Use libp2p-crypto

[D4nte]

Problem

We are using several crypto libraries in js-waku: https://docs.wakuconnect.dev/docs/crypto_libraries/.
Some of them import polyfills as they were written for node first.
It can be quite messy too as there is a current node + browser support. We only want browser support so the complexity is unnecessary.

Solution

Review whether libp2p can be used, if so, use it and remove other crypto dependencies.
If not, review what work needs to be pushed upstream.

Notes

Consider vacp2p/rfc#414, would libp2p-crypto support those operations?
Check if libp2p crypto does use the CryptoSubtle browser API. If not, consider whether it is an issue.
Also consider ethereum-cryptography if it does not work out.

[dao]

The link has moved to https://dev-docs.wakuconnect.dev/docs/crypto_libraries/

Should https://github.com/ethereum/js-ethereum-cryptography be considered as well as libp2p? They just released 1.0rc1 a couple days ago.

[D4nte]

The link has moved to dev-docs.wakuconnect.dev/docs/crypto_libraries

Corrected, thanks.

Should ethereum/js-ethereum-cryptography be considered as well as libp2p? They just released 1.0rc1 a couple days ago.

We can consider it.
However, libp2p-crypto is a dependency of libp2p-noise, which in turn, is a dependency of js-waku. Hence, whatever we do, we'll have libp2p-crypto in the dependency tree.

So better use a crypto library we already have in the dependency tree (if it's good enough) than adding a new one.

Moreover, libp2p-crypto has done some recent effort to move away from node dependencies: libp2p/js-libp2p-crypto#180 as js-waku targets the browser, it's good to see.

[D4nte]

Iceboxing it, likely to be part of the plan that is the output of #527

[fryorcraken]

Out of icebox, need to review crypto deps and see if we can improve bundle size.

[fryorcraken]

API exposed by @libp2p/crypto:

• crypto.aes: use node-forge which is mainly pure JS. We use native API subtle Crypto so no reason to change.
• crypto.hmac: we use subtle crypto API without dependency
• crypto.keys: it offers encryption utils but they do not match waku message version 1 requirements
• crypto.randomBytes: Uses @noble/secp256k1 as we do https://github.com/libp2p/js-libp2p-crypto/blob/19e08a25a3fa89a2c243e73afec036d9ccf8864e/src/random-bytes.ts#L8
• crypto.pbkdf2: we use hkdf, not pbkdf2 ref Review usage of HKDF #908

[fryorcraken]

Review done, see comment above.