Remove wallet encryption features and ed25519 crypto

[webmaster128]

CosmJS was designed to be used for secure key storage required by wallets, but I am not aware of a user who uses CosmJS for that. Removing the following features would reduce maintenance cost and bundle size:

• Remove Argon2 implementation (required for deriving encryption keys from a password)
• Remove symmetric encryption (Xchacha20poly1305Ietf)
• Remove all Ed25519 crypto

This affects {Direct,}Secp256k1{Hd,}Wallet.{serialize,deserialize}. Users of those features would need to implement secure key storage on their own.

As a result, we don't need the libsodium-wrappers-sumo dependency anymore (big Wasm blob) and remove a lot of code to maintain.

Closes

• Find strategy to remove libsodium being bundled #1478
• Find more lightweight libraries to replace libsodium.js #1031
• Switch Ed25519 implementation to zip215 compliant library #584
• Generate and store salt #903 / directsecp256k1hdwallet encryption improvements #906

[paulmillr]

maybe you can just remove useless stuff like: bn.js, elliptic, libsodium-wrappers, and replace it with noble/{curves,ciphers}, which would allow to keep all the features, reduce bundle size massively, switch from wasm to js, and implement zip215 support

[dynst]

Can either removing encryption or just doing #1031 #1585 be on the roadmap for 0.35?

The two libsodium packages together are more than 37% of the bundled size of stargate.

https://bundlephobia.com/package/@cosmjs/stargate@0.34.0

@stablelib/xchacha20poly1305 is much smaller.

https://bundlephobia.com/package/@stablelib/xchacha20poly1305@2.0.1

[webmaster128]

Libsodium was refactored away which is great. Thanks everyone for those efforts!

I don't see how a pure-JS implementation of Argon2 can ever give us sufficient speed for production grade software. So even after heavy modernization of dependencies we still have a Wasm blob from hash-wasm in here. And that is a feature no web app needs but only wallets need.

In any case there are two topics in this ticket which we should split:

• Removal of wallet encryption is in Who uses CosmJS' wallet serialization/deserialization? #1796
• Removal of Ed25519 crypto is not a priority right now. If it becomes one, it should get its own ticket.

Cosing here