-
Notifications
You must be signed in to change notification settings - Fork 405
Description
CosmJS was originally built to power wallets, but this is not something it was used for a lot. This makes the secure key storage a feature that is expensive to maintain and providing little value. In particular I would like to remove Argon2 KDF which is used by
Secp256k1HdWallet.serializeSecp256k1HdWallet.deserializeDirectSecp256k1HdWallet.serializeDirectSecp256k1HdWallet.deserialize
The problem witth Argon2 (and potentially any other KDF without native crypto API support) is: it requires an embedded Wasm implementation to be reasonably fast and even then it is 8x slower in Wasm compared to a native implementation, leading to an 8x advantage for attackers. If we want to get rid of that Wasm blob, we need to use a pure-JS implementation which is much slower.
Assuming nobody or almost nobody uses the functions above, we can remove all Argon2 implementation in CosmJS migrate aways from libsodium.
Wallets can still use most of the functionality just as before but need to implement the secure storage of keys or mnemonics themselves.
If you know any team that uses CosmJS for key storage via the above functions, please let us know here. If we don't hear anything we will assume it can be removed.