// Each participant must prove knowledge of secret key
fn generateProofOfPossession(secret_key: Fr, public_key: G1Point) G2Point {
    // Sign the public key itself
    const pop_message = Bls12381.G2.hashToCurve(public_key.serialize(), "BLS_POP_");
    return Bls12381.G2.mul(pop_message, secret_key);
}

fn verifyProofOfPossession(public_key: G1Point, pop: G2Point) bool {
    const pop_message = Bls12381.G2.hashToCurve(public_key.serialize(), "BLS_POP_");
    return Bls12381.Pairing.verify(public_key, pop_message, pop);
}

fn validateG1Point(point: G1Point) !void {
    // Check point is on curve
    if (!Bls12381.G1.isOnCurve(point)) {
        return error.PointNotOnCurve;
    }
    // Check point is in prime-order subgroup
    if (!Bls12381.G1.isInSubgroup(point)) {
        return error.PointNotInSubgroup;
    }
}

// ✅ Constant-time scalar multiplication
fn scalarMul(point: G1Point, scalar: Fr) G1Point {
    // Double-and-add with constant iterations
    var result = G1Point.identity();
    var temp = point;

    for (0..256) |i| {
        // Constant-time conditional add
        const bit = (scalar >> i) & 1;
        result = constantTimeSelect(bit,
            Bls12381.G1.add(result, temp),
            result
        );
        temp = Bls12381.G1.double(temp);
    }
    return result;
}

// ❌ BAD: Variable-time lookup
fn badLookup(table: []G1Point, index: usize) G1Point {
    return table[index]; // Timing leak!
}

// ✅ GOOD: Constant-time lookup
fn constantTimeLookup(table: []G1Point, index: usize) G1Point {
    var result = G1Point.identity();
    for (table, 0..) |point, i| {
        const mask = constantTimeEquals(i, index);
        result = constantTimeSelect(mask, point, result);
    }
    return result;
}

// Ethereum consensus domains
const DOMAIN_BEACON_PROPOSER = 0x00000000;
const DOMAIN_BEACON_ATTESTER = 0x01000000;
const DOMAIN_RANDAO = 0x02000000;
const DOMAIN_DEPOSIT = 0x03000000;
const DOMAIN_VOLUNTARY_EXIT = 0x04000000;
const DOMAIN_SYNC_COMMITTEE = 0x07000000;

fn computeDomain(domain_type: u32, fork_version: [4]u8, genesis_root: [32]u8) [32]u8 {
    const fork_data_root = hashTreeRoot(ForkData{
        .current_version = fork_version,
        .genesis_validators_root = genesis_root,
    });
    var domain: [32]u8 = undefined;
    @memcpy(domain[0..4], @bitCast([4]u8, domain_type));
    @memcpy(domain[4..32], fork_data_root[0..28]);
    return domain;
}

// ❌ UNSAFE: Aggregating signatures over different messages
fn unsafeAggregate(sigs: []G2Point) G2Point {
    // This allows forgery attacks!
    return sumG2Points(sigs);
}

// ✅ SAFE: Only aggregate same-message signatures
fn safeAggregate(
    message: []const u8,
    public_keys: []G1Point,
    signatures: []G2Point,
) !AggregatedSignature {
    // Verify each signature first
    for (public_keys, signatures) |pk, sig| {
        if (!verify(pk, message, sig)) {
            return error.InvalidSignature;
        }
    }
    return AggregatedSignature{
        .public_keys = public_keys,
        .signature = sumG2Points(signatures),
    };
}