Not in The Prophecies: Practical Attacks on Nostr

Hayato Kimura; Ryoma Ito; Kazuhiko Minematsu; Shogo Shiraki; Takanori Isobe

Paper 2025/1459

Not in The Prophecies: Practical Attacks on Nostr

Hayato Kimura

, National Institute of Information and Communications Technology, The University of Osaka

Ryoma Ito

, National Institute of Information and Communications Technology

Kazuhiko Minematsu

, NEC

Shogo Shiraki

, University of Hyogo

Takanori Isobe, The University of Osaka

Abstract

Distributed social networking services (SNSs) recently received significant attention as an alternative to traditional, centralized SNSs, which have inherent limitations on user privacy and freedom. We provide the first in-depth security analysis of Nostr, an open-source, distributed SNS protocol developed in 2019 with more than 1.1 million registered users. We investigate the specification of Nostr and the client implementations and present a number of practical attacks allowing forgeries on various objects, such as encrypted direct messages (DMs), by a malicious user or a malicious server. Even more, we show a confidentiality attack against encrypted DMs by a malicious user exploiting a flaw in the link preview mechanism and the CBC malleability. Our attacks are due to cryptographic flaws in the protocol specification and client implementation, some of which in combination elevate the forgery attack to a violation of confidentiality. We verify the practicality of our attacks via Proof-of-Concept implementations and discuss how to mitigate them.

Note: Website : https://crypto-sec-n.github.io/

Metadata

Available format(s): PDF
Category: Attacks and cryptanalysis
Publication info: Published elsewhere. 10th IEEE European Symposium on Security and Privacy (EuroS&P 2025)
Keywords: Nostr plaintext recovery attack forgery attack key replace attack Cache‐based Forgery Attack CBC-mode
Contact author(s): hytkimura @ protonmail com
itorym @ nict go jp
k-minematsu @ nec com
4w3tag185mpja @ gmail com
takanori isobe @ ist osaka-u ac jp
History: 2025-08-13: approved; 2025-08-12: received; See all versions
Short URL: https://ia.cr/2025/1459
License: CC BY

BibTeX

@misc{cryptoeprint:2025/1459,
      author = {Hayato Kimura and Ryoma Ito and Kazuhiko Minematsu and Shogo Shiraki and Takanori Isobe},
      title = {Not in The Prophecies: Practical Attacks on Nostr},
      howpublished = {Cryptology {ePrint} Archive, Paper 2025/1459},
      year = {2025},
      url = {https://eprint.iacr.org/2025/1459}
}