nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpq98t8kgwqas59rvmnghzcdn6krzhxhpkyt2mt53e4g9sdnj74sszs6a65q8 (nprofile…65q8) nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqrsjjkguerepp3dmh7xw5rnvckvz56hseuu5444aql6d7cfmwpatqncfpdh (nprofile…fpdh)
If there's a maybe-low-bandwidth way to pass on information alongside the ciphertext that's public (attacker can read) but trustworthy (attacker can't modify) I'd transmit hashes and filenames with it.
If there isn't one, I'd sign something (e.g. with minisign): either the encrypted file itself or the kind of manifest I described above. If you want to prevent the attacker from swapping files around you need to either go a manifest-like route or use sth like the "trusted comment" in minisign to specify which file it is, and verify that at decryption-and-verification time.
robryk
npub1em…u3nu7
2026-02-26 09:31:49 UTC
in reply to nevent1q…jguk
Author Public Key
npub1emktaflm039jkpnxw7t9l4l05623dg6lwuap89vzar4s22stgr7sdu3nu7Seen on
wss://relay.ditto.pubPublished at
2026-02-26 09:31:49 UTCEvent JSON
{
"id": "49d701639591d3040dbed18bf6b7c1183aa7257554aa0e613cfdae85ad23e9c3",
"pubkey": "ceecbea7fb7c4b2b066677965fd7efa69516a35f773a139582e8eb052a0b40fd",
"created_at": 1772098309,
"kind": 1,
"tags": [
[
"p",
"29d67b21c0ec2851b37345c586cf5618ae6b86c45ab6ba47354160d9cbd58405",
"wss://relay.ditto.pub"
],
[
"p",
"1c252b23991e4218b777f19d41cd98b3054d5e19e7295ad7a0fe9bec276e0f56",
"wss://relay.ditto.pub"
],
[
"p",
"774d614ebcf8fa1536805ff86bdbe7763f4f933e21608f14b43c2b1916f38403",
"wss://relay.ditto.pub"
],
[
"p",
"232411b0ca1de0c034f87bb257689bea88595223d50c18592dc823fc132ca8dd",
"wss://relay.ditto.pub"
],
[
"e",
"942f93a13ad7f83e3e4915b1d5689512f2fd751c6c1310d69ad1476dffaf5a6e",
"wss://relay.ditto.pub",
"reply"
],
[
"proxy",
"https://social.wuatek.is/objects/e18a7149-c234-4e24-a32f-fd6a8da4e0e3",
"activitypub"
],
[
"client",
"Mostr",
"31990:6be38f8c63df7dbf84db7ec4a6e6fbbd8d19dca3b980efad18585c46f04b26f9:mostr",
"wss://relay.ditto.pub"
]
],
"content": "nostr:nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpq98t8kgwqas59rvmnghzcdn6krzhxhpkyt2mt53e4g9sdnj74sszs6a65q8 nostr:nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqrsjjkguerepp3dmh7xw5rnvckvz56hseuu5444aql6d7cfmwpatqncfpdh \n\nIf there's a maybe-low-bandwidth way to pass on information alongside the ciphertext that's public (attacker can read) but trustworthy (attacker can't modify) I'd transmit hashes and filenames with it.\n\nIf there isn't one, I'd sign something (e.g. with minisign): either the encrypted file itself or the kind of manifest I described above. If you want to prevent the attacker from swapping files around you need to either go a manifest-like route or use sth like the \"trusted comment\" in minisign to specify which file it is, and verify that at decryption-and-verification time.",
"sig": "54ee6f7cec7e9d8524df6fbb45ef0f7d4fac15c41db501ddd193656147e10b2eba39381cc2bdf4c697841f3eec3601f60283b2109c46f3a0669dbfc3a5eadbe1"
}