modular.ts 17 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484
  1. /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
  2. // Utilities for modular arithmetics and finite fields
  3. import {
  4. bitMask,
  5. bytesToNumberBE,
  6. bytesToNumberLE,
  7. ensureBytes,
  8. numberToBytesBE,
  9. numberToBytesLE,
  10. validateObject,
  11. } from './utils.js';
  12. // prettier-ignore
  13. const _0n = BigInt(0), _1n = BigInt(1), _2n = BigInt(2), _3n = BigInt(3);
  14. // prettier-ignore
  15. const _4n = BigInt(4), _5n = BigInt(5), _8n = BigInt(8);
  16. // prettier-ignore
  17. const _9n = BigInt(9), _16n = BigInt(16);
  18. // Calculates a modulo b
  19. export function mod(a: bigint, b: bigint): bigint {
  20. const result = a % b;
  21. return result >= _0n ? result : b + result;
  22. }
  23. /**
  24. * Efficiently raise num to power and do modular division.
  25. * Unsafe in some contexts: uses ladder, so can expose bigint bits.
  26. * @example
  27. * pow(2n, 6n, 11n) // 64n % 11n == 9n
  28. */
  29. // TODO: use field version && remove
  30. export function pow(num: bigint, power: bigint, modulo: bigint): bigint {
  31. if (modulo <= _0n || power < _0n) throw new Error('Expected power/modulo > 0');
  32. if (modulo === _1n) return _0n;
  33. let res = _1n;
  34. while (power > _0n) {
  35. if (power & _1n) res = (res * num) % modulo;
  36. num = (num * num) % modulo;
  37. power >>= _1n;
  38. }
  39. return res;
  40. }
  41. // Does x ^ (2 ^ power) mod p. pow2(30, 4) == 30 ^ (2 ^ 4)
  42. export function pow2(x: bigint, power: bigint, modulo: bigint): bigint {
  43. let res = x;
  44. while (power-- > _0n) {
  45. res *= res;
  46. res %= modulo;
  47. }
  48. return res;
  49. }
  50. // Inverses number over modulo
  51. export function invert(number: bigint, modulo: bigint): bigint {
  52. if (number === _0n || modulo <= _0n) {
  53. throw new Error(`invert: expected positive integers, got n=${number} mod=${modulo}`);
  54. }
  55. // Euclidean GCD https://brilliant.org/wiki/extended-euclidean-algorithm/
  56. // Fermat's little theorem "CT-like" version inv(n) = n^(m-2) mod m is 30x slower.
  57. let a = mod(number, modulo);
  58. let b = modulo;
  59. // prettier-ignore
  60. let x = _0n, y = _1n, u = _1n, v = _0n;
  61. while (a !== _0n) {
  62. // JIT applies optimization if those two lines follow each other
  63. const q = b / a;
  64. const r = b % a;
  65. const m = x - u * q;
  66. const n = y - v * q;
  67. // prettier-ignore
  68. b = a, a = r, x = u, y = v, u = m, v = n;
  69. }
  70. const gcd = b;
  71. if (gcd !== _1n) throw new Error('invert: does not exist');
  72. return mod(x, modulo);
  73. }
  74. /**
  75. * Tonelli-Shanks square root search algorithm.
  76. * 1. https://eprint.iacr.org/2012/685.pdf (page 12)
  77. * 2. Square Roots from 1; 24, 51, 10 to Dan Shanks
  78. * Will start an infinite loop if field order P is not prime.
  79. * @param P field order
  80. * @returns function that takes field Fp (created from P) and number n
  81. */
  82. export function tonelliShanks(P: bigint) {
  83. // Legendre constant: used to calculate Legendre symbol (a | p),
  84. // which denotes the value of a^((p-1)/2) (mod p).
  85. // (a | p) ≡ 1 if a is a square (mod p)
  86. // (a | p) ≡ -1 if a is not a square (mod p)
  87. // (a | p) ≡ 0 if a ≡ 0 (mod p)
  88. const legendreC = (P - _1n) / _2n;
  89. let Q: bigint, S: number, Z: bigint;
  90. // Step 1: By factoring out powers of 2 from p - 1,
  91. // find q and s such that p - 1 = q*(2^s) with q odd
  92. for (Q = P - _1n, S = 0; Q % _2n === _0n; Q /= _2n, S++);
  93. // Step 2: Select a non-square z such that (z | p) ≡ -1 and set c ≡ zq
  94. for (Z = _2n; Z < P && pow(Z, legendreC, P) !== P - _1n; Z++);
  95. // Fast-path
  96. if (S === 1) {
  97. const p1div4 = (P + _1n) / _4n;
  98. return function tonelliFast<T>(Fp: IField<T>, n: T) {
  99. const root = Fp.pow(n, p1div4);
  100. if (!Fp.eql(Fp.sqr(root), n)) throw new Error('Cannot find square root');
  101. return root;
  102. };
  103. }
  104. // Slow-path
  105. const Q1div2 = (Q + _1n) / _2n;
  106. return function tonelliSlow<T>(Fp: IField<T>, n: T): T {
  107. // Step 0: Check that n is indeed a square: (n | p) should not be ≡ -1
  108. if (Fp.pow(n, legendreC) === Fp.neg(Fp.ONE)) throw new Error('Cannot find square root');
  109. let r = S;
  110. // TODO: will fail at Fp2/etc
  111. let g = Fp.pow(Fp.mul(Fp.ONE, Z), Q); // will update both x and b
  112. let x = Fp.pow(n, Q1div2); // first guess at the square root
  113. let b = Fp.pow(n, Q); // first guess at the fudge factor
  114. while (!Fp.eql(b, Fp.ONE)) {
  115. if (Fp.eql(b, Fp.ZERO)) return Fp.ZERO; // https://en.wikipedia.org/wiki/Tonelli%E2%80%93Shanks_algorithm (4. If t = 0, return r = 0)
  116. // Find m such b^(2^m)==1
  117. let m = 1;
  118. for (let t2 = Fp.sqr(b); m < r; m++) {
  119. if (Fp.eql(t2, Fp.ONE)) break;
  120. t2 = Fp.sqr(t2); // t2 *= t2
  121. }
  122. // NOTE: r-m-1 can be bigger than 32, need to convert to bigint before shift, otherwise there will be overflow
  123. const ge = Fp.pow(g, _1n << BigInt(r - m - 1)); // ge = 2^(r-m-1)
  124. g = Fp.sqr(ge); // g = ge * ge
  125. x = Fp.mul(x, ge); // x *= ge
  126. b = Fp.mul(b, g); // b *= g
  127. r = m;
  128. }
  129. return x;
  130. };
  131. }
  132. export function FpSqrt(P: bigint) {
  133. // NOTE: different algorithms can give different roots, it is up to user to decide which one they want.
  134. // For example there is FpSqrtOdd/FpSqrtEven to choice root based on oddness (used for hash-to-curve).
  135. // P ≡ 3 (mod 4)
  136. // √n = n^((P+1)/4)
  137. if (P % _4n === _3n) {
  138. // Not all roots possible!
  139. // const ORDER =
  140. // 0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaabn;
  141. // const NUM = 72057594037927816n;
  142. const p1div4 = (P + _1n) / _4n;
  143. return function sqrt3mod4<T>(Fp: IField<T>, n: T) {
  144. const root = Fp.pow(n, p1div4);
  145. // Throw if root**2 != n
  146. if (!Fp.eql(Fp.sqr(root), n)) throw new Error('Cannot find square root');
  147. return root;
  148. };
  149. }
  150. // Atkin algorithm for q ≡ 5 (mod 8), https://eprint.iacr.org/2012/685.pdf (page 10)
  151. if (P % _8n === _5n) {
  152. const c1 = (P - _5n) / _8n;
  153. return function sqrt5mod8<T>(Fp: IField<T>, n: T) {
  154. const n2 = Fp.mul(n, _2n);
  155. const v = Fp.pow(n2, c1);
  156. const nv = Fp.mul(n, v);
  157. const i = Fp.mul(Fp.mul(nv, _2n), v);
  158. const root = Fp.mul(nv, Fp.sub(i, Fp.ONE));
  159. if (!Fp.eql(Fp.sqr(root), n)) throw new Error('Cannot find square root');
  160. return root;
  161. };
  162. }
  163. // P ≡ 9 (mod 16)
  164. if (P % _16n === _9n) {
  165. // NOTE: tonelli is too slow for bls-Fp2 calculations even on start
  166. // Means we cannot use sqrt for constants at all!
  167. //
  168. // const c1 = Fp.sqrt(Fp.negate(Fp.ONE)); // 1. c1 = sqrt(-1) in F, i.e., (c1^2) == -1 in F
  169. // const c2 = Fp.sqrt(c1); // 2. c2 = sqrt(c1) in F, i.e., (c2^2) == c1 in F
  170. // const c3 = Fp.sqrt(Fp.negate(c1)); // 3. c3 = sqrt(-c1) in F, i.e., (c3^2) == -c1 in F
  171. // const c4 = (P + _7n) / _16n; // 4. c4 = (q + 7) / 16 # Integer arithmetic
  172. // sqrt = (x) => {
  173. // let tv1 = Fp.pow(x, c4); // 1. tv1 = x^c4
  174. // let tv2 = Fp.mul(c1, tv1); // 2. tv2 = c1 * tv1
  175. // const tv3 = Fp.mul(c2, tv1); // 3. tv3 = c2 * tv1
  176. // let tv4 = Fp.mul(c3, tv1); // 4. tv4 = c3 * tv1
  177. // const e1 = Fp.equals(Fp.square(tv2), x); // 5. e1 = (tv2^2) == x
  178. // const e2 = Fp.equals(Fp.square(tv3), x); // 6. e2 = (tv3^2) == x
  179. // tv1 = Fp.cmov(tv1, tv2, e1); // 7. tv1 = CMOV(tv1, tv2, e1) # Select tv2 if (tv2^2) == x
  180. // tv2 = Fp.cmov(tv4, tv3, e2); // 8. tv2 = CMOV(tv4, tv3, e2) # Select tv3 if (tv3^2) == x
  181. // const e3 = Fp.equals(Fp.square(tv2), x); // 9. e3 = (tv2^2) == x
  182. // return Fp.cmov(tv1, tv2, e3); // 10. z = CMOV(tv1, tv2, e3) # Select the sqrt from tv1 and tv2
  183. // }
  184. }
  185. // Other cases: Tonelli-Shanks algorithm
  186. return tonelliShanks(P);
  187. }
  188. // Little-endian check for first LE bit (last BE bit);
  189. export const isNegativeLE = (num: bigint, modulo: bigint) => (mod(num, modulo) & _1n) === _1n;
  190. // Field is not always over prime: for example, Fp2 has ORDER(q)=p^m
  191. export interface IField<T> {
  192. ORDER: bigint;
  193. BYTES: number;
  194. BITS: number;
  195. MASK: bigint;
  196. ZERO: T;
  197. ONE: T;
  198. // 1-arg
  199. create: (num: T) => T;
  200. isValid: (num: T) => boolean;
  201. is0: (num: T) => boolean;
  202. neg(num: T): T;
  203. inv(num: T): T;
  204. sqrt(num: T): T;
  205. sqr(num: T): T;
  206. // 2-args
  207. eql(lhs: T, rhs: T): boolean;
  208. add(lhs: T, rhs: T): T;
  209. sub(lhs: T, rhs: T): T;
  210. mul(lhs: T, rhs: T | bigint): T;
  211. pow(lhs: T, power: bigint): T;
  212. div(lhs: T, rhs: T | bigint): T;
  213. // N for NonNormalized (for now)
  214. addN(lhs: T, rhs: T): T;
  215. subN(lhs: T, rhs: T): T;
  216. mulN(lhs: T, rhs: T | bigint): T;
  217. sqrN(num: T): T;
  218. // Optional
  219. // Should be same as sgn0 function in
  220. // [RFC9380](https://www.rfc-editor.org/rfc/rfc9380#section-4.1).
  221. // NOTE: sgn0 is 'negative in LE', which is same as odd. And negative in LE is kinda strange definition anyway.
  222. isOdd?(num: T): boolean; // Odd instead of even since we have it for Fp2
  223. // legendre?(num: T): T;
  224. pow(lhs: T, power: bigint): T;
  225. invertBatch: (lst: T[]) => T[];
  226. toBytes(num: T): Uint8Array;
  227. fromBytes(bytes: Uint8Array): T;
  228. // If c is False, CMOV returns a, otherwise it returns b.
  229. cmov(a: T, b: T, c: boolean): T;
  230. }
  231. // prettier-ignore
  232. const FIELD_FIELDS = [
  233. 'create', 'isValid', 'is0', 'neg', 'inv', 'sqrt', 'sqr',
  234. 'eql', 'add', 'sub', 'mul', 'pow', 'div',
  235. 'addN', 'subN', 'mulN', 'sqrN'
  236. ] as const;
  237. export function validateField<T>(field: IField<T>) {
  238. const initial = {
  239. ORDER: 'bigint',
  240. MASK: 'bigint',
  241. BYTES: 'isSafeInteger',
  242. BITS: 'isSafeInteger',
  243. } as Record<string, string>;
  244. const opts = FIELD_FIELDS.reduce((map, val: string) => {
  245. map[val] = 'function';
  246. return map;
  247. }, initial);
  248. return validateObject(field, opts);
  249. }
  250. // Generic field functions
  251. /**
  252. * Same as `pow` but for Fp: non-constant-time.
  253. * Unsafe in some contexts: uses ladder, so can expose bigint bits.
  254. */
  255. export function FpPow<T>(f: IField<T>, num: T, power: bigint): T {
  256. // Should have same speed as pow for bigints
  257. // TODO: benchmark!
  258. if (power < _0n) throw new Error('Expected power > 0');
  259. if (power === _0n) return f.ONE;
  260. if (power === _1n) return num;
  261. let p = f.ONE;
  262. let d = num;
  263. while (power > _0n) {
  264. if (power & _1n) p = f.mul(p, d);
  265. d = f.sqr(d);
  266. power >>= _1n;
  267. }
  268. return p;
  269. }
  270. /**
  271. * Efficiently invert an array of Field elements.
  272. * `inv(0)` will return `undefined` here: make sure to throw an error.
  273. */
  274. export function FpInvertBatch<T>(f: IField<T>, nums: T[]): T[] {
  275. const tmp = new Array(nums.length);
  276. // Walk from first to last, multiply them by each other MOD p
  277. const lastMultiplied = nums.reduce((acc, num, i) => {
  278. if (f.is0(num)) return acc;
  279. tmp[i] = acc;
  280. return f.mul(acc, num);
  281. }, f.ONE);
  282. // Invert last element
  283. const inverted = f.inv(lastMultiplied);
  284. // Walk from last to first, multiply them by inverted each other MOD p
  285. nums.reduceRight((acc, num, i) => {
  286. if (f.is0(num)) return acc;
  287. tmp[i] = f.mul(acc, tmp[i]);
  288. return f.mul(acc, num);
  289. }, inverted);
  290. return tmp;
  291. }
  292. export function FpDiv<T>(f: IField<T>, lhs: T, rhs: T | bigint): T {
  293. return f.mul(lhs, typeof rhs === 'bigint' ? invert(rhs, f.ORDER) : f.inv(rhs));
  294. }
  295. // This function returns True whenever the value x is a square in the field F.
  296. export function FpIsSquare<T>(f: IField<T>) {
  297. const legendreConst = (f.ORDER - _1n) / _2n; // Integer arithmetic
  298. return (x: T): boolean => {
  299. const p = f.pow(x, legendreConst);
  300. return f.eql(p, f.ZERO) || f.eql(p, f.ONE);
  301. };
  302. }
  303. // CURVE.n lengths
  304. export function nLength(n: bigint, nBitLength?: number) {
  305. // Bit size, byte size of CURVE.n
  306. const _nBitLength = nBitLength !== undefined ? nBitLength : n.toString(2).length;
  307. const nByteLength = Math.ceil(_nBitLength / 8);
  308. return { nBitLength: _nBitLength, nByteLength };
  309. }
  310. type FpField = IField<bigint> & Required<Pick<IField<bigint>, 'isOdd'>>;
  311. /**
  312. * Initializes a finite field over prime. **Non-primes are not supported.**
  313. * Do not init in loop: slow. Very fragile: always run a benchmark on a change.
  314. * Major performance optimizations:
  315. * * a) denormalized operations like mulN instead of mul
  316. * * b) same object shape: never add or remove keys
  317. * * c) Object.freeze
  318. * @param ORDER prime positive bigint
  319. * @param bitLen how many bits the field consumes
  320. * @param isLE (def: false) if encoding / decoding should be in little-endian
  321. * @param redef optional faster redefinitions of sqrt and other methods
  322. */
  323. export function Field(
  324. ORDER: bigint,
  325. bitLen?: number,
  326. isLE = false,
  327. redef: Partial<IField<bigint>> = {}
  328. ): Readonly<FpField> {
  329. if (ORDER <= _0n) throw new Error(`Expected Field ORDER > 0, got ${ORDER}`);
  330. const { nBitLength: BITS, nByteLength: BYTES } = nLength(ORDER, bitLen);
  331. if (BYTES > 2048) throw new Error('Field lengths over 2048 bytes are not supported');
  332. const sqrtP = FpSqrt(ORDER);
  333. const f: Readonly<FpField> = Object.freeze({
  334. ORDER,
  335. BITS,
  336. BYTES,
  337. MASK: bitMask(BITS),
  338. ZERO: _0n,
  339. ONE: _1n,
  340. create: (num) => mod(num, ORDER),
  341. isValid: (num) => {
  342. if (typeof num !== 'bigint')
  343. throw new Error(`Invalid field element: expected bigint, got ${typeof num}`);
  344. return _0n <= num && num < ORDER; // 0 is valid element, but it's not invertible
  345. },
  346. is0: (num) => num === _0n,
  347. isOdd: (num) => (num & _1n) === _1n,
  348. neg: (num) => mod(-num, ORDER),
  349. eql: (lhs, rhs) => lhs === rhs,
  350. sqr: (num) => mod(num * num, ORDER),
  351. add: (lhs, rhs) => mod(lhs + rhs, ORDER),
  352. sub: (lhs, rhs) => mod(lhs - rhs, ORDER),
  353. mul: (lhs, rhs) => mod(lhs * rhs, ORDER),
  354. pow: (num, power) => FpPow(f, num, power),
  355. div: (lhs, rhs) => mod(lhs * invert(rhs, ORDER), ORDER),
  356. // Same as above, but doesn't normalize
  357. sqrN: (num) => num * num,
  358. addN: (lhs, rhs) => lhs + rhs,
  359. subN: (lhs, rhs) => lhs - rhs,
  360. mulN: (lhs, rhs) => lhs * rhs,
  361. inv: (num) => invert(num, ORDER),
  362. sqrt: redef.sqrt || ((n) => sqrtP(f, n)),
  363. invertBatch: (lst) => FpInvertBatch(f, lst),
  364. // TODO: do we really need constant cmov?
  365. // We don't have const-time bigints anyway, so probably will be not very useful
  366. cmov: (a, b, c) => (c ? b : a),
  367. toBytes: (num) => (isLE ? numberToBytesLE(num, BYTES) : numberToBytesBE(num, BYTES)),
  368. fromBytes: (bytes) => {
  369. if (bytes.length !== BYTES)
  370. throw new Error(`Fp.fromBytes: expected ${BYTES}, got ${bytes.length}`);
  371. return isLE ? bytesToNumberLE(bytes) : bytesToNumberBE(bytes);
  372. },
  373. } as FpField);
  374. return Object.freeze(f);
  375. }
  376. export function FpSqrtOdd<T>(Fp: IField<T>, elm: T) {
  377. if (!Fp.isOdd) throw new Error(`Field doesn't have isOdd`);
  378. const root = Fp.sqrt(elm);
  379. return Fp.isOdd(root) ? root : Fp.neg(root);
  380. }
  381. export function FpSqrtEven<T>(Fp: IField<T>, elm: T) {
  382. if (!Fp.isOdd) throw new Error(`Field doesn't have isOdd`);
  383. const root = Fp.sqrt(elm);
  384. return Fp.isOdd(root) ? Fp.neg(root) : root;
  385. }
  386. /**
  387. * "Constant-time" private key generation utility.
  388. * Same as mapKeyToField, but accepts less bytes (40 instead of 48 for 32-byte field).
  389. * Which makes it slightly more biased, less secure.
  390. * @deprecated use mapKeyToField instead
  391. */
  392. export function hashToPrivateScalar(
  393. hash: string | Uint8Array,
  394. groupOrder: bigint,
  395. isLE = false
  396. ): bigint {
  397. hash = ensureBytes('privateHash', hash);
  398. const hashLen = hash.length;
  399. const minLen = nLength(groupOrder).nByteLength + 8;
  400. if (minLen < 24 || hashLen < minLen || hashLen > 1024)
  401. throw new Error(`hashToPrivateScalar: expected ${minLen}-1024 bytes of input, got ${hashLen}`);
  402. const num = isLE ? bytesToNumberLE(hash) : bytesToNumberBE(hash);
  403. return mod(num, groupOrder - _1n) + _1n;
  404. }
  405. /**
  406. * Returns total number of bytes consumed by the field element.
  407. * For example, 32 bytes for usual 256-bit weierstrass curve.
  408. * @param fieldOrder number of field elements, usually CURVE.n
  409. * @returns byte length of field
  410. */
  411. export function getFieldBytesLength(fieldOrder: bigint): number {
  412. if (typeof fieldOrder !== 'bigint') throw new Error('field order must be bigint');
  413. const bitLength = fieldOrder.toString(2).length;
  414. return Math.ceil(bitLength / 8);
  415. }
  416. /**
  417. * Returns minimal amount of bytes that can be safely reduced
  418. * by field order.
  419. * Should be 2^-128 for 128-bit curve such as P256.
  420. * @param fieldOrder number of field elements, usually CURVE.n
  421. * @returns byte length of target hash
  422. */
  423. export function getMinHashLength(fieldOrder: bigint): number {
  424. const length = getFieldBytesLength(fieldOrder);
  425. return length + Math.ceil(length / 2);
  426. }
  427. /**
  428. * "Constant-time" private key generation utility.
  429. * Can take (n + n/2) or more bytes of uniform input e.g. from CSPRNG or KDF
  430. * and convert them into private scalar, with the modulo bias being negligible.
  431. * Needs at least 48 bytes of input for 32-byte private key.
  432. * https://research.kudelskisecurity.com/2020/07/28/the-definitive-guide-to-modulo-bias-and-how-to-avoid-it/
  433. * FIPS 186-5, A.2 https://csrc.nist.gov/publications/detail/fips/186/5/final
  434. * RFC 9380, https://www.rfc-editor.org/rfc/rfc9380#section-5
  435. * @param hash hash output from SHA3 or a similar function
  436. * @param groupOrder size of subgroup - (e.g. secp256k1.CURVE.n)
  437. * @param isLE interpret hash bytes as LE num
  438. * @returns valid private scalar
  439. */
  440. export function mapHashToField(key: Uint8Array, fieldOrder: bigint, isLE = false): Uint8Array {
  441. const len = key.length;
  442. const fieldLen = getFieldBytesLength(fieldOrder);
  443. const minLen = getMinHashLength(fieldOrder);
  444. // No small numbers: need to understand bias story. No huge numbers: easier to detect JS timings.
  445. if (len < 16 || len < minLen || len > 1024)
  446. throw new Error(`expected ${minLen}-1024 bytes of input, got ${len}`);
  447. const num = isLE ? bytesToNumberBE(key) : bytesToNumberLE(key);
  448. // `mod(x, 11)` can sometimes produce 0. `mod(x, 10) + 1` is the same, but no 0
  449. const reduced = mod(num, fieldOrder - _1n) + _1n;
  450. return isLE ? numberToBytesLE(reduced, fieldLen) : numberToBytesBE(reduced, fieldLen);
  451. }