Switch from node-webcrypto-ossl to @peculiar/webcrypto

[davedoesdev]

Due to PeculiarVentures/node-webcrypto-ossl#138

@peculiar/webcrypto is the replacement which doesn't need C code
(uses Node crypto from JS only).

[coveralls]

Pull Request Test Coverage Report for Build 78

• 1 of 1 (100.0%) changed or added relevant line in 1 file are covered.
• No unchanged relevant lines lost coverage.
• Overall coverage remained the same at 80.983%

---

Totals
Change from base Build 56:	0.0%
Covered Lines:	1451
Relevant Lines:	1694

---

💛 - Coveralls

[davedoesdev]

Note: published as @davedoesdev/fido2-lib and will install on Node 11.9.0

[davedoesdev]

Looks like the issue with node-webcrypto-ossl was fixed in PeculiarVentures/node-webcrypto-ossl@fecc26f

@microshine which do you recommend - node-webcrypto-ossl or webcrypto?

[microshine]

@davedoesdev @peculiar/webcrypto is easier to install but node-webcrypto-ossl works faster

Installation

node-webcrypto-ossl

+ node-webcrypto-ossl@1.0.48
added 6 packages from 11 contributors and audited 7 packages in 34.004s

@peculiar/webcrypto

+ @peculiar/webcrypto@1.0.12
added 8 packages from 40 contributors and audited 25 packages in 6.439s

Speed test

import * as assert from "assert";
import { Crypto } from "@peculiar/webcrypto";
const CryptoOSSL: typeof Crypto = require("node-webcrypto-ossl");

async function main() {
  const providers = [
    { name: "@peculiar/webcrypto", crypto: new Crypto() },
    { name: "node-webcrypto-ossl", crypto: new CryptoOSSL() },
  ]
  const iterations = 1000;
  const data = Buffer.from("Test message");
  const alg: RsaHashedKeyGenParams = {
    name: "RSASSA-PKCS1-v1_5",
    hash: "SHA-256",
    publicExponent: new Uint8Array([1, 0, 1]),
    modulusLength: 2048,
  };

  for (const provider of providers) {
    const testName = `Speed test for ${provider.name} ${iterations} iterations`;
    console.time(testName);

    const keys = await provider.crypto.subtle.generateKey(alg, false, ["sign", "verify"]);
    let it = iterations;
    while (it--) {
      const signature = await provider.crypto.subtle.sign(alg, keys.privateKey, data);
      const ok = await provider.crypto.subtle.verify(alg, keys.publicKey, signature, data);
      assert.equal(ok, true);
    }

    console.timeEnd(testName);
  }
}

main().catch(err => console.error(err));

Output

Speed test for @peculiar/webcrypto 1000 iterations: 1434.031ms
Speed test for node-webcrypto-ossl 1000 iterations: 907.142ms

[davedoesdev]

@microshine many thanks.
I think sticking to node-webcrypto-ossl probably makes sense for a library like fido2-lib then (in which case this PR can be closed).
@apowers313 what do you think?

[davedoesdev]

node-webcrypto-ossl has been installing and working for a while now, so closing this PR

[davedoesdev]

@microshine I've just done the speed test and got:

Speed test for @peculiar/webcrypto 1000 iterations: 1.398s
Speed test for node-webcrypto-ossl 1000 iterations: 1.574s

Has @peculiar/webcrypto got faster?

[microshine]

It depends on the mechanisms you are using. As I can remember @peculiar/webcrypto was slower.

[microshine]

My current speed test result is

Speed test for @peculiar/webcrypto 1000 iterations: 1590.679ms
Speed test for node-webcrypto-ossl 1000 iterations: 928.808ms

[davedoesdev]

@microshine thanks, appreciate it. I'll close this PR again to keep this library using the native version.

In my clone I think I'll switch to @peculiar/webcrypto as it's nice to have pure JS and usually results in less maintenance burden.

[microshine]

You can use something like setCrypto function to setup a global crypto engine for your library. It must allow switching between different WebCrypto implementations (eg node-webcrypto-ossl, node-webcrypto-p11, @peculiar/webcrypto)