add ristretto methods

crypto_scalarmult_ed25519.js

@@ -1,13 +1,14 @@
 const assert = require('nanoassert')
 const ec = require('./fe25519_25')
-const { sodium_is_zero } = require('./')
 
 module.exports = {
   crypto_scalarmult_ed25519,
   crypto_scalarmult_ed25519_base,
   crypto_scalarmult_curve25519,
   crypto_scalarmult_curve25519_1,
-  crypto_scalarmult_curve25519_base
+  crypto_scalarmult_curve25519_base,
+  crypto_scalarmult_ristretto255,
+  crypto_scalarmult_ristretto255_base
 }
 
 const _121666buf = Buffer.alloc(32)
@@ -338,8 +339,9 @@ function edwards_to_montgomery(montgomeryX, edwardsY, edwardsZ) {
 
 function crypto_scalarmult_curve25519_base (q, n) {
   var t = q.slice()
-  var A = ec.ge3()
+  var Q = ec.ge3()
-  var pk = ec.fe25519()
+  const pk = ec.fe25519()
+
   var i
 
   for (i = 0; i < 32; i++) {
@@ -347,10 +349,11 @@ function crypto_scalarmult_curve25519_base (q, n) {
   }
 
   t[0] &= 248
-  t[31] &= 127
   t[31] |= 64
-  ec.ge25519_scalarmult_base(A, t)
+  t[31] &= 127
-  edwards_to_montgomery(pk, A[1], A[2])
+
+  ec.ge25519_scalarmult_base(Q, t)
+  edwards_to_montgomery(pk, Q[1], Q[2]);
   ec.fe25519_tobytes(q, pk)
 
   return 0
@@ -364,3 +367,14 @@ function print32 (num) {
 function printfe (fe) {
   for (let i of fe) print32(i)
 }
+
+function sodium_is_zero (n) {
+  let i
+  let d = 0
+
+  for (let i = 0; i < n.length; i++) {
+    d |= n[i]
+  }
+
+  return 1 & ((d - 1) >> 8)
+}

crypto_sign.js

@@ -36,7 +36,9 @@ module.exports = {
   crypto_sign_ed25519_BYTES,
   crypto_sign_ed25519_pk_to_curve25519,
   unpackneg,
-  pack
+  pack,
+  scalarbase,
+  scalarmult
 }
 
 function set25519 (r, a) {
@@ -315,6 +317,7 @@ function crypto_sign_open (msg, sm, pk) {
   for (i = 0; i < 32; i++) m[i + 32] = pk[i]
   crypto_hash(h, m, n)
   reduce(h)
+  console.log('h so -->', Buffer.from(h).subarray(0, 32).toString('hex'))
   scalarmult(p, q, h)
 
   scalarbase(q, sm.subarray(32))

crypto_sign_ed25519.js

@@ -1,4 +1,4 @@
-const { sodium_memzero, sodium_memcmp } = require('./')
+const { sodium_memzero } = require('./')
 const ec = require('./fe25519_25')
 const {
   crypto_hash_sha512, crypto_hash_sha512_update,
@@ -12,6 +12,11 @@ var crypto_sign_ed25519_PUBLICKEYBYTES = 32
 var crypto_sign_ed25519_SECRETKEYBYTES = 64
 var crypto_sign_ed25519_MESSAGEBYTES_MAX = Number.MAX_SAFE_INTEGER
 
+const crypto_sign_BYTES = crypto_sign_ed25519_BYTES
+const crypto_sign_PUBLICKEYBYTES = crypto_sign_ed25519_PUBLICKEYBYTES
+const crypto_sign_SECRETKEYBYTES = crypto_sign_ed25519_SECRETKEYBYTES
+const crypto_sign_SEEDBYTES = crypto_sign_ed25519_SEEDBYTES
+
 function _crypto_sign_ed25519_ref10_hinit (hs, prehashed) {
   const DOM2PREFIX = Buffer.from('SigEd25519 no Ed25519 collisions  ')
   DOM2PREFIX[30] = 1
@@ -28,7 +33,7 @@ function _crypto_sign_ed25519_clamp (k) {
   k[31] |= 64
 }
 
-function _crypto_sign_ed25519_detached (sig, m, mlen, sk, prehashed) {
+function _crypto_sign_ed25519_detached (sig, m, sk, prehashed) {
   var state = crypto_hash_sha512_state()
   var az = Buffer.alloc(64)
   var nonce = Buffer.alloc(64)
@@ -39,7 +44,7 @@ function _crypto_sign_ed25519_detached (sig, m, mlen, sk, prehashed) {
 
   crypto_hash_sha512(az, sk, 32)
   crypto_hash_sha512_update(state, az.subarray(32), 32)
-  crypto_hash_sha512_update(state, m, mlen)
+  crypto_hash_sha512_update(state, m)
   crypto_hash_sha512_final(state, nonce)
 
   sig.set(sk.subarray(32, 64), 32)
@@ -51,10 +56,11 @@ function _crypto_sign_ed25519_detached (sig, m, mlen, sk, prehashed) {
   state = crypto_hash_sha512_state()
   _crypto_sign_ed25519_ref10_hinit(state, prehashed)
   crypto_hash_sha512_update(state, sig, 64)
-  crypto_hash_sha512_update(state, m, mlen)
+  crypto_hash_sha512_update(state, m)
   crypto_hash_sha512_final(state, hram)
 
   ec.sc25519_reduce(hram)
+  console.log('h s', hram.toString('hex'))
   _crypto_sign_ed25519_clamp(az)
   ec.sc25519_muladd(sig.subarray(32), hram, az, nonce)
 
@@ -64,18 +70,16 @@ function _crypto_sign_ed25519_detached (sig, m, mlen, sk, prehashed) {
   return 0
 }
 
-function crypto_sign_ed25519_detached (sig, m, mlen, sk) {
+function crypto_sign_ed25519_detached (sig, m, sk) {
-  return _crypto_sign_ed25519_detached(sig, m, mlen, sk, 0)
+  return _crypto_sign_ed25519_detached(sig, m, sk, 0)
 }
 
-function crypto_sign_ed25519 (sm, m, mlen, sk) {
+function crypto_sign_ed25519 (sm, m, sk) {
-  var siglen
+  sm.set(m, crypto_sign_ed25519_BYTES)
-
-  sm.set(m.subarray(0, mlen), crypto_sign_ed25519_BYTES)
 
   /* LCOV_EXCL_START */
-  if (crypto_sign_ed25519_detached(sm, sm.subarray(crypto_sign_ed25519_BYTES), mlen, sk) !== 0) {
+  if (crypto_sign_ed25519_detached(sm, sm.subarray(crypto_sign_ed25519_BYTES), sk) !== 0) {
-    sm.fill(0, mlen + crypto_sign_ed25519_BYTES)
+    sm.fill(0, m.byteLength + crypto_sign_ed25519_BYTES)
     return -1
   }
   /* LCOV_EXCL_STOP */
@@ -83,10 +87,10 @@ function crypto_sign_ed25519 (sm, m, mlen, sk) {
 }
 
 function crypto_sign (sm, m, sk) {
-  return crypto_sign_ed25519(sm, m, m.byteLength, sk)
+  return crypto_sign_ed25519(sm, m, sk)
 }
 
-function _crypto_sign_ed25519_verify_detached(sig, m, mlen, pk, prehashed) {
+function _crypto_sign_ed25519_verify_detached(sig, m, pk, prehashed) {
   var hs = crypto_hash_sha512_state()
   var h = Buffer.alloc(64)
   var rcheck = Buffer.alloc(32)
@@ -118,30 +122,27 @@ function _crypto_sign_ed25519_verify_detached(sig, m, mlen, pk, prehashed) {
   _crypto_sign_ed25519_ref10_hinit(hs, prehashed)
   crypto_hash_sha512_update(hs, sig, 32)
   crypto_hash_sha512_update(hs, pk, 32)
-  crypto_hash_sha512_update(hs, m, mlen)
+  crypto_hash_sha512_update(hs, m)
   crypto_hash_sha512_final(hs, h)
   ec.sc25519_reduce(h)
+  console.log('h v', h.toString('hex'))
 
   ec.ge25519_double_scalarmult_vartime(R, h, A, sig.subarray(32))
   ec.ge25519_tobytes(rcheck, R)
 
-  return crypto_verify_32(rcheck, 0, sig, 0) | sodium_memcmp(sig.subarray(0, 32), rcheck.subarray(0, 32))
+  return crypto_verify_32(rcheck, 0, sig, 0)// | sodium_memcmp(sig.subarray(0, 32), rcheck.subarray(0, 32))
 }
 
-function crypto_sign_ed25519_verify_detached (sig, m, mlen, pk) {
+function crypto_sign_ed25519_verify_detached (sig, m, pk) {
-  return _crypto_sign_ed25519_verify_detached(sig, m, mlen, pk, 0);
+  return _crypto_sign_ed25519_verify_detached(sig, m, pk, 0);
 }
 
 function crypto_sign_ed25519_open (m, sm, pk) {
-  var mlen = 0
-
   if (sm.byteLength < 64 || sm.byteLength - 64 > crypto_sign_ed25519_MESSAGEBYTES_MAX) {
     throw new Error('Bad signature.')
   }
 
-  mlen = sm.byteLength - 64
+  if (crypto_sign_ed25519_verify_detached(sm, sm.subarray(64), pk) !== 0) {
-
-  if (!crypto_sign_ed25519_verify_detached(sm, sm.subarray(64), mlen, pk)) {
     if (m.byteLength) m.fill(0)
     throw new Error('Bad signature.')
   }
@@ -157,7 +158,148 @@ function crypto_sign_open (m, sm, pk) {
   return crypto_sign_ed25519_open(m, sm, pk)
 }
 
+function crypto_sign_verify_detached (m, sm, pk) {
+  return crypto_sign_ed25519_verify_detached(m, sm, pk)
+}
+
+function _crypto_sign_ristretto25519_detached (sig, m, sk, prehashed) {
+  var state = crypto_hash_sha512_state()
+  var az = Buffer.alloc(64)
+  var nonce = Buffer.alloc(64)
+  var hram = Buffer.alloc(64)
+  var R = ec.ge3()
+
+  _crypto_sign_ed25519_ref10_hinit(state, prehashed)
+
+  crypto_hash_sha512(az, sk, 32)
+  crypto_hash_sha512_update(state, az.subarray(32), 32)
+  crypto_hash_sha512_update(state, m)
+  crypto_hash_sha512_final(state, nonce)
+
+  sig.set(sk.subarray(32, 64), 32)
+
+  ec.sc25519_reduce(nonce)
+  ec.ge25519_scalarmult_base(R, nonce)
+  ec.ristretto255_p3_tobytes(sig, R)
+
+  state = crypto_hash_sha512_state()
+  _crypto_sign_ed25519_ref10_hinit(state, prehashed)
+  crypto_hash_sha512_update(state, sig, 64)
+  crypto_hash_sha512_update(state, m)
+  crypto_hash_sha512_final(state, hram)
+
+  ec.sc25519_reduce(hram)
+  az[31] &= 127
+  // az[0] &= 248
+  // az[0] |= 1
+  // console.log(az[31] & 128)
+  // console.log(nonce[31] & 128)
+  // console.log(hram[31] & 128)
+  ec.sc25519_muladd(sig.subarray(32), hram, az, nonce)
+
+  sodium_memzero(az)
+  sodium_memzero(nonce)
+
+  return 0
+
+  var rcheck = Buffer.alloc(32)
+  var A = ec.ge3()
+  var _A = ec.ge3()
+  var h = Buffer.alloc(64)
+  var hs = crypto_hash_sha512_state()
+  var pk = sk.subarray(32).slice()
+  // pk[31] &= 127
+  ec.ristretto255_frombytes(A, pk, true)
+  ec.ge25519_scalarmult_base(_A, az)
+  ec.ge25519_p3_add(_A, _A, A)
+  ec.ge25519_p3_tobytes(rcheck, _A)
+  // console.log(rcheck.toString('hex'))
+
+  _crypto_sign_ed25519_ref10_hinit(hs, prehashed)
+  crypto_hash_sha512_update(hs, sig, 32)
+  crypto_hash_sha512_update(hs, pk, 32)
+  crypto_hash_sha512_update(hs, m)
+  crypto_hash_sha512_final(hs, h)
+  ec.sc25519_reduce(h)
+
+  ec.ge25519_double_scalarmult_vartime(R, h, A, sig.subarray(32))
+  ec.ristretto255_p3_tobytes(rcheck, R)
+
+}
+
+function _crypto_sign_ristretto25519_verify_detached(sig, m, pk, prehashed) {
+  var hs = crypto_hash_sha512_state()
+  var h = Buffer.alloc(64)
+  var rcheck = Buffer.alloc(32)
+  var A = ec.ge3()
+  var R = ec.ge3()
+
+  // #ifdef ED25519_COMPAT
+  if (sig[63] & 224) {
+    console.log('here')
+    return -1
+  }
+  // #else
+  // if ((sig[63] & 240) &&
+  //     sc25519_is_canonical(sig + 32) == 0) {
+  //     return -1;
+  // }
+  // if (ge25519_has_small_order(sig) != 0) {
+  //     return -1;
+  // }
+  // if (ge25519_is_canonical(pk) == 0 ||
+  //     ge25519_has_small_order(pk) != 0) {
+  //     return -1;
+  // }
+  // #endif
+  if (ec.ristretto255_frombytes(A, pk, true) !== 0) {
+    console.log('there')
+    return -1
+  }
+
+  _crypto_sign_ed25519_ref10_hinit(hs, prehashed)
+  crypto_hash_sha512_update(hs, sig, 32)
+  crypto_hash_sha512_update(hs, pk, 32)
+  crypto_hash_sha512_update(hs, m)
+  crypto_hash_sha512_final(hs, h)
+  ec.sc25519_reduce(h)
+
+  ec.ge25519_double_scalarmult_vartime(R, h, A, sig.subarray(32))
+  ec.ristretto255_p3_tobytes(rcheck, R)
+
+  return crypto_verify_32(rcheck, 0, sig, 0)// | sodium_memcmp(sig.subarray(0, 32), rcheck.subarray(0, 32))
+}
+
+function crypto_sign_ristretto25519_detached (sig, m, sk) {
+  return _crypto_sign_ristretto25519_detached(sig, m, sk)
+}
+
+function crypto_sign_ristretto25519_verify_detached (sig, m, pk) {
+  return _crypto_sign_ristretto25519_verify_detached(sig, m, pk, 0)
+}
+
+function crypto_sign_ristretto25519 (sm, m, sk) {
+  var siglen
+
+  sm.set(m.subarray(0, mlen), crypto_sign_ristretto25519_BYTES)
+
+  /* LCOV_EXCL_START */
+  if (crypto_sign_ristretto25519_detached(sm, sm.subarray(crypto_sign_ristretto25519_BYTES), mlen, sk) !== 0) {
+    sm.fill(0, mlen + crypto_sign_ristretto25519_BYTES)
+    return -1
+  }
+  /* LCOV_EXCL_STOP */
+  return m.byteLength + 64
+}
+
 module.exports = {
   crypto_sign,
-  crypto_sign_open
+  crypto_sign_open,
+  crypto_sign_ristretto25519_detached,
+  crypto_sign_ristretto25519_verify_detached,
+  crypto_sign_verify_detached,
+  crypto_sign_BYTES,
+  crypto_sign_PUBLICKEYBYTES,
+  crypto_sign_SECRETKEYBYTES,
+  crypto_sign_SEEDBYTES
 }

ed-wasm.js

@@ -1,12 +1,12 @@
 const sodium = require('./')
 const native = require('sodium-native')
 const { crypto_scalarmult_ed25519, crypto_scalarmult_ed25519_base, crypto_scalarmult_curve25519, crypto_scalarmult_curve25519_1, crypto_scalarmult_curve25519_base } = require('./crypto_scalarmult_ed25519')
-const { crypto_sign, crypto_sign_open } = require('./crypto_sign_ed25519')
+const { crypto_sign, crypto_sign_open, crypto_sign_verify_detached } = require('./crypto_sign_ed25519')
 const sign = require('./crypto_sign')
 const ed = require('./ed25519')
+const ec = require('./fe25519_25')
 
 console.log(crypto_scalarmult_ed25519)
-let sig = Buffer.alloc(sodium.crypto_sign_BYTES)
 let sm = Buffer.alloc(1024 + sodium.crypto_sign_BYTES)
 let sm1 = Buffer.alloc(1024 + sodium.crypto_sign_BYTES)
 let skpk = Buffer.alloc(sodium.crypto_sign_SECRETKEYBYTES)
@@ -17,7 +17,7 @@ let smlen1
 let i
 let test
 
-sig.fill(0)
+// sig.fill(0)
 
 var an = Buffer.from([
   0x77, 0x07, 0x6d, 0x0a, 0x73, 0x18, 0xa5, 0x7d, 0x3c, 0x16, 0xc1,
@@ -86,6 +86,26 @@ var pass = true
 // sodium.crypto_scalarmult(res, an, bn)
 // console.log(res.toString('hex'))
 
+function main () {
+  const b = 3;
+  const pos = 21;
+  const p = ec.ge2();
+  const res = Buffer.alloc(32)
+  // static char     hex[32];
+
+  // printf("hello\n");
+  ec.ge25519_cmov8_base(p, pos, b);
+  // printf("hello\n");
+  ec.ge25519_tobytes(res, p);
+
+  console.log(res.toString('hex'))
+}
+console.log('====================')
+main()
+console.log('====================')
+
+/////////////////////////////////////////
+
 res.fill(0)
 crypto_scalarmult_curve25519(res, an, bobpk)
 console.log(res.toString('hex'))
@@ -93,19 +113,31 @@ console.log(res.toString('hex'))
 // console.time('whole')
 crypto_scalarmult_curve25519_1(res, an, bobpk)
 // console.timeEnd('whole')
-console.log(res.toString('hex'))
+console.log('scmult wasm', res.toString('hex'))
 
 native.crypto_scalarmult(res, an, bobpk)
-console.log(res.toString('hex'))
+console.log('scmult nati', res.toString('hex'))
+
+sodium.crypto_scalarmult(res, an, bobpk)
+console.log('scmult js  ', res.toString('hex'))
 
 sodium.crypto_scalarmult_base(res, an)
-console.log(res.toString('hex'))
+console.log('scmultb js', res.toString('hex'))
+
+// const basepoint = Buffer.alloc(32)
+// res.fill(0)
+// native.crypto_scalarmult_base(basepoint, res)
+// console.log('---------------', basepoint.toString('hex'))
 
 native.crypto_scalarmult_base(res, an)
-console.log(res.toString('hex'))
+console.log('scmultb nat', res.toString('hex'))
 
+// res.fill(0)
+// const p = ec.ge3()
+// ec.ge25519_scalarmult_base(p, an)
+// ec.ge25519_tobytes(res, p)
 crypto_scalarmult_curve25519_base(res, an)
-console.log(res.toString('hex'))
+console.log('scmultb was', res.toString('hex'))
 
 native.crypto_scalarmult(res, fixtures[1].sk, fixtures[1].pk)
 console.log(res.toString('hex'))
@@ -122,50 +154,63 @@ console.log('native', res.toString('hex'))
 crypto_scalarmult_ed25519(res, fixtures[1].sk, fixtures[1].pk)
 console.log(res.toString('hex'))
 
-const a = Buffer.alloc(32)
+// const a = Buffer.alloc(32)
-a[i] = 9
+// a[i] = 9
-crypto_scalarmult_curve25519_base(res, an)
+// crypto_scalarmult_curve25519_base(res, an)
-console.log(res.toString('hex'))
+// console.log(res.toString('hex'))
 
 
-console.time('hello')
+// console.time('hello')
-for (let test of fixtures) {
+// for (let test of fixtures) {
-  sodium.crypto_scalarmult(res, test.sk, test.pk)
+//   sodium.crypto_scalarmult(res, test.sk, test.pk)
-}
+// }
-console.timeEnd('hello')
+// console.timeEnd('hello')
-console.log(res.toString('hex'))
+// console.log(res.toString('hex'))
 
-const res1 = Buffer.from(res)
+// const res1 = Buffer.from(res)
-console.time('ed')
+// console.time('ed')
-for (let test of fixtures) {
+// for (let test of fixtures) {
-  crypto_scalarmult_curve25519(res, test.sk, test.pk)
+//   crypto_scalarmult_curve25519(res, test.sk, test.pk)
-}
+// }
-console.timeEnd('ed')
+// console.timeEnd('ed')
 
-console.time('wasm')
+// console.time('wasm')
-for (let test of fixtures) {
+// for (let test of fixtures) {
-  crypto_scalarmult_curve25519_1(res1, test.sk, test.pk)
+//   crypto_scalarmult_curve25519_1(res1, test.sk, test.pk)
-}
+// }
-console.timeEnd('wasm')
+// console.timeEnd('wasm')
 
-console.time('native')
+// console.time('native')
-for (let test of fixtures) {
+// for (let test of fixtures) {
-  native.crypto_scalarmult(res1, test.sk, test.pk)
+//   native.crypto_scalarmult(res1, test.sk, test.pk)
-}
+// }
-console.timeEnd('native')
+// console.timeEnd('native')
-console.log(res.toString('hex'))
+// console.log(res.toString('hex'))
-console.log(res1.toString('hex'))
+// console.log(res1.toString('hex'))
+
+/////////////////////////////////////////
 
 // console.log(sm.toString('hex'))
 
+native.crypto_sign_keypair(pk, sk)
+
+let sig = Buffer.alloc(sodium.crypto_sign_BYTES + 32)
+const m = Buffer.alloc(32)
+const m2 = Buffer.alloc(32)
+for (let i = 0; i < 32; i++) m[i] = i
+
+crypto_sign(sig, m, sk)
 // pass &= smlen === sodium.crypto_sign_BYTES + test.m.byteLength
 // pass &= Buffer.compare(test.sig, sm.subarray(0, 64)) === 0
 // pass &= sodium.crypto_sign_open(test.m, sm.subarray(0, smlen), test.pk)
+console.log('sig', sig.toString('hex'))
 
-// sodium.crypto_sign_detached(sig, test.m, skpk)
+console.log(sodium.crypto_sign_open(m2, sig, pk))
+console.log(crypto_sign_open(m2, sig, pk))
+console.log(m2.toString('hex'))
 
-// pass &= sig.byteLength !== 0 && sig.byteLength <= sodium.crypto_sign_BYTES
+// // pass &= sig.byteLength !== 0 && sig.byteLength <= sodium.crypto_sign_BYTES
-// pass &= Buffer.compare(test.sig, sig) === 0
+// // pass &= Buffer.compare(test.sig, sig) === 0
 // pass &= sodium.crypto_sign_verify_detached(sig, test.m.subarray(0, i), test.pk)
 
 function parseTest (t) {

fe25519_25.js

@@ -71,11 +71,38 @@ function fe25519_pow22523 (h, f) {
 const base = require('./fe25519_25/base.json').map(a => a.map(b => ge2(b)))
 const printbuf =Buffer.alloc(32)
 
+const ed25519_d = fe25519([
+  -10913610, 13857413, -15372611, 6949391, 114729, -8787816, -6275908, -3247719, -18696448, -12055116
+])
+
+const ed25519_d2 = fe25519([
+  -21827239, -5839606, -30745221, 13898782, 229458, 15978800, -12551817, -6495438, 29715968, 9444199
+])
+
+const fe25519_sqrtm1 = fe25519([
+  -32595792, -7943725, 9377950, 3500415, 12389472, -272473, -25146209, -2005654, 326686, 11406482
+])
+
+const ed25519_sqrtam2 = fe25519([
+  -12222970, -8312128, -11511410, 9067497, -15300785, -241793, 25456130, 14121551, -12187136, 3972024
+])
+
+/* 1 / sqrt(a - d) */
+const ed25519_invsqrtamd = fe25519([
+  6111485, 4156064, -27798727, 12243468, -25904040, 120897, 20826367, -7060776, 6093568, -1986012
+])
+
+const one = fe25519()
+fe25519_1(one)
+const basepoint = Buffer.alloc(32)
+fe25519_tobytes(basepoint, one)
+
 module.exports = {
   fe25519,
   ge2,
   ge3,
   print_ge,
+  basepoint,
   fe25519_0,
   fe25519_1,
   fe25519_reduce,
@@ -102,8 +129,14 @@ module.exports = {
   fe25519_sqrt,
   ge25519_has_small_order,
   ge25519_frombytes,
+  ge25519_add_cached,
+  ge25519_sub_cached,
   ge25519_tobytes,
+  ge25519_cmov8_base,
+  ge25519_p3_to_cached,
+  ge25519_p1p1_to_p3,
   ge25519_p3_tobytes,
+  ge25519_p3_add,
   ge25519_p3_dbl,
   ge25519_scalarmult,
   ge25519_scalarmult_base,
@@ -133,22 +166,6 @@ module.exports = {
   ristretto255_from_hash
 }
 
-const ed25519_d = fe25519([
-  -10913610, 13857413, -15372611, 6949391, 114729, -8787816, -6275908, -3247719, -18696448, -12055116
-])
-
-const ed25519_d2 = fe25519([
-  -21827239, -5839606, -30745221, 13898782, 229458, 15978800, -12551817, -6495438, 29715968, 9444199
-])
-
-const fe25519_sqrtm1 = fe25519([
-  -32595792, -7943725, 9377950, 3500415, 12389472, -272473, -25146209, -2005654, 326686, 11406482
-])
-
-const ed25519_sqrtam2 = fe25519([
-  -12222970, -8312128, -11511410, 9067497, -15300785, -241793, 25456130, 14121551, -12187136, 3972024
-])
-
 function print_ge (g, n = 4) {
   for (let i = 0; i < n; i++) for (let j = 0; j <10; j++) console.log(`g[${i}][${j}]:`, signedInt(g[i][j]).toString(16).padStart(8, '0'))
 }
@@ -823,7 +840,7 @@ function fe25519_sq2 (h, f) {
 
   var buf = new Uint8Array(f.buffer)
 
-  mem.set(buf)
+  mem.set(buf, 120)
   wasm_sq.exports.sq(160, 120, 1)
 
   parse_fe(h, mem, 160)
@@ -859,42 +876,42 @@ function fe25519_invert_1 (out, z) {
   fe25519_sq(t2, t0)
   fe25519_mul(t1, t1, t2)
   fe25519_sq(t2, t1)
-  for (i = 1; i < 5; ++i) {
+  for (i = 1; i < 5; i++) {
     fe25519_sq(t2, t2)
   }
   fe25519_mul(t1, t2, t1)
   fe25519_sq(t2, t1)
-  for (i = 1; i < 10; ++i) {
+  for (i = 1; i < 10; i++) {
     fe25519_sq(t2, t2)
   }
   fe25519_mul(t2, t2, t1)
   fe25519_sq(t3, t2)
-  for (i = 1; i < 20; ++i) {
+  for (i = 1; i < 20; i++) {
     fe25519_sq(t3, t3)
   }
   fe25519_mul(t2, t3, t2)
   fe25519_sq(t2, t2)
-  for (i = 1; i < 10; ++i) {
+  for (i = 1; i < 10; i++) {
     fe25519_sq(t2, t2)
   }
   fe25519_mul(t1, t2, t1)
   fe25519_sq(t2, t1)
-  for (i = 1; i < 50; ++i) {
+  for (i = 1; i < 50; i++) {
     fe25519_sq(t2, t2)
   }
   fe25519_mul(t2, t2, t1)
   fe25519_sq(t3, t2)
-  for (i = 1; i < 100; ++i) {
+  for (i = 1; i < 100; i++) {
     fe25519_sq(t3, t3)
   }
   fe25519_mul(t2, t3, t2)
   fe25519_sq(t2, t2)
-  for (i = 1; i < 50; ++i) {
+  for (i = 1; i < 50; i++) {
     fe25519_sq(t2, t2)
   }
   fe25519_mul(t1, t2, t1)
   fe25519_sq(t1, t1)
-  for (i = 1; i < 5; ++i) {
+  for (i = 1; i < 5; i++) {
     fe25519_sq(t1, t1)
   }
   fe25519_mul(out, t1, t0)
@@ -919,37 +936,37 @@ function fe25519_pow22523_1 (out, z) {
   fe25519_sq(t0, t0)
   fe25519_mul(t0, t1, t0)
   fe25519_sq(t1, t0)
-  for (i = 1; i < 5; ++i) {
+  for (i = 1; i < 5; i++) {
     fe25519_sq(t1, t1)
   }
   fe25519_mul(t0, t1, t0)
   fe25519_sq(t1, t0)
-  for (i = 1; i < 10; ++i) {
+  for (i = 1; i < 10; i++) {
     fe25519_sq(t1, t1)
   }
   fe25519_mul(t1, t1, t0)
   fe25519_sq(t2, t1)
-  for (i = 1; i < 20; ++i) {
+  for (i = 1; i < 20; i++) {
     fe25519_sq(t2, t2)
   }
   fe25519_mul(t1, t2, t1)
   fe25519_sq(t1, t1)
-  for (i = 1; i < 10; ++i) {
+  for (i = 1; i < 10; i++) {
     fe25519_sq(t1, t1)
   }
   fe25519_mul(t0, t1, t0)
   fe25519_sq(t1, t0)
-  for (i = 1; i < 50; ++i) {
+  for (i = 1; i < 50; i++) {
     fe25519_sq(t1, t1)
   }
   fe25519_mul(t1, t1, t0)
   fe25519_sq(t2, t1)
-  for (i = 1; i < 100; ++i) {
+  for (i = 1; i < 100; i++) {
     fe25519_sq(t2, t2)
   }
   fe25519_mul(t1, t2, t1)
   fe25519_sq(t1, t1)
-  for (i = 1; i < 50; ++i) {
+  for (i = 1; i < 50; i++) {
     fe25519_sq(t1, t1)
   }
   fe25519_mul(t0, t1, t0)
@@ -992,25 +1009,37 @@ function fe25519_sqrt (x, x2) {
 r = p + q
 */
 
-function ge25519_add (r, p, q) {
+// function ge25519_add (r, p, q) {
-  check_ge3(r)
+//   let Aa = fe25519(),
-  check_ge3(p)
+//       Ab = fe25519(),
-  check_ge3(q)
+//       Ac = fe25519(),
+//       Ad = fe25519(),
+//       Ae = fe25519(),
+//       Af = fe25519(),
+//       Ag = fe25519(),
+//       Ah = fe25519(),
+//       At = fe25519();
 
-  var t0 = fe25519()
+//   fe25519_sub(Aa, p[0], p[1]);
+//   fe25519_sub(At, q[0], q[1]);
+//   fe25519_mul(Aa, Aa, At);
+//   fe25519_add(Ab, p[0], p[1]);
+//   fe25519_add(At, q[0], q[1]);
+//   fe25519_mul(Ab, Ab, At);
+//   fe25519_mul(Ac, p[3], q[3]);
+//   fe25519_mul(Ac, Ac, ed25519_d2);
+//   fe25519_mul(Ad, p[2], q[2]);
+//   fe25519_add(Ad, Ad, Ad);
+//   fe25519_sub(Ae, Ab, Aa);
+//   fe25519_sub(Af, Ad, Ac);
+//   fe25519_add(Ag, Ad, Ac);
+//   fe25519_add(Ah, Ab, Aa);
 
-  fe25519_add(r[0], p[1], p[0])
+//   fe25519_mul(p[0], Ae, Af);
-  fe25519_sub(r[1], p[1], p[0])
+//   fe25519_mul(p[1], Ah, Ag);
-  fe25519_mul(r[2], r[0], q[0])
+//   fe25519_mul(p[2], Ag, Af);
-  fe25519_mul(r[1], r[1], q[1])
+//   fe25519_mul(p[3], Ae, Ah);
-  fe25519_mul(r[3], q[3], p[3])
+// }
-  fe25519_mul(r[0], p[2], q[2])
-  fe25519_add(t0, r[0], r[0])
-  fe25519_sub(r[0], r[2], r[1])
-  fe25519_add(r[1], r[2], r[1])
-  fe25519_add(r[2], t0, r[3])
-  fe25519_sub(r[3], t0, r[3])
-}
 
 /*
  r = p - q
@@ -1063,11 +1092,11 @@ function slide_vartime (r, a) {
   var ribs
   var cmp
 
-  for (i = 0; i < 256; ++i) {
+  for (i = 0; i < 256; i++) {
     r[i] = 1 & (a[i >> 3] >> (i & 7))
   }
 
-  for (i = 0; i < 256; ++i) {
+  for (i = 0; i < 256; i++) {
     if (!r[i]) {
       continue
     }
@@ -1248,6 +1277,7 @@ function ge25519_p1p1_to_p2 (r, p) {
   fe25519_mul(r[0], p[0], p[3])
   fe25519_mul(r[1], p[1], p[2])
   fe25519_mul(r[2], p[2], p[3])
+  // console.log(r[0])
 }
 
 /*
@@ -1647,31 +1677,31 @@ function ge25519_double_scalarmult_vartime (r, a, A, b) {
   ge25519_p3_dbl(t, A)
   ge25519_p1p1_to_p3(A2, t)
 
-  ge25519_add(t, A2, Ai[0])
+  ge25519_add_cached(t, A2, Ai[0])
   ge25519_p1p1_to_p3(u, t)
   ge25519_p3_to_cached(Ai[1], u)
 
-  ge25519_add(t, A2, Ai[1])
+  ge25519_add_cached(t, A2, Ai[1])
   ge25519_p1p1_to_p3(u, t)
   ge25519_p3_to_cached(Ai[2], u)
 
-  ge25519_add(t, A2, Ai[2])
+  ge25519_add_cached(t, A2, Ai[2])
   ge25519_p1p1_to_p3(u, t)
   ge25519_p3_to_cached(Ai[3], u)
 
-  ge25519_add(t, A2, Ai[3])
+  ge25519_add_cached(t, A2, Ai[3])
   ge25519_p1p1_to_p3(u, t)
   ge25519_p3_to_cached(Ai[4], u)
 
-  ge25519_add(t, A2, Ai[4])
+  ge25519_add_cached(t, A2, Ai[4])
   ge25519_p1p1_to_p3(u, t)
   ge25519_p3_to_cached(Ai[5], u)
 
-  ge25519_add(t, A2, Ai[5])
+  ge25519_add_cached(t, A2, Ai[5])
   ge25519_p1p1_to_p3(u, t)
   ge25519_p3_to_cached(Ai[6], u)
 
-  ge25519_add(t, A2, Ai[6])
+  ge25519_add_cached(t, A2, Ai[6])
   ge25519_p1p1_to_p3(u, t)
   ge25519_p3_to_cached(Ai[7], u)
 
@@ -1737,7 +1767,7 @@ function ge25519_scalarmult (h, a, p) {
   ge25519_p1p1_to_p3(p2, t2)
   ge25519_p3_to_cached(pi[2 - 1], p2) /* 2p = 2*p */
 
-  ge25519_add(t3, p, pi[2 - 1])
+  ge25519_add_cached(t3, p, pi[2 - 1])
   ge25519_p1p1_to_p3(p3, t3)
   ge25519_p3_to_cached(pi[3 - 1], p3) /* 3p = 2p+p */
 
@@ -1745,7 +1775,7 @@ function ge25519_scalarmult (h, a, p) {
   ge25519_p1p1_to_p3(p4, t4)
   ge25519_p3_to_cached(pi[4 - 1], p4) /* 4p = 2*2p */
 
-  ge25519_add(t5, p, pi[4 - 1])
+  ge25519_add_cached(t5, p, pi[4 - 1])
   ge25519_p1p1_to_p3(p5, t5)
   ge25519_p3_to_cached(pi[5 - 1], p5) /* 5p = 4p+p */
 
@@ -1753,7 +1783,7 @@ function ge25519_scalarmult (h, a, p) {
   ge25519_p1p1_to_p3(p6, t6)
   ge25519_p3_to_cached(pi[6 - 1], p6) /* 6p = 2*3p */
 
-  ge25519_add(t7, p, pi[6 - 1])
+  ge25519_add_cached(t7, p, pi[6 - 1])
   ge25519_p1p1_to_p3(p7, t7)
   ge25519_p3_to_cached(pi[7 - 1], p7) /* 7p = 6p+p */
 
@@ -1761,7 +1791,7 @@ function ge25519_scalarmult (h, a, p) {
   ge25519_p1p1_to_p3(p8, t8)
   ge25519_p3_to_cached(pi[8 - 1], p8) /* 8p = 2*4p */
 
-  for (let i = 0; i < 32; ++i) {
+  for (let i = 0; i < 32; i++) {
     e[2 * i + 0] = (a[i] >> 0) & 15
     e[2 * i + 1] = (a[i] >> 4) & 15
   }
@@ -1769,7 +1799,7 @@ function ge25519_scalarmult (h, a, p) {
   /* e[63] is between 0 and 7 */
 
   carry[0] = 0
-  for (let i = 0; i < 63; ++i) {
+  for (let i = 0; i < 63; i++) {
     e[i] += carry[0]
     carry[0] = e[i] + 8
     carry[0] >>= 4
@@ -1782,7 +1812,7 @@ function ge25519_scalarmult (h, a, p) {
 
   for (i = 63; i != 0; i--) {
     ge25519_cmov8_cached(t, pi, e[i])
-    ge25519_add(r, h, t)
+    ge25519_add_cached(r, h, t)
 
     ge25519_p1p1_to_p2(s, r)
     ge25519_p2_dbl(r, s)
@@ -1797,7 +1827,7 @@ function ge25519_scalarmult (h, a, p) {
   }
 
   ge25519_cmov8_cached(t, pi, e[i])
-  ge25519_add(r, h, t)
+  ge25519_add_cached(r, h, t)
 
   ge25519_p1p1_to_p3(h, r)
 }
@@ -1814,27 +1844,28 @@ function ge25519_scalarmult (h, a, p) {
 function ge25519_scalarmult_base (h, a) {
   check_ge3(h)
 
+  var i
   var e = new Int8Array(64)
-  var carry = new Int8Array(1)
+  var carry = 0
   var r = ge3()
   var s = ge2()
   var t = ge2()
 
-  for (i = 0; i < 32; ++i) {
+  for (i = 0; i < 32; i++) {
     e[2 * i + 0] = (a[i] >> 0) & 15
     e[2 * i + 1] = (a[i] >> 4) & 15
   }
   /* each e[i] is between 0 and 15 */
   /* e[63] is between 0 and 7 */
 
-  carry[0] = 0
+  carry = 0
-  for (i = 0; i < 63; ++i) {
+  for (i = 0; i < 63; i++) {
-    e[i] += carry[0]
+    e[i] += carry
-    carry[0] = e[i] + 8
+    carry = e[i] + 8
-    carry[0] >>= 4
+    carry >>= 4
-    e[i] -= carry[0] * (1 << 4)
+    e[i] -= carry * (1 << 4)
   }
-  e[63] += carry[0]
+  e[63] += carry
   /* each e[i] is between -8 and 8 */
 
   ge25519_p3_0(h)
@@ -2150,7 +2181,7 @@ function sc25519_muladd (s, a, b, c) {
 
   wasm_sc_muladd.exports.sc25519_muladd(144, 0, 48, 96)
 
-  s.set(wasm_sc_muladd.memory.slice(144, 176))
+  s.set(wasm_sc_red.memory.slice(144, 176))
 }
 
 /*
@@ -2623,7 +2654,7 @@ function ristretto255_is_canonical (s) {
   return 1 - (((c & d) | e | s[0]) & 1)
 }
 
-function ristretto255_frombytes (h, s) {
+function ristretto255_frombytes (h, s, neg = false) {
   check_ge3(h)
   assert(s instanceof Uint8Array)
 
@@ -2671,9 +2702,14 @@ function ristretto255_frombytes (h, s) {
   fe25519_abs(h[0], h[0])
   fe25519_mul(h[1], u1, h[1])
   fe25519_1(h[2])
+
+  if (neg) {
+    fe25519_neg(h[1], h[1])
+  }
+
   fe25519_mul(h[3], h[0], h[1])
 
-  return -((1 - was_square) | fe25519_isnegative(h[3]) | fe25519_iszero(h[1]))
+  return -((1 - was_square) | fe25519_isnegative(h[3]) ^ neg | fe25519_iszero(h[1]))
 }
 
 function ristretto255_p3_tobytes (s, h) {
@@ -2862,3 +2898,15 @@ function parse_fe (res, buf, offset = 0) {
     res[i] = buf.readInt32LE(4 * i + offset)
   }
 }
+
+function print_fe_hex (p) {
+  const buf = Buffer.alloc(32)
+  fe25519_tobytes(buf, p)
+  console.log(buf.toString('hex'))
+}
+
+function print_ge_hex (p) {
+  const buf = Buffer.alloc(32)
+  ge25519_tobytes(buf, p)
+  console.log(buf.toString('hex'))
+}

fe25519_25/fe25519_mul.js

@@ -7,7 +7,7 @@ function loadWebAssembly (opts) {
   if (!loadWebAssembly.supported) return null
 
   var imp = opts && opts.imports
-  var wasm = toUint8Array('AGFzbQEAAAABHwJgFX5+fn5+fn5+fn5+fn5+fn5+fn5+fwBgA39/fwACGAICanMFdGFibGUBcAABAmpzA21lbQIAAQMDAgABBw8BC2ZlMjU1MTlfbXVsAAEJBwEAQQELAQAK/hACkBABhgF+IACnrCEAIAGnrCEBIAKnrCECIAOnrCEDIASnrCEEIAWnrCEFIAanrCEGIAenrCEHIAinrCEIIAmnrCEJIAqnrCEKIAunrCELIAynrCEMIA2nrCENIA6nrCEOIA+nrCEPIBCnrCEQIBGnrCERIBKnrCESIBOnrCETQhMgC34gC0KAgICACINCAYZCE359ISlCEyAMfiAMQoCAgIAIg0IBhkITfn0hKkITIA1+IA1CgICAgAiDQgGGQhN+fSErQhMgDn4gDkKAgICACINCAYZCE359ISxCEyAPfiAPQoCAgIAIg0IBhkITfn0hLUITIBB+IBBCgICAgAiDQgGGQhN+fSEuQhMgEX4gEUKAgICACINCAYZCE359IS9CEyASfiASQoCAgIAIg0IBhkITfn0hMEITIBN+IBNCgICAgAiDQgGGQhN+fSExQgIgAX4gAUKAgICACINCAYZCAn59ITJCAiADfiADQoCAgIAIg0IBhkICfn0hM0ICIAV+IAVCgICAgAiDQgGGQgJ+fSE0QgIgB34gB0KAgICACINCAYZCAn59ITVCAiAJfiAJQoCAgIAIg0IBhkICfn0hNiApp6whKSAqp6whKiArp6whKyAsp6whLCAtp6whLSAup6whLiAvp6whLyAwp6whMCAxp6whMSAyp6whMiAzp6whMyA0p6whNCA1p6whNSA2p6whNiAAIAp+ITcgACALfiE4IAAgDH4hOSAAIA1+ITogACAOfiE7IAAgD34hPCAAIBB+IT0gACARfiE+IAAgEn4hPyAAIBN+IUAgASAKfiFBIDIgC34hQiABIAx+IUMgMiANfiFEIAEgDn4hRSAyIA9+IUYgASAQfiFHIDIgEX4hSCABIBJ+IUkgMiAxfiFKIAIgCn4hSyACIAt+IUwgAiAMfiFNIAIgDX4hTiACIA5+IU8gAiAPfiFQIAIgEH4hUSACIBF+IVIgAiAwfiFTIAIgMX4hVCADIAp+IVUgMyALfiFWIAMgDH4hVyAzIA1+IVggAyAOfiFZIDMgD34hWiADIBB+IVsgMyAvfiFcIAMgMH4hXSAzIDF+IV4gBCAKfiFfIAQgC34hYCAEIAx+IWEgBCANfiFiIAQgDn4hYyAEIA9+IWQgBCAufiFlIAQgL34hZiAEIDB+IWcgBCAxfiFoIAUgCn4haSA0IAt+IWogBSAMfiFrIDQgDX4hbCAFIA5+IW0gNCAtfiFuIAUgLn4hbyA0IC9+IXAgBSAwfiFxIDQgMX4hciAGIAp+IXMgBiALfiF0IAYgDH4hdSAGIA1+IXYgBiAsfiF3IAYgLX4heCAGIC5+IXkgBiAvfiF6IAYgMH4heyAGIDF+IXwgByAKfiF9IDUgC34hfiAHIAx+IX8gNSArfiGAASAHICx+IYEBIDUgLX4hggEgByAufiGDASA1IC9+IYQBIAcgMH4hhQEgNSAxfiGGASAIIAp+IYcBIAggC34hiAEgCCAqfiGJASAIICt+IYoBIAggLH4hiwEgCCAtfiGMASAIIC5+IY0BIAggL34hjgEgCCAwfiGPASAIIDF+IZABIAkgCn4hkQEgNiApfiGSASAJICp+IZMBIDYgK34hlAEgCSAsfiGVASA2IC1+IZYBIAkgLn4hlwEgNiAvfiGYASAJIDB+IZkBIDYgMX4hmgEgNyBKIFMgXCBlIG4gdyCAASCJASCSAXx8fHx8fHx8fCEVIDggQSBUIF0gZiBvIHgggQEgigEgkwF8fHx8fHx8fHwhFiA5IEIgSyBeIGcgcCB5IIIBIIsBIJQBfHx8fHx8fHx8IRcgOiBDIEwgVSBoIHEgeiCDASCMASCVAXx8fHx8fHx8fCEYIDsgRCBNIFYgXyByIHsghAEgjQEglgF8fHx8fHx8fHwhGSA8IEUgTiBXIGAgaSB8IIUBII4BIJcBfHx8fHx8fHx8IRogPSBGIE8gWCBhIGogcyCGASCPASCYAXx8fHx8fHx8fCEbID4gRyBQIFkgYiBrIHQgfSCQASCZAXx8fHx8fHx8fCEcID8gSCBRIFogYyBsIHUgfiCHASCaAXx8fHx8fHx8fCEdIEAgSSBSIFsgZCBtIHYgfyCIASCRAXx8fHx8fHx8fCEeIBVCAUIZhnxCGochHyAWIB98IRYgFSAfQgFCGoZ+fSEVIBlCAUIZhnxCGochIyAaICN8IRogGSAjQgFCGoZ+fSEZIBZCAUIYhnxCGYchICAXICB8IRcgFiAgQgFCGYZ+fSEWIBpCAUIYhnxCGYchJCAbICR8IRsgGiAkQgFCGYZ+fSEaIBdCAUIZhnxCGochISAYICF8IRggFyAhQgFCGoZ+fSEXIBtCAUIZhnxCGochJSAcICV8IRwgGyAlQgFCGoZ+fSEbIBhCAUIYhnxCGYchIiAZICJ8IRkgGCAiQgFCGYZ+fSEYIBxCAUIYhnxCGYchJiAdICZ8IR0gHCAmQgFCGYZ+fSEcIBlCAUIZhnxCGochIyAaICN8IRogGSAjQgFCGoZ+fSEZIB1CAUIZhnxCGochJyAeICd8IR4gHSAnQgFCGoZ+fSEdIB5CAUIYhnxCGYchKCAVIChCE358IRUgHiAoQgFCGYZ+fSEeIBVCAUIZhnxCGochHyAWIB98IRYgFSAfQgFCGoZ+fSEVIBQgFT4CACAUIBY+AgQgFCAXPgIIIBQgGD4CDCAUIBk+AhAgFCAaPgIUIBQgGz4CGCAUIBw+AhwgFCAdPgIgIBQgHj4CJAtqACABNQIAIAE1AgQgATUCCCABNQIMIAE1AhAgATUCFCABNQIYIAE1AhwgATUCICABNQIkIAI1AgAgAjUCBCACNQIIIAI1AgwgAjUCECACNQIUIAI1AhggAjUCHCACNQIgIAI1AiQgABAACw==')
+  var wasm = toUint8Array('AGFzbQEAAAABHwJgFX5+fn5+fn5+fn5+fn5+fn5+fn5+fwBgA39/fwACGAICanMFdGFibGUBcAAEAmpzA21lbQIAAQMDAgABBw8BC2ZlMjU1MTlfbXVsAAEJBwEAQQELAQAK/hACkBABhgF+IACnrCEAIAGnrCEBIAKnrCECIAOnrCEDIASnrCEEIAWnrCEFIAanrCEGIAenrCEHIAinrCEIIAmnrCEJIAqnrCEKIAunrCELIAynrCEMIA2nrCENIA6nrCEOIA+nrCEPIBCnrCEQIBGnrCERIBKnrCESIBOnrCETQhMgC34gC0KAgICACINCAYZCE359ISlCEyAMfiAMQoCAgIAIg0IBhkITfn0hKkITIA1+IA1CgICAgAiDQgGGQhN+fSErQhMgDn4gDkKAgICACINCAYZCE359ISxCEyAPfiAPQoCAgIAIg0IBhkITfn0hLUITIBB+IBBCgICAgAiDQgGGQhN+fSEuQhMgEX4gEUKAgICACINCAYZCE359IS9CEyASfiASQoCAgIAIg0IBhkITfn0hMEITIBN+IBNCgICAgAiDQgGGQhN+fSExQgIgAX4gAUKAgICACINCAYZCAn59ITJCAiADfiADQoCAgIAIg0IBhkICfn0hM0ICIAV+IAVCgICAgAiDQgGGQgJ+fSE0QgIgB34gB0KAgICACINCAYZCAn59ITVCAiAJfiAJQoCAgIAIg0IBhkICfn0hNiApp6whKSAqp6whKiArp6whKyAsp6whLCAtp6whLSAup6whLiAvp6whLyAwp6whMCAxp6whMSAyp6whMiAzp6whMyA0p6whNCA1p6whNSA2p6whNiAAIAp+ITcgACALfiE4IAAgDH4hOSAAIA1+ITogACAOfiE7IAAgD34hPCAAIBB+IT0gACARfiE+IAAgEn4hPyAAIBN+IUAgASAKfiFBIDIgC34hQiABIAx+IUMgMiANfiFEIAEgDn4hRSAyIA9+IUYgASAQfiFHIDIgEX4hSCABIBJ+IUkgMiAxfiFKIAIgCn4hSyACIAt+IUwgAiAMfiFNIAIgDX4hTiACIA5+IU8gAiAPfiFQIAIgEH4hUSACIBF+IVIgAiAwfiFTIAIgMX4hVCADIAp+IVUgMyALfiFWIAMgDH4hVyAzIA1+IVggAyAOfiFZIDMgD34hWiADIBB+IVsgMyAvfiFcIAMgMH4hXSAzIDF+IV4gBCAKfiFfIAQgC34hYCAEIAx+IWEgBCANfiFiIAQgDn4hYyAEIA9+IWQgBCAufiFlIAQgL34hZiAEIDB+IWcgBCAxfiFoIAUgCn4haSA0IAt+IWogBSAMfiFrIDQgDX4hbCAFIA5+IW0gNCAtfiFuIAUgLn4hbyA0IC9+IXAgBSAwfiFxIDQgMX4hciAGIAp+IXMgBiALfiF0IAYgDH4hdSAGIA1+IXYgBiAsfiF3IAYgLX4heCAGIC5+IXkgBiAvfiF6IAYgMH4heyAGIDF+IXwgByAKfiF9IDUgC34hfiAHIAx+IX8gNSArfiGAASAHICx+IYEBIDUgLX4hggEgByAufiGDASA1IC9+IYQBIAcgMH4hhQEgNSAxfiGGASAIIAp+IYcBIAggC34hiAEgCCAqfiGJASAIICt+IYoBIAggLH4hiwEgCCAtfiGMASAIIC5+IY0BIAggL34hjgEgCCAwfiGPASAIIDF+IZABIAkgCn4hkQEgNiApfiGSASAJICp+IZMBIDYgK34hlAEgCSAsfiGVASA2IC1+IZYBIAkgLn4hlwEgNiAvfiGYASAJIDB+IZkBIDYgMX4hmgEgNyBKIFMgXCBlIG4gdyCAASCJASCSAXx8fHx8fHx8fCEVIDggQSBUIF0gZiBvIHgggQEgigEgkwF8fHx8fHx8fHwhFiA5IEIgSyBeIGcgcCB5IIIBIIsBIJQBfHx8fHx8fHx8IRcgOiBDIEwgVSBoIHEgeiCDASCMASCVAXx8fHx8fHx8fCEYIDsgRCBNIFYgXyByIHsghAEgjQEglgF8fHx8fHx8fHwhGSA8IEUgTiBXIGAgaSB8IIUBII4BIJcBfHx8fHx8fHx8IRogPSBGIE8gWCBhIGogcyCGASCPASCYAXx8fHx8fHx8fCEbID4gRyBQIFkgYiBrIHQgfSCQASCZAXx8fHx8fHx8fCEcID8gSCBRIFogYyBsIHUgfiCHASCaAXx8fHx8fHx8fCEdIEAgSSBSIFsgZCBtIHYgfyCIASCRAXx8fHx8fHx8fCEeIBVCAUIZhnxCGochHyAWIB98IRYgFSAfQgFCGoZ+fSEVIBlCAUIZhnxCGochIyAaICN8IRogGSAjQgFCGoZ+fSEZIBZCAUIYhnxCGYchICAXICB8IRcgFiAgQgFCGYZ+fSEWIBpCAUIYhnxCGYchJCAbICR8IRsgGiAkQgFCGYZ+fSEaIBdCAUIZhnxCGochISAYICF8IRggFyAhQgFCGoZ+fSEXIBtCAUIZhnxCGochJSAcICV8IRwgGyAlQgFCGoZ+fSEbIBhCAUIYhnxCGYchIiAZICJ8IRkgGCAiQgFCGYZ+fSEYIBxCAUIYhnxCGYchJiAdICZ8IR0gHCAmQgFCGYZ+fSEcIBlCAUIZhnxCGochIyAaICN8IRogGSAjQgFCGoZ+fSEZIB1CAUIZhnxCGochJyAeICd8IR4gHSAnQgFCGoZ+fSEdIB5CAUIYhnxCGYchKCAVIChCE358IRUgHiAoQgFCGYZ+fSEeIBVCAUIZhnxCGochHyAWIB98IRYgFSAfQgFCGoZ+fSEVIBQgFT4CACAUIBY+AgQgFCAXPgIIIBQgGD4CDCAUIBk+AhAgFCAaPgIUIBQgGz4CGCAUIBw+AhwgFCAdPgIgIBQgHj4CJAtqACABNQIAIAE1AgQgATUCCCABNQIMIAE1AhAgATUCFCABNQIYIAE1AhwgATUCICABNQIkIAI1AgAgAjUCBCACNQIIIAI1AgwgAjUCECACNQIUIAI1AhggAjUCHCACNQIgIAI1AiQgABAACw==')
   var ready = null
 
   var mod = {

fe25519_25/fe25519_mul.wat

@@ -1,5 +1,5 @@
 (module
-  (import "js" "table" (table 1 anyfunc))
+  (import "js" "table" (table 4 anyfunc))
   (import "js" "mem" (memory 1))
   
   (elem (i32.const 1) $fe_mul)

fe25519_25/sc25519_mul.js

@@ -39,7 +39,6 @@ function loadWebAssembly (opts) {
       if (opts && opts.async) throw new Error('async')
       setup({instance: new WebAssembly.Instance(new WebAssembly.Module(wasm), imp)})
     } catch (err) {
-      console.log(err)
       ready = WebAssembly.instantiate(wasm, imp).then(setup)
     }
 

fe25519_25/sc25519_mul.wat

@@ -304,3 +304,5 @@
     (get_local $s23)
     (i32.const 0)
     (call_indirect (type $to_void))))
+
+;;  TODO: export muladd and call in reduce

fe25519_25/sc25519_muladd.js

@@ -7,7 +7,7 @@ function loadWebAssembly (opts) {
   if (!loadWebAssembly.supported) return null
 
   var imp = opts && opts.imports
-  var wasm = toUint8Array('AGFzbQEAAAABJAJgGX9+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn4AYAR/f39/AAIOAQJqcwV0YWJsZQFwAAEDAgEBBQMBAAEHGwIGbWVtb3J5AgAOc2MyNTUxOV9tdWxhZGQAAAqoEQGlEQFUfiABNQIAIQUgATUCBCEGIAE1AgghByABNQIMIQggATUCECEJIAE1AhQhCiABNQIYIQsgATUCHCEMIAE1AiAhDSABNQIkIQ4gATUCKCEPIAE1AiwhECACNQIAIREgAjUCBCESIAI1AgghEyACNQIMIRQgAjUCECEVIAI1AhQhFiACNQIYIRcgAjUCHCEYIAI1AiAhGSACNQIkIRogAjUCKCEbIAI1AiwhHCADNQIAIR0gAzUCBCEeIAM1AgghHyADNQIMISAgAzUCECEhIAM1AhQhIiADNQIYISMgAzUCHCEkIAM1AiAhJSADNQIkISYgAzUCKCEnIAM1AiwhKCAFp6whBSAGp6whBiAHp6whByAIp6whCCAJp6whCSAKp6whCiALp6whCyAMp6whDCANp6whDSAOp6whDiAPp6whDyAQp6whECARp6whESASp6whEiATp6whEyAUp6whFCAVp6whFSAWp6whFiAXp6whFyAYp6whGCAZp6whGSAap6whGiAbp6whGyAcp6whHCAdp6whHSAep6whHiAfp6whHyAgp6whICAhp6whISAip6whIiAjp6whIyAkp6whJCAlp6whJSAmp6whJiAnp6whJyAop6whKCAdIAUgEX58ISkgHiAFIBJ+IAYgEX58fCEqIB8gBSATfiAGIBJ+IAcgEX58fHwhKyAgIAUgFH4gBiATfiAHIBJ+IAggEX58fHx8ISwgISAFIBV+IAYgFH4gByATfiAIIBJ+IAkgEX58fHx8fCEtICIgBSAWfiAGIBV+IAcgFH4gCCATfiAJIBJ+IAogEX58fHx8fHwhLiAjIAUgF34gBiAWfiAHIBV+IAggFH4gCSATfiAKIBJ+IAsgEX58fHx8fHx8IS8gJCAFIBh+IAYgF34gByAWfiAIIBV+IAkgFH4gCiATfiALIBJ+IAwgEX58fHx8fHx8fCEwICUgBSAZfiAGIBh+IAcgF34gCCAWfiAJIBV+IAogFH4gCyATfiAMIBJ+IA0gEX58fHx8fHx8fHwhMSAmIAUgGn4gBiAZfiAHIBh+IAggF34gCSAWfiAKIBV+IAsgFH4gDCATfiANIBJ+IA4gEX58fHx8fHx8fHx8ITIgJyAFIBt+IAYgGn4gByAZfiAIIBh+IAkgF34gCiAWfiALIBV+IAwgFH4gDSATfiAOIBJ+IA8gEX58fHx8fHx8fHx8fCEzICggBSAcfiAGIBt+IAcgGn4gCCAZfiAJIBh+IAogF34gCyAWfiAMIBV+IA0gFH4gDiATfiAPIBJ+IBAgEX58fHx8fHx8fHx8fHwhNCAGIBx+IAcgG34gCCAafiAJIBl+IAogGH4gCyAXfiAMIBZ+IA0gFX4gDiAUfiAPIBN+IBAgEn58fHx8fHx8fHx8ITUgByAcfiAIIBt+IAkgGn4gCiAZfiALIBh+IAwgF34gDSAWfiAOIBV+IA8gFH4gECATfnx8fHx8fHx8fCE2IAggHH4gCSAbfiAKIBp+IAsgGX4gDCAYfiANIBd+IA4gFn4gDyAVfiAQIBR+fHx8fHx8fHwhNyAJIBx+IAogG34gCyAafiAMIBl+IA0gGH4gDiAXfiAPIBZ+IBAgFX58fHx8fHx8ITggCiAcfiALIBt+IAwgGn4gDSAZfiAOIBh+IA8gF34gECAWfnx8fHx8fCE5IAsgHH4gDCAbfiANIBp+IA4gGX4gDyAYfiAQIBd+fHx8fHwhOiAMIBx+IA0gG34gDiAafiAPIBl+IBAgGH58fHx8ITsgDSAcfiAOIBt+IA8gGn4gECAZfnx8fCE8IA4gHH4gDyAbfiAQIBp+fHwhPSAPIBx+IBAgG358IT4gECAcfiE/QgAhQCApQgFCFIZ8QhWHIUEgKiBBfCEqICkgQUIBQhWGfn0hKSArQgFCFIZ8QhWHIUMgLCBDfCEsICsgQ0IBQhWGfn0hKyAtQgFCFIZ8QhWHIUUgLiBFfCEuIC0gRUIBQhWGfn0hLSAvQgFCFIZ8QhWHIUcgMCBHfCEwIC8gR0IBQhWGfn0hLyAxQgFCFIZ8QhWHIUkgMiBJfCEyIDEgSUIBQhWGfn0hMSAzQgFCFIZ8QhWHIUsgNCBLfCE0IDMgS0IBQhWGfn0hMyA1QgFCFIZ8QhWHIU0gNiBNfCE2IDUgTUIBQhWGfn0hNSA3QgFCFIZ8QhWHIU8gOCBPfCE4IDcgT0IBQhWGfn0hNyA5QgFCFIZ8QhWHIVEgOiBRfCE6IDkgUUIBQhWGfn0hOSA7QgFCFIZ8QhWHIVMgPCBTfCE8IDsgU0IBQhWGfn0hOyA9QgFCFIZ8QhWHIVUgPiBVfCE+ID0gVUIBQhWGfn0hPSA/QgFCFIZ8QhWHIVcgQCBXfCFAID8gV0IBQhWGfn0hPyAqQgFCFIZ8QhWHIUIgKyBCfCErICogQkIBQhWGfn0hKiAsQgFCFIZ8QhWHIUQgLSBEfCEtICwgREIBQhWGfn0hLCAuQgFCFIZ8QhWHIUYgLyBGfCEvIC4gRkIBQhWGfn0hLiAwQgFCFIZ8QhWHIUggMSBIfCExIDAgSEIBQhWGfn0hMCAyQgFCFIZ8QhWHIUogMyBKfCEzIDIgSkIBQhWGfn0hMiA0QgFCFIZ8QhWHIUwgNSBMfCE1IDQgTEIBQhWGfn0hNCA2QgFCFIZ8QhWHIU4gNyBOfCE3IDYgTkIBQhWGfn0hNiA4QgFCFIZ8QhWHIVAgOSBQfCE5IDggUEIBQhWGfn0hOCA6QgFCFIZ8QhWHIVIgOyBSfCE7IDogUkIBQhWGfn0hOiA8QgFCFIZ8QhWHIVQgPSBUfCE9IDwgVEIBQhWGfn0hPCA+QgFCFIZ8QhWHIVYgPyBWfCE/ID4gVkIBQhWGfn0hPiAAICkgKiArICwgLSAuIC8gMCAxIDIgMyA0IDUgNiA3IDggOSA6IDsgPCA9ID4gPyBAQQARAAAL')
+  var wasm = toUint8Array('AGFzbQEAAAABTQtgGX9+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn4AYAF/AGABfwF/YAJ/fwBgAX0AYAF9AX1gAXwAYAF8AXxgAX4AYAF+AX5gBH9/f38AAm4IAmpzBXRhYmxlAXAAAQVkZWJ1ZwNsb2cAAQVkZWJ1Zwdsb2dfdGVlAAIFZGVidWcDbG9nAAMFZGVidWcDbG9nAAQFZGVidWcHbG9nX3RlZQAFBWRlYnVnA2xvZwAGBWRlYnVnB2xvZ190ZWUABwMEAwgJCgUDAQABBxsCBm1lbW9yeQIADnNjMjU1MTlfbXVsYWRkAAkKwBEDDQAgAEIgh6cgAKcQAgsJACAAEAcgAA8LpREBVH4gATUCACEFIAE1AgQhBiABNQIIIQcgATUCDCEIIAE1AhAhCSABNQIUIQogATUCGCELIAE1AhwhDCABNQIgIQ0gATUCJCEOIAE1AighDyABNQIsIRAgAjUCACERIAI1AgQhEiACNQIIIRMgAjUCDCEUIAI1AhAhFSACNQIUIRYgAjUCGCEXIAI1AhwhGCACNQIgIRkgAjUCJCEaIAI1AighGyACNQIsIRwgAzUCACEdIAM1AgQhHiADNQIIIR8gAzUCDCEgIAM1AhAhISADNQIUISIgAzUCGCEjIAM1AhwhJCADNQIgISUgAzUCJCEmIAM1AighJyADNQIsISggBaesIQUgBqesIQYgB6esIQcgCKesIQggCaesIQkgCqesIQogC6esIQsgDKesIQwgDaesIQ0gDqesIQ4gD6esIQ8gEKesIRAgEaesIREgEqesIRIgE6esIRMgFKesIRQgFaesIRUgFqesIRYgF6esIRcgGKesIRggGaesIRkgGqesIRogG6esIRsgHKesIRwgHaesIR0gHqesIR4gH6esIR8gIKesISAgIaesISEgIqesISIgI6esISMgJKesISQgJaesISUgJqesISYgJ6esIScgKKesISggHSAFIBF+fCEpIB4gBSASfiAGIBF+fHwhKiAfIAUgE34gBiASfiAHIBF+fHx8ISsgICAFIBR+IAYgE34gByASfiAIIBF+fHx8fCEsICEgBSAVfiAGIBR+IAcgE34gCCASfiAJIBF+fHx8fHwhLSAiIAUgFn4gBiAVfiAHIBR+IAggE34gCSASfiAKIBF+fHx8fHx8IS4gIyAFIBd+IAYgFn4gByAVfiAIIBR+IAkgE34gCiASfiALIBF+fHx8fHx8fCEvICQgBSAYfiAGIBd+IAcgFn4gCCAVfiAJIBR+IAogE34gCyASfiAMIBF+fHx8fHx8fHwhMCAlIAUgGX4gBiAYfiAHIBd+IAggFn4gCSAVfiAKIBR+IAsgE34gDCASfiANIBF+fHx8fHx8fHx8ITEgJiAFIBp+IAYgGX4gByAYfiAIIBd+IAkgFn4gCiAVfiALIBR+IAwgE34gDSASfiAOIBF+fHx8fHx8fHx8fCEyICcgBSAbfiAGIBp+IAcgGX4gCCAYfiAJIBd+IAogFn4gCyAVfiAMIBR+IA0gE34gDiASfiAPIBF+fHx8fHx8fHx8fHwhMyAoIAUgHH4gBiAbfiAHIBp+IAggGX4gCSAYfiAKIBd+IAsgFn4gDCAVfiANIBR+IA4gE34gDyASfiAQIBF+fHx8fHx8fHx8fHx8ITQgBiAcfiAHIBt+IAggGn4gCSAZfiAKIBh+IAsgF34gDCAWfiANIBV+IA4gFH4gDyATfiAQIBJ+fHx8fHx8fHx8fCE1IAcgHH4gCCAbfiAJIBp+IAogGX4gCyAYfiAMIBd+IA0gFn4gDiAVfiAPIBR+IBAgE358fHx8fHx8fHwhNiAIIBx+IAkgG34gCiAafiALIBl+IAwgGH4gDSAXfiAOIBZ+IA8gFX4gECAUfnx8fHx8fHx8ITcgCSAcfiAKIBt+IAsgGn4gDCAZfiANIBh+IA4gF34gDyAWfiAQIBV+fHx8fHx8fCE4IAogHH4gCyAbfiAMIBp+IA0gGX4gDiAYfiAPIBd+IBAgFn58fHx8fHwhOSALIBx+IAwgG34gDSAafiAOIBl+IA8gGH4gECAXfnx8fHx8ITogDCAcfiANIBt+IA4gGn4gDyAZfiAQIBh+fHx8fCE7IA0gHH4gDiAbfiAPIBp+IBAgGX58fHwhPCAOIBx+IA8gG34gECAafnx8IT0gDyAcfiAQIBt+fCE+IBAgHH4hP0IAIUAgKUIBQhSGfEIVhyFBICogQXwhKiApIEFCAUIVhn59ISkgK0IBQhSGfEIVhyFDICwgQ3whLCArIENCAUIVhn59ISsgLUIBQhSGfEIVhyFFIC4gRXwhLiAtIEVCAUIVhn59IS0gL0IBQhSGfEIVhyFHIDAgR3whMCAvIEdCAUIVhn59IS8gMUIBQhSGfEIVhyFJIDIgSXwhMiAxIElCAUIVhn59ITEgM0IBQhSGfEIVhyFLIDQgS3whNCAzIEtCAUIVhn59ITMgNUIBQhSGfEIVhyFNIDYgTXwhNiA1IE1CAUIVhn59ITUgN0IBQhSGfEIVhyFPIDggT3whOCA3IE9CAUIVhn59ITcgOUIBQhSGfEIVhyFRIDogUXwhOiA5IFFCAUIVhn59ITkgO0IBQhSGfEIVhyFTIDwgU3whPCA7IFNCAUIVhn59ITsgPUIBQhSGfEIVhyFVID4gVXwhPiA9IFVCAUIVhn59IT0gP0IBQhSGfEIVhyFXIEAgV3whQCA/IFdCAUIVhn59IT8gKkIBQhSGfEIVhyFCICsgQnwhKyAqIEJCAUIVhn59ISogLEIBQhSGfEIVhyFEIC0gRHwhLSAsIERCAUIVhn59ISwgLkIBQhSGfEIVhyFGIC8gRnwhLyAuIEZCAUIVhn59IS4gMEIBQhSGfEIVhyFIIDEgSHwhMSAwIEhCAUIVhn59ITAgMkIBQhSGfEIVhyFKIDMgSnwhMyAyIEpCAUIVhn59ITIgNEIBQhSGfEIVhyFMIDUgTHwhNSA0IExCAUIVhn59ITQgNkIBQhSGfEIVhyFOIDcgTnwhNyA2IE5CAUIVhn59ITYgOEIBQhSGfEIVhyFQIDkgUHwhOSA4IFBCAUIVhn59ITggOkIBQhSGfEIVhyFSIDsgUnwhOyA6IFJCAUIVhn59ITogPEIBQhSGfEIVhyFUID0gVHwhPSA8IFRCAUIVhn59ITwgPkIBQhSGfEIVhyFWID8gVnwhPyA+IFZCAUIVhn59IT4gACApICogKyAsIC0gLiAvIDAgMSAyIDMgNCA1IDYgNyA4IDkgOiA7IDwgPSA+ID8gQEEAEQAACw==')
   var ready = null
 
   var mod = {

fe25519_25/sc25519_muladd.wat

@@ -27,6 +27,34 @@
     (param $s22 i64)
     (param $s23 i64)))
 
+  (func $i32.log (import "debug" "log") (param i32))
+  (func $i32.log_tee (import "debug" "log_tee") (param i32) (result i32))
+  ;; No i64 interop with JS yet - but maybe coming with WebAssembly BigInt
+  ;; So we can instead fake this by splitting the i64 into two i32 limbs,
+  ;; however these are WASM functions using i32x2.log:
+  (func $i32x2.log (import "debug" "log") (param i32) (param i32))
+  (func $f32.log (import "debug" "log") (param f32))
+  (func $f32.log_tee (import "debug" "log_tee") (param f32) (result f32))
+  (func $f64.log (import "debug" "log") (param f64))
+  (func $f64.log_tee (import "debug" "log_tee") (param f64) (result f64))
+
+  ;; i64 logging by splitting into two i32 limbs
+  (func $i64.log
+    (param $0 i64)
+    (call $i32x2.log
+      ;; Upper limb
+      (i32.wrap/i64
+        (i64.shr_s (get_local $0)
+          (i64.const 32)))
+      ;; Lower limb
+      (i32.wrap/i64 (get_local $0))))
+
+  (func $i64.log_tee
+    (param $0 i64)
+    (result i64)
+    (call $i64.log (get_local $0))
+    (return (get_local $0)))
+
   (memory $0 1)
   (export "memory" (memory $0))
   

fe25519_25/sc_reduce.js

@@ -7,7 +7,7 @@ function loadWebAssembly (opts) {
   if (!loadWebAssembly.supported) return null
 
   var imp = opts && opts.imports
-  var wasm = toUint8Array('AGFzbQEAAAABIQJgGX9+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn4AYAF/AAIOAQJqcwV0YWJsZQFwAAEDAwIAAQUDAQABBycDBm1lbW9yeQIACXNjX3JlZHVjZQAADnNjMjU1MTlfcmVkdWNlAAEJBwEAQQALAQAK+hcC+BYBEX4gDCAYQpPYKH58IQwgDSAYQpjaHH58IQ0gDiAYQuf2J358IQ4gDyAYQq3zPH59IQ8gECAYQtGrCH58IRAgESAYQv3eKX59IREgCyAXQpPYKH58IQsgDCAXQpjaHH58IQwgDSAXQuf2J358IQ0gDiAXQq3zPH59IQ4gDyAXQtGrCH58IQ8gECAXQv3eKX59IRAgCiAWQpPYKH58IQogCyAWQpjaHH58IQsgDCAWQuf2J358IQwgDSAWQq3zPH59IQ0gDiAWQtGrCH58IQ4gDyAWQv3eKX59IQ8gCSAVQpPYKH58IQkgCiAVQpjaHH58IQogCyAVQuf2J358IQsgDCAVQq3zPH59IQwgDSAVQtGrCH58IQ0gDiAVQv3eKX59IQ4gCCAUQpPYKH58IQggCSAUQpjaHH58IQkgCiAUQuf2J358IQogCyAUQq3zPH59IQsgDCAUQtGrCH58IQwgDSAUQv3eKX59IQ0gByATQpPYKH58IQcgCCATQpjaHH58IQggCSATQuf2J358IQkgCiATQq3zPH59IQogCyATQtGrCH58IQsgDCATQv3eKX59IQwgB0IBQhSGfEIVhyEfIAggH3whCCAHIB9CAUIVhn59IQcgCUIBQhSGfEIVhyEhIAogIXwhCiAJICFCAUIVhn59IQkgC0IBQhSGfEIVhyEjIAwgI3whDCALICNCAUIVhn59IQsgDUIBQhSGfEIVhyElIA4gJXwhDiANICVCAUIVhn59IQ0gD0IBQhSGfEIVhyEnIBAgJ3whECAPICdCAUIVhn59IQ8gEUIBQhSGfEIVhyEpIBIgKXwhEiARIClCAUIVhn59IREgCEIBQhSGfEIVhyEgIAkgIHwhCSAIICBCAUIVhn59IQggCkIBQhSGfEIVhyEiIAsgInwhCyAKICJCAUIVhn59IQogDEIBQhSGfEIVhyEkIA0gJHwhDSAMICRCAUIVhn59IQwgDkIBQhSGfEIVhyEmIA8gJnwhDyAOICZCAUIVhn59IQ4gEEIBQhSGfEIVhyEoIBEgKHwhESAQIChCAUIVhn59IRAgBiASQpPYKH58IQYgByASQpjaHH58IQcgCCASQuf2J358IQggCSASQq3zPH59IQkgCiASQtGrCH58IQogCyASQv3eKX59IQsgBSARQpPYKH58IQUgBiARQpjaHH58IQYgByARQuf2J358IQcgCCARQq3zPH59IQggCSARQtGrCH58IQkgCiARQv3eKX59IQogBCAQQpPYKH58IQQgBSAQQpjaHH58IQUgBiAQQuf2J358IQYgByAQQq3zPH59IQcgCCAQQtGrCH58IQggCSAQQv3eKX59IQkgAyAPQpPYKH58IQMgBCAPQpjaHH58IQQgBSAPQuf2J358IQUgBiAPQq3zPH59IQYgByAPQtGrCH58IQcgCCAPQv3eKX59IQggAiAOQpPYKH58IQIgAyAOQpjaHH58IQMgBCAOQuf2J358IQQgBSAOQq3zPH59IQUgBiAOQtGrCH58IQYgByAOQv3eKX59IQcgASANQpPYKH58IQEgAiANQpjaHH58IQIgAyANQuf2J358IQMgBCANQq3zPH59IQQgBSANQtGrCH58IQUgBiANQv3eKX59IQZCACENIAFCAUIUhnxCFYchGSACIBl8IQIgASAZQgFCFYZ+fSEBIANCAUIUhnxCFYchGyAEIBt8IQQgAyAbQgFCFYZ+fSEDIAVCAUIUhnxCFYchHSAGIB18IQYgBSAdQgFCFYZ+fSEFIAdCAUIUhnxCFYchHyAIIB98IQggByAfQgFCFYZ+fSEHIAlCAUIUhnxCFYchISAKICF8IQogCSAhQgFCFYZ+fSEJIAtCAUIUhnxCFYchIyAMICN8IQwgCyAjQgFCFYZ+fSELIAJCAUIUhnxCFYchGiADIBp8IQMgAiAaQgFCFYZ+fSECIARCAUIUhnxCFYchHCAFIBx8IQUgBCAcQgFCFYZ+fSEEIAZCAUIUhnxCFYchHiAHIB58IQcgBiAeQgFCFYZ+fSEGIAhCAUIUhnxCFYchICAJICB8IQkgCCAgQgFCFYZ+fSEIIApCAUIUhnxCFYchIiALICJ8IQsgCiAiQgFCFYZ+fSEKIAxCAUIUhnxCFYchJCANICR8IQ0gDCAkQgFCFYZ+fSEMIAEgDUKT2Ch+fCEBIAIgDUKY2hx+fCECIAMgDULn9id+fCEDIAQgDUKt8zx+fSEEIAUgDULRqwh+fCEFIAYgDUL93il+fSEGQgAhDSABQhWHIRkgAiAZfCECIAEgGUIBQhWGfn0hASACQhWHIRogAyAafCEDIAIgGkIBQhWGfn0hAiADQhWHIRsgBCAbfCEEIAMgG0IBQhWGfn0hAyAEQhWHIRwgBSAcfCEFIAQgHEIBQhWGfn0hBCAFQhWHIR0gBiAdfCEGIAUgHUIBQhWGfn0hBSAGQhWHIR4gByAefCEHIAYgHkIBQhWGfn0hBiAHQhWHIR8gCCAffCEIIAcgH0IBQhWGfn0hByAIQhWHISAgCSAgfCEJIAggIEIBQhWGfn0hCCAJQhWHISEgCiAhfCEKIAkgIUIBQhWGfn0hCSAKQhWHISIgCyAifCELIAogIkIBQhWGfn0hCiALQhWHISMgDCAjfCEMIAsgI0IBQhWGfn0hCyAMQhWHISQgDSAkfCENIAwgJEIBQhWGfn0hDCABIA1Ck9gofnwhASACIA1CmNocfnwhAiADIA1C5/YnfnwhAyAEIA1CrfM8fn0hBCAFIA1C0asIfnwhBSAGIA1C/d4pfn0hBiABQhWHIRkgAiAZfCECIAEgGUIBQhWGfn0hASACQhWHIRogAyAafCEDIAIgGkIBQhWGfn0hAiADQhWHIRsgBCAbfCEEIAMgG0IBQhWGfn0hAyAEQhWHIRwgBSAcfCEFIAQgHEIBQhWGfn0hBCAFQhWHIR0gBiAdfCEGIAUgHUIBQhWGfn0hBSAGQhWHIR4gByAefCEHIAYgHkIBQhWGfn0hBiAHQhWHIR8gCCAffCEIIAcgH0IBQhWGfn0hByAIQhWHISAgCSAgfCEJIAggIEIBQhWGfn0hCCAJQhWHISEgCiAhfCEKIAkgIUIBQhWGfn0hCSAKQhWHISIgCyAifCELIAogIkIBQhWGfn0hCiALQhWHISMgDCAjfCEMIAsgI0IBQhWGfn0hCyAAIAFC/wGDIAFCgP4Dg4QgASACQiB+QhCGhEKAgPwHg4QgAkIVhkKAgID4D4OEIAJCFYZCgICAgPAfg4QgAkIVhiADQgR+QiiGhEKAgICAgOA/g4QgA0IqhkKAgICAgIDA/wCDhCADQiqGIARCgAF+QjiGhEKAgICAgICAgH+DhDcDACAAIARCAYdC/wGDIARCAYdCgP4Dg4QgBEIBhyAFQhB+QhCGhEKAgPwHg4QgBUIUhkKAgID4D4OEIAVCFIZCgICAgPAfg4QgBUIUhiAGQgJ+QiiGhEKAgICAgOA/g4QgBkIphkKAgICAgIDA/wCDhCAGQimGIAdCwAB+QjiGhEKAgICAgICAgH+DhDcDCCAAIAdCAodC/wGDIAdCAodCgP4Dg4QgB0IChyAIQgh+QhCGhEKAgPwHg4QgCEIThkKAgID4D4OEIAhCE4ZCgICAgPAfg4QgCUIohkKAgICAgOA/g4QgCUIohkKAgICAgIDA/wCDhCAJQiiGIApCIH5COIaEQoCAgICAgICAf4OENwMQIAAgCkIDh0L/AYMgCkIDh0KA/gODhCAKQgOHIAtCBH5CEIaEQoCA/AeDhCALQhKGQoCAgPgPg4QgC0IShiAMQoABfkIghoRCgICAgPAfg4QgDEInhkKAgICAgOA/g4QgDEInhkKAgICAgIDA/wCDhCAMQieGQoCAgICAgICAf4OENwMYC34AIAAgADUCACAANQIEIAA1AgggADUCDCAANQIQIAA1AhQgADUCGCAANQIcIAA1AiAgADUCJCAANQIoIAA1AiwgADUCMCAANQI0IAA1AjggADUCPCAANQJAIAA1AkQgADUCSCAANQJMIAA1AlAgADUCVCAANQJYIAA1AlwQAAs=')
+  var wasm = toUint8Array('AGFzbQEAAAABRgpgAX8AYAF/AX9gAn9/AGABfQBgAX0BfWABfABgAXwBfGABfgBgAX4BfmAZf35+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fgACbggCanMFdGFibGUBcAABBWRlYnVnA2xvZwAABWRlYnVnB2xvZ190ZWUAAQVkZWJ1ZwNsb2cAAgVkZWJ1ZwNsb2cAAwVkZWJ1Zwdsb2dfdGVlAAQFZGVidWcDbG9nAAUFZGVidWcHbG9nX3RlZQAGAwUEBwgJAAUDAQABBycDBm1lbW9yeQIACXNjX3JlZHVjZQAJDnNjMjU1MTlfcmVkdWNlAAoJBwEAQQALAQkKkhgEDQAgAEIgh6cgAKcQAgsJACAAEAcgAA8L+BYBEX4gDCAYQpPYKH58IQwgDSAYQpjaHH58IQ0gDiAYQuf2J358IQ4gDyAYQq3zPH59IQ8gECAYQtGrCH58IRAgESAYQv3eKX59IREgCyAXQpPYKH58IQsgDCAXQpjaHH58IQwgDSAXQuf2J358IQ0gDiAXQq3zPH59IQ4gDyAXQtGrCH58IQ8gECAXQv3eKX59IRAgCiAWQpPYKH58IQogCyAWQpjaHH58IQsgDCAWQuf2J358IQwgDSAWQq3zPH59IQ0gDiAWQtGrCH58IQ4gDyAWQv3eKX59IQ8gCSAVQpPYKH58IQkgCiAVQpjaHH58IQogCyAVQuf2J358IQsgDCAVQq3zPH59IQwgDSAVQtGrCH58IQ0gDiAVQv3eKX59IQ4gCCAUQpPYKH58IQggCSAUQpjaHH58IQkgCiAUQuf2J358IQogCyAUQq3zPH59IQsgDCAUQtGrCH58IQwgDSAUQv3eKX59IQ0gByATQpPYKH58IQcgCCATQpjaHH58IQggCSATQuf2J358IQkgCiATQq3zPH59IQogCyATQtGrCH58IQsgDCATQv3eKX59IQwgB0IBQhSGfEIVhyEfIAggH3whCCAHIB9CAUIVhn59IQcgCUIBQhSGfEIVhyEhIAogIXwhCiAJICFCAUIVhn59IQkgC0IBQhSGfEIVhyEjIAwgI3whDCALICNCAUIVhn59IQsgDUIBQhSGfEIVhyElIA4gJXwhDiANICVCAUIVhn59IQ0gD0IBQhSGfEIVhyEnIBAgJ3whECAPICdCAUIVhn59IQ8gEUIBQhSGfEIVhyEpIBIgKXwhEiARIClCAUIVhn59IREgCEIBQhSGfEIVhyEgIAkgIHwhCSAIICBCAUIVhn59IQggCkIBQhSGfEIVhyEiIAsgInwhCyAKICJCAUIVhn59IQogDEIBQhSGfEIVhyEkIA0gJHwhDSAMICRCAUIVhn59IQwgDkIBQhSGfEIVhyEmIA8gJnwhDyAOICZCAUIVhn59IQ4gEEIBQhSGfEIVhyEoIBEgKHwhESAQIChCAUIVhn59IRAgBiASQpPYKH58IQYgByASQpjaHH58IQcgCCASQuf2J358IQggCSASQq3zPH59IQkgCiASQtGrCH58IQogCyASQv3eKX59IQsgBSARQpPYKH58IQUgBiARQpjaHH58IQYgByARQuf2J358IQcgCCARQq3zPH59IQggCSARQtGrCH58IQkgCiARQv3eKX59IQogBCAQQpPYKH58IQQgBSAQQpjaHH58IQUgBiAQQuf2J358IQYgByAQQq3zPH59IQcgCCAQQtGrCH58IQggCSAQQv3eKX59IQkgAyAPQpPYKH58IQMgBCAPQpjaHH58IQQgBSAPQuf2J358IQUgBiAPQq3zPH59IQYgByAPQtGrCH58IQcgCCAPQv3eKX59IQggAiAOQpPYKH58IQIgAyAOQpjaHH58IQMgBCAOQuf2J358IQQgBSAOQq3zPH59IQUgBiAOQtGrCH58IQYgByAOQv3eKX59IQcgASANQpPYKH58IQEgAiANQpjaHH58IQIgAyANQuf2J358IQMgBCANQq3zPH59IQQgBSANQtGrCH58IQUgBiANQv3eKX59IQZCACENIAFCAUIUhnxCFYchGSACIBl8IQIgASAZQgFCFYZ+fSEBIANCAUIUhnxCFYchGyAEIBt8IQQgAyAbQgFCFYZ+fSEDIAVCAUIUhnxCFYchHSAGIB18IQYgBSAdQgFCFYZ+fSEFIAdCAUIUhnxCFYchHyAIIB98IQggByAfQgFCFYZ+fSEHIAlCAUIUhnxCFYchISAKICF8IQogCSAhQgFCFYZ+fSEJIAtCAUIUhnxCFYchIyAMICN8IQwgCyAjQgFCFYZ+fSELIAJCAUIUhnxCFYchGiADIBp8IQMgAiAaQgFCFYZ+fSECIARCAUIUhnxCFYchHCAFIBx8IQUgBCAcQgFCFYZ+fSEEIAZCAUIUhnxCFYchHiAHIB58IQcgBiAeQgFCFYZ+fSEGIAhCAUIUhnxCFYchICAJICB8IQkgCCAgQgFCFYZ+fSEIIApCAUIUhnxCFYchIiALICJ8IQsgCiAiQgFCFYZ+fSEKIAxCAUIUhnxCFYchJCANICR8IQ0gDCAkQgFCFYZ+fSEMIAEgDUKT2Ch+fCEBIAIgDUKY2hx+fCECIAMgDULn9id+fCEDIAQgDUKt8zx+fSEEIAUgDULRqwh+fCEFIAYgDUL93il+fSEGQgAhDSABQhWHIRkgAiAZfCECIAEgGUIBQhWGfn0hASACQhWHIRogAyAafCEDIAIgGkIBQhWGfn0hAiADQhWHIRsgBCAbfCEEIAMgG0IBQhWGfn0hAyAEQhWHIRwgBSAcfCEFIAQgHEIBQhWGfn0hBCAFQhWHIR0gBiAdfCEGIAUgHUIBQhWGfn0hBSAGQhWHIR4gByAefCEHIAYgHkIBQhWGfn0hBiAHQhWHIR8gCCAffCEIIAcgH0IBQhWGfn0hByAIQhWHISAgCSAgfCEJIAggIEIBQhWGfn0hCCAJQhWHISEgCiAhfCEKIAkgIUIBQhWGfn0hCSAKQhWHISIgCyAifCELIAogIkIBQhWGfn0hCiALQhWHISMgDCAjfCEMIAsgI0IBQhWGfn0hCyAMQhWHISQgDSAkfCENIAwgJEIBQhWGfn0hDCABIA1Ck9gofnwhASACIA1CmNocfnwhAiADIA1C5/YnfnwhAyAEIA1CrfM8fn0hBCAFIA1C0asIfnwhBSAGIA1C/d4pfn0hBiABQhWHIRkgAiAZfCECIAEgGUIBQhWGfn0hASACQhWHIRogAyAafCEDIAIgGkIBQhWGfn0hAiADQhWHIRsgBCAbfCEEIAMgG0IBQhWGfn0hAyAEQhWHIRwgBSAcfCEFIAQgHEIBQhWGfn0hBCAFQhWHIR0gBiAdfCEGIAUgHUIBQhWGfn0hBSAGQhWHIR4gByAefCEHIAYgHkIBQhWGfn0hBiAHQhWHIR8gCCAffCEIIAcgH0IBQhWGfn0hByAIQhWHISAgCSAgfCEJIAggIEIBQhWGfn0hCCAJQhWHISEgCiAhfCEKIAkgIUIBQhWGfn0hCSAKQhWHISIgCyAifCELIAogIkIBQhWGfn0hCiALQhWHISMgDCAjfCEMIAsgI0IBQhWGfn0hCyAAIAFC/wGDIAFCgP4Dg4QgASACQiB+QhCGhEKAgPwHg4QgAkIVhkKAgID4D4OEIAJCFYZCgICAgPAfg4QgAkIVhiADQgR+QiiGhEKAgICAgOA/g4QgA0IqhkKAgICAgIDA/wCDhCADQiqGIARCgAF+QjiGhEKAgICAgICAgH+DhDcDACAAIARCAYdC/wGDIARCAYdCgP4Dg4QgBEIBhyAFQhB+QhCGhEKAgPwHg4QgBUIUhkKAgID4D4OEIAVCFIZCgICAgPAfg4QgBUIUhiAGQgJ+QiiGhEKAgICAgOA/g4QgBkIphkKAgICAgIDA/wCDhCAGQimGIAdCwAB+QjiGhEKAgICAgICAgH+DhDcDCCAAIAdCAodC/wGDIAdCAodCgP4Dg4QgB0IChyAIQgh+QhCGhEKAgPwHg4QgCEIThkKAgID4D4OEIAhCE4ZCgICAgPAfg4QgCUIohkKAgICAgOA/g4QgCUIohkKAgICAgIDA/wCDhCAJQiiGIApCIH5COIaEQoCAgICAgICAf4OENwMQIAAgCkIDh0L/AYMgCkIDh0KA/gODhCAKQgOHIAtCBH5CEIaEQoCA/AeDhCALQhKGQoCAgPgPg4QgC0IShiAMQoABfkIghoRCgICAgPAfg4QgDEInhkKAgICAgOA/g4QgDEInhkKAgICAgIDA/wCDhCAMQieGQoCAgICAgICAf4OENwMYC34AIAAgADUCACAANQIEIAA1AgggADUCDCAANQIQIAA1AhQgADUCGCAANQIcIAA1AiAgADUCJCAANQIoIAA1AiwgADUCMCAANQI0IAA1AjggADUCPCAANQJAIAA1AkQgADUCSCAANQJMIAA1AlAgADUCVCAANQJYIAA1AlwQCQs=')
   var ready = null
 
   var mod = {

fe25519_25/sc_reduce.wat

@@ -2,6 +2,34 @@
   (import "js" "table" (table 1 anyfunc))
   (elem (i32.const 0) $sc_reduce)
 
+  (func $i32.log (import "debug" "log") (param i32))
+  (func $i32.log_tee (import "debug" "log_tee") (param i32) (result i32))
+  ;; No i64 interop with JS yet - but maybe coming with WebAssembly BigInt
+  ;; So we can instead fake this by splitting the i64 into two i32 limbs,
+  ;; however these are WASM functions using i32x2.log:
+  (func $i32x2.log (import "debug" "log") (param i32) (param i32))
+  (func $f32.log (import "debug" "log") (param f32))
+  (func $f32.log_tee (import "debug" "log_tee") (param f32) (result f32))
+  (func $f64.log (import "debug" "log") (param f64))
+  (func $f64.log_tee (import "debug" "log_tee") (param f64) (result f64))
+
+  ;; i64 logging by splitting into two i32 limbs
+  (func $i64.log
+    (param $0 i64)
+    (call $i32x2.log
+      ;; Upper limb
+      (i32.wrap/i64
+        (i64.shr_s (get_local $0)
+          (i64.const 32)))
+      ;; Lower limb
+      (i32.wrap/i64 (get_local $0))))
+
+  (func $i64.log_tee
+    (param $0 i64)
+    (result i64)
+    (call $i64.log (get_local $0))
+    (return (get_local $0)))
+
   (memory $0 1)
   (export "memory" (memory $0))
 
@@ -370,7 +398,7 @@
     (i64.const 0xff00000000000000)
     (i64.and)
     (i64.or)
-    
+
     (i64.store offset=0)
 
     (get_local $s)

index.js

@@ -28,10 +28,12 @@ forward(require('./crypto_kdf'))
 forward(require('./crypto_kx'))
 forward(require('./crypto_aead'))
 forward(require('./crypto_onetimeauth'))
+// forward(require('./crypto_scalarmult_ed25519'))
 forward(require('./crypto_scalarmult'))
 forward(require('./crypto_secretbox'))
 forward(require('./crypto_shorthash'))
-forward(require('./crypto_sign'))
+// forward(require('./crypto_sign'))
+forward(require('./crypto_sign_ed25519'))
 forward(require('./crypto_stream'))
 forward(require('./crypto_stream_chacha20'))
 forward(require('./crypto_verify'))