nwc-ruby 0.3.1 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1d4c011d51eac1622cceede610301765731ca586ffddea5a3e99cbeba7fdd28e
-  data.tar.gz: 68b349cd70ae9d423111a6d4b04c3c6bf088e100a6cad066c93504b0cd078ca0
+  metadata.gz: e2d94a88c6465f4422539d861f346b8d7ab7726d2805be0c4b9d0705b6dd9399
+  data.tar.gz: ae16489410ce6cb3663a93c3aa5e20b84ff9c920294cebb5ab690a00f12da1f0
 SHA512:
-  metadata.gz: da57ea11db970c08836488cd99a617b85ddff08242facb3c5f2d5984957507ab87597f5b6d9844134550f46b209c97e13163345b2c419b2968392c486848a637
-  data.tar.gz: fb90130f2bdd51bb5e650e2b772979ce5573dcd19363d5a8bcebb5f5df17baab29c51401faea95fb9eca64ec06e5335078d95a373556664b715813b61e77730c
+  metadata.gz: d91f00c5dc93b17b8c6eb9cbcdc0e3a31175fcd1b0ddcb843bd3fd3a58948cdbe1844a5f0dcf3e363915eb6339071b9f3691c564f66362eb96f3431dea1b3db3
+  data.tar.gz: 3169a1dd02f32a5bbefd6c03b037e35acbd3773922d88c145fad408b8fc18d4bd5a1b4c26e5aed34909a036750c81f64db4264e38cfca5367516796ee0b23a65

data/CHANGELOG.md

@@ -7,6 +7,77 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.5.0] — 2026-11-08
+
+### Changed
+
+- **ECDH is native, about 58x faster.** NIP-04 and NIP-44 v2 derive their
+  keys from an ECDH that this gem computed as pure-Ruby scalar multiplication
+  with the `ecdsa` gem. It now runs in OpenSSL through Ruby's built-in
+  `openssl` library: 34.3 ms → 0.60 ms per ECDH on an Apple-silicon laptop
+  (Docker, aarch64 Linux, Ruby 3.4.9, OpenSSL 3.5.6). A `Client` built per
+  request gains the most; a reused `Client` has run ECDH once per connection
+  since 0.4.0. The output is byte-for-byte unchanged: checked against the
+  0.4.0 code on 6,171 key pairs (including private keys and shared X values
+  with leading zero bytes) and against paulmillr's NIP-44 vectors. OpenSSL
+  also multiplies secret scalars with a constant-time ladder, which the
+  `ecdsa` gem did not.
+
+### Removed
+
+- The `ecdsa` runtime dependency, along with `NwcRuby::Crypto::ECDH.lift_x`
+  and `ECDH::GROUP`. OpenSSL now decodes the peer's even-Y point from
+  `02 || x`.
+
+### Added
+
+- `NwcRuby::CryptoUnavailableError`, raised when this Ruby's OpenSSL cannot
+  do secp256k1 ECDH, e.g. in FIPS mode. It is deliberately not an
+  `EncryptionError`, which the notification listener treats as one bad
+  message and skips. `NwcRuby::Crypto::ECDH.available?` checks ahead of time.
+- Specs: paulmillr's full `nip44.vectors.json`, pinned to the SHA-256 that
+  NIP-44 publishes (all 35 valid and 8 invalid `get_conversation_key`
+  vectors, all 10 `encrypt_decrypt` vectors), and ECDH specs checked against
+  libsecp256k1's point multiplication.
+
+### Fixed
+
+- `ECDH.shared_x` rejects an out-of-range private key with `EncryptionError`
+  ("private key out of range"). Before, 0 or n raised a bare `ArgumentError`
+  and a key above n was silently reduced mod n. Off-curve and out-of-range
+  public keys raise the same `EncryptionError` messages as before.
+
+## [0.4.0] — 2026-10-20
+
+### Changed
+
+- **Each connection now derives its encryption key once, not on every
+  message.** NIP-04 and NIP-44 v2 both start from an ECDH that this gem runs
+  as pure-Ruby scalar multiplication: about 33 ms on an Apple-silicon laptop,
+  more on a typical server vCPU. Every request ran it twice (encrypting the
+  request, decrypting the response) and every notification once. The result
+  depends only on the client secret and the wallet pubkey, both fixed when the
+  connection string is parsed, so `ConnectionString#conversation` now computes
+  it on first use and keeps it. A `Client` reused across calls pays for ECDH
+  once in its lifetime. Nonces and IVs are still drawn fresh for every
+  message, and the wire format is unchanged.
+- A response that fails NIP-44 decryption and falls back to NIP-04 reuses the
+  same ECDH instead of running it a second time.
+
+### Added
+
+- `NwcRuby::Crypto::Conversation`: the NIP-04 and NIP-44 v2 keys for one
+  (private key, public key) pair, derived lazily and cached. A bad key raises
+  at first use, as before, and a failure is not cached.
+- `NIP44::Cipher.encrypt_with` / `decrypt_with` and
+  `NIP04::Cipher.encrypt_with` / `decrypt_with`, which take a `Conversation`
+  in place of the two hex keys. The existing `encrypt` / `decrypt` signatures
+  are unchanged.
+- An optional `conversation:` keyword on `NIP47::Request.build`,
+  `NIP47::Response.parse` and `NIP47::Notification.parse`.
+- Specs against paulmillr's `get_conversation_key` and `encrypt_decrypt`
+  NIP-44 vectors.
+
 ## [0.3.1] — 2026-10-05
 
 ### Fixed

data/README.md

@@ -166,6 +166,15 @@ If you see `LoadError: cannot load such file -- secp256k1` at runtime, the
 native extension wasn't compiled. Install the build dependencies above and
 run `gem pristine rbsecp256k1` (or re-run `bundle install`) to rebuild it.
 
+NIP-04 and NIP-44 encryption run their ECDH through Ruby's built-in `openssl`,
+which needs an OpenSSL that allows secp256k1. Standard builds do. OpenSSL in
+FIPS mode does not, and then every encrypt and decrypt raises
+`NwcRuby::CryptoUnavailableError`. To check at boot:
+
+```ruby
+NwcRuby::Crypto::ECDH.available? # => true
+```
+
 ---
 
 ## Usage
@@ -528,6 +537,11 @@ the request is written to the relay are retried across every `relay` in the
 connection string, with 0.25 s / 1 s backoff, inside `request_timeout`.
 Nothing is ever retried after the request is written.
 
+Build one `Client` per connection string and reuse it. It caches the wallet's
+info event (a relay round trip) and the connection's encryption key (an ECDH,
+under a millisecond), so only its first call pays for them; a `Client` built
+per request pays for both on every call.
+
 Introspection:
 
 | Method            | Returns                                  |
@@ -577,6 +591,9 @@ the original is kept as `#cause`.
 
 - `InvalidConnectionStringError` — the URI couldn't be parsed.
 - `EncryptionError` — bad MAC / bad padding / unknown version byte / bad key.
+- `CryptoUnavailableError` — this Ruby's OpenSSL can't do secp256k1 ECDH
+  (FIPS mode, or a build without the curve), so nothing can be encrypted or
+  decrypted. Retrying won't help.
 - `InvalidSignatureError` — an event's signature did not verify.
 - `TransportError` — the connection failed **after** the request was written
   to the relay. The wallet may have acted on it: reconcile with

data/lib/nwc_ruby/client.rb

@@ -207,7 +207,8 @@ module NwcRuby
         last_seen_at = event.created_at if event.created_at && event.created_at > last_seen_at
 
         begin
-          notification = NIP47::Notification.parse(event, @connection_string.secret, @connection_string.wallet_pubkey)
+          notification = NIP47::Notification.parse(event, @connection_string.secret, @connection_string.wallet_pubkey,
+                                                   conversation: @connection_string.conversation)
         rescue EncryptionError => e
           @logger.warn("[nwc] could not decrypt notification: #{e.message}")
           next
@@ -282,7 +283,8 @@ module NwcRuby
         params: params,
         client_privkey: @connection_string.secret,
         wallet_pubkey: @connection_string.wallet_pubkey,
-        encryption: @info.preferred_encryption
+        encryption: @info.preferred_encryption,
+        conversation: @connection_string.conversation
       )
 
       response = with_relays(deadline) { |url| send_request(url, deadline, method, request_event) }
@@ -328,7 +330,8 @@ module NwcRuby
         event = relay_event(parsed, sub_id)
         next unless event && event.kind == NIP47::Methods::KIND_RESPONSE && response_to?(event, request_id)
 
-        return NIP47::Response.parse(event, @connection_string.secret, @connection_string.wallet_pubkey)
+        return NIP47::Response.parse(event, @connection_string.secret, @connection_string.wallet_pubkey,
+                                     conversation: @connection_string.conversation)
       end
       raise TransportError, 'relay closed the connection before the wallet responded'
     end

data/lib/nwc_ruby/connection_string.rb

@@ -53,6 +53,13 @@ module NwcRuby
       @client_pubkey ||= Crypto::Keys.public_key_from_private(@secret)
     end
 
+    # Encryption keys for this client/wallet pair. Both inputs are fixed at
+    # parse time, so the ECDH behind them runs once per connection string
+    # rather than on every request, response and notification.
+    def conversation
+      @conversation ||= Crypto::Conversation.new(@secret, @wallet_pubkey)
+    end
+
     def to_s
       params = { 'relay' => @relays, 'secret' => [@secret] }
       params['lud16'] = [@lud16] if @lud16

data/lib/nwc_ruby/crypto/conversation.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+module NwcRuby
+  module Crypto
+    # The symmetric keys for one (our private key, their public key) pair.
+    #
+    # NIP-04 and NIP-44 v2 both start from the same ECDH, the costliest step
+    # here (a scalar multiplication) and one that depends only on the two
+    # keys. This object runs it once, on first use, and keeps the result.
+    # Per-message randomness is unaffected: NIP-44 still draws a fresh nonce
+    # and NIP-04 a fresh IV on every encrypt.
+    #
+    # Nothing is computed in `initialize`, so a bad key raises at first use,
+    # exactly where the uncached path raises it, and a failure is not cached.
+    class Conversation
+      def initialize(privkey_hex, pubkey_hex)
+        @privkey_hex = privkey_hex
+        @pubkey_hex  = pubkey_hex
+      end
+
+      # NIP-04's AES-256 key: the raw shared X coordinate.
+      def nip04_key
+        @nip04_key ||= ECDH.shared_x(@privkey_hex, @pubkey_hex)
+      end
+
+      # NIP-44 v2's conversation key: HKDF-extract over the same shared X.
+      def nip44_key
+        @nip44_key ||= NIP44::Cipher.hkdf_extract(NIP44::Cipher::SALT.b, nip04_key)
+      end
+    end
+  end
+end

data/lib/nwc_ruby/crypto/ecdh.rb

@@ -1,7 +1,6 @@
 # frozen_string_literal: true
 
-require 'rbsecp256k1'
-require 'ecdsa'
+require 'openssl'
 
 module NwcRuby
   module Crypto
@@ -9,45 +8,119 @@ module NwcRuby
     # their x-only public key.
     #
     # CRITICAL: Nostr ECDH returns the **X coordinate of the shared point only**
-    # (32 bytes). This differs from libsecp256k1's default `ecdh()` function,
-    # which returns SHA256(compressed_point). We have to do the multiplication
-    # ourselves using the `ecdsa` gem.
+    # (32 bytes). libsecp256k1's `ecdh()` returns SHA256(compressed_point)
+    # instead, and rbsecp256k1 hard-codes that hash, so it can't be used here.
+    # OpenSSL's ECDH returns the raw X coordinate, left-padded to 32 bytes.
     #
     # This is used by both NIP-04 (as the AES key directly) and NIP-44 v2 (as
     # the IKM for HKDF).
     module ECDH
       module_function
 
-      GROUP = ::ECDSA::Group::Secp256k1
+      # secp256k1 field prime and group order (SEC 2, section 2.4.1).
+      P = 0xFFFFFFFF_FFFFFFFF_FFFFFFFF_FFFFFFFF_FFFFFFFF_FFFFFFFF_FFFFFFFE_FFFFFC2F
+      N = 0xFFFFFFFF_FFFFFFFF_FFFFFFFF_FFFFFFFE_BAAEDCE6_AF48A03B_BFD25E8C_D0364141
+
+      # Numeric OIDs, so nothing depends on OpenSSL's curve-name table.
+      SECP256K1_OID = '1.3.132.0.10'
+      EC_PUBLIC_KEY_OID = '1.2.840.10045.2.1'
+
+      # X coordinate of the generator G, for the self-test in `available?`.
+      GX_HEX = '79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798'
 
       # Returns the raw 32-byte X coordinate of the shared point.
       #
       # @param privkey_hex [String] our 32-byte private key (hex)
       # @param xonly_pubkey_hex [String] their 32-byte x-only public key (hex)
       # @return [String] 32 raw bytes (binary-encoded)
+      # @raise [EncryptionError] if either key is out of range or the public
+      #   key is not on the curve
+      # @raise [CryptoUnavailableError] if this OpenSSL lacks secp256k1
       def shared_x(privkey_hex, xonly_pubkey_hex)
         Keys.validate_hex32!(privkey_hex, 'private key')
         Keys.validate_hex32!(xonly_pubkey_hex, 'public key')
 
-        # BIP-340 x-only pubkeys always correspond to the even-Y lifted point.
-        pubkey_point = lift_x(Keys.hex_to_bytes(xonly_pubkey_hex).unpack1('H*').to_i(16))
-        priv_int     = privkey_hex.to_i(16)
+        d = privkey_hex.to_i(16)
+        raise EncryptionError, 'private key out of range' if d.zero? || d >= N
 
-        shared_point = pubkey_point.multiply_by_scalar(priv_int)
-        [shared_point.x.to_s(16).rjust(64, '0')].pack('H*')
+        x = xonly_pubkey_hex.to_i(16)
+        raise EncryptionError, 'x out of range' if x.zero? || x >= P
+
+        ensure_available!
+        derive(Keys.hex_to_bytes(privkey_hex), Keys.hex_to_bytes(xonly_pubkey_hex))
       end
 
-      # BIP-340 "lift_x": given an x coordinate, return the point with even Y.
-      def lift_x(x)
-        raise EncryptionError, 'x out of range' if x.zero? || x >= GROUP.field.prime
+      # Whether this Ruby's OpenSSL can do secp256k1 ECDH. Some builds leave
+      # the curve out, and FIPS mode refuses it. Under RHEL 9's FIPS provider
+      # the curve's group still loads and only the key operations fail, so
+      # this runs a real ECDH with a known answer (1 * G has X coordinate GX)
+      # instead of looking the curve up. Checked once per process.
+      def available?
+        return @available unless @available.nil?
 
-        p   = GROUP.field.prime
-        c   = (x.pow(3, p) + 7) % p
-        y   = c.pow((p + 1) / 4, p)
-        raise EncryptionError, 'x is not on the curve' unless y.pow(2, p) == c
+        gx = Keys.hex_to_bytes(GX_HEX)
+        @available = begin
+          derive(Keys.hex_to_bytes("#{'0' * 63}1"), gx) == gx
+        rescue EncryptionError
+          false
+        end
+      end
+
+      def ensure_available!
+        return if available?
+
+        reason = if ::OpenSSL.fips_mode
+                   'OpenSSL is in FIPS mode, which does not allow it'
+                 else
+                   'this OpenSSL build lacks it'
+                 end
+        raise CryptoUnavailableError,
+              "secp256k1 ECDH is unavailable in #{::OpenSSL::OPENSSL_LIBRARY_VERSION} (#{reason}); " \
+              'NIP-04 and NIP-44 encryption both need it'
+      end
+
+      # ECDH on validated, in-range inputs. The peer is the even-Y point with
+      # X coordinate `x_bytes` (BIP-340 lift_x), encoded as "02" || x.
+      def derive(d_bytes, x_bytes)
+        theirs = begin
+          ::OpenSSL::PKey.read(public_key_der(x_bytes))
+        rescue ::OpenSSL::OpenSSLError
+          raise EncryptionError, 'x is not on the curve'
+        end
+
+        begin
+          secret = ::OpenSSL::PKey.read(private_key_der(d_bytes)).derive(theirs)
+        rescue ::OpenSSL::OpenSSLError => e
+          raise EncryptionError, "ECDH failed: #{e.message}"
+        end
+        raise EncryptionError, "ECDH returned #{secret.bytesize} bytes, expected 32" unless secret.bytesize == 32
+
+        secret
+      end
+
+      # SubjectPublicKeyInfo (RFC 5480) for the compressed point "02" || x.
+      def public_key_der(x_bytes)
+        ::OpenSSL::ASN1::Sequence.new(
+          [
+            ::OpenSSL::ASN1::Sequence.new(
+              [::OpenSSL::ASN1::ObjectId.new(EC_PUBLIC_KEY_OID), ::OpenSSL::ASN1::ObjectId.new(SECP256K1_OID)]
+            ),
+            ::OpenSSL::ASN1::BitString.new("\x02".b + x_bytes)
+          ]
+        ).to_der
+      end
 
-        y = p - y if y.odd?
-        GROUP.new_point([x, y])
+      # ECPrivateKey (RFC 5915) holding exactly 32 bytes of scalar, leading
+      # zeros included. The optional publicKey field is left out; OpenSSL
+      # derives it from the scalar.
+      def private_key_der(d_bytes)
+        ::OpenSSL::ASN1::Sequence.new(
+          [
+            ::OpenSSL::ASN1::Integer.new(1),
+            ::OpenSSL::ASN1::OctetString.new(d_bytes),
+            ::OpenSSL::ASN1::ObjectId.new(SECP256K1_OID, 0, :EXPLICIT)
+          ]
+        ).to_der
       end
     end
   end

data/lib/nwc_ruby/errors.rb

@@ -11,9 +11,17 @@ module NwcRuby
   # The connection string is missing or malformed.
   class InvalidConnectionStringError < Error; end
 
-  # Encryption / decryption failed (bad MAC, bad padding, unknown version byte).
+  # Encryption / decryption failed (bad MAC, bad padding, unknown version
+  # byte, or a key that is out of range or not on the curve).
   class EncryptionError < Error; end
 
+  # This Ruby's OpenSSL cannot do secp256k1 ECDH, which NIP-04 and NIP-44
+  # both need: FIPS mode refuses the curve, and some builds leave it out.
+  # Unlike `EncryptionError` this is not about one message: nothing can be
+  # encrypted or decrypted in this process. `Crypto::ECDH.available?` checks
+  # ahead of time.
+  class CryptoUnavailableError < Error; end
+
   # Signature verification failed on an inbound event.
   class InvalidSignatureError < Error; end
 

data/lib/nwc_ruby/nip04/cipher.rb

@@ -14,11 +14,17 @@ module NwcRuby
       module_function
 
       def encrypt(plaintext, privkey_hex, pubkey_hex)
-        key = Crypto::ECDH.shared_x(privkey_hex, pubkey_hex)
-        iv  = SecureRandom.bytes(16)
+        encrypt_with(plaintext, Crypto::Conversation.new(privkey_hex, pubkey_hex))
+      end
+
+      # `encrypt`, reusing the conversation's cached key instead of redoing ECDH.
+      #
+      # @param conversation [Crypto::Conversation]
+      def encrypt_with(plaintext, conversation)
+        iv = SecureRandom.bytes(16)
 
         cipher = OpenSSL::Cipher.new('aes-256-cbc').encrypt
-        cipher.key = key
+        cipher.key = conversation.nip04_key
         cipher.iv  = iv
         ct = cipher.update(plaintext.encode('UTF-8')) + cipher.final
 
@@ -26,6 +32,14 @@ module NwcRuby
       end
 
       def decrypt(payload, privkey_hex, pubkey_hex)
+        decrypt_with(payload, Crypto::Conversation.new(privkey_hex, pubkey_hex))
+      end
+
+      # `decrypt`, reusing the conversation's cached key instead of redoing
+      # ECDH. The payload is checked before the key is touched.
+      #
+      # @param conversation [Crypto::Conversation]
+      def decrypt_with(payload, conversation)
         raise EncryptionError, 'malformed NIP-04 payload' unless payload.include?('?iv=')
 
         ct_b64, iv_b64 = payload.split('?iv=', 2)
@@ -33,10 +47,8 @@ module NwcRuby
         iv = Base64.strict_decode64(iv_b64)
         raise EncryptionError, 'invalid IV length' unless iv.bytesize == 16
 
-        key = Crypto::ECDH.shared_x(privkey_hex, pubkey_hex)
-
         cipher = OpenSSL::Cipher.new('aes-256-cbc').decrypt
-        cipher.key = key
+        cipher.key = conversation.nip04_key
         cipher.iv  = iv
         (cipher.update(ct) + cipher.final).force_encoding('UTF-8')
       rescue OpenSSL::Cipher::CipherError, ArgumentError => e

data/lib/nwc_ruby/nip44/cipher.rb

@@ -37,12 +37,19 @@ module NwcRuby
       # @param nonce [String, nil] optional 32-byte nonce (for tests); random if nil
       # @return [String] base64 payload
       def encrypt(plaintext, privkey_hex, pubkey_hex, nonce: nil)
+        encrypt_with(plaintext, Crypto::Conversation.new(privkey_hex, pubkey_hex), nonce: nonce)
+      end
+
+      # `encrypt`, reusing the conversation's cached key instead of redoing ECDH.
+      #
+      # @param conversation [Crypto::Conversation]
+      def encrypt_with(plaintext, conversation, nonce: nil)
         pt_bytes = plaintext.to_s.dup.force_encoding('UTF-8').b
         if pt_bytes.bytesize < MIN_PLAINTEXT || pt_bytes.bytesize > MAX_PLAINTEXT
           raise EncryptionError, 'plaintext length must be 1..65535 bytes'
         end
 
-        conversation_key = derive_conversation_key(privkey_hex, pubkey_hex)
+        conversation_key = conversation.nip44_key
         nonce ||= SecureRandom.bytes(32)
         raise EncryptionError, 'nonce must be 32 bytes' unless nonce.bytesize == 32
 
@@ -56,7 +63,16 @@ module NwcRuby
 
       # @param payload [String] base64 NIP-44 payload
       # @return [String] UTF-8 plaintext
-      def decrypt(payload, privkey_hex, pubkey_hex) # rubocop:disable Metrics/AbcSize
+      def decrypt(payload, privkey_hex, pubkey_hex)
+        decrypt_with(payload, Crypto::Conversation.new(privkey_hex, pubkey_hex))
+      end
+
+      # `decrypt`, reusing the conversation's cached key instead of redoing
+      # ECDH. The payload is fully checked before the key is touched, so a
+      # malformed one is rejected without paying for ECDH.
+      #
+      # @param conversation [Crypto::Conversation]
+      def decrypt_with(payload, conversation) # rubocop:disable Metrics/AbcSize
         raise EncryptionError, 'payload is nil or empty' if payload.nil? || payload.empty?
         raise EncryptionError, "payload starts with '#' (not encrypted)" if payload.start_with?('#')
 
@@ -77,8 +93,7 @@ module NwcRuby
         mac        = raw.byteslice(raw.bytesize - 32, 32)
         ciphertext = raw.byteslice(33, raw.bytesize - 33 - 32)
 
-        conversation_key = derive_conversation_key(privkey_hex, pubkey_hex)
-        chacha_key, chacha_nonce, hmac_key = derive_message_keys(conversation_key, nonce)
+        chacha_key, chacha_nonce, hmac_key = derive_message_keys(conversation.nip44_key, nonce)
 
         expected_mac = OpenSSL::HMAC.digest('SHA256', hmac_key, nonce + ciphertext)
         raise EncryptionError, 'NIP-44 MAC verification failed' unless secure_compare(mac, expected_mac)
@@ -90,8 +105,7 @@ module NwcRuby
       # --- Internals ------------------------------------------------------
 
       def derive_conversation_key(privkey_hex, pubkey_hex)
-        shared = Crypto::ECDH.shared_x(privkey_hex, pubkey_hex)
-        hkdf_extract(SALT.b, shared)
+        Crypto::Conversation.new(privkey_hex, pubkey_hex).nip44_key
       end
 
       def derive_message_keys(conversation_key, nonce)

data/lib/nwc_ruby/nip47/notification.rb

@@ -32,12 +32,15 @@ module NwcRuby
         @type == 'payment_sent'
       end
 
-      def self.parse(event, client_privkey, wallet_pubkey)
+      # @param conversation [Crypto::Conversation, nil] cached keys for this
+      #   client/wallet pair; derived from the two keys when nil
+      def self.parse(event, client_privkey, wallet_pubkey, conversation: nil)
+        conversation ||= Crypto::Conversation.new(client_privkey, wallet_pubkey)
         plaintext = case event.kind
                     when Methods::KIND_NOTIFICATION_NIP44
-                      NIP44::Cipher.decrypt(event.content, client_privkey, wallet_pubkey)
+                      NIP44::Cipher.decrypt_with(event.content, conversation)
                     when Methods::KIND_NOTIFICATION_NIP04
-                      NIP04::Cipher.decrypt(event.content, client_privkey, wallet_pubkey)
+                      NIP04::Cipher.decrypt_with(event.content, conversation)
                     else
                       raise ArgumentError, "not a notification kind: #{event.kind}"
                     end

data/lib/nwc_ruby/nip47/request.rb

@@ -13,12 +13,16 @@ module NwcRuby
       # @param wallet_pubkey [String] hex
       # @param encryption [Symbol] :nip44_v2 or :nip04
       # @param expiration [Integer, nil] optional unix timestamp
+      # @param conversation [Crypto::Conversation, nil] cached keys for this
+      #   client/wallet pair; derived from the two keys above when nil
       # @return [Event]
-      def build(method:, params:, client_privkey:, wallet_pubkey:, encryption: :nip44_v2, expiration: nil)
+      def build(method:, params:, client_privkey:, wallet_pubkey:, encryption: :nip44_v2, expiration: nil,
+                conversation: nil)
+        conversation ||= Crypto::Conversation.new(client_privkey, wallet_pubkey)
         payload = JSON.generate({ 'method' => method, 'params' => params })
         ciphertext = case encryption
-                     when :nip44_v2 then NIP44::Cipher.encrypt(payload, client_privkey, wallet_pubkey)
-                     when :nip04    then NIP04::Cipher.encrypt(payload, client_privkey, wallet_pubkey)
+                     when :nip44_v2 then NIP44::Cipher.encrypt_with(payload, conversation)
+                     when :nip04    then NIP04::Cipher.encrypt_with(payload, conversation)
                      else raise ArgumentError, "unknown encryption: #{encryption}"
                      end
 

data/lib/nwc_ruby/nip47/response.rb

@@ -29,13 +29,16 @@ module NwcRuby
       # @param event [Event] the kind 23195 event (already signature-verified)
       # @param client_privkey [String] hex
       # @param wallet_pubkey [String] hex
+      # @param conversation [Crypto::Conversation, nil] cached keys for this
+      #   client/wallet pair; derived from the two keys above when nil
       # @return [Response]
-      def self.parse(event, client_privkey, wallet_pubkey)
+      def self.parse(event, client_privkey, wallet_pubkey, conversation: nil)
         # Tags: ["p", client_pubkey], ["e", request_event_id]
         e_tag = event.tags.find { |t| t[0] == 'e' }
         request_id = e_tag && e_tag[1]
 
-        plaintext = decrypt(event.content, client_privkey, wallet_pubkey)
+        conversation ||= Crypto::Conversation.new(client_privkey, wallet_pubkey)
+        plaintext = decrypt_with(event.content, conversation)
         data = JSON.parse(plaintext)
 
         new(
@@ -47,11 +50,17 @@ module NwcRuby
         )
       end
 
-      # Try NIP-44 v2 first; fall back to NIP-04 if the version byte is wrong.
       def self.decrypt(content, client_privkey, wallet_pubkey)
-        NIP44::Cipher.decrypt(content, client_privkey, wallet_pubkey)
+        decrypt_with(content, Crypto::Conversation.new(client_privkey, wallet_pubkey))
+      end
+
+      # Try NIP-44 v2 first; fall back to NIP-04 if the version byte is wrong.
+      # Both attempts share the conversation, so the fallback reuses any ECDH
+      # the NIP-44 attempt already ran.
+      def self.decrypt_with(content, conversation)
+        NIP44::Cipher.decrypt_with(content, conversation)
       rescue EncryptionError
-        NIP04::Cipher.decrypt(content, client_privkey, wallet_pubkey)
+        NIP04::Cipher.decrypt_with(content, conversation)
       end
     end
   end

data/lib/nwc_ruby/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module NwcRuby
-  VERSION = '0.3.1'
+  VERSION = '0.5.0'
 end

data/lib/nwc_ruby.rb

@@ -12,6 +12,7 @@ require_relative 'nwc_ruby/errors'
 require_relative 'nwc_ruby/crypto/keys'
 require_relative 'nwc_ruby/crypto/schnorr'
 require_relative 'nwc_ruby/crypto/ecdh'
+require_relative 'nwc_ruby/crypto/conversation'
 require_relative 'nwc_ruby/nip04/cipher'
 require_relative 'nwc_ruby/nip44/cipher'
 require_relative 'nwc_ruby/event'

data/nwc-ruby.gemspec

@@ -41,7 +41,6 @@ Gem::Specification.new do |spec|
   spec.add_dependency 'async-http', '~> 0.70'
   spec.add_dependency 'async-websocket', '~> 0.26'
   spec.add_dependency 'base64', '~> 0.2'
-  spec.add_dependency 'ecdsa', '~> 1.2'
   spec.add_dependency 'logger', '~> 1.6'
   spec.add_dependency 'rbsecp256k1', '~> 6.0'
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: nwc-ruby
 version: !ruby/object:Gem::Version
-  version: 0.3.1
+  version: 0.5.0
 platform: ruby
 authors:
 - MegalithicBTC
@@ -65,20 +65,6 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '0.2'
-- !ruby/object:Gem::Dependency
-  name: ecdsa
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.2'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.2'
 - !ruby/object:Gem::Dependency
   name: logger
   requirement: !ruby/object:Gem::Requirement
@@ -183,6 +169,7 @@ files:
 - lib/nwc_ruby.rb
 - lib/nwc_ruby/client.rb
 - lib/nwc_ruby/connection_string.rb
+- lib/nwc_ruby/crypto/conversation.rb
 - lib/nwc_ruby/crypto/ecdh.rb
 - lib/nwc_ruby/crypto/keys.rb
 - lib/nwc_ruby/crypto/schnorr.rb
@@ -222,7 +209,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.8
+rubygems_version: 4.0.23
 specification_version: 4
 summary: Ruby client for Nostr Wallet Connect (NIP-47) with safe long-running relay
   connections.