MetaMask / MetaMask/metamask-extension
Switch to more secure & faster secp256k1 library, shave-off 90kb
- Dominant language
- TypeScript
- Stars
- 13.2k
- Forks
- 5.6k
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 451
Description
Hi! I've created [noble-secp256k1](https://github.com/paulmillr/noble-secp256k1) one year ago. The goal was to create an extremely simple zero-dependency library. With all the optimizations, even though it's just <1kloc, it's actually **faster** than elliptic — which you're using right now:
```
noble#sign x 3,952 ops/sec
elliptic#sign x 1,808 ops/sec
noble#verify x 851 ops/sec
elliptic#verify x 812 ops/sec
```
The reasoning behind the creation was that more and more dependencies are used in all kinds of projects, and there is a huge need in reducing the number — because any dep could get hacked, and it becomes complex to verify the source code by hand. Check out the blog post: https://paulmillr.com/posts/noble-secp256k1-fast-ecc/
- noble secp is [10kb minified](https://bundlephobia.com/result?p=noble-secp256k1@1.0.6), while your current elliptic + bn.js is ~100kb, you'll save 90kb — which is a lot
- noble was audited by Cure53. Elliptic was not audited, so noble should be considered more secure
- elliptic [does not seem to be maintained](https://github.com/indutny/elliptic/issues). Elliptic recently had terrible private key leak (CVE-2020-28498)
- you'll receive faster signatures and verification
I strongly recommend switching to noble. I can prepare a pull request.
Contributor guide
Research direction
Start by locating the current elliptic and bn.js usage and compare the required interfaces with noble-secp256k1. Done means the existing dependency path is replaced without changing signing or verification behavior, while preserving the reported bundle-size and performance benefits.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, typescript
- Domain
- blockchain, cryptography
- Issue type
- Refactor
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100