11import { IKeyProvider } from '../kms' ;
22import { AbstractPrivateKeyStore , KmsKeyId , KmsKeyType } from '../store' ;
3- import Elliptic from 'elliptic' ;
43import * as providerHelpers from '../provider-helpers' ;
5- import { ES256KSigner } from 'did-jwt' ;
6- import { base64UrlToBytes , byteEncoder , bytesToHex , hexToBytes } from '../../utils' ;
4+ import { base64UrlToBytes , bytesToHex } from '../../utils' ;
5+ import { secp256k1 } from '@noble/curves/secp256k1' ;
6+ import { sha256 } from '@iden3/js-crypto' ;
7+ import { ES256KSigner , hexToBytes } from 'did-jwt' ;
78
89/**
9- * Provider for Sec256p1 keys256p1
10+ * Provider for Secp256k1
1011 * @public
11- * @class Sec256p1Provider
12+ * @class Secp256k1Provider
1213 * @implements implements IKeyProvider interface
1314 */
1415export class Sec256k1Provider implements IKeyProvider {
@@ -19,16 +20,17 @@ export class Sec256k1Provider implements IKeyProvider {
1920 keyType : KmsKeyType ;
2021 private _keyStore : AbstractPrivateKeyStore ;
2122
22- private readonly _ec ;
2323 /**
2424 * Creates an instance of BjjProvider.
2525 * @param {KmsKeyType } keyType - kms key type
2626 * @param {AbstractPrivateKeyStore } keyStore - key store for kms
2727 */
2828 constructor ( keyType : KmsKeyType , keyStore : AbstractPrivateKeyStore ) {
29+ if ( keyType !== KmsKeyType . Secp256k1 ) {
30+ throw new Error ( 'Key type must be Secp256k1' ) ;
31+ }
2932 this . keyType = keyType ;
3033 this . _keyStore = keyStore ;
31- this . _ec = new Elliptic . ec ( 'secp256k1' ) ;
3234 }
3335 /**
3436 * generates a baby jub jub key from a seed phrase
@@ -39,14 +41,15 @@ export class Sec256k1Provider implements IKeyProvider {
3941 if ( seed . length !== 32 ) {
4042 throw new Error ( 'Seed should be 32 bytes' ) ;
4143 }
42- const keyPair = this . _ec . keyFromPrivate ( seed ) ;
44+ const publicKey = secp256k1 . getPublicKey ( seed ) ;
4345 const kmsId = {
4446 type : this . keyType ,
45- id : providerHelpers . keyPath ( this . keyType , keyPair . getPublic ( ) . encode ( 'hex' , false ) )
47+ id : providerHelpers . keyPath ( this . keyType , bytesToHex ( publicKey ) )
4648 } ;
49+
4750 await this . _keyStore . importKey ( {
4851 alias : kmsId . id ,
49- key : keyPair . getPrivate ( ) . toString ( 'hex' ) . padStart ( 64 , '0' )
52+ key : bytesToHex ( seed ) . padStart ( 64 , '0' )
5053 } ) ;
5154
5255 return kmsId ;
@@ -59,37 +62,46 @@ export class Sec256k1Provider implements IKeyProvider {
5962 */
6063 async publicKey ( keyId : KmsKeyId ) : Promise < string > {
6164 const privateKeyHex = await this . privateKey ( keyId ) ;
62- return this . _ec . keyFromPrivate ( privateKeyHex , 'hex' ) . getPublic ( ) . encode ( 'hex' , false ) ; // 04 + x + y (uncompressed key)
65+ const publicKey = secp256k1 . getPublicKey ( privateKeyHex , false ) ; // 04 + x + y (uncompressed key)
66+ return bytesToHex ( publicKey ) ;
6367 }
6468
6569 /**
66- * signs prepared payload of size,
67- * with a key id
68- *
69- * @param {KmsKeyId } keyId - key identifier
70- * @param {Uint8Array } data - data to sign (32 bytes)
71- * @returns Uint8Array signature
70+ * Signs the given data using the private key associated with the specified key identifier.
71+ * @param keyId - The key identifier to use for signing.
72+ * @param data - The data to sign.
73+ * @param opts - Signing options, such as the algorithm to use.
74+ * @returns A Promise that resolves to the signature as a Uint8Array.
7275 */
7376 async sign (
7477 keyId : KmsKeyId ,
7578 data : Uint8Array ,
7679 opts : { [ key : string ] : unknown } = { alg : 'ES256K' }
7780 ) : Promise < Uint8Array > {
7881 const privateKeyHex = await this . privateKey ( keyId ) ;
79- if ( ! privateKeyHex ) {
80- throw new Error ( 'Private key not found for keyId: ' + keyId . id ) ;
81- }
82+
8283 const signatureBase64 = await ES256KSigner (
8384 hexToBytes ( privateKeyHex ) ,
8485 opts . alg === 'ES256K-R'
8586 ) ( data ) ;
8687
87- const signatureHex = bytesToHex ( base64UrlToBytes ( signatureBase64 . toString ( ) ) ) ;
88- if ( typeof signatureHex !== 'string' ) {
89- throw new Error ( 'Signature is not a string' ) ;
88+ if ( typeof signatureBase64 !== 'string' ) {
89+ throw new Error ( 'signatureBase64 must be a string' ) ;
9090 }
9191
92- return byteEncoder . encode ( signatureBase64 . toString ( ) ) ;
92+ return base64UrlToBytes ( signatureBase64 ) ;
93+ }
94+
95+ /**
96+ * Verifies a signature for the given message and key identifier.
97+ * @param message - The message to verify the signature against.
98+ * @param signatureHex - The signature to verify, as a hexadecimal string.
99+ * @param keyId - The key identifier to use for verification.
100+ * @returns A Promise that resolves to a boolean indicating whether the signature is valid.
101+ */
102+ async verify ( message : Uint8Array , signatureHex : string , keyId : KmsKeyId ) : Promise < boolean > {
103+ const publicKeyHex = await this . publicKey ( keyId ) ;
104+ return secp256k1 . verify ( signatureHex , sha256 ( message ) , publicKeyHex ) ;
93105 }
94106
95107 private async privateKey ( keyId : KmsKeyId ) : Promise < string > {
0 commit comments