mirror of
https://github.com/permissionlesstech/bitchat.git
synced 2026-07-25 00:25:19 +00:00
jackandClaude Fable 5
7200b3de2a
The bespoke "v2" DM envelope (XChaCha20-Poly1305 over the raw UTF-8 rumor JSON) leaks exact plaintext length to relays. Add NIP-44 v2 style payload framing: a 2-byte big-endian length prefix followed by zero padding to NIP-44's calc_padded_len buckets (32-byte minimum, power-of-two-derived chunks), carried in a new "v3:" envelope that reuses the existing key derivation and AEAD. Compatibility: deployed clients hard-reject any envelope that does not start with "v2:", and the v2 payload is raw JSON, so padded payloads cannot be introduced inside v2 either. This lands phase 1 of a two-phase rollout: decrypt accepts both v2 (unpadded) and v3 (padded), while encrypt keeps emitting v2, gated by NostrProtocol.sendPaddedEnvelope (defaults to false with the rollout plan documented inline). Flip the flag once v3-capable clients are widely deployed. Unpad validates that the claimed length's bucket exactly matches the authenticated payload size, so a tampered or malformed length prefix fails closed. Tests cover pad/unpad round-trips, the NIP-44 bucket vectors, v3 round-trip, legacy v2 decrypt, default-envelope pinning, and tampered length prefixes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>