Nymchat fasaha whitepaper

Post-Quantum Key Agreement a Nymchat

Distributing ML-KEM-768 Public Key a kan Nostr ba tare da wani directory ko wani kayan aiki, da kuma ƙirƙirar su daga wani ra'ayoyi cewa ba wani ra'ayoyi ya rarraba.

Adding wani post-quantum key exchange to a messenger ne mafi yawanci ba a matsaloli matsaloli. The primitives suna normalized da kuma library suna. The matsaloli ne cewa kowane dalibai yanzu bukatar wani Tsarin This paper describes how Nymchat ya ce wannan - inda na biyu key ya zo daga, yadda ya zo zuwa mutane da ake bukata da shi, da kuma abin da yanar gizo ne ba su ba su ba su ba su ba su sayi game da matsaloli - da, a karshe, abin da wannan matsaloli ba ba za a sarrafa.

An fassara wannan shafin na inji don dacewa. Asalin Ingilishi shine sigar da ke aiki.

1Ƙananan

Our masu ban sha'awa suna encrypted tare da NIP-44, wanda yana da biyu da za a iya ƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙiri Kasa (RFC 5869) — ba ne mai ban sha'awa da wani quantum kwamfuta; Grover's algorithm ya dace wani square-root accelerup ga wani symmetrical key, kuma 256 bits ya sa shi. Ƙaddamar a kan key ne elliptic-curve Diffie-Hellman over Sabuwar Sabuwar Sabuwar K1, da shor's algorithm ya ƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙiri.

Wannan baƙi ba za a haifar kafin cewa wannan na'urorin yana da gaskiya. A na'urorin tare da storage za a iya sauke da rubutu a yau da kuma saukar da shi a lokacin da damar da aka samu. Duk da abin da aka sauke yanzu da kuma yana da muhimmanci, shi ne ko da yaushe. Wannan shi ne na musamman da haɓaka na post-quantum key exchange, kuma shi ne dalilin da aiki ba za a iya fara ga na'urorin da aka gina.

1.1 Tsarin wannan rubutu ya ce

The mitigation ne mai kyau da aka sani: yi post-quantum key encapsulation mechanism tare da yanki mai amfani, don haka mai ban sha'awa ya kamata ka rufe biyu don karanta wani abu. Nymchat yana amfani da ML-KEM-768 (Ƙararrawa 203) Wannan ya sa da wani matsaloli matsaloli:

Na iya rubuta shi a kan takarda, sauki, ko sauke shi daga wani screen, kuma shi ne duk abin da kowane mutum ya kamata ka sauke shi. A ML-KEM-768 Public Key yana 1,184 bytes. Yana ba za a iya sauki, shi ba za a sauke a cikin amfani da sunan, kuma shi ba zai zama a cikin QR code fiye da wani asali wanda ne kawai 32 bytes.

Sabuwar ƙarfi ne cewa na biyu key ya ba tare da uku daban-daban matsaloli, da sauran wannan karatun ne mafi girma wani bayani ga su:

• Yana iya canza. A key wanda ke ba za a iya karanta a cikin wani mataki ne daidai da abin da mai ban sha'awar ya canza ga su. Section 4 ya ƙirƙirar shi tare da alama, wanda ya ƙirƙirar wannan.
• Ya kamata ka dogara a kan na'urorin mai amfani. The same account a kan wani waya da kuma wani laptop yana da sama key, ko bayanai da aka shigarwa a cikin daya ba za a iya buga a cikin sauran. Section 3.2 yana samu shi.
• Za a iya rage. Public key ne re-published daga wani halitta, don haka abin da ya kamata a haifar ne wannan halitta - da kuma ba tare da halitta ba za a gina shi. Section 10.1 ya ce daidai abin da ya dace, saboda wannan halitta ba za a gyara kamar yadda za a bayar.

2Design ƙarfi

Tsarin ƙirƙirar da aka ƙirƙirar bayani, da suka ƙirƙirar da yawa daga cikin m zane kafin wani code an rubuta.

1. Za a iya samun daidaici. Kasuwanci na Nostr yana ƙirƙirar da hanya daya, nsec. Kowane ƙarin ra'ayoyi ne wani yanayi don ra'ayoyi, kuma wani mutum wanda ya sani don sauke nsec ba za a iya sauke wani abu don sauke wani abu. Sabuwar 3.1 yana nuna cewa wannan daya ba za a iya sauke tare da tsaye - wani post-quantum key da aka sauke daga nsec ba ya samar da wani post-quantum sarrafa a kowace - don haka zane ya sauke wani ra'ayoyi da ba mafi: wani nau'in nau'in kayan, da aka sauke daya daya daya a kowace identity, da aka buga a matsayin nsec da a cikin sama yanki, don haka wanda ya san yadda za a sauke daya za a sauke daya. Sabuwar 10.1 ne m game da kudi.
2. Ƙungiyoyi Duk wani sabis wanda za a iya yiwuwa don sayen abin da key yana da kowane. Duk wani wannan sabis yana zama da mataki a cikin abin da bayanai za a iya redirect.
3. Manyan kayan aiki, daya identity. A Nostr identity an amfani da yawa abokan ciniki a lokacin da. Kowace key kayayyakin da aka samuwa a kan dukkan su, da kuma lalace-tallace-tallace-tallace-tallace-tallace-tallace-tallace-tallace-tallace-tallace-tallace-tallace-tallace-tallace-tallace-tallace-tallace.
4. Bincike ba. Duk wani canja-in-band na “wayo'i ba ka taimakawa?” ne wani yanki da wani mashawarci iya riga don ƙirƙirar ƙananan. A zane ne ba za a iya ƙirƙirƙirar.

3Ƙwararraki Ƙwararraki Ƙwararraki

Saboda haka, za mu iya yi amfani da wata mahimmanci da za a yi amfani da wata mahimmanci da za a yi amfani da wata mahimmanci.

pqRoot   = 32 bytes from a CSPRNG, generated ONCE per identity

seed     = HKDF-Expand(
               HKDF-Extract(salt = "nym-pq-root-v2", IKM = pqRoot),
               info = "mlkem768/epoch/" || epoch,
               64 bytes)

(ek, dk) = ML-KEM-768.KeyGen(seed)

Tsarin aka nuna don masu amfani kamar yadda nsec ne: Wasanni32 Ƙungiyoyi Ƙungiyoyi Ƙungiyoyi Ƙungiyoyi Ƙungiyoyi nympqKuma shi ya karanta a matsayin nympq1…, da aka nuna tare da nsec a kan asali screen a kan dace da haɗin haɗin haɗin, da aka saita tare da wannan aiki, ba tare da wannan tsari, ba tare da saita da kuma ba tare da saita a kowace ƙasa a cikin tsari. Yana ba ne wani haske da kuma ba shi ne wani login. Yana da kayayyakin da masu amfani zai iya saita, kamar yadda nsec.

Salt ne domain-sara a kan sha'awa, don haka ba wani rahoton zai iya yiwuwa da sama keypair. epoch Counter drive rotation (Section 9).

3.1 Yadda za a iya ƙirƙirar da Key daga Identity Key

The daidaici zane ne don ƙirƙirar keywordpair daga ra'ayin da masu amfani ya dace:

seed = HKDF(salt = "…", IKM = nsec)          // do not do this

Yana da sha'awa ga hudu ma'aikata, duk da su ne ma'aikace-aikace: ba tare da wani abu don saukewa, saboda nsec ya zama saukewa; kowane na'urorin da aka sauke da gina, tare da ba tare da wani saukewa protocol, za a yi magana; daya canza-cace-cace na'urorin da ke daidai da shi, saboda na'urorin ba za a iya ba da sha'awar game da kewayon; da kewayon da aka zama kafin da aka ba da kowane lokaci, don haka wani abokin ciniki za a iya shigar da wani abu a gare shi a farko.

Duk da haka, al'amurran Shor yana da kyau, saboda wani dalilin. Algorithm na Shor yana aiki ga npub da aka gabatar da nsec. A al'amurran al'amurran yana da al'amurran a kan nsec. Saboda haka, al'amurran wanda ya gabatar da al'amurran al'amurran yana aiki da al'amurran post-quantum ta hanyar aiki da sama HKDF da kowane mutum yana aiki. Ga al'amurran-da-decrypt-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da

The second clause of that rule does as much work as the first. A independently generated secret that is then synchronized between a user's devices within an ordinary NIP-44 message is the same failure with additional steps: a mai ban sha'awa ya rubuta wannan labarin a yau da kuma samu ta classic key a baya, kuma asali rufe. Saboda haka da yanayin a cikin gaba sassa ne yanayin da su ne, kuma haka ba su ne “send shi to your other device.”

3.2 Sauke tsari zuwa sauran na'urorin masu amfani

Tsarin 3 na Section 2 - daya identity, da yawa na'urorin - ba za a iya yiwuwa ta arithmetic a nan, saboda cikakken mataki ne cewa daidaitacce ba ne wani aiki na wani abu da na'urorin da aka ƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙiri. nympq1… QR koda

Root yana nuna a matsayin nympq1… a kan nsec, kuma wani na biyu na'urorin da aka ba da shi a cikin wannan panel. Wannan shi ne cikakken mechanism. A na'urorin da ba ya ba da code ba za a iya shiga, wanda Section 4.2 ya ce.

Tallace-tallace ne mai ban sha'awa a kan wani farko mataki. Rule a 3.1 ya ce da wuri ba za a iya ba za a iya tafiya a karkashin classic-only encryption, da kuma kowane mechanism wanda zai yi wannan automatic - syncing shi ta hanyar wani relay, shirya shi tare da identity key - saduwa daidai cewa.

The format sauke wuri ga wani wraped paths: wani record zai iya ƙirƙirar wani lissafi na wraps, kowane wani AEAD blob a karkashin mai amfani za a iya ƙirƙirar a kan wani na'urorin - wani passkey PRF ƙirƙirar, misali. nympq1… code ne kawai hanyar zuwa. Section 10.1 ya ce abin da ya dace.

Takardun shaida yana haifar a cikin sassan sassa, nymchat-pq-rootDuk da ba da wani wraps, yana yi aiki da ake bukata: da kewaya shi ne kamar yadda wani biyu na'urorin ya sa cewa wannan asali yana da wani wuri, wanda shi ne abin da ya sa shi da wani rike (Section 3.3).

3.3 Hanyar da kuma ƙaddamarwa

On boot, rike wani durable identity, wani client yana aiki a wannan tsari:

1. Zabi wani existing nymchat-pq-root takardar kebantawa
2. Record found, kuma wannan na'urar zai iya rarraba shi - Ya yi amfani da shi da kuma nuna wannan al'amari a matsayin post-quantum iya.
3. kayan aiki da aka samu, kuma wannan na'urar ba za a iya rarraba shi — ba za a yi wani sabon root, kuma ba za a buga wani al'amari a kowace lokaci. nympq1… code daga wani na'urorin da yana da shi.
4. Bincike — yi wani roots, sayar da kayan, kunshi, da kuma nuna nympq1… code don amfani da wani lokaci don haka za su iya saita shi.

Mataki 3 ne mataki da za a sauki za a sauke, kuma shi ne da haka da alamar da aka rubuta a kan lissafi fiye da ƙaddamar da kowane ƙaddamarwa. Two na'urorin da kowane za a yi shawara don samar da ƙaddamarwa biyu a karkashin wani asali, da kuma shi ne ƙaddamarwa wannan alamarwa yana zama don canza.

4Ƙananan Ƙananan Ƙananan

Public yarda na derived keypair an buga a matsayin addressable Kasa-01 event — irin 30078, tagged nym-pq:

{
  "kind": 30078,
  "tags": [
    ["d", "nym-pq"],
    ["t", "nym-pq"],
    ["expiration", "<unix seconds>"]
  ],
  "content": {
    "v":     2,
    "alg":   "mlkem768",
    "nym":   1,
    "epoch": 0,
    "pk2":   "<base64url ML-KEM-768 encapsulation key>",
    "exp":   <unix seconds>,
    "devices": [ ... ]
  }
}

Addressable yana daidai da relay yana da wani matsaloli a kowace (kind, pubkey, d-tag), don haka wani republish ya canza gabatarwa na farko a lokaci. Duk da haka kowane identity yana daidai da wani yanzu record, wanda ya sa “ku yi “ look up Alice's key” wani kawai m fetch fiye da wani lissafi don haɓaka.

Takaddun shaida ne mai ban shaida. The event da aka ƙirƙirar ta ID key, don haka shawarar “da wannan ML-KEM key yana da wannan npub” ne daidai da yafi kamar yadda npub ya sami. A canza wani daban-daban encapsulation key da ake bukata da secp256k1 takardar shaida. A mai yiwuwa wanda zai iya yi wannan ba za su yi magana da KEM.

Tare da Bincike. Sabuwar Sabuwar NIP-40 Shigarwa, da aka rubuta a kowace 24 hours, yana ƙirƙirar takardun shaida game da wani abokan ciniki da aka yi aiki a kan abin da aka yi. The root ya ba zai zama ba tare da shi, kawai takardun shaida game da shi ya yi.

Kyakkyawan bayanai da aka karfafa ne daidai da abin da ba ya ba da wani gwiwa: mataimakin da aka sauke NIP-44, wanda kowane login zai iya saita, kuma abokan ciniki ya tafi post-quantum canja a kan gaba mai amfani, a lõkacin da ya rubuta. Saboda haka, yi waƙa kowace kowace kowace kowace kowace kowace kowace kowace kowace kowace kowace kowace kowace kowace kowace kowace kowace kowace kowace kowace kowace.

Wannan asymmetry yana da matsaloli don matsa lissafi, ba tare da wani matsa lissafi, matsa lissafi ya zama matsa lissafi tare da matsa lissafi: wani na'urorin da aka saukarwa, reset, ko yana da matsa lissafi ya saukar da wani matsa lissafi don ƙirƙirar a kan wani matsa lissafi wanda ba da wani matsa lissafi, da kuma bayanai da aka sauke a karkashin shi ba tare da wani lissafi a kowace ƙasa. Seven days bounds that window, da kuma sa relays drop the record themselves rather than relying on clients to notice.

The key field ya saduwa da format. Yanar Gizo pk2, da digiri ne sassa na al'ada fiye da na'urorin: shi ne sassa da fayil na yanayin da za a iya amfani da tare da. A daidaitaccen da ba ya sani da yanayin ya sa “Nymchat client, ba post-quantum key” da kuma ya ba da al'ada NIP-44, wanda kowane login zai iya saita. Wannan shi ne daidai da yanayin haske, kuma shi ne daidaituwa a matsayin kan al'ada da yanayin numbering yana zama don ƙirƙirar: wani ƙirƙirar ƙirƙirar ƙirƙirar da ba za a ba da kudi, ba za a ba da shi. A daidaitaccen da wani peer ba za a iya amfani da shi ne mafi girma fiye da wani key a kowace, saboda bayanin da

4.1 Abun ciki ne mai ban sha'awa, da kuma tri-valuated

Subtle amma muhimmanci bayanin: Binciken da aka buga da kowane Nymchat abokan ciniki, ba kawai waɗanda za su iya post-quantum, da yanki ne mai ban sha'awa. Wannan yana samar da uku daban-daban hali ko biyu:

Ƙungiyoyi ba tare da keywords ne wani takardun shaida cewa mai ban shaida ne Nymchat, wanda ya sa shi don ƙirƙirar ƙirƙirar ƙirƙirar ƙirƙirar ƙirƙirar ƙirƙirar ƙirƙirar ƙirƙirar ƙirƙirar ƙirƙirar ƙirƙirar ƙirƙirar ƙirƙirar ƙirƙirar ƙirƙirar ƙirƙirar.

4.2 A na'urorin cewa ba za a iya buga asali ya zama tsanani

Shawarar shi ne canzawa: wani matsaloli a kowace asali, last write wins. Wannan shi ne abin da ya yi aiki na single-record zane, kuma shi ne kuma abin da ya sa da wani na'ura mai ban sha'awa idan ya gabatar da. A na'urorin da ya gabatar da key da ya gabatar da shi don ƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙir.

Saboda haka, wani na'urorin da ke sani wani roots yana, amma ba za a iya buga shi, ba ya gabatarwa a kowace lokaci. Yana ba ya rufe da kuma ba ya ba ya rufe daga aikace-aikace-aikace: shi ba ya karanta kowane labarin da yake yana da kewayon da kuma ba ya sauke a cikin al'ada, yayin da ke ba da abokan ciniki don ƙirƙirar shi. Silence ne daidaita mai kyau ga na'urorin da ba za a iya magana ga al'ada.

5Discovery da ƙirƙirar ƙirƙirar

Customers dalibai peer's keys cikin biyu hanyoyin. A standing abokin tarayya ya ƙunshi mutane da wani masu amfani ya rarraba tare da — open tallace-tallace da grup na ma'aikata — don haka al'amari su zo a matsayin yawancin matsala. Ga wani peer-tabi a farko, wani wani tsari na farko ya yi a lokacin send, ƙarfi a 2.5 seconds; idan shi ba ya rarraba, da al'amari ya zama classic, wanda shi ne al'amari da aka zama kafin post-quantum aka buga a kan wani sabon matsaloli mode.

A masu amfani wanda ya sauke wani sabon na'ura, ko wanda ke goyon baya daga wani browser-extension login zuwa wani yanar gizo, ya zama post-quantum iya mid-conversation, da kuma daidaitacce “no” za su sauke su a cikin classic encryption don rayuwa na al'ada.

5.1 Yadda za a ba da wani downgrade attack

Routing takardar shaida ya rage zuwa wani tambayoyi:

pq = (we hold a signed, unexpired ML-KEM key for this recipient)

Duk da haka, za a iya samun daidai da cewa za a iya samun daidai da cewa za a iya samun daidai da cewa za a iya samun daidai da cewa za a iya samun daidai da cewa za a iya samun daidai da cewa za a iya samun daidai da cewa za a iya samun daidai da cewa za a iya samun daidai da cewa za a iya samun daidai da shi. shine The fault mode of a stripped or withholded announcement ne cewa lissafi ya zama classic - status quo kafin wannan halitta - fiye da cewa wani halitta lissafi ne lowranged zuwa wani abu da za a iya ba.

Converse kuma yana da muhimmanci: wani abokin ciniki ya ba da hybrid hanya a lokacin da yana da key, da kuma yin key shi ne dokokin da abokin ciniki za a iya decapsulate. Akwai wani hali a cikin abin da al'amurran ya rubuta post-quantum ga abin da ba za a iya karanta shi.

6Ƙararrawa na Hybrid

Nymchat ba ya canza NIP-44. Yana ƙarya shi. Unmodified NIP-44 ciphertext ne cikin yanki, kuma ML-KEM keys wani yanki AEAD game da shi:

inner = nip44_encrypt(plaintext, conversation_key(sender, recipient))

info  = "nymchat-pq2" || sender_secp_pk || recip_secp_pk || kem_ct || recip_kem_pk
prk   = HKDF-Extract(salt = "nymchat-pq2-v1", IKM = kem_ss)
key   = HKDF-Expand(prk, info || "key",   32)
nonce = HKDF-Expand(prk, info || "nonce", 12)

outer = ChaCha20-Poly1305(key, nonce, plaintext = inner, aad = info)

payload = "pq2." || base64url(kem_ct) || "." || base64url(outer)

Duk da haƙƙoƙin haƙoƙin haƙoƙin haƙoƙin haƙoƙin haƙoƙin haƙoƙin haƙoƙin haƙoƙin haƙoƙin haƙoƙin haƙoƙin haƙoƙin haƙoƙin haƙoƙin haƙoƙin haƙoƙin haƙoƙin haƙoƙin haƙoƙin haƙoƙin haƙoƙin haƙoƙin haƙoƙin haƙoƙin haƙoƙin haƙoƙin haƙoƙin haƙoƙin haƙoƙin haƙoƙin haƙoƙin haƙoƙin haƙoƙin haƙoƙin haƙoƙin haƙoƙin haƙoƙin haƙoƙin

• kem_ss Duk wani abu a cikin wannan ƙaddamarwa ba ya sa ECDH raw output, wanda shi ne abin da Section 6.1 rufe.
• kem_ct, recip_kem_pk Kuma dukkan asusun asusun da aka haƙƙoƙi a matsayin bayanai da aka haƙƙoƙi, don haka da ƙarƙirar ƙarƙirar da aka samar da shi. Splicing wani asusun asusun a kan asusun na wasu abokan ciniki ba zauna asali fiye da decrypting.

Ƙaddamarwa da aka yi aiki a cikin kowane rahoton. Ƙaddamarwa na ML-KEM na abokin ciniki yana da tsawon lokaci, amma kowane rahoton yana ƙirƙirar wani ra'ayoyi na tsari da haka wani ra'ayoyi na tsari kem_ssWannan shi ne abin da ya yi amfani da nonce fiye da randomize shi sauke: Shafin shafi: ChaCha20-Poly1305 Yana da ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙananan ƙ

6.1 Yadda za a jera layers

Alternative ne ya ƙirƙirar biyu ra'ayi a cikin daya tallace-tallace key da kuma ƙirƙirar da shi zuwa NIP-44:

ck = HKDF-Extract(salt = "…",
                  IKM  = ecdh_x || kem_ss || …)          // do not do this

Wannan shigarwa yana so kamar cryptography. Yana yana da wani tsarin matsaloli: yana bukatar ecdh_x, raw x-koordinate na output na ECDH, a matsayin key kayan - da ƙarin browser (Farashin NIP-07) ko ƙirƙirar ƙirƙirar (NIP-46Yana aiki NIP-44 a girmama mai ba da sha'awar da kuma saukarwa a cikin rubutu, wanda shi ne cikakken mataki na haɓaka key a wani yanki da aikace-aikace ba za a iya samun.

Takaddun sha'awar da yaushe kowane login wanda ya sa da kimiyya key a cikin signer, wanda shi ne ya ce mafi kyau masu amfani, kuma ba tare da wani yawan aiki a kan Key Derivation zai iya canza shi. Layering yaushe da dependency: NIP-44 ya zama cikakken da aka samar da abin da ke dauke da kimiyya key, signer ciki har da, yayin da KEM yarda da aka sayarwa daga daidaitacce code da abokin ciniki ya halaka. Signer logins ne m post-quantum dalibai a kowace hanyoyin.

The farashin ne bandwidth, kuma shi ne ba. The ML-KEM ciphertext ne 1,088 bytes da yaushe a kan kowane labarin, base64url-coded zuwa 1,451 alama; na yanki AEAD ya sa a 16 byte Poly1305 tag da ya ƙirƙirƙirar NIP-44 payload shi ƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙ

6.2 Self-describing payloads

da pq2. Prefix ya yi amfani da tsari: shi ne self-describing, don haka da abokin ciniki ya zabi decryption path by inspecting the payload rather than by trusting a tag or remembering what a peer supports. A reader that does not recognize a prefix fail to open that payload rather than mis-reading it, kuma takardun sha'awar kafin kowane yanki za a iya yi post-quantum daidaitacce kamar kananan NIP-44 ba tare da ba m.

6.3 Duk wani layer na gift wrap

A NIP-17 takardar kebantawa a NIP-59 Gift wrap: wani alama ba tare da alama, da aka girmama a karkashin takardun sha'awa (kayan 13), sa'an nan aka girmama a karkashin takardun sha'awa (kayan 1059). A kan wani login wanda ya riga takardun sha'awa ta hanyar tsaye, Nymchat hybridizes biyu layers, kowane tare da wani musamman encapsulation.

A signer login yana samu kawai yanki. The seal ne samar da signer a matsayin m NIP-44 - da aikace-aikace ba ya yi shi da key - don haka ba za a iya hybridize a yanki. Wannan ba zai iya ba da wani kudi ga shigarwa a kwatanta: da seal ne iya samun kawai ta hanyar shigarwa, da shigarwa ne abin da wani recording kayayyakin. A na'urorin haƙƙƙĩƙa da kayan aiki da aka shigar da ML-KEM kafin da shigarwa zai zama m ga shigarwa.

7Group Messages da ƙarin ƙarfi

A group message ba ne daya siffar texts. Yana da wannan tsare texts funned out to kowane mita, kowane copy encapsulated to that member's own ML-KEM key. A mita wanda ya gabatar da wani key yana samu wani hybrid wrap; wani wanda ba ya samu wani classic wrap.

Wannan ya ƙirƙirar wani matsaloli matsaloli cewa wani naivi ƙirƙirƙirar yana da matsaloli. Idan matsaloli na kowane kowane kyakkyawan da aka samu wani hybrid copy, ba 8-10 ajiya. A mai ban sha'awa yana bukatar wani classic copy na ajiya da aka dace a cikin kowane kowane kowane kowane kowane kowane, don haka lissafi ne ajiya kawai idan kowane Copy ya.

Nymchat duk da haka tracks per-message coverage a lokacin fan-out - da aka sani kawai yayin da wraps suna gina - da kuma badge ya gabatar da “quantum-tallace-tallace zuwa 8 na 10 abokan ciniki” fiye da cewa al'amari ne mai sarrafawa. Tuntube group message (ko kawai mai ban sha'awa ya sayar da fan-out), da interface ya gabatarwa sassa fiye da cikakken sarrafawa. Gano da cikakken sarrafawa a kan ƙarfi na kowane copy kawai zai zama wani overstatement game da bayanin a cikakken.

7.1 Yadda Shield ya gabatarwa

Shield ya ce hakkinta game da Tuntube mu, ba game da software wanda ya sa shi:

• Full kudi: kowane copy na wannan plaintext ya zama hybrid.
• Partial: wasu copies na wani group message ya fara classically. Drawn degraded fiye da cikakken, saboda daya classical copy na wani m texts identical a dukkan su ne duk wani adadin bukatun.
• Classical da aka ƙaddamar da tsaye, ba tare da wani badge, saboda wani ƙaddamarwa ba ne m tsakanin “unprotected”, “broken”, da “tallace wannan ƙaddamarwa ba da aiki”.

Tsarin da aka zama ba za a iya zama mafi kyau da shi ne, da kuma wani yanar gizon da ke daidaito a kan daidaitacce a kan wani sabon al'amari zai tabbatar da wani abu a kan bytes a kan wani relay.

The group rules fiye da stack a kan wannan fiye da ƙirƙirar shi: wani group message ne cikakken sarrafawa kawai a lokacin da kowane dalibai copy ne, da kuma a gabatarwa group message tare da ba tare da coverage sayarwa nuna sassa.

8Copies da aka rubuta da ku

Manyan abubuwa da abokan ciniki suna ajiya a kan asali na masu amfani: zane-zane, tallace-tallace list, group keys, da messaging archive. Wadannan suna ƙirƙirar fiye da masu amfani fiye da mafi na musamman messaging, don haka ba da su classic za su yi su ne mafi kyau ajiya artifact ba tare da yadda kammala da bayanai da aka shigarwa. Suna amfani da sama hybrid, ajiya tare da masu amfani ta halitta-tallace-tallace-tallace - tare da wani ƙarshe da aka ce a Section 3.2, da nymchat-pq-root category, wanda ba za a canza a karkashin key wanda kawai ya iya samar.

A settings blob ko wani archive bar ne a cikin wani yanki don shekaru, wanda shi ne daidai da mataki na abu da wani gaban-da-deskript-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da-da.

Wani ƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙira kowane Kowane na'urorin yana nuna abin da za a iya buga a cikin takardun sha'awa da aka buga, da aka rubuta kawai abin da kowane na'urorin yana iya sa. Gina abin da ke ba zai rubuta wani na'urorin daga cikin dacewa - da wannan abu mai ban sha'awa na Section 3.2 ba tare da sauran kayayyakin, a cikin wani daban-daban yanki.

9Rotace

da epoch Counter a cikin derivation ne abin da ya yiwuwa na rotation ba tare da sabon key kayayyakin. Binciken shi yana samar da wani sabon keypair daga sama roots da kuma a republished kunshi; peers samu sabon key daga cikin canzawa kayayyakin. Saboda haka rotation ba ya ce masu amfani don rubuta wani abu: da root an samar da wani lokaci ga wani identity da epoch ya yi girma.

9.1 Gamma epochs suna daidaita, kuma wani abu ne re-encrypted

Duk da haka, wani abokan ciniki ya gina decryption kandida daga cikin yanzu epoch zuwa epoch − 3, don haka bayanai da aka girmama a karkashin kafin ajiya ba zauna a kan keypair da aka yanzu a lokacin da ya rubuta.

Wannan yanki shi ne abin da ya sa rotation mai sauri don yin a kowace: ba tare da shi, kowane rotation za su rage abin da aka a cikin jirgin. Duk da ake sauke ya zama sauki ga rayuwa na identity, saboda bayanin da masu amfani ba za a iya sauke shi ne mai sauki ga su fiye da wani wanda shi ne ba za a iya ci gaba da hankali (Section 10.5).

10Yadda za a tabbatar da

A karkashin cewa kawai listed abin da wani zane ya samu ne ba ya nuna tsarin, da kuma overstating wani zane-zane a cikin yanar gizon ne mafi girma fiye da rufe shi. A karshe ne fiye da abin da wannan zane ya gina.

10.1 Tsarin ne na biyu ra'ayoyi, kuma ra'ayoyi ba za a iya rage

Wannan shi ne real price na zane. Bincike a cikin Section 2 cewa masu amfani ya kamata ka samu wani abu: nsec kawai ba ya ƙirƙirƙirar post-quantum key, saboda cikakken mataki shi ne cewa ba wani jama'a da kuma ba wani abu ya ƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙir

tare da manufa ta kawai lalata, wannan yana da karfi fiye da za a iya karfafa. A masu amfani wanda ba ya ba da nympq1… code a kowace rana yana daidai da wani copy na shi, a kan wani na'urorin, da kuma rage wannan na'urorin ya rage kowane post-quantum message, settings blob da kuma archive line shigar da shi. nsec ba zai taimakawa; shi ne abin da cikakken zane ne a kan.

Duk wani shimfidar shimfidar shimfidar shimfidar shimfidar shimfidar shimfidar shimfidar shimfidar shimfidar shimfidar shimfidar shimfidar shimfidar shimfidar shimfidar shimfidar shimfidar shimfidar shimfidar shimfidar shimfidar shimfidar shimfidar shimfidar shimfidar shimfidar shimfidar shimfidar shimfidar shimfidar shimfidar shimfidar shimfidar shimfidar shimfidar shimfidar shimfidar shimfidar shimfidar shimfidar shimfidar shimfidar shimfidar shimfidar shimfidar shimfidar shimfidar shimfidar

10.2 Authentification, kamar yadda zauna daga ra'ayi

Kowane takardar shaida a Nostr ne Schnorr fiye da secp256k1, kuma shi ne ba a canza a nan. Abokin ciniki tare da wani quantum kwamfuta za a iya gabatar takardar shaida da kuma canza wani masu amfani a lokaci daidai. Saboda abin da hibrid key exchange zauna shi ne har ma'adinai-da-decrypt-sa'an nan: wani takardun shaida a yau ba za a iya karanta shi har yanzu. Yana ba zai ba da wani takardar shaida ba tare da wani abokin ciniki wanda ya dace da na'ura. Wannan takardar shaida an ƙunshi a cikin aikace-aikace-aikace - takardun shaida ya gabatar da takardun shaida, takardun shaida da takardun shaida, da kuma su ne sassa glyphs saboda

Yana da ƙaddamar da abin da ƙaddamar da a cikin Sabuwar 4 za a iya ƙaddamar da. A ƙaddamar tsakanin npub da ML-KEM key ne secp256k1 takardar shaida, don haka mai ban mamaki wanda zai iya ƙaddamar da waɗanda za su iya ƙaddamar da wani takardar shaida. Awarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwarwar

10.3 Metadata

Gift wraping sanyaya mai ban mamaki, mai ban mamaki fiye da wani p tags, type, da timestamp na yanar gizon. Yana ba su gane cewa wani matsaloli yana, da ƙarfi, ko a lokacin da wani relay ya samu shi. Traffic analytics ba da wani ɓangare na wannan zane.

10.4 The offline mesh

Nymchat's Bluetooth mesh sabis ne mai ban sha'awa tare da hanyoyinsa, kuma ba shi ne ba tare da wannan aiki. Messages over the mesh ne classic.

10.5 Ma'aikatan da aka saita

Ciphertext da aka rubuta yayin da kowane yanki ya zama classic da aka zama classic daidaituwa. Yana da aka zama kuma ba za a iya rubuta. Tsaro yana fara a cikin lissafi inda kowane yanki da aka gane post-quantum keys, ba a lokacin da halitta da aka canza.

11Tuntube Alternatives

12Ƙididdiga na Gida

Nymchat ships biyu m zane-zane na wannan zane-zane-zane-zane-zane - daya a JavaScript for web application, daya a Dart for mobile applications, ciki har da wani daga-duba ML-KEM-768 port. Two zane-zane na sama primitive ne har ila yau da kullum wani wajibi, don haka su ne daidaita a kan daidaito fitarwa fitarwa.

The Dart ML-KEM ƙirƙirar da aka ƙirƙirar da asali NIST ACVP Ƙararrawa Ƙararrawa Ƙararrawa Ƙararrawa Ƙararrawa Ƙararrawa Ƙararrawa Ƙararrawa (ML-KEM-*-FIPS203) — 25 key-generation, 25 encapsulation da 10 decapsulation cases, da aka yi aiki a matsayin da shirye-shirye. Wadannan ne vectors NIST ya gabatar don karfafawa wani girmama, don haka karfafawa su ne gabatarwa cewa port ne daidai, ba kawai gabatarwa cewa biyu abokan ciniki suna da shawarar da su. Bugu da wannan, wani gabatarwa na gwaji vectors — sanyi derivation, encapsulation, biyu payload format, da kuma cikakken gift wraps — an ƙirƙirar daga JavaScript reference da kuma daidai da biyu gwaji shirye-shirye. The root secret ya ƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙirƙ nympq1… Code yana daidai ko game da baits da bayanin da aka ƙaddamar da. A daidaitacce a cikin kowane ƙirƙirar ba za a yi ba da bayanin da sauran abokin ciniki ba za a iya buga.

Yana da abin da ya ce wani na'ura “tallace shi ne asali na yi” daga “tallace shi ne wani daban-daban, da kuma wani abokin ciniki wanda ba zai iya ƙirƙirar asali na wani abokin ciniki zai karanta wani kyau kayayyakin kamar yadda ba kayayyakin ba - kuma sa'an nan, bayan Section 3.3, mint wani na biyu asali da ƙirƙirar asali. Yana da wani vector don haka.