Skip to content

nip-04 key material not uniformly random #72

@mikedilger

Description

@mikedilger

Encrypted messages are encrypted according to nip-04 using a Diffie-Hellman shared secret generated from a private key and a public key. This shared secret is then used as an AES key. But such a shared secret is not uniformly random. AES requires a uniformly random key to guarantee its level of security. Cryptographers recommend using an HKDF (HMAC-based extract and expand key derivation function) ideally with a salt in order to get a uniformly random key suitable for symmetric encryption by, e.g. AES. SHA256 can be used as the HKDF.

I would suggest generating a random salt, SHA256 the shared secret and the salt together, and include the salt with the message in the same way that the IV is included with the message. Alternatively, ditch the salt entirely. Or it can be a fixed well-known string.

Lest you mistake me for a cryptographer (albeit I did take a crypto class from Phil Rogaway in the early 1990s), I'm getting my information from this page: https://docs.rs/elliptic-curve/latest/elliptic_curve/ecdh/struct.SharedSecret.html

I'll leave it to others to suggest how to move forward. IMHO event kind 4 should not change but should be superseded.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions