-
Notifications
You must be signed in to change notification settings - Fork 753
nip-04 key material not uniformly random #72
Description
Encrypted messages are encrypted according to nip-04 using a Diffie-Hellman shared secret generated from a private key and a public key. This shared secret is then used as an AES key. But such a shared secret is not uniformly random. AES requires a uniformly random key to guarantee its level of security. Cryptographers recommend using an HKDF (HMAC-based extract and expand key derivation function) ideally with a salt in order to get a uniformly random key suitable for symmetric encryption by, e.g. AES. SHA256 can be used as the HKDF.
I would suggest generating a random salt, SHA256 the shared secret and the salt together, and include the salt with the message in the same way that the IV is included with the message. Alternatively, ditch the salt entirely. Or it can be a fixed well-known string.
Lest you mistake me for a cryptographer (albeit I did take a crypto class from Phil Rogaway in the early 1990s), I'm getting my information from this page: https://docs.rs/elliptic-curve/latest/elliptic_curve/ecdh/struct.SharedSecret.html
I'll leave it to others to suggest how to move forward. IMHO event kind 4 should not change but should be superseded.