AI
Nostr Puts All Security Responsibility on the Client
Nostr has over 1.1 million user accounts and no central server. Users hold public/private key pairs as their identity; relays store and forward events without owning them. That design removes censorship risk but moves all trust to the client. If a client skips signature verification, nothing else catches the error.
“There are over 1.1 million user account” — Hayato Kimura
The Nostr spec does not require relays to verify signatures. Some do, but only to filter spam. Kimura’s team at NICT targeted the common case: relays that pass events through unverified. That is not a contrived test setup. It matches the spec.
Seven Vulnerabilities, Eight Attacks, Three Proof-of-Concept Demos
Kimura’s team analyzed 56 Nostr specs and 9 clients, open-source and proprietary. They found 7 vulnerabilities and built 8 attacks, then ran three PoC videos live. The event forgery PoC demo (05:56) shows a forged post on a victim’s screen with no signature. The encrypted DM hijack demo (06:35) leaks a secret token via link preview. The Bitcoin address hijack demo (07:29) redirects a payment from the victim’s wallet to the attacker’s. Two years of coordinated disclosure with developers preceded the presentation.
Signature Verification Is Skipped or Bypassable
Many Nostr clients, including mobile apps, skip signature verification entirely.
“the signature. That’s serious wrong.” — Hayato Kimura
Damus, a popular iOS client, does include verification logic, but a cache check runs first. If an event ID is already cached, the client returns the cached result without re-checking. An attacker who injects a fake event with the same ID as a verified event poisons that cache entry, swapping in content like a different Bitcoin address. The client treats it as verified. Bypassing the crypto requires no cryptographic attack. Recalculating an event ID is one hash.
CBC Bit-Flipping Lets Attackers Modify Encrypted Messages Without the Key
NIP-04 uses ECDH for key agreement and AES-CBC for encryption. CBC has no integrity protection. An attacker who intercepts ciphertext can flip bits in the IV to alter specific decrypted bytes without the key. Random flipping yields unpredictable output, but a known plaintext/ciphertext pair lets the attacker compute the exact XOR delta needed.
Kimura’s team sourced that pair from Nostr’s delegation protocol, which shares the same key structure. With it, they redirected a Bitcoin address inside an encrypted message to their own wallet without touching the cipher.
Link Preview Oracles Leak Plaintext From Encrypted DMs
Nostr clients that generate link previews on the receiver side fetch any URL in a decrypted message. An attacker uses CBC bit-flipping to change the URL’s domain to an attacker-controlled host. The victim’s client decrypts, fires a preview fetch, and the secret token in the URL path arrives at the attacker’s server.
To recover text outside the URL, the attacker flips bits until the decrypted bytes start with “http” and watches for a preview request. One byte at a time, full message plaintext leaks with no key.
Decentralized Systems Cannot Patch Fast Enough to Fix Design Mistakes
In a centralized system, a broken crypto check gets patched once. In Nostr, dozens of independently developed clients each need their own fix.
“The problems are not just an coding mistakes.” — Hayato Kimura
Kimura’s fixes require spec changes: mandate how to verify signatures, not just that events must be signed; require separate keys for messaging and delegation; replace AES-CBC in direct messages with authenticated encryption. Two years of working with developers showed how long coordinated patching takes when server operators and client communities are all independent.
Notable Quotes
There are over 1.1 million user account Hayato Kimura · ▶ 3:03
the signature. That’s serious wrong. Hayato Kimura · ▶ 13:10
The problems are not just an coding mistakes. Hayato Kimura · ▶ 27:57
Key Takeaways
- Nostr’s spec does not require servers to verify signatures, so clients must do it, and many don’t.
- NIP-04 uses unauthenticated CBC encryption; bit-flipping lets attackers redirect Bitcoin payments without the key.
- Client-side link previews turn ciphertext malleability into byte-by-byte plaintext recovery.