Nymchat teknikal nhoma

Post-Quantum Nkyerɛeɛ nkabom wɔ Nymchat mu

De ML-KEM-768 public keys no ma wɔ Nostr so a ɛnyɛ wɔ directory anaa registry bi so, na yɛde ahosuo a ɛnyɛ adeɛ biara a obiara hu bɛtumi aka no na yɛhyɛ wɔn ase.

Sɛ yɛde post-quantum key exchange hyɛ messenger mu a, ɛnyɛ cryptography asɛm paa. Adeɛ a ɛhyɛ aseɛ noahyɛ mu, na adeɛ a yɛde bɛyɛ no nso wɔ hɔ. Asɛm a ɛyɛ den no ne sɛ, ɛsɛ sɛ obiara nya... banan ...public key, na decentralized network no ammu kwan biara a ɛyɛ mpaapa a wɔbɛto no wɔ hɔ. Dwumadie yi kyerɛ sɛnea Nymchat besaa asɛm no — bea a ɛkin kii no firi, sɛnea ɛbɛdua wɔn a wɔhia no, na nea interface no bɛtumi akyerɛw kyerɛw nsuaeɛ no ho — na wɔn akyiri kɔm a ɛtɔ so a, ɛkyerɛ nea nsuaeɛ no ntumi nkyɛ.

Wɔde mfiri na ɛkyerɛ krataafa yi ase sɛnea ɛbɛyɛ a ɛbɛyɛ mmerɛw. Engiresi kasa mu mfitiase de no ne nkyerɛase a ɛfa ho.

1Asɛm no

Nostr mmuaeɛ a ɛyɛ biako yɛahyɛ mu mu wɔ NIP-44 na ɛwɔ hɔ, a ɛwɔ nkyɛn mmienu a wɔbɛtumi aka. Sa nkyɛn a ɛma asɛmfua no ma ɛnyɛ hɔ — ChaCha20 ne HMAC-SHA256 tag, a wɔde nkyerɛkyerɛmu (key) kyerɛɛ... HKDF (RFC 5869) — ɛnyɛ adeɛ kɛseɛ a quantum computer bɛtumi ayɛ hwee; Grover's algorithm ma mmerɛw a ɛfiri square-root mu ma symmetric key, na 256 bits no bɛtumi agye saa adeɛ no. Adwoluo a ɛyɛ no ɔfa nka wɔ key no so ne elliptic-curve Diffie-Hellman wɔ secp256k1, na Shor's algorithm no tumi ayɛ discrete logarithm no adwuma kɛseɛ ntɛm. Sɛ yɛgye private key bi firi ne public counterpart no mu a, ɛbɛkyerɛ shared secret biara a saa key no ayɛɛ no nyinaa.

Asɛm a eyi bɛma no, ɛnyɛ sɛ yɛgye so nkyɛ sɛ adeɛ a ɛbɛyɛ saa no bɛba. Obi a ɔwɔ adeɛ a ɔde asɛm ano deɛ (ciphertext) no bɛka no nnɛ, ɔbɛtumi aka no na ɔbɛtumi atena asɛm no mu berɛ a ne kwan no bɛba. Deɛ ɛhɔ sent nnɛ a ɛbɛhia wɔ afe no mu no, asɛm no akɔ mu mpo ansa na ɛnyɛ foforo. Eyie ne asɛm a post-quantum key exchange no bɛtumi asɛe, na ɛno nti na yɛntumi nnye ani nkyerɛ sɛ yɛgye so nkyɛ sɛ adeɛ a ɛbɛyɛ saa no bɛbae.

1.1 Nsɛmbisa a dwumadie yi bɔ

Sɛnea yɛbɛtumi asɛe ɔhaw no ho nimdeɛ kɛse ne sɛ: de post-quantum key encapsulation mechanism bi hyɛ classical exchange no nkyɛn, na ɛsɛ sɛ ɔhwɛfoɔ no tu nea ɛda hɔ no nyinaa na ɔtumi ahu adeɛ bi. Nymchat de ML-KEM-768 di dwuma (FIPS 203). Ɛno ma asɛm bi a ɛfa sɛnea wɔtɔ nneɛma no abɔ mu ho hyɛ aseɛ ntɛm:

Npub yɛ adeɛ a ɛwɔ ne ho kɔm. Wotumi atwerɛ no wɔ papa so, aka no nne so, anaa wowɔ no wɔ screen no so, na ɛno ne nea obiara pɛ sɛ ɔde yɛ wo encryption. ML-KEM-768 public key no yɛ 1,184 bytes. Wontumi aka no nne so, ɛnsa wɔ username mu, na ɛnyɛ adeɛ a ɛbɛtena QR code mu de kyerɛ identity a ɛyɛ 32 bytes nkoaa.

Size ne nea ɛyɛ mmerɛ no. Nea ɛyɛ den no ne sɛ, adeɛ a ɛboa a ɛtɔ so mmiɛnsa no ma asɛm a ɛnyɛ pɛ mmiɛnsa ba, na ɛda ɛdaeɛ yi mu akyi nyinaa yɛ mmuaeɛ ma saa asɛm no:

• Wɔtumi afa ho. Kyɛdeɛ a obiara ntumi nkyerɛ n'ani mmerɛw yɛ ne nneɛma a ɔtamfoɔ de ne dea hyɛ mu. Nkyekyɛmu a ɛtɔ so mmiɛnsa hyɛ ɛno ne obi nkyerɛkyerɛmu mu wɔ nkyerɛkyerɛmu so, na ɛno ma ɛyɛ kanea koraa.
• Ɛsɛ sɛ ɛyɛ biako wɔ ɔwiaa no nneɛma dwumadie nyinaa mu. Akontini baako a ɛwɔ fon ne laptop biara so ɛsɛ sɛ ɛkyerɛ key baako no ara, anaa ntetee a wɔatye wɔ bi so no, wɔntumi nnye wɔ ne kan. Section 3.2 kyerɛ saa adeɛ no.
• Ɛbɛtumi afoa. Public key no fiti wɔ secret mu firi hɔ, enti ade a ɛsɛ sɛ ɛtena hɔ ne saa secret no ara — na sɛnea yɛayɛ no, biribiara foforo nni kwan biara a ɛbɛma obi anya no bio. Section 10.1 kyerɛ kɛseɛ kwan sɛnea ɛdi ani, efisɛ ɛnyɛ sɛ yɛasiesie biribi a, na mmom ɛyɛ ade a wɔtɔ nnuae na ɛba.

2Ɔdɔdwɛe nkitahwɛ

Nneɛma nne a ɛhyɛ mmara no na ɛyɛɛ asɛm no mu, na ɛmaa nnwuma a wɔhu no nyinaa annye hɔ ansa na yɛatwerɛ kɔdi biara.

1. Adeɛ a wɔahyɛ mu nketewa koraa. Nostr nipa wɔ n'ankasa sekret koro mu pɛ, ɛno ne nsec. Sekret biara a ɛbɛba foforɔ no yɛ kwan foforɔ bi a ɛbɛma wo atia wo nneɛma a woayɛ bi no, na obi a ɔnim sɛnea wɔde nsec hyɛ hwɛ mu, ɔrennim sɛnea wɔde nneɛma foforɔ hyɛ hwɛ mu. Nkyekyɛmu 3.1 kyerɛ sɛ ɛnyɛ possible koraa sɛ yɛyɛ ɛno ɛtɔ mma—post-quantum key a ɛfiri nsec no mu no nnyɛ post-quantum nkwabɔ biara—entia nkaeɛ no de sekret koro pɛ na ɛde, na ɛnyɛ koro a ɛsii hɔ: key koro pɛ, a wɔayɛ no koro pɛ ma baako baako, na ɛte sɛ nsec no ɛnam na ɛwɔ baako, na sɛ obi nim sɛnea wɔde bi hyɛ hwɛ mu a, ɔbɛnim sɛnea wɔde foforɔ no nso hyɛ hwɛ mu. Nkyekyɛmu 10.1 ka nokorɛ wɔ deɛ ɛsɛ sɛ ɛbɔ sɛ.
2. Tumidie nni hɔ. Ɛnni server biara a yɛbɛtumi de to so de kyerɛ sɛ kɔteɛ bɛn na ɛdeɛ nna hwan. Server biara a ɛyɛ saa no bɛyɛ beaeɛ a wɔbɛtumi atum atu mɛsɛji no kwan foforɔ.
3. Nneɛma pii, ɔhunu baako. Nostr identity no wɔde di dwuma dwom (clients) pii firi baako ara so. Sɛnea nkyerɛkyerɛmu (key material) biara teɛ a, ɛsɛ sɛ ɛyɛ baako pɛ wɔ wɔn nyinaa so, na kwan a ɛkɔ so kɔ hɔ no, ɛsɛ sɛ ɔtamfo a ɛdwene sɛ ɛbɛhyɛ no ase no ntumi nkenkan.
4. Nkontompo nni hɔ. Sɛnea yɛdi nkɔmmɔ wɔ kwan koro so sɛ “nea wote si akwankyerɛsoɔ no?” no, ɛyɛ baabi a ɔhwɛfoɔ bɛtumi asiesie sɛnea ɛbɛyɛ a wɔbɛde nea ɛnyɛ den no. Adwuma no mu nhyia biribi a wɔbɛtumi aseseɛ no.

3Asɛm kɔkɔɔ a ɛtɔ mmu a ɛhyɛ aseɛ

Decision a ɛhia paa no ne sɛ ML-KEM decapsulation key no yɛ ne mmoa firi key material bi mu a obiara nni kwan so bɛhu. Identity biara nya root secret baako, a wɔayɛ no ɛcipa:

pqRoot   = 32 bytes from a CSPRNG, generated ONCE per identity

seed     = HKDF-Expand(
               HKDF-Extract(salt = "nym-pq-root-v2", IKM = pqRoot),
               info = "mlkem768/epoch/" || epoch,
               64 bytes)

(ek, dk) = ML-KEM-768.KeyGen(seed)

Root no kyɛrɛ ɔdeɛ no sɛnea nsec teɛ no: bech32 ne animkyerɛkyerɛ a nnipa bɛtumi akenkan no nympq, enti ɛkyerɛ sɛ nympq1…, akyerɛ nsec no nkyɛn wɔ identity screen no ase, sɛnea reveal interaction no yɛ, wɔde ne mmoa no nso kɔpii, ɛnyɛ nea wɔde kɔtɔn (log) anaa nea wɔde kɔma obiara wɔ ɛhɔ tiawa. Ɛnyɛ password anaa ɛnyɛ login. Ɛyɛ key material a ɔdomfo no bɛteti akyi, sɛnea nsec no te.

Salt no wɔ hɔ a wɔayɛ no sɛnea wɔpɛ sɛ ɛba nneɛma biara nnyɛ biara, na ɛnam saa so no, asɛm a obiara nnim biara nnim hɔ a ɛbɛtumi azi keypair a ɛte biara. Ɛno epoch counter ma ɛtwɛ (Nkyekyɛm 9).

3.1 Ɛhe nti na kɔtɔ no ntumi nfi identity kɔtɔ no mu.

Nea ɛyɛ kanea ne sɛ yɛbɛde adeɛ a ɔnoafoɔ no wɔ no ansa nnɛ afiri mu bɛyɛ keypair no:

seed = HKDF(salt = "…", IKM = nsec)          // do not do this

Ɛyɛ dɛ ma nneɛma anon, na ɛnyina nokware: nneɛma foforɔ biara nni hɔ a yɛbɛgye so, efisɛ nsec no nso ne nneɛma a yɛgye so no; adanwuma nyinaa mu nte efisɛ ɛyɛɛ wɔn sɛ saa, na ɛnyɛ kwan biara a ɛbɛtumi agyina; ɔhwere biara a ɛwɔ n'anim no yɛ nokware, efisɛ adanwuma no ntumi ntumi nnye nkyerɛkyerɛmu biara fa kwan foforɔ so wɔ adeɛ a ɛyɛ kwan no ho; na adeɛ a ɛyɛ kwan no wɔ hɔ ansa na wɔahyɛ no aman mu, enti ɔnoankyerɛfoɔ no bɛtumi de adeɛ bi gyinadeɛ ma ne ho ansa na ɔdeɛ no bɛyɛ nneɛma foforɔ.

Nhyira nneɛnsa nyinaa ayɛ nneɛma a ɛnyɛ hwee biara, ɛfiri anihunu baako nti. Shor's algorithm a wɔde hyɛ mpɔwsɛm npub a wɔagye di adi so no, ɛma wɔnya nsec. Seed derivation no yɛ mpɔwsɛm a obiara bɛtumi de di dwuma wɔ nsec so. Enti, ɔtamfo a ɔtumi asi classical no mu no, ɔbɛtumi ayɛ post-quantum no mu nso ase wɔ HKDF a obiara de di dwuma no so. Sɛ ɛfa harvest-now-decrypt-later — deɛ ɛyɛ anihunu a ɛnam feature yi so bɛsi sɛ ɛbɛsi no — no a, key a wɔanya no kɔ so nyɛ hwee biara.

Ɔkan a ɛdi soɔ no nkyerɛkyerɛmu no yɛ adwuma sɛ nea ɛdi kan no. Adeɛ a wɔasiesie wɔ wɔn nanso koraa na wɔde hyɛɛ mu deɛ ɛteɛ sɛ nea ɛda hɔ no wɔ NIP-44 nkyerɛkyerɛmu mu yɛ mmerɛ a ɛyɛ mmerɛ a ɛdi soɔ no ara nanso ɛyɛ adwuma pii: obi bɛtwaa saa nkyerɛkyerɛmu no rekɔ aduhuɔ mu nnɛ na ɔbɛnya ne kɔteɛ no ɛnkyɛ, na ɛno na ɛbɛma nkyɛ no abue. Ɛno nti na kwan a ɛwɔ akyi no yɛ saa, na ɛno nti na obiara nkyerɛ wo sɛ “twere no kɔ wo foforɔ nneɛma mu.”

3.2 De root no kɔ user no nneɛma foforo mu.

Sekshon 2 mu nkyerɛkyerɛmu a ɛtɔ so nwɔtwe — ɔdom baako, nneɛma pii — ɛnyɛ nhomɔ bɔ na ɛbɛtumi ayɛ adwuma wɔ ha, ɛnam sɛ ne kɔtɔ no nyɛ biribi a nneɛma no nkyɛn mu wɔ hɔ no firi mu. Ɛsɛ sɛ wɔde kɔ na ɛyɛ adwuma, na kwan baako nko ara wɔ hɔ: ɔnoafoɔ no kɔ... nympq1… Wɔkɔdi wɔn ho.

Abɔnten no wɔ kyerɛ sɛ nympq1… nsec no nkyɛn, na device a ɛtɔ so mmienu no ka no sɛnea wɔahyɛ no wɔ panel no mu kɔm. Ɛno ne kwan no nyinaa. Device a wɔannyaa kɔd no ntumi nnye mu, ɛno na Section 4.2 kyerɛ.

Ɛyɛ adwuma a wɔyɛ no ne nsa so nea ɛyɛ nnyinasoɔ na ɛnyɛ akyɛaseɛ kɛkan. Section 3.1 mu akwadaeɛ no ka sɛ nnyinasoɔ no ntumi mfa encryption a ɛde nneyɛeɛ a ɛda hɔ no nko ara so kɔ, na kwan biara a ɛbɛma saa adwuma yi sɛ ne ho ara na ɛyɛ no — sɛ yɛde relay so ma ɛhyɛ mu, anaa sɛ yɛde identity key no so bɔ — ɛsɛ sɛ ɛhyɛ saa akwadaeɛ no mu. Adwuma a ɔnofoɔ no yɛ no nti na ɛbɔɔdefɔ no yɛ nokware.

Saa nkyerɛwee yi ma kwan ma "wrapped path" bi: koraa bi bɛtumi aka nkyerɛwee (list) a wɔate so (wraps) bi, ɛtɔɔ biara yɛ "AEAD blob" a ɛwɔ "key" bi ase a ɔno nipa no bɛtumi aka no foforɔ wɔ adeɛ foforɔ bi a ɛwɔ hɔ so — sɛnea "passkey PRF output" te sɛ. Ɛhweeara nni hɔ a wɔde ba nnɛ, na kɔsi sɛ biribi bɛba, no nympq1… code no ne kwan koro a ɛbɛma wo akɔ. Sekshon 10.1 kyerɛ nea ɛdi ne bo.

Kyerɛwdeɛ no ara tena ne nkyerɛkyerɛmu kɛseɛ mu, nymchat-pq-root, na ɛbɔ ne ho nnam sɛe anɔkra kategoria no nyinaa. Ɛmfa wraps biara nni hɔ mpo a, ɛyɛ adwuma a ɛhia no: ne wɔwɔ hɔ no ne sɛnea adesoa a ɛtɔ so mmienu no hu sɛ saa identity yi wɔ hɔ root bi tete no, ɛno na ɛgyina sɛnea ɛbɛyɛ a ɛbɛtumi ahyɛ baako foforɔ a ɛbɛhyɛ ne ho kwan (Section 3.3).

3.3 Yɛdeɛ ne yɛfa so

Berɛ a ɛhyɛ aseɛ, na ɛtena identity a ɛte hɔ daa so, client no yɛ adwuma wɔ saa order yi mu:

1. Hwehwɛ biribi a ɛwɔ hɔ nymchat-pq-root Twe.
2. Akyerɛwdeɛ bi wɔ hɔ, na adeɛ yi bɛtumi aka ho — fa no na kyerɛ saa identity yi sɛ ɛwɔ post-quantum tumi.
3. Nkyerɛkyerɛmu bi wɔn, na saa aparayɛ yi ntumi nkyɛ mu. — root foforɔ biara nnyɛ, na woahyɛ amanneɛ biara nso nnkyerɛ. Hyɛ ɔnoɔmani no ma sɛ ɔbɛhyɛ saa adeɛ yi nso mu sɛ ɔhyɛ nympq1… kod firi adeɛ bi a ɛwɔ ne ho no tete.
4. Nneɛma biara nni hɔ — hyɛ ɛnyinyã bi ase, fa nkyerɛkyerɛmu no nkyerɛ, bɔ amanneɛ, na kyerɛ... nympq1… Ma code no ɔdomfo no mmerɛ baako na wɔatumi de to so.

Adeɛ a ɛtɔ so mmiɛnsa yɛ adeɛ a ɛyɛ mmerɛ sɛ wubetumi ayɛ kwan, na ɛno nti na wɔatwerɛ kwan a wɔde fa so no, na ɛnyɛ sɛ wɔde ma obiara sɛ ɔbɛyɛ sɛnea ɔpɛ. Adeɛ mmienu a obiara tua nnyinasoɔ foforɔ bɛma nnyinasoɔ mmienu a ɛnyɛ biara nnyinasoɔ biara kɔ so wɔ din baako akyi, na ɛno ne asɛm a kwan a wɔatwerɛ yi wɔ hɔ sɛ ɛbɛhyɛ so.

4Adwumayɛ nsem bɔ no

Keypair no fã a obiara hu yɛ no a wɔafiri mu no, wɔkyerɛ ne ho sɛ adesoa a wɔbɛtumi akyere ho. NIP-01 asɛm — sɛbea 30078, a wɔatwa nkyerɛkyerɛmu nym-pq:

{
  "kind": 30078,
  "tags": [
    ["d", "nym-pq"],
    ["t", "nym-pq"],
    ["expiration", "<unix seconds>"]
  ],
  "content": {
    "v":     2,
    "alg":   "mlkem768",
    "nym":   1,
    "epoch": 0,
    "pk2":   "<base64url ML-KEM-768 encapsulation key>",
    "exp":   <unix seconds>,
    "devices": [ ... ]
  }
}

Addressable kyerɛ sɛ relay no si adwuma baako kɔɔ (kind, pubkey, d-tag) ho, enti sɛnea wɔyɛ adwuma no bio no, ɛto asɛm a wɔhyɛɛ no animuonyam no kɔtɔ kɔɔ hɔ no ara. Enti obiara wɔ asɛm baako pɛ a ɛwɔ hɔ nnɛ, ɛno na ɛma sɛ "hwɛ Alice nkyɛaseɛ no" yɛ asɛm baako a ɛyɛ nokware na ɛnyɛ asɛm pii a wɔde bɛyɛ nteteeɛ.

Ɔhyɛn nkyerɛwee no ne nkrabaw no. Adesua yi no, identity key no na ɛhyira mu, enti asɛm a ɛka sɛ “ei ML-KEM key yi yɛ saa npub yi deɛ” no, ɛyɛ den te sɛ npub no ankasa. Sɛ wopɛ sɛ wode encapsulation key foforɔ gu mu a, ɛsɛ sɛ wopue secp256k1 signature bi foforɔ. Ɔdamfoɔ a ɔbɛtumi ayɛ saa no, ɛnyɛ KEM no na ɛhia no.

Nsem bɔbuo no teɛ. Nkronɔ da bi NIP-40 na ɛwɔ hɔ ɛkɔm kɔ no, a wɔhyehyɛ mu bio anɔpa biara, ɛma nkaeɛ no kyerɛ sɛ adwumafoɔ no wɔ hɔ nnɛ, na ɛnyɛ sɛ na ɔwɔ hɔ kɔɔ bio. Ɛnamkɔ no nkwagyeɛ nni hɔ; ɛda mu nkaeɛ no nko ara na ɛtwa.

Asɛm bɔ a ɛapira no, wɔtena ne sɛ asɛm bɔ a ɛnyɛ kwan (key) biara na ɛwɔ no: nnipa a wɔwɔ hɔ no bɛhyɛ NIP-44 a ɛyɛ biara, na login biara bɛtumi akenkan, na client no bɛkɔ so wɔ post-quantum kɔkɔɔ no so wɔ ne nketewa (connection) a ɛreba no so, berɛ a ɛbɛkyerɛw no bio. Enti, sɛ woyɛ dɔm nkyɛ adena nson bi a, ɛsɛ asɛm no abom (protection) wɔ asɛm a wɔatwerɛ wɔ ɛnketewa no mu no nti — wɔatwerɛ asɛm no kɔkɔɔ (encrypted) a ɛnyɛ quantum-resistant — na ɛnsɛ biribi foforɔ. Asɛm no nkyerɛwee no nni hwee wɔ ne so, biribiara a wɔatwam akenkan no bɛtena hɔ, na ɛsɛn sɛ obiara nnyɛ hwee berɛ a wobɛba bio.

Ɛno nti na ɛpue, ɛnyɛ deɛ ɛkɔɔ so mpo na ɛmaa ɛpue. Sɛ ɛnni bi a, asɛm bi bɛtena hɔ kɔsi sɛ nkyerɛkyerɛmu (key) a ɛkyerɛ no no bɛwu: mmoa a wɔahyɛ aseɛ, wɔsesa no, anaa wɔasɛe ne mfonin (root) no, ɛma asɛm bi wɔ hɔ a ɛkyerɛ sɛ ɛde asɛm no kɔ nkyerɛkyerɛmu a obiara nnwɔ no; na mpanin (messages) a wɔde kɔfi saa nkyerɛkyerɛmu no ase no, ɛbɛpue kɔ mpo na ɛnyɛ asɛm bi wɔ hɔ wɔ mfafo biara nkyɛn. Nnɔnketan (7 days) na ɛma saa bere no hwehwɛ, na ɛma nnyinaso (relays) no tumi de asɛm no twa ase wɔn ankasa, na ɛnyɛ sɛ wɔregye ɔkɔmɔ (clients) sɛ wɔbɛhunu no.

Key field no kyerɛ ne kwan. Ateneɛ no yɛ pk2...na nɔmber no yɛ dwumadie mu nneɛma, ɛnyɛ mmuaeɛ kɛkɛ: ɛkyerɛ saa amammere (format) a wɔbɛfa nkyɛn no so. Ɔtwenefoɔ a ɔnhunu saa nneɛma yi a, ɔbɛka sɛ “Nymchat client, post-quantum key nni hɔ” na ɔbɛma NIP-44 a ɛyɛ nea obiara bɛtumi akenkan no. Ɛno ne kwan a ɛsɛ sɛ yɛyɛ no sɛ adwuma ntumi nni hɔ, na ɛsɛ sɛ yɛka sɛ kwan no kyerɛ: sɛ yɛntumi nnya nneɛma a yɛreka no a, ɛsɛ sɛ ɛma abomahyɛ (protection) a, ɛnyɛ sɛ ɛma asɛm no ntumi mfi kɔ (delivery). Nkyɛn a ɔhunufoɔ ntumi nnyɛ no no yɛ mpo sɛ nkyɛn a obiara nni hɔ no, ɛnam sɛ asɛm no a ɔbɛma no no, ɛkɔ a ɛnyɛ hwee na obiara nnya mfomsoɔ.

4.1 Ɛnni hɔ yɛ adeɛ a ɛwɔ nea ɛkyerɛ, na ɛwɔ nnyigyeɛ mmiɛnsa.

Biribi a ɛnyɛ kɛseɛ nanso ɛhia paa: Nymchat client biara na wɔkyerɛw nhyehyɛdeɛ no, ɛnyɛ wɔn a wɔnanya post-quantum kwan nkoaa, na wɔbɛtumi ayɛ key field no anaa ɛnyɛ. Ɛno ma ɛyɛ adeɛ sesaa mmiɛnsa a wɔtumi akyerɛ aseɛ, ɛnyɛ mmienu koraa:

Sɛ yɛde akyɛn a ɛtɔ so mmiɛnsa ne akyɛn a ɛtɔ so nan ayɛ baako a, ɛbɛyɛ mawaa kɛseɛ. Anidasoɔ a nkyɛaseɛ nni mu ne nkyerɛwee a wɔahyira sɛ wohane no te Nymchat mu, ɛno na ɛma kwan no kɔ anim no tumi atwa kwan a ɛfa protokol mmienu ntam a ɛyɛ nhwɛsoɔ no so, sɛ ɛnyɛ saa a na ɛbɛhyɛ no mu ma obiara a ɔnhu no.

4.2 Ɔhyehyɛdeɛ a ɛntumi nnye asɛm aseɛ mu yɛ komm.

Nkyerɛkyerɛ no tuabi twa: Ɔhyehyɛe baako ma obiara, na nea ɛtɔɔ no na ɛbɛtena. Ɛno na ɛma nkyerɛkyerɛ no yɛ adwuma, na ɛno nso na ɛma adeɛ a ɛnyɛ nkɔmɔ yɛ kommɔ sɛ ɛbɛkyerɛkyerɛ ne ho. Adeɛ a ɛyɛ adwuma a ɛbɛkyerɛkyerɛ kɔteɛ a ɛde hyɛɛ ne ho no, ɛbɛtu nkyerɛkyerɛ no ase na ɛbɛma obiara de kɔteɛ a nneɛma foforɔ no ntumi ntua no de kɔ bɔ.

Enti, mfonini a ɔnim sɛ root bi wɔ hɔ nanso ɔntumi nmu no, ɔmfa asɛm biara nkyerɛ obiara. Ɛnsɛe na ɔnyɛ adwuma kɔm: ɔka asɛm biara a ɔwɔ nnyigyeɛ (keys) no na ɔsɛe asɛm no kɔ so sɛnea ɛyɛ nokware no, na ɔka kyerɛ ɔnoa (user) sɛ ɔmfa nnye nkorɔ so. Aseɛ kɔm no ne nea ɛsɛ ma mfonini a ɔntumi nnye ne ho asɛm nkyerɛ.

5Hu nneɛma ne decision a wɔde kɔ.

Nnipa (clients) hu nnipa a wɔn nneyɛeɛ (keys) wɔ kwan mmienu so. Adidi a ɛtena daa no fa nnipa a ɔno nkoaa na ɔne wɔn bɔ nkɔmmɔ no ho — nnipa a wɔwɔ nkɔmmɔ mu a ɛsu mu no ne nnipa a wɔwɔ kuro (group) no mu no — enti wɔn nkyerɛkyerɛmu no ba kɔ sɛ asɛm a ɛda hɔ da. Deɛ ɛfa nnipa a wobenya wɔn bio ansa na wobenya wɔn no ho, asɛm bi a ɛyɛ koro no tɔ mmerɛ a wɔrehyɛ mfatih no, ɛnyɛ mmerɛ mmienu a ɛyɛ adɔm (2.5 seconds); sɛ ɛnyɛ deɛ ɛsɛ sɛ ɛyɛ no a, mfatih no kɔ kɔm (classical) fa, ɛno ne sɛnea ɛyɛɛ no ansa na wɔde post-quantum no hyɛɛ mu, na ɛnyɛ ɔhaw foforɔ.

Nnuaeɛ a ɛnyɛ no kae bɔ no mmerɛ du, ɛnyɛ emu mmerɛ biara. Onipa a ɔhyɛ adeɛ foforɔ bi mu, anaa onipa a ɔfirii browser-extension login kɔɔ local key kɔ, ɔbɛyɛ post-quantum capable wɔ ne nkitahodie no mu, na nkabom mmuaeɛ "daadaa" a wɔakae no bɛma wɔn kɔ so di dwuma ne classical encryption no mmerɛ a nkitahodie no kɔ so no nyinaa.

5.1 Adɛn nti downgrade attack biara nni hɔ

Decision a ɛfa kwan a yɛfa so no ho kɔ so ma ɛyɛ asɛm biako pɛ:

pq = (we hold a signed, unexpired ML-KEM key for this recipient)

Ɛnnyɛ sɛ wɔbɛtumi akɔ mpaeɛ mu, ɛnnyɛ sɛ wɔwɔ nkyerɛkyerɛmu a wɔatumi de yɛ adwuma, na ɛnnyɛ sɛ wɔwɔ kwan bi a ɔhawfo bɛtumi aka so de ama adwuma no ayɛ mmerɛ. Mma nkabom no mu. yɛ akɔmɔdeɛ no, na wɔatwerɛ aseɛ. Sɛ wɔayɛ nkitahodie no mpo anaa wɔate nkitahodie no ano a ɛtee mpo a, ɛyɛ sɛ mpaebɔ no kɔ tete kɔ—nea ɛda hɔ ansa na saa adeɛ yi aba—na ɛnyɛ sɛ mpaebɔ a ɛhyia nneɛma mmienu no kɔ mmerɛ mu de ma obi bɛtumi ayɛ mfomsoɔ.

Ɛno nso yɛ nokware na ɛhia kɛseɛ: ɔdom no de hybrid bɛtu. nkoaa sɛnea ɛgye kɔteɛ bi, na kɔteɛ no so kɔmɔ no yɛ adanseɛ sɛ ɔdeɛ no bɛtumi afa mu. Ɛnni biara a bɛtumi a wɔde nkabom hyɛɛ mmaa kɔ ma obi a ɔntumi nkenkan no.

6Ahofakorɔ adidi no

Nymchat nnye NIP-44 mmerɛ, mmom ɛhyɛ no mu. NIP-44 ciphertext a wɔanyɛ biribi koro no ne ade a ɛwɔ ɛdaeɛ mu, na ML-KEM keys no yɛ AEAD a ɛhyɛ no awieɛ mu:

inner = nip44_encrypt(plaintext, conversation_key(sender, recipient))

info  = "nymchat-pq2" || sender_secp_pk || recip_secp_pk || kem_ct || recip_kem_pk
prk   = HKDF-Extract(salt = "nymchat-pq2-v1", IKM = kem_ss)
key   = HKDF-Expand(prk, info || "key",   32)
nonce = HKDF-Expand(prk, info || "nonce", 12)

outer = ChaCha20-Poly1305(key, nonce, plaintext = inner, aad = info)

payload = "pq2." || base64url(kem_ct) || "." || base64url(outer)

Wɔbɛtumi akyerɛ mfonini no nkyerɛaseɛ no nkoaa sɛ woyi anihunu (secrets) biara no fi mu: akoben no (outer layer) ma NIP-44 ciphertext kɛkɛ, na sɛ wopɛ sɛ wofiri mu a, ɛhia ECDH no. Quantum adversary a ɔbɛtumi asɛe secp256k1 no, ɔbɛnya inner key no nanso ɔbɛka ML-KEM nso; ML-KEM a wɔasɛe no, ɛbɛma akoben no atow nsuo na NIP-44 no bɛtena hɔ. Adeɛ biara a yɛde ba no, ɛwɔ ne baabi a ɛsɛ sɛ ɔtena:

• kem_ss nkyerɛ kɔm fam nkyerɛkyerɛmu no mpanim mu nko ara. Ɛnyɛ biribiara wɔ saa derivation yi mu a ɛbɛtumi aka ECDH output no a ɛnsɛe (raw) no, nea Section 6.1 no ma ɛyɛ.
• kem_ct, recip_kem_pk na identity key biara nso wɔde wɔn nkyerɛkyerɛmu (associated data) mu, enti layer no nyinaa bɔɔ mu wɔ hɔn nkyerɛkyerɛmu a ɛhyɛɛ no ase no mu exactly. Sɛ wobɛhyɛ ciphertext bi bɛhyɛ obi foforɔ identity mu a, authentication no bɛfiri, na ɛnsa deɛ.

Wɔyɛ encapsulation foforo wɔ message biara so. ML-KEM key a ɔno na ɔbɛnya no kɔ so dɛɛɛ, nanso message biara wɔ ne ciphertext a ɛtɔ nna koraa na ɛno nti ɛyɛ... kem_ss. Ɛno na ɛma sɛ wɔfiri nonce no mu sen sɛ wɔde ɛyɛ ɛyɛ atɛmmuu no, ɛyɛ nnam: ChaCha20-Poly1305 Wubue no sɛ wode (key, nonce) pair bi ara de kɔ adi dwuma, na wɔ ha, kɛy no ara yɛ foforɔ ma mesaage biara, enti pair biara nnnye biara.

6.1 Adɛn nti na adeɛ a ɛyɛ ɛda ɛda no kɔ so nkyɛn?

Sɛnea a yɛbɛyɛ no foforo ne sɛ yɛbɛfa adeɛ mmienu a wɔahyɛ mu no hyɛ kɔmɔ mu kwan koro mu na yɛahyɛ ɛno awɔ NIP-44:

ck = HKDF-Extract(salt = "…",
                  IKM  = ecdh_x || kem_ss || …)          // do not do this

Saa ahyɛdeɛ yi yɛ den sɛ cryptography. Ɛwɔ asiane baako a ɛfa ne asɛmmuaeɛ ho: ɛhia ecdh_x, ECDH nsuae no mu x-coordinate a ɛnyɛ adi no, sɛ kɔteɛ nneɛma — ne browser extension (NIP-07 na ɛwɔ hɔ) anaasɛ ɔhyɛ nkyerɛwee a ɛwɔ hɔ (NIP-46 na ɛwɔ hɔ) ɛnyɛ saa value no na ɛsan ma. Ɛyɛ NIP-44 ama nea ɔpɛ no na ɛde ciphertext bi hyɛ nsa, ɛno nti na yɛde kɔdeɛ no hyɛ baabi a application no ntumi nnya no.

Enti sɛ yɛhyɛ mmuaeɛ no mu a, ɛkyerɛ sɛ ɛnyɛ ɔkwan biara a ɛhwɛ identity key no wɔ signer mu, ɛno ne sɛ ɛhyɛ nnipa a wɔyɛ adwuma titiriw no mu, na mmoa biara a yɛbɛyɛ wɔ key derivation no so ntumi asesa saa. Layering ma ɛnyɛ nneɛma biara nnye nnyɛ biribi: NIP-44 nya ne nea ɛwɔ hɔ no nyinaa, na nea ɛhwɛ identity key no (signer nso) na ɛyɛ saa, na sɛnea KEM no kɔ so no, ɛfiri recovery code a client no wɔ hɔ no na ɛyɛ. Signer login no yɛ adwumafoɔ a wɔwɔ post-quantum mu wɔ kwan biara so.

Bandwidth ne denka no, na ɛnyɛ nketewa. ML-KEM ciphertext no yɛ bytes 1,088 na ɛfa mesaj koro biara so, wɔde base64url-encode na ɛyɛ characters 1,451; AEAD no nso hyɛ Poly1305 tag a ɛwɔ bytes 16 bi to na ɛma NIP-44 payload no kɔ mu mma nkyɛn baako. Mesaj a ɛwɔ characters 50 bi firi bytes 176 kɔ bytes 1,712 so, na mesaj a ɛwɔ characters 2,000 bi firi bytes 2,820 kɔ bytes 5,238 so. Mesaj koro biara nnyɛ saa koraa sɛ ɛyɛ ketewa, ɛbɛyɛ bra bytes 1.5 KB nkoaa, na ɛno ne denka a ɛwɔ sɛ wɔde enkapsule (encapsulate) foforɔ biara bere bi wɔnkyɛ shared secret bi reuse a wɔnni.

6.2 Nneɛma a ɛkyerɛ ne ho

The pq2. Prefix no ma deployment no kɔ mmerɛ mmerɛ mu: ɛkyerɛ ne ho, enti client no hwɛ payload no na ɛkyerɛ kwan a ɛbɛfa so de decryption no, na ɛnyɛ sɛ ɔde tag no ato ne ho anaa ɔkae nea ne fiefoɔ (peer) no tumi. Reader a ɔntumi nnim prefix no ntumi nnye payload no ase, na ɛnyɛ sɛ ɔtena ne ho nnyɛ no nnyinasoɔ, na nkaeɛ a wɔasee wɔ post-quantum anim no, wɔbɛtumi akenkan no sɛ NIP-44 a ɛyɛ tiawa no, ɛnyɛ sɛ wɔasɛe mu.

6.3 Adeɛ a wɔahyɛ akyɛdeɛ no so mmienu no nyinaa.

A NIP-17 na ɛwɔ hɔ Mowa a ɛyɛ kɔkɔɔ yɛ... NIP-59 na ɛwɔ hɔ adeɛ a wɔahyɛ bɔtene: asɛm a obiannwtɛ ne din so, wɔadehyɛ mu wɔ obi a ɔde asɛm no adi no din ne ne akofena (kind 13) ase, na wɔadehyɛ mu bio wɔ akofena a wɔde ma asɛm biara (kind 1059) ase. Sɛ ɔbɔ mu na ɛhɔ wɔ din ne ne akofena no kɛseɛ, Nymchat sɔ kɔkɔɔ no nyinaa bɔ mu, na obiara wɔ ne nneɛma a ɛhyɛ ne mu.

Signer no akyia no wɔ ɛkan bi a ɛwɔ ntɛm no nko ara. Signer no wɔde nkyerɛwee (seal) no yɛ no sɛ NIP-44 a ɛda hɔ — app no ntumi nnyɛ nnyinasoɔ no hu kɔti a ɛyɛ no — enti ɛntumi nnyɛ no mmerɛ bi a ɛwɔ hɔ no mu. Wei annye mmoa bi wɔ atɛw no ho: nkyerɛwee no wotumi ahu no mmerɛ bi a ɛwɔ ɛhyɛnno (wrap) no mu nko, na ɛhyɛnno no ne nea ɔkyerɛw no de to so. Ɔtamfo a ɔwɔ nea wɔde atwerɛ no mu no, ɔsɛ ML-KEM no ansa na nkyerɛwee noahyɛ n'ani sɛ ɔbɛtumi atɛɛ no.

7Nkabom nsɛm ne kɔm a ɛnyɛ kɛseɛ

Asɛm a wɔde ma group bi nyɛ ciphertext baako. Ɛyɛ asɛm koro a wɔde ma obiara wɔ group no mu, na wɔahyɛ akopi biara mu wɔ obi a wɔde ma no ML-KEM key no mu. Obi a ɔde ne key hyɛɛ ase no nya hybrid wrap; na obi a ɔmme de no nya classical wrap.

Eyi ma akontabuo asɛm bi wom a obi a ɔnyɛ no nteaseɛ no nti ɔyɛ no mpa. Sɛ mma du mmienu mu nson wɔ akɔmgye mu de hybiri kɔpia bi wɔn nka a, asɛm no ne sɛ n nwɔtwe nson no wɔ hyehyɛe mu. Ɔgyinafoɔ hia akopɔɔ baako a ɛyɛ tete wɔ asɛm a ɛyɛ pɛ no mu a ɛyɛ pɛ wɔ nsen nson no nyinaa mu, entisɛ asɛm no wɔ hyehyɛe mu ɛmfa sɛ biara akopii ne.

Enti Nymchat si nkyerɛkyerɛmu wɔ mfom no mu wɔ fan-out no ase — nkan no wɔ hɔ wɔ wraps no wɔn mu yɛ adwuma no ase no nko — na badge no kyerɛ sɛ “quantum-resistant kɔsi nnipa 8 wɔ nnipa 10 mu” na ɛnyɛ sɛ ɛka sɛ mesaj no hwɛ so. Berɛ a nkan biara nni hɔ no, ɛno ne nea ɛyɛ biakɔ ma... Manya Asɛm a ɛkɔfoɔ pii kɔ (osɛnfoɔ no nkoaa na ɔhwɛ nea ɛkɔ sukuu), interface no ka sɛ ɛhyɛ mu mfinimfini na ɛnyɛ kɛseɛ. Sɛ woka sɛ asubɔnten kɛseɛ wɔ wo nkyerɛkyerɛmu no nkoaa so a, ɛyɛ asɛm a ɛyɛ kɛseɛ sen nokware ma asɛm no nyinaa.

7.1 Nea ntwatwa no bɔ amanneɛ

Akontuo no ka nokware fa... mmesɛ, ɛnyɛ software a ɛdeɛ no hyɛɛ mu no ho asɛm:

• Nidi kɛseɛ: asɛm a ɛwɔ mu yi mu nnyinasoɔ biara puee akɔmhyɛ mmienu so.
• Ɛyɛ kakra: Mfonini bi a ɛfa mpɛnkbɔl mfonini ho kɔɔ kwan a ɛyɛ ankasa. Wɔde mfonini a ɛnyɛ kɛseɛ na ɛnyɛ kɛseɛ koraa kɔɔ so, ɛnam sɛ mfonini baako a ɛyɛ ankasa a ne nkyerɛkyerɛmu (plaintext) yɛ teɛ mfonini nyinaa mu no, ɛno na ɛdi adeɛ ma obi a ɔpɛ sɛ ɔyɛ ɔhaw no.
• Yɛka 'Classical' no kɔm nkyerɛ, na ɛnyɛ sɛ yɛma badge biara nnye hɔ, efisɛ sɛ sɛ nkyerɛkyerɛ no nni hɔ a, ɛbɛyɛ sɛ ɛyɛ amanneɛ a ɛbɛtumi aka sɛ 'ɛnni hwee a ɛbɛhwɛ no,' 'ɛwerɛw,' anaa 'saa version yi nni saa adeɛ no mu.'

Decision no wɔtɔ no berɛ a wɔbɔ nkɔmmɔ no mu, ɛnyɛ berɛ a obi bɛka asɛm foforɔ a wɔbɛtumi aka no nkyerɛkyerɛmu no nso. Ciphertext a ɛwɔ hɔ fam nnyɛ possible sɛ wɔbɛma no anibere pa seneɛ ɛteɛ no, na interface a ɛbɛgyina nkɔmmɔ a ɛwɔ hɔ tete no so wɔ nhyɛbɔ foforɔ nti, ɛbɛkyerɛ asɛm a ɛnyɛ nokware fa bytes a ɛwɔ relay no ho.

Akyiwadeɛ a ɛwɔ apatem no so yi de so mfa saa deɛ na ɛnyɛ sɛ ɛde aba saa deɛ: apatem ntebea bɔ no guankɔ yie paa sɛ obiara nkyɛn mu ntebea no wɔ hɔ, na apatem ntebea a ɛno mu nkontaa biara nni hɔ no, ɛkyerɛ sɛ ɛnyɛ kɔmkorom.

8Nnyigyeɛ a wɔakyerɛwdeɛ ma wo

Nneɛma pii a client no to so no wɔ obi a ɔde no di dwuma no nneyɛeɛ mu: asenyina mu a wɔasenyina mu no, asɛmbuo nkyerɛkyerɛmu no, group keys no, ne asɛm a wɔasotow no. Saa nneɛma yi kyerɛ biribi pii a ɛfa obi a ɔde no di dwuma ho koraa sen asɛm baako biara a ɛwɔ hɔ no, enti sɛ yɛbɛma wɔn ayɛ nea ɛda hɔ tiawa (classical) a, ɛbɛyɛ sɛ ɛno ne nea ɛyɛ afonim paa wɔ nneɛma a wɔasotow no mu no, ɛmfa ne sɛ asɛm no mu no wɔase no sɛnea ɛyɛ den. Wɔde adwuma (hybrid) a ɛho yɛ den no ara di dwuma, na wɔahyɛ mu ma ɛkɔ obi a ɔde no di dwuma no nneyɛeɛ mu — deɛ ɛnyɛ saa ne nea wɔaka no wɔ Section 3.2 mu, ne... nymchat-pq-root Kategoria no ankasa, a yɛntumi nkyee wɔ mfuatɛ a ɛno nko ara na ɛtumi yi ase.

Saa nneɛma yi ne bebae a ɛhia paa. Settings nneɛma bi anaa nneɛma a wɔde agye nneɛma a wɔasɛe no, ɛda baabiara wɔ hɔ wɔ afe adindene, na ɛyɛ nneɛma a obi a ɔpɛ sɛ ɔgye nneɛma a ɛwɔ hɔ nnɛ na ɔbɛhwehwɛ nea ɛwɔ mu anɔpa no de kura — ɛyɛ kɛse sene nteɛm biara a ɛkyɛ wɔ onipa no adwene mu.

Ɔkɔnkɔsɛm baako na ɛhyɛ sɛnea ɛyɛ wɔ ha, na ɛnyɛ key no. Akọntaa a wanyɛ no nkyerɛkyerɛmu ma wo nkoaa ɛsɛ sɛ wɔtumi akenkan no biara device no wɔ akaunt no so, enti device biara kyerɛ nea ɔtumi ahu wɔ ne nkyerɛkyerɛmu no mu, na akaunt no ato nea wɔ nyinaa bɛtumi akenkan no nko ara. Sɛ wɔta birikyɛ a, ɛbɛma device biara ammu ne ne ho nsɛm no — ɛno ara ne nsɛm a ɛyɛ deɛ yɛmmu a Section 3.2 de nneɛma foforɔ kã mu kɔsɛeɛ no.

9Nnuaeɛ

The epoch Counter a ɛwɔ derivation no mu na ɛma rotation yɛ possible a ɛmfata key foforo. Sɛ yɛma no kɔ anim a, ɛde keypair tenten foforo firi root koro no mu na ɛde amanneɛ foforo a wɔahyɛ no bio; nnipa a wɔwɔ hɔ no (peers) nya key foforo no firi record a wɔsɛe (replaceable) no mu. Enti, rotation no nkyerɛ ɔhawfo no sɛ ɔnhwɛ nea ɔahyɛ aseɛ bio: root no wɔ hɔ koro ara ma identity biara, na epoch no na ɛma ɛtwam.

9.1 Nkyekyɛmu a ɛda no wɔnkae, na hwee biara wɔrehyɛ asɛm mu bio.

Sɛ kwan (key) sesa a, biribiara nsi kyerɛw bio. Klient no si decryption kwan afiri ɛda (epoch) a ɛwɔ hɔ yi ase kɔ ɛda ɛtɔɔ atɔnwɔ (3) a ɛwɔ hɔ so, enti nsenkyerɛɛma a wɔbɔɔ no ansa na kwan no sesa no, ɛtumi mu ma yɛtumi asusu nea ɛwɔ mu wɔ kwan no a ɛwɔ hɔ berɛ a wɔatumaa nsenkyerɛɛma no.

Ɛtɔ mmerɛ no ne nea ɛma sesa nneyɛeɛ no ayɛ asɛm a wɔbɛtumi ayɛ no wɔ asomdwoeɛ mu: sɛ ɛnni bi a, sesa biara bɛma biribiara a ɛreba no nni kwan. Biribiara a wɔahyɛ mu ansa na ɛnhyɛ bɛtena sɛnea wɔbɛtumi akenkan mfeɛ a ɛtena ahoti no so nyinaa, efisɛ ntoma a ɔnoafoɔ no ntumi nnye no noɔ, ɛyɛ asɛm bɔne kɛseɛ wɔ wɔn nkyɛn sen biribi a nea ɛbɔ ne ho ahoɔden ntumi nnyɛ kwa de hyɛ mfomsoɔ kɔ anim (Section 10.5).

10Deɛ ɛyi nnkyɛ

Nwoma a ɛkyerɛ biribiara a adwuma bi bɛyɛ no nko ara nnye adwuma kɛseɛ bi ase nkyerɛkyerɛ, na sɛ yɛka asɛm a ɛfa ho ban ho kɛseɛ sen ne nokware wɔ asɛm bi ho a, ɛyɛ bɔne kɛseɛ sene sɛ yɛmfa ase mma no. Nea ɛdi ɛnkan yi nnye nea saa adwuma yi bɔ ho ban.

10.1 Asɛmti no yɛ anokware a ɛtɔ so mmienu, na sɛ wate ase a, ɛnyɛ possible sɛ wɔbɛsan nnya no.

Wei ne dwuma yi nsesaeɛ ankasa. Nkyerɛkyerɛmu a ɛwɔ Section 2 mu sɛ ɔmanfoɔ nnye adeɛ baako pɛ na wɔasɛe no, ɛnyɛ possible: nsec no nko ara nnye post-quantum key no ano, ɛdeɛ ɛsɛ sɛ ɛyɛ no ne sɛ, adeɛ biara a obiara hu kwan mma ne mmoa foforɔ nni hɔ a ɛbɛkyerɛ no. Sɛ adeɛ biara nni hɔ a ɛgye root no na Section 3.2 mu wraps no nso nni kwan a wɔbɛto wɔn mu no, nneɛma a wɔataa hɔ tie root-derived key no nnyɛ possible sɛ wɔbɛsan nya wɔn. Wɔnnyɛ escrow biara na wɔate sɛnea ɛsɛ sɛ wɔyɛ no, na wɔate sɛnea ɛsɛ sɛ wɔyɛ no sɛ obiara nni hɔ a ɔbɛtumi agye bi.

Sɛ ɛne nsa kwan nkoaa na ɛyɛ kwan no a, ɛyɛ den sen sɛnea obi bɛtena nka no anim. Ɔno a ɔnnye... nympq1… code anywhere wɔ ne mfeɛ baako pɛ, wɔ adwumayɛ adeɛ baako so, na sɛ wate saa adwumayɛ adeɛ no a, wopue nhyɛeɛ biara a ɛfa post-quantum ho, settings blob, ne archive row a wɔahyɛ mu kyerɛ ɛno ho. Ɛno nsec Ɛnyɛ mmoa; ɛno ne nneɛma no a dwuma no nyinaa hyɛ so.

Sɛ wɔde kwan a wɔahyɛ mu foforɔ hyɛ ɛda bi a, ɛsɛ sɛ ɛdi kwan a wɔde ne nsa adi no so nkyekyɛmu no so ara. Ɔtamfo no hwɛ kwan a ɛyɛ mmerɛw paa na ɔdi no, enti saa nkɔsoɔ no nyinaa yɛ deɛ ne kwan a ɛyɛ mmerɛw paa a wɔde boa ma obi nya deɛ no nyinaa yɛ — ɛtɔ mmom, asɛm a wɔbɛka a wɔbɛkae bi, bɛma ne nyinaa nyɛ deɛ saa asɛm no nti yɛ, na kɔtɔ a wɔahyɛ mu no yɛ deɛ ɔtamfo a ɔgya deɛ ɛwɔ hɔ na ɔrekɔ so bɛhwehwɛ ne mu ɛkyera ɛkyera wɔ hɔ nkyɛn a ɔpɛ no deɛ.

10.2 Nkyerɛkyerɛmu, ɛtɔ ne nhyɛ mu anom si

Nostr mu signature biara yɛ Schnorr wɔ secp256k1 so, na ɛnyɛ biara nso wɔ ha. Ɔtamfo a ɔwɔ quantum computer bi wɔ no, ɔbɛtumi ayɛ signature mpanahyɛ na ɔatumi ayɛ ne ho sɛ ɔno ne ɔno wɔ mmerɛ a ɛreba no mu. Deɛ hybrid key exchange no si kwan kɔ so no yɛ "dua wie, na ɛnka ho" (harvest-now-decrypt-later): ɔtamfo a ɔtwe nneɛma bi wɔ nnɛ, ɔntumi anni kan hwia wɔn deɛ ɔtweee no wɔ ɛda kɔɔ so. Ɛnyɛ ma ɛbɛyɛ dɛ message biara nnyɛ possible sɛ obi bɛyɛ mpanahyɛ wɔ n'anim a ɔwɔ saa mfiri no. Yɛayɛ biribi a ɛda saa nneɛma yi ase no wɔ application no mu wɔ intention mu — padlock no kyerɛ authentication, na shield no kyerɛ confidentiality, na ɛyɛ nneɛma a ɛtwa nkyɛn ɛfiri sɛ message bi bɛtumi ani wɔ biribi anɔkoraa.

Ɛyɛ kwan mmerɛ nso ma nea nkyerɛkyerɛmu a ɛwɔ Section 4 mu no bɛtumi ayɛe. Nea ɛbɔ npub ne ML-KEM key no nso yɛ secp256k1 signature, enti ɔtamfo a ɔbɛtumi ayɛ mfomsoɔ wɔ ɛno so no bɛtumi atow ne key bi atwam. Amanneɛ mmuaeɛ ma ɔtamfo a ɔbɛba wɔ da a ɛreba no so no nyɛ pɛ pɛ ne nokwaremu ma ɔtamfo bi.

10.3 Nsɛm a ɛfa nnyigyeɛ ho

Akyɛdeɛ nkwabɔ hyɛ onim deɛ ɔdeɛ no, na ɔno a wɔde ma no nso mmoa baako akyi. p tag, ne sɛnea ɛyɛ, ne berɛ a ɛhyɛeɛ mu nkrataa no nkyerɛwee. Ɛnyɛ deɛ ɛbɛma obi annya sɛ biribi si hɔ, ne kɛseɛ, anaa berɛ a relay no nyaa ɛno. Traffic analysis nni wɔ saa dwumadie yi mu biara mu.

10.4 Mesh a ɛnyɛ online

Nymchat Bluetooth mesh transport yɛ protocol a ɛtwa biako a ɛwɔ ne nkyerɛkyerɛmu (handshake) pɛ, na saa dwumadi yi nnyɛ ne ho. Mensajɛ a ɛba mesh no so yɛ nea ɛda hɔ (classical).

10.5 Nsɛm a wɔatuma

Mmoa nkyerɛwee a wɔasiesie berɛ a ɛda biara nkyɛn no mu nante tete (classical) deɛ, ɛbɛtena tete sɛ tete nkyerɛwee. Ɛwɔ hɔ deɛ, na wontumi nnye nkyekyem foforo ma. Aboa no bɛhyɛ aseɛ wɔ mbeae a nkyerɛwee no mu nkyɛn biara wɔ post-quantum nkyerɛkyerɛmu (keys) no mu, ɛnyɛ berɛ a wɔahyɛ saa adeɛ no ase deɛ.

11Nneɛma a yɛatwae

12Ayɛ adwuma a ɛda so

Nymchat de adwuma ahorow mmienu a ɛnyɛ baako ma saa adwuma yi — baako ne JavaScript ma web application no, na ɛtɔ so mmienu ne Dart ma mobile applications no, ɛka ML-KEM-768 a wɔayɛ no foforɔ pɛ. Adwuma ahorow mmienu a ɛfiri adeɛ baako mu no, ɛtɔ da biara ase sɛ asɛm bi a ɛbɛyɛ den, enti wɔde wɔn hyɛ wɔn ntam sɛ wɔanya nteteeɛ, na ɛnyɛ sɛ wɔde wɔn hyɛ wo nan sɛ wɔbɛyɛ biara a ɛteɛ pɛ.

Dart ML-KEM nneyɛeɛ no wɔahyɛ no adi die wɔ official no ho NIST ACVP nhwehwɛmu a nimdeɛ wɔ mu ma ML-KEM-768 (ML-KEM-*-FIPS20325 key-generation, 25 encapsulation ne 10 decapsulation cases, wɔde wɔn suite tiawa bi na wɔyɛ. Saa nneɛma yi ne NIST de ma adwuma a wɔyɛ no sɛ wɔasusu (validate), enti sɛ wɔadi bi a ɛkyerɛ sɛ adwuma no yɛ nokware, ɛnyɛ sɛ ɛkyerɛ sɛ clients mmienu no bɔ mu koro. Ɛnneɛ, test vectors a wɔde nso yɛ adwuma no — seed derivation, encapsulation, payload formats mmienu no nyinaa, ne complete gift wraps — wɔfi JavaScript reference no mu na test suites mmienu no hwɛ wɔn. Root secret no ma saa fixture no kɔ anim na ɛnyɛ sɛ ɛsesa no: root kɔ seed, root kɔ keypair, root no public fingerprint, ne key, nonce, ne associated data a wɔfi outer layer no mu, ɛyɛ wɔn nso vectors, enti clients mmienu no ntumi nnye nkyerɛkyerɛmu biara wɔ nea... nympq1… Code no kyerɛ kɔm (bytes) a wɔde si mese no mu. Sɛ nea wɔyɛ no mu nnyɛ pɛ pɛ a, ɛma wobuo (build) no nni mma, na ɛnyɛ ma wanya mese bi a afoforɔ nni kwan sɛ wɔbɛtena mu anaa wɔbɛsane no.

Fingerprint no yɛ adeɛ a ɛsɛ sɛ wɔka no wɔ ne nneɛma yi mu no. Ɛno na ɛma device no kyerɛ sɛ “einya ɛno na me nante so” afiri “einya ɛno na ɛyɛ bi foforo” no mu, na client a ɔntumi nnyɛ client foforo no fingerprint no ase no bɛhunu record a ɛyɛ papa no sɛ ɛnyɛ record biara — na ɛnna, sɛ wɔdi Section 3.3 a, wɔbɛyɛ root a ɛtɔ so mmienu na wɔapira identity no. Ɛno nti na ɛyɛ vector ma saa adeɛ no.