Nymchat ubuchwepheshe whitepaper

I-Post-Quantum Key Agreement ku-Nymchat

Ukuhambisa i-ML-KEM-768 key public phezu ku-Nostr ngaphandle kwe-directory noma i-register, futhi ukucubungula kusuka ku-secret okuyinto akukho-value public.

Ukongezelela i-post-quantum key exchange ku-messenger akuyona ngokuvamile ingozi ye-cryptography. I-primitive iyatholakala kanye ne-libraries. Indawo enhle kuyinto ukuthi wonke umdlali akufuneka ngoku ikhaya Umbhali elihlanganisa kanjani i-Nymchat uxhumane lokhu - lapho ikhoyili yesibili ivela, indlela yokufinyelela abantu abesifazane, futhi ukuthi isixhumanisi ingatholele ukuthi isiphumo - futhi, ekupheleni lokugqibela, ukuthi isiphumo esizukile.

Leli khasi lihunyushwe ngomshini ukuze kube lula. IsiNgisi sangempela inguqulo esebenzayo.

1Ukuphendula

Izindaba zethu zebhizinisi zihlanganiswa nge I-NIP-44, okuyinto amabili amabili amabili amabili. I-half that scrambles the plaintext — I-ChaCha20 nge-HMAC-SHA256 tag, ifakwe nge Ukubuyekezwa (I-RFC ye-5869) - akuyona ngempumelelo kwekhompyutha ye-quantum; i-algorithm ye-Grover inikeza isivinini se-square-root ngokumelene ne-symmetric key, futhi i-bits ye-256 ibhokisi lokhu. Ukulungele ku-key yi-elliptic-curve Diffie-Hellman phezu ukunakekelwa256k1I-algorithm ye-Shor isixazululo i-logarithm enhle. Ukuguqulwa kwe-private key kusuka ku-private key ye-private counterpart ye-private ye-private key ngokugqithiselwe ngokugqithiselwa kwe-private key ye-private key.

Imininingwane okuholela akuyona asekelwe kuze kube nenkqubo efana. Umngciwane onguchwepheshe nge-akhawunti angakwazi ukucacisa i-encrypt text namhlanje futhi ukucacisa lapho izinga lokufika. Yonke okuzenzakalelayo okuzenzakalelayo okungenani okungenani iyatholakala. Lokhu ku-attack yesifazane ye-post-quantum key exchange, futhi lokhu kungenzeka ukuthi umsebenzi akuyona ukuthi igcinwa ukuthi igcinwa.

1.1 Umbuzo le ncwadi inikeza

Ukunciphisa iyatholakala kahle: isebenze i-post-quantum key encapsulation mechanism ngokubambisana ne-classical exchange, ngakho-ke umngciwane uxhumane amabili ukucacisa konke. I-Nymchat isebenzisa i-ML-KEM-768 (Imininingwane 203). Lokhu ngokushesha inikeza ingxaki yokusabalalisa:

I-NPUB iyatholakala ngokweqile. Ungathayela iphepha, ungazifunda ngokulandelanayo, noma ukhiye kusuka ku-screen, futhi kuyinto wonke umuntu kufuneka u-encrypt kuwe. I-ML-KEM-768 isisekelo se-public is 1,184 i-byte. Ungathola ngokulandelanayo, akuyona ingatholakala ku-username, futhi akuyona ku-QR code ngaphandle kwe-identity eyi-32 i-byte kuphela.

Usayizi kuyinto ingxenye elula. Indawo enhle kuyinto inikeza imibuzo ezintathu ezahlukile, futhi inkosi le ncwadi kuyinto ngokuvamile impendulo kubo:

• Kuyinto kungenziwa i-substitute. I-key ungayitholanga ngokugqithiselwe ngegama elifanayo kuyinto elilodwa enomthombo enomthombo. I-Section 4 iveza ku-identity nge-signature, okuyinto ivula lokhu ngokugqithiselwe.
• Kuyinto kufuneka uqhagamshelane kumadivayisi we-user. I-akhawunti efanayo kwi-telephone kanye ne-laptop kufanele ibonise i-key efanayo, noma imiyalezo ebonakalayo kwelinye ayikwazi ukufinyelela kwelinye. I-Section 3.2 ibonise khona.
• Kuyinto kunokwenzeka ukufinyelela. I-published key iyahlaziywa kusuka ku-secret, ngakho-ke into efanelekayo kuyinto esithakazelisayo - futhi ngokuvimbela akukho enye akuvimbela. I-Section 10.1 ibonisa ngokucacileyo ukuthi ingozi, ngoba lokhu akuyona akuyona okungenani okwenziwe.

2Design Izinzuzo

Izinzuzo ezine zihlanganisa impendulo, futhi zihlanganisa izakhiwo ezininzi ezivamile ngaphambi kokubili isixhumanisi.

1. Imininingwane ezingenalutho. Izinzuzo zethu zithunyelwe ngokugcwele, i- nsec. Yonke ingcindezi ezengeziwe iyindlela eyodwa yokuthintela ingozi yakho, futhi umuntu owaziwa ukubuyekeza i-nsec akuyona akuyona ukunakekelwa okuhle. Isigaba 3.1 ibonisa ukuthi lokhu akuyona akuyona ngokugcwele - isifinyezo se-post-quantum esekelwe ku-nsec akuyona akuyona ngokugcwele - ngakho umklamo akuyona nje ngokugcwele futhi akuyona kakhulu: isakhiwo esisodwa se-key, eyenziwe ngexesha elinye ngama-identity, esekelwe ekubeni njenge-nsec futhi kwindawo efanayo, ukuze umuntu owazi ukwenza indlela yokuthintela eyodwa akuyona indlela yokuthintela eyodwa. Isigaba 10.1 iyatholakala ngokug
2. akukho umthetho. Kungekho inkonzo enokutholwe ukuthi ungacabanga ukuthi isifinyezo kuyinto wayo. Yonke inkonzo efanayo kuyinto indawo lapho imiyalezo ingathunyelwa.
3. Izinhlelo ezininzi, idivayisi eyodwa. I-Nostr identity isetshenziswe ngokuvamile kumakhasimende eziningana ngexesha elifanayo. Yonke izinto eziyinhloko ziye ziye ziye zihlanganisa ngokufanayo kumakhasimende, futhi izindlela ezivela khona akuyona akuyona akuyona ngokuvumelana ne-opponent eyenza.
4. Ngaphandle kokufaka. Noma-in-band exchange ye- “isibuyekezo esisekelwe?” kuyinto indawo e-attacker angakwazi ukujabulela ukhetho okungenani. Umklamo kufanele akuyona lokho yokunciphisa.

3I-Root Secret ye-Independent

I-decision-bearing is that the ML-KEM decapsulation key is seededed from key material that no public value exposes. I-identity is a root secret, generated once:

pqRoot   = 32 bytes from a CSPRNG, generated ONCE per identity

seed     = HKDF-Expand(
               HKDF-Extract(salt = "nym-pq-root-v2", IKM = pqRoot),
               info = "mlkem768/epoch/" || epoch,
               64 bytes)

(ek, dk) = ML-KEM-768.KeyGen(seed)

I-root iboniswe kubasebenzisi ngokufanayo ne nsec: ikhaya32 Nge-humano-ukudlulisa prefix nympqNgiyaxolisa njengoba nympq1…Ukubonisa nge nsec ku-identity screen emzimbeni elifanayo yokubonisa ukuxhumana, ifakwe nge-control efanayo, akukwazi ukuxhumana futhi akukwazi ukuxhumana. It is not a password and it is not a login. It is key material that the user can save, just like the nsec.

I-salt iyahlukaniswa kwe-domain ngempumelelo, ngakho-ke akuyona ingozi elinye angakwazi ukufinyelela ngama-keypair efanayo. epoch Counter drive rotation (I-Section 9).

3.1 Why the key can't be derived kusukela idivayisi key

Ukucubungula okuhlobene ku-keypair kusuka ku-secret e-user:

seed = HKDF(salt = "…", IKM = nsec)          // do not do this

Kuyinto emangalisayo ngezikhathi ezine, zonke zihlanganisa: akukho entsha yokukhipha, ngoba nsec kuyinto yebhokisi; zonke izixhobo zihlanganisa ngokubunjwa, ngaphandle kwe-synchronization protocol ukuhlangabezana; isibuyekezo eyodwa yokubuyekezwa ngalinye idivayisi ngokubuyekezwa ngokubuyekeza, ngoba izixhobo angakwazi ukuxhaswa mayelana ne-key; futhi i-key eyenziwe ngaphambi kokubuyekezwa, ngakho-ke i-client angakwazi ukucindezeleka yini ngokuvamile kuqala.

Zonke izinzuzo ezine zihlukile, ngenxa yesizathu eyodwa. I-algorithm ye-Shor isebenza ngokumelene ne-nppub eyakhelwe yi-nsec. I-seed derivation iyinhlangano eyakhelwe ngokumelene ne-nsec. Ngakho-ke umngciwane owawufaka i-half ye-classic ibonise i-post-quantum i-half ngokushesha i-HKDF efanayo ebonakalayo wonke umuntu. Ngaphandle kwe-harvest-now-decrypt-later - umngciwane eyodwa we-feature iyatholakala ukucindezeleka - i-key eyenziwe ngokuvamile akuyona yini.

I-clause yesibili ye-regime elifanayo isebenza kakhulu njengesi-first. I-secret eyenziwe ngokuzimela esithathwe phakathi kwamakhemikhali ye-user ngaphakathi kwekhompyutha ye-NIP-44 ebonakalayo kuyinto elifanayo yokungasebenzi nge iminyathelo ezengeziwe: umngciwane uthumele iminyango elandelayo namhlanje futhi ufakele ikhoyili yayo yayo yokuqala ngemva kwalokho, futhi i-root ifumelele. Ngakho-ke izindlela ezilandelayo zihlanganisa izindlela zayo, futhi ukuthi akuyona akuyona “ukuthumela kumadivayisi wakho omunye.”

3.2 Ukufinyelela ku-root kumadivayisi omunye we-user

I-Constraint 3 ye-Section 2 - idivayisi eyodwa, izixhobo eziningana - ayikwazi ukujabulela nge-arithmetic lapha, ngenxa yokuba yonke into kuyinto ukuthi umkhosi akuyona inqubo ye-ni-ni-ni-ni-ni-ni-ni-ni-ni-ni-ni-ni-ni-ni-ni-ni-ni-ni-ni-ni-ni-ni-ni-ni-ni-ni-ni-ni-ni-ni-ni-ni-ni-ni-ni-ni-ni nympq1… ikhodi ngokuvamile.

I-root ifakwe njenge nympq1… Ngaphandle kwe nsec, futhi idivayisi yesibili iboniswe ku-panel efanayo. Kuyinto inqubo ephelele. I-appliance ebonakalayo ikhodi ayikwazi ukufinyelela, okuyinto i-Section 4.2 ibonisa.

Ukudluliselwa kwama-manual iyinhlangano olusebenzayo kunoma isinyathelo yokuqala. Isisekelo se-Section 3.1 ivumela ukuthi isisekelo akuyona akuyona ngaphansi kwe-encryption esizayo-only, futhi zonke izindlela ezokwenza okuzenzakalelayo-ukudluliselwa nge-relay, ukuvikela ku-identity key-ukudluliselwa lokho ngokufanayo. Isinyathelo esebenzayo yama-user kuyinto isizathu sokuphefumula.

I-format inikeza indawo ye-wrapped path: idokhumenti angakwazi ukuthatha isithombe se-wraps, ngamunye i-AEAD blob ngaphansi kwe-key eyayitholakala kubasebenzisi kumadivayisi omunye - isithombe se-PRF ye-passkey, isibonelo. Akukho isithombe se-AEAD namhlanje, futhi kuze kube yini, i-PRF nympq1… ikhodi kuyinto indlela kuphela. I-Section 10.1 ibonise kanjani.

I-record ngokuvamile ibhekwa ku-settings category yayo, nymchat-pq-rootNgaphandle kokubeletha ama-wraps, inikeza umsebenzi olufanelekayo: ukufinyelela kwayo kuyindlela yokufundisa ukuthi le idivayisi inesikhathi esifundeni, okuyinto ivimbele ukunambitheka umlingani (I-Section 3.3).

3.3 Ukulungiswa kanye nokulethwa

Ku-boot, ngokuvumelana ne-identity enhle, i-client isebenza ngezikhathi esilandelayo:

1. Thola i-Existing nymchat-pq-root Ukuhlolwa
2. I-Record ebonakalayo, futhi le ngekhompyutha inokufaka - ukwamukela futhi ukunikezela lokhu ikhono njenge-post-quantum efanelekayo.
3. I-record ebonakalayo, futhi le nkqubo ayikwazi ukufaka - akuyona isakhiwo esitsha, futhi akuyona izibuyekezo zangaphakathi. Qinisekisa abasebenzisi ukuxhumanisa le isixhobo ngokuvumelana nympq1… ikhodi kusuka kumadivayisi eyenziwe.
4. Ukubalwa — generate a root, ukulayisha idokhumenti, ukulayisha, futhi ukubonisa nympq1… ikhowudi kubasebenzisi once ukuze bafumane.

Isinyathelo se-3 kuyinto isinyathelo esifanelekayo kakhulu, futhi kuyinto isizathu sokubhalisa ngokubhalisa kunoma ngalinye isicelo. Amadivayisi amabili abahlala ukukhiqiza isisindo amabili ngokuzihlanganisa ngaphansi kwe-identity eyodwa, futhi lokhu kuyinto isizukulwane esisekelwe ukuhlangabezana.

4Ukubonisa umthamo

I-Public Half of the derived keypair ifakwe njenge-addressable Imininingwane 01 event — uhlobo 30078, ethandwa nym-pq:

{
  "kind": 30078,
  "tags": [
    ["d", "nym-pq"],
    ["t", "nym-pq"],
    ["expiration", "<unix seconds>"]
  ],
  "content": {
    "v":     2,
    "alg":   "mlkem768",
    "nym":   1,
    "epoch": 0,
    "pk2":   "<base64url ML-KEM-768 encapsulation key>",
    "exp":   <unix seconds>,
    "devices": [ ... ]
  }
}

I-Addressable inikeza ukuthi i-relay inikeza into eyodwa ngamunye (i-kind, i-pubkey, i-d-tag), ngakho-ke i-republish inikeza ibhizinisi elandelayo emkhakheni. I-identity ngamunye ikakhulukazi inesibopho esifanayo, okuyinto inikeza i- “look up ye-Alice's key” a single unambiguous fetch kunokuba isithombe sokubambisana.

Umbhali we-Binding is the Binding. I-event ibhaliswe yi-identity key, ngakho-ke i-claim “ile ye-ML-KEM key ibhaliswe yi- npub” kuyinto enhle kakhulu njengesi-nppub. Ukuguqulwa kwe-encapsulation key eyahlukile kufuneka i-signature ye-secp256k1 eyenziwe. Umdlali abakwazi ukwenza lokhu akufanele ukuphazanyiswa ne-KEM.

Izikhangibavakashi zihlala. Izinsuku ezingu-7 I-NIP-40 I-expiration, ebhalwe ngamahora angu-24, ivela ibhokisi isifundo se-customer eyenziwe nangokuthi isifundo se-customer eyenziwe. I-root ngokuvamile akuyona; kuphela isifundo se-customer esebenza.

I-announcement eyenziwe ngokugcwele njenge-announcement eyenziwa njenge-announcement eyenziwe ngalinye: ama-peers zithumela i-NIP ye-node-44 eyenziwe ngalinye, okuyinto zonke ama-login angathola, futhi i-client ibuyekeza ukuxhumana kwe-post-quantum ku-connection esilandelayo, lapho ivula. Ngakho-ke ukuxhumana kwe-silent engaphezulu kwe-ukudluliswa kwe-ukudluliswa kwe-ukudluliswa kwe-ukudluliswa kwe-ukudluliswa kwe-ukudluliswa kwe-ukudluliswa-ukudluliswa-ukudluliswa-ukudluliswa-ukudluliswa-ukudluliswa-ukudluliswa-ukudluliswa-ukudluliswa-

Kuyinto asymmetry kuyinto isizathu sokugqibela kunokwenzeka. Ngaphandle kwalokho, idokhumenti akuyona elithakazelisayo: isixhobo esifushane, reset, noma i-root eyahlukile isithombe isinyathelo esifundeni yokubacindezela ku-key engaba akuyona, futhi imiyalezo eziholwe ngaphansi kwalo akuyona ngaphandle kokungabikho kwebhizinisi. Izinsuku ezingu-7 zihlanganisa le window, futhi ivumela i-relayers ukujabulela idokhumenti ngokuvamile ngaphandle kokufakwa kumakhasimende ukhangela.

I-key field inama ifomu yayo. I-Felter is pk2, futhi idivaysi kuyinto ingxenye ye-contract kune-decoration: inama ifomati ye-payload eyayisebenzisa i-key. Umbhali owaziwa i-field akuyona “i-Nymchat client, akukho i-post-quantum key” futhi inikeza i-NIP-44, enhle, okuyinto iyiphi isixhumanisi ingasetshenziswa. Kuyinto indlela efanelekayo yokungasebenzi, futhi kuncike njengoba isisekelo i-numbering ye-format iyathuthukisa: isivumelwano se-capacity engatholakali kuxabiso, akufinyelela. A key a peer akufanele usebenzisa kune-key engabizi, ngoba isivumelwano esithathwe ngaphandle kwe-error emibini.

4.1 Ukungabonakaliswa kubalulekile, futhi i-tri-value

I-detail enhle kodwa enhle: I-announcement iyathunyelwa kumakhasimende wonke we-Nymchat, ngaphandle kwe-post-quantum-capable, futhi i-key field iyathunyelwe. Lokhu kunikeza izimo ezintathu ezahlukile kunezinto ezimbili:

Ukuhlukanisa umugqa wesithathu ku-fourth kuyinto isizukulwane esiyingqayizivele. Ukubuyekezwa okuzenzakalelayo kuyinto ukubuyekezwa okuzenzakalelayo ukuthi umbhali isebenzisa i-Nymchat, okuvumela umbhali ukuhambisa ukuhambisa umbhalo we-cross-protocol esithakazelisayo okuyinto kufanele kuhlanganise kumadokhumenti angakwazi ukucacisa.

4.2 Isixhobo esizokukwazi ukufinyelela isisombululo ivame

Ukubuyekezwa kwe-announcement: umphumela omunye ngalinye, ukubuyekezwa kwe-last write wins. Lokhu kwenza isakhiwo se-single-record ukusebenza, futhi lokhu kwenza isixhobo esithakazelisayo esithakazelisayo uma ivumela. Isixhobo esithakazelisayo isikhwama esithakazelisayo esithakazelisayo ngokuvumelana nesithombe esithakazelisayo futhi ivumela wonke umlinganiselo ukucubungula ngaphansi kwesikhwama esithakazelisayo.

Ngokwenza lokhu, isixhobo esithakazelisayo isakhiwo esithakazelisayo, kodwa ayikwazi ukufinyelela, ayikwazi ukuhlaziywa. It is not broken and it is not locked out of the application: it still reads every message it has the keys for and still sends classically, while prompting the user to link it. Silence is the correct behavior for a device that cannot speak for the identity.

5Ukufundwa kanye nokulandela ukhetho

I-Clients akufundisa i-peer's keys ngezindlela ezimbini. I-subscription ephakeme ifakwe abantu abasebenzayo ngokuvamile - izibuyekezo ezivela kanye namalungu be-group - ngakho-ke izibuyekezo zayo zithunyelwe njengezimali ezivamile. Ngokuba i-peer ebonakalayo okokuqala, isibuyekezo se-one-shot isebenza ngesikhathi se-send time, eyenziwe ku-2.5 amaminithi; uma akufuna, umbhalo uye ngokuvumelana, okuyinto isebenzisana ngaphambi kokuphumelela kwe-post-quantum, engaphezulu kwe-new failure mode.

Umdlali oyinxibelelana isixhobo entsha, noma oyinxibelelana kusuka ku-browser-extension login kuya ku-local key, ivela post-quantum enamandla mid-conversation, futhi a permanently cached “no” uyavikela ku-encryption yocwaningo for the life of the announcement.

5.1 Yini kungekho isivakashi se-Downgrade

Ukuphakama kwe-routing kuncike ku-question kuphela:

pq = (we hold a signed, unexpired ML-KEM key for this recipient)

Akukho ukulungiselela umthamo, akunakekela-algorithms isithombe, futhi akukho indawo umngciwane angakwazi ukunceda umngcele umngcele wehlabathi. kuyinto I-Failure Mode of a stripped or withholded announcement kuyinto ukuthi umbhalo uye classic - i-status quo ngaphambi kwe-function - ngaphandle ukuthi umbhalo we-hybrid igcinwe ku-imeyili enhle.

I-converse inikeza futhi kubaluleke kakhulu: i-client inikeza i-hybrid Waze Uma inikeza inethiwekhi, futhi inethiwekhi inethiwekhi kuyinto inethiwekhi inethiwekhi inethiwekhi inethiwekhi inethiwekhi inethiwekhi inethiwekhi inethiwekhi inethiwekhi inethiwekhi inethiwekhi.

6Ukwakhiwa kwe-hybrid

I-Nymchat ayihlaziyela i-NIP-44. It ivela. I-NIP-44 encryptor text eyenziwe ayihlaziywa, futhi i-ML-KEM ihlaziyela i-AEAD emkhakheni:

inner = nip44_encrypt(plaintext, conversation_key(sender, recipient))

info  = "nymchat-pq2" || sender_secp_pk || recip_secp_pk || kem_ct || recip_kem_pk
prk   = HKDF-Extract(salt = "nymchat-pq2-v1", IKM = kem_ss)
key   = HKDF-Expand(prk, info || "key",   32)
nonce = HKDF-Expand(prk, info || "nonce", 12)

outer = ChaCha20-Poly1305(key, nonce, plaintext = inner, aad = info)

payload = "pq2." || base64url(kem_ct) || "." || base64url(outer)

Zonke izicathulo zihlanganisa ukufumana ukubuyekeza umbhalo: i-layer ephakeme inikeza kuphela i-NIP-44 encryption text, futhi ukulungiselela kufuneka i-ECDH ephakeme. Umngciwane we-quantum owaqhathanisa i-secp256k1 inokufumana i-key ephakeme futhi akuyona i-ML-KEM; Ukuqhathaniswa kwe-ML-KEM inikeza i-layer ephakeme futhi inikeza i-NIP-44 emangalisayo. Yonke inguqulo inikeza indawo yayo:

• kem_ss Yenza i-key ye-layer ye-external kuphela. Akukho nto le-derivation akuyona i-ECDH yokukhipha okushisayo, okuyinto i-Section 6.1 ibonisa.
• kem_ct, recip_kem_pk Ukulungiselela umbhalo we-identity njengoba idatha ehlanganisiwe, ngakho-ke isigaba se-external igxile ku-transcript esizayo. Ukuqhathanisa umbhalo we-cipher text ku-identity ye-other sender akufanele ukuhambisa kunoma ukucubungula.

I-ML-KEM key ye-receiver iyinto elide, kodwa ngamunye imiyalezo inezinto ye-encapsulation eyahlukile futhi ngakho-ke eyahlukile kem_ssKuyinto okuholela ukuguqulwa kwe-nonce kunokuba ukuguqulwa ngempumelelo: I-ChaCha20-Poly1305 I-key ye-nonce yahlukaniswe ngokubethelwa kokusebenzisa i-key (i-nonce) pair, futhi lapha i-key ngokuvamile iyahlukaniswa ngalinye ama-message, ngakho-ke akuyona i-pair angakwazi ukuguqulwa.

6.1 Ngoba izindandatho zihlanganisa ngaphandle

I-alternative iyinhlanganisela amabhodlela amabili ku-conversation key kanye nokuthumela ku-NIP-44:

ck = HKDF-Extract(salt = "…",
                  IKM  = ecdh_x || kem_ss || …)          // do not do this

Ukwakhiwa okuhlobisa njenge-cryptography. I-problem eyodwa yokwakhiwa: kufuneka ecdh_x, i-corrhage x-coordinate ye-ECDH yokukhipha, njengomthombo ebalulekile - kanye ne-browser extension (I-NIP-07) noma isithombe eside (I-NIP-46Yenza i-NIP-44 emelweni yama-caller futhi yakhelwe umbhalo we-encryption, okuyinto yindawo ephelele yokugcina isikhwama lapho isicelo asikwazi ukufinyelela.

Ukusabalalisa izimpazamo ngakho-ke ivimbele zonke izicelo ezihambayo ezihambayo ezihambayo ezihambayo ezihambayo, okungenani abasebenzisi ezihambayo kakhulu, futhi akukho inani lokusebenza ku-key derivation angakwazi ukuguqulwa. I-Layering ivimbela ukuxhaswa: I-NIP-44 ivimbela ngokuphelele futhi ikhiqizwa ngokuthi yini enezinto ezihambayo ezihambayo ezihambayo, i-signer kuhlanganiswe, kanti i-KEM isilinganiselwe kusuka ku-coding yokuguqulwa eyenziwe ngqo yi-client. I-Signer logins zihlanganisa ngokuvamile post-quantum ezimbini.

I-cryptertext ye-ML-KEM yi-1088 bytes futhi isitimela kuzo zonke izitimela, base64url-koded kuya ku-1451 izidakamizwa; i-AEAD ephakeme i-16-byte ye-Poly1305 tag futhi ukwandisa isitimela se-NIP-44 esithile ngalinye. Isitimela se-50-character ikakhulu kusuka ku-176 bytes kuya ku-1,712, futhi isitimela se-2000-character kusuka ku-28,820 kuya ku-5,238. Isitolo se-approx. 1.5 KB ngalinye isitimela ngaphandle kokubili isitimela, okuyinto iindleko yokubamba ngokushesha ngalinye ngaphandle kokusebenzisa isitimela esebenzayo.

6.2 I-self-describing payloads

Waze pq2. I-prefix inikeza ukufakwa kwama-incremental: it is self-describing, ngakho-ke i-client ukhethe indlela yokubhalisa ngokuvakashela i-payload kunokuba ngokuvakashela i-tag noma ukunakekela into enesixhumanisi. Umbhali owaziwa i-prefix akukwazi ukufinyelela le-payload kunokungabikho, futhi ama-messages eyenziwe ngaphambi kwe-both side angakwazi ukwenza i-post-quantum ukufinyelela njenge-NIP-44 ebonakalayo ngaphandle kokuphindaphinda.

6.3 Izindwangu ezimbili ze-cade wrap

A I-NIP-17 Umhlahlandlela A I-NIP-59 gift wrap: inguqulo ongaphakeme, ebhalwe ngaphansi kwe-sender's identity key (i-type 13), bese ebhalwe ngaphansi kwe-throwable key eyenziwe ngalinye umbhalo (type 1059). On a login that holds the identity key directly, I-Nymchat i-hybridizes izindwangu ezimbili, zonke nge-encapsulation yayo.

I-signer login inatholakala kuphela ingxubevange. I-seal ikhiqizwa yi-signer njenge-NIP-44 ebonakalayo - isicelo akuyona ikhoyili ebonakalayo - ngakho-ke akuyona i-hybridized emkhakheni. Lokhu akufinyelelana nangokungapheli: i-seal iyatholakala kuphela ngokusebenzisa i-wrap, futhi i-wrap iyiphi na i-recorder ibhekwa. Umngciwane owenziwe umbhalo wabhala kufuneka uxhumane i-ML-KEM ngaphambi kwe-seal iyakwazi ukufinyelela.

7Izindaba ze-Group kanye nokuphepha kwe-partial

Umbhalo we-Group ayikho umbhalo wayo. Kuyinto umbhalo elifanayo eyenziwe kumalungu ngamunye, isithombe ngamunye eyenziwe ku-ML-KEM key yayo. Umbhali owawuthumela umbhalo we-hybrid wrap; umbhali owawufumana umbhalo we-classical.

Ngokwenza lokhu, inikeza ingozi yebhizinisi ukuthi isicelo enhle inesibho. Uma abalandeli abalandeli abalandeli ibhizinisi, ingozi hhayi 8-10-protected. Umthandazo ungenza isithombe esiyingqayizivele se-plaintext esifanayo ku-10, ngakho-ke isitimela isivakashi kuphela uma zonke I-copy ye

I-Nymchat ngakho-ke ivela ukucindezeleka kwe-per-message ngexesha le-fan-out - inani kunokwenzeka kuphela lapho izikhwama zithunyelwe - futhi i-badge ibhalisele "ku-quantum-resistant kuya ku-8 kusuka ku-10 ama-member'rdquo; Ngaphandle kokuqinisekisa ukuthi umyalezo igcinwe. Uma akukho ukubuyekeza kunazo, okuyinto isibonelo esivamile Waze Umbhalo we-group (only the sender counts the fan-out), umbhalo we-interface inikeza ingxenye kunoma ukhuseleko olupheleleyo. Ukukhuluma ukhuseleko olupheleleyo ku-power of one's own copy kuphela kuyinto ukuphazamiseka mayelana umbhalo ngokugcwele.

7.1 Izindaba ze-Shield

I-Shield inikeza ngokwenene. Imibuzo, kungekho mayelana ne-software enikezelwe:

• Ukhuseleko oluphelele: Zonke i-copy ye-plaintext yaziwa i-hybrid.
• I-Party: Izinhlelo ezithile ze-group message ziye zithunyelwe ngokuvamile. I-Draw degraded kunokuba i-full, ngoba i-copy eyodwa ye-classic ye-plate-text ebonakalayo kuzo zonke zihlanganisa nezidingo ze-adversary.
• I-Classic ibizwa ngokuphathelene kunokuthi ibonisa njenge-no badge, ngenxa yokungabikho kwe-indicator ebonakalayo phakathi kwe- “unprotected”, “broken”, futhi i- “i-build yayo ayikho i-feature”.

I-vultimate isetshenziselwa lapho umbhalo igcinwe, futhi akubuyekezwa kusuka ku-peer ads ngemva. Umbhalo we-ciphertext eyenza akuyona asikwazi ukuvikelwa okungcono kunazo, futhi i-interface enikezela ama-messages amasha ku-strength ye-announcement entsha kuyoba ukhangela into oluthile mayelana ne-byte ku-relay.

I-Group rule emaphaketheni ku-stack emaphaketheni yayo, ngaphandle kokuguqulwa: isitimela se-Group ikhuselwe ngokuphelele kuphela lapho isithombe se-member ngamunye, futhi isitimela se-Group ebonakalayo ngaphandle kokubili kokubili isibonelwayo.

8Imininingwane ezivela ku-Self

Izinto eziningana ze-client zithunyelwe ku-identity ye-user: izakhiwo ezincinane, i-conversation list, i-group keys, kanye ne-message archive. Lezi zithunyelwe ngaphezulu kwe-user kunezindaba ezingenalutho, ngakho-ke ukubuyekeza ku-classic kuya kwenziwa ku-artifact ebuthunyelwe kakhulu ngaphandle kokuthunyelwe ngokufanele ama-messages ngokufanele. Zisebenzisa i-hybrid efanayo, e-encapsulated ku-user's own root-derived key - nge-exception eyodwa esifundwe ku-Section 3.2, i nymchat-pq-root isigaba esiyingqayizivele, okuyinto ayikwazi ukucindezeleka ngaphansi kwe-key eyenza kuphela.

I-blob ye-settings noma i-archive row ibhekwa emzimbeni eyodwa iminyaka eminingi, okuyinto yinkimbinkimbi esiyinhloko esithathwe ngumthengisi we-harvest-now-decrypt-later - ngaphezulu kunoma iyiphi imiyalezo eyodwa, okungenani ephemeral emzimbeni wayo.

I-constraint eyahlukile ifomati apha kunokuba yi-key. I-copy ye-self-addressed kufanele kuhlolwe ngu: zonke umugqa ku-akhawunti, ngakho-ke wonke umugqa uhlasela ukuthi kungenziwa ekukhanyeni ekhukhanyeni i-akhawunti yayo, futhi i-akhawunti ivumela kuphela ukuthi bonke bafumane. Ukukhanyisa konke okungenani ngeke ikhoyile umugqa ngaphandle kokufaka yayo - elilodwa ukufakelwa okuzenzakalelayo I-Section 3.2 ibhimbela ngezinye izindlela, ekhukhanyeni kwelinye isinyathelo.

9Ukuhlobisa

Waze epoch I-counter ku-derivation yenza i-rotating kungenziwa ngaphandle kwe-key material entsha. Ukwandisa it ekhiqiza i-key pair entsha kusuka ku-root efanayo kanye ne-re-published announcement; ama-peers zithole i-key entsha kusuka ku-record eyenziwe. I-rotating ngakho-ke akuyona abasebenzisi ukuba ushiye lokho ngezinye izikhathi: i-root ikhiqizwa nje ngalinye ngama-identity futhi i-epoch ikhiqiza ukubuyekeza.

9.1 Amahora amabili asekelwe, futhi akukho okuzenzakalelayo

Ngaphandle kwalokho, i-Client inikeza i-candidates ye-decryption kusuka ku-epoche yamanje kuze ku-epoche − 3, ngakho-ke umyalezo wahlukaniswa ngaphambi kokuqala kokuguqulwa kunikeza ngokuvumelana ne-keyword-pair okuyinto ephakeme lapho i-envoyed.

Okuvela okuhlobisa okuhlobisa ngokushesha: ngaphandle kwalokho, yonke ukuhlobisa uyavuma okuhlobisa okuhlobisa okuhlobisa okuhlobisa okuhlobisa okuhlobisa okuhlobisa okuhlobisa okuhlobisa okuhlobisa okuhlobisa okuhlobisa okuhlobisa okuhlobisa okuhlobisa okuhlobisa okuhlobisa okuhlobisa okuhlobisa okuhlobisa okuhlobisa okuhlobisa (Section 10.5).

10Yini lokhu akuvimbela

Ibhokisi elihlanganisa kuphela ukuthi isakhiwo ivumela akuyona uhlelo, futhi ukuhlangabezana isakhiwo se-security ku-interface kuyinto enhle kuncike. Izinto ezilandelayo zihlanganisa ukuthi lokhu isakhiwo ivela.

10.1 Umdlavuza kuyinto umdlavuza wesibili, futhi ukuphazamiseka kuyinto engcono

Kuyinto ixabiso efanelekayo yekhwalithi. Umthombo we-Section 2 ukuthi umsebenzisi kufanele ungenza into eyodwa kuphela akufanele ukugcina: i-nsec kuphela akufanele ukuguqulwa kwe-post-quantum key, ngenxa yokuba ingxenye ephelele kuyinto ukuthi akukho izinga lwethu futhi akukho isithombe esinye akuvumela. Uma akukho isixhobo esithathwe isisindo futhi akukho ingxubevange se-Section 3.2 angakwazi ukufinyelela, izinto ezivela ku-root-derived key akufanele ukuguqulwa. Akukho escrow futhi akufanele akufanele ukufinyelela.

Nge-manual transfer i-path kuphela, lokhu kuyinto enhle kakhulu kunokwenzeka ekuqaleni. A user who never copies the nympq1… ikhowudi noma iyiphi isithombe esifanayo, ku-device eyodwa, futhi ukuphazamiseka kwelinye isixhobo ukuphazamiseka yonke imiyalezo se-post-quantum, imiyalezo se-blob kanye ne-archive edluliselwe ku-it. nsec akuyona; lokhu kuyinto izakhiwo esihlalweni yonke design.

Noma umzila wephakamisa wahlanganyela ngempumelelo, kufanele wahlanganyele ibhande elifanayo efana ne-manual. Umzila wahlanganyela ibhande elithakazelisayo, ngakho-ke umzila wahlanganyela ukuthi umzila wephakamisa wahlanganyela – umzila wephakamisa, isibonelo, wahlanganyela yonke into lapho umzila wahlanganyela, futhi umzila wephakamisa kuyinto ngempumelelo umzila wahlanganyela futhi wahlanganyela offline ngempumelelo.

10.2 Ukubhalisa, njengezinhlangano ezivela ku-confidentiality

Konke umbhalo ku-Nostr i-Schnorr phezu ku-secp256k1, futhi lokhu akuyona lapha. Umbhali nge-computer ye-quantum angakwazi ukufakelwa imbhalo kanye nokuthintela umsebenzisi isikhathi esifanayo. Yini i-hybrid key exchange isaphukile-now-decrypt-later: umbhali wokubhalisa traffic namhlanje ayikwazi ukufunda ngemva. It akukwazi ukwenza umbhali asikwazi ukufudumeza umbhali owayenze umshini. Lolu hlelo lithunyelwe izicelo ngokuzimela - i-padlock indicator ibhalisele ukuhambisa, i-shield ibhalisele ukuhambisa, futhi zithunyelwe ama-glyphs ezahlukile ngoba umbhali angakwazi ukuhambisa omunye ngaphandle kw

Ngaphezu kwalokho, inikeza ukuthi inkulumo ku-Section 4 ingatholela. Ukuxhumana phakathi kwe-nppub ne-ML-KEM key kuyinto isifinyezo se-secp256k1, ngakho-ke umngciwane owaziwa ukuxuba lezi kungenzeka ukuguqulela isifinyezo yayo yayo yayo. Ukuxhaswa kumngcele esizayo akuyona ngokufanayo ne-authenticity ku-one.

10.3 I-Metadata

Ukupakisha i-Gift ibonisa umphumela, umphumela ngaphandle kwe-single p I-tag, uhlobo, ne-timestamp ye-imeyili ye-internal. I-imeyili ayikho, ubukhulu be-imeyili, noma lapho i-relay yatholakala. Ukuhlolwa kwe-traffic ayikwazanga ngezinye izingxenye ze-design.

10.4 I-offline mesh

I-Nymchat ye-Bluetooth mesh transport kuyinto i-protocol eyahlukile nge-handshake yayo, futhi akufanele kule umsebenzi. Izindaba nge-mesh zihlukile.

10.5 Izindaba ezidlulile

I-Cyphertext ebhalwe ngenkathi izindandatho zihlanganisa ngokuqondile. I-Cyphertext iyatholakala futhi ayikwazi ukucindezeleka. Ukuvikelwa uqala ku-message lapho izindandatho zihlanganisa izincwadi ze-post-quantum, akuyona ekubeni inkinobho yasungulwa.

11Imibuzo ye-alternative

12Ukusebenza Parity

I-Nymchat inikeza izicelo ezimbili ezivela kulokhu - eyodwa ku-JavaScript ye-web application, eyodwa ku-Dart ye-mobile applications, kuhlanganise i-port ye-ML-KEM-768. Izinhlelo ezimbili ze-primitive efanayo zihlanganisa ngokuvamile, ngakho-ke zihlanganiswa ngokuphathelene ngaphandle kokubili.

Ukukhiqizwa kwe-Dart ML-KEM kubhalwe ngokumelene ne-official I-NIST ACVP Ukuhlolwa kwama-response ezaziwayo ye-ML-KEM-768 (ML-KEM-*-FIPS203) — 25 key-generation, 25 encapsulation futhi 10 cases decapsulation, asebenza njengoba suite yabo. Lezi zibe i-vector NIST zithunyelwe ukuguqulwa ukuvalwa isicelo, ngakho-ke ukuvalwa zithunyelwa ukuthi i-port iyahambisana, futhi akuyona kuphela ukuthi amaklayenti ezimbili zihlanganisa. Ngaphezu kwalokho, i-fixture esahlukile ye-vector test — derivation ye-seed, encapsulation, ama-payload format kanye ne- gift wraps ephelele — iyatholakala kusuka ku-JavaScript reference futhi i-checked ngu-both test suites. I-root secret ibandakanya le fixture ngaphandle kokuguqulwa: root ku-seed, root ku-keypair, umlilo wekhasi we-root, futhi idatha eyenziwe nympq1… I-code inikeza noma mayelana ne-bytes idivayisi idivayisi idivayisi idivayisi idivayisi idivayisi idivayisi idivayisi idivayisi idivayisi idivayisi idivayisi idivayisi idivayisi.

I-fingerprint kuyinto etholakalayo. Kuyinto enikeza idivayisi “is is the root I hold” ukusuka “is a different one”, futhi i-client enokukwazi ukudlala i-fingerprint ye-client enesixhumi idivayisi enhle kakhulu njengoba akukho idivayisi - bese, ngokulandelana ne-Section 3.3, i-mint ye-root yesibili kanye nokuhlanganisa idivayisi. Kuyinto i-vector ngenxa yayo kuphela.