bitcoinjs-lib/src/ec.js

// Basic Javascript Elliptic Curve implementation
// Ported loosely from BouncyCastle's Java EC code
// Only Fp curves implemented for now

var assert = require('assert')
var BigInteger = require('bigi')

// constants
var THREE = BigInteger.valueOf(3)

function ECFieldElementFp(q,x) {
  this.x = x
  // TODO if (x.compareTo(q) >= 0) error
  this.q = q
}

function feFpEquals(other) {
  if (other == this) return true
  return (this.q.equals(other.q) && this.x.equals(other.x))
}

function feFpToBigInteger() {
  return this.x
}

function feFpNegate() {
  return new ECFieldElementFp(this.q, this.x.negate().mod(this.q))
}

function feFpAdd(b) {
  return new ECFieldElementFp(this.q, this.x.add(b.toBigInteger()).mod(this.q))
}

function feFpSubtract(b) {
  return new ECFieldElementFp(this.q, this.x.subtract(b.toBigInteger()).mod(this.q))
}

function feFpMultiply(b) {
  return new ECFieldElementFp(this.q, this.x.multiply(b.toBigInteger()).mod(this.q))
}

function feFpSquare() {
  return new ECFieldElementFp(this.q, this.x.square().mod(this.q))
}

function feFpDivide(b) {
  return new ECFieldElementFp(this.q, this.x.multiply(b.toBigInteger().modInverse(this.q)).mod(this.q))
}

ECFieldElementFp.prototype.equals = feFpEquals
ECFieldElementFp.prototype.toBigInteger = feFpToBigInteger
ECFieldElementFp.prototype.negate = feFpNegate
ECFieldElementFp.prototype.add = feFpAdd
ECFieldElementFp.prototype.subtract = feFpSubtract
ECFieldElementFp.prototype.multiply = feFpMultiply
ECFieldElementFp.prototype.square = feFpSquare
ECFieldElementFp.prototype.divide = feFpDivide

// ----------------
// ECPointFp

// constructor
function ECPointFp(curve,x,y,z) {
  this.curve = curve
  this.x = x
  this.y = y

  // Projective coordinates: either zinv == null or z * zinv == 1
  // z and zinv are just BigIntegers, not fieldElements
  this.z = (z == undefined) ? BigInteger.ONE : z
  this.zinv = null

  //TODO: compression flag
}

function pointFpGetX() {
  if (this.zinv === null) {
    this.zinv = this.z.modInverse(this.curve.q)
  }

  return this.curve.fromBigInteger(this.x.toBigInteger().multiply(this.zinv).mod(this.curve.q))
}

function pointFpGetY() {
  if (this.zinv === null) {
    this.zinv = this.z.modInverse(this.curve.q)
  }

  return this.curve.fromBigInteger(this.y.toBigInteger().multiply(this.zinv).mod(this.curve.q))
}

function pointFpEquals(other) {
  if (other == this) return true
  if (this.isInfinity()) return other.isInfinity()
  if (other.isInfinity()) return this.isInfinity()

  // u = Y2 * Z1 - Y1 * Z2
  var u = other.y.toBigInteger().multiply(this.z).subtract(this.y.toBigInteger().multiply(other.z)).mod(this.curve.q)

  if (u.signum() !== 0) return false

  // v = X2 * Z1 - X1 * Z2
  var v = other.x.toBigInteger().multiply(this.z).subtract(this.x.toBigInteger().multiply(other.z)).mod(this.curve.q)

  return v.signum() === 0
}

function pointFpIsInfinity() {
  if ((this.x === null) && (this.y === null)) return true
  return this.z.signum() === 0 && this.y.toBigInteger().signum() !== 0
}

function pointFpNegate() {
  return new ECPointFp(this.curve, this.x, this.y.negate(), this.z)
}

function pointFpAdd(b) {
  if (this.isInfinity()) return b
  if (b.isInfinity()) return this

  var x1 = this.x.toBigInteger()
  var y1 = this.y.toBigInteger()
  var x2 = b.x.toBigInteger()
  var y2 = b.y.toBigInteger()

  // u = Y2 * Z1 - Y1 * Z2
  var u = y2.multiply(this.z).subtract(y1.multiply(b.z)).mod(this.curve.q)
  // v = X2 * Z1 - X1 * Z2
  var v = x2.multiply(this.z).subtract(x1.multiply(b.z)).mod(this.curve.q)

  if (v.signum() === 0) {
      if (u.signum() === 0) {
          return this.twice() // this == b, so double
      }

      return this.curve.getInfinity() // this = -b, so infinity
  }

  var v2 = v.square()
  var v3 = v2.multiply(v)
  var x1v2 = x1.multiply(v2)
  var zu2 = u.square().multiply(this.z)

  // x3 = v * (z2 * (z1 * u^2 - 2 * x1 * v^2) - v^3)
  var x3 = zu2.subtract(x1v2.shiftLeft(1)).multiply(b.z).subtract(v3).multiply(v).mod(this.curve.q)
  // y3 = z2 * (3 * x1 * u * v^2 - y1 * v^3 - z1 * u^3) + u * v^3
  var y3 = x1v2.multiply(THREE).multiply(u).subtract(y1.multiply(v3)).subtract(zu2.multiply(u)).multiply(b.z).add(u.multiply(v3)).mod(this.curve.q)
  // z3 = v^3 * z1 * z2
  var z3 = v3.multiply(this.z).multiply(b.z).mod(this.curve.q)

  return new ECPointFp(this.curve, this.curve.fromBigInteger(x3), this.curve.fromBigInteger(y3), z3)
}

function pointFpTwice() {
  if (this.isInfinity()) return this
  if (this.y.toBigInteger().signum() === 0) return this.curve.getInfinity()

  var x1 = this.x.toBigInteger()
  var y1 = this.y.toBigInteger()

  var y1z1 = y1.multiply(this.z)
  var y1sqz1 = y1z1.multiply(y1).mod(this.curve.q)
  var a = this.curve.a.toBigInteger()

  // w = 3 * x1^2 + a * z1^2
  var w = x1.square().multiply(THREE)

  if (a.signum() !== 0) {
    w = w.add(this.z.square().multiply(a))
  }

  w = w.mod(this.curve.q)
  // x3 = 2 * y1 * z1 * (w^2 - 8 * x1 * y1^2 * z1)
  var x3 = w.square().subtract(x1.shiftLeft(3).multiply(y1sqz1)).shiftLeft(1).multiply(y1z1).mod(this.curve.q)
  // y3 = 4 * y1^2 * z1 * (3 * w * x1 - 2 * y1^2 * z1) - w^3
  var y3 = w.multiply(THREE).multiply(x1).subtract(y1sqz1.shiftLeft(1)).shiftLeft(2).multiply(y1sqz1).subtract(w.pow(3)).mod(this.curve.q)
  // z3 = 8 * (y1 * z1)^3
  var z3 = y1z1.pow(3).shiftLeft(3).mod(this.curve.q)

  return new ECPointFp(this.curve, this.curve.fromBigInteger(x3), this.curve.fromBigInteger(y3), z3)
}

// Simple NAF (Non-Adjacent Form) multiplication algorithm
// TODO: modularize the multiplication algorithm
function pointFpMultiply(k) {
  if (this.isInfinity()) return this
  if (k.signum() === 0) return this.curve.getInfinity()

  var e = k
  var h = e.multiply(THREE)

  var neg = this.negate()
  var R = this

  for (var i = h.bitLength() - 2; i > 0; --i) {
    R = R.twice()

    var hBit = h.testBit(i)
    var eBit = e.testBit(i)

    if (hBit != eBit) {
        R = R.add(hBit ? this : neg)
    }
  }

  return R
}

// Compute this*j + x*k (simultaneous multiplication)
function pointFpMultiplyTwo(j,x,k) {
  var i

  if (j.bitLength() > k.bitLength())
    i = j.bitLength() - 1
  else
    i = k.bitLength() - 1

  var R = this.curve.getInfinity()
  var both = this.add(x)
  while (i >= 0) {
    R = R.twice()
    if (j.testBit(i)) {
      if (k.testBit(i)) {
        R = R.add(both)
      }
      else {
        R = R.add(this)
      }
    }
    else {
      if (k.testBit(i)) {
        R = R.add(x)
      }
    }
    --i
  }

  return R
}

ECPointFp.prototype.getX = pointFpGetX
ECPointFp.prototype.getY = pointFpGetY
ECPointFp.prototype.equals = pointFpEquals
ECPointFp.prototype.isInfinity = pointFpIsInfinity
ECPointFp.prototype.negate = pointFpNegate
ECPointFp.prototype.add = pointFpAdd
ECPointFp.prototype.twice = pointFpTwice
ECPointFp.prototype.multiply = pointFpMultiply
ECPointFp.prototype.multiplyTwo = pointFpMultiplyTwo

// ----------------
// ECCurveFp

// constructor
function ECCurveFp(q,a,b) {
  this.q = q
  this.a = this.fromBigInteger(a)
  this.b = this.fromBigInteger(b)
  this.infinity = new ECPointFp(this, null, null)
}

function curveFpGetQ() {
  return this.q
}

function curveFpGetA() {
  return this.a
}

function curveFpGetB() {
  return this.b
}

function curveFpEquals(other) {
  if (other == this) return true
  return(this.q.equals(other.q) && this.a.equals(other.a) && this.b.equals(other.b))
}

function curveFpGetInfinity() {
  return this.infinity
}

function curveFpFromBigInteger(x) {
  return new ECFieldElementFp(this.q, x)
}

ECCurveFp.prototype.getQ = curveFpGetQ
ECCurveFp.prototype.getA = curveFpGetA
ECCurveFp.prototype.getB = curveFpGetB
ECCurveFp.prototype.equals = curveFpEquals
ECCurveFp.prototype.getInfinity = curveFpGetInfinity
ECCurveFp.prototype.fromBigInteger = curveFpFromBigInteger

ECFieldElementFp.prototype.getByteLength = function () {
  return Math.floor((this.toBigInteger().bitLength() + 7) / 8)
}

ECPointFp.prototype.getEncoded = function(compressed) {
  var x = this.getX().toBigInteger()
  var y = this.getY().toBigInteger()
  var buffer

  // 0x02/0x03 | X
  if (compressed) {
    buffer = new Buffer(33)
    buffer.writeUInt8(y.isEven() ? 0x02 : 0x03, 0)

  // 0x04 | X | Y
  } else {
    buffer = new Buffer(65)
    buffer.writeUInt8(0x04, 0)

    y.toBuffer(32).copy(buffer, 33)
  }

  x.toBuffer(32).copy(buffer, 1)

  return buffer
}

ECPointFp.decodeFrom = function (curve, buffer) {
  var type = buffer.readUInt8(0)
  var compressed = type !== 0x04
  var x = BigInteger.fromBuffer(buffer.slice(1, 33))
  var y

  if (compressed) {
    assert.equal(buffer.length, 33, 'Invalid sequence length')
    assert(type === 0x02 || type === 0x03, 'Invalid sequence tag')

    var isYEven = (type === 0x02)
    var a = curve.getA().toBigInteger()
    var b = curve.getB().toBigInteger()
    var p = curve.getQ()

    // We precalculate (p + 1) / 4 where p is the field order
    if (!curve.P_OVER_FOUR) {
      curve.P_OVER_FOUR = p.add(BigInteger.ONE).shiftRight(2)
    }

    // Convert x to point
    var alpha = x.pow(3).add(a.multiply(x)).add(b).mod(p)
    var beta = alpha.modPow(curve.P_OVER_FOUR, p)

    // If beta is even, but y isn't, or vice versa, then convert it,
    // otherwise we're done and y == beta.
    y = (beta.isEven() ^ isYEven) ? p.subtract(beta) : beta

  } else {
    assert.equal(buffer.length, 65, 'Invalid sequence length')

    y = BigInteger.fromBuffer(buffer.slice(33))
  }

  var Q = new ECPointFp(curve, curve.fromBigInteger(x), curve.fromBigInteger(y))

  return {
    Q: Q,
    compressed: compressed
  }
}

ECPointFp.prototype.isOnCurve = function () {
  var x = this.getX().toBigInteger()
  var y = this.getY().toBigInteger()
  var a = this.curve.getA().toBigInteger()
  var b = this.curve.getB().toBigInteger()
  var p = this.curve.getQ()
  var lhs = y.square().mod(p)
  var rhs = x.pow(3).add(a.multiply(x)).add(b).mod(p)
  return lhs.equals(rhs)
}

ECPointFp.prototype.toString = function () {
  return '('+this.getX().toBigInteger().toString()+','+
    this.getY().toBigInteger().toString()+')'
}

/**
 * Validate an elliptic curve point.
 *
 * See SEC 1, section 3.2.2.1: Elliptic Curve Public Key Validation Primitive
 */
ECPointFp.prototype.validate = function () {
  var n = this.curve.getQ()

  // Check Q != O
  if (this.isInfinity()) {
    throw new Error("Point is at infinity.")
  }

  // Check coordinate bounds
  var x = this.getX().toBigInteger()
  var y = this.getY().toBigInteger()
  if (x.compareTo(BigInteger.ONE) < 0 ||
      x.compareTo(n.subtract(BigInteger.ONE)) > 0) {
    throw new Error('x coordinate out of bounds')
  }
  if (y.compareTo(BigInteger.ONE) < 0 ||
      y.compareTo(n.subtract(BigInteger.ONE)) > 0) {
    throw new Error('y coordinate out of bounds')
  }

  // Check y^2 = x^3 + ax + b (mod n)
  if (!this.isOnCurve()) {
    throw new Error("Point is not on the curve.")
  }

  // Check nQ = 0 (Q is a scalar multiple of G)
  if (this.multiply(n).isInfinity()) {
    // TODO: This check doesn't work - fix.
    throw new Error("Point is not a scalar multiple of G.")
  }

  return true
}

module.exports = ECCurveFp
module.exports.ECPointFp = ECPointFp