I-Nymchat whitepaper zobuchwepheshe

I-Post-Quantum Key Agreement kwi-Nymchat

Ukudibanisa i-ML-KEM-768 keys public kwi-Nostr ngaphandle kwe-directory okanye i-register, kwaye ukutya kwi-secret eyenza i-no public value.

Ukongeza i-post-quantum key exchange kwi-messenger iyiphi na ingxaki ye-cryptography. I-primitives ziquka kwaye i-libraries ziquka. I-part ye-hard is that every participant now needs a ikhaya Le nqaku ibonisa njani i-Nymchat - apho ikhoyili yesibini ivela, indlela yokufikelela abantu abasebenzisi, kunye neengxaki enokufuneka ukhangela kwimiphumo - kwaye, kwi-section lokugqibela, nto le mphumo ayikho.

Eli phepha liguqulelwe ngoomatshini ukuze kube lula. Uqobo lwesiNgesi yinguqulelo esebenzayo.

1inkinga

Iingxelo zethu ze-private zihlanganiswa nge I-NIP-44, leyo iiyure ezimbini ezahlukileyo ezahlukileyo. Iiyure ezahlukileyo ezahlukileyo - I-ChaCha20 kunye ne-HMAC-SHA256 i-tag, ifakwe nge Ukucinga (I-RFC 5869) - ayikho ngempumelelo yekhompyutha ye-quantum; i-algorithm ye-Grover inikeza isantya se-root ye-square vs. key ye-symmetric, kwaye i-bits ye-256 ibopha. Ukuvumelana kwi-key yi-elliptic-curve Diffie-Hellman phezu Qhagamshelana nathiUkuguqulwa kwe-private key ye-private key ye-private key ye-private key ye-private key ye-private key ye-private key ye-private key ye-private key ye-private key ye-private key ye-private key ye-private key.

Ukucaciswa oku kwenziwa ayidlulanga kuze kube nenkqubo efanayo. Umngeni we-storage inokufumana i-cryptertext namhlanje kwaye uyakwazi ukucacisa ngexesha lokufika umgangatho. Yonke into ekuthunyelwe ngoku nto leyo nangokufuneka kwakhona iyathengiswa. Le ngxaki elifanelekileyo ye-post-quantum key exchange, yaye yintoni iingcebiso akufutshane ukuba i-machine ifumaneke.

1.1 Umbuzo le nqaku ithetha

Ukucaciswa kubonakala kakuhle: isebenze i-post-quantum key encapsulation mechanism kunye ne-classical exchange, ngoko umngcipheko kufuneka ukucacisa zombini ukucacisa into. I-Nymchat isebenzisa i-ML-KEM-768 (I-FIPS 203). Oku kwandisa ngokuzenzekelayo inkcubeko yokudibanisa:

I-NPUB i-self-contained. Uyakwazi ukucacisa kwi-paper, ukucacisa ngqo, okanye ukucacisa kwi-screen, kwaye kufuneka yonke into ukuba uqhagamshelane nawe. I-ML-KEM-768 key ye-public is 1,184 bytes. Ayikwazi ukucaciswa ngqo, ayikwazanga kwi-username, kwaye ayikho kwi-QR code ngaphandle kwe-identity eyi-32 bytes kuphela.

I-Size is the easy part. I-key yesibini inikeza iinkcubeko ezintathu ezahlukileyo, kwaye i-resume yeephepha leyo ikakhulu ingxelo kubo:

• Oku kunokwenzeka ukuchithwa. I-key ye-no one can read at a glance is exactly the kind of thing an attacker swaps for their own. I-Section 4 ibandakanya kwi-identity kunye ne-signature, leyo ibandakanya le nto ngokupheleleyo.
• Yintoni kufuneka uqhagamshelane kwi-devices ye-user. I-akhawunti efanayo kwi-telephone kunye ne-laptop kufuneka ibonise i-key efanayo, okanye iingxelo ezivela kwi-one ayikwazi ukufumanisa kwi-other.
• Oku kunokwenzeka. I-key ye-public ifumaneka kwi-secret, ngoko into efanelekileyo kufuneka ifumaneke yi-secret - kwaye ngexesha lokuvelisa, akukho nto elinye ibekwe. I-Section 10.1 ibonise ngokucacileyo ukuba i-cost, ngenxa yokuba le nto ayifumaneka ngexabiso efanelekileyo.

2Ukucinga design

Iintlobo ezine zihlanganisa impendulo, kwaye zihlanganisa iimfuno ezininzi ezibonakalayo ngaphambi kokubhaliwe i-code.

1. Iingcebiso ezincinane kunokuba. Zonke iingcebiso ezongezelelweyo ziquka indlela eyodwa yokuthintela i-history yakho, kwaye umntu owazi ukhokha i-nsec akuyona akuyona ukhokha nayiphi na enye into. I-Section 3.1 ibonisa ukuba oku akuyona akuyona ngokufanelekileyo - i-post-quantum key ebonakalayo kwi-nsec akuyona akukho ukhuseleko ye-post-quantum - ngoko i-design ibonelela ngexesha elinye kwaye akuyona ngakumbi: isixhobo esisodwa se-key, ebonakalisiwe ngexesha elinye ngexabiso le-nsec kwaye kwindawo efanayo, ngoko ke umntu owazi ukugcina omnye uyazi indlela yokuthintela omnye. I-Section 10.1 ibonakalisa malunga neengxabiso
2. Akukho authority. Kukho i-server enokufutshane ukuba uyazi ukuba i-key yintoni. Yonke i-server efanayo ibekwe kwindawo apho imiyalezo ingathintela.
3. izixhobo ezininzi, umntu omnye. I-Nostr identity isetyenziswa ngokubanzi kumakhasimende ezininzi ngexesha elifanayo. Yintoni izinto eziphambili ziyafumaneka kuxhomekeke kumakhasimende ezininzi, kwaye izitimela ezinikezele ku-Nostr kuxhomekeka ku-Nostr kuxhomekeke kuxhomekeke kwi-adversary esebenzayo.
4. Yintoni ukuhambisa. Yonke i-in-band exchange ye- “i-ciphers ye-support?” i-surface ye-attacker enokukwazi ukuchithisa i-optional ephumileyo. I-design kufuneka akukho nto yokunciphisa.

3I-Root Secret ye-Independent

Umxholo we-load-bearing yinto ukuba i-ML-KEM decapsulation key iyasetyenziswa kwi-chief material that no public value exposes. Yonke idilesi ibonelela i-root secret, ebonakalayo ngexesha elinye:

pqRoot   = 32 bytes from a CSPRNG, generated ONCE per identity

seed     = HKDF-Expand(
               HKDF-Extract(salt = "nym-pq-root-v2", IKM = pqRoot),
               info = "mlkem768/epoch/" || epoch,
               64 bytes)

(ek, dk) = ML-KEM-768.KeyGen(seed)

I-root ifumaneka kubasebenzisi ngexesha le nsec: Ukucinga kunye ne-human-readable prefix nympqNdiyathanda njengoko nympq1…Ukubonisa phantsi kwe nsec kwi-screen ye-identity phantsi kwe-reveal interaction efanayo, ifakwe nge-control efanayo, awukwazi ukuqhagamshelane kwaye awukwazi ukuhanjiswa kwindawo ye-clear. It is not a password and it is not a login. It is key material the user can save, just like the nsec.

I-salt i-domain eyenziwe ngempumelelo, ngoko akukho enye ingcaciso kunokufumana i-keypair efanayo. epoch Counter drive rotation (I-Section 9).

3.1 Yintoni i-key ayikwazi ukuqhuba kwi-identity key

Ukucaciswa kwimveliso yenzelwe ukucacisa i-keypair kwi-secret ebonakalayo yabasebenzisi:

seed = HKDF(salt = "…", IKM = nsec)          // do not do this

Yintoni iingxaki ezininzi, zonke ziyi-real: akukho nto entsha yokukhusela, kuba nsec xa yinkqubo yokukhusela; zonke izixhobo zihlanganisa ngokubunjwa, ngaphandle kwe-protocol synchronization ukuba ziyafumaneka; enye izibuyekezo ezahlukileyo ngalinye-identity njengoko zibonakalayo, ngenxa yokuba izixhobo angakwazi ukuxhaswa malunga ne-key; kunye ne-key esekelwe phambi kokuba ifumaneka, ukuze i-client inokukwazi ukucacisa into kwi-first run.

Zonke izinzuzo ezine zihlanganisa, ngenxa yokuqala. I-algorithm yeShor isebenza kwi-NPUB ebhalisiweyo yenza i-NSEC. I-seed derivation yi-algorithm ebhalisiweyo kwi-NSEC. Ngoko ke umngeni owaza i-half ye-classic ibonise i-post-quantum i-half ngokulungisa i-HKDF efanayo yaye bonke abaninzi abasebenza. Ngaphandle kwe-harvest-now-decrypt-later - i-one threat the feature exists to stop - i-key ebhalisiweyo ngexesha elifanelekileyo akhawunti.

I-clause yesibini le rhoqo isebenza ngexesha elinye. I-secret ebonakalayo esekelwe ngexesha elidlulileyo phakathi kwizixhobo ze-user ngaphakathi kwizixhobo ze-NIP-44 ebonakalayo kunye neengxaki ezininzi: i-adversary ibhalisele le imiyalezo namhlanje kwaye ibhalisele i-key yayo ebonakalayo emva koko, kwaye i-root ifumaneka. Yeyona iindlela kwi-section elandelayo ziyafana neengxaki, yaye ngoko ke akukho nawo “ukuthumela kwifowuni yakho elinye.”

3.2 Ukusuka kwi-root kwizixhobo ezininzi ze-user

I-Constraint 3 ye-Section 2 - i-identity enye, i-devices ezininzi - ayikwazi ukufunyanwa nge-arithmetic apha, ngenxa yokuba yonke ingxaki kuye ukuba i-key ayikho umsebenzi yeenxaxheba ezixhomekeke kwizixhobo. Kufuneka kufunyanwa nge-transport kunokuba, kwaye kukho ngexesha elinye: umdlali utshintshe i-device. nympq1… ikhowudi ngokwenene.

I-root ifumaneka njengoko nympq1… ekubeni nsec, kwaye isixhobo yesibini ibonelela ifakwe kwiphaneli efanayo. Yeyona inkqubo epheleleyo. Iisixhobo ebonakalayo i-coding ayikwazi ukuqhagamshelane, apho i-Section 4.2 ibonisa.

Ukudluliselwa kwimveliso ye-manual iyona ingxaki yokuqala. Umgaqo we-Section 3.1 ibonisa ukuba umgca ayikwazi ukuhambisa phantsi kwe-encryption ye-classical-only, kwaye zonke iinkqubo ezibonisa oku ngokuzenzakalelayo - ukuhanjiswa nge-relay, ukupakisha kwi-identity key-ukukhangisa ngexesha elifanelekileyo. I-step eyenziwe ngu-username iye yenza inkqubo yokhuseleko.

I-format ibonisa indawo ye-wrapped path: i-record ingathumela i-list ye-wraps, ngalinye i-AEAD blob phantsi kwe-key ye-user ingathumela kwi-device elinye - i-passkey PRF output, isib. Akukho nto leyo, kwaye ngexesha elinye, i-PRF nympq1… ikhowudi yindlela kuphela. I-Section 10.1 ibonise ngexabiso.

I-record yenye kuba kwi-settings category yayo, nymchat-pq-rootNgaphandle kokusebenzisa i-wraps, inikeza umsebenzi olufanelekileyo: ubonakaliso yayo yindlela yokuba idivayisi yesibini ufunde ukuba le idivayisi iye yenza i-root, nto leyo ivimbela ukuba isibophelela enye (i-Section 3.3).

3.3 Ukulungiselela kunye nokuveliswa

Kwi-boot, ukugcina idilesi elide, i-client isebenza ngexesha elandelayo:

1. Thola i-Existing nymchat-pq-root Ukucinga.
2. I-Record ebonakalayo, kwaye le mveliso inokufumana - ukwamkela kwaye ukwamkela le idilesi njenge-post-quantum efanelekileyo.
3. I-record ebonakalayo, kwaye le mveliso ayikwazi ukufumana — akukwazi ukuvelisa i-root entsha, kwaye akukwazi ukuvelisa i-advertisement. Qhagamshelane umqhubi ukuba uqhagamshelane le mveliso ngokuchofoza nympq1… ikhowudi evela kumadivayisi ebonakalayo.
4. Ukubhalisa — generate a root, publish the record, kunceda, kwaye ukubonisa nympq1… ikhowudi kubasebenzisi ngexesha elinye ukuze bafumane.

I-Step 3 yintloko elula ukufumana iingxaki, yaye yintoni i-ordering ibhalwe phantsi kwexesha elinye. Amadivayisi ezimbini ezinxulumene ukuvelisa i-root ikhiqiza izilwanyana ezimbini ezizodwa phantsi kwe-identity eyodwa, kwaye le yintloko le-ordering ikhona ukunceda.

4Ukubonisa umthamo

I-Public Half of the derived keypair ifumaneka njenge-addressable Molo-01 umnikelo — kind 30078, tagged nym-pq:

{
  "kind": 30078,
  "tags": [
    ["d", "nym-pq"],
    ["t", "nym-pq"],
    ["expiration", "<unix seconds>"]
  ],
  "content": {
    "v":     2,
    "alg":   "mlkem768",
    "nym":   1,
    "epoch": 0,
    "pk2":   "<base64url ML-KEM-768 encapsulation key>",
    "exp":   <unix seconds>,
    "devices": [ ... ]
  }
}

I-Addressable inikeza ukuba i-relay ibhalisele i-event eyodwa ngalinye (i-kind, i-pubkey, i-d-tag), ngoko i-republish ibhalisele i-announced eyadlulayo. Ngoko ke, zonke i-identity zihlanganisa ngexesha elinye, nto leyo ibhalisele i-key ye-Alice; i-catch efanelekileyo engapheliyo kunokuba i-list yokuxhomekeka.

I-Signature yi-binding I-event ibhaliswe yi-identity key, ngoko i-claim “i-ML-KEM key ibhaliswe yi- npub” ibekwe ngexesha elifanelekileyo kunye ne- npub yenye. Ukuguqulwa kwe-encapsulation key eyahlukileyo kufuneka i-signature ye-secp256k1 ifakwe. I-attacker enokufumana ukuba akufanele ukuba akufanele ukuba akufanele i-KEM.

Izibuyekezo zithunyelwe. iintsuku ze-7 I-NIP-40 I-expiration, ebhalwe ngexesha le-24 iiyure, ibhalisele iingcebiso malunga ne-client eyenziwa nangokufutshane ne-client eyenziwa nangokufutshane ne-client eyenziwa ngexesha elidlulileyo. I-root ngokufanayo akufutshane nangokufutshane; kuphela i-claim ngokufutshane nayo.

Iingcebiso elidlulileyo ibhalwe ngexabiso efana neengcebiso elidlulileyo: abalandeli zithumela i-NIP-44 ebonakalayo, leyo zonke iingcebiso zibonakalayo, kwaye i-client ibhalwe kwi-post-quantum exchange kwi-connection elandelayo, xa ibhalwe. Ngoko ke ukuchithwa kwiminyaka engaphezulu kweenyanga kunokuhlawula iingcebiso ezihlawulwe ngexesha elidlulileyo - ziyi-encrypted ngokuvamile ngaphezu kwe-quantum-resistant - kwaye akuyona nayiphi na enye. Ukudluliselwa akufutshane, akukho into efunyenwe xa kuza kuza kubonakala, kwaye akufutshane.

Kwaye asymmetry yenza ingxaki lokugqibela kunokuba ngempumelelo yayo. Akukho, i-record ifumaneka kwi-key ebizwa na: isixhobo esifutshane, i-reset, okanye ifumaneka kwi-root yayo ifumaneka isinyathelo esifutshane ukuba ifumaneke kwi-key ye-no one holds any more, kwaye iingxelo zithunyelwe phantsi kwalo zithunyelwa ngaphandle kwe-error kwiiyure ezimbini. Iintsuku ezisixhenxe le window, kwaye ivumela i-relayers ukunciphisa i-record ngokufanelekileyo kunokuba zithunyelwe kwi-clients ukuba zibonise.

I-key field inama i-format yayo. Le mveliso pk2, yaye i-digit iindawo ye-contract kunokuba yi-decoration: inama ifomati ye-payload esetyenziselwa. I-reader ebonakalayo i-field ibonelela “i-Nymchat client, akukho i-post-quantum key” kwaye ibonelela i-NIP-44 ebonakalayo, leyo enokufuneka zonke i-login. Yinto yindlela elungileyo yokukhangisa, kwaye kufuneka ibonwe njengomgangatho ukuba i-numbering ye-format ibonelela: isicelo se-capacity ebonakalayo kufuneka kuxhomekeke ukhuseleko, ngokuzenzakalelayo. I-key ye-peer ayikwazi ukusetyenziswa kunokunyanzeleka kunokuba kunokunyanzeleka, ngenxa yokuba umx

4.1 I-Absence yinto efanelekileyo, kunye ne-tri-value

Inani elincinci kodwa ebalulekileyo: i-announcement ifumaneka ngalinye i-Nymchat client, ngaphandle kwe-post-quantum-capable, kwaye i-key field iyahlukileyo. Oku kunikeza iintlobo ezintathu ezahlukileyo kunokuba iintlobo ezimbini:

Ukugqithisa umgca we-third ukuya kumgca we-fourth iya kuba isisombululo esemgangathweni. I-anunci ye-keyless iyisisombululo ebhalisiweyo ukuba umbhali isebenzisa i-Nymchat, leyo ivumela i-sending path ukufumana i-cross-protocol wrap ye-speculative enokuthi kufuneka ifumaneke kumadoda oya kufumaneka.

4.2 Izixhobo ebonakalayo ukuyifunda i-root ifumaneka

Ukuhlaziywa kunokwenzeka: intsebenziswano omnye ngalinye, ukuhlaziywa kwexesha elidlulileyo. Yinto yenza isakhiwo se-single-record ukusebenza, kwaye oko kwenza isixhobo engabonakaliwe ukuba ibhalisele. Isixhobo elidlulileyo isixhobo esithintweni isixhobo esithintela isixhobo efanelekileyo kwaye ibhalisele wonke umlinganiselo ukucacisa phantsi kwexesha elinye isixhobo akayi kufumana.

Ngoko ke, isixhobo esaziwa i-root kodwa ayikwazi ukuyifaka, ayikwazi ukuhlaziywa. Akukwazi ukuyifaka kwaye ayikwazi ukuyifaka kwi-application: kunokufunda zonke iingxelo apho iingxelo zihlanganisa kwaye akuyithumela ngokubanzi, nangokuchaza umqhubi ukuba uqhagamshelane. I-silence yintloko olungcono kwizixhobo ebonakalayo ukuhambisa umntu.

5Ukufumaneka kunye nokuthumela umxholo

I-Clients uyazi i-peer keys ngezindlela ezimbini. I-subscription epheleleyo ifumaneka kubasebenzisi esebenzayo - iingxowa ezivulekileyo kunye neengcali ze-group - ngoko izibuyekezo zayo ziyafumaneka njengeengxaki ezivamile. Kwi-peer-meet for the first time, i-one-shot query is running at send time, limited to 2.5 seconds; if it doesn't resolve, the message goes classic, which is the behavior that existed before post-quantum was added rather than a new failure mode.

Umxhaso we-negative isekelwe kwi-cache yeenyanga ezisixhenxe kunokuba ngexesha elide. Umxhaso oyanzelisa isixhobo esitsha, okanye oyanzelisa ukusuka kwi-browser-extension login ukuya ku-local key, kuza post-quantum efanelekileyo kwi-midd-conversation, kwaye i-cache ye-permanent “no” uya kubuyela kwi-encryption ye-classical ngexesha lokuzalwa.

5.1 Yintoni akukho umdla wamafutha

I-routing decision ikunciphisa kwiziphi na ingxaki:

pq = (we hold a signed, unexpired ML-KEM key for this recipient)

Kukho ukulungiselela umthamo, akukho uhlu-algorithms-ukusetyenziswa, kwaye akukho indawo i-attacker angakwazi ukunceda ukuxhaswa umzila we-weaker. yi I-Failure Mode ye-akhawunti ebhalisiweyo okanye ebhalisiweyo yinto ukuba umyalezo uqhagamshelwano - i-status quo ngaphambi kwe-function. - Ngaphandle kokuba umyalezo we-hybrid iyafumaneka kwakhona.

I-Converse sincoma nangaphezulu: i-client inikeza i-hybrid Ukucinga xa ithatha i-key, kwaye ukuchitha i-key i-proof i-receiver inokukwazi ukuxhaswa. Akukho kwimeko apho umyalezo ifumaneka post-quantum ukuba umntu owazi ukucinga.

6Ukwakhiwa kwe-hybrid

I-Nymchat ayihlaziywa ne-NIP-44. I-NIP-44 ye-encryption ye-encryption ye-NIP-44 ye-layer ye-internal, kwaye i-ML-KEM ibonisa i-AEAD ye-extern ngokugqithisileyo:

inner = nip44_encrypt(plaintext, conversation_key(sender, recipient))

info  = "nymchat-pq2" || sender_secp_pk || recip_secp_pk || kem_ct || recip_kem_pk
prk   = HKDF-Extract(salt = "nymchat-pq2-v1", IKM = kem_ss)
key   = HKDF-Expand(prk, info || "key",   32)
nonce = HKDF-Expand(prk, info || "nonce", 12)

outer = ChaCha20-Poly1305(key, nonce, plaintext = inner, aad = info)

payload = "pq2." || base64url(kem_ct) || "." || base64url(outer)

Zonke iingcebiso ziya kufuneka ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye ziye zibe.

• kem_ss I-ECDH yenza i-key ye-layer ye-outer kuphela. Akukho nto le-derivation igxininisa i-ECDH yokukhipha, nto leyo i-Section 6.1.
• kem_ct, recip_kem_pk Zonke iingcebiso ze-identity ziquka iinkcukacha ezinxulumeneyo, ngoko i-layer ye-extern isetyenziswe kwi-transcript efanelekileyo ebonakalayo. Ukuqhathanisa i-cryptertext kwi-identity ye-other sender ibonakaliswa kwe-authentication kunokuba yi-decrypting.

I-ML-KEM key ye-receiver ihamba elide, kodwa zonke iingxelo zihlanganisa i-encapsulation eyahlukileyo kwaye ngoko ke i-encryptor text eyahlukileyo. kem_ssYinto yenza ukuqhuba i-nonce kunokuba ukhangela: I-ChaCha20-Poly1305 Ukusetyenziswa kwipari ye-key, i-nonce, kwaye apha i-key yintoni yintoni yintoni yintoni yintoni yintoni, ngoko akukho i-pair engathintela.

6.1 Yintoni iingqungquthela ziyafumaneka

I-alternative ye-mixing ezimbini iingcebiso kwi-conversation key enye kunye nokuthintela ukuba kwi-NIP-44:

ck = HKDF-Extract(salt = "…",
                  IKM  = ecdh_x || kem_ss || …)          // do not do this

Yintoni ukwakhiwa kubonakalisa njenge-cryptography. It has one structural problem: it needs ecdh_x, i-rough x-coordinate ye-ECDH output, njengezinto esisombululo - kunye ne-browser extension (I-NIP-07) okanye umnqweno rhoqo (I-NIP-46Yenza i-NIP-44 kumnqweno we-caller kunye nokuthumela i-encryption text, nto leyo yinto epheleleyo yokugcina i-key apho isicelo akakwazi ukufikelela.

Ukutshintsha iingcebiso ngoko kuxhomekeka zonke iingcebiso ezihlabathi iingcebiso ye-identity kwi-signer, ngoko ke abasebenzisi abenzi ezininzi, kwaye akukho inani lokusebenza kwiingcebiso ye-derivation iya kubuyekeza. Iingcebiso ivimbela ukuxhomekeka: I-NIP-44 ibekwe ngokupheleleyo kwaye ifakwe ngoko ke yintoni ekubeni iingcebiso ye-identity, i-signer kuquka, kwaye i-KEM i-half ibekwe kwi-code yokukhuthaza i-client ibekwe ngqo. Iingcebiso ze-signer ziyixhomekeke ngokufanelekileyo post-quantum kwiibini.

I-coding ye-ML-KEM yi-1088 iibayti kunye nokuhamba yonke imiyalezo, i-base64url-i-coded kwi-1451 imiyalezo; i-AEAD ye-extern ibandakanya i-tag ye-16-byte ye-Poly1305 kwaye ibandakanya i-NIP-44 ye-payload ye-wraps nge-third. Umyalezo we-50-character ibandakanya kwi-176-byte ukuya kwi-1722, kunye ne-2000-character one ukusuka kwi-28,820 ukuya kwi-5238. Umyalezo we-1,5 KB ngalinye ngalinye umyalezo ngaphandle kokungaphakathi, nto leyo ixabiso yokubandakanya ngokugqithisileyo ngexesha elinye ngaphandle kokusebenzisa i-secret eyahlwayo.

6.2 I-self-describing payloads

Yintoni pq2. I-prefix yenza ukuguqulwa kwe-incremental: yintoni i-self-describing, ngoko i-client ikhetha i-path of decryption ngokucacisa i-payload ngaphandle kokufumana i-tag okanye ukucacisa into e-peer. I-reader ebonakalayo i-prefix akufumana ukuyifunda le-payload ngaphandle kokufunda, kwaye iingxelo zithintela phambi kwelinye iingxelo zingafumana i-post-quantum njenge-NIP-44 ebonakalayo ngaphandle kwe-migration.

6.3 Zonke iingqungquthela ze-cadeau wrap

A I-NIP-17 Umxholo we-A I-NIP-59 i- gift wrap: i-spoken engabonakaliweyo, ifakwe phantsi kwe-sender's identity key (i-type 13), ke ifakwe phantsi kwe-throwable key eyenziwe ngexesha le-message (type 1059). Kwi-login eyenza i-identity key ngqo, i-Nymchat i-hybridizes iindidi ezimbini, ngamnye nge-encapsulation yayo.

I-login ye-signer inokufumana i-layer ye-outer kuphela. I-seal ifakwe ngu-signer njenge-NIP-44 ebonakalayo - i-application ayikwazi ukufumana i-key ebonakalayo - ngoko akakwazi ukuhanjiswa kwindawo yayo. Oku akuyona engabonakaliyo kwi-attack ebonakalayo: i-seal iyatholakala kuphela nge-wrap, kwaye i-wrap yintoni i-recorder ibekwe. I-opponent enikezela i-traffic ebonakalayo kufuneka uqhuba i-ML-KEM phambi kokuba i-seal iya kuba kwakhona ekhawulezayo ukuxhaswa.

7Iingxelo zeGruppe kunye ne-Coverage ye-Party

Umxholo we-Group ayikho umxholo wesixhobo enye. Yintoni umxholo wesixhobo wesixhobo wesixhobo wesixhobo wesixhobo wesixhobo wesixhobo wesixhobo wesixhobo wesixhobo wesixhobo wesixhobo wesixhobo.

Ukwenza oku kwimeko yebhizinisi ukuba isebenzo naividiyo ivula. Ukuba iiyure ezisixhenxe ze-10 zithunyelwe i-copy ye-hybrid, i-message ifumaneka. hayi iiyure ezisibhozo ezihambelana. Umngeni kufuneka i-copy yesibhozo yesibhozo yesibhozo ezisibhozo ezisibhozo ezisibhozo, ngoko i-message ifumaneka kuphela ukuba yonke I-copy yeyona

Nymchat ngoko kucacisa ukucaciswa kwe-per-message ngexesha le-fan-out - ukucaciswa kunokwenzeka kuphela xa i-wraps ziye zibonwa - kwaye i-badge ibhalisele ukuba i-8 kwi-10 iingcali-resistant, ngaphandle kokuqinisekisa ukuba i-message ifumaneka. Xa akukho ukucaciswa kunokufumaneka, nto leyo iimeko esemgangathweni Ukufumana umxholo we-group (only the sender counts the fan-out), umxholo we-interface unxibelelanisa i-partial rather than full protection. Ukukhangela ukhuseleko olupheleleyo kwi-power of one's own copy kuphela kunokuthi ukuphazamiseka kwi-message ngokugqithisileyo.

7.1 Yintoni iinkcukacha ze-Shield

I-Shield ibonisa i-truth malunga Ukucinga, akukho malunga ne-software enikezelwa:

• Ukhuseleko olugqibeleleyo: Zonke i-copy ye-plaintext yaba-hybrid.
• I-Partitional: ezinye i-copies ye-group message ziye zithunyelwe ngokucacileyo. I-Draw degraded kunokuba i-full, ngenxa yokuba i-copy ye-classic ye-plate-text ebonakalayo zonke ziphumo ze-adversary.
• I-Classic ifumaneka ngokufanelekileyo kunokuba ifumaneka njenge-no badge, ngenxa yokuba i-indicator ebonakalayo phakathi kwe- “unprotected”, “broken”, kunye ne- “i-build ye-function”.

I-Cyphertext eyenziwa ngoku kunokufumaneka ngexabiso efanelekileyo, kwaye i-interface eyenza iingxelo ezidlulileyo kwi-power of a new announcement kuya kubonisa into oluthile malunga ne-byte kwi-relay.

Umgaqo weqela le-group kwi-stack kwi-top ye-stake ye-group instead of replacing it: i-group message is fully protected only when each member's copy was, and a received group message with no coverage count shows partial.

8Iingxelo ziye zithunyelwe kwakhona

Izinto ezininzi iinkcukacha ze-client zithunyelwe kwi-identity ye-user: izakhiwo ezincinane, i-conversation list, i-group keys, kunye ne-message archive. Ezi zithunyelwe kwi-user ngaphezulu kweengxelo ezininzi, ngoko ukugcina iingxelo ezincinane yenza i-artifact ezincinane ezihlaziywa ngaphandle kokubili ukuba iingxelo ziye zithunyelwe ngokufanelekileyo. Zisebenzisa i-hybrid efanayo, i-encapsulated kwi-root-derived key ye-user - nge-exception eyahlwayo kwi-Section 3.2. nymchat-pq-root i-category yenyewe, leyo ayikwazi ukufuma phantsi kwe-key eyayikwazi ukuvelisa kuphela.

I-blob yokufakelwa okanye i-archive row ibekwe kwindawo efanayo iminyaka emininzi, nto leyo yinto efanelekileyo yintliziyo-ngoku-decrypt-ngoku-adversary ibekwe-ngaphezulu kunokuba ingxelo efanelekileyo, nto leyo ngexabiso efanelekileyo kumasebenzisi wayo.

Umnqweno omnye ukulawula ifomati apha kunokuba i-key. I-copy ye-self-addressed kufuneka ifumaneka ngathi: yonke umatshini kwi-akhawunti, ngoko zonke izixhobo zithintela into efanelekileyo kwi-router ebonakalayo yayo, kwaye i-akhawunti ibhalise kuphela into ezininzi ezaziwayo. Ukubhalisela nayiphi na enye ingxaki umatshini ngaphandle kweengxaki zayo zayo zayo - lo mfuneko efanelekileyo efana ne-Section 3.2, isifumaneka ngexesha elinye, ukufikelela kwindawo ezahlukeneyo.

9Ukucinga

Yintoni epoch I-counter kwi-derivation yenza i-rotating kunokwenzeka ngaphandle kwimveliso ye-key entsha. Ukwandisa inikeza i-keypair entsha evela kwi-root efanayo kunye ne-re-published announcement; i-peers ibonise i-key entsha kwi-record enokufutshane. I-rotating ngoko ke ayidinga abasebenzisi ukuyibhale into engundoqo: i-root iboniswa ngexesha elinye ngalinye ngalinye kunye ne-epoch ibonelela.

9.1 Iintsuku ezidlulileyo zithunyelwe, kwaye akukho nto ifakwe

Kwi-client, i-decryption candidates ifumaneka kwi-epoche yamanje ukuya kwi-epoche − 3, ngoko i-message eyenziwe ngexesha elandelayo phambi kokuba i-rotating iye ifumaneka kwi-keypair ebonakalayo xa ifumaneka.

Yintoni ivenkile iye yenza i-rotating ekhuselekileyo: ngaphandle kwe-rotating, zonke i-rotating ziya kuxhaswa ngexesha elide. Yonke into ekhuselekileyo ibekwe ekhuselekileyo ngexesha lokuzalwa kwe-identity, ngenxa yokuba umyalezo owenziwe ngexesha elidlulileyo kunokufumana ngexabiso owenziwe ngexabiso (i-Section 10.5).

10Yintoni oku kutshintshwa

Inqaku elidibanisa kuphela into efunyenwe yi-design ayibonakalisa i-system, kwaye ukuchitha i-property ye-security kwi-interface kunzima kunzima kunokuba ukunceda.

10.1 I-root i-secret yesibini, kwaye ukuphazamiseka kunokufumana

Yinto ixabiso efanelekileyo ye-Design. I-Constraint e-Section 2 ukuba umqhubi kufuneka unako ukufumana into efanelekileyo: i-nsec kuphela akukwazi ukuguqulwa i-post-quantum key, ngenxa yokuba ingxaki yokuba akukho i-value ye-publish kunye ne-secret eyayithintela. Ukuba nayiphi na isixhobo unayo i-root kwaye akukho yeengxaki ze-Section 3.2 iya kufumaneka, i-material ebonakalisiwe kwi-root-derived key ayikho. Akukho i-escrow, kwaye akukho ngokufanelekileyo akukho i-authority enokufanelekayo.

Nge-manual transfer i-path kuphela, oku kubaluleke kakhulu kunokwenzeka ekuqaleni. A user who never copies the nympq1… ikhowudi apho umzekelo umzekelo umzekelo umzekelo umzekelo umzekelo umzekelo umzekelo umzekelo umzekelo umzekelo umzekelo umzekelo umzekelo umzekelo umzekelo umzekelo umzekelo umzekelo umzekelo umzekelo umzekelo umzekelo umzekelo umzekelo umzekelo umzekelo umzekelo umzekelo nsec akukho mfuneko; nto leyo i-property esekelwe yonke design.

I-attacker ifumaneka i-path eyenziwe ngexabiso, ngoko ke i-scheme ibhekwa ngexabiso yayo ebuthandayo - i-passsphrase evamile, ngexabiso, ibhekwa yonke into ngexabiso yaye i-passsphrase ibhekwa ngexabiso ngexabiso.

10.2 Ukubhalisa, njengoko eyahlukileyo kwi-confidentiality

Zonke i-signature kwi-Nostr i-Schnorr phezu kwe-secp256k1, kwaye oku kutshintshwe apha. Umngcipheko kunye ne-computer ye-quantum angakwazi ukuqhuba i-signatures kunye nokuthintela umqhubi ngexesha elifanelekileyo. Yintoni i-hybrid key exchange isaphulelo-now-decrypt-later: umngcipheko ebhalise i-traffic namhlanje ayikwazi ukuyifumana ngexesha elandelayo. Akukwazi ukwenza umyalelo olungabonakalisayo kwi-adversary enomatshini. Le nkcwaliso lithunyelwe kwizicelo ngokufanelekileyo - i-indicator ye-padlock ibhalisela ukuqhuba, i-shield ibhalisele ukhuseleko,

Kwakhona ibandakanya into efunyenweyo kwi-Section 4. Ukuxhaswa phakathi kwe-NPUB kunye ne-ML-KEM key yi-signature ye-secp256k1, ngoko umngcipheko owazi ukuxhaswa oku kunokukwazi ukuguqulwa i-key yayo yayo. Ukuxhaswa kwi-adversary elandelayo ayinayo ne-authenticity kwi-one.

10.3 Izixhobo ze-metadata

Ukupakisha i-Gift ibala i-sender, i-receiver ngaphezu kwelinye p i-tag, i-type, kunye ne-timestamp ye-message ye-internal. I-tag ayifunda ukuba i-event, ubungakanani yayo, okanye xa i-relay yaziwa. I-traffic analysis ayifumaneka ngalinye ingxenye ye-design.

10.4 I-offline mesh

I-Bluetooth mesh transport ye-Nymchat i-protocol eyahlukileyo kunye ne-handshake yayo yayo yayo, kwaye ayikho kwebhizinisi leyo. Iingxelo kwi-mesh ziyi-classic.

10.5 Iingxelo ezidlulileyo

I-Cyphertext ebhalwe ngeli xesha elinye iinkcukacha ziyi-classic zihlabathi. I-Cyphertext ifumaneka kwakhona kwaye ayikho. Ukhuseleko ifumaneka kwi-message apho iinkcukacha ze-post-quantum ziye zithunyelwe kwiinkcukacha ze-post-quantum, ayikho ngexesha lokufaka i-function.

11Iimveliso ezibonakalayo

12Ukusebenza Parity

I-Nymchat inikeza izakhiwo ezimbini ezimbini - enye kwi-JavaScript ye-web application, enye kwi-Dart ye-mobile applications, kuquka i-port ye-ML-KEM-768. Izakhiwo ezimbini ziyi-primitive efanayo zihlanganisa, ngoko zihlanganisa ngokufanelekileyo kunokuba zihlanganisa ukuba zihlanganise.

Ukusetyenziswa kwe-Dart ML-KEM kubhalwe kwi-official I-NIST ACVP iimveliso ezaziwayo ze-response ye-ML-KEM-768 (ML-KEM-*-FIPS203) — i-25 key-generation, i-25 encapsulation kunye ne-10 cases decapsulation, ezisebenza njenge suite yayo. Lezi zibe i-vectors i-NIST zithunyelwe ukuvalwa i-implementation, ngoko ukuvalwa zibonisa ukuba i-port yinto efanelekileyo, yaye kuphela i-evidence ukuba iinkcukacha ezimbini zihlanganisa. Ukongezelela, i-fixture eyahlukileyo ye-vectors ye-test — derivation ye-seed, encapsulation, i-payload ye-formats, kunye ne- gift wraps epheleleyo — ifumaneka kwi-reference ye-JavaScript kwaye ilawulwe yi-test suites ezimbini. I-root secret ibandakanya le fixture kunokuba ukuguqulwa: root kwi-seed, nympq1… Umzekelo kwinqanaba omnye umzekelo umzekelo umzekelo umzekelo umzekelo umzekelo umzekelo umzekelo umzekelo umzekelo umzekelo umzekelo umzekelo umzekelo umzekelo umzekelo umzekelo umzekelo umzekelo umzekelo umzekelo umzekelo umzekelo umzekelo umzekelo umzekelo umzekelo umzekelo.

I-fingerprint iyathanda ukuba ifumaneke phakathi kwezi. Yintoni ibonelela i-device “e-root i-I hold” ukusuka kwi- “e-root enye, kwaye i-client enokukwazi ukudlala i-fingerprint ye-client ye-client eyayithanda i-record elungileyo njengoko akukho i-record - kwaye ke, emva kwe-Section 3.3, i-mint ye-root yesibini kwaye i-identity. Yinto i-vector ngenxa yile nto.