Nostr Web Client

Thoughts on #nostr.

Nostr is a websockets-based text protocol for logs of authenticated (but unauthorized) tagged (and otherwise unstructured) messages stored at public relay servers. The rest is a specific nostr application (like social networking or payments) on top of it.

Nostr takes several decisions on possible tradeoffs, which I try to analyze here:

1. Websockets. Good: pub/sub data access, web-integratable. Bad: high load on relay servers limiting scalability. Verdict: ⚠️

2. Elliptic curve (secp256k1) for identities. Good: bitcoin-based. Bad: very low performance, not GPG/SSH compatible, sidechannels. Overall: ❌.

3. Signature scheme: BIP-340 Schnorr. Good: batch verification, standard. Bad: optimized for onchain, discarding y coord, making verification ~50% more expensive than non-BIP Schnorr. Verdict: ⚠️

4. Hashing function: SHA256. Good: standard, bitcoin. Bad: slower than BLACKE3. Verdict: ⚠️

5. Text JSON encoding. Good: easy to implement. Bad: hard to pass & slow to encode/decode non-text/binary data; no limits on data sizing opening a door for DoSing relays and clients. Verdict: ❌

6. No authorization scheme. Good: easy to implement. Bad: limits use cases, limits scalability. Verdict: ⚠️

7. No encryption on the transport level, relying on TLS. Good: easy to implement. Bad: centralized, not end-to-end. Verdict: ⚠️

So I see most of selected tradeoffs by Nostr as a bad or poor decision. This us arguable of course.

Can Nostr survive and success? For sure, if even much worse systems had done that in the past (Ethereum, JavaScript, PHP).

What is the greatest Nostr weakness? Limited scalability and possible DoS (not even DDoS) attacks.

If I were the one who did nostr, what I would had made differently? I would had used Ed25519 signatures on Ristretto25519 (speed), binary encoding with strict limits on data sizes, use Noise_XK encryption - and provide bridges to Websockets only when they are needed for the web. But we have what we have.

Dr Maxim Orlovsky 2y ago

TL;DR:

1. Choice of crypto: nostr picked “bitcoin crypto starter pack”. But what is good for blockchain may be bad for network: it is ultra-slow and non-standard in digital identity world (incompatible with PGP/SSH)

2. Choice of javascript-style (no data typing): vectors for DoS attacks, slow speed, low extensibility

3. No end-to-end encryption

Overall: very vulnerable to DoS, incompatible with other decentralized identity schemata, will have scalability problems.

Reply to this note

Please Login to reply.

Discussion

Alexis Roussel 2y ago

i think the choices in #nostr are not only technical, but social and mostly taken from the Bitcoin culture:

1. Open source and open protocol

2. Bips are Nips

3. transparency by default

4. selfhosting relays

5. all you need are your keys.

6. start with a small set of function

7. provide an emancipating tool

8. time it when twitter and co goes mental :) (like 2008 and financial sector)

TL;DR:

nostr reuses basic bitcoin culture to create a basic protocol that can evolve.

Dr Maxim Orlovsky 2y ago

That’s all true. But it needs to survive through the future DoS attacks and scale, though. And I see that because of the tech issues that may be very challenging and limiting its future.