paulmillr / noble-hashes

Audited & minimal JS implementation of hash functions, MACs and KDFs.
https://paulmillr.com/noble
MIT License
545 stars 46 forks source link

Enhancements: add `equalsBytes` and `compareBytes` helper methods #59

Closed mahnunchik closed 1 year ago

mahnunchik commented 1 year ago

It would be helpful to have equalsBytes and compareBytes methods in utils in addition to concatBytes.

This will make it easy to migrate from buffer methods:

paulmillr commented 1 year ago

We only export methods, which are used in noble-hashes. If you want custom ones, you should write them for your app.

mahnunchik commented 1 year ago

I'm working on Tron library using @noble/curves, @noble/hashes, and @scure/base. I've faced that some useful methods are exists in libraries or even are present copies in multiple libraries.

concatBytes are present in @noble/curves and @noble/hashes:

https://github.com/paulmillr/noble-hashes/blob/6854aaac0bd67a546a136271d8928e340cca8373/src/utils.ts#L107-L118

https://github.com/paulmillr/noble-curves/blob/79dd7d342636f421d36acbf3dbe2014ad7ba7ece/src/abstract/utils.ts#L93-L102

equalBytes from https://github.com/paulmillr/noble-curves/blob/79dd7d342636f421d36acbf3dbe2014ad7ba7ece/src/abstract/utils.ts#L104-L109

utf8ToBytes

https://github.com/paulmillr/noble-hashes/blob/6854aaac0bd67a546a136271d8928e340cca8373/src/utils.ts#L85-L93 https://github.com/paulmillr/noble-curves/blob/79dd7d342636f421d36acbf3dbe2014ad7ba7ece/src/abstract/utils.ts#L113-L120

@noble/curves depends on @noble/hashes, but methods are duplicated.


Maybe there is sense to extract common bytes/hex/utf8 methods to separated scure-?utils? package? This will allow developers to use helpers from one source and not jump between modules.

paulmillr commented 1 year ago

The reason for this duplication is simple:

  1. noble-curves depend on hashes, but abstract directory with algorithms themselves doesn't. If anyone to use noble-curves with custom hashing library, they could, and hashes won't be touched.
  2. scure-base don't depend on curves / hashes

So it's not too straightforward. If they depended on each other, I would surely reuse them.

Overall I agree with you that we should keep less methods, but the current situation is as good as it gets.

Regarding a custom library for byte touching - seems like a fine idea. Although I won't depend on it in curves/hashes.

mahnunchik commented 1 year ago

I understand the goal to minimize dependencies especially for crypto-specific libraries.


For tron library three packages are used @noble/curves, @noble/hashes, and @scure/base. Of course I'd like to reuse helpers, so I've to choose from which library to import helpers https://github.com/CoinSpace/tronlib/blob/53ca109659591324516213acb63c30ae6a7882fe/lib/utils.js#L2-L3

paulmillr commented 1 year ago

But it makes it easier to audit common helpers in single place rather than for each individual library.

There is no issue in auditing additional 50 lines of code. It's better than having a dependency.

Bundle size of dependent code can be controlled by modularity like it implemented in hashes library.

Yeah, by 50 lines. Doesn't matter.

paulmillr commented 1 year ago

BTW, once your Tron lib is ready, feel free to send a pull request to noble-curves README, which lists projects using the lib.