Nymchat teknekel raita-papel

Post-Quantum Ki Agrement in Nymchat

Sen ML-KEM-768 pɔblik ki go na Nostr witout ɛni diriktori o rejistri, ɛn yu de mek dem fɔm frɔm wan sikret we no pɔblik valyu kin ɛksōz.

Put post-quantum key exchange inside wan messenja no be mostly cryptography problem. Di primitives don set di stannad an di librari de. Di difikult pat na se evri wan we de yus am naw nid... sekun pablik ki, and wan netwerk we nɔ de sentraliz nɔ get wan klia ples for put am. Dis pepa de tɛl us aw Nymchat ansa dat — we di sɛkɔn ki de kam frɔm, aw i de riːt di pipul we nid am, and wet in di intafɛs de ɔlow fɔ se bɔt di risɔlt — and, in di las sɛkʃɔn, wet di risɔlt nɔ de protɛkt.

Dɛn translet dis pej wit mashin fɔ mek i izi fɔ am. Di Inglish ɔrijinal na di vɛshɔn we de aplay.

1Di prɔblɛm

Nostr praiwet mesij de enkript wit NIP-44 we dɛn kɔl, wey get tu part wey kin de separate. Di half wey de scrambl di plaintext — ChaCha20 wit an HMAC-SHA256 tag, wey dem di ki thru HKDF (RFC 5869) — wan quantum computer nɔ go de do anything serious to am; Grover's algorithm de gi wan square-root speedup pan wan symmetric key, and 256 bits de kover dat. Di half wey agri na di ki na elliptic-curve Diffie-Hellman over secp256k1, an Shor's algorit de solf di diskrit logaritm plen. If yu get wan privat ki frɔm di pabliki wan, e go mek di ol sekrit we dat ki don share de show bak.

Dis titi we dis de mek nɔ de pas go tɛl we di makin de. Eni enimi we de stɔːj tin de kɛn kɔpiti di kɔd tɔdey, ɛn rɛd am wen di pɔw de. Wen yu sɛnt ɔni tin nɔw we go stɛl bɛ bɛrim tɛn, ɛn ɛlɛdi kɔmpromɔs. Dis na di spesifik atak we post-quantum kii ɛksʧen sɛp, ɛn na ɛ bɔdi de rɛzɔn we di wok nɔ kɛn wait tɛl we dem go bɔld di makin.

1.1 Di kweschan dis pepa ansuh

Di way fɔ stop di problem de well understood: run wan post-quantum key encapsulation mechanism go tɔgɛda wit di klasikal exchange, so dat wan enimi go hafen brok bot di wan dem fɔ in de rɛd ɔni-tin. Nymchat de us ML-KEM-768 (FIPS 203). Dat mek wan distribution problem kam up raet away:

Npub de kumpit imself. Yu kin wit am pan pepa, rit am out loud, ɔ skan am frɔm wan skrin, and na dat aw enri oda wan nid for enkrip tin to yu. Wan ML-KEM-768 pabliki ki na 1,184 bays. Yu nɔ kin rit am out loud, e nɔ go fit insay wan yusnaem, and e nɔ de bɛlong insay wan QR kɔd na saed na wan ayidɛntiti we na 32 bays ɛn ɔn.

Sais na di isi pat. Di hard pat na se di sekan kii de kɔm wit tri difrɛnt prɔblɛm, an di rɛst di dis pepa na bot di ansaw fɔ dem:

• I kɛn bi ɔda tɛŋ in in pleis. Wan kii we no wan pipul kin tin tin wan luk, na dat kine tin we bad pipul de du, dem de swop am for dem wan. Sekshon 4 mek am konek to di identiti wit wan signatshon, we de mek di tin klar tede.
• E mus de de de fɔ di dewis we di yuzah de yuze. Di sem akount na wan fon wetin wan lap-top fɔ sho di sem ki, o di mesij we dem lock na wan nɔ go ɛbul fɔ op na di ɔda wan. Sekshon 3.2 de ɛkspleɪn am gud.
• E kin lus. Di pablik ki de kam bak fɔm wan si-kret, so wet fɔ de stap na di rili na dat si-kret — an fɔ di we di tin dɔn set ap, no oda tin de mek am kam bak. Sekshon 10.1 tɛl klia wet di kɔst na, bi-kɔs dis wan nɔt na mek dɛn solve am, na de we dɛn de pɛ di pise fɔ am.

2Design limitishon

Fo kɔnstren shap di ansɔ, and dem kout mos na di ol kɔmɔn dijayin bifo wan kɔd rayt.

1. Lɛk se-kret we de wan as pɔsibl. Nostr yuzas de kery jus wan sikiwet, di nsec. Any oda sikiwet we yu add na anoda wey yu kin los yu histori, ɛn wan pipul we sabi bak ap an nsec no go sabi bak ap nɔtin ɛlsa. Sekshon 3.1 sho se dis wan no go fit kam tru fɔst — wan post-quantum ki we yu de get frɔm di nsec no de giv ɛni post-quantum protɛksin ɛti — so di dizayen de spɛnd jus wan sikiwet ɛn nɔtin mɔ: wan wan pɔsin di ki mɛtɪərɪəl, we dem de mek wan tɛm fɔ ɛvri ɛdɛntiti, we de kam ɔp na di sɛm fɔm as di nsec ɛn na di sɛm pleis, so se ɛvriwan we sabi kib di wan, go sabi kib di oda wan. Sekshon 10.1 de tɛl tru abaut wetin dat stil kɔst.
2. Nɔ otoriti. No sɛːvɐ de we yu kin trɔst fɔ se wey kɛi bɛlɔŋ to ɔm. Any sɛːvɐ lɛk dat de bi kam di pɔint wey mesɪʤ ɔ kɛn tɔn dɛn rɔt.
3. Plenti devices, wan identity. Wan Nostr identity de koman fɔ de use fɔ mami kliant at di sime-taim. Anin kɛi mɛtiyəl we de, ɛ fɔ de di sime-tin ɔn ɔl di wan de, ɛn di wey de kɛri am go de fɔ nɔ mek di ɛnɛmi we di fitcha de fɛt ɛm ɛns fɔ rɛd am.
4. No bargin. Any tɔk we de pass inside di sɛm kɔmɔnyukeʃən fɔ ask "wetin cipher de-u go de support?" na wan opɔtuniti we wan atakɛ kin rɔp fɔ mek di weak wan go fɔs. Di dizaɪn fɔ no get anytin we kin du fɔ mek di sɛkyuriti go down.

3Wan indipen-dent root sikret

Di big decision wey de carry di weight na say di ML-KEM decapsulation key de start from key material wey no poblik value de ekspoz. Evri identity de get wan root secret, wey dem bin mek wan tɛm:

pqRoot   = 32 bytes from a CSPRNG, generated ONCE per identity

seed     = HKDF-Expand(
               HKDF-Extract(salt = "nym-pq-root-v2", IKM = pqRoot),
               info = "mlkem768/epoch/" || epoch,
               64 bytes)

(ek, dk) = ML-KEM-768.KeyGen(seed)

Di root de show to di usah di wei nsec de show: bech32 wit di prefix we pɔpl dem de rɛd nympq, so e de riid as nympq1…, we de show am na side di nsec na di identity skrin, di sem way yu de di reveal am, yu de kopii am wit di sem kontrol, we no de log am and we no de sen am anywhere for di open. E no be password and e no be login. Na key material we di user kin sef, jus lik di nsec.

Di salt de divide am na difren domain on purpɔs, so mek no oda si-kret kɔn ɛvər get di sɛm kii-pea. Di epoch Kontra mek ɛn spin (Sɛkʃɔn 9).

3.1 Wetin mek di key no de posibul for de-raiv frɔm di identity key

Di klia disin na to seed di keypair frɔm di sekret we di user olredi de tin:

seed = HKDF(salt = "…", IKM = nsec)          // do not do this

E get lɔk fɔ fɔ rɔzn, ɔl dɛm na rɛl rɔzn: no nyu tin fɔ bɛk ap, bɔkɔs nsec de de bɛk ap ɔlredi; ɛvri dɛvays de ɛgri bɔkɔs di we dɛm de mek dɛm, wit no sin-kron-a-zɛn prọtokɔ fɔ go wrɔng; wan rɪpleɪsabl an-nauns-mɛnt fɔ ɛvri aɪdɛntiti de ɔbviəsli kɔrɛkt, bɔkɔs dɛvayses nɔ kɔn ɛgri dɛm ɛbaut di ki; an di ki de de bɛfɔ ɛm de pɔblɪʃ, so wan klaiɛnt kɔn siːl sɔmtin fɔ ɔmsɛlf na in fɔst rʌn.

Di fo benifits nɔ get value, fɔ wan reason. If yu run Shor's algoridem pan wan npub wey don kam out, yu go get di nsec. Di way dem de get di seed na wan publik algoridem wey de run pan di nsec. So di enimi wey brok di klasikal half, e go fit mek di post-quantum half again by ran di sem HKDF wey evribodi de ran. Fɔ di "harvest-now-decrypt-later" tins — di wan big threat wey dis fiti-chur de try stop — wan ki wey dem get dis wey nɔ add anything at all.

Di sɛkɔn pɔsin di rùul di wok di am as much as di fɔst pɔsin. Wan sɛkrit wey dem mek sef, wey dem de ɛnd de mek ɛkipmɛnt kam fɔlō ɔvan na wan ordinɛri NIP-44 mesij, na di ɛdin de ɛm biznɛs, ɛkstra wok de de: wan ɛnɛmi go rɛkɔd di mesij tɔdey, ɛnɛm go fɛnd di kii lɛtɛ, ɛnɛm di rùt go kɔm aut. Na fɔ dat di pat di ɛksɛksɔn wey de kam de am de, ɛnɛm di se "sen am to yu ɔda ɛkipmɛnt."

3.2 Mek di root ritch di oda diwis we di user get

Konstrain 3 fɔ Sekshon 2 — wan identity, en-en dizayis — nɔ kin wok usin arithmetik for ya, bikos di en-en point de, na se di ki nɔ de kɔm frɔm en-en tin we di dizayis de shɛ. Instead, yu mas jus tranzport am, an de wan ɛk-sak wey: di usɛ de muv di nympq1… Kɔd dɛm-selv.

Di rut de sho as nympq1… beside de nsec, and wan oda device de tek am we dem pas am na de seym panal. Dat na de ful mekinism. Wan device we dem no gi am de kod no go de tek part, wetin Sekshon 4.2 de tok abaut.

Manual transfer na wan ting we yu du on purpous fɔ set a limit, no be se na fɔst step lɛk dɛn de mek am. Di rul in Sekshon 3.1 se di root nɔ de mek ɛn trip go lɛk se ɛnklipshen fɔ klasikal onli de, an ɛvri metod we de mek dɛn du am ɔtomatik — lɛk se de sink am ɔ fɔ wrap am wit di aydentiti ki — de brik dɛn rul ɛksakti. Di step we di yuzer de du na di risin we di protekshon de rili waka.

Di fɔmat de lẹf spɔs fɔ wan "wrapped path": wan rɛkɔd de kɛp wan lɪst ɔf "wraps", ɛch wan de ɛn AEAD blɔb na wan kī dɛn mɛk di yuzɛ de kɔpi ɔ dɛn fɛn pan ɔda dɛvays — fɔ ɛksampəl, wan passkey PRF autpʊt. Nɔtin de kɔm wit wan tɔdey, ɛn antɛl sumtin de kɔm wit wan, di... nympq1… kɔd na di ɔnli wei to kros. Sekʃən 10.1 se we di kɔst bɔt am.

Di rekɔd de self de na in in wan settings katekori, nymchat-pq-root...an e sink de na di wei di oda kategori de du. Efen if e no de kadi any wraps, e de du di wok we de nid: di fiti we e de de na di wei di sekon dipays de lɔn se dis aidantiti alredi get wan rut, we na wetin de stop am fɔ mek wan we de kɔmpit am (Sekshɔn 3.3).

3.3 Mekin ɛn adopsin

Wɛn di sistem on, wi pɔsẹn wan ID we de lang, a klayɛnt wok in dis ɔdɛ:

1. Luku fɔ wan we de nymchat-pq-root rikɔd.
2. Record faynd, an dis diwaiis kin unpak am. — tek am an ɔns dis aidɛntiti se i kapa-bel fɔ post-quantum.
3. Rikɔd foun, and dis dipayis no kin unwrap am — no kriyet wan nju rut, an no publosh eni anonsment at ol. Tell di usɛ fɔ link dis disivay ba ɛ enta di nympq1… koud frɔm wan dɛvays we de got am ɔlredɛ.
4. Nɔ rekɔd de — mek wan root, pablish de rekɔd, anons, an sho de nympq1… Kood for di usur wan taim so dem kin sef am.

Step 3 na de step we de mek mistake fasin, and na dat de reason we di order de pan pepa instead of mek e de depend na how e de mek am. Two diavays we de decid to mek wan rut go mek two difren rut na wan nem, and na dat de feyl we dis order de try to stop.

4Di kapabiliti anonsment

Di pabliki pɔt de kwa keypair we dem bin de-raiv de pɔblish lɛk wan addressable NIP-01 event — kind 30078, tagd nym-pq:

{
  "kind": 30078,
  "tags": [
    ["d", "nym-pq"],
    ["t", "nym-pq"],
    ["expiration", "<unix seconds>"]
  ],
  "content": {
    "v":     2,
    "alg":   "mlkem768",
    "nym":   1,
    "epoch": 0,
    "pk2":   "<base64url ML-KEM-768 encapsulation key>",
    "exp":   <unix seconds>,
    "devices": [ ... ]
  }
}

Addressable de in dat di relay de kíp wan ɛvri ɛvɛnt fɔ ɛvri (kind, pubkey, d-tag), so if yu republish, e go tek di ɛfri ɛnansment we yu bin mek bɛfɔ, fɔ ɛtit pɔzishɔn. So ɛvri identity de kíp ɛksaktli wan kɔrɛnt rɛkɔd, dis na wetin mek 'luk ap Alice key' bi wan sɛŋɡəl fɛʧ we de klia gud, nɔ di ɛn lɪst we yu go nid fɔ kɔm fɔm ɔ rɛkɔnsayl.

Di sinal na di baund. Di ivɛnt de de sign wit di identity ki, so di klem se "dis ML-KEM ki bɛlong to dis npub" de jus as strong as di npub de sɛf. If yu wan ɔpɔs wit ɔda ɛnkapsulɛshɔn ki, yu go nid fɔ fɔj secp256k1 signatʃɔ. An ataka we de kæn du dat no nid fɔ bor wi di KEM.

Anonsment de finis. Wan sefen dey NIP-40 we dɛn kɔl Eks-pay, dem de put am out again evri 24 aua, e de mek di rekɔd de se na bout wan kleyant we de wok stil, no be di wan we bin de du bɔf. Di rut sef nɔ de ɛks-pay; na ɔnli di klem we de de nɔ de las.

Wan anonsment wey don kɔm aw, dem de rɛd am pas de wey wan we nɔ ɛvɛ kɛr kī: di pīr de sɛnd ɔdinɛri NIP-44, we ɛvri lɔgin kɛn rɛd, ɛn di klayɛnt de stɔt di pɔst-kwantɔm ɛksʧenj wen i rīpɔblɪʃ ɛn i nɛks kɔnɛkʃɔn kam. So, if yu nɔ kɔnɛkt fɔ mɔ di wek de, di ɛfɛkt na se di prɔtɛkʃɔn fɔ di mesɪʤ we yu sɛnd dɛn dɛn taim yu nɔ bɛ kɔnɛkt — dɛn ɛnkrɪpt dɛn usin ɔdinɛri way we kwantɔm nɔ kɛn kɔntrɔl am — ɛn nɔ ɛfɛkt nɔtin ɛls. Di ɛndivɛri nɔ ɛfɛkt, nɔtin we yu ɔlredì ɛm nɔ go jam, ɛn yu nɔ nidɔ du nɔtin wen yu kam bak.

Dis asimetri na di rason fɔ di ɛksayari, nɔ se ɛn aksid lɛt am pas. Wɪðaut wan, wan rɛkɔd go liv pas di kii we i nɛm: wan dɛvays we i dɛl, reset, ɔ fɔ ɔp nū rūt, de lɪv wan in-struksyon fɔ ɛnkapsulɛt to wan kii we nɔbɔdi nɔ de ɔl ɔ nɔ mɔ, an mesij we dɛn sɛnt ɔndə ɛm go lɔs, an nɔ nɔ ɛni ɛrɔ ɔ nɔ bɔθ saɪd. Sɛvɛn de bɔnd dat wɪndō, an lɛt rilɛis dɔp di rɛkɔd ɔm-sɛlf ɔndə dɛn, nɔ fɔ rɪlay ɔn klaiɛnts fɔ nɔtɪs am.

Di key fild nime im fomat. Di fild i pk2, an di namba na wan pat di kontrat, no be fɔ dekorashin: i de se we di payload format de, we di ki de fɔ yuz. Wan riida we nɔ no di fild go se "Nymchat klayan, nɔ get post-quantum ki" an i go sen di oda NIP-44, we ɛvri login kin rid. Dat na di kɔrekt we tin fɔ fɛl, an e gud fɔ mek am wan rul we di format namba de fɔ mek: if wan klayan klem wetin i nɔ no, i fɔ kɔst protɛkshun, nɔ de kɔst di de-livari. Wan ki we wan pìr nɔ kin yuz bad fɔ no ki at ɔl, bikɔs di mesij i de mek go lɛlos wit nɔ ɛni ɛrɔ on ɛdi saɪd.

4.1 Nɔ de get meaning, and e get tri valyu

Wan smɔl bɔt impɔrtant tin: di anɔuns de kam aut fɔm ɔvri Nymchat klayɛnt, nɔt ɔnli di wan we de kɔntrɔl post-quantum, an ɛnd di kī fild na wan we yu nɔt fɔr du. Dis mek ɛri difrɛnt stet de kam aut, nɔt ɔnli tu:

If yu kɔlaps di tɔd row na di fɔθ row, e go bi wan big loss. Wan keyless anonsment na wan sign stetment se di sen-dɛ rɔn Nymchat, we mek di sen path skip wan spɛkyulativ kros-protokòl wap we e wuda bin nɔ kɔd inklud fɔ eniwan we e nɔ kɔd nidinfay.

4.2 Wan dipayis we no de klan opn di root de kyam

Di anonsment na tin we yu kin sen agin: wan tin fɔ ɛvri aydin-titi, di latast wan we yu rayt na am de win. Na dat de mek di wan-rikɔd di-zayn wok, ɛn na dat ɛlso de mek en di-vays we nɔ linkt dɛnjas if e kɔm ɔut am. En di-vays we anons en kii we e mek fɔ ɛlsɛf go kɔmɔn di tru rikl, ɛn e go mek ɛvri pii start enkript wit en kii we di ɔda di-vays nɔ kin ɔpɛn.

So, wan gadget we sabi say wan root de, but e no fit opn am, e no de gi wan sing at ol. E no bin spoil, and e no bin lok out of di apilikeshon: e de stil rid evri mesij we e get di ki for, and e de stil sen di wan we de go olwey, wen e de tell di usah se e fɔ link am. Kwayetness na di rait ting fɔ wan gadget we no fit tok fɔ di ayidintiti.

5Diskovri en di disisin to sen

Kliant de get di key dem fɔ di pipul we de tok wit na tu wei. Wan subscription we de de ɔlwey de kover di pipul we di usur de tok wit fɔ ɔlwey — di pipul we de in open konvɛrsashon wetin ɛn di grup memba dem — so di nɔtiz we de kam de kam in na di ɔdin wey tin de de. Fɔ wan pipul we yu mek fɔ di fɔst taim, wan wan-taim kweri de run wen yu de sɛn, ɛn ɛn no go pas tu point faif (2.5) sekɔnd; if ɛn nɔt finisht, di mesij de go di ol kɔlasik wey de de bɛfɔ dem ɛd post-kwantɔm, nɔt se na wan nyu wey tin de fɔ kray.

If di ansa na "no", dem go kɛʃɔ am fɔ ten minits, no fo ɔltaim. An ɔsn̩ de we de kɔnek ɔ wan nyu dipayz, ɔ wan de mɔv frɔm ɔ brɔusa-ekstensɔn lɔgin tɔ ɔ wan lokɔl ki, dem go bin de kapa-siti fɔ post-quantum mid-kɔnvɔseʃɔn, an if di "no" de kɛʃɔ fɔ ɔltaim, de go mek dem de yus di ɔl-fɔ-stɛdi enkripʃɔn tɛl di ɔnansɔns fɔ finɔsh.

5.1 Wai dere no de downgrade attack

Di routing decision de kam doun to wan single kuestin:

pq = (we hold a signed, unexpired ML-KEM key for this recipient)

No de kapa-biliti negosie-shon, no list we de show di algorism we de support, and no fild we wan ataker kin klia fi forz di way go weak. Bin de hol di anonsment. na di negosieyoshon, an e don sign am. Di we di ting go rong wen wan anonsment bin de rili or bin de hodd na dat di mesij go bak na di ol weg — di tin we de apin bifo dis fitcha — boku pass na dat wan mix-mix mesij go de-gren de go wan ting we de kin fof.

Di rɔvɔs de wok too an ɛt mɔ impɔtɔnt: wan klayɛnt sen hybryd Onli wen i de hol wan ki, and de hol di ki na pruf se di porson wey de kaba di mesij kin decapsulate. No de any wae we mesij kin go post-quantum go to porson wey nɔ kin rɛd am.

6Di hybrid kɔnstrʌkʃɔn

Nymchat nɔ rreplace NIP-44. E wrap am. Wan NIP-44 ciphertext wey nɔ eni change na di inna laye, and ML-KEM de gi di key fɔ wan outa AEAD roun am:

inner = nip44_encrypt(plaintext, conversation_key(sender, recipient))

info  = "nymchat-pq2" || sender_secp_pk || recip_secp_pk || kem_ct || recip_kem_pk
prk   = HKDF-Extract(salt = "nymchat-pq2-v1", IKM = kem_ss)
key   = HKDF-Expand(prk, info || "key",   32)
nonce = HKDF-Expand(prk, info || "nonce", 12)

outer = ChaCha20-Poly1305(key, nonce, plaintext = inner, aad = info)

payload = "pq2." || base64url(kem_ct) || "." || base64url(outer)

Bot sɛkrits mus fɔ bɛ kɔm bak fɔ yu de rɛd di mesij: di auta laye de gi ɔnli wan NIP-44 sifa-tek, ɛn fɔ ɔpɛn dat, yu nid di klasik ECDH. Wan kuantɔm ɛnɛmi we de brɛk secp256k1 go get di in-sayd ki, ɛn ɛ go stil fɛs ML-KEM; if de brɛk ML-KEM, e go rip ɔp di auta laye, ɛn NIP-44 go stil de. Èvri in-put de get ɛn sɛf plɛs:

• kem_ss e de gi ki fɔ di auta laya wan bɔk. Nɔten we de na dis derivaysen de tɔːt di raw ECDH output, wey na wetin Sekshɔn 6.1 de turn on.
• kem_ct, recip_kem_pk And ɔl di tu idɛntiti kii de bɔn in togeda as asosi-et deeta, so di auta laya de tɛkd to di ɛksak trænskrɪpt we mek am. If yu try put wan sayfateks na ɔda sen-da idɛntiti, di ɔθɛntik-ešɛn go fɛl inisɛd fɔ dɪ-krɪpt am.

Dɛn de mek enkapsulashon fres foh ɛri mesej. Di ML-KEM ki we di rɔsiv de yu, de stap fɔ lɔŋ tɛm, bɔt ɛri mesej de kɛri in in sɛf sifeatɛks and fɔ dɛn, in in ɔn kem_ss. Na dat de mek gettin de nonce instead of makin am random sound: ChaCha20-Poly1305 e de brik wen yu de yuz wan (key, nonce) pair agin, an na dis, di key de inis na nyu fɔ evri mesij, so no pair kin rypit.

6.1 Wetin mek di layas de apart

Di oda opchon na to mix bot di sekret na wan singul konversashon ki and gi dat to NIP-44:

ck = HKDF-Extract(salt = "…",
                  IKM  = ecdh_x || kem_ss || …)          // do not do this

Dat konstrakshon dey gud as kriptograf. I get wan strukshonal problem: i nid ecdh_x, di raw x-coordinate fɔm di ECDH output, as key material — an a browser extension (NIP-07 we dɛn kɔl) o wan remot signa (NIP-46 we dɛn kɔl) nɔ de gi dat valyu bak. E de du NIP-44 fɔ di wan we de kɔl am, an e gi am wan ciphertext bak, we na di ɛntay pɔin fɔ kip di ki na wan ples we di aplikeshɔn nɔ de kin.

So, if yu mix di sekrets, e go mean say e go kɛk aut di ol login we de kip di idinti ki inside wan signa, we na di pipul we de mek di mos kɛfɔl, and no matta wetin yu du fɔ mek di ki, e no go ɛn fɔ ɛn dɛn. Layaring de mek di depɛndɛns go aw: NIP-44 de de wen-wen, and ɛvritin we de kip di idinti ki, in mɛs, de mek am, bɔt di KEM pat de kam out fɔm di rikavri kɔd we di klient de kip de. Di signa login na olosinar post-kwantɔm partisa-pɛnt na bot di dɛsin.

Di kos na bandwidth, and e no small. Di ML-KEM ciphertext de 1,088 bytes and e de go pan evri mesij, we de base64url-encode am go 1,451 characters; di auta AEAD de add 16-byte Poly1305 tag and e de mek di NIP-44 payload we e de wrap biggan by wan part in tri. Wan mesij we get 50 characters de gi 176 bytes go 1,712, and wan we get 2,000 characters de gi 2,820 go 5,238. Di minimam na rɔfli 1.5 KB per mesij, no matter aw smɔl di mesij bi, and na dis na di kos for de do kapsulashin nyu fɔ di ɛbritaym instead of de yuz di sem si-kret.

6.2 Pèlɔd we de dɛskrayb inself

Di pq2. Prefix mek di wey di ting kɔm ap de step-by-step: e de sef-explain wetin e bi, so wan client de kɔntrol di wey e de op di dɛk-rip-shɔn by lukin gud na di mesij, nek dɛn de trust wan tag ɔ de try rimɛmbɛ wetin di oda pɔsin de du. Wan oda pɔsin we nɔ no di prefix go nɔ ɔpin di mesij at ɔl, nɔ se e go rɛd am wron, and di mesij we de ɛfɔ bifo ɛniwan de du di post-quantum tɛknɔlɔji, de go stil de klia fɔ rɛd bɔf NIP-44 dɛn we nɔ nid fɔ ɔsin ɛni tin.

6.3 Bot layas di gift wrap

A NIP-17 we dɛn kɔl privet mesij na wan NIP-59 we dɛn kɔl gi-wrap: wan rumo we no get sign, seal am na de sender di identity key (kind 13), den wrap am na wan throwaway key we de mek fɔ ɛvri mesij (kind 1059). Fɔ di login we de hol di identity key direkt, Nymchat de mix di ɔl lɛya tɔgɛda, ɛvri wan de na in in pakij.

Wan oda we de sign de in, e jus de ketch di outa laye de. Di seal de kam fram di signer de as de noraml NIP-44 — di aplikashon no de si di ki we de mek am — so e no fit de kombain am de na di seim pleis. Dis no de kostat nitin go seens di atak de we de tin de bawt: di seal de na di wrap de we yu fɔ katch, and na di wrap de we rekoder de kip. Wan enimi we de kip di rekordid trafık must brok ML-KEM bifo se di seal de katch am fɔ atɛk.

7Grup mesij an patsi koverij

Wan grup mesij nɔ wan sɛf krayptekst. Na di sɛm plain tekst we de fɔ send to evri memba, wey di kopin de pak na di memba wan ML-KEM ki. Wan memba we don put im ki out, i go get wan hybrayd pak; di wan we nɔ don put am out, i go get wan klasikal pak.

Dis kriyet an akountin proble wey wan simpl implemen-shon go mek mistek. If eit outa ten memba get wan hybid kapi, di mesij na nɔto eiti-ten de protekted. Wan enemi nid wan kalsikal kopi di plentekst wey de de seim in ɔl ten, so di mesij de protekted ɔnli if ɛvri kopi de.

Nymchat fɔ de trok di per-message coverage dɛn de spray am—di nambɛ de kɛn ɛfɔ ɛnɔm ɔni tɛm we dɛn de mek di wraps—ɛn badj de se “quantum-resistant fɔ 8 ɔv 10 members” dɛn fɔ se di mɛsɛj de protekt. Wɛ nɔ de ɛni nambɛ, ɛn we de kɔmɔn fɔ... Mi bin ridi am Group mesij (na di senda de kount di fan-out), di interface de tɛl se na pɔrtʃɔn proteksion de, no na ful proteksion. If yu se na ful proteksion de bɔs na yu wan kɔpi de, yu de mek am pass wetin e bi fɔ di mesij as a wul.

7.1 Wetin di shield de report

Di sheld se di tru bout di messa, no de bout di softwer we sen am:

• Full protɛksin: ɛvri kɔpi di dis plaintext wɛnt aut as hybrid.
• Nɔ ful: som copy di group mesij kam out de olde stail. E nɔ de ful, e de sɔm-sɔm, bɔkoz if wan kɔlna copy di plaintext de sef na ol di odam, na dat aw di ɛnimifɛ di nid.
• Dem de write 'Classical' de pan de instead of dem de rely on di absence of badge, because if di sign no de, e go confusing and e fit mean 'unprotected', 'broken', or 'dis build nɔ get di feature'.

Di verdict de go na di record wen di mesij de seal, nɔ di de kɔmpyut am again frɔm wetin ɔda pɔsin de fɔs tɔk lɔtɛ. Di krayptɔks we don de ɛlɛdi nɔ kɔm bɛtɛ dɛn de de bɛfɔ, an ɛn in-tɛfɛs we de rili-drɔ ɔlda mesij de bɔs di pɔwɛ di nju anɔnsmɛnt, de se tɔk fɔls tɔk ɔba di bayts de na di rili.

Di grup rul we de na top de, dem de add on top dis instead of de tek am out: wan grup mesij de ful protekt onli wen evri memba get im kapi, an wan grup mesij we yu bin ricsiv we no get koverij kount, e go sho "partial".

8Kopi we de adress to yu sefl

Sometin we di klient de stor de lock wit di usɛ se yon sɛf idɛntiti: di sɛtɛng we de sink, di lɪst fɔ di konvɛsešɔn, di grup ki, ɛn di arkayv fɔ di mesɪʤ. Dis tin de kɛri mɔ ɛbaut ɛn usɛ sɛn mɔ ɛn wan sɛf mesɪʤ de kɛri, so if yu lɛt dɛm de de fɔ sɛm fɔm dɛm, dɛm go bi di wɔst tin we de stor, ɛn dɛn no de kɛɛ ɛbaut ɛn aw yu sɛl dɛm mesɪʤ lɛk. Dɛn de yuz di sɛm hatbrɪd mɛtɔd, dɛn de lɔk am na di usɛ se yon sɛf rʊt-dɛraɪvd ki — ɛksɛp ɛp wan we dɛn tɔl ɛbaut na Sekʃɔn 3.2, di nymchat-pq-root di kategori de self, we de nɔ fɔ lok na wan ki we nɔ am de mɛk.

Dis tin dem na we di design de rili mɛn. Wan setin blob ɔ wan arkiv row de stay na wan ples fɔ yia dem, we na ɛksakt tin we wan enemi we de kɔlɛkt tin naw fɔ dɛkrayt lɛtā de kɔlɛkt — mɔ bɛt ɛnɛk wan wan mesij, we at lɔst na wan tin we nɔ de last lang na di usɛ in in mɛnd.

Wan limit de kontrol di format ya pas di ki. Wan kopi we de adres am fo yu-sef fɔ mek pɔsin de red am ɛvri Dɛvays na di ɛkaʊnt, so ɛch dɛvays de sho wetin e kin op na di lɔst we in anʌnsment de kɛri, an di ɛkaʊnt de rayt ɛks na wetin ol dɛvays kin rɛd. If ɛ kɛp rayt ɛni-tin ɛls, e go lok wan dɛvays aut na in ɔn sɛtings — di sɛm sɔp-sɔp fɛl we Sekʃɛn 3.2 de ayvɔid apusin ɔda wey, we de kam frɔm ɛnɔda ɛdirɛkʃɛn.

9Rotešɔn

Di epoch Di konta we de fɔ di derivation na wetin de mek rotation pɔsibul widout nyu key material. If yu kas di konta up, i go gi yu nyu keypair fɔm di sem root en i go bɔnkɔst di anɔnsment agen; di oda pɔsin go luk di nyu key fɔm di rekɔd we i de mek fɔ de chanj. So, di rotation nɔ de mek di user rayt ɔnytin dɔn fɔ di sɛkɔn tɛm: di root de kam aut wan tɛm fɔ ɛch identity, en di epoch de mek di tɔnning.

9.1 Ol epoch dem de kip, an nɔtin de re-enkript

Nɔtin nɔ rərit wen wan kii tɔn. Wan klianit de mek di difren kii fɔ ɔpən di mesij fɔm di kɔrent epɔk go dɔn tɔ di epɔk dɔn 3, so wan mesij we dem lok smɔl tɛm bifo di kii tɔn, de go ɔpɔn di kii de we de waka at di tɛm we dem sɛnt am.

Dis window na wetin mek di rotashin sef fɔ du: witawt am, evri rotashin go lɔs ɛvritin we de mek go. Enin we de alredi sɛl go de kɔn fɔ rɛd fɔ di ɛf ɛn de fɔ di ɛdɛntiti, bɔkɔs wan mesij we di usɛ ɛ nɔ kɔn ɔpɛn ɛm na wan we bɛtɛ bɛd fɔ dɛm ɔ wan we in prɔtɛkshɔn nɔ kɔn bɛm bɛtɛ fɔ di ɔld wan (Sɛkshɔn 10.5).

10Wetin dis nɔ protɛkt

Wan pepa we de list ɛn wan design wetin ɛ de du, ɛ no de dɛskraib wan sistim, an if yu de tɛl lie wetin wan security property de du na wan intafɛs, ɛt bɛt ɛn yu no tɛl am at ɔl. Di tin de bɛlow ɛ de ɔsay wetin dis kɔnst rɔksɔn de fɛnd.

10.1 Di root na di sekon siikret, and if yu lus am, yu no go ɛbɔ di get am bak

Dis na di real pris fɔ di design. Di rule we de na Sekshɔn 2 se wan usɛ fɔ kip ɛn ɛn wan tin, nɔ de mek dɛn dɛn. Di nsec ɛn ɛn sɛf nɔ de mek di post-quantum ki kam bak, biko di ɛn-ɛn tin na se nɔ wan pɔblik valyu o ɔda si kret de mek dɛm sabi am. If nɔ wan diivàys de hɔl di rut, ɛn if nɔ wan di wraps we de na Sekshɔn 3.2 de mek fɔ ɔpɛn, di tin we de siːl na di ki we de kam fɔ di rut, nɔ de mek fɔ kip am bak. Nɔ de ɛskro, ɛn dɛn du dɛn dɛn de mek fɔ nɔ de ɛni ɔθɔriti we fɔ kɔd hɔl wan.

Wif manual transfer na di onli weg, dis de kaba pas wetin e go luk at de bignin. Wan usah we nɔ de kɔpi di nympq1… kɔd ɛniwe get ɛksaktli wan kɔpi dɛn, na wan dɛvays, an if yu lɛl dat dɛvays yu go lɛl ɛvri post-kwantɔm mɛsɛj, settings blɔb an ɔkaiv rɔ we de yon dɛn na am. Di nsec e nɔ hɛlp; dat na di prapati di ɛntayə dizaɪn de rɛst na am.

Eni wrapped path wey dem add afta mas go pas di sem bari wey di manul wan de pas. Ataker de ataki di chiyapest path wey de available, so wan skim de worth jus di wan wey di weakis rici-veri rut de worth—fɔ instance, wan passphrase wey eku-mem-ba, go put di hol tin na di samtin wey di passphrase de worth, and di wrapped row na di exact tin wey an ataker wey de 'harvest-now-decrypt-later' de koliokt den de grind am offline wen e get time.

10.2 Pruving se na yu, wetin difrens wit kipin tin sɔkret

Evri sinatsha na Nostr na Schnorr over secp256k1, and dat nɔ de chanj fɔ dis. If bad man get quantum computer, e kin fɔɔj sinatsha and pretend se e na di user na wan de di tɛm. Wetin di hybrid key exchange de stop na "harvest-now-decrypt-later": if bad man de rɛkɔːd tæfɪk tɔdey, e nɔ go ɛbil am lɔtɛː. E nɔ de mek wan mesij nɔ pɔsɪbl fɔ fɔɔj fɔ bad man wego ɔlredi get di makin. Dɛn de mek dis difrɛns na di aplyɛshon de de—di padlock sho se authentication de, di shield sho se confidentiality de, and dɛn na difrɛnt simbo (glyphs) bikɔs wan mesij kin get wan lɛk e nɔ de di ɔda.

E de set limit na wetin di informashin in Sekshon 4 de pramis. Di link we de bɛtwin an npub an ML-KEM kɛi na wan secp256k1 signatshon, so eni bad man we sabi mek fɔk signatshon, e de kɔn chanje am fɔ put in dɛn wan kɛi. Kēp tin sākrit agɛnst bad man we de kam na fiutshɔ nɔ de se am de se authenticity agɛnst am.

10.3 Metadata

Di gift wrapping de hid di sen-da, di wan we rili am pas wan single p di tag, di kɛn, ɛn di tɛm wen di mesij de inside kam. I nɔ hɛd se semtin de apin, i sɛz, ɔ di tɛm wen di relai rɔsiv am. Dis dizɛn nɔ tɔk ɛbout trafik ɛnɛlɪsɪs.

10.4 Di offline mesh

Nymchat Bluetooth mesh transport na wan difren protokòl we de us in in wan handshake, an in nɔ de kɔvɔ na dis wok. Di mesij we de go na di mesh na de klasik de.

10.5 Mesij don sen

Sekrit mesij we dem kɔrdi wen wan saed nɔ de use post-quantum sistim yet, e go de ol old sistim for ɛvətaim. E de de ɔlredii, ɛn yu nɔ go de kɔm kɔm am fɔ mek e sef. Protɛksin de stat fɔm di mesij we bot di saed de use post-quantum ki, nɔt na di tɛm we dem switʃ di fitch on.

11Oda opchon wi tink bin tink bout

12Di we yu mek di wan de wok, i de sef.

Nymchat de yu wit tu difren ways dem mek dis kɔnstrɔksɔn — wan na JavaScript fɔ di web aplikɛshɔn, ɛn wan na Dart fɔ di mobayl aplikɛshɔn, we in kɔm nɔmɔ, dem mek wan ML-KEM-768 port fɔm skræch. Di wan dɛn mek di sɛm kɔmputɛ de tin na wan riski tin, so dem de mek dem fɛs ɛgan ɛgan rader dɛn de trɔst se dem go agree.

Di Dart ML-KEM implemen-shon de validat wit di ofishal NIST ACVP tes we sabi di ansa fo ML-KEM-768 (ML-KEM-*-FIPS20325 kii-mekin, 25 enkapsule, and 10 de-enkapsule kaysa, we de ran wetin dem de kɔl wan wan set. Dem na di vektas we NIST de pɔblish fɔ mek pipul no di mek-wet we dem de du gud, so if di test pass, e de sho se di port de kɔrekt, e no jus se di tu klayent de ɛgri wit ɔna ɔða. Pas dat, wan wan set we de ɛl ɛl fɔ di test vektas — siːd derivashin, enkapsule, ɔl di pɔlɔd fɔmat, and di ful gift wrap — de kam fɔm di JavaScript referens and di tu test set de mek ɛkamin am. Di root siːkret de mek di fiksɔ di biga pan di nɔt de rimeplɛs am: root go fɔ siːd, root go fɔ kii-pe, di root pɔblik finggaprɛnt, and di kii, non-s, and di oda data fɔ di auta laye na den wan wan vektas, so di tu klayent nɔ de ɛgri pan wetin a nympq1… Kɔd de tok wetin di bytes we di luk di mesij wit de. If di we dem de mek di kɔd difren, di build go fèl instead of to mek wan mesij we di ɔda klient no go de kɔn opən.

Di fingerprint de worth nem inside dis ol ting. Na am de tel di device se 'dis na di root we mi de hol' instead of 'dis na difren wan', and if wan client no fit mek anader client fingerprint, e go luk di gud record se na no record at ol — and den, if e de folo Section 3.3, e go mek di seken root and split di identity. Na for dat exact reason di ting de risk.