feat: WASM based checks#1684

Open

Xe wants to merge 60 commits into

mainfrom

Xe commented Jun 15, 2026 •

edited

Loading

Contributor

Closes #283
Closes #1116
Closes #1159
Replaces #1151

Adds argon2id and sha256 WASM based checks. These checks run faster than JavaScript can and will use exponentially less memory on both client and server:

=== RUN   TestAlgos/argon2id.wasm
    wasm_test.go:50: used 333 pages of wasm memory (21102592 bytes)
=== RUN   TestAlgos/sha256.wasm
    wasm_test.go:50: used 18 pages of wasm memory (1179648 bytes)
=== RUN   TestAlgos/argon2id.wasm#01
    wasm_test.go:50: used 333 pages of wasm memory (21102592 bytes)
=== RUN   TestAlgos/sha256.wasm#01
    wasm_test.go:50: used 18 pages of wasm memory (1179648 bytes)

TODO:

Import Rust code
Wire up to config validation
Wire up in Browser JS
Test in a few browsers
Error message for clients without WASM telling them to enable WASM and that this is NOT an Anubis bug

I have been putting off finishing this due to some burnout and fear of retaliation from the privacy community.

Checklist:

Added a description of the changes to the [Unreleased] section of docs/docs/CHANGELOG.md
Added test cases to the relevant parts of the codebase
Ran integration tests npm run test:integration (unsupported on Windows, please use WSL)
All of my commits have verified signatures

Xe added 4 commits

June 15, 2026 15:54


          feat: add wasm modules from branch Xe/wasm3

2aa0244

I'm working on actually shipping this for real this time. In order to
get started, import all the existing logic from PR Xe/wasm3.

Signed-off-by: Xe Iaso <me@xeiaso.net>


          test(ssh-ci): add rust detritus to test closure

b707500

Signed-off-by: Xe Iaso <me@xeiaso.net>


          fix(yeetfile): terminate quote properly

bc802fb

Signed-off-by: Xe Iaso <me@xeiaso.net>


          ci: update CI jobs for rust dependencies

6ae2db9

Signed-off-by: Xe Iaso <me@xeiaso.net>

Xe self-assigned this

github-advanced-security AI found potential problems

View reviewed changes

.github/workflows/asset-verification.yml Fixed

.github/workflows/docker-pr.yml Fixed

.github/workflows/docker.yml Fixed

.github/workflows/go.yml Fixed

.github/workflows/package-builds-stable.yml Fixed

.github/workflows/package-builds-unstable.yml Fixed

.github/workflows/smoke-tests.yml Fixed

github-advanced-security AI found potential problems

View reviewed changes

github-advanced-security AI left a comment

check-spelling found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.

Xe and others added 21 commits

June 15, 2026 16:15


          ci: use more modern rustup flow

a33d5b8

Signed-off-by: Xe Iaso <me@xeiaso.net>


          feat: import hashx from wasm3 branch

a4fe7ee

Signed-off-by: Xe Iaso <me@xeiaso.net>


          feat: import client-side JS from Xe/wasm3 branch

f1509ec

Signed-off-by: Xe Iaso <me@xeiaso.net>


          test(wasm): reorg benchmarks so they run in alphabetical order

5b80566

Signed-off-by: Xe Iaso <me@xeiaso.net>


          chore: update license disclaimer banner for LibreJS

e10f690

Signed-off-by: Xe Iaso <me@xeiaso.net>


          chore(web/wasm): clean up unused import

68c71c7

Signed-off-by: Xe Iaso <me@xeiaso.net>


          docs(wasm): add WASM challenge docs

7bb3a5e

Signed-off-by: Xe Iaso <me@xeiaso.net>


          feat(challenge): import wasm challenges, change Impl interface to add…

a988fd5

… errors

Signed-off-by: Xe Iaso <me@xeiaso.net>


          ci: add rust-specific CI

25bc3d5

Signed-off-by: Xe Iaso <me@xeiaso.net>


          chore: use new wasm checks in default configuration

2d5b115

Signed-off-by: Xe Iaso <me@xeiaso.net>


          chore: remove local docker test, it's complicated to test outside of …

f9acdf7

…github actions directly for reasons I hate

Signed-off-by: Xe Iaso <me@xeiaso.net>


          Merge branch 'main' into Xe/wasm4

e1dad6e

Signed-off-by: Xe Iaso <xe.iaso@techaro.lol>


          chore: confirm wasm checks work with an end to end test

2a3a7a9

Signed-off-by: Xe Iaso <me@xeiaso.net>


          ci: apt-get needs sudo in gha

f3d31a5

Signed-off-by: Xe Iaso <me@xeiaso.net>


          chore(wasm): only rebuild wasm if files changed

2ccc4e4

Signed-off-by: Xe Iaso <me@xeiaso.net>


          chore: update Makefile for rust dependencies

767ed51

Signed-off-by: Xe Iaso <me@xeiaso.net>


          docs: update CHANGELOG

102f5dd

Signed-off-by: Xe Iaso <me@xeiaso.net>


          fix(wasm): better catch and localize wasm unsupported messages

58b6546

Signed-off-by: Xe Iaso <me@xeiaso.net>


          chore(localization): add placeholder wasm translations

f61827a

Assisted-by: Claude Opus 4.8 via Claude Code
Signed-off-by: Xe Iaso <me@xeiaso.net>


          chore: go mod tidy

46ff1ac

Signed-off-by: Xe Iaso <me@xeiaso.net>


          fix(scripts/wasm): don't die if you have to build

9cc0fdd

Signed-off-by: Xe Iaso <me@xeiaso.net>

Xe mentioned this pull request

feat: add non-SHA256 proof of work challenge method #1151

Closed

12 tasks


          chore: spelling

650297b

Signed-off-by: Xe Iaso <me@xeiaso.net>

Xe added 6 commits

June 16, 2026 11:46


          test(challenge/wasm): expand to all methods

f139e42

Signed-off-by: Xe Iaso <me@xeiaso.net>


          style(argon2id): fix variable names and outdated comments

6a90871

Signed-off-by: Xe Iaso <me@xeiaso.net>


          fix(wasm/hashx): make hashx solvable on any input

305d9aa

There are a nontrivial fraction of hashx inputs that are unsolvable. Tor
handles this by just incrementing a padding byte until it gets a
solvable input. In spot testing, this seems to be rare (did not show up
given 2048 random inputs), but it's better to be defensive here by
incrementing a padding byte until it's solvable.

Also mend the commentary and some small remnants of things being
copy/pasted from the sha256 hash solver.

Signed-off-by: Xe Iaso <me@xeiaso.net>


          style(wasm/sha256): mend update check

96fd1c6

This new check uses the bit shift operator to check if it's been at
least 1024 iterations, not a brittle if statement that I've found out
parses incorrectly.

Some commentary has been updated to better reflect reality.

Signed-off-by: Xe Iaso <me@xeiaso.net>


          style(wasm): fix go vet errors

c53e50f

%w is preferred for wrapping errors in fmt.Errorf instead of passing the
value with %v.

Signed-off-by: Xe Iaso <me@xeiaso.net>


          style(worker/wasm): reduce typecast complexity

1864bdc

Signed-off-by: Xe Iaso <me@xeiaso.net>

Xe commented Jun 16, 2026

Contributor Author

Check spelling results are known. Ignoring for now.

Kurtoid reviewed

View reviewed changes

docs/docs/admin/configuration/challenges/wasm.mdx Outdated


          docs(wasm): i've tried so hard to make this work but it won't

d9145d9

Signed-off-by: Xe Iaso <me@xeiaso.net>

tdgroot reviewed

View reviewed changes

web/js/algorithms/wasm.ts

+                  throw new WASMUnsupportedError();
+                }
+                return new Promise(async (resolve, reject) => {

tdgroot Jun 17, 2026

Contributor

Both the fetch and WebAssembly.compileStreaming could raise, but aren't handled, therefore not rejecting the promise.

Xe added 9 commits

June 17, 2026 16:47


          feat(utils): add wazero-exec tool for running wasm-opt / wasm2js

74817dc

Signed-off-by: Xe Iaso <me@xeiaso.net>


          chore(utils): add fixed builds of wasm2js/wasm-opt v130

505bb36

Assisted-by: Claude Opus 4.8 via Claude Code
Signed-off-by: Xe Iaso <me@xeiaso.net>


          ci: add binaryen to ci closure

092f4d6

Signed-off-by: Xe Iaso <me@xeiaso.net>


          style(scripts/build_wasm): run formatter

b046d29

Signed-off-by: Xe Iaso <me@xeiaso.net>


          style(wazero-exec): oops

7e8a8fa

Signed-off-by: Xe Iaso <me@xeiaso.net>


          chore(wasm2js): add wasm2js build plane

f97429b

Signed-off-by: Xe Iaso <me@xeiaso.net>


          feat(wasm): add support for wasm2js modules

baf5046

Signed-off-by: Xe Iaso <me@xeiaso.net>


          chore(scripts/wasm2js): enhance laziness

99308c4

Signed-off-by: Xe Iaso <me@xeiaso.net>


          ci: use wasmtime instead of binaryen, dogfood our binaries hard

fb2101f

Signed-off-by: Xe Iaso <me@xeiaso.net>

Xe commented Jun 17, 2026 •

edited

Loading

Contributor Author

@Kurtoid I figured out how to obviate the need for wasm. I had to build parts of binaryen to webassembly with a script claude puzzled out and commit the resulting binaries to the repo, but this works enough. I'll write more about this in the near future. It's working in Chrome on my workstation at least.


          docs(wasm): document the fact that wasm2js is slow and quiet

ef77a53

Signed-off-by: Xe Iaso <me@xeiaso.net>

Xe commented Jun 17, 2026

Contributor Author

Did a smoke test on an aarch64 system and found that hashx verification never terminates. Gonna remove hashx for now.


          fix: rip out hashx for now, it never terminates on arm64

fb04172

Signed-off-by: Xe Iaso <me@xeiaso.net>

Xe commented Jun 17, 2026

Contributor Author

Oh what it's the wazero compiler being broken on aarch64 somehow. I'm gonna disable it on GOOS=arm64.

Xe added 2 commits

June 17, 2026 18:44


          fix(wasm): use interpreter on GOOS=arm64, will file bug with wazero

a371fac

Signed-off-by: Xe Iaso <me@xeiaso.net>


          revert: return hashx

8771c16

This reverts commit fb04172.

Signed-off-by: Xe Iaso <me@xeiaso.net>

Xe force-pushed the Xe/wasm4 branch from 82e76df to 8771c16 Compare

June 17, 2026 22:47

Xe added 3 commits

June 17, 2026 19:36


          doc(wasm2js): record the tale of woe

36d4153

Signed-off-by: Xe Iaso <me@xeiaso.net>


          fix(wasm2js): make builds reproducible

84a3afa

Assisted-by: Claude Opus 4.8 via Claude Code
Signed-off-by: Xe Iaso <me@xeiaso.net>


          perf(wasm): use interpreter for a few checks on GOARCH=arm64

46ce428

Signed-off-by: Xe Iaso <me@xeiaso.net>

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

JasonLovesDoggo JasonLovesDoggo left review comments

+3 more reviewers

tdgroot tdgroot left review comments

Kurtoid Kurtoid left review comments

github-advanced-security[bot] github-advanced-security[bot] left review comments

Labels

None yet