paulmillr
Paul Miller

https://paulmillr.com

Noble cryptography. OSS, infosec.

Public Key

npub10jcnehsxwrjepupvh602pl83up0dh3wv3fqfwv062smygqvpeuwsk03kag

NIP-05 Address

paul@paulmillr.com

Profile Code

nprofile1qqs8evfumcr8pevs7qkta84qlnc7qhkmchxg5syhx8a9gdjyqxqu78gpp4mhxue69uhkummn9ekx7mq4j499e

Publishing to

nos.lol

Author Public Key

npub10jcnehsxwrjepupvh602pl83up0dh3wv3fqfwv062smygqvpeuwsk03kag

Show more details

Last Notes

2025-08-28 23:10:20 UTC

- reply

Falcon is 4+ weeks of full time work. It's also unreliable while being implemented, due to the fact it needs floating point math. Maybe fips 206 will fix quirks.

2025-08-27 10:34:42 UTC

noble cryptography v2 is out. Improvements include Schnorr implementation in 5kb noble-secp256k1, hybrid pq algorithms, OPRFs, friendly wrappers around native WebCrypto, better security, and much more.
Live on GitHub, NPM & JSR.

2025-07-10 17:49:02 UTC

- reply

Low-level - yes, it's a good idea to use it for a media.

2024-06-06 22:29:10 UTC

#WeAreAllFiatjaf

2024-04-13 15:04:48 UTC

Announcing noble-post-quantum: minimal JS implementation of ML-KEM, ML-DSA and SLH-DSA.
Also known as Kyber, Dilithium and SPHINCS+. Only 2000 lines of code - great learning resource for anyone who’s messing with PQ stuff.
Check out README for algorithm comparison and usage guidelines. https://github.com/paulmillr/noble-post-quantum

2024-01-07 07:02:34 UTC

- reply

I have it in noble-curves readme https://github.com/paulmillr/noble-curves#weierstrass-short-weierstrass-curve

2023-12-31 19:53:51 UTC

2023 progress on JS cryptography:
- noble-hashes: 400K => 1.7M downloads per week
- noble-curves: ~0 => 0.9M, got 2 audits
- noble-ciphers: 0 => 25K
- Finally adopted by ProtonMail, MetаMасk, Rainbow, Rabby, ethers, web3.js, viem
Takes time, but we’re getting there.

2023-12-21 21:18:36 UTC

- reply

sphincs looks good, kyber not quite. I think Signal's decision is proper and other should follow, because it's hybrid. In the end, everything is a placeholder, and the only question is: "for how long?".

2023-12-21 16:07:27 UTC

- reply

Please check out this writing https://blog.cryptographyengineering.com/2020/07/10/a-few-thoughts-about-signals-secure-value-recovery/

2023-12-21 15:54:04 UTC

- reply

> We're sacrificing almost all the values we stand for
I'm not sure what are you talking about. SimpleX is not a silver bullet. It's trivially decrypt-able by quantum computers. It's also not popular, which means, if/when it becomes popular, only then we'll see how it holds up.
Again - if you think simplex would work - go ahead and implement it. If you can convince the community your solution is better, everyone will switch to it.
nostr is open for everyone. We're just a bunch of folks who've spent some time on the issue we thought was important. No one paid us for it.

2023-12-21 15:38:05 UTC

- reply

It's possible to deduce who messages whom (timing / correlation attack). All user contacts are uploaded to Signal servers (they say it's stored in SGX - which may be broken). Groups also store some data on Signal servers. And - most important - Signal relies on phone numbers.

2023-12-21 15:34:01 UTC

- reply

https://github.com/paulmillr/nip44

2023-12-21 15:33:38 UTC

- reply

Also there's a separate "gift wrap" NIP which seems to solve the problem.

2023-12-21 15:32:51 UTC

- reply

It's not as good as Signal for now - but it's open and permissionless.

2023-12-21 15:32:39 UTC

- reply

I think we can eat some share of other messengers, yes. It's not as good as Signal for now - but it's open and permissionless.

2023-12-21 15:30:33 UTC

- reply

It was discussed. SimpleX is extremely complicated. It's barely maintained. For example, for JS there is https://github.com/simplex-chat/simplexmq-js - but as per SimpleX founder words, it's abandoned and represents less than 5% of required code.
For comparison, full NIP-44 js implementation fits in just ~100 lines.
SimpleX is not a solution for nostr. Integrating simplex server functionality into relays is also extremely complicated. If you think you can do this - submit a proposal, and write some code, but it doesn't seem to be worth it.

2023-12-21 15:25:22 UTC

- reply

He consulted on some ideas, yes.

2023-12-21 15:24:54 UTC

- reply

The problem you're mentioning (metadata leakage) can't be solved by cryptography alone.
It's solved separately by specifying which relays can be responsible for your DMs. You will set up a preferred DM relay and only this relay would be used for all chats.

2023-12-20 22:41:09 UTC

- reply

Yes, the audit requests have been incorporated into the current version.

2023-12-20 22:24:10 UTC

- reply

There is no certainty. Two words for you: Cheon's attack.

2023-12-20 19:36:19 UTC

- reply

We've discussed this on GitHub for most of 2023. If you've had any comments or suggestions, you could have voiced them. This is a community effort. Don't like it? Build something better.

2023-12-20 19:30:10 UTC

- reply

Correct! Threat of "Harvest now, decrypt later" is real.

2023-12-20 19:11:47 UTC

- reply

Ask other cryptographers what they think about NIP-04. NIP-44 took many weeks of work by different people and an audit by an indie company. It's the first step. We can add one feature at a time, since we have versioning now. FS is also not "everything": even with it, all signal messages would be decrypted by a powerful quantum computer.

2023-12-20 19:04:42 UTC

- reply

https://github.com/paulmillr/nip44 => all good. If your nostr client doesn't see a valid URL in the post, create a bug report.

2023-12-20 18:48:26 UTC

- reply

The goal is to add more features later. FS does not protect against quantum computers, which will decrypt all previous signal conversations. FS does not protect against metadata leakage, which is present in both nostr and signal.

2023-12-20 18:37:03 UTC

Signal is cool, but do you know what is cooler? Chatting on decentralized social network. We’ve implemented and audited end-to-end encrypted direct messaging for nostr.  
 Thanks to Jon (npub1jlrs53pkdfjnts29kveljul2sm0actt6n8dxrrzqcersttvcuv3qdjynqn), OpenSats, Michael (npub1acg6thl5psv62405rljzkj8spesceyfz2c32udakc2ak0dmvfeyse9p35c), ekzyis (npub16x07c4qz05yhqe2gy2q2u9ax359d2lc0tsh6wn3y70dmk8nv2j2s96s89d), Vitor (npub1gcxzte5zlkncx26j68ez60fzkvtkm9e0vrwdcvsjakxf9mu9qewqlfnj5z), Cure53, Matthew Green and everyone else involved.
 https://github.com/nostr-protocol/nips/blob/master/44.md, https://github.com/paulmillr/nip44

2023-09-21 22:17:09 UTC

Signal is upgrading all conversations to a combination of X25519 and CRYSTALS-Kyber. Probably the first large-scale deployment of Kyber. https://signal.org/blog/pqxdh/

2023-08-12 16:12:08 UTC

Someone published NPM fork of noble-curves that sent private keys to a server in China. Be careful and check for typos https://blog.phylum.io/typosquat-of-popular-ethereum-package-steals-private-keys/

2023-07-11 00:28:16 UTC

Ever wanted a privacy-focused nostr web client? http://nostr.spa (https://paulmillr.com/demos/nostr) got you covered! It’s simple, open-source, and does not require a private key. You can even send messages, pre-signed somewhere else.

2023-06-29 00:47:43 UTC

Announcing noble-ciphers: tiny 0-dependency cryptographic library, implementing Salsa20, ChaCha, Poly1305, AES-SIV and others. Bonus: a reasonable wrapper around native WebCrypto's AES. Check out its README for some insights: https://github.com/paulmillr/noble-ciphers

2023-06-03 15:24:02 UTC

New noble cryptography releases are out:
- NPM provenance is now used for transparent builds, to strengthen supply chain security [1]
- ed25519 and ed448 now provide non-repudiation (Strongly Binding Signatures). The feature is not present in most other libraries [2]
- tweetnacl users (including DJB's C version): it's time to switch away. It does not provide SUF-CMA, meaning, in some circumstances, the signatures are malleable [3]
1.https://github.blog/2023-04-19-introducing-npm-package-provenance/
2. https://csrc.nist.gov/csrc/media/Presentations/2023/crclub-2023-03-08/images-media/20230308-crypto-club-slides--taming-the-many-EdDSAs.pdf
3.https://blog.cryptographyengineering.com/euf-cma-and-suf-cma/

2023-05-11 09:50:35 UTC

Twitter launched encrypted* DMs for verified accounts.
* No sync
* No group chats
* No attachments
* No timers
* Vulnerable to MITM
* No reporting (msg franking)
* No Forward Secrecy
* No Key Transparency
* Private keys are NOT erased after web logout
https://help.twitter.com/en/using-twitter/encrypted-direct-messages

2023-04-13 12:16:33 UTC

Elliptic curve calculator just got a new big update:
1. Select a curve, including NIST, ed448, BLS
2. Create custom curves
3. Add and multiply points
4. Sign messages with different hashes
The demo works offline. It’s great for learning! Check it out:
https://paulmillr.com/noble/

2023-03-24 10:58:20 UTC

4KB cryptography. Does that sound safe? Because it should.
Announcing v2 of single-feature modules noble secp256k1 and noble ed25519. secp is just 430 lines of code (4KB gzipped), ed is only 330 lines (3.3KB gzipped) — 4x smaller than previous versions.
Tweetnacl was a great idea. Smaller attack surface means less things that could go wrong. New libraries develop the concept further: there are tons of comments everywhere, describing how things work - makes it much easier for cryptography newcomers to read.
https://github.com/paulmillr/noble-secp256k1
https://github.com/paulmillr/noble-ed25519

2023-02-17 14:11:02 UTC

@npub1teawtzxh6y02cnp9jphxm2q8u6xxfx85nguwg6ftuksgjctvavvqnsgq5u Verifying My Public Key: "paulmillr"

2023-02-16 22:10:57 UTC

Hello, world. Message made with #noble-crypto