JWK.pkl.go

@@ -1,4 +1,4 @@
-// Code generated from Pkl module `common.types.ORM`. DO NOT EDIT.
+// Code generated from Pkl module `sonr.motr.ORM`. DO NOT EDIT.
 package models
 
 type JWK struct {

pkg/common/models/Keyshare.pkl.go

@@ -1,4 +1,4 @@
-// Code generated from Pkl module `common.types.ORM`. DO NOT EDIT.
+// Code generated from Pkl module `sonr.motr.ORM`. DO NOT EDIT.
 package models
 
 type Keyshare struct {

pkg/common/models/ORM.pkl.go

@@ -1,4 +1,4 @@
-// Code generated from Pkl module `common.types.ORM`. DO NOT EDIT.
+// Code generated from Pkl module `sonr.motr.ORM`. DO NOT EDIT.
 package models
 
 import (

pkg/common/models/Profile.pkl.go

@@ -1,4 +1,4 @@
-// Code generated from Pkl module `common.types.ORM`. DO NOT EDIT.
+// Code generated from Pkl module `sonr.motr.ORM`. DO NOT EDIT.
 package models
 
 type Profile struct {

pkg/common/models/assettype/AssetType.pkl.go

@@ -1,4 +1,4 @@
-// Code generated from Pkl module `common.types.ORM`. DO NOT EDIT.
+// Code generated from Pkl module `sonr.motr.ORM`. DO NOT EDIT.
 package assettype
 
 import (

pkg/common/models/didmethod/DIDMethod.pkl.go

@@ -1,4 +1,4 @@
-// Code generated from Pkl module `common.types.ORM`. DO NOT EDIT.
+// Code generated from Pkl module `sonr.motr.ORM`. DO NOT EDIT.
 package didmethod
 
 import (

pkg/common/models/init.pkl.go

@@ -1,17 +1,17 @@
-// Code generated from Pkl module `common.types.ORM`. DO NOT EDIT.
+// Code generated from Pkl module `sonr.motr.ORM`. DO NOT EDIT.
 package models
 
 import "github.com/apple/pkl-go/pkl"
 
 func init() {
-	pkl.RegisterMapping("common.types.ORM", ORM{})
-	pkl.RegisterMapping("common.types.ORM#Account", Account{})
-	pkl.RegisterMapping("common.types.ORM#Asset", Asset{})
-	pkl.RegisterMapping("common.types.ORM#Chain", Chain{})
-	pkl.RegisterMapping("common.types.ORM#Credential", Credential{})
-	pkl.RegisterMapping("common.types.ORM#DID", DID{})
-	pkl.RegisterMapping("common.types.ORM#JWK", JWK{})
-	pkl.RegisterMapping("common.types.ORM#Grant", Grant{})
-	pkl.RegisterMapping("common.types.ORM#Keyshare", Keyshare{})
-	pkl.RegisterMapping("common.types.ORM#Profile", Profile{})
+	pkl.RegisterMapping("sonr.motr.ORM", ORM{})
+	pkl.RegisterMapping("sonr.motr.ORM#Account", Account{})
+	pkl.RegisterMapping("sonr.motr.ORM#Asset", Asset{})
+	pkl.RegisterMapping("sonr.motr.ORM#Chain", Chain{})
+	pkl.RegisterMapping("sonr.motr.ORM#Credential", Credential{})
+	pkl.RegisterMapping("sonr.motr.ORM#DID", DID{})
+	pkl.RegisterMapping("sonr.motr.ORM#JWK", JWK{})
+	pkl.RegisterMapping("sonr.motr.ORM#Grant", Grant{})
+	pkl.RegisterMapping("sonr.motr.ORM#Keyshare", Keyshare{})
+	pkl.RegisterMapping("sonr.motr.ORM#Profile", Profile{})
 }

pkg/common/models/keyalgorithm/KeyAlgorithm.pkl.go

@@ -1,4 +1,4 @@
-// Code generated from Pkl module `common.types.ORM`. DO NOT EDIT.
+// Code generated from Pkl module `sonr.motr.ORM`. DO NOT EDIT.
 package keyalgorithm
 
 import (

pkg/common/models/keycurve/KeyCurve.pkl.go

@@ -1,4 +1,4 @@
-// Code generated from Pkl module `common.types.ORM`. DO NOT EDIT.
+// Code generated from Pkl module `sonr.motr.ORM`. DO NOT EDIT.
 package keycurve
 
 import (

pkg/common/models/keyencoding/KeyEncoding.pkl.go

@@ -1,4 +1,4 @@
-// Code generated from Pkl module `common.types.ORM`. DO NOT EDIT.
+// Code generated from Pkl module `sonr.motr.ORM`. DO NOT EDIT.
 package keyencoding
 
 import (

pkg/common/models/keyrole/KeyRole.pkl.go

@@ -1,4 +1,4 @@
-// Code generated from Pkl module `common.types.ORM`. DO NOT EDIT.
+// Code generated from Pkl module `sonr.motr.ORM`. DO NOT EDIT.
 package keyrole
 
 import (

pkg/common/models/keysharerole/KeyShareRole.pkl.go

@@ -1,4 +1,4 @@
-// Code generated from Pkl module `common.types.ORM`. DO NOT EDIT.
+// Code generated from Pkl module `sonr.motr.ORM`. DO NOT EDIT.
 package keysharerole
 
 import (

pkg/common/models/keytype/KeyType.pkl.go

@@ -1,4 +1,4 @@
-// Code generated from Pkl module `common.types.ORM`. DO NOT EDIT.
+// Code generated from Pkl module `sonr.motr.ORM`. DO NOT EDIT.
 package keytype
 
 import (

pkg/common/models/permissiongrant/PermissionGrant.pkl.go

@@ -1,4 +1,4 @@
-// Code generated from Pkl module `common.types.ORM`. DO NOT EDIT.
+// Code generated from Pkl module `sonr.motr.ORM`. DO NOT EDIT.
 package permissiongrant
 
 import (

pkg/common/models/permissionscope/PermissionScope.pkl.go

@@ -1,4 +1,4 @@
-// Code generated from Pkl module `common.types.ORM`. DO NOT EDIT.
+// Code generated from Pkl module `sonr.motr.ORM`. DO NOT EDIT.
 package permissionscope
 
 import (

pkg/common/response/redirect.go

@@ -0,0 +1,19 @@
+package response
+
+import (
+	"net/http"
+
+	"github.com/labstack/echo/v4"
+)
+
+func RedirectLanding(c echo.Context) error {
+	return c.Redirect(http.StatusFound, "http://localhost:3000")
+}
+
+func RedirectVaultCID(c echo.Context, cid string) error {
+	return c.Redirect(http.StatusFound, cid)
+}
+
+func RedirectVaultIPNS(c echo.Context, ipns string) error {
+	return c.Redirect(http.StatusFound, ipns)
+}

pkg/common/session/exports.go

@@ -0,0 +1,42 @@
+package session
+
+import (
+	"github.com/labstack/echo/v4"
+	"github.com/onsonr/sonr/pkg/common/cookie"
+	"github.com/onsonr/sonr/pkg/common/header"
+	"github.com/onsonr/sonr/pkg/vault/types"
+)
+
+// TODO: Returns fixed chain ID for testing.
+func GetChainID(c echo.Context) string {
+	return "sonr-testnet-1"
+}
+
+// GetVaultConfig returns the default vault config
+func GetVaultConfig(c echo.Context, addr string, ucanCID string) *types.Config {
+	return &types.Config{
+		MotrToken:      ucanCID,
+		MotrAddress:    addr,
+		IpfsGatewayUrl: "http://localhost:80",
+		SonrApiUrl:     "http://localhost:1317",
+		SonrRpcUrl:     "http://localhost:26657",
+		SonrChainId:    GetChainID(c),
+		VaultSchema:    GetVaultSchema(c),
+	}
+}
+
+// GetVaultSchema returns the default vault schema
+func GetVaultSchema(c echo.Context) *types.Schema {
+	return types.DefaultSchema()
+}
+
+// SetVaultAddress sets the address of the vault
+func SetVaultAddress(c echo.Context, address string) error {
+	return cookie.Write(c, cookie.SonrAddress, address)
+}
+
+// SetVaultAuthorization sets the UCAN CID of the vault
+func SetVaultAuthorization(c echo.Context, ucanCID string) error {
+	header.Write(c, header.Authorization, formatAuth(ucanCID))
+	return nil
+}

pkg/common/session/middleware.go

@@ -6,9 +6,9 @@ import (
 	"github.com/labstack/echo/v4"
 
 	"github.com/onsonr/sonr/pkg/common"
-	"github.com/onsonr/sonr/pkg/common/middleware/cookie"
-	"github.com/onsonr/sonr/pkg/common/middleware/header"
-	"github.com/onsonr/sonr/pkg/core/dwn"
+	"github.com/onsonr/sonr/pkg/common/cookie"
+	"github.com/onsonr/sonr/pkg/common/header"
+	"github.com/onsonr/sonr/pkg/vault/types"
 )
 
 // HwayMiddleware establishes a Session Cookie.
@@ -22,7 +22,7 @@ func HwayMiddleware() echo.MiddlewareFunc {
 }
 
 // MotrMiddleware establishes a Session Cookie.
-func MotrMiddleware(config *dwn.Config) echo.MiddlewareFunc {
+func MotrMiddleware(config *types.Config) echo.MiddlewareFunc {
 	return func(next echo.HandlerFunc) echo.HandlerFunc {
 		return func(c echo.Context) error {
 			err := injectConfig(c, config)
@@ -35,16 +35,11 @@ func MotrMiddleware(config *dwn.Config) echo.MiddlewareFunc {
 	}
 }
 
-func injectConfig(c echo.Context, config *dwn.Config) error {
-	header.Write(c, header.IPFSHost, config.IpfsGatewayUrl)
-	header.Write(c, header.ChainID, config.SonrChainId)
-
+func injectConfig(c echo.Context, config *types.Config) error {
 	header.Write(c, header.SonrAPIURL, config.SonrApiUrl)
 	header.Write(c, header.SonrRPCURL, config.SonrRpcUrl)
 
 	cookie.Write(c, cookie.SonrAddress, config.MotrAddress)
-	cookie.Write(c, cookie.SonrKeyshare, config.MotrKeyshare)
-
 	schemaBz, err := json.Marshal(config.VaultSchema)
 	if err != nil {
 		return err
@@ -58,16 +53,16 @@ func injectSession(c echo.Context, role common.PeerRole) *HTTPContext {
 	if c == nil {
 		return initHTTPContext(nil)
 	}
-	
+
 	cookie.Write(c, cookie.SessionRole, role.String())
-	
+
 	// Continue even if there are errors, just ensure we have valid session data
 	if err := loadOrGenKsuid(c); err != nil {
 		// Log error but continue
 	}
 	if err := loadOrGenChallenge(c); err != nil {
-		// Log error but continue  
+		// Log error but continue
 	}
-	
+
 	return initHTTPContext(c)
 }

pkg/common/session/session.go

@@ -6,7 +6,7 @@ import (
 	"github.com/labstack/echo/v4"
 
 	"github.com/onsonr/sonr/pkg/common"
-	"github.com/onsonr/sonr/pkg/common/middleware/cookie"
+	"github.com/onsonr/sonr/pkg/common/cookie"
 	"github.com/onsonr/sonr/pkg/common/types"
 )
 
@@ -41,18 +41,18 @@ func initHTTPContext(c echo.Context) *HTTPContext {
 			sessionData: &types.Session{},
 		}
 	}
-	
+
 	sessionData := injectSessionData(c)
 	if sessionData == nil {
 		sessionData = &types.Session{}
 	}
-	
+
 	cc := &HTTPContext{
 		Context:     c,
 		role:        common.PeerRole(cookie.ReadUnsafe(c, cookie.SessionRole)),
 		sessionData: sessionData,
 	}
-	
+
 	// Set the session data in both contexts
 	c.SetRequest(c.Request().WithContext(WithData(c.Request().Context(), sessionData)))
 	return cc

pkg/common/session/utils.go

@@ -10,8 +10,8 @@ import (
 	"github.com/segmentio/ksuid"
 
 	"github.com/onsonr/sonr/pkg/common"
-	"github.com/onsonr/sonr/pkg/common/middleware/cookie"
-	"github.com/onsonr/sonr/pkg/common/middleware/header"
+	"github.com/onsonr/sonr/pkg/common/cookie"
+	"github.com/onsonr/sonr/pkg/common/header"
 	"github.com/onsonr/sonr/pkg/common/types"
 )
 
@@ -186,3 +186,7 @@ func baseRegisterOptions() *common.RegisterOptions {
 		},
 	}
 }
+
+func formatAuth(ucanCID string) string {
+	return "Bearer " + ucanCID
+}

pkg/common/types/Ctx.pkl.go

@@ -1,4 +1,4 @@
-// Code generated from Pkl module `common.types.Ctx`. DO NOT EDIT.
+// Code generated from Pkl module `sonr.hway.Ctx`. DO NOT EDIT.
 package types
 
 import (

pkg/common/types/Session.pkl.go

@@ -1,4 +1,4 @@
-// Code generated from Pkl module `common.types.Ctx`. DO NOT EDIT.
+// Code generated from Pkl module `sonr.hway.Ctx`. DO NOT EDIT.
 package types
 
 type Session struct {

pkg/common/types/init.pkl.go

@@ -1,9 +1,9 @@
-// Code generated from Pkl module `common.types.Ctx`. DO NOT EDIT.
+// Code generated from Pkl module `sonr.hway.Ctx`. DO NOT EDIT.
 package types
 
 import "github.com/apple/pkl-go/pkl"
 
 func init() {
-	pkl.RegisterMapping("common.types.Ctx", Ctx{})
-	pkl.RegisterMapping("common.types.Ctx#Session", Session{})
+	pkl.RegisterMapping("sonr.hway.Ctx", Ctx{})
+	pkl.RegisterMapping("sonr.hway.Ctx#Session", Session{})
 }

pkg/core/dwn/bridge/fetch.go

@@ -1,211 +0,0 @@
-//go:build js && wasm
-// +build js,wasm
-
-package bridge
-
-import (
-	"bytes"
-	"fmt"
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"sync"
-	"syscall/js"
-)
-
-var (
-	// Global buffer pool to reduce allocations
-	bufferPool = sync.Pool{
-		New: func() interface{} {
-			return new(bytes.Buffer)
-		},
-	}
-
-	// Cached JS globals
-	jsGlobal     = js.Global()
-	jsUint8Array = jsGlobal.Get("Uint8Array")
-	jsResponse   = jsGlobal.Get("Response")
-	jsPromise    = jsGlobal.Get("Promise")
-	jsWasmHTTP   = jsGlobal.Get("wasmhttp")
-)
-
-// serveFetch serves HTTP requests with optimized handler management
-func ServeFetch(handler http.Handler) func() {
-	h := handler
-	if h == nil {
-		h = http.DefaultServeMux
-	}
-
-	// Optimize prefix handling
-	prefix := strings.TrimRight(jsWasmHTTP.Get("path").String(), "/")
-	if prefix != "" {
-		mux := http.NewServeMux()
-		mux.Handle(prefix+"/", http.StripPrefix(prefix, h))
-		h = mux
-	}
-
-	// Create request handler function
-	cb := js.FuncOf(func(_ js.Value, args []js.Value) interface{} {
-		promise, resolve, reject := newPromiseOptimized()
-
-		go handleRequest(h, args[1], resolve, reject)
-
-		return promise
-	})
-
-	jsWasmHTTP.Call("setHandler", cb)
-	return cb.Release
-}
-
-// handleRequest processes the request with panic recovery
-func handleRequest(h http.Handler, jsReq js.Value, resolve, reject func(interface{})) {
-	defer func() {
-		if r := recover(); r != nil {
-			var errMsg string
-			if err, ok := r.(error); ok {
-				errMsg = fmt.Sprintf("wasmhttp: panic: %+v", err)
-			} else {
-				errMsg = fmt.Sprintf("wasmhttp: panic: %v", r)
-			}
-			reject(errMsg)
-		}
-	}()
-
-	recorder := newResponseRecorder()
-	h.ServeHTTP(recorder, buildRequest(jsReq))
-	resolve(recorder.jsResponse())
-}
-
-// buildRequest creates an http.Request from JS Request
-func buildRequest(jsReq js.Value) *http.Request {
-	// Get request body
-	arrayBuffer, err := awaitPromiseOptimized(jsReq.Call("arrayBuffer"))
-	if err != nil {
-		panic(err)
-	}
-
-	// Create body buffer
-	jsBody := jsUint8Array.New(arrayBuffer)
-	bodyLen := jsBody.Get("length").Int()
-	body := make([]byte, bodyLen)
-	js.CopyBytesToGo(body, jsBody)
-
-	// Create request
-	req := httptest.NewRequest(
-		jsReq.Get("method").String(),
-		jsReq.Get("url").String(),
-		bytes.NewReader(body),
-	)
-
-	// Set headers efficiently
-	headers := jsReq.Get("headers")
-	headersIt := headers.Call("entries")
-	for {
-		entry := headersIt.Call("next")
-		if entry.Get("done").Bool() {
-			break
-		}
-		pair := entry.Get("value")
-		req.Header.Set(pair.Index(0).String(), pair.Index(1).String())
-	}
-
-	return req
-}
-
-// ResponseRecorder with optimized buffer handling
-type ResponseRecorder struct {
-	*httptest.ResponseRecorder
-	buffer *bytes.Buffer
-}
-
-func newResponseRecorder() *ResponseRecorder {
-	return &ResponseRecorder{
-		ResponseRecorder: httptest.NewRecorder(),
-		buffer:           bufferPool.Get().(*bytes.Buffer),
-	}
-}
-
-// jsResponse creates a JS Response with optimized memory usage
-func (rr *ResponseRecorder) jsResponse() js.Value {
-	defer func() {
-		rr.buffer.Reset()
-		bufferPool.Put(rr.buffer)
-	}()
-
-	res := rr.Result()
-	defer res.Body.Close()
-
-	// Prepare response body
-	body := js.Undefined()
-	if res.ContentLength != 0 {
-		if _, err := io.Copy(rr.buffer, res.Body); err != nil {
-			panic(err)
-		}
-		bodyBytes := rr.buffer.Bytes()
-		body = jsUint8Array.New(len(bodyBytes))
-		js.CopyBytesToJS(body, bodyBytes)
-	}
-
-	// Prepare response init object
-	init := make(map[string]interface{}, 3)
-	if res.StatusCode != 0 {
-		init["status"] = res.StatusCode
-	}
-
-	if len(res.Header) > 0 {
-		headers := make(map[string]interface{}, len(res.Header))
-		for k, v := range res.Header {
-			if len(v) > 0 {
-				headers[k] = v[0]
-			}
-		}
-		init["headers"] = headers
-	}
-
-	return jsResponse.New(body, init)
-}
-
-// newPromiseOptimized creates a new JavaScript Promise with optimized callback handling
-func newPromiseOptimized() (js.Value, func(interface{}), func(interface{})) {
-	var (
-		resolve     func(interface{})
-		reject      func(interface{})
-		promiseFunc = js.FuncOf(func(_ js.Value, args []js.Value) interface{} {
-			resolve = func(v interface{}) { args[0].Invoke(v) }
-			reject = func(v interface{}) { args[1].Invoke(v) }
-			return js.Undefined()
-		})
-	)
-	defer promiseFunc.Release()
-
-	return jsPromise.New(promiseFunc), resolve, reject
-}
-
-// awaitPromiseOptimized waits for Promise resolution with optimized channel handling
-func awaitPromiseOptimized(promise js.Value) (js.Value, error) {
-	done := make(chan struct{})
-	var (
-		result js.Value
-		err    error
-	)
-
-	thenFunc := js.FuncOf(func(_ js.Value, args []js.Value) interface{} {
-		result = args[0]
-		close(done)
-		return nil
-	})
-	defer thenFunc.Release()
-
-	catchFunc := js.FuncOf(func(_ js.Value, args []js.Value) interface{} {
-		err = js.Error{Value: args[0]}
-		close(done)
-		return nil
-	})
-	defer catchFunc.Release()
-
-	promise.Call("then", thenFunc).Call("catch", catchFunc)
-	<-done
-
-	return result, err
-}

pkg/core/dwn/bridge/wasm.go

@@ -1,34 +0,0 @@
-//go:build js && wasm
-// +build js,wasm
-
-package bridge
-
-import (
-	"encoding/base64"
-	"encoding/json"
-
-	"github.com/labstack/echo/v4"
-)
-
-func WasmContextMiddleware(next echo.HandlerFunc) echo.HandlerFunc {
-	return func(c echo.Context) error {
-		// Extract WASM context from headers
-		if wasmCtx := c.Request().Header.Get("X-Wasm-Context"); wasmCtx != "" {
-			if ctx, err := DecodeWasmContext(wasmCtx); err == nil {
-				c.Set("wasm_context", ctx)
-			}
-		}
-		return next(c)
-	}
-}
-
-// decodeWasmContext decodes the WASM context from a base64 encoded string
-func DecodeWasmContext(ctx string) (map[string]any, error) {
-	decoded, err := base64.StdEncoding.DecodeString(ctx)
-	if err != nil {
-		return nil, err
-	}
-	var ctxData map[string]any
-	err = json.Unmarshal(decoded, &ctxData)
-	return ctxData, err
-}

pkg/core/dwn/dwn.go

@@ -1,30 +0,0 @@
-package dwn
-
-import (
-	"encoding/json"
-	"os"
-)
-
-const dwnJSONFileName = "dwn.json"
-
-func LoadJSONConfig() (*Config, error) {
-	// Read dwn.json config
-	dwnBz, err := os.ReadFile(dwnJSONFileName)
-	if err != nil {
-		return nil, err
-	}
-	dwnConfig := new(Config)
-	err = json.Unmarshal(dwnBz, dwnConfig)
-	if err != nil {
-		return nil, err
-	}
-	return dwnConfig, nil
-}
-
-func (c *Config) MarshalJSON() ([]byte, error) {
-	return json.Marshal(c)
-}
-
-func (c *Config) UnmarshalJSON(data []byte) error {
-	return json.Unmarshal(data, c)
-}

pkg/core/dwn/handlers/worker.go

@@ -1,284 +0,0 @@
-package handlers
-
-import (
-	"fmt"
-	"net/http"
-
-	"github.com/labstack/echo/v4"
-	"github.com/onsonr/sonr/pkg/core/dwn"
-)
-
-// generateRawServiceWorkerJS returns the service worker JavaScript as a string
-func generateRawServiceWorkerJS(cfg *dwn.Environment) string {
-	return fmt.Sprintf(`const CACHE_NAMES = {
-    wasm: "wasm-cache-%s",
-    static: "static-cache-%s",
-    dynamic: "dynamic-cache-%s"
-};
-
-importScripts(
-    %q,
-    %q
-);
-
-// Initialize WASM HTTP listener with configured path
-const wasmInstance = registerWasmHTTPListener(%q);
-
-// MessageChannel port for WASM communication
-let wasmPort;
-
-// Request queue for offline operations
-let requestQueue = new Map();
-
-// Setup message channel handler
-self.addEventListener('message', async (event) => {
-    if (event.data.type === 'PORT_INITIALIZATION') {
-        wasmPort = event.data.port;
-        setupWasmCommunication();
-    }
-});
-
-function setupWasmCommunication() {
-    wasmPort.onmessage = async (event) => {
-        const { type, data } = event.data;
-        
-        switch (type) {
-            case 'WASM_REQUEST':
-                handleWasmRequest(data);
-                break;
-            case 'SYNC_REQUEST':
-                processSyncQueue();
-                break;
-        }
-    };
-
-    // Notify that WASM is ready
-    wasmPort.postMessage({ type: 'WASM_READY' });
-}
-
-// Enhanced install event
-self.addEventListener("install", (event) => {
-    event.waitUntil(
-        Promise.all([
-            skipWaiting(),
-            // Cache WASM binary and essential resources
-            caches.open(CACHE_NAMES.wasm).then(cache => 
-                cache.addAll([
-                    %q,
-                    %q
-                ])
-            )
-        ])
-    );
-});
-
-// Enhanced activate event
-self.addEventListener("activate", (event) => {
-    event.waitUntil(
-        Promise.all([
-            clients.claim(),
-            // Clean up old caches
-            caches.keys().then(keys => 
-                Promise.all(
-                    keys.map(key => {
-                        if (!Object.values(CACHE_NAMES).includes(key)) {
-                            return caches.delete(key);
-                        }
-                    })
-                )
-            )
-        ])
-    );
-});
-
-// Intercept fetch events
-self.addEventListener('fetch', (event) => {
-    const request = event.request;
-
-    // Handle API requests differently from static resources
-    if (request.url.includes('/api/')) {
-        event.respondWith(handleApiRequest(request));
-    } else {
-        event.respondWith(handleStaticRequest(request));
-    }
-});
-
-async function handleApiRequest(request) {
-    try {
-        // Try to make the request
-        const response = await fetch(request.clone());
-        
-        // If successful, pass through WASM handler
-        if (response.ok) {
-            return await processWasmResponse(request, response);
-        }
-        
-        // If offline or failed, queue the request
-        await queueRequest(request);
-        
-        // Return cached response if available
-        const cachedResponse = await caches.match(request);
-        if (cachedResponse) {
-            return cachedResponse;
-        }
-        
-        // Return offline response
-        return new Response(
-            JSON.stringify({ error: 'Currently offline' }),
-            { 
-                status: 503,
-                headers: { 'Content-Type': 'application/json' }
-            }
-        );
-    } catch (error) {
-        await queueRequest(request);
-        return new Response(
-            JSON.stringify({ error: 'Request failed' }),
-            { 
-                status: 500,
-                headers: { 'Content-Type': 'application/json' }
-            }
-        );
-    }
-}
-
-async function handleStaticRequest(request) {
-    // Check cache first
-    const cachedResponse = await caches.match(request);
-    if (cachedResponse) {
-        return cachedResponse;
-    }
-
-    try {
-        const response = await fetch(request);
-        
-        // Cache successful responses
-        if (response.ok) {
-            const cache = await caches.open(CACHE_NAMES.static);
-            cache.put(request, response.clone());
-        }
-        
-        return response;
-    } catch (error) {
-        // Return offline page for navigation requests
-        if (request.mode === 'navigate') {
-            return caches.match('/offline.html');
-        }
-        throw error;
-    }
-}
-
-async function processWasmResponse(request, response) {
-    const responseClone = response.clone();
-    
-    try {
-        const processedResponse = await wasmInstance.processResponse(responseClone);
-        
-        if (wasmPort) {
-            wasmPort.postMessage({
-                type: 'RESPONSE',
-                requestId: request.headers.get('X-Wasm-Request-ID'),
-                response: processedResponse
-            });
-        }
-        
-        return processedResponse;
-    } catch (error) {
-        console.error('WASM processing error:', error);
-        return response;
-    }
-}
-
-async function queueRequest(request) {
-    const serializedRequest = await serializeRequest(request);
-    requestQueue.set(request.url, serializedRequest);
-    
-    try {
-        await self.registration.sync.register('wasm-sync');
-    } catch (error) {
-        console.error('Sync registration failed:', error);
-    }
-}
-
-async function serializeRequest(request) {
-    const headers = {};
-    for (const [key, value] of request.headers.entries()) {
-        headers[key] = value;
-    }
-    
-    return {
-        url: request.url,
-        method: request.method,
-        headers,
-        body: await request.text(),
-        timestamp: Date.now()
-    };
-}
-
-// Handle background sync
-self.addEventListener('sync', (event) => {
-    if (event.tag === 'wasm-sync') {
-        event.waitUntil(processSyncQueue());
-    }
-});
-
-async function processSyncQueue() {
-    const requests = Array.from(requestQueue.values());
-    
-    for (const serializedRequest of requests) {
-        try {
-            const response = await fetch(new Request(serializedRequest.url, {
-                method: serializedRequest.method,
-                headers: serializedRequest.headers,
-                body: serializedRequest.body
-            }));
-            
-            if (response.ok) {
-                requestQueue.delete(serializedRequest.url);
-                
-                if (wasmPort) {
-                    wasmPort.postMessage({
-                        type: 'SYNC_COMPLETE',
-                        url: serializedRequest.url
-                    });
-                }
-            }
-        } catch (error) {
-            console.error('Sync failed for request:', error);
-        }
-    }
-}
-
-// Handle payment requests
-self.addEventListener("canmakepayment", function (e) {
-    e.respondWith(Promise.resolve(true));
-});
-
-// Handle periodic sync if available
-self.addEventListener('periodicsync', (event) => {
-    if (event.tag === 'wasm-sync') {
-        event.waitUntil(processSyncQueue());
-    }
-});`,
-		cfg.CacheVersion,
-		cfg.CacheVersion,
-		cfg.CacheVersion,
-		cfg.WasmExecPath,
-		cfg.HttpserverPath,
-		cfg.WasmPath,
-		cfg.WasmPath,
-		cfg.WasmExecPath,
-	)
-}
-
-// ServiceWorkerHandler is an Echo handler that serves the service worker
-func ServiceWorkerHandler(cfg *dwn.Environment) echo.HandlerFunc {
-	return func(c echo.Context) error {
-		// Set appropriate headers for service worker
-		c.Response().Header().Set("Content-Type", "application/javascript")
-		c.Response().Header().Set("Service-Worker-Allowed", "/")
-
-		// Generate and write the service worker JavaScript
-		return c.String(http.StatusOK, generateRawServiceWorkerJS(cfg))
-	}
-}

pkg/core/dwn/init.pkl.go

@@ -1,11 +0,0 @@
-// Code generated from Pkl module `common.types.DWN`. DO NOT EDIT.
-package dwn
-
-import "github.com/apple/pkl-go/pkl"
-
-func init() {
-	pkl.RegisterMapping("common.types.DWN", DWN{})
-	pkl.RegisterMapping("common.types.DWN#Config", Config{})
-	pkl.RegisterMapping("common.types.DWN#Schema", Schema{})
-	pkl.RegisterMapping("common.types.DWN#Environment", Environment{})
-}

pkg/core/dwn/server/server.go

@@ -1,60 +0,0 @@
-//go:build js && wasm
-// +build js,wasm
-
-package server
-
-import (
-	"github.com/labstack/echo/v4"
-
-	"github.com/onsonr/sonr/pkg/common/middleware/session"
-	"github.com/onsonr/sonr/pkg/core/dwn"
-
-	"github.com/onsonr/sonr/pkg/core/dwn/bridge"
-	"github.com/onsonr/sonr/pkg/core/dwn/handlers"
-)
-
-// Server is the interface that wraps the Serve function.
-type Server interface {
-	Serve() func()
-}
-
-type MotrServer struct {
-	e *echo.Echo
-
-	WasmPath       string
-	WasmExecPath   string
-	HTTPServerPath string
-	CacheVersion   string
-	IsDev          bool
-}
-
-func New(env *dwn.Environment, config *dwn.Config) Server {
-	s := &MotrServer{e: echo.New()}
-
-	s.e.Use(session.MotrMiddleware(config))
-	s.e.Use(bridge.WasmContextMiddleware)
-
-	// Add WASM-specific routes
-	registerAPI(s.e)
-	return s
-}
-
-func (s *MotrServer) Serve() func() {
-	return bridge.ServeFetch(s.e)
-}
-
-// registerAPI registers the Decentralized Web Node API routes.
-func registerAPI(e *echo.Echo) {
-	g1 := e.Group("api")
-	g1.GET("/register/:subject/start", handlers.RegisterSubjectStart)
-	g1.POST("/register/:subject/check", handlers.RegisterSubjectCheck)
-	g1.POST("/register/:subject/finish", handlers.RegisterSubjectFinish)
-
-	g1.GET("/login/:subject/start", handlers.LoginSubjectStart)
-	g1.POST("/login/:subject/check", handlers.LoginSubjectCheck)
-	g1.POST("/login/:subject/finish", handlers.LoginSubjectFinish)
-
-	g1.GET("/:origin/grant/jwks", handlers.GetJWKS)
-	g1.GET("/:origin/grant/token", handlers.GetToken)
-	g1.POST("/:origin/grant/:subject", handlers.GrantAuthorization)
-}

pkg/crypto/accumulator/accumulator.go

@@ -1,171 +0,0 @@
-//
-// Copyright Coinbase, Inc. All Rights Reserved.
-//
-// SPDX-License-Identifier: Apache-2.0
-//
-
-// Package accumulator implements the cryptographic accumulator as described in https://eprint.iacr.org/2020/777.pdf
-// It also implements the zero knowledge proof of knowledge protocol
-// described in section 7 of the paper.
-// Note: the paper only describes for non-membership witness case, but we don't
-// use non-membership witness. We only implement the membership witness case.
-package accumulator
-
-import (
-	"fmt"
-
-	"git.sr.ht/~sircmpwn/go-bare"
-
-	"github.com/onsonr/sonr/pkg/crypto/core/curves"
-)
-
-type structMarshal struct {
-	Curve string `bare:"curve"`
-	Value []byte `bare:"value"`
-}
-
-type Element curves.Scalar
-
-// Coefficient is a point
-type Coefficient curves.Point
-
-// Accumulator is a point
-type Accumulator struct {
-	value curves.Point
-}
-
-// New creates a new accumulator.
-func (acc *Accumulator) New(curve *curves.PairingCurve) (*Accumulator, error) {
-	// If we need to support non-membership witness, we need to implement Accumulator Initialization
-	// as described in section 6 of <https://eprint.iacr.org/2020/777.pdf>
-	// for now we don't need non-membership witness
-
-	// i.e., it computes V0 = prod(y + α) * P, y ∈ Y_V0, P is a generator of G1. Since we do not use non-membership witness
-	// we just set the initial accumulator a G1 generator.
-	acc.value = curve.Scalar.Point().Generator()
-	return acc, nil
-}
-
-// WithElements initializes a new accumulator prefilled with entries
-// Each member is assumed to be hashed
-// V = prod(y + α) * V0, for all y∈ Y_V
-func (acc *Accumulator) WithElements(curve *curves.PairingCurve, key *SecretKey, m []Element) (*Accumulator, error) {
-	_, err := acc.New(curve)
-	if err != nil {
-		return nil, err
-	}
-	y, err := key.BatchAdditions(m)
-	if err != nil {
-		return nil, err
-	}
-	acc.value = acc.value.Mul(y)
-	return acc, nil
-}
-
-// AddElements accumulates a set of elements into the accumulator.
-func (acc *Accumulator) AddElements(key *SecretKey, m []Element) (*Accumulator, error) {
-	if acc.value == nil || key.value == nil {
-		return nil, fmt.Errorf("accumulator and secret key should not be nil")
-	}
-	y, err := key.BatchAdditions(m)
-	if err != nil {
-		return nil, err
-	}
-	acc.value = acc.value.Mul(y)
-	return acc, nil
-}
-
-// Add accumulates a single element into the accumulator
-// V' = (y + alpha) * V
-func (acc *Accumulator) Add(key *SecretKey, e Element) (*Accumulator, error) {
-	if acc.value == nil || acc.value.IsIdentity() || key.value == nil || e == nil {
-		return nil, fmt.Errorf("accumulator, secret key and element should not be nil")
-	}
-	y := e.Add(key.value) // y + alpha
-	acc.value = acc.value.Mul(y)
-	return acc, nil
-}
-
-// Remove removes a single element from accumulator if it exists
-// V' = 1/(y+alpha) *  V
-func (acc *Accumulator) Remove(key *SecretKey, e Element) (*Accumulator, error) {
-	if acc.value == nil || acc.value.IsIdentity() || key.value == nil || e == nil {
-		return nil, fmt.Errorf("accumulator, secret key and element should not be nil")
-	}
-	y := e.Add(key.value) // y + alpha
-	y, err := y.Invert()  // 1/(y+alpha)
-	if err != nil {
-		return nil, err
-	}
-	acc.value = acc.value.Mul(y)
-	return acc, nil
-}
-
-// Update performs a batch addition and deletion as described on page 7, section 3 in
-// https://eprint.iacr.org/2020/777.pdf
-func (acc *Accumulator) Update(key *SecretKey, additions []Element, deletions []Element) (*Accumulator, []Coefficient, error) {
-	if acc.value == nil || acc.value.IsIdentity() || key.value == nil {
-		return nil, nil, fmt.Errorf("accumulator and secret key should not be nil")
-	}
-
-	// Compute dA(-alpha) = prod(y + alpha), y in the set of A ⊆ ACC-Y_V
-	a, err := key.BatchAdditions(additions)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	// Compute dD(-alpha) = 1/prod(y + alpha), y in the set of D ⊆ Y_V
-	d, err := key.BatchDeletions(deletions)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	// dA(-alpha)/dD(-alpha)
-	div := a.Mul(d)
-	newAcc := acc.value.Mul(div)
-
-	// build an array of coefficients
-	elements, err := key.CreateCoefficients(additions, deletions)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	coefficients := make([]Coefficient, len(elements))
-	for i := 0; i < len(elements); i++ {
-		coefficients[i] = acc.value.Mul(elements[i])
-	}
-	acc.value = newAcc
-	return acc, coefficients, nil
-}
-
-// MarshalBinary converts Accumulator to bytes
-func (acc Accumulator) MarshalBinary() ([]byte, error) {
-	if acc.value == nil {
-		return nil, fmt.Errorf("accumulator cannot be nil")
-	}
-	tv := &structMarshal{
-		Value: acc.value.ToAffineCompressed(),
-		Curve: acc.value.CurveName(),
-	}
-	return bare.Marshal(tv)
-}
-
-// UnmarshalBinary sets Accumulator from bytes
-func (acc *Accumulator) UnmarshalBinary(data []byte) error {
-	tv := new(structMarshal)
-	err := bare.Unmarshal(data, tv)
-	if err != nil {
-		return err
-	}
-	curve := curves.GetCurveByName(tv.Curve)
-	if curve == nil {
-		return fmt.Errorf("invalid curve")
-	}
-
-	value, err := curve.NewIdentityPoint().FromAffineCompressed(tv.Value)
-	if err != nil {
-		return err
-	}
-	acc.value = value
-	return nil
-}

pkg/crypto/accumulator/accumulator_test.go

@@ -1,188 +0,0 @@
-//
-// Copyright Coinbase, Inc. All Rights Reserved.
-//
-// SPDX-License-Identifier: Apache-2.0
-//
-
-package accumulator
-
-import (
-	"encoding/hex"
-	"fmt"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/onsonr/sonr/pkg/crypto/core/curves"
-)
-
-func TestNewAccumulator100(t *testing.T) {
-	curve := curves.BLS12381(&curves.PointBls12381G1{})
-	var seed [32]byte
-	key, err := new(SecretKey).New(curve, seed[:])
-	require.NoError(t, err)
-	require.NotNil(t, key)
-	acc, err := new(Accumulator).New(curve)
-	require.NoError(t, err)
-	accBz, err := acc.MarshalBinary()
-	require.NoError(t, err)
-	fmt.Println(accBz)
-	fmt.Println(len(accBz))
-	fmt.Println(hex.EncodeToString(accBz))
-	fmt.Println(len(hex.EncodeToString(accBz)))
-	require.Equal(t, 60, len(accBz), "Marshalled accumulator should be 60 bytes")
-	require.Equal(t, 120, len(hex.EncodeToString(accBz)), "Hex-encoded accumulator should be 120 characters")
-	require.NotNil(t, acc)
-	require.Equal(t, acc.value.ToAffineCompressed(), curve.PointG1.Generator().ToAffineCompressed())
-}
-
-func TestNewAccumulator10K(t *testing.T) {
-	curve := curves.BLS12381(&curves.PointBls12381G1{})
-	var seed [32]byte
-	key, err := new(SecretKey).New(curve, seed[:])
-	require.NoError(t, err)
-	require.NotNil(t, key)
-	acc, err := new(Accumulator).New(curve)
-	require.NoError(t, err)
-	require.NotNil(t, acc)
-	require.Equal(t, acc.value.ToAffineCompressed(), curve.PointG1.Generator().ToAffineCompressed())
-}
-
-func TestNewAccumulator10M(t *testing.T) {
-	// Initiating 10M values takes time
-	if testing.Short() {
-		t.Skip("skipping test in short mode.")
-	}
-	curve := curves.BLS12381(&curves.PointBls12381G1{})
-	var seed [32]byte
-	key, err := new(SecretKey).New(curve, seed[:])
-	require.NoError(t, err)
-	require.NotNil(t, key)
-	acc, err := new(Accumulator).New(curve)
-	require.NoError(t, err)
-	require.NotNil(t, acc)
-	require.Equal(t, acc.value.ToAffineCompressed(), curve.PointG1.Generator().ToAffineCompressed())
-}
-
-func TestWithElements(t *testing.T) {
-	curve := curves.BLS12381(&curves.PointBls12381G1{})
-	var seed [32]byte
-	key, _ := new(SecretKey).New(curve, seed[:])
-	element1 := curve.Scalar.Hash([]byte("value1"))
-	element2 := curve.Scalar.Hash([]byte("value2"))
-	elements := []Element{element1, element2}
-	newAcc, err := new(Accumulator).WithElements(curve, key, elements)
-	require.NoError(t, err)
-	require.NotNil(t, newAcc)
-	require.NotEqual(t, newAcc.value.ToAffineCompressed(), curve.PointG1.Identity().ToAffineCompressed())
-	require.NotEqual(t, newAcc.value.ToAffineCompressed(), curve.PointG1.Generator().ToAffineCompressed())
-
-	_, _ = newAcc.Remove(key, element1)
-	_, _ = newAcc.Remove(key, element2)
-	require.Equal(t, newAcc.value.ToAffineCompressed(), curve.PointG1.Generator().ToAffineCompressed())
-}
-
-func TestAdd(t *testing.T) {
-	curve := curves.BLS12381(&curves.PointBls12381G1{})
-	var seed [32]byte
-	key, err := new(SecretKey).New(curve, seed[:])
-	require.NoError(t, err)
-	require.NotNil(t, key)
-	acc := &Accumulator{curve.PointG1.Generator()}
-	_, _ = acc.New(curve)
-	require.NoError(t, err)
-	require.NotNil(t, acc)
-
-	element := curve.Scalar.Hash([]byte("value1"))
-	require.NoError(t, err)
-	require.NotNil(t, element)
-	_, _ = acc.Add(key, element)
-	require.NotEqual(t, acc.value.ToAffineCompressed(), curve.PointG1.Generator().ToAffineCompressed())
-}
-
-func TestRemove(t *testing.T) {
-	curve := curves.BLS12381(&curves.PointBls12381G1{})
-	var seed [32]byte
-	key, err := new(SecretKey).New(curve, seed[:])
-	require.NoError(t, err)
-	require.NotNil(t, key)
-	acc, err := new(Accumulator).New(curve)
-	require.NoError(t, err)
-	require.NotNil(t, acc)
-	require.Equal(t, acc.value.ToAffineCompressed(), curve.PointG1.Generator().ToAffineCompressed())
-
-	element := curve.Scalar.Hash([]byte("value1"))
-	require.NoError(t, err)
-	require.NotNil(t, element)
-
-	// add element
-	_, _ = acc.Add(key, element)
-	require.NotEqual(t, acc.value.ToAffineCompressed(), curve.PointG1.Generator().ToAffineCompressed())
-
-	// remove element
-	acc, err = acc.Remove(key, element)
-	require.NoError(t, err)
-	require.Equal(t, acc.value.ToAffineCompressed(), curve.PointG1.Generator().ToAffineCompressed())
-}
-
-func TestAddElements(t *testing.T) {
-	curve := curves.BLS12381(&curves.PointBls12381G1{})
-	var seed [32]byte
-	key, err := new(SecretKey).New(curve, seed[:])
-	require.NoError(t, err)
-	require.NotNil(t, key)
-	acc := &Accumulator{curve.PointG1.Generator()}
-	_, _ = acc.New(curve)
-	require.NoError(t, err)
-	require.NotNil(t, acc)
-	require.Equal(t, acc.value.ToAffineCompressed(), curve.PointG1.Generator().ToAffineCompressed())
-
-	element1 := curve.Scalar.Hash([]byte("value1"))
-	element2 := curve.Scalar.Hash([]byte("value2"))
-	element3 := curve.Scalar.Hash([]byte("value3"))
-	elements := []Element{element1, element2, element3}
-
-	acc, err = acc.AddElements(key, elements)
-	require.NoError(t, err)
-	require.NotEqual(t, acc.value.ToAffineCompressed(), curve.PointG1.Generator().ToAffineCompressed())
-}
-
-func TestAccumulatorMarshal(t *testing.T) {
-	curve := curves.BLS12381(&curves.PointBls12381G1{})
-	point := curve.PointG1.Generator().Mul(curve.Scalar.New(2))
-	data, err := Accumulator{point}.MarshalBinary()
-	require.NoError(t, err)
-	require.NotNil(t, data)
-	// element cannot be empty
-	_, err = Accumulator{}.MarshalBinary()
-	require.Error(t, err)
-
-	e := &Accumulator{curve.PointG1.Generator()}
-	_ = e.UnmarshalBinary(data)
-	require.True(t, e.value.Equal(point))
-}
-
-func TestUpdate(t *testing.T) {
-	curve := curves.BLS12381(&curves.PointBls12381G1{})
-	var seed [32]byte
-	key, err := new(SecretKey).New(curve, seed[:])
-	require.NoError(t, err)
-	require.NotNil(t, key)
-	acc, err := new(Accumulator).New(curve)
-	require.NoError(t, err)
-	require.NotNil(t, acc)
-	require.Equal(t, acc.value.ToAffineCompressed(), curve.PointG1.Generator().ToAffineCompressed())
-
-	element1 := curve.Scalar.Hash([]byte("value1"))
-	element2 := curve.Scalar.Hash([]byte("value2"))
-	element3 := curve.Scalar.Hash([]byte("value3"))
-	elements := []Element{element1, element2, element3}
-
-	acc, _, err = acc.Update(key, elements, nil)
-	require.NoError(t, err)
-	require.NotEqual(t, acc.value.ToAffineCompressed(), curve.PointG1.Generator().ToAffineCompressed())
-
-	acc, _, err = acc.Update(key, nil, elements)
-	require.NoError(t, err)
-	require.Equal(t, acc.value.ToAffineCompressed(), curve.PointG1.Generator().ToAffineCompressed())
-}

pkg/crypto/accumulator/key.go

@@ -1,244 +0,0 @@
-//
-// Copyright Coinbase, Inc. All Rights Reserved.
-//
-// SPDX-License-Identifier: Apache-2.0
-//
-
-package accumulator
-
-import (
-	"errors"
-	"fmt"
-
-	"git.sr.ht/~sircmpwn/go-bare"
-
-	"github.com/onsonr/sonr/pkg/crypto/core/curves"
-)
-
-// SecretKey is the secret alpha only held by the accumulator manager.
-type SecretKey struct {
-	value curves.Scalar
-}
-
-// New creates a new secret key from the seed.
-func (sk *SecretKey) New(curve *curves.PairingCurve, seed []byte) (*SecretKey, error) {
-	sk.value = curve.Scalar.Hash(seed)
-	return sk, nil
-}
-
-// GetPublicKey creates a public key from SecretKey sk
-func (sk SecretKey) GetPublicKey(curve *curves.PairingCurve) (*PublicKey, error) {
-	if sk.value == nil || curve == nil {
-		return nil, fmt.Errorf("curve and sk value cannot be nil")
-	}
-	value := curve.Scalar.Point().(curves.PairingPoint).OtherGroup().Generator().Mul(sk.value)
-	return &PublicKey{value.(curves.PairingPoint)}, nil
-}
-
-// MarshalBinary converts SecretKey to bytes
-func (sk SecretKey) MarshalBinary() ([]byte, error) {
-	if sk.value == nil {
-		return nil, fmt.Errorf("sk cannot be empty")
-	}
-	tv := &structMarshal{
-		Value: sk.value.Bytes(),
-		Curve: sk.value.Point().CurveName(),
-	}
-	return bare.Marshal(tv)
-}
-
-// UnmarshalBinary sets SecretKey from bytes
-func (sk *SecretKey) UnmarshalBinary(data []byte) error {
-	tv := new(structMarshal)
-	err := bare.Unmarshal(data, tv)
-	if err != nil {
-		return err
-	}
-	curve := curves.GetCurveByName(tv.Curve)
-	if curve == nil {
-		return fmt.Errorf("invalid curve")
-	}
-
-	value, err := curve.NewScalar().SetBytes(tv.Value)
-	if err != nil {
-		return err
-	}
-	sk.value = value
-	return nil
-}
-
-// BatchAdditions computes product(y + sk) for y in additions and output the product
-func (sk SecretKey) BatchAdditions(additions []Element) (Element, error) {
-	if sk.value == nil {
-		return nil, fmt.Errorf("secret key cannot be empty")
-	}
-	mul := sk.value.One()
-	for i := 0; i < len(additions); i++ {
-		if additions[i] == nil {
-			return nil, fmt.Errorf("some element in additions is nil")
-		}
-		// y + alpha
-		temp := additions[i].Add(sk.value)
-		// prod(y + alpha)
-		mul = mul.Mul(temp)
-	}
-	return mul, nil
-}
-
-// BatchDeletions computes 1/product(y + sk) for y in deletions and output it
-func (sk SecretKey) BatchDeletions(deletions []Element) (Element, error) {
-	v, err := sk.BatchAdditions(deletions)
-	if err != nil {
-		return nil, err
-	}
-	y, err := v.Invert()
-	if err != nil {
-		return nil, err
-	}
-	return y, nil
-}
-
-// CreateCoefficients creates the Batch Polynomial coefficients
-// See page 7 of https://eprint.iacr.org/2020/777.pdf
-func (sk SecretKey) CreateCoefficients(additions []Element, deletions []Element) ([]Element, error) {
-	if sk.value == nil {
-		return nil, fmt.Errorf("secret key should not be nil")
-	}
-
-	// vD(x) = ∑^{m}_{s=1}{ ∏ 1..s {yD_i + alpha}^-1 ∏ 1 ..s-1 {yD_j - x}
-	one := sk.value.One()
-	m1 := one.Neg() // m1 is -1
-	vD := make(polynomial, 0, len(deletions))
-	for s := 0; s < len(deletions); s++ {
-		// ∏ 1..s (yD_i + alpha)^-1
-		c, err := sk.BatchDeletions(deletions[0 : s+1])
-		if err != nil {
-			return nil, fmt.Errorf("error in sk batchDeletions")
-		}
-		poly := make(polynomial, 1, s+2)
-		poly[0] = one
-
-		// ∏ 1..(s-1) (yD_j - x)
-		for j := 0; j < s; j++ {
-			t := make(polynomial, 2)
-			// yD_j
-			t[0] = deletions[j]
-			// -x
-			t[1] = m1
-
-			// polynomial multiplication (yD_1-x) * (yD_2 - x) ...
-			poly, err = poly.Mul(t)
-			if err != nil {
-				return nil, err
-			}
-		}
-		poly, err = poly.MulScalar(c)
-		if err != nil {
-			return nil, err
-		}
-		vD, err = vD.Add(poly)
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	// vD(x) * ∏ 1..n (yA_i + alpha)
-	bAdd, err := sk.BatchAdditions(additions)
-	if err != nil {
-		return nil, fmt.Errorf("error in sk batchAdditions")
-	}
-	vD, err = vD.MulScalar(bAdd)
-	if err != nil {
-		return nil, err
-	}
-
-	// vA(x) = ∑^n_{s=1}{ ∏ 1..s-1 {yA_i + alpha} ∏ s+1..n {yA_j - x} }
-	vA := make(polynomial, 0, len(additions))
-	for s := 0; s < len(additions); s++ {
-		// ∏ 1..s-1 {yA_i + alpha}
-		var c Element
-		if s == 0 {
-			c = one
-		} else {
-			c, err = sk.BatchAdditions(additions[0:s])
-			if err != nil {
-				return nil, err
-			}
-		}
-		poly := make(polynomial, 1, s+2)
-		poly[0] = one
-
-		// ∏ s+1..n {yA_j - x}
-		for j := s + 1; j < len(additions); j++ {
-			t := make(polynomial, 2)
-			t[0] = additions[j]
-			t[1] = m1
-
-			// polynomial multiplication (yA_1-x) * (yA_2 - x) ...
-			poly, err = poly.Mul(t)
-			if err != nil {
-				return nil, err
-			}
-		}
-		poly, err = poly.MulScalar(c)
-		if err != nil {
-			return nil, err
-		}
-		vA, err = vA.Add(poly)
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	// vA - vD
-	vA, err = vA.Sub(vD)
-	if err != nil {
-		return nil, err
-	}
-	result := make([]Element, len(vA))
-	for i := 0; i < len(vA); i++ {
-		result[i] = vA[i]
-	}
-	return result, nil
-}
-
-// PublicKey is the public key of accumulator, it should be sk * generator of G2
-type PublicKey struct {
-	value curves.PairingPoint
-}
-
-// MarshalBinary converts PublicKey to bytes
-func (pk PublicKey) MarshalBinary() ([]byte, error) {
-	if pk.value == nil {
-		return nil, fmt.Errorf("public key cannot be nil")
-	}
-	tv := &structMarshal{
-		Value: pk.value.ToAffineCompressed(),
-		Curve: pk.value.CurveName(),
-	}
-	return bare.Marshal(tv)
-}
-
-// UnmarshalBinary sets PublicKey from bytes
-func (pk *PublicKey) UnmarshalBinary(data []byte) error {
-	tv := new(structMarshal)
-	err := bare.Unmarshal(data, tv)
-	if err != nil {
-		return err
-	}
-	curve := curves.GetPairingCurveByName(tv.Curve)
-	if curve == nil {
-		return fmt.Errorf("invalid curve")
-	}
-
-	value, err := curve.NewScalar().Point().FromAffineCompressed(tv.Value)
-	if err != nil {
-		return err
-	}
-	var ok bool
-	pk.value, ok = value.(curves.PairingPoint)
-	if !ok {
-		return errors.New("can't convert to PairingPoint")
-	}
-	return nil
-}

pkg/crypto/accumulator/key_test.go

@@ -1,88 +0,0 @@
-//
-// Copyright Coinbase, Inc. All Rights Reserved.
-//
-// SPDX-License-Identifier: Apache-2.0
-//
-
-package accumulator
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/onsonr/sonr/pkg/crypto/core/curves"
-)
-
-func TestSecretKeyMarshal(t *testing.T) {
-	curve := curves.BLS12381(&curves.PointBls12381G1{})
-	data, err := SecretKey{curve.Scalar.One()}.MarshalBinary()
-	require.NoError(t, err)
-	require.NotNil(t, data)
-	e := &SecretKey{curve.Scalar.New(2)}
-	err = e.UnmarshalBinary(data)
-	require.NoError(t, err)
-	require.Equal(t, e.value.Bytes(), curve.Scalar.One().Bytes())
-
-	// element cannot be empty
-	_, err = SecretKey{}.MarshalBinary()
-	require.Error(t, err)
-}
-
-func TestPublicKeyMarshal(t *testing.T) {
-	// Actually test both toBytes() and from()
-	curve := curves.BLS12381(&curves.PointBls12381G1{})
-	sk := &SecretKey{curve.Scalar.New(3)}
-	pk, _ := sk.GetPublicKey(curve)
-	pkBytes, err := pk.MarshalBinary()
-	require.NoError(t, err)
-	require.NotNil(t, pkBytes)
-
-	pk2 := &PublicKey{}
-	err = pk2.UnmarshalBinary(pkBytes)
-	require.NoError(t, err)
-	require.True(t, pk.value.Equal(pk2.value))
-}
-
-func TestBatch(t *testing.T) {
-	curve := curves.BLS12381(&curves.PointBls12381G1{})
-	var seed [32]byte
-	sk, _ := new(SecretKey).New(curve, seed[:])
-	element1 := curve.Scalar.Hash([]byte("value1"))
-	element2 := curve.Scalar.Hash([]byte("value2"))
-	elements := []Element{element1, element2}
-
-	add, err := sk.BatchAdditions(elements)
-	require.NoError(t, err)
-	require.NotNil(t, add)
-
-	del, err := sk.BatchDeletions(elements)
-	require.NoError(t, err)
-	require.NotNil(t, del)
-
-	result := add.Mul(del)
-	require.Equal(t, result, curve.Scalar.One())
-
-	g1 := curve.PointG1.Generator()
-	acc := g1.Mul(add)
-	require.NotEqual(t, acc, g1)
-	acc = acc.Mul(del)
-	require.Equal(t, acc.ToAffineCompressed(), g1.ToAffineCompressed())
-
-	acc2 := g1.Mul(result)
-	require.True(t, acc2.Equal(g1))
-}
-
-func TestCoefficient(t *testing.T) {
-	curve := curves.BLS12381(&curves.PointBls12381G1{})
-	sk, _ := new(SecretKey).New(curve, []byte("1234567890"))
-	element1 := curve.Scalar.Hash([]byte("value1"))
-	element2 := curve.Scalar.Hash([]byte("value2"))
-	element3 := curve.Scalar.Hash([]byte("value3"))
-	element4 := curve.Scalar.Hash([]byte("value4"))
-	element5 := curve.Scalar.Hash([]byte("value5"))
-	elements := []Element{element1, element2, element3, element4, element5}
-	coefficients, err := sk.CreateCoefficients(elements[0:2], elements[2:5])
-	require.NoError(t, err)
-	require.Equal(t, len(coefficients), 3)
-}

pkg/crypto/accumulator/lib.go

@@ -1,204 +0,0 @@
-//
-// Copyright Coinbase, Inc. All Rights Reserved.
-//
-// SPDX-License-Identifier: Apache-2.0
-//
-
-package accumulator
-
-import (
-	"fmt"
-	"math"
-
-	"github.com/onsonr/sonr/pkg/crypto/core/curves"
-)
-
-// dad constructs two polynomials - dA(x) and dD(x)
-// dA(y) = prod(y_A,t - y), t = 1...n
-// dD(y) = prod(y_D,t - y), t = 1...n
-func dad(values []Element, y Element) (Element, error) {
-	if values == nil || y == nil {
-		return nil, fmt.Errorf("curve, values or y should not be nil")
-	}
-
-	for _, value := range values {
-		if value == nil {
-			return nil, fmt.Errorf("some element is nil")
-		}
-	}
-
-	result := y.One()
-	if len(values) == 1 {
-		a := values[0]
-		result = a.Sub(y)
-	} else {
-		for i := 0; i < len(values); i++ {
-			temp := values[i].Sub(y)
-			result = result.Mul(temp)
-		}
-	}
-	return result, nil
-}
-
-type polynomialPoint []curves.Point
-
-// evaluate evaluates a PolynomialG1 on input x.
-func (p polynomialPoint) evaluate(x curves.Scalar) (curves.Point, error) {
-	if p == nil {
-		return nil, fmt.Errorf("p cannot be empty")
-	}
-	for i := 0; i < len(p); i++ {
-		if p[i] == nil {
-			return nil, fmt.Errorf("some coefficient in p is nil")
-		}
-	}
-
-	pp := x
-	res := p[0]
-	for i := 1; i < len(p); i++ {
-		r := p[i].Mul(pp)
-		res = res.Add(r)
-		pp = pp.Mul(x)
-	}
-	return res, nil
-}
-
-// Add adds two PolynomialG1
-func (p polynomialPoint) Add(rhs polynomialPoint) (polynomialPoint, error) {
-	maxLen := int(math.Max(float64(len(p)), float64(len(rhs))))
-
-	result := make(polynomialPoint, maxLen)
-
-	for i, c := range p {
-		if c == nil {
-			return nil, fmt.Errorf("invalid coefficient at %d", i)
-		}
-		result[i] = c.Add(c.Identity())
-	}
-
-	for i, c := range rhs {
-		if c == nil {
-			return nil, fmt.Errorf("invalid coefficient at %d", i)
-		}
-		if result[i] == nil {
-			result[i] = c.Add(c.Identity())
-		} else {
-			result[i] = result[i].Add(c)
-		}
-	}
-	return result, nil
-}
-
-// Mul for PolynomialG1 computes rhs * p, p is a polynomial, rhs is a value
-func (p polynomialPoint) Mul(rhs curves.Scalar) (polynomialPoint, error) {
-	result := make(polynomialPoint, len(p))
-
-	for i, c := range p {
-		if c == nil {
-			return nil, fmt.Errorf("invalid coefficient at %d", i)
-		}
-		result[i] = c.Mul(rhs)
-	}
-
-	return result, nil
-}
-
-type polynomial []curves.Scalar
-
-// Add adds two polynomials
-func (p polynomial) Add(rhs polynomial) (polynomial, error) {
-	maxLen := int(math.Max(float64(len(p)), float64(len(rhs))))
-	result := make([]curves.Scalar, maxLen)
-
-	for i, c := range p {
-		if c == nil {
-			return nil, fmt.Errorf("invalid coefficient at %d", i)
-		}
-		result[i] = c.Clone()
-	}
-
-	for i, c := range rhs {
-		if c == nil {
-			return nil, fmt.Errorf("invalid coefficient at %d", i)
-		}
-		if result[i] == nil {
-			result[i] = c.Clone()
-		} else {
-			result[i] = result[i].Add(c)
-		}
-	}
-
-	return result, nil
-}
-
-// Sub computes p-rhs and returns
-func (p polynomial) Sub(rhs polynomial) (polynomial, error) {
-	maxLen := int(math.Max(float64(len(p)), float64(len(rhs))))
-	result := make([]curves.Scalar, maxLen)
-
-	for i, c := range p {
-		if c == nil {
-			return nil, fmt.Errorf("invalid coefficient at %d", i)
-		}
-		result[i] = c.Clone()
-	}
-
-	for i, c := range rhs {
-		if c == nil {
-			return nil, fmt.Errorf("invalid coefficient at %d", i)
-		}
-		if result[i] == nil {
-			result[i] = c.Neg()
-		} else {
-			result[i] = result[i].Sub(c)
-		}
-	}
-
-	return result, nil
-}
-
-// Mul multiplies two polynomials - p * rhs
-func (p polynomial) Mul(rhs polynomial) (polynomial, error) {
-	// Check for each coefficient that should not be nil
-	for i, c := range p {
-		if c == nil {
-			return nil, fmt.Errorf("coefficient in p at %d is nil", i)
-		}
-	}
-
-	for i, c := range rhs {
-		if c == nil {
-			return nil, fmt.Errorf("coefficient in rhs at %d is nil", i)
-		}
-	}
-
-	m := len(p)
-	n := len(rhs)
-
-	// Initialize the product polynomial
-	prod := make(polynomial, m+n-1)
-	for i := 0; i < len(prod); i++ {
-		prod[i] = p[0].Zero()
-	}
-
-	// Multiply two polynomials term by term
-	for i, cp := range p {
-		for j, cr := range rhs {
-			temp := cp.Mul(cr)
-			prod[i+j] = prod[i+j].Add(temp)
-		}
-	}
-	return prod, nil
-}
-
-// MulScalar computes p * rhs, where rhs is a scalar value
-func (p polynomial) MulScalar(rhs curves.Scalar) (polynomial, error) {
-	result := make(polynomial, len(p))
-	for i, c := range p {
-		if c == nil {
-			return nil, fmt.Errorf("coefficient at %d is nil", i)
-		}
-		result[i] = c.Mul(rhs)
-	}
-	return result, nil
-}

pkg/crypto/accumulator/lib_test.go

@@ -1,404 +0,0 @@
-//
-// Copyright Coinbase, Inc. All Rights Reserved.
-//
-// SPDX-License-Identifier: Apache-2.0
-//
-
-package accumulator
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/onsonr/sonr/pkg/crypto/core/curves"
-)
-
-func TestEvaluatePolyG1(t *testing.T) {
-	curve := curves.BLS12381(&curves.PointBls12381G1{})
-	poly := polynomialPoint{
-		curve.PointG1.Generator().Mul(curve.Scalar.New(3)),
-		curve.PointG1.Generator().Mul(curve.Scalar.New(2)),
-		curve.PointG1.Generator().Mul(curve.Scalar.New(1)),
-	}
-	output1, err := poly.evaluate(curve.Scalar.New(1))
-	require.NoError(t, err)
-	require.NotNil(t, output1)
-	result1 := curve.PointG1.Generator().Mul(curve.Scalar.New(6))
-	require.Equal(t, output1.ToAffineCompressed(), result1.ToAffineCompressed())
-
-	output2, err := poly.evaluate(curve.Scalar.New(2))
-	require.NoError(t, err)
-	require.NotNil(t, output2)
-	result2 := curve.PointG1.Generator().Mul(curve.Scalar.New(11))
-	require.Equal(t, output2.ToAffineCompressed(), result2.ToAffineCompressed())
-}
-
-func TestEvaluatePolyG1Error(t *testing.T) {
-	curve := curves.BLS12381(&curves.PointBls12381G1{})
-	poly := polynomialPoint{
-		nil,
-		curve.PointG1.Generator().Mul(curve.Scalar.New(2)),
-		curve.PointG1.Generator().Mul(curve.Scalar.New(1)),
-	}
-	_, err := poly.evaluate(curve.Scalar.New(1))
-	require.Error(t, err)
-}
-
-func TestAddAssignPolyG1(t *testing.T) {
-	curve := curves.BLS12381(&curves.PointBls12381G1{})
-	// Test polynomial with equal length
-	poly1 := polynomialPoint{
-		curve.PointG1.Generator().Mul(curve.Scalar.New(3)),
-		curve.PointG1.Generator().Mul(curve.Scalar.New(2)),
-		curve.PointG1.Generator().Mul(curve.Scalar.New(1)),
-	}
-	poly2 := polynomialPoint{
-		curve.PointG1.Generator().Mul(curve.Scalar.New(1)),
-		curve.PointG1.Generator().Mul(curve.Scalar.New(2)),
-		curve.PointG1.Generator().Mul(curve.Scalar.New(3)),
-	}
-
-	output, err := poly1.Add(poly2)
-	require.NoError(t, err)
-	require.NotNil(t, output)
-	result := polynomialPoint{
-		curve.PointG1.Generator().Mul(curve.Scalar.New(4)),
-		curve.PointG1.Generator().Mul(curve.Scalar.New(4)),
-		curve.PointG1.Generator().Mul(curve.Scalar.New(4)),
-	}
-	for i := 0; i < len(output); i++ {
-		require.Equal(t, output[i].ToAffineCompressed(), result[i].ToAffineCompressed())
-	}
-
-	// Test polynomials with unequal length
-	poly3 := polynomialPoint{
-		curve.PointG1.Generator().Mul(curve.Scalar.New(1)),
-		curve.PointG1.Generator().Mul(curve.Scalar.New(2)),
-	}
-	output2, err := poly1.Add(poly3)
-	require.NoError(t, err)
-	require.NotNil(t, output2)
-	result2 := polynomialPoint{
-		curve.PointG1.Generator().Mul(curve.Scalar.New(4)),
-		curve.PointG1.Generator().Mul(curve.Scalar.New(4)),
-		curve.PointG1.Generator().Mul(curve.Scalar.New(1)),
-	}
-	require.Equal(t, len(output2), len(result2))
-	for i := 0; i < len(output2); i++ {
-		require.Equal(t, output2[i].ToAffineCompressed(), result2[i].ToAffineCompressed())
-	}
-
-	// Test polynomial with Capacity
-	poly4 := make(polynomialPoint, 0, 3)
-	poly5, err := poly4.Add(poly1)
-	require.NoError(t, err)
-	require.Equal(t, len(poly5), len(poly1))
-	for i := 0; i < len(poly5); i++ {
-		require.Equal(t, poly5[i].ToAffineCompressed(), poly1[i].ToAffineCompressed())
-	}
-}
-
-func TestAddAssignPolyG1Error(t *testing.T) {
-	curve := curves.BLS12381(&curves.PointBls12381G1{})
-	poly1 := polynomialPoint{
-		nil,
-		curve.PointG1.Generator().Mul(curve.Scalar.New(2)),
-		curve.PointG1.Generator().Mul(curve.Scalar.New(1)),
-	}
-	poly2 := polynomialPoint{
-		curve.PointG1.Generator().Mul(curve.Scalar.New(1)),
-		curve.PointG1.Generator().Mul(curve.Scalar.New(2)),
-		curve.PointG1.Generator().Mul(curve.Scalar.New(3)),
-	}
-	output, err := poly1.Add(poly2)
-	require.Error(t, err)
-	require.Nil(t, output)
-}
-
-func TestMulAssignPolyG1(t *testing.T) {
-	curve := curves.BLS12381(&curves.PointBls12381G1{})
-	poly := polynomialPoint{
-		curve.PointG1.Generator().Mul(curve.Scalar.New(3)),
-		curve.PointG1.Generator().Mul(curve.Scalar.New(2)),
-		curve.PointG1.Generator().Mul(curve.Scalar.New(1)),
-	}
-	rhs := curve.Scalar.New(3)
-	output, err := poly.Mul(rhs)
-	require.NoError(t, err)
-	require.NotNil(t, output)
-	poly2 := polynomialPoint{
-		curve.PointG1.Generator().Mul(curve.Scalar.New(9)),
-		curve.PointG1.Generator().Mul(curve.Scalar.New(6)),
-		curve.PointG1.Generator().Mul(curve.Scalar.New(3)),
-	}
-	for i := 0; i < len(poly2); i++ {
-		require.Equal(t, output[i].ToAffineCompressed(), poly2[i].ToAffineCompressed())
-	}
-}
-
-func TestMulAssignPolyG1Error(t *testing.T) {
-	curve := curves.BLS12381(&curves.PointBls12381G1{})
-	poly := polynomialPoint{
-		nil,
-		curve.PointG1.Generator().Mul(curve.Scalar.New(2)),
-		curve.PointG1.Generator().Mul(curve.Scalar.New(1)),
-	}
-	rhs := curve.Scalar.New(3)
-	output, err := poly.Mul(rhs)
-	require.Error(t, err)
-	require.Nil(t, output)
-}
-
-func TestPushPoly(t *testing.T) {
-	curve := curves.BLS12381(&curves.PointBls12381G1{})
-	poly := polynomial{
-		curve.Scalar.New(3),
-		curve.Scalar.New(2),
-		curve.Scalar.New(1),
-	}
-	scalar := curve.Scalar.New(4)
-	result := append(poly, scalar)
-	require.Equal(t, result[3], scalar)
-
-	// Push one more
-	scalar2 := curve.Scalar.New(5)
-	result2 := append(result, scalar2)
-	require.Equal(t, result2[4], scalar2)
-
-	// Push to a new polynomial
-	newPoly := polynomial{}
-	newPoly = append(newPoly, scalar)
-	require.Equal(t, newPoly[0], scalar)
-	newPoly = append(newPoly, scalar2)
-	require.Equal(t, newPoly[1], scalar2)
-}
-
-func TestAddAssignPoly(t *testing.T) {
-	curve := curves.BLS12381(&curves.PointBls12381G1{})
-	// Test polynomial with equal length
-	poly1 := polynomial{
-		curve.Scalar.New(3),
-		curve.Scalar.New(2),
-		curve.Scalar.New(1),
-	}
-	poly2 := polynomial{
-		curve.Scalar.New(1),
-		curve.Scalar.New(2),
-		curve.Scalar.New(3),
-	}
-
-	output, err := poly1.Add(poly2)
-	require.NoError(t, err)
-	require.NotNil(t, output)
-	result := []curves.Scalar{
-		curve.Scalar.New(4),
-		curve.Scalar.New(4),
-		curve.Scalar.New(4),
-	}
-	for i := 0; i < len(output); i++ {
-		require.Equal(t, output[i], result[i])
-	}
-
-	// Test polynomials with unequal length
-	poly3 := polynomial{
-		curve.Scalar.New(1),
-		curve.Scalar.New(2),
-	}
-	output2, err := poly1.Add(poly3)
-	require.NoError(t, err)
-	require.NotNil(t, output2)
-	result2 := []curves.Scalar{
-		curve.Scalar.New(4),
-		curve.Scalar.New(4),
-		curve.Scalar.New(1),
-	}
-	require.Equal(t, len(output2), len(result2))
-	for i := 0; i < len(output2); i++ {
-		require.Equal(t, output2[i], result2[i])
-	}
-}
-
-func TestAddAssignPolyError(t *testing.T) {
-	curve := curves.BLS12381(&curves.PointBls12381G1{})
-	// Test polynomial with equal length
-	poly1 := polynomial{
-		nil,
-		curve.Scalar.New(2),
-		curve.Scalar.New(1),
-	}
-	poly2 := polynomial{
-		curve.Scalar.New(1),
-		curve.Scalar.New(2),
-		curve.Scalar.New(3),
-	}
-
-	output, err := poly1.Add(poly2)
-	require.Error(t, err)
-	require.Nil(t, output)
-}
-
-func TestSubAssignPoly(t *testing.T) {
-	curve := curves.BLS12381(&curves.PointBls12381G1{})
-	// Test polynomial with equal length
-	poly1 := polynomial{
-		curve.Scalar.New(3),
-		curve.Scalar.New(2),
-		curve.Scalar.New(1),
-	}
-	poly2 := polynomial{
-		curve.Scalar.New(1),
-		curve.Scalar.New(2),
-		curve.Scalar.New(3),
-	}
-
-	output, err := poly1.Sub(poly2)
-	require.NoError(t, err)
-	require.NotNil(t, output)
-	result := []curves.Scalar{
-		curve.Scalar.New(2),
-		curve.Scalar.New(0),
-		curve.Scalar.New(-2),
-	}
-	for i := 0; i < len(output); i++ {
-		require.Equal(t, output[i].Bytes(), result[i].Bytes())
-	}
-
-	// Test polynomials with unequal length
-	poly3 := polynomial{
-		curve.Scalar.New(1),
-		curve.Scalar.New(2),
-		curve.Scalar.New(3),
-		curve.Scalar.New(4),
-	}
-	output2, err := poly1.Sub(poly3)
-	require.NoError(t, err)
-	require.NotNil(t, output2)
-	result2 := []curves.Scalar{
-		curve.Scalar.New(2),
-		curve.Scalar.New(0),
-		curve.Scalar.New(-2),
-		curve.Scalar.New(-4),
-	}
-	require.Equal(t, len(output2), len(result2))
-	for i := 0; i < len(output2); i++ {
-		require.Equal(t, output2[i].Bytes(), result2[i].Bytes())
-	}
-}
-
-func TestSubAssignPolyError(t *testing.T) {
-	curve := curves.BLS12381(&curves.PointBls12381G1{})
-	poly1 := polynomial{
-		nil,
-		curve.Scalar.New(2),
-		curve.Scalar.New(1),
-	}
-	poly2 := polynomial{
-		curve.Scalar.New(1),
-		curve.Scalar.New(2),
-		curve.Scalar.New(3),
-	}
-
-	output, err := poly1.Sub(poly2)
-	require.Error(t, err)
-	require.Nil(t, output)
-}
-
-func TestMulAssignPoly(t *testing.T) {
-	curve := curves.BLS12381(&curves.PointBls12381G1{})
-	// Test polynomial with equal length
-	poly1 := polynomial{
-		curve.Scalar.New(3),
-		curve.Scalar.New(2),
-		curve.Scalar.New(1),
-	}
-	poly2 := polynomial{
-		curve.Scalar.New(1),
-		curve.Scalar.New(2),
-		curve.Scalar.New(3),
-	}
-
-	output, err := poly1.Mul(poly2)
-	require.NoError(t, err)
-	require.NotNil(t, output)
-	result := []curves.Scalar{
-		curve.Scalar.New(3),
-		curve.Scalar.New(8),
-		curve.Scalar.New(14),
-		curve.Scalar.New(8),
-		curve.Scalar.New(3),
-	}
-	for i := 0; i < len(result); i++ {
-		require.Equal(t, output[i].Bytes(), result[i].Bytes())
-	}
-
-	// Test polynomials with unequal length
-	poly3 := polynomial{
-		curve.Scalar.New(1),
-		curve.Scalar.New(2),
-	}
-	output2, err := poly1.Mul(poly3)
-	require.NoError(t, err)
-	require.NotNil(t, output2)
-	result2 := []curves.Scalar{
-		curve.Scalar.New(3),
-		curve.Scalar.New(8),
-		curve.Scalar.New(5),
-		curve.Scalar.New(2),
-	}
-	require.Equal(t, len(output2), 4)
-	for i := 0; i < len(output2); i++ {
-		require.Equal(t, output2[i].Bytes(), result2[i].Bytes())
-	}
-}
-
-func TestMulAssignPolyError(t *testing.T) {
-	curve := curves.BLS12381(&curves.PointBls12381G1{})
-	poly1 := polynomial{
-		nil,
-		curve.Scalar.New(2),
-		curve.Scalar.New(1),
-	}
-	poly2 := polynomial{
-		curve.Scalar.New(1),
-		curve.Scalar.New(2),
-		curve.Scalar.New(3),
-	}
-	output, err := poly1.Mul(poly2)
-	require.Error(t, err)
-	require.Nil(t, output)
-}
-
-func TestMulValueAssignPoly(t *testing.T) {
-	curve := curves.BLS12381(&curves.PointBls12381G1{})
-	poly := polynomial{
-		curve.Scalar.New(3),
-		curve.Scalar.New(2),
-		curve.Scalar.New(1),
-	}
-	rhs := curve.Scalar.New(3)
-	output, err := poly.MulScalar(rhs)
-	require.NoError(t, err)
-	require.NotNil(t, output)
-	coefficients2 := []curves.Scalar{
-		curve.Scalar.New(9),
-		curve.Scalar.New(6),
-		curve.Scalar.New(3),
-	}
-	for i := 0; i < len(coefficients2); i++ {
-		require.Equal(t, output[i].Bytes(), coefficients2[i].Bytes())
-	}
-}
-
-func TestMulValueAssignPolyError(t *testing.T) {
-	curve := curves.BLS12381(&curves.PointBls12381G1{})
-	poly := polynomial{
-		nil,
-		curve.Scalar.New(2),
-		curve.Scalar.New(1),
-	}
-	rhs := curve.Scalar.New(3)
-	output, err := poly.MulScalar(rhs)
-	require.Error(t, err)
-	require.Nil(t, output)
-}

pkg/crypto/accumulator/proof.go

@@ -1,518 +0,0 @@
-//
-// Copyright Coinbase, Inc. All Rights Reserved.
-//
-// SPDX-License-Identifier: Apache-2.0
-//
-
-package accumulator
-
-import (
-	"bytes"
-	crand "crypto/rand"
-	"errors"
-	"fmt"
-
-	"git.sr.ht/~sircmpwn/go-bare"
-
-	"github.com/onsonr/sonr/pkg/crypto/core/curves"
-)
-
-type proofParamsMarshal struct {
-	X     []byte `bare:"x"`
-	Y     []byte `bare:"y"`
-	Z     []byte `bare:"z"`
-	Curve string `bare:"curve"`
-}
-
-// ProofParams contains four distinct public generators of G1 - X, Y, Z
-type ProofParams struct {
-	x, y, z curves.Point
-}
-
-// New samples X, Y, Z, K
-func (p *ProofParams) New(curve *curves.PairingCurve, pk *PublicKey, entropy []byte) (*ProofParams, error) {
-	pkBytes, err := pk.MarshalBinary()
-	if err != nil {
-		return nil, err
-	}
-	prefix := bytes.Repeat([]byte{0xFF}, 32)
-	data := append(prefix, entropy...)
-	data = append(data, pkBytes...)
-	p.z = curve.Scalar.Point().Hash(data)
-
-	data[0] = 0xFE
-	p.y = curve.Scalar.Point().Hash(data)
-
-	data[0] = 0xFD
-	p.x = curve.Scalar.Point().Hash(data)
-
-	return p, nil
-}
-
-// MarshalBinary converts ProofParams to bytes
-func (p *ProofParams) MarshalBinary() ([]byte, error) {
-	if p.x == nil || p.y == nil || p.z == nil {
-		return nil, fmt.Errorf("some value x, y, or z is nil")
-	}
-	tv := &proofParamsMarshal{
-		X:     p.x.ToAffineCompressed(),
-		Y:     p.y.ToAffineCompressed(),
-		Z:     p.z.ToAffineCompressed(),
-		Curve: p.x.CurveName(),
-	}
-	return bare.Marshal(tv)
-}
-
-// UnmarshalBinary converts bytes to ProofParams
-func (p *ProofParams) UnmarshalBinary(data []byte) error {
-	if data == nil {
-		return fmt.Errorf("expected non-zero byte sequence")
-	}
-	tv := new(proofParamsMarshal)
-	err := bare.Unmarshal(data, tv)
-	if err != nil {
-		return err
-	}
-	curve := curves.GetCurveByName(tv.Curve)
-	if curve == nil {
-		return fmt.Errorf("invalid curve")
-	}
-	x, err := curve.NewIdentityPoint().FromAffineCompressed(tv.X)
-	if err != nil {
-		return err
-	}
-	y, err := curve.NewIdentityPoint().FromAffineCompressed(tv.Y)
-	if err != nil {
-		return err
-	}
-	z, err := curve.NewIdentityPoint().FromAffineCompressed(tv.Z)
-	if err != nil {
-		return err
-	}
-	p.x = x
-	p.y = y
-	p.z = z
-	return nil
-}
-
-// MembershipProofCommitting contains value computed in Proof of knowledge and
-// Blinding phases as described in section 7 of https://eprint.iacr.org/2020/777.pdf
-type MembershipProofCommitting struct {
-	eC             curves.Point
-	tSigma         curves.Point
-	tRho           curves.Point
-	deltaSigma     curves.Scalar
-	deltaRho       curves.Scalar
-	blindingFactor curves.Scalar
-	rSigma         curves.Scalar
-	rRho           curves.Scalar
-	rDeltaSigma    curves.Scalar
-	rDeltaRho      curves.Scalar
-	sigma          curves.Scalar
-	rho            curves.Scalar
-	capRSigma      curves.Point
-	capRRho        curves.Point
-	capRDeltaSigma curves.Point
-	capRDeltaRho   curves.Point
-	capRE          curves.Scalar
-	accumulator    curves.Point
-	witnessValue   curves.Scalar
-	xG1            curves.Point
-	yG1            curves.Point
-	zG1            curves.Point
-}
-
-// New initiates values of MembershipProofCommitting
-func (mpc *MembershipProofCommitting) New(
-	witness *MembershipWitness,
-	acc *Accumulator,
-	pp *ProofParams,
-	pk *PublicKey,
-) (*MembershipProofCommitting, error) {
-	// Randomly select σ, ρ
-	sigma := witness.y.Random(crand.Reader)
-	rho := witness.y.Random(crand.Reader)
-
-	// E_C = C + (σ + ρ)Z
-	t := sigma
-	t = t.Add(rho)
-	eC := pp.z
-	eC = eC.Mul(t)
-	eC = eC.Add(witness.c)
-
-	// T_σ = σX
-	tSigma := pp.x
-	tSigma = tSigma.Mul(sigma)
-
-	// T_ρ = ρY
-	tRho := pp.y
-	tRho = tRho.Mul(rho)
-
-	// δ_σ = yσ
-	deltaSigma := witness.y
-	deltaSigma = deltaSigma.Mul(sigma)
-
-	// δ_ρ = yρ
-	deltaRho := witness.y
-	deltaRho = deltaRho.Mul(rho)
-
-	// Randomly pick r_σ,r_ρ,r_δσ,r_δρ
-	rY := witness.y.Random(crand.Reader)
-	rSigma := witness.y.Random(crand.Reader)
-	rRho := witness.y.Random(crand.Reader)
-	rDeltaSigma := witness.y.Random(crand.Reader)
-	rDeltaRho := witness.y.Random(crand.Reader)
-
-	// R_σ = r_σ X
-	capRSigma := pp.x
-	capRSigma = capRSigma.Mul(rSigma)
-
-	// R_ρ = ρY
-	capRRho := pp.y
-	capRRho = capRRho.Mul(rRho)
-
-	// R_δσ = r_y T_σ - r_δσ X
-	negX := pp.x
-	negX = negX.Neg()
-	capRDeltaSigma := tSigma.Mul(rY)
-	capRDeltaSigma = capRDeltaSigma.Add(negX.Mul(rDeltaSigma))
-
-	// R_δρ = r_y T_ρ - r_δρ Y
-	negY := pp.y
-	negY = negY.Neg()
-	capRDeltaRho := tRho.Mul(rY)
-	capRDeltaRho = capRDeltaRho.Add(negY.Mul(rDeltaRho))
-
-	// P~
-	g2 := pk.value.Generator()
-
-	// -r_δσ - r_δρ
-	exp := rDeltaSigma
-	exp = exp.Add(rDeltaRho)
-	exp = exp.Neg()
-
-	// -r_σ - r_ρ
-	exp2 := rSigma
-	exp2 = exp2.Add(rRho)
-	exp2 = exp2.Neg()
-
-	// rY * eC
-	rYeC := eC.Mul(rY)
-
-	// (-r_δσ - r_δρ)*Z
-	expZ := pp.z.Mul(exp)
-
-	// (-r_σ - r_ρ)*Z
-	exp2Z := pp.z.Mul(exp2)
-
-	// Prepare
-	rYeCPrep, ok := rYeC.(curves.PairingPoint)
-	if !ok {
-		return nil, errors.New("incorrect type conversion")
-	}
-	g2Prep, ok := g2.(curves.PairingPoint)
-	if !ok {
-		return nil, errors.New("incorrect type conversion")
-	}
-	expZPrep, ok := expZ.(curves.PairingPoint)
-	if !ok {
-		return nil, errors.New("incorrect type conversion")
-	}
-	exp2ZPrep, ok := exp2Z.(curves.PairingPoint)
-	if !ok {
-		return nil, errors.New("incorrect type conversion")
-	}
-	pkPrep := pk.value
-
-	// Pairing
-	capRE := g2Prep.MultiPairing(rYeCPrep, g2Prep, expZPrep, g2Prep, exp2ZPrep, pkPrep)
-
-	return &MembershipProofCommitting{
-		eC,
-		tSigma,
-		tRho,
-		deltaSigma,
-		deltaRho,
-		rY,
-		rSigma,
-		rRho,
-		rDeltaSigma,
-		rDeltaRho,
-		sigma,
-		rho,
-		capRSigma,
-		capRRho,
-		capRDeltaSigma,
-		capRDeltaRho,
-		capRE,
-		acc.value,
-		witness.y,
-		pp.x,
-		pp.y,
-		pp.z,
-	}, nil
-}
-
-// GetChallenge returns bytes that need to be hashed for generating challenge.
-// V || Ec || T_sigma || T_rho || R_E || R_sigma || R_rho || R_delta_sigma || R_delta_rho
-func (mpc MembershipProofCommitting) GetChallengeBytes() []byte {
-	res := mpc.accumulator.ToAffineCompressed()
-	res = append(res, mpc.eC.ToAffineCompressed()...)
-	res = append(res, mpc.tSigma.ToAffineCompressed()...)
-	res = append(res, mpc.tRho.ToAffineCompressed()...)
-	res = append(res, mpc.capRE.Bytes()...)
-	res = append(res, mpc.capRSigma.ToAffineCompressed()...)
-	res = append(res, mpc.capRRho.ToAffineCompressed()...)
-	res = append(res, mpc.capRDeltaSigma.ToAffineCompressed()...)
-	res = append(res, mpc.capRDeltaRho.ToAffineCompressed()...)
-	return res
-}
-
-// GenProof computes the s values for Fiat-Shamir and return the actual
-// proof to be sent to the verifier given the challenge c.
-func (mpc *MembershipProofCommitting) GenProof(c curves.Scalar) *MembershipProof {
-	// s_y = r_y + c*y
-	sY := schnorr(mpc.blindingFactor, mpc.witnessValue, c)
-	// s_σ = r_σ + c*σ
-	sSigma := schnorr(mpc.rSigma, mpc.sigma, c)
-	// s_ρ = r_ρ + c*ρ
-	sRho := schnorr(mpc.rRho, mpc.rho, c)
-	// s_δσ = rδσ + c*δ_σ
-	sDeltaSigma := schnorr(mpc.rDeltaSigma, mpc.deltaSigma, c)
-	// s_δρ = rδρ + c*δ_ρ
-	sDeltaRho := schnorr(mpc.rDeltaRho, mpc.deltaRho, c)
-
-	return &MembershipProof{
-		mpc.eC,
-		mpc.tSigma,
-		mpc.tRho,
-		sSigma,
-		sRho,
-		sDeltaSigma,
-		sDeltaRho,
-		sY,
-	}
-}
-
-func schnorr(r, v, challenge curves.Scalar) curves.Scalar {
-	res := v
-	res = res.Mul(challenge)
-	res = res.Add(r)
-	return res
-}
-
-type membershipProofMarshal struct {
-	EC          []byte `bare:"e_c"`
-	TSigma      []byte `bare:"t_sigma"`
-	TRho        []byte `bare:"t_rho"`
-	SSigma      []byte `bare:"s_sigma"`
-	SRho        []byte `bare:"s_rho"`
-	SDeltaSigma []byte `bare:"s_delta_sigma"`
-	SDeltaRho   []byte `bare:"s_delta_rho"`
-	SY          []byte `bare:"s_y"`
-	Curve       string `bare:"curve"`
-}
-
-// MembershipProof contains values in the proof to be verified
-type MembershipProof struct {
-	eC          curves.Point
-	tSigma      curves.Point
-	tRho        curves.Point
-	sSigma      curves.Scalar
-	sRho        curves.Scalar
-	sDeltaSigma curves.Scalar
-	sDeltaRho   curves.Scalar
-	sY          curves.Scalar
-}
-
-// Finalize computes values in the proof to be verified.
-func (mp *MembershipProof) Finalize(acc *Accumulator, pp *ProofParams, pk *PublicKey, challenge curves.Scalar) (*MembershipProofFinal, error) {
-	// R_σ = s_δ X + c T_σ
-	negTSigma := mp.tSigma
-	negTSigma = negTSigma.Neg()
-	capRSigma := pp.x.Mul(mp.sSigma)
-	capRSigma = capRSigma.Add(negTSigma.Mul(challenge))
-
-	// R_ρ = s_ρ Y + c T_ρ
-	negTRho := mp.tRho
-	negTRho = negTRho.Neg()
-	capRRho := pp.y.Mul(mp.sRho)
-	capRRho = capRRho.Add(negTRho.Mul(challenge))
-
-	// R_δσ =  s_y T_σ - s_δσ X
-	negX := pp.x
-	negX = negX.Neg()
-	capRDeltaSigma := mp.tSigma.Mul(mp.sY)
-	capRDeltaSigma = capRDeltaSigma.Add(negX.Mul(mp.sDeltaSigma))
-
-	// R_δρ =  s_y T_ρ - s_δρ Y
-	negY := pp.y
-	negY = negY.Neg()
-	capRDeltaRho := mp.tRho.Mul(mp.sY)
-	capRDeltaRho = capRDeltaRho.Add(negY.Mul(mp.sDeltaRho))
-
-	// tildeP
-	g2 := pk.value.Generator()
-
-	// Compute capRE, the pairing
-	// E_c * s_y
-	eCsY := mp.eC.Mul(mp.sY)
-
-	// (-s_delta_sigma - s_delta_rho) * Z
-	exp := mp.sDeltaSigma
-	exp = exp.Add(mp.sDeltaRho)
-	exp = exp.Neg()
-	expZ := pp.z.Mul(exp)
-
-	// (-c) * V
-	exp = challenge.Neg()
-	expV := acc.value.Mul(exp)
-
-	// E_c * s_y + (-s_delta_sigma - s_delta_rho) * Z + (-c) * V
-	lhs := eCsY.Add(expZ).Add(expV)
-
-	// (-s_sigma - s_rho) * Z
-	exp = mp.sSigma
-	exp = exp.Add(mp.sRho)
-	exp = exp.Neg()
-	expZ2 := pp.z.Mul(exp)
-
-	// E_c * c
-	cEc := mp.eC.Mul(challenge)
-
-	// (-s_sigma - s_rho) * Z + E_c * c
-	rhs := cEc.Add(expZ2)
-
-	// Prepare
-	lhsPrep, ok := lhs.(curves.PairingPoint)
-	if !ok {
-		return nil, errors.New("incorrect type conversion")
-	}
-	g2Prep, ok := g2.(curves.PairingPoint)
-	if !ok {
-		return nil, errors.New("incorrect type conversion")
-	}
-	rhsPrep, ok := rhs.(curves.PairingPoint)
-	if !ok {
-		return nil, errors.New("incorrect type conversion")
-	}
-	pkPrep := pk.value
-
-	// capRE
-	capRE := g2Prep.MultiPairing(lhsPrep, g2Prep, rhsPrep, pkPrep)
-
-	return &MembershipProofFinal{
-		acc.value,
-		mp.eC,
-		mp.tSigma,
-		mp.tRho,
-		capRE,
-		capRSigma,
-		capRRho,
-		capRDeltaSigma,
-		capRDeltaRho,
-	}, nil
-}
-
-// MarshalBinary converts MembershipProof to bytes
-func (mp MembershipProof) MarshalBinary() ([]byte, error) {
-	tv := &membershipProofMarshal{
-		EC:          mp.eC.ToAffineCompressed(),
-		TSigma:      mp.tSigma.ToAffineCompressed(),
-		TRho:        mp.tRho.ToAffineCompressed(),
-		SSigma:      mp.sSigma.Bytes(),
-		SRho:        mp.sRho.Bytes(),
-		SDeltaSigma: mp.sDeltaSigma.Bytes(),
-		SDeltaRho:   mp.sDeltaRho.Bytes(),
-		SY:          mp.sY.Bytes(),
-		Curve:       mp.eC.CurveName(),
-	}
-	return bare.Marshal(tv)
-}
-
-// UnmarshalBinary converts bytes to MembershipProof
-func (mp *MembershipProof) UnmarshalBinary(data []byte) error {
-	if data == nil {
-		return fmt.Errorf("expected non-zero byte sequence")
-	}
-	tv := new(membershipProofMarshal)
-	err := bare.Unmarshal(data, tv)
-	if err != nil {
-		return err
-	}
-	curve := curves.GetCurveByName(tv.Curve)
-	if curve == nil {
-		return fmt.Errorf("invalid curve")
-	}
-	eC, err := curve.NewIdentityPoint().FromAffineCompressed(tv.EC)
-	if err != nil {
-		return err
-	}
-	tSigma, err := curve.NewIdentityPoint().FromAffineCompressed(tv.TSigma)
-	if err != nil {
-		return err
-	}
-	tRho, err := curve.NewIdentityPoint().FromAffineCompressed(tv.TRho)
-	if err != nil {
-		return err
-	}
-	sSigma, err := curve.NewScalar().SetBytes(tv.SSigma)
-	if err != nil {
-		return err
-	}
-	sRho, err := curve.NewScalar().SetBytes(tv.SRho)
-	if err != nil {
-		return err
-	}
-	sDeltaSigma, err := curve.NewScalar().SetBytes(tv.SDeltaSigma)
-	if err != nil {
-		return err
-	}
-	sDeltaRho, err := curve.NewScalar().SetBytes(tv.SDeltaRho)
-	if err != nil {
-		return err
-	}
-	sY, err := curve.NewScalar().SetBytes(tv.SY)
-	if err != nil {
-		return err
-	}
-
-	mp.eC = eC
-	mp.tSigma = tSigma
-	mp.tRho = tRho
-	mp.sSigma = sSigma
-	mp.sRho = sRho
-	mp.sDeltaSigma = sDeltaSigma
-	mp.sDeltaRho = sDeltaRho
-	mp.sY = sY
-
-	return nil
-}
-
-// MembershipProofFinal contains values that are input to Fiat-Shamir Heuristic
-type MembershipProofFinal struct {
-	accumulator    curves.Point
-	eC             curves.Point
-	tSigma         curves.Point
-	tRho           curves.Point
-	capRE          curves.Scalar
-	capRSigma      curves.Point
-	capRRho        curves.Point
-	capRDeltaSigma curves.Point
-	capRDeltaRho   curves.Point
-}
-
-// GetChallenge computes Fiat-Shamir Heuristic taking input values of MembershipProofFinal
-func (m MembershipProofFinal) GetChallenge(curve *curves.PairingCurve) curves.Scalar {
-	res := m.accumulator.ToAffineCompressed()
-	res = append(res, m.eC.ToAffineCompressed()...)
-	res = append(res, m.tSigma.ToAffineCompressed()...)
-	res = append(res, m.tRho.ToAffineCompressed()...)
-	res = append(res, m.capRE.Bytes()...)
-	res = append(res, m.capRSigma.ToAffineCompressed()...)
-	res = append(res, m.capRRho.ToAffineCompressed()...)
-	res = append(res, m.capRDeltaSigma.ToAffineCompressed()...)
-	res = append(res, m.capRDeltaRho.ToAffineCompressed()...)
-	challenge := curve.Scalar.Hash(res)
-	return challenge
-}

pkg/crypto/accumulator/proof_test.go

@@ -1,182 +0,0 @@
-//
-// Copyright Coinbase, Inc. All Rights Reserved.
-//
-// SPDX-License-Identifier: Apache-2.0
-//
-
-package accumulator
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/onsonr/sonr/pkg/crypto/core/curves"
-)
-
-func TestProofParamsMarshal(t *testing.T) {
-	curve := curves.BLS12381(&curves.PointBls12381G1{})
-	sk, _ := new(SecretKey).New(curve, []byte("1234567890"))
-	pk, _ := sk.GetPublicKey(curve)
-
-	params, err := new(ProofParams).New(curve, pk, []byte("entropy"))
-	require.NoError(t, err)
-	require.NotNil(t, params.x)
-	require.NotNil(t, params.y)
-	require.NotNil(t, params.z)
-
-	bytes, err := params.MarshalBinary()
-	require.NoError(t, err)
-	require.NotNil(t, bytes)
-
-	params2 := &ProofParams{
-		curve.PointG1.Generator(),
-		curve.PointG1.Generator(),
-		curve.PointG1.Generator(),
-	}
-	err = params2.UnmarshalBinary(bytes)
-	require.NoError(t, err)
-	require.True(t, params.x.Equal(params2.x))
-	require.True(t, params.y.Equal(params2.y))
-	require.True(t, params.z.Equal(params2.z))
-}
-
-func TestMembershipProof(t *testing.T) {
-	curve := curves.BLS12381(&curves.PointBls12381G1{})
-	sk, _ := new(SecretKey).New(curve, []byte("1234567890"))
-	pk, _ := sk.GetPublicKey(curve)
-
-	element1 := curve.Scalar.Hash([]byte("3"))
-	element2 := curve.Scalar.Hash([]byte("4"))
-	element3 := curve.Scalar.Hash([]byte("5"))
-	element4 := curve.Scalar.Hash([]byte("6"))
-	element5 := curve.Scalar.Hash([]byte("7"))
-	element6 := curve.Scalar.Hash([]byte("8"))
-	element7 := curve.Scalar.Hash([]byte("9"))
-	elements := []Element{element1, element2, element3, element4, element5, element6, element7}
-
-	// Initiate a new accumulator
-	acc, err := new(Accumulator).WithElements(curve, sk, elements)
-	require.NoError(t, err)
-	require.NotNil(t, acc.value)
-
-	// Initiate a new membership witness for value elements[3]
-	wit, err := new(MembershipWitness).New(elements[3], acc, sk)
-	require.NoError(t, err)
-	require.Equal(t, wit.y, elements[3])
-
-	// Create proof parameters, which contains randomly sampled G1 points X, Y, Z, K
-	params, err := new(ProofParams).New(curve, pk, []byte("entropy"))
-	require.NoError(t, err)
-	require.NotNil(t, params.x)
-	require.NotNil(t, params.y)
-	require.NotNil(t, params.z)
-
-	mpc, err := new(MembershipProofCommitting).New(wit, acc, params, pk)
-	require.NoError(t, err)
-	testMPC(t, mpc)
-
-	challenge := curve.Scalar.Hash(mpc.GetChallengeBytes())
-	require.NotNil(t, challenge)
-
-	proof := mpc.GenProof(challenge)
-	require.NotNil(t, proof)
-	testProof(t, proof)
-
-	finalProof, err := proof.Finalize(acc, params, pk, challenge)
-	require.NoError(t, err)
-	require.NotNil(t, finalProof)
-	testFinalProof(t, finalProof)
-
-	challenge2 := finalProof.GetChallenge(curve)
-	require.Equal(t, challenge, challenge2)
-
-	// Check we can still have a valid proof even if accumulator and witness are updated
-	data1 := curve.Scalar.Hash([]byte("1"))
-	data2 := curve.Scalar.Hash([]byte("2"))
-	data3 := curve.Scalar.Hash([]byte("3"))
-	data4 := curve.Scalar.Hash([]byte("4"))
-	data5 := curve.Scalar.Hash([]byte("5"))
-	data := []Element{data1, data2, data3, data4, data5}
-	additions := data[0:2]
-	deletions := data[2:5]
-	_, coefficients, err := acc.Update(sk, additions, deletions)
-	require.NoError(t, err)
-	require.NotNil(t, coefficients)
-
-	_, err = wit.BatchUpdate(additions, deletions, coefficients)
-	require.NoError(t, err)
-
-	newParams, err := new(ProofParams).New(curve, pk, []byte("entropy"))
-	require.NoError(t, err)
-	require.NotNil(t, newParams.x)
-	require.NotNil(t, newParams.y)
-	require.NotNil(t, newParams.z)
-
-	newMPC, err := new(MembershipProofCommitting).New(wit, acc, newParams, pk)
-	require.NoError(t, err)
-	testMPC(t, newMPC)
-
-	challenge3 := curve.Scalar.Hash(newMPC.GetChallengeBytes())
-	require.NotNil(t, challenge3)
-
-	newProof := newMPC.GenProof(challenge3)
-	require.NotNil(t, newProof)
-	testProof(t, newProof)
-
-	newFinalProof, err := newProof.Finalize(acc, newParams, pk, challenge3)
-	require.NoError(t, err)
-	require.NotNil(t, newFinalProof)
-	testFinalProof(t, newFinalProof)
-
-	challenge4 := newFinalProof.GetChallenge(curve)
-	require.Equal(t, challenge3, challenge4)
-}
-
-func testMPC(t *testing.T, mpc *MembershipProofCommitting) {
-	require.NotNil(t, mpc.eC)
-	require.NotNil(t, mpc.tSigma)
-	require.NotNil(t, mpc.tRho)
-	require.NotNil(t, mpc.deltaSigma)
-	require.NotNil(t, mpc.deltaRho)
-	require.NotNil(t, mpc.blindingFactor)
-	require.NotNil(t, mpc.rSigma)
-	require.NotNil(t, mpc.rRho)
-	require.NotNil(t, mpc.rDeltaSigma)
-	require.NotNil(t, mpc.rDeltaRho)
-	require.NotNil(t, mpc.sigma)
-	require.NotNil(t, mpc.rho)
-	require.NotNil(t, mpc.capRSigma)
-	require.NotNil(t, mpc.capRRho)
-	require.NotNil(t, mpc.capRDeltaSigma)
-	require.NotNil(t, mpc.capRDeltaRho)
-	require.NotNil(t, mpc.capRE)
-	require.NotNil(t, mpc.accumulator)
-	require.NotNil(t, mpc.witnessValue)
-	require.NotNil(t, mpc.xG1)
-	require.NotNil(t, mpc.yG1)
-	require.NotNil(t, mpc.zG1)
-}
-
-func testProof(t *testing.T, proof *MembershipProof) {
-	require.NotNil(t, proof.eC)
-	require.NotNil(t, proof.tSigma)
-	require.NotNil(t, proof.tRho)
-	require.NotNil(t, proof.sSigma)
-	require.NotNil(t, proof.sRho)
-	require.NotNil(t, proof.sDeltaSigma)
-	require.NotNil(t, proof.sDeltaRho)
-	require.NotNil(t, proof.sY)
-}
-
-func testFinalProof(t *testing.T, finalProof *MembershipProofFinal) {
-	require.NotNil(t, finalProof.accumulator)
-	require.NotNil(t, finalProof.eC)
-	require.NotNil(t, finalProof.tSigma)
-	require.NotNil(t, finalProof.tRho)
-	require.NotNil(t, finalProof.capRE)
-	require.NotNil(t, finalProof.capRSigma)
-	require.NotNil(t, finalProof.capRRho)
-	require.NotNil(t, finalProof.capRDeltaSigma)
-	require.NotNil(t, finalProof.capRDeltaRho)
-}

pkg/crypto/accumulator/witness.go

@@ -1,375 +0,0 @@
-//
-// Copyright Coinbase, Inc. All Rights Reserved.
-//
-// SPDX-License-Identifier: Apache-2.0
-//
-
-package accumulator
-
-import (
-	"errors"
-	"fmt"
-
-	"git.sr.ht/~sircmpwn/go-bare"
-
-	"github.com/onsonr/sonr/pkg/crypto/core/curves"
-)
-
-// MembershipWitness contains the witness c and the value y respect to the accumulator state.
-type MembershipWitness struct {
-	c curves.Point
-	y curves.Scalar
-}
-
-// New creates a new membership witness
-func (mw *MembershipWitness) New(y Element, acc *Accumulator, sk *SecretKey) (*MembershipWitness, error) {
-	if acc.value == nil || acc.value.IsIdentity() {
-		return nil, fmt.Errorf("value of accumulator should not be nil")
-	}
-	if sk.value == nil || sk.value.IsZero() {
-		return nil, fmt.Errorf("secret key should not be nil")
-	}
-	if y == nil || y.IsZero() {
-		return nil, fmt.Errorf("y should not be nil")
-	}
-	newAcc := &Accumulator{acc.value}
-	_, err := newAcc.Remove(sk, y)
-	if err != nil {
-		return nil, err
-	}
-	mw.c = newAcc.value
-	mw.y = y.Add(y.Zero())
-	return mw, nil
-}
-
-// Verify the MembershipWitness mw is a valid witness as per section 4 in
-// <https://eprint.iacr.org/2020/777>
-func (mw MembershipWitness) Verify(pk *PublicKey, acc *Accumulator) error {
-	if mw.c == nil || mw.y == nil || mw.c.IsIdentity() || mw.y.IsZero() {
-		return fmt.Errorf("c and y should not be nil")
-	}
-
-	if pk.value == nil || pk.value.IsIdentity() {
-		return fmt.Errorf("invalid public key")
-	}
-	if acc.value == nil || acc.value.IsIdentity() {
-		return fmt.Errorf("accumulator value should not be nil")
-	}
-
-	// Set -tildeP
-	g2, ok := pk.value.Generator().(curves.PairingPoint)
-	if !ok {
-		return errors.New("incorrect type conversion")
-	}
-
-	// y*tildeP + tildeQ, tildeP is a G2 generator.
-	p, ok := g2.Mul(mw.y).Add(pk.value).(curves.PairingPoint)
-	if !ok {
-		return errors.New("incorrect type conversion")
-	}
-
-	// Prepare
-	witness, ok := mw.c.(curves.PairingPoint)
-	if !ok {
-		return errors.New("incorrect type conversion")
-	}
-	v, ok := acc.value.Neg().(curves.PairingPoint)
-	if !ok {
-		return errors.New("incorrect type conversion")
-	}
-
-	// Check e(witness, y*tildeP + tildeQ) * e(-acc, tildeP) == Identity
-	result := p.MultiPairing(witness, p, v, g2)
-	if !result.IsOne() {
-		return fmt.Errorf("invalid result")
-	}
-
-	return nil
-}
-
-// ApplyDelta returns C' = dA(y)/dD(y)*C + 1/dD(y) * <Gamma_y, Omega>
-// according to the witness update protocol described in section 4 of
-// https://eprint.iacr.org/2020/777.pdf
-func (mw *MembershipWitness) ApplyDelta(delta *Delta) (*MembershipWitness, error) {
-	if mw.c == nil || mw.y == nil || delta == nil {
-		return nil, fmt.Errorf("y, c or delta should not be nil")
-	}
-
-	// C' = dA(y)/dD(y)*C + 1/dD(y) * <Gamma_y, Omega>
-	mw.c = mw.c.Mul(delta.d).Add(delta.p)
-	return mw, nil
-}
-
-// BatchUpdate performs batch update as described in section 4
-func (mw *MembershipWitness) BatchUpdate(additions []Element, deletions []Element, coefficients []Coefficient) (*MembershipWitness, error) {
-	delta, err := evaluateDelta(mw.y, additions, deletions, coefficients)
-	if err != nil {
-		return nil, err
-	}
-	mw, err = mw.ApplyDelta(delta)
-	if err != nil {
-		return nil, fmt.Errorf("applyDelta fails")
-	}
-	return mw, nil
-}
-
-// MultiBatchUpdate performs multi-batch update using epoch as described in section 4.2
-func (mw *MembershipWitness) MultiBatchUpdate(A [][]Element, D [][]Element, C [][]Coefficient) (*MembershipWitness, error) {
-	delta, err := evaluateDeltas(mw.y, A, D, C)
-	if err != nil {
-		return nil, fmt.Errorf("evaluateDeltas fails")
-	}
-	mw, err = mw.ApplyDelta(delta)
-	if err != nil {
-		return nil, err
-	}
-	return mw, nil
-}
-
-// MarshalBinary converts a membership witness to bytes
-func (mw MembershipWitness) MarshalBinary() ([]byte, error) {
-	if mw.c == nil || mw.y == nil {
-		return nil, fmt.Errorf("c and y value should not be nil")
-	}
-
-	result := append(mw.c.ToAffineCompressed(), mw.y.Bytes()...)
-	tv := &structMarshal{
-		Value: result,
-		Curve: mw.c.CurveName(),
-	}
-	return bare.Marshal(tv)
-}
-
-// UnmarshalBinary converts bytes into MembershipWitness
-func (mw *MembershipWitness) UnmarshalBinary(data []byte) error {
-	if data == nil {
-		return fmt.Errorf("input data should not be nil")
-	}
-	tv := new(structMarshal)
-	err := bare.Unmarshal(data, tv)
-	if err != nil {
-		return err
-	}
-	curve := curves.GetCurveByName(tv.Curve)
-	if curve == nil {
-		return fmt.Errorf("invalid curve")
-	}
-
-	ptLength := len(curve.Point.ToAffineCompressed())
-	scLength := len(curve.Scalar.Bytes())
-	expectedLength := ptLength + scLength
-	if len(tv.Value) != expectedLength {
-		return fmt.Errorf("invalid byte sequence")
-	}
-	cValue, err := curve.Point.FromAffineCompressed(tv.Value[:ptLength])
-	if err != nil {
-		return err
-	}
-	yValue, err := curve.Scalar.SetBytes(tv.Value[ptLength:])
-	if err != nil {
-		return err
-	}
-	mw.c = cValue
-	mw.y = yValue
-	return nil
-}
-
-// Delta contains values d and p, where d should be the division dA(y)/dD(y) on some value y
-// p should be equal to 1/dD * <Gamma_y, Omega>
-type Delta struct {
-	d curves.Scalar
-	p curves.Point
-}
-
-// MarshalBinary converts Delta into bytes
-func (d *Delta) MarshalBinary() ([]byte, error) {
-	if d.d == nil || d.p == nil {
-		return nil, fmt.Errorf("d and p should not be nil")
-	}
-	var result []byte
-	result = append(result, d.p.ToAffineCompressed()...)
-	result = append(result, d.d.Bytes()...)
-	tv := &structMarshal{
-		Value: result,
-		Curve: d.p.CurveName(),
-	}
-	return bare.Marshal(tv)
-}
-
-// UnmarshalBinary converts data into Delta
-func (d *Delta) UnmarshalBinary(data []byte) error {
-	if data == nil {
-		return fmt.Errorf("expected non-zero byte sequence")
-	}
-
-	tv := new(structMarshal)
-	err := bare.Unmarshal(data, tv)
-	if err != nil {
-		return err
-	}
-	curve := curves.GetCurveByName(tv.Curve)
-	if curve == nil {
-		return fmt.Errorf("invalid curve")
-	}
-
-	ptLength := len(curve.Point.ToAffineCompressed())
-	scLength := len(curve.Scalar.Bytes())
-	expectedLength := ptLength + scLength
-	if len(tv.Value) != expectedLength {
-		return fmt.Errorf("invalid byte sequence")
-	}
-	pValue, err := curve.NewIdentityPoint().FromAffineCompressed(tv.Value[:ptLength])
-	if err != nil {
-		return err
-	}
-	dValue, err := curve.NewScalar().SetBytes(tv.Value[ptLength:])
-	if err != nil {
-		return err
-	}
-	d.d = dValue
-	d.p = pValue
-	return nil
-}
-
-// evaluateDeltas compute values used for membership witness batch update with epoch
-// as described in section 4.2, page 11 of https://eprint.iacr.org/2020/777.pdf
-func evaluateDeltas(y Element, A [][]Element, D [][]Element, C [][]Coefficient) (*Delta, error) {
-	if len(A) != len(D) || len(A) != len(C) {
-		return nil, fmt.Errorf("a, d, c should have same length")
-	}
-
-	one := y.One()
-	size := len(A)
-
-	// dA(x) =  ∏ 1..n (yA_i - x)
-	aa := make([]curves.Scalar, 0)
-	// dD(x) = ∏ 1..m (yD_i - x)
-	dd := make([]curves.Scalar, 0)
-
-	a := one
-	d := one
-
-	// dA_{a->b}(y) = ∏ a..b dAs(y)
-	// dD_{a->b}(y) = ∏ a..b dDs(y)
-	for i := 0; i < size; i++ {
-		adds := A[i]
-		dels := D[i]
-
-		// ta = dAs(y)
-		ta, err := dad(adds, y)
-		if err != nil {
-			return nil, fmt.Errorf("dad on additions fails")
-		}
-		// td = dDs(y)
-		td, err := dad(dels, y)
-		if err != nil {
-			return nil, fmt.Errorf("dad on deletions fails")
-		}
-		// ∏ a..b dAs(y)
-		a = a.Mul(ta)
-		// ∏ a..b dDs(y)
-		d = d.Mul(td)
-
-		aa = append(aa, ta)
-		dd = append(dd, td)
-	}
-
-	// If this fails, then this value was removed.
-	d, err := d.Invert()
-	if err != nil {
-		return nil, fmt.Errorf("no inverse exists")
-	}
-
-	// <Gamma_y, Omega>
-	p := make(polynomialPoint, 0, size)
-
-	// Ωi->j+1 = ∑ 1..t (dAt * dDt-1) · Ω
-	for i := 0; i < size; i++ {
-		// t = i+1
-		// ∏^(t-1)_(h=i+1)
-		ddh := one
-
-		// dDi→t−1 (y)
-		for h := 0; h < i; h++ {
-			ddh = ddh.Mul(dd[h])
-		}
-
-		// ∏^(j+1)_(k=t+1)
-		dak := one
-		// dAt->j(y)
-		for k := i + 1; k < size; k++ {
-			dak = dak.Mul(aa[k])
-		}
-
-		// dDi->t-1(y) * dAt->j(y)
-		dak = dak.Mul(ddh)
-		pp := make(polynomialPoint, len(C[i]))
-		for j := 0; j < len(pp); j++ {
-			pp[j] = C[i][j]
-		}
-
-		// dDi->t-1(y) * dAt->j(y) · Ω
-		pp, err := pp.Mul(dak)
-		if err != nil {
-			return nil, fmt.Errorf("pp.Mul fails")
-		}
-
-		p, err = p.Add(pp)
-		if err != nil {
-			return nil, fmt.Errorf("pp.Add fails")
-		}
-	}
-	// dAi->j(y)/dDi->j(y)
-	a = a.Mul(d)
-
-	// Ωi->j(y)
-	v, err := p.evaluate(y)
-	if err != nil {
-		return nil, fmt.Errorf("p.evaluate fails")
-	}
-
-	// (1/dDi->j(y)) * Ωi->j(y)
-	v = v.Mul(d)
-
-	// return
-	return &Delta{d: a, p: v}, nil
-}
-
-// evaluateDelta computes values used for membership witness batch update
-// as described in section 4.1 of https://eprint.iacr.org/2020/777.pdf
-func evaluateDelta(y Element, additions []Element, deletions []Element, coefficients []Coefficient) (*Delta, error) {
-	// dD(y) = ∏ 1..m (yD_i - y), d = 1/dD(y)
-	var err error
-	d, err := dad(deletions, y)
-	if err != nil {
-		return nil, fmt.Errorf("dad fails on deletions")
-	}
-	d, err = d.Invert()
-	if err != nil {
-		return nil, fmt.Errorf("no inverse exists")
-	}
-
-	// dA(y) =  ∏ 1..n (yA_i - y)
-	a, err := dad(additions, y)
-	if err != nil {
-		return nil, fmt.Errorf("dad fails on additions")
-	}
-	// dA(y)/dD(y)
-	a = a.Mul(d)
-
-	// Create a PolynomialG1 from coefficients
-	p := make(polynomialPoint, len(coefficients))
-	for i := 0; i < len(coefficients); i++ {
-		p[i] = coefficients[i]
-	}
-
-	// <Gamma_y, Omega>
-	v, err := p.evaluate(y)
-	if err != nil {
-		return nil, fmt.Errorf("p.evaluate fails")
-	}
-	// 1/dD * <Gamma_y, Omega>
-	v = v.Mul(d)
-
-	return &Delta{d: a, p: v}, nil
-}

pkg/crypto/accumulator/witness_test.go

@@ -1,229 +0,0 @@
-//
-// Copyright Coinbase, Inc. All Rights Reserved.
-//
-// SPDX-License-Identifier: Apache-2.0
-//
-
-package accumulator
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/onsonr/sonr/pkg/crypto/core/curves"
-)
-
-func Test_Membership_Witness_New(t *testing.T) {
-	curve := curves.BLS12381(&curves.PointBls12381G1{})
-	var seed [32]byte
-	key, _ := new(SecretKey).New(curve, seed[:])
-	acc, _ := new(Accumulator).New(curve)
-	e := curve.Scalar.New(2)
-	mw, err := new(MembershipWitness).New(e, acc, key)
-	require.NoError(t, err)
-	require.NotNil(t, mw.c)
-	require.NotNil(t, mw.y)
-}
-
-func Test_Membership_Witness_Marshal(t *testing.T) {
-	curve := curves.BLS12381(&curves.PointBls12381G1{})
-	mw := &MembershipWitness{
-		curve.PointG1.Generator().Mul(curve.Scalar.New(10)),
-		curve.Scalar.New(15),
-	}
-	data, err := mw.MarshalBinary()
-	require.NoError(t, err)
-	require.NotNil(t, data)
-	newMW := &MembershipWitness{}
-	err = newMW.UnmarshalBinary(data)
-	require.NoError(t, err)
-	require.True(t, mw.c.Equal(newMW.c))
-	require.Equal(t, 0, mw.y.Cmp(newMW.y))
-}
-
-func Test_Membership(t *testing.T) {
-	curve := curves.BLS12381(&curves.PointBls12381G1{})
-	sk, _ := new(SecretKey).New(curve, []byte("1234567890"))
-	pk, _ := sk.GetPublicKey(curve)
-
-	element1 := curve.Scalar.Hash([]byte("3"))
-	element2 := curve.Scalar.Hash([]byte("4"))
-	element3 := curve.Scalar.Hash([]byte("5"))
-	element4 := curve.Scalar.Hash([]byte("6"))
-	element5 := curve.Scalar.Hash([]byte("7"))
-	element6 := curve.Scalar.Hash([]byte("8"))
-	element7 := curve.Scalar.Hash([]byte("9"))
-	elements := []Element{element1, element2, element3, element4, element5, element6, element7}
-
-	// nm_witness_max works as well if set to value larger than 0 for this test.x
-	acc, err := new(Accumulator).WithElements(curve, sk, elements)
-	require.NoError(t, err)
-	require.NotNil(t, acc.value)
-	require.False(t, acc.value.IsIdentity())
-	require.True(t, acc.value.IsOnCurve())
-	require.NotEqual(t, acc.value, curve.NewG1GeneratorPoint())
-
-	wit, err := new(MembershipWitness).New(elements[3], acc, sk)
-	require.NoError(t, err)
-	require.Equal(t, wit.y, elements[3])
-
-	err = wit.Verify(pk, acc)
-	require.NoError(t, err)
-
-	// Test wrong cases, forge a wrong witness
-	wrongWit := MembershipWitness{
-		curve.PointG1.Identity(),
-		curve.Scalar.One(),
-	}
-	err = wrongWit.Verify(pk, acc)
-	require.Error(t, err)
-
-	// Test wrong cases, forge a wrong accumulator
-	wrongAcc := &Accumulator{
-		curve.PointG1.Generator(),
-	}
-	err = wit.Verify(pk, wrongAcc)
-	require.Error(t, err)
-}
-
-func Test_Membership_Batch_Update(t *testing.T) {
-	curve := curves.BLS12381(&curves.PointBls12381G1{})
-	sk, _ := new(SecretKey).New(curve, []byte("1234567890"))
-	pk, _ := sk.GetPublicKey(curve)
-
-	element1 := curve.Scalar.Hash([]byte("3"))
-	element2 := curve.Scalar.Hash([]byte("4"))
-	element3 := curve.Scalar.Hash([]byte("5"))
-	element4 := curve.Scalar.Hash([]byte("6"))
-	element5 := curve.Scalar.Hash([]byte("7"))
-	element6 := curve.Scalar.Hash([]byte("8"))
-	element7 := curve.Scalar.Hash([]byte("9"))
-	elements := []Element{element1, element2, element3, element4, element5, element6, element7}
-
-	// nm_witness_max works as well if set to value larger than 0 for this test.
-	acc, err := new(Accumulator).WithElements(curve, sk, elements)
-	require.NoError(t, err)
-	require.NotNil(t, acc.value)
-
-	wit, err := new(MembershipWitness).New(elements[3], acc, sk)
-	require.NoError(t, err)
-	require.Equal(t, wit.y, elements[3])
-
-	err = wit.Verify(pk, acc)
-	require.Nil(t, err)
-
-	data1 := curve.Scalar.Hash([]byte("1"))
-	data2 := curve.Scalar.Hash([]byte("2"))
-	data3 := curve.Scalar.Hash([]byte("3"))
-	data4 := curve.Scalar.Hash([]byte("4"))
-	data5 := curve.Scalar.Hash([]byte("5"))
-	data := []Element{data1, data2, data3, data4, data5}
-	additions := data[0:2]
-	deletions := data[2:5]
-	_, coefficients, err := acc.Update(sk, additions, deletions)
-	require.NoError(t, err)
-	require.NotNil(t, coefficients)
-
-	_, err = wit.BatchUpdate(additions, deletions, coefficients)
-	require.NoError(t, err)
-	err = wit.Verify(pk, acc)
-	require.Nil(t, err)
-}
-
-func Test_Membership_Multi_Batch_Update(t *testing.T) {
-	curve := curves.BLS12381(&curves.PointBls12381G1{})
-	sk, _ := new(SecretKey).New(curve, []byte("1234567890"))
-	pk, _ := sk.GetPublicKey(curve)
-
-	element1 := curve.Scalar.Hash([]byte("3"))
-	element2 := curve.Scalar.Hash([]byte("4"))
-	element3 := curve.Scalar.Hash([]byte("5"))
-	element4 := curve.Scalar.Hash([]byte("6"))
-	element5 := curve.Scalar.Hash([]byte("7"))
-	element6 := curve.Scalar.Hash([]byte("8"))
-	element7 := curve.Scalar.Hash([]byte("9"))
-	element8 := curve.Scalar.Hash([]byte("10"))
-	element9 := curve.Scalar.Hash([]byte("11"))
-	element10 := curve.Scalar.Hash([]byte("12"))
-	element11 := curve.Scalar.Hash([]byte("13"))
-	element12 := curve.Scalar.Hash([]byte("14"))
-	element13 := curve.Scalar.Hash([]byte("15"))
-	element14 := curve.Scalar.Hash([]byte("16"))
-	element15 := curve.Scalar.Hash([]byte("17"))
-	element16 := curve.Scalar.Hash([]byte("18"))
-	element17 := curve.Scalar.Hash([]byte("19"))
-	element18 := curve.Scalar.Hash([]byte("20"))
-	elements := []Element{
-		element1,
-		element2,
-		element3,
-		element4,
-		element5,
-		element6,
-		element7,
-		element8,
-		element9,
-		element10,
-		element11,
-		element12,
-		element13,
-		element14,
-		element15,
-		element16,
-		element17,
-		element18,
-	}
-	acc, err := new(Accumulator).WithElements(curve, sk, elements)
-	require.NoError(t, err)
-	require.NotNil(t, acc.value)
-
-	wit, err := new(MembershipWitness).New(elements[3], acc, sk)
-	require.NoError(t, err)
-
-	err = wit.Verify(pk, acc)
-	require.Nil(t, err)
-
-	data1 := curve.Scalar.Hash([]byte("1"))
-	data2 := curve.Scalar.Hash([]byte("2"))
-	data3 := curve.Scalar.Hash([]byte("3"))
-	data4 := curve.Scalar.Hash([]byte("4"))
-	data5 := curve.Scalar.Hash([]byte("5"))
-	data := []Element{data1, data2, data3, data4, data5}
-	adds1 := data[0:2]
-	dels1 := data[2:5]
-	_, coeffs1, err := acc.Update(sk, adds1, dels1)
-	require.NoError(t, err)
-	require.NotNil(t, coeffs1)
-
-	dels2 := elements[8:10]
-	_, coeffs2, err := acc.Update(sk, []Element{}, dels2)
-	require.NoError(t, err)
-	require.NotNil(t, coeffs2)
-
-	dels3 := elements[11:14]
-	_, coeffs3, err := acc.Update(sk, []Element{}, dels3)
-	require.NoError(t, err)
-	require.NotNil(t, coeffs3)
-
-	a := make([][]Element, 3)
-	a[0] = adds1
-	a[1] = []Element{}
-	a[2] = []Element{}
-
-	d := make([][]Element, 3)
-	d[0] = dels1
-	d[1] = dels2
-	d[2] = dels3
-
-	c := make([][]Coefficient, 3)
-	c[0] = coeffs1
-	c[1] = coeffs2
-	c[2] = coeffs3
-
-	_, err = wit.MultiBatchUpdate(a, d, c)
-	require.NoError(t, err)
-
-	err = wit.Verify(pk, acc)
-	require.Nil(t, err)
-}

pkg/crypto/bip32/bip32.go

@@ -1,66 +0,0 @@
-package bip32
-
-import (
-	"crypto/hmac"
-	"crypto/sha512"
-	"encoding/binary"
-	"errors"
-	"math/big"
-
-	"github.com/btcsuite/btcd/btcec/v2"
-)
-
-// ComputePublicKey computes the public key of a child key given the extended public key, chain code, and index.
-func ComputePublicKey(extPubKey []byte, chainCode uint32, index int) ([]byte, error) {
-	// Check if the index is a hardened child key
-	if chainCode&0x80000000 != 0 && index < 0 {
-		return nil, errors.New("invalid index")
-	}
-
-	// Serialize the public key
-	pubKey, err := btcec.ParsePubKey(extPubKey)
-	if err != nil {
-		return nil, err
-	}
-	pubKeyBytes := pubKey.SerializeCompressed()
-
-	// Serialize the index
-	indexBytes := make([]byte, 4)
-	binary.BigEndian.PutUint32(indexBytes, uint32(index))
-
-	// Compute the HMAC-SHA512
-	mac := hmac.New(sha512.New, []byte{byte(chainCode)})
-	mac.Write(pubKeyBytes)
-	mac.Write(indexBytes)
-	I := mac.Sum(nil)
-
-	// Split I into two 32-byte sequences
-	IL := I[:32]
-
-	// Convert IL to a big integer
-	ilNum := new(big.Int).SetBytes(IL)
-
-	// Check if parse256(IL) >= n
-	curve := btcec.S256()
-	if ilNum.Cmp(curve.N) >= 0 {
-		return nil, errors.New("invalid child key")
-	}
-
-	// Compute the child public key
-	ilx, ily := curve.ScalarBaseMult(IL)
-	childX, childY := curve.Add(ilx, ily, pubKey.X(), pubKey.Y())
-	lx := newBigIntFieldVal(childX)
-	ly := newBigIntFieldVal(childY)
-
-	// Create the child public key
-	childPubKey := btcec.NewPublicKey(lx, ly)
-	childPubKeyBytes := childPubKey.SerializeCompressed()
-	return childPubKeyBytes, nil
-}
-
-// newBigIntFieldVal creates a new field value from a big integer.
-func newBigIntFieldVal(val *big.Int) *btcec.FieldVal {
-	lx := new(btcec.FieldVal)
-	lx.SetByteSlice(val.Bytes())
-	return lx
-}

pkg/crypto/bulletproof/generators.go

@@ -1,57 +0,0 @@
-//
-// Copyright Coinbase, Inc. All Rights Reserved.
-//
-// SPDX-License-Identifier: Apache-2.0
-//
-
-package bulletproof
-
-import (
-	"github.com/pkg/errors"
-	"golang.org/x/crypto/sha3"
-
-	"github.com/onsonr/sonr/pkg/crypto/core/curves"
-)
-
-// generators contains a list of points to be used as generators for bulletproofs.
-type generators []curves.Point
-
-// ippGenerators holds generators necessary for an Inner Product Proof
-// It includes a single u generator, and a list of generators divided in half to G and H
-// See lines 10 on pg 16 of https://eprint.iacr.org/2017/1066.pdf
-type ippGenerators struct {
-	G generators
-	H generators
-}
-
-// getGeneratorPoints generates generators using HashToCurve with Shake256(domain) as input
-// lenVector is the length of the scalars used for the Inner Product Proof
-// getGeneratorPoints will return 2*lenVector + 1 total points, split between a single u generator
-// and G and H lists of vectors per the IPP specification
-// See lines 10 on pg 16 of https://eprint.iacr.org/2017/1066.pdf
-func getGeneratorPoints(lenVector int, domain []byte, curve curves.Curve) (*ippGenerators, error) {
-	shake := sha3.NewShake256()
-	_, err := shake.Write(domain)
-	if err != nil {
-		return nil, errors.Wrap(err, "getGeneratorPoints shake.Write")
-	}
-	numPoints := lenVector * 2
-	points := make([]curves.Point, numPoints)
-	for i := 0; i < numPoints; i++ {
-		bytes := [64]byte{}
-		_, err := shake.Read(bytes[:])
-		if err != nil {
-			return nil, errors.Wrap(err, "getGeneratorPoints shake.Read")
-		}
-		nextPoint := curve.Point.Hash(bytes[:])
-		points[i] = nextPoint
-	}
-	// Get G and H by splitting points in half
-	G, H, err := splitPointVector(points)
-	if err != nil {
-		return nil, errors.Wrap(err, "getGeneratorPoints splitPointVector")
-	}
-	out := ippGenerators{G: G, H: H}
-
-	return &out, nil
-}

pkg/crypto/bulletproof/generators_test.go

@@ -1,61 +0,0 @@
-package bulletproof
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/require"
-	"golang.org/x/crypto/sha3"
-
-	"github.com/onsonr/sonr/pkg/crypto/core/curves"
-)
-
-func TestGeneratorsHappyPath(t *testing.T) {
-	curve := curves.ED25519()
-	gs, err := getGeneratorPoints(10, []byte("test"), *curve)
-	gsConcatenated := concatIPPGenerators(*gs)
-	require.NoError(t, err)
-	require.Len(t, gs.G, 10)
-	require.Len(t, gs.H, 10)
-	require.True(t, noDuplicates(gsConcatenated))
-}
-
-func TestGeneratorsUniquePerDomain(t *testing.T) {
-	curve := curves.ED25519()
-	gs1, err := getGeneratorPoints(10, []byte("test"), *curve)
-	gs1Concatenated := concatIPPGenerators(*gs1)
-	require.NoError(t, err)
-	gs2, err := getGeneratorPoints(10, []byte("test2"), *curve)
-	gs2Concatenated := concatIPPGenerators(*gs2)
-	require.NoError(t, err)
-	require.True(t, areDisjoint(gs1Concatenated, gs2Concatenated))
-}
-
-func noDuplicates(gs generators) bool {
-	seen := map[[32]byte]bool{}
-	for _, G := range gs {
-		value := sha3.Sum256(G.ToAffineCompressed())
-		if seen[value] {
-			return false
-		}
-		seen[value] = true
-	}
-	return true
-}
-
-func areDisjoint(gs1, gs2 generators) bool {
-	for _, g1 := range gs1 {
-		for _, g2 := range gs2 {
-			if g1.Equal(g2) {
-				return false
-			}
-		}
-	}
-	return true
-}
-
-func concatIPPGenerators(ippGens ippGenerators) generators {
-	var out generators
-	out = append(out, ippGens.G...)
-	out = append(out, ippGens.H...)
-	return out
-}

pkg/crypto/bulletproof/helpers.go

@@ -1,181 +0,0 @@
-//
-// Copyright Coinbase, Inc. All Rights Reserved.
-//
-// SPDX-License-Identifier: Apache-2.0
-//
-
-package bulletproof
-
-import (
-	"github.com/pkg/errors"
-
-	"github.com/onsonr/sonr/pkg/crypto/core/curves"
-)
-
-// innerProduct takes two lists of scalars (a, b) and performs the dot product returning a single scalar.
-func innerProduct(a, b []curves.Scalar) (curves.Scalar, error) {
-	if len(a) != len(b) {
-		return nil, errors.New("length of scalar vectors must be the same")
-	}
-	if len(a) < 1 {
-		return nil, errors.New("length of vectors must be at least one")
-	}
-	// Get a new scalar of value zero of the same curve as input arguments
-	innerProduct := a[0].Zero()
-	for i, aElem := range a {
-		bElem := b[i]
-		// innerProduct = aElem*bElem + innerProduct
-		innerProduct = aElem.MulAdd(bElem, innerProduct)
-	}
-
-	return innerProduct, nil
-}
-
-// splitPointVector takes a vector of points, splits it in half returning each half.
-func splitPointVector(points []curves.Point) ([]curves.Point, []curves.Point, error) {
-	if len(points) < 1 {
-		return nil, nil, errors.New("length of points must be at least one")
-	}
-	if len(points)&0x01 != 0 {
-		return nil, nil, errors.New("length of points must be even")
-	}
-	nPrime := len(points) >> 1
-	firstHalf := points[:nPrime]
-	secondHalf := points[nPrime:]
-	return firstHalf, secondHalf, nil
-}
-
-// splitScalarVector takes a vector of scalars, splits it in half returning each half.
-func splitScalarVector(scalars []curves.Scalar) ([]curves.Scalar, []curves.Scalar, error) {
-	if len(scalars) < 1 {
-		return nil, nil, errors.New("length of scalars must be at least one")
-	}
-	if len(scalars)&0x01 != 0 {
-		return nil, nil, errors.New("length of scalars must be even")
-	}
-	nPrime := len(scalars) >> 1
-	firstHalf := scalars[:nPrime]
-	secondHalf := scalars[nPrime:]
-	return firstHalf, secondHalf, nil
-}
-
-// multiplyScalarToPointVector takes a single scalar and a list of points, multiplies each point by scalar.
-func multiplyScalarToPointVector(x curves.Scalar, g []curves.Point) []curves.Point {
-	products := make([]curves.Point, len(g))
-	for i, gElem := range g {
-		product := gElem.Mul(x)
-		products[i] = product
-	}
-
-	return products
-}
-
-// multiplyScalarToScalarVector takes a single scalar (x) and a list of scalars (a), multiplies each scalar in the vector by the scalar.
-func multiplyScalarToScalarVector(x curves.Scalar, a []curves.Scalar) []curves.Scalar {
-	products := make([]curves.Scalar, len(a))
-	for i, aElem := range a {
-		product := aElem.Mul(x)
-		products[i] = product
-	}
-
-	return products
-}
-
-// multiplyPairwisePointVectors takes two lists of points (g, h) and performs a pairwise multiplication returning a list of points.
-func multiplyPairwisePointVectors(g, h []curves.Point) ([]curves.Point, error) {
-	if len(g) != len(h) {
-		return nil, errors.New("length of point vectors must be the same")
-	}
-	product := make([]curves.Point, len(g))
-	for i, gElem := range g {
-		product[i] = gElem.Add(h[i])
-	}
-
-	return product, nil
-}
-
-// multiplyPairwiseScalarVectors takes two lists of points (a, b) and performs a pairwise multiplication returning a list of scalars.
-func multiplyPairwiseScalarVectors(a, b []curves.Scalar) ([]curves.Scalar, error) {
-	if len(a) != len(b) {
-		return nil, errors.New("length of point vectors must be the same")
-	}
-	product := make([]curves.Scalar, len(a))
-	for i, aElem := range a {
-		product[i] = aElem.Mul(b[i])
-	}
-
-	return product, nil
-}
-
-// addPairwiseScalarVectors takes two lists of scalars (a, b) and performs a pairwise addition returning a list of scalars.
-func addPairwiseScalarVectors(a, b []curves.Scalar) ([]curves.Scalar, error) {
-	if len(a) != len(b) {
-		return nil, errors.New("length of scalar vectors must be the same")
-	}
-	sum := make([]curves.Scalar, len(a))
-	for i, aElem := range a {
-		sum[i] = aElem.Add(b[i])
-	}
-
-	return sum, nil
-}
-
-// subtractPairwiseScalarVectors takes two lists of scalars (a, b) and performs a pairwise subtraction returning a list of scalars.
-func subtractPairwiseScalarVectors(a, b []curves.Scalar) ([]curves.Scalar, error) {
-	if len(a) != len(b) {
-		return nil, errors.New("length of scalar vectors must be the same")
-	}
-	diff := make([]curves.Scalar, len(a))
-	for i, aElem := range a {
-		diff[i] = aElem.Sub(b[i])
-	}
-	return diff, nil
-}
-
-// invertScalars takes a list of scalars then returns a list with each element inverted.
-func invertScalars(xs []curves.Scalar) ([]curves.Scalar, error) {
-	xinvs := make([]curves.Scalar, len(xs))
-	for i, x := range xs {
-		xinv, err := x.Invert()
-		if err != nil {
-			return nil, errors.Wrap(err, "bulletproof helpers invertx")
-		}
-		xinvs[i] = xinv
-	}
-
-	return xinvs, nil
-}
-
-// isPowerOfTwo returns whether a number i is a power of two or not.
-func isPowerOfTwo(i int) bool {
-	return i&(i-1) == 0
-}
-
-// get2nVector returns a scalar vector 2^n such that [1, 2, 4, ... 2^(n-1)]
-// See k^n and 2^n definitions on pg 12 of https://eprint.iacr.org/2017/1066.pdf
-func get2nVector(length int, curve curves.Curve) []curves.Scalar {
-	vector2n := make([]curves.Scalar, length)
-	vector2n[0] = curve.Scalar.One()
-	for i := 1; i < length; i++ {
-		vector2n[i] = vector2n[i-1].Double()
-	}
-	return vector2n
-}
-
-func get1nVector(length int, curve curves.Curve) []curves.Scalar {
-	vector1n := make([]curves.Scalar, length)
-	for i := 0; i < length; i++ {
-		vector1n[i] = curve.Scalar.One()
-	}
-	return vector1n
-}
-
-func getknVector(k curves.Scalar, length int, curve curves.Curve) []curves.Scalar {
-	vectorkn := make([]curves.Scalar, length)
-	vectorkn[0] = curve.Scalar.One()
-	vectorkn[1] = k
-	for i := 2; i < length; i++ {
-		vectorkn[i] = vectorkn[i-1].Mul(k)
-	}
-	return vectorkn
-}

pkg/crypto/bulletproof/helpers_test.go

@@ -1,85 +0,0 @@
-package bulletproof
-
-import (
-	crand "crypto/rand"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/onsonr/sonr/pkg/crypto/core/curves"
-)
-
-func TestInnerProductHappyPath(t *testing.T) {
-	curve := curves.ED25519()
-	a := randScalarVec(3, *curve)
-	b := randScalarVec(3, *curve)
-	_, err := innerProduct(a, b)
-	require.NoError(t, err)
-}
-
-func TestInnerProductMismatchedLengths(t *testing.T) {
-	curve := curves.ED25519()
-	a := randScalarVec(3, *curve)
-	b := randScalarVec(4, *curve)
-	_, err := innerProduct(a, b)
-	require.Error(t, err)
-}
-
-func TestInnerProductEmptyVector(t *testing.T) {
-	curve := curves.ED25519()
-	a := randScalarVec(0, *curve)
-	b := randScalarVec(0, *curve)
-	_, err := innerProduct(a, b)
-	require.Error(t, err)
-}
-
-func TestInnerProductOut(t *testing.T) {
-	curve := curves.ED25519()
-	a := randScalarVec(2, *curve)
-	b := randScalarVec(2, *curve)
-	c, err := innerProduct(a, b)
-	require.NoError(t, err)
-
-	// Calculate manually a0*b0 + a1*b1
-	cPrime := a[0].Mul(b[0]).Add(a[1].Mul(b[1]))
-	require.Equal(t, c, cPrime)
-}
-
-func TestSplitListofPointsHappyPath(t *testing.T) {
-	curve := curves.ED25519()
-	points := randPointVec(10, *curve)
-	firstHalf, secondHalf, err := splitPointVector(points)
-	require.NoError(t, err)
-	require.Len(t, firstHalf, 5)
-	require.Len(t, secondHalf, 5)
-}
-
-func TestSplitListofPointsOddLength(t *testing.T) {
-	curve := curves.ED25519()
-	points := randPointVec(11, *curve)
-	_, _, err := splitPointVector(points)
-	require.Error(t, err)
-}
-
-func TestSplitListofPointsZeroLength(t *testing.T) {
-	curve := curves.ED25519()
-	points := randPointVec(0, *curve)
-	_, _, err := splitPointVector(points)
-	require.Error(t, err)
-}
-
-func randScalarVec(length int, curve curves.Curve) []curves.Scalar {
-	out := make([]curves.Scalar, length)
-	for i := 0; i < length; i++ {
-		out[i] = curve.Scalar.Random(crand.Reader)
-	}
-	return out
-}
-
-func randPointVec(length int, curve curves.Curve) []curves.Point {
-	out := make([]curves.Point, length)
-	for i := 0; i < length; i++ {
-		out[i] = curve.Point.Random(crand.Reader)
-	}
-	return out
-}

pkg/crypto/bulletproof/ipp_prover.go

@@ -1,396 +0,0 @@
-//
-// Copyright Coinbase, Inc. All Rights Reserved.
-//
-// SPDX-License-Identifier: Apache-2.0
-//
-
-// Package bulletproof implements the zero knowledge protocol bulletproofs as defined in https://eprint.iacr.org/2017/1066.pdf
-package bulletproof
-
-import (
-	"github.com/gtank/merlin"
-	"github.com/pkg/errors"
-
-	"github.com/onsonr/sonr/pkg/crypto/core/curves"
-)
-
-// InnerProductProver is the struct used to create InnerProductProofs
-// It specifies which curve to use and holds precomputed generators
-// See NewInnerProductProver() for prover initialization.
-type InnerProductProver struct {
-	curve      curves.Curve
-	generators ippGenerators
-}
-
-// InnerProductProof contains necessary output for the inner product proof
-// a and b are the final input vectors of scalars, they should be of length 1
-// Ls and Rs are calculated per recursion of the IPP and are necessary for verification
-// See section 3.1 on pg 15 of https://eprint.iacr.org/2017/1066.pdf
-type InnerProductProof struct {
-	a, b         curves.Scalar
-	capLs, capRs []curves.Point
-	curve        *curves.Curve
-}
-
-// ippRecursion is the same as IPP but tracks recursive a', b', g', h' and Ls and Rs
-// It should only be used internally by InnerProductProver.Prove()
-// See L35 on pg 16 of https://eprint.iacr.org/2017/1066.pdf
-type ippRecursion struct {
-	a, b         []curves.Scalar
-	c            curves.Scalar
-	capLs, capRs []curves.Point
-	g, h         []curves.Point
-	u, capP      curves.Point
-	transcript   *merlin.Transcript
-}
-
-// NewInnerProductProver initializes a new prover
-// It uses the specified domain to generate generators for vectors of at most maxVectorLength
-// A prover can be used to construct inner product proofs for vectors of length less than or equal to maxVectorLength
-// A prover is defined by an explicit curve.
-func NewInnerProductProver(maxVectorLength int, domain []byte, curve curves.Curve) (*InnerProductProver, error) {
-	generators, err := getGeneratorPoints(maxVectorLength, domain, curve)
-	if err != nil {
-		return nil, errors.Wrap(err, "ipp getGenerators")
-	}
-	return &InnerProductProver{curve: curve, generators: *generators}, nil
-}
-
-// NewInnerProductProof initializes a new InnerProductProof for a specified curve
-// This should be used in tandem with UnmarshalBinary() to convert a marshaled proof into the struct.
-func NewInnerProductProof(curve *curves.Curve) *InnerProductProof {
-	var capLs, capRs []curves.Point
-	newProof := InnerProductProof{
-		a:     curve.NewScalar(),
-		b:     curve.NewScalar(),
-		capLs: capLs,
-		capRs: capRs,
-		curve: curve,
-	}
-	return &newProof
-}
-
-// rangeToIPP takes the output of a range proof and converts it into an inner product proof
-// See section 4.2 on pg 20
-// The conversion specifies generators to use (g and hPrime), as well as the two vectors l, r of which the inner product is tHat
-// Additionally, note that the P used for the IPP is in fact P*h^-mu from the range proof.
-func (prover *InnerProductProver) rangeToIPP(proofG, proofH []curves.Point, l, r []curves.Scalar, tHat curves.Scalar, capPhmuinv, u curves.Point, transcript *merlin.Transcript) (*InnerProductProof, error) {
-	// Note that P as a witness is only g^l * h^r
-	// P needs to be in the form of g^l * h^r * u^<l,r>
-	// Calculate the final P including the u^<l,r> term
-	utHat := u.Mul(tHat)
-	capP := capPhmuinv.Add(utHat)
-
-	// Use params to prove inner product
-	recursionParams := &ippRecursion{
-		a:          l,
-		b:          r,
-		capLs:      []curves.Point{},
-		capRs:      []curves.Point{},
-		c:          tHat,
-		g:          proofG,
-		h:          proofH,
-		capP:       capP,
-		u:          u,
-		transcript: transcript,
-	}
-
-	return prover.proveRecursive(recursionParams)
-}
-
-// getP returns the initial P value given two scalars a,b and point u
-// This method should only be used for testing
-// See (3) on page 13 of https://eprint.iacr.org/2017/1066.pdf
-func (prover *InnerProductProver) getP(a, b []curves.Scalar, u curves.Point) (curves.Point, error) {
-	// Vectors must have length power of two
-	if !isPowerOfTwo(len(a)) {
-		return nil, errors.New("ipp vector length must be power of two")
-	}
-	// Generator vectors must be same length
-	if len(prover.generators.G) != len(prover.generators.H) {
-		return nil, errors.New("ipp generator lengths of g and h must be equal")
-	}
-	// Inner product requires len(a) == len(b) else error is returned
-	c, err := innerProduct(a, b)
-	if err != nil {
-		return nil, errors.Wrap(err, "ipp getInnerProduct")
-	}
-
-	// In case where len(a) is less than number of generators precomputed by prover, trim to length
-	proofG := prover.generators.G[0:len(a)]
-	proofH := prover.generators.H[0:len(b)]
-
-	// initial P = g^a * h^b * u^(a dot b) (See (3) on page 13 of https://eprint.iacr.org/2017/1066.pdf)
-	ga := prover.curve.NewGeneratorPoint().SumOfProducts(proofG, a)
-	hb := prover.curve.NewGeneratorPoint().SumOfProducts(proofH, b)
-	uadotb := u.Mul(c)
-	capP := ga.Add(hb).Add(uadotb)
-
-	return capP, nil
-}
-
-// Prove executes the prover protocol on pg 16 of https://eprint.iacr.org/2017/1066.pdf
-// It generates an inner product proof for vectors a and b, using u to blind the inner product in P
-// A transcript is used for the Fiat Shamir heuristic.
-func (prover *InnerProductProver) Prove(a, b []curves.Scalar, u curves.Point, transcript *merlin.Transcript) (*InnerProductProof, error) {
-	// Vectors must have length power of two
-	if !isPowerOfTwo(len(a)) {
-		return nil, errors.New("ipp vector length must be power of two")
-	}
-	// Generator vectors must be same length
-	if len(prover.generators.G) != len(prover.generators.H) {
-		return nil, errors.New("ipp generator lengths of g and h must be equal")
-	}
-	// Inner product requires len(a) == len(b) else error is returned
-	c, err := innerProduct(a, b)
-	if err != nil {
-		return nil, errors.Wrap(err, "ipp getInnerProduct")
-	}
-
-	// Length of vectors must be less than the number of generators generated
-	if len(a) > len(prover.generators.G) {
-		return nil, errors.New("ipp vector length must be less than maxVectorLength")
-	}
-	// In case where len(a) is less than number of generators precomputed by prover, trim to length
-	proofG := prover.generators.G[0:len(a)]
-	proofH := prover.generators.H[0:len(b)]
-
-	// initial P = g^a * h^b * u^(a dot b) (See (3) on page 13 of https://eprint.iacr.org/2017/1066.pdf)
-	ga := prover.curve.NewGeneratorPoint().SumOfProducts(proofG, a)
-	hb := prover.curve.NewGeneratorPoint().SumOfProducts(proofH, b)
-	uadotb := u.Mul(c)
-	capP := ga.Add(hb).Add(uadotb)
-
-	recursionParams := &ippRecursion{
-		a:          a,
-		b:          b,
-		capLs:      []curves.Point{},
-		capRs:      []curves.Point{},
-		c:          c,
-		g:          proofG,
-		h:          proofH,
-		capP:       capP,
-		u:          u,
-		transcript: transcript,
-	}
-	return prover.proveRecursive(recursionParams)
-}
-
-// proveRecursive executes the recursion on pg 16 of https://eprint.iacr.org/2017/1066.pdf
-func (prover *InnerProductProver) proveRecursive(recursionParams *ippRecursion) (*InnerProductProof, error) {
-	// length checks
-	if len(recursionParams.a) != len(recursionParams.b) {
-		return nil, errors.New("ipp proveRecursive a and b different lengths")
-	}
-	if len(recursionParams.g) != len(recursionParams.h) {
-		return nil, errors.New("ipp proveRecursive g and h different lengths")
-	}
-	if len(recursionParams.a) != len(recursionParams.g) {
-		return nil, errors.New("ipp proveRecursive scalar and point vectors different lengths")
-	}
-	// Base case (L14, pg16 of https://eprint.iacr.org/2017/1066.pdf)
-	if len(recursionParams.a) == 1 {
-		proof := &InnerProductProof{
-			a:     recursionParams.a[0],
-			b:     recursionParams.b[0],
-			capLs: recursionParams.capLs,
-			capRs: recursionParams.capRs,
-			curve: &prover.curve,
-		}
-		return proof, nil
-	}
-
-	// Split current state into low (first half) vs high (second half) vectors
-	aLo, aHi, err := splitScalarVector(recursionParams.a)
-	if err != nil {
-		return nil, errors.Wrap(err, "recursionParams splitScalarVector")
-	}
-	bLo, bHi, err := splitScalarVector(recursionParams.b)
-	if err != nil {
-		return nil, errors.Wrap(err, "recursionParams splitScalarVector")
-	}
-	gLo, gHi, err := splitPointVector(recursionParams.g)
-	if err != nil {
-		return nil, errors.Wrap(err, "recursionParams splitPointVector")
-	}
-	hLo, hHi, err := splitPointVector(recursionParams.h)
-	if err != nil {
-		return nil, errors.Wrap(err, "recursionParams splitPointVector")
-	}
-
-	// c_l, c_r (L21,22, pg16 of https://eprint.iacr.org/2017/1066.pdf)
-	cL, err := innerProduct(aLo, bHi)
-	if err != nil {
-		return nil, errors.Wrap(err, "recursionParams innerProduct")
-	}
-
-	cR, err := innerProduct(aHi, bLo)
-	if err != nil {
-		return nil, errors.Wrap(err, "recursionParams innerProduct")
-	}
-
-	// L, R (L23,24, pg16 of https://eprint.iacr.org/2017/1066.pdf)
-	lga := prover.curve.Point.SumOfProducts(gHi, aLo)
-	lhb := prover.curve.Point.SumOfProducts(hLo, bHi)
-	ucL := recursionParams.u.Mul(cL)
-	capL := lga.Add(lhb).Add(ucL)
-
-	rga := prover.curve.Point.SumOfProducts(gLo, aHi)
-	rhb := prover.curve.Point.SumOfProducts(hHi, bLo)
-	ucR := recursionParams.u.Mul(cR)
-	capR := rga.Add(rhb).Add(ucR)
-
-	// Add L,R for verifier to use to calculate final g, h
-	newL := recursionParams.capLs
-	newL = append(newL, capL)
-	newR := recursionParams.capRs
-	newR = append(newR, capR)
-
-	// Get x from L, R for non-interactive (See section 4.4 pg22 of https://eprint.iacr.org/2017/1066.pdf)
-	// Note this replaces the interactive model, i.e. L36-28 of pg16 of https://eprint.iacr.org/2017/1066.pdf
-	x, err := prover.calcx(capL, capR, recursionParams.transcript)
-	if err != nil {
-		return nil, errors.Wrap(err, "recursionParams calcx")
-	}
-
-	// Calculate recursive inputs
-	xInv, err := x.Invert()
-	if err != nil {
-		return nil, errors.Wrap(err, "recursionParams x.Invert")
-	}
-
-	// g', h' (L29,30, pg16 of https://eprint.iacr.org/2017/1066.pdf)
-	gLoxInverse := multiplyScalarToPointVector(xInv, gLo)
-	gHix := multiplyScalarToPointVector(x, gHi)
-	gPrime, err := multiplyPairwisePointVectors(gLoxInverse, gHix)
-	if err != nil {
-		return nil, errors.Wrap(err, "recursionParams multiplyPairwisePointVectors")
-	}
-
-	hLox := multiplyScalarToPointVector(x, hLo)
-	hHixInv := multiplyScalarToPointVector(xInv, hHi)
-	hPrime, err := multiplyPairwisePointVectors(hLox, hHixInv)
-	if err != nil {
-		return nil, errors.Wrap(err, "recursionParams multiplyPairwisePointVectors")
-	}
-
-	// P' (L31, pg16 of https://eprint.iacr.org/2017/1066.pdf)
-	xSquare := x.Square()
-	xInvSquare := xInv.Square()
-	LxSquare := capL.Mul(xSquare)
-	RxInvSquare := capR.Mul(xInvSquare)
-	PPrime := LxSquare.Add(recursionParams.capP).Add(RxInvSquare)
-
-	// a', b' (L33, 34, pg16 of https://eprint.iacr.org/2017/1066.pdf)
-	aLox := multiplyScalarToScalarVector(x, aLo)
-	aHixIn := multiplyScalarToScalarVector(xInv, aHi)
-	aPrime, err := addPairwiseScalarVectors(aLox, aHixIn)
-	if err != nil {
-		return nil, errors.Wrap(err, "recursionParams addPairwiseScalarVectors")
-	}
-
-	bLoxInv := multiplyScalarToScalarVector(xInv, bLo)
-	bHix := multiplyScalarToScalarVector(x, bHi)
-	bPrime, err := addPairwiseScalarVectors(bLoxInv, bHix)
-	if err != nil {
-		return nil, errors.Wrap(err, "recursionParams addPairwiseScalarVectors")
-	}
-
-	// c'
-	cPrime, err := innerProduct(aPrime, bPrime)
-	if err != nil {
-		return nil, errors.Wrap(err, "recursionParams innerProduct")
-	}
-
-	// Make recursive call (L35, pg16 of https://eprint.iacr.org/2017/1066.pdf)
-	recursiveIPP := &ippRecursion{
-		a:          aPrime,
-		b:          bPrime,
-		capLs:      newL,
-		capRs:      newR,
-		c:          cPrime,
-		g:          gPrime,
-		h:          hPrime,
-		capP:       PPrime,
-		u:          recursionParams.u,
-		transcript: recursionParams.transcript,
-	}
-
-	out, err := prover.proveRecursive(recursiveIPP)
-	if err != nil {
-		return nil, errors.Wrap(err, "recursionParams proveRecursive")
-	}
-	return out, nil
-}
-
-// calcx uses a merlin transcript for Fiat Shamir
-// For each recursion, it takes the current state of the transcript and appends the newly calculated L and R values
-// A new scalar is then read from the transcript
-// See section 4.4 pg22 of https://eprint.iacr.org/2017/1066.pdf
-func (prover *InnerProductProver) calcx(capL, capR curves.Point, transcript *merlin.Transcript) (curves.Scalar, error) {
-	// Add the newest capL and capR values to transcript
-	transcript.AppendMessage([]byte("addRecursiveL"), capL.ToAffineUncompressed())
-	transcript.AppendMessage([]byte("addRecursiveR"), capR.ToAffineUncompressed())
-	// Read 64 bytes from, set to scalar
-	outBytes := transcript.ExtractBytes([]byte("getx"), 64)
-	x, err := prover.curve.NewScalar().SetBytesWide(outBytes)
-	if err != nil {
-		return nil, errors.Wrap(err, "calcx NewScalar SetBytesWide")
-	}
-
-	return x, nil
-}
-
-// MarshalBinary takes an inner product proof and marshals into bytes.
-func (proof *InnerProductProof) MarshalBinary() []byte {
-	var out []byte
-	out = append(out, proof.a.Bytes()...)
-	out = append(out, proof.b.Bytes()...)
-	for i, capLElem := range proof.capLs {
-		capRElem := proof.capRs[i]
-		out = append(out, capLElem.ToAffineCompressed()...)
-		out = append(out, capRElem.ToAffineCompressed()...)
-	}
-	return out
-}
-
-// UnmarshalBinary takes bytes of a marshaled proof and writes them into an inner product proof
-// The inner product proof used should be from the output of NewInnerProductProof().
-func (proof *InnerProductProof) UnmarshalBinary(data []byte) error {
-	scalarLen := len(proof.curve.NewScalar().Bytes())
-	pointLen := len(proof.curve.NewGeneratorPoint().ToAffineCompressed())
-	ptr := 0
-	// Get scalars
-	a, err := proof.curve.NewScalar().SetBytes(data[ptr : ptr+scalarLen])
-	if err != nil {
-		return errors.New("innerProductProof UnmarshalBinary SetBytes")
-	}
-	proof.a = a
-	ptr += scalarLen
-	b, err := proof.curve.NewScalar().SetBytes(data[ptr : ptr+scalarLen])
-	if err != nil {
-		return errors.New("innerProductProof UnmarshalBinary SetBytes")
-	}
-	proof.b = b
-	ptr += scalarLen
-	// Get points
-	var capLs, capRs []curves.Point //nolint:prealloc // pointer arithmetic makes it too unreadable.
-	for ptr < len(data) {
-		capLElem, err := proof.curve.Point.FromAffineCompressed(data[ptr : ptr+pointLen])
-		if err != nil {
-			return errors.New("innerProductProof UnmarshalBinary FromAffineCompressed")
-		}
-		capLs = append(capLs, capLElem)
-		ptr += pointLen
-		capRElem, err := proof.curve.Point.FromAffineCompressed(data[ptr : ptr+pointLen])
-		if err != nil {
-			return errors.New("innerProductProof UnmarshalBinary FromAffineCompressed")
-		}
-		capRs = append(capRs, capRElem)
-		ptr += pointLen
-	}
-	proof.capLs = capLs
-	proof.capRs = capRs
-
-	return nil
-}

pkg/crypto/bulletproof/ipp_prover_test.go

@@ -1,99 +0,0 @@
-package bulletproof
-
-import (
-	crand "crypto/rand"
-	"testing"
-
-	"github.com/gtank/merlin"
-	"github.com/stretchr/testify/require"
-
-	"github.com/onsonr/sonr/pkg/crypto/core/curves"
-)
-
-func TestIPPHappyPath(t *testing.T) {
-	curve := curves.ED25519()
-	prover, err := NewInnerProductProver(8, []byte("test"), *curve)
-	require.NoError(t, err)
-	a := randScalarVec(8, *curve)
-	b := randScalarVec(8, *curve)
-	u := curve.Point.Random(crand.Reader)
-	transcript := merlin.NewTranscript("test")
-	proof, err := prover.Prove(a, b, u, transcript)
-	require.NoError(t, err)
-	require.Equal(t, 3, len(proof.capLs))
-	require.Equal(t, 3, len(proof.capRs))
-}
-
-func TestIPPMismatchedVectors(t *testing.T) {
-	curve := curves.ED25519()
-	prover, err := NewInnerProductProver(8, []byte("test"), *curve)
-	require.NoError(t, err)
-	a := randScalarVec(4, *curve)
-	b := randScalarVec(8, *curve)
-	u := curve.Point.Random(crand.Reader)
-	transcript := merlin.NewTranscript("test")
-	_, err = prover.Prove(a, b, u, transcript)
-	require.Error(t, err)
-}
-
-func TestIPPNonPowerOfTwoLengthVectors(t *testing.T) {
-	curve := curves.ED25519()
-	prover, err := NewInnerProductProver(8, []byte("test"), *curve)
-	require.NoError(t, err)
-	a := randScalarVec(3, *curve)
-	b := randScalarVec(3, *curve)
-	u := curve.Point.Random(crand.Reader)
-	transcript := merlin.NewTranscript("test")
-	_, err = prover.Prove(a, b, u, transcript)
-	require.Error(t, err)
-}
-
-func TestIPPZeroLengthVectors(t *testing.T) {
-	curve := curves.ED25519()
-	prover, err := NewInnerProductProver(8, []byte("test"), *curve)
-	require.NoError(t, err)
-	a := randScalarVec(0, *curve)
-	b := randScalarVec(0, *curve)
-	u := curve.Point.Random(crand.Reader)
-	transcript := merlin.NewTranscript("test")
-	_, err = prover.Prove(a, b, u, transcript)
-	require.Error(t, err)
-}
-
-func TestIPPGreaterThanMaxLengthVectors(t *testing.T) {
-	curve := curves.ED25519()
-	prover, err := NewInnerProductProver(8, []byte("test"), *curve)
-	require.NoError(t, err)
-	a := randScalarVec(16, *curve)
-	b := randScalarVec(16, *curve)
-	u := curve.Point.Random(crand.Reader)
-	transcript := merlin.NewTranscript("test")
-	_, err = prover.Prove(a, b, u, transcript)
-	require.Error(t, err)
-}
-
-func TestIPPMarshal(t *testing.T) {
-	curve := curves.ED25519()
-	prover, err := NewInnerProductProver(8, []byte("test"), *curve)
-	require.NoError(t, err)
-	a := randScalarVec(8, *curve)
-	b := randScalarVec(8, *curve)
-	u := curve.Point.Random(crand.Reader)
-	transcript := merlin.NewTranscript("test")
-	proof, err := prover.Prove(a, b, u, transcript)
-	require.NoError(t, err)
-
-	proofMarshaled := proof.MarshalBinary()
-	proofPrime := NewInnerProductProof(curve)
-	err = proofPrime.UnmarshalBinary(proofMarshaled)
-	require.NoError(t, err)
-	require.Zero(t, proof.a.Cmp(proofPrime.a))
-	require.Zero(t, proof.b.Cmp(proofPrime.b))
-	for i, proofCapLElem := range proof.capLs {
-		proofPrimeCapLElem := proofPrime.capLs[i]
-		require.True(t, proofCapLElem.Equal(proofPrimeCapLElem))
-		proofCapRElem := proof.capRs[i]
-		proofPrimeCapRElem := proofPrime.capRs[i]
-		require.True(t, proofCapRElem.Equal(proofPrimeCapRElem))
-	}
-}

pkg/crypto/bulletproof/ipp_verifier.go

@@ -1,209 +0,0 @@
-package bulletproof
-
-import (
-	"github.com/gtank/merlin"
-	"github.com/pkg/errors"
-
-	"github.com/onsonr/sonr/pkg/crypto/core/curves"
-)
-
-// InnerProductVerifier is the struct used to verify inner product proofs
-// It specifies which curve to use and holds precomputed generators
-// See NewInnerProductProver() for prover initialization.
-type InnerProductVerifier struct {
-	curve      curves.Curve
-	generators ippGenerators
-}
-
-// NewInnerProductVerifier initializes a new verifier
-// It uses the specified domain to generate generators for vectors of at most maxVectorLength
-// A verifier can be used to verify inner product proofs for vectors of length less than or equal to maxVectorLength
-// A verifier is defined by an explicit curve.
-func NewInnerProductVerifier(maxVectorLength int, domain []byte, curve curves.Curve) (*InnerProductVerifier, error) {
-	generators, err := getGeneratorPoints(maxVectorLength, domain, curve)
-	if err != nil {
-		return nil, errors.Wrap(err, "ipp getGenerators")
-	}
-	return &InnerProductVerifier{curve: curve, generators: *generators}, nil
-}
-
-// Verify verifies the given proof inputs
-// It implements the final comparison of section 3.1 on pg17 of https://eprint.iacr.org/2017/1066.pdf
-func (verifier *InnerProductVerifier) Verify(capP, u curves.Point, proof *InnerProductProof, transcript *merlin.Transcript) (bool, error) {
-	if len(proof.capLs) != len(proof.capRs) {
-		return false, errors.New("ipp capLs and capRs must be same length")
-	}
-	// Generator vectors must be same length
-	if len(verifier.generators.G) != len(verifier.generators.H) {
-		return false, errors.New("ipp generator lengths of g and h must be equal")
-	}
-
-	// Get generators for each elem in a, b and one more for u
-	// len(Ls) = log n, therefore can just exponentiate
-	n := 1 << len(proof.capLs)
-
-	// Length of vectors must be less than the number of generators generated
-	if n > len(verifier.generators.G) {
-		return false, errors.New("ipp vector length must be less than maxVectorLength")
-	}
-	// In case where len(a) is less than number of generators precomputed by prover, trim to length
-	proofG := verifier.generators.G[0:n]
-	proofH := verifier.generators.H[0:n]
-
-	xs, err := getxs(transcript, proof.capLs, proof.capRs, verifier.curve)
-	if err != nil {
-		return false, errors.Wrap(err, "verifier getxs")
-	}
-	s, err := verifier.getsNew(xs, n)
-	if err != nil {
-		return false, errors.Wrap(err, "verifier getss")
-	}
-	lhs, err := verifier.getLHS(u, proof, proofG, proofH, s)
-	if err != nil {
-		return false, errors.Wrap(err, "verify getLHS")
-	}
-	rhs, err := verifier.getRHS(capP, proof, xs)
-	if err != nil {
-		return false, errors.Wrap(err, "verify getRHS")
-	}
-	return lhs.Equal(rhs), nil
-}
-
-// Verify verifies the given proof inputs
-// It implements the final comparison of section 3.1 on pg17 of https://eprint.iacr.org/2017/1066.pdf
-func (verifier *InnerProductVerifier) VerifyFromRangeProof(proofG, proofH []curves.Point, capPhmuinv, u curves.Point, tHat curves.Scalar, proof *InnerProductProof, transcript *merlin.Transcript) (bool, error) {
-	// Get generators for each elem in a, b and one more for u
-	// len(Ls) = log n, therefore can just exponentiate
-	n := 1 << len(proof.capLs)
-
-	xs, err := getxs(transcript, proof.capLs, proof.capRs, verifier.curve)
-	if err != nil {
-		return false, errors.Wrap(err, "verifier getxs")
-	}
-	s, err := verifier.gets(xs, n)
-	if err != nil {
-		return false, errors.Wrap(err, "verifier getss")
-	}
-	lhs, err := verifier.getLHS(u, proof, proofG, proofH, s)
-	if err != nil {
-		return false, errors.Wrap(err, "verify getLHS")
-	}
-	utHat := u.Mul(tHat)
-	capP := capPhmuinv.Add(utHat)
-	rhs, err := verifier.getRHS(capP, proof, xs)
-	if err != nil {
-		return false, errors.Wrap(err, "verify getRHS")
-	}
-	return lhs.Equal(rhs), nil
-}
-
-// getRHS gets the right hand side of the final comparison of section 3.1 on pg17.
-func (*InnerProductVerifier) getRHS(capP curves.Point, proof *InnerProductProof, xs []curves.Scalar) (curves.Point, error) {
-	product := capP
-	for j, Lj := range proof.capLs {
-		Rj := proof.capRs[j]
-		xj := xs[j]
-		xjSquare := xj.Square()
-		xjSquareInv, err := xjSquare.Invert()
-		if err != nil {
-			return nil, errors.Wrap(err, "verify invert")
-		}
-		LjxjSquare := Lj.Mul(xjSquare)
-		RjxjSquareInv := Rj.Mul(xjSquareInv)
-		product = product.Add(LjxjSquare).Add(RjxjSquareInv)
-	}
-	return product, nil
-}
-
-// getLHS gets the left hand side of the final comparison of section 3.1 on pg17.
-func (verifier *InnerProductVerifier) getLHS(u curves.Point, proof *InnerProductProof, g, h []curves.Point, s []curves.Scalar) (curves.Point, error) {
-	sInv, err := invertScalars(s)
-	if err != nil {
-		return nil, errors.Wrap(err, "verify invertScalars")
-	}
-	// g^(a*s)
-	as := multiplyScalarToScalarVector(proof.a, s)
-	gas := verifier.curve.Point.SumOfProducts(g, as)
-	// h^(b*s^-1)
-	bsInv := multiplyScalarToScalarVector(proof.b, sInv)
-	hbsInv := verifier.curve.Point.SumOfProducts(h, bsInv)
-	// u^a*b
-	ab := proof.a.Mul(proof.b)
-	uab := u.Mul(ab)
-	// g^(a*s) * h^(b*s^-1) * u^a*b
-	out := gas.Add(hbsInv).Add(uab)
-
-	return out, nil
-}
-
-// getxs calculates the x values from Ls and Rs
-// Note that each x is read from the transcript, then the L and R at a certain index are written to the transcript
-// This mirrors the reading of xs and writing of Ls and Rs in the prover.
-func getxs(transcript *merlin.Transcript, capLs, capRs []curves.Point, curve curves.Curve) ([]curves.Scalar, error) {
-	xs := make([]curves.Scalar, len(capLs))
-	for i, capLi := range capLs {
-		capRi := capRs[i]
-		// Add the newest L and R values to transcript
-		transcript.AppendMessage([]byte("addRecursiveL"), capLi.ToAffineUncompressed())
-		transcript.AppendMessage([]byte("addRecursiveR"), capRi.ToAffineUncompressed())
-		// Read 64 bytes from, set to scalar
-		outBytes := transcript.ExtractBytes([]byte("getx"), 64)
-		x, err := curve.NewScalar().SetBytesWide(outBytes)
-		if err != nil {
-			return nil, errors.Wrap(err, "calcx NewScalar SetBytesWide")
-		}
-		xs[i] = x
-	}
-
-	return xs, nil
-}
-
-// gets calculates the vector s of values used for verification
-// See the second expression of section 3.1 on pg15
-// nolint
-func (verifier *InnerProductVerifier) gets(xs []curves.Scalar, n int) ([]curves.Scalar, error) {
-	ss := make([]curves.Scalar, n)
-	for i := 0; i < n; i++ {
-		si := verifier.curve.Scalar.One()
-		for j, xj := range xs {
-			if i>>(len(xs)-j-1)&0x01 == 1 {
-				si = si.Mul(xj)
-			} else {
-				xjInverse, err := xj.Invert()
-				if err != nil {
-					return nil, errors.Wrap(err, "getss invert")
-				}
-				si = si.Mul(xjInverse)
-			}
-		}
-		ss[i] = si
-	}
-
-	return ss, nil
-}
-
-// getsNew calculates the vector s of values used for verification
-// It provides analogous functionality as gets(), but uses a O(n) algorithm vs O(nlogn)
-// The algorithm inverts all xs, then begins multiplying the inversion by the square of x elements to
-// calculate all s values thus minimizing necessary inversions/ computation.
-func (verifier *InnerProductVerifier) getsNew(xs []curves.Scalar, n int) ([]curves.Scalar, error) {
-	var err error
-	ss := make([]curves.Scalar, n)
-	// First element is all xs inverted mul'd
-	ss[0] = verifier.curve.Scalar.One()
-	for _, xj := range xs {
-		ss[0] = ss[0].Mul(xj)
-	}
-	ss[0], err = ss[0].Invert()
-	if err != nil {
-		return nil, errors.Wrap(err, "ipp gets inv ss0")
-	}
-	for j, xj := range xs {
-		xjSquared := xj.Square()
-		for i := 0; i < n; i += 1 << (len(xs) - j) {
-			ss[i+1<<(len(xs)-j-1)] = ss[i].Mul(xjSquared)
-		}
-	}
-
-	return ss, nil
-}

pkg/crypto/bulletproof/ipp_verifier_test.go

@@ -1,79 +0,0 @@
-package bulletproof
-
-import (
-	crand "crypto/rand"
-	"testing"
-
-	"github.com/gtank/merlin"
-	"github.com/stretchr/testify/require"
-
-	"github.com/onsonr/sonr/pkg/crypto/core/curves"
-)
-
-func TestIPPVerifyHappyPath(t *testing.T) {
-	curve := curves.ED25519()
-	vecLength := 256
-	prover, err := NewInnerProductProver(vecLength, []byte("test"), *curve)
-	require.NoError(t, err)
-	a := randScalarVec(vecLength, *curve)
-	b := randScalarVec(vecLength, *curve)
-	u := curve.Point.Random(crand.Reader)
-	transcriptProver := merlin.NewTranscript("test")
-	proof, err := prover.Prove(a, b, u, transcriptProver)
-	require.NoError(t, err)
-
-	verifier, err := NewInnerProductVerifier(vecLength, []byte("test"), *curve)
-	require.NoError(t, err)
-	capP, err := prover.getP(a, b, u)
-	require.NoError(t, err)
-	transcriptVerifier := merlin.NewTranscript("test")
-	verified, err := verifier.Verify(capP, u, proof, transcriptVerifier)
-	require.NoError(t, err)
-	require.True(t, verified)
-}
-
-func BenchmarkIPPVerification(bench *testing.B) {
-	curve := curves.ED25519()
-	vecLength := 1024
-	prover, _ := NewInnerProductProver(vecLength, []byte("test"), *curve)
-	a := randScalarVec(vecLength, *curve)
-	b := randScalarVec(vecLength, *curve)
-	u := curve.Point.Random(crand.Reader)
-	transcriptProver := merlin.NewTranscript("test")
-	proof, _ := prover.Prove(a, b, u, transcriptProver)
-
-	verifier, _ := NewInnerProductVerifier(vecLength, []byte("test"), *curve)
-	capP, _ := prover.getP(a, b, u)
-	transcriptVerifier := merlin.NewTranscript("test")
-	verified, _ := verifier.Verify(capP, u, proof, transcriptVerifier)
-	require.True(bench, verified)
-}
-
-func TestIPPVerifyInvalidProof(t *testing.T) {
-	curve := curves.ED25519()
-	vecLength := 64
-	prover, err := NewInnerProductProver(vecLength, []byte("test"), *curve)
-	require.NoError(t, err)
-
-	a := randScalarVec(vecLength, *curve)
-	b := randScalarVec(vecLength, *curve)
-	u := curve.Point.Random(crand.Reader)
-
-	aPrime := randScalarVec(64, *curve)
-	bPrime := randScalarVec(64, *curve)
-	uPrime := curve.Point.Random(crand.Reader)
-	transcriptProver := merlin.NewTranscript("test")
-
-	proofPrime, err := prover.Prove(aPrime, bPrime, uPrime, transcriptProver)
-	require.NoError(t, err)
-
-	verifier, err := NewInnerProductVerifier(vecLength, []byte("test"), *curve)
-	require.NoError(t, err)
-	capP, err := prover.getP(a, b, u)
-	require.NoError(t, err)
-	transcriptVerifier := merlin.NewTranscript("test")
-	// Check for different capP, u from proof
-	verified, err := verifier.Verify(capP, u, proofPrime, transcriptVerifier)
-	require.NoError(t, err)
-	require.False(t, verified)
-}

pkg/crypto/bulletproof/range_batch_prover.go

@@ -1,348 +0,0 @@
-package bulletproof
-
-import (
-	crand "crypto/rand"
-
-	"github.com/gtank/merlin"
-	"github.com/pkg/errors"
-
-	"github.com/onsonr/sonr/pkg/crypto/core/curves"
-)
-
-// BatchProve proves that a list of scalars v are in the range n.
-// It implements the aggregating logarithmic proofs defined on pg21.
-// Instead of taking a single value and a single blinding factor, BatchProve takes in a list of values and list of
-// blinding factors.
-func (prover *RangeProver) BatchProve(v, gamma []curves.Scalar, n int, proofGenerators RangeProofGenerators, transcript *merlin.Transcript) (*RangeProof, error) {
-	// Define nm as the total bits required for secrets, calculated as number of secrets * n
-	m := len(v)
-	nm := n * m
-	// nm must be less than or equal to the number of generators generated
-	if nm > len(prover.generators.G) {
-		return nil, errors.New("ipp vector length must be less than or equal to maxVectorLength")
-	}
-
-	// In case where nm is less than number of generators precomputed by prover, trim to length
-	proofG := prover.generators.G[0:nm]
-	proofH := prover.generators.H[0:nm]
-
-	// Check that each elem in v is in range [0, 2^n]
-	for _, vi := range v {
-		checkedRange := checkRange(vi, n)
-		if checkedRange != nil {
-			return nil, checkedRange
-		}
-	}
-
-	// L40 on pg19
-	aL, err := getaLBatched(v, n, prover.curve)
-	if err != nil {
-		return nil, errors.Wrap(err, "rangeproof prove")
-	}
-	onenm := get1nVector(nm, prover.curve)
-	// L41 on pg19
-	aR, err := subtractPairwiseScalarVectors(aL, onenm)
-	if err != nil {
-		return nil, errors.Wrap(err, "rangeproof prove")
-	}
-
-	alpha := prover.curve.Scalar.Random(crand.Reader)
-	// Calc A (L44, pg19)
-	halpha := proofGenerators.h.Mul(alpha)
-	gaL := prover.curve.Point.SumOfProducts(proofG, aL)
-	haR := prover.curve.Point.SumOfProducts(proofH, aR)
-	capA := halpha.Add(gaL).Add(haR)
-
-	// L45, 46, pg19
-	sL := getBlindingVector(nm, prover.curve)
-	sR := getBlindingVector(nm, prover.curve)
-	rho := prover.curve.Scalar.Random(crand.Reader)
-
-	// Calc S (L47, pg19)
-	hrho := proofGenerators.h.Mul(rho)
-	gsL := prover.curve.Point.SumOfProducts(proofG, sL)
-	hsR := prover.curve.Point.SumOfProducts(proofH, sR)
-	capS := hrho.Add(gsL).Add(hsR)
-
-	// Fiat Shamir for y,z (L49, pg19)
-	capV := getcapVBatched(v, gamma, proofGenerators.g, proofGenerators.h)
-	y, z, err := calcyzBatched(capV, capA, capS, transcript, prover.curve)
-	if err != nil {
-		return nil, errors.Wrap(err, "rangeproof prove")
-	}
-
-	// Calc t_1, t_2
-	// See the l(X), r(X), equations on pg 21
-	// Use l(X)'s and r(X)'s constant and linear terms to derive t_1 and t_2
-	// (a_l - z*1^n)
-	zonenm := multiplyScalarToScalarVector(z, onenm)
-	constantTerml, err := subtractPairwiseScalarVectors(aL, zonenm)
-	if err != nil {
-		return nil, errors.Wrap(err, "rangeproof prove")
-	}
-	linearTerml := sL
-
-	// zSum term, see equation 71 on pg21
-	zSum := getSumTermrXBatched(z, n, len(v), prover.curve)
-	// a_r + z*1^nm
-	aRPluszonenm, err := addPairwiseScalarVectors(aR, zonenm)
-	if err != nil {
-		return nil, errors.Wrap(err, "rangeproof prove")
-	}
-	ynm := getknVector(y, nm, prover.curve)
-	hadamard, err := multiplyPairwiseScalarVectors(ynm, aRPluszonenm)
-	if err != nil {
-		return nil, errors.Wrap(err, "rangeproof prove")
-	}
-	constantTermr, err := addPairwiseScalarVectors(hadamard, zSum)
-	if err != nil {
-		return nil, errors.Wrap(err, "rangeproof prove")
-	}
-	linearTermr, err := multiplyPairwiseScalarVectors(ynm, sR)
-	if err != nil {
-		return nil, errors.Wrap(err, "rangeproof prove")
-	}
-
-	// t_1 (as the linear coefficient) is the sum of the dot products of l(X)'s linear term dot r(X)'s constant term
-	// and r(X)'s linear term dot l(X)'s constant term
-	t1FirstTerm, err := innerProduct(linearTerml, constantTermr)
-	if err != nil {
-		return nil, errors.Wrap(err, "rangeproof prove")
-	}
-	t1SecondTerm, err := innerProduct(linearTermr, constantTerml)
-	if err != nil {
-		return nil, errors.Wrap(err, "rangeproof prove")
-	}
-	t1 := t1FirstTerm.Add(t1SecondTerm)
-
-	// t_2 (as the quadratic coefficient) is the dot product of l(X)'s and r(X)'s linear terms
-	t2, err := innerProduct(linearTerml, linearTermr)
-	if err != nil {
-		return nil, errors.Wrap(err, "rangeproof prove")
-	}
-
-	// L52, pg20
-	tau1 := prover.curve.Scalar.Random(crand.Reader)
-	tau2 := prover.curve.Scalar.Random(crand.Reader)
-
-	// T_1, T_2 (L53, pg20)
-	capT1 := proofGenerators.g.Mul(t1).Add(proofGenerators.h.Mul(tau1))
-	capT2 := proofGenerators.g.Mul(t2).Add(proofGenerators.h.Mul(tau2))
-
-	// Fiat shamir for x (L55, pg20)
-	x, err := calcx(capT1, capT2, transcript, prover.curve)
-	if err != nil {
-		return nil, errors.Wrap(err, "rangeproof prove")
-	}
-
-	// Calc l
-	// Instead of using the expression in the line, evaluate l() at x
-	sLx := multiplyScalarToScalarVector(x, linearTerml)
-	l, err := addPairwiseScalarVectors(constantTerml, sLx)
-	if err != nil {
-		return nil, errors.Wrap(err, "rangeproof prove")
-	}
-
-	// Calc r
-	// Instead of using the expression in the line, evaluate r() at x
-	ynsRx := multiplyScalarToScalarVector(x, linearTermr)
-	r, err := addPairwiseScalarVectors(constantTermr, ynsRx)
-	if err != nil {
-		return nil, errors.Wrap(err, "rangeproof prove")
-	}
-
-	// Calc t hat
-	// For efficiency, instead of calculating the dot product, evaluate t() at x
-	zm := getknVector(z, m, prover.curve)
-	zsquarezm := multiplyScalarToScalarVector(z.Square(), zm)
-	sumv := prover.curve.Scalar.Zero()
-	for i := 0; i < m; i++ {
-		elem := zsquarezm[i].Mul(v[i])
-		sumv = sumv.Add(elem)
-	}
-
-	deltayzBatched, err := deltayzBatched(y, z, n, m, prover.curve)
-	if err != nil {
-		return nil, errors.Wrap(err, "rangeproof prove")
-	}
-	t0 := sumv.Add(deltayzBatched)
-	tLinear := t1.Mul(x)
-	tQuadratic := t2.Mul(x.Square())
-	tHat := t0.Add(tLinear).Add(tQuadratic)
-
-	// Calc tau_x (L61, pg20)
-	tau2xsquare := tau2.Mul(x.Square())
-	tau1x := tau1.Mul(x)
-	zsum := prover.curve.Scalar.Zero()
-	zExp := z.Clone()
-	for j := 1; j < m+1; j++ {
-		zExp = zExp.Mul(z)
-		zsum = zsum.Add(zExp.Mul(gamma[j-1]))
-	}
-	taux := tau2xsquare.Add(tau1x).Add(zsum)
-
-	// Calc mu (L62, pg20)
-	mu := alpha.Add(rho.Mul(x))
-
-	// Calc IPP (See section 4.2)
-	hPrime, err := gethPrime(proofH, y, prover.curve)
-	if err != nil {
-		return nil, errors.Wrap(err, "rangeproof prove")
-	}
-
-	// P is redefined in batched case, see bottom equation on pg21.
-	capPhmu := getPhmuBatched(proofG, hPrime, proofGenerators.h, capA, capS, x, y, z, mu, n, m, prover.curve)
-
-	wBytes := transcript.ExtractBytes([]byte("getw"), 64)
-	w, err := prover.curve.NewScalar().SetBytesWide(wBytes)
-	if err != nil {
-		return nil, errors.Wrap(err, "rangeproof prove")
-	}
-
-	ipp, err := prover.ippProver.rangeToIPP(proofG, hPrime, l, r, tHat, capPhmu, proofGenerators.u.Mul(w), transcript)
-	if err != nil {
-		return nil, errors.Wrap(err, "rangeproof prove")
-	}
-
-	out := &RangeProof{
-		capA:  capA,
-		capS:  capS,
-		capT1: capT1,
-		capT2: capT2,
-		taux:  taux,
-		mu:    mu,
-		tHat:  tHat,
-		ipp:   ipp,
-		curve: &prover.curve,
-	}
-	return out, nil
-}
-
-// See final term of L71 on pg 21
-// Sigma_{j=1}^{m} z^{1+j} * (0^{(j-1)*n} || 2^{n} || 0^{(m-j)*n}).
-func getSumTermrXBatched(z curves.Scalar, n, m int, curve curves.Curve) []curves.Scalar {
-	twoN := get2nVector(n, curve)
-	var out []curves.Scalar
-	// The final power should be one more than m
-	zExp := z.Clone()
-	for j := 0; j < m; j++ {
-		zExp = zExp.Mul(z)
-		elem := multiplyScalarToScalarVector(zExp, twoN)
-		out = append(out, elem...)
-	}
-
-	return out
-}
-
-func getcapVBatched(v, gamma []curves.Scalar, g, h curves.Point) []curves.Point {
-	out := make([]curves.Point, len(v))
-	for i, vi := range v {
-		out[i] = getcapV(vi, gamma[i], g, h)
-	}
-	return out
-}
-
-func getaLBatched(v []curves.Scalar, n int, curve curves.Curve) ([]curves.Scalar, error) {
-	var aL []curves.Scalar
-	for _, vi := range v {
-		aLi, err := getaL(vi, n, curve)
-		if err != nil {
-			return nil, err
-		}
-		aL = append(aL, aLi...)
-	}
-	return aL, nil
-}
-
-func calcyzBatched(capV []curves.Point, capA, capS curves.Point, transcript *merlin.Transcript, curve curves.Curve) (curves.Scalar, curves.Scalar, error) {
-	// Add the A,S values to transcript
-	for _, capVi := range capV {
-		transcript.AppendMessage([]byte("addV"), capVi.ToAffineUncompressed())
-	}
-	transcript.AppendMessage([]byte("addcapA"), capA.ToAffineUncompressed())
-	transcript.AppendMessage([]byte("addcapS"), capS.ToAffineUncompressed())
-	// Read 64 bytes twice from, set to scalar for y and z
-	yBytes := transcript.ExtractBytes([]byte("gety"), 64)
-	y, err := curve.NewScalar().SetBytesWide(yBytes)
-	if err != nil {
-		return nil, nil, errors.Wrap(err, "calcyz NewScalar SetBytesWide")
-	}
-	zBytes := transcript.ExtractBytes([]byte("getz"), 64)
-	z, err := curve.NewScalar().SetBytesWide(zBytes)
-	if err != nil {
-		return nil, nil, errors.Wrap(err, "calcyz NewScalar SetBytesWide")
-	}
-
-	return y, z, nil
-}
-
-func deltayzBatched(y, z curves.Scalar, n, m int, curve curves.Curve) (curves.Scalar, error) {
-	// z - z^2
-	zMinuszsquare := z.Sub(z.Square())
-	// 1^(n*m)
-	onenm := get1nVector(n*m, curve)
-	// <1^nm, y^nm>
-	onenmdotynm, err := innerProduct(onenm, getknVector(y, n*m, curve))
-	if err != nil {
-		return nil, errors.Wrap(err, "deltayz")
-	}
-	// (z - z^2)*<1^n, y^n>
-	termFirst := zMinuszsquare.Mul(onenmdotynm)
-
-	// <1^n, 2^n>
-	onendottwon, err := innerProduct(get1nVector(n, curve), get2nVector(n, curve))
-	if err != nil {
-		return nil, errors.Wrap(err, "deltayz")
-	}
-
-	termSecond := curve.Scalar.Zero()
-	zExp := z.Square()
-	for j := 1; j < m+1; j++ {
-		zExp = zExp.Mul(z)
-		elem := zExp.Mul(onendottwon)
-		termSecond = termSecond.Add(elem)
-	}
-
-	// (z - z^2)*<1^n, y^n> - z^3*<1^n, 2^n>
-	out := termFirst.Sub(termSecond)
-
-	return out, nil
-}
-
-// Bottom equation on pg21.
-func getPhmuBatched(proofG, proofHPrime []curves.Point, h, capA, capS curves.Point, x, y, z, mu curves.Scalar, n, m int, curve curves.Curve) curves.Point {
-	twoN := get2nVector(n, curve)
-	// h'^(z*y^n + z^2*2^n)
-	lastElem := curve.NewIdentityPoint()
-	zExp := z.Clone()
-	for j := 1; j < m+1; j++ {
-		// Get subvector of h
-		hSubvector := proofHPrime[(j-1)*n : j*n]
-		// z^(j+1)
-		zExp = zExp.Mul(z)
-		exp := multiplyScalarToScalarVector(zExp, twoN)
-		// Final elem
-		elem := curve.Point.SumOfProducts(hSubvector, exp)
-		lastElem = lastElem.Add(elem)
-	}
-
-	zynm := multiplyScalarToScalarVector(z, getknVector(y, n*m, curve))
-	hPrimezynm := curve.Point.SumOfProducts(proofHPrime, zynm)
-	lastElem = lastElem.Add(hPrimezynm)
-
-	// S^x
-	capSx := capS.Mul(x)
-
-	// g^-z --> -z*<1,g>
-	onenm := get1nVector(n*m, curve)
-	zNeg := z.Neg()
-	zinvonen := multiplyScalarToScalarVector(zNeg, onenm)
-	zgdotonen := curve.Point.SumOfProducts(proofG, zinvonen)
-
-	// L66 on pg20
-	P := capA.Add(capSx).Add(zgdotonen).Add(lastElem)
-	hmu := h.Mul(mu)
-	Phmu := P.Sub(hmu)
-
-	return Phmu
-}

pkg/crypto/bulletproof/range_batch_prover_test.go

@@ -1,102 +0,0 @@
-package bulletproof
-
-import (
-	crand "crypto/rand"
-	"testing"
-
-	"github.com/gtank/merlin"
-	"github.com/stretchr/testify/require"
-
-	"github.com/onsonr/sonr/pkg/crypto/core/curves"
-)
-
-func TestRangeBatchProverHappyPath(t *testing.T) {
-	curve := curves.ED25519()
-	n := 256
-	prover, err := NewRangeProver(n*4, []byte("rangeDomain"), []byte("ippDomain"), *curve)
-	require.NoError(t, err)
-	v1 := curve.Scalar.Random(crand.Reader)
-	v2 := curve.Scalar.Random(crand.Reader)
-	v3 := curve.Scalar.Random(crand.Reader)
-	v4 := curve.Scalar.Random(crand.Reader)
-	v := []curves.Scalar{v1, v2, v3, v4}
-
-	gamma1 := curve.Scalar.Random(crand.Reader)
-	gamma2 := curve.Scalar.Random(crand.Reader)
-	gamma3 := curve.Scalar.Random(crand.Reader)
-	gamma4 := curve.Scalar.Random(crand.Reader)
-	gamma := []curves.Scalar{gamma1, gamma2, gamma3, gamma4}
-	g := curve.Point.Random(crand.Reader)
-	h := curve.Point.Random(crand.Reader)
-	u := curve.Point.Random(crand.Reader)
-	proofGenerators := RangeProofGenerators{
-		g: g,
-		h: h,
-		u: u,
-	}
-	transcript := merlin.NewTranscript("test")
-	proof, err := prover.BatchProve(v, gamma, n, proofGenerators, transcript)
-	require.NoError(t, err)
-	require.NotNil(t, proof)
-	require.Equal(t, 10, len(proof.ipp.capLs))
-	require.Equal(t, 10, len(proof.ipp.capRs))
-}
-
-func TestGetaLBatched(t *testing.T) {
-	curve := curves.ED25519()
-	v1 := curve.Scalar.Random(crand.Reader)
-	v2 := curve.Scalar.Random(crand.Reader)
-	v3 := curve.Scalar.Random(crand.Reader)
-	v4 := curve.Scalar.Random(crand.Reader)
-	v := []curves.Scalar{v1, v2, v3, v4}
-	aL, err := getaLBatched(v, 256, *curve)
-	require.NoError(t, err)
-	twoN := get2nVector(256, *curve)
-	for i := 1; i < len(v)+1; i++ {
-		vec := aL[(i-1)*256 : i*256]
-		product, err := innerProduct(vec, twoN)
-		require.NoError(t, err)
-		require.Zero(t, product.Cmp(v[i-1]))
-	}
-}
-
-func TestRangeBatchProverMarshal(t *testing.T) {
-	curve := curves.ED25519()
-	n := 256
-	prover, err := NewRangeProver(n*4, []byte("rangeDomain"), []byte("ippDomain"), *curve)
-	require.NoError(t, err)
-	v1 := curve.Scalar.Random(crand.Reader)
-	v2 := curve.Scalar.Random(crand.Reader)
-	v3 := curve.Scalar.Random(crand.Reader)
-	v4 := curve.Scalar.Random(crand.Reader)
-	v := []curves.Scalar{v1, v2, v3, v4}
-
-	gamma1 := curve.Scalar.Random(crand.Reader)
-	gamma2 := curve.Scalar.Random(crand.Reader)
-	gamma3 := curve.Scalar.Random(crand.Reader)
-	gamma4 := curve.Scalar.Random(crand.Reader)
-	gamma := []curves.Scalar{gamma1, gamma2, gamma3, gamma4}
-	g := curve.Point.Random(crand.Reader)
-	h := curve.Point.Random(crand.Reader)
-	u := curve.Point.Random(crand.Reader)
-	proofGenerators := RangeProofGenerators{
-		g: g,
-		h: h,
-		u: u,
-	}
-	transcript := merlin.NewTranscript("test")
-	proof, err := prover.BatchProve(v, gamma, n, proofGenerators, transcript)
-	require.NoError(t, err)
-
-	proofMarshaled := proof.MarshalBinary()
-	proofPrime := NewRangeProof(curve)
-	err = proofPrime.UnmarshalBinary(proofMarshaled)
-	require.NoError(t, err)
-	require.True(t, proof.capA.Equal(proofPrime.capA))
-	require.True(t, proof.capS.Equal(proofPrime.capS))
-	require.True(t, proof.capT1.Equal(proofPrime.capT1))
-	require.True(t, proof.capT2.Equal(proofPrime.capT2))
-	require.Zero(t, proof.taux.Cmp(proofPrime.taux))
-	require.Zero(t, proof.mu.Cmp(proofPrime.mu))
-	require.Zero(t, proof.tHat.Cmp(proofPrime.tHat))
-}

pkg/crypto/bulletproof/range_batch_verifier.go

@@ -1,91 +0,0 @@
-package bulletproof
-
-import (
-	"github.com/gtank/merlin"
-	"github.com/pkg/errors"
-
-	"github.com/onsonr/sonr/pkg/crypto/core/curves"
-)
-
-// VerifyBatched verifies a given batched range proof.
-// It takes in a list of commitments to the secret values as capV instead of a single commitment to a single point
-// when compared to the unbatched single range proof case.
-func (verifier *RangeVerifier) VerifyBatched(proof *RangeProof, capV []curves.Point, proofGenerators RangeProofGenerators, n int, transcript *merlin.Transcript) (bool, error) {
-	// Define nm as the total bits required for secrets, calculated as number of secrets * n
-	m := len(capV)
-	nm := n * m
-	// nm must be less than the number of generators generated
-	if nm > len(verifier.generators.G) {
-		return false, errors.New("ipp vector length must be less than maxVectorLength")
-	}
-
-	// In case where len(a) is less than number of generators precomputed by prover, trim to length
-	proofG := verifier.generators.G[0:nm]
-	proofH := verifier.generators.H[0:nm]
-
-	// Calc y,z,x from Fiat Shamir heuristic
-	y, z, err := calcyzBatched(capV, proof.capA, proof.capS, transcript, verifier.curve)
-	if err != nil {
-		return false, errors.Wrap(err, "rangeproof verify")
-	}
-
-	x, err := calcx(proof.capT1, proof.capT2, transcript, verifier.curve)
-	if err != nil {
-		return false, errors.Wrap(err, "rangeproof verify")
-	}
-
-	wBytes := transcript.ExtractBytes([]byte("getw"), 64)
-	w, err := verifier.curve.NewScalar().SetBytesWide(wBytes)
-	if err != nil {
-		return false, errors.Wrap(err, "rangeproof prove")
-	}
-
-	// Calc delta(y,z), redefined for batched case on pg21
-	deltayzBatched, err := deltayzBatched(y, z, n, m, verifier.curve)
-	if err != nil {
-		return false, errors.Wrap(err, "rangeproof verify")
-	}
-
-	// Check tHat: L65, pg20
-	// See equation 72 on pg21
-	tHatIsValid := verifier.checktHatBatched(proof, capV, proofGenerators.g, proofGenerators.h, deltayzBatched, x, z, m)
-	if !tHatIsValid {
-		return false, errors.New("rangeproof verify tHat is invalid")
-	}
-
-	// Verify IPP
-	hPrime, err := gethPrime(proofH, y, verifier.curve)
-	if err != nil {
-		return false, errors.Wrap(err, "rangeproof verify")
-	}
-
-	capPhmu := getPhmuBatched(proofG, hPrime, proofGenerators.h, proof.capA, proof.capS, x, y, z, proof.mu, n, m, verifier.curve)
-
-	ippVerified, err := verifier.ippVerifier.VerifyFromRangeProof(proofG, hPrime, capPhmu, proofGenerators.u.Mul(w), proof.tHat, proof.ipp, transcript)
-	if err != nil {
-		return false, errors.Wrap(err, "rangeproof verify")
-	}
-
-	return ippVerified, nil
-}
-
-// L65, pg20.
-func (verifier *RangeVerifier) checktHatBatched(proof *RangeProof, capV []curves.Point, g, h curves.Point, deltayz, x, z curves.Scalar, m int) bool {
-	// g^tHat * h^tau_x
-	gtHat := g.Mul(proof.tHat)
-	htaux := h.Mul(proof.taux)
-	lhs := gtHat.Add(htaux)
-
-	// V^z^2 * g^delta(y,z) * Tau_1^x * Tau_2^x^2
-	// g^delta(y,z) * V^(z^2*z^m) * Tau_1^x * Tau_2^x^2
-	zm := getknVector(z, m, verifier.curve)
-	zsquarezm := multiplyScalarToScalarVector(z.Square(), zm)
-	capVzsquaretwom := verifier.curve.Point.SumOfProducts(capV, zsquarezm)
-	gdeltayz := g.Mul(deltayz)
-	capTau1x := proof.capT1.Mul(x)
-	capTau2xsquare := proof.capT2.Mul(x.Square())
-	rhs := capVzsquaretwom.Add(gdeltayz).Add(capTau1x).Add(capTau2xsquare)
-
-	// Compare lhs =? rhs
-	return lhs.Equal(rhs)
-}

pkg/crypto/bulletproof/range_batch_verifier_test.go

@@ -1,148 +0,0 @@
-package bulletproof
-
-import (
-	crand "crypto/rand"
-	"testing"
-
-	"github.com/gtank/merlin"
-	"github.com/stretchr/testify/require"
-
-	"github.com/onsonr/sonr/pkg/crypto/core/curves"
-)
-
-func TestRangeBatchVerifyHappyPath(t *testing.T) {
-	curve := curves.ED25519()
-	n := 256
-	prover, err := NewRangeProver(n*4, []byte("rangeDomain"), []byte("ippDomain"), *curve)
-	require.NoError(t, err)
-	v1 := curve.Scalar.Random(crand.Reader)
-	v2 := curve.Scalar.Random(crand.Reader)
-	v3 := curve.Scalar.Random(crand.Reader)
-	v4 := curve.Scalar.Random(crand.Reader)
-	v := []curves.Scalar{v1, v2, v3, v4}
-	gamma1 := curve.Scalar.Random(crand.Reader)
-	gamma2 := curve.Scalar.Random(crand.Reader)
-	gamma3 := curve.Scalar.Random(crand.Reader)
-	gamma4 := curve.Scalar.Random(crand.Reader)
-	gamma := []curves.Scalar{gamma1, gamma2, gamma3, gamma4}
-	g := curve.Point.Random(crand.Reader)
-	h := curve.Point.Random(crand.Reader)
-	u := curve.Point.Random(crand.Reader)
-	proofGenerators := RangeProofGenerators{
-		g: g,
-		h: h,
-		u: u,
-	}
-	transcript := merlin.NewTranscript("test")
-	proof, err := prover.BatchProve(v, gamma, n, proofGenerators, transcript)
-	require.NoError(t, err)
-
-	verifier, err := NewRangeVerifier(n*4, []byte("rangeDomain"), []byte("ippDomain"), *curve)
-	require.NoError(t, err)
-	transcriptVerifier := merlin.NewTranscript("test")
-	capV := getcapVBatched(v, gamma, g, h)
-	verified, err := verifier.VerifyBatched(proof, capV, proofGenerators, n, transcriptVerifier)
-	require.NoError(t, err)
-	require.True(t, verified)
-}
-
-func TestRangeBatchVerifyNotInRange(t *testing.T) {
-	curve := curves.ED25519()
-	n := 2
-	prover, err := NewRangeProver(n*4, []byte("rangeDomain"), []byte("ippDomain"), *curve)
-	require.NoError(t, err)
-	v1 := curve.Scalar.One()
-	v2 := curve.Scalar.Random(crand.Reader)
-	v3 := curve.Scalar.Random(crand.Reader)
-	v4 := curve.Scalar.Random(crand.Reader)
-	v := []curves.Scalar{v1, v2, v3, v4}
-	gamma1 := curve.Scalar.Random(crand.Reader)
-	gamma2 := curve.Scalar.Random(crand.Reader)
-	gamma3 := curve.Scalar.Random(crand.Reader)
-	gamma4 := curve.Scalar.Random(crand.Reader)
-	gamma := []curves.Scalar{gamma1, gamma2, gamma3, gamma4}
-	g := curve.Point.Random(crand.Reader)
-	h := curve.Point.Random(crand.Reader)
-	u := curve.Point.Random(crand.Reader)
-	proofGenerators := RangeProofGenerators{
-		g: g,
-		h: h,
-		u: u,
-	}
-	transcript := merlin.NewTranscript("test")
-	_, err = prover.BatchProve(v, gamma, n, proofGenerators, transcript)
-	require.Error(t, err)
-}
-
-func TestRangeBatchVerifyNonRandom(t *testing.T) {
-	curve := curves.ED25519()
-	n := 2
-	prover, err := NewRangeProver(n*4, []byte("rangeDomain"), []byte("ippDomain"), *curve)
-	require.NoError(t, err)
-	v1 := curve.Scalar.One()
-	v2 := curve.Scalar.One()
-	v3 := curve.Scalar.One()
-	v4 := curve.Scalar.One()
-	v := []curves.Scalar{v1, v2, v3, v4}
-	gamma1 := curve.Scalar.Random(crand.Reader)
-	gamma2 := curve.Scalar.Random(crand.Reader)
-	gamma3 := curve.Scalar.Random(crand.Reader)
-	gamma4 := curve.Scalar.Random(crand.Reader)
-	gamma := []curves.Scalar{gamma1, gamma2, gamma3, gamma4}
-	g := curve.Point.Random(crand.Reader)
-	h := curve.Point.Random(crand.Reader)
-	u := curve.Point.Random(crand.Reader)
-	proofGenerators := RangeProofGenerators{
-		g: g,
-		h: h,
-		u: u,
-	}
-	transcript := merlin.NewTranscript("test")
-	proof, err := prover.BatchProve(v, gamma, n, proofGenerators, transcript)
-	require.NoError(t, err)
-
-	verifier, err := NewRangeVerifier(n*4, []byte("rangeDomain"), []byte("ippDomain"), *curve)
-	require.NoError(t, err)
-	transcriptVerifier := merlin.NewTranscript("test")
-	capV := getcapVBatched(v, gamma, g, h)
-	verified, err := verifier.VerifyBatched(proof, capV, proofGenerators, n, transcriptVerifier)
-	require.NoError(t, err)
-	require.True(t, verified)
-}
-
-func TestRangeBatchVerifyInvalid(t *testing.T) {
-	curve := curves.ED25519()
-	n := 2
-	prover, err := NewRangeProver(n*4, []byte("rangeDomain"), []byte("ippDomain"), *curve)
-	require.NoError(t, err)
-	v1 := curve.Scalar.One()
-	v2 := curve.Scalar.One()
-	v3 := curve.Scalar.One()
-	v4 := curve.Scalar.One()
-	v := []curves.Scalar{v1, v2, v3, v4}
-	gamma1 := curve.Scalar.Random(crand.Reader)
-	gamma2 := curve.Scalar.Random(crand.Reader)
-	gamma3 := curve.Scalar.Random(crand.Reader)
-	gamma4 := curve.Scalar.Random(crand.Reader)
-	gamma := []curves.Scalar{gamma1, gamma2, gamma3, gamma4}
-	g := curve.Point.Random(crand.Reader)
-	h := curve.Point.Random(crand.Reader)
-	u := curve.Point.Random(crand.Reader)
-	proofGenerators := RangeProofGenerators{
-		g: g,
-		h: h,
-		u: u,
-	}
-	transcript := merlin.NewTranscript("test")
-	proof, err := prover.BatchProve(v, gamma, n, proofGenerators, transcript)
-	require.NoError(t, err)
-
-	verifier, err := NewRangeVerifier(n*4, []byte("rangeDomain"), []byte("ippDomain"), *curve)
-	require.NoError(t, err)
-	transcriptVerifier := merlin.NewTranscript("test")
-	capV := getcapVBatched(v, gamma, g, h)
-	capV[0] = curve.Point.Random(crand.Reader)
-	verified, err := verifier.VerifyBatched(proof, capV, proofGenerators, n, transcriptVerifier)
-	require.Error(t, err)
-	require.False(t, verified)
-}

pkg/crypto/bulletproof/range_prover.go

@@ -1,476 +0,0 @@
-//
-// Copyright Coinbase, Inc. All Rights Reserved.
-//
-// SPDX-License-Identifier: Apache-2.0
-//
-
-// Package bulletproof implements the zero knowledge protocol bulletproofs as defined in https://eprint.iacr.org/2017/1066.pdf
-package bulletproof
-
-import (
-	crand "crypto/rand"
-	"math/big"
-
-	"github.com/gtank/merlin"
-	"github.com/pkg/errors"
-
-	"github.com/onsonr/sonr/pkg/crypto/core/curves"
-)
-
-// RangeProver is the struct used to create RangeProofs
-// It specifies which curve to use and holds precomputed generators
-// See NewRangeProver() for prover initialization.
-type RangeProver struct {
-	curve      curves.Curve
-	generators *ippGenerators
-	ippProver  *InnerProductProver
-}
-
-// RangeProof is the struct used to hold a range proof
-// capA is a commitment to a_L and a_R using randomness alpha
-// capS is a commitment to s_L and s_R using randomness rho
-// capTau1,2 are commitments to t1,t2 respectively using randomness tau_1,2
-// tHat represents t(X) as defined on page 19
-// taux is the blinding factor for tHat
-// ipp is the inner product proof used for compacting the transfer of l,r (See 4.2 on pg20).
-type RangeProof struct {
-	capA, capS, capT1, capT2 curves.Point
-	taux, mu, tHat           curves.Scalar
-	ipp                      *InnerProductProof
-	curve                    *curves.Curve
-}
-
-type RangeProofGenerators struct {
-	g, h, u curves.Point
-}
-
-// NewRangeProver initializes a new prover
-// It uses the specified domain to generate generators for vectors of at most maxVectorLength
-// A prover can be used to construct range proofs for vectors of length less than or equal to maxVectorLength
-// A prover is defined by an explicit curve.
-func NewRangeProver(maxVectorLength int, rangeDomain, ippDomain []byte, curve curves.Curve) (*RangeProver, error) {
-	generators, err := getGeneratorPoints(maxVectorLength, rangeDomain, curve)
-	if err != nil {
-		return nil, errors.Wrap(err, "range NewRangeProver")
-	}
-	ippProver, err := NewInnerProductProver(maxVectorLength, ippDomain, curve)
-	if err != nil {
-		return nil, errors.Wrap(err, "range NewRangeProver")
-	}
-	return &RangeProver{curve: curve, generators: generators, ippProver: ippProver}, nil
-}
-
-// NewRangeProof initializes a new RangeProof for a specified curve
-// This should be used in tandem with UnmarshalBinary() to convert a marshaled proof into the struct.
-func NewRangeProof(curve *curves.Curve) *RangeProof {
-	out := RangeProof{
-		capA:  nil,
-		capS:  nil,
-		capT1: nil,
-		capT2: nil,
-		taux:  nil,
-		mu:    nil,
-		tHat:  nil,
-		ipp:   NewInnerProductProof(curve),
-		curve: curve,
-	}
-
-	return &out
-}
-
-// Prove uses the range prover to prove that some value v is within the range [0, 2^n]
-// It implements the protocol defined on pgs 19,20 in https://eprint.iacr.org/2017/1066.pdf
-// v is the value of which to prove the range
-// n is the power that specifies the upper bound of the range, ie. 2^n
-// gamma is a scalar used for as a blinding factor
-// g, h, u are unique points used as generators for the blinding factor
-// transcript is a merlin transcript to be used for the fiat shamir heuristic.
-func (prover *RangeProver) Prove(v, gamma curves.Scalar, n int, proofGenerators RangeProofGenerators, transcript *merlin.Transcript) (*RangeProof, error) {
-	// n must be less than or equal to the number of generators generated
-	if n > len(prover.generators.G) {
-		return nil, errors.New("ipp vector length must be less than or equal to maxVectorLength")
-	}
-	// In case where len(a) is less than number of generators precomputed by prover, trim to length
-	proofG := prover.generators.G[0:n]
-	proofH := prover.generators.H[0:n]
-
-	// Check that v is in range [0, 2^n]
-	if bigZero := big.NewInt(0); v.BigInt().Cmp(bigZero) == -1 {
-		return nil, errors.New("v is less than 0")
-	}
-
-	bigTwo := big.NewInt(2)
-	if n < 0 {
-		return nil, errors.New("n cannot be less than 0")
-	}
-	bigN := big.NewInt(int64(n))
-	var bigTwoToN big.Int
-	bigTwoToN.Exp(bigTwo, bigN, nil)
-	if v.BigInt().Cmp(&bigTwoToN) == 1 {
-		return nil, errors.New("v is greater than 2^n")
-	}
-
-	// L40 on pg19
-	aL, err := getaL(v, n, prover.curve)
-	if err != nil {
-		return nil, errors.Wrap(err, "rangeproof prove")
-	}
-	onen := get1nVector(n, prover.curve)
-	// L41 on pg19
-	aR, err := subtractPairwiseScalarVectors(aL, onen)
-	if err != nil {
-		return nil, errors.Wrap(err, "rangeproof prove")
-	}
-
-	alpha := prover.curve.Scalar.Random(crand.Reader)
-	// Calc A (L44, pg19)
-	halpha := proofGenerators.h.Mul(alpha)
-	gaL := prover.curve.Point.SumOfProducts(proofG, aL)
-	haR := prover.curve.Point.SumOfProducts(proofH, aR)
-	capA := halpha.Add(gaL).Add(haR)
-
-	// L45, 46, pg19
-	sL := getBlindingVector(n, prover.curve)
-	sR := getBlindingVector(n, prover.curve)
-	rho := prover.curve.Scalar.Random(crand.Reader)
-
-	// Calc S (L47, pg19)
-	hrho := proofGenerators.h.Mul(rho)
-	gsL := prover.curve.Point.SumOfProducts(proofG, sL)
-	hsR := prover.curve.Point.SumOfProducts(proofH, sR)
-	capS := hrho.Add(gsL).Add(hsR)
-
-	// Fiat Shamir for y,z (L49, pg19)
-	capV := getcapV(v, gamma, proofGenerators.g, proofGenerators.h)
-	y, z, err := calcyz(capV, capA, capS, transcript, prover.curve)
-	if err != nil {
-		return nil, errors.Wrap(err, "rangeproof prove")
-	}
-
-	// Calc t_1, t_2
-	// See the l(X), r(X), t(X) equations on pg 19
-	// Use l(X)'s and r(X)'s constant and linear terms to derive t_1 and t_2
-	// (a_l - z*1^n)
-	zonen := multiplyScalarToScalarVector(z, onen)
-	constantTerml, err := subtractPairwiseScalarVectors(aL, zonen)
-	if err != nil {
-		return nil, errors.Wrap(err, "rangeproof prove")
-	}
-	linearTerml := sL
-
-	// z^2 * 2^N
-	twoN := get2nVector(n, prover.curve)
-	zSquareTwon := multiplyScalarToScalarVector(z.Square(), twoN)
-	// a_r + z*1^n
-	aRPluszonen, err := addPairwiseScalarVectors(aR, zonen)
-	if err != nil {
-		return nil, errors.Wrap(err, "rangeproof prove")
-	}
-	yn := getknVector(y, n, prover.curve)
-	hadamard, err := multiplyPairwiseScalarVectors(yn, aRPluszonen)
-	if err != nil {
-		return nil, errors.Wrap(err, "rangeproof prove")
-	}
-	constantTermr, err := addPairwiseScalarVectors(hadamard, zSquareTwon)
-	if err != nil {
-		return nil, errors.Wrap(err, "rangeproof prove")
-	}
-	linearTermr, err := multiplyPairwiseScalarVectors(yn, sR)
-	if err != nil {
-		return nil, errors.Wrap(err, "rangeproof prove")
-	}
-
-	// t_1 (as the linear coefficient) is the sum of the dot products of l(X)'s linear term dot r(X)'s constant term
-	// and r(X)'s linear term dot l(X)'s constant term
-	t1FirstTerm, err := innerProduct(linearTerml, constantTermr)
-	if err != nil {
-		return nil, errors.Wrap(err, "rangeproof prove")
-	}
-	t1SecondTerm, err := innerProduct(linearTermr, constantTerml)
-	if err != nil {
-		return nil, errors.Wrap(err, "rangeproof prove")
-	}
-	t1 := t1FirstTerm.Add(t1SecondTerm)
-
-	// t_2 (as the quadratic coefficient) is the dot product of l(X)'s and r(X)'s linear terms
-	t2, err := innerProduct(linearTerml, linearTermr)
-	if err != nil {
-		return nil, errors.Wrap(err, "rangeproof prove")
-	}
-
-	// L52, pg20
-	tau1 := prover.curve.Scalar.Random(crand.Reader)
-	tau2 := prover.curve.Scalar.Random(crand.Reader)
-
-	// T_1, T_2 (L53, pg20)
-	capT1 := proofGenerators.g.Mul(t1).Add(proofGenerators.h.Mul(tau1))
-	capT2 := proofGenerators.g.Mul(t2).Add(proofGenerators.h.Mul(tau2))
-
-	// Fiat shamir for x (L55, pg20)
-	x, err := calcx(capT1, capT2, transcript, prover.curve)
-	if err != nil {
-		return nil, errors.Wrap(err, "rangeproof prove")
-	}
-
-	// Calc l (L58, pg20)
-	// Instead of using the expression in the line, evaluate l() at x
-	sLx := multiplyScalarToScalarVector(x, linearTerml)
-	l, err := addPairwiseScalarVectors(constantTerml, sLx)
-	if err != nil {
-		return nil, errors.Wrap(err, "rangeproof prove")
-	}
-
-	// Calc r (L59, pg20)
-	// Instead of using the expression in the line, evaluate r() at x
-	ynsRx := multiplyScalarToScalarVector(x, linearTermr)
-	r, err := addPairwiseScalarVectors(constantTermr, ynsRx)
-	if err != nil {
-		return nil, errors.Wrap(err, "rangeproof prove")
-	}
-
-	// Calc t hat (L60, pg20)
-	// For efficiency, instead of calculating the dot product, evaluate t() at x
-	deltayz, err := deltayz(y, z, n, prover.curve)
-	if err != nil {
-		return nil, errors.Wrap(err, "rangeproof prove")
-	}
-	t0 := v.Mul(z.Square()).Add(deltayz)
-	tLinear := t1.Mul(x)
-	tQuadratic := t2.Mul(x.Square())
-	tHat := t0.Add(tLinear).Add(tQuadratic)
-
-	// Calc tau_x (L61, pg20)
-	tau2xsquare := tau2.Mul(x.Square())
-	tau1x := tau1.Mul(x)
-	zsquaregamma := z.Square().Mul(gamma)
-	taux := tau2xsquare.Add(tau1x).Add(zsquaregamma)
-
-	// Calc mu (L62, pg20)
-	mu := alpha.Add(rho.Mul(x))
-
-	// Calc IPP (See section 4.2)
-	hPrime, err := gethPrime(proofH, y, prover.curve)
-	if err != nil {
-		return nil, errors.Wrap(err, "rangeproof prove")
-	}
-
-	capPhmu, err := getPhmu(proofG, hPrime, proofGenerators.h, capA, capS, x, y, z, mu, n, prover.curve)
-	if err != nil {
-		return nil, errors.Wrap(err, "rangeproof prove")
-	}
-
-	wBytes := transcript.ExtractBytes([]byte("getw"), 64)
-	w, err := prover.curve.NewScalar().SetBytesWide(wBytes)
-	if err != nil {
-		return nil, errors.Wrap(err, "rangeproof prove")
-	}
-
-	ipp, err := prover.ippProver.rangeToIPP(proofG, hPrime, l, r, tHat, capPhmu, proofGenerators.u.Mul(w), transcript)
-	if err != nil {
-		return nil, errors.Wrap(err, "rangeproof prove")
-	}
-
-	out := &RangeProof{
-		capA:  capA,
-		capS:  capS,
-		capT1: capT1,
-		capT2: capT2,
-		taux:  taux,
-		mu:    mu,
-		tHat:  tHat,
-		ipp:   ipp,
-		curve: &prover.curve,
-	}
-	return out, nil
-}
-
-// MarshalBinary takes a range proof and marshals into bytes.
-func (proof *RangeProof) MarshalBinary() []byte {
-	var out []byte
-	out = append(out, proof.capA.ToAffineCompressed()...)
-	out = append(out, proof.capS.ToAffineCompressed()...)
-	out = append(out, proof.capT1.ToAffineCompressed()...)
-	out = append(out, proof.capT2.ToAffineCompressed()...)
-	out = append(out, proof.taux.Bytes()...)
-	out = append(out, proof.mu.Bytes()...)
-	out = append(out, proof.tHat.Bytes()...)
-	out = append(out, proof.ipp.MarshalBinary()...)
-
-	return out
-}
-
-// UnmarshalBinary takes bytes of a marshaled proof and writes them into a range proof
-// The range proof used should be from the output of NewRangeProof().
-func (proof *RangeProof) UnmarshalBinary(data []byte) error {
-	scalarLen := len(proof.curve.NewScalar().Bytes())
-	pointLen := len(proof.curve.NewGeneratorPoint().ToAffineCompressed())
-	ptr := 0
-	// Get points
-	capA, err := proof.curve.Point.FromAffineCompressed(data[ptr : ptr+pointLen])
-	if err != nil {
-		return errors.New("rangeProof UnmarshalBinary FromAffineCompressed")
-	}
-	proof.capA = capA
-	ptr += pointLen
-	capS, err := proof.curve.Point.FromAffineCompressed(data[ptr : ptr+pointLen])
-	if err != nil {
-		return errors.New("rangeProof UnmarshalBinary FromAffineCompressed")
-	}
-	proof.capS = capS
-	ptr += pointLen
-	capT1, err := proof.curve.Point.FromAffineCompressed(data[ptr : ptr+pointLen])
-	if err != nil {
-		return errors.New("rangeProof UnmarshalBinary FromAffineCompressed")
-	}
-	proof.capT1 = capT1
-	ptr += pointLen
-	capT2, err := proof.curve.Point.FromAffineCompressed(data[ptr : ptr+pointLen])
-	if err != nil {
-		return errors.New("rangeProof UnmarshalBinary FromAffineCompressed")
-	}
-	proof.capT2 = capT2
-	ptr += pointLen
-
-	// Get scalars
-	taux, err := proof.curve.NewScalar().SetBytes(data[ptr : ptr+scalarLen])
-	if err != nil {
-		return errors.New("rangeProof UnmarshalBinary SetBytes")
-	}
-	proof.taux = taux
-	ptr += scalarLen
-	mu, err := proof.curve.NewScalar().SetBytes(data[ptr : ptr+scalarLen])
-	if err != nil {
-		return errors.New("rangeProof UnmarshalBinary SetBytes")
-	}
-	proof.mu = mu
-	ptr += scalarLen
-	tHat, err := proof.curve.NewScalar().SetBytes(data[ptr : ptr+scalarLen])
-	if err != nil {
-		return errors.New("rangeProof UnmarshalBinary SetBytes")
-	}
-	proof.tHat = tHat
-	ptr += scalarLen
-
-	// Get IPP
-	err = proof.ipp.UnmarshalBinary(data[ptr:])
-	if err != nil {
-		return errors.New("rangeProof UnmarshalBinary")
-	}
-
-	return nil
-}
-
-// checkRange validates whether some scalar v is within the range [0, 2^n - 1]
-// It will return an error if v is less than 0 or greater than 2^n - 1
-// Otherwise it will return nil.
-func checkRange(v curves.Scalar, n int) error {
-	bigOne := big.NewInt(1)
-	if n < 0 {
-		return errors.New("n cannot be less than 0")
-	}
-	var bigTwoToN big.Int
-	bigTwoToN.Lsh(bigOne, uint(n))
-	if v.BigInt().Cmp(&bigTwoToN) == 1 {
-		return errors.New("v is greater than 2^n")
-	}
-
-	return nil
-}
-
-// getBlindingVector returns a vector of scalars used as blinding factors for commitments.
-func getBlindingVector(length int, curve curves.Curve) []curves.Scalar {
-	vec := make([]curves.Scalar, length)
-	for i := 0; i < length; i++ {
-		vec[i] = curve.Scalar.Random(crand.Reader)
-	}
-	return vec
-}
-
-// getcapV returns a commitment to v using blinding factor gamma.
-func getcapV(v, gamma curves.Scalar, g, h curves.Point) curves.Point {
-	return h.Mul(gamma).Add(g.Mul(v))
-}
-
-// getaL obtains the bit vector representation of v
-// See the a_L definition towards the bottom of pg 17 of https://eprint.iacr.org/2017/1066.pdf
-func getaL(v curves.Scalar, n int, curve curves.Curve) ([]curves.Scalar, error) {
-	var err error
-
-	vBytes := v.Bytes()
-	zero := curve.Scalar.Zero()
-	one := curve.Scalar.One()
-	aL := make([]curves.Scalar, n)
-	for j := 0; j < len(aL); j++ {
-		aL[j] = zero
-	}
-	for i := 0; i < n; i++ {
-		ithBit := vBytes[i>>3] >> (i & 0x07) & 0x01
-		aL[i], err = cmoveScalar(zero, one, int(ithBit), curve)
-		if err != nil {
-			return nil, errors.Wrap(err, "getaL")
-		}
-	}
-
-	return aL, nil
-}
-
-// cmoveScalar provides a constant time operation that returns x if which is 0 and returns y if which is 1.
-func cmoveScalar(x, y curves.Scalar, which int, curve curves.Curve) (curves.Scalar, error) {
-	if which != 0 && which != 1 {
-		return nil, errors.New("cmoveScalar which must be 0 or 1")
-	}
-	mask := -byte(which)
-	xBytes := x.Bytes()
-	yBytes := y.Bytes()
-	for i, xByte := range xBytes {
-		xBytes[i] ^= (xByte ^ yBytes[i]) & mask
-	}
-	out, err := curve.NewScalar().SetBytes(xBytes)
-	if err != nil {
-		return nil, errors.Wrap(err, "cmoveScalar SetBytes")
-	}
-
-	return out, nil
-}
-
-// calcyz uses a merlin transcript for Fiat Shamir
-// It takes the current state of the transcript and appends the newly calculated capA and capS values
-// Two new scalars are then read from the transcript
-// See section 4.4 pg22 of https://eprint.iacr.org/2017/1066.pdf
-func calcyz(capV, capA, capS curves.Point, transcript *merlin.Transcript, curve curves.Curve) (curves.Scalar, curves.Scalar, error) {
-	// Add the A,S values to transcript
-	transcript.AppendMessage([]byte("addV"), capV.ToAffineUncompressed())
-	transcript.AppendMessage([]byte("addcapA"), capA.ToAffineUncompressed())
-	transcript.AppendMessage([]byte("addcapS"), capS.ToAffineUncompressed())
-	// Read 64 bytes twice from, set to scalar for y and z
-	yBytes := transcript.ExtractBytes([]byte("gety"), 64)
-	y, err := curve.NewScalar().SetBytesWide(yBytes)
-	if err != nil {
-		return nil, nil, errors.Wrap(err, "calcyz NewScalar SetBytesWide")
-	}
-	zBytes := transcript.ExtractBytes([]byte("getz"), 64)
-	z, err := curve.NewScalar().SetBytesWide(zBytes)
-	if err != nil {
-		return nil, nil, errors.Wrap(err, "calcyz NewScalar SetBytesWide")
-	}
-
-	return y, z, nil
-}
-
-// calcx uses a merlin transcript for Fiat Shamir
-// It takes the current state of the transcript and appends the newly calculated capT1 and capT2 values
-// A new scalar is then read from the transcript
-// See section 4.4 pg22 of https://eprint.iacr.org/2017/1066.pdf
-func calcx(capT1, capT2 curves.Point, transcript *merlin.Transcript, curve curves.Curve) (curves.Scalar, error) {
-	// Add the Tau1,2 values to transcript
-	transcript.AppendMessage([]byte("addcapT1"), capT1.ToAffineUncompressed())
-	transcript.AppendMessage([]byte("addcapT2"), capT2.ToAffineUncompressed())
-	// Read 64 bytes from, set to scalar
-	outBytes := transcript.ExtractBytes([]byte("getx"), 64)
-	x, err := curve.NewScalar().SetBytesWide(outBytes)
-	if err != nil {
-		return nil, errors.Wrap(err, "calcx NewScalar SetBytesWide")
-	}
-
-	return x, nil
-}

pkg/crypto/bulletproof/range_prover_test.go

@@ -1,86 +0,0 @@
-package bulletproof
-
-import (
-	crand "crypto/rand"
-	"testing"
-
-	"github.com/gtank/merlin"
-	"github.com/stretchr/testify/require"
-
-	"github.com/onsonr/sonr/pkg/crypto/core/curves"
-)
-
-func TestRangeProverHappyPath(t *testing.T) {
-	curve := curves.ED25519()
-	n := 256
-	prover, err := NewRangeProver(n, []byte("rangeDomain"), []byte("ippDomain"), *curve)
-	require.NoError(t, err)
-	v := curve.Scalar.Random(crand.Reader)
-	gamma := curve.Scalar.Random(crand.Reader)
-	g := curve.Point.Random(crand.Reader)
-	h := curve.Point.Random(crand.Reader)
-	u := curve.Point.Random(crand.Reader)
-	proofGenerators := RangeProofGenerators{
-		g: g,
-		h: h,
-		u: u,
-	}
-	transcript := merlin.NewTranscript("test")
-	proof, err := prover.Prove(v, gamma, n, proofGenerators, transcript)
-	require.NoError(t, err)
-	require.NotNil(t, proof)
-	require.Equal(t, 8, len(proof.ipp.capLs))
-	require.Equal(t, 8, len(proof.ipp.capRs))
-}
-
-func TestGetaL(t *testing.T) {
-	curve := curves.ED25519()
-	v := curve.Scalar.Random(crand.Reader)
-	aL, err := getaL(v, 256, *curve)
-	require.NoError(t, err)
-	twoN := get2nVector(256, *curve)
-	product, err := innerProduct(aL, twoN)
-	require.NoError(t, err)
-	require.Zero(t, product.Cmp(v))
-}
-
-func TestCmove(t *testing.T) {
-	curve := curves.ED25519()
-	two := curve.Scalar.One().Double()
-	four := two.Double()
-	out, err := cmoveScalar(two, four, 1, *curve)
-	require.NoError(t, err)
-	require.Zero(t, out.Cmp(four))
-}
-
-func TestRangeProverMarshal(t *testing.T) {
-	curve := curves.ED25519()
-	n := 256
-	prover, err := NewRangeProver(n, []byte("rangeDomain"), []byte("ippDomain"), *curve)
-	require.NoError(t, err)
-	v := curve.Scalar.Random(crand.Reader)
-	gamma := curve.Scalar.Random(crand.Reader)
-	g := curve.Point.Random(crand.Reader)
-	h := curve.Point.Random(crand.Reader)
-	u := curve.Point.Random(crand.Reader)
-	proofGenerators := RangeProofGenerators{
-		g: g,
-		h: h,
-		u: u,
-	}
-	transcript := merlin.NewTranscript("test")
-	proof, err := prover.Prove(v, gamma, n, proofGenerators, transcript)
-	require.NoError(t, err)
-
-	proofMarshaled := proof.MarshalBinary()
-	proofPrime := NewRangeProof(curve)
-	err = proofPrime.UnmarshalBinary(proofMarshaled)
-	require.NoError(t, err)
-	require.True(t, proof.capA.Equal(proofPrime.capA))
-	require.True(t, proof.capS.Equal(proofPrime.capS))
-	require.True(t, proof.capT1.Equal(proofPrime.capT1))
-	require.True(t, proof.capT2.Equal(proofPrime.capT2))
-	require.Zero(t, proof.taux.Cmp(proofPrime.taux))
-	require.Zero(t, proof.mu.Cmp(proofPrime.mu))
-	require.Zero(t, proof.tHat.Cmp(proofPrime.tHat))
-}

pkg/crypto/bulletproof/range_verifier.go

@@ -1,187 +0,0 @@
-package bulletproof
-
-import (
-	"github.com/gtank/merlin"
-	"github.com/pkg/errors"
-
-	"github.com/onsonr/sonr/pkg/crypto/core/curves"
-)
-
-// RangeVerifier is the struct used to verify RangeProofs
-// It specifies which curve to use and holds precomputed generators
-// See NewRangeVerifier() for verifier initialization.
-type RangeVerifier struct {
-	curve       curves.Curve
-	generators  *ippGenerators
-	ippVerifier *InnerProductVerifier
-}
-
-// NewRangeVerifier initializes a new verifier
-// It uses the specified domain to generate generators for vectors of at most maxVectorLength
-// A verifier can be used to verify range proofs for vectors of length less than or equal to maxVectorLength
-// A verifier is defined by an explicit curve.
-func NewRangeVerifier(maxVectorLength int, rangeDomain, ippDomain []byte, curve curves.Curve) (*RangeVerifier, error) {
-	generators, err := getGeneratorPoints(maxVectorLength, rangeDomain, curve)
-	if err != nil {
-		return nil, errors.Wrap(err, "range NewRangeProver")
-	}
-	ippVerifier, err := NewInnerProductVerifier(maxVectorLength, ippDomain, curve)
-	if err != nil {
-		return nil, errors.Wrap(err, "range NewRangeProver")
-	}
-	return &RangeVerifier{curve: curve, generators: generators, ippVerifier: ippVerifier}, nil
-}
-
-// Verify verifies the given range proof inputs
-// It implements the checking of L65 on pg 20
-// It also verifies the dot product of <l,r> using the inner product proof\
-// capV is a commitment to v using blinding factor gamma
-// n is the power that specifies the upper bound of the range, ie. 2^n
-// g, h, u are unique points used as generators for the blinding factor
-// transcript is a merlin transcript to be used for the fiat shamir heuristic.
-func (verifier *RangeVerifier) Verify(proof *RangeProof, capV curves.Point, proofGenerators RangeProofGenerators, n int, transcript *merlin.Transcript) (bool, error) {
-	// Length of vectors must be less than the number of generators generated
-	if n > len(verifier.generators.G) {
-		return false, errors.New("ipp vector length must be less than maxVectorLength")
-	}
-	// In case where len(a) is less than number of generators precomputed by prover, trim to length
-	proofG := verifier.generators.G[0:n]
-	proofH := verifier.generators.H[0:n]
-
-	// Calc y,z,x from Fiat Shamir heuristic
-	y, z, err := calcyz(capV, proof.capA, proof.capS, transcript, verifier.curve)
-	if err != nil {
-		return false, errors.Wrap(err, "rangeproof verify")
-	}
-
-	x, err := calcx(proof.capT1, proof.capT2, transcript, verifier.curve)
-	if err != nil {
-		return false, errors.Wrap(err, "rangeproof verify")
-	}
-
-	wBytes := transcript.ExtractBytes([]byte("getw"), 64)
-	w, err := verifier.curve.NewScalar().SetBytesWide(wBytes)
-	if err != nil {
-		return false, errors.Wrap(err, "rangeproof prove")
-	}
-
-	// Calc delta(y,z)
-	deltayz, err := deltayz(y, z, n, verifier.curve)
-	if err != nil {
-		return false, errors.Wrap(err, "rangeproof verify")
-	}
-
-	// Check tHat: L65, pg20
-	tHatIsValid := verifier.checktHat(proof, capV, proofGenerators.g, proofGenerators.h, deltayz, x, z)
-	if !tHatIsValid {
-		return false, errors.New("rangeproof verify tHat is invalid")
-	}
-
-	// Verify IPP
-	hPrime, err := gethPrime(proofH, y, verifier.curve)
-	if err != nil {
-		return false, errors.Wrap(err, "rangeproof verify")
-	}
-
-	capPhmu, err := getPhmu(proofG, hPrime, proofGenerators.h, proof.capA, proof.capS, x, y, z, proof.mu, n, verifier.curve)
-	if err != nil {
-		return false, errors.Wrap(err, "rangeproof verify")
-	}
-
-	ippVerified, err := verifier.ippVerifier.VerifyFromRangeProof(proofG, hPrime, capPhmu, proofGenerators.u.Mul(w), proof.tHat, proof.ipp, transcript)
-	if err != nil {
-		return false, errors.Wrap(err, "rangeproof verify")
-	}
-
-	return ippVerified, nil
-}
-
-// L65, pg20.
-func (*RangeVerifier) checktHat(proof *RangeProof, capV, g, h curves.Point, deltayz, x, z curves.Scalar) bool {
-	// g^tHat * h^tau_x
-	gtHat := g.Mul(proof.tHat)
-	htaux := h.Mul(proof.taux)
-	lhs := gtHat.Add(htaux)
-
-	// V^z^2 * g^delta(y,z) * Tau_1^x * Tau_2^x^2
-	capVzsquare := capV.Mul(z.Square())
-	gdeltayz := g.Mul(deltayz)
-	capTau1x := proof.capT1.Mul(x)
-	capTau2xsquare := proof.capT2.Mul(x.Square())
-	rhs := capVzsquare.Add(gdeltayz).Add(capTau1x).Add(capTau2xsquare)
-
-	// Compare lhs =? rhs
-	return lhs.Equal(rhs)
-}
-
-// gethPrime calculates new h prime generators as defined in L64 on pg20.
-func gethPrime(h []curves.Point, y curves.Scalar, curve curves.Curve) ([]curves.Point, error) {
-	hPrime := make([]curves.Point, len(h))
-	yInv, err := y.Invert()
-	yInvn := getknVector(yInv, len(h), curve)
-	if err != nil {
-		return nil, errors.Wrap(err, "gethPrime")
-	}
-	for i, hElem := range h {
-		hPrime[i] = hElem.Mul(yInvn[i])
-	}
-	return hPrime, nil
-}
-
-// Obtain P used for IPP verification
-// See L67 on pg20
-// Note P on L66 includes blinding factor hmu, this method removes that factor.
-func getPhmu(proofG, proofHPrime []curves.Point, h, capA, capS curves.Point, x, y, z, mu curves.Scalar, n int, curve curves.Curve) (curves.Point, error) {
-	// h'^(z*y^n + z^2*2^n)
-	zyn := multiplyScalarToScalarVector(z, getknVector(y, n, curve))
-	zsquaretwon := multiplyScalarToScalarVector(z.Square(), get2nVector(n, curve))
-	elemLastExponent, err := addPairwiseScalarVectors(zyn, zsquaretwon)
-	if err != nil {
-		return nil, errors.Wrap(err, "getPhmu")
-	}
-	lastElem := curve.Point.SumOfProducts(proofHPrime, elemLastExponent)
-
-	// S^x
-	capSx := capS.Mul(x)
-
-	// g^-z --> -z*<1,g>
-	onen := get1nVector(n, curve)
-	zNeg := z.Neg()
-	zinvonen := multiplyScalarToScalarVector(zNeg, onen)
-	zgdotonen := curve.Point.SumOfProducts(proofG, zinvonen)
-
-	// L66 on pg20
-	P := capA.Add(capSx).Add(zgdotonen).Add(lastElem)
-	hmu := h.Mul(mu)
-	Phmu := P.Sub(hmu)
-
-	return Phmu, nil
-}
-
-// Delta function for delta(y,z), See (39) on pg18.
-func deltayz(y, z curves.Scalar, n int, curve curves.Curve) (curves.Scalar, error) {
-	// z - z^2
-	zMinuszsquare := z.Sub(z.Square())
-	// 1^n
-	onen := get1nVector(n, curve)
-	// <1^n, y^n>
-	onendotyn, err := innerProduct(onen, getknVector(y, n, curve))
-	if err != nil {
-		return nil, errors.Wrap(err, "deltayz")
-	}
-	// (z - z^2)*<1^n, y^n>
-	termFirst := zMinuszsquare.Mul(onendotyn)
-
-	// <1^n, 2^n>
-	onendottwon, err := innerProduct(onen, get2nVector(n, curve))
-	if err != nil {
-		return nil, errors.Wrap(err, "deltayz")
-	}
-	// z^3*<1^n, 2^n>
-	termSecond := z.Cube().Mul(onendottwon)
-
-	// (z - z^2)*<1^n, y^n> - z^3*<1^n, 2^n>
-	out := termFirst.Sub(termSecond)
-
-	return out, nil
-}

pkg/crypto/bulletproof/range_verifier_test.go

@@ -1,87 +0,0 @@
-package bulletproof
-
-import (
-	crand "crypto/rand"
-	"testing"
-
-	"github.com/gtank/merlin"
-	"github.com/stretchr/testify/require"
-
-	"github.com/onsonr/sonr/pkg/crypto/core/curves"
-)
-
-func TestRangeVerifyHappyPath(t *testing.T) {
-	curve := curves.ED25519()
-	n := 256
-	prover, err := NewRangeProver(n, []byte("rangeDomain"), []byte("ippDomain"), *curve)
-	require.NoError(t, err)
-	v := curve.Scalar.Random(crand.Reader)
-	gamma := curve.Scalar.Random(crand.Reader)
-	g := curve.Point.Random(crand.Reader)
-	h := curve.Point.Random(crand.Reader)
-	u := curve.Point.Random(crand.Reader)
-	proofGenerators := RangeProofGenerators{
-		g: g,
-		h: h,
-		u: u,
-	}
-	transcript := merlin.NewTranscript("test")
-	proof, err := prover.Prove(v, gamma, n, proofGenerators, transcript)
-	require.NoError(t, err)
-
-	verifier, err := NewRangeVerifier(n, []byte("rangeDomain"), []byte("ippDomain"), *curve)
-	require.NoError(t, err)
-	transcriptVerifier := merlin.NewTranscript("test")
-	capV := getcapV(v, gamma, g, h)
-	verified, err := verifier.Verify(proof, capV, proofGenerators, n, transcriptVerifier)
-	require.NoError(t, err)
-	require.True(t, verified)
-}
-
-func TestRangeVerifyNotInRange(t *testing.T) {
-	curve := curves.ED25519()
-	n := 2
-	prover, err := NewRangeProver(n, []byte("rangeDomain"), []byte("ippDomain"), *curve)
-	require.NoError(t, err)
-	v := curve.Scalar.Random(crand.Reader)
-	gamma := curve.Scalar.Random(crand.Reader)
-	g := curve.Point.Random(crand.Reader)
-	h := curve.Point.Random(crand.Reader)
-	u := curve.Point.Random(crand.Reader)
-	proofGenerators := RangeProofGenerators{
-		g: g,
-		h: h,
-		u: u,
-	}
-	transcript := merlin.NewTranscript("test")
-	_, err = prover.Prove(v, gamma, n, proofGenerators, transcript)
-	require.Error(t, err)
-}
-
-func TestRangeVerifyNonRandom(t *testing.T) {
-	curve := curves.ED25519()
-	n := 2
-	prover, err := NewRangeProver(n, []byte("rangeDomain"), []byte("ippDomain"), *curve)
-	require.NoError(t, err)
-	v := curve.Scalar.One()
-	gamma := curve.Scalar.Random(crand.Reader)
-	g := curve.Point.Random(crand.Reader)
-	h := curve.Point.Random(crand.Reader)
-	u := curve.Point.Random(crand.Reader)
-	proofGenerators := RangeProofGenerators{
-		g: g,
-		h: h,
-		u: u,
-	}
-	transcript := merlin.NewTranscript("test")
-	proof, err := prover.Prove(v, gamma, n, proofGenerators, transcript)
-	require.NoError(t, err)
-
-	verifier, err := NewRangeVerifier(n, []byte("rangeDomain"), []byte("ippDomain"), *curve)
-	require.NoError(t, err)
-	transcriptVerifier := merlin.NewTranscript("test")
-	capV := getcapV(v, gamma, g, h)
-	verified, err := verifier.Verify(proof, capV, proofGenerators, n, transcriptVerifier)
-	require.NoError(t, err)
-	require.True(t, verified)
-}

pkg/crypto/core/README.md

@@ -1,14 +0,0 @@
----
-aliases: [README]
-tags: []
-title: README
-linter-yaml-title-alias: README
-date created: Wednesday, April 17th 2024, 4:11:40 pm
-date modified: Thursday, April 18th 2024, 8:19:25 am
----
-
-## Core Package
-
-The core package contains a set of primitives, including but not limited to various
-elliptic curves, hashes, and commitment schemes. These primitives are used internally
-and can also be used independently on their own externally.

pkg/crypto/core/commit.go

@@ -1,115 +0,0 @@
-//
-// Copyright Coinbase, Inc. All Rights Reserved.
-//
-// SPDX-License-Identifier: Apache-2.0
-//
-
-package core
-
-import (
-	"crypto/hmac"
-	crand "crypto/rand"
-	"crypto/sha256"
-	"crypto/subtle"
-	"encoding/json"
-	"fmt"
-	"hash"
-)
-
-// Size of random values and hash outputs are determined by our hash function
-const Size = sha256.Size
-
-type (
-	// Commitment to a given message which can be later revealed.
-	// This is sent to and held by a verifier until the corresponding
-	// witness is provided.
-	Commitment []byte
-
-	// Witness is sent to and opened by the verifier. This proves that
-	// committed message hasn't been altered by later information.
-	Witness struct {
-		Msg []byte
-		r   [Size]byte
-	}
-
-	// witnessJSON is used for un/marshaling.
-	witnessJSON struct {
-		Msg []byte
-		R   [Size]byte
-	}
-)
-
-// MarshalJSON encodes Witness in JSON
-func (w Witness) MarshalJSON() ([]byte, error) {
-	return json.Marshal(witnessJSON{w.Msg, w.r})
-}
-
-// UnmarshalJSON decodes JSON into a Witness struct
-func (w *Witness) UnmarshalJSON(data []byte) error {
-	witness := &witnessJSON{}
-	err := json.Unmarshal(data, witness)
-	if err != nil {
-		return err
-	}
-	w.Msg = witness.Msg
-	w.r = witness.R
-	return nil
-}
-
-// Commit to a given message. Uses SHA256 as the hash function.
-func Commit(msg []byte) (Commitment, *Witness, error) {
-	// Initialize our decommitment
-	d := Witness{msg, [Size]byte{}}
-
-	// Generate a random nonce of the required length
-	n, err := crand.Read(d.r[:])
-	// Ensure no errors retrieving nonce
-	if err != nil {
-		return nil, nil, err
-	}
-
-	// Ensure we read all the bytes expected
-	if n != Size {
-		return nil, nil, fmt.Errorf("failed to read %v bytes from crypto/rand: received %v bytes", Size, n)
-	}
-	// Compute the commitment: HMAC(Sha2, msg, key)
-	c, err := ComputeHMAC(sha256.New, msg, d.r[:])
-	if err != nil {
-		return nil, nil, err
-	}
-	return c, &d, nil
-}
-
-// Open a commitment and return true if the commitment/decommitment pair are valid.
-// reference: spec.§2.4: Commitment Scheme
-func Open(c Commitment, d Witness) (bool, error) {
-	// Ensure commitment is well-formed.
-	if len(c) != Size {
-		return false, fmt.Errorf("invalid commitment, wrong length. %v != %v", len(c), Size)
-	}
-
-	// Re-compute the commitment: HMAC(Sha2, msg, key)
-	cʹ, err := ComputeHMAC(sha256.New, d.Msg, d.r[:])
-	if err != nil {
-		return false, err
-	}
-	return subtle.ConstantTimeCompare(cʹ, c) == 1, nil
-}
-
-// ComputeHMAC computes HMAC(hash_fn, msg, key)
-// Takes in a hash function to use for HMAC
-func ComputeHMAC(f func() hash.Hash, msg []byte, k []byte) ([]byte, error) {
-	if f == nil {
-		return nil, fmt.Errorf("hash function cannot be nil")
-	}
-
-	mac := hmac.New(f, k)
-	w, err := mac.Write(msg)
-
-	if w != len(msg) {
-		return nil, fmt.Errorf("bytes written to hash doesn't match expected: %v != %v", w, len(msg))
-	} else if err != nil {
-		return nil, err
-	}
-	return mac.Sum(nil), nil
-}

pkg/crypto/core/commit_test.go

@@ -1,374 +0,0 @@
-//
-// Copyright Coinbase, Inc. All Rights Reserved.
-//
-// SPDX-License-Identifier: Apache-2.0
-//
-
-package core
-
-import (
-	"bytes"
-	"encoding/json"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-// An entry into our test table
-type entry struct {
-	// Input
-	msg []byte
-
-	// Result (actual, not expected)
-	commit   Commitment
-	decommit *Witness
-	err      error
-}
-
-// Test inputs and placeholders for results that will be filled in
-// during init()
-var testResults = []entry{
-	{[]byte("This is a test message"), nil, nil, nil},
-	{[]byte("short msg"), nil, nil, nil},
-	{[]byte("This input field is intentionally longer than the SHA256 block size to ensure that the entire message is processed"),
-		nil, nil, nil},
-	{[]byte{0xFB, 0x1A, 0x18, 0x47, 0x39, 0x3C, 0x9F, 0x45, 0x5F, 0x29, 0x4C, 0x51, 0x42, 0x30, 0xA6, 0xB9},
-		nil, nil, nil},
-	// msg = \epsilon (empty string)
-	{[]byte{}, nil, nil, nil},
-	// msg == nil
-	{nil, nil, nil, nil},
-}
-
-// Run our inputs through commit and record the outputs
-func init() {
-	for i := range testResults {
-		entry := &testResults[i]
-		entry.commit, entry.decommit, entry.err = Commit(entry.msg)
-	}
-}
-
-// Computing commitments should never produce errors
-func TestCommitWithoutErrors(t *testing.T) {
-	for _, entry := range testResults {
-		if entry.err != nil {
-			t.Errorf("received Commit(%v): %v", entry.msg, entry.err)
-		}
-	}
-}
-
-// Commitments should be 256b == 64B in length
-func TestCommitmentsAreExpectedLength(t *testing.T) {
-	const expLen = 256 / 8
-	for _, entry := range testResults {
-		if len(entry.commit) != expLen {
-			t.Errorf("commitment is not expected length: %v != %v", len(entry.commit), expLen)
-		}
-	}
-}
-
-// Decommit cannot be nil
-func TestCommmitProducesDecommit(t *testing.T) {
-	for _, entry := range testResults {
-		if entry.decommit == nil {
-			t.Errorf("decommit cannot be nil: Commit(%v)", entry.msg)
-		}
-	}
-}
-
-// Decommit value should contain the same message
-func TestCommmitProducesDecommitWithSameMessage(t *testing.T) {
-	for _, entry := range testResults {
-		if !bytes.Equal(entry.msg, entry.decommit.Msg) {
-			t.Errorf("decommit.msg != msg: %v != %v", entry.msg, entry.decommit.Msg)
-		}
-	}
-}
-
-// Commitments should be unique
-func TestCommmitProducesDistinctCommitments(t *testing.T) {
-	seen := make(map[[Size]byte]bool)
-
-	// Check the pre-computed commitments for uniquness
-	for _, entry := range testResults {
-
-		// Slices cannot be used as hash keys, so we need to copy into
-		// an array. Oh, go-lang.
-		var cee [Size]byte
-		copy(cee[:], entry.commit)
-
-		// Ensure each commit is unique
-		if seen[cee] {
-			t.Errorf("duplicate commit found: %v", cee)
-		}
-		seen[cee] = true
-	}
-}
-
-// Commitments should be unique even for the same message since the nonce is
-// randomly selected
-func TestCommmitDistinctCommitments(t *testing.T) {
-	seen := make(map[[Size]byte]bool)
-	msg := []byte("black lives matter")
-	const iterations = 1000
-
-	// Check the pre-computed commitments for uniquness
-	for i := 0; i < iterations; i++ {
-		// Compute a commitment
-		c, _, err := Commit(msg)
-		if err != nil {
-			t.Error(err)
-		}
-
-		// Slices cannot be used as hash keys, so copy into an array
-		var cee [Size]byte
-		copy(cee[:], []byte(c))
-
-		// Ensure each commit is unique
-		if seen[cee] {
-			t.Errorf("duplicate commit found: %v", cee)
-		}
-		seen[cee] = true
-	}
-}
-
-// Nonces must be 256b = 64B
-func TestCommmitNonceIsExpectedLength(t *testing.T) {
-	const expLen = 256 / 8
-
-	// Check the pre-computed nonces
-	for _, entry := range testResults {
-		if len(entry.decommit.r) != expLen {
-			t.Errorf("nonce is not expected length: %v != %v", len(entry.decommit.r), expLen)
-		}
-	}
-}
-
-// Randomly selected nonces will be unique with overwhelming probability
-func TestCommmitProducesDistinctNonces(t *testing.T) {
-	seen := make(map[[Size]byte]bool)
-	msg := []byte("black lives matter")
-	const iterations = 1000
-
-	// Check the pre-computed commitments for uniquness
-	for i := 0; i < iterations; i++ {
-		// Compute a commitment
-		_, dee, err := Commit(msg)
-		if err != nil {
-			t.Error(err)
-		}
-
-		// Ensure each nonce is unique
-		if seen[dee.r] {
-			t.Errorf("duplicate nonce found: %v", dee.r)
-		}
-		seen[dee.r] = true
-	}
-}
-
-func TestOpenOnValidCommitments(t *testing.T) {
-	for _, entry := range testResults {
-
-		// Open each commitment
-		ok, err := Open(entry.commit, *entry.decommit)
-
-		// There should be no error
-		if err != nil {
-			t.Error(err)
-		}
-
-		// The commitments should verify
-		if !ok {
-			t.Errorf("commitment failed to open: %v", entry.msg)
-		}
-	}
-}
-
-func TestOpenOnModifiedNonce(t *testing.T) {
-	for _, entry := range testResults {
-		dʹ := copyWitness(entry.decommit)
-
-		// Modify the nonce
-		dʹ.r[0] ^= 0x40
-
-		// Open and check for failure
-		ok, err := Open(entry.commit, *dʹ)
-		assertFailedOpen(t, ok, err)
-	}
-}
-
-func TestOpenOnZeroPrefixNonce(t *testing.T) {
-	for _, entry := range testResults {
-		dʹ := copyWitness(entry.decommit)
-
-		// Modify the nonce
-		dʹ.r[0] = 0x00
-		dʹ.r[1] = 0x00
-		dʹ.r[2] = 0x00
-		dʹ.r[3] = 0x00
-		dʹ.r[4] = 0x00
-		dʹ.r[5] = 0x00
-		dʹ.r[6] = 0x00
-		dʹ.r[7] = 0x00
-		dʹ.r[8] = 0x00
-		dʹ.r[9] = 0x00
-		dʹ.r[10] = 0x00
-
-		// Open and check for failure
-		ok, err := Open(entry.commit, *dʹ)
-		assertFailedOpen(t, ok, err)
-	}
-}
-
-// Makes a deep copy of a Witness
-func copyWitness(d *Witness) *Witness {
-	msg := make([]byte, len(d.Msg))
-	var r [Size]byte
-
-	copy(msg, d.Msg)
-	copy(r[:], d.r[:])
-	return &Witness{msg, r}
-}
-
-// Asserts that err != nil, and ok == false.
-func assertFailedOpen(t *testing.T, ok bool, err error) {
-	// There should be no error
-	if err != nil {
-		t.Error(err)
-	}
-
-	// But the commitments should fail
-	if ok {
-		t.Error("commitment was verified but was expected to fail")
-	}
-}
-
-// An unrelated message should fail on open
-func TestOpenOnNewMessage(t *testing.T) {
-	for _, entry := range testResults {
-		dʹ := copyWitness(entry.decommit)
-
-		// Use a distinct message
-		dʹ.Msg = []byte("no one expects the spanish inquisition")
-
-		// Open and check for failure
-		ok, err := Open(entry.commit, *dʹ)
-		assertFailedOpen(t, ok, err)
-	}
-}
-
-// An appended message should fail on open
-func TestOpenOnAppendedMessage(t *testing.T) {
-	for _, entry := range testResults {
-		dʹ := copyWitness(entry.decommit)
-
-		// Modify the message
-		dʹ.Msg = []byte("no one expects the spanish inquisition")
-
-		// Open and check for failure
-		ok, err := Open(entry.commit, *dʹ)
-		assertFailedOpen(t, ok, err)
-	}
-}
-
-// A modified message should fail on open
-func TestOpenOnModifiedMessage(t *testing.T) {
-	for _, entry := range testResults {
-		// Skip the empty string message for this test case
-		if len(entry.msg) == 0 {
-			continue
-		}
-
-		// Modify the message _in situ_
-		dʹ := copyWitness(entry.decommit)
-		dʹ.Msg[1] ^= 0x99
-
-		// Open and check for failure
-		ok, err := Open(entry.commit, *dʹ)
-		assertFailedOpen(t, ok, err)
-	}
-}
-
-// A modified commitment should fail on open
-func TestOpenOnModifiedCommitment(t *testing.T) {
-	for _, entry := range testResults {
-		// Copy and then modify the commitment
-		cʹ := make([]byte, Size)
-		copy(cʹ[:], entry.commit)
-		cʹ[6] ^= 0x33
-
-		// Open and check for failure
-		ok, err := Open(cʹ, *entry.decommit)
-		assertFailedOpen(t, ok, err)
-	}
-}
-
-// An empty decommit should fail to open
-func TestOpenOnDefaultDecommitObject(t *testing.T) {
-	for _, entry := range testResults {
-		// Open and check for failure
-		ok, err := Open(entry.commit, Witness{})
-		assertFailedOpen(t, ok, err)
-	}
-}
-
-// A nil commit should return an error
-func TestOpenOnNilCommitment(t *testing.T) {
-	_, err := Open(nil, Witness{})
-	assertError(t, err)
-}
-
-// Verifies that err != nil
-func assertError(t *testing.T, err error) {
-	if err == nil {
-		t.Error("expected an error but received nil")
-	}
-}
-
-// Ill-formed commitment should produce an error
-func TestOpenOnLongCommitment(t *testing.T) {
-	tooLong := make([]byte, Size+1)
-	_, err := Open(tooLong, Witness{})
-	assertError(t, err)
-}
-
-// Ill-formed commitment should produce an error
-func TestOpenOnShortCommitment(t *testing.T) {
-	tooShort := make([]byte, Size-1)
-	_, err := Open(tooShort, Witness{})
-	assertError(t, err)
-}
-
-// Tests that marshal-unmarshal is the identity function
-func TestWitnessMarshalRoundTrip(t *testing.T) {
-	expected := &Witness{
-		[]byte("I'm the dude. So that's what you call me"),
-		[Size]byte{0xAC},
-	}
-
-	// Marhal and test
-	jsonBytes, err := json.Marshal(expected)
-	require.NoError(t, err)
-	require.NotNil(t, jsonBytes)
-
-	// Unmarshal and test
-	actual := &Witness{}
-	require.NoError(t, json.Unmarshal(jsonBytes, actual))
-	require.Equal(t, expected.Msg, actual.Msg)
-	require.Equal(t, expected.r, actual.r)
-}
-
-// Tests that marshal-unmarshal is the identity function
-func TestCommitmentMarshalRoundTrip(t *testing.T) {
-	expected := Commitment([]byte("That or uh his-dudeness or duder or el duderino."))
-
-	// Marhal and test
-	jsonBytes, err := json.Marshal(expected)
-	require.NoError(t, err)
-	require.NotNil(t, jsonBytes)
-
-	// Unmarshal and test
-	actual := Commitment{}
-	require.NoError(t, json.Unmarshal(jsonBytes, &actual))
-	require.Equal(t, []byte(expected), []byte(actual))
-}

pkg/crypto/core/curves/curve.go

@@ -1,863 +0,0 @@
-//
-// Copyright Coinbase, Inc. All Rights Reserved.
-//
-// SPDX-License-Identifier: Apache-2.0
-//
-
-package curves
-
-import (
-	"crypto/elliptic"
-	"encoding/hex"
-	"encoding/json"
-	"fmt"
-	"hash"
-	"io"
-	"math/big"
-	"sync"
-
-	"github.com/onsonr/sonr/pkg/crypto/core/curves/native/bls12381"
-)
-
-var (
-	k256Initonce sync.Once
-	k256         Curve
-
-	bls12381g1Initonce sync.Once
-	bls12381g1         Curve
-
-	bls12381g2Initonce sync.Once
-	bls12381g2         Curve
-
-	bls12377g1Initonce sync.Once
-	bls12377g1         Curve
-
-	bls12377g2Initonce sync.Once
-	bls12377g2         Curve
-
-	p256Initonce sync.Once
-	p256         Curve
-
-	ed25519Initonce sync.Once
-	ed25519         Curve
-
-	pallasInitonce sync.Once
-	pallas         Curve
-)
-
-const (
-	K256Name       = "secp256k1"
-	BLS12381G1Name = "BLS12381G1"
-	BLS12381G2Name = "BLS12381G2"
-	BLS12831Name   = "BLS12831"
-	P256Name       = "P-256"
-	ED25519Name    = "ed25519"
-	PallasName     = "pallas"
-	BLS12377G1Name = "BLS12377G1"
-	BLS12377G2Name = "BLS12377G2"
-	BLS12377Name   = "BLS12377"
-)
-
-const scalarBytes = 32
-
-// Scalar represents an element of the scalar field \mathbb{F}_q
-// of the elliptic curve construction.
-type Scalar interface {
-	// Random returns a random scalar using the provided reader
-	// to retrieve bytes
-	Random(reader io.Reader) Scalar
-	// Hash the specific bytes in a manner to yield a
-	// uniformly distributed scalar
-	Hash(bytes []byte) Scalar
-	// Zero returns the additive identity element
-	Zero() Scalar
-	// One returns the multiplicative identity element
-	One() Scalar
-	// IsZero returns true if this element is the additive identity element
-	IsZero() bool
-	// IsOne returns true if this element is the multiplicative identity element
-	IsOne() bool
-	// IsOdd returns true if this element is odd
-	IsOdd() bool
-	// IsEven returns true if this element is even
-	IsEven() bool
-	// New returns an element with the value equal to `value`
-	New(value int) Scalar
-	// Cmp returns
-	// -2 if this element is in a different field than rhs
-	// -1 if this element is less than rhs
-	// 0 if this element is equal to rhs
-	// 1 if this element is greater than rhs
-	Cmp(rhs Scalar) int
-	// Square returns element*element
-	Square() Scalar
-	// Double returns element+element
-	Double() Scalar
-	// Invert returns element^-1 mod p
-	Invert() (Scalar, error)
-	// Sqrt computes the square root of this element if it exists.
-	Sqrt() (Scalar, error)
-	// Cube returns element*element*element
-	Cube() Scalar
-	// Add returns element+rhs
-	Add(rhs Scalar) Scalar
-	// Sub returns element-rhs
-	Sub(rhs Scalar) Scalar
-	// Mul returns element*rhs
-	Mul(rhs Scalar) Scalar
-	// MulAdd returns element * y + z mod p
-	MulAdd(y, z Scalar) Scalar
-	// Div returns element*rhs^-1 mod p
-	Div(rhs Scalar) Scalar
-	// Neg returns -element mod p
-	Neg() Scalar
-	// SetBigInt returns this element set to the value of v
-	SetBigInt(v *big.Int) (Scalar, error)
-	// BigInt returns this element as a big integer
-	BigInt() *big.Int
-	// Point returns the associated point for this scalar
-	Point() Point
-	// Bytes returns the canonical byte representation of this scalar
-	Bytes() []byte
-	// SetBytes creates a scalar from the canonical representation expecting the exact number of bytes needed to represent the scalar
-	SetBytes(bytes []byte) (Scalar, error)
-	// SetBytesWide creates a scalar expecting double the exact number of bytes needed to represent the scalar which is reduced by the modulus
-	SetBytesWide(bytes []byte) (Scalar, error)
-	// Clone returns a cloned Scalar of this value
-	Clone() Scalar
-}
-
-type PairingScalar interface {
-	Scalar
-	SetPoint(p Point) PairingScalar
-}
-
-func unmarshalScalar(input []byte) (*Curve, []byte, error) {
-	sep := byte(':')
-	i := 0
-	for ; i < len(input); i++ {
-		if input[i] == sep {
-			break
-		}
-	}
-	name := string(input[:i])
-	curve := GetCurveByName(name)
-	if curve == nil {
-		return nil, nil, fmt.Errorf("unrecognized curve")
-	}
-	return curve, input[i+1:], nil
-}
-
-func scalarMarshalBinary(scalar Scalar) ([]byte, error) {
-	// All scalars are 32 bytes long
-	// The last 32 bytes are the actual value
-	// The first remaining bytes are the curve name
-	// separated by a colon
-	name := []byte(scalar.Point().CurveName())
-	output := make([]byte, len(name)+1+scalarBytes)
-	copy(output[:len(name)], name)
-	output[len(name)] = byte(':')
-	copy(output[len(name)+1:], scalar.Bytes())
-	return output, nil
-}
-
-func scalarUnmarshalBinary(input []byte) (Scalar, error) {
-	// All scalars are 32 bytes long
-	// The first 32 bytes are the actual value
-	// The remaining bytes are the curve name
-	if len(input) < scalarBytes+1+len(P256Name) {
-		return nil, fmt.Errorf("invalid byte sequence")
-	}
-	sc, data, err := unmarshalScalar(input)
-	if err != nil {
-		return nil, err
-	}
-	return sc.Scalar.SetBytes(data)
-}
-
-func scalarMarshalText(scalar Scalar) ([]byte, error) {
-	// All scalars are 32 bytes long
-	// For text encoding we put the curve name first for readability
-	// separated by a colon, then the hex encoding of the scalar
-	// which avoids the base64 weakness with strict mode or not
-	name := []byte(scalar.Point().CurveName())
-	output := make([]byte, len(name)+1+scalarBytes*2)
-	copy(output[:len(name)], name)
-	output[len(name)] = byte(':')
-	_ = hex.Encode(output[len(name)+1:], scalar.Bytes())
-	return output, nil
-}
-
-func scalarUnmarshalText(input []byte) (Scalar, error) {
-	if len(input) < scalarBytes*2+len(P256Name)+1 {
-		return nil, fmt.Errorf("invalid byte sequence")
-	}
-	curve, data, err := unmarshalScalar(input)
-	if err != nil {
-		return nil, err
-	}
-	var t [scalarBytes]byte
-	_, err = hex.Decode(t[:], data)
-	if err != nil {
-		return nil, err
-	}
-	return curve.Scalar.SetBytes(t[:])
-}
-
-func scalarMarshalJson(scalar Scalar) ([]byte, error) {
-	m := make(map[string]string, 2)
-	m["type"] = scalar.Point().CurveName()
-	m["value"] = hex.EncodeToString(scalar.Bytes())
-	return json.Marshal(m)
-}
-
-func scalarUnmarshalJson(input []byte) (Scalar, error) {
-	var m map[string]string
-
-	err := json.Unmarshal(input, &m)
-	if err != nil {
-		return nil, err
-	}
-	curve := GetCurveByName(m["type"])
-	if curve == nil {
-		return nil, fmt.Errorf("invalid type")
-	}
-	s, err := hex.DecodeString(m["value"])
-	if err != nil {
-		return nil, err
-	}
-	S, err := curve.Scalar.SetBytes(s)
-	if err != nil {
-		return nil, err
-	}
-	return S, nil
-}
-
-// Point represents an elliptic curve point
-type Point interface {
-	Random(reader io.Reader) Point
-	Hash(bytes []byte) Point
-	Identity() Point
-	Generator() Point
-	IsIdentity() bool
-	IsNegative() bool
-	IsOnCurve() bool
-	Double() Point
-	Scalar() Scalar
-	Neg() Point
-	Add(rhs Point) Point
-	Sub(rhs Point) Point
-	Mul(rhs Scalar) Point
-	Equal(rhs Point) bool
-	Set(x, y *big.Int) (Point, error)
-	ToAffineCompressed() []byte
-	ToAffineUncompressed() []byte
-	FromAffineCompressed(bytes []byte) (Point, error)
-	FromAffineUncompressed(bytes []byte) (Point, error)
-	CurveName() string
-	SumOfProducts(points []Point, scalars []Scalar) Point
-}
-
-type PairingPoint interface {
-	Point
-	OtherGroup() PairingPoint
-	Pairing(rhs PairingPoint) Scalar
-	MultiPairing(...PairingPoint) Scalar
-}
-
-func pointMarshalBinary(point Point) ([]byte, error) {
-	// Always stores points in compressed form
-	// The first bytes are the curve name
-	// separated by a colon followed by the compressed point
-	// bytes
-	t := point.ToAffineCompressed()
-	name := []byte(point.CurveName())
-	output := make([]byte, len(name)+1+len(t))
-	copy(output[:len(name)], name)
-	output[len(name)] = byte(':')
-	copy(output[len(output)-len(t):], t)
-	return output, nil
-}
-
-func pointUnmarshalBinary(input []byte) (Point, error) {
-	if len(input) < scalarBytes+1+len(P256Name) {
-		return nil, fmt.Errorf("invalid byte sequence")
-	}
-	sep := byte(':')
-	i := 0
-	for ; i < len(input); i++ {
-		if input[i] == sep {
-			break
-		}
-	}
-	name := string(input[:i])
-	curve := GetCurveByName(name)
-	if curve == nil {
-		return nil, fmt.Errorf("unrecognized curve")
-	}
-	return curve.Point.FromAffineCompressed(input[i+1:])
-}
-
-func pointMarshalText(point Point) ([]byte, error) {
-	// Always stores points in compressed form
-	// The first bytes are the curve name
-	// separated by a colon followed by the compressed point
-	// bytes
-	t := point.ToAffineCompressed()
-	name := []byte(point.CurveName())
-	output := make([]byte, len(name)+1+len(t)*2)
-	copy(output[:len(name)], name)
-	output[len(name)] = byte(':')
-	hex.Encode(output[len(output)-len(t)*2:], t)
-	return output, nil
-}
-
-func pointUnmarshalText(input []byte) (Point, error) {
-	if len(input) < scalarBytes*2+1+len(P256Name) {
-		return nil, fmt.Errorf("invalid byte sequence")
-	}
-	sep := byte(':')
-	i := 0
-	for ; i < len(input); i++ {
-		if input[i] == sep {
-			break
-		}
-	}
-	name := string(input[:i])
-	curve := GetCurveByName(name)
-	if curve == nil {
-		return nil, fmt.Errorf("unrecognized curve")
-	}
-	buffer := make([]byte, (len(input)-i)/2)
-	_, err := hex.Decode(buffer, input[i+1:])
-	if err != nil {
-		return nil, err
-	}
-	return curve.Point.FromAffineCompressed(buffer)
-}
-
-func pointMarshalJson(point Point) ([]byte, error) {
-	m := make(map[string]string, 2)
-	m["type"] = point.CurveName()
-	m["value"] = hex.EncodeToString(point.ToAffineCompressed())
-	return json.Marshal(m)
-}
-
-func pointUnmarshalJson(input []byte) (Point, error) {
-	var m map[string]string
-
-	err := json.Unmarshal(input, &m)
-	if err != nil {
-		return nil, err
-	}
-	curve := GetCurveByName(m["type"])
-	if curve == nil {
-		return nil, fmt.Errorf("invalid type")
-	}
-	p, err := hex.DecodeString(m["value"])
-	if err != nil {
-		return nil, err
-	}
-	P, err := curve.Point.FromAffineCompressed(p)
-	if err != nil {
-		return nil, err
-	}
-	return P, nil
-}
-
-// Curve represents a named elliptic curve with a scalar field and point group
-type Curve struct {
-	Scalar Scalar
-	Point  Point
-	Name   string
-}
-
-func (c Curve) ScalarBaseMult(sc Scalar) Point {
-	return c.Point.Generator().Mul(sc)
-}
-
-func (c Curve) NewGeneratorPoint() Point {
-	return c.Point.Generator()
-}
-
-func (c Curve) NewIdentityPoint() Point {
-	return c.Point.Identity()
-}
-
-func (c Curve) NewScalar() Scalar {
-	return c.Scalar.Zero()
-}
-
-// ToEllipticCurve returns the equivalent of this curve as the go interface `elliptic.Curve`
-func (c Curve) ToEllipticCurve() (elliptic.Curve, error) {
-	err := fmt.Errorf("can't convert %s", c.Name)
-	switch c.Name {
-	case K256Name:
-		return K256Curve(), nil
-	case BLS12381G1Name:
-		return nil, err
-	case BLS12381G2Name:
-		return nil, err
-	case BLS12831Name:
-		return nil, err
-	case P256Name:
-		return NistP256Curve(), nil
-	case ED25519Name:
-		return nil, err
-	case PallasName:
-		return nil, err
-	case BLS12377G1Name:
-		return nil, err
-	case BLS12377G2Name:
-		return nil, err
-	case BLS12377Name:
-		return nil, err
-	default:
-		return nil, err
-	}
-}
-
-// PairingCurve represents a named elliptic curve
-// that supports pairings
-type PairingCurve struct {
-	Scalar  PairingScalar
-	PointG1 PairingPoint
-	PointG2 PairingPoint
-	GT      Scalar
-	Name    string
-}
-
-func (c PairingCurve) ScalarG1BaseMult(sc Scalar) PairingPoint {
-	return c.PointG1.Generator().Mul(sc).(PairingPoint)
-}
-
-func (c PairingCurve) ScalarG2BaseMult(sc Scalar) PairingPoint {
-	return c.PointG2.Generator().Mul(sc).(PairingPoint)
-}
-
-func (c PairingCurve) NewG1GeneratorPoint() PairingPoint {
-	return c.PointG1.Generator().(PairingPoint)
-}
-
-func (c PairingCurve) NewG2GeneratorPoint() PairingPoint {
-	return c.PointG2.Generator().(PairingPoint)
-}
-
-func (c PairingCurve) NewG1IdentityPoint() PairingPoint {
-	return c.PointG1.Identity().(PairingPoint)
-}
-
-func (c PairingCurve) NewG2IdentityPoint() PairingPoint {
-	return c.PointG2.Identity().(PairingPoint)
-}
-
-func (c PairingCurve) NewScalar() PairingScalar {
-	return c.Scalar.Zero().(PairingScalar)
-}
-
-// GetCurveByName returns the correct `Curve` given the name
-func GetCurveByName(name string) *Curve {
-	switch name {
-	case K256Name:
-		return K256()
-	case BLS12381G1Name:
-		return BLS12381G1()
-	case BLS12381G2Name:
-		return BLS12381G2()
-	case BLS12831Name:
-		return BLS12381G1()
-	case P256Name:
-		return P256()
-	case ED25519Name:
-		return ED25519()
-	case PallasName:
-		return PALLAS()
-	case BLS12377G1Name:
-		return BLS12377G1()
-	case BLS12377G2Name:
-		return BLS12377G2()
-	case BLS12377Name:
-		return BLS12377G1()
-	default:
-		return nil
-	}
-}
-
-func GetPairingCurveByName(name string) *PairingCurve {
-	switch name {
-	case BLS12381G1Name:
-		return BLS12381(BLS12381G1().NewIdentityPoint())
-	case BLS12381G2Name:
-		return BLS12381(BLS12381G2().NewIdentityPoint())
-	case BLS12831Name:
-		return BLS12381(BLS12381G1().NewIdentityPoint())
-	default:
-		return nil
-	}
-}
-
-// BLS12381G1 returns the BLS12-381 curve with points in G1
-func BLS12381G1() *Curve {
-	bls12381g1Initonce.Do(bls12381g1Init)
-	return &bls12381g1
-}
-
-func bls12381g1Init() {
-	bls12381g1 = Curve{
-		Scalar: &ScalarBls12381{
-			Value: bls12381.Bls12381FqNew(),
-			point: new(PointBls12381G1),
-		},
-		Point: new(PointBls12381G1).Identity(),
-		Name:  BLS12381G1Name,
-	}
-}
-
-// BLS12381G2 returns the BLS12-381 curve with points in G2
-func BLS12381G2() *Curve {
-	bls12381g2Initonce.Do(bls12381g2Init)
-	return &bls12381g2
-}
-
-func bls12381g2Init() {
-	bls12381g2 = Curve{
-		Scalar: &ScalarBls12381{
-			Value: bls12381.Bls12381FqNew(),
-			point: new(PointBls12381G2),
-		},
-		Point: new(PointBls12381G2).Identity(),
-		Name:  BLS12381G2Name,
-	}
-}
-
-func BLS12381(preferredPoint Point) *PairingCurve {
-	return &PairingCurve{
-		Scalar: &ScalarBls12381{
-			Value: bls12381.Bls12381FqNew(),
-			point: preferredPoint,
-		},
-		PointG1: &PointBls12381G1{
-			Value: new(bls12381.G1).Identity(),
-		},
-		PointG2: &PointBls12381G2{
-			Value: new(bls12381.G2).Identity(),
-		},
-		GT: &ScalarBls12381Gt{
-			Value: new(bls12381.Gt).SetOne(),
-		},
-		Name: BLS12831Name,
-	}
-}
-
-// BLS12377G1 returns the BLS12-377 curve with points in G1
-func BLS12377G1() *Curve {
-	bls12377g1Initonce.Do(bls12377g1Init)
-	return &bls12377g1
-}
-
-func bls12377g1Init() {
-	bls12377g1 = Curve{
-		Scalar: &ScalarBls12377{
-			value: new(big.Int),
-			point: new(PointBls12377G1),
-		},
-		Point: new(PointBls12377G1).Identity(),
-		Name:  BLS12377G1Name,
-	}
-}
-
-// BLS12377G2 returns the BLS12-377 curve with points in G2
-func BLS12377G2() *Curve {
-	bls12377g2Initonce.Do(bls12377g2Init)
-	return &bls12377g2
-}
-
-func bls12377g2Init() {
-	bls12377g2 = Curve{
-		Scalar: &ScalarBls12377{
-			value: new(big.Int),
-			point: new(PointBls12377G2),
-		},
-		Point: new(PointBls12377G2).Identity(),
-		Name:  BLS12377G2Name,
-	}
-}
-
-// K256 returns the secp256k1 curve
-func K256() *Curve {
-	k256Initonce.Do(k256Init)
-	return &k256
-}
-
-func k256Init() {
-	k256 = Curve{
-		Scalar: new(ScalarK256).Zero(),
-		Point:  new(PointK256).Identity(),
-		Name:   K256Name,
-	}
-}
-
-func P256() *Curve {
-	p256Initonce.Do(p256Init)
-	return &p256
-}
-
-func p256Init() {
-	p256 = Curve{
-		Scalar: new(ScalarP256).Zero(),
-		Point:  new(PointP256).Identity(),
-		Name:   P256Name,
-	}
-}
-
-func ED25519() *Curve {
-	ed25519Initonce.Do(ed25519Init)
-	return &ed25519
-}
-
-func ed25519Init() {
-	ed25519 = Curve{
-		Scalar: new(ScalarEd25519).Zero(),
-		Point:  new(PointEd25519).Identity(),
-		Name:   ED25519Name,
-	}
-}
-
-func PALLAS() *Curve {
-	pallasInitonce.Do(pallasInit)
-	return &pallas
-}
-
-func pallasInit() {
-	pallas = Curve{
-		Scalar: new(ScalarPallas).Zero(),
-		Point:  new(PointPallas).Identity(),
-		Name:   PallasName,
-	}
-}
-
-// https://tools.ietf.org/html/draft-irtf-cfrg-hash-to-curve-11#appendix-G.2.1
-func osswu3mod4(u *big.Int, p *sswuParams) (x, y *big.Int) {
-	params := p.Params
-	field := NewField(p.Params.P)
-
-	tv1 := field.NewElement(u)
-	tv1 = tv1.Mul(tv1)                    // tv1 = u^2
-	tv3 := field.NewElement(p.Z).Mul(tv1) // tv3 = Z * tv1
-	tv2 := tv3.Mul(tv3)                   // tv2 = tv3^2
-	xd := tv2.Add(tv3)                    // xd = tv2 + tv3
-	x1n := xd.Add(field.One())            // x1n = (xd + 1)
-	x1n = x1n.Mul(field.NewElement(p.B))  // x1n * B
-	aNeg := field.NewElement(p.A).Neg()
-	xd = xd.Mul(aNeg) // xd = -A * xd
-
-	if xd.Value.Cmp(big.NewInt(0)) == 0 {
-		xd = field.NewElement(p.Z).Mul(field.NewElement(p.A)) // xd = Z * A
-	}
-
-	tv2 = xd.Mul(xd)                     // tv2 = xd^2
-	gxd := tv2.Mul(xd)                   // gxd = tv2 * xd
-	tv2 = tv2.Mul(field.NewElement(p.A)) // tv2 = A * tv2
-
-	gx1 := x1n.Mul(x1n)                  // gx1 = x1n^2
-	gx1 = gx1.Add(tv2)                   // gx1 = gx1 + tv2
-	gx1 = gx1.Mul(x1n)                   // gx1 = gx1 * x1n
-	tv2 = gxd.Mul(field.NewElement(p.B)) // tv2 = B * gxd
-	gx1 = gx1.Add(tv2)                   // gx1 = gx1 + tv2
-
-	tv4 := gxd.Mul(gxd) // tv4 = gxd^2
-	tv2 = gx1.Mul(gxd)  // tv2 = gx1 * gxd
-	tv4 = tv4.Mul(tv2)  // tv4 = tv4 * tv2
-
-	y1 := tv4.Pow(field.NewElement(p.C1))
-	y1 = y1.Mul(tv2)    // y1 = y1 * tv2
-	x2n := tv3.Mul(x1n) // x2n = tv3 * x1n
-
-	y2 := y1.Mul(field.NewElement(p.C2)) // y2 = y1 * c2
-	y2 = y2.Mul(tv1)                     // y2 = y2 * tv1
-	y2 = y2.Mul(field.NewElement(u))     // y2 = y2 * u
-
-	tv2 = y1.Mul(y1) // tv2 = y1^2
-
-	tv2 = tv2.Mul(gxd) // tv2 = tv2 * gxd
-
-	e2 := tv2.Value.Cmp(gx1.Value) == 0
-
-	// If e2, x = x1, else x = x2
-	if e2 {
-		x = x1n.Value
-	} else {
-		x = x2n.Value
-	}
-	// xn / xd
-	x.Mul(x, new(big.Int).ModInverse(xd.Value, params.P))
-	x.Mod(x, params.P)
-
-	// If e2, y = y1, else y = y2
-	if e2 {
-		y = y1.Value
-	} else {
-		y = y2.Value
-	}
-
-	uBytes := u.Bytes()
-	yBytes := y.Bytes()
-
-	usign := uBytes[len(uBytes)-1] & 1
-	ysign := yBytes[len(yBytes)-1] & 1
-
-	// Fix sign of y
-	if usign != ysign {
-		y.Neg(y)
-		y.Mod(y, params.P)
-	}
-
-	return
-}
-
-func expandMsgXmd(h hash.Hash, msg, domain []byte, outLen int) ([]byte, error) {
-	domainLen := uint8(len(domain))
-	if domainLen > 255 {
-		return nil, fmt.Errorf("invalid domain length")
-	}
-	// DST_prime = DST || I2OSP(len(DST), 1)
-	// b_0 = H(Z_pad || msg || l_i_b_str || I2OSP(0, 1) || DST_prime)
-	_, _ = h.Write(make([]byte, h.BlockSize()))
-	_, _ = h.Write(msg)
-	_, _ = h.Write([]byte{uint8(outLen >> 8), uint8(outLen)})
-	_, _ = h.Write([]byte{0})
-	_, _ = h.Write(domain)
-	_, _ = h.Write([]byte{domainLen})
-	b0 := h.Sum(nil)
-
-	// b_1 = H(b_0 || I2OSP(1, 1) || DST_prime)
-	h.Reset()
-	_, _ = h.Write(b0)
-	_, _ = h.Write([]byte{1})
-	_, _ = h.Write(domain)
-	_, _ = h.Write([]byte{domainLen})
-	b1 := h.Sum(nil)
-
-	// b_i = H(strxor(b_0, b_(i - 1)) || I2OSP(i, 1) || DST_prime)
-	ell := (outLen + h.Size() - 1) / h.Size()
-	bi := b1
-	out := make([]byte, outLen)
-	for i := 1; i < ell; i++ {
-		h.Reset()
-		// b_i = H(strxor(b_0, b_(i - 1)) || I2OSP(i, 1) || DST_prime)
-		tmp := make([]byte, h.Size())
-		for j := 0; j < h.Size(); j++ {
-			tmp[j] = b0[j] ^ bi[j]
-		}
-		_, _ = h.Write(tmp)
-		_, _ = h.Write([]byte{1 + uint8(i)})
-		_, _ = h.Write(domain)
-		_, _ = h.Write([]byte{domainLen})
-
-		// b_1 || ... || b_(ell - 1)
-		copy(out[(i-1)*h.Size():i*h.Size()], bi[:])
-		bi = h.Sum(nil)
-	}
-	// b_ell
-	copy(out[(ell-1)*h.Size():], bi[:])
-	return out[:outLen], nil
-}
-
-func bhex(s string) *big.Int {
-	r, _ := new(big.Int).SetString(s, 16)
-	return r
-}
-
-type sswuParams struct {
-	Params          *elliptic.CurveParams
-	C1, C2, A, B, Z *big.Int
-}
-
-// sumOfProductsPippenger implements a version of Pippenger's algorithm.
-//
-// The algorithm works as follows:
-//
-// Let `n` be a number of point-scalar pairs.
-// Let `w` be a window of bits (6..8, chosen based on `n`, see cost factor).
-//
-//  1. Prepare `2^(w-1) - 1` buckets with indices `[1..2^(w-1))` initialized with identity points.
-//     Bucket 0 is not needed as it would contain points multiplied by 0.
-//  2. Convert scalars to a radix-`2^w` representation with signed digits in `[-2^w/2, 2^w/2]`.
-//     Note: only the last digit may equal `2^w/2`.
-//  3. Starting with the last window, for each point `i=[0..n)` add it to a a bucket indexed by
-//     the point's scalar's value in the window.
-//  4. Once all points in a window are sorted into buckets, add buckets by multiplying each
-//     by their index. Efficient way of doing it is to start with the last bucket and compute two sums:
-//     intermediate sum from the last to the first, and the full sum made of all intermediate sums.
-//  5. Shift the resulting sum of buckets by `w` bits by using `w` doublings.
-//  6. Add to the return value.
-//  7. Repeat the loop.
-//
-// Approximate cost w/o wNAF optimizations (A = addition, D = doubling):
-//
-// ```ascii
-// cost = (n*A + 2*(2^w/2)*A + w*D + A)*256/w
-//
-//	      |          |       |     |   |
-//	      |          |       |     |   looping over 256/w windows
-//	      |          |       |     adding to the result
-//	sorting points   |       shifting the sum by w bits (to the next window, starting from last window)
-//	one by one       |
-//	into buckets     adding/subtracting all buckets
-//	                 multiplied by their indexes
-//	                 using a sum of intermediate sums
-//
-// ```
-//
-// For large `n`, dominant factor is (n*256/w) additions.
-// However, if `w` is too big and `n` is not too big, then `(2^w/2)*A` could dominate.
-// Therefore, the optimal choice of `w` grows slowly as `n` grows.
-//
-// # For constant time we use a fixed window of 6
-//
-// This algorithm is adapted from section 4 of <https://eprint.iacr.org/2012/549.pdf>.
-// and https://cacr.uwaterloo.ca/techreports/2010/cacr2010-26.pdf
-func sumOfProductsPippenger(points []Point, scalars []*big.Int) Point {
-	if len(points) != len(scalars) {
-		return nil
-	}
-
-	const w = 6
-
-	bucketSize := (1 << w) - 1
-	windows := make([]Point, 255/w+1)
-	for i := range windows {
-		windows[i] = points[0].Identity()
-	}
-	bucket := make([]Point, bucketSize)
-
-	for j := 0; j < len(windows); j++ {
-		for i := 0; i < bucketSize; i++ {
-			bucket[i] = points[0].Identity()
-		}
-
-		for i := 0; i < len(scalars); i++ {
-			index := bucketSize & int(new(big.Int).Rsh(scalars[i], uint(w*j)).Int64())
-			if index != 0 {
-				bucket[index-1] = bucket[index-1].Add(points[i])
-			}
-		}
-
-		acc, sum := windows[j].Identity(), windows[j].Identity()
-
-		for i := bucketSize - 1; i >= 0; i-- {
-			sum = sum.Add(bucket[i])
-			acc = acc.Add(sum)
-		}
-		windows[j] = acc
-	}
-
-	acc := windows[0].Identity()
-	for i := len(windows) - 1; i >= 0; i-- {
-		for j := 0; j < w; j++ {
-			acc = acc.Double()
-		}
-		acc = acc.Add(windows[i])
-	}
-	return acc
-}

pkg/crypto/core/curves/ec_point.go

@@ -1,251 +0,0 @@
-//
-// Copyright Coinbase, Inc. All Rights Reserved.
-//
-// SPDX-License-Identifier: Apache-2.0
-//
-
-package curves
-
-import (
-	"crypto/elliptic"
-	"encoding/json"
-	"fmt"
-	"math/big"
-
-	"github.com/onsonr/sonr/pkg/crypto/core"
-
-	"github.com/dustinxie/ecc"
-	"github.com/onsonr/sonr/pkg/crypto/internal"
-)
-
-var curveNameToID = map[string]byte{
-	"secp256k1": 0,
-	"P-224":     1,
-	"P-256":     2,
-	"P-384":     3,
-	"P-521":     4,
-}
-
-var curveIDToName = map[byte]func() elliptic.Curve{
-	0: ecc.P256k1,
-	1: elliptic.P224,
-	2: elliptic.P256,
-	3: elliptic.P384,
-	4: elliptic.P521,
-}
-
-var curveMapper = map[string]func() elliptic.Curve{
-	"secp256k1": ecc.P256k1,
-	"P-224":     elliptic.P224,
-	"P-256":     elliptic.P256,
-	"P-384":     elliptic.P384,
-	"P-521":     elliptic.P521,
-}
-
-// EcPoint represents an elliptic curve Point
-type EcPoint struct {
-	Curve elliptic.Curve
-	X, Y  *big.Int
-}
-
-// EcPointJSON encapsulates the data that is serialized to JSON
-// used internally and not for external use. Public so other pieces
-// can use for serialization
-type EcPointJSON struct {
-	X         *big.Int `json:"x"`
-	Y         *big.Int `json:"y"`
-	CurveName string   `json:"curve_name"`
-}
-
-// MarshalJSON serializes EcPoint to JSON
-func (a EcPoint) MarshalJSON() ([]byte, error) {
-	return json.Marshal(EcPointJSON{
-		CurveName: a.Curve.Params().Name,
-		X:         a.X,
-		Y:         a.Y,
-	})
-}
-
-// UnmarshalJSON deserializes JSON to EcPoint
-func (a *EcPoint) UnmarshalJSON(bytes []byte) error {
-	data := new(EcPointJSON)
-	err := json.Unmarshal(bytes, data)
-	if err != nil {
-		return err
-	}
-	if mapper, ok := curveMapper[data.CurveName]; ok {
-		a.Curve = mapper()
-		a.X = data.X
-		a.Y = data.Y
-		return nil
-	}
-	return fmt.Errorf("unknown curve deserialized")
-}
-
-// MarshalBinary serializes EcPoint to binary
-func (a *EcPoint) MarshalBinary() ([]byte, error) {
-	result := [65]byte{}
-	if code, ok := curveNameToID[a.Curve.Params().Name]; ok {
-		result[0] = code
-		a.X.FillBytes(result[1:33])
-		a.Y.FillBytes(result[33:65])
-		return result[:], nil
-	}
-	return nil, fmt.Errorf("unknown curve serialized")
-}
-
-// UnmarshalBinary deserializes binary to EcPoint
-func (a *EcPoint) UnmarshalBinary(data []byte) error {
-	if mapper, ok := curveIDToName[data[0]]; ok {
-		a.Curve = mapper()
-		a.X = new(big.Int).SetBytes(data[1:33])
-		a.Y = new(big.Int).SetBytes(data[33:65])
-		return nil
-	}
-	return fmt.Errorf("unknown curve deserialized")
-}
-
-// IsValid checks if the point is valid
-func (a EcPoint) IsValid() bool {
-	return a.IsOnCurve() || a.IsIdentity()
-}
-
-// IsOnCurve checks if the point is on the curve
-func (a EcPoint) IsOnCurve() bool {
-	return a.Curve.IsOnCurve(a.X, a.Y)
-}
-
-// IsIdentity returns true if this Point is the Point at infinity
-func (a EcPoint) IsIdentity() bool {
-	x := core.ConstantTimeEqByte(a.X, core.Zero)
-	y := core.ConstantTimeEqByte(a.Y, core.Zero)
-	return (x & y) == 1
-}
-
-// Equals return true if a and b have the same x,y coordinates
-func (a EcPoint) Equals(b *EcPoint) bool {
-	if !sameCurve(&a, b) {
-		return false
-	}
-	x := core.ConstantTimeEqByte(a.X, b.X)
-	y := core.ConstantTimeEqByte(a.Y, b.Y)
-	return (x & y) == 1
-}
-
-// IsBasePoint returns true if this Point is curve's base Point
-func (a EcPoint) IsBasePoint() bool {
-	p := a.Curve.Params()
-	x := core.ConstantTimeEqByte(a.X, p.Gx)
-	y := core.ConstantTimeEqByte(a.Y, p.Gy)
-	return (x & y) == 1
-}
-
-// reduceModN normalizes the Scalar to a positive element smaller than the base Point order.
-func reduceModN(curve elliptic.Curve, k *big.Int) *big.Int {
-	return new(big.Int).Mod(k, curve.Params().N)
-}
-
-// Add performs elliptic curve addition on two points
-func (a *EcPoint) Add(b *EcPoint) (*EcPoint, error) {
-	if a == nil || b == nil {
-		return nil, internal.ErrNilArguments
-	}
-	if !sameCurve(a, b) {
-		return nil, internal.ErrPointsDistinctCurves
-	}
-	p := &EcPoint{Curve: a.Curve}
-	p.X, p.Y = a.Curve.Add(a.X, a.Y, b.X, b.Y)
-	if !p.IsValid() {
-		return nil, internal.ErrNotOnCurve
-	}
-	return p, nil
-}
-
-// Neg returns the negation of a Weierstrass Point.
-func (a *EcPoint) Neg() (*EcPoint, error) {
-	if a == nil {
-		return nil, internal.ErrNilArguments
-	}
-	p := &EcPoint{Curve: a.Curve, X: a.X, Y: new(big.Int).Sub(a.Curve.Params().P, a.Y)}
-	if !p.IsValid() {
-		return nil, internal.ErrNotOnCurve
-	}
-	return p, nil
-}
-
-// ScalarMult multiplies this Point by a Scalar
-func (a *EcPoint) ScalarMult(k *big.Int) (*EcPoint, error) {
-	if a == nil || k == nil {
-		return nil, fmt.Errorf("cannot multiply nil Point or element")
-	}
-	n := reduceModN(a.Curve, k)
-	p := new(EcPoint)
-	p.Curve = a.Curve
-	p.X, p.Y = a.Curve.ScalarMult(a.X, a.Y, n.Bytes())
-	if !p.IsValid() {
-		return nil, fmt.Errorf("result not on the curve")
-	}
-	return p, nil
-}
-
-// NewScalarBaseMult creates a Point from the base Point multiplied by a field element
-func NewScalarBaseMult(curve elliptic.Curve, k *big.Int) (*EcPoint, error) {
-	if curve == nil || k == nil {
-		return nil, fmt.Errorf("nil parameters are not supported")
-	}
-	n := reduceModN(curve, k)
-	p := new(EcPoint)
-	p.Curve = curve
-	p.X, p.Y = curve.ScalarBaseMult(n.Bytes())
-	if !p.IsValid() {
-		return nil, fmt.Errorf("result not on the curve")
-	}
-	return p, nil
-}
-
-// Bytes returns the bytes represented by this Point with x || y
-func (a EcPoint) Bytes() []byte {
-	fieldSize := internal.CalcFieldSize(a.Curve)
-	out := make([]byte, fieldSize*2)
-
-	a.X.FillBytes(out[0:fieldSize])
-	a.Y.FillBytes(out[fieldSize : fieldSize*2])
-	return out
-}
-
-// PointFromBytesUncompressed outputs uncompressed X || Y similar to
-// https://www.secg.org/sec1-v1.99.dif.pdf section 2.2 and 2.3
-func PointFromBytesUncompressed(curve elliptic.Curve, b []byte) (*EcPoint, error) {
-	fieldSize := internal.CalcFieldSize(curve)
-	if len(b) != fieldSize*2 {
-		return nil, fmt.Errorf("invalid number of bytes")
-	}
-	p := &EcPoint{
-		Curve: curve,
-		X:     new(big.Int).SetBytes(b[:fieldSize]),
-		Y:     new(big.Int).SetBytes(b[fieldSize:]),
-	}
-	if !p.IsValid() {
-		return nil, fmt.Errorf("invalid Point")
-	}
-	return p, nil
-}
-
-// sameCurve determines if points a,b appear to be from the same curve
-func sameCurve(a, b *EcPoint) bool {
-	if a == b {
-		return true
-	}
-	if a == nil || b == nil {
-		return false
-	}
-	aParams := a.Curve.Params()
-	bParams := b.Curve.Params()
-	return aParams.P.Cmp(bParams.P) == 0 &&
-		aParams.N.Cmp(bParams.N) == 0 &&
-		aParams.B.Cmp(bParams.B) == 0 &&
-		aParams.BitSize == bParams.BitSize &&
-		aParams.Gx.Cmp(bParams.Gx) == 0 &&
-		aParams.Gy.Cmp(bParams.Gy) == 0 &&
-		aParams.Name == bParams.Name
-}

pkg/crypto/core/curves/ec_point_test.go

@@ -1,369 +0,0 @@
-//
-// Copyright Coinbase, Inc. All Rights Reserved.
-//
-// SPDX-License-Identifier: Apache-2.0
-//
-
-package curves
-
-import (
-	"bytes"
-	"crypto/elliptic"
-	"math/big"
-	"testing"
-
-	"github.com/btcsuite/btcd/btcec/v2"
-	"github.com/stretchr/testify/require"
-
-	"github.com/onsonr/sonr/pkg/crypto/core"
-	tt "github.com/onsonr/sonr/pkg/crypto/internal"
-)
-
-func TestIsIdentity(t *testing.T) {
-	// Should be Point at infinity
-	identity := &EcPoint{btcec.S256(), core.Zero, core.Zero}
-	require.True(t, identity.IsIdentity())
-}
-
-func TestNewScalarBaseMultZero(t *testing.T) {
-	// Should be Point at infinity
-	curve := btcec.S256()
-	num := big.NewInt(0)
-	p, err := NewScalarBaseMult(curve, num)
-	if err != nil {
-		t.Errorf("NewScalarBaseMult failed: %v", err)
-	}
-	if p == nil {
-		t.Errorf("NewScalarBaseMult failed when it should've succeeded.")
-	}
-}
-
-func TestNewScalarBaseMultOne(t *testing.T) {
-	// Should be base Point
-	curve := btcec.S256()
-	num := big.NewInt(1)
-	p, err := NewScalarBaseMult(curve, num)
-	if err != nil {
-		t.Errorf("NewScalarBaseMult failed: %v", err)
-	}
-	if p == nil {
-		t.Errorf("NewScalarBaseMult failed when it should've succeeded.")
-		t.FailNow()
-	}
-	if !bytes.Equal(p.Bytes(), append(curve.Gx.Bytes(), curve.Gy.Bytes()...)) {
-		t.Errorf("NewScalarBaseMult should've returned the base Point.")
-	}
-}
-
-func TestNewScalarBaseMultNeg(t *testing.T) {
-	curve := btcec.S256()
-	num := big.NewInt(-1)
-	p, err := NewScalarBaseMult(curve, num)
-	if err != nil {
-		t.Errorf("NewScalarBaseMult failed: %v", err)
-	}
-	if p == nil {
-		t.Errorf("NewScalarBaseMult failed when it should've succeeded.")
-		t.FailNow()
-	}
-	num.Mod(num, curve.N)
-
-	e, err := NewScalarBaseMult(curve, num)
-	if err != nil {
-		t.Errorf("NewScalarBaseMult failed: %v", err)
-	}
-	if e == nil {
-		t.Errorf("NewScalarBaseMult failed when it should've succeeded.")
-		t.FailNow()
-	}
-
-	if !bytes.Equal(p.Bytes(), e.Bytes()) {
-		t.Errorf("NewScalarBaseMult should've returned the %v, found: %v", e, p)
-	}
-}
-
-func TestScalarMultZero(t *testing.T) {
-	// Should be Point at infinity
-	curve := btcec.S256()
-	p := &EcPoint{
-		Curve: curve,
-		X:     curve.Gx,
-		Y:     curve.Gy,
-	}
-	num := big.NewInt(0)
-	q, err := p.ScalarMult(num)
-	if err != nil {
-		t.Errorf("ScalarMult failed: %v", err)
-	}
-	if q == nil {
-		t.Errorf("ScalarMult failed when it should've succeeded.")
-		t.FailNow()
-	}
-	if !q.IsIdentity() {
-		t.Errorf("ScalarMult should've returned the identity Point.")
-	}
-}
-
-func TestScalarMultOne(t *testing.T) {
-	// Should be base Point
-	curve := btcec.S256()
-	p := &EcPoint{
-		Curve: curve,
-		X:     curve.Gx,
-		Y:     curve.Gy,
-	}
-	num := big.NewInt(1)
-	q, err := p.ScalarMult(num)
-	if err != nil {
-		t.Errorf("ScalarMult failed: %v", err)
-	}
-	if q == nil {
-		t.Errorf("ScalarMult failed when it should've succeeded.")
-		t.FailNow()
-	}
-	if !bytes.Equal(q.Bytes(), append(curve.Gx.Bytes(), curve.Gy.Bytes()...)) {
-		t.Errorf("ScalarMult should've returned the base Point.")
-	}
-}
-
-func TestScalarMultNeg(t *testing.T) {
-	curve := btcec.S256()
-	p := &EcPoint{
-		Curve: curve,
-		X:     curve.Gx,
-		Y:     curve.Gy,
-	}
-	num := big.NewInt(-1)
-	q, err := p.ScalarMult(num)
-	if err != nil {
-		t.Errorf("ScalarMult failed: %v", err)
-	}
-	if q == nil {
-		t.Errorf("ScalarMult failed when it should've succeeded.")
-	}
-	num.Mod(num, curve.N)
-
-	e, err := p.ScalarMult(num)
-	if err != nil {
-		t.Errorf("ScalarMult failed: %v", err)
-	}
-	if e == nil {
-		t.Errorf("ScalarMult failed when it should've succeeded.")
-		t.FailNow()
-	}
-
-	if !bytes.Equal(q.Bytes(), e.Bytes()) {
-		t.Errorf("ScalarMult should've returned the %v, found: %v", e, p)
-	}
-}
-
-func TestEcPointAddSimple(t *testing.T) {
-	curve := btcec.S256()
-	num := big.NewInt(1)
-	p1, _ := NewScalarBaseMult(curve, num)
-
-	p2, _ := NewScalarBaseMult(curve, num)
-	p3, err := p1.Add(p2)
-	if err != nil {
-		t.Errorf("EcPoint.Add failed: %v", err)
-	}
-	num = big.NewInt(2)
-
-	ep, _ := NewScalarBaseMult(curve, num)
-
-	if !bytes.Equal(ep.Bytes(), p3.Bytes()) {
-		t.Errorf("EcPoint.Add failed: should equal %v, found: %v", ep, p3)
-	}
-}
-
-func TestEcPointAddCommunicative(t *testing.T) {
-	curve := btcec.S256()
-	a, _ := core.Rand(curve.Params().N)
-	b, _ := core.Rand(curve.Params().N)
-
-	p1, _ := NewScalarBaseMult(curve, a)
-	p2, _ := NewScalarBaseMult(curve, b)
-	p3, err := p1.Add(p2)
-	if err != nil {
-		t.Errorf("EcPoint.Add failed: %v", err)
-	}
-	p4, err := p2.Add(p1)
-	if err != nil {
-		t.Errorf("EcPoint.Add failed: %v", err)
-	}
-	if !bytes.Equal(p3.Bytes(), p4.Bytes()) {
-		t.Errorf("EcPoint.Add Communicative not valid")
-	}
-}
-
-func TestEcPointAddNeg(t *testing.T) {
-	curve := btcec.S256()
-	num := big.NewInt(-1)
-
-	p1, _ := NewScalarBaseMult(curve, num)
-	num.Abs(num)
-
-	p2, _ := NewScalarBaseMult(curve, num)
-
-	p3, err := p1.Add(p2)
-	if err != nil {
-		t.Errorf("EcPoint.Add failed: %v", err)
-	}
-	zero := make([]byte, 64)
-	if !bytes.Equal(zero, p3.Bytes()) {
-		t.Errorf("Expected value to be zero, found: %v", p3)
-	}
-}
-
-func TestEcPointBytes(t *testing.T) {
-	curve := btcec.S256()
-
-	point, err := NewScalarBaseMult(curve, big.NewInt(2))
-	require.NoError(t, err)
-	data := point.Bytes()
-	point2, err := PointFromBytesUncompressed(curve, data)
-	require.NoError(t, err)
-	if point.X.Cmp(point2.X) != 0 && point.Y.Cmp(point2.Y) != 0 {
-		t.Errorf("Points are not equal. Expected %v, found %v", point, point2)
-	}
-
-	curve2 := elliptic.P224()
-	p2, err := NewScalarBaseMult(curve2, big.NewInt(2))
-	require.NoError(t, err)
-	dta := p2.Bytes()
-	point3, err := PointFromBytesUncompressed(curve2, dta)
-	require.NoError(t, err)
-	if p2.X.Cmp(point3.X) != 0 && p2.Y.Cmp(point3.Y) != 0 {
-		t.Errorf("Points are not equal. Expected %v, found %v", p2, point3)
-	}
-
-	curve3 := elliptic.P521()
-	p3, err := NewScalarBaseMult(curve3, big.NewInt(2))
-	require.NoError(t, err)
-	data = p3.Bytes()
-	point4, err := PointFromBytesUncompressed(curve3, data)
-	require.NoError(t, err)
-	if p3.X.Cmp(point4.X) != 0 && p3.Y.Cmp(point4.Y) != 0 {
-		t.Errorf("Points are not equal. Expected %v, found %v", p3, point4)
-	}
-}
-
-func TestEcPointBytesDifferentCurves(t *testing.T) {
-	k256 := btcec.S256()
-	p224 := elliptic.P224()
-	p256 := elliptic.P256()
-
-	kp, err := NewScalarBaseMult(k256, big.NewInt(1))
-	require.NoError(t, err)
-	data := kp.Bytes()
-	_, err = PointFromBytesUncompressed(p224, data)
-	require.Error(t, err)
-	_, err = PointFromBytesUncompressed(p256, data)
-	require.Error(t, err)
-}
-
-func TestEcPointBytesInvalidNumberBytes(t *testing.T) {
-	curve := btcec.S256()
-
-	for i := 1; i < 64; i++ {
-		data := make([]byte, i)
-		_, err := PointFromBytesUncompressed(curve, data)
-		require.Error(t, err)
-	}
-	for i := 65; i < 128; i++ {
-		data := make([]byte, i)
-		_, err := PointFromBytesUncompressed(curve, data)
-		require.Error(t, err)
-	}
-}
-
-func TestEcPointMultRandom(t *testing.T) {
-	curve := btcec.S256()
-	r, err := core.Rand(curve.N)
-	require.NoError(t, err)
-	pt, err := NewScalarBaseMult(curve, r)
-	require.NoError(t, err)
-	require.NotNil(t, pt)
-	data := pt.Bytes()
-	pt2, err := PointFromBytesUncompressed(curve, data)
-	require.NoError(t, err)
-	if pt.X.Cmp(pt2.X) != 0 || pt.Y.Cmp(pt2.Y) != 0 {
-		t.Errorf("Points are not equal. Expected: %v, found: %v", pt, pt2)
-	}
-}
-
-func TestIsBasePoint(t *testing.T) {
-	k256 := btcec.S256()
-	p224 := elliptic.P224()
-	p256 := elliptic.P256()
-
-	notG_p224, err := NewScalarBaseMult(p224, tt.B10("9876453120"))
-	require.NoError(t, err)
-
-	tests := []struct {
-		name     string
-		curve    elliptic.Curve
-		x, y     *big.Int
-		expected bool
-	}{
-		{"k256-positive", k256, k256.Gx, k256.Gy, true},
-		{"p224-positive", p224, p224.Params().Gx, p224.Params().Gy, true},
-		{"p256-positive", p256, p256.Params().Gx, p256.Params().Gy, true},
-
-		{"p224-negative", p224, notG_p224.X, notG_p224.Y, false},
-		{"p256-negative-wrong-curve", p256, notG_p224.X, notG_p224.Y, false},
-		{"k256-negative-doubleGx", k256, k256.Gx, k256.Gx, false},
-		{"k256-negative-doubleGy", k256, k256.Gy, k256.Gy, false},
-		{"k256-negative-xy-swap", k256, k256.Gy, k256.Gx, false},
-		{"k256-negative-oh-oh", k256, core.Zero, core.Zero, false},
-	}
-	// Run all the tests!
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			actual := EcPoint{test.curve, test.x, test.y}.IsBasePoint()
-			require.Equal(t, test.expected, actual)
-		})
-	}
-}
-
-func TestEquals(t *testing.T) {
-	k256 := btcec.S256()
-	p224 := elliptic.P224()
-	p256 := elliptic.P256()
-	P_p224, _ := NewScalarBaseMult(p224, tt.B10("9876453120"))
-	P1_p224, _ := NewScalarBaseMult(p224, tt.B10("9876453120"))
-
-	P_k256 := &EcPoint{k256, P_p224.X, P_p224.Y}
-
-	id_p224 := &EcPoint{p224, core.Zero, core.Zero}
-	id_k256 := &EcPoint{k256, core.Zero, core.Zero}
-	id_p256 := &EcPoint{p256, core.Zero, core.Zero}
-
-	tests := []struct {
-		name     string
-		x, y     *EcPoint
-		expected bool
-	}{
-		{"p224 same pointer", P_p224, P_p224, true},
-		{"p224 same Point", P_p224, P1_p224, true},
-		{"p224 identity", id_p224, id_p224, true},
-		{"p256 identity", id_p256, id_p256, true},
-		{"k256 identity", id_k256, id_k256, true},
-
-		{"negative-same x different y", P_p224, &EcPoint{p224, P_p224.X, core.One}, false},
-		{"negative-same y different x", P_p224, &EcPoint{p224, core.Two, P_k256.Y}, false},
-
-		{"negative-wrong curve", P_p224, P_k256, false},
-		{"negative-wrong curve reversed", P_k256, P_p224, false},
-		{"Point is not the identity", P_p224, id_p224, false},
-		{"negative nil", P1_p224, nil, false},
-		{"identities on wrong curve", id_p256, id_k256, false},
-	}
-	// Run all the tests!
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			actual := test.x.Equals(test.y)
-			require.Equal(t, test.expected, actual)
-		})
-	}
-}

pkg/crypto/core/curves/ec_scalar.go

@@ -1,351 +0,0 @@
-//
-// Copyright Coinbase, Inc. All Rights Reserved.
-//
-// SPDX-License-Identifier: Apache-2.0
-//
-
-package curves
-
-import (
-	"crypto/elliptic"
-	crand "crypto/rand"
-	"crypto/sha512"
-	"fmt"
-	"io"
-	"math/big"
-
-	"filippo.io/edwards25519"
-	"github.com/btcsuite/btcd/btcec/v2"
-	"github.com/bwesterb/go-ristretto"
-
-	"github.com/onsonr/sonr/pkg/crypto/core"
-	"github.com/onsonr/sonr/pkg/crypto/core/curves/native/bls12381"
-	"github.com/onsonr/sonr/pkg/crypto/internal"
-)
-
-type EcScalar interface {
-	Add(x, y *big.Int) *big.Int
-	Sub(x, y *big.Int) *big.Int
-	Neg(x *big.Int) *big.Int
-	Mul(x, y *big.Int) *big.Int
-	Hash(input []byte) *big.Int
-	Div(x, y *big.Int) *big.Int
-	Random() (*big.Int, error)
-	IsValid(x *big.Int) bool
-	Bytes(x *big.Int) []byte // fixed-length byte array
-}
-
-type K256Scalar struct{}
-
-// Static interface assertion
-var _ EcScalar = (*K256Scalar)(nil)
-
-// warning: the Euclidean alg which Mod uses is not constant-time.
-
-func NewK256Scalar() *K256Scalar {
-	return &K256Scalar{}
-}
-
-func (k K256Scalar) Add(x, y *big.Int) *big.Int {
-	v := new(big.Int).Add(x, y)
-	v.Mod(v, btcec.S256().N)
-	return v
-}
-
-func (k K256Scalar) Sub(x, y *big.Int) *big.Int {
-	v := new(big.Int).Sub(x, y)
-	v.Mod(v, btcec.S256().N)
-	return v
-}
-
-func (k K256Scalar) Neg(x *big.Int) *big.Int {
-	v := new(big.Int).Sub(btcec.S256().N, x)
-	v.Mod(v, btcec.S256().N)
-	return v
-}
-
-func (k K256Scalar) Mul(x, y *big.Int) *big.Int {
-	v := new(big.Int).Mul(x, y)
-	v.Mod(v, btcec.S256().N)
-	return v
-}
-
-func (k K256Scalar) Div(x, y *big.Int) *big.Int {
-	t := new(big.Int).ModInverse(y, btcec.S256().N)
-	return k.Mul(x, t)
-}
-
-func (k K256Scalar) Hash(input []byte) *big.Int {
-	return new(ScalarK256).Hash(input).BigInt()
-}
-
-func (k K256Scalar) Random() (*big.Int, error) {
-	b := make([]byte, 48)
-	n, err := crand.Read(b)
-	if err != nil {
-		return nil, err
-	}
-	if n != 48 {
-		return nil, fmt.Errorf("insufficient bytes read")
-	}
-	v := new(big.Int).SetBytes(b)
-	v.Mod(v, btcec.S256().N)
-	return v, nil
-}
-
-func (k K256Scalar) IsValid(x *big.Int) bool {
-	return core.In(x, btcec.S256().N) == nil
-}
-
-func (k K256Scalar) Bytes(x *big.Int) []byte {
-	bytes := make([]byte, 32)
-	x.FillBytes(bytes) // big-endian; will left-pad.
-	return bytes
-}
-
-type P256Scalar struct{}
-
-// Static interface assertion
-var _ EcScalar = (*P256Scalar)(nil)
-
-func NewP256Scalar() *P256Scalar {
-	return &P256Scalar{}
-}
-
-func (k P256Scalar) Add(x, y *big.Int) *big.Int {
-	v := new(big.Int).Add(x, y)
-	v.Mod(v, elliptic.P256().Params().N)
-	return v
-}
-
-func (k P256Scalar) Sub(x, y *big.Int) *big.Int {
-	v := new(big.Int).Sub(x, y)
-	v.Mod(v, elliptic.P256().Params().N)
-	return v
-}
-
-func (k P256Scalar) Neg(x *big.Int) *big.Int {
-	v := new(big.Int).Sub(elliptic.P256().Params().N, x)
-	v.Mod(v, elliptic.P256().Params().N)
-	return v
-}
-
-func (k P256Scalar) Mul(x, y *big.Int) *big.Int {
-	v := new(big.Int).Mul(x, y)
-	v.Mod(v, elliptic.P256().Params().N)
-	return v
-}
-
-func (k P256Scalar) Div(x, y *big.Int) *big.Int {
-	t := new(big.Int).ModInverse(y, elliptic.P256().Params().N)
-	return k.Mul(x, t)
-}
-
-func (k P256Scalar) Hash(input []byte) *big.Int {
-	return new(ScalarP256).Hash(input).BigInt()
-}
-
-func (k P256Scalar) Random() (*big.Int, error) {
-	b := make([]byte, 48)
-	n, err := crand.Read(b)
-	if err != nil {
-		return nil, err
-	}
-	if n != 48 {
-		return nil, fmt.Errorf("insufficient bytes read")
-	}
-	v := new(big.Int).SetBytes(b)
-	v.Mod(v, elliptic.P256().Params().N)
-	return v, nil
-}
-
-func (k P256Scalar) IsValid(x *big.Int) bool {
-	return core.In(x, elliptic.P256().Params().N) == nil
-}
-
-func (k P256Scalar) Bytes(x *big.Int) []byte {
-	bytes := make([]byte, 32)
-	x.FillBytes(bytes) // big-endian; will left-pad.
-	return bytes
-}
-
-type Bls12381Scalar struct{}
-
-// Static interface assertion
-var _ EcScalar = (*Bls12381Scalar)(nil)
-
-func NewBls12381Scalar() *Bls12381Scalar {
-	return &Bls12381Scalar{}
-}
-
-func (k Bls12381Scalar) Add(x, y *big.Int) *big.Int {
-	a := bls12381.Bls12381FqNew().SetBigInt(x)
-	b := bls12381.Bls12381FqNew().SetBigInt(y)
-	return a.Add(a, b).BigInt()
-}
-
-func (k Bls12381Scalar) Sub(x, y *big.Int) *big.Int {
-	a := bls12381.Bls12381FqNew().SetBigInt(x)
-	b := bls12381.Bls12381FqNew().SetBigInt(y)
-	return a.Sub(a, b).BigInt()
-}
-
-func (k Bls12381Scalar) Neg(x *big.Int) *big.Int {
-	a := bls12381.Bls12381FqNew().SetBigInt(x)
-	return a.Neg(a).BigInt()
-}
-
-func (k Bls12381Scalar) Mul(x, y *big.Int) *big.Int {
-	a := bls12381.Bls12381FqNew().SetBigInt(x)
-	b := bls12381.Bls12381FqNew().SetBigInt(y)
-	return a.Mul(a, b).BigInt()
-}
-
-func (k Bls12381Scalar) Div(x, y *big.Int) *big.Int {
-	c := bls12381.Bls12381FqNew()
-	a := bls12381.Bls12381FqNew().SetBigInt(x)
-	b := bls12381.Bls12381FqNew().SetBigInt(y)
-	_, wasInverted := c.Invert(b)
-	c.Mul(a, c)
-	tt := map[bool]int{false: 0, true: 1}
-	return a.CMove(a, c, tt[wasInverted]).BigInt()
-}
-
-func (k Bls12381Scalar) Hash(input []byte) *big.Int {
-	return new(ScalarBls12381).Hash(input).BigInt()
-}
-
-func (k Bls12381Scalar) Random() (*big.Int, error) {
-	a := BLS12381G1().NewScalar().Random(crand.Reader)
-	if a == nil {
-		return nil, fmt.Errorf("invalid random value")
-	}
-	return a.BigInt(), nil
-}
-
-func (k Bls12381Scalar) Bytes(x *big.Int) []byte {
-	bytes := make([]byte, 32)
-	x.FillBytes(bytes) // big-endian; will left-pad.
-	return bytes
-}
-
-func (k Bls12381Scalar) IsValid(x *big.Int) bool {
-	a := bls12381.Bls12381FqNew().SetBigInt(x)
-	return a.BigInt().Cmp(x) == 0
-}
-
-// taken from https://datatracker.ietf.org/doc/html/rfc8032
-var ed25519N, _ = new(big.Int).SetString("1000000000000000000000000000000014DEF9DEA2F79CD65812631A5CF5D3ED", 16)
-
-type Ed25519Scalar struct{}
-
-// Static interface assertion
-var _ EcScalar = (*Ed25519Scalar)(nil)
-
-func NewEd25519Scalar() *Ed25519Scalar {
-	return &Ed25519Scalar{}
-}
-
-func (k Ed25519Scalar) Add(x, y *big.Int) *big.Int {
-	a, err := internal.BigInt2Ed25519Scalar(x)
-	if err != nil {
-		panic(err)
-	}
-	b, err := internal.BigInt2Ed25519Scalar(y)
-	if err != nil {
-		panic(err)
-	}
-	a.Add(a, b)
-	return new(big.Int).SetBytes(internal.ReverseScalarBytes(a.Bytes()))
-}
-
-func (k Ed25519Scalar) Sub(x, y *big.Int) *big.Int {
-	a, err := internal.BigInt2Ed25519Scalar(x)
-	if err != nil {
-		panic(err)
-	}
-	b, err := internal.BigInt2Ed25519Scalar(y)
-	if err != nil {
-		panic(err)
-	}
-	a.Subtract(a, b)
-	return new(big.Int).SetBytes(internal.ReverseScalarBytes(a.Bytes()))
-}
-
-func (k Ed25519Scalar) Neg(x *big.Int) *big.Int {
-	a, err := internal.BigInt2Ed25519Scalar(x)
-	if err != nil {
-		panic(err)
-	}
-	a.Negate(a)
-	return new(big.Int).SetBytes(internal.ReverseScalarBytes(a.Bytes()))
-}
-
-func (k Ed25519Scalar) Mul(x, y *big.Int) *big.Int {
-	a, err := internal.BigInt2Ed25519Scalar(x)
-	if err != nil {
-		panic(err)
-	}
-	b, err := internal.BigInt2Ed25519Scalar(y)
-	if err != nil {
-		panic(err)
-	}
-	a.Multiply(a, b)
-	return new(big.Int).SetBytes(internal.ReverseScalarBytes(a.Bytes()))
-}
-
-func (k Ed25519Scalar) Div(x, y *big.Int) *big.Int {
-	b, err := internal.BigInt2Ed25519Scalar(y)
-	if err != nil {
-		panic(err)
-	}
-	b.Invert(b)
-	a, err := internal.BigInt2Ed25519Scalar(x)
-	if err != nil {
-		panic(err)
-	}
-	a.Multiply(a, b)
-	return new(big.Int).SetBytes(internal.ReverseScalarBytes(a.Bytes()))
-}
-
-func (k Ed25519Scalar) Hash(input []byte) *big.Int {
-	v := new(ristretto.Scalar).Derive(input)
-	var data [32]byte
-	v.BytesInto(&data)
-	return new(big.Int).SetBytes(internal.ReverseScalarBytes(data[:]))
-}
-
-func (k Ed25519Scalar) Bytes(x *big.Int) []byte {
-	a, err := internal.BigInt2Ed25519Scalar(x)
-	if err != nil {
-		panic(err)
-	}
-	return internal.ReverseScalarBytes(a.Bytes())
-}
-
-func (k Ed25519Scalar) Random() (*big.Int, error) {
-	return k.RandomWithReader(crand.Reader)
-}
-
-func (k Ed25519Scalar) RandomWithReader(r io.Reader) (*big.Int, error) {
-	b := make([]byte, 64)
-	n, err := r.Read(b)
-	if err != nil {
-		return nil, err
-	}
-	if n != 64 {
-		return nil, fmt.Errorf("insufficient bytes read")
-	}
-	digest := sha512.Sum512(b)
-	var hBytes [32]byte
-	copy(hBytes[:], digest[:])
-	s, err := edwards25519.NewScalar().SetBytesWithClamping(hBytes[:])
-	if err != nil {
-		return nil, err
-	}
-	return new(big.Int).SetBytes(internal.ReverseScalarBytes(s.Bytes())), nil
-}
-
-func (k Ed25519Scalar) IsValid(x *big.Int) bool {
-	return x.Cmp(ed25519N) == -1
-}

pkg/crypto/core/curves/ecdsa.go

@@ -1,39 +0,0 @@
-//
-// Copyright Coinbase, Inc. All Rights Reserved.
-//
-// SPDX-License-Identifier: Apache-2.0
-//
-
-package curves
-
-import (
-	"crypto/ecdsa"
-	"math/big"
-)
-
-// EcdsaVerify runs a curve- or algorithm-specific ECDSA verification function on input
-// an ECDSA public (verification) key, a message digest, and an ECDSA signature.
-// It must return true if all the parameters are sane and the ECDSA signature is valid,
-// and false otherwise
-type EcdsaVerify func(pubKey *EcPoint, hash []byte, signature *EcdsaSignature) bool
-
-// EcdsaSignature represents a (composite) digital signature
-type EcdsaSignature struct {
-	R *big.Int
-	S *big.Int
-	V int
-}
-
-// Static type assertion
-var _ EcdsaVerify = VerifyEcdsa
-
-// Verifies ECDSA signature using core types.
-func VerifyEcdsa(pk *EcPoint, hash []byte, sig *EcdsaSignature) bool {
-	return ecdsa.Verify(
-		&ecdsa.PublicKey{
-			Curve: pk.Curve,
-			X:     pk.X,
-			Y:     pk.Y,
-		},
-		hash, sig.R, sig.S)
-}

pkg/crypto/core/curves/ed25519_curve.go

@@ -1,788 +0,0 @@
-//
-// Copyright Coinbase, Inc. All Rights Reserved.
-//
-// SPDX-License-Identifier: Apache-2.0
-//
-
-package curves
-
-import (
-	"bytes"
-	"crypto/sha512"
-	"crypto/subtle"
-	"fmt"
-	"io"
-	"math/big"
-
-	"filippo.io/edwards25519"
-	"filippo.io/edwards25519/field"
-	"github.com/bwesterb/go-ristretto"
-	ed "github.com/bwesterb/go-ristretto/edwards25519"
-
-	"github.com/onsonr/sonr/pkg/crypto/internal"
-)
-
-type ScalarEd25519 struct {
-	value *edwards25519.Scalar
-}
-
-type PointEd25519 struct {
-	value *edwards25519.Point
-}
-
-var scOne, _ = edwards25519.NewScalar().SetCanonicalBytes([]byte{1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0})
-
-func (s *ScalarEd25519) Random(reader io.Reader) Scalar {
-	if reader == nil {
-		return nil
-	}
-	var seed [64]byte
-	_, _ = reader.Read(seed[:])
-	return s.Hash(seed[:])
-}
-
-func (s *ScalarEd25519) Hash(bytes []byte) Scalar {
-	v := new(ristretto.Scalar).Derive(bytes)
-	var data [32]byte
-	v.BytesInto(&data)
-	value, err := edwards25519.NewScalar().SetCanonicalBytes(data[:])
-	if err != nil {
-		return nil
-	}
-	return &ScalarEd25519{value}
-}
-
-func (s *ScalarEd25519) Zero() Scalar {
-	return &ScalarEd25519{
-		value: edwards25519.NewScalar(),
-	}
-}
-
-func (s *ScalarEd25519) One() Scalar {
-	return &ScalarEd25519{
-		value: edwards25519.NewScalar().Set(scOne),
-	}
-}
-
-func (s *ScalarEd25519) IsZero() bool {
-	i := byte(0)
-	for _, b := range s.value.Bytes() {
-		i |= b
-	}
-	return i == 0
-}
-
-func (s *ScalarEd25519) IsOne() bool {
-	data := s.value.Bytes()
-	i := byte(0)
-	for j := 1; j < len(data); j++ {
-		i |= data[j]
-	}
-	return i == 0 && data[0] == 1
-}
-
-func (s *ScalarEd25519) IsOdd() bool {
-	return s.value.Bytes()[0]&1 == 1
-}
-
-func (s *ScalarEd25519) IsEven() bool {
-	return s.value.Bytes()[0]&1 == 0
-}
-
-func (s *ScalarEd25519) New(input int) Scalar {
-	var data [64]byte
-	i := input
-	if input < 0 {
-		i = -input
-	}
-	data[0] = byte(i)
-	data[1] = byte(i >> 8)
-	data[2] = byte(i >> 16)
-	data[3] = byte(i >> 24)
-	value, err := edwards25519.NewScalar().SetUniformBytes(data[:])
-	if err != nil {
-		return nil
-	}
-	if input < 0 {
-		value.Negate(value)
-	}
-
-	return &ScalarEd25519{
-		value,
-	}
-}
-
-func (s *ScalarEd25519) Cmp(rhs Scalar) int {
-	r := s.Sub(rhs)
-	if r != nil && r.IsZero() {
-		return 0
-	} else {
-		return -2
-	}
-}
-
-func (s *ScalarEd25519) Square() Scalar {
-	value := edwards25519.NewScalar().Multiply(s.value, s.value)
-	return &ScalarEd25519{value}
-}
-
-func (s *ScalarEd25519) Double() Scalar {
-	return &ScalarEd25519{
-		value: edwards25519.NewScalar().Add(s.value, s.value),
-	}
-}
-
-func (s *ScalarEd25519) Invert() (Scalar, error) {
-	return &ScalarEd25519{
-		value: edwards25519.NewScalar().Invert(s.value),
-	}, nil
-}
-
-func (s *ScalarEd25519) Sqrt() (Scalar, error) {
-	bi25519, _ := new(big.Int).SetString("1000000000000000000000000000000014DEF9DEA2F79CD65812631A5CF5D3ED", 16)
-	x := s.BigInt()
-	x.ModSqrt(x, bi25519)
-	return s.SetBigInt(x)
-}
-
-func (s *ScalarEd25519) Cube() Scalar {
-	value := edwards25519.NewScalar().Multiply(s.value, s.value)
-	value.Multiply(value, s.value)
-	return &ScalarEd25519{value}
-}
-
-func (s *ScalarEd25519) Add(rhs Scalar) Scalar {
-	r, ok := rhs.(*ScalarEd25519)
-	if ok {
-		return &ScalarEd25519{
-			value: edwards25519.NewScalar().Add(s.value, r.value),
-		}
-	} else {
-		return nil
-	}
-}
-
-func (s *ScalarEd25519) Sub(rhs Scalar) Scalar {
-	r, ok := rhs.(*ScalarEd25519)
-	if ok {
-		return &ScalarEd25519{
-			value: edwards25519.NewScalar().Subtract(s.value, r.value),
-		}
-	} else {
-		return nil
-	}
-}
-
-func (s *ScalarEd25519) Mul(rhs Scalar) Scalar {
-	r, ok := rhs.(*ScalarEd25519)
-	if ok {
-		return &ScalarEd25519{
-			value: edwards25519.NewScalar().Multiply(s.value, r.value),
-		}
-	} else {
-		return nil
-	}
-}
-
-func (s *ScalarEd25519) MulAdd(y, z Scalar) Scalar {
-	yy, ok := y.(*ScalarEd25519)
-	if !ok {
-		return nil
-	}
-	zz, ok := z.(*ScalarEd25519)
-	if !ok {
-		return nil
-	}
-	return &ScalarEd25519{value: edwards25519.NewScalar().MultiplyAdd(s.value, yy.value, zz.value)}
-}
-
-func (s *ScalarEd25519) Div(rhs Scalar) Scalar {
-	r, ok := rhs.(*ScalarEd25519)
-	if ok {
-		value := edwards25519.NewScalar().Invert(r.value)
-		value.Multiply(value, s.value)
-		return &ScalarEd25519{value}
-	} else {
-		return nil
-	}
-}
-
-func (s *ScalarEd25519) Neg() Scalar {
-	return &ScalarEd25519{
-		value: edwards25519.NewScalar().Negate(s.value),
-	}
-}
-
-func (s *ScalarEd25519) SetBigInt(x *big.Int) (Scalar, error) {
-	if x == nil {
-		return nil, fmt.Errorf("invalid value")
-	}
-
-	bi25519, _ := new(big.Int).SetString("1000000000000000000000000000000014DEF9DEA2F79CD65812631A5CF5D3ED", 16)
-	var v big.Int
-	buf := v.Mod(x, bi25519).Bytes()
-	var rBuf [32]byte
-	for i := 0; i < len(buf) && i < 32; i++ {
-		rBuf[i] = buf[len(buf)-i-1]
-	}
-	value, err := edwards25519.NewScalar().SetCanonicalBytes(rBuf[:])
-	if err != nil {
-		return nil, err
-	}
-	return &ScalarEd25519{value}, nil
-}
-
-func (s *ScalarEd25519) BigInt() *big.Int {
-	var ret big.Int
-	buf := internal.ReverseScalarBytes(s.value.Bytes())
-	return ret.SetBytes(buf)
-}
-
-func (s *ScalarEd25519) Bytes() []byte {
-	return s.value.Bytes()
-}
-
-// SetBytes takes input a 32-byte long array and returns a ed25519 scalar.
-// The input must be 32-byte long and must be a reduced bytes.
-func (s *ScalarEd25519) SetBytes(input []byte) (Scalar, error) {
-	if len(input) != 32 {
-		return nil, fmt.Errorf("invalid byte sequence")
-	}
-	value, err := edwards25519.NewScalar().SetCanonicalBytes(input)
-	if err != nil {
-		return nil, err
-	}
-	return &ScalarEd25519{value}, nil
-}
-
-// SetBytesWide takes input a 64-byte long byte array, reduce it and return an ed25519 scalar.
-// It uses SetUniformBytes of fillipo.io/edwards25519 - https://github.com/FiloSottile/edwards25519/blob/v1.0.0-rc.1/scalar.go#L85
-// If bytes is not of the right length, it returns nil and an error
-func (s *ScalarEd25519) SetBytesWide(bytes []byte) (Scalar, error) {
-	value, err := edwards25519.NewScalar().SetUniformBytes(bytes)
-	if err != nil {
-		return nil, err
-	}
-	return &ScalarEd25519{value}, nil
-}
-
-// SetBytesClamping uses SetBytesWithClamping of fillipo.io/edwards25519- https://github.com/FiloSottile/edwards25519/blob/v1.0.0-rc.1/scalar.go#L135
-// which applies the buffer pruning described in RFC 8032, Section 5.1.5 (also known as clamping)
-// and sets bytes to the result. The input must be 32-byte long, and it is not modified.
-// If bytes is not of the right length, SetBytesWithClamping returns nil and an error, and the receiver is unchanged.
-func (s *ScalarEd25519) SetBytesClamping(bytes []byte) (Scalar, error) {
-	value, err := edwards25519.NewScalar().SetBytesWithClamping(bytes)
-	if err != nil {
-		return nil, err
-	}
-	return &ScalarEd25519{value}, nil
-}
-
-// SetBytesCanonical uses SetCanonicalBytes of fillipo.io/edwards25519.
-// https://github.com/FiloSottile/edwards25519/blob/v1.0.0-rc.1/scalar.go#L98
-// This function takes an input x and sets s = x, where x is a 32-byte little-endian
-// encoding of s, then it returns the corresponding ed25519 scalar. If the input is
-// not a canonical encoding of s, it returns nil and an error.
-func (s *ScalarEd25519) SetBytesCanonical(bytes []byte) (Scalar, error) {
-	return s.SetBytes(bytes)
-}
-
-func (s *ScalarEd25519) Point() Point {
-	return new(PointEd25519).Identity()
-}
-
-func (s *ScalarEd25519) Clone() Scalar {
-	return &ScalarEd25519{
-		value: edwards25519.NewScalar().Set(s.value),
-	}
-}
-
-func (s *ScalarEd25519) MarshalBinary() ([]byte, error) {
-	return scalarMarshalBinary(s)
-}
-
-func (s *ScalarEd25519) UnmarshalBinary(input []byte) error {
-	sc, err := scalarUnmarshalBinary(input)
-	if err != nil {
-		return err
-	}
-	ss, ok := sc.(*ScalarEd25519)
-	if !ok {
-		return fmt.Errorf("invalid scalar")
-	}
-	s.value = ss.value
-	return nil
-}
-
-func (s *ScalarEd25519) MarshalText() ([]byte, error) {
-	return scalarMarshalText(s)
-}
-
-func (s *ScalarEd25519) UnmarshalText(input []byte) error {
-	sc, err := scalarUnmarshalText(input)
-	if err != nil {
-		return err
-	}
-	ss, ok := sc.(*ScalarEd25519)
-	if !ok {
-		return fmt.Errorf("invalid scalar")
-	}
-	s.value = ss.value
-	return nil
-}
-
-func (s *ScalarEd25519) GetEdwardsScalar() *edwards25519.Scalar {
-	return edwards25519.NewScalar().Set(s.value)
-}
-
-func (s *ScalarEd25519) SetEdwardsScalar(sc *edwards25519.Scalar) *ScalarEd25519 {
-	return &ScalarEd25519{value: edwards25519.NewScalar().Set(sc)}
-}
-
-func (s *ScalarEd25519) MarshalJSON() ([]byte, error) {
-	return scalarMarshalJson(s)
-}
-
-func (s *ScalarEd25519) UnmarshalJSON(input []byte) error {
-	sc, err := scalarUnmarshalJson(input)
-	if err != nil {
-		return err
-	}
-	S, ok := sc.(*ScalarEd25519)
-	if !ok {
-		return fmt.Errorf("invalid type")
-	}
-	s.value = S.value
-	return nil
-}
-
-func (p *PointEd25519) Random(reader io.Reader) Point {
-	var seed [64]byte
-	_, _ = reader.Read(seed[:])
-	return p.Hash(seed[:])
-}
-
-func (p *PointEd25519) Hash(bytes []byte) Point {
-	/// Perform hashing to the group using the Elligator2 map
-	///
-	/// See https://tools.ietf.org/html/draft-irtf-cfrg-hash-to-curve-11#section-6.7.1
-	h := sha512.Sum512(bytes)
-	var res [32]byte
-	copy(res[:], h[:32])
-	signBit := (res[31] & 0x80) >> 7
-
-	fe := new(ed.FieldElement).SetBytes(&res).BytesInto(&res)
-	m1 := elligatorEncode(fe)
-
-	return toEdwards(m1, signBit)
-}
-
-func (p *PointEd25519) Identity() Point {
-	return &PointEd25519{
-		value: edwards25519.NewIdentityPoint(),
-	}
-}
-
-func (p *PointEd25519) Generator() Point {
-	return &PointEd25519{
-		value: edwards25519.NewGeneratorPoint(),
-	}
-}
-
-func (p *PointEd25519) IsIdentity() bool {
-	return p.Equal(p.Identity())
-}
-
-func (p *PointEd25519) IsNegative() bool {
-	// Negative points don't really exist in ed25519
-	return false
-}
-
-func (p *PointEd25519) IsOnCurve() bool {
-	_, err := edwards25519.NewIdentityPoint().SetBytes(p.ToAffineCompressed())
-	return err == nil
-}
-
-func (p *PointEd25519) Double() Point {
-	return &PointEd25519{value: edwards25519.NewIdentityPoint().Add(p.value, p.value)}
-}
-
-func (p *PointEd25519) Scalar() Scalar {
-	return new(ScalarEd25519).Zero()
-}
-
-func (p *PointEd25519) Neg() Point {
-	return &PointEd25519{value: edwards25519.NewIdentityPoint().Negate(p.value)}
-}
-
-func (p *PointEd25519) Add(rhs Point) Point {
-	if rhs == nil {
-		return nil
-	}
-	r, ok := rhs.(*PointEd25519)
-	if ok {
-		return &PointEd25519{value: edwards25519.NewIdentityPoint().Add(p.value, r.value)}
-	} else {
-		return nil
-	}
-}
-
-func (p *PointEd25519) Sub(rhs Point) Point {
-	if rhs == nil {
-		return nil
-	}
-	r, ok := rhs.(*PointEd25519)
-	if ok {
-		rTmp := edwards25519.NewIdentityPoint().Negate(r.value)
-		return &PointEd25519{value: edwards25519.NewIdentityPoint().Add(p.value, rTmp)}
-	} else {
-		return nil
-	}
-}
-
-func (p *PointEd25519) Mul(rhs Scalar) Point {
-	if rhs == nil {
-		return nil
-	}
-	r, ok := rhs.(*ScalarEd25519)
-	if ok {
-		value := edwards25519.NewIdentityPoint().ScalarMult(r.value, p.value)
-		return &PointEd25519{value}
-	} else {
-		return nil
-	}
-}
-
-// MangleScalarBitsAndMulByBasepointToProducePublicKey
-// is a function for mangling the bits of a (formerly
-// mathematically well-defined) "scalar" and multiplying it to produce a
-// public key.
-func (p *PointEd25519) MangleScalarBitsAndMulByBasepointToProducePublicKey(rhs *ScalarEd25519) *PointEd25519 {
-	data := rhs.value.Bytes()
-	s, err := edwards25519.NewScalar().SetBytesWithClamping(data[:])
-	if err != nil {
-		return nil
-	}
-	value := edwards25519.NewIdentityPoint().ScalarBaseMult(s)
-	return &PointEd25519{value}
-}
-
-func (p *PointEd25519) Equal(rhs Point) bool {
-	r, ok := rhs.(*PointEd25519)
-	if ok {
-		// We would like to check that the point (X/Z, Y/Z) is equal to
-		// the point (X'/Z', Y'/Z') without converting into affine
-		// coordinates (x, y) and (x', y'), which requires two inversions.
-		// We have that X = xZ and X' = x'Z'. Thus, x = x' is equivalent to
-		// (xZ)Z' = (x'Z')Z, and similarly for the y-coordinate.
-		return p.value.Equal(r.value) == 1
-		//lhs1 := new(ed.FieldElement).Mul(&p.value.X, &r.value.Z)
-		//rhs1 := new(ed.FieldElement).Mul(&r.value.X, &p.value.Z)
-		//lhs2 := new(ed.FieldElement).Mul(&p.value.Y, &r.value.Z)
-		//rhs2 := new(ed.FieldElement).Mul(&r.value.Y, &p.value.Z)
-		//
-		//return lhs1.Equals(rhs1) && lhs2.Equals(rhs2)
-	} else {
-		return false
-	}
-}
-
-func (p *PointEd25519) Set(x, y *big.Int) (Point, error) {
-	// check is identity
-	xx := subtle.ConstantTimeCompare(x.Bytes(), []byte{})
-	yy := subtle.ConstantTimeCompare(y.Bytes(), []byte{})
-	if (xx | yy) == 1 {
-		return p.Identity(), nil
-	}
-	xElem := new(ed.FieldElement).SetBigInt(x)
-	yElem := new(ed.FieldElement).SetBigInt(y)
-
-	var data [32]byte
-	var affine [64]byte
-	xElem.BytesInto(&data)
-	copy(affine[:32], data[:])
-	yElem.BytesInto(&data)
-	copy(affine[32:], data[:])
-	return p.FromAffineUncompressed(affine[:])
-}
-
-// sqrtRatio sets r to the non-negative square root of the ratio of u and v.
-//
-// If u/v is square, sqrtRatio returns r and 1. If u/v is not square, SqrtRatio
-// sets r according to Section 4.3 of draft-irtf-cfrg-ristretto255-decaf448-00,
-// and returns r and 0.
-func sqrtRatio(u, v *ed.FieldElement) (r *ed.FieldElement, wasSquare bool) {
-	sqrtM1 := ed.FieldElement{
-		533094393274173, 2016890930128738, 18285341111199,
-		134597186663265, 1486323764102114,
-	}
-	a := new(ed.FieldElement)
-	b := new(ed.FieldElement)
-	r = new(ed.FieldElement)
-
-	// r = (u * v3) * (u * v7)^((p-5)/8)
-	v2 := a.Square(v)
-	uv3 := b.Mul(u, b.Mul(v2, v))
-	uv7 := a.Mul(uv3, a.Square(v2))
-	r.Mul(uv3, r.Exp22523(uv7))
-
-	check := a.Mul(v, a.Square(r)) // check = v * r^2
-
-	uNeg := b.Neg(u)
-	correctSignSqrt := check.Equals(u)
-	flippedSignSqrt := check.Equals(uNeg)
-	flippedSignSqrtI := check.Equals(uNeg.Mul(uNeg, &sqrtM1))
-
-	rPrime := b.Mul(r, &sqrtM1) // r_prime = SQRT_M1 * r
-	// r = CT_SELECT(r_prime IF flipped_sign_sqrt | flipped_sign_sqrt_i ELSE r)
-	cselect(r, rPrime, r, flippedSignSqrt || flippedSignSqrtI)
-
-	r.Abs(r) // Choose the nonnegative square root.
-	return r, correctSignSqrt || flippedSignSqrt
-}
-
-// cselect sets v to a if cond == 1, and to b if cond == 0.
-func cselect(v, a, b *ed.FieldElement, cond bool) *ed.FieldElement {
-	const mask64Bits uint64 = (1 << 64) - 1
-
-	m := uint64(0)
-	if cond {
-		m = mask64Bits
-	}
-
-	v[0] = (m & a[0]) | (^m & b[0])
-	v[1] = (m & a[1]) | (^m & b[1])
-	v[2] = (m & a[2]) | (^m & b[2])
-	v[3] = (m & a[3]) | (^m & b[3])
-	v[4] = (m & a[4]) | (^m & b[4])
-	return v
-}
-
-func (p *PointEd25519) ToAffineCompressed() []byte {
-	return p.value.Bytes()
-}
-
-func (p *PointEd25519) ToAffineUncompressed() []byte {
-	x, y, z, _ := p.value.ExtendedCoordinates()
-	recip := new(field.Element).Invert(z)
-	x.Multiply(x, recip)
-	y.Multiply(y, recip)
-	var out [64]byte
-	copy(out[:32], x.Bytes())
-	copy(out[32:], y.Bytes())
-	return out[:]
-}
-
-func (p *PointEd25519) FromAffineCompressed(inBytes []byte) (Point, error) {
-	pt, err := edwards25519.NewIdentityPoint().SetBytes(inBytes)
-	if err != nil {
-		return nil, err
-	}
-	return &PointEd25519{value: pt}, nil
-}
-
-func (p *PointEd25519) FromAffineUncompressed(inBytes []byte) (Point, error) {
-	if len(inBytes) != 64 {
-		return nil, fmt.Errorf("invalid byte sequence")
-	}
-	if bytes.Equal(inBytes, []byte{0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}) {
-		return &PointEd25519{value: edwards25519.NewIdentityPoint()}, nil
-	}
-	x, err := new(field.Element).SetBytes(inBytes[:32])
-	if err != nil {
-		return nil, err
-	}
-	y, err := new(field.Element).SetBytes(inBytes[32:])
-	if err != nil {
-		return nil, err
-	}
-	z := new(field.Element).One()
-	t := new(field.Element).Multiply(x, y)
-	value, err := edwards25519.NewIdentityPoint().SetExtendedCoordinates(x, y, z, t)
-	if err != nil {
-		return nil, err
-	}
-	return &PointEd25519{value}, nil
-}
-
-func (p *PointEd25519) CurveName() string {
-	return ED25519Name
-}
-
-func (p *PointEd25519) SumOfProducts(points []Point, scalars []Scalar) Point {
-	nScalars := make([]*edwards25519.Scalar, len(scalars))
-	nPoints := make([]*edwards25519.Point, len(points))
-	for i, sc := range scalars {
-		s, err := edwards25519.NewScalar().SetCanonicalBytes(sc.Bytes())
-		if err != nil {
-			return nil
-		}
-		nScalars[i] = s
-	}
-	for i, pt := range points {
-		pp, ok := pt.(*PointEd25519)
-		if !ok {
-			return nil
-		}
-		nPoints[i] = pp.value
-	}
-	pt := edwards25519.NewIdentityPoint().MultiScalarMult(nScalars, nPoints)
-	return &PointEd25519{value: pt}
-}
-
-func (p *PointEd25519) VarTimeDoubleScalarBaseMult(a Scalar, A Point, b Scalar) Point {
-	AA, ok := A.(*PointEd25519)
-	if !ok {
-		return nil
-	}
-	aa, ok := a.(*ScalarEd25519)
-	if !ok {
-		return nil
-	}
-	bb, ok := b.(*ScalarEd25519)
-	if !ok {
-		return nil
-	}
-	value := edwards25519.NewIdentityPoint().VarTimeDoubleScalarBaseMult(aa.value, AA.value, bb.value)
-	return &PointEd25519{value}
-}
-
-func (p *PointEd25519) MarshalBinary() ([]byte, error) {
-	return pointMarshalBinary(p)
-}
-
-func (p *PointEd25519) UnmarshalBinary(input []byte) error {
-	pt, err := pointUnmarshalBinary(input)
-	if err != nil {
-		return err
-	}
-	ppt, ok := pt.(*PointEd25519)
-	if !ok {
-		return fmt.Errorf("invalid point")
-	}
-	p.value = ppt.value
-	return nil
-}
-
-func (p *PointEd25519) MarshalText() ([]byte, error) {
-	return pointMarshalText(p)
-}
-
-func (p *PointEd25519) UnmarshalText(input []byte) error {
-	pt, err := pointUnmarshalText(input)
-	if err != nil {
-		return err
-	}
-	ppt, ok := pt.(*PointEd25519)
-	if !ok {
-		return fmt.Errorf("invalid point")
-	}
-	p.value = ppt.value
-	return nil
-}
-
-func (p *PointEd25519) MarshalJSON() ([]byte, error) {
-	return pointMarshalJson(p)
-}
-
-func (p *PointEd25519) UnmarshalJSON(input []byte) error {
-	pt, err := pointUnmarshalJson(input)
-	if err != nil {
-		return err
-	}
-	P, ok := pt.(*PointEd25519)
-	if !ok {
-		return fmt.Errorf("invalid type")
-	}
-	p.value = P.value
-	return nil
-}
-
-func (p *PointEd25519) GetEdwardsPoint() *edwards25519.Point {
-	return edwards25519.NewIdentityPoint().Set(p.value)
-}
-
-func (p *PointEd25519) SetEdwardsPoint(pt *edwards25519.Point) *PointEd25519 {
-	return &PointEd25519{value: edwards25519.NewIdentityPoint().Set(pt)}
-}
-
-// Attempt to convert to an `EdwardsPoint`, using the supplied
-// choice of sign for the `EdwardsPoint`.
-//   - `sign`: a `u8` donating the desired sign of the resulting
-//     `EdwardsPoint`.  `0` denotes positive and `1` negative.
-func toEdwards(u *ed.FieldElement, sign byte) *PointEd25519 {
-	one := new(ed.FieldElement).SetOne()
-	// To decompress the Montgomery u coordinate to an
-	// `EdwardsPoint`, we apply the birational map to obtain the
-	// Edwards y coordinate, then do Edwards decompression.
-	//
-	// The birational map is y = (u-1)/(u+1).
-	//
-	// The exceptional points are the zeros of the denominator,
-	// i.e., u = -1.
-	//
-	// But when u = -1, v^2 = u*(u^2+486662*u+1) = 486660.
-	//
-	// Since this is nonsquare mod p, u = -1 corresponds to a point
-	// on the twist, not the curve, so we can reject it early.
-	if u.Equals(new(ed.FieldElement).Neg(one)) {
-		return nil
-	}
-
-	// y = (u-1)/(u+1)
-	yLhs := new(ed.FieldElement).Sub(u, one)
-	yRhs := new(ed.FieldElement).Add(u, one)
-	yInv := new(ed.FieldElement).Inverse(yRhs)
-	y := new(ed.FieldElement).Mul(yLhs, yInv)
-	yBytes := y.Bytes()
-	yBytes[31] ^= sign << 7
-
-	pt, err := edwards25519.NewIdentityPoint().SetBytes(yBytes[:])
-	if err != nil {
-		return nil
-	}
-	pt.MultByCofactor(pt)
-	return &PointEd25519{value: pt}
-}
-
-// Perform the Elligator2 mapping to a Montgomery point encoded as a 32 byte value
-//
-// See <https://tools.ietf.org/html/draft-irtf-cfrg-hash-to-curve-11#section-6.7.1>
-func elligatorEncode(r0 *ed.FieldElement) *ed.FieldElement {
-	montgomeryA := &ed.FieldElement{
-		486662, 0, 0, 0, 0,
-	}
-	// montgomeryANeg is equal to -486662.
-	montgomeryANeg := &ed.FieldElement{
-		2251799813198567,
-		2251799813685247,
-		2251799813685247,
-		2251799813685247,
-		2251799813685247,
-	}
-	t := new(ed.FieldElement)
-	one := new(ed.FieldElement).SetOne()
-	// 2r^2
-	d1 := new(ed.FieldElement).Add(one, t.DoubledSquare(r0))
-	// A/(1+2r^2)
-	d := new(ed.FieldElement).Mul(montgomeryANeg, t.Inverse(d1))
-	dsq := new(ed.FieldElement).Square(d)
-	au := new(ed.FieldElement).Mul(montgomeryA, d)
-
-	inner := new(ed.FieldElement).Add(dsq, au)
-	inner.Add(inner, one)
-
-	// d^3 + Ad^2 + d
-	eps := new(ed.FieldElement).Mul(d, inner)
-	_, wasSquare := sqrtRatio(eps, one)
-
-	zero := new(ed.FieldElement).SetZero()
-	aTemp := new(ed.FieldElement).SetZero()
-	// 0 or A if non-square
-	cselect(aTemp, zero, montgomeryA, wasSquare)
-	// d, or d+A if non-square
-	u := new(ed.FieldElement).Add(d, aTemp)
-	// d or -d-A if non-square
-	cselect(u, u, new(ed.FieldElement).Neg(u), wasSquare)
-	return u
-}

pkg/crypto/core/curves/ed25519_curve_test.go

@@ -1,403 +0,0 @@
-//
-// Copyright Coinbase, Inc. All Rights Reserved.
-//
-// SPDX-License-Identifier: Apache-2.0
-//
-
-package curves
-
-import (
-	crand "crypto/rand"
-	"encoding/hex"
-	"math/big"
-	"testing"
-
-	ed "filippo.io/edwards25519"
-	"github.com/stretchr/testify/require"
-
-	"github.com/onsonr/sonr/pkg/crypto/internal"
-)
-
-func TestScalarEd25519Random(t *testing.T) {
-	ed25519 := ED25519()
-	sc := ed25519.Scalar.Random(testRng())
-	s, ok := sc.(*ScalarEd25519)
-	require.True(t, ok)
-	expected := toRSc("feaa6a9d6dda758da6145f7d411a3af9f8a120698e0093faa97085b384c3f00e")
-	require.Equal(t, s.value.Equal(expected), 1)
-	// Try 10 random values
-	for i := 0; i < 10; i++ {
-		sc := ed25519.Scalar.Random(crand.Reader)
-		_, ok := sc.(*ScalarEd25519)
-		require.True(t, ok)
-		require.True(t, !sc.IsZero())
-	}
-}
-
-func TestScalarEd25519Hash(t *testing.T) {
-	var b [32]byte
-	ed25519 := ED25519()
-	sc := ed25519.Scalar.Hash(b[:])
-	s, ok := sc.(*ScalarEd25519)
-	require.True(t, ok)
-	expected := toRSc("9d574494a02d72f5ff311cf0fb844d0fdd6103b17255274e029bdeed7207d409")
-	require.Equal(t, s.value.Equal(expected), 1)
-}
-
-func TestScalarEd25519Zero(t *testing.T) {
-	ed25519 := ED25519()
-	sc := ed25519.Scalar.Zero()
-	require.True(t, sc.IsZero())
-	require.True(t, sc.IsEven())
-}
-
-func TestScalarEd25519One(t *testing.T) {
-	ed25519 := ED25519()
-	sc := ed25519.Scalar.One()
-	require.True(t, sc.IsOne())
-	require.True(t, sc.IsOdd())
-}
-
-func TestScalarEd25519New(t *testing.T) {
-	ed25519 := ED25519()
-	three := ed25519.Scalar.New(3)
-	require.True(t, three.IsOdd())
-	four := ed25519.Scalar.New(4)
-	require.True(t, four.IsEven())
-	neg1 := ed25519.Scalar.New(-1)
-	require.True(t, neg1.IsEven())
-	neg2 := ed25519.Scalar.New(-2)
-	require.True(t, neg2.IsOdd())
-}
-
-func TestScalarEd25519Square(t *testing.T) {
-	ed25519 := ED25519()
-	three := ed25519.Scalar.New(3)
-	nine := ed25519.Scalar.New(9)
-	require.Equal(t, three.Square().Cmp(nine), 0)
-}
-
-func TestScalarEd25519Cube(t *testing.T) {
-	ed25519 := ED25519()
-	three := ed25519.Scalar.New(3)
-	twentySeven := ed25519.Scalar.New(27)
-	require.Equal(t, three.Cube().Cmp(twentySeven), 0)
-}
-
-func TestScalarEd25519Double(t *testing.T) {
-	ed25519 := ED25519()
-	three := ed25519.Scalar.New(3)
-	six := ed25519.Scalar.New(6)
-	require.Equal(t, three.Double().Cmp(six), 0)
-}
-
-func TestScalarEd25519Neg(t *testing.T) {
-	ed25519 := ED25519()
-	one := ed25519.Scalar.One()
-	neg1 := ed25519.Scalar.New(-1)
-	require.Equal(t, one.Neg().Cmp(neg1), 0)
-	lotsOfThrees := ed25519.Scalar.New(333333)
-	expected := ed25519.Scalar.New(-333333)
-	require.Equal(t, lotsOfThrees.Neg().Cmp(expected), 0)
-}
-
-func TestScalarEd25519Invert(t *testing.T) {
-	ed25519 := ED25519()
-	nine := ed25519.Scalar.New(9)
-	actual, _ := nine.Invert()
-	sa, _ := actual.(*ScalarEd25519)
-	expected := toRSc("c3d9c4db0516043013b1e1ce8637dc92e3388ee3388ee3388ee3388ee3388e03")
-	require.Equal(t, sa.value.Equal(expected), 1)
-}
-
-func TestScalarEd25519Sqrt(t *testing.T) {
-	ed25519 := ED25519()
-	nine := ed25519.Scalar.New(9)
-	actual, err := nine.Sqrt()
-	sa, _ := actual.(*ScalarEd25519)
-	expected := toRSc("03")
-	require.NoError(t, err)
-	require.Equal(t, sa.value.Equal(expected), 1)
-}
-
-func TestScalarEd25519Add(t *testing.T) {
-	ed25519 := ED25519()
-	nine := ed25519.Scalar.New(9)
-	six := ed25519.Scalar.New(6)
-	fifteen := nine.Add(six)
-	require.NotNil(t, fifteen)
-	expected := ed25519.Scalar.New(15)
-	require.Equal(t, expected.Cmp(fifteen), 0)
-
-	upper := ed25519.Scalar.New(-3)
-	actual := upper.Add(nine)
-	require.NotNil(t, actual)
-	require.Equal(t, actual.Cmp(six), 0)
-}
-
-func TestScalarEd25519Sub(t *testing.T) {
-	ed25519 := ED25519()
-	nine := ed25519.Scalar.New(9)
-	six := ed25519.Scalar.New(6)
-	expected := ed25519.Scalar.New(-3)
-
-	actual := six.Sub(nine)
-	require.Equal(t, expected.Cmp(actual), 0)
-
-	actual = nine.Sub(six)
-	require.Equal(t, actual.Cmp(ed25519.Scalar.New(3)), 0)
-}
-
-func TestScalarEd25519Mul(t *testing.T) {
-	ed25519 := ED25519()
-	nine := ed25519.Scalar.New(9)
-	six := ed25519.Scalar.New(6)
-	actual := nine.Mul(six)
-	require.Equal(t, actual.Cmp(ed25519.Scalar.New(54)), 0)
-
-	upper := ed25519.Scalar.New(-1)
-	require.Equal(t, upper.Mul(upper).Cmp(ed25519.Scalar.New(1)), 0)
-}
-
-func TestScalarEd25519Div(t *testing.T) {
-	ed25519 := ED25519()
-	nine := ed25519.Scalar.New(9)
-	actual := nine.Div(nine)
-	require.Equal(t, actual.Cmp(ed25519.Scalar.New(1)), 0)
-	require.Equal(t, ed25519.Scalar.New(54).Div(nine).Cmp(ed25519.Scalar.New(6)), 0)
-}
-
-func TestScalarEd25519Serialize(t *testing.T) {
-	ed25519 := ED25519()
-	sc := ed25519.Scalar.New(255)
-	sequence := sc.Bytes()
-	require.Equal(t, len(sequence), 32)
-	require.Equal(t, sequence, []byte{0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
-	ret, err := ed25519.Scalar.SetBytes(sequence)
-	require.NoError(t, err)
-	require.Equal(t, ret.Cmp(sc), 0)
-
-	// Try 10 random values
-	for i := 0; i < 10; i++ {
-		sc = ed25519.Scalar.Random(crand.Reader)
-		sequence = sc.Bytes()
-		require.Equal(t, len(sequence), 32)
-		ret, err = ed25519.Scalar.SetBytes(sequence)
-		require.NoError(t, err)
-		require.Equal(t, ret.Cmp(sc), 0)
-	}
-}
-
-func TestScalarEd25519Nil(t *testing.T) {
-	ed25519 := ED25519()
-	one := ed25519.Scalar.New(1)
-	require.Nil(t, one.Add(nil))
-	require.Nil(t, one.Sub(nil))
-	require.Nil(t, one.Mul(nil))
-	require.Nil(t, one.Div(nil))
-	require.Nil(t, ed25519.Scalar.Random(nil))
-	require.Equal(t, one.Cmp(nil), -2)
-	_, err := ed25519.Scalar.SetBigInt(nil)
-	require.Error(t, err)
-}
-
-func TestPointEd25519Random(t *testing.T) {
-	ed25519 := ED25519()
-	sc := ed25519.Point.Random(testRng())
-	s, ok := sc.(*PointEd25519)
-	require.True(t, ok)
-	expected := toRPt("6011540c6231421a70ced5f577432531f198d318facfaad6e52cc42fba6e6fc5")
-	require.True(t, s.Equal(&PointEd25519{expected}))
-	// Try 25 random values
-	for i := 0; i < 25; i++ {
-		sc := ed25519.Point.Random(crand.Reader)
-		_, ok := sc.(*PointEd25519)
-		require.True(t, ok)
-		require.True(t, !sc.IsIdentity())
-		pBytes := sc.ToAffineCompressed()
-		_, err := ed.NewIdentityPoint().SetBytes(pBytes)
-		require.NoError(t, err)
-	}
-}
-
-func TestPointEd25519Hash(t *testing.T) {
-	var b [32]byte
-	ed25519 := ED25519()
-	sc := ed25519.Point.Hash(b[:])
-	s, ok := sc.(*PointEd25519)
-	require.True(t, ok)
-	expected := toRPt("b4d75c3bb03ca644ab6c6d2a955c911003d8cfa719415de93a6b85eeb0c8dd97")
-	require.True(t, s.Equal(&PointEd25519{expected}))
-
-	// Fuzz test
-	for i := 0; i < 25; i++ {
-		_, _ = crand.Read(b[:])
-		sc = ed25519.Point.Hash(b[:])
-		require.NotNil(t, sc)
-	}
-}
-
-func TestPointEd25519Identity(t *testing.T) {
-	ed25519 := ED25519()
-	sc := ed25519.Point.Identity()
-	require.True(t, sc.IsIdentity())
-	require.Equal(t, sc.ToAffineCompressed(), []byte{1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0})
-}
-
-func TestPointEd25519Generator(t *testing.T) {
-	ed25519 := ED25519()
-	sc := ed25519.Point.Generator()
-	s, ok := sc.(*PointEd25519)
-	require.True(t, ok)
-	require.Equal(t, s.ToAffineCompressed(), []byte{0x58, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66})
-}
-
-func TestPointEd25519Set(t *testing.T) {
-	ed25519 := ED25519()
-	iden, err := ed25519.Point.Set(big.NewInt(0), big.NewInt(0))
-	require.NoError(t, err)
-	require.True(t, iden.IsIdentity())
-	xBytes, _ := hex.DecodeString("1ad5258f602d56c9b2a7259560c72c695cdcd6fd31e2a4c0fe536ecdd3366921")
-	yBytes, _ := hex.DecodeString("5866666666666666666666666666666666666666666666666666666666666666")
-	x := new(big.Int).SetBytes(internal.ReverseScalarBytes(xBytes))
-	y := new(big.Int).SetBytes(internal.ReverseScalarBytes(yBytes))
-	newPoint, err := ed25519.Point.Set(x, y)
-	require.NoError(t, err)
-	require.NotEqualf(t, iden, newPoint, "after setting valid x and y, the point should NOT be identity point")
-
-	emptyX := new(big.Int).SetBytes(internal.ReverseScalarBytes([]byte{}))
-	identityPoint, err := ed25519.Point.Set(emptyX, y)
-	require.NoError(t, err)
-	require.Equalf(t, iden, identityPoint, "When x is empty, the point will be identity")
-}
-
-func TestPointEd25519Double(t *testing.T) {
-	ed25519 := ED25519()
-	g := ed25519.Point.Generator()
-	g2 := g.Double()
-	require.True(t, g2.Equal(g.Mul(ed25519.Scalar.New(2))))
-	i := ed25519.Point.Identity()
-	require.True(t, i.Double().Equal(i))
-}
-
-func TestPointEd25519Neg(t *testing.T) {
-	ed25519 := ED25519()
-	g := ed25519.Point.Generator().Neg()
-	require.True(t, g.Neg().Equal(ed25519.Point.Generator()))
-	require.True(t, ed25519.Point.Identity().Neg().Equal(ed25519.Point.Identity()))
-}
-
-func TestPointEd25519Add(t *testing.T) {
-	ed25519 := ED25519()
-	pt := ed25519.Point.Generator()
-	require.True(t, pt.Add(pt).Equal(pt.Double()))
-	require.True(t, pt.Mul(ed25519.Scalar.New(3)).Equal(pt.Add(pt).Add(pt)))
-}
-
-func TestPointEd25519Sub(t *testing.T) {
-	ed25519 := ED25519()
-	g := ed25519.Point.Generator()
-	pt := ed25519.Point.Generator().Mul(ed25519.Scalar.New(4))
-	require.True(t, pt.Sub(g).Sub(g).Sub(g).Equal(g))
-	require.True(t, pt.Sub(g).Sub(g).Sub(g).Sub(g).IsIdentity())
-}
-
-func TestPointEd25519Mul(t *testing.T) {
-	ed25519 := ED25519()
-	g := ed25519.Point.Generator()
-	pt := ed25519.Point.Generator().Mul(ed25519.Scalar.New(4))
-	require.True(t, g.Double().Double().Equal(pt))
-}
-
-func TestPointEd25519Serialize(t *testing.T) {
-	ed25519 := ED25519()
-	ss := ed25519.Scalar.Random(testRng())
-	g := ed25519.Point.Generator()
-
-	ppt := g.Mul(ss)
-	expectedC := []byte{0x7f, 0x5b, 0xa, 0xd9, 0xb8, 0xce, 0xb7, 0x7, 0x4c, 0x10, 0xc8, 0xb4, 0x27, 0xe8, 0xd2, 0x28, 0x50, 0x42, 0x6c, 0x0, 0x8a, 0x3, 0x72, 0x2b, 0x7c, 0x3c, 0x37, 0x6f, 0xf8, 0x8f, 0x42, 0x5d}
-	expectedU := []byte{0x70, 0xad, 0x4, 0xa1, 0x6, 0x8, 0x9f, 0x47, 0xe1, 0xe8, 0x9b, 0x9c, 0x81, 0x5a, 0xfb, 0xb9, 0x85, 0x6a, 0x2c, 0xa, 0xbc, 0xff, 0xe, 0xc6, 0xa0, 0xb0, 0xac, 0x75, 0xc, 0xd8, 0x59, 0x53, 0x7f, 0x5b, 0xa, 0xd9, 0xb8, 0xce, 0xb7, 0x7, 0x4c, 0x10, 0xc8, 0xb4, 0x27, 0xe8, 0xd2, 0x28, 0x50, 0x42, 0x6c, 0x0, 0x8a, 0x3, 0x72, 0x2b, 0x7c, 0x3c, 0x37, 0x6f, 0xf8, 0x8f, 0x42, 0x5d}
-	require.Equal(t, ppt.ToAffineCompressed(), expectedC)
-	require.Equal(t, ppt.ToAffineUncompressed(), expectedU)
-	retP, err := ppt.FromAffineCompressed(ppt.ToAffineCompressed())
-	require.NoError(t, err)
-	require.True(t, ppt.Equal(retP))
-	retP, err = ppt.FromAffineUncompressed(ppt.ToAffineUncompressed())
-	require.NoError(t, err)
-	require.True(t, ppt.Equal(retP))
-
-	// smoke test
-	for i := 0; i < 25; i++ {
-		s := ed25519.Scalar.Random(crand.Reader)
-		pt := g.Mul(s)
-		cmprs := pt.ToAffineCompressed()
-		require.Equal(t, len(cmprs), 32)
-		retC, err := pt.FromAffineCompressed(cmprs)
-		require.NoError(t, err)
-		require.True(t, pt.Equal(retC))
-
-		un := pt.ToAffineUncompressed()
-		require.Equal(t, len(un), 64)
-		retU, err := pt.FromAffineUncompressed(un)
-		require.NoError(t, err)
-		require.True(t, pt.Equal(retU))
-	}
-}
-
-func TestPointEd25519Nil(t *testing.T) {
-	ed25519 := ED25519()
-	one := ed25519.Point.Generator()
-	require.Nil(t, one.Add(nil))
-	require.Nil(t, one.Sub(nil))
-	require.Nil(t, one.Mul(nil))
-	require.Nil(t, ed25519.Scalar.Random(nil))
-	require.False(t, one.Equal(nil))
-	_, err := ed25519.Scalar.SetBigInt(nil)
-	require.Error(t, err)
-}
-
-func TestPointEd25519SumOfProducts(t *testing.T) {
-	lhs := new(PointEd25519).Generator().Mul(new(ScalarEd25519).New(50))
-	points := make([]Point, 5)
-	for i := range points {
-		points[i] = new(PointEd25519).Generator()
-	}
-	scalars := []Scalar{
-		new(ScalarEd25519).New(8),
-		new(ScalarEd25519).New(9),
-		new(ScalarEd25519).New(10),
-		new(ScalarEd25519).New(11),
-		new(ScalarEd25519).New(12),
-	}
-	rhs := lhs.SumOfProducts(points, scalars)
-	require.NotNil(t, rhs)
-	require.True(t, lhs.Equal(rhs))
-}
-
-func TestPointEd25519VarTimeDoubleScalarBaseMult(t *testing.T) {
-	curve := ED25519()
-	h := curve.Point.Hash([]byte("TestPointEd25519VarTimeDoubleScalarBaseMult"))
-	a := curve.Scalar.New(23)
-	b := curve.Scalar.New(77)
-	H, ok := h.(*PointEd25519)
-	require.True(t, ok)
-	rhs := H.VarTimeDoubleScalarBaseMult(a, H, b)
-	lhs := h.Mul(a).Add(curve.Point.Generator().Mul(b))
-	require.True(t, lhs.Equal(rhs))
-}
-
-func toRSc(hx string) *ed.Scalar {
-	e, _ := hex.DecodeString(hx)
-	var data [32]byte
-	copy(data[:], e)
-	value, _ := new(ed.Scalar).SetCanonicalBytes(data[:])
-	return value
-}
-
-func toRPt(hx string) *ed.Point {
-	e, _ := hex.DecodeString(hx)
-	var data [32]byte
-	copy(data[:], e)
-	pt, _ := new(PointEd25519).FromAffineCompressed(data[:])
-	return pt.(*PointEd25519).value
-}

pkg/crypto/core/curves/field.go

@@ -1,280 +0,0 @@
-//
-// Copyright Coinbase, Inc. All Rights Reserved.
-//
-// SPDX-License-Identifier: Apache-2.0
-//
-
-// Package curves: Field implementation IS NOT constant time as it leverages math/big for big number operations.
-package curves
-
-import (
-	"crypto/rand"
-	"encoding/json"
-	"fmt"
-	"io"
-	"math/big"
-	"sync"
-)
-
-var ed25519SubGroupOrderOnce sync.Once
-var ed25519SubGroupOrder *big.Int
-
-// Field is a finite field.
-type Field struct {
-	*big.Int
-}
-
-// Element is a group element within a finite field.
-type Element struct {
-	Modulus *Field   `json:"modulus"`
-	Value   *big.Int `json:"value"`
-}
-
-// ElementJSON is used in JSON<>Element conversions.
-// For years, big.Int hasn't properly supported JSON unmarshaling
-// https://github.com/golang/go/issues/28154
-type ElementJSON struct {
-	Modulus string `json:"modulus"`
-	Value   string `json:"value"`
-}
-
-// Marshal Element to JSON
-func (x *Element) MarshalJSON() ([]byte, error) {
-	return json.Marshal(ElementJSON{
-		Modulus: x.Modulus.String(),
-		Value:   x.Value.String(),
-	})
-}
-
-func (x *Element) UnmarshalJSON(bytes []byte) error {
-	var e ElementJSON
-	err := json.Unmarshal(bytes, &e)
-	if err != nil {
-		return err
-	}
-	// Convert the strings to big.Ints
-	modulus, ok := new(big.Int).SetString(e.Modulus, 10)
-	if !ok {
-		return fmt.Errorf("failed to unmarshal modulus string '%v' to big.Int", e.Modulus)
-	}
-	x.Modulus = &Field{modulus}
-	x.Value, ok = new(big.Int).SetString(e.Value, 10)
-	if !ok {
-		return fmt.Errorf("failed to unmarshal value string '%v' to big.Int", e.Value)
-	}
-	return nil
-}
-
-// The probability of returning true for a randomly chosen
-// non-prime is at most ¼ⁿ. 64 is a widely used standard
-// that is more than sufficient.
-const millerRabinRounds = 64
-
-// New is a constructor for a Field.
-func NewField(modulus *big.Int) *Field {
-	// For our purposes we never expect to be dealing with a non-prime field. This provides some protection against
-	// accidentally doing that.
-	if !modulus.ProbablyPrime(millerRabinRounds) {
-		panic(fmt.Sprintf("modulus: %x is not a prime", modulus))
-	}
-
-	return &Field{modulus}
-}
-
-func newElement(field *Field, value *big.Int) *Element {
-	if !field.IsValid(value) {
-		panic(fmt.Sprintf("value: %x is not within field: %x", value, field))
-	}
-
-	return &Element{field, value}
-}
-
-// IsValid returns whether or not the value is within [0, modulus)
-func (f Field) IsValid(value *big.Int) bool {
-	// value < modulus && value >= 0
-	return value.Cmp(f.Int) < 0 && value.Sign() >= 0
-}
-
-func (f Field) NewElement(value *big.Int) *Element {
-	return newElement(&f, value)
-}
-
-func (f Field) Zero() *Element {
-	return newElement(&f, big.NewInt(0))
-}
-
-func (f Field) One() *Element {
-	return newElement(&f, big.NewInt(1))
-}
-
-func (f Field) RandomElement(r io.Reader) (*Element, error) {
-	if r == nil {
-		r = rand.Reader
-	}
-	var randInt *big.Int
-	var err error
-	// Ed25519 needs to do special handling
-	// in case the value is used in
-	// Scalar multiplications with points
-	if f.Int.Cmp(Ed25519Order()) == 0 {
-		scalar := NewEd25519Scalar()
-		randInt, err = scalar.RandomWithReader(r)
-	} else {
-		// Read a random integer within the field. This is defined as [0, max) so we don't need to
-		// explicitly check it is within the field. If it is not, NewElement will panic anyways.
-		randInt, err = rand.Int(r, f.Int)
-	}
-	if err != nil {
-		return nil, err
-	}
-	return newElement(&f, randInt), nil
-}
-
-// ElementFromBytes initializes a new field element from big-endian bytes
-func (f Field) ElementFromBytes(bytes []byte) *Element {
-	return newElement(&f, new(big.Int).SetBytes(bytes))
-}
-
-// ReducedElementFromBytes initializes a new field element from big-endian bytes and reduces it by
-// the modulus of the field.
-//
-// WARNING: If this is used with cryptographic constructions which rely on a uniform distribution of
-// values, this may introduce a bias to the value of the returned field element. This happens when
-// the integer range of the provided bytes is not an integer multiple of the field order.
-//
-// Assume we are working in field which a modulus of 3 and the range of the uniform random bytes we
-// provide as input is 5. Thus, the set of field elements is {0, 1, 2} and the set of integer values
-// for the input bytes is: {0, 1, 2, 3, 4}. What is the distribution of the output values produced
-// by this function?
-//
-//	ReducedElementFromBytes(0) => 0
-//	ReducedElementFromBytes(1) => 1
-//	ReducedElementFromBytes(2) => 2
-//	ReducedElementFromBytes(3) => 0
-//	ReducedElementFromBytes(4) => 1
-//
-// For a value space V and random value v, a uniform distribution is defined as P[V = v] = 1/|V|
-// where |V| is to the order of the field. Using the results from above, we see that P[v = 0] = 2/5,
-// P[v = 1] = 2/5, and P[v = 2] = 1/5. For a uniform distribution we would expect these to each be
-// equal to 1/3. As they do not, this does not return uniform output for that example.
-//
-// To see why this is okay if the range is a multiple of the field order, change the input range to
-// 6 and notice that now each output has a probability of 2/6 = 1/3, and the output is uniform.
-func (f Field) ReducedElementFromBytes(bytes []byte) *Element {
-	value := new(big.Int).SetBytes(bytes)
-	value.Mod(value, f.Int)
-	return newElement(&f, value)
-}
-
-func (x Element) Field() *Field {
-	return x.Modulus
-}
-
-// Add returns the sum x+y
-func (x Element) Add(y *Element) *Element {
-	x.validateFields(y)
-
-	sum := new(big.Int).Add(x.Value, y.Value)
-	sum.Mod(sum, x.Modulus.Int)
-	return newElement(x.Modulus, sum)
-}
-
-// Sub returns the difference x-y
-func (x Element) Sub(y *Element) *Element {
-	x.validateFields(y)
-
-	difference := new(big.Int).Sub(x.Value, y.Value)
-	difference.Mod(difference, x.Modulus.Int)
-	return newElement(x.Modulus, difference)
-}
-
-// Neg returns the field negation
-func (x Element) Neg() *Element {
-	z := new(big.Int).Neg(x.Value)
-	z.Mod(z, x.Modulus.Int)
-	return newElement(x.Modulus, z)
-}
-
-// Mul returns the product x*y
-func (x Element) Mul(y *Element) *Element {
-	x.validateFields(y)
-
-	product := new(big.Int).Mul(x.Value, y.Value)
-	product.Mod(product, x.Modulus.Int)
-	return newElement(x.Modulus, product)
-}
-
-// Div returns the quotient x/y
-func (x Element) Div(y *Element) *Element {
-	x.validateFields(y)
-
-	yInv := new(big.Int).ModInverse(y.Value, x.Modulus.Int)
-	quotient := new(big.Int).Mul(x.Value, yInv)
-	quotient.Mod(quotient, x.Modulus.Int)
-	return newElement(x.Modulus, quotient)
-}
-
-// Pow computes x^y reduced by the modulus
-func (x Element) Pow(y *Element) *Element {
-	x.validateFields(y)
-
-	return newElement(x.Modulus, new(big.Int).Exp(x.Value, y.Value, x.Modulus.Int))
-}
-
-func (x Element) Invert() *Element {
-	return newElement(x.Modulus, new(big.Int).ModInverse(x.Value, x.Modulus.Int))
-}
-
-func (x Element) Sqrt() *Element {
-	return newElement(x.Modulus, new(big.Int).ModSqrt(x.Value, x.Modulus.Int))
-}
-
-// BigInt returns value as a big.Int
-func (x Element) BigInt() *big.Int {
-	return x.Value
-}
-
-// Bytes returns the value as bytes
-func (x Element) Bytes() []byte {
-	return x.BigInt().Bytes()
-}
-
-// IsEqual returns x == y
-func (x Element) IsEqual(y *Element) bool {
-	if !x.isEqualFields(y) {
-		return false
-	}
-
-	return x.Value.Cmp(y.Value) == 0
-}
-
-// Clone returns a new copy of the element
-func (x Element) Clone() *Element {
-	return x.Modulus.ElementFromBytes(x.Bytes())
-}
-
-func (x Element) isEqualFields(y *Element) bool {
-	return x.Modulus.Int.Cmp(y.Modulus.Int) == 0
-}
-
-func (x Element) validateFields(y *Element) {
-	if !x.isEqualFields(y) {
-		panic("fields must match for valid binary operation")
-	}
-}
-
-// SubgroupOrder returns the order of the Ed25519 base Point.
-func Ed25519Order() *big.Int {
-	ed25519SubGroupOrderOnce.Do(func() {
-		order, ok := new(big.Int).SetString(
-			"1000000000000000000000000000000014DEF9DEA2F79CD65812631A5CF5D3ED",
-			16,
-		)
-		if !ok {
-			panic("invalid hex string provided. This should never happen as it is constant.")
-		}
-		ed25519SubGroupOrder = order
-	})
-
-	return ed25519SubGroupOrder
-}

pkg/crypto/core/curves/field_test.go

@@ -1,301 +0,0 @@
-//
-// Copyright Coinbase, Inc. All Rights Reserved.
-//
-// SPDX-License-Identifier: Apache-2.0
-//
-
-package curves
-
-import (
-	"encoding/json"
-	"errors"
-	"fmt"
-	"math/big"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-var (
-	one                = big.NewInt(1)
-	modulus, modulusOk = new(big.Int).SetString(
-		"1000000000000000000000000000000014DEF9DEA2F79CD65812631A5CF5D3ED",
-		16,
-	)
-	oneBelowModulus = zero().Sub(modulus, one)
-	oneAboveModulus = zero().Add(modulus, one)
-	field25519      = NewField(modulus)
-)
-
-type buggedReader struct{}
-
-func (r buggedReader) Read(p []byte) (n int, err error) {
-	return 0, errors.New("EOF")
-}
-
-func zero() *big.Int {
-	return new(big.Int)
-}
-
-func assertElementZero(t *testing.T, e *Element) {
-	require.Equal(t, zero().Bytes(), e.Bytes())
-}
-
-type binaryOperation func(*Element) *Element
-
-func assertUnequalFieldsPanic(t *testing.T, b binaryOperation) {
-	altField := NewField(big.NewInt(23))
-	altElement := altField.NewElement(one)
-
-	require.PanicsWithValue(
-		t,
-		"fields must match for valid binary operation",
-		func() { b(altElement) },
-	)
-}
-
-func TestFieldModulus(t *testing.T) {
-	require.True(t, modulusOk)
-}
-
-func TestNewField(t *testing.T) {
-	require.PanicsWithValue(
-		t,
-		fmt.Sprintf("modulus: %x is not a prime", oneBelowModulus),
-		func() { NewField(oneBelowModulus) },
-	)
-	require.NotPanics(
-		t,
-		func() { NewField(modulus) },
-	)
-}
-
-func TestNewElement(t *testing.T) {
-	require.PanicsWithValue(
-		t,
-		fmt.Sprintf("value: %x is not within field: %x", modulus, field25519.Int),
-		func() { newElement(field25519, modulus) },
-	)
-	require.NotPanics(
-		t,
-		func() { newElement(field25519, oneBelowModulus) },
-	)
-}
-
-func TestElementIsValid(t *testing.T) {
-	require.False(t, field25519.IsValid(zero().Neg(one)))
-	require.False(t, field25519.IsValid(modulus))
-	require.False(t, field25519.IsValid(oneAboveModulus))
-	require.True(t, field25519.IsValid(oneBelowModulus))
-}
-
-func TestFieldNewElement(t *testing.T) {
-	element := field25519.NewElement(oneBelowModulus)
-
-	require.Equal(t, oneBelowModulus, element.Value)
-	require.Equal(t, field25519, element.Field())
-}
-
-func TestZeroElement(t *testing.T) {
-	require.Equal(t, zero(), field25519.Zero().Value)
-	require.Equal(t, field25519, field25519.Zero().Field())
-}
-
-func TestOneElement(t *testing.T) {
-	require.Equal(t, field25519.One().Value, one)
-	require.Equal(t, field25519.One().Field(), field25519)
-}
-
-func TestRandomElement(t *testing.T) {
-	randomElement1, err := field25519.RandomElement(nil)
-	require.NoError(t, err)
-	randomElement2, err := field25519.RandomElement(nil)
-	require.NoError(t, err)
-	randomElement3, err := field25519.RandomElement(new(buggedReader))
-	require.Error(t, err)
-
-	require.Equal(t, field25519, randomElement1.Field())
-	require.Equal(t, field25519, randomElement2.Field())
-	require.NotEqual(t, randomElement1.Value, randomElement2.Value)
-	require.Nil(t, randomElement3)
-}
-
-func TestElementFromBytes(t *testing.T) {
-	element := field25519.ElementFromBytes(oneBelowModulus.Bytes())
-
-	require.Equal(t, field25519, element.Field())
-	require.Equal(t, oneBelowModulus, element.Value)
-}
-
-func TestReducedElementFromBytes(t *testing.T) {
-	element := field25519.ReducedElementFromBytes(oneBelowModulus.Bytes())
-
-	require.Equal(t, field25519, element.Field())
-	require.Equal(t, oneBelowModulus, element.Value)
-
-	element = field25519.ReducedElementFromBytes(oneAboveModulus.Bytes())
-
-	require.Equal(t, field25519, element.Field())
-	require.Equal(t, one, element.Value)
-}
-
-func TestAddElement(t *testing.T) {
-	element1 := field25519.NewElement(one)
-	element2 := field25519.NewElement(big.NewInt(2))
-	element3 := field25519.NewElement(oneBelowModulus)
-	element4 := &Element{field25519, modulus}
-
-	require.Equal(t, element2, element1.Add(element1))
-	require.Equal(t, big.NewInt(3), element1.Add(element2).Value)
-	require.Equal(t, big.NewInt(3), element2.Add(element1).Value)
-	require.Equal(t, one, element1.Add(element4).Value)
-	require.Equal(t, one, element3.Add(element2).Value)
-	assertElementZero(t, element1.Add(element3))
-	assertUnequalFieldsPanic(t, element1.Add)
-}
-
-func TestSubElement(t *testing.T) {
-	element1 := field25519.NewElement(one)
-	element2 := field25519.NewElement(big.NewInt(2))
-	element3 := field25519.NewElement(oneBelowModulus)
-	element4 := &Element{field25519, modulus}
-
-	assertElementZero(t, element1.Sub(element1))
-	require.Equal(t, element3, element1.Sub(element2))
-	require.Equal(t, element1, element2.Sub(element1))
-	require.Equal(t, element1, element1.Sub(element4))
-	require.Equal(t, element3, element4.Sub(element1))
-	require.Equal(t, element1, element4.Sub(element3))
-	require.Equal(t, element3, element3.Sub(element4))
-	assertUnequalFieldsPanic(t, element1.Sub)
-}
-
-func TestMulElement(t *testing.T) {
-	element1 := field25519.NewElement(one)
-	element2 := field25519.NewElement(big.NewInt(2))
-	element3 := field25519.NewElement(oneBelowModulus)
-	element4 := field25519.NewElement(zero())
-	expectedProduct, ok := new(big.Int).SetString(
-		"1000000000000000000000000000000014def9dea2f79cd65812631a5cf5d3eb",
-		16,
-	)
-	require.True(t, ok)
-
-	assertElementZero(t, element1.Mul(element4))
-	assertElementZero(t, element4.Mul(element1))
-	require.Equal(t, element3, element1.Mul(element3))
-	require.Equal(t, element3, element3.Mul(element1))
-	require.Equal(t, expectedProduct, element3.Mul(element2).Value)
-	require.Equal(t, expectedProduct, element2.Mul(element3).Value)
-	assertUnequalFieldsPanic(t, element1.Mul)
-}
-
-func TestDivElement(t *testing.T) {
-	element1 := field25519.NewElement(one)
-	element2 := field25519.NewElement(big.NewInt(2))
-	element3 := field25519.NewElement(oneBelowModulus)
-	element4 := field25519.NewElement(zero())
-	expectedQuotient1, ok := new(big.Int).SetString(
-		"80000000000000000000000000000000a6f7cef517bce6b2c09318d2e7ae9f6",
-		16,
-	)
-	require.True(t, ok)
-	expectedQuotient2, ok := new(big.Int).SetString(
-		"1000000000000000000000000000000014def9dea2f79cd65812631a5cf5d3eb",
-		16,
-	)
-	require.True(t, ok)
-
-	assertElementZero(t, element4.Div(element3))
-	require.Equal(t, element3, element3.Div(element1))
-	require.Equal(t, expectedQuotient1, element3.Div(element2).Value)
-	require.Equal(t, expectedQuotient2, element2.Div(element3).Value)
-	require.Panics(t, func() { element3.Div(element4) })
-	assertUnequalFieldsPanic(t, element1.Div)
-}
-
-func TestIsEqualElement(t *testing.T) {
-	element1 := field25519.NewElement(oneBelowModulus)
-	element2 := field25519.NewElement(big.NewInt(23))
-	element3 := field25519.NewElement(oneBelowModulus)
-	altField := NewField(big.NewInt(23))
-	altElement1 := altField.NewElement(one)
-
-	require.False(t, element1.IsEqual(element2))
-	require.True(t, element1.IsEqual(element3))
-	require.True(t, element1.IsEqual(element1))
-	require.False(t, element1.IsEqual(altElement1))
-}
-
-func TestBigIntElement(t *testing.T) {
-	element := field25519.NewElement(oneBelowModulus)
-
-	require.Equal(t, oneBelowModulus, element.BigInt())
-}
-
-func TestBytesElement(t *testing.T) {
-	element := field25519.NewElement(oneBelowModulus)
-
-	require.Equal(
-		t,
-		[]byte{
-			0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
-			0x0, 0x0, 0x0, 0x0, 0x0, 0x14, 0xde, 0xf9, 0xde, 0xa2,
-			0xf7, 0x9c, 0xd6, 0x58, 0x12, 0x63, 0x1a, 0x5c, 0xf5,
-			0xd3, 0xec,
-		},
-		element.Bytes(),
-	)
-}
-
-func TestCloneElement(t *testing.T) {
-	element := field25519.NewElement(oneBelowModulus)
-	clone := element.Clone()
-
-	require.Equal(t, clone, element)
-
-	clone.Value.Add(one, one)
-
-	require.NotEqual(t, clone, element)
-}
-
-// Tests un/marshaling Element
-func TestElementMarshalJsonRoundTrip(t *testing.T) {
-	reallyBigInt1, ok := new(big.Int).SetString("12365234878725472538962348629568356835892346729834725643857832", 10)
-	require.True(t, ok)
-
-	reallyBigInt2, ok := new(big.Int).SetString("123652348787DEF9DEA2F79CD65812631A5CF5D3ED46729834725643857832", 16)
-	require.True(t, ok)
-
-	ins := []*Element{
-		newElement(field25519, big.NewInt(300)),
-		newElement(field25519, big.NewInt(300000)),
-		newElement(field25519, big.NewInt(12812798)),
-		newElement(field25519, big.NewInt(17)),
-		newElement(field25519, big.NewInt(5066680)),
-		newElement(field25519, big.NewInt(3005)),
-		newElement(field25519, big.NewInt(317)),
-		newElement(field25519, big.NewInt(323)),
-		newElement(field25519, reallyBigInt1),
-		newElement(field25519, reallyBigInt2),
-		newElement(field25519, oneBelowModulus),
-	}
-
-	// Run all the tests!
-	for _, in := range ins {
-		bytes, err := json.Marshal(in)
-		require.NoError(t, err)
-		require.NotNil(t, bytes)
-
-		// Unmarshal and test
-		out := &Element{}
-		err = json.Unmarshal(bytes, &out)
-		require.NoError(t, err)
-		require.NotNil(t, out)
-		require.NotNil(t, out.Modulus)
-		require.NotNil(t, out.Value)
-
-		require.Equal(t, in.Modulus.Bytes(), out.Modulus.Bytes())
-		require.Equal(t, in.Value.Bytes(), out.Value.Bytes())
-	}
-}

pkg/crypto/core/curves/k256_bench_test.go

@@ -1,446 +0,0 @@
-package curves
-
-import (
-	crand "crypto/rand"
-	"crypto/sha256"
-	"io"
-	"math/big"
-	"testing"
-
-	"github.com/btcsuite/btcd/btcec/v2"
-
-	mod "github.com/onsonr/sonr/pkg/crypto/core"
-	"github.com/onsonr/sonr/pkg/crypto/internal"
-)
-
-func BenchmarkK256(b *testing.B) {
-	// 1000 points
-	b.Run("1000 point add - btcec", func(b *testing.B) {
-		b.StopTimer()
-		points := make([]*BenchPoint, 1000)
-		for i := range points {
-			points[i] = points[i].Random(crand.Reader).(*BenchPoint)
-		}
-		acc := new(BenchPoint).Identity()
-		b.StartTimer()
-		for _, pt := range points {
-			acc = acc.Add(pt)
-		}
-	})
-	b.Run("1000 point add - ct k256", func(b *testing.B) {
-		b.StopTimer()
-		curve := K256()
-		points := make([]*PointK256, 1000)
-		for i := range points {
-			points[i] = curve.NewIdentityPoint().Random(crand.Reader).(*PointK256)
-		}
-		acc := curve.NewIdentityPoint()
-		b.StartTimer()
-		for _, pt := range points {
-			acc = acc.Add(pt)
-		}
-	})
-	b.Run("1000 point double - btcec", func(b *testing.B) {
-		b.StopTimer()
-		acc := new(BenchPoint).Generator()
-		b.StartTimer()
-		for i := 0; i < 1000; i++ {
-			acc = acc.Double()
-		}
-	})
-	b.Run("1000 point double - ct k256", func(b *testing.B) {
-		b.StopTimer()
-		acc := new(PointK256).Generator()
-		b.StartTimer()
-		for i := 0; i < 1000; i++ {
-			acc = acc.Double()
-		}
-	})
-	b.Run("1000 point multiply - btcec", func(b *testing.B) {
-		b.StopTimer()
-		scalars := make([]*BenchScalar, 1000)
-		for i := range scalars {
-			s := new(BenchScalar).Random(crand.Reader)
-			scalars[i] = s.(*BenchScalar)
-		}
-		acc := new(BenchPoint).Generator().Mul(new(BenchScalar).New(2))
-		b.StartTimer()
-		for _, sc := range scalars {
-			acc = acc.Mul(sc)
-		}
-	})
-	b.Run("1000 point multiply - ct k256", func(b *testing.B) {
-		b.StopTimer()
-		scalars := make([]*ScalarK256, 1000)
-		for i := range scalars {
-			s := new(ScalarK256).Random(crand.Reader)
-			scalars[i] = s.(*ScalarK256)
-		}
-		acc := new(PointK256).Generator()
-		b.StartTimer()
-		for _, sc := range scalars {
-			acc = acc.Mul(sc)
-		}
-	})
-	b.Run("1000 scalar invert - btcec", func(b *testing.B) {
-		b.StopTimer()
-		scalars := make([]*BenchScalar, 1000)
-		for i := range scalars {
-			s := new(BenchScalar).Random(crand.Reader)
-			scalars[i] = s.(*BenchScalar)
-		}
-		b.StartTimer()
-		for _, sc := range scalars {
-			_, _ = sc.Invert()
-		}
-	})
-	b.Run("1000 scalar invert - ct k256", func(b *testing.B) {
-		b.StopTimer()
-		scalars := make([]*ScalarK256, 1000)
-		for i := range scalars {
-			s := new(ScalarK256).Random(crand.Reader)
-			scalars[i] = s.(*ScalarK256)
-		}
-		b.StartTimer()
-		for _, sc := range scalars {
-			_, _ = sc.Invert()
-		}
-	})
-	b.Run("1000 scalar sqrt - btcec", func(b *testing.B) {
-		b.StopTimer()
-		scalars := make([]*BenchScalar, 1000)
-		for i := range scalars {
-			s := new(BenchScalar).Random(crand.Reader)
-			scalars[i] = s.(*BenchScalar)
-		}
-		b.StartTimer()
-		for _, sc := range scalars {
-			_, _ = sc.Sqrt()
-		}
-	})
-	b.Run("1000 scalar sqrt - ct k256", func(b *testing.B) {
-		b.StopTimer()
-		scalars := make([]*ScalarK256, 1000)
-		for i := range scalars {
-			s := new(ScalarK256).Random(crand.Reader)
-			scalars[i] = s.(*ScalarK256)
-		}
-		b.StartTimer()
-		for _, sc := range scalars {
-			_, _ = sc.Sqrt()
-		}
-	})
-}
-
-type BenchScalar struct {
-	value *big.Int
-}
-
-func (s *BenchScalar) Random(reader io.Reader) Scalar {
-	var v [32]byte
-	_, _ = reader.Read(v[:])
-	value := new(big.Int).SetBytes(v[:])
-	return &BenchScalar{
-		value: value.Mod(value, btcec.S256().N),
-	}
-}
-
-func (s *BenchScalar) Hash(bytes []byte) Scalar {
-	h := sha256.Sum256(bytes)
-	value := new(big.Int).SetBytes(h[:])
-	return &BenchScalar{
-		value: value.Mod(value, btcec.S256().N),
-	}
-}
-
-func (s *BenchScalar) Zero() Scalar {
-	return &BenchScalar{
-		value: big.NewInt(0),
-	}
-}
-
-func (s *BenchScalar) One() Scalar {
-	return &BenchScalar{
-		value: big.NewInt(1),
-	}
-}
-
-func (s *BenchScalar) IsZero() bool {
-	return s.value.Cmp(big.NewInt(0)) == 0
-}
-
-func (s *BenchScalar) IsOne() bool {
-	return s.value.Cmp(big.NewInt(1)) == 0
-}
-
-func (s *BenchScalar) IsOdd() bool {
-	return s.value.Bit(0) == 1
-}
-
-func (s *BenchScalar) IsEven() bool {
-	return s.value.Bit(0) == 0
-}
-
-func (s *BenchScalar) New(value int) Scalar {
-	v := big.NewInt(int64(value))
-	return &BenchScalar{
-		value: v.Mod(v, btcec.S256().N),
-	}
-}
-
-func (s *BenchScalar) Cmp(rhs Scalar) int {
-	r := rhs.(*BenchScalar)
-	return s.value.Cmp(r.value)
-}
-
-func (s *BenchScalar) Square() Scalar {
-	v := new(big.Int).Mul(s.value, s.value)
-	return &BenchScalar{
-		value: v.Mod(v, btcec.S256().N),
-	}
-}
-
-func (s *BenchScalar) Double() Scalar {
-	v := new(big.Int).Add(s.value, s.value)
-	return &BenchScalar{
-		value: v.Mod(v, btcec.S256().N),
-	}
-}
-
-func (s *BenchScalar) Invert() (Scalar, error) {
-	return &BenchScalar{
-		value: new(big.Int).ModInverse(s.value, btcec.S256().N),
-	}, nil
-}
-
-func (s *BenchScalar) Sqrt() (Scalar, error) {
-	return &BenchScalar{
-		value: new(big.Int).ModSqrt(s.value, btcec.S256().N),
-	}, nil
-}
-
-func (s *BenchScalar) Cube() Scalar {
-	v := new(big.Int).Mul(s.value, s.value)
-	v.Mul(v, s.value)
-	return &BenchScalar{
-		value: v.Mod(v, btcec.S256().N),
-	}
-}
-
-func (s *BenchScalar) Add(rhs Scalar) Scalar {
-	r := rhs.(*BenchScalar)
-	v := new(big.Int).Add(s.value, r.value)
-	return &BenchScalar{
-		value: v.Mod(v, btcec.S256().N),
-	}
-}
-
-func (s *BenchScalar) Sub(rhs Scalar) Scalar {
-	r := rhs.(*BenchScalar)
-	v := new(big.Int).Sub(s.value, r.value)
-	return &BenchScalar{
-		value: v.Mod(v, btcec.S256().N),
-	}
-}
-
-func (s *BenchScalar) Mul(rhs Scalar) Scalar {
-	r := rhs.(*BenchScalar)
-	v := new(big.Int).Mul(s.value, r.value)
-	return &BenchScalar{
-		value: v.Mod(v, btcec.S256().N),
-	}
-}
-
-func (s *BenchScalar) MulAdd(y, z Scalar) Scalar {
-	yy := y.(*BenchScalar)
-	zz := z.(*BenchScalar)
-	v := new(big.Int).Mul(s.value, yy.value)
-	v.Add(v, zz.value)
-	return &BenchScalar{
-		value: v.Mod(v, btcec.S256().N),
-	}
-}
-
-func (s *BenchScalar) Div(rhs Scalar) Scalar {
-	r := rhs.(*BenchScalar)
-	v := new(big.Int).ModInverse(r.value, btcec.S256().N)
-	v.Mul(v, s.value)
-	return &BenchScalar{
-		value: v.Mod(v, btcec.S256().N),
-	}
-}
-
-func (s *BenchScalar) Neg() Scalar {
-	v, _ := mod.Neg(s.value, btcec.S256().N)
-	return &BenchScalar{
-		value: v,
-	}
-}
-
-func (s *BenchScalar) SetBigInt(v *big.Int) (Scalar, error) {
-	return &BenchScalar{
-		value: new(big.Int).Set(v),
-	}, nil
-}
-
-func (s *BenchScalar) BigInt() *big.Int {
-	return new(big.Int).Set(s.value)
-}
-
-func (s *BenchScalar) Point() Point {
-	return (&BenchPoint{}).Identity()
-}
-
-func (s *BenchScalar) Bytes() []byte {
-	return internal.ReverseScalarBytes(s.value.Bytes())
-}
-
-func (s *BenchScalar) SetBytes(bytes []byte) (Scalar, error) {
-	value := new(big.Int).SetBytes(internal.ReverseScalarBytes(bytes))
-	value.Mod(value, btcec.S256().N)
-	return &BenchScalar{
-		value,
-	}, nil
-}
-
-func (s *BenchScalar) SetBytesWide(bytes []byte) (Scalar, error) {
-	value := new(big.Int).SetBytes(internal.ReverseScalarBytes(bytes))
-	value.Mod(value, btcec.S256().N)
-	return &BenchScalar{
-		value,
-	}, nil
-}
-
-func (s *BenchScalar) Clone() Scalar {
-	return &BenchScalar{
-		value: new(big.Int).Set(s.value),
-	}
-}
-
-type BenchPoint struct {
-	x, y *big.Int
-}
-
-func (p *BenchPoint) Random(reader io.Reader) Point {
-	var k [32]byte
-	curve := btcec.S256()
-	_, _ = reader.Read(k[:])
-	x, y := curve.ScalarBaseMult(k[:])
-	for !curve.IsOnCurve(x, y) {
-		_, _ = reader.Read(k[:])
-		x, y = curve.ScalarBaseMult(k[:])
-	}
-	return &BenchPoint{x, y}
-}
-
-func (p *BenchPoint) Hash(bytes []byte) Point {
-	return nil
-}
-
-func (p *BenchPoint) Identity() Point {
-	return &BenchPoint{x: big.NewInt(0), y: big.NewInt(0)}
-}
-
-func (p *BenchPoint) Generator() Point {
-	return &BenchPoint{
-		x: new(big.Int).Set(btcec.S256().Gx),
-		y: new(big.Int).Set(btcec.S256().Gy),
-	}
-}
-
-func (p *BenchPoint) IsIdentity() bool {
-	return false
-}
-
-func (p *BenchPoint) IsNegative() bool {
-	return false
-}
-
-func (p *BenchPoint) IsOnCurve() bool {
-	return btcec.S256().IsOnCurve(p.x, p.y)
-}
-
-func (p *BenchPoint) Double() Point {
-	x, y := btcec.S256().Double(p.x, p.y)
-	return &BenchPoint{
-		x, y,
-	}
-}
-
-func (p *BenchPoint) Scalar() Scalar {
-	return &BenchScalar{value: big.NewInt(0)}
-}
-
-func (p *BenchPoint) Neg() Point {
-	y, _ := mod.Neg(p.y, btcec.S256().P)
-	return &BenchPoint{
-		x: new(big.Int).Set(p.x), y: y,
-	}
-}
-
-func (p *BenchPoint) Add(rhs Point) Point {
-	r := rhs.(*BenchPoint)
-	x, y := btcec.S256().Add(p.x, p.y, r.x, r.y)
-	return &BenchPoint{
-		x, y,
-	}
-}
-
-func (p *BenchPoint) Sub(rhs Point) Point {
-	t := rhs.Neg().(*BenchPoint)
-	return t.Add(p)
-}
-
-func (p *BenchPoint) Mul(rhs Scalar) Point {
-	k := rhs.Bytes()
-	x, y := btcec.S256().ScalarMult(p.x, p.y, k)
-	return &BenchPoint{
-		x, y,
-	}
-}
-
-func (p *BenchPoint) Equal(rhs Point) bool {
-	r := rhs.(*BenchPoint)
-	return p.x.Cmp(r.x) == 0 && p.y.Cmp(r.y) == 0
-}
-
-func (p *BenchPoint) Set(x, y *big.Int) (Point, error) {
-	return &BenchPoint{
-		x, y,
-	}, nil
-}
-
-func (p *BenchPoint) ToAffineCompressed() []byte {
-	return nil
-}
-
-func (p *BenchPoint) ToAffineUncompressed() []byte {
-	return nil
-}
-
-func (p *BenchPoint) FromAffineCompressed(bytes []byte) (Point, error) {
-	return nil, nil
-}
-
-func (p *BenchPoint) FromAffineUncompressed(bytes []byte) (Point, error) {
-	return nil, nil
-}
-
-func (p *BenchPoint) CurveName() string {
-	return btcec.S256().Name
-}
-
-func (p *BenchPoint) SumOfProducts(points []Point, scalars []Scalar) Point {
-	biScalars := make([]*big.Int, len(scalars))
-	for i := 0; i < len(scalars); i++ {
-		biScalars[i] = scalars[i].BigInt()
-	}
-	return sumOfProductsPippenger(points, biScalars)
-}
-
-//func rhsK256(x *big.Int) *big.Int {
-//	// y^2 = x^3 + B
-//	x3, _ := mod.Exp(x, big.NewInt(3), btcec.S256().P)
-//	x3.Add(x3, btcec.S256().B)
-//	return x3.ModSqrt(x3, btcec.S256().P)
-//}

pkg/crypto/core/curves/k256_curve.go

@@ -1,670 +0,0 @@
-//
-// Copyright Coinbase, Inc. All Rights Reserved.
-//
-// SPDX-License-Identifier: Apache-2.0
-//
-
-package curves
-
-import (
-	"crypto/elliptic"
-	"fmt"
-	"io"
-	"math/big"
-	"sync"
-
-	"github.com/btcsuite/btcd/btcec/v2"
-
-	"github.com/onsonr/sonr/pkg/crypto/core/curves/native"
-	secp256k1 "github.com/onsonr/sonr/pkg/crypto/core/curves/native/k256"
-	"github.com/onsonr/sonr/pkg/crypto/core/curves/native/k256/fp"
-	"github.com/onsonr/sonr/pkg/crypto/core/curves/native/k256/fq"
-	"github.com/onsonr/sonr/pkg/crypto/internal"
-)
-
-var (
-	oldK256Initonce sync.Once
-	oldK256         Koblitz256
-)
-
-type Koblitz256 struct {
-	*elliptic.CurveParams
-}
-
-func oldK256InitAll() {
-	curve := btcec.S256()
-	oldK256.CurveParams = new(elliptic.CurveParams)
-	oldK256.P = curve.P
-	oldK256.N = curve.N
-	oldK256.Gx = curve.Gx
-	oldK256.Gy = curve.Gy
-	oldK256.B = curve.B
-	oldK256.BitSize = curve.BitSize
-	oldK256.Name = K256Name
-}
-
-func K256Curve() *Koblitz256 {
-	oldK256Initonce.Do(oldK256InitAll)
-	return &oldK256
-}
-
-func (curve *Koblitz256) Params() *elliptic.CurveParams {
-	return curve.CurveParams
-}
-
-func (curve *Koblitz256) IsOnCurve(x, y *big.Int) bool {
-	_, err := secp256k1.K256PointNew().SetBigInt(x, y)
-	return err == nil
-}
-
-func (curve *Koblitz256) Add(x1, y1, x2, y2 *big.Int) (*big.Int, *big.Int) {
-	p1, err := secp256k1.K256PointNew().SetBigInt(x1, y1)
-	if err != nil {
-		return nil, nil
-	}
-	p2, err := secp256k1.K256PointNew().SetBigInt(x2, y2)
-	if err != nil {
-		return nil, nil
-	}
-	return p1.Add(p1, p2).BigInt()
-}
-
-func (curve *Koblitz256) Double(x1, y1 *big.Int) (*big.Int, *big.Int) {
-	p1, err := secp256k1.K256PointNew().SetBigInt(x1, y1)
-	if err != nil {
-		return nil, nil
-	}
-	return p1.Double(p1).BigInt()
-}
-
-func (curve *Koblitz256) ScalarMult(Bx, By *big.Int, k []byte) (*big.Int, *big.Int) {
-	p1, err := secp256k1.K256PointNew().SetBigInt(Bx, By)
-	if err != nil {
-		return nil, nil
-	}
-	var bytes [32]byte
-	copy(bytes[:], internal.ReverseScalarBytes(k))
-	s, err := fq.K256FqNew().SetBytes(&bytes)
-	if err != nil {
-		return nil, nil
-	}
-	return p1.Mul(p1, s).BigInt()
-}
-
-func (curve *Koblitz256) ScalarBaseMult(k []byte) (*big.Int, *big.Int) {
-	var bytes [32]byte
-	copy(bytes[:], internal.ReverseScalarBytes(k))
-	s, err := fq.K256FqNew().SetBytes(&bytes)
-	if err != nil {
-		return nil, nil
-	}
-	p1 := secp256k1.K256PointNew().Generator()
-	return p1.Mul(p1, s).BigInt()
-}
-
-type ScalarK256 struct {
-	value *native.Field
-}
-
-type PointK256 struct {
-	value *native.EllipticPoint
-}
-
-func (s *ScalarK256) Random(reader io.Reader) Scalar {
-	if reader == nil {
-		return nil
-	}
-	var seed [64]byte
-	_, _ = reader.Read(seed[:])
-	return s.Hash(seed[:])
-}
-
-func (s *ScalarK256) Hash(bytes []byte) Scalar {
-	dst := []byte("secp256k1_XMD:SHA-256_SSWU_RO_")
-	xmd := native.ExpandMsgXmd(native.EllipticPointHasherSha256(), bytes, dst, 48)
-	var t [64]byte
-	copy(t[:48], internal.ReverseScalarBytes(xmd))
-
-	return &ScalarK256{
-		value: fq.K256FqNew().SetBytesWide(&t),
-	}
-}
-
-func (s *ScalarK256) Zero() Scalar {
-	return &ScalarK256{
-		value: fq.K256FqNew().SetZero(),
-	}
-}
-
-func (s *ScalarK256) One() Scalar {
-	return &ScalarK256{
-		value: fq.K256FqNew().SetOne(),
-	}
-}
-
-func (s *ScalarK256) IsZero() bool {
-	return s.value.IsZero() == 1
-}
-
-func (s *ScalarK256) IsOne() bool {
-	return s.value.IsOne() == 1
-}
-
-func (s *ScalarK256) IsOdd() bool {
-	return s.value.Bytes()[0]&1 == 1
-}
-
-func (s *ScalarK256) IsEven() bool {
-	return s.value.Bytes()[0]&1 == 0
-}
-
-func (s *ScalarK256) New(value int) Scalar {
-	t := fq.K256FqNew()
-	v := big.NewInt(int64(value))
-	if value < 0 {
-		v.Mod(v, t.Params.BiModulus)
-	}
-	return &ScalarK256{
-		value: t.SetBigInt(v),
-	}
-}
-
-func (s *ScalarK256) Cmp(rhs Scalar) int {
-	r, ok := rhs.(*ScalarK256)
-	if ok {
-		return s.value.Cmp(r.value)
-	} else {
-		return -2
-	}
-}
-
-func (s *ScalarK256) Square() Scalar {
-	return &ScalarK256{
-		value: fq.K256FqNew().Square(s.value),
-	}
-}
-
-func (s *ScalarK256) Double() Scalar {
-	return &ScalarK256{
-		value: fq.K256FqNew().Double(s.value),
-	}
-}
-
-func (s *ScalarK256) Invert() (Scalar, error) {
-	value, wasInverted := fq.K256FqNew().Invert(s.value)
-	if !wasInverted {
-		return nil, fmt.Errorf("inverse doesn't exist")
-	}
-	return &ScalarK256{
-		value,
-	}, nil
-}
-
-func (s *ScalarK256) Sqrt() (Scalar, error) {
-	value, wasSquare := fq.K256FqNew().Sqrt(s.value)
-	if !wasSquare {
-		return nil, fmt.Errorf("not a square")
-	}
-	return &ScalarK256{
-		value,
-	}, nil
-}
-
-func (s *ScalarK256) Cube() Scalar {
-	value := fq.K256FqNew().Mul(s.value, s.value)
-	value.Mul(value, s.value)
-	return &ScalarK256{
-		value,
-	}
-}
-
-func (s *ScalarK256) Add(rhs Scalar) Scalar {
-	r, ok := rhs.(*ScalarK256)
-	if ok {
-		return &ScalarK256{
-			value: fq.K256FqNew().Add(s.value, r.value),
-		}
-	} else {
-		return nil
-	}
-}
-
-func (s *ScalarK256) Sub(rhs Scalar) Scalar {
-	r, ok := rhs.(*ScalarK256)
-	if ok {
-		return &ScalarK256{
-			value: fq.K256FqNew().Sub(s.value, r.value),
-		}
-	} else {
-		return nil
-	}
-}
-
-func (s *ScalarK256) Mul(rhs Scalar) Scalar {
-	r, ok := rhs.(*ScalarK256)
-	if ok {
-		return &ScalarK256{
-			value: fq.K256FqNew().Mul(s.value, r.value),
-		}
-	} else {
-		return nil
-	}
-}
-
-func (s *ScalarK256) MulAdd(y, z Scalar) Scalar {
-	return s.Mul(y).Add(z)
-}
-
-func (s *ScalarK256) Div(rhs Scalar) Scalar {
-	r, ok := rhs.(*ScalarK256)
-	if ok {
-		v, wasInverted := fq.K256FqNew().Invert(r.value)
-		if !wasInverted {
-			return nil
-		}
-		v.Mul(v, s.value)
-		return &ScalarK256{value: v}
-	} else {
-		return nil
-	}
-}
-
-func (s *ScalarK256) Neg() Scalar {
-	return &ScalarK256{
-		value: fq.K256FqNew().Neg(s.value),
-	}
-}
-
-func (s *ScalarK256) SetBigInt(v *big.Int) (Scalar, error) {
-	if v == nil {
-		return nil, fmt.Errorf("'v' cannot be nil")
-	}
-	value := fq.K256FqNew().SetBigInt(v)
-	return &ScalarK256{
-		value,
-	}, nil
-}
-
-func (s *ScalarK256) BigInt() *big.Int {
-	return s.value.BigInt()
-}
-
-func (s *ScalarK256) Bytes() []byte {
-	t := s.value.Bytes()
-	return internal.ReverseScalarBytes(t[:])
-}
-
-func (s *ScalarK256) SetBytes(bytes []byte) (Scalar, error) {
-	if len(bytes) != 32 {
-		return nil, fmt.Errorf("invalid length")
-	}
-	var seq [32]byte
-	copy(seq[:], internal.ReverseScalarBytes(bytes))
-	value, err := fq.K256FqNew().SetBytes(&seq)
-	if err != nil {
-		return nil, err
-	}
-	return &ScalarK256{
-		value,
-	}, nil
-}
-
-func (s *ScalarK256) SetBytesWide(bytes []byte) (Scalar, error) {
-	if len(bytes) != 64 {
-		return nil, fmt.Errorf("invalid length")
-	}
-	var seq [64]byte
-	copy(seq[:], bytes)
-	return &ScalarK256{
-		value: fq.K256FqNew().SetBytesWide(&seq),
-	}, nil
-}
-
-func (s *ScalarK256) Point() Point {
-	return new(PointK256).Identity()
-}
-
-func (s *ScalarK256) Clone() Scalar {
-	return &ScalarK256{
-		value: fq.K256FqNew().Set(s.value),
-	}
-}
-
-func (s *ScalarK256) MarshalBinary() ([]byte, error) {
-	return scalarMarshalBinary(s)
-}
-
-func (s *ScalarK256) UnmarshalBinary(input []byte) error {
-	sc, err := scalarUnmarshalBinary(input)
-	if err != nil {
-		return err
-	}
-	ss, ok := sc.(*ScalarK256)
-	if !ok {
-		return fmt.Errorf("invalid scalar")
-	}
-	s.value = ss.value
-	return nil
-}
-
-func (s *ScalarK256) MarshalText() ([]byte, error) {
-	return scalarMarshalText(s)
-}
-
-func (s *ScalarK256) UnmarshalText(input []byte) error {
-	sc, err := scalarUnmarshalText(input)
-	if err != nil {
-		return err
-	}
-	ss, ok := sc.(*ScalarK256)
-	if !ok {
-		return fmt.Errorf("invalid scalar")
-	}
-	s.value = ss.value
-	return nil
-}
-
-func (s *ScalarK256) MarshalJSON() ([]byte, error) {
-	return scalarMarshalJson(s)
-}
-
-func (s *ScalarK256) UnmarshalJSON(input []byte) error {
-	sc, err := scalarUnmarshalJson(input)
-	if err != nil {
-		return err
-	}
-	S, ok := sc.(*ScalarK256)
-	if !ok {
-		return fmt.Errorf("invalid type")
-	}
-	s.value = S.value
-	return nil
-}
-
-func (p *PointK256) Random(reader io.Reader) Point {
-	var seed [64]byte
-	_, _ = reader.Read(seed[:])
-	return p.Hash(seed[:])
-}
-
-func (p *PointK256) Hash(bytes []byte) Point {
-	value, err := secp256k1.K256PointNew().Hash(bytes, native.EllipticPointHasherSha256())
-	// TODO: change hash to return an error also
-	if err != nil {
-		return nil
-	}
-
-	return &PointK256{value}
-}
-
-func (p *PointK256) Identity() Point {
-	return &PointK256{
-		value: secp256k1.K256PointNew().Identity(),
-	}
-}
-
-func (p *PointK256) Generator() Point {
-	return &PointK256{
-		value: secp256k1.K256PointNew().Generator(),
-	}
-}
-
-func (p *PointK256) IsIdentity() bool {
-	return p.value.IsIdentity()
-}
-
-func (p *PointK256) IsNegative() bool {
-	return p.value.GetY().Value[0]&1 == 1
-}
-
-func (p *PointK256) IsOnCurve() bool {
-	return p.value.IsOnCurve()
-}
-
-func (p *PointK256) Double() Point {
-	value := secp256k1.K256PointNew().Double(p.value)
-	return &PointK256{value}
-}
-
-func (p *PointK256) Scalar() Scalar {
-	return new(ScalarK256).Zero()
-}
-
-func (p *PointK256) Neg() Point {
-	value := secp256k1.K256PointNew().Neg(p.value)
-	return &PointK256{value}
-}
-
-func (p *PointK256) Add(rhs Point) Point {
-	if rhs == nil {
-		return nil
-	}
-	r, ok := rhs.(*PointK256)
-	if ok {
-		value := secp256k1.K256PointNew().Add(p.value, r.value)
-		return &PointK256{value}
-	} else {
-		return nil
-	}
-}
-
-func (p *PointK256) Sub(rhs Point) Point {
-	if rhs == nil {
-		return nil
-	}
-	r, ok := rhs.(*PointK256)
-	if ok {
-		value := secp256k1.K256PointNew().Sub(p.value, r.value)
-		return &PointK256{value}
-	} else {
-		return nil
-	}
-}
-
-func (p *PointK256) Mul(rhs Scalar) Point {
-	if rhs == nil {
-		return nil
-	}
-	r, ok := rhs.(*ScalarK256)
-	if ok {
-		value := secp256k1.K256PointNew().Mul(p.value, r.value)
-		return &PointK256{value}
-	} else {
-		return nil
-	}
-}
-
-func (p *PointK256) Equal(rhs Point) bool {
-	r, ok := rhs.(*PointK256)
-	if ok {
-		return p.value.Equal(r.value) == 1
-	} else {
-		return false
-	}
-}
-
-func (p *PointK256) Set(x, y *big.Int) (Point, error) {
-	value, err := secp256k1.K256PointNew().SetBigInt(x, y)
-	if err != nil {
-		return nil, err
-	}
-	return &PointK256{value}, nil
-}
-
-func (p *PointK256) ToAffineCompressed() []byte {
-	var x [33]byte
-	x[0] = byte(2)
-
-	t := secp256k1.K256PointNew().ToAffine(p.value)
-
-	x[0] |= t.Y.Bytes()[0] & 1
-
-	xBytes := t.X.Bytes()
-	copy(x[1:], internal.ReverseScalarBytes(xBytes[:]))
-	return x[:]
-}
-
-func (p *PointK256) ToAffineUncompressed() []byte {
-	var out [65]byte
-	out[0] = byte(4)
-	t := secp256k1.K256PointNew().ToAffine(p.value)
-	arr := t.X.Bytes()
-	copy(out[1:33], internal.ReverseScalarBytes(arr[:]))
-	arr = t.Y.Bytes()
-	copy(out[33:], internal.ReverseScalarBytes(arr[:]))
-	return out[:]
-}
-
-func (p *PointK256) FromAffineCompressed(bytes []byte) (Point, error) {
-	var raw [native.FieldBytes]byte
-	if len(bytes) != 33 {
-		return nil, fmt.Errorf("invalid byte sequence")
-	}
-	sign := int(bytes[0])
-	if sign != 2 && sign != 3 {
-		return nil, fmt.Errorf("invalid sign byte")
-	}
-	sign &= 0x1
-
-	copy(raw[:], internal.ReverseScalarBytes(bytes[1:]))
-	x, err := fp.K256FpNew().SetBytes(&raw)
-	if err != nil {
-		return nil, err
-	}
-
-	value := secp256k1.K256PointNew().Identity()
-	rhs := fp.K256FpNew()
-	p.value.Arithmetic.RhsEq(rhs, x)
-	// test that rhs is quadratic residue
-	// if not, then this Point is at infinity
-	y, wasQr := fp.K256FpNew().Sqrt(rhs)
-	if wasQr {
-		// fix the sign
-		sigY := int(y.Bytes()[0] & 1)
-		if sigY != sign {
-			y.Neg(y)
-		}
-		value.X = x
-		value.Y = y
-		value.Z.SetOne()
-	}
-	return &PointK256{value}, nil
-}
-
-func (p *PointK256) FromAffineUncompressed(bytes []byte) (Point, error) {
-	var arr [native.FieldBytes]byte
-	if len(bytes) != 65 {
-		return nil, fmt.Errorf("invalid byte sequence")
-	}
-	if bytes[0] != 4 {
-		return nil, fmt.Errorf("invalid sign byte")
-	}
-
-	copy(arr[:], internal.ReverseScalarBytes(bytes[1:33]))
-	x, err := fp.K256FpNew().SetBytes(&arr)
-	if err != nil {
-		return nil, err
-	}
-	copy(arr[:], internal.ReverseScalarBytes(bytes[33:]))
-	y, err := fp.K256FpNew().SetBytes(&arr)
-	if err != nil {
-		return nil, err
-	}
-	value := secp256k1.K256PointNew()
-	value.X = x
-	value.Y = y
-	value.Z.SetOne()
-	return &PointK256{value}, nil
-}
-
-func (p *PointK256) CurveName() string {
-	return p.value.Params.Name
-}
-
-func (p *PointK256) SumOfProducts(points []Point, scalars []Scalar) Point {
-	nPoints := make([]*native.EllipticPoint, len(points))
-	nScalars := make([]*native.Field, len(scalars))
-	for i, pt := range points {
-		ptv, ok := pt.(*PointK256)
-		if !ok {
-			return nil
-		}
-		nPoints[i] = ptv.value
-	}
-	for i, sc := range scalars {
-		s, ok := sc.(*ScalarK256)
-		if !ok {
-			return nil
-		}
-		nScalars[i] = s.value
-	}
-	value := secp256k1.K256PointNew()
-	_, err := value.SumOfProducts(nPoints, nScalars)
-	if err != nil {
-		return nil
-	}
-	return &PointK256{value}
-}
-
-func (p *PointK256) X() *native.Field {
-	return p.value.GetX()
-}
-
-func (p *PointK256) Y() *native.Field {
-	return p.value.GetY()
-}
-
-func (p *PointK256) Params() *elliptic.CurveParams {
-	return K256Curve().Params()
-}
-
-func (p *PointK256) MarshalBinary() ([]byte, error) {
-	return pointMarshalBinary(p)
-}
-
-func (p *PointK256) UnmarshalBinary(input []byte) error {
-	pt, err := pointUnmarshalBinary(input)
-	if err != nil {
-		return err
-	}
-	ppt, ok := pt.(*PointK256)
-	if !ok {
-		return fmt.Errorf("invalid point")
-	}
-	p.value = ppt.value
-	return nil
-}
-
-func (p *PointK256) MarshalText() ([]byte, error) {
-	return pointMarshalText(p)
-}
-
-func (p *PointK256) UnmarshalText(input []byte) error {
-	pt, err := pointUnmarshalText(input)
-	if err != nil {
-		return err
-	}
-	ppt, ok := pt.(*PointK256)
-	if !ok {
-		return fmt.Errorf("invalid point")
-	}
-	p.value = ppt.value
-	return nil
-}
-
-func (p *PointK256) MarshalJSON() ([]byte, error) {
-	return pointMarshalJson(p)
-}
-
-func (p *PointK256) UnmarshalJSON(input []byte) error {
-	pt, err := pointUnmarshalJson(input)
-	if err != nil {
-		return err
-	}
-	P, ok := pt.(*PointK256)
-	if !ok {
-		return fmt.Errorf("invalid type")
-	}
-	p.value = P.value
-	return nil
-}

pkg/crypto/core/curves/k256_curve_test.go

@@ -1,423 +0,0 @@
-//
-// Copyright Coinbase, Inc. All Rights Reserved.
-//
-// SPDX-License-Identifier: Apache-2.0
-//
-
-package curves
-
-import (
-	crand "crypto/rand"
-	"math/big"
-	"sync"
-	"testing"
-
-	"github.com/btcsuite/btcd/btcec/v2"
-	"github.com/stretchr/testify/require"
-)
-
-type mockReader struct {
-	index int
-	seed  []byte
-}
-
-var (
-	mockRngInitonce sync.Once
-	mockRng         mockReader
-)
-
-func newMockReader() {
-	mockRng.index = 0
-	mockRng.seed = make([]byte, 32)
-	for i := range mockRng.seed {
-		mockRng.seed[i] = 1
-	}
-}
-
-func testRng() *mockReader {
-	mockRngInitonce.Do(newMockReader)
-	return &mockRng
-}
-
-func (m *mockReader) Read(p []byte) (n int, err error) {
-	limit := len(m.seed)
-	for i := range p {
-		p[i] = m.seed[m.index]
-		m.index += 1
-		m.index %= limit
-	}
-	n = len(p)
-	err = nil
-	return
-}
-
-func TestScalarK256Random(t *testing.T) {
-	curve := K256()
-	sc := curve.Scalar.Random(testRng())
-	s, ok := sc.(*ScalarK256)
-	require.True(t, ok)
-	expected, _ := new(big.Int).SetString("2f71aaec5e14d747c72e46cdcaffffe6f542f38b3f0925469ceb24ac1c65885d", 16)
-	require.Equal(t, s.value.BigInt(), expected)
-	// Try 10 random values
-	for i := 0; i < 10; i++ {
-		sc := curve.Scalar.Random(crand.Reader)
-		_, ok := sc.(*ScalarK256)
-		require.True(t, ok)
-		require.True(t, !sc.IsZero())
-	}
-}
-
-func TestScalarK256Hash(t *testing.T) {
-	var b [32]byte
-	k256 := K256()
-	sc := k256.Scalar.Hash(b[:])
-	s, ok := sc.(*ScalarK256)
-	require.True(t, ok)
-	expected, _ := new(big.Int).SetString("e5cb3500b809a8202de0834a805068bc21bde09bd6367815e7523a37adf8f52e", 16)
-	require.Equal(t, s.value.BigInt(), expected)
-}
-
-func TestScalarK256Zero(t *testing.T) {
-	k256 := K256()
-	sc := k256.Scalar.Zero()
-	require.True(t, sc.IsZero())
-	require.True(t, sc.IsEven())
-}
-
-func TestScalarK256One(t *testing.T) {
-	k256 := K256()
-	sc := k256.Scalar.One()
-	require.True(t, sc.IsOne())
-	require.True(t, sc.IsOdd())
-}
-
-func TestScalarK256New(t *testing.T) {
-	k256 := K256()
-	three := k256.Scalar.New(3)
-	require.True(t, three.IsOdd())
-	four := k256.Scalar.New(4)
-	require.True(t, four.IsEven())
-	neg1 := k256.Scalar.New(-1)
-	require.True(t, neg1.IsEven())
-	neg2 := k256.Scalar.New(-2)
-	require.True(t, neg2.IsOdd())
-}
-
-func TestScalarK256Square(t *testing.T) {
-	k256 := K256()
-	three := k256.Scalar.New(3)
-	nine := k256.Scalar.New(9)
-	require.Equal(t, three.Square().Cmp(nine), 0)
-}
-
-func TestScalarK256Cube(t *testing.T) {
-	k256 := K256()
-	three := k256.Scalar.New(3)
-	twentySeven := k256.Scalar.New(27)
-	require.Equal(t, three.Cube().Cmp(twentySeven), 0)
-}
-
-func TestScalarK256Double(t *testing.T) {
-	k256 := K256()
-	three := k256.Scalar.New(3)
-	six := k256.Scalar.New(6)
-	require.Equal(t, three.Double().Cmp(six), 0)
-}
-
-func TestScalarK256Neg(t *testing.T) {
-	k256 := K256()
-	one := k256.Scalar.One()
-	neg1 := k256.Scalar.New(-1)
-	require.Equal(t, one.Neg().Cmp(neg1), 0)
-	lotsOfThrees := k256.Scalar.New(333333)
-	expected := k256.Scalar.New(-333333)
-	require.Equal(t, lotsOfThrees.Neg().Cmp(expected), 0)
-}
-
-func TestScalarK256Invert(t *testing.T) {
-	k256 := K256()
-	nine := k256.Scalar.New(9)
-	actual, _ := nine.Invert()
-	sa, _ := actual.(*ScalarK256)
-	bn, _ := new(big.Int).SetString("8e38e38e38e38e38e38e38e38e38e38d842841d57dd303af6a9150f8e5737996", 16)
-	expected, err := k256.Scalar.SetBigInt(bn)
-	require.NoError(t, err)
-	require.Equal(t, sa.Cmp(expected), 0)
-}
-
-func TestScalarK256Sqrt(t *testing.T) {
-	k256 := K256()
-	nine := k256.Scalar.New(9)
-	actual, err := nine.Sqrt()
-	sa, _ := actual.(*ScalarK256)
-	expected := k256.Scalar.New(3)
-	require.NoError(t, err)
-	require.Equal(t, sa.Cmp(expected), 0)
-}
-
-func TestScalarK256Add(t *testing.T) {
-	k256 := K256()
-	nine := k256.Scalar.New(9)
-	six := k256.Scalar.New(6)
-	fifteen := nine.Add(six)
-	require.NotNil(t, fifteen)
-	expected := k256.Scalar.New(15)
-	require.Equal(t, expected.Cmp(fifteen), 0)
-	n := new(big.Int).Set(btcec.S256().N)
-	n.Sub(n, big.NewInt(3))
-
-	upper, err := k256.Scalar.SetBigInt(n)
-	require.NoError(t, err)
-	actual := upper.Add(nine)
-	require.NotNil(t, actual)
-	require.Equal(t, actual.Cmp(six), 0)
-}
-
-func TestScalarK256Sub(t *testing.T) {
-	k256 := K256()
-	nine := k256.Scalar.New(9)
-	six := k256.Scalar.New(6)
-	n := new(big.Int).Set(btcec.S256().N)
-	n.Sub(n, big.NewInt(3))
-
-	expected, err := k256.Scalar.SetBigInt(n)
-	require.NoError(t, err)
-	actual := six.Sub(nine)
-	require.Equal(t, expected.Cmp(actual), 0)
-
-	actual = nine.Sub(six)
-	require.Equal(t, actual.Cmp(k256.Scalar.New(3)), 0)
-}
-
-func TestScalarK256Mul(t *testing.T) {
-	k256 := K256()
-	nine := k256.Scalar.New(9)
-	six := k256.Scalar.New(6)
-	actual := nine.Mul(six)
-	require.Equal(t, actual.Cmp(k256.Scalar.New(54)), 0)
-	n := new(big.Int).Set(btcec.S256().N)
-	n.Sub(n, big.NewInt(1))
-	upper, err := k256.Scalar.SetBigInt(n)
-	require.NoError(t, err)
-	require.Equal(t, upper.Mul(upper).Cmp(k256.Scalar.New(1)), 0)
-}
-
-func TestScalarK256Div(t *testing.T) {
-	k256 := K256()
-	nine := k256.Scalar.New(9)
-	actual := nine.Div(nine)
-	require.Equal(t, actual.Cmp(k256.Scalar.New(1)), 0)
-	require.Equal(t, k256.Scalar.New(54).Div(nine).Cmp(k256.Scalar.New(6)), 0)
-}
-
-func TestScalarK256Serialize(t *testing.T) {
-	k256 := K256()
-	sc := k256.Scalar.New(255)
-	sequence := sc.Bytes()
-	require.Equal(t, len(sequence), 32)
-	require.Equal(t, sequence, []byte{0x00, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xff})
-	ret, err := k256.Scalar.SetBytes(sequence)
-	require.NoError(t, err)
-	require.Equal(t, ret.Cmp(sc), 0)
-
-	// Try 10 random values
-	for i := 0; i < 10; i++ {
-		sc = k256.Scalar.Random(crand.Reader)
-		sequence = sc.Bytes()
-		require.Equal(t, len(sequence), 32)
-		ret, err = k256.Scalar.SetBytes(sequence)
-		require.NoError(t, err)
-		require.Equal(t, ret.Cmp(sc), 0)
-	}
-}
-
-func TestScalarK256Nil(t *testing.T) {
-	k256 := K256()
-	one := k256.Scalar.New(1)
-	require.Nil(t, one.Add(nil))
-	require.Nil(t, one.Sub(nil))
-	require.Nil(t, one.Mul(nil))
-	require.Nil(t, one.Div(nil))
-	require.Nil(t, k256.Scalar.Random(nil))
-	require.Equal(t, one.Cmp(nil), -2)
-	_, err := k256.Scalar.SetBigInt(nil)
-	require.Error(t, err)
-}
-
-func TestPointK256Random(t *testing.T) {
-	curve := K256()
-	sc := curve.Point.Random(testRng())
-	s, ok := sc.(*PointK256)
-	require.True(t, ok)
-	expectedX, _ := new(big.Int).SetString("c6e18a1d7cf834462675b31581639a18e14fd0f73f8dfd5fe2993f88f6fbe008", 16)
-	expectedY, _ := new(big.Int).SetString("b65fab3243c5d07cef005d7fb335ebe8019efd954e95e68c86ef9b3bd7bccd36", 16)
-	require.Equal(t, s.X().BigInt(), expectedX)
-	require.Equal(t, s.Y().BigInt(), expectedY)
-	// Try 10 random values
-	for i := 0; i < 10; i++ {
-		sc := curve.Point.Random(crand.Reader)
-		_, ok := sc.(*PointK256)
-		require.True(t, ok)
-		require.True(t, !sc.IsIdentity())
-	}
-}
-
-func TestPointK256Hash(t *testing.T) {
-	var b [32]byte
-	curve := K256()
-	sc := curve.Point.Hash(b[:])
-	s, ok := sc.(*PointK256)
-	require.True(t, ok)
-	expectedX, _ := new(big.Int).SetString("95d0ad42f68ddb5a808469dd75fa866890dcc7d039844e0e2d58a6d25bd9a66b", 16)
-	expectedY, _ := new(big.Int).SetString("f37c564d05168dab4413caacdb8e3426143fc5fb24a470ccd8a51856c11d163c", 16)
-	require.Equal(t, s.X().BigInt(), expectedX)
-	require.Equal(t, s.Y().BigInt(), expectedY)
-}
-
-func TestPointK256Identity(t *testing.T) {
-	k256 := K256()
-	sc := k256.Point.Identity()
-	require.True(t, sc.IsIdentity())
-	require.Equal(t, sc.ToAffineCompressed(), []byte{2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0})
-}
-
-func TestPointK256Generator(t *testing.T) {
-	curve := K256()
-	sc := curve.Point.Generator()
-	s, ok := sc.(*PointK256)
-	require.True(t, ok)
-	require.Equal(t, s.X().BigInt().Cmp(btcec.S256().Gx), 0)
-	require.Equal(t, s.Y().BigInt().Cmp(btcec.S256().Gy), 0)
-}
-
-func TestPointK256Set(t *testing.T) {
-	k256 := K256()
-	iden, err := k256.Point.Set(big.NewInt(0), big.NewInt(0))
-	require.NoError(t, err)
-	require.True(t, iden.IsIdentity())
-	_, err = k256.Point.Set(btcec.S256().Gx, btcec.S256().Gy)
-	require.NoError(t, err)
-}
-
-func TestPointK256Double(t *testing.T) {
-	curve := K256()
-	g := curve.Point.Generator()
-	g2 := g.Double()
-	require.True(t, g2.Equal(g.Mul(curve.Scalar.New(2))))
-	i := curve.Point.Identity()
-	require.True(t, i.Double().Equal(i))
-	gg := curve.Point.Generator().Add(curve.Point.Generator())
-	require.True(t, g2.Equal(gg))
-}
-
-func TestPointK256Neg(t *testing.T) {
-	k256 := K256()
-	g := k256.Point.Generator().Neg()
-	require.True(t, g.Neg().Equal(k256.Point.Generator()))
-	require.True(t, k256.Point.Identity().Neg().Equal(k256.Point.Identity()))
-}
-
-func TestPointK256Add(t *testing.T) {
-	curve := K256()
-	pt := curve.Point.Generator().(*PointK256)
-	pt1 := pt.Add(pt).(*PointK256)
-	pt2 := pt.Double().(*PointK256)
-	pt3 := pt.Mul(curve.Scalar.New(2)).(*PointK256)
-
-	require.True(t, pt1.Equal(pt2))
-	require.True(t, pt1.Equal(pt3))
-	require.True(t, pt.Add(pt).Equal(pt.Double()))
-	require.True(t, pt.Mul(curve.Scalar.New(3)).Equal(pt.Add(pt).Add(pt)))
-}
-
-func TestPointK256Sub(t *testing.T) {
-	curve := K256()
-	g := curve.Point.Generator()
-	pt := curve.Point.Generator().Mul(curve.Scalar.New(4))
-
-	require.True(t, pt.Sub(g).Sub(g).Sub(g).Equal(g))
-	require.True(t, pt.Sub(g).Sub(g).Sub(g).Sub(g).IsIdentity())
-}
-
-func TestPointK256Mul(t *testing.T) {
-	curve := K256()
-	g := curve.Point.Generator()
-	pt := curve.Point.Generator().Mul(curve.Scalar.New(4))
-	require.True(t, g.Double().Double().Equal(pt))
-}
-
-func TestPointK256Serialize(t *testing.T) {
-	curve := K256()
-	ss := curve.Scalar.Random(testRng())
-
-	g := curve.Point.Generator()
-	ppt := g.Mul(ss).(*PointK256)
-
-	require.Equal(t, ppt.ToAffineCompressed(), []byte{0x2, 0x1b, 0xa7, 0x7e, 0x98, 0xd6, 0xd8, 0x49, 0x45, 0xa4, 0x75, 0xd8, 0x6, 0xc0, 0x94, 0x5b, 0x8c, 0xf0, 0x5b, 0x8a, 0xb2, 0x76, 0xbb, 0x9f, 0x6e, 0x52, 0x9a, 0x11, 0x9c, 0x79, 0xdd, 0xf6, 0x5a})
-	require.Equal(t, ppt.ToAffineUncompressed(), []byte{0x4, 0x1b, 0xa7, 0x7e, 0x98, 0xd6, 0xd8, 0x49, 0x45, 0xa4, 0x75, 0xd8, 0x6, 0xc0, 0x94, 0x5b, 0x8c, 0xf0, 0x5b, 0x8a, 0xb2, 0x76, 0xbb, 0x9f, 0x6e, 0x52, 0x9a, 0x11, 0x9c, 0x79, 0xdd, 0xf6, 0x5a, 0xb2, 0x96, 0x7c, 0x59, 0x4, 0xeb, 0x9a, 0xaa, 0xa9, 0x1d, 0x4d, 0xd0, 0x2d, 0xc6, 0x37, 0xee, 0x4a, 0x95, 0x51, 0x60, 0xab, 0xab, 0xf7, 0xdb, 0x30, 0x7d, 0x7d, 0x0, 0x68, 0x6c, 0xcf, 0xf6})
-	retP, err := ppt.FromAffineCompressed(ppt.ToAffineCompressed())
-	require.NoError(t, err)
-	require.True(t, ppt.Equal(retP))
-	retP, err = ppt.FromAffineUncompressed(ppt.ToAffineUncompressed())
-	require.NoError(t, err)
-	require.True(t, ppt.Equal(retP))
-
-	// smoke test
-	for i := 0; i < 25; i++ {
-		s := curve.Scalar.Random(crand.Reader)
-		pt := g.Mul(s)
-		cmprs := pt.ToAffineCompressed()
-		require.Equal(t, len(cmprs), 33)
-		retC, err := pt.FromAffineCompressed(cmprs)
-		require.NoError(t, err)
-		require.True(t, pt.Equal(retC))
-
-		un := pt.ToAffineUncompressed()
-		require.Equal(t, len(un), 65)
-		retU, err := pt.FromAffineUncompressed(un)
-		require.NoError(t, err)
-		require.True(t, pt.Equal(retU))
-	}
-}
-
-func TestPointK256Nil(t *testing.T) {
-	k256 := K256()
-	one := k256.Point.Generator()
-	require.Nil(t, one.Add(nil))
-	require.Nil(t, one.Sub(nil))
-	require.Nil(t, one.Mul(nil))
-	require.Nil(t, k256.Scalar.Random(nil))
-	require.False(t, one.Equal(nil))
-	_, err := k256.Scalar.SetBigInt(nil)
-	require.Error(t, err)
-}
-
-func TestPointK256SumOfProducts(t *testing.T) {
-	lhs := new(PointK256).Generator().Mul(new(ScalarK256).New(50))
-	points := make([]Point, 5)
-	for i := range points {
-		points[i] = new(PointK256).Generator()
-	}
-	scalars := []Scalar{
-		new(ScalarK256).New(8),
-		new(ScalarK256).New(9),
-		new(ScalarK256).New(10),
-		new(ScalarK256).New(11),
-		new(ScalarK256).New(12),
-	}
-	rhs := lhs.SumOfProducts(points, scalars)
-	require.NotNil(t, rhs)
-	require.True(t, lhs.Equal(rhs))
-
-	for j := 0; j < 25; j++ {
-		lhs = lhs.Identity()
-		for i := range points {
-			points[i] = new(PointK256).Random(crand.Reader)
-			scalars[i] = new(ScalarK256).Random(crand.Reader)
-			lhs = lhs.Add(points[i].Mul(scalars[i]))
-		}
-		rhs = lhs.SumOfProducts(points, scalars)
-		require.NotNil(t, rhs)
-		require.True(t, lhs.Equal(rhs))
-	}
-}

pkg/crypto/core/curves/native/bls12381/bls12381.go

@@ -1,48 +0,0 @@
-package bls12381
-
-import (
-	"math/bits"
-
-	"github.com/onsonr/sonr/pkg/crypto/core/curves/native"
-)
-
-var fqModulusBytes = [native.FieldBytes]byte{0x01, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, 0xfe, 0x5b, 0xfe, 0xff, 0x02, 0xa4, 0xbd, 0x53, 0x05, 0xd8, 0xa1, 0x09, 0x08, 0xd8, 0x39, 0x33, 0x48, 0x7d, 0x9d, 0x29, 0x53, 0xa7, 0xed, 0x73}
-
-const (
-	// The BLS parameter x for BLS12-381 is -0xd201000000010000
-	paramX               = uint64(0xd201000000010000)
-	Limbs                = 6
-	FieldBytes           = 48
-	WideFieldBytes       = 96
-	DoubleWideFieldBytes = 192
-)
-
-// mac Multiply and Accumulate - compute a + (b * c) + d, return the result and new carry
-func mac(a, b, c, d uint64) (uint64, uint64) {
-	hi, lo := bits.Mul64(b, c)
-	carry2, carry := bits.Add64(a, d, 0)
-	hi, _ = bits.Add64(hi, 0, carry)
-	lo, carry = bits.Add64(lo, carry2, 0)
-	hi, _ = bits.Add64(hi, 0, carry)
-
-	return lo, hi
-}
-
-// adc Add w/Carry
-func adc(x, y, carry uint64) (uint64, uint64) {
-	sum := x + y + carry
-	// The sum will overflow if both top bits are set (x & y) or if one of them
-	// is (x | y), and a carry from the lower place happened. If such a carry
-	// happens, the top bit will be 1 + 0 + 1 = 0 (&^ sum).
-	carryOut := ((x & y) | ((x | y) &^ sum)) >> 63
-	carryOut |= ((x & carry) | ((x | carry) &^ sum)) >> 63
-	carryOut |= ((y & carry) | ((y | carry) &^ sum)) >> 63
-	return sum, carryOut
-}
-
-// sbb Subtract with borrow
-func sbb(x, y, borrow uint64) (uint64, uint64) {
-	diff := x - (y + borrow)
-	borrowOut := ((^x & y) | (^(x ^ y) & diff)) >> 63
-	return diff, borrowOut
-}