Implement Argon2id using @noble/hashes

CHANGELOG.md

@@ -11,8 +11,11 @@ and this project adheres to
 - all: Drop support for Node.js < 22.
 - @cosmjs/crypto: Upgrade dependencies @noble/ciphers, @noble/curves,
   @noble/hashes and @scure/bip39 to v2. ([#1935])
+- @cosmjs/crypto: Use pure-JS implementation of Argon2id from @noble/hashes.
+  ([#1938])
 
 [#1935]: https://github.com/cosmos/cosmjs/pull/1935
+[#1938]: https://github.com/cosmos/cosmjs/issues/1938
 
 ## [0.38.0] - 2025-12-30
 

packages/crypto/package.json

@@ -46,8 +46,7 @@
     "@noble/ciphers": "^2.1.1",
     "@noble/curves": "^2.0.1",
     "@noble/hashes": "^2.0.1",
-    "@scure/bip39": "^2.0.1",
-    "hash-wasm": "^4.12.0"
+    "@scure/bip39": "^2.0.1"
   },
   "devDependencies": {
     "@istanbuljs/nyc-config-typescript": "^1.0.1",

packages/crypto/src/argon2.ts

@@ -1,5 +1,5 @@
-import { assert, isNonNullObject } from "@cosmjs/utils";
-import { type IArgon2Options, argon2id } from "hash-wasm";
+import { isNonNullObject } from "@cosmjs/utils";
+import { argon2id, ArgonOpts } from "@noble/hashes/argon2.js";
 
 export interface Argon2idOptions {
   /** Output length in bytes */
@@ -29,28 +29,24 @@ export function isArgon2idOptions(thing: unknown): thing is Argon2idOptions {
 }
 
 export class Argon2id {
+  // This is async for historic reasons. If we switch to a Wasm implementation or get argon2 in WebCrypto,
+  // this is needed again.
   public static async execute(
     password: string,
     salt: Uint8Array,
     options: Argon2idOptions,
   ): Promise<Uint8Array> {
-    const opts: IArgon2Options = {
-      password,
-      salt,
-      outputType: "binary",
-      iterations: options.opsLimit,
-      memorySize: options.memLimitKib,
-      parallelism: 1, // no parallelism allowed, just like libsodium
-      hashLength: options.outputLength,
+    const opts: ArgonOpts = {
+      t: options.opsLimit, // Time cost, iterations count
+      m: options.memLimitKib, // Memory cost (in KB)
+      p: 1, // parallelism
+      dkLen: options.outputLength, // Desired number of returned bytes
     };
 
     if (salt.length !== 16) {
       throw new Error(`Got invalid salt length ${salt.length}. Must be 16.`);
     }
 
-    const hash = await argon2id(opts);
-    // guaranteed by outputType: 'binary'
-    assert(typeof hash !== "string");
-    return hash;
+    return argon2id(password, salt, opts);
   }
 }

yarn.lock

@@ -289,7 +289,6 @@ __metadata:
     "@types/karma-jasmine-html-reporter": "npm:^1"
     "@types/node": "npm:*"
     glob: "npm:^13.0.0"
-    hash-wasm: "npm:^4.12.0"
     jasmine: "npm:^4"
     jasmine-spec-reporter: "npm:^6"
     karma: "npm:^6.3.14"
@@ -4421,13 +4420,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"hash-wasm@npm:^4.12.0":
-  version: 4.12.0
-  resolution: "hash-wasm@npm:4.12.0"
-  checksum: 10c0/6cb95055319810b6f673de755289960683a9831807690795f0e8918b2fd7e6ae5b82a9dc47cbace171cf2814b412ef68c315a0ead0b4d96bd3e56a05e4bde136
-  languageName: node
-  linkType: hard
-
 "hasha@npm:^5.0.0":
   version: 5.2.2
   resolution: "hasha@npm:5.2.2"