Skip to content

Who uses CosmJS' wallet serialization/deserialization? #1796

@webmaster128

Description

@webmaster128

CosmJS was originally built to power wallets, but this is not something it was used for a lot. This makes the secure key storage a feature that is expensive to maintain and providing little value. In particular I would like to remove Argon2 KDF which is used by

  • Secp256k1HdWallet.serialize
  • Secp256k1HdWallet.deserialize
  • DirectSecp256k1HdWallet.serialize
  • DirectSecp256k1HdWallet.deserialize

The problem witth Argon2 (and potentially any other KDF without native crypto API support) is: it requires an embedded Wasm implementation to be reasonably fast and even then it is 8x slower in Wasm compared to a native implementation, leading to an 8x advantage for attackers. If we want to get rid of that Wasm blob, we need to use a pure-JS implementation which is much slower.

Assuming nobody or almost nobody uses the functions above, we can remove all Argon2 implementation in CosmJS migrate aways from libsodium.

Wallets can still use most of the functionality just as before but need to implement the secure storage of keys or mnemonics themselves.

If you know any team that uses CosmJS for key storage via the above functions, please let us know here. If we don't hear anything we will assume it can be removed.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions