also, gpg support of secp256k1 signatures is not widely recognised by apps that handle gpg indirectly, such as git and key managers like kleopatra or seahorse.

Reply to this note

Please Login to reply.

Discussion

This is very helpful, thank you. Lot to learn here.

Are you saying I could create a gpg key pair with curve25519, set a revocation key, the whole nine yards, use that as my npub/nsec, and it would be recognized by the nostr protocol and its client apps...?

the tl;dr is: no

a brief search for information shows me a few important facts about gpg keys:

firstly, what's stored in your ~/.gnupg folder is more than one key, it is an auth key (for signing) and an encryption key (used with ECDH key negotiation),

it is complicated.

there does not appear to be a simple tool to just get the raw 32 byte secret for an elliptic curve private key, either auth or encryption.

gnupg/PGP is an overly complex and outdated cryptographic key system.

the SSH keys are less complex but don't include secp256k1 in the list of EC key options (only the near relative P256).

conversely, nostr is an underspecified, and insecure protocol that doesn't do sufficient things to make sure that glaring errors are done by app writers with keys, and there is no central keychain CLI apart from the one i wrote, which isn't adopted by anyone, and mine was only designed for general signing of files, and uses a custom signing protocol which is properly secure.

so, currently no, but in theory i could write a tool that extracts the auth key and turns it into a nostr key, this would not be difficult to add to https://github.com/mleuk/signr

i'd take donations to add this feature! haha.