The spec or the implementation?
i wrote a logging library so i could get that without using panics, runtime.Caller
it fails at the error that nostr:nprofile1qyfhwumn8ghj7mmxve3ksctfdch8qatz9uqsuamnwvaz7tmwdaejumr0dshszxthwden5te0dphkgmrzdajzumn0wd68yvfwvdhk6tcqyztuwzjyxe4x2dwpgken87tna2rdlhpd02va5cvvgrrywpddnr3jyhdw0my reports - the hmac is not being calculated correctly, more likely it's not being partitioned out of the raw bytes properly
come to think of it, the way it pulls that thing out is from the last 32 bytes of it but it doesn't require a multiple of anything, just a set of boundaries on the length
the whole NIP-44 is a clown show
Discussion
the implementation
the spec is hard to read, i could try and write it based on the spec, i may yet, it's just not a high priority for me right now
i don't quit have my head wrapped around how it works but HMACs are annoying anyway, signatures do the same thing, and if the thing inside is signed and only the receiver can unpack that then there is security, and if the client can maintain the state of that, it could turn into a chain if you sent one or more future pubkeys to reply with, since the sender can identify a reply by that
but i think it's lower priority than getting everyone to fully support NIP-42 so the relays don't hand out these messages to anyone who hasn't proved they are the valid parties to the messages
Yeah, the HMAC thing was discussed in the audit. I don't fully understand why paul went that direction, but it does work as long as it's in an event
well i'm just telling you that that the go implementation is definitely divergent from the javascript version
and the javascript version seems to not be referred to by the NIP actually, i know your codebase has it but it's not pointed to by the NIP
there really should be an interop test for this, preferably one that uses randomly generated content so it's only repeatable if it's correct
The javascript version comes from paul miller's reference implementation, it's basically copied over into nostr-tools
of course i don't know it because javascript is the most abominable language ever invented, and i curse Griesemer, he only avoids hell by helping build Go