Switch from noble-secp256k1 to noble-curves

[paulmillr]

Describe the Feature

1.0.0 of curves is out, and we have already did the switch in ethereum-cryptography: https://github.com/ethereum/js-ethereum-cryptography/releases/tag/2.0.0

Better also bump noble-hashes to 1.3.0 because you'll get deduplication for free: same version is used as dep in noble-curves

Example pull request that shows how you'll need to update the API: ethereumjs/ethereumjs-monorepo#2639 (basically everything is in variable secp256k1)

[0xSidius]

+1 @ricmoo

[ricmoo]

It's coming. :)

[ricmoo]

FYI. I've added this to try it out, and it increased the overall min-zipped package size by 4kb. :s

Looking in the output now to figure out why it adds so much.

[paulmillr]

From a quick glance over your diff, I see hashToCurve, encodeToCurve in it. Those bring hash-to-curve module which is not necessary for ethers. I have explicitly moved those to them separate variables to be tree-shaking-friendly.

Assuming you're using tree shaking, it needs to be configured properly to have good bundle size.

[paulmillr]

paulmillr/noble-curves@ff5b231 this should help in the next release

[paulmillr]

@ricmoo try curves 1.1.0 now

[ricmoo]

Awesome!! Thanks, I will. :)

[ricmoo]

There seems to still be a problem with it pulling in more than we want it to? :(

Here is a gist of the dist files (minified and unminified) and the size comparisons:

https://gist.github.com/ricmoo/a9ea99e77fc6a52493bc6c58cf016364

[paulmillr]

@ricmoo I will need a branch with the new deps used, synced with main: v6-curves is outdated. You seem to have it on your machine.

[paulmillr]

860k on my machine, so all correct. you've forgot to update treeshake: false to treeshake: true in your build.

860K	./dist/ethers.js

[ricmoo]

Here is a branch... I still can't get your results. The treeshake: true is present in the rollup config.

I build it using npm run build-clean, but youy could skip all the admin steps and use npm run build-all && npm run _build-dist && npm run _dist-stats. The _build-stats step dumps out the file sizes for the dist files.

[paulmillr]

This seems about right then. With new branch, don't see anything that's unnecessary in the build diff file.

The build is as minimal as possible. Difference is 2.7% of mingzipped size, or 1.7% of minified size. For non-minified, 40kb can seem like a lot, but that's mostly comments -- which are as descriptive as ethers comments.

Main points of change were using complete formulas and abstracting Field away. Complete formulas are important for security, even though they are much longer. Field is also good to have. For the record, the v1.1 decreased non-minified bundle size by 13kb for secp256k1.

	min.gz	min	umd min	full
old	144	460	464	872
new	148	468	472	912
	+2.7%	+1.7%

[paulmillr]

For those who want tiny build size, there's noble-secp256k1 v2.0, which is just 4kb mingzipped: smaller than before. But it's not audited.

[paulmillr]

A few updates:

1. new ethereumjs with curves would be out any day now
2. viem has been using curves for many releases
3. curves will overtake secp256k1 by npm downloads very soon

[ricmoo]

My plan is to switch in the next minor bump too. :)

[ricmoo]

This change has been made in v6.8.0.

Thanks! :)