noir-security

Cryptography

Elliptic Curves

• BigCurve - operations over elliptic curves instantiated with an arbitrary prime field
• Pairing over BLS12-381 - Pairing over BLS12-381

Hashes

• Keccak256 - Keccak256 hashes
• MiMC - MiMC hashes
• Poseidon - Poseidon and Poseidon2 hashes
• RIPEMD160 - RIPEMD160 hashes
• SHA256 - SHA256 hashes
• SHA512 - SHA512 and SHA384 hashes

Encryption

• AES - a (naive) implementation of AES encryption and decryption
• ChaCha20 Implementation - a Noir implementation of ChaCha20 as defined by RFC7539
• ElGamal Encryption - Exponential ElGamal Encryption on the Baby Jubjub curve
• Hydra for BN254 - symmetric encryption and decryption
• ECIES - simple implementation of ECIES on the Baby Jubjub curve
• ECDH - simple implementation of ECDH on the Baby Jubjub curve

Signatures

• BLS12_381 Elliptic Curve Pairing and Signature Verification Library
• EdDSA - EdDSA signature verification
• ECDSA - ECDSA (NIST and Brainpool curves) signature verification
• JWT - Verification of JSON Web Tokens (JWTs) and prove claims
• PLUME - ECDSA-based nullifiers
• RSA - RSA signature verification
• Schnorr - Schnorr signature verification
• WebAuthn/Passkeys - Verification of WebAuthn/Passkeys signatures; verifies signatures produced by credentials.get

Merkle Trees

• ZK-Kit: Merkle Trees - verification of (non-)membership proofs and add/update/delete leaves
• Indexed Merkle Tree - Generate and verify proofs of inclusion, exclusion, or insert transition, includes complementary NPM package
• Merkle Tree - Merkle Tree implementations forked from Aztec Packages

Message Authentication Code

• Noir HMAC - hash-based message authentication code

Randomness

• Cryptographically Secure Pseudo-Random Number Generator - pseudo-random number generation

Security

• rocq-of-noir - formal verification of Noir programs with Rocq
• lampe - formal verification of Noir programs with Lean
• hunter - mutation-testing of Noir programs
• zk-mutant - mutation testing for Noir programs (source-level), running nargo test against small mutations to assess test-suite effectiveness
• Circuzz fuzzer - fuzzer for finding soundness and completeness issues in the Noir infrastructure (by Consensys Diligence and TU Vienna)
• noir-metrics - source code metrics for Noir programs, with JSON output designed for audits, tooling, and mutation testing

Security

• [Workshop] Circuit Safety and an Introduction to Noir - common ZK vulnerabilities and an introduction to Noir
• [Workshop] Noir Xmas Camp: Circuit Security & Production Readiness with Noir
• [Workshop] NoirCon 2: Lampe - formal verification of Noir programs in Lean