Nostr notes by paulmillr

Falcon is 4+ weeks of full time work. It's also unreliable ...

2025-08-28T23:10:20Z

In reply to nevent1q…3d97
_________________________

Falcon is 4+ weeks of full time work. It's also unreliable while being implemented, due to the fact it needs floating point math. Maybe fips 206 will fix quirks.

noble cryptography v2 is out. Improvements include Schnorr ...

2025-08-27T10:34:42Z

noble cryptography v2 is out. Improvements include Schnorr implementation in 5kb noble-secp256k1, hybrid pq algorithms, OPRFs, friendly wrappers around native WebCrypto, better security, and much more.

Live on GitHub, NPM & JSR.

Low-level - yes, it's a good idea to use it for a media.

2025-07-10T17:49:02Z

In reply to nevent1q…6jxl
_________________________

Low-level - yes, it's a good idea to use it for a media.

Announcing noble-post-quantum: minimal JS implementation of ...

2024-04-13T15:04:48Z

Announcing noble-post-quantum: minimal JS implementation of ML-KEM, ML-DSA and SLH-DSA.

Also known as Kyber, Dilithium and SPHINCS+. Only 2000 lines of code - great learning resource for anyone who’s messing with PQ stuff.

Check out README for algorithm comparison and usage guidelines. https://github.com/paulmillr/noble-post-quantum

2023 progress on JS cryptography: - noble-hashes: 400K => 1.7M ...

2023-12-31T19:53:51Z

2023 progress on JS cryptography:

- noble-hashes: 400K => 1.7M downloads per week
- noble-curves: ~0 => 0.9M, got 2 audits
- noble-ciphers: 0 => 25K
- Finally adopted by ProtonMail, MetаMасk, Rainbow, Rabby, ethers, web3.js, viem

Takes time, but we’re getting there.

> We're sacrificing almost all the values we stand for ...

2023-12-21T15:54:04Z

In reply to nevent1q…h73m
_________________________

> We're sacrificing almost all the values we stand for

I'm not sure what are you talking about. SimpleX is not a silver bullet. It's trivially decrypt-able by quantum computers. It's also not popular, which means, if/when it becomes popular, only then we'll see how it holds up.

Again - if you think simplex would work - go ahead and implement it. If you can convince the community your solution is better, everyone will switch to it.

nostr is open for everyone. We're just a bunch of folks who've spent some time on the issue we thought was important. No one paid us for it.

It's possible to deduce who messages whom (timing / ...

2023-12-21T15:38:05Z

In reply to nevent1q…tz72
_________________________

It's possible to deduce who messages whom (timing / correlation attack). All user contacts are uploaded to Signal servers (they say it's stored in SGX - which may be broken). Groups also store some data on Signal servers. And - most important - Signal relies on phone numbers.

The problem you're mentioning (metadata leakage) can't be ...

2023-12-21T15:24:54Z

In reply to nevent1q…zx3z
_________________________

The problem you're mentioning (metadata leakage) can't be solved by cryptography alone.

It's solved separately by specifying which relays can be responsible for your DMs. You will set up a preferred DM relay and only this relay would be used for all chats.

There is no certainty. Two words for you: Cheon's attack.

2023-12-20T22:24:10Z

In reply to nevent1q…w730
_________________________

There is no certainty. Two words for you: Cheon's attack.

We've discussed this on GitHub for most of 2023. If ...

2023-12-20T19:36:19Z

In reply to nevent1q…6zdg
_________________________

We've discussed this on GitHub for most of 2023. If you've had any comments or suggestions, you could have voiced them. This is a community effort. Don't like it? Build something better.

Ask other cryptographers what they think about NIP-04. NIP-44 ...

2023-12-20T19:11:47Z

In reply to nevent1q…gee0
_________________________

Ask other cryptographers what they think about NIP-04. NIP-44 took many weeks of work by different people and an audit by an indie company. It's the first step. We can add one feature at a time, since we have versioning now. FS is also not "everything": even with it, all signal messages would be decrypted by a powerful quantum computer.

https://github.com/paulmillr/nip44 => all good. If your nostr ...

2023-12-20T19:04:42Z

In reply to nevent1q…zwlj
_________________________

https://github.com/paulmillr/nip44 => all good. If your nostr client doesn't see a valid URL in the post, create a bug report.

Signal is cool, but do you know what is cooler? Chatting on ...

2023-12-20T18:37:03Z

Signal is cool, but do you know what is cooler? Chatting on decentralized social network. We’ve implemented and audited end-to-end encrypted direct messaging for nostr.  

 Thanks to Jon (npub1jlrs53pkdfjnts29kveljul2sm0actt6n8dxrrzqcersttvcuv3qdjynqn), OpenSats, Michael (npub1acg6thl5psv62405rljzkj8spesceyfz2c32udakc2ak0dmvfeyse9p35c), ekzyis (npub16x07c4qz05yhqe2gy2q2u9ax359d2lc0tsh6wn3y70dmk8nv2j2s96s89d), Vitor (npub1gcxzte5zlkncx26j68ez60fzkvtkm9e0vrwdcvsjakxf9mu9qewqlfnj5z), Cure53, Matthew Green and everyone else involved.

 https://github.com/nostr-protocol/nips/blob/master/44.md, https://github.com/paulmillr/nip44

Someone published NPM fork of noble-curves that sent private keys ...

2023-08-12T16:12:08Z

Someone published NPM fork of noble-curves that sent private keys to a server in China. Be careful and check for typos https://blog.phylum.io/typosquat-of-popular-ethereum-package-steals-private-keys/

Ever wanted a privacy-focused nostr web client? http://nostr.spa ...

2023-07-11T00:28:16Z

Ever wanted a privacy-focused nostr web client? http://nostr.spa (https://paulmillr.com/demos/nostr) got you covered! It’s simple, open-source, and does not require a private key. You can even send messages, pre-signed somewhere else.

New noble cryptography releases are out: - NPM provenance is now ...

2023-06-03T15:24:02Z

New noble cryptography releases are out:

- NPM provenance is now used for transparent builds, to strengthen supply chain security [1]
- ed25519 and ed448 now provide non-repudiation (Strongly Binding Signatures). The feature is not present in most other libraries [2]
- tweetnacl users (including DJB's C version): it's time to switch away. It does not provide SUF-CMA, meaning, in some circumstances, the signatures are malleable [3]

1.https://github.blog/2023-04-19-introducing-npm-package-provenance/
2. https://csrc.nist.gov/csrc/media/Presentations/2023/crclub-2023-03-08/images-media/20230308-crypto-club-slides--taming-the-many-EdDSAs.pdf
3.https://blog.cryptographyengineering.com/euf-cma-and-suf-cma/

4KB cryptography. Does that sound safe? Because it should. ...

2023-03-24T10:58:20Z

4KB cryptography. Does that sound safe? Because it should.

Announcing v2 of single-feature modules noble secp256k1 and noble ed25519. secp is just 430 lines of code (4KB gzipped), ed is only 330 lines (3.3KB gzipped) — 4x smaller than previous versions.

Tweetnacl was a great idea. Smaller attack surface means less things that could go wrong. New libraries develop the concept further: there are tons of comments everywhere, describing how things work - makes it much easier for cryptography newcomers to read.

https://github.com/paulmillr/noble-secp256k1
https://github.com/paulmillr/noble-ed25519

Nostr event nevent1qqspet4msdn46h2aak456cerdennuvfncrg87jun0xe2rjqrw0z39aqzyp7tz0x7qecwty8s9jlfag8u78s9ak79ej9yp9e3lf2rv3qps8836j4e077

2023-02-17T14:11:02Z

@npub1teawtzxh6y02cnp9jphxm2q8u6xxfx85nguwg6ftuksgjctvavvqnsgq5u Verifying My Public Key: "paulmillr"