Use node:crypto instead of noble/curves

[rafaelbsky]

@atproto/crypto currently does signature validation with @noble/curves, which is a JS implementation.

Our CPU profiling shows that validation takes a good CPU share, so we want to see how that improves by switching to the native node:crypto, but not yet changing the current implementation in @atproto/crypto.

The solution was to make customizable the signature verification function that happens inside the JWT validation, which happens on @atproto/xrpc-server.

So in short:

1. @atproto/crypto exports the utils to avoid duplication.
2. @aproto/xrpc-server allows customization of the signature verification function.
3. @atproto/bsky uses 1 to build a customization for 2, using node:crypto instead of @noble/curves.

[matthieusieben]

This looks good. It's kind of a bummer that we are able to benefit from this change everywhere.

Wouldn't be a better solution to add your changes to the following function instead ?

atproto/packages/xrpc-server/src/auth.ts

Lines 119 to 124 in 709ba30

	const verifySignatureWithKey = async (key: string) => {
	return crypto.verifySignature(key, msgBytes, sigBytes, {
	jwtAlg: header.alg,
	allowMalleableSig: true,
	})
	}

[rafaelbsky]

@matthieusieben I think your 3 comments fall into the same concern, so I'll reply to them all here.

Your suggestion was to make the change in xrpc-server so it would benefit more services at once. I think that's what we're trying to avoid: we want to only have it affect appview, to assess the performance difference. Once we confirm that, we will make the change directly in crypto (which would benefit all services that use it).

Do you think it makes sense? LMK if I misunderstood something.

[matthieusieben]

Gotcha !