MetaMask / MetaMask/metamask-extension

Switch to more secure & faster secp256k1 library, shave-off 90kb

Open
#9,741 11 comments 1 reaction 0 assignees View on GitHub
type-enhancement
Dominant language
TypeScript
Stars
13.2k
Forks
5.6k
Avg merge
2d 5h
Merged PRs (30d)
451

Description

Hi! I've created [noble-secp256k1](https://github.com/paulmillr/noble-secp256k1) one year ago. The goal was to create an extremely simple zero-dependency library. With all the optimizations, even though it's just <1kloc, it's actually **faster** than elliptic — which you're using right now:

```
noble#sign x 3,952 ops/sec
elliptic#sign x 1,808 ops/sec
noble#verify x 851 ops/sec
elliptic#verify x 812 ops/sec
```

The reasoning behind the creation was that more and more dependencies are used in all kinds of projects, and there is a huge need in reducing the number — because any dep could get hacked, and it becomes complex to verify the source code by hand. Check out the blog post: https://paulmillr.com/posts/noble-secp256k1-fast-ecc/

- noble secp is [10kb minified](https://bundlephobia.com/result?p=noble-secp256k1@1.0.6), while your current elliptic + bn.js is ~100kb, you'll save 90kb — which is a lot
- noble was audited by Cure53. Elliptic was not audited, so noble should be considered more secure
- elliptic [does not seem to be maintained](https://github.com/indutny/elliptic/issues). Elliptic recently had terrible private key leak (CVE-2020-28498)
- you'll receive faster signatures and verification

I strongly recommend switching to noble. I can prepare a pull request.

Contributor guide

Open the contributing guide

Research direction

Start by locating the current elliptic and bn.js usage and compare the required interfaces with noble-secp256k1. Done means the existing dependency path is replaced without changing signing or verification behavior, while preserving the reported bundle-size and performance benefits.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, typescript
Domain
blockchain, cryptography
Issue type
Refactor
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.