Contract Address Details

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.28;

/// @title SRA — commutative-encryption verification primitives
/// @notice On-chain half of the SRA mental-poker protocol (SPEC §2). All
///         deck values are 1024-bit big-endian byte strings (quadratic
///         residues mod P); all exponent checks run forward through the
///         MODEXP precompile. Mirrors web/js/sra.mjs.
library SRA {
    /// RFC 2409 Oakley Group 2 prime (1024-bit safe prime), big-endian words.
    uint256 internal constant P0 = 0xFFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74;
    uint256 internal constant P1 = 0x020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F1437;
    uint256 internal constant P2 = 0x4FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7ED;
    uint256 internal constant P3 = 0xEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE65381FFFFFFFFFFFFFFFF;

    uint256 internal constant VALUE_BYTES = 128;
    uint256 internal constant DECK = 52;

    /// @dev P as a 128-byte string (for the precompile modulus field).
    function pBytes() internal pure returns (bytes memory out) {
        out = new bytes(128);
        assembly ("memory-safe") {
            mstore(add(out, 32), P0)
            mstore(add(out, 64), P1)
            mstore(add(out, 96), P2)
            mstore(add(out, 128), P3)
        }
    }

    /// @notice base^exp mod P with a 32-byte exponent; returns 128-byte result.
    function modexp32(bytes memory base128, uint256 exp) public view returns (bytes memory) {
        return _modexp(base128, abi.encodePacked(exp));
    }

    /// @notice base^(e1*e2) mod P (512-bit exponent product of two scalars).
    function modexpMul(bytes memory base128, uint256 e1, uint256 e2)
        public view returns (bytes memory)
    {
        (uint256 hi, uint256 lo) = mul512(e1, e2);
        return _modexp(base128, abi.encodePacked(hi, lo));
    }

    /// @dev Full 512-bit product of two uint256.
    function mul512(uint256 a, uint256 b) internal pure returns (uint256 hi, uint256 lo) {
        unchecked {
            lo = a * b;
            uint256 mm = mulmod(a, b, type(uint256).max);
            hi = mm - lo;
            if (mm < lo) hi--;
        }
    }

    /// @dev MODEXP precompile call; base must be 128 bytes; mod = P.
    function _modexp(bytes memory base128, bytes memory exp)
        private view returns (bytes memory result)
    {
        require(base128.length == 128, "base len");
        bytes memory input = abi.encodePacked(
            uint256(128), uint256(exp.length), uint256(128), base128, exp, pBytes()
        );
        result = new bytes(128);
        bool ok;
        assembly ("memory-safe") {
            ok := staticcall(gas(), 0x05, add(input, 32), mload(input), add(result, 32), 128)
        }
        require(ok, "modexp failed");
    }

    /// @notice keccak of base^exp mod P — cheap equality comparisons.
    function modexpHash32(bytes memory base128, uint256 exp) public view returns (bytes32) {
        return keccak256(modexp32(base128, exp));
    }

    /// @notice base^exp mod P with an arbitrary-length exponent (used for
    ///         1024-bit inverse exponents in dispute round-trips).
    function modexpBytes(bytes memory base128, bytes memory exp) public view returns (bytes memory) {
        return _modexp(base128, exp);
    }

    /// @notice Deterministic card code for k in [0,52): full-size QR mod P.
    /// @dev h = BE(keccak(TAG‖k‖0)‖…‖keccak(TAG‖k‖3)); code = h^2 mod P.
    ///      Mirrors sra.mjs cardCode().
    function cardCode(uint8 k) public view returns (bytes memory) {
        require(k < DECK, "bad card");
        bytes memory h = new bytes(128);
        bytes memory tag = "PLSHOLDEM_CARD_V1";
        for (uint8 ctr = 0; ctr < 4; ctr++) {
            bytes32 part = keccak256(abi.encodePacked(tag, k, ctr));
            assembly ("memory-safe") {
                mstore(add(add(h, 32), mul(ctr, 32)), part)
            }
        }
        return _modexp(h, hex"02");
    }

    /// @notice keccak of cardCode(k).
    function cardCodeHash(uint8 k) internal view returns (bytes32) {
        return keccak256(cardCode(k));
    }

    /// @notice Find the card index whose code hashes to `h`; 255 if none.
    function cardFromHash(bytes32 h) public view returns (uint8) {
        for (uint8 k = 0; k < DECK; k++) {
            if (cardCodeHash(k) == h) return k;
        }
        return 255;
    }

    /// @notice Extract 128-byte value i from a packed 52-value deck blob.
    function deckValue(bytes calldata deck, uint256 i) internal pure returns (bytes memory v) {
        v = deck[i * VALUE_BYTES:(i + 1) * VALUE_BYTES];
    }

    /// @notice Validate a posted deck stage: exactly 52 values, each in
    ///         (1, P-1), all distinct. Reverts otherwise.
    function checkDeck(bytes calldata deck) public pure {
        require(deck.length == DECK * VALUE_BYTES, "deck len");
        bytes32[DECK] memory hashes;
        for (uint256 i = 0; i < DECK; i++) {
            uint256 off = i * VALUE_BYTES;
            uint256 w0;
            uint256 w1;
            uint256 w2;
            uint256 w3;
            assembly ("memory-safe") {
                w0 := calldataload(add(deck.offset, off))
                w1 := calldataload(add(deck.offset, add(off, 32)))
                w2 := calldataload(add(deck.offset, add(off, 64)))
                w3 := calldataload(add(deck.offset, add(off, 96)))
            }
            require(inRange(w0, w1, w2, w3), "value range");
            bytes32 h = keccak256(abi.encodePacked(w0, w1, w2, w3));
            for (uint256 j = 0; j < i; j++) {
                require(hashes[j] != h, "duplicate value");
            }
            hashes[i] = h;
        }
    }

    /// @dev true iff 1 < v < P-1 for v given as 4 big-endian words.
    function inRange(uint256 w0, uint256 w1, uint256 w2, uint256 w3) internal pure returns (bool) {
        // v > 1
        if (w0 == 0 && w1 == 0 && w2 == 0 && w3 <= 1) return false;
        // v < P - 1  (P3 ends in ...FFFF, so P-1 differs only in last word)
        if (w0 < P0) return true;
        if (w0 > P0) return false;
        if (w1 < P1) return true;
        if (w1 > P1) return false;
        if (w2 < P2) return true;
        if (w2 > P2) return false;
        return w3 < P3 - 1;
    }

    /// @notice Range-check a 128-byte memory value (used for proven values).
    function inRangeMem(bytes memory v) internal pure returns (bool) {
        require(v.length == 128, "len");
        uint256 w0;
        uint256 w1;
        uint256 w2;
        uint256 w3;
        assembly ("memory-safe") {
            w0 := mload(add(v, 32))
            w1 := mload(add(v, 64))
            w2 := mload(add(v, 96))
            w3 := mload(add(v, 128))
        }
        return inRange(w0, w1, w2, w3);
    }

    /// @dev Scalar exponent sanity: odd (invertible mod P-1) and nonzero.
    function validScalar(uint256 e) internal pure returns (bool) {
        return e & 1 == 1 && e > 1;
    }
}