New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Remove `crypto-js` library in next major release #1239

Closed

lawrence-forooghian opened this issue May 4, 2023 · 3 comments

Assignees

Labels

breaking

Collaborator

lawrence-forooghian commented May 4, 2023 •

edited

Loading

As suggested by @SimonWoolf here as a way of reducing bundle size. This would mean removing the crypto-js library and instead using the browser’s Crypto interface.

Split into:

The text was updated successfully, but these errors were encountered:

lawrence-forooghian added the breaking label

lawrence-forooghian changed the title ~~Remove "`WordArray' stuff" in next major release~~ Remove "WordArray stuff" in next major release

lawrence-forooghian self-assigned this

sync-by-unito bot commented May 4, 2023

➤ Automation for Jira commented:

The link to the corresponding Jira issue is https://ably.atlassian.net/browse/SDK-3570

lawrence-forooghian mentioned this issue

Convert platform crypto.js files to TypeScript #1252

Closed

Collaborator Author

lawrence-forooghian commented May 10, 2023

Putting this on hold whilst I work on #1252, which I've split from this task.

lawrence-forooghian changed the title ~~Remove "WordArray stuff" in next major release~~ Remove crypto-js library in next major release

lawrence-forooghian added a commit that referenced this issue


          Add types for CryptoJS functionality used by web’s crypto.js

710456c

Preparation for converting platforms’ crypto.js files to TypeScript
(#1252).

We’ll be removing these types shortly, though, when we stop using the
CryptoJS library in #1239.

lawrence-forooghian added a commit that referenced this issue


          Add types for CryptoJS functionality used by web’s crypto.js

ab1b977

Preparation for converting platforms’ crypto.js files to TypeScript
(#1252).

We’ll be removing these types shortly, though, when we stop using the
CryptoJS library in #1239.

This was referenced May 24, 2023

Use Web Crypto API for encrypting and decrypting #1292

Closed

Stop using CryptoJS for signing token requests #1295

Closed

lawrence-forooghian added a commit that referenced this issue


          Add types for CryptoJS functionality used by web’s crypto.js

34cdfe5

Preparation for converting platforms’ crypto.js files to TypeScript
(#1252).

We’ll be removing these types shortly, though, when we stop using the
CryptoJS library in #1239.

lawrence-forooghian added a commit that referenced this issue


          Add types for CryptoJS functionality used by web’s crypto.js

7c2373c

Preparation for converting platforms’ crypto.js files to TypeScript
(#1252).

We’ll be removing these types shortly, though, when we stop using the
CryptoJS library in #1239.

lawrence-forooghian added a commit that referenced this issue


          Use Web Crypto for encrypting and decrypting on web

959c7e7

This removes our use of the CryptoJS library for performing encryption
and decryption operations, instead using the browser’s built-in crypto
APIs. We’re doing this as part of our work to remove the CryptoJS
library (#1239) to reduce the size of our SDK.

Resolves #1292.

lawrence-forooghian added a commit that referenced this issue


          WIP remove crypto-js

74e3092

TODO also look for CryptoJS

Resolves #1239.

lawrence-forooghian mentioned this issue

1295 use web crypto for signing token requests and remove CryptoJS #1315

Closed

lawrence-forooghian added a commit that referenced this issue


          Add types for CryptoJS functionality used by web’s crypto.js

53c3a55

Preparation for converting platforms’ crypto.js files to TypeScript
(#1252).

We’ll be removing these types shortly, though, when we stop using the
CryptoJS library in #1239.

lawrence-forooghian mentioned this issue

[SDK-3570] Use Web Crypto API for encrypting and decrypting #1299

Merged

lawrence-forooghian added a commit that referenced this issue


          Use Web Crypto for encrypting and decrypting on web

fcdb9f3

This removes our use of the CryptoJS library for performing encryption
and decryption operations, instead using the browser’s built-in crypto
APIs. We’re doing this as part of our work to remove the CryptoJS
library (#1239) to reduce the size of our SDK.

Resolves #1292.

lawrence-forooghian added a commit that referenced this issue


          WIP remove crypto-js

144fe06

TODO also look for CryptoJS

Resolves #1239.

lawrence-forooghian added a commit that referenced this issue


          Remove all usage of the CryptoJS library

206b851

We’re no longer making use of this library (in order to reduce bundle
size, given that modern browsers provide all of the necessary crypto
functionality).

Resolves #1239.

lawrence-forooghian added a commit that referenced this issue


          Remove all usage of the CryptoJS library

74d180a

We’re no longer making use of this library (in order to reduce bundle
size, given that modern browsers provide all of the necessary crypto
functionality).

Resolves #1239.

lawrence-forooghian added a commit that referenced this issue


          Remove all usage of the CryptoJS library

e455e26

We’re no longer making use of this library (in order to reduce bundle
size, given that modern browsers provide all of the necessary crypto
functionality).

Resolves #1239.

lawrence-forooghian added a commit that referenced this issue


          Remove all usage of the CryptoJS library

e2fb020

We’re no longer making use of this library (in order to reduce bundle
size, given that modern browsers provide all of the necessary crypto
functionality).

Resolves #1239.

lawrence-forooghian added a commit that referenced this issue


          Remove all usage of the CryptoJS library

1c471e7

We’re no longer making use of this library (in order to reduce bundle
size, given that modern browsers provide all of the necessary crypto
functionality).

Resolves #1239.

lawrence-forooghian added a commit that referenced this issue


          Add an implementation of HMAC-SHA-256

c197d79

We’re going to use this to replace our current usage of CryptoJS, which
we intend to remove in #1239.

We considered using the implementation of HMAC from the Web Crypto, but
after weighing the implications of doing so (token signing becoming
unavailable in non-secure contexts) against the mildly-increased library
size (1.61 kB increase) from adding an HMAC implementation, decided to
go with the latter [1].

I picked this implementation because it's a single file that contains
precisely the functionality that we need and it claims to be “designed
for efficient minification”. It doesn’t come with any tests, but since
our SDK has quite a few tests that will fail if the result of token
signing is incorrect, I believe we’re OK.

The code added here is taken verbatim from the linked gist, and then
I’ve added an attribution comment and run Prettier.

[1] https://ably-real-time.slack.com/archives/C030C5YLY/p1686152214032779?thread_ts=1686096207.512069&cid=C030C5YLY

lawrence-forooghian added a commit that referenced this issue


          Add an implementation of HMAC-SHA-256

fc94b80

We’re going to use this to replace our current usage of CryptoJS, which
we intend to remove in #1239.

We considered using the implementation of HMAC from the Web Crypto API,
but after weighing the implications of doing so (token signing becoming
unavailable in non-secure contexts) against the mildly-increased library
size (1.61 kB increase) from adding an HMAC implementation, decided to
go with the latter [1].

I picked this implementation because it's a single file that contains
precisely the functionality that we need and it claims to be “designed
for efficient minification”. It doesn’t come with any tests, but since
our SDK has quite a few tests that will fail if the result of token
signing is incorrect, I believe we’re OK.

The code added here is taken verbatim from the linked gist, and then
I’ve added an attribution comment and run Prettier.

[1] https://ably-real-time.slack.com/archives/C030C5YLY/p1686152214032779?thread_ts=1686096207.512069&cid=C030C5YLY

lawrence-forooghian added a commit that referenced this issue


          Remove all usage of the CryptoJS library

dd7f6c5

We’re no longer making use of this library (in order to reduce bundle
size, given that modern browsers provide all of the necessary crypto
functionality).

Resolves #1239.

lawrence-forooghian added a commit that referenced this issue


          Remove all usage of the CryptoJS library

b549208

We’re no longer making use of this library (in order to reduce bundle
size, given that modern browsers provide all of the necessary crypto
functionality).

Resolves #1239.

lawrence-forooghian mentioned this issue

Remove the CryptoJS library #1326

Closed

lawrence-forooghian mentioned this issue

Remove fallbacks to Math.random #1332

Closed

lawrence-forooghian added a commit that referenced this issue


          Remove a comment relating to CryptoJS

a334c8a

Preparation for #1239 (removing CryptoJS dependency).

lawrence-forooghian added a commit that referenced this issue


          Stop using CryptoJS in testapp_manager.js

184245b

Preparation for #1239 (removing CryptoJS dependency).

lawrence-forooghian added a commit that referenced this issue


          Remove all usage of the CryptoJS library

d493337

We’re no longer making use of this library (in order to reduce bundle
size, given that modern browsers provide all of the necessary crypto
functionality).

Resolves #1239.

lawrence-forooghian mentioned this issue

[SDK-3570] Remove CryptoJS library #1333

Merged

lawrence-forooghian added a commit that referenced this issue


          Remove a comment relating to CryptoJS

c61070a

Preparation for #1239 (removing CryptoJS dependency).

lawrence-forooghian added a commit that referenced this issue


          Stop using CryptoJS in testapp_manager.js

c25e562

Preparation for #1239 (removing CryptoJS dependency).

lawrence-forooghian added a commit that referenced this issue


          Remove all usage of the CryptoJS library

ad1e808

We’re no longer making use of this library (in order to reduce bundle
size, given that modern browsers provide all of the necessary crypto
functionality).

Resolves #1239.

lawrence-forooghian added a commit that referenced this issue


          Remove a comment relating to CryptoJS

a2e3e00

Preparation for #1239 (removing CryptoJS dependency).

lawrence-forooghian added a commit that referenced this issue


          Stop using CryptoJS in testapp_manager.js

e15dccd

Preparation for #1239 (removing CryptoJS dependency).

lawrence-forooghian added a commit that referenced this issue


          Remove all usage of the CryptoJS library

f1bf748

We’re no longer making use of this library (in order to reduce bundle
size, given that modern browsers provide all of the necessary crypto
functionality).

Resolves #1239.

Collaborator Author

lawrence-forooghian commented Jun 19, 2023

Closed by #1333.

lawrence-forooghian closed this as completed

VeskeR mentioned this issue

RFC: Tree shaking #1210

Closed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment