Introduce Nostr #4436

ibz · 2024-12-10T12:41:52Z

This PR adds Nostr support to the Trezor firmware, trezorlib and trezorctl.

Firmware

The Trezor firmware accepts the NostrGetPubkey and NostrSignEvent messages, as defined in common/protob/messages-nostr.proto.

To avoid adding complexity to the firmware, it does not parse the event JSON. The event needs to be parsed beforehand and its individual fields passed via the protobuf message. The return value contains the pubkey, event ID and signature, which need to be added back to the JSON by the caller before forwarding the event to relays.

UI

A simple UI exists to confirm the event being signed on your Trezor's screen. It will be improved later, but for now it just shows all the fields of the event being signed:

Trezor Safe 5

Main screen shows the event kind and the content:

From the menu you can view the created_at and the tags:

Trezor Safe 3

Trezor Model T

trezorctl

trezorctl accepts the nostr get-pubkey and nostr sign-event commands which correspond to the protobuf messages described above.

Note: by passing --account (which defaults to 0 - the "first" account) to trezorctl nostr get-pubkey or trezorctl nostr sign-event you can generate a virtually infinite amount of Nostr keypairs from your Trezor - all derived from your seed phrase using the m/44'/1237'/<account>'/0/0 derivation path, as defined by NIP-06.

get-pubkey

Example:

ibz@localhost:~/dev/trezor-firmware$ trezorctl nostr get-pubkey

Output:

pubkey: 2dc0dd32b499f7bd428156334c3431893c18e6016cf1bf00187d76513368dba7

sign-event

trezorctl nostr sign-event will parse the event JSON, send the NostrSignEvent to the Trezor device and re-assemble the event JSON with the id, pubkey and sig obtained from the Trezor.

Example:

ibz@localhost:~/dev/trezor-firmware$ trezorctl nostr sign-event "{\"kind\": 1, \"created_at\": 1733917737, \"tags\": [[\"e\", \"5c83da77af1dec6d7289834998ad7aafbd9e2191396d75ec3cc27f5a77226f36\", \"wss://nostr.example.com\"], [\"p\", \"f7234bd4c1394dda46d09f35bd384dd30cc552ad5541990f98844fb06676e9ca\"], [\"a\", \"30023:f7234bd4c1394dda46d09f35bd384dd30cc552ad5541990f98844fb06676e9ca:abcd\", \"wss://nostr.example.com\"], [\"alt\", \"reply\"]], \"content\": \"Hello world\"}"

Output:

signed_event: {"kind": 1, "created_at": 1733917737, "tags": [["e", "5c83da77af1dec6d7289834998ad7aafbd9e2191396d75ec3cc27f5a77226f36", "wss://nostr.example.com"], ["p", "f7234bd4c1394dda46d09f35bd384dd30cc552ad5541990f98844fb06676e9ca"], ["a", "30023:f7234bd4c1394dda46d09f35bd384dd30cc552ad5541990f98844fb06676e9ca:abcd", "wss://nostr.example.com"], ["alt", "reply"]], "content": "Hello world", "id": "c2ea8f08093caebf6d73bfe4edbb7e8825bac8eb4308ab634e23161db18b78f8", "pubkey": "2dc0dd32b499f7bd428156334c3431893c18e6016cf1bf00187d76513368dba7", "sig": "4176eaa45730a617f7393ba53df009278504911b3b30d35e125cb1c0f0d1e92102f468705eaed7d3ae5bb3bb4267d9411f0184a7ab6c451110553c2fca97b39c"}

github-actions · 2024-12-10T12:49:32Z

core UI changes	device test	click test	persistence test
T2T1 Model T	test(screens) main(screens)	test(screens) main(screens)	test(screens) main(screens)
T3B1 Safe 3	test(screens) main(screens)	test(screens) main(screens)	test(screens) main(screens)
T3T1 Safe 5	test(screens) main(screens)	test(screens) main(screens)	test(screens) main(screens)
All	main(screens)

prusnak · 2024-12-11T17:43:38Z

We should check that the address_n provided to NostrGetPubkey and NostrSignEvent matches m/44'/1237'/<account>'/0/0 and fail if it does not.

Also I prefer changing the CLI interface from using --address to using --account where default account is 0 (see below).

Otherwise great work! 🎉

common/protob/messages.proto

python/src/trezorlib/cli/nostr.py

tests/device_tests/nostr/test_nostr.py

prusnak · 2024-12-12T13:29:14Z

core/src/apps/bitcoin/keychain.py

@@ -91,6 +91,9 @@ class MsgWithAddressScriptType(Protocol):
 # SLIP-44 coin type for all Testnet coins
 SLIP44_TESTNET = const(1)

+# SLIP-44 "coin type" for Nostr
+SLIP44_NOSTR = const(1237)


It seems this is not used anywhere.

prusnak · 2024-12-12T13:33:02Z

core/src/apps/nostr/sign_event.py

+    content = msg.content
+
+    node = keychain.derive(address_n)
+    pk = node.public_key()[-32:]


Can we do this? Don't we care about the public key parity? Or does nostr use x-only keys?

Can we do this? Don't we care about the public key parity? Or does nostr use x-only keys?

From what I understand, Nostr uses X-only keys, indeed.

But it is not guaranteed that keychain.derive returns an x-only key, right?
I think we need to convert the key if a non x-only key is returned.

Isn't conversion to x-only basically dropping the first byte if the key is 33 bytes long? Which is the same as taking the last 32 bytes always?

ibz · 2024-12-18T11:23:52Z

We should check that the address_n provided to NostrGetPubkey and NostrSignEvent matches m/44'/1237'/<account>'/0/0 and fail if it does not.

Yup! dc1a257#diff-3dd8aea4110592e07746c9d3233736246c7083e001c9d29db7c1b03f7423f93bR19

obrusvit

Some points for discussion.

common/protob/messages-nostr.proto

core/src/apps/nostr/sign_event.py

core/.changelog.d/4160.added

core/src/apps/nostr/__init__.py

core/src/apps/nostr/get_pubkey.py

core/src/trezor/wire/__init__.py

python/src/trezorlib/mapping.py

matejcik · 2025-01-13T10:11:59Z

tests/device_tests/nostr/test_nostr.py

+
+
+@pytest.mark.setup_client(mnemonic=LEAD_MONKEY_MNEMONIC)
+def test_sign_event_lead_monkey(client: Client):


there's a better way to write these tests:

LEAD_MONKEY = pytest.mark.setup_client(...) WHAT_BLEAK = pytest.mark.setup_client(...) VECTORS = ( # pubkey_hex pytest.param("cafecacebeef", mark=LEAD_MONKEY), pytest.param(...) ) @pytest.mark.parametrize("pubkey_hex", VECTORS) def test_get_pubkey(client, pubkey_hex): ...

dtto for sign_event except i'd prefer also hardcoding the signature bytes, in addition to verifying

7f493ea#diff-1a61ba923388ca946c730e9cec2ca549a97e355ff7a53673617057d39f95f0f5R44

The signature cannot be hardcoded because every time an event is signed it gets a different signature. That is the reason to use verify rather than comparing to a known signature.

The signature cannot be hardcoded because every time an event is signed it gets a different signature.

what is the source of this nondeterminism?

It's a feature of ECDSA - a random value is included. This is to prevent deriving of the private key if you have many signatures that you can analyze.

that's what RFC 6979 is for -- i was under the impression that this is built into ecdsa signing on library level...?

Right... I think that in theory we should be allowed to use the deterministic signatures, but from what I noticed Nostr signatures are usually of the non-deterministic kind. Do you think it should be otherwise? I guess the library can do both, if needed, but isn't the non-deterministic version better?

isn't the non-deterministic version better?

i'm not aware of any argument why it would be.
in our particular case, there's another issue on top: if the nonce is not deterministic, attacks like Dark Skippy can use the signatures to smuggle out secret bits without the user being able to detect it. (with rfc6979 at least you can verify the signature if you also have the seed on the host side)

so please change to deterministic signatures, unless you have a spec explicitly saying you shouldn't do that. (and if so let's see it and talk to R&D about this)

I don't think RFC 6979 would work actually because we need Schnorr signatures. So I used BIP-340 to sign and I got deterministic signatures now. 45d4ee0

tests/device_tests/nostr/test_nostr.py

python/src/trezorlib/nostr.py

matejcik · 2025-01-13T10:14:59Z

python/src/trezorlib/nostr.py

+
+
+@expect(messages.NostrPubkey)
+def get_pubkey(


this function should return just bytes of the public key.

perhaps it's a good idea to rebase on #4490

Actually I don't think it should be bytes but rather the hex-encoded bytes, which is human readable and the (most) standard way to encode Nostr keys. Another encoding commonly used is NPUB - and I should probably add an option to return that encoding if desired, but at the most fundamental level it is the hex encoding, which is what all code dealing with Nostr is using. bytes seems strange, because it looks bad, can't even be copy-pasted, and is of no use...

7f493ea#diff-d0a53275e15314e83ef900790cfdd6af05df702377562408a76287ae1507a853L34

bytes seems strange, because it looks bad, can't even be copy-pasted, and is of no use...

I mean you're deep inside a library, nobody is supposed to be copy-pasting the return value of this.
If there is a canonical representation of the pubkey as readable string, the NostrPubkey message should send that from Trezor. If there isn't (you apparently have two choices, npub / hex), and you're returning raw bytes, the library function should return raw bytes.

Consumers of trezorlib.nostr.get_pubkey are expected to do their own human readable conversion if they need to; specifically, if encoding to npub is simple, feel free to implement that in cli/nostr.py and add an option to the user-exposed function

(fwiw if you return bytes from a click-exposed function, there's some sort of conversion machinery that will automagically print it as hex for the user)

If there is a canonical representation of the pubkey as readable string, the NostrPubkey message should send that from Trezor

hex is the standard way to represent keys in code interacting with Nostr events. npub is a more "human friendly" standard, but it always has to be converted back to hex after being received from user input. So I think hex is the most appropriate standard to use here.

okay, if that's the case, please modify the Trezor side to return the hex string

Good point. It's all str now: a95dc04 !

python/src/trezorlib/cli/nostr.py

[no changelog]

matejcik · 2025-01-21T11:54:33Z

python/src/trezorlib/cli/nostr.py

+# If not, see <https://www.gnu.org/licenses/lgpl-3.0.html>.
+
+import json
+from typing import TYPE_CHECKING, Dict


instead:

from __future__ import annotations # ... import typing as t # ... if t.TYPE_CHECKING: # ... # ... def foo() -> dict[str, str]:

a95dc04#diff-fe4291c13985e00ae63aea21ee979921f4e974707d7830066a0aa0956aa120deR17

matejcik · 2025-01-21T11:55:53Z

python/src/trezorlib/nostr.py

+    ).pubkey.hex()
+
+
+@expect(messages.NostrEventSignature)


per #4490 please drop the @expect and replace with client.call(..., expect=NostrEventSignature)
dtto for get_pubkey

a95dc04#diff-d0a53275e15314e83ef900790cfdd6af05df702377562408a76287ae1507a853R36

matejcik · 2025-01-21T11:58:04Z

tests/device_tests/nostr/test_nostr.py

+def test_sign_event(client, pubkey_hex):
+    response = nostr.sign_event(
+        client,
+        messages.NostrSignEvent(


would it make sense to move this construction to top level directly?

a95dc04#diff-1a61ba923388ca946c730e9cec2ca549a97e355ff7a53673617057d39f95f0f5R72

ibz self-assigned this Dec 10, 2024

ibz force-pushed the ibz/nostr branch from 7148b04 to 4f32cb3 Compare December 10, 2024 12:45

ibz linked an issue Dec 10, 2024 that may be closed by this pull request

Add app/feature to sign Nostr messages using m/44'/1237'/* keys. #4160

Open

ibz force-pushed the ibz/nostr branch 3 times, most recently from de9d4e4 to bd13fed Compare December 11, 2024 11:44

ibz changed the title ~~feat(core): add nostr event signing~~ Add Nostr Dec 11, 2024

ibz force-pushed the ibz/nostr branch 2 times, most recently from 9ef8c6a to feabb03 Compare December 11, 2024 14:40

prusnak reviewed Dec 11, 2024

View reviewed changes

prusnak reviewed Dec 12, 2024

View reviewed changes

ibz force-pushed the ibz/nostr branch 3 times, most recently from d66d0af to 8bc5409 Compare December 18, 2024 10:19

ibz marked this pull request as ready for review December 18, 2024 11:24

ibz requested a review from matejcik as a code owner December 18, 2024 11:24

ibz force-pushed the ibz/nostr branch from 7822ca3 to 4076b62 Compare December 19, 2024 08:48

ibz requested a review from martykan December 19, 2024 10:29

obrusvit reviewed Dec 19, 2024

View reviewed changes

common/protob/messages-nostr.proto Outdated Show resolved Hide resolved

common/protob/messages-nostr.proto Outdated Show resolved Hide resolved

core/src/apps/nostr/sign_event.py Show resolved Hide resolved

core/src/apps/nostr/sign_event.py Outdated Show resolved Hide resolved

ibz changed the title ~~Add Nostr~~ Introduce Nostr Dec 19, 2024

ibz force-pushed the ibz/nostr branch from 126dc0b to af4f669 Compare January 7, 2025 11:27

matejcik reviewed Jan 13, 2025

View reviewed changes

ibz added 5 commits January 20, 2025 12:35

feat(core): add nostr

3a8656e

fixup! feat(core): add nostr

dda3d85

fixup! feat(core): add nostr

7c6f3b5

fixup! feat(core): add nostr

b975659

fixup! feat(core): add nostr

b916d45

ibz added 12 commits January 20, 2025 12:35

feat(core/ui): add basic confirmation for Nostr signing

564cf57

[no changelog]

fixup! fixup! feat(core): add nostr

de2f3f1

fixup! feat(core): add nostr

b8fd48f

fixup! fixup! feat(core): add nostr

6bbd471

fixup! feat(core): add nostr

dded1e2

fixup! fixup! feat(core): add nostr

1e48dfc

fixup! feat(core): add nostr

0791404

chore(core/nostr): remove Nostr from production build

a83f8fe

[no changelog]

fixup! feat(core/ui): add basic confirmation for Nostr signing

d6e6a57

fixup! feat(core): add nostr

c1fac9d

fixup! feat(core): add nostr

7f493ea

fixup! chore(core/nostr): remove Nostr from production build

339471f

ibz force-pushed the ibz/nostr branch from af4f669 to 339471f Compare January 21, 2025 08:31

chore(core): improve error message

6806267

[no changelog]

ibz force-pushed the ibz/nostr branch from 3e8b37b to 6806267 Compare January 21, 2025 08:58

fixup! feat(core): add nostr

ff8be7a

matejcik requested changes Jan 21, 2025

View reviewed changes

ibz added 2 commits January 22, 2025 17:45

fixup! feat(core): add nostr

a95dc04

chore(core): use BIP-340 to sign Nostr events

45d4ee0

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Introduce Nostr #4436

Introduce Nostr #4436

ibz commented Dec 10, 2024 •

edited

Loading

github-actions bot commented Dec 10, 2024 •

edited

Loading

prusnak commented Dec 11, 2024 •

edited

Loading

prusnak Dec 12, 2024

prusnak Dec 12, 2024 •

edited

Loading

ibz Dec 19, 2024

prusnak Jan 13, 2025

ibz Jan 21, 2025

ibz commented Dec 18, 2024

obrusvit left a comment

matejcik Jan 13, 2025

ibz Jan 21, 2025

matejcik Jan 21, 2025

ibz Jan 21, 2025

matejcik Jan 21, 2025

ibz Jan 21, 2025

matejcik Jan 21, 2025

ibz Jan 22, 2025

matejcik Jan 13, 2025

ibz Jan 21, 2025

ibz Jan 21, 2025

matejcik Jan 21, 2025

matejcik Jan 21, 2025

ibz Jan 21, 2025

matejcik Jan 21, 2025

ibz Jan 22, 2025

matejcik Jan 21, 2025

ibz Jan 22, 2025

matejcik Jan 21, 2025

ibz Jan 22, 2025

matejcik Jan 21, 2025

ibz Jan 22, 2025



		@pytest.mark.setup_client(mnemonic=LEAD_MONKEY_MNEMONIC)
		def test_sign_event_lead_monkey(client: Client):

		).pubkey.hex()


		@expect(messages.NostrEventSignature)

Introduce Nostr #4436

Are you sure you want to change the base?

Introduce Nostr #4436

Conversation

ibz commented Dec 10, 2024 • edited Loading

Firmware

UI

Trezor Safe 5

Trezor Safe 3

Trezor Model T

trezorctl

get-pubkey

sign-event

github-actions bot commented Dec 10, 2024 • edited Loading

prusnak commented Dec 11, 2024 • edited Loading

Choose a reason for hiding this comment

prusnak Dec 12, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ibz commented Dec 18, 2024

obrusvit left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ibz commented Dec 10, 2024 •

edited

Loading

github-actions bot commented Dec 10, 2024 •

edited

Loading

prusnak commented Dec 11, 2024 •

edited

Loading

prusnak Dec 12, 2024 •

edited

Loading