Top 3 JavaScript noble Projects

noble-secp256k1

3 695 7.5 JavaScript

Fastest 4KB JS implementation of secp256k1 signatures and ECDH

Project mention: A beginner's guide to constant-time cryptography (2017) | news.ycombinator.com | 2024-02-22

I noticed in July of 2022 that Go did exactly the vulnerable example and reported it to the security team.
https://github.com/golang/go/issues/53849
It was fixed as of Go 1.21 https://go.dev/doc/go1.21
---
The article cites JavaScript, which is not constant time. There's no sure way to do constant time operations in JavaScript and thus no secure way to do crypto directly in Javascript. Browsers like Firefox depend on low level calls which should be implemented in languages that are constant time capable.
JavaScript needs something like constant time WASM in order to do crypto securely, but seeing the only constant time WASM project on GitHub has only 16 stars and the last commit was 2 years ago, it doesn't appear to have much interest. https://github.com/WebAssembly/constant-time
However, for JavaScript, I recommend Paul's library Noble which is "hardened to be algorithmically constant time". It is by far the best library available for JavaScript. https://github.com/paulmillr/noble-secp256k1

noble-ed25519

2 387 7.2 JavaScript

Fastest 4KB JS implementation of ed25519 signatures
SurveyJS

surveyjs.io featured

Open-Source JSON Form Builder to Create Dynamic Forms Right in Your App. With SurveyJS form UI libraries, you can build and style forms in a fully-integrated drag & drop form builder, render them in your JS app, and store form submission data in any backend, inc. PHP, ASP.NET Core, and Node.js.
Ed25519Tool

5 20 5.6 JavaScript

Ed25519 signing and verification online tool.

Project mention: Show HN: Non.io, a Reddit-like platform Ive been working on for the last 4 years | news.ycombinator.com | 2023-06-12

I'm concerned about the `#` character in the URL.
# means fragment and that's kept local and not sent to the server unless client side Javascript sends it to the server. I would use an identifier that doesn't already mean something to the URL.
See https://github.com/Cyphrme/URLFormJS#query-parameters-fragme... (Also see https://github.com/Cyphrme/Path)
For an example where this is relevant: https://cyphr.me/ed25519_tool/ed.html#?msg_encoding=Text&msg...
And see https://www.rfc-editor.org/rfc/rfc3986#section-3.5

NOTE: The open source projects on this list are ordered by number of github stars. The number of mentions indicates repo mentiontions in the last 12 Months or since we started tracking (Dec 2020).