Performance increase to sign & verify signature

[DenisCarriere]

Performance increase

A significant improvement replacing tweetnacl with @noble/curves

• sign: 6.5x faster
• verify: 2.5x faster

What's Breaking?

• Rename env SECRET_KEY => PRIVATE_KEY
• Secret key is 64 char length (using @noble/curves ) long instead of 128 (using tweetnacl)
• Remove cached sign
• Signature the same as Discord Authorization
  • https://discord.com/developers/docs/interactions/receiving-and-responding#security-and-authorization

What's new?

• update substreams-sink
  • improved inactivity handling
• add new webhook CLI flags
  • disablePing
  • disableSignature
  • maximumAttempt
• Add more test cases for sign & verify

Tweetnacl

const nacl = require("tweetnacl");

// Your public key can be found on your application in the Developer Portal
const PUBLIC_KEY = "APPLICATION_PUBLIC_KEY";

const signature = req.get("X-Signature-Ed25519");
const timestamp = req.get("X-Signature-Timestamp");
const body = req.rawBody; // rawBody is expected to be a string, not raw bytes

const isVerified = nacl.sign.detached.verify(
    Buffer.from(timestamp + body),
    Buffer.from(signature, "hex"),
    Buffer.from(PUBLIC_KEY, "hex")
);

if (!isVerified) {
    return res.status(401).end("invalid request signature");
}

@noble/curves

import { ed25519 } from "@noble/curves/ed25519.js";

// validate signature using public key
const isVerified = ed25519.verify(
  signature,
  Buffer.from(timestamp + body),
  PUBLIC_KEY,
);

.env

# Webhook
PRIVATE_KEY=<Ed25519 Private Key>
WEBHOOK_URL=http://127.0.0.1:3000
PORT=9102

# Get Substreams API Key
# https://app.pinax.network
# https://app.streamingfast.io/
SUBSTREAMS_API_KEY=<Substreams API Token @ https://pinax.network>
SUBSTREAMS_ENDPOINT=https://eth.substreams.pinax.network:443

# Substreams Package (*.spkg)
MANIFEST=https://github.com/pinax-network/substreams/releases/download/blocks-v0.1.0/blocks-v0.1.0.spkg
MODULE_NAME=map_blocks
START_BLOCK=-10
PRODUCTION_MODE=true

# Webhook (Optional)
DISABLE_PING=false
DISABLE_SIGNATURE=false
VERBOSE=true
MAXIMUM_ATTEMPTS=100