Claude
2ad1a48123
The custom C secp256k1 implementation under quartz/src/main/c/ was never
wired into Gradle (no externalNativeBuild block) and only existed for the
3-way benchmark + cross-validation test against ACINQ on JVM/Android.
The C library has been split out to vitorpamplona/libschnorr256k1{,-kmp},
so the in-repo copy is dead weight.
This change replaces it with the published Maven Central artifact
`com.vitorpamplona:schnorr256k1-kmp:1.0.0`, scoped to test/benchmark
configurations only — production crypto continues to use ACINQ
secp256k1-kmp on JVM/Android and the pure-Kotlin Secp256k1 on native.
The Android AAR ships libschnorr256k1_jni.so for arm64-v8a and x86_64,
so the Android benchmark now exercises the C row automatically (no more
manual build_android.sh). On JVM the .so still has to be installed by the
developer; the cross-validation test and triple-benchmark gracefully skip
the C row when System.loadLibrary fails, matching prior behavior.
Verified on JVM: all 13 secp256k1 jvmTest classes pass (188 tests), and
ACINQ vs pure-Kotlin benchmark numbers match the documented baseline
within sandbox noise (verifySchnorr ~15k ops/s, signSchnorr cached
~33k ops/s, pubkeyCreate+Compress ~36k ops/s).
Removes ~5,100 LOC: quartz/src/main/c/ (4,500), Secp256k1InstanceC.*
expect/actual shim (560), Secp256k1C JNI declaration object.
https://claude.ai/code/session_01KnvpK2amcVZKfFiZJvHjVe
81 lines
4.3 KiB
Markdown
81 lines
4.3 KiB
Markdown
# Crypto & Encryption in Quartz
|
|
|
|
Event signing, hashing, and NIP-44 payload encryption.
|
|
|
|
## Layout
|
|
|
|
### Core crypto (`quartz/src/commonMain/kotlin/com/vitorpamplona/quartz/nip01Core/crypto/`)
|
|
|
|
- `EventHasher.kt` — canonical JSON serialization + SHA-256 → event id. NIP-01 §1.
|
|
- `EventHasherSerializer.kt` — Jackson serializer that emits the exact byte layout NIP-01 hashing requires.
|
|
- `KeyPair.kt` — holder for `privateKey: ByteArray` + derived `pubKey: ByteArray`. Generates fresh key pairs via `secureRandom`.
|
|
- `Nip01Crypto.kt` — one-stop helper: sign an event, verify a signature, derive pubkey from seckey.
|
|
- `EventAssembler.kt` — takes an unsigned template + signer and produces a fully populated `Event`.
|
|
- `EventExt.kt` — `Event.verify()` / `Event.hasValidSignature()` extensions.
|
|
|
|
### secp256k1 abstraction (`quartz/src/commonMain/kotlin/com/vitorpamplona/quartz/utils/`)
|
|
|
|
- `Secp256k1Instance.kt` — `expect object` with `signSchnorr`, `verifySchnorr`, `pubKey(seckey)`, `sharedSecret`.
|
|
- `Secp256k1InstanceKotlin.kt` — pure-Kotlin actual (iOS via native, etc.).
|
|
- Android actual: `secp256k1-kmp-jni-android` (0.23.0). JVM actual: `secp256k1-kmp-jni-jvm`.
|
|
- Tests/benchmarks pull in `com.vitorpamplona:schnorr256k1-kmp` (libschnorr256k1) for the in-house C JNI baseline used in `Secp256k1CrossValidationTest` and the 3-way benchmarks; production never ships it.
|
|
|
|
### NIP-44 encryption (`quartz/src/commonMain/kotlin/com/vitorpamplona/quartz/nip44Encryption/`)
|
|
|
|
- `Nip44.kt` — dispatcher that handles both v1 (ChaCha20 w/o Poly1305, legacy) and v2 (XChaCha20-Poly1305).
|
|
- `Nip44v2.kt` — current spec: HKDF key derivation → XChaCha20-Poly1305 → padded plaintext → Base64.
|
|
- `Nip44v1.kt` — legacy path (decrypt-only for backward compat; do not encrypt with v1).
|
|
- `crypto/` — `ChaCha20Poly1305`, `HKDF`, `Hmac`, etc. (pure Kotlin, MPP-friendly).
|
|
- `SharedKeyCache.kt` — in-process LRU for ECDH shared secrets. Critical for performance in chat/list screens that decrypt many messages with the same counterparty.
|
|
- `EncryptedInfoString.kt` — versioned payload envelope that the parser reads to pick v1 vs v2.
|
|
|
|
## Typical Flows
|
|
|
|
### Sign an event
|
|
|
|
```kotlin
|
|
// Direct (when you have the privkey in memory)
|
|
val signed = Nip01Crypto.sign(unsignedEvent, keyPair.privateKey)
|
|
|
|
// Via signer (preferred — honors external/remote signers)
|
|
val signer: NostrSigner = ... // NostrSignerInternal, Nip46RemoteSigner, NostrSignerExternal
|
|
signer.sign(template) { signed -> /* emit signed event */ }
|
|
```
|
|
|
|
Use `NostrSigner` whenever the key might not live in the current process (NIP-46 bunker, NIP-55 Android external signer). See the `auth-signers` skill.
|
|
|
|
### Verify an event
|
|
|
|
```kotlin
|
|
event.verify() // throws on failure
|
|
event.hasValidSignature() // returns Boolean
|
|
```
|
|
|
|
Both recompute `sha256(canonicalJson(event))` and call Schnorr `verifySchnorr(sig, hash, pubKey)`.
|
|
|
|
### NIP-44 encrypt / decrypt
|
|
|
|
```kotlin
|
|
// Always compute shared secret through the cache — direct ECDH is expensive
|
|
val sharedSecret = SharedKeyCache.getOrComputeShared(mySeckey, theirPubkey)
|
|
|
|
val cipherText = Nip44.encrypt(plaintext, sharedSecret) // v2 by default
|
|
val plain = Nip44.decrypt(cipherText, sharedSecret) // dispatches on version byte
|
|
```
|
|
|
|
Callers rarely touch `Nip44v2` directly; go through `Nip44`.
|
|
|
|
## Gotchas
|
|
|
|
- **Never log private keys, shared secrets, or raw plaintext.** `KeyPair.privateKey` is a `ByteArray` on purpose so it doesn't get interned as a String.
|
|
- **Don't recompute ECDH per message.** `SharedKeyCache` exists because the same counterparty appears in many messages; bypassing the cache produces noticeable UI lag.
|
|
- **`EventHasher` ordering is canonical.** Serialize tags / content exactly as `EventHasherSerializer` emits, or ids won't match relays.
|
|
- **secp256k1 JNI is platform-specific**: if you add crypto that must run in `commonTest`, wrap it in `expect/actual` or you'll get `UnsatisfiedLinkError` in JVM unit tests.
|
|
- **NIP-44 pads messages**. Don't assert exact ciphertext length; assert decrypt round-trips.
|
|
|
|
## Tests
|
|
|
|
- `quartz/src/commonTest/kotlin/com/vitorpamplona/quartz/nip01Core/crypto/` — sign/verify/hash round-trips.
|
|
- `quartz/src/commonTest/kotlin/com/vitorpamplona/quartz/nip44Encryption/` — NIP-44 vectors (encryption parity with reference vectors).
|
|
- JNI crypto is exercised in `androidUnitTest` / JVM integration tests.
|