nwc-ruby 0.4.0 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: eb3477afba784c35d4e2db68ea408f30efec1330516c24f368471b123dcc7ddc
-  data.tar.gz: aabf55cb7cbeb1263945e457aab8f2908f39e560f0297d7406adc31ba7e56a73
+  metadata.gz: e2d94a88c6465f4422539d861f346b8d7ab7726d2805be0c4b9d0705b6dd9399
+  data.tar.gz: ae16489410ce6cb3663a93c3aa5e20b84ff9c920294cebb5ab690a00f12da1f0
 SHA512:
-  metadata.gz: 9c52a015142aec41f912b9f3881f56e5ce8289be0106f000be2786677320426e250ac73b70a9905c691e082ac293286caf169aac453af92886380053b7e34461
-  data.tar.gz: 73035a32f7fe34602f527f44941703ebecf7c505319f5e4899e8a6168350b2ae5d108f3be1e8c661d2854b05c087e752f44d6960a9f401ac880be0776d6a6166
+  metadata.gz: d91f00c5dc93b17b8c6eb9cbcdc0e3a31175fcd1b0ddcb843bd3fd3a58948cdbe1844a5f0dcf3e363915eb6339071b9f3691c564f66362eb96f3431dea1b3db3
+  data.tar.gz: 3169a1dd02f32a5bbefd6c03b037e35acbd3773922d88c145fad408b8fc18d4bd5a1b4c26e5aed34909a036750c81f64db4264e38cfca5367516796ee0b23a65

data/CHANGELOG.md

@@ -7,6 +7,46 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.5.0] — 2026-11-08
+
+### Changed
+
+- **ECDH is native, about 58x faster.** NIP-04 and NIP-44 v2 derive their
+  keys from an ECDH that this gem computed as pure-Ruby scalar multiplication
+  with the `ecdsa` gem. It now runs in OpenSSL through Ruby's built-in
+  `openssl` library: 34.3 ms → 0.60 ms per ECDH on an Apple-silicon laptop
+  (Docker, aarch64 Linux, Ruby 3.4.9, OpenSSL 3.5.6). A `Client` built per
+  request gains the most; a reused `Client` has run ECDH once per connection
+  since 0.4.0. The output is byte-for-byte unchanged: checked against the
+  0.4.0 code on 6,171 key pairs (including private keys and shared X values
+  with leading zero bytes) and against paulmillr's NIP-44 vectors. OpenSSL
+  also multiplies secret scalars with a constant-time ladder, which the
+  `ecdsa` gem did not.
+
+### Removed
+
+- The `ecdsa` runtime dependency, along with `NwcRuby::Crypto::ECDH.lift_x`
+  and `ECDH::GROUP`. OpenSSL now decodes the peer's even-Y point from
+  `02 || x`.
+
+### Added
+
+- `NwcRuby::CryptoUnavailableError`, raised when this Ruby's OpenSSL cannot
+  do secp256k1 ECDH, e.g. in FIPS mode. It is deliberately not an
+  `EncryptionError`, which the notification listener treats as one bad
+  message and skips. `NwcRuby::Crypto::ECDH.available?` checks ahead of time.
+- Specs: paulmillr's full `nip44.vectors.json`, pinned to the SHA-256 that
+  NIP-44 publishes (all 35 valid and 8 invalid `get_conversation_key`
+  vectors, all 10 `encrypt_decrypt` vectors), and ECDH specs checked against
+  libsecp256k1's point multiplication.
+
+### Fixed
+
+- `ECDH.shared_x` rejects an out-of-range private key with `EncryptionError`
+  ("private key out of range"). Before, 0 or n raised a bare `ArgumentError`
+  and a key above n was silently reduced mod n. Off-curve and out-of-range
+  public keys raise the same `EncryptionError` messages as before.
+
 ## [0.4.0] — 2026-10-20
 
 ### Changed

data/README.md

@@ -166,6 +166,15 @@ If you see `LoadError: cannot load such file -- secp256k1` at runtime, the
 native extension wasn't compiled. Install the build dependencies above and
 run `gem pristine rbsecp256k1` (or re-run `bundle install`) to rebuild it.
 
+NIP-04 and NIP-44 encryption run their ECDH through Ruby's built-in `openssl`,
+which needs an OpenSSL that allows secp256k1. Standard builds do. OpenSSL in
+FIPS mode does not, and then every encrypt and decrypt raises
+`NwcRuby::CryptoUnavailableError`. To check at boot:
+
+```ruby
+NwcRuby::Crypto::ECDH.available? # => true
+```
+
 ---
 
 ## Usage
@@ -529,9 +538,9 @@ connection string, with 0.25 s / 1 s backoff, inside `request_timeout`.
 Nothing is ever retried after the request is written.
 
 Build one `Client` per connection string and reuse it. It caches the wallet's
-info event and the connection's encryption key, so only its first call pays
-for the ECDH (tens of milliseconds in pure Ruby); a `Client` built per request
-pays it on every call.
+info event (a relay round trip) and the connection's encryption key (an ECDH,
+under a millisecond), so only its first call pays for them; a `Client` built
+per request pays for both on every call.
 
 Introspection:
 
@@ -582,6 +591,9 @@ the original is kept as `#cause`.
 
 - `InvalidConnectionStringError` — the URI couldn't be parsed.
 - `EncryptionError` — bad MAC / bad padding / unknown version byte / bad key.
+- `CryptoUnavailableError` — this Ruby's OpenSSL can't do secp256k1 ECDH
+  (FIPS mode, or a build without the curve), so nothing can be encrypted or
+  decrypted. Retrying won't help.
 - `InvalidSignatureError` — an event's signature did not verify.
 - `TransportError` — the connection failed **after** the request was written
   to the relay. The wallet may have acted on it: reconcile with

data/lib/nwc_ruby/crypto/conversation.rb

@@ -4,11 +4,11 @@ module NwcRuby
   module Crypto
     # The symmetric keys for one (our private key, their public key) pair.
     #
-    # NIP-04 and NIP-44 v2 both start from the same ECDH, which is the slow
-    # step here (pure-Ruby scalar multiplication, tens of milliseconds) and
-    # depends only on the two keys. This object runs it once, on first use,
-    # and keeps the result. Per-message randomness is unaffected: NIP-44 still
-    # draws a fresh nonce and NIP-04 a fresh IV on every encrypt.
+    # NIP-04 and NIP-44 v2 both start from the same ECDH, the costliest step
+    # here (a scalar multiplication) and one that depends only on the two
+    # keys. This object runs it once, on first use, and keeps the result.
+    # Per-message randomness is unaffected: NIP-44 still draws a fresh nonce
+    # and NIP-04 a fresh IV on every encrypt.
     #
     # Nothing is computed in `initialize`, so a bad key raises at first use,
     # exactly where the uncached path raises it, and a failure is not cached.

data/lib/nwc_ruby/crypto/ecdh.rb

@@ -1,7 +1,6 @@
 # frozen_string_literal: true
 
-require 'rbsecp256k1'
-require 'ecdsa'
+require 'openssl'
 
 module NwcRuby
   module Crypto
@@ -9,45 +8,119 @@ module NwcRuby
     # their x-only public key.
     #
     # CRITICAL: Nostr ECDH returns the **X coordinate of the shared point only**
-    # (32 bytes). This differs from libsecp256k1's default `ecdh()` function,
-    # which returns SHA256(compressed_point). We have to do the multiplication
-    # ourselves using the `ecdsa` gem.
+    # (32 bytes). libsecp256k1's `ecdh()` returns SHA256(compressed_point)
+    # instead, and rbsecp256k1 hard-codes that hash, so it can't be used here.
+    # OpenSSL's ECDH returns the raw X coordinate, left-padded to 32 bytes.
     #
     # This is used by both NIP-04 (as the AES key directly) and NIP-44 v2 (as
     # the IKM for HKDF).
     module ECDH
       module_function
 
-      GROUP = ::ECDSA::Group::Secp256k1
+      # secp256k1 field prime and group order (SEC 2, section 2.4.1).
+      P = 0xFFFFFFFF_FFFFFFFF_FFFFFFFF_FFFFFFFF_FFFFFFFF_FFFFFFFF_FFFFFFFE_FFFFFC2F
+      N = 0xFFFFFFFF_FFFFFFFF_FFFFFFFF_FFFFFFFE_BAAEDCE6_AF48A03B_BFD25E8C_D0364141
+
+      # Numeric OIDs, so nothing depends on OpenSSL's curve-name table.
+      SECP256K1_OID = '1.3.132.0.10'
+      EC_PUBLIC_KEY_OID = '1.2.840.10045.2.1'
+
+      # X coordinate of the generator G, for the self-test in `available?`.
+      GX_HEX = '79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798'
 
       # Returns the raw 32-byte X coordinate of the shared point.
       #
       # @param privkey_hex [String] our 32-byte private key (hex)
       # @param xonly_pubkey_hex [String] their 32-byte x-only public key (hex)
       # @return [String] 32 raw bytes (binary-encoded)
+      # @raise [EncryptionError] if either key is out of range or the public
+      #   key is not on the curve
+      # @raise [CryptoUnavailableError] if this OpenSSL lacks secp256k1
       def shared_x(privkey_hex, xonly_pubkey_hex)
         Keys.validate_hex32!(privkey_hex, 'private key')
         Keys.validate_hex32!(xonly_pubkey_hex, 'public key')
 
-        # BIP-340 x-only pubkeys always correspond to the even-Y lifted point.
-        pubkey_point = lift_x(Keys.hex_to_bytes(xonly_pubkey_hex).unpack1('H*').to_i(16))
-        priv_int     = privkey_hex.to_i(16)
+        d = privkey_hex.to_i(16)
+        raise EncryptionError, 'private key out of range' if d.zero? || d >= N
 
-        shared_point = pubkey_point.multiply_by_scalar(priv_int)
-        [shared_point.x.to_s(16).rjust(64, '0')].pack('H*')
+        x = xonly_pubkey_hex.to_i(16)
+        raise EncryptionError, 'x out of range' if x.zero? || x >= P
+
+        ensure_available!
+        derive(Keys.hex_to_bytes(privkey_hex), Keys.hex_to_bytes(xonly_pubkey_hex))
       end
 
-      # BIP-340 "lift_x": given an x coordinate, return the point with even Y.
-      def lift_x(x)
-        raise EncryptionError, 'x out of range' if x.zero? || x >= GROUP.field.prime
+      # Whether this Ruby's OpenSSL can do secp256k1 ECDH. Some builds leave
+      # the curve out, and FIPS mode refuses it. Under RHEL 9's FIPS provider
+      # the curve's group still loads and only the key operations fail, so
+      # this runs a real ECDH with a known answer (1 * G has X coordinate GX)
+      # instead of looking the curve up. Checked once per process.
+      def available?
+        return @available unless @available.nil?
 
-        p   = GROUP.field.prime
-        c   = (x.pow(3, p) + 7) % p
-        y   = c.pow((p + 1) / 4, p)
-        raise EncryptionError, 'x is not on the curve' unless y.pow(2, p) == c
+        gx = Keys.hex_to_bytes(GX_HEX)
+        @available = begin
+          derive(Keys.hex_to_bytes("#{'0' * 63}1"), gx) == gx
+        rescue EncryptionError
+          false
+        end
+      end
+
+      def ensure_available!
+        return if available?
+
+        reason = if ::OpenSSL.fips_mode
+                   'OpenSSL is in FIPS mode, which does not allow it'
+                 else
+                   'this OpenSSL build lacks it'
+                 end
+        raise CryptoUnavailableError,
+              "secp256k1 ECDH is unavailable in #{::OpenSSL::OPENSSL_LIBRARY_VERSION} (#{reason}); " \
+              'NIP-04 and NIP-44 encryption both need it'
+      end
+
+      # ECDH on validated, in-range inputs. The peer is the even-Y point with
+      # X coordinate `x_bytes` (BIP-340 lift_x), encoded as "02" || x.
+      def derive(d_bytes, x_bytes)
+        theirs = begin
+          ::OpenSSL::PKey.read(public_key_der(x_bytes))
+        rescue ::OpenSSL::OpenSSLError
+          raise EncryptionError, 'x is not on the curve'
+        end
+
+        begin
+          secret = ::OpenSSL::PKey.read(private_key_der(d_bytes)).derive(theirs)
+        rescue ::OpenSSL::OpenSSLError => e
+          raise EncryptionError, "ECDH failed: #{e.message}"
+        end
+        raise EncryptionError, "ECDH returned #{secret.bytesize} bytes, expected 32" unless secret.bytesize == 32
+
+        secret
+      end
+
+      # SubjectPublicKeyInfo (RFC 5480) for the compressed point "02" || x.
+      def public_key_der(x_bytes)
+        ::OpenSSL::ASN1::Sequence.new(
+          [
+            ::OpenSSL::ASN1::Sequence.new(
+              [::OpenSSL::ASN1::ObjectId.new(EC_PUBLIC_KEY_OID), ::OpenSSL::ASN1::ObjectId.new(SECP256K1_OID)]
+            ),
+            ::OpenSSL::ASN1::BitString.new("\x02".b + x_bytes)
+          ]
+        ).to_der
+      end
 
-        y = p - y if y.odd?
-        GROUP.new_point([x, y])
+      # ECPrivateKey (RFC 5915) holding exactly 32 bytes of scalar, leading
+      # zeros included. The optional publicKey field is left out; OpenSSL
+      # derives it from the scalar.
+      def private_key_der(d_bytes)
+        ::OpenSSL::ASN1::Sequence.new(
+          [
+            ::OpenSSL::ASN1::Integer.new(1),
+            ::OpenSSL::ASN1::OctetString.new(d_bytes),
+            ::OpenSSL::ASN1::ObjectId.new(SECP256K1_OID, 0, :EXPLICIT)
+          ]
+        ).to_der
       end
     end
   end

data/lib/nwc_ruby/errors.rb

@@ -11,9 +11,17 @@ module NwcRuby
   # The connection string is missing or malformed.
   class InvalidConnectionStringError < Error; end
 
-  # Encryption / decryption failed (bad MAC, bad padding, unknown version byte).
+  # Encryption / decryption failed (bad MAC, bad padding, unknown version
+  # byte, or a key that is out of range or not on the curve).
   class EncryptionError < Error; end
 
+  # This Ruby's OpenSSL cannot do secp256k1 ECDH, which NIP-04 and NIP-44
+  # both need: FIPS mode refuses the curve, and some builds leave it out.
+  # Unlike `EncryptionError` this is not about one message: nothing can be
+  # encrypted or decrypted in this process. `Crypto::ECDH.available?` checks
+  # ahead of time.
+  class CryptoUnavailableError < Error; end
+
   # Signature verification failed on an inbound event.
   class InvalidSignatureError < Error; end
 

data/lib/nwc_ruby/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module NwcRuby
-  VERSION = '0.4.0'
+  VERSION = '0.5.0'
 end

data/nwc-ruby.gemspec

@@ -41,7 +41,6 @@ Gem::Specification.new do |spec|
   spec.add_dependency 'async-http', '~> 0.70'
   spec.add_dependency 'async-websocket', '~> 0.26'
   spec.add_dependency 'base64', '~> 0.2'
-  spec.add_dependency 'ecdsa', '~> 1.2'
   spec.add_dependency 'logger', '~> 1.6'
   spec.add_dependency 'rbsecp256k1', '~> 6.0'
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: nwc-ruby
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.5.0
 platform: ruby
 authors:
 - MegalithicBTC
@@ -65,20 +65,6 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '0.2'
-- !ruby/object:Gem::Dependency
-  name: ecdsa
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.2'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.2'
 - !ruby/object:Gem::Dependency
   name: logger
   requirement: !ruby/object:Gem::Requirement
@@ -223,7 +209,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 4.0.23
 specification_version: 4
 summary: Ruby client for Nostr Wallet Connect (NIP-47) with safe long-running relay
   connections.