Replace k256 library with rust-secp256k1

[lescuer97]

Hi! I was having a look around the code and notice the library is using k256 instead of the rust-secp256k1 library. k256 is not cryptographic audited compared to rust-secp256k1 which is probably the most audited crypto library out there.

I was looking to work on a cashu library and found this package. do you think this would be a good change?
I would probably be interested in doing the change.

[thesimplekid]

Hi, Thank you for taking a look. Ideally we would use rust-secp256k1 however it cannot compile to wasm, and I want this library to be as cross platform as possible. There is an open issue for wasm support in rust-secp256k1 but it may take some time as it's not an issue with the lib itself it's a wider c binding issue. I'll put in a link to the issue later when I'm not on mobile.

…

On October 27, 2023 2:52:14 PM GMT+01:00, Leonardo Escuer ***@***.***> wrote: Hi! I was having a look around the code and notice the library is using k256 instead of the [rust-secp256k1](https://github.com/rust-bitcoin/rust-secp256k1) library. k256 is not cryptographic audited compared to rust-secp256k1 which is probably the most audited crypto library out there. I was looking to work on a cashu library and found this package. do you think this would be a good change? I would probably be interested in doing the change.

[thesimplekid]

Issue on rust-secp256k1: <rust-bitcoin/rust-secp256k1#485> Wider rust issue: <rustwasm/team#291>

…

On October 27, 2023 2:52:14 PM GMT+01:00, Leonardo Escuer ***@***.***> wrote: Hi! I was having a look around the code and notice the library is using k256 instead of the [rust-secp256k1](https://github.com/rust-bitcoin/rust-secp256k1) library. k256 is not cryptographic audited compared to rust-secp256k1 which is probably the most audited crypto library out there. I was looking to work on a cashu library and found this package. do you think this would be a good change? I would probably be interested in doing the change.

[thesimplekid]

I think its worth looking into this again.

It still seems to be an open issue but other crates in the ecosystem are using the secp256k1 re-exported by the bitcoin crate which is already a dependency, Using this instead of k256 would reduce a dependency here and on other projects that use CDK.

@yukibtc Do you have any advice here?

[yukibtc]

I agree, I think we should use secp256k1 instead of k256 for the same reason you said. That's one of the things I started doing in my fork :)

The same for the bip32 crate: https://github.com/rust-bitcoin/rust-bitcoin/blob/master/bitcoin/src/bip32.rs

---

rust-secp256k1 can be compiled to WASM. If you are on macOS you need to do this:

brew install llvm
LLVM_PATH=$(brew --prefix llvm)
AR="${LLVM_PATH}/bin/llvm-ar" CC="${LLVM_PATH}/bin/clang" cargo build --target wasm32-unknown-unknown

On Linux it works without having to do anything (at least on debian).

[yukibtc]

I can take this issue if you're not already working on it, so I can get more familiar with the library :)

[thesimplekid]

I can take this issue if you're not already working on it, so I can get more familiar with the library

I haven't started so that's great, thanks

[thesimplekid]

That's one of the things I started doing in my fork

Definitely open an issue or shoot me a message with any other suggestions