noone.

Censorship-resistant, end-to-end encrypted voice, video, and messaging over Nostr.

100% open source. Zero server-side trust. Every line of code is auditable.

overview cryptography protocol apps SDK threat model source code

Architecture

Key invariants

All cryptographic operations happen inside the WASM module. Private keys never cross the WASM/JS boundary in plaintext.
Every Nostr event uses a fresh ephemeral keypair as the outer pubkey (NIP-59 gift wrap). Relay operators cannot determine sender or recipient.
Device trust is a local certificate chain verified entirely on-device. No server, CA, or PKI.
The SPA is a single static build. Zero backend required.
Lite mode (no WASM) uses @noble/curves for pure-JS crypto with the same protocol.

Codebase Structure

Path	Purpose	Lines
`crates/nostrcomm-crypto/src/lib.rs`	WASM entry -- 20+ exported functions	~500
`crates/nostrcomm-crypto/src/identity.rs`	Key derivation (PBKDF2+HKDF), device certificates	~500
`crates/nostrcomm-crypto/src/envelope.rs`	NIP-59 sealed sender (X25519 + ML-KEM-768 hybrid)	~300
`crates/nostrcomm-crypto/src/ratchet.rs`	Signal Double Ratchet	~350
`crates/nostrcomm-crypto/src/pairing.rs`	Emoji pairing codes (45-emoji alphabet)	~200
`web/src/main.js`	App shell, screen routing, inbox handler, group chat	~2500
`web/src/vault.js`	IndexedDB encrypted storage (AES-GCM)	~400
`web/src/relay.js`	Multi-relay Nostr pub/sub manager	~170
`web/src/call.js`	WebRTC call manager (1:1 voice/video)	~310
`web/src/group-call.js`	Mesh P2P group voice calls	~220
`web/src/group-crypto.js`	Group E2E encryption (AES-GCM session keys)	~95
`web/src/p2p.js`	WebRTC DataChannel for direct P2P messaging	~420
`web/src/radio.js`	Ultra-low-bandwidth voice (8-12 kbps Opus)	~300
`web/src/apps/sdk.js`	Apps SDK v2 (sandbox interface for apps)	~160
`web/src/apps/chess.js`	Chess game (full rules + spectator mode)	~660
`web/src/apps/sketch.js`	Real-time collaborative whiteboard	~390
`web/src/apps/location.js`	GPS sharing over OSM tiles	~550

How Messages Work

1:1 Message Flow

P2P DataChannel (when both online)

Identity & Key Management

Key Derivation

Device Certificates

CBOR-encoded, Ed25519-signed certificates with:

device_pk -- Ed25519 verifying key (32 bytes)
nostr_pk -- secp256k1 BIP-340 x-only pubkey (32 bytes)
encryption_pk -- X25519 public key (32 bytes)
kem_pk -- ML-KEM-768 encapsulation key (1184 bytes)
tier -- 0=self-signed, 1=direct contact, 2=friend-of-friend
capabilities -- { text, voice, video, file }
issued_at, expires_at -- Unix timestamps

Identity Merging

A person may use multiple devices (phone, laptop, tablet), each with different keys. The "merge" feature links multiple nostrPkHex values to one display name. When you send a message to a merged contact, it's encrypted and delivered to all their devices independently.

Emoji Pairing

45-emoji alphabet, visually distinct and cross-platform consistent:

🌙 ⚡ 🐬 🍀 🦋 🌊 🔥 🌸 ⭐ 🦁 🐉 🎈 🍎 🌈 🦅 🏔 🌺 🐢 🎵 🦊 🍄 🌻 🐋 🎯 🔮 🌴 🐝 🏪 🦩 🌮 🐠 🌿 🎭 🦄 🌝 🍋 🐧 🎸 🍇 🐺 🌾 🎨 🦜 🐙 🧊

6 emoji = 45⁶ = ~8.3 billion combinations. One-time use, 24h expiry.

Nostr Event Kinds

Kind	Purpose	Encrypted
14	Direct message (inner event)	Inside NIP-59
1059	Gift wrap (NIP-59 outer envelope)	Outer layer
10050	Pairing offer	Signed, public
14100	Group message (inner, with session key)	Inside NIP-59
25000	WebRTC signal (SDP/ICE)	Inside NIP-59
25001	Certificate chain	Inside NIP-59
25002	P2P DataChannel signal	Inside NIP-59
25003	Radio voice signal	Inside NIP-59
25100	Group call signal	Inside NIP-59

Local Storage

All data encrypted with AES-256-GCM using the vault key derived from identity.

IDB Store	Key	Contains
identity	'self' / 'all'	Device identity (public keys, salt, label)
contacts	nostrPkHex	Encrypted contact (x25519, kem, ed25519 keys, label, tier)
sessions	peerNostrPkHex	Double Ratchet state per peer
messages	id	Encrypted messages (indexed by peer and time)
groups	groupId	Group metadata (name, members, keys)
merged_contacts	mergedId	Identity merge records (displayName, deviceKeys)

Cryptographic Primitives

Primitive	Library	Use
secp256k1 (Schnorr BIP-340)	k256 / libsecp256k1	Nostr event signing
X25519	x25519-dalek	ECDH key agreement
Ed25519	ed25519-dalek	Device certificate signatures
ML-KEM-768	ml-kem	Post-quantum key encapsulation
ChaCha20-Poly1305	chacha20poly1305	AEAD encryption (messages, ratchet)
AES-256-GCM	Web Crypto API	Local vault encryption, group session keys
SHA-256	sha2	Hashing, event IDs
HKDF-SHA256	hkdf	Key derivation from shared secrets
PBKDF2-SHA256	pbkdf2	PIN stretching (600,000 rounds)
Argon2	argon2	Password hashing (planned)

WebRTC

1:1 Calls

STUN: stun:stun.l.google.com:19302
Adaptive bitrate: HD (1280x720) to SD (640x480) to Low (150 kbps) based on RTT and packet loss
Codec preference: Opus audio, VP8/AV1 video
All signaling (SDP, ICE) sealed with NIP-59

Group Calls

Full mesh topology: each pair has a separate RTCPeerConnection
Audio mixing via AudioContext -- each remote stream connected to shared destination
Max ~6 participants (mesh bandwidth limit)
Signaling: kind 25100 sealed events, one per peer pair

Radio Mode

Ultra-low bandwidth: Opus mono 8-12 kbps
Voice Activity Detection (VAD) + push-to-talk
Works on 2G/3G connections

Two Client Modes

Feature	WASM (index.html)	Lite (lite.html)
Crypto engine	Rust/WASM	@noble/curves (JS)
ML-KEM-768	Yes	No
Interoperable	Yes -- hybrid encryption falls back to classical when KEM key absent
Bundle size	~550 KB WASM + ~100 KB JS	~128 KB JS
Works offline	Yes -- Service Worker caches all assets

Relay Privacy Guarantees

What	Relay sees	Why
Message plaintext	Nothing	ChaCha20-Poly1305 AEAD
Real sender pubkey	Nothing	NIP-59: fresh ephemeral key per message
Real recipient pubkey	Nothing	Recipient address inside encrypted envelope
Social graph	Nothing	No persistent keys in outer events
Call initiation	Nothing	SDP offers are sealed events, identical to messages
Message timing	Approximate	Timestamps randomized +/- 5 minutes
Number of messages	Yes	Cannot be hidden without mix network

Transparency commitment: Every cryptographic operation is implemented in open-source Rust (auditable WASM) or open-source JavaScript. No obfuscation, no telemetry, no analytics, no server-side processing. The complete source code is available for audit.

Test Coverage

76 unit tests (Vitest) -- crypto, vault, relay, pairing
49 E2E tests (Playwright) -- enrollment, pairing, messaging, calls, cross-client interop, group chat
Client combinations tested: WASM-WASM, WASM-Lite, Lite-Lite, 4-person groups
Tests run against production (noone.chat) with real relays and real WebRTC

MIT License. Built for privacy.