Practical Attacks on Nostr, a Decentralized Censorship-Resistant Protocol

Overview: H. Kuma from Japan's National Institute of Information and Communications Technology (NICT) presents a security evaluation of Nostr, an open, decentralized social networking protocol. The research analyzes how shifting trust and verification entirely from central servers to client applications creates severe attack surfaces across diverse implementations. Covering 56 Nostr Implementation Possibilities (NIPs) and 9 client applications, the talk discloses 7 distinct vulnerabilities and demonstrates 8 practical attack vectors breaking integrity, confidentiality, and financial transactions.

Key Topics: - Nostr protocol architecture, Schnorr signatures, and untrusted relay models - Complete signature verification omission in popular mobile clients - Signature verification cache poisoning and event forgery in Damus - Cryptographic weaknesses in NIP-04 encrypted direct messaging - Micro-payment and Bitcoin/Lightning Network tipping (NIP-57) hijacking

Technical Details: Nostr relies on public/private key pairs over secp256k1 with Schnorr signatures, routing JSON events through distributed relay servers that store and forward messages without requiring cryptographic verification. The speaker demonstrated that because relays do not validate signatures by default, the entire burden of cryptographic integrity rests on client applications. In several mobile clients, developers completely omitted Schnorr signature verification routines—frequently to preserve device battery life or reduce CPU overhead. This omission enables attackers to inject forged events, impersonate arbitrary users, modify public profiles, and falsify posts across the network.

In more sophisticated clients like Damus (a prominent iOS Nostr client), the author discovered an integrity bypass stemming from improper caching logic. Before executing cryptographic signature verification, Damus checks an internal event cache to determine if an event ID has already been verified. Because the client failed to rehash the event content to verify that the event ID cryptographically matched the payload, an attacker could supply modified event content paired with a previously cached, verified event ID. This cache-poisoning vulnerability allowed attackers to silently alter public user profiles, substituting the victim's displayed Bitcoin address with an attacker-controlled address.

The research also uncovered critical cryptographic flaws in NIP-04, the standard for encrypted direct messages (DMs). NIP-04 utilizes Elliptic Curve Diffie-Hellman (ECDH) key exchange combined with AES in Cipher Block Chaining (CBC) mode without an authenticated message authentication code (MAC) or AEAD scheme. Attackers can execute AES-CBC bit-flipping attacks. By executing a cross-protocol attack against Nostr's delegation protocol (used for multi-device signing via QR codes), the researcher obtained paired plaintext and ciphertext metadata, enabling practical message injection and invoice manipulation without knowing the victim's private key. Combined with profile tampering, these exploits allow attackers to hijack NIP-57 micropayments and redirect Lightning Network tips.

Key Takeaways: Decentralized social networking protocols must mandate rigorous client-side cryptographic verification, strictly prohibiting the display of unverified events or caching mechanisms that decouple event IDs from content hashes. Encrypted messaging standards like NIP-04 must deprecate unauthenticated AES-CBC in favor of Authenticated Encryption with Associated Data (AEAD) such as AES-GCM or ChaCha20-Poly1305. Relay implementations should perform baseline signature and schema validation to filter malicious payloads, and payment protocols (NIP-57) must bind payment invoices cryptographically to verified recipient public keys.

(AI summary — Gemini Flash)