feat(companion): backup envelope + NIP-46 signer crypto in the native core
Extends archy-fips-core with the two companion-release features' crypto (#128, #139), same JNI-over-JSON contract as the mesh surface: backup.rs — the ADR-005 encrypted-backup envelope, byte-compatible with the node's backup code (Argon2id default params + ChaCha20-Poly1305, blob = base64(salt||nonce||ct)); decrypt ignores extra envelope fields so node backups read here too. Round-trip, tamper, wrong-passphrase and cross-shape tests included. nostr.rs — the phone-side remote-signer crypto: nsec/npub bech32 keys, BIP340 schnorr event signing (NIP-01 id serialization), NIP-44 v2 payloads (HKDF-SHA256 + ChaCha20 + HMAC-SHA256, both padding prefixes), NIP-04 fallback, nostrconnect:// parsing with repeated relay params. Verified against the official NIP-44 vectors (conversation keys, message keys, padded lengths, byte-exact encrypt vectors), the BIP-340 reference sign vectors, and round-trip/tamper/failure tests. secp256k1 0.29 note: Keypair::public_key() is the 33-byte compressed key — x-only pubkeys must go through .x_only_public_key().0 (one real bug the vectors caught). JNI glue adds com.archipelago.app.NativeCore: backupEncrypt/Decrypt, nostrGenerateSecret/SecretFromAny/ParseConnectUri/SignEvent and the NIP-44/NIP-04 cipher pairs. Android arm64 build verified via cargo-ndk (7.2 MB .so, +0.4 MB for both modules). Host: cargo test 23/23, clippy clean.
This commit is contained in:
Dorian
@@ -0,0 +1,798 @@
|
||||
//! NIP-46 phone-side remote signer ("bunker") crypto core.
|
||||
//!
|
||||
//! Everything that must be constant-time correct for the companion to act as
|
||||
//! a nostr remote signer: key handling (nsec/npub bech32), BIP340 schnorr
|
||||
//! event signing, NIP-44 v2 payload encryption (the mandated NIP-46
|
||||
//! transport), NIP-04 fallback decryption (deprecated, but real clients
|
||||
//! still speak it), and `nostrconnect://` URI parsing. The protocol session
|
||||
//! — relay WebSocket, JSON-RPC dispatch, approve/deny UX — lives in Kotlin;
|
||||
//! this module is the crypto and nothing but.
|
||||
//!
|
||||
//! Verified against the official NIP-44 vectors and BIP-340 reference
|
||||
//! vectors (see tests below).
|
||||
|
||||
use anyhow::{bail, Context, Result};
|
||||
use base64::engine::general_purpose::{STANDARD as BASE64, URL_SAFE as BASE64_URL};
|
||||
use base64::Engine;
|
||||
use bech32::{Bech32, Hrp};
|
||||
use chacha20::cipher::{KeyIvInit, StreamCipher};
|
||||
use chacha20::ChaCha20;
|
||||
use hmac::{Hmac, Mac};
|
||||
use hkdf::Hkdf;
|
||||
use secp256k1::ecdh;
|
||||
use secp256k1::schnorr::Signature;
|
||||
use secp256k1::{
|
||||
Keypair, Message, PublicKey, Secp256k1, SecretKey, XOnlyPublicKey,
|
||||
};
|
||||
use sha2::{Digest, Sha256};
|
||||
|
||||
type HmacSha256 = Hmac<Sha256>;
|
||||
|
||||
const NIP44_VERSION: u8 = 2;
|
||||
const NIP44_SALT: &[u8] = b"nip44-v2";
|
||||
const NIP44_MIN_PAYLOAD_LEN: usize = 99; // 1 ver + 32 nonce + 32 ct + 32 mac
|
||||
const NIP44_MIN_B64_LEN: usize = 132;
|
||||
|
||||
// ── keys ──────────────────────────────────────────────────────────────────
|
||||
|
||||
/// Generate a fresh nostr secret key (hex) from the OS CSPRNG.
|
||||
pub fn generate_secret() -> Result<String> {
|
||||
loop {
|
||||
let mut bytes = [0u8; 32];
|
||||
getrandom::getrandom(&mut bytes).context("OS RNG")?;
|
||||
// Reject zero and >= curve order — the valid scalar range (mirrors
|
||||
// the mesh identity loop; rejection is astronomically unlikely).
|
||||
if bytes.iter().all(|&b| b == 0) {
|
||||
continue;
|
||||
}
|
||||
if SecretKey::from_slice(&bytes).is_ok() {
|
||||
return Ok(hex::encode(bytes));
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Parse a secret key from hex or bech32 `nsec…` form into hex.
|
||||
pub fn secret_from_any(s: &str) -> Result<String> {
|
||||
let s = s.trim();
|
||||
if s.starts_with("nsec") {
|
||||
return secret_from_nsec(s);
|
||||
}
|
||||
let bytes = hex::decode(s.trim()).context("secret key must be hex or nsec")?;
|
||||
let sk = SecretKey::from_slice(&bytes).context("invalid nostr secret key")?;
|
||||
Ok(hex::encode(sk.secret_bytes()))
|
||||
}
|
||||
|
||||
pub fn secret_from_nsec(nsec: &str) -> Result<String> {
|
||||
let (hrp, data) = bech32::decode(nsec).context("bad nsec encoding")?;
|
||||
if hrp.as_str() != "nsec" {
|
||||
bail!("not an nsec");
|
||||
}
|
||||
let sk = SecretKey::from_slice(&data).context("invalid nostr secret key")?;
|
||||
Ok(hex::encode(sk.secret_bytes()))
|
||||
}
|
||||
|
||||
pub fn nsec_from_secret(secret_hex: &str) -> Result<String> {
|
||||
let bytes = hex::decode(secret_hex.trim()).context("bad secret hex")?;
|
||||
let hrp = Hrp::parse("nsec").context("nsec hrp")?;
|
||||
bech32::encode::<Bech32>(hrp, &bytes).context("nsec encoding")
|
||||
}
|
||||
|
||||
/// x-only public key (hex) for a secret key.
|
||||
/// NOTE: `Keypair::public_key()` in secp256k1 0.29 is the full compressed
|
||||
/// (33-byte) key — nostr uses x-only pubkeys, so serialize `.x_only_public_key().0`.
|
||||
pub fn pubkey_hex(secret_hex: &str) -> Result<String> {
|
||||
let kp = keypair(secret_hex)?;
|
||||
Ok(hex::encode(kp.public_key().x_only_public_key().0.serialize()))
|
||||
}
|
||||
|
||||
pub fn npub_from_pubkey(pub_hex: &str) -> Result<String> {
|
||||
let bytes = hex::decode(pub_hex.trim()).context("bad pubkey hex")?;
|
||||
let hrp = Hrp::parse("npub").context("npub hrp")?;
|
||||
bech32::encode::<Bech32>(hrp, &bytes).context("npub encoding")
|
||||
}
|
||||
|
||||
/// Parse an x-only pubkey from hex or bech32 `npub…` form into hex.
|
||||
pub fn pubkey_from_any(s: &str) -> Result<String> {
|
||||
let s = s.trim();
|
||||
let bytes = if s.starts_with("npub") {
|
||||
let (hrp, data) = bech32::decode(s).context("bad npub encoding")?;
|
||||
if hrp.as_str() != "npub" {
|
||||
bail!("not an npub");
|
||||
}
|
||||
data
|
||||
} else {
|
||||
hex::decode(s).context("pubkey must be hex or npub")?
|
||||
};
|
||||
XOnlyPublicKey::from_slice(&bytes).context("invalid x-only pubkey")?;
|
||||
Ok(hex::encode(bytes))
|
||||
}
|
||||
|
||||
fn keypair(secret_hex: &str) -> Result<Keypair> {
|
||||
let bytes = hex::decode(secret_hex.trim()).context("bad secret hex")?;
|
||||
let sk = SecretKey::from_slice(&bytes).context("invalid nostr secret key")?;
|
||||
Ok(Keypair::from_secret_key(&Secp256k1::new(), &sk))
|
||||
}
|
||||
|
||||
// ── nostrconnect:// URI ───────────────────────────────────────────────────
|
||||
|
||||
#[derive(Debug, Clone)]
|
||||
pub struct ConnectUri {
|
||||
/// The client's pubkey, hex.
|
||||
pub client_pubkey: String,
|
||||
/// Relays the client is listening on (≥1 by spec; kept in URI order).
|
||||
pub relays: Vec<String>,
|
||||
/// One-time pairing secret the client expects to see echoed back.
|
||||
pub secret: String,
|
||||
/// Comma-separated permission grants the client requests (display hint
|
||||
/// only — approval always stays with the human).
|
||||
pub perms: Vec<String>,
|
||||
pub name: String,
|
||||
pub url: String,
|
||||
pub image: String,
|
||||
}
|
||||
|
||||
impl ConnectUri {
|
||||
/// JSON shape for the JNI boundary (flat strings/arrays — easy to parse
|
||||
/// with org.json on the Kotlin side).
|
||||
pub fn to_json(&self) -> serde_json::Value {
|
||||
serde_json::json!({
|
||||
"clientPubkey": self.client_pubkey,
|
||||
"relays": self.relays,
|
||||
"secret": self.secret,
|
||||
"perms": self.perms,
|
||||
"name": self.name,
|
||||
"url": self.url,
|
||||
"image": self.image,
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
/// Parse `nostrconnect://<client-pubkey>?relay=…&secret=…&perms=…&name=…`.
|
||||
///
|
||||
/// Query values are percent-decoded; `relay` may repeat. The pubkey in the
|
||||
/// host position may be hex or (non-spec but harmless) `npub…`.
|
||||
pub fn parse_connect_uri(uri: &str) -> Result<ConnectUri> {
|
||||
let uri = uri.trim();
|
||||
let rest = uri
|
||||
.strip_prefix("nostrconnect://")
|
||||
.ok_or_else(|| anyhow::anyhow!("not a nostrconnect:// URI"))?;
|
||||
|
||||
let (host, query) = match rest.split_once('?') {
|
||||
Some((h, q)) => (h, q),
|
||||
None => bail!("nostrconnect URI has no query parameters"),
|
||||
};
|
||||
let client_pubkey = pubkey_from_any(host).context("nostrconnect URI: bad client pubkey")?;
|
||||
|
||||
let mut relays = Vec::new();
|
||||
let mut secret = String::new();
|
||||
let mut perms: Vec<String> = Vec::new();
|
||||
let mut name = String::new();
|
||||
let mut url = String::new();
|
||||
let mut image = String::new();
|
||||
|
||||
for (k, v) in url::form_urlencoded::parse(query.as_bytes()) {
|
||||
let v = v.into_owned();
|
||||
match k.as_ref() {
|
||||
"relay" => {
|
||||
if v.starts_with("ws://") || v.starts_with("wss://") {
|
||||
relays.push(v);
|
||||
}
|
||||
}
|
||||
"secret" => secret = v,
|
||||
"perms" => perms = v.split(',').filter(|s| !s.is_empty()).map(String::from).collect(),
|
||||
"name" => name = v,
|
||||
"url" => url = v,
|
||||
"image" => image = v,
|
||||
_ => {} // forward-compat: ignore unknown params
|
||||
}
|
||||
}
|
||||
|
||||
if relays.is_empty() {
|
||||
bail!("nostrconnect URI carries no relay");
|
||||
}
|
||||
if secret.is_empty() {
|
||||
bail!("nostrconnect URI carries no secret");
|
||||
}
|
||||
|
||||
Ok(ConnectUri {
|
||||
client_pubkey,
|
||||
relays,
|
||||
secret,
|
||||
perms,
|
||||
name,
|
||||
url,
|
||||
image,
|
||||
})
|
||||
}
|
||||
|
||||
// ── events (NIP-01 id + BIP340 signature) ─────────────────────────────────
|
||||
|
||||
/// Compute the NIP-01 event id: sha256 over the compact serialization
|
||||
/// `[0, pubkey, created_at, kind, tags, content]`.
|
||||
fn event_id(pubkey: &str, created_at: u64, kind: u64, tags: &serde_json::Value, content: &str) -> [u8; 32] {
|
||||
let serialized = serde_json::json!([
|
||||
0,
|
||||
pubkey,
|
||||
created_at,
|
||||
kind,
|
||||
tags,
|
||||
content,
|
||||
]);
|
||||
let mut hasher = Sha256::new();
|
||||
hasher.update(serialized.to_string().as_bytes());
|
||||
hasher.finalize().into()
|
||||
}
|
||||
|
||||
/// Sign an unsigned event `{kind, content, tags, created_at}` (pubkey filled
|
||||
/// from the secret key; `pubkey` in the input ignored) and return the signed
|
||||
/// event JSON. This is the `sign_event` NIP-46 method's core — the approve
|
||||
/// happens before this call, never inside it.
|
||||
pub fn sign_event(secret_hex: &str, event_json: &str) -> Result<String> {
|
||||
let ev: serde_json::Value = serde_json::from_str(event_json).context("event is not JSON")?;
|
||||
let kind = ev
|
||||
.get("kind")
|
||||
.and_then(|v| v.as_u64())
|
||||
.context("event has no kind")?;
|
||||
let created_at = ev
|
||||
.get("created_at")
|
||||
.and_then(|v| v.as_u64())
|
||||
.context("event has no created_at")?;
|
||||
let tags = ev
|
||||
.get("tags")
|
||||
.cloned()
|
||||
.unwrap_or_else(|| serde_json::json!([]));
|
||||
let content = ev
|
||||
.get("content")
|
||||
.and_then(|v| v.as_str())
|
||||
.unwrap_or("")
|
||||
.to_string();
|
||||
|
||||
let kp = keypair(secret_hex)?;
|
||||
let pubkey = hex::encode(kp.public_key().x_only_public_key().0.serialize());
|
||||
let id = event_id(&pubkey, created_at, kind, &tags, &content);
|
||||
|
||||
let mut aux = [0u8; 32];
|
||||
getrandom::getrandom(&mut aux).context("OS RNG")?;
|
||||
let sig = Secp256k1::new().sign_schnorr_with_aux_rand(
|
||||
&Message::from_digest(id),
|
||||
&kp,
|
||||
&aux,
|
||||
);
|
||||
|
||||
Ok(serde_json::json!({
|
||||
"id": hex::encode(id),
|
||||
"pubkey": pubkey,
|
||||
"created_at": created_at,
|
||||
"kind": kind,
|
||||
"tags": tags,
|
||||
"content": content,
|
||||
"sig": hex::encode(sig.serialize()),
|
||||
})
|
||||
.to_string())
|
||||
}
|
||||
|
||||
/// Verify a signed event's id and schnorr signature (tests + defensive use).
|
||||
pub fn verify_event(event_json: &str) -> Result<()> {
|
||||
let ev: serde_json::Value = serde_json::from_str(event_json).context("event is not JSON")?;
|
||||
let pubkey = ev.get("pubkey").and_then(|v| v.as_str()).context("no pubkey")?;
|
||||
let id_hex = ev.get("id").and_then(|v| v.as_str()).context("no id")?;
|
||||
let sig_hex = ev.get("sig").and_then(|v| v.as_str()).context("no sig")?;
|
||||
let kind = ev.get("kind").and_then(|v| v.as_u64()).context("no kind")?;
|
||||
let created_at = ev.get("created_at").and_then(|v| v.as_u64()).context("no created_at")?;
|
||||
let tags = ev.get("tags").cloned().unwrap_or_else(|| serde_json::json!([]));
|
||||
let content = ev.get("content").and_then(|v| v.as_str()).unwrap_or("");
|
||||
|
||||
let expected = event_id(pubkey, created_at, kind, &tags, content);
|
||||
if hex::encode(expected) != id_hex {
|
||||
bail!("event id mismatch");
|
||||
}
|
||||
|
||||
let pk = XOnlyPublicKey::from_slice(&hex::decode(pubkey)?)
|
||||
.context("bad pubkey")?;
|
||||
let sig = Signature::from_slice(&hex::decode(sig_hex)?)
|
||||
.context("bad signature")?;
|
||||
Secp256k1::new()
|
||||
.verify_schnorr(&sig, &Message::from_digest(expected), &pk)
|
||||
.context("signature verification failed")?;
|
||||
Ok(())
|
||||
}
|
||||
|
||||
// ── NIP-44 v2 ──────────────────────────────────────────────────────────────
|
||||
|
||||
/// ECDH shared x-coordinate (unhashed, 32 bytes) between our secret key and
|
||||
/// the peer's x-only public key. Lifting the x-only key with even-y parity
|
||||
/// is safe here: negating a point flips only y, so the shared x — the only
|
||||
/// thing NIP-44/NIP-04 consume — is unchanged.
|
||||
fn shared_x(secret_hex: &str, peer_pubkey_hex: &str) -> Result<[u8; 32]> {
|
||||
let sk_bytes = hex::decode(secret_hex.trim()).context("bad secret hex")?;
|
||||
let sk = SecretKey::from_slice(&sk_bytes).context("invalid secret key")?;
|
||||
let peer_hex = pubkey_from_any(peer_pubkey_hex)?;
|
||||
let peer = XOnlyPublicKey::from_slice(&hex::decode(&peer_hex)?)
|
||||
.context("invalid peer pubkey")?;
|
||||
// Lift x-only key to a full public key (even-y representative).
|
||||
let full = PublicKey::from_x_only_public_key(peer, secp256k1::Parity::Even);
|
||||
let point = ecdh::shared_secret_point(&full, &sk); // 64 bytes: x || y
|
||||
let mut x = [0u8; 32];
|
||||
x.copy_from_slice(&point[..32]);
|
||||
Ok(x)
|
||||
}
|
||||
|
||||
/// NIP-44 v2 conversation key: HKDF-extract(IKM = ECDH x, salt = 'nip44-v2').
|
||||
fn conversation_key(secret_hex: &str, peer_pubkey_hex: &str) -> Result<[u8; 32]> {
|
||||
let x = shared_x(secret_hex, peer_pubkey_hex)?;
|
||||
let mut hk = HkdfExtractSha256::new(Some(NIP44_SALT));
|
||||
hk.input_ikm(&x);
|
||||
let (prk, _) = hk.finalize();
|
||||
let mut ck = [0u8; 32];
|
||||
ck.copy_from_slice(prk.as_slice());
|
||||
Ok(ck)
|
||||
}
|
||||
|
||||
/// HKDF-SHA256 extract step, exposing the raw PRK (Hkdf::expand hashes with
|
||||
/// an info suffix even when info is empty, which is NOT the extract output;
|
||||
/// finalize returns (PRK, ready-to-expand Hkdf)).
|
||||
type HkdfExtractSha256 = hkdf::HkdfExtract<Sha256>;
|
||||
|
||||
/// Per-message keys: HKDF-expand(PRK = conversation key, info = nonce, L = 76)
|
||||
/// sliced into chacha_key[32] chacha_nonce[12] hmac_key[32].
|
||||
fn message_keys(ck: &[u8; 32], nonce: &[u8; 32]) -> ([u8; 32], [u8; 12], [u8; 32]) {
|
||||
let hk = Hkdf::<Sha256>::from_prk(ck).expect("conversation key is 32 bytes");
|
||||
let mut okm = [0u8; 76];
|
||||
hk.expand(nonce, &mut okm).expect("76 <= 255 * hash len");
|
||||
let mut chacha_key = [0u8; 32];
|
||||
let mut chacha_nonce = [0u8; 12];
|
||||
let mut hmac_key = [0u8; 32];
|
||||
chacha_key.copy_from_slice(&okm[..32]);
|
||||
chacha_nonce.copy_from_slice(&okm[32..44]);
|
||||
hmac_key.copy_from_slice(&okm[44..76]);
|
||||
(chacha_key, chacha_nonce, hmac_key)
|
||||
}
|
||||
|
||||
/// NIP-44 padding: 2-byte big-endian plaintext length (6 bytes, `0x0000` +
|
||||
/// u32, when ≥ 65536), zero-padded to the next power-of-two-ish chunk.
|
||||
fn calc_padded_len(unpadded: usize) -> usize {
|
||||
let unpadded: u64 = unpadded as u64;
|
||||
if unpadded <= 32 {
|
||||
return 32;
|
||||
}
|
||||
let next_power = 1u64 << ((63 - (unpadded - 1).leading_zeros()) + 1);
|
||||
let chunk = if next_power <= 256 { 32 } else { next_power / 8 };
|
||||
(chunk * ((unpadded - 1) / chunk + 1)) as usize
|
||||
}
|
||||
|
||||
fn pad(plaintext: &[u8]) -> Result<Vec<u8>> {
|
||||
if plaintext.is_empty() || plaintext.len() > u32::MAX as usize {
|
||||
bail!("invalid plaintext length");
|
||||
}
|
||||
let prefix: Vec<u8> = if plaintext.len() >= 65536 {
|
||||
let mut p = vec![0u8, 0u8];
|
||||
p.extend_from_slice(&(plaintext.len() as u32).to_be_bytes());
|
||||
p
|
||||
} else {
|
||||
(plaintext.len() as u16).to_be_bytes().to_vec()
|
||||
};
|
||||
let padded_len = calc_padded_len(plaintext.len());
|
||||
let mut out = Vec::with_capacity(prefix.len() + padded_len);
|
||||
out.extend_from_slice(&prefix);
|
||||
out.extend_from_slice(plaintext);
|
||||
out.resize(prefix.len() + padded_len, 0);
|
||||
Ok(out)
|
||||
}
|
||||
|
||||
fn unpad(padded: &[u8]) -> Result<Vec<u8>> {
|
||||
if padded.len() < 2 {
|
||||
bail!("invalid padding");
|
||||
}
|
||||
let first_two = u16::from_be_bytes([padded[0], padded[1]]);
|
||||
let (unpadded_len, prefix_len) = if first_two == 0 {
|
||||
if padded.len() < 6 {
|
||||
bail!("invalid padding");
|
||||
}
|
||||
(u32::from_be_bytes([padded[2], padded[3], padded[4], padded[5]]) as usize, 6)
|
||||
} else {
|
||||
(first_two as usize, 2)
|
||||
};
|
||||
if unpadded_len == 0
|
||||
|| padded.len() < prefix_len + unpadded_len
|
||||
|| padded.len() != prefix_len + calc_padded_len(unpadded_len)
|
||||
{
|
||||
bail!("invalid padding");
|
||||
}
|
||||
Ok(padded[prefix_len..prefix_len + unpadded_len].to_vec())
|
||||
}
|
||||
|
||||
/// Constant-time equality (length differs → false; content comparison never
|
||||
/// short-circuits on a byte).
|
||||
fn ct_eq(a: &[u8], b: &[u8]) -> bool {
|
||||
if a.len() != b.len() {
|
||||
return false;
|
||||
}
|
||||
let mut diff = 0u8;
|
||||
for (x, y) in a.iter().zip(b.iter()) {
|
||||
diff |= x ^ y;
|
||||
}
|
||||
diff == 0
|
||||
}
|
||||
|
||||
/// NIP-44 v2 encrypt: returns `base64(0x02 || nonce || ciphertext || mac)`.
|
||||
pub fn nip44_encrypt(secret_hex: &str, peer_pubkey_hex: &str, plaintext: &str) -> Result<String> {
|
||||
let ck = conversation_key(secret_hex, peer_pubkey_hex)?;
|
||||
let mut nonce = [0u8; 32];
|
||||
getrandom::getrandom(&mut nonce).context("OS RNG")?;
|
||||
let (chacha_key, chacha_nonce, hmac_key) = message_keys(&ck, &nonce);
|
||||
|
||||
let mut padded = pad(plaintext.as_bytes())?;
|
||||
ChaCha20::new(&chacha_key.into(), &chacha_nonce.into()).apply_keystream(&mut padded);
|
||||
|
||||
let mut mac = <HmacSha256 as Mac>::new_from_slice(&hmac_key).expect("hmac accepts any key len");
|
||||
mac.update(&nonce);
|
||||
mac.update(&padded);
|
||||
let tag = mac.finalize().into_bytes();
|
||||
|
||||
let mut out = Vec::with_capacity(1 + 32 + padded.len() + 32);
|
||||
out.push(NIP44_VERSION);
|
||||
out.extend_from_slice(&nonce);
|
||||
out.extend_from_slice(&padded);
|
||||
out.extend_from_slice(&tag);
|
||||
Ok(BASE64.encode(&out))
|
||||
}
|
||||
|
||||
/// NIP-44 v2 decrypt of a `base64(0x02 || …)` payload.
|
||||
pub fn nip44_decrypt(secret_hex: &str, peer_pubkey_hex: &str, payload: &str) -> Result<String> {
|
||||
if payload.starts_with('#') {
|
||||
bail!("unknown NIP-44 version (non-base64 payload)");
|
||||
}
|
||||
let data = BASE64
|
||||
.decode(payload.trim())
|
||||
.context("payload is not base64")?;
|
||||
if payload.len() < NIP44_MIN_B64_LEN || data.len() < NIP44_MIN_PAYLOAD_LEN {
|
||||
bail!("invalid NIP-44 payload size");
|
||||
}
|
||||
if data[0] != NIP44_VERSION {
|
||||
bail!("unknown NIP-44 version {}", data[0]);
|
||||
}
|
||||
let nonce: [u8; 32] = data[1..33].try_into().expect("slice is 32");
|
||||
let ciphertext = &data[33..data.len() - 32];
|
||||
let mac_bytes = &data[data.len() - 32..];
|
||||
|
||||
let ck = conversation_key(secret_hex, peer_pubkey_hex)?;
|
||||
let (chacha_key, chacha_nonce, hmac_key) = message_keys(&ck, &nonce);
|
||||
|
||||
let mut mac = <HmacSha256 as Mac>::new_from_slice(&hmac_key).expect("hmac accepts any key len");
|
||||
mac.update(&nonce);
|
||||
mac.update(ciphertext);
|
||||
let expected = mac.finalize().into_bytes();
|
||||
if !ct_eq(&expected, mac_bytes) {
|
||||
bail!("invalid NIP-44 MAC");
|
||||
}
|
||||
|
||||
let mut buf = ciphertext.to_vec();
|
||||
ChaCha20::new(&chacha_key.into(), &chacha_nonce.into()).apply_keystream(&mut buf);
|
||||
let plaintext = unpad(&buf)?;
|
||||
String::from_utf8(plaintext).context("decrypted payload is not UTF-8")
|
||||
}
|
||||
|
||||
// ── NIP-04 (deprecated transport, still spoken by real clients) ────────────
|
||||
|
||||
/// NIP-04 encrypt: AES-256-CBC, key = raw ECDH x-coordinate (unhashed — the
|
||||
/// spec's quirk), output `<base64 ct>?iv=<base64 iv>`.
|
||||
pub fn nip04_encrypt(secret_hex: &str, peer_pubkey_hex: &str, plaintext: &str) -> Result<String> {
|
||||
use aes::cipher::{BlockEncryptMut, KeyIvInit};
|
||||
type Enc = cbc::Encryptor<aes::Aes256>;
|
||||
|
||||
let key = shared_x(secret_hex, peer_pubkey_hex)?;
|
||||
let mut iv = [0u8; 16];
|
||||
getrandom::getrandom(&mut iv).context("OS RNG")?;
|
||||
let ct = Enc::new(&key.into(), &iv.into()).encrypt_padded_vec_mut::<aes::cipher::block_padding::Pkcs7>(plaintext.as_bytes());
|
||||
Ok(format!("{}?iv={}", BASE64.encode(&ct), BASE64.encode(iv)))
|
||||
}
|
||||
|
||||
/// NIP-04 decrypt of `<base64 ct>?iv=<base64 iv>`.
|
||||
pub fn nip04_decrypt(secret_hex: &str, peer_pubkey_hex: &str, payload: &str) -> Result<String> {
|
||||
use aes::cipher::{BlockDecryptMut, KeyIvInit};
|
||||
type Dec = cbc::Decryptor<aes::Aes256>;
|
||||
|
||||
let (ct_b64, iv_b64) = payload
|
||||
.trim()
|
||||
.split_once("?iv=")
|
||||
.ok_or_else(|| anyhow::anyhow!("not a NIP-04 payload (no iv)"))?;
|
||||
let ct = BASE64.decode(ct_b64).context("bad NIP-04 ciphertext base64")?;
|
||||
let iv: [u8; 16] = BASE64
|
||||
.decode(iv_b64)
|
||||
.context("bad NIP-04 iv base64")?
|
||||
.try_into()
|
||||
.map_err(|_| anyhow::anyhow!("NIP-04 iv must be 16 bytes"))?;
|
||||
let key = shared_x(secret_hex, peer_pubkey_hex)?;
|
||||
let pt = Dec::new(&key.into(), &iv.into())
|
||||
.decrypt_padded_vec_mut::<aes::cipher::block_padding::Pkcs7>(&ct)
|
||||
.map_err(|_| anyhow::anyhow!("NIP-04 decryption failed"))?;
|
||||
String::from_utf8(pt).context("decrypted payload is not UTF-8")
|
||||
}
|
||||
|
||||
/// URL-safe base64 for keys that cross the JNI boundary — unused by the
|
||||
/// protocol but handy for the Kotlin side; keep the engine in one place.
|
||||
pub fn b64_url(data: &[u8]) -> String {
|
||||
BASE64_URL.encode(data)
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
// ── official NIP-44 vectors (paulmillr/nip44 nip44.vectors.json) ──────
|
||||
|
||||
#[test]
|
||||
fn nip44_official_conversation_keys() {
|
||||
let vectors: &[(&str, &str, &str)] = &[
|
||||
("315e59ff51cb9209768cf7da80791ddcaae56ac9775eb25b6dee1234bc5d2268", "c2f9d9948dc8c7c38321e4b85c8558872eafa0641cd269db76848a6073e69133", "3dfef0ce2a4d80a25e7a328accf73448ef67096f65f79588e358d9a0eb9013f1"),
|
||||
("98a5902fd67518a0c900f0fb62158f278f94a21d6f9d33d30cd3091195500311", "aae65c15f98e5e677b5050de82e3aba47a6fe49b3dab7863cf35d9478ba9f7d1", "9c00b769d5f54d02bf175b7284a1cbd28b6911b06cda6666b2243561ac96bad7"),
|
||||
("86ae5ac8034eb2542ce23ec2f84375655dab7f836836bbd3c54cefe9fdc9c19f", "59f90272378089d73f1339710c02e2be6db584e9cdbe86eed3578f0c67c23585", "19f934aafd3324e8415299b64df42049afaa051c71c98d0aa10e1081f2e3e2ba"),
|
||||
// sec1 == pub2 (ECDH with self)
|
||||
("0000000000000000000000000000000000000000000000000000000000000001", "79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798", "3b4610cb7189beb9cc29eb3716ecc6102f1247e8f3101a03a1787d8908aeb54e"),
|
||||
];
|
||||
for (sec1, pub2, expected) in vectors {
|
||||
let ck = conversation_key(sec1, pub2).unwrap();
|
||||
assert_eq!(hex::encode(ck), *expected);
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn nip44_official_message_keys() {
|
||||
let ck_bytes: [u8; 32] = hex::decode("a1a3d60f3470a8612633924e91febf96dc5366ce130f658b1f0fc652c20b3b54")
|
||||
.unwrap()
|
||||
.try_into()
|
||||
.unwrap();
|
||||
let vectors: &[(&str, &str, &str, &str)] = &[
|
||||
("e1e6f880560d6d149ed83dcc7e5861ee62a5ee051f7fde9975fe5d25d2a02d72", "f145f3bed47cb70dbeaac07f3a3fe683e822b3715edb7c4fe310829014ce7d76", "c4ad129bb01180c0933a160c", "027c1db445f05e2eee864a0975b0ddef5b7110583c8c192de3732571ca5838c4"),
|
||||
("ea6eb84cac23c5c1607c334e8bdf66f7977a7e374052327ec28c6906cbe25967", "ff68db24b34fa62c78ac5ffeeaf19533afaedf651fb6a08384e46787f6ce94be", "50bb859aa2dde938cc49ec7a", "06ff32e1f7b29753a727d7927b25c2dd175aca47751462d37a2039023ec6b5a6"),
|
||||
];
|
||||
for (nonce_h, ck_exp, cn_exp, hk_exp) in vectors {
|
||||
let nonce: [u8; 32] = hex::decode(nonce_h).unwrap().try_into().unwrap();
|
||||
let (chacha_key, chacha_nonce, hmac_key) = message_keys(&ck_bytes, &nonce);
|
||||
assert_eq!(hex::encode(chacha_key), *ck_exp);
|
||||
assert_eq!(hex::encode(chacha_nonce), *cn_exp);
|
||||
assert_eq!(hex::encode(hmac_key), *hk_exp);
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn nip44_offical_padded_len() {
|
||||
let vectors: &[(usize, usize)] = &[
|
||||
(16, 32), (32, 32), (33, 64), (37, 64), (45, 64), (49, 64), (64, 64),
|
||||
(65, 96), (100, 128), (111, 128), (200, 224), (250, 256), (320, 320),
|
||||
(383, 384), (384, 384), (400, 448), (500, 512), (512, 512), (515, 640),
|
||||
(700, 768), (800, 896), (900, 1024), (1020, 1024), (65536, 65536),
|
||||
];
|
||||
for (unpadded, padded) in vectors {
|
||||
assert_eq!(calc_padded_len(*unpadded), *padded, "unpadded {unpadded}");
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn nip44_official_encrypt_vectors() {
|
||||
// (sec1, sec2, nonce, plaintext, payload) — decrypt with the peer's
|
||||
// view (sec2, pub(sec1)) so this also proves key symmetry.
|
||||
let vectors: &[(&str, &str, &str, &str, &str)] = &[
|
||||
("0000000000000000000000000000000000000000000000000000000000000001",
|
||||
"0000000000000000000000000000000000000000000000000000000000000002",
|
||||
"0000000000000000000000000000000000000000000000000000000000000001",
|
||||
"a",
|
||||
"AgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABee0G5VSK0/9YypIObAtDKfYEAjD35uVkHyB0F4DwrcNaCXlCWZKaArsGrY6M9wnuTMxWfp1RTN9Xga8no+kF5Vsb"),
|
||||
("0000000000000000000000000000000000000000000000000000000000000002",
|
||||
"0000000000000000000000000000000000000000000000000000000000000001",
|
||||
"f00000000000000000000000000000f00000000000000000000000000000000f",
|
||||
"🍕🫃",
|
||||
"AvAAAAAAAAAAAAAAAAAAAPAAAAAAAAAAAAAAAAAAAAAPSKSK6is9ngkX2+cSq85Th16oRTISAOfhStnixqZziKMDvB0QQzgFZdjLTPicCJaV8nDITO+QfaQ61+KbWQIOO2Yj"),
|
||||
("5c0c523f52a5b6fad39ed2403092df8cebc36318b39383bca6c00808626fab3a",
|
||||
"4b22aa260e4acb7021e32f38a6cdf4b673c6a277755bfce287e370c924dc936d",
|
||||
"b635236c42db20f021bb8d1cdff5ca75dd1a0cc72ea742ad750f33010b24f73b",
|
||||
"表ポあA鷗ŒéＢ逍Üߪąñ丂㐀𠀀",
|
||||
"ArY1I2xC2yDwIbuNHN/1ynXdGgzHLqdCrXUPMwELJPc7s7JqlCMJBAIIjfkpHReBPXeoMCyuClwgbT419jUWU1PwaNl4FEQYKCDKVJz+97Mp3K+Q2YGa77B6gpxB/lr1QgoqpDf7wDVrDmOqGoiPjWDqy8KzLueKDcm9BVP8xeTJIxs="),
|
||||
("eba1687cab6a3101bfc68fd70f214aa4cc059e9ec1b79fdb9ad0a0a4e259829f",
|
||||
"dff20d262bef9dfd94666548f556393085e6ea421c8af86e9d333fa8747e94b3",
|
||||
"2180b52ae645fcf9f5080d81b1f0b5d6f2cd77ff3c986882bb549158462f3407",
|
||||
"( ͡° ͜ʖ ͡°)",
|
||||
"AiGAtSrmRfz59QgNgbHwtdbyzXf/PJhogrtUkVhGLzQHv4qhKQwnFQ54OjVMgqCea/Vj0YqBSdhqNR777TJ4zIUk7R0fnizp6l1zwgzWv7+ee6u+0/89KIjY5q1wu6inyuiv"),
|
||||
("d5633530f5bcfebceb5584cfbbf718a30df0751b729dd9a789b9f30c0587d74e",
|
||||
"b74e6a341fb134127272b795a08b59250e5fa45a82a2eb4095e4ce9ed5f5e214",
|
||||
"a3e219242d85465e70adcd640b564b3feff57d2ef8745d5e7a0663b2dccceb54",
|
||||
"🙈 🙉 🙊 0️⃣ 1️⃣ 2️⃣ 3️⃣ 4️⃣ 5️⃣ 6️⃣ 7️⃣ 8️⃣ 9️⃣ 🔟 Powerلُلُصّبُلُلصّبُررً ॣ ॣh ॣ ॣ冗",
|
||||
"AqPiGSQthUZecK3NZAtWSz/v9X0u+HRdXnoGY7LczOtUf05aMF89q1FLwJvaFJYICZoMYgRJHFLwPiOHce7fuAc40kX0wXJvipyBJ9HzCOj7CgtnC1/cmPCHR3s5AIORmroBWglm1LiFMohv1FSPEbaBD51VXxJa4JyWpYhreSOEjn1wd0lMKC9b+osV2N2tpbs+rbpQem2tRen3sWflmCqjkG5VOVwRErCuXuPb5+hYwd8BoZbfCrsiAVLd7YT44dRtKNBx6rkabWfddKSLtreHLDysOhQUVOp/XkE7OzSkWl6sky0Hva6qJJ/V726hMlomvcLHjE41iKmW2CpcZfOedg=="),
|
||||
];
|
||||
for (sec1, sec2, nonce_hex, plaintext, payload) in vectors {
|
||||
// Encrypt from A to B with the fixed nonce must reproduce the
|
||||
// official payload byte-for-byte.
|
||||
let pub1 = pubkey_hex(sec1).unwrap();
|
||||
let made = {
|
||||
let ck = conversation_key(sec1, &pubkey_hex(sec2).unwrap()).unwrap();
|
||||
let nonce: [u8; 32] = hex::decode(nonce_hex).unwrap().try_into().unwrap();
|
||||
let (chacha_key, chacha_nonce, hmac_key) = message_keys(&ck, &nonce);
|
||||
let mut padded = pad(plaintext.as_bytes()).unwrap();
|
||||
ChaCha20::new(&chacha_key.into(), &chacha_nonce.into()).apply_keystream(&mut padded);
|
||||
let mut mac = <HmacSha256 as Mac>::new_from_slice(&hmac_key).unwrap();
|
||||
mac.update(&nonce);
|
||||
mac.update(&padded);
|
||||
let tag = mac.finalize().into_bytes();
|
||||
let mut out = vec![NIP44_VERSION];
|
||||
out.extend_from_slice(&nonce);
|
||||
out.extend_from_slice(&padded);
|
||||
out.extend_from_slice(&tag);
|
||||
BASE64.encode(&out)
|
||||
};
|
||||
assert_eq!(&made, payload, "encrypt vector for {plaintext:?}");
|
||||
|
||||
// Decrypt from B's view of A (key-role symmetry).
|
||||
let got = nip44_decrypt(sec2, &pub1, payload).unwrap();
|
||||
assert_eq!(got, *plaintext);
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn nip44_round_trip_and_failures() {
|
||||
let sk_a = generate_secret().unwrap();
|
||||
let sk_b = generate_secret().unwrap();
|
||||
let pub_b = pubkey_hex(&sk_b).unwrap();
|
||||
let pub_a = pubkey_hex(&sk_a).unwrap();
|
||||
|
||||
let msg = "hello, remote signer";
|
||||
let payload = nip44_encrypt(&sk_a, &pub_b, msg).unwrap();
|
||||
assert_eq!(nip44_decrypt(&sk_b, &pub_a, &payload).unwrap(), msg);
|
||||
|
||||
// Round-trip long content across the 65536 prefix boundary.
|
||||
let long = "x".repeat(70_000);
|
||||
let payload = nip44_encrypt(&sk_a, &pub_b, &long).unwrap();
|
||||
assert_eq!(nip44_decrypt(&sk_b, &pub_a, &payload).unwrap(), long);
|
||||
|
||||
// Wrong peer key must fail the MAC, not return garbage.
|
||||
let stranger = generate_secret().unwrap();
|
||||
assert!(nip44_decrypt(&sk_b, &pub_b, &payload).is_err());
|
||||
let _ = stranger;
|
||||
|
||||
// Tampered payload fails.
|
||||
let payload = nip44_encrypt(&sk_a, &pub_b, msg).unwrap();
|
||||
let mut tampered = BASE64.decode(&payload).unwrap();
|
||||
let n = tampered.len();
|
||||
tampered[n - 1] ^= 0x01;
|
||||
assert!(nip44_decrypt(&sk_b, &pub_a, &BASE64.encode(&tampered)).is_err());
|
||||
|
||||
// Truncated payload fails.
|
||||
assert!(nip44_decrypt(&sk_b, &pub_a, "AAAA").is_err());
|
||||
}
|
||||
|
||||
// ── BIP-340 official vectors (github.com/bitcoin/bips test vectors) ────
|
||||
|
||||
#[test]
|
||||
fn bip340_reference_sign_vectors() {
|
||||
// (seckey, pubkey, aux, msg, expected sig) — indices 0/1/2 of the
|
||||
// official BIP-340 `bip-0340/test-vectors.csv` "should sign" set,
|
||||
// transcribed from the file itself (x(3G) additionally verified
|
||||
// by independent scalar-math in the review notes for this commit).
|
||||
let vectors: &[(&str, &str, &str, &str, &str)] = &[
|
||||
("0000000000000000000000000000000000000000000000000000000000000003",
|
||||
"F9308A019258C31049344F85F89D5229B531C845836F99B08601F113BCE036F9",
|
||||
"0000000000000000000000000000000000000000000000000000000000000000",
|
||||
"0000000000000000000000000000000000000000000000000000000000000000",
|
||||
"E907831F80848D1069A5371B402410364BDF1C5F8307B0084C55F1CE2DCA821525F66A4A85EA8B71E482A74F382D2CE5EBEEE8FDB2172F477DF4900D310536C0"),
|
||||
("B7E151628AED2A6ABF7158809CF4F3C762E7160F38B4DA56A784D9045190CFEF",
|
||||
"DFF1D77F2A671C5F36183726DB2341BE58FEAE1DA2DECED843240F7B502BA659",
|
||||
"0000000000000000000000000000000000000000000000000000000000000001",
|
||||
"243F6A8885A308D313198A2E03707344A4093822299F31D0082EFA98EC4E6C89",
|
||||
"6896BD60EEAE296DB48A229FF71DFE071BDE413E6D43F917DC8DCF8C78DE33418906D11AC976ABCCB20B091292BFF4EA897EFCB639EA871CFA95F6DE339E4B0A"),
|
||||
("C90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B14E5C9",
|
||||
"DD308AFEC5777E13121FA72B9CC1B7CC0139715309B086C960E18FD969774EB8",
|
||||
"C87AA53824B4D7AE2EB035A2B5BBBCCC080E76CDC6D1692C4B0B62D798E6D906",
|
||||
"7E2D58D8B3BCDF1ABADEC7829054F90DDA9805AAB56C77333024B9D0A508B75C",
|
||||
"5831AAEED7B44BB74E5EAB94BA9D4294C49BCF2A60728D8B4C200F50DD313C1BAB745879A5AD954A72C45A91C3A51D3C7ADEA98D82F8481E0E1E03674A6F3FB7"),
|
||||
];
|
||||
for (sk_hex, pk_hex, aux_hex, msg_hex, sig_hex) in vectors {
|
||||
let sk_bytes = hex::decode(sk_hex).unwrap();
|
||||
let sk = SecretKey::from_slice(&sk_bytes).unwrap();
|
||||
let kp = Keypair::from_secret_key(&Secp256k1::new(), &sk);
|
||||
assert_eq!(hex::encode(kp.public_key().x_only_public_key().0.serialize()).to_uppercase(), *pk_hex);
|
||||
|
||||
let msg: [u8; 32] = hex::decode(msg_hex).unwrap().try_into().unwrap();
|
||||
let aux: [u8; 32] = hex::decode(aux_hex).unwrap().try_into().unwrap();
|
||||
let sig = Secp256k1::new().sign_schnorr_with_aux_rand(
|
||||
&Message::from_digest(msg),
|
||||
&kp,
|
||||
&aux,
|
||||
);
|
||||
assert_eq!(hex::encode(sig.serialize()).to_uppercase(), *sig_hex);
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn event_signing_round_trip() {
|
||||
let sk = generate_secret().unwrap();
|
||||
let unsigned = r#"{"kind":22242,"content":"{\"challenge\":\"abc123\"}","tags":[["relay","ws://127.0.0.1:7777"]],"created_at":1725100000}"#;
|
||||
let signed = sign_event(&sk, unsigned).unwrap();
|
||||
verify_event(&signed).unwrap();
|
||||
|
||||
let ev: serde_json::Value = serde_json::from_str(&signed).unwrap();
|
||||
assert_eq!(ev["kind"], 22242);
|
||||
assert_eq!(ev["pubkey"], pubkey_hex(&sk).unwrap());
|
||||
// Tampering with content breaks the id, which breaks verification.
|
||||
let mut tampered = ev.clone();
|
||||
tampered["content"] = serde_json::Value::String("nope".into());
|
||||
assert!(verify_event(&tampered.to_string()).is_err());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn connect_uri_parsing() {
|
||||
let uri = "nostrconnect://83f3b2ae6aa368e8275397b9c26cf550101d63ebaab900d19dd4a4429f5ad8f5?relay=wss%3A%2F%2Frelay1.example.com&perms=nip44_encrypt%2Csign_event%3A22242&name=My+Client&secret=0s8j2djs&relay=ws%3A%2F%2F192.168.1.20%3A7777";
|
||||
let info = parse_connect_uri(uri).unwrap();
|
||||
assert_eq!(info.client_pubkey, "83f3b2ae6aa368e8275397b9c26cf550101d63ebaab900d19dd4a4429f5ad8f5");
|
||||
assert_eq!(
|
||||
info.relays,
|
||||
vec!["wss://relay1.example.com", "ws://192.168.1.20:7777"]
|
||||
);
|
||||
assert_eq!(info.secret, "0s8j2djs");
|
||||
assert_eq!(info.perms, vec!["nip44_encrypt", "sign_event:22242"]);
|
||||
assert_eq!(info.name, "My Client");
|
||||
|
||||
// npub client keys and unknown params tolerated — the npub is
|
||||
// generated through our own encoder so the test carries no
|
||||
// hand-transcribed bech32 string.
|
||||
let sk1 = "0000000000000000000000000000000000000000000000000000000000000001";
|
||||
let npub = npub_from_pubkey(&pubkey_hex(sk1).unwrap()).unwrap();
|
||||
let pubkey = pubkey_from_any(&npub).unwrap();
|
||||
let uri = format!("nostrconnect://{npub}?relay=wss://r&secret=s&future=1");
|
||||
let info = parse_connect_uri(&uri).unwrap();
|
||||
assert_eq!(info.client_pubkey, pubkey);
|
||||
assert_eq!(info.relays, vec!["wss://r"]);
|
||||
|
||||
assert!(parse_connect_uri("bunker://abc?relay=wss://r&secret=s").is_err());
|
||||
assert!(parse_connect_uri("nostrconnect://zz?relay=wss://r&secret=s").is_err());
|
||||
assert!(parse_connect_uri("nostrconnect://83f3b2ae6aa368e8275397b9c26cf550101d63ebaab900d19dd4a4429f5ad8f5?name=x").is_err());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn nip04_round_trip_and_cross_check() {
|
||||
let sk_a = generate_secret().unwrap();
|
||||
let sk_b = generate_secret().unwrap();
|
||||
let pub_b = pubkey_hex(&sk_b).unwrap();
|
||||
let pub_a = pubkey_hex(&sk_a).unwrap();
|
||||
|
||||
let payload = nip04_encrypt(&sk_a, &pub_b, "old client hello").unwrap();
|
||||
assert!(payload.contains("?iv="));
|
||||
assert_eq!(nip04_decrypt(&sk_b, &pub_a, &payload).unwrap(), "old client hello");
|
||||
|
||||
// Wrong key must fail (PKCS#7 padding check) rather than return garbage.
|
||||
assert!(nip04_decrypt(&sk_a, &pub_a, &payload).is_err());
|
||||
assert!(nip04_decrypt(&sk_b, &pub_b, &payload).is_err());
|
||||
assert!(nip04_decrypt(&sk_b, &pub_a, "not-a-payload").is_err());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn key_encoding_round_trip() {
|
||||
let sk = generate_secret().unwrap();
|
||||
let nsec = nsec_from_secret(&sk).unwrap();
|
||||
assert!(nsec.starts_with("nsec1"));
|
||||
assert_eq!(secret_from_nsec(&nsec).unwrap(), sk);
|
||||
assert_eq!(secret_from_any(&nsec).unwrap(), sk);
|
||||
assert_eq!(secret_from_any(&sk).unwrap(), sk);
|
||||
|
||||
let pk = pubkey_hex(&sk).unwrap();
|
||||
let npub = npub_from_pubkey(&pk).unwrap();
|
||||
assert!(npub.starts_with("npub1"));
|
||||
assert_eq!(pubkey_from_any(&npub).unwrap(), pk);
|
||||
assert_eq!(pubkey_from_any(&pk).unwrap(), pk);
|
||||
|
||||
// The famous even-y lift edge case: pubkey of sk=1 is x(G) (y is odd);
|
||||
// shared_x with oneself is exactly x(G) — pins the unhashed-x ECDH and
|
||||
// the even-parity lift in one assertion (x is invariant under y-negation,
|
||||
// so the lift is safe for NIP-44/NIP-04 keys).
|
||||
let g_x = "79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798";
|
||||
assert_eq!(
|
||||
pubkey_hex("0000000000000000000000000000000000000000000000000000000000000001").unwrap(),
|
||||
g_x
|
||||
);
|
||||
assert_eq!(
|
||||
hex::encode(
|
||||
shared_x("0000000000000000000000000000000000000000000000000000000000000001", g_x).unwrap()
|
||||
),
|
||||
g_x
|
||||
);
|
||||
assert!(secret_from_nsec("npub1").is_err());
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user