Skip to content

migrate off libsodium #1722

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 5 commits into
base: main
Choose a base branch
from
Open

migrate off libsodium #1722

wants to merge 5 commits into from

Conversation

dynst
Copy link
Contributor

@dynst dynst commented Jul 20, 2025

This removes a WebAssembly dependency and a huge chunk of bundle size https://bundlephobia.com/package/@cosmjs/[email protected]

(The other, even more huge chunk is cosmos/cosmjs-types#98)

Closes #584
Closes #907
Closes #964
Closes #1031
Closes #1478
Closes #1585

Related: #1479

Technically, now that there's no longer a quirky requirement to await sodium.ready at the start of every function, asynchronous methods could be made synchronous now after this PR.

Considered but rejected a faster alternative to @noble/hashes Argon2id https://bundlephobia.com/package/[email protected] https://www.npmjs.com/package/@node-rs/argon2

But hopefully it just gets standardized in Web Crypto someday and then implemented by Node.js. https://twiss.github.io/webcrypto-modern-algos/#argon2

@dynst dynst force-pushed the desalinate branch 9 times, most recently from db7bc41 to 28c2583 Compare July 21, 2025 16:45
@dynst
Copy link
Contributor Author

dynst commented Jul 22, 2025

This conflicts with #1720 but let's get that one merged first.

@dynst dynst force-pushed the desalinate branch 2 times, most recently from 033cdf5 to c4da581 Compare July 23, 2025 15:50
@dynst
Copy link
Contributor Author

dynst commented Aug 7, 2025

This seems like really low-hanging fruit for a massive reduction in bundle size, is it not gonna make it into 0.35?

@webmaster128
Copy link
Member

Looks straight forward at first glance. However, I would be very surprised if the pure-JS implementation of Argon2 is as fast as the WebAssembly one. So this PR has the potential to hit existing users hard. Which then leads to the questions: who uses CosmJS pro private key encryption at all? Should we remove that functionality alltogether?

@dynst
Copy link
Contributor Author

dynst commented Aug 7, 2025

I thought if it was going to be removed it already would've been.

Releasing a slower version could make for a good scream test. Maybe mark all the types with @deprecated for one release to see if anyone complains.

https://www.typescriptlang.org/docs/handbook/jsdoc-supported-types.html#deprecated

Or just switch to hash-wasm instead of libsodium or noble cryptography for a fast but much smaller Argon2id implementation.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
2 participants