# パディングされた場合のバイト配列の長さを計算する def calc_padded_len(unpadded_len): next_power = 1 << (floor(log2(unpadded_len - 1))) + 1 if next_power <= 256: chunk = 32 else: chunk = next_power / 8 if unpadded_len <= 32: return 32 else: return chunk * (floor((len - 1) / chunk) + 1) # パディングされてない平文をパディング済みのバイト配列に変換する def pad(plaintext): unpadded = utf8_encode(plaintext) unpadded_len = len(plaintext) if (unpadded_len < c.min_plaintext_size or unpadded_len > c.max_plaintext_size): raise Exception('平文の長さが不正') prefix = write_u16_be(unpadded_len) suffix = zeros(calc_padded_len(unpadded_len) - unpadded_len) return concat(prefix, unpadded, suffix) # パディング済みのバイト配列をパディングされていない平文に変換する def unpad(padded): unpadded_len = read_uint16_be(padded[0:2]) unpadded = padded[2:2+unpadded_len] if (unpadded_len == 0 or len(unpadded) != unpadded_len or len(padded) != 2 + calc_padded_len(unpadded_len)): raise Exception('不正なパディング') return utf8_decode(unpadded) # メタデータ : 常に 65バイト (version: 1バイト, nonce: 32バイト, max: 32バイト) # 平文 : 1 〜 65535(0xffff)バイト # パディング済みの平文 : 32 〜 65535(0xffff)バイト # 暗号文: 32 + 2 〜 65535(0xffff) + 2 バイト # 生のペイロード: 99 (65+32+2) 〜o 65603 (65+65535(0xffff)+2) バイト # 圧縮されたペイロード (base64): 132 〜 87472b def decode_payload(payload): plen = len(payload) if plen == 0 or payload[0] == '#': raise Exception('未知のバージョン') if plen < 132 or plen > 87472: raise Exception('ペイロード長が不正') data = base64_decode(payload) dlen = len(d) if dlen < 99 or dlen > 65603: raise Exception('データ長が不正'); vers = data[0] if vers != 2: raise Exception('未知の―ジョン ' + vers) nonce = data[1:33] ciphertext = data[33:dlen - 32] mac = data[dlen - 32:dlen] return (nonce, ciphertext, mac) def hmac_aad(key, message, aad): if len(aad) != 32: raise Exception('AAD関連データは 32 バイトでなければならない'); return hmac(sha256, key, concat(aad, message)); # Calculates long-term key between users A and B: `get_key(Apriv, Bpub) == get_key(Bpriv, Apub)` def get_conversation_key(private_key_a, public_key_b): shared_x = secp256k1_ecdh(private_key_a, public_key_b) return hkdf_extract(IKM=shared_x, salt=utf8_encode('nip44-v2')) # Calculates unique per-message key def get_message_keys(conversation_key, nonce): if len(conversation_key) != 32: raise Exception('対話鍵(conversation_key)の長さが不正') if len(nonce) != 32: raise Exception('nonceの長さが不正') keys = hkdf_expand(OKM=conversation_key, info=nonce, L=76) chacha_key = keys[0:32] chacha_nonce = keys[32:44] hmac_key = keys[44:76] return (chacha_key, chacha_nonce, hmac_key) def encrypt(plaintext, conversation_key, nonce): (chacha_key, chacha_nonce, hmac_key) = get_message_keys(conversation_key, nonce) padded = pad(plaintext) ciphertext = chacha20(key=chacha_key, nonce=chacha_nonce, data=padded) mac = hmac_aad(key=hmac_key, message=ciphertext, aad=nonce) return base64_encode(concat(write_u8(2), nonce, ciphertext, mac)) def decrypt(payload, conversation_key): (nonce, ciphertext, mac) = decode_payload(payload) (chacha_key, chacha_nonce, hmac_key) = get_message_keys(conversation_key, nonce) calculated_mac = hmac_aad(key=hmac_key, message=ciphertext, aad=nonce) if not is_equal_ct(calculated_mac, mac): raise Exception('invalid MAC') padded_plaintext = chacha20(key=chacha_key, nonce=chacha_nonce, data=ciphertext) return unpad(padded_plaintext) # 使用法: # conversation_key = get_conversation_key(sender_privkey, recipient_pubkey) # nonce = secure_random_bytes(32) # payload = encrypt('hello world', conversation_key, nonce) # 'hello world' == decrypt(payload, conversation_key)

269ed0f69e4c192512cc779e78c555090cebc7c785b609e338a62afc3ce25040 nip44.vectors.json

{ "sec1": "0000000000000000000000000000000000000000000000000000000000000001", "sec2": "0000000000000000000000000000000000000000000000000000000000000002", "conversation_key": "c41c775356fd92eadc63ff5a0dc1da211b268cbea22316767095b2871ea1412d", "nonce": "0000000000000000000000000000000000000000000000000000000000000001", "plaintext": "a", "payload": "AgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABee0G5VSK0/9YypIObAtDKfYEAjD35uVkHyB0F4DwrcNaCXlCWZKaArsGrY6M9wnuTMxWfp1RTN9Xga8no+kF5Vsb" }

// npm install @noble/curves @noble/hashes @scure/base @stablelib/xchacha20 import {xchacha20} from '@noble/ciphers/chacha' import {secp256k1} from '@noble/curves/secp256k1' import {sha256} from '@noble/hashes/sha256' import {randomBytes} from '@noble/hashes/utils' import {base64} from '@scure/base' import {utf8Decoder, utf8Encoder} from './utils.ts' export function getConversationKey(privkeyA: string, pubkeyB: string): Uint8Array { const key = secp256k1.getSharedSecret(privkeyA, '02' + pubkeyB) return sha256(key.subarray(1, 33)) } export function encrypt( key: Uint8Array, text: string, ver = 1 ): string { if (ver !== 1) throw new Error('NIP44: unknown encryption version') let nonce = randomBytes(24) let plaintext = utf8Encoder.encode(text) let ciphertext = xchacha20(key, nonce, plaintext, plaintext) return `1,${base64.encode(nonce)},${base64.encode(ciphertext)}` } export function decrypt(key: Uint8Array, data: string): string { let dt = data.split(',') if (dt.length !== 3) throw new Error('NIP44: unknown encryption version'); let v = Number.parseInt(dt[0]) if (v !== 1) throw new Error('NIP44: unknown encryption version') let nonce = base64.decode(dt[1]) let ciphertext = base64.decode(dt[2]) let plaintext = xchacha20(key, nonce, ciphertext) let text = utf8Decoder.decode(plaintext) return text }